commit 8bb7eca972ad531c9b149c0a51ab43a417385813 Author: Linus Torvalds Date: Sun Oct 31 13:53:10 2021 -0700 Linux 5.15 commit 75fcbd38608c3ce9f4dc784f2ac8916add64c9a8 Merge: ca5e83eddc8bc 27730c8cd60d1 Author: Linus Torvalds Date: Sun Oct 31 11:24:06 2021 -0700 Merge tag 'perf-tools-fixes-for-v5.15-2021-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix compilation of callchain related code on powerpc with gcc11+ - Fix PERF_SAMPLE_WEIGHT_STRUCT support in 'perf script' - Check session->header.env.arch before using it, fixing a segmentation fault - Suppress 'rm dlfilter' build messages * tag 'perf-tools-fixes-for-v5.15-2021-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf script: Fix PERF_SAMPLE_WEIGHT_STRUCT support perf callchain: Fix compilation on powerpc with gcc11+ perf script: Check session->header.env.arch before using it perf build: Suppress 'rm dlfilter' build message commit ca5e83eddc8bc85db5698ef702b610ee64243459 Merge: 180eca540ae06 f3d1436d4bf8c Author: Linus Torvalds Date: Sun Oct 31 11:19:02 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: - Fixes for s390 interrupt delivery - Fixes for Xen emulator bugs showing up as debug kernel WARNs - Fix another issue with SEV/ES string I/O VMGEXITs * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Take srcu lock in post_kvm_run_save() KVM: SEV-ES: fix another issue with string I/O VMGEXITs KVM: x86/xen: Fix kvm_xen_has_interrupt() sleeping in kvm_vcpu_block() KVM: x86: switch pvclock_gtod_sync_lock to a raw spinlock KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu KVM: s390: clear kicked_mask before sleeping again commit 27730c8cd60d1574d8337276e7a9d7d2ca92e0d1 Author: Kan Liang Date: Wed Sep 29 08:38:13 2021 -0700 perf script: Fix PERF_SAMPLE_WEIGHT_STRUCT support -F weight in perf script is broken. # ./perf mem record # ./perf script -F weight Samples for 'dummy:HG' event do not have WEIGHT attribute set. Cannot print 'weight' field. The sample type, PERF_SAMPLE_WEIGHT_STRUCT, is an alternative of the PERF_SAMPLE_WEIGHT sample type. They share the same space, weight. The lower 32 bits are exactly the same for both sample type. The higher 32 bits may be different for different architecture. For a new kernel on x86, the PERF_SAMPLE_WEIGHT_STRUCT is used. For an old kernel or other ARCHs, the PERF_SAMPLE_WEIGHT is used. With -F weight, current perf script will only check the input string "weight" with the PERF_SAMPLE_WEIGHT sample type. Because the commit ea8d0ed6eae3 ("perf tools: Support PERF_SAMPLE_WEIGHT_STRUCT") didn't update the PERF_SAMPLE_WEIGHT_STRUCT sample type for perf script. For a new kernel on x86, the check fails. Use PERF_SAMPLE_WEIGHT_TYPE, which supports both sample types, to replace PERF_SAMPLE_WEIGHT Fixes: ea8d0ed6eae37b01 ("perf tools: Support PERF_SAMPLE_WEIGHT_STRUCT") Reported-by: Joe Mario Reviewed-by: Kajol Jain Signed-off-by: Kan Liang Tested-by: Jiri Olsa Tested-by: Joe Mario Acked-by: Jiri Olsa Acked-by: Joe Mario Cc: Andi Kleen Link: https://lore.kernel.org/r/1632929894-102778-1-git-send-email-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 89ac61ff05a5c79545aa93f7b1da7e4dbc60fc9a Author: Jiri Olsa Date: Tue Sep 28 21:52:53 2021 +0200 perf callchain: Fix compilation on powerpc with gcc11+ Got following build fail on powerpc: CC arch/powerpc/util/skip-callchain-idx.o In function ‘check_return_reg’, inlined from ‘check_return_addr’ at arch/powerpc/util/skip-callchain-idx.c:213:7, inlined from ‘arch_skip_callchain_idx’ at arch/powerpc/util/skip-callchain-idx.c:265:7: arch/powerpc/util/skip-callchain-idx.c:54:18: error: ‘dwarf_frame_register’ accessing 96 bytes \ in a region of size 64 [-Werror=stringop-overflow=] 54 | result = dwarf_frame_register(frame, ra_regno, ops_mem, &ops, &nops); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/powerpc/util/skip-callchain-idx.c: In function ‘arch_skip_callchain_idx’: arch/powerpc/util/skip-callchain-idx.c:54:18: note: referencing argument 3 of type ‘Dwarf_Op *’ In file included from /usr/include/elfutils/libdwfl.h:32, from arch/powerpc/util/skip-callchain-idx.c:10: /usr/include/elfutils/libdw.h:1069:12: note: in a call to function ‘dwarf_frame_register’ 1069 | extern int dwarf_frame_register (Dwarf_Frame *frame, int regno, | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors The dwarf_frame_register args changed with [1], Updating ops_mem accordingly. [1] https://sourceware.org/git/?p=elfutils.git;a=commit;h=5621fe5443da23112170235dd5cac161e5c75e65 Reviewed-by: Kajol Jain Signed-off-by: Jiri Olsa Acked-by: Mark Wieelard Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sukadev Bhattiprolu Link: https://lore.kernel.org/r/20210928195253.1267023-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 29c77550eef31b0d72a45b49eeab03b8963264e8 Author: Song Liu Date: Sun Oct 3 22:32:38 2021 -0700 perf script: Check session->header.env.arch before using it When perf.data is not written cleanly, we would like to process existing data as much as possible (please see f_header.data.size == 0 condition in perf_session__read_header). However, perf.data with partial data may crash perf. Specifically, we see crash in 'perf script' for NULL session->header.env.arch. Fix this by checking session->header.env.arch before using it to determine native_arch. Also split the if condition so it is easier to read. Committer notes: If it is a pipe, we already assume is a native arch, so no need to check session->header.env.arch. Signed-off-by: Song Liu Cc: Peter Zijlstra Cc: kernel-team@fb.com Cc: stable@vger.kernel.org Link: http://lore.kernel.org/lkml/20211004053238.514936-1-songliubraving@fb.com Signed-off-by: Arnaldo Carvalho de Melo commit 095729484efc4aa4604c474792b059bd940addce Author: Adrian Hunter Date: Thu Sep 30 09:28:49 2021 +0300 perf build: Suppress 'rm dlfilter' build message The following build message: rm dlfilters/dlfilter-test-api-v0.o is unwanted. The object file is being treated as an intermediate file and being automatically removed. Mark the object file as .SECONDARY to prevent removal and hence the message. Requested-by: Arnaldo Carvalho de Melo Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20210930062849.110416-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 180eca540ae06246d594bdd8d8213426a259cc8c Merge: 3a4347d82efdf 09d9e4d041876 Author: Linus Torvalds Date: Sat Oct 30 15:56:38 2021 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three small fixes, all in drivers, and one sizeable update to the UFS driver to remove the HPB 2.0 feature that has been objected to by Jens and Christoph. Although the UFS patch is large and last minute, it's essentially the least intrusive way of resolving the objections in time for the 5.15 release" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: ufshpb: Remove HPB2.0 flows scsi: mpt3sas: Fix reference tag handling for WRITE_INSERT scsi: ufs: ufs-exynos: Correct timeout value setting registers scsi: ibmvfc: Fix up duplicate response detection commit 3a4347d82efdfcc5465b3ed37616426989182915 Merge: bf85ba018f922 675c496d0f92b Author: Linus Torvalds Date: Sat Oct 30 09:55:46 2021 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One fix for the composite clk that broke when we changed this clk type to use the determine_rate instead of round_rate clk op by default. This caused lots of problems on Rockchip SoCs because they heavily use the composite clk code to model the clk tree" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: composite: Also consider .determine_rate for rate + mux composites commit bf85ba018f9229ce54765a62dba2dea60f7cdafb Merge: 119c85055d867 54c5639d8f507 Author: Linus Torvalds Date: Sat Oct 30 09:28:24 2021 -0700 Merge tag 'riscv-for-linus-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "These are pretty late, but they do fix concrete issues. - ensure the trap vector's address is aligned. - avoid re-populating the KASAN shadow memory. - allow kasan to build without warnings, which have recently become errors" * tag 'riscv-for-linus-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix asan-stack clang build riscv: Do not re-populate shadow memory with kasan_populate_early_shadow riscv: fix misalgned trap vector base address commit 09d9e4d041876684d33f21d02bcdaea6586734f1 Author: Avri Altman Date: Sat Oct 30 09:23:01 2021 +0300 scsi: ufs: ufshpb: Remove HPB2.0 flows The Host Performance Buffer feature allows UFS read commands to carry the physical media addresses along with the LBAs, thus allowing less internal L2P-table switches in the device. HPB1.0 allowed a single LBA, while HPB2.0 increases this capacity up to 255 blocks. Carrying more than a single record, the read operation is no longer purely of type "read" but a "hybrid" command: Writing the physical address to the device in one operation and reading back the required payload in another. The JEDEC HPB spec defines two commands for this operation: HPB-WRITE-BUFFER (0x2) to write the physical addresses to device, and HPB-READ to read the payload. With the current HPB design the UFS driver has no alternative but to divide the READ request into 2 separate commands: HPB-WRITE-BUFFER and HPB-READ. This causes a great deal of aggravation to the block layer guys who demanded that we completely revert the entire HPB driver regardless of the huge amount of corporate effort already invested in it. As a compromise, remove only the pieces that implement the 2.0 specification. This is done as a matter of urgency for the final 5.15 release. Link: https://lore.kernel.org/r/20211030062301.248-1-avri.altman@wdc.com Tested-by: Avri Altman Tested-by: Bean Huo Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Co-developed-by: James Bottomley Signed-off-by: James Bottomley Signed-off-by: Avri Altman Signed-off-by: Martin K. Petersen commit 119c85055d867b9588263bca59794c872ef2a30e Merge: db2398a56aece d853adc7adf60 Author: Linus Torvalds Date: Fri Oct 29 17:35:56 2021 -0700 Merge tag 'powerpc-5.15-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Three commits fixing some issues introduced with the recent IOMMU changes we merged. Thanks to Alexey Kardashevskiy" * tag 'powerpc-5.15-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries/iommu: Create huge DMA window if no MMIO32 is present powerpc/pseries/iommu: Check if the default window in use before removing it powerpc/pseries/iommu: Use correct vfree for it_map commit db2398a56aecec058643d35828e8cca56a0ac0a3 Merge: a379fbbcb88bc c0eee6fbfa2b3 Author: Linus Torvalds Date: Fri Oct 29 17:04:38 2021 -0700 Merge tag 'gpio-fixes-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix the return value check when parsing the ngpios property in gpio-xgs-iproc - check the return value of bgpio_init() in gpio-mlxbf2 * tag 'gpio-fixes-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mlxbf2.c: Add check for bgpio_init failure gpio: xgs-iproc: fix parsing of ngpios property commit a379fbbcb88bcf43d886977c6fb91fb43f330b84 Merge: 17d50f89410c5 f4aaf1fa8b17e Author: Linus Torvalds Date: Fri Oct 29 11:10:29 2021 -0700 Merge tag 'block-5.15-2021-10-29' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request: - fix nvmet-tcp header digest verification (Amit Engel) - fix a memory leak in nvmet-tcp when releasing a queue (Maurizio Lombardi) - fix nvme-tcp H2CData PDU send accounting again (Sagi Grimberg) - fix digest pointer calculation in nvme-tcp and nvmet-tcp (Varun Prakash) - fix possible nvme-tcp req->offset corruption (Varun Prakash) - Queue drain ordering fix (Ming) - Partition check regression for zoned devices (Shin'ichiro) - Zone queue restart fix (Naohiro) * tag 'block-5.15-2021-10-29' of git://git.kernel.dk/linux-block: block: Fix partition check for host-aware zoned block devices nvmet-tcp: fix header digest verification nvmet-tcp: fix data digest pointer calculation nvme-tcp: fix data digest pointer calculation nvme-tcp: fix possible req->offset corruption block: schedule queue restart after BLK_STS_ZONE_RESOURCE block: drain queue after disk is removed from sysfs nvme-tcp: fix H2CData PDU send accounting (again) nvmet-tcp: fix a memory leak when releasing a queue commit 61a9f252c1c026f84129a7bfa476e880b75e80eb Author: Martin K. Petersen Date: Wed Oct 27 23:42:02 2021 -0400 scsi: mpt3sas: Fix reference tag handling for WRITE_INSERT Testing revealed a problem with how the reference tag was handled for a WRITE_INSERT operation. The SCSI_PROT_REF_CHECK flag is not set when the controller is asked to generate the protection information (i.e. not DIX). And as a result the initial reference tag would not be set in the WRITE_INSERT case. Separate handling of the REF_CHECK and REF_INCREMENT flags to align with both the DIX spec and the MPI implementation. Link: https://lore.kernel.org/r/20211028034202.24225-1-martin.petersen@oracle.com Fixes: b3e2c72af1d5 ("scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI") Signed-off-by: Martin K. Petersen commit 17d50f89410c5f71142657d9a012cbabcaadb134 Merge: fd919bbd334f2 90935eb303e0d Author: Linus Torvalds Date: Fri Oct 29 10:54:44 2021 -0700 Merge tag 'mmc-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - tmio: Re-enable card irqs after a reset - mtk-sd: Fixup probing of cqhci for crypto - cqhci: Fix support for suspend/resume - vub300: Fix control-message timeouts - dw_mmc-exynos: Fix support for tuning - winbond: Silences build errors on M68K - sdhci-esdhc-imx: Fix support for tuning - sdhci-pci: Read card detect from ACPI for Intel Merrifield - sdhci: Fix eMMC support for Thundercomm TurboX CM2290 * tag 'mmc-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: tmio: reenable card irqs after the reset callback mmc: mediatek: Move cqhci init behind ungate clock mmc: cqhci: clear HALT state after CQE enable mmc: vub300: fix control-message timeouts mmc: dw_mmc: exynos: fix the finding clock sample value mmc: winbond: don't build on M68K mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit mmc: sdhci-pci: Read card detect from ACPI for Intel Merrifield mmc: sdhci: Map more voltage level to SDHCI_POWER_330 commit fd919bbd334f22486ee2e9c16ceefe833bb9e32f Merge: 6f11521267319 ccaa66c8dd277 Author: Linus Torvalds Date: Fri Oct 29 10:46:59 2021 -0700 Merge tag 'for-5.15-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Last minute fixes for crash on 32bit architectures when compression is in use. It's a regression introduced in 5.15-rc and I'd really like not let this into the final release, fixes via stable trees would add unnecessary delay. The problem is on 32bit architectures with highmem enabled, the pages for compression may need to be kmapped, while the patches removed that as we don't use GFP_HIGHMEM allocations anymore. The pages that don't come from local allocation still may be from highmem. Despite being on 32bit there's enough such ARM machines in use so it's not a marginal issue. I did full reverts of the patches one by one instead of a huge one. There's one exception for the "lzo" revert as there was an intermediate patch touching the same code to make it compatible with subpage. I can't revert that one too, so the revert in lzo.c is manual. Qu Wenruo has worked on that with me and verified the changes" * tag 'for-5.15-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Revert "btrfs: compression: drop kmap/kunmap from lzo" Revert "btrfs: compression: drop kmap/kunmap from zlib" Revert "btrfs: compression: drop kmap/kunmap from zstd" Revert "btrfs: compression: drop kmap/kunmap from generic helpers" commit 6f11521267319659cceabe073112a0e35bcb7ff8 Merge: 75c7a6c1ca631 ddcf906fe5ed8 Author: Linus Torvalds Date: Fri Oct 29 10:41:07 2021 -0700 Merge tag 'trace-v5.15-rc6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing comment fixes from Steven Rostedt: - Some bots have informed me that some of the ftrace functions kernel-doc has formatting issues. - Also, fix my snake instinct. * tag 'trace-v5.15-rc6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix misspelling of "missing" ftrace: Fix kernel-doc formatting issues commit 75c7a6c1ca63131875fe869cbfd404c94d0e1944 Merge: 2c04d67ec1eb5 f8690a4b5a1b6 Author: Linus Torvalds Date: Fri Oct 29 10:17:08 2021 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a build-time warning in x86/sm4" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/sm4 - Fix invalid section entry size commit 2c04d67ec1eb558c9d0f58d61e64554d8f39f120 Merge: f25a5481af12c 9c7516d669e68 Author: Linus Torvalds Date: Fri Oct 29 10:03:07 2021 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "11 patches. Subsystems affected by this patch series: mm (memcg, memory-failure, oom-kill, secretmem, vmalloc, hugetlb, damon, and tools), and ocfs2" * emailed patches from Andrew Morton : tools/testing/selftests/vm/split_huge_page_test.c: fix application of sizeof to pointer mm/damon/core-test: fix wrong expectations for 'damon_split_regions_of()' mm: khugepaged: skip huge page collapse for special files mm, thp: bail out early in collapse_file for writeback page mm/vmalloc: fix numa spreading for large hash tables mm/secretmem: avoid letting secretmem_users drop to zero ocfs2: fix race between searching chunks and release journal_head from buffer_head mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap mm: filemap: check if THP has hwpoisoned subpage for PMD page fault mm: hwpoison: remove the unnecessary THP check memcg: page_alloc: skip bulk allocator for __GFP_ACCOUNT commit 54c5639d8f507ebefa814f574cb6f763033a72a5 Author: Alexandre Ghiti Date: Fri Oct 29 06:59:27 2021 +0200 riscv: Fix asan-stack clang build Nathan reported that because KASAN_SHADOW_OFFSET was not defined in Kconfig, it prevents asan-stack from getting disabled with clang even when CONFIG_KASAN_STACK is disabled: fix this by defining the corresponding config. Reported-by: Nathan Chancellor Signed-off-by: Alexandre Ghiti Fixes: 8ad8b72721d0 ("riscv: Add KASAN support") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit cf11d01135ea1ff7fddb612033e3cb5cde279ff2 Author: Alexandre Ghiti Date: Fri Oct 29 06:59:26 2021 +0200 riscv: Do not re-populate shadow memory with kasan_populate_early_shadow When calling this function, all the shadow memory is already populated with kasan_early_shadow_pte which has PAGE_KERNEL protection. kasan_populate_early_shadow write-protects the mapping of the range of addresses passed in argument in zero_pte_populate, which actually write-protects all the shadow memory mapping since kasan_early_shadow_pte is used for all the shadow memory at this point. And then when using memblock API to populate the shadow memory, the first write access to the kernel stack triggers a trap. This becomes visible with the next commit that contains a fix for asan-stack. We already manually populate all the shadow memory in kasan_early_init and we write-protect kasan_early_shadow_pte at the end of kasan_init which makes the calls to kasan_populate_early_shadow superfluous so we can remove them. Signed-off-by: Alexandre Ghiti Fixes: e178d670f251 ("riscv/kasan: add KASAN_VMALLOC support") Fixes: 8ad8b72721d0 ("riscv: Add KASAN support") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit ddcf906fe5ed842034b2d995064c1de1dcc7e812 Author: Steven Rostedt (VMware) Date: Fri Oct 29 09:54:14 2021 -0400 tracing: Fix misspelling of "missing" My snake instinct was on and I wrote "misssing" instead of "missing". Signed-off-by: Steven Rostedt (VMware) commit 6130722f1114cac4f3ec858763ad8995d5a2e586 Author: Steven Rostedt (VMware) Date: Fri Oct 29 09:52:23 2021 -0400 ftrace: Fix kernel-doc formatting issues Some functions had kernel-doc that used a comma instead of a hash to separate the function name from the one line description. Also, the "ftrace_is_dead()" had an incomplete description. Signed-off-by: Steven Rostedt (VMware) commit ccaa66c8dd277ac02f96914168bb7177f7ea8117 Author: David Sterba Date: Wed Oct 27 10:44:21 2021 +0200 Revert "btrfs: compression: drop kmap/kunmap from lzo" This reverts commit 8c945d32e60427cbc0859cf7045bbe6196bb03d8. The kmaps in compression code are still needed and cause crashes on 32bit machines (ARM, x86). Reproducible eg. by running fstest btrfs/004 with enabled LZO or ZSTD compression. The revert does not apply cleanly due to changes in a6e66e6f8c1b ("btrfs: rework lzo_decompress_bio() to make it subpage compatible") that reworked the page iteration so the revert is done to be equivalent to the original code. Link: https://lore.kernel.org/all/CAJCQCtT+OuemovPO7GZk8Y8=qtOObr0XTDp8jh4OHD6y84AFxw@mail.gmail.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214839 Tested-by: Qu Wenruo Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 55276e14df4324ade34583adef110e11d249fb7b Author: David Sterba Date: Wed Oct 27 10:42:43 2021 +0200 Revert "btrfs: compression: drop kmap/kunmap from zlib" This reverts commit 696ab562e6df9fbafd6052d8ce4aafcb2ed16069. The kmaps in compression code are still needed and cause crashes on 32bit machines (ARM, x86). Reproducible eg. by running fstest btrfs/004 with enabled LZO or ZSTD compression. Link: https://lore.kernel.org/all/CAJCQCtT+OuemovPO7GZk8Y8=qtOObr0XTDp8jh4OHD6y84AFxw@mail.gmail.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214839 Signed-off-by: David Sterba commit 56ee254d23c59fd48fb6f192d79858f60cfe2bf6 Author: David Sterba Date: Wed Oct 27 10:42:27 2021 +0200 Revert "btrfs: compression: drop kmap/kunmap from zstd" This reverts commit bbaf9715f3f5b5ff0de71da91fcc34ee9c198ed8. The kmaps in compression code are still needed and cause crashes on 32bit machines (ARM, x86). Reproducible eg. by running fstest btrfs/004 with enabled LZO or ZSTD compression. Example stacktrace with ZSTD on a 32bit ARM machine: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c4159ed3 [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 210 Comm: kworker/u2:3 Not tainted 5.14.0-rc79+ #12 Hardware name: Allwinner sun4i/sun5i Families Workqueue: btrfs-delalloc btrfs_work_helper PC is at mmiocpy+0x48/0x330 LR is at ZSTD_compressStream_generic+0x15c/0x28c (mmiocpy) from [] (ZSTD_compressStream_generic+0x15c/0x28c) (ZSTD_compressStream_generic) from [] (ZSTD_compressStream+0x64/0xa0) (ZSTD_compressStream) from [] (zstd_compress_pages+0x170/0x488) (zstd_compress_pages) from [] (btrfs_compress_pages+0x124/0x12c) (btrfs_compress_pages) from [] (compress_file_range+0x3c0/0x834) (compress_file_range) from [] (async_cow_start+0x10/0x28) (async_cow_start) from [] (btrfs_work_helper+0x100/0x230) (btrfs_work_helper) from [] (process_one_work+0x1b4/0x418) (process_one_work) from [] (worker_thread+0x44/0x524) (worker_thread) from [] (kthread+0x180/0x1b0) (kthread) from [] Link: https://lore.kernel.org/all/CAJCQCtT+OuemovPO7GZk8Y8=qtOObr0XTDp8jh4OHD6y84AFxw@mail.gmail.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214839 Signed-off-by: David Sterba commit 9c7516d669e68e94e17203469a873ff5d1d3a41a Author: David Yang Date: Thu Oct 28 14:36:36 2021 -0700 tools/testing/selftests/vm/split_huge_page_test.c: fix application of sizeof to pointer The coccinelle check report: ./tools/testing/selftests/vm/split_huge_page_test.c:344:36-42: ERROR: application of sizeof to pointer Use "strlen" to fix it. Link: https://lkml.kernel.org/r/20211012030116.184027-1-davidcomponentone@gmail.com Signed-off-by: David Yang Reported-by: Zeal Robot Cc: Zi Yan Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e014660b3e4b7bd0e75f845cdcf745c0f632889 Author: SeongJae Park Date: Thu Oct 28 14:36:33 2021 -0700 mm/damon/core-test: fix wrong expectations for 'damon_split_regions_of()' Kunit test cases for 'damon_split_regions_of()' expects the number of regions after calling the function will be same to their request ('nr_sub'). However, the requested number is just an upper-limit, because the function randomly decides the size of each sub-region. This fixes the wrong expectation. Link: https://lkml.kernel.org/r/20211028090628.14948-1-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4aeaa06d45e90f9b279f0b09de84bd00006e733 Author: Yang Shi Date: Thu Oct 28 14:36:30 2021 -0700 mm: khugepaged: skip huge page collapse for special files The read-only THP for filesystems will collapse THP for files opened readonly and mapped with VM_EXEC. The intended usecase is to avoid TLB misses for large text segments. But it doesn't restrict the file types so a THP could be collapsed for a non-regular file, for example, block device, if it is opened readonly and mapped with EXEC permission. This may cause bugs, like [1] and [2]. This is definitely not the intended usecase, so just collapse THP for regular files in order to close the attack surface. [shy828301@gmail.com: fix vm_file check [3]] Link: https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/ [1] Link: https://lore.kernel.org/linux-mm/000000000000c6a82505ce284e4c@google.com/ [2] Link: https://lkml.kernel.org/r/CAHbLzkqTW9U3VvTu1Ki5v_cLRC9gHW+znBukg_ycergE0JWj-A@mail.gmail.com [3] Link: https://lkml.kernel.org/r/20211027195221.3825-1-shy828301@gmail.com Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") Signed-off-by: Hugh Dickins Signed-off-by: Yang Shi Reported-by: Hao Sun Reported-by: syzbot+aae069be1de40fb11825@syzkaller.appspotmail.com Cc: Matthew Wilcox Cc: Kirill A. Shutemov Cc: Song Liu Cc: Andrea Righi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74c42e1baacf206338b1dd6b6199ac964512b5bb Author: Rongwei Wang Date: Thu Oct 28 14:36:27 2021 -0700 mm, thp: bail out early in collapse_file for writeback page Currently collapse_file does not explicitly check PG_writeback, instead, page_has_private and try_to_release_page are used to filter writeback pages. This does not work for xfs with blocksize equal to or larger than pagesize, because in such case xfs has no page->private. This makes collapse_file bail out early for writeback page. Otherwise, xfs end_page_writeback will panic as follows. page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32 aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so" flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback) raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8 raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000 page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u)) page->mem_cgroup:ffff0000c3e9a000 ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1212! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: BUG: Bad page state in process khugepaged pfn:84ef32 xfs(E) page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32 libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ... CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ... pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) Call trace: end_page_writeback+0x1c0/0x214 iomap_finish_page_writeback+0x13c/0x204 iomap_finish_ioend+0xe8/0x19c iomap_writepage_end_bio+0x38/0x50 bio_endio+0x168/0x1ec blk_update_request+0x278/0x3f0 blk_mq_end_request+0x34/0x15c virtblk_request_done+0x38/0x74 [virtio_blk] blk_done_softirq+0xc4/0x110 __do_softirq+0x128/0x38c __irq_exit_rcu+0x118/0x150 irq_exit+0x1c/0x30 __handle_domain_irq+0x8c/0xf0 gic_handle_irq+0x84/0x108 el1_irq+0xcc/0x180 arch_cpu_idle+0x18/0x40 default_idle_call+0x4c/0x1a0 cpuidle_idle_call+0x168/0x1e0 do_idle+0xb4/0x104 cpu_startup_entry+0x30/0x9c secondary_start_kernel+0x104/0x180 Code: d4210000 b0006161 910c8021 94013f4d (d4210000) ---[ end trace 4a88c6a074082f8c ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt Link: https://lkml.kernel.org/r/20211022023052.33114-1-rongwei.wang@linux.alibaba.com Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") Signed-off-by: Rongwei Wang Signed-off-by: Xu Yu Suggested-by: Yang Shi Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Yang Shi Acked-by: Kirill A. Shutemov Cc: Song Liu Cc: William Kucharski Cc: Hugh Dickins Cc: Mike Kravetz Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ffb29b1c255ab48cb0062a3d11c101501e3e9b3f Author: Chen Wandun Date: Thu Oct 28 14:36:24 2021 -0700 mm/vmalloc: fix numa spreading for large hash tables Eric Dumazet reported a strange numa spreading info in [1], and found commit 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings") introduced this issue [2]. Dig into the difference before and after this patch, page allocation has some difference: before: alloc_large_system_hash __vmalloc __vmalloc_node(..., NUMA_NO_NODE, ...) __vmalloc_node_range __vmalloc_area_node alloc_page /* because NUMA_NO_NODE, so choose alloc_page branch */ alloc_pages_current alloc_page_interleave /* can be proved by print policy mode */ after: alloc_large_system_hash __vmalloc __vmalloc_node(..., NUMA_NO_NODE, ...) __vmalloc_node_range __vmalloc_area_node alloc_pages_node /* choose nid by nuam_mem_id() */ __alloc_pages_node(nid, ....) So after commit 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings"), it will allocate memory in current node instead of interleaving allocate memory. Link: https://lore.kernel.org/linux-mm/CANn89iL6AAyWhfxdHO+jaT075iOa3XcYn9k6JJc7JR2XYn6k_Q@mail.gmail.com/ [1] Link: https://lore.kernel.org/linux-mm/CANn89iLofTR=AK-QOZY87RdUZENCZUT4O6a0hvhu3_EwRMerOg@mail.gmail.com/ [2] Link: https://lkml.kernel.org/r/20211021080744.874701-2-chenwandun@huawei.com Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings") Signed-off-by: Chen Wandun Reported-by: Eric Dumazet Cc: Shakeel Butt Cc: Nicholas Piggin Cc: Kefeng Wang Cc: Hanjun Guo Cc: Uladzislau Rezki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 855d44434fa24d5344c1cb0edb38723f891cd415 Author: Kees Cook Date: Thu Oct 28 14:36:21 2021 -0700 mm/secretmem: avoid letting secretmem_users drop to zero Quoting Dmitry: "refcount_inc() needs to be done before fd_install(). After fd_install() finishes, the fd can be used by userspace and we can have secret data in memory before the refcount_inc(). A straightforward misuse where a user will predict the returned fd in another thread before the syscall returns and will use it to store secret data is somewhat dubious because such a user just shoots themself in the foot. But a more interesting misuse would be to close the predicted fd and decrement the refcount before the corresponding refcount_inc, this way one can briefly drop the refcount to zero while there are other users of secretmem." Move fd_install() after refcount_inc(). Link: https://lkml.kernel.org/r/20211021154046.880251-1-keescook@chromium.org Link: https://lore.kernel.org/lkml/CACT4Y+b1sW6-Hkn8HQYw_SsT7X3tp-CJNh2ci0wG3ZnQz9jjig@mail.gmail.com Fixes: 9a436f8ff631 ("PM: hibernate: disable when there are active secretmem users") Signed-off-by: Kees Cook Reported-by: Dmitry Vyukov Reviewed-by: Dmitry Vyukov Reviewed-by: David Hildenbrand Reviewed-by: Jordy Zomer Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6f1b228529ae49b0f85ab89bcdb6c365df401558 Author: Gautham Ananthakrishna Date: Thu Oct 28 14:36:17 2021 -0700 ocfs2: fix race between searching chunks and release journal_head from buffer_head Encountered a race between ocfs2_test_bg_bit_allocatable() and jbd2_journal_put_journal_head() resulting in the below vmcore. PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3" Call trace: panic oops_end no_context __bad_area_nosemaphore bad_area_nosemaphore __do_page_fault do_page_fault page_fault [exception RIP: ocfs2_block_group_find_clear_bits+316] ocfs2_block_group_find_clear_bits [ocfs2] ocfs2_cluster_group_search [ocfs2] ocfs2_search_chain [ocfs2] ocfs2_claim_suballoc_bits [ocfs2] __ocfs2_claim_clusters [ocfs2] ocfs2_claim_clusters [ocfs2] ocfs2_local_alloc_slide_window [ocfs2] ocfs2_reserve_local_alloc_bits [ocfs2] ocfs2_reserve_clusters_with_limit [ocfs2] ocfs2_reserve_clusters [ocfs2] ocfs2_lock_refcount_allocators [ocfs2] ocfs2_make_clusters_writable [ocfs2] ocfs2_replace_cow [ocfs2] ocfs2_refcount_cow [ocfs2] ocfs2_file_write_iter [ocfs2] lo_rw_aio loop_queue_work kthread_worker_fn kthread ret_from_fork When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and released the jounal head from the buffer head. Needed to take bit lock for the bit 'BH_JournalHead' to fix this race. Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com Signed-off-by: Gautham Ananthakrishna Reviewed-by: Joseph Qi Cc: Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 337546e83fc7e50917f44846beee936abb9c9f1f Author: Suren Baghdasaryan Date: Thu Oct 28 14:36:14 2021 -0700 mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap Race between process_mrelease and exit_mmap, where free_pgtables is called while __oom_reap_task_mm is in progress, leads to kernel crash during pte_offset_map_lock call. oom-reaper avoids this race by setting MMF_OOM_VICTIM flag and causing exit_mmap to take and release mmap_write_lock, blocking it until oom-reaper releases mmap_read_lock. Reusing MMF_OOM_VICTIM for process_mrelease would be the simplest way to fix this race, however that would be considered a hack. Fix this race by elevating mm->mm_users and preventing exit_mmap from executing until process_mrelease is finished. Patch slightly refactors the code to adapt for a possible mmget_not_zero failure. This fix has considerable negative impact on process_mrelease performance and will likely need later optimization. Link: https://lkml.kernel.org/r/20211022014658.263508-1-surenb@google.com Fixes: 884a7e5964e0 ("mm: introduce process_mrelease system call") Signed-off-by: Suren Baghdasaryan Acked-by: Michal Hocko Cc: David Rientjes Cc: Matthew Wilcox (Oracle) Cc: Johannes Weiner Cc: Roman Gushchin Cc: Rik van Riel Cc: Minchan Kim Cc: Christian Brauner Cc: Christoph Hellwig Cc: Oleg Nesterov Cc: David Hildenbrand Cc: Jann Horn Cc: Shakeel Butt Cc: Andy Lutomirski Cc: Christian Brauner Cc: Florian Weimer Cc: Jan Engelhardt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eac96c3efdb593df1a57bb5b95dbe037bfa9a522 Author: Yang Shi Date: Thu Oct 28 14:36:11 2021 -0700 mm: filemap: check if THP has hwpoisoned subpage for PMD page fault When handling shmem page fault the THP with corrupted subpage could be PMD mapped if certain conditions are satisfied. But kernel is supposed to send SIGBUS when trying to map hwpoisoned page. There are two paths which may do PMD map: fault around and regular fault. Before commit f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") the thing was even worse in fault around path. The THP could be PMD mapped as long as the VMA fits regardless what subpage is accessed and corrupted. After this commit as long as head page is not corrupted the THP could be PMD mapped. In the regular fault path the THP could be PMD mapped as long as the corrupted page is not accessed and the VMA fits. This loophole could be fixed by iterating every subpage to check if any of them is hwpoisoned or not, but it is somewhat costly in page fault path. So introduce a new page flag called HasHWPoisoned on the first tail page. It indicates the THP has hwpoisoned subpage(s). It is set if any subpage of THP is found hwpoisoned by memory failure and after the refcount is bumped successfully, then cleared when the THP is freed or split. The soft offline path doesn't need this since soft offline handler just marks a subpage hwpoisoned when the subpage is migrated successfully. But shmem THP didn't get split then migrated at all. Link: https://lkml.kernel.org/r/20211020210755.23964-3-shy828301@gmail.com Fixes: 800d8c63b2e9 ("shmem: add huge pages support") Signed-off-by: Yang Shi Reviewed-by: Naoya Horiguchi Suggested-by: Kirill A. Shutemov Cc: Hugh Dickins Cc: Matthew Wilcox Cc: Oscar Salvador Cc: Peter Xu Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c7cb42e94473aafe553c0f2a3d8ca904599399ed Author: Yang Shi Date: Thu Oct 28 14:36:07 2021 -0700 mm: hwpoison: remove the unnecessary THP check When handling THP hwpoison checked if the THP is in allocation or free stage since hwpoison may mistreat it as hugetlb page. After commit 415c64c1453a ("mm/memory-failure: split thp earlier in memory error handling") the problem has been fixed, so this check is no longer needed. Remove it. The side effect of the removal is hwpoison may report unsplit THP instead of unknown error for shmem THP. It seems not like a big deal. The following patch "mm: filemap: check if THP has hwpoisoned subpage for PMD page fault" depends on this, which fixes shmem THP with hwpoisoned subpage(s) are mapped PMD wrongly. So this patch needs to be backported to -stable as well. Link: https://lkml.kernel.org/r/20211020210755.23964-2-shy828301@gmail.com Signed-off-by: Yang Shi Suggested-by: Naoya Horiguchi Acked-by: Naoya Horiguchi Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Matthew Wilcox Cc: Oscar Salvador Cc: Peter Xu Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8dcb3060d81dbfa8d954a2ec64ef7ca330f5bb4d Author: Shakeel Butt Date: Thu Oct 28 14:36:04 2021 -0700 memcg: page_alloc: skip bulk allocator for __GFP_ACCOUNT Commit 5c1f4e690eec ("mm/vmalloc: switch to bulk allocator in __vmalloc_area_node()") switched to bulk page allocator for order 0 allocation backing vmalloc. However bulk page allocator does not support __GFP_ACCOUNT allocations and there are several users of kvmalloc(__GFP_ACCOUNT). For now make __GFP_ACCOUNT allocations bypass bulk page allocator. In future if there is workload that can be significantly improved with the bulk page allocator with __GFP_ACCCOUNT support, we can revisit the decision. Link: https://lkml.kernel.org/r/20211014151607.2171970-1-shakeelb@google.com Fixes: 5c1f4e690eec ("mm/vmalloc: switch to bulk allocator in __vmalloc_area_node()") Signed-off-by: Shakeel Butt Reported-by: Vasily Averin Tested-by: Vasily Averin Acked-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Roman Gushchin Acked-by: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f25a5481af12c2360710583b84537eb9e652d57d Merge: f31531e55495c 3dd60fb9d95db Author: Linus Torvalds Date: Thu Oct 28 16:50:25 2021 -0700 Merge tag 'libnvdimm-fixes-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Dan Williams: - Fix a regression introduced in v5.15-rc6 that caused nvdimm namespace shutdown to hang due to reworks in the block layer q_usage_count. * tag 'libnvdimm-fixes-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm/pmem: stop using q_usage_count as external pgmap refcount commit 90935eb303e0d12f3d3d0383262e65290321f5f6 Author: Wolfram Sang Date: Thu Oct 28 21:51:49 2021 +0200 mmc: tmio: reenable card irqs after the reset callback The reset callback may clear the internal card detect interrupts, so make sure to reenable them if needed. Fixes: b4d86f37eacb ("mmc: renesas_sdhi: do hard reset if possible") Reported-by: Biju Das Signed-off-by: Wolfram Sang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211028195149.8003-1-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit f31531e55495ca3746fb895ffdf73586be8259fa Merge: 411a44c24a561 b112166a894db Author: Linus Torvalds Date: Thu Oct 28 12:17:01 2021 -0700 Merge tag 'drm-fixes-2021-10-29' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Quiet but not too quiet, I blame Halloween. The first set of amdgpu fixes missed last week, hence why this has a few more of them, it's mostly display fixes for new GPUs and some debugfs OOB stuff. The i915 patches have one to remove a tracepoint possible issue before it's a real problem, the others around cflush and display are cc'ed to stable as well. Otherwise it's just a few misc fixes. Summary: MAINTAINERS: - Fix the path pattern ttm: - Fix fence leak in ttm_transfered_destroy. core: - Add GPD Win3 rotation quirk i915: - Remove unconditional clflushes - Fix oops on boot due to sync state on disabled DP encoders - Revert backend specific data added to tracepoints - Remove useless and incorrect memory frequence calculation panel: - Add quirk for Aya Neo 2021 seltest: - Reset property count for each drm damage selftest so full run will work correctly. amdgpu: - Fix two potential out of bounds writes in debugfs - Fix revision handling for Yellow Carp - Display fixes for Yellow Carp - Display fixes for DCN 3.1" * tag 'drm-fixes-2021-10-29' of git://anongit.freedesktop.org/drm/drm: (21 commits) MAINTAINERS: dri-devel is for all of drivers/gpu drm/i915: Revert 'guc_id' from i915_request tracepoint drm/amd/display: Fix deadlock when falling back to v2 from v3 drm/amd/display: Fallback to clocks which meet requested voltage on DCN31 drm/amdgpu: Fix even more out of bound writes from debugfs drm: panel-orientation-quirks: Add quirk for GPD Win3 drm/i915/dp: Skip the HW readout of DPCD on disabled encoders drm/i915: Catch yet another unconditioal clflush drm/i915: Convert unconditional clflush to drm_clflush_virt_range() drm/i915/selftests: Properly reset mock object propers for each test drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 drm/ttm: fix memleak in ttm_transfered_destroy drm/amdgpu: support B0&B1 external revision id for yellow carp drm/amd/display: Moved dccg init to after bios golden init drm/amd/display: Increase watermark latencies for DCN3.1 drm/amd/display: increase Z9 latency to workaround underflow in Z9 drm/amd/display: Require immediate flip support for DCN3.1 planes drm/amd/display: Fix prefetch bandwidth calculation for DCN3.1 drm/amd/display: Limit display scaling to up to true 4k for DCN 3.1 drm/amdgpu: fix out of bounds write ... commit b112166a894db446f47a8c31781b037f28ac1721 Author: Daniel Vetter Date: Thu Oct 28 19:08:57 2021 +0200 MAINTAINERS: dri-devel is for all of drivers/gpu Somehow we only have a list of subdirectories, which apparently made it harder for folks to find the gpu maintainers. Fix that. References: https://lore.kernel.org/dri-devel/YXrAAZlxxStNFG%2FK@phenom.ffwll.local/ Signed-off-by: Daniel Vetter Cc: David Airlie Cc: Daniel Vetter Cc: Steven Rostedt Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20211028170857.4029606-1-daniel.vetter@ffwll.ch commit 946ca97e2ea3682e434ae1d0958a4565fa10b6bc Merge: 79516af3497a5 9a4aa3a2f1606 Author: Dave Airlie Date: Fri Oct 29 04:46:14 2021 +1000 Merge tag 'drm-intel-fixes-2021-10-28' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15 final: - Remove unconditional clflushes - Fix oops on boot due to sync state on disabled DP encoders - Revert backend specific data added to tracepoints - Remove useless and incorrect memory frequence calculation Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/8735olh27y.fsf@intel.com commit 411a44c24a561e449b592ff631b7ae321f1eb559 Merge: 4fb7d85b2ebf0 35392da51b1ab Author: Linus Torvalds Date: Thu Oct 28 10:17:31 2021 -0700 Merge tag 'net-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from WiFi (mac80211), and BPF. Current release - regressions: - skb_expand_head: adjust skb->truesize to fix socket memory accounting - mptcp: fix corrupt receiver key in MPC + data + checksum Previous releases - regressions: - multicast: calculate csum of looped-back and forwarded packets - cgroup: fix memory leak caused by missing cgroup_bpf_offline - cfg80211: fix management registrations locking, prevent list corruption - cfg80211: correct false positive in bridge/4addr mode check - tcp_bpf: fix race in the tcp_bpf_send_verdict resulting in reusing previous verdict Previous releases - always broken: - sctp: enhancements for the verification tag, prevent attackers from killing SCTP sessions - tipc: fix size validations for the MSG_CRYPTO type - mac80211: mesh: fix HE operation element length check, prevent out of bound access - tls: fix sign of socket errors, prevent positive error codes being reported from read()/write() - cfg80211: scan: extend RCU protection in cfg80211_add_nontrans_list() - implement ->sock_is_readable() for UDP and AF_UNIX, fix poll() for sockets in a BPF sockmap - bpf: fix potential race in tail call compatibility check resulting in two operations which would make the map incompatible succeeding - bpf: prevent increasing bpf_jit_limit above max - bpf: fix error usage of map_fd and fdget() in generic batch update - phy: ethtool: lock the phy for consistency of results - prevent infinite while loop in skb_tx_hash() when Tx races with driver reconfiguring the queue <> traffic class mapping - usbnet: fixes for bad HW conjured by syzbot - xen: stop tx queues during live migration, prevent UAF - net-sysfs: initialize uid and gid before calling net_ns_get_ownership - mlxsw: prevent Rx stalls under memory pressure" * tag 'net-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (67 commits) Revert "net: hns3: fix pause config problem after autoneg disabled" mptcp: fix corrupt receiver key in MPC + data + checksum riscv, bpf: Fix potential NULL dereference octeontx2-af: Fix possible null pointer dereference. octeontx2-af: Display all enabled PF VF rsrc_alloc entries. octeontx2-af: Check whether ipolicers exists net: ethernet: microchip: lan743x: Fix skb allocation failure net/tls: Fix flipped sign in async_wait.err assignment net/tls: Fix flipped sign in tls_err_abort() calls net/smc: Correct spelling mistake to TCPF_SYN_RECV net/smc: Fix smc_link->llc_testlink_time overflow nfp: bpf: relax prog rejection for mtu check through max_pkt_offset vmxnet3: do not stop tx queues after netif_device_detach() r8169: Add device 10ec:8162 to driver r8169 ptp: Document the PTP_CLK_MAGIC ioctl number usbnet: fix error return code in usbnet_probe() net: hns3: adjust string spaces of some parameters of tx bd info in debugfs net: hns3: expand buffer len for some debugfs command net: hns3: add more string spaces for dumping packets number of queue info in debugfs net: hns3: fix data endian problem of some functions of debugfs ... commit 4fb7d85b2ebf0f06d6b47df2c9f2d45c6fec8b8c Merge: 8685de2ed8c1b d81d0e41ed5fe Author: Linus Torvalds Date: Thu Oct 28 10:04:39 2021 -0700 Merge tag 'spi-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of final driver specific fixes for v5.15, one fixing potential ID collisions between two instances of the Altera driver and one making Microwire full duplex mode actually work on pl022" * tag 'spi-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spl022: fix Microwire full duplex mode spi: altera: Change to dynamic allocation of spi id commit 8685de2ed8c1b0e5cfb07d1986e6a38250a58e8a Merge: eecd231a80a5d 55e6d8037805b Author: Linus Torvalds Date: Thu Oct 28 10:00:58 2021 -0700 Merge tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "This fixes a potential double free when handling an out of memory error inserting a node into an rbtree regcache" * tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Fix possible double-free in regcache_rbtree_exit() commit eecd231a80a5d54afc5eb350fc890ab15350408d Merge: fc18cc89b9802 cd004d8299f1d Author: Linus Torvalds Date: Thu Oct 28 09:55:25 2021 -0700 Merge tag 'linux-watchdog-5.15-rc7' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: "I overlooked Guenters request to sent this upstream earlier, so it's a bit late in the release cycle. This contains: - Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" - sbsa: only use 32-bit accessors - sbsa: drop unneeded MODULE_ALIAS - ixp4xx_wdt: Fix address space warning - Fix OMAP watchdog early handling" * tag 'linux-watchdog-5.15-rc7' of git://www.linux-watchdog.org/linux-watchdog: watchdog: Fix OMAP watchdog early handling watchdog: ixp4xx_wdt: Fix address space warning watchdog: sbsa: drop unneeded MODULE_ALIAS watchdog: sbsa: only use 32-bit accessors Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" commit fc18cc89b9802dbe710cbfb52d0b11b3197ead18 Merge: 9c5456773d79b 7fa598f9706d4 Author: Linus Torvalds Date: Thu Oct 28 09:50:56 2021 -0700 Merge tag 'trace-v5.15-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Do not WARN when attaching event probe to non-existent event If the user tries to attach an event probe (eprobe) to an event that does not exist, it will trigger a warning. There's an error check that only expects memory issues otherwise it is considered a bug. But changes in the code to move around the locking made it that it can error out if the user attempts to attach to an event that does not exist, returning an -ENODEV. As this path can be caused by user space putting in a bad value, do not trigger a WARN" * tag 'trace-v5.15-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Do not warn when connecting eprobe to non existing event commit 35392da51b1ab7ba0c63de0a553e2a93c2314266 Author: Guangbin Huang Date: Thu Oct 28 22:06:24 2021 +0800 Revert "net: hns3: fix pause config problem after autoneg disabled" This reverts commit 3bda2e5df476417b6d08967e2d84234a59d57b1c. According to discussion with Andrew as follow: https://lore.kernel.org/netdev/09eda9fe-196b-006b-6f01-f54e75715961@huawei.com/ HNS3 driver needs to separate pause autoneg from general autoneg, so revert this incorrect patch. Signed-off-by: Guangbin Huang Link: https://lore.kernel.org/r/20211028140624.53149-1-huangguangbin2@huawei.com Signed-off-by: Jakub Kicinski commit f7cc8890f30d3ddc785e2b2ddc647da5b4b3c3ec Author: Davide Caratti Date: Wed Oct 27 13:38:55 2021 -0700 mptcp: fix corrupt receiver key in MPC + data + checksum using packetdrill it's possible to observe that the receiver key contains random values when clients transmit MP_CAPABLE with data and checksum (as specified in RFC8684 §3.1). Fix the layout of mptcp_out_options, to avoid using the skb extension copy when writing the MP_CAPABLE sub-option. Fixes: d7b269083786 ("mptcp: shrink mptcp_out_options struct") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/233 Reported-by: Poorva Sonparote Signed-off-by: Davide Caratti Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20211027203855.264600-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit 27de809a3d83a6199664479ebb19712533d6fd9b Author: Björn Töpel Date: Thu Oct 28 14:51:15 2021 +0200 riscv, bpf: Fix potential NULL dereference The bpf_jit_binary_free() function requires a non-NULL argument. When the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps, jit_data->header will be NULL, which triggers a NULL dereference. Avoid this by checking the argument, prior calling the function. Fixes: ca6cb5447cec ("riscv, bpf: Factor common RISC-V JIT code") Signed-off-by: Björn Töpel Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20211028125115.514587-1-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit f3d1436d4bf8ced1c9a62a045d193a65567e1fcc Author: David Woodhouse Date: Tue Oct 26 04:12:38 2021 +0100 KVM: x86: Take srcu lock in post_kvm_run_save() The Xen interrupt injection for event channels relies on accessing the guest's vcpu_info structure in __kvm_xen_has_interrupt(), through a gfn_to_hva_cache. This requires the srcu lock to be held, which is mostly the case except for this code path: [ 11.822877] WARNING: suspicious RCU usage [ 11.822965] ----------------------------- [ 11.823013] include/linux/kvm_host.h:664 suspicious rcu_dereference_check() usage! [ 11.823131] [ 11.823131] other info that might help us debug this: [ 11.823131] [ 11.823196] [ 11.823196] rcu_scheduler_active = 2, debug_locks = 1 [ 11.823253] 1 lock held by dom:0/90: [ 11.823292] #0: ffff998956ec8118 (&vcpu->mutex){+.+.}, at: kvm_vcpu_ioctl+0x85/0x680 [ 11.823379] [ 11.823379] stack backtrace: [ 11.823428] CPU: 2 PID: 90 Comm: dom:0 Kdump: loaded Not tainted 5.4.34+ #5 [ 11.823496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 11.823612] Call Trace: [ 11.823645] dump_stack+0x7a/0xa5 [ 11.823681] lockdep_rcu_suspicious+0xc5/0x100 [ 11.823726] __kvm_xen_has_interrupt+0x179/0x190 [ 11.823773] kvm_cpu_has_extint+0x6d/0x90 [ 11.823813] kvm_cpu_accept_dm_intr+0xd/0x40 [ 11.823853] kvm_vcpu_ready_for_interrupt_injection+0x20/0x30 < post_kvm_run_save() inlined here > [ 11.823906] kvm_arch_vcpu_ioctl_run+0x135/0x6a0 [ 11.823947] kvm_vcpu_ioctl+0x263/0x680 Fixes: 40da8ccd724f ("KVM: x86/xen: Add event channel interrupt vector upcall") Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org Message-Id: <606aaaf29fca3850a63aa4499826104e77a72346.camel@infradead.org> Signed-off-by: Paolo Bonzini commit f4aaf1fa8b17e74aa46bf0165c35a1575b239d4e Merge: e0c60d0102a5a 86aeda32b887c Author: Jens Axboe Date: Thu Oct 28 08:34:01 2021 -0600 Merge tag 'nvme-5.15-2021-10-28' of git://git.infradead.org/nvme into block-5.15 Pull NVMe fixes from Christoph: "nvme fixe for Linux 5.15 - fix nvmet-tcp header digest verification (Amit Engel) - fix a memory leak in nvmet-tcp when releasing a queue (Maurizio Lombardi) - fix nvme-tcp H2CData PDU send accounting again (Sagi Grimberg) - fix digest pointer calculation in nvme-tcp and nvmet-tcp (Varun Prakash) - fix possible nvme-tcp req->offset corruption (Varun Prakash)" * tag 'nvme-5.15-2021-10-28' of git://git.infradead.org/nvme: nvmet-tcp: fix header digest verification nvmet-tcp: fix data digest pointer calculation nvme-tcp: fix data digest pointer calculation nvme-tcp: fix possible req->offset corruption nvme-tcp: fix H2CData PDU send accounting (again) nvmet-tcp: fix a memory leak when releasing a queue commit 20af8864a3029fde67fd00999f58bc1ada632374 Merge: e8684db191e41 c2d4c543f74c9 Author: David S. Miller Date: Thu Oct 28 14:47:37 2021 +0100 Merge branch 'octeontx2-debugfs-fixes' Rakesh Babu Saladi says: ==================== RVU Debugfs fix updates. The following patch series consists of the patch fixes done over rvu_debugfs.c and rvu_nix.c files. Patch 1: Check and return if ipolicers do not exists. Patch 2: Fix rsrc_alloc to print all enabled PF/VF entries with list of LFs allocated for each functional block. Patch 3: Fix possible null pointer dereference. ==================== Signed-off-by: David S. Miller commit c2d4c543f74c90f883e8ec62a31973ae8807d354 Author: Rakesh Babu Saladi Date: Wed Oct 27 23:02:34 2021 +0530 octeontx2-af: Fix possible null pointer dereference. This patch fixes possible null pointer dereference in files "rvu_debugfs.c" and "rvu_nix.c" Fixes: 8756828a8148 ("octeontx2-af: Add NPA aura and pool contexts to debugfs") Fixes: 9a946def264d ("octeontx2-af: Modify nix_vtag_cfg mailbox to support TX VTAG entries") Signed-off-by: Rakesh Babu Saladi Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit e77bcdd1f639809950c45234b08647ac6d3ffe7b Author: Rakesh Babu Date: Wed Oct 27 23:02:33 2021 +0530 octeontx2-af: Display all enabled PF VF rsrc_alloc entries. Currently, we are using a fixed buffer size of length 2048 to display rsrc_alloc output. As a result a maximum of 2048 characters of rsrc_alloc output is displayed, which may lead sometimes to display only partial output. This patch fixes this dependency on max limit of buffer size and displays all PF VF entries. Each column of the debugfs entry "rsrc_alloc" uses a fixed width of 12 characters to print the list of LFs of each block for a PF/VF. If the length of list of LFs of a block exceeds this fixed width then the list gets truncated and displays only a part of the list. This patch fixes this by using the maximum possible length of list of LFs among all blocks of all PFs and VFs entries as the width size. Fixes: f7884097141b ("octeontx2-af: Formatting debugfs entry rsrc_alloc.") Fixes: 23205e6d06d4 ("octeontx2-af: Dump current resource provisioning status") Signed-off-by: Rakesh Babu Signed-off-by: Nithin Dabilpuram Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: David S. Miller commit cc45b96e2de7ada26520f101dada0abafa4ba997 Author: Subbaraya Sundeep Date: Wed Oct 27 23:02:32 2021 +0530 octeontx2-af: Check whether ipolicers exists While displaying ingress policers information in debugfs check whether ingress policers exist in the hardware or not because some platforms(CN9XXX) do not have this feature. Fixes: e7d8971763f3 ("octeontx2-af: cn10k: Debugfs support for bandwidth") Signed-off-by: Subbaraya Sundeep Signed-off-by: Rakesh Babu Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: David S. Miller commit e8684db191e4164f3f5f3ad7dec04a6734c25f1c Author: Yuiko Oshino Date: Wed Oct 27 14:23:02 2021 -0400 net: ethernet: microchip: lan743x: Fix skb allocation failure The driver allocates skb during ndo_open with GFP_ATOMIC which has high chance of failure when there are multiple instances. GFP_KERNEL is enough while open and use GFP_ATOMIC only from interrupt context. Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Yuiko Oshino Signed-off-by: David S. Miller commit 1d9d6fd21ad4a28b16ed9ee5432ae738b9dc58aa Author: Daniel Jordan Date: Wed Oct 27 17:59:21 2021 -0400 net/tls: Fix flipped sign in async_wait.err assignment sk->sk_err contains a positive number, yet async_wait.err wants the opposite. Fix the missed sign flip, which Jakub caught by inspection. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Suggested-by: Jakub Kicinski Signed-off-by: Daniel Jordan Signed-off-by: David S. Miller commit da353fac65fede6b8b4cfe207f0d9408e3121105 Author: Daniel Jordan Date: Wed Oct 27 17:59:20 2021 -0400 net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once. Cc: stable@vger.kernel.org Fixes: c46234ebb4d1e ("tls: RX path for ktls") Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com Signed-off-by: Daniel Jordan Signed-off-by: David S. Miller commit a32f07d21102dd40496724e4416a7e97fc1755d8 Merge: 90a881fc352a9 f3a3a0fe0b644 Author: David S. Miller Date: Thu Oct 28 13:04:29 2021 +0100 Merge branch 'SMC-fixes' Tony Lu says: ==================== Fixes for SMC There are some fixes for SMC. v1->v2: - fix wrong email address. ==================== Signed-off-by: David S. Miller commit f3a3a0fe0b644582fa5d83dd94b398f99fc57914 Author: Wen Gu Date: Thu Oct 28 15:13:47 2021 +0800 net/smc: Correct spelling mistake to TCPF_SYN_RECV There should use TCPF_SYN_RECV instead of TCP_SYN_RECV. Signed-off-by: Wen Gu Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit c4a146c7cf5e8ad76231523b174d161bf152c6e7 Author: Tony Lu Date: Thu Oct 28 15:13:45 2021 +0800 net/smc: Fix smc_link->llc_testlink_time overflow The value of llc_testlink_time is set to the value stored in net->ipv4.sysctl_tcp_keepalive_time when linkgroup init. The value of sysctl_tcp_keepalive_time is already jiffies, so we don't need to multiply by HZ, which would cause smc_link->llc_testlink_time overflow, and test_link send flood. Signed-off-by: Tony Lu Reviewed-by: Xuan Zhuo Reviewed-by: Wen Gu Signed-off-by: David S. Miller commit 90a881fc352a953f1c8beb61977a2db0818157d4 Author: Yu Xiao Date: Thu Oct 28 12:00:36 2021 +0200 nfp: bpf: relax prog rejection for mtu check through max_pkt_offset MTU change is refused whenever the value of new MTU is bigger than the max packet bytes that fits in NFP Cluster Target Memory (CTM). However, an eBPF program doesn't always need to access the whole packet data. The maximum direct packet access (DPA) offset has always been caculated by verifier and stored in the max_pkt_offset field of prog aux data. Signed-off-by: Yu Xiao Reviewed-by: Yinjun Zhang Reviewed-by: Niklas Soderlund Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 Author: Dongli Zhang Date: Tue Oct 26 14:50:31 2021 -0700 vmxnet3: do not stop tx queues after netif_device_detach() The netif_device_detach() conditionally stops all tx queues if the queues are running. There is no need to call netif_tx_stop_all_queues() again. Signed-off-by: Dongli Zhang Signed-off-by: David S. Miller commit e8a1ff65927080278e6826f797b7c197fb2611a6 Author: Wenbin Mei Date: Thu Oct 28 10:20:49 2021 +0800 mmc: mediatek: Move cqhci init behind ungate clock We must enable clock before cqhci init, because crypto needs read information from CQHCI registers, otherwise, it will hang in MediaTek mmc host controller. Signed-off-by: Wenbin Mei Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support") Cc: stable@vger.kernel.org Acked-by: Chaotian Jing Link: https://lore.kernel.org/r/20211028022049.22129-1-wenbin.mei@mediatek.com Signed-off-by: Ulf Hansson commit 9a4aa3a2f1606a03c220b21049baa4a2b6169626 Author: Joonas Lahtinen Date: Wed Oct 27 12:32:55 2021 +0300 drm/i915: Revert 'guc_id' from i915_request tracepoint Avoid adding backend specific data to the tracepoints outside of the LOW_LEVEL_TRACEPOINTS kernel config protection. These bits of information are bound to change depending on the selected submission method per platform and are not necessarily possible to maintain in the future. Fixes: dbf9da8d55ef ("drm/i915/guc: Add trace point for GuC submit") Signed-off-by: Joonas Lahtinen Cc: John Harrison Cc: Matthew Brost Cc: Daniele Ceraolo Spurio Cc: Chris Wilson Cc: Matt Roper Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20211027093255.66489-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 64512a66b67e6546e2db15192b3603cd6d58b75c) Signed-off-by: Joonas Lahtinen commit 79516af3497a5b89acb09f4a644f61d6c69e5f16 Merge: 19928833e8f8f 61b1d445f3bfe Author: Dave Airlie Date: Thu Oct 28 17:27:10 2021 +1000 Merge tag 'drm-misc-fixes-2021-10-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes One patch to fix the default screen orientation on the GPD Win3 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20211028072300.b4gqexq6zfhby24g@gilmour commit 19928833e8f8fa5ee687c451437ce674f19d6c09 Merge: 03424d380be72 ee71fb6c4d99c Author: Dave Airlie Date: Thu Oct 28 15:22:14 2021 +1000 Merge tag 'drm-misc-fixes-2021-10-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.15-rc8: - Fix fence leak in ttm_transfered_destroy. - Add quirk for Aya Neo 2021 - Reset property count for each drm damage selftest so full run will work correctly. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/4a133970-ff4b-aa62-d346-b269b1b9236e@linux.intel.com commit 03424d380be72dfe6f87eed02b4fef7979583af8 Merge: defbbcd99fa68 ad76744b041d8 Author: Dave Airlie Date: Thu Oct 28 15:21:50 2021 +1000 Merge tag 'amd-drm-fixes-5.15-2021-10-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-10-27: amdgpu: - Display fixes for DCN 3.1 - Fix potential out of bounds write in debugfs Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20211028023130.4528-1-alexander.deucher@amd.com commit ad76744b041d8c87ef1c9adbb04fb7eaa20a179e Author: Nicholas Kazlauskas Date: Fri Oct 22 16:14:24 2021 -0400 drm/amd/display: Fix deadlock when falling back to v2 from v3 [Why] A deadlock in the kernel occurs when we fallback from the V3 to V2 add_topology_to_display or remove_topology_to_display because they both try to acquire the dtm_mutex but recursive locking isn't supported on mutex_lock(). [How] Make the mutex_lock/unlock more fine grained and move them up such that they're only required for the psp invocation itself. Fixes: bf62221e9d0e ("drm/amd/display: Add DCN3.1 HDCP support") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Aric Cyr Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 54149d13f369e1ab02f36b91feee02069184c1d8 Author: Michael Strauss Date: Thu Oct 21 13:27:16 2021 -0400 drm/amd/display: Fallback to clocks which meet requested voltage on DCN31 [WHY] On certain configs, SMU clock table voltages don't match which cause parser to behave incorrectly by leaving dcfclk and socclk table entries unpopulated. [HOW] Currently the function that finds the corresponding clock for a given voltage only checks for exact voltage level matches. In the case that no match gets found, parser now falls back to searching for the max clock which meets the requested voltage (i.e. its corresponding voltage is below requested). Signed-off-by: Michael Strauss Reviewed-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 Author: Patrik Jakobsson Date: Wed Oct 27 16:27:30 2021 +0200 drm/amdgpu: Fix even more out of bound writes from debugfs CVE-2021-42327 was fixed by: commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones. v2: * Add missing fix in dp_max_bpc_write (Harry Wentland) Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") Signed-off-by: Patrik Jakobsson Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 7fa598f9706d40bd16f2ab286bdf5808e1393d35 Author: Steven Rostedt (VMware) Date: Wed Oct 27 12:08:54 2021 -0400 tracing: Do not warn when connecting eprobe to non existing event When the syscall trace points are not configured in, the kselftests for ftrace will try to attach an event probe (eprobe) to one of the system call trace points. This triggered a WARNING, because the failure only expects to see memory issues. But this is not the only failure. The user may attempt to attach to a non existent event, and the kernel must not warn about it. Link: https://lkml.kernel.org/r/20211027120854.0680aa0f@gandalf.local.home Fixes: 7491e2c442781 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Steven Rostedt (VMware) commit 72f898ca0ab85fde6facf78b14d9f67a4a7b32d1 Author: Janghyub Seo Date: Tue Oct 26 07:12:42 2021 +0000 r8169: Add device 10ec:8162 to driver r8169 This patch makes the driver r8169 pick up device Realtek Semiconductor Co. , Ltd. Device [10ec:8162]. Signed-off-by: Janghyub Seo Suggested-by: Rushab Shah Link: https://lore.kernel.org/r/1635231849296.1489250046.441294000@gmail.com Signed-off-by: Jakub Kicinski commit f82161516756be2827609ec4845e1e4316df0709 Author: Randy Dunlap Date: Sun Oct 24 09:38:31 2021 -0700 ptp: Document the PTP_CLK_MAGIC ioctl number Add PTP_CLK_MAGIC to the userspace-api/ioctl/ioctl-number.rst documentation file. Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") Signed-off-by: Randy Dunlap Cc: Richard Cochran Cc: John Stultz Cc: Jonathan Corbet Link: https://lore.kernel.org/r/20211024163831.10200-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 9c5456773d79b64cc6cebb06f668e29249636ba9 Merge: 1fc596a56b334 890d33561337f Author: Linus Torvalds Date: Wed Oct 27 13:15:05 2021 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "A couple of fixes that seem important enough to pick at the last moment" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio-ring: fix DMA metadata flags vduse: Fix race condition between resetting and irq injecting vduse: Disallow injecting interrupt before DRIVER_OK is set commit 64a19591a2938b170aa736443d5d3bf4c51e1388 Author: Chen Lu <181250012@smail.nju.edu.cn> Date: Mon Oct 18 13:22:38 2021 +0800 riscv: fix misalgned trap vector base address The trap vector marked by label .Lsecondary_park must align on a 4-byte boundary, as the {m,s}tvec is defined to require 4-byte alignment. Signed-off-by: Chen Lu <181250012@smail.nju.edu.cn> Reviewed-by: Anup Patel Fixes: e011995e826f ("RISC-V: Move relocate and few other functions out of __init") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 890d33561337ffeba0d8ba42517e71288cfee2b6 Author: Vincent Whitchurch Date: Tue Oct 26 15:31:00 2021 +0200 virtio-ring: fix DMA metadata flags The flags are currently overwritten, leading to the wrong direction being passed to the DMA unmap functions. Fixes: 72b5e8958738aaa4 ("virtio-ring: store DMA metadata in desc_extra for split virtqueue") Signed-off-by: Vincent Whitchurch Link: https://lore.kernel.org/r/20211026133100.17541-1-vincent.whitchurch@axis.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6f7c88691191e6c52ef2543d6f1da8d360b27a24 Author: Wang Hai Date: Tue Oct 26 20:40:15 2021 +0800 usbnet: fix error return code in usbnet_probe() Return error code if usb_maxpacket() returns 0 in usbnet_probe() Fixes: 397430b50a36 ("usbnet: sanity check for maxpacket") Reported-by: Hulk Robot Signed-off-by: Wang Hai Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20211026124015.3025136-1-wanghai38@huawei.com Signed-off-by: Jakub Kicinski commit 1fc596a56b334f4d593a2b49e5ff55af6aaa0816 Merge: 646b0de5fe323 4e84dc47bb48a Author: Linus Torvalds Date: Wed Oct 27 10:41:59 2021 -0700 Merge tag 'trace-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull nds32 tracing fix from Steven Rostedt: "Fix nds32le build when DYNAMIC_FTRACE is disabled A randconfig found that nds32le architecture fails to build due to a prototype mismatch between a ftrace function pointer and the function it was to be assigned to. That function pointer prototype missed being updated when all the ftrace callbacks were updated" * tag 'trace-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace/nds32: Update the proto for ftrace_trace_function to match ftrace_stub commit 646b0de5fe32306eaf5399647adf2177d4417021 Merge: ab2aa486f48c7 4a089e95b4d6b Author: Linus Torvalds Date: Wed Oct 27 10:19:43 2021 -0700 Merge tag 'nios2_fixes_for_v5.15_part3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 fix from Dinh Nguyen: "Fix a build error for allmodconfig" * tag 'nios2_fixes_for_v5.15_part3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST commit ab2aa486f48c79b0c9df77e3827922d29c60df0c Merge: d25f27432f80a 64733956ebba7 Author: Linus Torvalds Date: Wed Oct 27 10:01:17 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Nothing very exciting here, it has been a quiet cycle overall. Usual collection of small bug fixes: - irdma issues with CQ entries, VLAN completions and a mutex deadlock - Incorrect DCT packets in mlx5 - Userspace triggered overflows in qib - Locking error in hfi - Typo in errno value in qib/hfi1 - Double free in qedr - Leak of random kernel memory to userspace with a netlink callback" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string RDMA/irdma: Do not hold qos mutex twice on QP resume RDMA/irdma: Set VLAN in UD work completion correctly RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR rdma/qedr: Fix crash due to redundant release of device's qp memory RDMA/rdmavt: Fix error code in rvt_create_qp() IB/hfi1: Fix abba locking issue with sc_disable() IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields RDMA/mlx5: Set user priority for DCT RDMA/irdma: Process extended CQ entries correctly commit 4e84dc47bb48accbbeeba4e6bb3f31aa7895323c Author: Steven Rostedt (VMware) Date: Wed Oct 27 12:51:01 2021 -0400 ftrace/nds32: Update the proto for ftrace_trace_function to match ftrace_stub The ftrace callback prototype was changed to pass a special ftrace_regs instead of pt_regs as the last parameter, but the static ftrace for nds32 missed updating ftrace_trace_function and this caused a warning when compared to ftrace_stub: ../arch/nds32/kernel/ftrace.c: In function '_mcount': ../arch/nds32/kernel/ftrace.c:24:35: error: comparison of distinct pointer types lacks a cast [-Werror] 24 | if (ftrace_trace_function != ftrace_stub) | ^~ Link: https://lore.kernel.org/all/20211027055554.19372-1-rdunlap@infradead.org/ Link: https://lkml.kernel.org/r/20211027125101.33449969@gandalf.local.home Cc: Ingo Molnar Cc: Andrew Morton Cc: Nick Hu Cc: Greentime Hu Cc: Vincent Chen Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: stable@vger.kernel.org Fixes: d19ad0775dcd6 ("ftrace: Have the callbacks receive a struct ftrace_regs instead of pt_regs") Reported-by: Randy Dunlap Signed-off-by: Steven Rostedt (VMware) commit afe8ca110cf4c99dee7b31473eacb56b72944df4 Merge: 424a4f52c5d4f 689a0a9f505f7 Author: Jakub Kicinski Date: Wed Oct 27 08:12:25 2021 -0700 Merge tag 'mac80211-for-net-2021-10-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Two fixes: * bridge vs. 4-addr mode check was wrong * management frame registrations locking was wrong, causing list corruption/crashes ==================== Link: https://lore.kernel.org/r/20211027143756.91711-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 9b0971ca7fc75daca80c0bb6c02e96059daea90a Author: Paolo Bonzini Date: Mon Oct 25 12:14:31 2021 -0400 KVM: SEV-ES: fix another issue with string I/O VMGEXITs If the guest requests string I/O from the hypervisor via VMGEXIT, SW_EXITINFO2 will contain the REP count. However, sev_es_string_io was incorrectly treating it as the size of the GHCB buffer in bytes. This fixes the "outsw" test in the experimental SEV tests of kvm-unit-tests. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reported-by: Marc Orr Tested-by: Marc Orr Reviewed-by: Marc Orr Signed-off-by: Paolo Bonzini commit 4a089e95b4d6bb625044d47aed0c442a8f7bd093 Author: Guenter Roeck Date: Wed Oct 20 12:11:16 2021 -0700 nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST nios2:allmodconfig builds fail with make[1]: *** No rule to make target 'arch/nios2/boot/dts/""', needed by 'arch/nios2/boot/dts/built-in.a'. Stop. make: [Makefile:1868: arch/nios2/boot/dts] Error 2 (ignored) This is seen with compile tests since those enable NIOS2_DTB_SOURCE_BOOL, which in turn enables NIOS2_DTB_SOURCE. This causes the build error because the default value for NIOS2_DTB_SOURCE is an empty string. Disable NIOS2_DTB_SOURCE_BOOL for compile tests to avoid the error. Fixes: 2fc8483fdcde ("nios2: Build infrastructure") Signed-off-by: Guenter Roeck Reviewed-by: Randy Dunlap Signed-off-by: Dinh Nguyen commit 424a4f52c5d4fe232ba55a4553eae4db2025121a Merge: 440ffcdd9db47 630a6738da82e Author: David S. Miller Date: Wed Oct 27 14:47:34 2021 +0100 Merge branch 'hns3-fixes' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 630a6738da82e2c29e1c38eafd6f8328e0a4963c Author: Guangbin Huang Date: Wed Oct 27 20:11:49 2021 +0800 net: hns3: adjust string spaces of some parameters of tx bd info in debugfs This patch adjusts the string spaces of some parameters of tx bd info in debugfs according to their maximum needs. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit c7a6e3978ea952efb107ecf511c095c3bbb2945f Author: Guangbin Huang Date: Wed Oct 27 20:11:48 2021 +0800 net: hns3: expand buffer len for some debugfs command The specified buffer length for three debugfs files fd_tcam, uc and tqp is not enough for their maximum needs, so this patch fixes them. Fixes: b5a0b70d77b9 ("net: hns3: refactor dump fd tcam of debugfs") Fixes: 1556ea9120ff ("net: hns3: refactor dump mac list of debugfs") Fixes: d96b0e59468d ("net: hns3: refactor dump reg of debugfs") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 6754614a787cbcbf87bae8a75619c24a33ea6791 Author: Jie Wang Date: Wed Oct 27 20:11:47 2021 +0800 net: hns3: add more string spaces for dumping packets number of queue info in debugfs As the width of packets number registers is 32 bits, they needs at most 10 characters for decimal data printing, but now the string spaces is not enough, so this patch fixes it. Fixes: e44c495d95e ("net: hns3: refactor queue info of debugfs") Signed-off-by: Jie Wang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 2a21dab594a98c338c4bfbc31864cbca15888549 Author: Jie Wang Date: Wed Oct 27 20:11:46 2021 +0800 net: hns3: fix data endian problem of some functions of debugfs The member data in struct hclge_desc is type of __le32, it needs endian conversion before using it, and some functions of debugfs didn't do that, so this patch fixes it. Fixes: c0ebebb9ccc1 ("net: hns3: Add "dcb register" status information query function") Signed-off-by: Jie Wang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 0251d196b0e1a19c870be882e5d4f496de8ab758 Author: Guangbin Huang Date: Wed Oct 27 20:11:45 2021 +0800 net: hns3: ignore reset event before initialization process is done Currently, if there is a reset event triggered by RAS during device in initialization process, driver may run reset process concurrently with initialization process. In this case, it may cause problem. For example, the RSS indirection table may has not been alloc memory in initialization process yet, but it is used in reset process, it will cause a call trace like this: [61228.744836] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... [61228.897677] Workqueue: hclgevf hclgevf_service_task [hclgevf] [61228.911390] pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) [61228.918670] pc : hclgevf_set_rss_indir_table+0xb4/0x190 [hclgevf] [61228.927812] lr : hclgevf_set_rss_indir_table+0x90/0x190 [hclgevf] [61228.937248] sp : ffff8000162ebb50 [61228.941087] x29: ffff8000162ebb50 x28: ffffb77add72dbc0 x27: ffff0820c7dc8080 [61228.949516] x26: 0000000000000000 x25: ffff0820ad4fc880 x24: ffff0820c7dc8080 [61228.958220] x23: ffff0820c7dc8090 x22: 00000000ffffffff x21: 0000000000000040 [61228.966360] x20: ffffb77add72b9c0 x19: 0000000000000000 x18: 0000000000000030 [61228.974646] x17: 0000000000000000 x16: ffffb77ae713feb0 x15: ffff0820ad4fcce8 [61228.982808] x14: ffffffffffffffff x13: ffff8000962eb7f7 x12: 00003834ec70c960 [61228.991990] x11: 00e0fafa8c206982 x10: 9670facc78a8f9a8 x9 : ffffb77add717530 [61229.001123] x8 : ffff0820ad4fd6b8 x7 : 0000000000000000 x6 : 0000000000000011 [61229.010249] x5 : 00000000000cb1b0 x4 : 0000000000002adb x3 : 0000000000000049 [61229.018662] x2 : ffff8000162ebbb8 x1 : 0000000000000000 x0 : 0000000000000480 [61229.027002] Call trace: [61229.030177] hclgevf_set_rss_indir_table+0xb4/0x190 [hclgevf] [61229.039009] hclgevf_rss_init_hw+0x128/0x1b4 [hclgevf] [61229.046809] hclgevf_reset_rebuild+0x17c/0x69c [hclgevf] [61229.053862] hclgevf_reset_service_task+0x4cc/0xa80 [hclgevf] [61229.061306] hclgevf_service_task+0x6c/0x630 [hclgevf] [61229.068491] process_one_work+0x1dc/0x48c [61229.074121] worker_thread+0x15c/0x464 [61229.078562] kthread+0x168/0x16c [61229.082873] ret_from_fork+0x10/0x18 [61229.088221] Code: 7900e7f6 f904a683 d503201f 9101a3e2 (38616b43) [61229.095357] ---[ end trace 153661a538f6768c ]--- To fix this problem, don't schedule reset task before initialization process is done. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit f29da4088fb4eeba457219a931327d1d5f45196a Author: Yufeng Mo Date: Wed Oct 27 20:11:44 2021 +0800 net: hns3: change hclge/hclgevf workqueue to WQ_UNBOUND mode Currently, the workqueue of hclge/hclgevf is executed on the CPU that initiates scheduling requests by default. In stress scenarios, the CPU may be busy and workqueue scheduling is completed after a long period of time. To avoid this situation and implement proper scheduling, use the WQ_UNBOUND mode instead. In this way, the workqueue can be performed on a relatively idle CPU. Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 3bda2e5df476417b6d08967e2d84234a59d57b1c Author: Guangbin Huang Date: Wed Oct 27 20:11:43 2021 +0800 net: hns3: fix pause config problem after autoneg disabled If a TP port is configured by follow steps: 1.ethtool -s ethx autoneg off speed 100 duplex full 2.ethtool -A ethx rx on tx on 3.ethtool -s ethx autoneg on(rx&tx negotiated pause results are off) 4.ethtool -s ethx autoneg off speed 100 duplex full In step 3, driver will set rx&tx pause parameters of hardware to off as pause parameters negotiated with link partner are off. After step 4, the "ethtool -a ethx" command shows both rx and tx pause parameters are on. However, pause parameters of hardware are still off and port has no flow control function actually. To fix this problem, if autoneg is disabled, driver uses its saved parameters to restore pause of hardware. If the speed is not changed in this case, there is no link state changed for phy, it will cause the pause parameter is not taken effect, so we need to force phy to go down and up. Fixes: aacbe27e82f0 ("net: hns3: modify how pause options is displayed") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e0c60d0102a5ad3475401e1a2faa3d3623eefce4 Author: Shin'ichiro Kawasaki Date: Tue Oct 26 15:01:15 2021 +0900 block: Fix partition check for host-aware zoned block devices Commit a33df75c6328 ("block: use an xarray for disk->part_tbl") modified the method to check partition existence in host-aware zoned block devices from disk_has_partitions() helper function call to empty check of xarray disk->part_tbl. However, disk->part_tbl always has single entry for disk->part0 and never becomes empty. This resulted in the host-aware zoned devices always judged to have partitions, and it made the sysfs queue/zoned attribute to be "none" instead of "host-aware" regardless of partition existence in the devices. This also caused DEBUG_LOCKS_WARN_ON(lock->magic != lock) for sdkp->rev_mutex in scsi layer when the kernel detects host-aware zoned device. Since block layer handled the host-aware zoned devices as non- zoned devices, scsi layer did not have chance to initialize the mutex for zone revalidation. Therefore, the warning was triggered. To fix the issues, call the helper function disk_has_partitions() in place of disk->part_tbl empty check. Since the function was removed with the commit a33df75c6328, reimplement it to walk through entries in the xarray disk->part_tbl. Fixes: a33df75c6328 ("block: use an xarray for disk->part_tbl") Signed-off-by: Shin'ichiro Kawasaki Cc: stable@vger.kernel.org # v5.14+ Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211026060115.753746-1-shinichiro.kawasaki@wdc.com Signed-off-by: Jens Axboe commit 3a60f6537c9adf0828bf1dd868c59f659395257e Author: David Sterba Date: Wed Oct 27 10:39:03 2021 +0200 Revert "btrfs: compression: drop kmap/kunmap from generic helpers" This reverts commit 4c2bf276b56d8d27ddbafcdf056ef3fc60ae50b0. The kmaps in compression code are still needed and cause crashes on 32bit machines (ARM, x86). Reproducible eg. by running fstest btrfs/004 with enabled LZO or ZSTD compression. Link: https://lore.kernel.org/all/CAJCQCtT+OuemovPO7GZk8Y8=qtOObr0XTDp8jh4OHD6y84AFxw@mail.gmail.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214839 Signed-off-by: David Sterba commit 86aeda32b887cdaeb0f4b7bfc9971e36377181c7 Author: Amit Engel Date: Wed Oct 27 09:49:27 2021 +0300 nvmet-tcp: fix header digest verification Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu header length. This fixes a wrong behaviour where header digest verification passes although the digest is wrong. Signed-off-by: Amit Engel Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit e790de54e94a7a15fb725b34724d41d41cbaa60c Author: Varun Prakash Date: Mon Oct 25 22:46:54 2021 +0530 nvmet-tcp: fix data digest pointer calculation exp_ddgst is of type __le32, &cmd->exp_ddgst + cmd->offset increases &cmd->exp_ddgst by 4 * cmd->offset, fix this by type casting &cmd->exp_ddgst to u8 *. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: Varun Prakash Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit d89b9f3bbb58e9e378881209756b0723694f22ff Author: Varun Prakash Date: Mon Oct 25 22:47:30 2021 +0530 nvme-tcp: fix data digest pointer calculation ddgst is of type __le32, &req->ddgst + req->offset increases &req->ddgst by 4 * req->offset, fix this by type casting &req->ddgst to u8 *. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Signed-off-by: Varun Prakash Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit ce7723e9cdae4eb3030da082876580f4b2dc0861 Author: Varun Prakash Date: Tue Oct 26 19:01:55 2021 +0530 nvme-tcp: fix possible req->offset corruption With commit db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context") r2t and response PDU can get processed while send function is executing. Current data digest send code uses req->offset after kernel_sendmsg(), this creates a race condition where req->offset gets reset before it is used in send function. This can happen in two cases - 1. Target sends r2t PDU which resets req->offset. 2. Target send response PDU which completes the req and then req is used for a new command, nvme_tcp_setup_cmd_pdu() resets req->offset. Fix this by storing req->offset in a local variable and using this local variable after kernel_sendmsg(). Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context") Signed-off-by: Varun Prakash Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit defbbcd99fa68cb7feed453662048baa87e9a441 Merge: 3906fe9bb7f1a 53c2ff8bcb06a Author: Dave Airlie Date: Wed Oct 27 10:01:21 2021 +1000 Merge tag 'amd-drm-fixes-5.15-2021-10-21' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-10-21: amdgpu: - Fix a potential out of bounds write in debugfs - Fix revision handling for Yellow Carp - Display fixes for Yellow Carp Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20211021203430.4578-1-alexander.deucher@amd.com commit d25f27432f80a800a3592db128254c8140bd71bf Merge: 3906fe9bb7f1a 05d5da3cb11c9 Author: Linus Torvalds Date: Tue Oct 26 15:24:33 2021 -0700 Merge tag 'arm-soc-fixes-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "One last set of small fixes for the soc tree: - Incorrect ethernet phy settings found on i.mx and allwinner platforms - a revert for a Qualcomm DT change that caused a boot regression - four patches for incorrect settings in i.MX DT files - new MAINTAINER file entries for dhcom boards - a Kconfig fix for a reset driver that became unselectable - three more code changes for bugs in reset drivers" * tag 'arm-soc-fixes-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: Add maintainers for DHCOM i.MX6 and DHCOM/DHCOR STM32MP1 Revert "arm64: dts: qcom: sm8250: remove bus clock from the mdss node for sm8250 target" arm64: dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY arm64: dts: imx8mm-kontron: Fix CAN SPI clock frequency arm64: dts: imx8mm-kontron: Fix polarity of reg_rst_eth2 arm64: dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV arm64: dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are correct reset: socfpga: add empty driver allowing consumers to probe reset: tegra-bpmp: Handle errors in BPMP response reset: pistachio: Re-enable driver selection reset: brcmstb-rescal: fix incorrect polarity of status bit ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node commit 9586e67b911c95ba158fcc247b230e9c2d718623 Author: Naohiro Aota Date: Wed Oct 27 01:51:27 2021 +0900 block: schedule queue restart after BLK_STS_ZONE_RESOURCE When dispatching a zone append write request to a SCSI zoned block device, if the target zone of the request is already locked, the device driver will return BLK_STS_ZONE_RESOURCE and the request will be pushed back to the hctx dipatch queue. The queue will be marked as RESTART in dd_finish_request() and restarted in __blk_mq_free_request(). However, this restart applies to the hctx of the completed request. If the requeued request is on a different hctx, dispatch will no be retried until another request is submitted or the next periodic queue run triggers, leading to up to 30 seconds latency for the requeued request. Fix this problem by scheduling a queue restart similarly to the BLK_STS_RESOURCE case or when we cannot get the budget. Also, consolidate the checks into the "need_resource" variable to simplify the condition. Signed-off-by: Naohiro Aota Reviewed-by: Christoph Hellwig Cc: Niklas Cassel Link: https://lore.kernel.org/r/20211026165127.4151055-1-naohiro.aota@wdc.com Signed-off-by: Jens Axboe commit 440ffcdd9db4758f1503a25fb49a8e15ca83d6bc Merge: 19fa0887c57d3 54713c85f5360 Author: Jakub Kicinski Date: Tue Oct 26 14:38:54 2021 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2021-10-26 We've added 12 non-merge commits during the last 7 day(s) which contain a total of 23 files changed, 118 insertions(+), 98 deletions(-). The main changes are: 1) Fix potential race window in BPF tail call compatibility check, from Toke Høiland-Jørgensen. 2) Fix memory leak in cgroup fs due to missing cgroup_bpf_offline(), from Quanyang Wang. 3) Fix file descriptor reference counting in generic_map_update_batch(), from Xu Kuohai. 4) Fix bpf_jit_limit knob to the max supported limit by the arch's JIT, from Lorenz Bauer. 5) Fix BPF sockmap ->poll callbacks for UDP and AF_UNIX sockets, from Cong Wang and Yucong Sun. 6) Fix BPF sockmap concurrency issue in TCP on non-blocking sendmsg calls, from Liu Jian. 7) Fix build failure of INODE_STORAGE and TASK_STORAGE maps on !CONFIG_NET, from Tejun Heo. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix potential race in tail call compatibility check bpf: Move BPF_MAP_TYPE for INODE_STORAGE and TASK_STORAGE outside of CONFIG_NET selftests/bpf: Use recv_timeout() instead of retries net: Implement ->sock_is_readable() for UDP and AF_UNIX skmsg: Extract and reuse sk_msg_is_readable() net: Rename ->stream_memory_read to ->sock_is_readable tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function cgroup: Fix memory leak caused by missing cgroup_bpf_offline bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch() bpf: Prevent increasing bpf_jit_limit above max bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT bpf: Define bpf_jit_alloc_exec_limit for riscv JIT ==================== Link: https://lore.kernel.org/r/20211026201920.11296-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 54713c85f536048e685258f880bf298a74c3620d Author: Toke Høiland-Jørgensen Date: Tue Oct 26 13:00:19 2021 +0200 bpf: Fix potential race in tail call compatibility check Lorenzo noticed that the code testing for program type compatibility of tail call maps is potentially racy in that two threads could encounter a map with an unset type simultaneously and both return true even though they are inserting incompatible programs. The race window is quite small, but artificially enlarging it by adding a usleep_range() inside the check in bpf_prog_array_compatible() makes it trivial to trigger from userspace with a program that does, essentially: map_fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, 4, 4, 2, 0); pid = fork(); if (pid) { key = 0; value = xdp_fd; } else { key = 1; value = tc_fd; } err = bpf_map_update_elem(map_fd, &key, &value, 0); While the race window is small, it has potentially serious ramifications in that triggering it would allow a BPF program to tail call to a program of a different type. So let's get rid of it by protecting the update with a spinlock. The commit in the Fixes tag is the last commit that touches the code in question. v2: - Use a spinlock instead of an atomic variable and cmpxchg() (Alexei) v3: - Put lock and the members it protects into an embedded 'owner' struct (Daniel) Fixes: 3324b584b6f6 ("ebpf: misc core cleanup") Reported-by: Lorenzo Bianconi Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211026110019.363464-1-toke@redhat.com commit 99d0a3831e3500d945162cdb2310e3a5fce90b60 Author: Tejun Heo Date: Thu Oct 21 08:46:10 2021 -1000 bpf: Move BPF_MAP_TYPE for INODE_STORAGE and TASK_STORAGE outside of CONFIG_NET bpf_types.h has BPF_MAP_TYPE_INODE_STORAGE and BPF_MAP_TYPE_TASK_STORAGE declared inside #ifdef CONFIG_NET although they are built regardless of CONFIG_NET. So, when CONFIG_BPF_SYSCALL && !CONFIG_NET, they are built without the declarations leading to spurious build failures and not registered to bpf_map_types making them unavailable. Fix it by moving the BPF_MAP_TYPE for the two map types outside of CONFIG_NET. Reported-by: kernel test robot Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs") Signed-off-by: Tejun Heo Signed-off-by: Alexei Starovoitov Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/YXG1cuuSJDqHQfRY@slm.duckdns.org commit a94b5aae2a40b164f1d67c37f466f06cb1398ef0 Merge: cd9733f5d75c9 67b821502dbd6 Author: Alexei Starovoitov Date: Tue Oct 26 12:29:33 2021 -0700 Merge branch 'sock_map: fix ->poll() and update selftests' Cong Wang says: ==================== This patchset fixes ->poll() for sockets in sockmap and updates selftests accordingly with select(). Please check each patch for more details. Fixes: c50524ec4e3a ("Merge branch 'sockmap: add sockmap support for unix datagram socket'") Fixes: 89d69c5d0fbc ("Merge branch 'sockmap: introduce BPF_SK_SKB_VERDICT and support UDP'") Acked-by: John Fastabend --- v4: add a comment in udp_poll() v3: drop sk_psock_get_checked() reuse tcp_bpf_sock_is_readable() v2: rename and reuse ->stream_memory_read() fix a compile error in sk_psock_get_checked() Cong Wang (3): net: rename ->stream_memory_read to ->sock_is_readable skmsg: extract and reuse sk_msg_is_readable() net: implement ->sock_is_readable() for UDP and AF_UNIX ==================== Reviewed-by: Jakub Sitnicki Acked-by: John Fastabend Signed-off-by: Alexei Starovoitov commit 67b821502dbd6c9b23715da79cb9b37fa7d969dc Author: Yucong Sun Date: Fri Oct 8 13:33:06 2021 -0700 selftests/bpf: Use recv_timeout() instead of retries We use non-blocking sockets in those tests, retrying for EAGAIN is ugly because there is no upper bound for the packet arrival time, at least in theory. After we fix poll() on sockmap sockets, now we can switch to select()+recv(). Signed-off-by: Yucong Sun Signed-off-by: Cong Wang Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211008203306.37525-5-xiyou.wangcong@gmail.com commit af493388950b6ea3a86f860cfaffab137e024fc8 Author: Cong Wang Date: Fri Oct 8 13:33:05 2021 -0700 net: Implement ->sock_is_readable() for UDP and AF_UNIX Yucong noticed we can't poll() sockets in sockmap even when they are the destination sockets of redirections. This is because we never poll any psock queues in ->poll(), except for TCP. With ->sock_is_readable() now we can overwrite >sock_is_readable(), invoke and implement it for both UDP and AF_UNIX sockets. Reported-by: Yucong Sun Signed-off-by: Cong Wang Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211008203306.37525-4-xiyou.wangcong@gmail.com commit fb4e0a5e73d4bb5ab69b7905abd2ec3b580e9b59 Author: Cong Wang Date: Fri Oct 8 13:33:04 2021 -0700 skmsg: Extract and reuse sk_msg_is_readable() tcp_bpf_sock_is_readable() is pretty much generic, we can extract it and reuse it for non-TCP sockets. Signed-off-by: Cong Wang Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211008203306.37525-3-xiyou.wangcong@gmail.com commit 7b50ecfcc6cdfe87488576bc3ed443dc8d083b90 Author: Cong Wang Date: Fri Oct 8 13:33:03 2021 -0700 net: Rename ->stream_memory_read to ->sock_is_readable The proto ops ->stream_memory_read() is currently only used by TCP to check whether psock queue is empty or not. We need to rename it before reusing it for non-TCP protocols, and adjust the exsiting users accordingly. Signed-off-by: Cong Wang Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211008203306.37525-2-xiyou.wangcong@gmail.com commit cd9733f5d75c94a32544d6ce5be47e14194cf137 Author: Liu Jian Date: Tue Oct 12 13:20:19 2021 +0800 tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function With two Msgs, msgA and msgB and a user doing nonblocking sendmsg calls (or multiple cores) on a single socket 'sk' we could get the following flow. msgA, sk msgB, sk ----------- --------------- tcp_bpf_sendmsg() lock(sk) psock = sk->psock tcp_bpf_sendmsg() lock(sk) ... blocking tcp_bpf_send_verdict if (psock->eval == NONE) psock->eval = sk_psock_msg_verdict .. < handle SK_REDIRECT case > release_sock(sk) < lock dropped so grab here > ret = tcp_bpf_sendmsg_redir psock = sk->psock tcp_bpf_send_verdict lock_sock(sk) ... blocking on B if (psock->eval == NONE) <- boom. psock->eval will have msgA state The problem here is we dropped the lock on msgA and grabbed it with msgB. Now we have old state in psock and importantly psock->eval has not been cleared. So msgB will run whatever action was done on A and the verdict program may never see it. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian Signed-off-by: Alexei Starovoitov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20211012052019.184398-1-liujian56@huawei.com commit 61b1d445f3bfe4c3ba4335ceeb7e8ba688fd31e2 Author: Mario Date: Tue Oct 26 13:27:37 2021 +0200 drm: panel-orientation-quirks: Add quirk for GPD Win3 Fixes screen orientation for GPD Win 3 handheld gaming console. Signed-off-by: Mario Risoldi Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211026112737.9181-1-awxkrnl@gmail.com commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 Author: Walter Stoll Date: Thu Oct 14 12:22:29 2021 +0200 watchdog: Fix OMAP watchdog early handling TI's implementation does not service the watchdog even if the kernel command line parameter omap_wdt.early_enable is set to 1. This patch fixes the issue. Signed-off-by: Walter Stoll Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit abd1c6adc16d1b82109a29b570fc545b775049d5 Author: Guenter Roeck Date: Fri Sep 10 21:29:25 2021 -0700 watchdog: ixp4xx_wdt: Fix address space warning sparse reports the following address space warning. drivers/watchdog/ixp4xx_wdt.c:122:20: sparse: incorrect type in assignment (different address spaces) drivers/watchdog/ixp4xx_wdt.c:122:20: sparse: expected void [noderef] __iomem *base drivers/watchdog/ixp4xx_wdt.c:122:20: sparse: got void *platform_data Add a typecast to solve the problem. Fixes: 21a0a29d16c6 ("watchdog: ixp4xx: Rewrite driver to use core") Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20210911042925.556889-1-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit bcc3e704f1b73f7f8674364f0bda6593bbc9fd2b Author: Krzysztof Kozlowski Date: Fri Sep 17 11:20:23 2021 +0200 watchdog: sbsa: drop unneeded MODULE_ALIAS The MODULE_DEVICE_TABLE already creates proper alias for platform driver. Having another MODULE_ALIAS causes the alias to be duplicated. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20210917092024.19323-1-krzysztof.kozlowski@canonical.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f31afb502c3151855df3ed40f5974c7884c10d14 Author: Jamie Iles Date: Fri Sep 3 12:21:01 2021 +0100 watchdog: sbsa: only use 32-bit accessors SBSA says of the generic watchdog: All registers are 32 bits in size and should be accessed using 32-bit reads and writes. If an access size other than 32 bits is used then the results are IMPLEMENTATION DEFINED. and for qemu, the implementation will only allow 32-bit accesses resulting in a synchronous external abort when configuring the watchdog. Use lo_hi_* accessors rather than a readq/writeq. Fixes: abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") Signed-off-by: Jamie Iles Reviewed-by: Guenter Roeck Reviewed-by: Shaokun Zhang Link: https://lore.kernel.org/r/20210903112101.493552-1-quic_jiles@quicinc.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6e7733ef0bb9372d5491168635f6ecba8ac3cb8a Author: Guenter Roeck Date: Thu Oct 7 17:33:02 2021 -0700 Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" This reverts commit cb011044e34c ("watchdog: iTCO_wdt: Account for rebooting on second timeout") and commit aec42642d91f ("watchdog: iTCO_wdt: Fix detection of SMI-off case") since those patches cause a regression on certain boards (https://bugzilla.kernel.org/show_bug.cgi?id=213809). While this revert may result in some boards to only reset after twice the configured timeout value, that is still better than a watchdog reset after half the configured value. Fixes: cb011044e34c ("watchdog: iTCO_wdt: Account for rebooting on second timeout") Fixes: aec42642d91f ("watchdog: iTCO_wdt: Fix detection of SMI-off case") Cc: Jan Kiszka Cc: Mantas Mikulėnas Reported-by: Javier S. Pedro Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20211008003302.1461733-1-linux@roeck-us.net Signed-off-by: Wim Van Sebroeck commit 92b18252b91de567cd875f2e84722b10ab34ee28 Author: Wenbin Mei Date: Tue Oct 26 15:08:12 2021 +0800 mmc: cqhci: clear HALT state after CQE enable While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush cache) and disable cqe, for resume back, we enable CQE and not clear HALT state. In this case MediaTek mmc host controller will keep the value for HALT state after CQE disable/enable flow, so the next CQE transfer after resume will be timeout due to CQE is in HALT state, the log as below: <4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP =========== <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps: 0x100020b6 | Version: 0x00000510 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config: 0x00001103 | Control: 0x00000001 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat: 0x00000000 | Int enab: 0x00000006 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig: 0x00000006 | Int Coal: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base: 0xfd05f000 | TDL up32: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell: 0x8000203c | TCN: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr: 0x00000000 | SSC1: 0x00001000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2: 0x00000001 | DCMD rsp: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask: 0xfdf9a080 | TERRI: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx: 0x00000000 | Resp arg: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP: 0x00000000 | CRNQDUN: 0x00000000 <4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS: 0x00000000 | CRNQIE: 0x00000000 This change check HALT state after CQE enable, if CQE is in HALT state, we will clear it. Signed-off-by: Wenbin Mei Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Link: https://lore.kernel.org/r/20211026070812.9359-1-wenbin.mei@mediatek.com Signed-off-by: Ulf Hansson commit 8c8171929116cc23f74743d99251eedadf62341a Author: Johan Hovold Date: Mon Oct 25 13:56:08 2021 +0200 mmc: vub300: fix control-message timeouts USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org Signed-off-by: Ulf Hansson commit 697542bceae51f7620af333b065dd09d213629fb Author: Jaehoon Chung Date: Fri Oct 22 17:21:06 2021 +0900 mmc: dw_mmc: exynos: fix the finding clock sample value Even though there are candiates value if can't find best value, it's returned -EIO. It's not proper behavior. If there is not best value, use a first candiate value to work eMMC. Signed-off-by: Jaehoon Chung Tested-by: Marek Szyprowski Tested-by: Christian Hewitt Cc: stable@vger.kernel.org Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence") Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com Signed-off-by: Ulf Hansson commit 05d5da3cb11c91c39e607066d3313a6ce621796a Author: Christoph Niedermaier Date: Mon Oct 25 09:37:06 2021 +0200 MAINTAINERS: Add maintainers for DHCOM i.MX6 and DHCOM/DHCOR STM32MP1 Add maintainers for DH electronics DHCOM i.MX6 and DHCOM/DHCOR STM32MP1 boards. Signed-off-by: Christoph Niedermaier Cc: linux-arm-kernel@lists.infradead.org Cc: kernel@dh-electronics.com Cc: arnd@arndb.de Link: https://lore.kernel.org/r/20211025073706.2794-1-cniedermaier@dh-electronics.com' To: soc@kernel.org To: linux-kernel@vger.kernel.org Signed-off-by: Arnd Bergmann commit d308ae0d299a6bb15be4efb91849582d19c23213 Author: Ming Lei Date: Tue Oct 26 18:12:04 2021 +0800 block: drain queue after disk is removed from sysfs Before removing disk from sysfs, userspace still may change queue via sysfs, such as switching elevator or setting wbt latency, both may reinitialize wbt, then the warning in blk_free_queue_stats() will be triggered since rq_qos_exit() is moved to del_gendisk(). Fixes the issue by moving draining queue & tearing down after disk is removed from sysfs, at that time no one can come into queue's store()/show(). Reported-by: Yi Zhang Tested-by: Yi Zhang Fixes: 8e141f9eb803 ("block: drain file system I/O on del_gendisk") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20211026101204.2897166-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit f44e8f91b89d42af0dd26f3b299a0c055d5737e0 Merge: 36b6dcbc1245a e091b836a3bae Author: Arnd Bergmann Date: Tue Oct 26 16:20:49 2021 +0200 Merge tag 'qcom-arm64-fixes-for-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DTS one more fix for 5.15 This reverts a clock change in the Qualcomm RB5 devicetree which in some combinations of firmware and configuration causes the device to crash during boot. Data on an adjacent platform indicates that this is probably not be the root cause of the problem, but this resolves the regression seen on RB5 and will allow the SM8250 platform to boot v5.15. * tag 'qcom-arm64-fixes-for-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: Revert "arm64: dts: qcom: sm8250: remove bus clock from the mdss node for sm8250 target" Link: https://lore.kernel.org/r/20211025201213.1145348-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 19fa0887c57d35b57bfb895e6caf8e72d9601ec0 Author: Vadym Kochan Date: Tue Oct 26 15:19:07 2021 +0300 MAINTAINERS: please remove myself from the Prestera driver Signed-off-by: Vadym Kochan Signed-off-by: David S. Miller commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 Author: Johan Hovold Date: Tue Oct 26 12:36:17 2021 +0200 net: lan78xx: fix division by zero in send path Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in lan78xx_tx_bh() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Cc: stable@vger.kernel.org # 4.3 Cc: Woojung.Huh@microchip.com Signed-off-by: Johan Hovold Signed-off-by: David S. Miller commit 6f68cd634856f8ca93bafd623ba5357e0f648c68 Author: Pavel Skripkin Date: Sun Oct 24 16:13:56 2021 +0300 net: batman-adv: fix error handling Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init(). Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1] To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions. So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields. Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1] Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Pavel Skripkin Acked-by: Sven Eckelmann Signed-off-by: David S. Miller commit fa40d9734a57bcbfa79a280189799f76c88f7bb0 Author: Max VA Date: Mon Oct 25 17:31:53 2021 +0200 tipc: fix size validations for the MSG_CRYPTO type The function tipc_crypto_key_rcv is used to parse MSG_CRYPTO messages to receive keys from other nodes in the cluster in order to decrypt any further messages from them. This patch verifies that any supplied sizes in the message body are valid for the received message. Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange") Signed-off-by: Max VA Acked-by: Ying Xue Signed-off-by: Greg Kroah-Hartman Acked-by: Jon Maloy Signed-off-by: David S. Miller commit 2195f2062e4cc93870da8e71c318ef98a1c51cef Author: Krzysztof Kozlowski Date: Mon Oct 25 16:49:36 2021 +0200 nfc: port100: fix using -ERRNO as command type mask During probing, the driver tries to get a list (mask) of supported command types in port100_get_command_type_mask() function. The value is u64 and 0 is treated as invalid mask (no commands supported). The function however returns also -ERRNO as u64 which will be interpret as valid command mask. Return 0 on every error case of port100_get_command_type_mask(), so the probing will stop. Cc: Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation") Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit eacd68b7ceaa82a5d15a286f727000cef898c0b0 Merge: 9122a70a63337 fd1b5beb177a8 Author: David S. Miller Date: Tue Oct 26 13:26:09 2021 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-10-25 This series contains updates to ice driver only. Dave adds event handler for LAG NETDEV_UNREGISTER to unlink device from link aggregate. Yongxin Liu adds a check for PTP support during release which would cause a call trace on non-PTP supported devices. ==================== Signed-off-by: David S. Miller commit 9122a70a6333705c0c35614ddc51c274ed1d3637 Author: Cyril Strejc Date: Sun Oct 24 22:14:25 2021 +0200 net: multicast: calculate csum of looped-back and forwarded packets During a testing of an user-space application which transmits UDP multicast datagrams and utilizes multicast routing to send the UDP datagrams out of defined network interfaces, I've found a multicast router does not fill-in UDP checksum into locally produced, looped-back and forwarded UDP datagrams, if an original output NIC the datagrams are sent to has UDP TX checksum offload enabled. The datagrams are sent malformed out of the NIC the datagrams have been forwarded to. It is because: 1. If TX checksum offload is enabled on the output NIC, UDP checksum is not calculated by kernel and is not filled into skb data. 2. dev_loopback_xmit(), which is called solely by ip_mc_finish_output(), sets skb->ip_summed = CHECKSUM_UNNECESSARY unconditionally. 3. Since 35fc92a9 ("[NET]: Allow forwarding of ip_summed except CHECKSUM_COMPLETE"), the ip_summed value is preserved during forwarding. 4. If ip_summed != CHECKSUM_PARTIAL, checksum is not calculated during a packet egress. The minimum fix in dev_loopback_xmit(): 1. Preserves skb->ip_summed CHECKSUM_PARTIAL. This is the case when the original output NIC has TX checksum offload enabled. The effects are: a) If the forwarding destination interface supports TX checksum offloading, the NIC driver is responsible to fill-in the checksum. b) If the forwarding destination interface does NOT support TX checksum offloading, checksums are filled-in by kernel before skb is submitted to the NIC driver. c) For local delivery, checksum validation is skipped as in the case of CHECKSUM_UNNECESSARY, thanks to skb_csum_unnecessary(). 2. Translates ip_summed CHECKSUM_NONE to CHECKSUM_UNNECESSARY. It means, for CHECKSUM_NONE, the behavior is unmodified and is there to skip a looped-back packet local delivery checksum validation. Signed-off-by: Cyril Strejc Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 Author: Thomas Perrot Date: Fri Oct 22 16:21:04 2021 +0200 spi: spl022: fix Microwire full duplex mode There are missing braces in the function that verify controller parameters, then an error is always returned when the parameter to select Microwire frames operation is used on devices allowing it. Signed-off-by: Thomas Perrot Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com Signed-off-by: Mark Brown commit 25e1f67eda4a19c91dc05c84d6d413c53efb447b Author: Sagi Grimberg Date: Sun Oct 24 10:43:31 2021 +0300 nvme-tcp: fix H2CData PDU send accounting (again) We should not access request members after the last send, even to determine if indeed it was the last data payload send. The reason is that a completion could have arrived and trigger a new execution of the request which overridden these members. This was fixed by commit 825619b09ad3 ("nvme-tcp: fix possible use-after-completion"). Commit e371af033c56 broke that assumption again to address cases where multiple r2t pdus are sent per request. To fix it, we need to record the request data_sent and data_len and after the payload network send we reference these counters to determine weather we should advance the request iterator. Fixes: e371af033c56 ("nvme-tcp: fix incorrect h2cdata pdu offset accounting") Reported-by: Keith Busch Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Sagi Grimberg Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 926245c7d22271307606c88b1fbb2539a8550e94 Author: Maurizio Lombardi Date: Fri Oct 15 10:26:34 2021 +0200 nvmet-tcp: fix a memory leak when releasing a queue page_frag_free() won't completely release the memory allocated for the commands, the cache page must be explicitly freed by calling __page_frag_cache_drain(). This bug can be easily reproduced by repeatedly executing the following command on the initiator: $echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Reviewed-by: John Meneghini Signed-off-by: Christoph Hellwig commit 6e6f96630805874fa80b0067e1a57aafc06225f6 Author: Imre Deak Date: Mon Oct 18 12:41:49 2021 +0300 drm/i915/dp: Skip the HW readout of DPCD on disabled encoders Reading out the DP encoders' DPCD during booting or resume is only required for enabled encoders: such encoders may be modesetted during the initial commit and the link training this involves depends on an initialized DPCD. For DDI encoders reading out the DPCD is skipped, do the same on pre-DDI platforms. Atm, the first DPCD readout without a sink connected - which is a likely scneario if the encoder is disabled - leaves intel_dp->num_common_rates at 0, which resulted in intel_dp_sync_state()->intel_dp_max_common_rate() in a intel_dp->common_rates[-1] access. This by definition results in an undefined behaviour, though to my best knowledge in all HW/compiler configurations it actually results in accessing the array item type value preceding the array. In this case the preceding value happens to be intel_dp->num_common_rates, which is 0, so this issue - by luck - didn't cause a user visible problem. Nevertheless it's still an undefined behaviour and in CONFIG_UBSAN builds leads to a kernel BUG() (which revealed this problem for us), hence CC:stable. A related problem in case the encoder is enabled but the sink is not connected or the DPCD readout fails is fixed by the next patch. v2: Amend the commit message describing the root cause of the CONFIG_UBSAN BUG(). Fixes: a532cde31de3 ("drm/i915/tc: Fix TypeC port init/resume time sanitization") References: https://gitlab.freedesktop.org/drm/intel/-/issues/4297 Reported-and-tested-by: Mat Jonczyk Cc: Mat Jonczyk Cc: José Roberto de Souza Cc: Jani Nikula Cc: Ville Syrjälä Cc: Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Acked-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20211018094154.1407705-2-imre.deak@intel.com (cherry picked from commit 4ec5ffc341cecbea060739aea1d53398ac2ec3f8) Signed-off-by: Jani Nikula commit 9761ffb8f1090289b908590039e2c363cc35cf45 Author: Ville Syrjälä Date: Thu Oct 14 12:09:40 2021 +0300 drm/i915: Catch yet another unconditioal clflush Replace the unconditional clflush() with drm_clflush_virt_range() which does the wbinvd() fallback when clflush is not available. This time no justification is given for the clflush in the offending commit. Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Cc: Thomas Hellström Fixes: 2c8ab3339e39 ("drm/i915: Pin timeline map after first timeline pin, v4.") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-4-ville.syrjala@linux.intel.com Reviewed-by: Dave Airlie (cherry picked from commit 9ced12182d0d8401d821e9602e56e276459900fc) Signed-off-by: Jani Nikula commit fcf918ffd3b35e288097036c04af7446b2c6f2f1 Author: Ville Syrjälä Date: Thu Oct 14 12:09:39 2021 +0300 drm/i915: Convert unconditional clflush to drm_clflush_virt_range() This one is apparently a "clflush for good measure", so bit more justification (if you can call it that) than some of the others. Convert to drm_clflush_virt_range() again so that machines without clflush will survive the ordeal. Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Cc: Thomas Hellström #v1 Fixes: 12ca695d2c1e ("drm/i915: Do not share hwsp across contexts any more, v8.") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20211014090941.12159-3-ville.syrjala@linux.intel.com Reviewed-by: Dave Airlie (cherry picked from commit af7b6d234eefa30c461cc16912bafb32b9e6141c) Signed-off-by: Jani Nikula commit 759635760a804b0d8ad0cc677b650f1544cae22f Author: Ido Schimmel Date: Sun Oct 24 09:40:14 2021 +0300 mlxsw: pci: Recycle received packet upon allocation failure When the driver fails to allocate a new Rx buffer, it passes an empty Rx descriptor (contains zero address and size) to the device and marks it as invalid by setting the skb pointer in the descriptor's metadata to NULL. After processing enough Rx descriptors, the driver will try to process the invalid descriptor, but will return immediately seeing that the skb pointer is NULL. Since the driver no longer passes new Rx descriptors to the device, the Rx queue will eventually become full and the device will start to drop packets. Fix this by recycling the received packet if allocation of the new packet failed. This means that allocation is no longer performed at the end of the Rx routine, but at the start, before tearing down the DMA mapping of the received packet. Remove the comment about the descriptor being zeroed as it is no longer correct. This is OK because we either use the descriptor as-is (when recycling) or overwrite its address and size fields with that of the newly allocated Rx buffer. The issue was discovered when a process ("perf") consumed too much memory and put the system under memory pressure. It can be reproduced by injecting slab allocation failures [1]. After the fix, the Rx queue no longer comes to a halt. [1] # echo 10 > /sys/kernel/debug/failslab/times # echo 1000 > /sys/kernel/debug/failslab/interval # echo 100 > /sys/kernel/debug/failslab/probability FAULT_INJECTION: forcing a failure. name failslab, interval 1000, probability 100, space 0, times 8 [...] Call Trace: dump_stack_lvl+0x34/0x44 should_fail.cold+0x32/0x37 should_failslab+0x5/0x10 kmem_cache_alloc_node+0x23/0x190 __alloc_skb+0x1f9/0x280 __netdev_alloc_skb+0x3a/0x150 mlxsw_pci_rdq_skb_alloc+0x24/0x90 mlxsw_pci_cq_tasklet+0x3dc/0x1200 tasklet_action_common.constprop.0+0x9f/0x100 __do_softirq+0xb5/0x252 irq_exit_rcu+0x7a/0xa0 common_interrupt+0x83/0xa0 asm_common_interrupt+0x1e/0x40 RIP: 0010:cpuidle_enter_state+0xc8/0x340 [...] mlxsw_spectrum2 0000:06:00.0: Failed to alloc skb for RDQ Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Link: https://lore.kernel.org/r/20211024064014.1060919-1-idosch@idosch.org Signed-off-by: Jakub Kicinski commit 3dd60fb9d95db9c78fec86ba4df20852a7b974ba Author: Christoph Hellwig Date: Tue Oct 19 09:36:40 2021 +0200 nvdimm/pmem: stop using q_usage_count as external pgmap refcount Originally all DAX access when through block_device operations and thus needed a queue reference. But since commit cccbce671582 ("filesystem-dax: convert to dax_direct_access()") all this happens at the DAX device level which uses its own refcounting. Having the external refcount thus wasn't needed but has otherwise been harmless for long time. But now that "block: drain file system I/O on del_gendisk" waits for q_usage_count to reach 0 in del_gendisk this whole scheme can't work anymore (and pmem is the only driver abusing q_usage_count like that). So switch to the internal reference and remove the unbalanced blk_freeze_queue_start that is taken care of by del_gendisk. Fixes: 8e141f9eb803 ("block: drain file system I/O on del_gendisk") Reported-by: Yi Zhang Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211019073641.2323410-2-hch@lst.de Signed-off-by: Dan Williams commit fd1b5beb177a8372cea2a0d014835491e4886f77 Author: Yongxin Liu Date: Mon Oct 11 15:02:16 2021 +0800 ice: check whether PTP is initialized in ice_ptp_release() PTP is currently only supported on E810 devices, it is checked in ice_ptp_init(). However, there is no check in ice_ptp_release(). For other E800 series devices, ice_ptp_release() will be wrongly executed. Fix the following calltrace. INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: ice ice_service_task [ice] Call Trace: dump_stack_lvl+0x5b/0x82 dump_stack+0x10/0x12 register_lock_class+0x495/0x4a0 ? find_held_lock+0x3c/0xb0 __lock_acquire+0x71/0x1830 lock_acquire+0x1e6/0x330 ? ice_ptp_release+0x3c/0x1e0 [ice] ? _raw_spin_lock+0x19/0x70 ? ice_ptp_release+0x3c/0x1e0 [ice] _raw_spin_lock+0x38/0x70 ? ice_ptp_release+0x3c/0x1e0 [ice] ice_ptp_release+0x3c/0x1e0 [ice] ice_prepare_for_reset+0xcb/0xe0 [ice] ice_do_reset+0x38/0x110 [ice] ice_service_task+0x138/0xf10 [ice] ? __this_cpu_preempt_check+0x13/0x20 process_one_work+0x26a/0x650 worker_thread+0x3f/0x3b0 ? __kthread_parkme+0x51/0xb0 ? process_one_work+0x650/0x650 kthread+0x161/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 Fixes: 4dd0d5c33c3e ("ice: add lock around Tx timestamp tracker flush") Signed-off-by: Yongxin Liu Reviewed-by: Jacob Keller Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 6a8b357278f5f8b9817147277ab8f12879dce8a8 Author: Dave Ertman Date: Thu Oct 7 08:40:31 2021 -0700 ice: Respond to a NETDEV_UNREGISTER event for LAG When the PF is a member of a link aggregate, and the driver is removed, the process will hang unless we respond to the NETDEV_UNREGISTER event that is sent to the event_handler for LAG. Add a case statement for the ice_lag_event_handler to unlink the PF from the link aggregate. Also remove code that was incorrectly applying a dev_hold to peer_netdevs that were associated with the ice driver. Fixes: df006dd4b1dc ("ice: Add initial support framework for LAG") Signed-off-by: Dave Ertman Tested-by: Tony Brelinski Signed-off-by: Tony Nguyen commit e091b836a3baee4c8b1423a969589196b88a9e06 Author: Amit Pundir Date: Thu Oct 14 16:54:10 2021 +0300 Revert "arm64: dts: qcom: sm8250: remove bus clock from the mdss node for sm8250 target" This reverts commit 001ce9785c0674d913531345e86222c965fc8bf4. This upstream commit broke AOSP (post Android 12 merge) build on RB5. The device either silently crashes into USB crash mode after android boot animation or we see a blank blue screen with following dpu errors in dmesg: [ T444] hw recovery is not complete for ctl:3 [ T444] [drm:dpu_encoder_phys_vid_prepare_for_kickoff:539] [dpu error]enc31 intf1 ctl 3 reset failure: -22 [ T444] [drm:dpu_encoder_phys_vid_wait_for_commit_done:513] [dpu error]vblank timeout [ T444] [drm:dpu_kms_wait_for_commit_done:454] [dpu error]wait for commit done returned -110 [ C7] [drm:dpu_encoder_frame_done_timeout:2127] [dpu error]enc31 frame done timeout [ T444] [drm:dpu_encoder_phys_vid_wait_for_commit_done:513] [dpu error]vblank timeout [ T444] [drm:dpu_kms_wait_for_commit_done:454] [dpu error]wait for commit done returned -110 Fixes: 001ce9785c06 ("arm64: dts: qcom: sm8250: remove bus clock from the mdss node for sm8250 target") Signed-off-by: Amit Pundir Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20211014135410.4136412-1-dmitry.baryshkov@linaro.org commit 3906fe9bb7f1a2c8667ae54e967dc8690824f4ea Author: Linus Torvalds Date: Mon Oct 25 11:30:31 2021 -0700 Linux 5.15-rc7 commit cb685432398122053f3e1dc6a1d68924e5b77be4 Author: Matthew Wilcox (Oracle) Date: Mon Oct 25 19:16:34 2021 +0100 secretmem: Prevent secretmem_users from wrapping to zero Commit 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t") attempted to fix the problem of secretmem_users wrapping to zero and allowing suspend once again. But it was reverted in commit 87066fdd2e30 ("Revert 'mm/secretmem: use refcount_t instead of atomic_t'") because of the problems it caused - a refcount_t was not semantically the right type to use. Instead prevent secretmem_users from wrapping to zero by forbidding new users if the number of users has wrapped from positive to negative. This stops a long way short of reaching the necessary 4 billion users where it wraps to zero again, so there's no need to be clever with special anti-wrap types or checking the return value from atomic_inc(). Signed-off-by: Matthew Wilcox (Oracle) Cc: Jordy Zomer Cc: Kees Cook , Cc: James Bottomley Cc: Mike Rapoport Cc: Andrew Morton Signed-off-by: Linus Torvalds commit ac8a6eba2a117e0fdc04da62ab568d1b7ca4c8f6 Author: Linus Torvalds Date: Mon Oct 25 10:46:41 2021 -0700 spi: Fix tegra20 build with CONFIG_PM=n once again Commit efafec27c565 ("spi: Fix tegra20 build with CONFIG_PM=n") already fixed the build without PM support once. There was an alternative fix by Guenter in commit 2bab94090b01 ("spi: tegra20-slink: Declare runtime suspend and resume functions conditionally"), and Mark then merged the two correctly in ffb1e76f4f32 ("Merge tag 'v5.15-rc2' into spi-5.15"). But for some inexplicable reason, Mark then merged things _again_ in commit 59c4e190b10c ("Merge tag 'v5.15-rc3' into spi-5.15"), and screwed things up at that point, and the __maybe_unused attribute on tegra_slink_runtime_resume() went missing. Reinstate it, so that alpha (and other architectures without PM support) builds cleanly again. Btw, this is another prime example of how random back-merges are not good. Just don't do them. Subsystem developers should not merge my tree in any normal circumstances. Both of those merge commits pointed to above are bad: even the one that got the merge result right doesn't even mention _why_ it was done, and the one that got it wrong is obviously broken. Reported-by: Guenter Roeck Cc: Mark Brown Signed-off-by: Linus Torvalds commit c2b43854aad9e52b422e6c6342a1da2261f98fa5 Merge: 4862649f16e79 00568b8a6364e Author: Linus Torvalds Date: Mon Oct 25 10:28:52 2021 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: - Fix clang-related relocation warning in futex code - Fix incorrect use of get_kernel_nofault() - Fix bad code generation in __get_user_check() when kasan is enabled - Ensure TLB function table is correctly aligned - Remove duplicated string function definitions in decompressor - Fix link-time orphan section warnings - Fix old-style function prototype for arch_init_kprobes() - Only warn about XIP address when not compile testing - Handle BE32 big endian for keystone2 remapping * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9148/1: handle CONFIG_CPU_ENDIAN_BE32 in arch/arm/kernel/head.S ARM: 9141/1: only warn about XIP address when not compile testing ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype ARM: 9138/1: fix link warning with XIP + frame-pointer ARM: 9134/1: remove duplicate memcpy() definition ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images ARM: 9125/1: fix incorrect use of get_kernel_nofault() ARM: 9122/1: select HAVE_FUTEX_CMPXCHG commit 4862649f16e79299b4f82a8e13dd8f9e5abcaa25 Merge: a51aec4109300 a0023bb9dd9bc Author: Linus Torvalds Date: Mon Oct 25 09:57:28 2021 -0700 Merge tag 'libata-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull libata fix from Damien Le Moal: "A single fix in this pull request addressing an invalid error code return in the sata_mv driver (from Zheyu)" * tag 'libata-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: sata_mv: Fix the error handling of mv_chip_id() commit a51aec4109300d843bf144579109d5288856f72a Merge: 87066fdd2e30f 4e5a04be88fe3 Author: Linus Torvalds Date: Mon Oct 25 09:47:18 2021 -0700 Merge tag 'pinctrl-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some late pin control fixes, the most generally annoying will probably be the AMD IRQ storm fix affecting the Microsoft surface. Summary: - Three fixes pertaining to Broadcom DT bindings. Some stuff didn't work out as inteded, we need to back out - A resume bug fix in the STM32 driver - Disable and mask the interrupts on probe in the AMD pinctrl driver, affecting Microsoft surface" * tag 'pinctrl-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: amd: disable and mask interrupts on probe pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" dt-bindings: pinctrl: brcm,ns-pinmux: drop unneeded CRU from example Revert "dt-bindings: pinctrl: bcm4708-pinmux: rework binding to use syscon" commit f7a1e76d0f608961cc2fc681f867a834f2746bce Author: Xin Long Date: Mon Oct 25 02:31:48 2021 -0400 net-sysfs: initialize uid and gid before calling net_ns_get_ownership Currently in net_ns_get_ownership() it may not be able to set uid or gid if make_kuid or make_kgid returns an invalid value, and an uninit-value issue can be triggered by this. This patch is to fix it by initializing the uid and gid before calling net_ns_get_ownership(), as it does in kobject_get_ownership() Fixes: e6dee9f3893c ("net-sysfs: add netdev_change_owner()") Reported-by: Paolo Abeni Signed-off-by: Xin Long Acked-by: Christian Brauner Signed-off-by: David S. Miller commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb Author: Dongli Zhang Date: Fri Oct 22 16:31:39 2021 -0700 xen/netfront: stop tx queues during live migration The tx queues are not stopped during the live migration. As a result, the ndo_start_xmit() may access netfront_info->queues which is freed by talk_to_netback()->xennet_destroy_queues(). This patch is to netif_device_detach() at the beginning of xen-netfront resuming, and netif_device_attach() at the end of resuming. CPU A CPU B talk_to_netback() -> if (info->queues) xennet_destroy_queues(info); to free netfront_info->queues xennet_start_xmit() to access netfront_info->queues -> err = xennet_create_queues(info, &num_queues); The idea is borrowed from virtio-net. Cc: Joe Jin Signed-off-by: Dongli Zhang Signed-off-by: David S. Miller commit 0c57eeecc559ca6bc18b8c4e2808bc78dbe769b0 Author: Michael Chan Date: Mon Oct 25 05:05:28 2021 -0400 net: Prevent infinite while loop in skb_tx_hash() Drivers call netdev_set_num_tc() and then netdev_set_tc_queue() to set the queue count and offset for each TC. So the queue count and offset for the TCs may be zero for a short period after dev->num_tc has been set. If a TX packet is being transmitted at this time in the code path netdev_pick_tx() -> skb_tx_hash(), skb_tx_hash() may see nonzero dev->num_tc but zero qcount for the TC. The while loop that keeps looping while hash >= qcount will not end. Fix it by checking the TC's qcount to be nonzero before using it. Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx") Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 64733956ebba7cc629856f4a6ee35a52bc9c023f Author: Mark Zhang Date: Sun Oct 24 09:08:20 2021 +0300 RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string When copying the device name, the length of the data memcpy copied exceeds the length of the source buffer, which cause the KASAN issue below. Use strscpy_pad() instead. BUG: KASAN: slab-out-of-bounds in ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core] Read of size 64 at addr ffff88811a10f5e0 by task rping/140263 CPU: 3 PID: 140263 Comm: rping Not tainted 5.15.0-rc1+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0+0x1d/0xa0 kasan_report+0xcb/0x110 kasan_check_range+0x13d/0x180 memcpy+0x20/0x60 ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core] ib_nl_make_request+0x1c6/0x380 [ib_core] send_mad+0x20a/0x220 [ib_core] ib_sa_path_rec_get+0x3e3/0x800 [ib_core] cma_query_ib_route+0x29b/0x390 [rdma_cm] rdma_resolve_route+0x308/0x3e0 [rdma_cm] ucma_resolve_route+0xe1/0x150 [rdma_ucm] ucma_write+0x17b/0x1f0 [rdma_ucm] vfs_write+0x142/0x4d0 ksys_write+0x133/0x160 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f26499aa90f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48 RSP: 002b:00007f26495f2dc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000000007d0 RCX: 00007f26499aa90f RDX: 0000000000000010 RSI: 00007f26495f2e00 RDI: 0000000000000003 RBP: 00005632a8315440 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000293 R12: 00007f26495f2e00 R13: 00005632a83154e0 R14: 00005632a8315440 R15: 00005632a830a810 Allocated by task 131419: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 proc_self_get_link+0x8b/0x100 pick_link+0x4f1/0x5c0 step_into+0x2eb/0x3d0 walk_component+0xc8/0x2c0 link_path_walk+0x3b8/0x580 path_openat+0x101/0x230 do_filp_open+0x12e/0x240 do_sys_openat2+0x115/0x280 __x64_sys_openat+0xce/0x140 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink") Link: https://lore.kernel.org/r/72ede0f6dab61f7f23df9ac7a70666e07ef314b0.1635055496.git.leonro@nvidia.com Signed-off-by: Mark Zhang Reviewed-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit ace19b992436a257d9a793672e57abc28fe83e2e Author: Trevor Woerner Date: Sun Oct 24 13:50:02 2021 -0400 net: nxp: lpc_eth.c: avoid hang when bringing interface down A hard hang is observed whenever the ethernet interface is brought down. If the PHY is stopped before the LPC core block is reset, the SoC will hang. Comparing lpc_eth_close() and lpc_eth_open() I re-arranged the ordering of the functions calls in lpc_eth_close() to reset the hardware before stopping the PHY. Fixes: b7370112f519 ("lpc32xx: Added ethernet driver") Signed-off-by: Trevor Woerner Acked-by: Vladimir Zapolskiy Signed-off-by: David S. Miller commit 689a0a9f505f7bffdefe6f17fddb41c8ab6344f6 Author: Janusz Dziedzic Date: Sun Oct 24 22:15:46 2021 +0200 cfg80211: correct bridge/4addr mode check Without the patch we fail: $ sudo brctl addbr br0 $ sudo brctl addif br0 wlp1s0 $ sudo iw wlp1s0 set 4addr on command failed: Device or resource busy (-16) Last command failed but iface was already in 4addr mode. Fixes: ad4bb6f8883a ("cfg80211: disallow bridging managed/adhoc interfaces") Signed-off-by: Janusz Dziedzic Link: https://lore.kernel.org/r/20211024201546.614379-1-janusz.dziedzic@gmail.com [add fixes tag, fix indentation, edit commit log] Signed-off-by: Johannes Berg commit 09b1d5dc6ce1c9151777f6c4e128a59457704c97 Author: Johannes Berg Date: Mon Oct 25 13:31:12 2021 +0200 cfg80211: fix management registrations locking The management registrations locking was broken, the list was locked for each wdev, but cfg80211_mgmt_registrations_update() iterated it without holding all the correct spinlocks, causing list corruption. Rather than trying to fix it with fine-grained locking, just move the lock to the wiphy/rdev (still need the list on each wdev), we already need to hold the wdev lock to change it, so there's no contention on the lock in any case. This trivially fixes the bug since we hold one wdev's lock already, and now will hold the lock that protects all lists. Cc: stable@vger.kernel.org Reported-by: Jouni Malinen Fixes: 6cd536fe62ef ("cfg80211: change internal management frame registration API") Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid Signed-off-by: Johannes Berg commit 0985dba842eaa391858972cfe2724c3c174a2827 Author: David Woodhouse Date: Sat Oct 23 20:47:19 2021 +0100 KVM: x86/xen: Fix kvm_xen_has_interrupt() sleeping in kvm_vcpu_block() In kvm_vcpu_block, the current task is set to TASK_INTERRUPTIBLE before making a final check whether the vCPU should be woken from HLT by any incoming interrupt. This is a problem for the get_user() in __kvm_xen_has_interrupt(), which really shouldn't be sleeping when the task state has already been set. I think it's actually harmless as it would just manifest itself as a spurious wakeup, but it's causing a debug warning: [ 230.963649] do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000b6bcdbc9>] prepare_to_swait_exclusive+0x30/0x80 Fix the warning by turning it into an *explicit* spurious wakeup. When invoked with !task_is_running(current) (and we might as well add in_atomic() there while we're at it), just return 1 to indicate that an IRQ is pending, which will cause a wakeup and then something will call it again in a context that *can* sleep so it can fault the page back in. Cc: stable@vger.kernel.org Fixes: 40da8ccd724f ("KVM: x86/xen: Add event channel interrupt vector upcall") Signed-off-by: David Woodhouse Message-Id: <168bf8c689561da904e48e2ff5ae4713eaef9e2d.camel@infradead.org> Signed-off-by: Paolo Bonzini commit 4b2caef043dd89dd98da282cd6b90af2cbb60650 Merge: 8228c77d8b56e 0e9ff65f455df Author: Paolo Bonzini Date: Mon Oct 25 09:08:56 2021 -0400 Merge tag 'kvm-s390-master-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes for interrupt delivery Two bugs that might result in CPUs not woken up when interrupts are pending. commit b4ab21f90320969e5360719467153fc2bbc9435c Merge: 95a359c955334 af1a02aa23c37 Author: David S. Miller Date: Mon Oct 25 14:06:43 2021 +0100 Merge branch 'ksettings-locking-fixes' Andrew Lunn says: ==================== ksettings_{get|set} lock fixes Walter Stoll reported a race condition between "ethtool -s eth0 speed 100 duplex full autoneg off" and phylib reading the current status from the PHY. Both ksetting_get and ksetting_set fail the take the phydev mutex, and as a result, there is a small window of time where the phydev members are not self consistent. Patch 1 fixes phy_ethtool_ksettings_get by adding the needed lock. Patches 2 and 3 move code around and perform to refactoring, to allow patch 4 to fix phy_ethtool_ksettings_set by added the lock. Thanks go to Walter for the detailed origional report, suggested fix, and testing of the proposed patches. ==================== Signed-off-by: David S. Miller commit af1a02aa23c37045e6adfcf074cf7dbac167a403 Author: Andrew Lunn Date: Sun Oct 24 21:48:05 2021 +0200 phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings There is a race condition where the PHY state machine can change members of the phydev structure at the same time userspace requests a change via ethtool. To prevent this, have phy_ethtool_ksettings_set take the PHY lock. Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support") Reported-by: Walter Stoll Suggested-by: Walter Stoll Tested-by: Walter Stoll Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 707293a56f95f8e7e0cfae008010c7933fb68973 Author: Andrew Lunn Date: Sun Oct 24 21:48:04 2021 +0200 phy: phy_start_aneg: Add an unlocked version Split phy_start_aneg into a wrapper which takes the PHY lock, and a helper doing the real work. This will be needed when phy_ethtook_ksettings_set takes the lock. Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 64cd92d5e8180c2ded3fdea76862de6f596ae2c9 Author: Andrew Lunn Date: Sun Oct 24 21:48:03 2021 +0200 phy: phy_ethtool_ksettings_set: Move after phy_start_aneg This allows it to make use of a helper which assume the PHY is already locked. Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit c10a485c3de5ccbf1fff65a382cebcb2730c6b06 Author: Andrew Lunn Date: Sun Oct 24 21:48:02 2021 +0200 phy: phy_ethtool_ksettings_get: Lock the phy for consistency The PHY structure should be locked while copying information out if it, otherwise there is no guarantee of self consistency. Without the lock the PHY state machine could be updating the structure. Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 8228c77d8b56e3f735baf71fefb1b548c23691a7 Author: David Woodhouse Date: Sat Oct 23 21:29:22 2021 +0100 KVM: x86: switch pvclock_gtod_sync_lock to a raw spinlock On the preemption path when updating a Xen guest's runstate times, this lock is taken inside the scheduler rq->lock, which is a raw spinlock. This was shown in a lockdep warning: [ 89.138354] ============================= [ 89.138356] [ BUG: Invalid wait context ] [ 89.138358] 5.15.0-rc5+ #834 Tainted: G S I E [ 89.138360] ----------------------------- [ 89.138361] xen_shinfo_test/2575 is trying to lock: [ 89.138363] ffffa34a0364efd8 (&kvm->arch.pvclock_gtod_sync_lock){....}-{3:3}, at: get_kvmclock_ns+0x1f/0x130 [kvm] [ 89.138442] other info that might help us debug this: [ 89.138444] context-{5:5} [ 89.138445] 4 locks held by xen_shinfo_test/2575: [ 89.138447] #0: ffff972bdc3b8108 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x77/0x6f0 [kvm] [ 89.138483] #1: ffffa34a03662e90 (&kvm->srcu){....}-{0:0}, at: kvm_arch_vcpu_ioctl_run+0xdc/0x8b0 [kvm] [ 89.138526] #2: ffff97331fdbac98 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0xff/0xbd0 [ 89.138534] #3: ffffa34a03662e90 (&kvm->srcu){....}-{0:0}, at: kvm_arch_vcpu_put+0x26/0x170 [kvm] ... [ 89.138695] get_kvmclock_ns+0x1f/0x130 [kvm] [ 89.138734] kvm_xen_update_runstate+0x14/0x90 [kvm] [ 89.138783] kvm_xen_update_runstate_guest+0x15/0xd0 [kvm] [ 89.138830] kvm_arch_vcpu_put+0xe6/0x170 [kvm] [ 89.138870] kvm_sched_out+0x2f/0x40 [kvm] [ 89.138900] __schedule+0x5de/0xbd0 Cc: stable@vger.kernel.org Reported-by: syzbot+b282b65c2c68492df769@syzkaller.appspotmail.com Fixes: 30b5c851af79 ("KVM: x86/xen: Add support for vCPU runstate information") Signed-off-by: David Woodhouse Message-Id: <1b02a06421c17993df337493a68ba923f3bd5c0f.camel@infradead.org> Signed-off-by: Paolo Bonzini commit 00568b8a6364e15009b345b462e927e0b9fc2bb9 Author: LABBE Corentin Date: Thu Oct 21 10:26:57 2021 +0100 ARM: 9148/1: handle CONFIG_CPU_ENDIAN_BE32 in arch/arm/kernel/head.S My intel-ixp42x-welltech-epbx100 no longer boot since 4.14. This is due to commit 463dbba4d189 ("ARM: 9104/2: Fix Keystone 2 kernel mapping regression") which forgot to handle CONFIG_CPU_ENDIAN_BE32 as possible BE config. Suggested-by: Krzysztof Hałasa Fixes: 463dbba4d189 ("ARM: 9104/2: Fix Keystone 2 kernel mapping regression") Signed-off-by: Corentin Labbe Signed-off-by: Russell King (Oracle) commit c0eee6fbfa2b3377f1efed10dad539abeb7312aa Author: Asmaa Mnebhi Date: Fri Oct 22 09:44:38 2021 -0400 gpio: mlxbf2.c: Add check for bgpio_init failure Add a check if bgpio_init fails. Signed-off-by: Asmaa Mnebhi Signed-off-by: Bartosz Golaszewski commit 85fe6415c146d5d42ce300c12f1ecf4d4af47d40 Author: Jonas Gorski Date: Thu Oct 14 14:33:42 2021 +0200 gpio: xgs-iproc: fix parsing of ngpios property of_property_read_u32 returns 0 on success, not true, so we need to invert the check to actually take over the provided ngpio value. Fixes: 6a41b6c5fc20 ("gpio: Add xgs-iproc driver") Signed-off-by: Jonas Gorski Reviewed-by: Chris Packham Reviewed-by: Florian Fainelli Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit d853adc7adf601d7d6823afe3ed396065a3e08d1 Author: Alexey Kardashevskiy Date: Thu Oct 21 00:23:15 2021 +1100 powerpc/pseries/iommu: Create huge DMA window if no MMIO32 is present The iommu_init_table() helper takes an address range to reserve in the IOMMU table being initialized to exclude MMIO addresses, this is useful if the window stretches far beyond 4GB (although wastes some TCEs). At the moment the code searches for such MMIO32 range and fails if none found which is considered a problem while it really is not: it is actually better as this says there is no MMIO32 to reserve and we can use usually wasted TCEs. Furthermore PHYP never actually allows creating windows starting at busaddress=0 so this MMIO32 range is never useful. This removes error exit and initializes the table with zero range if no MMIO32 is detected. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211020132315.2287178-5-aik@ozlabs.ru commit 92fe01b7c655b9767724e7d62bdded0761d232ff Author: Alexey Kardashevskiy Date: Thu Oct 21 00:23:14 2021 +1100 powerpc/pseries/iommu: Check if the default window in use before removing it At the moment this check is performed after we remove the default window which is late and disallows to revert whatever changes enable_ddw() has made to DMA windows. This moves the check and error exit before removing the window. This raised the message severity from "debug" to "warning" as this should not happen in practice and cannot be triggered by the userspace. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211020132315.2287178-4-aik@ozlabs.ru commit 41ee7232fa5f3c034f22baa52bc287e494e2129a Author: Alexey Kardashevskiy Date: Thu Oct 21 00:23:13 2021 +1100 powerpc/pseries/iommu: Use correct vfree for it_map The it_map array is vzalloc'ed so use vfree() for it when creating a huge DMA window failed for whatever reason. While at this, write zero to it_map. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211020132315.2287178-3-aik@ozlabs.ru commit a0023bb9dd9bc439d44604eeec62426a990054cd Author: Zheyu Ma Date: Fri Oct 22 09:12:26 2021 +0000 ata: sata_mv: Fix the error handling of mv_chip_id() mv_init_host() propagates the value returned by mv_chip_id() which in turn gets propagated by mv_pci_init_one() and hits local_pci_probe(). During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success. Since this is a bug rather than a recoverable runtime error we should use dev_alert() instead of dev_err(). Signed-off-by: Zheyu Ma Signed-off-by: Damien Le Moal commit 87066fdd2e30fe9dd531125d95257c118a74617e Author: Linus Torvalds Date: Sun Oct 24 09:48:33 2021 -1000 Revert "mm/secretmem: use refcount_t instead of atomic_t" This reverts commit 110860541f443f950c1274f217a1a3e298670a33. Converting the "secretmem_users" counter to a refcount is incorrect, because a refcount is special in zero and can't just be incremented (but a count of users is not, and "no users" is actually perfectly valid and not a sign of a free'd resource). Reported-by: syzbot+75639e6a0331cd61d3e2@syzkaller.appspotmail.com Cc: Jordy Zomer Cc: Kees Cook , Cc: Jordy Zomer Cc: James Bottomley Cc: Mike Rapoport Cc: Andrew Morton Signed-off-by: Linus Torvalds commit b20078fd69a3da08d85c79b95101cf25c4afcc97 Merge: 6c62666d88792 25f54d08f12fe Author: Linus Torvalds Date: Sun Oct 24 09:36:06 2021 -1000 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull autofs fix from Al Viro: "Fix for a braino of mine (in getting rid of open-coded dentry_path_raw() in autofs a couple of cycles ago). Mea culpa... Obvious -stable fodder" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: autofs: fix wait name hash calculation in autofs_wait() commit 6c62666d8879238578b727f8e0a821e90c88f87e Merge: 16bc177666c03 63acd42c0d494 Author: Linus Torvalds Date: Sun Oct 24 07:04:21 2021 -1000 Merge tag 'sched_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: "Reset clang's Shadow Call Stack on hotplug to prevent it from overflowing" * tag 'sched_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/scs: Reset the shadow stack when idle_task_exit commit 16bc177666c037b4aa3e1f68f4eac685006c622b Merge: c460e7896e690 0a30896fc5025 Author: Linus Torvalds Date: Sun Oct 24 07:00:15 2021 -1000 Merge tag 'x86_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: "A single change adding Dave Hansen to our maintainers team" * tag 'x86_urgent_for_v5.15_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: Add Dave Hansen to the x86 maintainer team commit c460e7896e6906d4e154f2e7fb7f40d46edbd006 Merge: 0f386a604ce50 0d994cd482ee4 Author: Linus Torvalds Date: Sun Oct 24 06:43:59 2021 -1000 Merge tag '5.15-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd Pull ksmbd fixes from Steve French: "Ten fixes for the ksmbd kernel server, for improved security and additional buffer overflow checks: - a security improvement to session establishment to reduce the possibility of dictionary attacks - fix to ensure that maximum i/o size negotiated in the protocol is not less than 64K and not more than 8MB to better match expected behavior - fix for crediting (flow control) important to properly verify that sufficient credits are available for the requested operation - seven additional buffer overflow, buffer validation checks" * tag '5.15-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: add buffer validation in session setup ksmbd: throttle session setup failures to avoid dictionary attacks ksmbd: validate OutputBufferLength of QUERY_DIR, QUERY_INFO, IOCTL requests ksmbd: validate credit charge after validating SMB2 PDU body size ksmbd: add buffer validation for smb direct ksmbd: limit read/write/trans buffer size not to exceed 8MB ksmbd: validate compound response buffer ksmbd: fix potencial 32bit overflow from data area check in smb2_write ksmbd: improve credits management ksmbd: add validation in smb2_ioctl commit 0f386a604ce5074724909a8927d6d97ef998b5a9 Merge: 9c0c4d24ac000 4e5483b8440d0 Author: Linus Torvalds Date: Sun Oct 24 06:23:48 2021 -1000 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Ten fixes, seven of which are in drivers. The core fixes are one to fix a potential crash on resume, one to sort out our reference count releases to avoid releasing in-use modules and one to adjust the cmd per lun calculation to avoid an overflow in hyper-v" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: ufs-pci: Force a full restore after suspend-to-disk scsi: qla2xxx: Fix unmap of already freed sgl scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() scsi: qla2xxx: Return -ENOMEM if kzalloc() fails scsi: sd: Fix crashes in sd_resume_runtime() scsi: mpi3mr: Fix duplicate device entries when scanning through sysfs scsi: core: Put LLD module refcnt after SCSI device is released scsi: storvsc: Fix validation for unsolicited incoming packets scsi: iscsi: Fix set_param() handling scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() commit 95a359c9553342d36d408d35331ff0bfce75272f Author: Yuiko Oshino Date: Fri Oct 22 11:53:43 2021 -0400 net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent The dma failure was reported in the raspberry pi github (issue #4117). https://github.com/raspberrypi/linux/issues/4117 The use of dma_set_mask_and_coherent fixes the issue. Tested on 32/64-bit raspberry pi CM4 and 64-bit ubuntu x86 PC with EVB-LAN7430. Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Yuiko Oshino Signed-off-by: David S. Miller commit d6423d2ec39cce2bfca418c81ef51792891576bc Author: Yuiko Oshino Date: Fri Oct 22 11:13:53 2021 -0400 net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails The driver needs to clean up and return when the initialization fails on resume. Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Yuiko Oshino Signed-off-by: David S. Miller commit 9c0c4d24ac000e52d55348961d3a3ba42065e0cf Merge: da4d34b669723 9fbfabfda25d8 Author: Linus Torvalds Date: Fri Oct 22 17:42:13 2021 -1000 Merge tag 'block-5.15-2021-10-22' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Fix for the cgroup code not ussing irq safe stats updates, and one fix for an error handling condition in add_partition()" * tag 'block-5.15-2021-10-22' of git://git.kernel.dk/linux-block: block: fix incorrect references to disk objects blk-cgroup: blk_cgroup_bio_start() should use irq-safe operations on blkg->iostat_cpu commit da4d34b669723508601a4c29daa22cdc669ee005 Merge: 5ab2ed0a8d75c b22fa62a35d7f Author: Linus Torvalds Date: Fri Oct 22 17:34:31 2021 -1000 Merge tag 'io_uring-5.15-2021-10-22' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Two fixes for the max workers limit API that was introduced this series: one fix for an issue with that code, and one fixing a linked timeout regression in this series" * tag 'io_uring-5.15-2021-10-22' of git://git.kernel.dk/linux-block: io_uring: apply worker limits to previous users io_uring: fix ltimeout unprep io_uring: apply max_workers limit to all future users io-wq: max_worker fixes commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba Author: Quanyang Wang Date: Mon Oct 18 15:56:23 2021 +0800 cgroup: Fix memory leak caused by missing cgroup_bpf_offline When enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running the command as below: $mount -t cgroup -o none,name=foo cgroup cgroup/ $umount cgroup/ unreferenced object 0xc3585c40 (size 64): comm "mount", pid 425, jiffies 4294959825 (age 31.990s) hex dump (first 32 bytes): 01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00 ......(......... 00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00 ........lC...... backtrace: [] cgroup_bpf_inherit+0x44/0x24c [<1f03679c>] cgroup_setup_root+0x174/0x37c [] cgroup1_get_tree+0x2c0/0x4a0 [] vfs_get_tree+0x24/0x108 [] path_mount+0x384/0x988 [] do_mount+0x64/0x9c [<208c9cfe>] sys_mount+0xfc/0x1f4 [<06dd06e0>] ret_fast_syscall+0x0/0x48 [] 0xbeb4daa8 This is because that since the commit 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") root_cgrp->bpf.refcnt.data is allocated by the function percpu_ref_init in cgroup_bpf_inherit which is called by cgroup_setup_root when mounting, but not freed along with root_cgrp when umounting. Adding cgroup_bpf_offline which calls percpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in umount path. This patch also fixes the commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself"). A cgroup_bpf_offline is needed to do a cleanup that frees the resources which are allocated by cgroup_bpf_inherit in cgroup_setup_root. And inside cgroup_bpf_offline, cgroup_get() is at the beginning and cgroup_put is at the end of cgroup_bpf_release which is called by cgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of cgroup's refcount. Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path") Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") Signed-off-by: Quanyang Wang Signed-off-by: Alexei Starovoitov Acked-by: Roman Gushchin Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20211018075623.26884-1-quanyang.wang@windriver.com commit fda7a38714f40b635f5502ec4855602c6b33dad2 Author: Xu Kuohai Date: Tue Oct 19 03:29:34 2021 +0000 bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch() 1. The ufd in generic_map_update_batch() should be read from batch.map_fd; 2. A call to fdget() should be followed by a symmetric call to fdput(). Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops") Signed-off-by: Xu Kuohai Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211019032934.1210517-1-xukuohai@huawei.com commit 22a127908e747c7ede8382d5f8d4cc6c9920004f Merge: 4225fea1cb283 fadb7ff1a6c2c Author: Alexei Starovoitov Date: Wed Oct 20 18:19:02 2021 -0700 Merge branch 'Fix up bpf_jit_limit some more' Lorenz Bauer says: ==================== Fix some inconsistencies of bpf_jit_limit on non-x86 platforms. I've dropped exposing bpf_jit_current since we couldn't agree on file modes, correct names, etc. ==================== Signed-off-by: Alexei Starovoitov commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 Author: Lorenz Bauer Date: Thu Oct 14 15:25:53 2021 +0100 bpf: Prevent increasing bpf_jit_limit above max Restrict bpf_jit_limit to the maximum supported by the arch's JIT. Signed-off-by: Lorenz Bauer Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com commit 5d63ae908242f028bd10860cba98450d11c079b8 Author: Lorenz Bauer Date: Thu Oct 14 15:25:52 2021 +0100 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT Expose the maximum amount of useable memory from the arm64 JIT. Signed-off-by: Lorenz Bauer Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20211014142554.53120-3-lmb@cloudflare.com commit 8f04db78e4e36a5d4858ce841a3e9cc3d69bde36 Author: Lorenz Bauer Date: Thu Oct 14 15:25:51 2021 +0100 bpf: Define bpf_jit_alloc_exec_limit for riscv JIT Expose the maximum amount of useable memory from the riscv JIT. Signed-off-by: Lorenz Bauer Signed-off-by: Alexei Starovoitov Acked-by: Luke Nelson Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20211014142554.53120-2-lmb@cloudflare.com commit 1f83b835a3eaa5ae4bd825fb07182698bfc243ba Author: Florian Westphal Date: Thu Oct 21 16:02:47 2021 +0200 fcnal-test: kill hanging ping/nettest binaries on cleanup On my box I see a bunch of ping/nettest processes hanging around after fcntal-test.sh is done. Clean those up before netns deletion. Signed-off-by: Florian Westphal Acked-by: David Ahern Link: https://lore.kernel.org/r/20211021140247.29691-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 5ab2ed0a8d75ce55ade89e3ff6b75bef7d9fa53f Merge: 477b4e80c57f7 964d32e512670 Author: Linus Torvalds Date: Fri Oct 22 10:39:47 2021 -1000 Merge tag 'fuse-fixes-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "Syzbot discovered a race in case of reusing the fuse sb (introduced in this cycle). Fix it by doing the s_fs_info initialization at the proper place" * tag 'fuse-fixes-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: clean up error exits in fuse_fill_super() fuse: always initialize sb->s_fs_info fuse: clean up fuse_mount destruction fuse: get rid of fuse_put_super() fuse: check s_root when destroying sb commit 477b4e80c57f787cf8f494ccb9be23a23642b2f2 Merge: 1d4590f5069bf 8017c99680fa6 Author: Linus Torvalds Date: Fri Oct 22 10:31:32 2021 -1000 Merge tag 'hyperv-fixes-signed-20211022' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyper-v fix from Wei Liu: - Fix vmbus ARM64 build (Arnd Bergmann) * tag 'hyperv-fixes-signed-20211022' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hyperv/vmbus: include linux/bitops.h commit 32f8807a48ae55be0e76880cfe8607a18b5bb0df Merge: 7f678def99d29 9d02831e517aa Author: Jakub Kicinski Date: Fri Oct 22 12:36:47 2021 -0700 Merge branch 'sctp-enhancements-for-the-verification-tag' Xin Long says: ==================== sctp: enhancements for the verification tag This patchset is to address CVE-2021-3772: A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. This is caused by the missing VTAG verification for the received chunks and the incorrect vtag for the ABORT used to reply to these invalid chunks. This patchset is to go over all processing functions for the received chunks and do: 1. Make sure sctp_vtag_verify() is called firstly to verify the vtag from the received chunk and discard this chunk if it fails. With some exceptions: a. sctp_sf_do_5_1B_init()/5_2_2_dupinit()/9_2_reshutack(), processing INIT chunk, as sctphdr vtag is always 0 in INIT chunk. b. sctp_sf_do_5_2_4_dupcook(), processing dupicate COOKIE_ECHO chunk, as the vtag verification will be done by sctp_tietags_compare() and then it takes right actions according to the return. c. sctp_sf_shut_8_4_5(), processing SHUTDOWN_ACK chunk for cookie_wait and cookie_echoed state, as RFC demand sending a SHUTDOWN_COMPLETE even if the vtag verification failed. d. sctp_sf_ootb(), called in many types of chunks for closed state or no asoc, as the same reason to c. 2. Always use the vtag from the received INIT chunk to make the response ABORT in sctp_ootb_pkt_new(). 3. Fix the order for some checks and add some missing checks for the received chunk. This patch series has been tested with SCTP TAHI testing to make sure no regression caused on protocol conformance. ==================== Link: https://lore.kernel.org/r/cover.1634730082.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 9d02831e517aa36ee6bdb453a0eb47bd49923fe3 Author: Xin Long Date: Wed Oct 20 07:42:47 2021 -0400 sctp: add vtag check in sctp_sf_ootb sctp_sf_ootb() is called when processing DATA chunk in closed state, and many other places are also using it. The vtag in the chunk's sctphdr should be verified, otherwise, as later in chunk length check, it may send abort with the existent asoc's vtag, which can be exploited by one to cook a malicious chunk to terminate a SCTP asoc. When fails to verify the vtag from the chunk, this patch sets asoc to NULL, so that the abort will be made with the vtag from the received chunk later. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit ef16b1734f0a176277b7bb9c71a6d977a6ef3998 Author: Xin Long Date: Wed Oct 20 07:42:46 2021 -0400 sctp: add vtag check in sctp_sf_do_8_5_1_E_sa sctp_sf_do_8_5_1_E_sa() is called when processing SHUTDOWN_ACK chunk in cookie_wait and cookie_echoed state. The vtag in the chunk's sctphdr should be verified, otherwise, as later in chunk length check, it may send abort with the existent asoc's vtag, which can be exploited by one to cook a malicious chunk to terminate a SCTP asoc. Note that when fails to verify the vtag from SHUTDOWN-ACK chunk, SHUTDOWN COMPLETE message will still be sent back to peer, but with the vtag from SHUTDOWN-ACK chunk, as said in 5) of rfc4960#section-8.4. While at it, also remove the unnecessary chunk length check from sctp_sf_shut_8_4_5(), as it's already done in both places where it calls sctp_sf_shut_8_4_5(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit aa0f697e45286a6b5f0ceca9418acf54b9099d99 Author: Xin Long Date: Wed Oct 20 07:42:45 2021 -0400 sctp: add vtag check in sctp_sf_violation sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk in cookie_wait state, and some other places are also using it. The vtag in the chunk's sctphdr should be verified, otherwise, as later in chunk length check, it may send abort with the existent asoc's vtag, which can be exploited by one to cook a malicious chunk to terminate a SCTP asoc. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit a64b341b8695e1c744dd972b39868371b4f68f83 Author: Xin Long Date: Wed Oct 20 07:42:44 2021 -0400 sctp: fix the processing for COOKIE_ECHO chunk 1. In closed state: in sctp_sf_do_5_1D_ce(): When asoc is NULL, making packet for abort will use chunk's vtag in sctp_ootb_pkt_new(). But when asoc exists, vtag from the chunk should be verified before using peer.i.init_tag to make packet for abort in sctp_ootb_pkt_new(), and just discard it if vtag is not correct. 2. In the other states: in sctp_sf_do_5_2_4_dupcook(): asoc always exists, but duplicate cookie_echo's vtag will be handled by sctp_tietags_compare() and then take actions, so before that we only verify the vtag for the abort sent for invalid chunk length. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 438b95a7c98f77d51cbf4db021f41b602d750a3f Author: Xin Long Date: Wed Oct 20 07:42:43 2021 -0400 sctp: fix the processing for INIT_ACK chunk Currently INIT_ACK chunk in non-cookie_echoed state is processed in sctp_sf_discard_chunk() to send an abort with the existent asoc's vtag if the chunk length is not valid. But the vtag in the chunk's sctphdr is not verified, which may be exploited by one to cook a malicious chunk to terminal a SCTP asoc. sctp_sf_discard_chunk() also is called in many other places to send an abort, and most of those have this problem. This patch is to fix it by sending abort with the existent asoc's vtag only if the vtag from the chunk's sctphdr is verified in sctp_sf_discard_chunk(). Note on sctp_sf_do_9_1_abort() and sctp_sf_shutdown_pending_abort(), the chunk length has been verified before sctp_sf_discard_chunk(), so replace it with sctp_sf_discard(). On sctp_sf_do_asconf_ack() and sctp_sf_do_asconf(), move the sctp_chunk_length_valid check ahead of sctp_sf_discard_chunk(), then replace it with sctp_sf_discard(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit eae5783908042a762c24e1bd11876edb91d314b1 Author: Xin Long Date: Wed Oct 20 07:42:42 2021 -0400 sctp: fix the processing for INIT chunk This patch fixes the problems below: 1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and sctp_sf_do_5_2_2_dupinit(): chunk length check should be done before any checks that may cause to send abort, as making packet for abort will access the init_tag from init_hdr in sctp_ootb_pkt_new(). 2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack(): The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed for sctp_sf_do_9_2_reshutack(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 4f7019c7eb33967eb87766e0e4602b5576873680 Author: Xin Long Date: Wed Oct 20 07:42:41 2021 -0400 sctp: use init_tag from inithdr for ABORT chunk Currently Linux SCTP uses the verification tag of the existing SCTP asoc when failing to process and sending the packet with the ABORT chunk. This will result in the peer accepting the ABORT chunk and removing the SCTP asoc. One could exploit this to terminate a SCTP asoc. This patch is to fix it by always using the initiate tag of the received INIT chunk for the ABORT chunk to be sent. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 7f678def99d29c520418607509bb19c7fc96a6db Author: Vasily Averin Date: Fri Oct 22 13:28:37 2021 +0300 skb_expand_head() adjust skb->truesize incorrectly Christoph Paasch reports [1] about incorrect skb->truesize after skb_expand_head() call in ip6_xmit. This may happen because of two reasons: - skb_set_owner_w() for newly cloned skb is called too early, before pskb_expand_head() where truesize is adjusted for (!skb-sk) case. - pskb_expand_head() does not adjust truesize in (skb->sk) case. In this case sk->sk_wmem_alloc should be adjusted too. [1] https://lkml.org/lkml/2021/8/20/1082 Fixes: f1260ff15a71 ("skbuff: introduce skb_expand_head()") Fixes: 2d85a1b31dde ("ipv6: ip6_finish_output2: set sk into newly allocated nskb") Reported-by: Christoph Paasch Signed-off-by: Vasily Averin Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/644330dd-477e-0462-83bf-9f514c41edd1@virtuozzo.com Signed-off-by: Jakub Kicinski commit 8017c99680fa65e1e8d999df1583de476a187830 Author: Arnd Bergmann Date: Mon Oct 18 15:19:08 2021 +0200 hyperv/vmbus: include linux/bitops.h On arm64 randconfig builds, hyperv sometimes fails with this error: In file included from drivers/hv/hv_trace.c:3: In file included from drivers/hv/hyperv_vmbus.h:16: In file included from arch/arm64/include/asm/sync_bitops.h:5: arch/arm64/include/asm/bitops.h:11:2: error: only can be included directly In file included from include/asm-generic/bitops/hweight.h:5: include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration] include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration] Include the correct header first. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org Signed-off-by: Wei Liu commit 1d4590f5069bff7d41d7ed1a7e7674fb9d6d502a Merge: cd82c4a73b671 7a7489005a80a Author: Linus Torvalds Date: Fri Oct 22 09:08:08 2021 -1000 Merge tag 'acpi-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix two regressions, one related to ACPI power resources management and one that broke ACPI tools compilation. Specifics: - Stop turning off unused ACPI power resources in an unknown state to address a regression introduced during the 5.14 cycle (Rafael Wysocki). - Fix an ACPI tools build issue introduced recently when the minimal stdarg.h was added (Miguel Bernal Marin)" * tag 'acpi-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: Do not turn off power resources in unknown state ACPI: tools: fix compilation error commit cd82c4a73b6713984b69c57a2a687203d3e0e34a Merge: 64222515138e4 95e16b4792b04 Author: Linus Torvalds Date: Fri Oct 22 09:02:15 2021 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more x86 kvm fixes from Paolo Bonzini: - Cache coherency fix for SEV live migration - Fix for instruction emulation with PKU - fixes for rare delaying of interrupt delivery - fix for SEV-ES buffer overflow * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed KVM: SEV-ES: keep INS functions together KVM: x86: remove unnecessary arguments from complete_emulator_pio_in KVM: x86: split the two parts of emulator_pio_in KVM: SEV-ES: clean up kvm_sev_es_ins/outs KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out KVM: SEV-ES: rename guest_ins_data to sev_pio_data KVM: SEV: Flush cache on non-coherent systems before RECEIVE_UPDATE_DATA KVM: MMU: Reset mmu->pkru_mask to avoid stale data KVM: nVMX: promptly process interrupts delivered while in guest mode KVM: x86: check for interrupts before deciding whether to exit the fast path commit 7a7489005a80af97ba289dc0579fccd50af4fe8d Merge: bc28368596436 136f282028dae Author: Rafael J. Wysocki Date: Fri Oct 22 20:45:10 2021 +0200 Merge branch 'acpi-tools' Merge a fix for a recent ACPI tools bild regresson. * acpi-tools: ACPI: tools: fix compilation error commit 7fcb1c950e98e47918e86a5aa7b8fcc283ec6629 Merge: 64222515138e4 a2083eeb119fb Author: Jakub Kicinski Date: Fri Oct 22 11:12:45 2021 -0700 Merge tag 'mac80211-for-net-2021-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Two small fixes: * RCU misuse in scan processing in cfg80211 * missing size check for HE data in mac80211 mesh * tag 'mac80211-for-net-2021-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211: cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() mac80211: mesh: fix HE operation element length check ==================== Link: https://lore.kernel.org/r/20211021154351.134297-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 95e16b4792b0429f1933872f743410f00e590c55 Author: Paolo Bonzini Date: Tue Oct 12 11:33:03 2021 -0400 KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed The PIO scratch buffer is larger than a single page, and therefore it is not possible to copy it in a single step to vcpu->arch/pio_data. Bound each call to emulator_pio_in/out to a single page; keep track of how many I/O operations are left in vcpu->arch.sev_pio_count, so that the operation can be restarted in the complete_userspace_io callback. For OUT, this means that the previous kvm_sev_es_outs implementation becomes an iterator of the loop, and we can consume the sev_pio_data buffer before leaving to userspace. For IN, instead, consuming the buffer and decreasing sev_pio_count is always done in the complete_userspace_io callback, because that is when the memcpy is done into sev_pio_data. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reported-by: Felix Wilhelm Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit 4fa4b38dae6fc6a3695695add8c18fa8b6a05a1a Author: Paolo Bonzini Date: Tue Oct 12 11:25:45 2021 -0400 KVM: SEV-ES: keep INS functions together Make the diff a little nicer when we actually get to fixing the bug. No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit 6b5efc930bbc8c97e4a1fe2ccb9a6f286365a56d Author: Paolo Bonzini Date: Tue Oct 12 12:35:20 2021 -0400 KVM: x86: remove unnecessary arguments from complete_emulator_pio_in complete_emulator_pio_in can expect that vcpu->arch.pio has been filled in, and therefore does not need the size and count arguments. This makes things nicer when the function is called directly from a complete_userspace_io callback. No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit 3b27de27183911d461afedf50c6fa30c59740c07 Author: Paolo Bonzini Date: Wed Oct 13 12:32:02 2021 -0400 KVM: x86: split the two parts of emulator_pio_in emulator_pio_in handles both the case where the data is pending in vcpu->arch.pio.count, and the case where I/O has to be done via either an in-kernel device or a userspace exit. For SEV-ES we would like to split these, to identify clearly the moment at which the sev_pio_data is consumed. To this end, create two different functions: __emulator_pio_in fills in vcpu->arch.pio.count, while complete_emulator_pio_in clears it and releases vcpu->arch.pio.data. Because this patch has to be backported, things are left a bit messy. kernel_pio() operates on vcpu->arch.pio, which leads to emulator_pio_in() having with two calls to complete_emulator_pio_in(). It will be fixed in the next release. While at it, remove the unused void* val argument of emulator_pio_in_out. The function currently hardcodes vcpu->arch.pio_data as the source/destination buffer, which sucks but will be fixed after the more severe SEV-ES buffer overflow. No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Signed-off-by: Paolo Bonzini commit ea724ea420aac58b41bc822d1aed6940b136b78d Author: Paolo Bonzini Date: Tue Oct 12 10:51:55 2021 -0400 KVM: SEV-ES: clean up kvm_sev_es_ins/outs A few very small cleanups to the functions, smushed together because the patch is already very small like this: - inline emulator_pio_in_emulated and emulator_pio_out_emulated, since we already have the vCPU - remove the data argument and pull setting vcpu->arch.sev_pio_data into the caller - remove unnecessary clearing of vcpu->arch.pio.count when emulation is done by the kernel (and therefore vcpu->arch.pio.count is already clear on exit from emulator_pio_in and emulator_pio_out). No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit 0d33b1baeb6ca7165d5ed4fdd1a8f969985e35b9 Author: Paolo Bonzini Date: Wed Oct 13 12:29:42 2021 -0400 KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out Currently emulator_pio_in clears vcpu->arch.pio.count twice if emulator_pio_in_out performs kernel PIO. Move the clear into emulator_pio_out where it is actually necessary. No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit b5998402e3de429b5e5f9bdea08ddf77c5fd661e Author: Paolo Bonzini Date: Tue Oct 12 10:22:34 2021 -0400 KVM: SEV-ES: rename guest_ins_data to sev_pio_data We will be using this field for OUTS emulation as well, in case the data that is pushed via OUTS spans more than one page. In that case, there will be a need to save the data pointer across exits to userspace. So, change the name to something that refers to any kind of PIO. Also spell out what it is used for, namely SEV-ES. No functional change intended. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit f8690a4b5a1b64f74ae5c4f7c4ea880d8a8e1a0d Author: Tianjia Zhang Date: Fri Oct 15 11:47:33 2021 +0800 crypto: x86/sm4 - Fix invalid section entry size This fixes the following warning: vmlinux.o: warning: objtool: elf_update: invalid section entry size The size of the rodata section is 164 bytes, directly using the entry_size of 164 bytes will cause errors in some versions of the gcc compiler, while using 16 bytes directly will cause errors in the clang compiler. This patch correct it by filling the size of rodata to a 16-byte boundary. Fixes: a7ee22ee1445 ("crypto: x86/sm4 - add AES-NI/AVX/x86_64 implementation") Fixes: 5b2efa2bb865 ("crypto: x86/sm4 - add AES-NI/AVX2/x86_64 implementation") Reported-by: Peter Zijlstra Reported-by: Abaci Robot Signed-off-by: Tianjia Zhang Tested-by: Heyuan Shi Signed-off-by: Herbert Xu commit 0943aacf5ae10471b68a702c022b42c89e91ba9e Author: Xie Yongji Date: Wed Sep 29 16:30:50 2021 +0800 vduse: Fix race condition between resetting and irq injecting The interrupt might be triggered after a reset since there is no synchronization between resetting and irq injecting. And it might break something if the interrupt is delayed until a new round of device initialization. Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Signed-off-by: Xie Yongji Link: https://lore.kernel.org/r/20210929083050.88-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 1394103fd72ce9c67d20f882a93d59403c8da057 Author: Xie Yongji Date: Thu Sep 23 15:57:22 2021 +0800 vduse: Disallow injecting interrupt before DRIVER_OK is set The interrupt callback should not be triggered before DRIVER_OK is set. Otherwise, it might break the virtio device driver. So let's add a check to avoid the unexpected behavior. Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Signed-off-by: Xie Yongji Link: https://lore.kernel.org/r/20210923075722.98-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit ee71fb6c4d99c51f2d82a32c503c872b7e40e7f7 Author: Daniel Vetter Date: Thu Oct 21 22:20:48 2021 +0200 drm/i915/selftests: Properly reset mock object propers for each test I forgot to do this properly in commit 6f11f37459d8f9f74ff1c299c0bedd50b458057a Author: Daniel Vetter Date: Fri Jul 23 10:34:55 2021 +0200 drm/plane: remove drm_helper_get_plane_damage_clips intel-gfx CI didn't spot this because we run each selftest in each own invocations, which means reloading i915.ko. But if you just run all the selftests in one go at boot-up, then it falls apart and eventually we cross over the hardcoded limited of how many properties can be attached to a single object. Fix this by resetting the property count. Nothing else to clean up since it's all static storage anyway. Reported-and-tested-by: Sebastian Andrzej Siewior Cc: Sebastian Andrzej Siewior Fixes: 6f11f37459d8 ("drm/plane: remove drm_helper_get_plane_damage_clips") Cc: José Roberto de Souza Cc: Ville Syrjälä Cc: Gwan-gyeong Mun Cc: Hans de Goede Cc: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Acked-by: Thomas Zimmermann Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20211021202048.2638668-1-daniel.vetter@ffwll.ch commit 64222515138e43da1fcf288f0289ef1020427b87 Merge: 658aafc8139c2 595cb5e0b832a Author: Linus Torvalds Date: Thu Oct 21 19:06:08 2021 -1000 Merge tag 'drm-fixes-2021-10-22' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Nothing too crazy at the end of the cycle, the kmb modesetting fixes are probably a bit large but it's not a major driver, and its fixing monitor doesn't turn on type problems. Otherwise it's just a few minor patches, one ast regression revert, an msm power stability fix. ast: - fix regression with connector detect msm: - fix power stability issue msxfb: - fix crash on unload panel: - sync fix kmb: - modesetting fixes" * tag 'drm-fixes-2021-10-22' of git://anongit.freedesktop.org/drm/drm: Revert "drm/ast: Add detect function support" drm/kmb: Enable ADV bridge after modeset drm/kmb: Corrected typo in handle_lcd_irq drm/kmb: Disable change of plane parameters drm/kmb: Remove clearing DPHY regs drm/kmb: Limit supported mode to 1080p drm/kmb: Work around for higher system clock drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel drm: mxsfb: Fix NULL pointer dereference crash on unload drm/msm/devfreq: Restrict idle clamping to a618 for now commit 658aafc8139c23a6a23f6f4d9a0c4c95476838d4 Author: Mike Rapoport Date: Thu Oct 21 10:09:29 2021 +0300 memblock: exclude MEMBLOCK_NOMAP regions from kmemleak Vladimir Zapolskiy reports: Commit a7259df76702 ("memblock: make memblock_find_in_range method private") invokes a kernel panic while running kmemleak on OF platforms with nomaped regions: Unable to handle kernel paging request at virtual address fff000021e00000 [...] scan_block+0x64/0x170 scan_gray_list+0xe8/0x17c kmemleak_scan+0x270/0x514 kmemleak_write+0x34c/0x4ac The memory allocated from memblock is registered with kmemleak, but if it is marked MEMBLOCK_NOMAP it won't have linear map entries so an attempt to scan such areas will fault. Ideally, memblock_mark_nomap() would inform kmemleak to ignore MEMBLOCK_NOMAP memory, but it can be called before kmemleak interfaces operating on physical addresses can use __va() conversion. Make sure that functions that mark allocated memory as MEMBLOCK_NOMAP take care of informing kmemleak to ignore such memory. Link: https://lore.kernel.org/all/8ade5174-b143-d621-8c8e-dc6a1898c6fb@linaro.org Link: https://lore.kernel.org/all/c30ff0a2-d196-c50d-22f0-bd50696b1205@quicinc.com Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Reported-by: Vladimir Zapolskiy Signed-off-by: Mike Rapoport Reviewed-by: Catalin Marinas Tested-by: Vladimir Zapolskiy Tested-by: Qian Cai Signed-off-by: Linus Torvalds commit 6c9a54551977ddf2d6e22c21354b4fb88946f96e Author: Mike Rapoport Date: Thu Oct 21 10:09:28 2021 +0300 Revert "memblock: exclude NOMAP regions from kmemleak" Commit 6e44bd6d34d6 ("memblock: exclude NOMAP regions from kmemleak") breaks boot on EFI systems with kmemleak and VM_DEBUG enabled: efi: Processing EFI memory map: efi: 0x000090000000-0x000091ffffff [Conventional| | | | | | | | | | |WB|WT|WC|UC] efi: 0x000092000000-0x0000928fffff [Runtime Data|RUN| | | | | | | | | |WB|WT|WC|UC] ------------[ cut here ]------------ kernel BUG at mm/kmemleak.c:1140! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc6-next-20211019+ #104 pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kmemleak_free_part_phys+0x64/0x8c lr : kmemleak_free_part_phys+0x38/0x8c sp : ffff800011eafbc0 x29: ffff800011eafbc0 x28: 1fffff7fffb41c0d x27: fffffbfffda0e068 x26: 0000000092000000 x25: 1ffff000023d5f94 x24: ffff800011ed84d0 x23: ffff800011ed84c0 x22: ffff800011ed83d8 x21: 0000000000900000 x20: ffff800011782000 x19: 0000000092000000 x18: ffff800011ee0730 x17: 0000000000000000 x16: 0000000000000000 x15: 1ffff0000233252c x14: ffff800019a905a0 x13: 0000000000000001 x12: ffff7000023d5ed7 x11: 1ffff000023d5ed6 x10: ffff7000023d5ed6 x9 : dfff800000000000 x8 : ffff800011eaf6b7 x7 : 0000000000000001 x6 : ffff800011eaf6b0 x5 : 00008ffffdc2a12a x4 : ffff7000023d5ed7 x3 : 1ffff000023dbf99 x2 : 1ffff000022f0463 x1 : 0000000000000000 x0 : ffffffffffffffff Call trace: kmemleak_free_part_phys+0x64/0x8c memblock_mark_nomap+0x5c/0x78 reserve_regions+0x294/0x33c efi_init+0x2d0/0x490 setup_arch+0x80/0x138 start_kernel+0xa0/0x3ec __primary_switched+0xc0/0xc8 Code: 34000041 97d526e7 f9418e80 36000040 (d4210000) random: get_random_bytes called from print_oops_end_marker+0x34/0x80 with crng_init=0 ---[ end trace 0000000000000000 ]--- The crash happens because kmemleak_free_part_phys() tries to use __va() before memstart_addr is initialized and this triggers a VM_BUG_ON() in arch/arm64/include/asm/memory.h: Revert 6e44bd6d34d6 ("memblock: exclude NOMAP regions from kmemleak"), the issue it is fixing will be fixed differently. Reported-by: Qian Cai Signed-off-by: Mike Rapoport Acked-by: Catalin Marinas Signed-off-by: Linus Torvalds commit 9d235ac01f54e8f8c1d967b25ac29e4313a41c5c Merge: 6c2c712767ee1 5ebcbe342b1c1 Author: Linus Torvalds Date: Thu Oct 21 17:27:17 2021 -1000 Merge branch 'ucount-fixes-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull ucounts fixes from Eric Biederman: "There has been one very hard to track down bug in the ucount code that we have been tracking since roughly v5.14 was released. Alex managed to find a reliable reproducer a few days ago and then I was able to instrument the code and figure out what the issue was. It turns out the sigqueue_alloc single atomic operation optimization did not play nicely with ucounts multiple level rlimits. It turned out that either sigqueue_alloc or sigqueue_free could be operating on multiple levels and trigger the conditions for the optimization on more than one level at the same time. To deal with that situation I have introduced inc_rlimit_get_ucounts and dec_rlimit_put_ucounts that just focuses on the optimization and the rlimit and ucount changes. While looking into the big bug I found I couple of other little issues so I am including those fixes here as well. When I have time I would very much like to dig into process ownership of the shared signal queue and see if we could pick a single owner for the entire queue so that all of the rlimits can count to that owner. That should entirely remove the need to call get_ucounts and put_ucounts in sigqueue_alloc and sigqueue_free. It is difficult because Linux unlike POSIX supports setuid that works on a single thread" * 'ucount-fixes-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring ucounts: Proper error handling in set_cred_ucounts ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds ucounts: Fix signal ucount refcounting commit 6c2c712767ee1d74b2234c9caaf1920808333be6 Merge: 0a3221b65874b 397430b50a363 Author: Linus Torvalds Date: Thu Oct 21 15:36:50 2021 -1000 Merge tag 'net-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, and can. We'll have one more fix for a socket accounting regression, it's still getting polished. Otherwise things look fine. Current release - regressions: - revert "vrf: reset skb conntrack connection on VRF rcv", there are valid uses for previous behavior - can: m_can: fix iomap_read_fifo() and iomap_write_fifo() Current release - new code bugs: - mlx5: e-switch, return correct error code on group creation failure Previous releases - regressions: - sctp: fix transport encap_port update in sctp_vtag_verify - stmmac: fix E2E delay mechanism (in PTP timestamping) Previous releases - always broken: - netfilter: ip6t_rt: fix out-of-bounds read of ipv6_rt_hdr - netfilter: xt_IDLETIMER: fix out-of-bound read caused by lack of init - netfilter: ipvs: make global sysctl read-only in non-init netns - tcp: md5: fix selection between vrf and non-vrf keys - ipv6: count rx stats on the orig netdev when forwarding - bridge: mcast: use multicast_membership_interval for IGMPv3 - can: - j1939: fix UAF for rx_kref of j1939_priv abort sessions on receiving bad messages - isotp: fix TX buffer concurrent access in isotp_sendmsg() fix return error on FC timeout on TX path - ice: fix re-init of RDMA Tx queues and crash if RDMA was not inited - hns3: schedule the polling again when allocation fails, prevent stalls - drivers: add missing of_node_put() when aborting for_each_available_child_of_node() - ptp: fix possible memory leak and UAF in ptp_clock_register() - e1000e: fix packet loss in burst mode on Tiger Lake and later - mlx5e: ipsec: fix more checksum offload issues" * tag 'net-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (75 commits) usbnet: sanity check for maxpacket net: enetc: make sure all traffic classes can send large frames net: enetc: fix ethtool counter name for PM0_TERR ptp: free 'vclock_index' in ptp_clock_release() sfc: Don't use netif_info before net_device setup sfc: Export fibre-specific supported link modes net/mlx5e: IPsec: Fix work queue entry ethernet segment checksum flags net/mlx5e: IPsec: Fix a misuse of the software parser's fields net/mlx5e: Fix vlan data lost during suspend flow net/mlx5: E-switch, Return correct error code on group creation failure net/mlx5: Lag, change multipath and bonding to be mutually exclusive ice: Add missing E810 device ids igc: Update I226_K device ID e1000e: Fix packet loss on Tiger Lake and later e1000e: Separate TGP board type from SPT ptp: Fix possible memory leak in ptp_clock_register() net: stmmac: Fix E2E delay mechanism nfc: st95hf: Make spi remove() callback return zero net: hns3: disable sriov before unload hclge layer net: hns3: fix vf reset workqueue cannot exit ... commit 0a3221b65874b5089f1742de59ef89f032b9f2ea Merge: 2f111a6fd5b52 787252a10d942 Author: Linus Torvalds Date: Thu Oct 21 15:30:09 2021 -1000 Merge tag 'powerpc-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a bug exposed by a previous fix, where running guests with certain SMT topologies could crash the host on Power8. - Fix atomic sleep warnings when re-onlining CPUs, when PREEMPT is enabled. Thanks to Nathan Lynch, Srikar Dronamraju, and Valentin Schneider. * tag 'powerpc-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/smp: do not decrement idle task preempt count in CPU offline powerpc/idle: Don't corrupt back chain when going idle commit 595cb5e0b832a3e100cbbdefef797b0c27bf725a Author: Kim Phillips Date: Thu Oct 21 10:30:06 2021 -0500 Revert "drm/ast: Add detect function support" This reverts commit aae74ff9caa8de9a45ae2e46068c417817392a26, since it prevents my AMD Milan system from booting, with: [ 27.189558] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 27.197506] #PF: supervisor write access in kernel mode [ 27.203333] #PF: error_code(0x0002) - not-present page [ 27.209064] PGD 0 P4D 0 [ 27.211885] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 27.216744] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-rc6+ #15 [ 27.223928] Hardware name: AMD Corporation ETHANOL_X/ETHANOL_X, BIOS RXM1006B 08/20/2021 [ 27.232955] RIP: 0010:run_timer_softirq+0x38b/0x4a0 [ 27.238397] Code: 4c 89 f7 e8 37 27 ac 00 49 c7 46 08 00 00 00 00 49 8b 04 24 48 85 c0 74 71 4d 8b 3c 24 4d 89 7e 08 66 90 49 8b 07 49 8b 57 08 <48> 89 02 48 85 c0 74 04 48 89 50 08 49 8b 77 18 41 f6 47 22 20 4c [ 27.259350] RSP: 0018:ffffc42d00003ee8 EFLAGS: 00010086 [ 27.265176] RAX: dead000000000122 RBX: 0000000000000000 RCX: 0000000000000101 [ 27.273134] RDX: 0000000000000000 RSI: 0000000000000087 RDI: 0000000000000001 [ 27.281084] RBP: ffffc42d00003f70 R08: 0000000000000000 R09: 00000000000003eb [ 27.289043] R10: ffffa0860cb300d0 R11: ffffa0c44de290b0 R12: ffffc42d00003ef8 [ 27.297002] R13: 00000000fffef200 R14: ffffa0c44de18dc0 R15: ffffa0867a882350 [ 27.304961] FS: 0000000000000000(0000) GS:ffffa0c44de00000(0000) knlGS:0000000000000000 [ 27.313988] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.320396] CR2: 0000000000000000 CR3: 000000014569c001 CR4: 0000000000770ef0 [ 27.328346] PKRU: 55555554 [ 27.331359] Call Trace: [ 27.334073] [ 27.336314] ? __queue_work+0x420/0x420 [ 27.340589] ? lapic_next_event+0x21/0x30 [ 27.345060] ? clockevents_program_event+0x8f/0xe0 [ 27.350402] __do_softirq+0xfb/0x2db [ 27.354388] irq_exit_rcu+0x98/0xd0 [ 27.358275] sysvec_apic_timer_interrupt+0xac/0xd0 [ 27.363620] [ 27.365955] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 27.371685] RIP: 0010:cpuidle_enter_state+0xcc/0x390 [ 27.377292] Code: 3d 01 79 0a 50 e8 44 ed 77 ff 49 89 c6 0f 1f 44 00 00 31 ff e8 f5 f8 77 ff 80 7d d7 00 0f 85 e6 01 00 00 fb 66 0f 1f 44 00 00 <45> 85 ff 0f 88 17 01 00 00 49 63 c7 4c 2b 75 c8 48 8d 14 40 48 8d [ 27.398243] RSP: 0018:ffffffffb0e03dc8 EFLAGS: 00000246 [ 27.404069] RAX: ffffa0c44de00000 RBX: 0000000000000001 RCX: 000000000000001f [ 27.412028] RDX: 0000000000000000 RSI: ffffffffb0bafc1f RDI: ffffffffb0bbdb81 [ 27.419986] RBP: ffffffffb0e03e00 R08: 00000006549f8f3f R09: ffffffffb1065200 [ 27.427935] R10: ffffa0c44de27ae4 R11: ffffa0c44de27ac4 R12: ffffa0c5634cb000 [ 27.435894] R13: ffffffffb1065200 R14: 00000006549f8f3f R15: 0000000000000001 [ 27.443854] ? cpuidle_enter_state+0xbb/0x390 [ 27.448712] cpuidle_enter+0x2e/0x40 [ 27.452695] call_cpuidle+0x23/0x40 [ 27.456584] do_idle+0x1f0/0x270 [ 27.460181] cpu_startup_entry+0x20/0x30 [ 27.464553] rest_init+0xd4/0xe0 [ 27.468149] arch_call_rest_init+0xe/0x1b [ 27.472619] start_kernel+0x6bc/0x6e2 [ 27.476764] x86_64_start_reservations+0x24/0x26 [ 27.481912] x86_64_start_kernel+0x75/0x79 [ 27.486477] secondary_startup_64_no_verify+0xb0/0xbb [ 27.492111] Modules linked in: kvm_amd(+) kvm ipmi_si(+) ipmi_devintf rapl wmi_bmof ipmi_msghandler input_leds ccp k10temp mac_hid sch_fq_codel msr ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper crct10dif_pclmul crc32_pclmul ghash_clmulni_intel syscopyarea aesni_intel sysfillrect crypto_simd sysimgblt fb_sys_fops cryptd hid_generic cec nvme ahci usbhid drm e1000e nvme_core hid libahci i2c_piix4 wmi [ 27.551789] CR2: 0000000000000000 [ 27.555482] ---[ end trace 897987dfe93dccc6 ]--- [ 27.560630] RIP: 0010:run_timer_softirq+0x38b/0x4a0 [ 27.566069] Code: 4c 89 f7 e8 37 27 ac 00 49 c7 46 08 00 00 00 00 49 8b 04 24 48 85 c0 74 71 4d 8b 3c 24 4d 89 7e 08 66 90 49 8b 07 49 8b 57 08 <48> 89 02 48 85 c0 74 04 48 89 50 08 49 8b 77 18 41 f6 47 22 20 4c [ 27.587021] RSP: 0018:ffffc42d00003ee8 EFLAGS: 00010086 [ 27.592848] RAX: dead000000000122 RBX: 0000000000000000 RCX: 0000000000000101 [ 27.600808] RDX: 0000000000000000 RSI: 0000000000000087 RDI: 0000000000000001 [ 27.608765] RBP: ffffc42d00003f70 R08: 0000000000000000 R09: 00000000000003eb [ 27.616716] R10: ffffa0860cb300d0 R11: ffffa0c44de290b0 R12: ffffc42d00003ef8 [ 27.624673] R13: 00000000fffef200 R14: ffffa0c44de18dc0 R15: ffffa0867a882350 [ 27.632624] FS: 0000000000000000(0000) GS:ffffa0c44de00000(0000) knlGS:0000000000000000 [ 27.641650] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.648159] CR2: 0000000000000000 CR3: 000000014569c001 CR4: 0000000000770ef0 [ 27.656119] PKRU: 55555554 [ 27.659133] Kernel panic - not syncing: Fatal exception in interrupt [ 29.030411] Shutting down cpus with NMI [ 29.034699] Kernel Offset: 0x2e600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 29.046790] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Since unreliable, found by bisecting for KASAN's use-after-free in enqueue_timer+0x4f/0x1e0, where the timer callback is called. Reported-by: Kim Phillips Signed-off-by: Kim Phillips Fixes: aae74ff9caa8 ("drm/ast: Add detect function support") Link: https://lore.kernel.org/lkml/0f7871be-9ca6-5ae4-3a40-5db9a8fb2365@amd.com/ Cc: Ainux Cc: Thomas Zimmermann Cc: David Airlie Cc: David Airlie Cc: Daniel Vetter Cc: sterlingteng@gmail.com Cc: chenhuacai@kernel.org Cc: Chuck Lever III Cc: Borislav Petkov Cc: Borislav Petkov Cc: Jon Grimm Cc: dri-devel Cc: linux-kernel Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20211021153006.92983-1-kim.phillips@amd.com commit 7e1c5440f4f9b4db5cb2482c347fa3d74bf50440 Merge: 730b64d827c30 74056092ff415 Author: Dave Airlie Date: Fri Oct 22 05:34:54 2021 +1000 Merge tag 'drm-misc-fixes-2021-10-21-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.15-rc7: - Rebased, to remove vc4 patches. - Fix mxsfb crash on unload. - Use correct sync parameters for Feixin K101-IM2BYL02. - Assorted kmb modeset/atomic fixes. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/e66eaf89-b9b9-41f5-d0d2-dad7e59fabb5@linux.intel.com commit 730b64d827c309f43bc6a91134e3551f25599cbc Merge: 519d81956ee27 5ca6779d2f18b Author: Dave Airlie Date: Fri Oct 22 05:22:10 2021 +1000 Merge tag 'drm-msm-fixes-2021-10-18' of https://gitlab.freedesktop.org/drm/msm into drm-fixes One more fix for v5.15, to work around a power stability issue on a630 (and possibly others) Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGs1WPLthmd=ToDcEHm=u-7O38RAVJ2XwRoS8xPmC520vg@mail.gmail.com commit def0c3697287f6e85d5ac68b21302966c95474f9 Author: Bryant Mairs Date: Tue Oct 19 09:24:33 2021 -0500 drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 Fixes screen orientation for the Aya Neo 2021 handheld gaming console. Signed-off-by: Bryant Mairs Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs commit b22fa62a35d7f2029d757a518d78041822b7c7c1 Author: Pavel Begunkov Date: Thu Oct 21 13:20:29 2021 +0100 io_uring: apply worker limits to previous users Another change to the API io-wq worker limitation API added in 5.15, apply the limit to all prior users that already registered a tctx. It may be confusing as it's now, in particular the change covers the following 2 cases: TASK1 | TASK2 _________________________________________________ ring = create() | | limit_iowq_workers() *not limited* | TASK1 | TASK2 _________________________________________________ ring = create() | | issue_requests() limit_iowq_workers() | | *not limited* A note on locking, it's safe to traverse ->tctx_list as we hold ->uring_lock, but do that after dropping sqd->lock to avoid possible problems. It's also safe to access tctx->io_wq there because tasks kill it only after removing themselves from tctx_list, see io_uring_cancel_generic() -> io_uring_clean_tctx() Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d6e09ecc3545e4dc56e43c906ee3d71b7ae21bed.1634818641.git.asml.silence@gmail.com Reviewed-by: Hao Xu Signed-off-by: Jens Axboe commit c8c340a9b4149fe5caa433f3b62463a1c8e07a46 Author: Masahiro Kozuka Date: Tue Sep 14 14:09:51 2021 -0700 KVM: SEV: Flush cache on non-coherent systems before RECEIVE_UPDATE_DATA Flush the destination page before invoking RECEIVE_UPDATE_DATA, as the PSP encrypts the data with the guest's key when writing to guest memory. If the target memory was not previously encrypted, the cache may contain dirty, unecrypted data that will persist on non-coherent systems. Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Cc: stable@vger.kernel.org Cc: Peter Gonda Cc: Marc Orr Cc: Tom Lendacky Cc: Brijesh Singh Signed-off-by: Masahiro Kozuka [sean: converted bug report to changelog] Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini Message-Id: <20210914210951.2994260-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a3ca5281bb771d8103ea16f0a6a8a5df9a7fb4f3 Author: Chenyi Qiang Date: Thu Oct 21 15:10:22 2021 +0800 KVM: MMU: Reset mmu->pkru_mask to avoid stale data When updating mmu->pkru_mask, the value can only be added but it isn't reset in advance. This will make mmu->pkru_mask keep the stale data. Fix this issue. Fixes: 2d344105f57c ("KVM, pkeys: introduce pkru_mask to cache conditions") Signed-off-by: Chenyi Qiang Message-Id: <20211021071022.1140-1-chenyi.qiang@intel.com> Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 397430b50a363d8b7bdda00522123f82df6adc5e Author: Oliver Neukum Date: Thu Oct 21 14:29:44 2021 +0200 usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues Signed-off-by: Oliver Neukum Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20211021122944.21816-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit e378f4967c8edd64c680f2e279cb646ee06b6f2d Author: Vladimir Oltean Date: Wed Oct 20 20:33:40 2021 +0300 net: enetc: make sure all traffic classes can send large frames The enetc driver does not implement .ndo_change_mtu, instead it configures the MAC register field PTC{Traffic Class}MSDUR[MAXSDU] statically to a large value during probe time. The driver used to configure only the max SDU for traffic class 0, and that was fine while the driver could only use traffic class 0. But with the introduction of mqprio, sending a large frame into any other TC than 0 is broken. This patch fixes that by replicating per traffic class the static configuration done in enetc_configure_port_mac(). Fixes: cbe9e835946f ("enetc: Enable TC offloading with mqprio") Reported-by: Richie Pearn Signed-off-by: Vladimir Oltean Reviewed-by: Link: https://lore.kernel.org/r/20211020173340.1089992-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit fb8dc5fc8cbdfd62ecd16493848aee2f42ed84d9 Author: Vladimir Oltean Date: Wed Oct 20 19:52:06 2021 +0300 net: enetc: fix ethtool counter name for PM0_TERR There are two counters named "MAC tx frames", one of them is actually incorrect. The correct name for that counter should be "MAC tx error frames", which is symmetric to the existing "MAC rx error frames". Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics") Signed-off-by: Vladimir Oltean Reviewed-by: Link: https://lore.kernel.org/r/20211020165206.1069889-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0db55f9a1bafbe3dac750ea669de9134922389b5 Author: Christian König Date: Wed Oct 20 19:19:46 2021 +0200 drm/ttm: fix memleak in ttm_transfered_destroy We need to cleanup the fences for ghost objects as well. Signed-off-by: Christian König Reported-by: Erhard F. Tested-by: Erhard F. Reviewed-by: Huang Rui Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447 CC: Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com commit 0a30896fc5025e71c350449760b240fba5581b42 Author: Thomas Gleixner Date: Wed Oct 20 23:08:16 2021 +0200 MAINTAINERS: Add Dave Hansen to the x86 maintainer team Dave is already listed as x86/mm maintainer, has a profund knowledge of the x86 architecture in general and a good taste in terms of kernel programming in general. Add him as a full x86 maintainer with all rights and duties. Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov Acked-by: Borislav Petkov Acked-by: Andy Lutomirski Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/87zgr3flq7.ffs@tglx commit b6b19a71c8bbde2abaa99ba29e6c76ddc84984f8 Author: Yang Yingliang Date: Thu Oct 21 17:13:53 2021 +0800 ptp: free 'vclock_index' in ptp_clock_release() 'vclock_index' is accessed from sysfs, it shouled be freed in release function, so move it from ptp_clock_unregister() to ptp_clock_release(). Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit bf6abf345dfa77786aca554bc58c64bd428ecb1d Author: Erik Ekman Date: Wed Oct 20 00:40:16 2021 +0200 sfc: Don't use netif_info before net_device setup Use pci_info instead to avoid unnamed/uninitialized noise: [197088.688729] sfc 0000:01:00.0: Solarflare NIC detected [197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F [197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed [197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before net_device is registered") from Heiner Kallweit. Signed-off-by: Erik Ekman Acked-by: Martin Habets Signed-off-by: David S. Miller commit c62041c5baa9ded3bc6fd38d3f724de70683b489 Author: Erik Ekman Date: Tue Oct 19 23:13:32 2021 +0200 sfc: Export fibre-specific supported link modes The 1/10GbaseT modes were set up for cards with SFP+ cages in 3497ed8c852a5 ("sfc: report supported link speeds on SFP connections"). 10GbaseT was likely used since no 10G fibre mode existed. The missing fibre modes for 1/10G were added to ethtool.h in 5711a9822144 ("net: ethtool: add support for 1000BaseX and missing 10G link modes") shortly thereafter. The user guide available at https://support-nic.xilinx.com/wp/drivers lists support for the following cable and transceiver types in section 2.9: - QSFP28 100G Direct Attach Cables - QSFP28 100G SR Optical Transceivers (with SR4 modules listed) - SFP28 25G Direct Attach Cables - SFP28 25G SR Optical Transceivers - QSFP+ 40G Direct Attach Cables - QSFP+ 40G Active Optical Cables - QSFP+ 40G SR4 Optical Transceivers - QSFP+ to SFP+ Breakout Direct Attach Cables - QSFP+ to SFP+ Breakout Active Optical Cables - SFP+ 10G Direct Attach Cables - SFP+ 10G SR Optical Transceivers - SFP+ 10G LR Optical Transceivers - SFP 1000BASE‐T Transceivers - 1G Optical Transceivers (From user guide issue 28. Issue 16 which also includes older cards like SFN5xxx/SFN6xxx has matching lists for 1/10/40G transceiver types.) Regarding SFP+ 10GBASE‐T transceivers the latest guide says: "Solarflare adapters do not support 10GBASE‐T transceiver modules." Tested using SFN5122F-R7 (with 2 SFP+ ports). Supported link modes do not change depending on module used (tested with 1000BASE-T, 1000BASE-BX10, 10GBASE-LR). Before: $ ethtool ext Settings for ext: Supported ports: [ FIBRE ] Supported link modes: 1000baseT/Full 10000baseT/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Link partner advertised link modes: Not reported Link partner advertised pause frame use: No Link partner advertised auto-negotiation: No Link partner advertised FEC modes: Not reported Speed: 1000Mb/s Duplex: Full Auto-negotiation: off Port: FIBRE PHYAD: 255 Transceiver: internal Current message level: 0x000020f7 (8439) drv probe link ifdown ifup rx_err tx_err hw Link detected: yes After: $ ethtool ext Settings for ext: Supported ports: [ FIBRE ] Supported link modes: 1000baseT/Full 1000baseX/Full 10000baseCR/Full 10000baseSR/Full 10000baseLR/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Link partner advertised link modes: Not reported Link partner advertised pause frame use: No Link partner advertised auto-negotiation: No Link partner advertised FEC modes: Not reported Speed: 1000Mb/s Duplex: Full Auto-negotiation: off Port: FIBRE PHYAD: 255 Transceiver: internal Supports Wake-on: g Wake-on: d Current message level: 0x000020f7 (8439) drv probe link ifdown ifup rx_err tx_err hw Link detected: yes Signed-off-by: Erik Ekman Acked-by: Martin Habets Signed-off-by: David S. Miller commit 1439caa1d989ef845765b755aa8fde77ab49ab6f Merge: e0bfcf9c77d9b d9aaaf223297f Author: David S. Miller Date: Thu Oct 21 12:32:41 2021 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter fixes for net: 1) Crash due to missing initialization of timer data in xt_IDLETIMER, from Juhee Kang. 2) NF_CONNTRACK_SECMARK should be bool in Kconfig, from Vegard Nossum. 3) Skip netdev events on netns removal, from Florian Westphal. 4) Add testcase to show port shadowing via UDP, also from Florian. 5) Remove pr_debug() code in ip6t_rt, this fixes a crash due to unsafe access to non-linear skbuff, from Xin Long. 6) Make net/ipv4/vs/debug_level read-only from non-init netns, from Antoine Tenart. 7) Remove bogus invocation to bash in selftests/netfilter/nft_flowtable.sh also from Florian. ==================== Signed-off-by: David S. Miller commit e0bfcf9c77d9b2c11d2767f0c747f7721ae0cc51 Merge: a689702a6cfc2 1d00032394013 Author: David S. Miller Date: Thu Oct 21 12:11:26 2021 +0100 Merge tag 'mlx5-fixes-2021-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2021-10-20 ==================== Signed-off-by: David S. Miller commit a689702a6cfc2a71b484a34df66c8cacd803874b Merge: 4225fea1cb283 7dcf78b870be6 Author: David S. Miller Date: Thu Oct 21 12:10:29 2021 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-10-20 This series contains updates to e1000e, igc, and ice drivers. Sasha fixes an issue with dropped packets on Tiger Lake platforms for e1000e and corrects a device ID for igc. Tony adds missing E810 device IDs for ice. ==================== Signed-off-by: David S. Miller commit 74056092ff415e7e20ce2544689b32ee811c4f0b Author: Anitha Chrisanthus Date: Mon Jun 7 14:17:11 2021 -0700 drm/kmb: Enable ADV bridge after modeset On KMB, ADV bridge must be programmed and powered on prior to MIPI DSI HW initialization. v2: changed to atomic_bridge_chain_enable (Sam) Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver") Co-developed-by: Edmund Dea Signed-off-by: Edmund Dea Signed-off-by: Anitha Chrisanthus Link: https://patchwork.freedesktop.org/patch/msgid/20211019230719.789958-1-anitha.chrisanthus@intel.com Acked-by: Sam Ravnborg Signed-off-by: Maarten Lankhorst commit 004d2719806fb8e355c1bccd538e82c04319d391 Author: Anitha Chrisanthus Date: Mon Jul 19 16:28:51 2021 -0700 drm/kmb: Corrected typo in handle_lcd_irq Check for Overflow bits for layer3 in the irq handler. Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display") Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-5-anitha.chrisanthus@intel.com Signed-off-by: Maarten Lankhorst commit 982f8ad666a1123028a077b6b009871a0dc9df26 Author: Edmund Dea Date: Wed Oct 6 16:03:48 2021 -0700 drm/kmb: Disable change of plane parameters Due to HW limitations, KMB cannot change height, width, or pixel format after initial plane configuration. v2: removed memset disp_cfg as it is already zero. Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display") Signed-off-by: Edmund Dea Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-4-anitha.chrisanthus@intel.com Signed-off-by: Maarten Lankhorst commit 13047a092c6d3f23b7d684b5b3fe46b2b50423b9 Author: Edmund Dea Date: Tue Apr 20 15:31:53 2021 -0700 drm/kmb: Remove clearing DPHY regs Don't clear the shared DPHY registers common to MIPI Rx and MIPI Tx during DSI initialization since this was causing MIPI Rx reset. Rest of the writes are bitwise, so will not affect Mipi Rx side. Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver") Signed-off-by: Edmund Dea Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-3-anitha.chrisanthus@intel.com Signed-off-by: Maarten Lankhorst commit a79f40cccd4644c32f6d5ae1ccf091a262e1dc57 Author: Anitha Chrisanthus Date: Fri Jan 8 14:34:13 2021 -0800 drm/kmb: Limit supported mode to 1080p KMB only supports single resolution(1080p), this commit checks for 1920x1080x60 or 1920x1080x59 in crtc_mode_valid. Also, modes with vfp < 4 are not supported in KMB display. This change prunes display modes with vfp < 4. v2: added vfp check Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display") Co-developed-by: Edmund Dea Signed-off-by: Edmund Dea Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link:https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-2-anitha.chrisanthus@intel.com Signed-off-by: Maarten Lankhorst commit 3e4c31e8f70251732529a10934355084c7fab0ac Author: Anitha Chrisanthus Date: Tue Dec 15 11:13:09 2020 -0800 drm/kmb: Work around for higher system clock Use a different value for system clock offset in the ppl/llp ratio calculations for clocks higher than 500 Mhz. Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver") Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-1-anitha.chrisanthus@intel.com Signed-off-by: Maarten Lankhorst commit 772970620a839141835eaf2bc507d957b10adcca Author: Dan Johansen Date: Wed Aug 18 23:48:18 2021 +0200 drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel This adjusts sync values according to the datasheet Fixes: 1c243751c095 ("drm/panel: ilitek-ili9881c: add support for Feixin K101-IM2BYL02 panel") Co-developed-by: Marius Gripsgard Signed-off-by: Dan Johansen Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20210818214818.298089-1-strit@manjaro.org Signed-off-by: Maarten Lankhorst commit 3cfc183052c3dbf8eae57b6c1685dab00ed3db4a Author: Marek Vasut Date: Sat Oct 16 23:04:46 2021 +0200 drm: mxsfb: Fix NULL pointer dereference crash on unload The mxsfb->crtc.funcs may already be NULL when unloading the driver, in which case calling mxsfb_irq_disable() via drm_irq_uninstall() from mxsfb_unload() leads to NULL pointer dereference. Since all we care about is masking the IRQ and mxsfb->base is still valid, just use that to clear and mask the IRQ. Fixes: ae1ed00932819 ("drm: mxsfb: Stop using DRM simple display pipeline helper") Signed-off-by: Marek Vasut Cc: Daniel Abrecht Cc: Emil Velikov Cc: Laurent Pinchart Cc: Sam Ravnborg Cc: Stefan Agner Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211016210446.171616-1-marex@denx.de Signed-off-by: Maarten Lankhorst commit 964d32e512670c7b87870e30cfed2303da86d614 Author: Miklos Szeredi Date: Thu Oct 21 10:01:39 2021 +0200 fuse: clean up error exits in fuse_fill_super() Instead of "goto err", return error directly, since there's no error cleanup to do now. Signed-off-by: Miklos Szeredi commit 80019f1138324b6f35ae728b4f25eeb08899b452 Author: Miklos Szeredi Date: Thu Oct 21 10:01:39 2021 +0200 fuse: always initialize sb->s_fs_info Syzkaller reports a null pointer dereference in fuse_test_super() that is caused by sb->s_fs_info being NULL. This is due to the fact that fuse_fill_super() is initializing s_fs_info, which is too late, it's already on the fs_supers list. The initialization needs to be done in sget_fc() with the sb_lock held. Move allocation of fuse_mount and fuse_conn from fuse_fill_super() into fuse_get_tree(). After this ->kill_sb() will always be called with non-NULL ->s_fs_info, hence fuse_mount_destroy() can drop the test for non-NULL "fm". Reported-by: syzbot+74a15f02ccb51f398601@syzkaller.appspotmail.com Fixes: 5d5b74aa9c76 ("fuse: allow sharing existing sb") Signed-off-by: Miklos Szeredi commit c191cd07ee948c93081d8e4cba43d23b18b2f3da Author: Miklos Szeredi Date: Thu Oct 21 10:01:39 2021 +0200 fuse: clean up fuse_mount destruction 1. call fuse_mount_destroy() for open coded variants 2. before deactivate_locked_super() don't need fuse_mount destruction since that will now be done (if ->s_fs_info is not cleared) 3. rearrange fuse_mount setup in fuse_get_tree_submount() so that the regular pattern can be used Signed-off-by: Miklos Szeredi commit a27c061a49afd7ad2d935e6ac734e2a9f62861b8 Author: Miklos Szeredi Date: Thu Oct 21 10:01:38 2021 +0200 fuse: get rid of fuse_put_super() The ->put_super callback is called from generic_shutdown_super() in case of a fully initialized sb. This is called from kill_***_super(), which is called from ->kill_sb instances. Fuse uses ->put_super to destroy the fs specific fuse_mount and drop the reference to the fuse_conn, while it does the same on each error case during sb setup. This patch moves the destruction from fuse_put_super() to fuse_mount_destroy(), called at the end of all ->kill_sb instances. A follup patch will clean up the error paths. Signed-off-by: Miklos Szeredi commit d534d31d6a45d71de61db22090b4820afb68fddc Author: Miklos Szeredi Date: Thu Oct 21 10:01:38 2021 +0200 fuse: check s_root when destroying sb Checking "fm" works because currently sb->s_fs_info is cleared on error paths; however, sb->s_root is what generic_shutdown_super() checks to determine whether the sb was fully initialized or not. This change will allow cleanup of sb setup error paths. Signed-off-by: Miklos Szeredi commit 3a25dfa67fe40f3a2690af2c562e0947a78bd6a0 Author: Paolo Bonzini Date: Wed Oct 20 06:22:59 2021 -0400 KVM: nVMX: promptly process interrupts delivered while in guest mode Since commit c300ab9f08df ("KVM: x86: Replace late check_nested_events() hack with more precise fix") there is no longer the certainty that check_nested_events() tries to inject an external interrupt vmexit to L1 on every call to vcpu_enter_guest. Therefore, even in that case we need to set KVM_REQ_EVENT. This ensures that inject_pending_event() is called, and from there kvm_check_nested_events(). Fixes: c300ab9f08df ("KVM: x86: Replace late check_nested_events() hack with more precise fix") Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit de7cd3f6761f49bef044ec49493d88737a70f1a6 Author: Paolo Bonzini Date: Wed Oct 20 06:27:36 2021 -0400 KVM: x86: check for interrupts before deciding whether to exit the fast path The kvm_x86_sync_pir_to_irr callback can sometimes set KVM_REQ_EVENT. If that happens exactly at the time that an exit is handled as EXIT_FASTPATH_REENTER_GUEST, vcpu_enter_guest will go incorrectly through the loop that calls kvm_x86_run, instead of processing the request promptly. Fixes: 379a3c8ee444 ("KVM: VMX: Optimize posted-interrupt delivery for timer fastpath") Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 282da7cef078a87b6d5e8ceba8b17e428cf0e37c Author: Chanho Park Date: Mon Oct 18 15:28:41 2021 +0900 scsi: ufs: ufs-exynos: Correct timeout value setting registers PA_PWRMODEUSERDATA0 -> DL_FC0PROTTIMEOUTVAL PA_PWRMODEUSERDATA1 -> DL_TC0REPLAYTIMEOUTVAL PA_PWRMODEUSERDATA2 -> DL_AFC0REQTIMEOUTVAL Link: https://lore.kernel.org/r/20211018062841.18226-1-chanho61.park@samsung.com Fixes: a967ddb22d94 ("scsi: ufs: ufs-exynos: Apply vendor-specific values for three timeouts") Cc: Alim Akhtar Cc: Kiwoong Kim Cc: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Reviewed-by: Avri Altman Signed-off-by: Chanho Park Signed-off-by: Martin K. Petersen commit e20f80b9b163dc402dca115eed0affba6df5ebb5 Author: Brian King Date: Tue Oct 19 10:21:29 2021 -0500 scsi: ibmvfc: Fix up duplicate response detection Commit a264cf5e81c7 ("scsi: ibmvfc: Fix command state accounting and stale response detection") introduced a regression in detecting duplicate responses. This was observed in test where a command was sent to the VIOS and completed before ibmvfc_send_event() set the active flag to 1, which resulted in the atomic_dec_if_positive() call in ibmvfc_handle_crq() thinking this was a duplicate response, which resulted in scsi_done() not getting called, so we then hit a SCSI command timeout for this command once the timeout expires. This simply ensures the active flag gets set prior to making the hcall to send the command to the VIOS, in order to close this window. Link: https://lore.kernel.org/r/20211019152129.16558-1-brking@linux.vnet.ibm.com Fixes: a264cf5e81c7 ("scsi: ibmvfc: Fix command state accounting and stale response detection") Cc: stable@vger.kernel.org Acked-by: Tyrel Datwyler Signed-off-by: Brian King Signed-off-by: Martin K. Petersen commit 25f54d08f12feb593e62cc2193fedefaf7825301 Author: Ian Kent Date: Thu Sep 23 15:13:39 2021 +0800 autofs: fix wait name hash calculation in autofs_wait() There's a mistake in commit 2be7828c9fefc ("get rid of autofs_getpath()") that affects kernels from v5.13.0, basically missed because of me not fully testing the change for Al. The problem is that the hash calculation for the wait name qstr hasn't been updated to account for the change to use dentry_path_raw(). This prevents the correct matching an existing wait resulting in multiple notifications being sent to the daemon for the same mount which must not occur. The problem wasn't discovered earlier because it only occurs when multiple processes trigger a request for the same mount concurrently so it only shows up in more aggressive testing. Fixes: 2be7828c9fefc ("get rid of autofs_getpath()") Cc: stable@vger.kernel.org Signed-off-by: Ian Kent Signed-off-by: Al Viro commit 2f111a6fd5b5297b4e92f53798ca086f7c7d33a4 Merge: 515dcc2e02178 1bd85aa65d0e7 Author: Linus Torvalds Date: Wed Oct 20 10:23:05 2021 -1000 Merge tag 'ceph-for-5.15-rc7' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Two important filesystem fixes, marked for stable. The blocklisted superblocks issue was particularly annoying because for unexperienced users it essentially exacted a reboot to establish a new functional mount in that scenario" * tag 'ceph-for-5.15-rc7' of git://github.com/ceph/ceph-client: ceph: fix handling of "meta" errors ceph: skip existing superblocks that are blocklisted or shut down when mounting commit 515dcc2e02178ea8af2ea53b4ae5bdb6875b53ef Merge: 8e37395c3a5dc c2bbf9d1e9ac7 Author: Linus Torvalds Date: Wed Oct 20 10:16:51 2021 -1000 Merge tag 'dma-mapping-5.15-2' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - fix more dma-debug fallout (Gerald Schaefer, Hamza Mahfooz) - fix a kerneldoc warning (Logan Gunthorpe) * tag 'dma-mapping-5.15-2' of git://git.infradead.org/users/hch/dma-mapping: dma-debug: teach add_dma_entry() about DMA_ATTR_SKIP_CPU_SYNC dma-debug: fix sg checks in debug_dma_map_sg() dma-mapping: fix the kerneldoc for dma_map_sgtable() commit 53c2ff8bcb06acd07e24a62e7f5a0247bd7c6f67 Author: Aaron Liu Date: Tue Oct 19 11:13:25 2021 +0800 drm/amdgpu: support B0&B1 external revision id for yellow carp B0 internal rev_id is 0x01, B1 internal rev_id is 0x02. The external rev_id for B0 and B1 is 0x20. The original expression is not suitable for B1. v2: squash in fix for display code (Alex) Signed-off-by: Aaron Liu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2ef8ea23942f4c2569930c34e7689a0cb1b232cc Author: Jake Wang Date: Fri Oct 1 17:14:21 2021 -0400 drm/amd/display: Moved dccg init to after bios golden init [Why] bios_golden_init will override dccg_init during init_hw. [How] Move dccg_init to after bios_golden_init. Reviewed-by: Aric Cyr Reviewed-by: Eric Yang Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Jake Wang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit dd8cb18906d97b2916fde42d32d915ae363c7e55 Author: Nikola Cornij Date: Fri Oct 1 13:26:05 2021 -0400 drm/amd/display: Increase watermark latencies for DCN3.1 [why] The original latencies were causing underflow in some modes [how] Replace with the up-to-date watermark values based on new measurments Reviewed-by: Ahmad Othman Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Nikola Cornij Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4835ea6c173a8d8dfbfdbb21c4cd987d12681610 Author: Eric Yang Date: Thu Sep 30 13:46:45 2021 -0400 drm/amd/display: increase Z9 latency to workaround underflow in Z9 [Why] Z9 latency is higher than when we originally tuned the watermark parameters, causing underflow. Increasing the value until the latency issues is resolved. Reviewed-by: Nicholas Kazlauskas Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Eric Yang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 672437486ee9da3ed0e774937e6d0dd570921b39 Author: Nicholas Kazlauskas Date: Wed Sep 29 16:22:53 2021 -0400 drm/amd/display: Require immediate flip support for DCN3.1 planes [Why] Immediate flip can be enabled dynamically and has higher BW requirements when validating which voltage mode to use. If we validate when it's not set then potentially DCFCLK will be too low and we will underflow. [How] DM always requires support so always require it as part of DML input parameters. This can't be enabled unconditionally on older ASIC because it blocks some expected modes so only target DCN3.1 for now. Reviewed-by: Dmytro Laktyushkin Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c938aed88f8259dc913b717a32319101c66e87a9 Author: Nicholas Kazlauskas Date: Wed Sep 29 11:37:33 2021 -0400 drm/amd/display: Fix prefetch bandwidth calculation for DCN3.1 [Why] Prefetch BW calculated is lower than the DML reference because of a porting error that's excluding cursor and row bandwidth from the pixel data bandwidth. [How] Change the dml_max4 to dml_max3 and include cursor and row bandwidth in the same calculation as the rest of the pixel data during vactive. Reviewed-by: Dmytro Laktyushkin Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c21b105380cf86e829c68586ca1315cfc253ad8c Author: Nikola Cornij Date: Tue Sep 28 22:43:52 2021 -0400 drm/amd/display: Limit display scaling to up to true 4k for DCN 3.1 [why] The requirement is that image width up to 4096 shall be supported Reviewed-by: Aric Cyr Acked-by: Agustin Gutierrez Sanchez Signed-off-by: Nikola Cornij Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5afa7898ab7a0ec9c28556a91df714bf3c2f725e Author: Thelford Williams Date: Wed Oct 13 16:04:13 2021 -0400 drm/amdgpu: fix out of bounds write Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf. Signed-off-by: Thelford Williams Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1d000323940137332d4d62c6332b6daf5f07aba7 Author: Emeel Hakim Date: Mon Oct 18 15:31:19 2021 +0300 net/mlx5e: IPsec: Fix work queue entry ethernet segment checksum flags Current Work Queue Entry (WQE) checksum (csum) flags in the ethernet segment (eseg) in case of IPsec crypto offload datapath are not aligned with PRM/HW expectations. Currently the driver always sets the l3_inner_csum flag in case of IPsec because of the wrong usage of skb->encapsulation as indicator for inner IPsec header since skb->encapsulation is always ON for IPsec packets since IPsec itself is an encapsulation protocol. The above forced a failing attempts of calculating csum of non-existing segments (like in the IP|ESP|TCP packet case which does not have an l3_inner) which led to lots of packet drops hence the low throughput. Fix by using xo->inner_ipproto as indicator for inner IPsec header instead of skb->encapsulation in addition to setting the csum flags as following: * Tunnel Mode: * Pkt: MAC IP ESP IP L4 * CSUM: l3_cs | l3_inner_cs | l4_inner_cs * * Transport Mode: * Pkt: MAC IP ESP L4 * CSUM: l3_cs [ | l4_cs (checksum partial case)] * * Tunnel(VXLAN TCP/UDP) over Transport Mode * Pkt: MAC IP ESP UDP VXLAN IP L4 * CSUM: l3_cs | l3_inner_cs | l4_inner_cs Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload") Signed-off-by: Emeel Hakim Signed-off-by: Saeed Mahameed commit d10457f85d4ae4d32c0df0cd65358a78c577fbe6 Author: Emeel Hakim Date: Mon Oct 18 15:30:09 2021 +0300 net/mlx5e: IPsec: Fix a misuse of the software parser's fields IPsec crypto offload current Software Parser (SWP) fields settings in the ethernet segment (eseg) are not aligned with PRM/HW expectations. Among others in case of IP|ESP|TCP packet, current driver sets the offsets for inner_l3 and inner_l4 although there is no inner l3/l4 headers relative to ESP header in such packets. SWP provides the offsets for HW ,so it can be used to find csum fields to offload the checksum, however these are not necessarily used by HW and are used as fallback in case HW fails to parse the packet, e.g when performing IPSec Transport Aware (IP | ESP | TCP) there is no need to add SW parse on inner packet. So in some cases packets csum was calculated correctly , whereas in other cases it failed. The later faced csum errors (caused by wrong packet length calculations) which led to lots of packet drops hence the low throughput. Fix by setting the SWP fields as expected in a IP|ESP|TCP packet. the following describe the expected SWP offsets: * Tunnel Mode: * SWP: OutL3 InL3 InL4 * Pkt: MAC IP ESP IP L4 * * Transport Mode: * SWP: OutL3 OutL4 * Pkt: MAC IP ESP L4 * * Tunnel(VXLAN TCP/UDP) over Transport Mode * SWP: OutL3 InL3 InL4 * Pkt: MAC IP ESP UDP VXLAN IP L4 Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload") Signed-off-by: Emeel Hakim Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit 68e66e1a69cd94f934522348ab232af49863452a Author: Moshe Shemesh Date: Sat Oct 2 11:15:35 2021 +0300 net/mlx5e: Fix vlan data lost during suspend flow During suspend flow the driver calls mlx5e_destroy_vlan_table() which does not only delete the vlans steering flow rules, but also frees the data on currently active vlans, thus it is not restored during resume flow. This fix keeps the vlan data on suspend flow and frees it only on driver remove flow. Fixes: 6783f0a21a3c ("net/mlx5e: Dynamic alloc vlan table for netdev when needed") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit a6f74333548f56afb413fc928ae1aefc4fe7608f Author: Dmytro Linkin Date: Wed Aug 25 17:51:26 2021 +0300 net/mlx5: E-switch, Return correct error code on group creation failure Dan Carpenter report: The patch f47e04eb96e0: "net/mlx5: E-switch, Allow setting share/max tx rate limits of rate groups" from May 31, 2021, leads to the following Smatch static checker warning: drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c:483 esw_qos_create_rate_group() warn: passing zero to 'ERR_PTR' If min rate normalization failed then error code may be overwritten to 0 if scheduling element destruction succeed. Ignore this value and always return initial one. Fixes: f47e04eb96e0 ("net/mlx5: E-switch, Allow setting share/max tx rate limits of rate groups") Reported-by: Dan Carpenter Signed-off-by: Dmytro Linkin Signed-off-by: Saeed Mahameed commit 14fe2471c62816ba82546fb68369d957c3a58b59 Author: Maor Dickman Date: Thu Oct 7 16:05:38 2021 +0300 net/mlx5: Lag, change multipath and bonding to be mutually exclusive Both multipath and bonding events are changing the HW LAG state independently. Handling one of the features events while the other is already enabled can cause unwanted behavior, for example handling bonding event while multipath enabled will disable the lag and cause multipath to stop working. Fix it by ignoring bonding event while in multipath and ignoring FIB events while in bonding mode. Fixes: 544fe7c2e654 ("net/mlx5e: Activate HW multipath and handle port affinity based on FIB events") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 8e37395c3a5dceff62a5010ebbbc107f4145935c Merge: 6da52dead8f59 29664923725a3 Author: Linus Torvalds Date: Wed Oct 20 06:13:22 2021 -1000 Merge tag 'sound-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Again it became bigger than wished, unfortunately, as this contains quite a few ASoC fixes that came up a bit late. It also includes yet more HD- and USB-audio quirks: I decided to merge them now, as those are for stable, and we'll need them sooner or later. Although the volumes are a bit high, all changes are device-specific (and reasonably small) fixes, so it should be safe for the late rc" * tag 'sound-5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Fix microphone sound on Jieli webcam. ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset ALSA: hda/realtek: Add quirk for Clevo PC50HS ALSA: usb-audio: add Schiit Hel device to quirk table ASoC: wm8960: Fix clock configuration on slave mode ASoC: cs42l42: Ensure 0dB full scale volume is used for headsets ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() ASoC: codec: wcd938x: Add irq config support ASoC: DAPM: Fix missing kctl change notifications ASoC: Intel: bytcht_es8316: Utilize dev_err_probe() to avoid log saturation ASoC: Intel: bytcht_es8316: Switch to use gpiod_get_optional() ASoC: Intel: bytcht_es8316: Use temporary variable for struct device ASoC: Intel: bytcht_es8316: Get platform data via dev_get_platdata() ASoC: wcd938x: Fix jack detection issue ASoC: nau8824: Fix headphone vs headset, button-press detection no longer working ASoC: cs4341: Add SPI device ID table ASoC: pcm179x: Add missing entries SPI to device ID table ASoC: fsl_xcvr: Fix channel swap issue with ARC ASoC: pcm512x: Mend accesses to the I2S_1 and I2S_2 registers commit 6da52dead8f59fcf81e19ad3937d903a9b87e1de Merge: fc9b289344b84 6e3ee990c9049 Author: Linus Torvalds Date: Wed Oct 20 06:11:17 2021 -1000 Merge tag 'audit-pr-20211019' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "One small audit patch to add a pointer NULL check" * tag 'audit-pr-20211019' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix possible null-pointer dereference in audit_filter_rules commit 7dcf78b870be6418d72bb1c4d4924bf0f5ca5052 Author: Tony Nguyen Date: Tue Oct 19 13:04:16 2021 -0700 ice: Add missing E810 device ids As part of support for E810 XXV devices, some device ids were inadvertently left out. Add those missing ids. Fixes: 195fb97766da ("ice: add additional E810 device id") Signed-off-by: Tony Nguyen Acked-by: Jesse Brandeburg Acked-by: Paul Menzel commit 79cc8322b6d82747cb63ea464146c0bf5b5a6bc1 Author: Sasha Neftin Date: Thu Sep 9 20:49:04 2021 +0300 igc: Update I226_K device ID The device ID for I226_K was incorrectly assigned, update the device ID to the correct one. Fixes: bfa5e98c9de4 ("igc: Add new device ID") Signed-off-by: Sasha Neftin Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen commit 639e298f432fb058a9496ea16863f53b1ce935fe Author: Sasha Neftin Date: Wed Sep 22 09:55:42 2021 +0300 e1000e: Fix packet loss on Tiger Lake and later Update the HW MAC initialization flow. Do not gate DMA clock from the modPHY block. Keeping this clock will prevent dropped packets sent in burst mode on the Kumeran interface. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213651 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213377 Fixes: fb776f5d57ee ("e1000e: Add support for Tiger Lake") Signed-off-by: Sasha Neftin Tested-by: Mark Pearson Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen commit fc9b289344b845576aedefe0691a4210987f3711 Merge: 1e59977463e98 ed65df63a39a3 Author: Linus Torvalds Date: Wed Oct 20 06:02:58 2021 -1000 Merge tag 'trace-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Recursion fix for tracing. While cleaning up some of the tracing recursion protection logic, I discovered a scenario that the current design would miss, and would allow an infinite recursion. Removing an optimization trick that opened the hole fixes the issue and cleans up the code as well" * tag 'trace-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Have all levels of checks prevent recursion commit 1e59977463e9894e3d579d4e1e2a1dc81f456633 Merge: 0afe64bebb135 4cce60f15c04d Author: Linus Torvalds Date: Wed Oct 20 05:56:51 2021 -1000 Merge tag 'nios2_fixes_for_v5.15_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 fix from Dinh Nguyen: - Renamed CTL_STATUS to CTL_FSTATUS to fix a redefined warning * tag 'nios2_fixes_for_v5.15_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: NIOS2: irqflags: rename a redefined register name commit 4ea672ab694c23886b52e97cee10dea056e43e62 Author: Pavel Begunkov Date: Wed Oct 20 09:53:02 2021 +0100 io_uring: fix ltimeout unprep io_unprep_linked_timeout() is broken, first it needs to return back REQ_F_ARM_LTIMEOUT, so the linked timeout is enqueued and disarmed. But now we refcounted it, and linked timeouts may get not executed at all, leaking a request. Just kill the unprep optimisation. Fixes: 906c6caaf586 ("io_uring: optimise io_prep_linked_timeout()") Reported-by: Beld Zhang Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/51b8e2bfc4bea8ee625cf2ba62b2a350cc9be031.1634719585.git.asml.silence@gmail.com Link: https://github.com/axboe/liburing/issues/460 Reported-by: Beld Zhang Signed-off-by: Jens Axboe commit e139a1ec92f8dbaaa7380d7e7ea17e148d473d06 Author: Pavel Begunkov Date: Tue Oct 19 23:43:46 2021 +0100 io_uring: apply max_workers limit to all future users Currently, IORING_REGISTER_IOWQ_MAX_WORKERS applies only to the task that issued it, it's unexpected for users. If one task creates a ring, limits workers and then passes it to another task the limit won't be applied to the other task. Another pitfall is that a task should either create a ring or submit at least one request for IORING_REGISTER_IOWQ_MAX_WORKERS to work at all, furher complicating the picture. Change the API, save the limits and apply to all future users. Note, it should be done first before giving away the ring or submitting new requests otherwise the result is not guaranteed. Fixes: 2e480058ddc2 ("io-wq: provide a way to limit max number of workers") Link: https://github.com/axboe/liburing/issues/460 Reported-by: Beld Zhang Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/51d0bae97180e08ab722c0d5c93e7439cfb6f697.1634683237.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0afe64bebb13509ef9a4be9deb18286b4c052c93 Merge: d9abdee5fd5ab 9f1ee7b169afb Author: Linus Torvalds Date: Wed Oct 20 05:52:10 2021 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Tools: - kvm_stat: do not show halt_wait_ns since it is not a cumulative statistic x86: - clean ups and fixes for bus lock vmexit and lazy allocation of rmaps - two fixes for SEV-ES (one more coming as soon as I get reviews) - fix for static_key underflow ARM: - Properly refcount pages used as a concatenated stage-2 PGD - Fix missing unlock when detecting the use of MTE+VM_SHARED" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SEV-ES: reduce ghcb_sa_len to 32 bits KVM: VMX: Remove redundant handling of bus lock vmexit KVM: kvm_stat: do not show halt_wait_ns KVM: x86: WARN if APIC HW/SW disable static keys are non-zero on unload Revert "KVM: x86: Open code necessary bits of kvm_lapic_set_base() at vCPU RESET" KVM: SEV-ES: Set guest_state_protected after VMSA update KVM: X86: fix lazy allocation of rmaps KVM: SEV-ES: fix length of string I/O KVM: arm64: Release mmap_lock when using VM_SHARED with MTE KVM: arm64: Report corrupted refcount at EL2 KVM: arm64: Fix host stage-2 PGD refcount KVM: s390: Function documentation fixes commit 280db5d420090a24e4e41f9ddcbf37920a598572 Author: Sasha Neftin Date: Wed Sep 22 09:54:49 2021 +0300 e1000e: Separate TGP board type from SPT We have the same LAN controller on different PCHs. Separate TGP board type from SPT which will allow for specific fixes to be applied for TGP platforms. Suggested-by: Kai-Heng Feng Signed-off-by: Sasha Neftin Reviewed-by: Paul Menzel Tested-by: Mark Pearson Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen commit 5ebcbe342b1c12fae44b4f83cbeae1520e09857e Author: Eric W. Biederman Date: Sat Oct 16 12:17:30 2021 -0500 ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring Setting cred->ucounts in cred_alloc_blank does not make sense. The uid and user_ns are deliberately not set in cred_alloc_blank but instead the setting is delayed until key_change_session_keyring. So move dealing with ucounts into key_change_session_keyring as well. Unfortunately that movement of get_ucounts adds a new failure mode to key_change_session_keyring. I do not see anything stopping the parent process from calling setuid and changing the relevant part of it's cred while keyctl_session_to_parent is running making it fundamentally necessary to call get_ucounts in key_change_session_keyring. Which means that the new failure mode cannot be avoided. A failure of key_change_session_keyring results in a single threaded parent keeping it's existing credentials. Which results in the parent process not being able to access the session keyring and whichever keys are in the new keyring. Further get_ucounts is only expected to fail if the number of bits in the refernece count for the structure is too few. Since the code has no other way to report the failure of get_ucounts and because such failures are not expected to be common add a WARN_ONCE to report this problem to userspace. Between the WARN_ONCE and the parent process not having access to the keys in the new session keyring I expect any failure of get_ucounts will be noticed and reported and we can find another way to handle this condition. (Possibly by just making ucounts->count an atomic_long_t). Cc: stable@vger.kernel.org Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Link: https://lkml.kernel.org/r/7k0ias0uf.fsf_-_@disp2133 Tested-by: Yu Zhao Reviewed-by: Alexey Gladkov Signed-off-by: "Eric W. Biederman" commit 36b6dcbc1245a3b4dd6bc5cc6b0284c9f05cdddc Merge: e23c7487f5a74 3ad60b4b35709 Author: Arnd Bergmann Date: Wed Oct 20 16:42:19 2021 +0200 Merge tag 'reset-fixes-for-v5.15' of git://git.pengutronix.de/pza/linux into arm/fixes Reset controller fixes for v5.15 Fix the status bit polarity in the brcmstb-rescal driver, re-enable pistachio driver selection after MACH_PISTACHIO removal, add transfer error handling in the tegra-bpmp driver, and fix probing of the reset-socfpga driver after recent device link changes. * tag 'reset-fixes-for-v5.15' of git://git.pengutronix.de/pza/linux: reset: socfpga: add empty driver allowing consumers to probe reset: tegra-bpmp: Handle errors in BPMP response reset: pistachio: Re-enable driver selection reset: brcmstb-rescal: fix incorrect polarity of status bit Link: https://lore.kernel.org/r/b378f2aae54538db6a13c98561b4cbcacbef937c.camel@pengutronix.de Signed-off-by: Arnd Bergmann commit e23c7487f5a74f5cc9f7e1090f1d83c3e33ae315 Merge: 72cd4e3bde4e8 55dd7e059098c Author: Arnd Bergmann Date: Wed Oct 20 15:51:37 2021 +0200 Merge tag 'sunxi-fixes-for-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Two patches to fix the GMAC PHY mode on some boards. * tag 'sunxi-fixes-for-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node Link: https://lore.kernel.org/r/d4c41c71-f1ff-4464-a26f-1bfd4b52fd78.lettre@localhost Signed-off-by: Arnd Bergmann commit 72cd4e3bde4e8ad178f9a698996275e20d235b63 Merge: 519d81956ee27 0b28c41e3c951 Author: Arnd Bergmann Date: Wed Oct 20 15:49:36 2021 +0200 Merge tag 'imx-fixes-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.15, round 4: - A series from Frieder Schrempf to fix i.MX8MM Kontron N801x board on various aspects, voltage settings, GPIO polarity, SPI clock frequency and Ethernet PHY type. * tag 'imx-fixes-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY arm64: dts: imx8mm-kontron: Fix CAN SPI clock frequency arm64: dts: imx8mm-kontron: Fix polarity of reg_rst_eth2 arm64: dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV arm64: dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are correct Link: https://lore.kernel.org/r/20211018000958.GC25810@dragon Signed-off-by: Arnd Bergmann commit 4225fea1cb28370086e17e82c0f69bec2779dca0 Author: Yang Yingliang Date: Wed Oct 20 16:18:34 2021 +0800 ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33] When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release(). Reported-by: Hulk Robot Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 3cb958027cb8b78d3ee639ce9af54c2ef1bf964f Author: Kurt Kanzenbach Date: Wed Oct 20 09:04:33 2021 +0200 net: stmmac: Fix E2E delay mechanism When utilizing End to End delay mechanism, the following error messages show up: |root@ehl1:~# ptp4l --tx_timestamp_timeout=50 -H -i eno2 -E -m |ptp4l[950.573]: selected /dev/ptp3 as PTP clock |ptp4l[950.586]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE |ptp4l[950.586]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE |ptp4l[952.879]: port 1: new foreign master 001395.fffe.4897b4-1 |ptp4l[956.879]: selected best master clock 001395.fffe.4897b4 |ptp4l[956.879]: port 1: assuming the grand master role |ptp4l[956.879]: port 1: LISTENING to GRAND_MASTER on RS_GRAND_MASTER |ptp4l[962.017]: port 1: received DELAY_REQ without timestamp |ptp4l[962.273]: port 1: received DELAY_REQ without timestamp |ptp4l[963.090]: port 1: received DELAY_REQ without timestamp Commit f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a") already addresses this problem for the dwmac v5.10. However, same holds true for all dwmacs above version v4.10. Correct the check accordingly. Afterwards everything works as expected. Tested on Intel Atom(R) x6414RE Processor. Fixes: 14f347334bf2 ("net: stmmac: Correctly take timestamp for PTPv2") Fixes: f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a") Suggested-by: Ong Boon Leong Signed-off-by: Kurt Kanzenbach Signed-off-by: David S. Miller commit 641e3fd1a038c68045bbf89d78502f4b4bbc7284 Author: Uwe Kleine-König Date: Tue Oct 19 22:49:16 2021 +0200 nfc: st95hf: Make spi remove() callback return zero If something goes wrong in the remove callback, returning an error code just results in an error message. The device still disappears. So don't skip disabling the regulator in st95hf_remove() if resetting the controller via spi fails. Also don't return an error code which just results in two error messages. Signed-off-by: Uwe Kleine-König Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 0e9ff65f455dfd0a8aea5e7843678ab6fe097e21 Author: Halil Pasic Date: Tue Oct 19 19:54:00 2021 +0200 KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu Changing the deliverable mask in __airqs_kick_single_vcpu() is a bug. If one idle vcpu can't take the interrupts we want to deliver, we should look for another vcpu that can, instead of saying that we don't want to deliver these interrupts by clearing the bits from the deliverable_mask. Fixes: 9f30f6216378 ("KVM: s390: add gib_alert_irq_handler()") Signed-off-by: Halil Pasic Reviewed-by: Christian Borntraeger Reviewed-by: Michael Mueller Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20211019175401.3757927-3-pasic@linux.ibm.com Signed-off-by: Christian Borntraeger commit 9b57e9d5010bbed7c0d9d445085840f7025e6f9a Author: Halil Pasic Date: Tue Oct 19 19:53:59 2021 +0200 KVM: s390: clear kicked_mask before sleeping again The idea behind kicked mask is that we should not re-kick a vcpu that is already in the "kick" process, i.e. that was kicked and is is about to be dispatched if certain conditions are met. The problem with the current implementation is, that it assumes the kicked vcpu is going to enter SIE shortly. But under certain circumstances, the vcpu we just kicked will be deemed non-runnable and will remain in wait state. This can happen, if the interrupt(s) this vcpu got kicked to deal with got already cleared (because the interrupts got delivered to another vcpu). In this case kvm_arch_vcpu_runnable() would return false, and the vcpu would remain in kvm_vcpu_block(), but this time with its kicked_mask bit set. So next time around we wouldn't kick the vcpu form __airqs_kick_single_vcpu(), but would assume that we just kicked it. Let us make sure the kicked_mask is cleared before we give up on re-dispatching the vcpu. Fixes: 9f30f6216378 ("KVM: s390: add gib_alert_irq_handler()") Reported-by: Matthew Rosato Signed-off-by: Halil Pasic Reviewed-by: Christian Borntraeger Reviewed-by: Michael Mueller Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20211019175401.3757927-2-pasic@linux.ibm.com Signed-off-by: Christian Borntraeger commit 323e9a957df89cf7240b3ce4952f2d40e426bd52 Merge: 55161e67d44fd 0dd8a25f355b4 Author: David S. Miller Date: Wed Oct 20 11:38:11 2021 +0100 Merge branch 'hns3-fixes' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 0dd8a25f355b4df2d41c08df1716340854c7d4c5 Author: Peng Li Date: Tue Oct 19 22:16:35 2021 +0800 net: hns3: disable sriov before unload hclge layer HNS3 driver includes hns3.ko, hnae3.ko and hclge.ko. hns3.ko includes network stack and pci_driver, hclge.ko includes HW device action, algo_ops and timer task, hnae3.ko includes some register function. When SRIOV is enable and hclge.ko is removed, HW device is unloaded but VF still exists, PF will not reply VF mbx messages, and cause errors. This patch fix it by disable SRIOV before remove hclge.ko. Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 1385cc81baeb3bd8cbbbcdc1557f038ac1712529 Author: Yufeng Mo Date: Tue Oct 19 22:16:34 2021 +0800 net: hns3: fix vf reset workqueue cannot exit The task of VF reset is performed through the workqueue. It checks the value of hdev->reset_pending to determine whether to exit the loop. However, the value of hdev->reset_pending may also be assigned by the interrupt function hclgevf_misc_irq_handle(), which may cause the loop fail to exit and keep occupying the workqueue. This loop is not necessary, so remove it and the workqueue will be rescheduled if the reset needs to be retried or a new reset occurs. Fixes: 1cc9bc6e5867 ("net: hns3: split hclgevf_reset() into preparing and rebuilding part") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 68752b24f51a71d4f350a764d890b670f59062c5 Author: Yunsheng Lin Date: Tue Oct 19 22:16:33 2021 +0800 net: hns3: schedule the polling again when allocation fails Currently when there is a rx page allocation failure, it is possible that polling may be stopped if there is no more packet to be reveiced, which may cause queue stall problem under memory pressure. This patch makes sure polling is scheduled again when there is any rx page allocation failure, and polling will try to allocate receive buffers until it succeeds. Now the allocation retry is added, it is unnecessary to do the rx page allocation at the end of rx cleaning, so remove it. And reset the unused_count to zero after calling hns3_nic_alloc_rx_buffers() to avoid calling hns3_nic_alloc_rx_buffers() repeatedly under memory pressure. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yunsheng Lin Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 9f9f0f19994b42b3e5e8735d41b9c5136828a76c Author: Yunsheng Lin Date: Tue Oct 19 22:16:32 2021 +0800 net: hns3: fix for miscalculation of rx unused desc rx unused desc is the desc that need attatching new buffer before refilling to hw to receive new packet, the number of desc need attatching new buffer is calculated using next_to_use and next_to_clean. when next_to_use == next_to_clean, currently hns3 driver assumes that all the desc has the buffer attatched, but 'next_to_use == next_to_clean' also means all the desc need attatching new buffer if hw has comsumed all the desc and the driver has not attatched any buffer to the desc yet. This patch adds 'refill' in desc_cb to indicate whether a new buffer has been refilled to a desc. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yunsheng Lin Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit adfb7b4966c0c4c63a791f202b8b3837b07a9ece Author: Yunsheng Lin Date: Tue Oct 19 22:16:31 2021 +0800 net: hns3: fix the max tx size according to user manual Currently the max tx size supported by the hw is calculated by using the max BD num supported by the hw. According to the hw user manual, the max tx size is fixed value for both non-TSO and TSO skb. This patch updates the max tx size according to the manual. Fixes: 8ae10cfb5089("net: hns3: support tx-scatter-gather-fraglist feature") Signed-off-by: Yunsheng Lin Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 731797fdffa3d083db536e2fdd07ceb050bb40b1 Author: Guangbin Huang Date: Tue Oct 19 22:16:30 2021 +0800 net: hns3: add limit ets dwrr bandwidth cannot be 0 If ets dwrr bandwidth of tc is set to 0, the hardware will switch to SP mode. In this case, this tc may occupy all the tx bandwidth if it has huge traffic, so it violates the purpose of the user setting. To fix this problem, limit the ets dwrr bandwidth must greater than 0. Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit b63fcaab959807282e9822e659034edf95fc8bd1 Author: Guangbin Huang Date: Tue Oct 19 22:16:29 2021 +0800 net: hns3: reset DWRR of unused tc to zero Currently, DWRR of tc will be initialized to a fixed value when this tc is enabled, but it is not been reset to 0 when this tc is disabled. It cause a problem that the DWRR of unused tc is not 0 after using tc tool to add and delete multi-tc parameters. For examples, after enabling 4 TCs and restoring to 1 TC by follow tc commands: $ tc qdisc add dev eth0 root mqprio num_tc 4 map 0 1 2 3 0 1 2 3 queues \ 8@0 8@8 8@16 8@24 hw 1 mode channel $ tc qdisc del dev eth0 root Now there is just one TC is enabled for eth0, but the tc info querying by debugfs is shown as follow: $ cat /mnt/hns3/0000:7d:00.0/tm/tc_sch_info enabled tc number: 1 weight_offset: 14 TC MODE WEIGHT 0 dwrr 100 1 dwrr 100 2 dwrr 100 3 dwrr 100 4 dwrr 0 5 dwrr 0 6 dwrr 0 7 dwrr 0 This patch fixes it by resetting DWRR of tc to 0 when tc is disabled. Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 60484103d5c387df49bd60de4b16c88022747048 Author: Jiaran Zhang Date: Tue Oct 19 22:16:28 2021 +0800 net: hns3: Add configuration of TM QCN error event Add configuration of interrupt type and fifo interrupt enable of TM QCN error event if enabled, otherwise this event will not be reported when there is error. Fixes: d914971df022 ("net: hns3: remove redundant query in hclge_config_tm_hw_err_int()") Signed-off-by: Jiaran Zhang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 787252a10d9422f3058df9a4821f389e5326c440 Author: Nathan Lynch Date: Fri Oct 15 12:39:02 2021 -0500 powerpc/smp: do not decrement idle task preempt count in CPU offline With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we get: BUG: scheduling while atomic: swapper/1/0/0x00000000 no locks held by swapper/1/0. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100 Call Trace: dump_stack_lvl+0xac/0x108 __schedule_bug+0xac/0xe0 __schedule+0xcf8/0x10d0 schedule_idle+0x3c/0x70 do_idle+0x2d8/0x4a0 cpu_startup_entry+0x38/0x40 start_secondary+0x2ec/0x3a0 start_secondary_prolog+0x10/0x14 This is because powerpc's arch_cpu_idle_dead() decrements the idle task's preempt count, for reasons explained in commit a7c2bb8279d2 ("powerpc: Re-enable preemption before cpu_die()"), specifically "start_secondary() expects a preempt_count() of 0." However, since commit 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug") and commit f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled"), that justification no longer holds. The idle task isn't supposed to re-enable preemption, so remove the vestigial preempt_enable() from the CPU offline path. Tested with pseries and powernv in qemu, and pseries on PowerVM. Fixes: 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug") Signed-off-by: Nathan Lynch Reviewed-by: Valentin Schneider Reviewed-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211015173902.2278118-1-nathanl@linux.ibm.com commit 496c5fe25c377ddb7815c4ce8ecfb676f051e9b6 Author: Michael Ellerman Date: Wed Oct 20 20:48:26 2021 +1100 powerpc/idle: Don't corrupt back chain when going idle In isa206_idle_insn_mayloss() we store various registers into the stack red zone, which is allowed. However inside the IDLE_STATE_ENTER_SEQ_NORET macro we save r2 again, to 0(r1), which corrupts the stack back chain. We used to do the same in isa206_idle_insn_mayloss() itself, but we fixed that in 73287caa9210 ("powerpc64/idle: Fix SP offsets when saving GPRs"), however we missed that the macro also corrupts the back chain. Corrupting the back chain is bad for debuggability but doesn't necessarily cause a bug. However we recently changed the stack handling in some KVM code, and it now relies on the stack back chain being valid when it returns. The corruption causes that code to return with r1 pointing somewhere in kernel data, at some point LR is restored from the stack and we branch to NULL or somewhere else invalid. Only affects Power8 hosts running KVM guests, with dynamic_mt_modes enabled (which it is by default). The fixes tag below points to the commit that changed the KVM stack handling, exposing this bug. The actual corruption of the back chain has always existed since 948cf67c4726 ("powerpc: Add NAP mode support on Power7 in HV mode"). Fixes: 9b4416c5095c ("KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211020094826.3222052-1-mpe@ellerman.id.au commit 55161e67d44fdd23900be166a81e996abd6e3be9 Author: Eugene Crosser Date: Mon Oct 18 20:22:50 2021 +0200 vrf: Revert "Reset skb conntrack connection..." This reverts commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1. When an interface is enslaved in a VRF, prerouting conntrack hook is called twice: once in the context of the original input interface, and once in the context of the VRF interface. If no special precausions are taken, this leads to creation of two conntrack entries instead of one, and breaks SNAT. Commit above was intended to avoid creation of extra conntrack entries when input interface is enslaved in a VRF. It did so by resetting conntrack related data associated with the skb when it enters VRF context. However it breaks netfilter operation. Imagine a use case when conntrack zone must be assigned based on the original input interface, rather than VRF interface (that would make original interfaces indistinguishable). One could create netfilter rules similar to these: chain rawprerouting { type filter hook prerouting priority raw; iif realiface1 ct zone set 1 return iif realiface2 ct zone set 2 return } This works before the mentioned commit, but not after: zone assignment is "forgotten", and any subsequent NAT or filtering that is dependent on the conntrack zone does not work. Here is a reproducer script that demonstrates the difference in behaviour. ========== #!/bin/sh # This script demonstrates unexpected change of nftables behaviour # caused by commit 09e856d54bda5f28 ""vrf: Reset skb conntrack # connection on VRF rcv" # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09e856d54bda5f288ef8437a90ab2b9b3eab83d1 # # Before the commit, it was possible to assign conntrack zone to a # packet (or mark it for `notracking`) in the prerouting chanin, raw # priority, based on the `iif` (interface from which the packet # arrived). # After the change, # if the interface is enslaved in a VRF, such # assignment is lost. Instead, assignment based on the `iif` matching # the VRF master interface is honored. Thus it is impossible to # distinguish packets based on the original interface. # # This script demonstrates this change of behaviour: conntrack zone 1 # or 2 is assigned depending on the match with the original interface # or the vrf master interface. It can be observed that conntrack entry # appears in different zone in the kernel versions before and after # the commit. IPIN=172.30.30.1 IPOUT=172.30.30.2 PFXL=30 ip li sh vein >/dev/null 2>&1 && ip li del vein ip li sh tvrf >/dev/null 2>&1 && ip li del tvrf nft list table testct >/dev/null 2>&1 && nft delete table testct ip li add vein type veth peer veout ip li add tvrf type vrf table 9876 ip li set veout master tvrf ip li set vein up ip li set veout up ip li set tvrf up /sbin/sysctl -w net.ipv4.conf.veout.accept_local=1 /sbin/sysctl -w net.ipv4.conf.veout.rp_filter=0 ip addr add $IPIN/$PFXL dev vein ip addr add $IPOUT/$PFXL dev veout nft -f - <<__END__ table testct { chain rawpre { type filter hook prerouting priority raw; iif { veout, tvrf } meta nftrace set 1 iif veout ct zone set 1 return iif tvrf ct zone set 2 return notrack } chain rawout { type filter hook output priority raw; notrack } } __END__ uname -rv conntrack -F ping -W 1 -c 1 -I vein $IPOUT conntrack -L Signed-off-by: Eugene Crosser Acked-by: David Ahern Signed-off-by: David S. Miller commit 0d994cd482ee4e8e851388a70869beee51be1c54 Author: Marios Makassikis Date: Tue Oct 19 17:39:38 2021 +0200 ksmbd: add buffer validation in session setup Make sure the security buffer's length/offset are valid with regards to the packet length. Acked-by: Namjae Jeon Signed-off-by: Marios Makassikis Signed-off-by: Steve French commit 621be84a9d1fbf0097fd058e249ec5cc4f35f3c5 Author: Namjae Jeon Date: Wed Oct 13 17:28:31 2021 +0900 ksmbd: throttle session setup failures to avoid dictionary attacks To avoid dictionary attacks (repeated session setups rapidly sent) to connect to server, ksmbd make a delay of a 5 seconds on session setup failure to make it harder to send enough random connection requests to break into a server if a user insert the wrong password 10 times in a row. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 34061d6b76a41b1e43c19e1e50d98e5d77f77d4e Author: Hyunchul Lee Date: Sat Oct 16 08:39:54 2021 +0900 ksmbd: validate OutputBufferLength of QUERY_DIR, QUERY_INFO, IOCTL requests Validate OutputBufferLength of QUERY_DIR, QUERY_INFO, IOCTL requests and check the free size of response buffer for these requests. Acked-by: Namjae Jeon Signed-off-by: Hyunchul Lee Signed-off-by: Steve French commit f09f6dfef8ce7b70a240cf83811e2b1909c3e47b Author: Russ Weight Date: Mon Oct 18 17:24:01 2021 -0700 spi: altera: Change to dynamic allocation of spi id The spi-altera driver has two flavors: platform and dfl. I'm seeing a case where I have both device types in the same machine, and they are conflicting on the SPI ID: ... kernel: couldn't get idr ... kernel: WARNING: CPU: 28 PID: 912 at drivers/spi/spi.c:2920 spi_register_controller.cold+0x84/0xc0a Both the platform and dfl drivers use the parent's driver ID as the SPI ID. In the error case, the parent devices are dfl_dev.4 and subdev_spi_altera.4.auto. When the second spi-master is created, the failure occurs because the SPI ID of 4 has already been allocated. Change the ID allocation to dynamic (by initializing bus_num to -1) to avoid duplicate SPI IDs. Signed-off-by: Russ Weight Link: https://lore.kernel.org/r/20211019002401.24041-1-russell.h.weight@intel.com Signed-off-by: Mark Brown commit 2dace185caa580720c7cd67fec9efc5ee26108ac Author: Mustafa Ismail Date: Tue Oct 19 10:16:54 2021 -0500 RDMA/irdma: Do not hold qos mutex twice on QP resume When irdma_ws_add fails, irdma_ws_remove is used to cleanup the leaf node. This lead to holding the qos mutex twice in the QP resume path. Fix this by avoiding the call to irdma_ws_remove and unwinding the error in irdma_ws_add. This skips the call to irdma_tc_in_use function which is not needed in the error unwind cases. Fixes: 3ae331c75128 ("RDMA/irdma: Add QoS definitions") Link: https://lore.kernel.org/r/20211019151654.1943-2-shiraz.saleem@intel.com Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit cc07b73ef11d11d4359fb104d0199b22451dd3d8 Author: Mustafa Ismail Date: Tue Oct 19 10:16:53 2021 -0500 RDMA/irdma: Set VLAN in UD work completion correctly Currently VLAN is reported in UD work completion when VLAN id is zero, i.e. no VLAN case. Report VLAN in UD work completion only when VLAN id is non-zero. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20211019151654.1943-1-shiraz.saleem@intel.com Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit 5508546631a0f555d7088203dec2614e41b5106e Author: Aharon Landau Date: Tue Oct 19 14:30:10 2021 +0300 RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR Normally the zero fill would hide the missing initialization, but an errant set to desc_size in reg_create() causes a crash: BUG: unable to handle page fault for address: 0000000800000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 890 Comm: ib_write_bw Not tainted 5.15.0-rc4+ #47 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_ib_dereg_mr+0x14/0x3b0 [mlx5_ib] Code: 48 63 cd 4c 89 f7 48 89 0c 24 e8 37 30 03 e1 48 8b 0c 24 eb a0 90 0f 1f 44 00 00 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 30 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 8b 87 c8 RSP: 0018:ffff88811afa3a60 EFLAGS: 00010286 RAX: 000000000000001c RBX: 0000000800000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000800000000 RBP: 0000000800000000 R08: 0000000000000000 R09: c0000000fffff7ff R10: ffff88811afa38f8 R11: ffff88811afa38f0 R12: ffffffffa02c7ac0 R13: 0000000000000000 R14: ffff88811afa3cd8 R15: ffff88810772fa00 FS: 00007f47b9080740(0000) GS:ffff88852cd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000800000000 CR3: 000000010761e003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_free_odp_mr+0x95/0xc0 [mlx5_ib] mlx5_ib_dereg_mr+0x128/0x3b0 [mlx5_ib] ib_dereg_mr_user+0x45/0xb0 [ib_core] ? xas_load+0x8/0x80 destroy_hw_idr_uobject+0x1a/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2f/0x150 [ib_uverbs] uobj_destroy+0x3c/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x467/0xb00 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ? ttwu_queue_wakelist+0xa9/0xe0 ? pty_write+0x85/0x90 ? file_tty_write.isra.33+0x214/0x330 ? process_echoes+0x60/0x60 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x10d/0x8e0 ? vfs_write+0x17f/0x260 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Add the missing xarray initialization and remove the desc_size set. Fixes: a639e66703ee ("RDMA/mlx5: Zero out ODP related items in the mlx5_ib_mr") Link: https://lore.kernel.org/r/a4846a11c9de834663e521770da895007f9f0d30.1634642730.git.leonro@nvidia.com Signed-off-by: Aharon Landau Reviewed-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 60fab1076636493cfa2686e712446595fe43bc16 Author: Prabhakar Kushwaha Date: Tue Oct 19 11:22:12 2021 +0300 rdma/qedr: Fix crash due to redundant release of device's qp memory Device's QP memory should only be allocated and released by IB layer. This patch removes the redundant release of the device's qp memory and uses completion APIs to make sure that .destroy_qp() only return, when qp reference becomes 0. Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Link: https://lore.kernel.org/r/20211019082212.7052-1-pkushwaha@marvell.com Acked-by: Michal Kalderon Signed-off-by: Ariel Elior Signed-off-by: Shai Malin Signed-off-by: Alok Prasad Signed-off-by: Prabhakar Kushwaha Signed-off-by: Jason Gunthorpe commit bc369921d6708542eb93da33478762f1162a5805 Author: Pavel Begunkov Date: Tue Oct 19 20:31:26 2021 +0100 io-wq: max_worker fixes First, fix nr_workers checks against max_workers, with max_worker registration, it may pretty easily happen that nr_workers > max_workers. Also, synchronise writing to acct->max_worker with wqe->lock. It's not an actual problem, but as we don't care about io_wqe_create_worker(), it's better than WRITE_ONCE()/READ_ONCE(). Fixes: 2e480058ddc2 ("io-wq: provide a way to limit max number of workers") Reported-by: Beld Zhang Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/11f90e6b49410b7d1a88f5d04fb8d95bb86b8cf3.1634671835.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ba69fd9101f20a6d05a96ab743341d4e7b1a2178 Author: Christophe JAILLET Date: Mon Oct 18 21:59:00 2021 +0200 net: dsa: Fix an error handling path in 'dsa_switch_parse_ports_of()' If we return before the end of the 'for_each_child_of_node()' iterator, the reference taken on 'port' must be released. Add the missing 'of_node_put()' calls. Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/15d5310d1d55ad51c1af80775865306d92432e03.1634587046.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit bc28368596436e6e81ffc48c815b8225d96121c0 Author: Rafael J. Wysocki Date: Fri Oct 15 19:12:21 2021 +0200 ACPI: PM: Do not turn off power resources in unknown state Commit 6381195ad7d0 ("ACPI: power: Rework turning off unused power resources") caused power resources in unknown state with reference counters equal to zero to be turned off too, but that caused issues to appear in the field, so modify the code to only turn off power resources that are known to be "on". Link: https://lore.kernel.org/linux-acpi/6faf4b92-78d5-47a4-63df-cc2bab7769d0@molgen.mpg.de/ Fixes: 6381195ad7d0 ("ACPI: power: Rework turning off unused power resources") Reported-by: Andreas K. Huettel Tested-by: Andreas K. Huettel Signed-off-by: Rafael J. Wysocki Cc: 5.14+ # 5.14+ commit 34dc2fd6e6908499b669c7b45320cddf38b332e1 Author: Eric W. Biederman Date: Sat Oct 16 12:47:51 2021 -0500 ucounts: Proper error handling in set_cred_ucounts Instead of leaking the ucounts in new if alloc_ucounts fails, store the result of alloc_ucounts into a temporary variable, which is later assigned to new->ucounts. Cc: stable@vger.kernel.org Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Link: https://lkml.kernel.org/r/87pms2s0v8.fsf_-_@disp2133 Tested-by: Yu Zhao Reviewed-by: Alexey Gladkov Signed-off-by: "Eric W. Biederman" commit 629715adc62b0ad27ab04d0aa73a71927f886910 Author: Eric W. Biederman Date: Sat Oct 16 12:30:00 2021 -0500 ucounts: Pair inc_rlimit_ucounts with dec_rlimit_ucoutns in commit_creds The purpose of inc_rlimit_ucounts and dec_rlimit_ucounts in commit_creds is to change which rlimit counter is used to track a process when the credentials changes. Use the same test for both to guarantee the tracking is correct. Cc: stable@vger.kernel.org Fixes: 21d1c5e386bc ("Reimplement RLIMIT_NPROC on top of ucounts") Link: https://lkml.kernel.org/r/87v91us0w4.fsf_-_@disp2133 Tested-by: Yu Zhao Reviewed-by: Alexey Gladkov Signed-off-by: "Eric W. Biederman" commit 63acd42c0d4942f74710b11c38602fb14dea7320 Author: Woody Lin Date: Tue Oct 12 16:35:21 2021 +0800 sched/scs: Reset the shadow stack when idle_task_exit Commit f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled") removed the init_idle() call from idle_thread_get(). This was the sole call-path on hotplug that resets the Shadow Call Stack (scs) Stack Pointer (sp). Not resetting the scs-sp leads to scs overflow after enough hotplug cycles. Therefore add an explicit scs_task_reset() to the hotplug code to make sure the scs-sp does get reset on hotplug. Fixes: f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled") Signed-off-by: Woody Lin [peterz: Changelog] Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Link: https://lore.kernel.org/r/20211012083521.973587-1-woodylin@google.com commit d9abdee5fd5abffd0e763e52fbfa3116de167822 Merge: 519d81956ee27 362d5dfc483c7 Author: Linus Torvalds Date: Tue Oct 19 05:41:36 2021 -1000 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "19 patches. Subsystems affected by this patch series: mm (userfaultfd, migration, memblock, mempolicy, slub, secretmem, and thp), ocfs2, binfmt, vfs, and misc" * emailed patches from Andrew Morton : mailmap: add Andrej Shadura mm/thp: decrease nr_thps in file's mapping on THP split mm/secretmem: fix NULL page->mapping dereference in page_is_secretmem() vfs: check fd has read access in kernel_read_file_from_fd() elfcore: correct reference to CONFIG_UML mm, slub: fix incorrect memcg slab count for bulk free mm, slub: fix potential use-after-free in slab_debugfs_fops mm, slub: fix potential memoryleak in kmem_cache_open() mm, slub: fix mismatch between reconstructed freelist depth and cnt mm, slub: fix two bugs in slab_debug_trace_open() mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() memblock: check memory total_size ocfs2: mount fails with buffer overflow in strlen ocfs2: fix data corruption after conversion from inline format mm/migrate: fix CPUHP state to update node demotion order mm/migrate: add CPU hotplug to demotion #ifdef mm/migrate: optimize hotplug-time demotion order updates userfaultfd: fix a race between writeprotect and exit_mmap() mm/userfaultfd: selftests: fix memory corruption with thp enabled commit 04ee2752a5a9a715ad6dd56cc3eee3ec0bd846b4 Merge: c69b2f4687682 d674a8f123b40 Author: David S. Miller Date: Tue Oct 19 13:14:36 2021 +0100 Merge tag 'linux-can-fixes-for-5.15-20211019' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2021-10-19 this is a pull request of a single patch for net/master. The patch is by me and fixes the error handling in case of a FC timeout in the TX path of the ISOTOP CAN protocol. ==================== Signed-off-by: David S. Miller commit c69b2f46876825c726bd8a97c7fa852d8932bc32 Author: Zheyu Ma Date: Mon Oct 18 14:32:57 2021 +0000 cavium: Fix return values of the probe function During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success. Signed-off-by: Zheyu Ma Signed-off-by: David S. Miller commit e211210098cb7490db2183d725f5c0f10463a704 Author: Zheyu Ma Date: Mon Oct 18 14:20:38 2021 +0000 mISDN: Fix return values of the probe function During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success. Signed-off-by: Zheyu Ma Signed-off-by: David S. Miller commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 Author: Randy Dunlap Date: Sun Oct 17 10:59:49 2021 -0700 mmc: winbond: don't build on M68K The Winbond MMC driver fails to build on ARCH=m68k so prevent that build config. Silences these build errors: ../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end': ../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] 212 | dmaflags = claim_dma_lock(); ../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration] 215 | release_dma_lock(dmaflags); Signed-off-by: Randy Dunlap Cc: Pierre Ossman Cc: Geert Uytterhoeven Cc: Arnd Bergmann Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org Signed-off-by: Ulf Hansson commit 9af372dc70e9fdcbb70939dac75365e7b88580b4 Author: Haibo Chen Date: Fri Oct 15 10:00:36 2021 +0800 mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit To reset standard tuning circuit completely, after clear ESDHC_MIX_CTRL_EXE_TUNE, also need to clear bit buffer_read_ready, this operation will finally clear the USDHC IP internal logic flag execute_tuning_with_clr_buf, make sure the following normal data transfer will not be impacted by standard tuning logic used before. Find this issue when do quick SD card insert/remove stress test. During standard tuning prodedure, if remove SD card, USDHC standard tuning logic can't clear the internal flag execute_tuning_with_clr_buf. Next time when insert SD card, all data related commands can't get any data related interrupts, include data transfer complete interrupt, data timeout interrupt, data CRC interrupt, data end bit interrupt. Always trigger software timeout issue. Even reset the USDHC through bits in register SYS_CTRL (0x2C, bit28 reset tuning, bit26 reset data, bit 25 reset command, bit 24 reset all) can't recover this. From the user's point of view, USDHC stuck, SD can't be recognized any more. Fixes: d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card") Signed-off-by: Haibo Chen Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/1634263236-6111-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 48ccc8edf5b90622cdc4f8878e0042ab5883e2ca Author: Arnd Bergmann Date: Mon Oct 18 15:30:37 2021 +0100 ARM: 9141/1: only warn about XIP address when not compile testing In randconfig builds, we sometimes come across this warning: arm-linux-gnueabi-ld: XIP start address may cause MPU programming issues While this is helpful for actual systems to figure out why it fails, the warning does not provide any benefit for build testing, so guard it in a check for CONFIG_COMPILE_TEST, which is usually set on randconfig builds. Fixes: 216218308cfb ("ARM: 8713/1: NOMMU: Support MPU in XIP configuration") Signed-off-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 1f323127cab086e4fd618981b1e5edc396eaf0f4 Author: Arnd Bergmann Date: Mon Oct 18 15:30:09 2021 +0100 ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype With extra warnings enabled, gcc complains about this function definition: arch/arm/probes/kprobes/core.c: In function 'arch_init_kprobes': arch/arm/probes/kprobes/core.c:465:12: warning: old-style function definition [-Wold-style-definition] 465 | int __init arch_init_kprobes() Link: https://lore.kernel.org/all/20201027093057.c685a14b386acacb3c449e3d@kernel.org/ Fixes: 24ba613c9d6c ("ARM kprobes: core code") Acked-by: Masami Hiramatsu Signed-off-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 44cc6412e66b2b84544eaf2e14cf1764301e2a80 Author: Arnd Bergmann Date: Mon Oct 18 15:30:08 2021 +0100 ARM: 9138/1: fix link warning with XIP + frame-pointer When frame pointers are used instead of the ARM unwinder, and the kernel is built using clang with an external assembler and CONFIG_XIP_KERNEL, every file produces two warnings like: arm-linux-gnueabi-ld: warning: orphan section `.ARM.extab' from `net/mac802154/util.o' being placed in section `.ARM.extab' arm-linux-gnueabi-ld: warning: orphan section `.ARM.exidx' from `net/mac802154/util.o' being placed in section `.ARM.exidx' The same fix was already merged for the normal (non-XIP) linker script, with a longer description. Fixes: c39866f268f8 ("arm/build: Always handle .ARM.exidx and .ARM.extab sections") Reviewed-by: Kees Cook Signed-off-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit eaf6cc7165c9c5aa3c2f9faa03a98598123d0afb Author: Arnd Bergmann Date: Mon Oct 18 15:30:04 2021 +0100 ARM: 9134/1: remove duplicate memcpy() definition Both the decompressor code and the kasan logic try to override the memcpy() and memmove() definitions, which leading to a clash in a KASAN-enabled kernel with XZ decompression: arch/arm/boot/compressed/decompress.c:50:9: error: 'memmove' macro redefined [-Werror,-Wmacro-redefined] #define memmove memmove ^ arch/arm/include/asm/string.h:59:9: note: previous definition is here #define memmove(dst, src, len) __memmove(dst, src, len) ^ arch/arm/boot/compressed/decompress.c:51:9: error: 'memcpy' macro redefined [-Werror,-Wmacro-redefined] #define memcpy memcpy ^ arch/arm/include/asm/string.h:58:9: note: previous definition is here #define memcpy(dst, src, len) __memcpy(dst, src, len) ^ Here we want the set of functions from the decompressor, so undefine the other macros before the override. Link: https://lore.kernel.org/linux-arm-kernel/CACRpkdZYJogU_SN3H9oeVq=zJkRgRT1gDz3xp59gdqWXxw-B=w@mail.gmail.com/ Link: https://lore.kernel.org/lkml/202105091112.F5rmd4By-lkp@intel.com/ Fixes: d6d51a96c7d6 ("ARM: 9014/2: Replace string mem* functions for KASan") Fixes: a7f464f3db93 ("ARM: 7001/2: Wire up support for the XZ decompressor") Reported-by: kernel test robot Reviewed-by: Linus Walleij Signed-off-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit e6a0c958bdf9b2e1b57501fc9433a461f0a6aadd Author: Nick Desaulniers Date: Mon Oct 4 18:03:28 2021 +0100 ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned A kernel built with CONFIG_THUMB2_KERNEL=y and using clang as the assembler could generate non-naturally-aligned v7wbi_tlb_fns which results in a boot failure. The original commit adding the macro missed the .align directive on this data. Link: https://github.com/ClangBuiltLinux/linux/issues/1447 Link: https://lore.kernel.org/all/0699da7b-354f-aecc-a62f-e25693209af4@linaro.org/ Debugged-by: Ard Biesheuvel Debugged-by: Nathan Chancellor Debugged-by: Richard Henderson Fixes: 66a625a88174 ("ARM: mm: proc-macros: Add generic proc/cache/tlb struct definition macros") Suggested-by: Ard Biesheuvel Acked-by: Ard Biesheuvel Signed-off-by: Nick Desaulniers Tested-by: Nathan Chancellor Signed-off-by: Russell King (Oracle) commit df909df0770779f1a5560c2bb641a2809655ef28 Author: Lexi Shao Date: Thu Sep 23 03:41:25 2021 +0100 ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images ARM: kasan: Fix __get_user_check failure with kasan In macro __get_user_check defined in arch/arm/include/asm/uaccess.h, error code is store in register int __e(r0). When kasan is enabled, assigning value to kernel address might trigger kasan check, which unexpectedly overwrites r0 and causes undefined behavior on arm kasan images. One example is failure in do_futex and results in process soft lockup. Log: watchdog: BUG: soft lockup - CPU#0 stuck for 62946ms! [rs:main Q:Reg:1151] ... (__asan_store4) from (futex_wait_setup+0xf8/0x2b4) (futex_wait_setup) from (futex_wait+0x138/0x394) (futex_wait) from (do_futex+0x164/0xe40) (do_futex) from (sys_futex_time32+0x178/0x230) (sys_futex_time32) from (ret_fast_syscall+0x0/0x50) The soft lockup happens in function futex_wait_setup. The reason is function get_futex_value_locked always return EINVAL, thus pc jump back to retry label and causes looping. This line in function get_futex_value_locked ret = __get_user(*dest, from); is expanded to *dest = (typeof(*(p))) __r2; , in macro __get_user_check. Writing to pointer dest triggers kasan check and overwrites the return value of __get_user_x function. The assembly code of get_futex_value_locked in kernel/futex.c: ... c01f6dc8: eb0b020e bl c04b7608 <__get_user_4> // "x = (typeof(*(p))) __r2;" triggers kasan check and r0 is overwritten c01f6dCc: e1a00007 mov r0, r7 c01f6dd0: e1a05002 mov r5, r2 c01f6dd4: eb04f1e6 bl c0333574 <__asan_store4> c01f6dd8: e5875000 str r5, [r7] // save ret value of __get_user(*dest, from), which is dest address now c01f6ddc: e1a05000 mov r5, r0 ... // checking return value of __get_user failed c01f6e00: e3550000 cmp r5, #0 ... c01f6e0c: 01a00005 moveq r0, r5 // assign return value to EINVAL c01f6e10: 13e0000d mvnne r0, #13 Return value is the destination address of get_user thus certainly non-zero, so get_futex_value_locked always return EINVAL. Fix it by using a tmp vairable to store the error code before the assignment. This fix has no effects to non-kasan images thanks to compiler optimization. It only affects cases that overwrite r0 due to kasan check. This should fix bug discussed in Link: [1] https://lore.kernel.org/linux-arm-kernel/0ef7c2a5-5d8b-c5e0-63fa-31693fd4495c@gmail.com/ Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") Signed-off-by: Lexi Shao Signed-off-by: Russell King (Oracle) commit 00d43d13da6c3424101aebabefab9e97e6318bee Author: Ard Biesheuvel Date: Tue Sep 21 15:31:23 2021 +0100 ARM: 9125/1: fix incorrect use of get_kernel_nofault() Commit 344179fc7ef4 ("ARM: 9106/1: traps: use get_kernel_nofault instead of set_fs()") replaced an occurrence of __get_user() with get_kernel_nofault(), but inverted the sense of the conditional in the process, resulting in no values to be printed at all. I.e., every exception stack now looks like this: Exception stack(0xc18d1fb0 to 0xc18d1ff8) 1fa0: ???????? ???????? ???????? ???????? 1fc0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ???????? 1fe0: ???????? ???????? ???????? ???????? ???????? ???????? which is rather unhelpful. Fixes: 344179fc7ef4 ("ARM: 9106/1: traps: use get_kernel_nofault instead of set_fs()") Signed-off-by: Ard Biesheuvel Reviewed-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 9d417cbe36eee7afdd85c2e871685f8dab7c2dba Author: Nick Desaulniers Date: Wed Sep 8 19:25:59 2021 +0100 ARM: 9122/1: select HAVE_FUTEX_CMPXCHG tglx notes: This function [futex_detect_cmpxchg] is only needed when an architecture has to runtime discover whether the CPU supports it or not. ARM has unconditional support for this, so the obvious thing to do is the below. Fixes linkage failure from Clang randconfigs: kernel/futex.o:(.text.fixup+0x5c): relocation truncated to fit: R_ARM_JUMP24 against `.init.text' and boot failures for CONFIG_THUMB2_KERNEL. Link: https://github.com/ClangBuiltLinux/linux/issues/325 Comments from Nick Desaulniers: See-also: 03b8c7b623c8 ("futex: Allow architectures to skip futex_atomic_cmpxchg_inatomic() test") Reported-by: Arnd Bergmann Reported-by: Nathan Chancellor Suggested-by: Thomas Gleixner Signed-off-by: Nick Desaulniers Reviewed-by: Thomas Gleixner Tested-by: Nathan Chancellor Reviewed-by: Linus Walleij Cc: stable@vger.kernel.org # v3.14+ Reviewed-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 59be177a909ac320e5f4b2a461ac09e20f35b2d8 Author: José Roberto de Souza Date: Tue Oct 12 18:00:46 2021 -0700 drm/i915: Remove memory frequency calculation This memory frequency calculated is only used to check if it is zero, what is not useful as it will never actually be zero. Also the calculation is wrong, we should be checking other bit to select the appropriate frequency multiplier while this code is stuck with a fixed multiplier. So here dropping it as whole. v2: - Also remove memory frequency calculation for gen9 LP platforms Cc: Yakui Zhao Cc: Matt Roper Fixes: 5d0c938ec9cc ("drm/i915/gen11+: Only load DRAM information from pcode") Signed-off-by: José Roberto de Souza Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20211013010046.91858-1-jose.souza@intel.com (cherry picked from commit 83f52364b15265aec47d07e02b0fbf4093ab8554) Signed-off-by: Jani Nikula commit 1bd85aa65d0e7b5e4d09240f492f37c569fdd431 Author: Jeff Layton Date: Thu Oct 7 14:19:49 2021 -0400 ceph: fix handling of "meta" errors Currently, we check the wb_err too early for directories, before all of the unsafe child requests have been waited on. In order to fix that we need to check the mapping->wb_err later nearer to the end of ceph_fsync. We also have an overly-complex method for tracking errors after blocklisting. The errors recorded in cleanup_session_requests go to a completely separate field in the inode, but we end up reporting them the same way we would for any other error (in fsync). There's no real benefit to tracking these errors in two different places, since the only reporting mechanism for them is in fsync, and we'd need to advance them both every time. Given that, we can just remove i_meta_err, and convert the places that used it to instead just use mapping->wb_err instead. That also fixes the original problem by ensuring that we do a check_and_advance of the wb_err at the end of the fsync op. Cc: stable@vger.kernel.org URL: https://tracker.ceph.com/issues/52864 Reported-by: Patrick Donnelly Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 98d0a6fb7303a6f4a120b8b8ed05b86ff5db53e8 Author: Jeff Layton Date: Thu Sep 30 08:33:13 2021 -0400 ceph: skip existing superblocks that are blocklisted or shut down when mounting Currently when mounting, we may end up finding an existing superblock that corresponds to a blocklisted MDS client. This means that the new mount ends up being unusable. If we've found an existing superblock with a client that is already blocklisted, and the client is not configured to recover on its own, fail the match. Ditto if the superblock has been forcibly unmounted. While we're in here, also rename "other" to the more conventional "fsc". Cc: stable@vger.kernel.org URL: https://bugzilla.redhat.com/show_bug.cgi?id=1901499 Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d674a8f123b4096d85955c7eaabec688f29724c9 Author: Marc Kleine-Budde Date: Fri May 7 11:18:39 2021 +0200 can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path When the a large chunk of data send and the receiver does not send a Flow Control frame back in time, the sendmsg() does not return a error code, but the number of bytes sent corresponding to the size of the packet. If a timeout occurs the isotp_tx_timer_handler() is fired, sets sk->sk_err and calls the sk->sk_error_report() function. It was wrongly expected that the error would be propagated to user space in every case. For isotp_sendmsg() blocking on wait_event_interruptible() this is not the case. This patch fixes the problem by checking if sk->sk_err is set and returning the error to user space. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://github.com/hartkopp/can-isotp/issues/42 Link: https://github.com/hartkopp/can-isotp/pull/43 Link: https://lore.kernel.org/all/20210507091839.1366379-1-mkl@pengutronix.de Cc: stable@vger.kernel.org Reported-by: Sottas Guillaume (LMB) Tested-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit 362d5dfc483c7786bcfff27ff48e7b6f493f7c5a Author: Andrej Shadura Date: Mon Oct 18 15:16:22 2021 -0700 mailmap: add Andrej Shadura Add a mapping for my old work email for BelDisplayTech to the personal email, and make sure the Collabora email has the correct spelling of the first name. Link: https://lkml.kernel.org/r/20210917091016.30232-1-andrew.shadura@collabora.co.uk Signed-off-by: Andrej Shadura Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ca7554d05ac038c98271f8968ed821266ecaa9c Author: Marek Szyprowski Date: Mon Oct 18 15:16:19 2021 -0700 mm/thp: decrease nr_thps in file's mapping on THP split Decrease nr_thps counter in file's mapping to ensure that the page cache won't be dropped excessively on file write access if page has been already split. I've tried a test scenario running a big binary, kernel remaps it with THPs, then force a THP split with /sys/kernel/debug/split_huge_pages. During any further open of that binary with O_RDWR or O_WRITEONLY kernel drops page cache for it, because of non-zero thps counter. Link: https://lkml.kernel.org/r/20211012120237.2600-1-m.szyprowski@samsung.com Signed-off-by: Marek Szyprowski Fixes: 09d91cda0e82 ("mm,thp: avoid writes to file with THP in pagecache") Fixes: 06d3eff62d9d ("mm/thp: fix node page state in split_huge_page_to_list()") Acked-by: Matthew Wilcox (Oracle) Reviewed-by: Yang Shi Cc: Cc: Song Liu Cc: Rik van Riel Cc: "Kirill A . Shutemov" Cc: Johannes Weiner Cc: Hillf Danton Cc: Hugh Dickins Cc: William Kucharski Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79f9bc5843142b649575f887dccdf1c07ad75c20 Author: Sean Christopherson Date: Mon Oct 18 15:16:16 2021 -0700 mm/secretmem: fix NULL page->mapping dereference in page_is_secretmem() Check for a NULL page->mapping before dereferencing the mapping in page_is_secretmem(), as the page's mapping can be nullified while gup() is running, e.g. by reclaim or truncation. BUG: kernel NULL pointer dereference, address: 0000000000000068 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 4173897 Comm: CPU 3/KVM Tainted: G W RIP: 0010:internal_get_user_pages_fast+0x621/0x9d0 Code: <48> 81 7a 68 80 08 04 bc 0f 85 21 ff ff 8 89 c7 be RSP: 0018:ffffaa90087679b0 EFLAGS: 00010046 RAX: ffffe3f37905b900 RBX: 00007f2dd561e000 RCX: ffffe3f37905b934 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffe3f37905b900 ... CR2: 0000000000000068 CR3: 00000004c5898003 CR4: 00000000001726e0 Call Trace: get_user_pages_fast_only+0x13/0x20 hva_to_pfn+0xa9/0x3e0 try_async_pf+0xa1/0x270 direct_page_fault+0x113/0xad0 kvm_mmu_page_fault+0x69/0x680 vmx_handle_exit+0xe1/0x5d0 kvm_arch_vcpu_ioctl_run+0xd81/0x1c70 kvm_vcpu_ioctl+0x267/0x670 __x64_sys_ioctl+0x83/0xa0 do_syscall_64+0x56/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Link: https://lkml.kernel.org/r/20211007231502.3552715-1-seanjc@google.com Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Sean Christopherson Reported-by: Darrick J. Wong Reported-by: Stephen Tested-by: Darrick J. Wong Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 032146cda85566abcd1c4884d9d23e4e30a07e9a Author: Matthew Wilcox (Oracle) Date: Mon Oct 18 15:16:12 2021 -0700 vfs: check fd has read access in kernel_read_file_from_fd() If we open a file without read access and then pass the fd to a syscall whose implementation calls kernel_read_file_from_fd(), we get a warning from __kernel_read(): if (WARN_ON_ONCE(!(file->f_mode & FMODE_READ))) This currently affects both finit_module() and kexec_file_load(), but it could affect other syscalls in the future. Link: https://lkml.kernel.org/r/20211007220110.600005-1-willy@infradead.org Fixes: b844f0ecbc56 ("vfs: define kernel_copy_file_from_fd()") Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Hao Sun Reviewed-by: Kees Cook Acked-by: Christian Brauner Cc: Al Viro Cc: Mimi Zohar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b0e901280d9860a0a35055f220e8e457f300f40a Author: Lukas Bulwahn Date: Mon Oct 18 15:16:09 2021 -0700 elfcore: correct reference to CONFIG_UML Commit 6e7b64b9dd6d ("elfcore: fix building with clang") introduces special handling for two architectures, ia64 and User Mode Linux. However, the wrong name, i.e., CONFIG_UM, for the intended Kconfig symbol for User-Mode Linux was used. Although the directory for User Mode Linux is ./arch/um; the Kconfig symbol for this architecture is called CONFIG_UML. Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: UM Referencing files: include/linux/elfcore.h Similar symbols: UML, NUMA Correct the name of the config to the intended one. [akpm@linux-foundation.org: fix um/x86_64, per Catalin] Link: https://lkml.kernel.org/r/20211006181119.2851441-1-catalin.marinas@arm.com Link: https://lkml.kernel.org/r/YV6pejGzLy5ppEpt@arm.com Link: https://lkml.kernel.org/r/20211006082209.417-1-lukas.bulwahn@gmail.com Fixes: 6e7b64b9dd6d ("elfcore: fix building with clang") Signed-off-by: Lukas Bulwahn Cc: Arnd Bergmann Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Catalin Marinas Cc: Barret Rhoden Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3ddd60268c24bcac9d744404cc277e9dc52fe6b6 Author: Miaohe Lin Date: Mon Oct 18 15:16:06 2021 -0700 mm, slub: fix incorrect memcg slab count for bulk free kmem_cache_free_bulk() will call memcg_slab_free_hook() for all objects when doing bulk free. So we shouldn't call memcg_slab_free_hook() again for bulk free to avoid incorrect memcg slab count. Link: https://lkml.kernel.org/r/20210916123920.48704-6-linmiaohe@huawei.com Fixes: d1b2cf6cb84a ("mm: memcg/slab: uncharge during kmem_cache_free_bulk()") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67823a544414def2a36c212abadb55b23bcda00c Author: Miaohe Lin Date: Mon Oct 18 15:16:02 2021 -0700 mm, slub: fix potential use-after-free in slab_debugfs_fops When sysfs_slab_add failed, we shouldn't call debugfs_slab_add() for s because s will be freed soon. And slab_debugfs_fops will use s later leading to a use-after-free. Link: https://lkml.kernel.org/r/20210916123920.48704-5-linmiaohe@huawei.com Fixes: 64dd68497be7 ("mm: slub: move sysfs slab alloc/free interfaces to debugfs") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9037c57681d25e4dcc442d940d6dbe24dd31f461 Author: Miaohe Lin Date: Mon Oct 18 15:15:59 2021 -0700 mm, slub: fix potential memoryleak in kmem_cache_open() In error path, the random_seq of slub cache might be leaked. Fix this by using __kmem_cache_release() to release all the relevant resources. Link: https://lkml.kernel.org/r/20210916123920.48704-4-linmiaohe@huawei.com Fixes: 210e7a43fa90 ("mm: SLUB freelist randomization") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 899447f669da76cc3605665e1a95ee877bc464cc Author: Miaohe Lin Date: Mon Oct 18 15:15:55 2021 -0700 mm, slub: fix mismatch between reconstructed freelist depth and cnt If object's reuse is delayed, it will be excluded from the reconstructed freelist. But we forgot to adjust the cnt accordingly. So there will be a mismatch between reconstructed freelist depth and cnt. This will lead to free_debug_processing() complaining about freelist count or a incorrect slub inuse count. Link: https://lkml.kernel.org/r/20210916123920.48704-3-linmiaohe@huawei.com Fixes: c3895391df38 ("kasan, slub: fix handling of kasan_slab_free hook") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2127d22509aec3a83dffb2a3c736df7ba747a7ce Author: Miaohe Lin Date: Mon Oct 18 15:15:52 2021 -0700 mm, slub: fix two bugs in slab_debug_trace_open() Patch series "Fixups for slub". This series contains various bug fixes for slub. We fix memoryleak, use-afer-free, NULL pointer dereferencing and so on in slub. More details can be found in the respective changelogs. This patch (of 5): It's possible that __seq_open_private() will return NULL. So we should check it before using lest dereferencing NULL pointer. And in error paths, we forgot to release private buffer via seq_release_private(). Memory will leak in these paths. Link: https://lkml.kernel.org/r/20210916123920.48704-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210916123920.48704-2-linmiaohe@huawei.com Fixes: 64dd68497be7 ("mm: slub: move sysfs slab alloc/free interfaces to debugfs") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Greg Kroah-Hartman Cc: Faiyaz Mohammed Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Kees Cook Cc: Bharata B Rao Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6d2aec9e123bb9c49cb5c7fc654f25f81e688e8c Author: Eric Dumazet Date: Mon Oct 18 15:15:49 2021 -0700 mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() syzbot reported access to unitialized memory in mbind() [1] Issue came with commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") This commit added a new bit in MPOL_MODE_FLAGS, but only checked valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in do_set_mempolicy() This patch moves the check in sanitize_mpol_flags() so that it is also used by mbind() [1] BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_alloc_node mm/slub.c:3221 [inline] slab_alloc mm/slub.c:3230 [inline] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [inline] do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae ===================================================== Kernel panic - not syncing: panic_on_kmsan set ... CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 panic+0x44f/0xdeb kernel/panic.c:232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Link: https://lkml.kernel.org/r/20211001215630.810592-1-eric.dumazet@gmail.com Fixes: bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Mel Gorman Cc: "Huang, Ying" Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5173ed72bcfcddda21ff274ee31c6472fa150f29 Author: Peng Fan Date: Mon Oct 18 15:15:45 2021 -0700 memblock: check memory total_size mem=[X][G|M] is broken on ARM64 platform, there are cases that even type.cnt is 1, but total_size is not 0 because regions are merged into 1. So only check 'cnt' is not enough, total_size should be used, othersize bootargs 'mem=[X][G|B]' not work anymore. Link: https://lkml.kernel.org/r/20210930024437.32598-1-peng.fan@oss.nxp.com Fixes: e888fa7bb882 ("memblock: Check memory add/cap ordering") Signed-off-by: Peng Fan Reviewed-by: Mike Rapoport Cc: Geert Uytterhoeven Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b15fa9224e6e1239414525d8d556d824701849fc Author: Valentin Vidic Date: Mon Oct 18 15:15:42 2021 -0700 ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null terminated in the disk representation, while strlcpy assumes that the source string is always null terminated. This causes a read outside of the source string triggering the buffer overflow detection. detected buffer overflow in strlen ------------[ cut here ]------------ kernel BUG at lib/string.c:1149! invalid opcode: 0000 [#1] SMP PTI CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1 Debian 5.14.6-2 RIP: 0010:fortify_panic+0xf/0x11 ... Call Trace: ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2] ocfs2_fill_super+0x359/0x19b0 [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x454/0xa20 __x64_sys_mount+0x103/0x140 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Link: https://lkml.kernel.org/r/20210929180654.32460-1-vvidic@valentin-vidic.from.hr Signed-off-by: Valentin Vidic Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5314454ea3ff6fc746eaf71b9a7ceebed52888fa Author: Jan Kara Date: Mon Oct 18 15:15:39 2021 -0700 ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion from inline inode format to a normal inode format. The code in ocfs2_convert_inline_data_to_extents() attempts to zero out the whole cluster allocated for file data by grabbing, zeroing, and dirtying all pages covering this cluster. However these pages are beyond i_size, thus writeback code generally ignores these dirty pages and no blocks were ever actually zeroed on the disk. This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero pages past i_size.") for standard ocfs2 write path, inline conversion path was apparently forgotten; the commit log also has a reasoning why the zeroing actually is not needed. After commit 6dbf7bb55598, things became worse as writeback code stopped invalidating buffers on pages beyond i_size and thus these pages end up with clean PageDirty bit but with buffers attached to these pages being still dirty. So when a file is converted from inline format, then writeback triggers, and then the file is grown so that these pages become valid, the invalid dirtiness state is preserved, mark_buffer_dirty() does nothing on these pages (buffers are already dirty) but page is never written back because it is clean. So data written to these pages is lost once pages are reclaimed. Simple reproducer for the problem is: xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \ -c "pwrite 4000 2000" ocfs2_file After unmounting and mounting the fs again, you can observe that end of 'ocfs2_file' has lost its contents. Fix the problem by not doing the pointless zeroing during conversion from inline format similarly as in the standard write path. [akpm@linux-foundation.org: fix whitespace, per Joseph] Link: https://lkml.kernel.org/r/20210930095405.21433-1-jack@suse.cz Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") Signed-off-by: Jan Kara Reviewed-by: Joseph Qi Tested-by: Joseph Qi Acked-by: Gang He Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: "Markov, Andrey" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a6a0251c6fce496744121b4e08c899f45270dbcc Author: Huang Ying Date: Mon Oct 18 15:15:35 2021 -0700 mm/migrate: fix CPUHP state to update node demotion order The node demotion order needs to be updated during CPU hotplug. Because whether a NUMA node has CPU may influence the demotion order. The update function should be called during CPU online/offline after the node_states[N_CPU] has been updated. That is done in CPUHP_AP_ONLINE_DYN during CPU online and in CPUHP_MM_VMSTAT_DEAD during CPU offline. But in commit 884a6e5d1f93 ("mm/migrate: update node demotion order on hotplug events"), the function to update node demotion order is called in CPUHP_AP_ONLINE_DYN during CPU online/offline. This doesn't satisfy the order requirement. For example, there are 4 CPUs (P0, P1, P2, P3) in 2 sockets (P0, P1 in S0 and P2, P3 in S1), the demotion order is - S0 -> NUMA_NO_NODE - S1 -> NUMA_NO_NODE After P2 and P3 is offlined, because S1 has no CPU now, the demotion order should have been changed to - S0 -> S1 - S1 -> NO_NODE but it isn't changed, because the order updating callback for CPU hotplug doesn't see the new nodemask. After that, if P1 is offlined, the demotion order is changed to the expected order as above. So in this patch, we added CPUHP_AP_MM_DEMOTION_ONLINE and CPUHP_MM_DEMOTION_DEAD to be called after CPUHP_AP_ONLINE_DYN and CPUHP_MM_VMSTAT_DEAD during CPU online and offline, and register the update function on them. Link: https://lkml.kernel.org/r/20210929060351.7293-1-ying.huang@intel.com Fixes: 884a6e5d1f93 ("mm/migrate: update node demotion order on hotplug events") Signed-off-by: "Huang, Ying" Cc: Thomas Gleixner Cc: Dave Hansen Cc: Yang Shi Cc: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 76af6a054da4055305ddb28c5eb151b9ee4f74f9 Author: Dave Hansen Date: Mon Oct 18 15:15:32 2021 -0700 mm/migrate: add CPU hotplug to demotion #ifdef Once upon a time, the node demotion updates were driven solely by memory hotplug events. But now, there are handlers for both CPU and memory hotplug. However, the #ifdef around the code checks only memory hotplug. A system that has HOTPLUG_CPU=y but MEMORY_HOTPLUG=n would miss CPU hotplug events. Update the #ifdef around the common code. Add memory and CPU-specific #ifdefs for their handlers. These memory/CPU #ifdefs avoid unused function warnings when their Kconfig option is off. [arnd@arndb.de: rework hotplug_memory_notifier() stub] Link: https://lkml.kernel.org/r/20211013144029.2154629-1-arnd@kernel.org Link: https://lkml.kernel.org/r/20210924161255.E5FE8F7E@davehans-spike.ostc.intel.com Fixes: 884a6e5d1f93 ("mm/migrate: update node demotion order on hotplug events") Signed-off-by: Dave Hansen Signed-off-by: Arnd Bergmann Cc: "Huang, Ying" Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 295be91f7ef0027fca2f2e4788e99731aa931834 Author: Dave Hansen Date: Mon Oct 18 15:15:29 2021 -0700 mm/migrate: optimize hotplug-time demotion order updates Patch series "mm/migrate: 5.15 fixes for automatic demotion", v2. This contains two fixes for the "automatic demotion" code which was merged into 5.15: * Fix memory hotplug performance regression by watching suppressing any real action on irrelevant hotplug events. * Ensure CPU hotplug handler is registered when memory hotplug is disabled. This patch (of 2): == tl;dr == Automatic demotion opted for a simple, lazy approach to handling hotplug events. This noticeably slows down memory hotplug[1]. Optimize away updates to the demotion order when memory hotplug events should have no effect. This has no effect on CPU hotplug. There is no known problem on the CPU side and any work there will be in a separate series. == Background == Automatic demotion is a memory migration strategy to ensure that new allocations have room in faster memory tiers on tiered memory systems. The kernel maintains an array (node_demotion[]) to drive these migrations. The node_demotion[] path is calculated by starting at nodes with CPUs and then "walking" to nodes with memory. Only hotplug events which online or offline a node with memory (N_ONLINE) or CPUs (N_CPU) will actually affect the migration order. == Problem == However, the current code is lazy. It completely regenerates the migration order on *any* CPU or memory hotplug event. The logic was that these events are extremely rare and that the overhead from indiscriminate order regeneration is minimal. Part of the update logic involves a synchronize_rcu(), which is a pretty big hammer. Its overhead was large enough to be detected by some 0day tests that watch memory hotplug performance[1]. == Solution == Add a new helper (node_demotion_topo_changed()) which can differentiate between superfluous and impactful hotplug events. Skip the expensive update operation for superfluous events. == Aside: Locking == It took me a few moments to declare the locking to be safe enough for node_demotion_topo_changed() to work. It all hinges on the memory hotplug lock: During memory hotplug events, 'mem_hotplug_lock' is held for write. This ensures that two memory hotplug events can not be called simultaneously. CPU hotplug has a similar lock (cpuhp_state_mutex) which also provides mutual exclusion between CPU hotplug events. In addition, the demotion code acquire and hold the mem_hotplug_lock for read during its CPU hotplug handlers. This provides mutual exclusion between the demotion memory hotplug callbacks and the CPU hotplug callbacks. This effectively allows treating the migration target generation code to act as if it is single-threaded. 1. https://lore.kernel.org/all/20210905135932.GE15026@xsang-OptiPlex-9020/ Link: https://lkml.kernel.org/r/20210924161251.093CCD06@davehans-spike.ostc.intel.com Link: https://lkml.kernel.org/r/20210924161253.D7673E31@davehans-spike.ostc.intel.com Fixes: 884a6e5d1f93 ("mm/migrate: update node demotion order on hotplug events") Signed-off-by: Dave Hansen Reported-by: kernel test robot Reviewed-by: David Hildenbrand Cc: "Huang, Ying" Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: Greg Thelen Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb185d5f1ebf900f4ae3bf84cee212e6dd035aca Author: Nadav Amit Date: Mon Oct 18 15:15:25 2021 -0700 userfaultfd: fix a race between writeprotect and exit_mmap() A race is possible when a process exits, its VMAs are removed by exit_mmap() and at the same time userfaultfd_writeprotect() is called. The race was detected by KASAN on a development kernel, but it appears to be possible on vanilla kernels as well. Use mmget_not_zero() to prevent the race as done in other userfaultfd operations. Link: https://lkml.kernel.org/r/20210921200247.25749-1-namit@vmware.com Fixes: 63b2d4174c4ad ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl") Signed-off-by: Nadav Amit Tested-by: Li Wang Reviewed-by: Peter Xu Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8913970c19915bbe773d97d42989cd85b7fdc098 Author: Peter Xu Date: Mon Oct 18 15:15:22 2021 -0700 mm/userfaultfd: selftests: fix memory corruption with thp enabled In RHEL's gating selftests we've encountered memory corruption in the uffd event test even with upstream kernel: # ./userfaultfd anon 128 4 nr_pages: 32768, nr_pages_per_cpu: 32768 bounces: 3, mode: rnd racing read, userfaults: 6240 missing (6240) 14729 wp (14729) bounces: 2, mode: racing read, userfaults: 1444 missing (1444) 28877 wp (28877) bounces: 1, mode: rnd read, userfaults: 6055 missing (6055) 14699 wp (14699) bounces: 0, mode: read, userfaults: 82 missing (82) 25196 wp (25196) testing uffd-wp with pagemap (pgsize=4096): done testing uffd-wp with pagemap (pgsize=2097152): done testing events (fork, remap, remove): ERROR: nr 32427 memory corruption 0 1 (errno=0, line=963) ERROR: faulting process failed (errno=0, line=1117) It can be easily reproduced when global thp enabled, which is the default for RHEL. It's also known as a side effect of commit 0db282ba2c12 ("selftest: use mmap instead of posix_memalign to allocate memory", 2021-07-23), which is imho right itself on using mmap() to make sure the addresses will be untagged even on arm. The problem is, for each test we allocate buffers using two allocate_area() calls. We assumed these two buffers won't affect each other, however they could, because mmap() could have found that the two buffers are near each other and having the same VMA flags, so they got merged into one VMA. It won't be a big problem if thp is not enabled, but when thp is agressively enabled it means when initializing the src buffer it could accidentally setup part of the dest buffer too when there's a shared THP that overlaps the two regions. Then some of the dest buffer won't be able to be trapped by userfaultfd missing mode, then it'll cause memory corruption as described. To fix it, do release_pages() after initializing the src buffer. Since the previous two release_pages() calls are after uffd_test_ctx_clear() which will unmap all the buffers anyway (which is stronger than release pages; as unmap() also tear town pgtables), drop them as they shouldn't really be anything useful. We can mark the Fixes tag upon 0db282ba2c12 as it's reported to only happen there, however the real "Fixes" IMHO should be 8ba6e8640844, as before that commit we'll always do explicit release_pages() before registration of uffd, and 8ba6e8640844 changed that logic by adding extra unmap/map and we didn't release the pages at the right place. Meanwhile I don't have a solid glue anyway on whether posix_memalign() could always avoid triggering this bug, hence it's safer to attach this fix to commit 8ba6e8640844. Link: https://lkml.kernel.org/r/20210923232512.210092-1-peterx@redhat.com Fixes: 8ba6e8640844 ("userfaultfd/selftests: reinitialize test context in each test") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1994931 Signed-off-by: Peter Xu Reported-by: Li Wang Tested-by: Li Wang Reviewed-by: Axel Rasmussen Cc: Andrea Arcangeli Cc: Nadav Amit Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 29664923725a384dc7e0f74af7c66e5ab7bb2a26 Author: Marco Giunta Date: Mon Oct 18 18:25:52 2021 +0200 ALSA: usb-audio: Fix microphone sound on Jieli webcam. When a Jieli Technology USB Webcam is connected, the video part works well, but the mic sound is speeded up. On dmesg there are messages about different rates from the runtime rates, warnings about volume resolution and lastly, the log is filled, every 5 seconds, with retire_capture_urb error messages. The mic works only when ep packet size is set to wMaxPacketSize (normal sound and no more retire_capture_urb error messages). Skipping reading sample rate, fixes the messages about different rates and forcing a volume resolution, fixes warnings about volume range. I have arbitrarily choosed the value (16): I read in a comment that there should be no more than 255 levels, so 4096 (max volume) / 16 = 0-255. Signed-off-by: Marco Giunta Link: https://lore.kernel.org/r/20211018162552.12082-1-giun7a@gmail.com Signed-off-by: Takashi Iwai commit 4e5483b8440d01f6851a1388801088a6e0da0b56 Author: Adrian Hunter Date: Mon Oct 18 18:10:04 2021 +0300 scsi: ufs: ufs-pci: Force a full restore after suspend-to-disk Implement the ->restore() PM operation and set the link to off, which will force a full reset and restore. This ensures that Host Performance Booster is reset after suspend-to-disk. The Host Performance Booster feature caches logical-to-physical mapping information in the host memory. After suspend-to-disk, such information is not valid, so a full reset and restore is needed. A full reset and restore is done if the SPM level is 5 or 6, but not for other SPM levels, so this change fixes those cases. A full reset and restore also restores base address registers, so that code is removed. Link: https://lore.kernel.org/r/20211018151004.284200-2-adrian.hunter@intel.com Reviewed-by: Avri Altman Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 Author: Dmitry Bogdanov Date: Mon Oct 18 15:26:50 2021 +0300 scsi: qla2xxx: Fix unmap of already freed sgl The sgl is freed in the target stack in target_release_cmd_kref() before calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that causes a panic if sgl is not yet DMA unmapped: NIP dma_direct_unmap_sg+0xdc/0x180 LR dma_direct_unmap_sg+0xc8/0x180 Call Trace: ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable) dma_unmap_sg_attrs+0x54/0xf0 qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx] qlt_free_cmd+0x124/0x1d0 [qla2xxx] tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx] target_put_sess_cmd+0x198/0x370 [target_core_mod] transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod] tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx] The sgl may be left unmapped in error cases of response sending. For instance, qlt_rdy_to_xfer() maps sgl and exits when session is being deleted keeping the sgl mapped. This patch removes use-after-free of the sgl and ensures that the sgl is unmapped for any command that was not sent to firmware. Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com Reviewed-by: Himanshu Madhani Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 7fb223d0ad801f633c78cbe42b1d1b55f5d163ad Author: Joy Gu Date: Tue Oct 12 12:18:33 2021 -0700 scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()"), intended to change: bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN to: bsg_job->request->msgcode != FC_BSG_RPT_ELS but changed it to: bsg_job->request->msgcode == FC_BSG_RPT_ELS instead. Change the == to a != to avoid leaking the fcport structure or freeing unallocated memory. Link: https://lore.kernel.org/r/20211012191834.90306-2-jgu@purestorage.com Fixes: 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()") Reviewed-by: Bart Van Assche Signed-off-by: Joy Gu Signed-off-by: Martin K. Petersen commit 06634d5b6e923ed0d4772aba8def5a618f44c7fe Author: Zheyu Ma Date: Mon Oct 18 01:56:21 2021 +0000 scsi: qla2xxx: Return -ENOMEM if kzalloc() fails The driver probing function should return < 0 for failure, otherwise kernel will treat value > 0 as success. Link: https://lore.kernel.org/r/1634522181-31166-1-git-send-email-zheyuma97@gmail.com Reviewed-by: Himanshu Madhani Signed-off-by: Zheyu Ma Signed-off-by: Martin K. Petersen commit 6e3ee990c90494561921c756481d0e2125d8b895 Author: Gaosheng Cui Date: Sat Oct 16 15:23:50 2021 +0800 audit: fix possible null-pointer dereference in audit_filter_rules Fix possible null-pointer dereference in audit_filter_rules. audit_filter_rules() error: we previously assumed 'ctx' could be null Cc: stable@vger.kernel.org Fixes: bf361231c295 ("audit: add saddr_fam filter field") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Gaosheng Cui Signed-off-by: Paul Moore commit ed65df63a39a3f6ed04f7258de8b6789e5021c18 Author: Steven Rostedt (VMware) Date: Mon Oct 18 15:44:12 2021 -0400 tracing: Have all levels of checks prevent recursion While writing an email explaining the "bit = 0" logic for a discussion on making ftrace_test_recursion_trylock() disable preemption, I discovered a path that makes the "not do the logic if bit is zero" unsafe. The recursion logic is done in hot paths like the function tracer. Thus, any code executed causes noticeable overhead. Thus, tricks are done to try to limit the amount of code executed. This included the recursion testing logic. Having recursion testing is important, as there are many paths that can end up in an infinite recursion cycle when tracing every function in the kernel. Thus protection is needed to prevent that from happening. Because it is OK to recurse due to different running context levels (e.g. an interrupt preempts a trace, and then a trace occurs in the interrupt handler), a set of bits are used to know which context one is in (normal, softirq, irq and NMI). If a recursion occurs in the same level, it is prevented*. Then there are infrastructure levels of recursion as well. When more than one callback is attached to the same function to trace, it calls a loop function to iterate over all the callbacks. Both the callbacks and the loop function have recursion protection. The callbacks use the "ftrace_test_recursion_trylock()" which has a "function" set of context bits to test, and the loop function calls the internal trace_test_and_set_recursion() directly, with an "internal" set of bits. If an architecture does not implement all the features supported by ftrace then the callbacks are never called directly, and the loop function is called instead, which will implement the features of ftrace. Since both the loop function and the callbacks do recursion protection, it was seemed unnecessary to do it in both locations. Thus, a trick was made to have the internal set of recursion bits at a more significant bit location than the function bits. Then, if any of the higher bits were set, the logic of the function bits could be skipped, as any new recursion would first have to go through the loop function. This is true for architectures that do not support all the ftrace features, because all functions being traced must first go through the loop function before going to the callbacks. But this is not true for architectures that support all the ftrace features. That's because the loop function could be called due to two callbacks attached to the same function, but then a recursion function inside the callback could be called that does not share any other callback, and it will be called directly. i.e. traced_function_1: [ more than one callback tracing it ] call loop_func loop_func: trace_recursion set internal bit call callback callback: trace_recursion [ skipped because internal bit is set, return 0 ] call traced_function_2 traced_function_2: [ only traced by above callback ] call callback callback: trace_recursion [ skipped because internal bit is set, return 0 ] call traced_function_2 [ wash, rinse, repeat, BOOM! out of shampoo! ] Thus, the "bit == 0 skip" trick is not safe, unless the loop function is call for all functions. Since we want to encourage architectures to implement all ftrace features, having them slow down due to this extra logic may encourage the maintainers to update to the latest ftrace features. And because this logic is only safe for them, remove it completely. [*] There is on layer of recursion that is allowed, and that is to allow for the transition between interrupt context (normal -> softirq -> irq -> NMI), because a trace may occur before the context update is visible to the trace recursion logic. Link: https://lore.kernel.org/all/609b565a-ed6e-a1da-f025-166691b5d994@linux.alibaba.com/ Link: https://lkml.kernel.org/r/20211018154412.09fcad3c@gandalf.local.home Cc: Linus Torvalds Cc: Petr Mladek Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Thomas Gleixner Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Josh Poimboeuf Cc: Jiri Kosina Cc: Miroslav Benes Cc: Joe Lawrence Cc: Colin Ian King Cc: Masami Hiramatsu Cc: "Peter Zijlstra (Intel)" Cc: Nicholas Piggin Cc: Jisheng Zhang Cc: =?utf-8?b?546L6LSH?= Cc: Guo Ren Cc: stable@vger.kernel.org Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks") Signed-off-by: Steven Rostedt (VMware) commit 8a64ef042eab8a6cec04a6c79d44d1af79b628ca Author: Nathan Chancellor Date: Mon Oct 18 12:31:01 2021 -0700 nfp: bpf: silence bitwise vs. logical OR warning A new warning in clang points out two places in this driver where boolean expressions are being used with a bitwise OR instead of a logical one: drivers/net/ethernet/netronome/nfp/nfp_asm.c:199:20: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical] reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ || drivers/net/ethernet/netronome/nfp/nfp_asm.c:199:20: note: cast one or both operands to int to silence this warning drivers/net/ethernet/netronome/nfp/nfp_asm.c:280:20: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical] reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ || drivers/net/ethernet/netronome/nfp/nfp_asm.c:280:20: note: cast one or both operands to int to silence this warning 2 errors generated. The motivation for the warning is that logical operations short circuit while bitwise operations do not. In this case, it does not seem like short circuiting is harmful so implement the suggested fix of changing to a logical operation to fix the warning. Link: https://github.com/ClangBuiltLinux/linux/issues/1479 Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20211018193101.2340261-1-nathan@kernel.org Signed-off-by: Jakub Kicinski commit 5ca6779d2f18b195cb3b66a14a271911fc609094 Author: Rob Clark Date: Mon Oct 18 08:36:25 2021 -0700 drm/msm/devfreq: Restrict idle clamping to a618 for now Until we better understand the stability issues caused by frequent frequency changes, lets limit them to a618. Signed-off-by: Rob Clark Tested-by: John Stultz Tested-by: Caleb Connolly Link: https://lore.kernel.org/r/20211018153627.2787882-1-robdclark@gmail.com Signed-off-by: Rob Clark commit 15bc01effefe97757ef02ca09e9d1b927ab22725 Author: Eric W. Biederman Date: Sat Oct 16 15:59:49 2021 -0500 ucounts: Fix signal ucount refcounting In commit fda31c50292a ("signal: avoid double atomic counter increments for user accounting") Linus made a clever optimization to how rlimits and the struct user_struct. Unfortunately that optimization does not work in the obvious way when moved to nested rlimits. The problem is that the last decrement of the per user namespace per user sigpending counter might also be the last decrement of the sigpending counter in the parent user namespace as well. Which means that simply freeing the leaf ucount in __free_sigqueue is not enough. Maintain the optimization and handle the tricky cases by introducing inc_rlimit_get_ucounts and dec_rlimit_put_ucounts. By moving the entire optimization into functions that perform all of the work it becomes possible to ensure that every level is handled properly. The new function inc_rlimit_get_ucounts returns 0 on failure to increment the ucount. This is different than inc_rlimit_ucounts which increments the ucounts and returns LONG_MAX if the ucount counter has exceeded it's maximum or it wrapped (to indicate the counter needs to decremented). I wish we had a single user to account all pending signals to across all of the threads of a process so this complexity was not necessary Cc: stable@vger.kernel.org Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") v1: https://lkml.kernel.org/r/87mtnavszx.fsf_-_@disp2133 Link: https://lkml.kernel.org/r/87fssytizw.fsf_-_@disp2133 Reviewed-by: Alexey Gladkov Tested-by: Rune Kleveland Tested-by: Yu Zhao Tested-by: Jordan Glover Signed-off-by: "Eric W. Biederman" commit 675c496d0f92b481ebe4abf4fb06eadad7789de6 Author: Martin Blumenstingl Date: Sat Oct 16 12:50:21 2021 +0200 clk: composite: Also consider .determine_rate for rate + mux composites Commit 69a00fb3d69706 ("clk: divider: Implement and wire up .determine_rate by default") switches clk_divider_ops to implement .determine_rate by default. This breaks composite clocks with multiple parents because clk-composite.c does not use the special handling for mux + divider combinations anymore (that was restricted to rate clocks which only implement .round_rate, but not .determine_rate). Alex reports: This breaks lot of clocks for Rockchip which intensively uses composites, i.e. those clocks will always stay at the initial parent, which in some cases is the XTAL clock and I strongly guess it is the same for other platforms, which use composite clocks having more than one parent (e.g. mediatek, ti ...) Example (RK3399) clk_sdio is set (initialized) with XTAL (24 MHz) as parent in u-boot. It will always stay at this parent, even if the mmc driver sets a rate of 200 MHz (fails, as the nature of things), which should switch it to any of its possible parent PLLs defined in mux_pll_src_cpll_gpll_npll_ppll_upll_24m_p (see clk-rk3399.c) - which never happens. Restore the original behavior by changing the priority of the conditions inside clk-composite.c. Now the special rate + mux case (with rate_ops having a .round_rate - which is still the case for the default clk_divider_ops) is preferred over rate_ops which have .determine_rate defined (and not further considering the mux). Fixes: 69a00fb3d69706 ("clk: divider: Implement and wire up .determine_rate by default") Reported-by: Alex Bee Signed-off-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20211016105022.303413-2-martin.blumenstingl@googlemail.com Tested-by: Alex Bee Tested-by: Chen-Yu Tsai Signed-off-by: Stephen Boyd commit 9f1ee7b169afbd10c3ad254220d1b37beb5798aa Author: Paolo Bonzini Date: Mon Oct 18 06:49:18 2021 -0400 KVM: SEV-ES: reduce ghcb_sa_len to 32 bits The size of the GHCB scratch area is limited to 16 KiB (GHCB_SCRATCH_AREA_LIMIT), so there is no need for it to be a u64. This fixes a build error on 32-bit systems: i686-linux-gnu-ld: arch/x86/kvm/svm/sev.o: in function `sev_es_string_io: sev.c:(.text+0x110f): undefined reference to `__udivdi3' Cc: stable@vger.kernel.org Fixes: 019057bd73d1 ("KVM: SEV-ES: fix length of string I/O") Reported-by: Naresh Kamboju Signed-off-by: Paolo Bonzini commit d61863c66f9b443192997613cd6aeca3f65cc313 Author: Hao Xiang Date: Fri Oct 15 19:59:21 2021 +0800 KVM: VMX: Remove redundant handling of bus lock vmexit Hardware may or may not set exit_reason.bus_lock_detected on BUS_LOCK VM-Exits. Dealing with KVM_RUN_X86_BUS_LOCK in handle_bus_lock_vmexit could be redundant when exit_reason.basic is EXIT_REASON_BUS_LOCK. We can remove redundant handling of bus lock vmexit. Unconditionally Set exit_reason.bus_lock_detected in handle_bus_lock_vmexit(), and deal with KVM_RUN_X86_BUS_LOCK only in vmx_handle_exit(). Signed-off-by: Hao Xiang Message-Id: <1634299161-30101-1-git-send-email-hao.xiang@linux.alibaba.com> Signed-off-by: Paolo Bonzini commit 01c7d2672a84dbdfa8050d073c3ea466437578fd Author: Christian Borntraeger Date: Wed Oct 6 12:17:24 2021 +0000 KVM: kvm_stat: do not show halt_wait_ns Similar to commit 111d0bda8eeb ("tools/kvm_stat: Exempt time-based counters"), we should not show timer values in kvm_stat. Remove the new halt_wait_ns. Fixes: 87bcc5fa092f ("KVM: stats: Add halt_wait_ns stats for all architectures") Cc: Jing Zhang Cc: Stefan Raspl Signed-off-by: Christian Borntraeger Reviewed-by: Stefan Raspl Message-Id: <20211006121724.4154-1-borntraeger@de.ibm.com> Signed-off-by: Paolo Bonzini commit 9139a7a64581c80d157027ae20e86f2f24d4292c Author: Sean Christopherson Date: Tue Oct 12 17:35:54 2021 -0700 KVM: x86: WARN if APIC HW/SW disable static keys are non-zero on unload WARN if the static keys used to track if any vCPU has disabled its APIC are left elevated at module exit. Unlike the underflow case, nothing in the static key infrastructure will complain if a key is left elevated, and because an elevated key only affects performance, nothing in KVM will fail if either key is improperly incremented. Signed-off-by: Sean Christopherson Message-Id: <20211013003554.47705-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f7d8a19f9a056a05c5c509fa65af472a322abfee Author: Sean Christopherson Date: Tue Oct 12 17:35:53 2021 -0700 Revert "KVM: x86: Open code necessary bits of kvm_lapic_set_base() at vCPU RESET" Revert a change to open code bits of kvm_lapic_set_base() when emulating APIC RESET to fix an apic_hw_disabled underflow bug due to arch.apic_base and apic_hw_disabled being unsyncrhonized when the APIC is created. If kvm_arch_vcpu_create() fails after creating the APIC, kvm_free_lapic() will see the initialized-to-zero vcpu->arch.apic_base and decrement apic_hw_disabled without KVM ever having incremented apic_hw_disabled. Using kvm_lapic_set_base() in kvm_lapic_reset() is also desirable for a potential future where KVM supports RESET outside of vCPU creation, in which case all the side effects of kvm_lapic_set_base() are needed, e.g. to handle the transition from x2APIC => xAPIC. Alternatively, KVM could temporarily increment apic_hw_disabled (and call kvm_lapic_set_base() at RESET), but that's a waste of cycles and would impact the performance of other vCPUs and VMs. The other subtle side effect is that updating the xAPIC ID needs to be done at RESET regardless of whether the APIC was previously enabled, i.e. kvm_lapic_reset() needs an explicit call to kvm_apic_set_xapic_id() regardless of whether or not kvm_lapic_set_base() also performs the update. That makes stuffing the enable bit at vCPU creation slightly more palatable, as doing so affects only the apic_hw_disabled key. Opportunistically tweak the comment to explicitly call out the connection between vcpu->arch.apic_base and apic_hw_disabled, and add a comment to call out the need to always do kvm_apic_set_xapic_id() at RESET. Underflow scenario: kvm_vm_ioctl() { kvm_vm_ioctl_create_vcpu() { kvm_arch_vcpu_create() { if (something_went_wrong) goto fail_free_lapic; /* vcpu->arch.apic_base is initialized when something_went_wrong is false. */ kvm_vcpu_reset() { kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) { vcpu->arch.apic_base = APIC_DEFAULT_PHYS_BASE | MSR_IA32_APICBASE_ENABLE; } } return 0; fail_free_lapic: kvm_free_lapic() { /* vcpu->arch.apic_base is not yet initialized when something_went_wrong is true. */ if (!(vcpu->arch.apic_base & MSR_IA32_APICBASE_ENABLE)) static_branch_slow_dec_deferred(&apic_hw_disabled); // <= underflow bug. } return r; } } } This (mostly) reverts commit 421221234ada41b4a9f0beeb08e30b07388bd4bd. Fixes: 421221234ada ("KVM: x86: Open code necessary bits of kvm_lapic_set_base() at vCPU RESET") Reported-by: syzbot+9fc046ab2b0cf295a063@syzkaller.appspotmail.com Debugged-by: Tetsuo Handa Signed-off-by: Sean Christopherson Message-Id: <20211013003554.47705-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit fa13843d1565d4c5b3aeb9be3343b313416bef46 Author: Paolo Bonzini Date: Fri Oct 15 13:05:00 2021 -0400 KVM: X86: fix lazy allocation of rmaps If allocation of rmaps fails, but some of the pointers have already been written, those pointers can be cleaned up when the memslot is freed, or even reused later for another attempt at allocating the rmaps. Therefore there is no need to WARN, as done for example in memslot_rmap_alloc, but the allocation *must* be skipped lest KVM will overwrite the previous pointer and will indeed leak memory. Signed-off-by: Paolo Bonzini commit baa1e5ca172ce7bf9554070139482dd7ea919528 Author: Peter Gonda Date: Fri Oct 15 13:32:22 2021 -0400 KVM: SEV-ES: Set guest_state_protected after VMSA update The refactoring in commit bb18a6777465 ("KVM: SEV: Acquire vcpu mutex when updating VMSA") left behind the assignment to svm->vcpu.arch.guest_state_protected; add it back. Signed-off-by: Peter Gonda [Delta between v2 and v3 of Peter's patch, which had already been committed; the commit message is my own. - Paolo] Fixes: bb18a6777465 ("KVM: SEV: Acquire vcpu mutex when updating VMSA") Signed-off-by: Paolo Bonzini commit 9fbfabfda25d8774c5a08634fdd2da000a924890 Author: Zqiang Date: Mon Oct 18 18:34:22 2021 +0800 block: fix incorrect references to disk objects When adding partitions to the disk, the reference count of the disk object is increased. then alloc partition device and called device_add(), if the device_add() return error, the reference count of the disk object will be reduced twice, at put_device(pdev) and put_disk(disk). this leads to the end of the object's life cycle prematurely, and trigger following calltrace. __init_work+0x2d/0x50 kernel/workqueue.c:519 synchronize_rcu_expedited+0x3af/0x650 kernel/rcu/tree_exp.h:847 bdi_remove_from_list mm/backing-dev.c:938 [inline] bdi_unregister+0x17f/0x5c0 mm/backing-dev.c:946 release_bdi+0xa1/0xc0 mm/backing-dev.c:968 kref_put include/linux/kref.h:65 [inline] bdi_put+0x72/0xa0 mm/backing-dev.c:976 bdev_free_inode+0x11e/0x220 block/bdev.c:408 i_callback+0x3f/0x70 fs/inode.c:226 rcu_do_batch kernel/rcu/tree.c:2508 [inline] rcu_core+0x76d/0x16c0 kernel/rcu/tree.c:2743 __do_softirq+0x1d7/0x93b kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0xf2/0x130 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 making disk is NULL when calling put_disk(). Reported-by: Hao Sun Signed-off-by: Zqiang Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211018103422.2043-1-qiang.zhang1211@gmail.com Signed-off-by: Jens Axboe commit 4cce60f15c04d69eff6ffc539ab09137dbe15070 Author: Randy Dunlap Date: Mon Oct 4 00:56:06 2021 -0700 NIOS2: irqflags: rename a redefined register name Both arch/nios2/ and drivers/mmc/host/tmio_mmc.c define a macro with the name "CTL_STATUS". Change the one in arch/nios2/ to be "CTL_FSTATUS" (flags status) to eliminate the build warning. In file included from ../drivers/mmc/host/tmio_mmc.c:22: drivers/mmc/host/tmio_mmc.h:31: warning: "CTL_STATUS" redefined 31 | #define CTL_STATUS 0x1c arch/nios2/include/asm/registers.h:14: note: this is the location of the previous definition 14 | #define CTL_STATUS 0 Fixes: b31ebd8055ea ("nios2: Nios2 registers") Signed-off-by: Randy Dunlap Cc: Dinh Nguyen Signed-off-by: Dinh Nguyen commit d49fe5e8151711ed5276f049bc7f73e02dc141f8 Author: Tianjia Zhang Date: Mon Oct 18 14:42:01 2021 +0800 selftests/tls: add SM4 algorithm dependency for tls selftests Kernel TLS test has added SM4 GCM/CCM algorithm support, but SM4 algorithm is not compiled by default, this patch add SM4 config dependency. Reported-by: Hangbin Liu Reported-by: kernel test robot Signed-off-by: Tianjia Zhang Signed-off-by: David S. Miller commit 5a20dd46b8b8459382685969cf0f196ae9fb9766 Author: Jeremy Kerr Date: Mon Oct 18 11:29:35 2021 +0800 mctp: Be explicit about struct sockaddr_mctp padding We currently have some implicit padding in struct sockaddr_mctp. This patch makes this padding explicit, and ensures we have consistent layout on platforms with <32bit alignmnent. Fixes: 60fc63981693 ("mctp: Add sockaddr_mctp to uapi") Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit b416beb25d9317499c823aea1522eefd8d72ea36 Author: Jeremy Kerr Date: Mon Oct 18 11:29:34 2021 +0800 mctp: unify sockaddr_mctp types Use the more precise __kernel_sa_family_t for smctp_family, to match struct sockaddr. Also, use an unsigned int for the network member; negative networks don't make much sense. We're already using unsigned for mctp_dev and mctp_skb_cb, but need to change mctp_sock to suit. Fixes: 60fc63981693 ("mctp: Add sockaddr_mctp to uapi") Signed-off-by: Jeremy Kerr Acked-by: Eugene Syromiatnikov Signed-off-by: David S. Miller commit b2cddb44bddc1a9c5949a978bb454bba863264db Author: Zheyu Ma Date: Mon Oct 18 02:16:22 2021 +0000 cavium: Return negative value when pci_alloc_irq_vectors() fails During the process of driver probing, the probe function should return < 0 for failure, otherwise, the kernel will treat value > 0 as success. Signed-off-by: Zheyu Ma Signed-off-by: David S. Miller commit d1a7b9e4696584ce05c12567762c18a866837a85 Author: Wan Jiabing Date: Sun Oct 17 21:32:32 2021 -0400 net: mscc: ocelot: Add of_node_put() before goto Fix following coccicheck warning: ./drivers/net/ethernet/mscc/ocelot_vsc7514.c:946:1-33: WARNING: Function for_each_available_child_of_node should have of_node_put() before goto. Early exits from for_each_available_child_of_node should decrement the node reference counter. Signed-off-by: Wan Jiabing Signed-off-by: David S. Miller commit d9fd7e9fccfac466fb528a783f2fc76f2982604c Author: Wan Jiabing Date: Sun Oct 17 21:31:30 2021 -0400 net: sparx5: Add of_node_put() before goto Fix following coccicheck warning: ./drivers/net/ethernet/microchip/sparx5/s4parx5_main.c:723:1-33: WARNING: Function for_each_available_child_of_node should have of_node_put() before goto Early exits from for_each_available_child_of_node should decrement the node reference counter. Signed-off-by: Wan Jiabing Signed-off-by: David S. Miller commit 2dc4e9e88cfcc38454d52b01ed3422238c134003 Author: Paul Blakey Date: Sun Oct 17 14:58:51 2021 +0300 net/sched: act_ct: Fix byte count on fragmented packets First fragmented packets (frag offset = 0) byte len is zeroed when stolen by ip_defrag(). And since act_ct update the stats only afterwards (at end of execute), bytes aren't correctly accounted for such packets. To fix this, move stats update to start of action execute. Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Paul Blakey Signed-off-by: David S. Miller commit 342afce10d6f61c443c95e244f812d4766f73f53 Author: DENG Qingfang Date: Sat Oct 16 14:24:14 2021 +0800 net: dsa: mt7530: correct ds->num_ports Setting ds->num_ports to DSA_MAX_PORTS made DSA core allocate unnecessary dsa_port's and call mt7530_port_disable for non-existent ports. Set it to MT7530_NUM_PORTS to fix that, and dsa_is_user_port check in port_enable/disable is no longer required. Cc: stable@vger.kernel.org Signed-off-by: DENG Qingfang Signed-off-by: David S. Miller commit 66d262804a2276721eac86cf18fcd61046149193 Author: Aleksander Jan Bajkowski Date: Sat Oct 16 00:10:20 2021 +0200 net: dsa: lantiq_gswip: fix register definition I compared the register definitions with the D-Link DWR-966 GPL sources and found that the PUAFD field definition was incorrect. This definition is unused and causes no issues. Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Signed-off-by: Aleksander Jan Bajkowski Acked-by: Hauke Mehrtens Signed-off-by: David S. Miller commit bca69044affa6bb1be38e91bbd9de99ba11aee76 Merge: 0a9bb11a5e298 553715feaa9e0 Author: David S. Miller Date: Mon Oct 18 13:04:42 2021 +0100 Merge tag 'linux-can-fixes-for-5.15-20211017' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2021-10-17 this is a pull request of 11 patches for net/master. The first 4 patches are by Ziyang Xuan and Zhang Changzhong and fix 1 use after free and 3 standard conformance problems in the j1939 CAN stack. The next 2 patches are by Ziyang Xuan and fix 2 concurrency problems in the ISOTP CAN stack. Yoshihiro Shimoda's patch for the rcar_can fix suspend/resume on not running CAN interfaces. Aswath Govindraju's patch for the m_can driver fixes access for MMIO devices. Zheyu Ma contributes a patch for the peak_pci driver to fix a use after free. Stephane Grosjean's 2 patches fix CAN error state handling in the peak_usb driver. ==================== Signed-off-by: David S. Miller commit 0a9bb11a5e298e72b675255a4bb2893513000584 Author: Randy Dunlap Date: Thu Oct 14 19:18:04 2021 -0700 hamradio: baycom_epp: fix build for UML On i386, the baycom_epp driver wants to inspect X86 CPU features (TSC) and then act on that data, but that info is not available when running on UML, so prevent that test and do the default action. Prevents this build error on UML + i386: ../drivers/net/hamradio/baycom_epp.c: In function ‘epp_bh’: ../drivers/net/hamradio/baycom_epp.c:630:6: error: implicit declaration of function ‘boot_cpu_has’; did you mean ‘get_cpu_mask’? [-Werror=implicit-function-declaration] if (boot_cpu_has(X86_FEATURE_TSC)) \ ^ ../drivers/net/hamradio/baycom_epp.c:658:2: note: in expansion of macro ‘GETTICK’ GETTICK(time1); Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap Cc: linux-um@lists.infradead.org Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Thomas Sailer Cc: linux-hams@vger.kernel.org Signed-off-by: David S. Miller commit c2bbf9d1e9ac7d4fdd503b190bc1ba8a6302bc49 Author: Hamza Mahfooz Date: Tue Oct 12 01:54:03 2021 -0400 dma-debug: teach add_dma_entry() about DMA_ATTR_SKIP_CPU_SYNC Mapping something twice should be possible as long as, DMA_ATTR_SKIP_CPU_SYNC is passed to the strictly speaking second relevant mapping operation (that attempts to map the same thing). So, don't issue a warning if the specified condition is met in add_dma_entry(). Signed-off-by: Hamza Mahfooz Signed-off-by: Christoph Hellwig commit 519d81956ee277b4419c723adfb154603c2565ba Author: Linus Torvalds Date: Sun Oct 17 20:00:13 2021 -1000 Linux 5.15-rc6 commit cd079b1f870729a9fe3294f800dff18b548f129d Merge: f2b3420b921d1 776c750108038 Author: Linus Torvalds Date: Sun Oct 17 19:39:22 2021 -1000 Merge tag 'libata-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull libata fixes from Damien Le Moal: "Two fixes for this cycle: - Fix a null pointer dereference in ahci-platform driver (from Hai) - Fix uninitialized variables in pata_legacy driver (from Dan)" * tag 'libata-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() pata_legacy: fix a couple uninitialized variable bugs commit f2b3420b921d142b4c55f7445385bdab4060d754 Merge: cc0af0a95172d d29bd41428cff Author: Linus Torvalds Date: Sun Oct 17 19:25:20 2021 -1000 Merge tag 'block-5.15-2021-10-17' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Bigger than usual for this point in time, the majority is fixing some issues around BDI lifetimes with the move from the request_queue to the disk in this release. In detail: - Series on draining fs IO for del_gendisk() (Christoph) - NVMe pull request via Christoph: - fix the abort command id (Keith Busch) - nvme: fix per-namespace chardev deletion (Adam Manzanares) - brd locking scope fix (Tetsuo) - BFQ fix (Paolo)" * tag 'block-5.15-2021-10-17' of git://git.kernel.dk/linux-block: block, bfq: reset last_bfqq_created on group change block: warn when putting the final reference on a registered disk brd: reduce the brd_devices_mutex scope kyber: avoid q->disk dereferences in trace points block: keep q_usage_counter in atomic mode after del_gendisk block: drain file system I/O on del_gendisk block: split bio_queue_enter from blk_queue_enter block: factor out a blk_try_enter_queue helper block: call submit_bio_checks under q_usage_counter nvme: fix per-namespace chardev deletion block/rnbd-clt-sysfs: fix a couple uninitialized variable bugs nvme-pci: Fix abort command id commit cc0af0a95172db52db2ab41b1e8a9c9ac0930b63 Merge: 3bb50f8530c9c 14cfbb7a7856f Author: Linus Torvalds Date: Sun Oct 17 19:20:13 2021 -1000 Merge tag 'io_uring-5.15-2021-10-17' of git://git.kernel.dk/linux-block Pull io_uring fix from Jens Axboe: "Just a single fix for a wrong condition for grabbing a lock, a regression in this merge window" * tag 'io_uring-5.15-2021-10-17' of git://git.kernel.dk/linux-block: io_uring: fix wrong condition to grab uring lock commit 3bb50f8530c9cb5ec69c0744b7fd32d0ca404254 Merge: be9eb2f00fa72 bcef9356fc2e1 Author: Linus Torvalds Date: Sun Oct 17 18:17:19 2021 -1000 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Fixes up some issues in rc5" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost-vdpa: Fix the wrong input in config_cb VDUSE: fix documentation underline warning Revert "virtio-blk: Add validation for block size in config space" vhost_vdpa: unset vq irq before freeing irq virtio: write back F_VERSION_1 before validate commit be9eb2f00fa7245116d49f76614054cce8e07af8 Merge: 6890acacdee09 cdeb5d7d890e1 Author: Linus Torvalds Date: Sun Oct 17 18:01:32 2021 -1000 Merge tag 'powerpc-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a bug where guests on P9 with interrupts passed through could get stuck in synchronize_irq(). - Fix a bug in KVM on P8 where secondary threads entering a guest would write outside their allocated stack. - Fix a bug in KVM on P8 where secondary threads could confuse the host offline code and cause the guest or host to crash. Thanks to Cédric Le Goater. * tag 'powerpc-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() powerpc/xive: Discard disabled interrupts in get_irqchip_state() commit 6890acacdee09d7cb7c988175c895ccb4f1bb340 Merge: f644750ccc02f 86e1e054e0d21 Author: Linus Torvalds Date: Sun Oct 17 17:41:39 2021 -1000 Merge tag 'objtool_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Borislav Petkov: - Update section headers before the respective relocations to not trigger a safety check in elftoolchain's implementation of libelf - Do not add garbage data to the .rela.orc_unwind_ip section * tag 'objtool_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Update section header before relocations objtool: Check for gelf_update_rel[a] failures commit f644750ccc02f5d513abf314a16bec5f70d13c40 Merge: 60ebc28b073bf d9b7748ffc452 Author: Linus Torvalds Date: Sun Oct 17 17:36:39 2021 -1000 Merge tag 'edac_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Log the "correct" uncorrectable error count in the armada_xp driver * tag 'edac_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/armada-xp: Fix output of uncorrectable error counter commit 60ebc28b073bf8a146d37b9d6b03a409714a0a47 Merge: 424e7d878cb7a 71920ea97d6d1 Author: Linus Torvalds Date: Sun Oct 17 17:34:18 2021 -1000 Merge tag 'perf_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Add Sapphire Rapids to the list of CPUs supporting the SMI count MSR * tag 'perf_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/msr: Add Sapphire Rapids CPU support commit 424e7d878cb7a51f446514826a0b9ddbc78ff1d0 Merge: 89f6602d4b952 38fa3206bf441 Author: Linus Torvalds Date: Sun Oct 17 17:30:49 2021 -1000 Merge tag 'efi-urgent-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Borislav Petkov: "Forwarded from Ard Biesheuvel through the tip tree. Ard will send stuff directly in the near future. Low priority fixes but fixes nonetheless: - update stub diagnostic print that is no longer accurate - avoid statically allocated buffer for CPER error record decoding - avoid sleeping on the efi_runtime semaphore when calling the ResetSystem EFI runtime service" * tag 'efi-urgent-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() efi/cper: use stack buffer for error record decoding efi/libstub: Simplify "Exiting bootservices" message commit 89f6602d4b952470e068638a90bc16dd75b22ee7 Merge: cf52ad5ff16c3 b2381acd3fd9b Author: Linus Torvalds Date: Sun Oct 17 17:27:22 2021 -1000 Merge tag 'x86_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Do not enable AMD memory encryption in Kconfig by default due to shortcomings of some platforms, leading to boot failures. - Mask out invalid bits in the MXCSR for 32-bit kernels again because Thomas and I don't know how to mask out bits properly. Third time's the charm. * tag 'x86_urgent_for_v5.15_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Mask out the invalid MXCSR bits properly x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically commit cf52ad5ff16c38a62a6536b5e7612b56794f5a5e Merge: e3572dff12798 81967efb5f396 Author: Linus Torvalds Date: Sun Oct 17 17:17:28 2021 -1000 Merge tag 'driver-core-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some small driver core fixes for 5.15-rc6, all of which have been in linux-next for a while with no reported issues. They include: - kernfs negative dentry bugfix - simple pm bus fixes to resolve reported issues" * tag 'driver-core-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: drivers: bus: Delete CONFIG_SIMPLE_PM_BUS drivers: bus: simple-pm-bus: Add support for probing simple bus only devices driver core: Reject pointless SYNC_STATE_ONLY device links kernfs: don't create a negative dentry if inactive node exists commit e3572dff127986cbf7ac01147720b4aa3e81878a Merge: a563ae0ff6dc1 f42752729e206 Author: Linus Torvalds Date: Sun Oct 17 17:14:00 2021 -1000 Merge tag 'char-misc-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for 5.15-rc6 for reported issues that include: - habanalabs driver fixes - mei driver fixes and new ids - fpga new device ids - MAINTAINER file updates for fpga subsystem - spi module id table additions and fixes - fastrpc locking fixes - nvmem driver fix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: eeprom: 93xx46: fix MODULE_DEVICE_TABLE nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells mei: hbm: drop hbm responses on early shutdown mei: me: add Ice Lake-N device id. eeprom: 93xx46: Add SPI device ID table eeprom: at25: Add SPI ID table misc: HI6421V600_IRQ should depend on HAS_IOMEM misc: fastrpc: Add missing lock before accessing find_vma() cb710: avoid NULL pointer subtraction misc: gehc: Add SPI ID table MAINTAINERS: Drop outdated FPGA Manager website MAINTAINERS: Add Hao and Yilun as maintainers habanalabs: fix resetting args in wait for CS IOCTL fpga: ice40-spi: Add SPI device ID table commit a563ae0ff6dc1b810f08e52dff3ad16affed3d24 Merge: b9e42b3cf237d 37f12202c5d28 Author: Linus Torvalds Date: Sun Oct 17 17:10:00 2021 -1000 Merge tag 'staging-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO driver fixes from Greg KH: "Here are a number of small IIO and staging driver fixes for 5.15-rc6. They include: - vc04_services bugfix for reported problem - r8188eu array underflow fix - iio driver fixes for a lot of tiny reported issues. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: r8188eu: prevent array underflow in rtw_hal_update_ra_mask() staging: vc04_services: shut up out-of-range warning iio: light: opt3001: Fixed timeout error when 0 lux iio: adis16480: fix devices that do not support sleep mode iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED iio: adis16475: fix deadlock on frequency set iio: ssp_sensors: add more range checking in ssp_parse_dataframe() iio: ssp_sensors: fix error code in ssp_print_mcu_debug() iio: adc: ad7793: Fix IRQ flag iio: adc: ad7780: Fix IRQ flag iio: adc: ad7192: Add IRQ flag iio: adc: aspeed: set driver data when adc probe. iio: adc: rzg2l_adc: add missing clk_disable_unprepare() in rzg2l_adc_pm_runtime_resume() iio: adc: max1027: Fix the number of max1X31 channels iio: adc: max1027: Fix wrong shift with 12-bit devices iio: adc128s052: Fix the error handling path of 'adc128_probe()' iio: adc: rzg2l_adc: Fix -EBUSY timeout error return iio: accel: fxls8962af: return IRQ_HANDLED when fifo is flushed iio: dac: ti-dac5571: fix an error code in probe() commit b9e42b3cf237d8a5d093d5d451d6ea75f95743d0 Merge: ebf613ae87baf cb2282213e84f Author: Linus Torvalds Date: Sun Oct 17 17:06:31 2021 -1000 Merge tag 'tty-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fix from Greg KH: "Here is a single 8250 Kconfig fix for 5.15-rc6 that resolves a regression that showed up in 5.15-rc1. It has been in linux-next for a while with no reported issues" * tag 'tty-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250: allow disabling of Freescale 16550 compile test commit ebf613ae87baff7804966d3f251d09ec7c3ad17f Merge: 12dbbfadd8f4e cd932c2a1ecc8 Author: Linus Torvalds Date: Sun Oct 17 17:02:00 2021 -1000 Merge tag 'usb-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes that resolve a number of tiny issues. They include: - new USB serial driver ids - xhci driver fixes for a bunch of issues - musb error path fixes. All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: musb: dsps: Fix the probe error path xhci: Enable trust tx length quirk for Fresco FL11 USB controller xhci: Fix command ring pointer corruption while aborting a command USB: xhci: dbc: fix tty registration race xhci: add quirk for host controllers that don't update endpoint DCS xhci: guard accesses to ep_state in xhci_endpoint_reset() USB: serial: qcserial: add EM9191 QDL support USB: serial: option: add Quectel EC200S-CN module support USB: serial: option: add prod. id for Quectel EG91 USB: serial: option: add Telit LE910Cx composition 0x1204 commit 12dbbfadd8f4e54607463414b06f9416a5c6d981 Merge: d999ade1cc86c a02dcde595f7c Author: Linus Torvalds Date: Sun Oct 17 16:57:06 2021 -1000 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a new product ID for the xpad joystick driver - fixes to resistive-adc-touch and snvs_pwrkey drivers - a change to touchscreen helpers to make clang happier * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: touchscreen - avoid bitwise vs logical OR warning Input: xpad - add support for another USB ID of Nacon GC-100 Input: resistive-adc-touch - fix division by zero error on z1 == 0 Input: snvs_pwrkey - add clk handling commit d9aaaf223297f6146d9d7f36caca927c92ab855a Author: Davidlohr Bueso Date: Sun Oct 10 11:24:39 2021 -0700 netfilter: ebtables: allocate chainstack on CPU local nodes Keep the per-CPU memory allocated for chainstacks local. Signed-off-by: Davidlohr Bueso Signed-off-by: Pablo Neira Ayuso commit 553715feaa9e0453bc59f6ba20e1c69346888bd5 Author: Stephane Grosjean Date: Wed Sep 29 16:21:11 2021 +0200 can: peak_usb: pcan_usb_fd_decode_status(): remove unnecessary test on the nullity of a pointer Since alloc_can_err_skb() puts NULL in cf in the case when skb cannot be allocated and can_change_state() handles the case when cf is NULL, the test on the nullity of skb is now unnecessary. Link: https://lore.kernel.org/all/20210929142111.55757-2-s.grosjean@peak-system.com Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde commit 3d031abc7e7249573148871180c28ecedb5e27df Author: Stephane Grosjean Date: Wed Sep 29 16:21:10 2021 +0200 can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification This corrects the lack of notification of a return to ERROR_ACTIVE state for USB - CANFD devices from PEAK-System. Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") Link: https://lore.kernel.org/all/20210929142111.55757-1-s.grosjean@peak-system.com Cc: stable@vger.kernel.org Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde commit 949fe9b35570361bc6ee2652f89a0561b26eec98 Author: Zheyu Ma Date: Thu Oct 14 06:28:33 2021 +0000 can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF. Fix this by releasing 'dev' later. The following log reveals it: [ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513 ] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ] print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0 [ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ] pci_device_remove+0xa9/0x250 Fixes: e6d9c80b7ca1 ("can: peak_pci: add support of some new PEAK-System PCI cards") Link: https://lore.kernel.org/all/1634192913-15639-1-git-send-email-zheyuma97@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Zheyu Ma Signed-off-by: Marc Kleine-Budde commit 99d173fbe8944861a00ebd1c73817a1260d21e60 Author: Aswath Govindraju Date: Mon Sep 20 18:03:43 2021 +0530 can: m_can: fix iomap_read_fifo() and iomap_write_fifo() The read and writes from the fifo are from a buffer, with various fields and data at predefined offsets. So, they should not be done to the same address(or port) in case of val_count greater than 1. Therefore, fix this by using iowrite32()/ioread32() instead of ioread32_rep()/iowrite32_rep(). Also, the write into FIFO must be performed with an offset from the message ram base address. Therefore, fix the base address to mram_base. Fixes: e39381770ec9 ("can: m_can: Disable IRQs on FIFO bus errors") Link: https://lore.kernel.org/all/20210920123344.2320-1-a-govindraju@ti.com Signed-off-by: Aswath Govindraju Signed-off-by: Marc Kleine-Budde commit f7c05c3987dcfde9a4e8c2d533db013fabebca0d Author: Yoshihiro Shimoda Date: Fri Sep 24 16:55:56 2021 +0900 can: rcar_can: fix suspend/resume If the driver was not opened, rcar_can_suspend() should not call clk_disable() because the clock was not enabled. Fixes: fd1159318e55 ("can: add Renesas R-Car CAN driver") Link: https://lore.kernel.org/all/20210924075556.223685-1-yoshihiro.shimoda.uh@renesas.com Cc: stable@vger.kernel.org Signed-off-by: Yoshihiro Shimoda Tested-by: Ayumi Nakamichi Reviewed-by: Ulrich Hecht Tested-by: Biju Das Signed-off-by: Marc Kleine-Budde commit 5370b0f49078203acf3c064b634a09707167a864 Author: Tejun Heo Date: Thu Oct 14 13:20:22 2021 -1000 blk-cgroup: blk_cgroup_bio_start() should use irq-safe operations on blkg->iostat_cpu c3df5fb57fe8 ("cgroup: rstat: fix A-A deadlock on 32bit around u64_stats_sync") made u64_stats updates irq-safe to avoid A-A deadlocks. Unfortunately, the conversion missed one in blk_cgroup_bio_start(). Fix it. Fixes: 2d146aa3aa84 ("mm: memcontrol: switch to rstat") Cc: stable@vger.kernel.org # v5.13+ Reported-by: syzbot+9738c8815b375ce482a1@syzkaller.appspotmail.com Signed-off-by: Tejun Heo Link: https://lore.kernel.org/r/YWi7NrQdVlxD6J9W@slm.duckdns.org Signed-off-by: Jens Axboe commit d29bd41428cfff9b582c248db14a47e2be8457a8 Author: Paolo Valente Date: Fri Oct 15 16:43:36 2021 +0200 block, bfq: reset last_bfqq_created on group change Since commit 430a67f9d616 ("block, bfq: merge bursts of newly-created queues"), BFQ maintains a per-group pointer to the last bfq_queue created. If such a queue, say bfqq, happens to move to a different group, then bfqq is no more a valid last bfq_queue created for its previous group. That pointer must then be cleared. Not resetting such a pointer may also cause UAF, if bfqq happens to also be freed after being moved to a different group. This commit performs this missing reset. As such it fixes commit 430a67f9d616 ("block, bfq: merge bursts of newly-created queues"). Such a missing reset is most likely the cause of the crash reported in [1]. With some analysis, we found that this crash was due to the above UAF. And such UAF did go away with this commit applied [1]. Anyway, before this commit, that crash happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq: honor already-setup queue merges""). Yet commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") contains no error related with the above UAF, and can then be restored. [1] https://bugzilla.kernel.org/show_bug.cgi?id=214503 Fixes: 430a67f9d616 ("block, bfq: merge bursts of newly-created queues") Tested-by: Grzegorz Kowal Signed-off-by: Paolo Valente Link: https://lore.kernel.org/r/20211015144336.45894-2-paolo.valente@linaro.org Signed-off-by: Jens Axboe commit a20417611b98e12a724e5c828c472ea16990b71f Author: Christoph Hellwig Date: Thu Oct 14 15:02:31 2021 +0200 block: warn when putting the final reference on a registered disk Warn when the last reference on a live disk is put without calling del_gendisk first. There are some BDI related bug reports that look like a case of this, so make sure we have the proper instrumentation to catch it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211014130231.1468538-1-hch@lst.de Signed-off-by: Jens Axboe commit f7bf35862477d6d4f8a9746c645a4380de984700 Author: Tetsuo Handa Date: Tue Sep 7 19:18:00 2021 +0900 brd: reduce the brd_devices_mutex scope As with commit 8b52d8be86d72308 ("loop: reorder loop_exit"), unregister_blkdev() needs to be called first in order to avoid calling brd_alloc() from brd_probe() after brd_del_one() from brd_exit(). Then, we can avoid holding global mutex during add_disk()/del_gendisk() as with commit 1c500ad706383f1a ("loop: reduce the loop_ctl_mutex scope"). Signed-off-by: Tetsuo Handa Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/e205f13d-18ff-a49c-0988-7de6ea5ff823@i-love.sakura.ne.jp Signed-off-by: Jens Axboe commit 43a08c3bdac4cb42eff8fe5e2278bffe0c5c3daa Author: Ziyang Xuan Date: Sat Oct 9 15:40:30 2021 +0800 can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg() When isotp_sendmsg() concurrent, tx.state of all TX processes can be ISOTP_IDLE. The conditions so->tx.state != ISOTP_IDLE and wq_has_sleeper(&so->wait) can not protect TX buffer from being accessed by multiple TX processes. We can use cmpxchg() to try to modify tx.state to ISOTP_SENDING firstly. If the modification of the previous process succeed, the later process must wait tx.state to ISOTP_IDLE firstly. Thus, we can ensure TX buffer is accessed by only one process at the same time. And we should also restore the original tx.state at the subsequent error processes. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/c2517874fbdf4188585cf9ddf67a8fa74d5dbde5.1633764159.git.william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Ziyang Xuan Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit 9acf636215a6ce9362fe618e7da4913b8bfe84c8 Author: Ziyang Xuan Date: Sat Oct 9 15:40:18 2021 +0800 can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() Using wait_event_interruptible() to wait for complete transmission, but do not check the result of wait_event_interruptible() which can be interrupted. It will result in TX buffer has multiple accessors and the later process interferes with the previous process. Following is one of the problems reported by syzbot. ============================================================= WARNING: CPU: 0 PID: 0 at net/can/isotp.c:840 isotp_tx_timer_handler+0x2e0/0x4c0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc7+ #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:isotp_tx_timer_handler+0x2e0/0x4c0 Call Trace: ? isotp_setsockopt+0x390/0x390 __hrtimer_run_queues+0xb8/0x610 hrtimer_run_softirq+0x91/0xd0 ? rcu_read_lock_sched_held+0x4d/0x80 __do_softirq+0xe8/0x553 irq_exit_rcu+0xf8/0x100 sysvec_apic_timer_interrupt+0x9e/0xc0 asm_sysvec_apic_timer_interrupt+0x12/0x20 Add result check for wait_event_interruptible() in isotp_sendmsg() to avoid multiple accessers for tx buffer. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/10ca695732c9dd267c76a3c30f37aefe1ff7e32f.1633764159.git.william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Reported-by: syzbot+78bab6958a614b0c80b9@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde commit a4fbe70c5cb746441d56b28cf88161d9e0e25378 Author: Zhang Changzhong Date: Thu Oct 14 17:26:40 2021 +0800 can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes The receiver should abort TP if 'total message size' in TP.CM_RTS and TP.CM_BAM is less than 9 or greater than 1785 [1], but currently the j1939 stack only checks the upper bound and the receiver will accept the following broadcast message: vcan1 18ECFF00 [8] 20 08 00 02 FF 00 23 01 vcan1 18EBFF00 [8] 01 00 00 00 00 00 00 00 vcan1 18EBFF00 [8] 02 00 FF FF FF FF FF FF This patch adds check for the lower bound and abort illegal TP. [1] SAE-J1939-82 A.3.4 Row 2 and A.3.6 Row 6. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/all/1634203601-3460-1-git-send-email-zhangchangzhong@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Zhang Changzhong Acked-by: Oleksij Rempel Signed-off-by: Marc Kleine-Budde commit 379743985ab6cfe2cbd32067cf4ed497baca6d06 Author: Zhang Changzhong Date: Thu Sep 30 11:33:20 2021 +0800 can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length According to SAE-J1939-21, the data length of TP.DT must be 8 bytes, so cancel session when receive unexpected TP.DT message. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/all/1632972800-45091-1-git-send-email-zhangchangzhong@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Zhang Changzhong Acked-by: Oleksij Rempel Signed-off-by: Marc Kleine-Budde commit d9d52a3ebd284882f5562c88e55991add5d01586 Author: Ziyang Xuan Date: Sun Sep 26 18:47:57 2021 +0800 can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...) j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN("addition on 0;...") ==================================================== refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to protect. Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan Acked-by: Oleksij Rempel Signed-off-by: Marc Kleine-Budde commit b504a884f6b5a77dac7d580ffa08e482f70d1a30 Author: Ziyang Xuan Date: Mon Sep 6 17:42:19 2021 +0800 can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer When the session state is J1939_SESSION_DONE, j1939_tp_rxtimer() will give an alert "rx timeout, send abort", but do nothing actually. Move the alert into session active judgment condition, it is more reasonable. One of the scenarios is that j1939_tp_rxtimer() execute followed by j1939_xtp_rx_abort_one(). After j1939_xtp_rx_abort_one(), the session state is J1939_SESSION_DONE, then j1939_tp_rxtimer() give an alert. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/all/20210906094219.95924-1-william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Ziyang Xuan Acked-by: Oleksij Rempel Signed-off-by: Marc Kleine-Budde commit 85374b6392293d103c2b3406ceb9a1253f81d328 Author: Miles Chen Date: Fri Oct 15 15:46:54 2021 +0800 scsi: sd: Fix crashes in sd_resume_runtime() After commit ed4246d37f3b ("scsi: sd: REQUEST SENSE for BLIST_IGN_MEDIA_CHANGE devices in runtime_resume()"), the following crash was observed. static int sd_resume_runtime(struct device *dev) { struct scsi_disk *sdkp = dev_get_drvdata(dev); struct scsi_device *sdp = sdkp->device; // sdkp == NULL and crash if (sdp->ignore_media_change) { ... } It is possible for sdkp to be NULL in sd_resume_runtime(). To fix this crash, follow sd_resume() to test if sdkp is NULL before dereferencing it. Crash: [ 4.695171][ T151] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [ 4.696591][ T151] Mem abort info: [ 4.697919][ T151] ESR = 0x96000005 [ 4.699692][ T151] EC = 0x25: DABT (current EL), IL = 32 bits [ 4.701990][ T151] SET = 0, FnV = 0 [ 4.702513][ T151] EA = 0, S1PTW = 0 [ 4.704431][ T151] FSC = 0x05: level 1 translation fault [ 4.705254][ T151] Data abort info: [ 4.705806][ T151] ISV = 0, ISS = 0x00000005 [ 4.706484][ T151] CM = 0, WnR = 0 [ 4.707048][ T151] [0000000000000008] user address but active_mm is swapper [ 4.710577][ T151] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 4.832361][ T151] Kernel Offset: 0x12acc80000 from 0xffffffc010000000 [ 4.833254][ T151] PHYS_OFFSET: 0x40000000 [ 4.833814][ T151] pstate: 80400005 (Nzcv daif +PAN -UAO) [ 4.834546][ T151] pc : sd_resume_runtime+0x20/0x14c [ 4.835227][ T151] lr : scsi_runtime_resume+0x84/0xe4 [ 4.835916][ T151] sp : ffffffc0110db8d0 [ 4.836450][ T151] x29: ffffffc0110db8d0 x28: 0000000000000001 [ 4.837258][ T151] x27: ffffff80c0bd1ac0 x26: ffffff80c0bd1ad0 [ 4.838063][ T151] x25: ffffff80cea7e448 x24: ffffffd2bf961000 [ 4.838867][ T151] x23: ffffffd2be69f838 x22: ffffffd2bd9dfb4c [ 4.839670][ T151] x21: 0000000000000000 x20: ffffff80cea7e000 [ 4.840474][ T151] x19: ffffff80cea7e260 x18: ffffffc0110dd078 [ 4.841277][ T151] x17: 00000000658783d9 x16: 0000000051469dac [ 4.842081][ T151] x15: 00000000b87f6327 x14: 0000000068fd680d [ 4.842885][ T151] x13: ffffff80c0bd2470 x12: ffffffd2bfa7f5f0 [ 4.843688][ T151] x11: 0000000000000078 x10: 0000000000000001 [ 4.844492][ T151] x9 : 00000000000000b1 x8 : ffffffd2be69f88c [ 4.845295][ T151] x7 : ffffffd2bd9e0e5c x6 : 0000000000000000 [ 4.846099][ T151] x5 : 0000000000000080 x4 : 0000000000000001 [ 4.846902][ T151] x3 : 68fd680dfe4ebe5e x2 : 0000000000000003 [ 4.847706][ T151] x1 : ffffffd2bf7f9380 x0 : ffffff80cea7e260 [ 4.856708][ T151] die+0x16c/0x59c [ 4.857191][ T151] __do_kernel_fault+0x1e8/0x210 [ 4.857833][ T151] do_page_fault+0xa4/0x654 [ 4.858418][ T151] do_translation_fault+0x6c/0x1b0 [ 4.859083][ T151] do_mem_abort+0x68/0x10c [ 4.859655][ T151] el1_abort+0x40/0x64 [ 4.860182][ T151] el1h_64_sync_handler+0x54/0x88 [ 4.860834][ T151] el1h_64_sync+0x7c/0x80 [ 4.861395][ T151] sd_resume_runtime+0x20/0x14c [ 4.862025][ T151] scsi_runtime_resume+0x84/0xe4 [ 4.862667][ T151] __rpm_callback+0x1f4/0x8cc [ 4.863275][ T151] rpm_resume+0x7e8/0xaa4 [ 4.863836][ T151] __pm_runtime_resume+0xa0/0x110 [ 4.864489][ T151] sd_probe+0x30/0x428 [ 4.865016][ T151] really_probe+0x14c/0x500 [ 4.865602][ T151] __driver_probe_device+0xb4/0x18c [ 4.866278][ T151] driver_probe_device+0x60/0x2c4 [ 4.866931][ T151] __device_attach_driver+0x228/0x2bc [ 4.867630][ T151] __device_attach_async_helper+0x154/0x21c [ 4.868398][ T151] async_run_entry_fn+0x5c/0x1c4 [ 4.869038][ T151] process_one_work+0x3ac/0x590 [ 4.869670][ T151] worker_thread+0x320/0x758 [ 4.870265][ T151] kthread+0x2e8/0x35c [ 4.870792][ T151] ret_from_fork+0x10/0x20 Link: https://lore.kernel.org/r/20211015074654.19615-1-miles.chen@mediatek.com Fixes: ed4246d37f3b ("scsi: sd: REQUEST SENSE for BLIST_IGN_MEDIA_CHANGE devices in runtime_resume()") Cc: Stanley Chu Reviewed-by: Martin Kepplinger Reviewed-by: Stanley Chu Signed-off-by: Miles Chen Signed-off-by: Martin K. Petersen commit 97e6ea6d78064e7f1e9e19c45dc690aabbb71297 Author: Sreekanth Reddy Date: Thu Oct 14 11:24:25 2021 +0530 scsi: mpi3mr: Fix duplicate device entries when scanning through sysfs When scanning devices through the 'scan' attribute in sysfs, the user will observe duplicate device entries in lsscsi command output. Set the shost's max_channel to zero to avoid this. Link: https://lore.kernel.org/r/20211014055425.30719-1-sreekanth.reddy@broadcom.com Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 4e5a04be88fe335ad5331f4f8c17f4ebd357e065 Author: Sachi King Date: Sat Oct 9 14:32:40 2021 +1100 pinctrl: amd: disable and mask interrupts on probe Some systems such as the Microsoft Surface Laptop 4 leave interrupts enabled and configured for use in sleep states on boot, which cause unexpected behaviour such as spurious wakes and failed resumes in s2idle states. As interrupts should not be enabled until they are claimed and explicitly enabled, disabling any interrupts mistakenly left enabled by firmware should be safe. Signed-off-by: Sachi King Link: https://lore.kernel.org/r/20211009033240.21543-1-nakato@nakato.io Signed-off-by: Linus Walleij commit d999ade1cc86cd2951d41c11ea769cb4452c8811 Merge: ccfb5ceb40072 3ff6d64e68abc Author: Linus Torvalds Date: Sat Oct 16 11:11:07 2021 -0700 Merge tag 'perf-tools-fixes-for-v5.15-2021-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix 'perf test evsel' build error on !x86 architectures - Fix libperf's test_stat_cpu mixup of CPU numbers and CPU indexes - Output offsets for decompressed records, not just useless zeros * tag 'perf-tools-fixes-for-v5.15-2021-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: libperf tests: Fix test_stat_cpu libperf test evsel: Fix build error on !x86 architectures perf report: Output non-zero offset for decompressed records commit ccfb5ceb400720969d6118c740c2fc37bcf990b8 Merge: 368a978cc52ad 6e44bd6d34d65 Author: Linus Torvalds Date: Sat Oct 16 10:57:13 2021 -0700 Merge tag 'fixes-2021-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "Fix handling of NOMAP regions with kmemleak. NOMAP regions don't have linear map entries so an attempt to scan these areas in kmemleak would fault. Prevent such faults by excluding NOMAP regions from kmemleak" * tag 'fixes-2021-10-16' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: exclude NOMAP regions from kmemleak commit 368a978cc52ad14f90bd04a7d94ec0070da3e1c1 Merge: 6985c40ab6c5d be358af1191b1 Author: Linus Torvalds Date: Sat Oct 16 10:51:41 2021 -0700 Merge tag 'trace-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Tracing fixes for 5.15: - Fix defined but not use warning/error for osnoise function - Fix memory leak in event probe - Fix memblock leak in bootconfig - Fix the API of event probes to be like kprobes - Added test to check removal of event probe API - Fix recordmcount.pl for nds32 failed build * tag 'trace-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^' selftests/ftrace: Update test for more eprobe removal process tracing: Fix event probe removal from dynamic events tracing: Fix missing * in comment block bootconfig: init: Fix memblock leak in xbc_make_cmdline() tracing: Fix memory leak in eprobe_register() tracing: Fix missing osnoise tracer on max_latency commit 6985c40ab6c5d63a494ce9adce9a4768364f2507 Merge: dcd619847ca7b 92c02ff1a43ed Author: Linus Torvalds Date: Sat Oct 16 10:22:08 2021 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver fixes from Stephen Boyd: "Clk driver fixes for critical issues found in the past few weeks: - Select gdsc config so qcom sm6350 driver probes - Fix a register offset in qcom gcc-sm6115 so the correct clk is controlled - Fix inverted logic in Renesas RZ/G2L .is_enabled() - Mark some more clks critical in Renesas clk driver - Remove a duplicate clk in the agilex driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: add select QCOM_GDSC for SM6350 clk: qcom: gcc-sm6115: Fix offset for hlos1_vote_turing_mmu_tbu0_gdsc clk: socfpga: agilex: fix duplicate s2f_user0_clk clk: renesas: rzg2l: Fix clk status function clk: renesas: r9a07g044: Mark IA55_CLK and DMAC_ACLK critical commit dcd619847ca7b1f3123ba35976225ee77b83f959 Merge: 304040fb4909f d208b89401e07 Author: Linus Torvalds Date: Sat Oct 16 10:12:21 2021 -0700 Merge tag 'for-5.15/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM verity target to skip redundant processing on I/O errors. - Fix request-based DM so that it doesn't queue request to blk-mq when DM device is suspended. - Fix DM core mempool NULL pointer race when completing IO. - Make DM clone target's 'descs' array static. * tag 'for-5.15/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: fix mempool NULL pointer race when completing IO dm rq: don't queue request to blk-mq during DM suspend dm clone: make array 'descs' static dm verity: skip redundant verity_handle_err() on I/O errors commit 304040fb4909f7771caf6f8e8c61dbe51c93505a Merge: c13f946bf1ef0 8b7216439e2e2 Author: Linus Torvalds Date: Sat Oct 16 09:14:55 2021 -0700 Merge tag 's390-5.15-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Maintainers and reviewers changes: * Cornelia decided to free up her time and step down from vfio-ccw maintainer and s390 kvm reviewer duties * Add Alexander Gordeev as s390 arch code reviewer - Fix broken strrchr implementation * tag 's390-5.15-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: add Alexander Gordeev as reviewer s390: fix strrchr() implementation vfio-ccw: step down as maintainer KVM: s390: remove myself as reviewer commit c13f946bf1ef0eef49748b1824a0bdfb3487fe8c Merge: 5fd01b7263999 e21e52ad1e012 Author: Linus Torvalds Date: Sat Oct 16 09:12:18 2021 -0700 Merge tag 'csky-for-linus-5.15-rc6' of git://github.com/c-sky/csky-linux Pull csky fixes from Guo Ren: "Only 5 fixups: - Make HAVE_TCM depend on !COMPILE_TEST - bitops: Remove duplicate __clear_bit define - Select ARCH_WANT_FRAME_POINTERS only if compiler supports it - Fixup regs.sr broken in ptrace - don't let sigreturn play with priveleged bits of status register" * tag 'csky-for-linus-5.15-rc6' of git://github.com/c-sky/csky-linux: csky: Make HAVE_TCM depend on !COMPILE_TEST csky: bitops: Remove duplicate __clear_bit define csky: Select ARCH_WANT_FRAME_POINTERS only if compiler supports it csky: Fixup regs.sr broken in ptrace csky: don't let sigreturn play with priveleged bits of status register commit 5fd01b7263999c09f0596f5efd726b681474283c Merge: f04298169d9c5 c3ca31ce0ea1e Author: Linus Torvalds Date: Sat Oct 16 09:09:27 2021 -0700 Merge tag 'arc-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fix from Vineet Gupta: "Small fixlet for ARC" * tag 'arc-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: fix potential build snafu commit f04298169d9c522d611a2ce8c54489990c38e72f Merge: 5a7ee55b1fcd2 011ace4a7fadc Author: Linus Torvalds Date: Sat Oct 16 09:05:58 2021 -0700 Merge tag 'arm-soc-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "A small number fixes this time, mostly touching actual code: - Add platform device for i.MX System Reset Controller (SRC) to fix a regression caused by fw_devlink change - A fixup for a boot regression caused by my own rework for the Qualcomm SCM driver - Multiple bugfixes for the Arm FFA and optee firmware drivers, addressing problems when they are built as a loadable module - Four dts bugfixes for the Broadcom SoC used in Raspberry pi, addressing VEC (video encoder), MDIO bus controller #address-cells/#size-cells, SDIO voltage and PCIe host bridge dtc warnings" * tag 'arm-soc-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: imx: register reset controller from a platform driver iommu/arm: fix ARM_SMMU_QCOM compilation ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting tee: optee: Fix missing devices unregister during optee_remove ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states ARM: dts: bcm2711: fix MDIO #address- and #size-cells ARM: dts: bcm283x: Fix VEC address for BCM2711 firmware: arm_ffa: Fix __ffa_devices_unregister firmware: arm_ffa: Add missing remove callback to ffa_bus_type commit 5a7ee55b1fcd23ebdb740fde9f4d795fff1b7443 Merge: 711c3686676ee 2b94b6b79b7c2 Author: Linus Torvalds Date: Sat Oct 16 09:00:46 2021 -0700 Merge tag 'pci-v5.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci fix from Bjorn Helgaas: - Don't save msi_populate_sysfs() error code as dev->msi_irq_groups so we don't dereference the error code as a pointer (Wang Hai) * tag 'pci-v5.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI/MSI: Handle msi_populate_sysfs() errors correctly commit 711c3686676eed0f88d494a187261e6a96c932b1 Merge: 8fe31e0995f04 1ea1dbf1f54c3 Author: Linus Torvalds Date: Sat Oct 16 08:45:46 2021 -0700 Merge tag 'acpi-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Add a missing device ID to a quirk list in the suspend-to-idle support code" * tag 'acpi-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: Include alternate AMDI0005 id in special behaviour commit fac3cb82a54a4b7c49c932f96ef196cf5774344c Author: Nikolay Aleksandrov Date: Fri Oct 15 12:05:46 2021 +0300 net: bridge: mcast: use multicast_membership_interval for IGMPv3 When I added IGMPv3 support I decided to follow the RFC for computing the GMI dynamically: " 8.4. Group Membership Interval The Group Membership Interval is the amount of time that must pass before a multicast router decides there are no more members of a group or a particular source on a network. This value MUST be ((the Robustness Variable) times (the Query Interval)) plus (one Query Response Interval)." But that actually is inconsistent with how the bridge used to compute it for IGMPv2, where it was user-configurable that has a correct default value but it is up to user-space to maintain it. This would make it consistent with the other timer values which are also maintained correct by the user instead of being dynamically computed. It also changes back to the previous user-expected GMI behaviour for IGMPv3 queries which were supported before IGMPv3 was added. Note that to properly compute it dynamically we would need to add support for "Robustness Variable" which is currently missing. Reported-by: Hangbin Liu Fixes: 0436862e417e ("net: bridge: mcast: support for IGMPv3/MLDv2 ALLOW_NEW_SOURCES report") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit b2381acd3fd9bacd2c63f53b2c610c89959b31cc Author: Borislav Petkov Date: Fri Oct 15 12:46:25 2021 +0200 x86/fpu: Mask out the invalid MXCSR bits properly This is a fix for the fix (yeah, /facepalm). The correct mask to use is not the negation of the MXCSR_MASK but the actual mask which contains the supported bits in the MXCSR register. Reported and debugged by Ville Syrjälä Fixes: d298b03506d3 ("x86/fpu: Restore the masking out of reserved MXCSR bits") Signed-off-by: Borislav Petkov Tested-by: Ville Syrjälä Tested-by: Ser Olmy Cc: Link: https://lore.kernel.org/r/YWgYIYXLriayyezv@intel.com commit 0b28c41e3c951ea3d4f012cfa9da5ebd6512cf6e Author: Frieder Schrempf Date: Fri Oct 15 14:48:40 2021 +0200 arm64: dts: imx8mm-kontron: Fix connection type for VSC8531 RGMII PHY Previously we falsely relied on the PHY driver to unconditionally enable the internal RX delay. Since the following fix for the PHY driver this is not the case anymore: commit 7b005a1742be ("net: phy: mscc: configure both RX and TX internal delays for RGMII") In order to enable the delay we need to set the connection type to "rgmii-rxid". Without the RX delay the ethernet is not functional at all. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Cc: stable@vger.kernel.org Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit ca6f9d85d5944046a241b325700c1ca395651c28 Author: Frieder Schrempf Date: Fri Oct 15 14:48:39 2021 +0200 arm64: dts: imx8mm-kontron: Fix CAN SPI clock frequency The MCP2515 can be used with an SPI clock of up to 10 MHz. Set the limit accordingly to prevent any performance issues caused by the really low clock speed of 100 kHz. This removes the arbitrarily low limit on the SPI frequency, that was caused by a typo in the original dts. Without this change, receiving CAN messages on the board beyond a certain bitrate will cause overrun errors (see 'ip -det -stat link show can0'). With this fix, receiving messages on the bus works without any overrun errors for bitrates up to 1 MBit. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Cc: stable@vger.kernel.org Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 6562d6e350284307e33ea10c7f46a6661ff22770 Author: Frieder Schrempf Date: Fri Oct 15 14:48:38 2021 +0200 arm64: dts: imx8mm-kontron: Fix polarity of reg_rst_eth2 The regulator reg_rst_eth2 should keep the reset signal of the USB ethernet adapter deasserted anytime. Fix the polarity and mark it as always-on. Anyway, using the regulator is only a workaround for the missing support of specifying a reset GPIO for USB devices in a generic way. As we don't have a solution for this at the moment, at least fix the current workaround. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Cc: stable@vger.kernel.org Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 256a24eba7f897c817fb0103dac73467d3789202 Author: Frieder Schrempf Date: Fri Oct 15 14:48:37 2021 +0200 arm64: dts: imx8mm-kontron: Set lower limit of VDD_SNVS to 800 mV According to the datasheet the typical value for VDD_SNVS should be 800 mV, so let's make sure that this is within the range of the regulator. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Cc: stable@vger.kernel.org Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 82a4f329b133ad0de66bee12c0be5c67bb8aa188 Author: Frieder Schrempf Date: Fri Oct 15 14:48:36 2021 +0200 arm64: dts: imx8mm-kontron: Make sure SOC and DRAM supply voltages are correct It looks like the voltages for the SOC and DRAM supply weren't properly validated before. The datasheet and uboot-imx code tells us that VDD_SOC should be 800 mV in suspend and 850 mV in run mode. VDD_DRAM should be 950 mV for DDR clock frequencies of up to 1.5 GHz. Let's fix these values to make sure the voltages are within the required range. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Cc: stable@vger.kernel.org Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit a02dcde595f7cbd240ccd64de96034ad91cffc40 Author: Nathan Chancellor Date: Fri Oct 15 13:13:06 2021 -0700 Input: touchscreen - avoid bitwise vs logical OR warning A new warning in clang points out a few places in this driver where a bitwise OR is being used with boolean types: drivers/input/touchscreen.c:81:17: warning: use of bitwise '|' with boolean operands [-Wbitwise-instead-of-logical] data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-x", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This use of a bitwise OR is intentional, as bitwise operations do not short circuit, which allows all the calls to touchscreen_get_prop_u32() to happen so that the last parameter is initialized while coalescing the results of the calls to make a decision after they are all evaluated. To make this clearer to the compiler, use the '|=' operator to assign the result of each touchscreen_get_prop_u32() call to data_present, which keeps the meaning of the code the same but makes it obvious that every one of these calls is expected to happen. Signed-off-by: Nathan Chancellor Reported-by: Nick Desaulniers Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20211014205757.3474635-1-nathan@kernel.org Signed-off-by: Dmitry Torokhov commit 3378a07daa6cdd11e042797454c706d1c69f9ca6 Author: Michael Cullen Date: Fri Oct 15 13:17:50 2021 -0700 Input: xpad - add support for another USB ID of Nacon GC-100 The Nacon GX100XF is already mapped, but it seems there is a Nacon GC-100 (identified as NC5136Wht PCGC-100WHITE though I believe other colours exist) with a different USB ID when in XInput mode. Signed-off-by: Michael Cullen Link: https://lore.kernel.org/r/20211015192051.5196-1-michael@michaelcullen.name Signed-off-by: Dmitry Torokhov commit fe0a7e3d012738b0034b3c97ddb0e8bc0a3ff0e6 Author: Oleksij Rempel Date: Fri Oct 15 21:12:06 2021 -0700 Input: resistive-adc-touch - fix division by zero error on z1 == 0 For proper pressure calculation we need at least x and z1 to be non zero. Even worse, in case z1 we may run in to division by zero error. Fixes: 60b7db914ddd ("Input: resistive-adc-touch - rework mapping of channels") Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20211007095727.29579-1-o.rempel@pengutronix.de Signed-off-by: Dmitry Torokhov commit d997cc1715df7b6c3df798881fb9941acf0079f8 Author: Uwe Kleine-König Date: Fri Oct 15 21:19:33 2021 -0700 Input: snvs_pwrkey - add clk handling On i.MX7S and i.MX8M* (but not i.MX6*) the pwrkey device has an associated clock. Accessing the registers requires that this clock is enabled. Binding the driver on at least i.MX7S and i.MX8MP while not having the clock enabled results in a complete hang of the machine. (This usually only happens if snvs_pwrkey is built as a module and the rtc-snvs driver isn't already bound because at bootup the required clk is on and only gets disabled when the clk framework disables unused clks late during boot.) This completes the fix in commit 135be16d3505 ("ARM: dts: imx7s: add snvs clock to pwrkey"). Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20211013062848.2667192-1-u.kleine-koenig@pengutronix.de Signed-off-by: Dmitry Torokhov commit c41108049d143304faf06852c7181262b7b0d242 Author: Christoph Hellwig Date: Tue Oct 12 11:33:01 2021 +0200 kyber: avoid q->disk dereferences in trace points q->disk becomes invalid after the gendisk is removed. Work around this by caching the dev_t for the tracepoints. The real fix would be to properly tear down the I/O schedulers with the gendisk, but that is a much more invasive change. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211012093301.GA27795@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit aec89dc5d421200b353d99a2bfff9e0967f67037 Author: Christoph Hellwig Date: Wed Sep 29 09:12:41 2021 +0200 block: keep q_usage_counter in atomic mode after del_gendisk Don't switch back to percpu mode to avoid the double RCU grace period when tearing down SCSI devices. After removing the disk only passthrough commands can be send anyway. Suggested-by: Ming Lei Signed-off-by: Christoph Hellwig Tested-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210929071241.934472-6-hch@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit 8e141f9eb803e209714a80aa6ec073893f94c526 Author: Christoph Hellwig Date: Wed Sep 29 09:12:40 2021 +0200 block: drain file system I/O on del_gendisk Instead of delaying draining of file system I/O related items like the blk-qos queues, the integrity read workqueue and timeouts only when the request_queue is removed, do that when del_gendisk is called. This is important for SCSI where the upper level drivers that control the gendisk are separate entities, and the disk can be freed much earlier than the request_queue, or can even be unbound without tearing down the queue. Fixes: edb0872f44ec ("block: move the bdi from the request_queue to the gendisk") Reported-by: Ming Lei Signed-off-by: Christoph Hellwig Tested-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210929071241.934472-5-hch@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit a6741536f44ae65491cfde6870ae518aabe1ca36 Author: Christoph Hellwig Date: Wed Sep 29 09:12:39 2021 +0200 block: split bio_queue_enter from blk_queue_enter To prepare for fixing a gendisk shutdown race, open code the blk_queue_enter logic in bio_queue_enter. This also removes the pointless flags translation. Signed-off-by: Christoph Hellwig Tested-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210929071241.934472-4-hch@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit 1f14a0989073459c2be6b5c7b3fb7f9f3d7fa2af Author: Christoph Hellwig Date: Wed Sep 29 09:12:38 2021 +0200 block: factor out a blk_try_enter_queue helper Factor out the code to try to get q_usage_counter without blocking into a separate helper. Both to improve code readability and to prepare for splitting bio_queue_enter from blk_queue_enter. Signed-off-by: Christoph Hellwig Tested-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210929071241.934472-3-hch@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit cc9c884dd7f4f036965e23f5445f838db316eb46 Author: Christoph Hellwig Date: Wed Sep 29 09:12:37 2021 +0200 block: call submit_bio_checks under q_usage_counter Ensure all bios check the current values of the queue under freeze protection, i.e. to make sure the zero capacity set by del_gendisk is actually seen before dispatching to the driver. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210929071241.934472-2-hch@lst.de Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit be358af1191b1b2fedebd8f3421cafdc8edacc7d Author: Steven Rostedt Date: Thu Oct 14 14:35:07 2021 -0400 nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^' I received a build failure for a new patch I'm working on the nds32 architecture, and when I went to test it, I couldn't get to my build error, because it failed to build with a bunch of: Error: invalid operands (*UND* and *UND* sections) for `^' issues with various files. Those files were temporary asm files that looked like: kernel/.tmp_mc_fork.s I decided to look deeper, and found that the "mc" portion of that name stood for "mcount", and was created by the recordmcount.pl script. One that I wrote over a decade ago. Once I knew the source of the problem, I was able to investigate it further. The way the recordmcount.pl script works (BTW, there's a C version that simply modifies the ELF object) is by doing an "objdump" on the object file. Looks for all the calls to "mcount", and creates an offset of those locations from some global variable it can use (usually a global function name, found with <.*>:). Creates a asm file that is a table of references to these locations, using the found variable/function. Compiles it and links it back into the original object file. This asm file is called ".tmp_mc_.s". The problem here is that the objdump produced by the nds32 object file, contains things that look like: 0000159a <.L3^B1>: 159a: c6 00 beqz38 $r6, 159a <.L3^B1> 159a: R_NDS32_9_PCREL_RELA .text+0x159e 159c: 84 d2 movi55 $r6, #-14 159e: 80 06 mov55 $r0, $r6 15a0: ec 3c addi10.sp #0x3c Where ".L3^B1 is somehow selected as the "global" variable to index off of. Then the assembly file that holds the mcount locations looks like this: .section __mcount_loc,"a",@progbits .align 2 .long .L3^B1 + -5522 .long .L3^B1 + -5384 .long .L3^B1 + -5270 .long .L3^B1 + -5098 .long .L3^B1 + -4970 .long .L3^B1 + -4758 .long .L3^B1 + -4122 [...] And when it is compiled back to an object to link to the original object, the compile fails on the "^" symbol. Simple solution for now, is to have the perl script ignore using function symbols that have an "^" in the name. Link: https://lkml.kernel.org/r/20211014143507.4ad2c0f7@gandalf.local.home Cc: stable@vger.kernel.org Acked-by: Greentime Hu Fixes: fbf58a52ac088 ("nds32/ftrace: Add RECORD_MCOUNT support") Signed-off-by: Steven Rostedt (VMware) commit c3ca31ce0ea1e1ae34748ded54b6ccc319e7ed20 Author: Vineet Gupta Date: Fri Oct 15 10:43:35 2021 -0700 ARC: fix potential build snafu In the big pgtable header split, I inadvertently introduced a couple of duplicate symbols. Fixes: fe6cb7b043b69cd9 ("ARC: mm: disintegrate pgtable.h into levels and flags") Signed-off-by: Vineet Gupta commit ba95a6225b02c24d99f39fd930b6a388e5fd7b48 Author: Stefano Garzarella Date: Thu Oct 14 17:20:45 2021 +0200 vsock_diag_test: remove free_sock_stat() call in test_no_sockets In `test_no_sockets` we don't expect any sockets, indeed check_no_sockets() prints an error and exits if `sockets` list is not empty, so free_sock_stat() call is unnecessary since it would only be called when the `sockets` list is empty. This was discovered by a strange warning printed by gcc v11.2.1: In file included from ../../include/linux/list.h:7, from vsock_diag_test.c:18: vsock_diag_test.c: In function ‘test_no_sockets’: ../../include/linux/kernel.h:35:45: error: array subscript ‘struct vsock_stat[0]’ is partly outside array bound s of ‘struct list_head[1]’ [-Werror=array-bounds] 35 | const typeof(((type *)0)->member) * __mptr = (ptr); \ | ^~~~~~ ../../include/linux/list.h:352:9: note: in expansion of macro ‘container_of’ 352 | container_of(ptr, type, member) | ^~~~~~~~~~~~ ../../include/linux/list.h:393:9: note: in expansion of macro ‘list_entry’ 393 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ ../../include/linux/list.h:522:21: note: in expansion of macro ‘list_next_entry’ 522 | n = list_next_entry(pos, member); \ | ^~~~~~~~~~~~~~~ vsock_diag_test.c:325:9: note: in expansion of macro ‘list_for_each_entry_safe’ 325 | list_for_each_entry_safe(st, next, sockets, list) { | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from vsock_diag_test.c:18: vsock_diag_test.c:333:19: note: while referencing ‘sockets’ 333 | LIST_HEAD(sockets); | ^~~~~~~ ../../include/linux/list.h:23:26: note: in definition of macro ‘LIST_HEAD’ 23 | struct list_head name = LIST_HEAD_INIT(name) It seems related to some compiler optimization and assumption about the empty `sockets` list, since this warning is printed only with -02 or -O3. Also removing `exit(1)` from check_no_sockets() makes the warning disappear since in that case free_sock_stat() can be reached also when the list is not empty. Reported-by: Marc-André Lureau Signed-off-by: Stefano Garzarella Link: https://lore.kernel.org/r/20211014152045.173872-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 2151135a1f613c16c134c3674382a1f202868486 Merge: 0857d6f8c759d b726ddf984a56 Author: Jakub Kicinski Date: Fri Oct 15 17:20:15 2021 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-10-14 Brett ensures RDMA nodes are removed during release and rebuild. He also corrects fw.mgmt.api to include the patch number for proper identification. Dave stops ida_free() being called when an IDA has not been allocated. Michal corrects the order of parameters being provided and the number of entries skipped for UDP tunnels. ==================== Link: https://lore.kernel.org/r/20211014181953.3538330-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e21e52ad1e0126e2a5e2013084ac3f47cf1e887a Author: Guenter Roeck Date: Thu Sep 16 21:38:38 2021 -0700 csky: Make HAVE_TCM depend on !COMPILE_TEST Building csky:allmodconfig results in the following build errors. arch/csky/mm/tcm.c:9:2: error: #error "You should define ITCM_RAM_BASE" 9 | #error "You should define ITCM_RAM_BASE" | ^~~~~ arch/csky/mm/tcm.c:14:2: error: #error "You should define DTCM_RAM_BASE" 14 | #error "You should define DTCM_RAM_BASE" | ^~~~~ arch/csky/mm/tcm.c:18:2: error: #error "You should define correct DTCM_RAM_BASE" 18 | #error "You should define correct DTCM_RAM_BASE" This is seen with compile tests since those enable HAVE_TCM, but do not provide useful default values for ITCM_RAM_BASE or DTCM_RAM_BASE. Disable HAVE_TCM for commpile tests to avoid the error. Signed-off-by: Guenter Roeck Signed-off-by: Guo Ren commit fb5d69a5cd7865a733c2c1f26e2e3b75f59ce00d Author: Guenter Roeck Date: Thu Sep 16 21:38:37 2021 -0700 csky: bitops: Remove duplicate __clear_bit define Building csky:allmodconfig results in the following build error. In file included from ./include/linux/bitops.h:33, from ./include/linux/log2.h:12, from kernel/bounds.c:13: ./arch/csky/include/asm/bitops.h:77: error: "__clear_bit" redefined Since commit 9248e52fec95 ("locking/atomic: simplify non-atomic wrappers"), __clear_bit is defined in include/asm-generic/bitops/non-atomic.h, and the define in the csky include file is no longer necessary or useful. Remove it. Fixes: 9248e52fec95 ("locking/atomic: simplify non-atomic wrappers") Signed-off-by: Guenter Roeck Signed-off-by: Guo Ren commit aeba0b84dd07a9e6b362395f5ad47091249db13d Author: Guenter Roeck Date: Thu Sep 16 21:38:36 2021 -0700 csky: Select ARCH_WANT_FRAME_POINTERS only if compiler supports it Compiling csky:allmodconfig with an upstream C compiler results in the following error. csky-linux-gcc: error: unrecognized command-line option '-mbacktrace'; did you mean '-fbacktrace'? Select ARCH_WANT_FRAME_POINTERS only if gcc supports it to avoid the error. Signed-off-by: Guenter Roeck Signed-off-by: Guo Ren commit af89ebaa64de726ca0a39bbb0bf0c81a1f43ad50 Author: Guo Ren Date: Fri Sep 24 15:33:38 2021 +0800 csky: Fixup regs.sr broken in ptrace gpr_get() return the entire pt_regs (include sr) to userspace, if we don't restore the C bit in gpr_set, it may break the ALU result in that context. So the C flag bit is part of gpr context, that's why riscv totally remove the C bit in the ISA. That makes sr reg clear from userspace to supervisor privilege. Signed-off-by: Guo Ren Cc: Al Viro Cc: stable@vger.kernel.org commit fbd63c08cdcca5fb1315aca3172b3c9c272cfb4f Author: Al Viro Date: Fri Sep 24 00:35:42 2021 +0000 csky: don't let sigreturn play with priveleged bits of status register csky restore_sigcontext() blindly overwrites regs->sr with the value it finds in sigcontext. Attacker can store whatever they want in there, which includes things like S-bit. Userland shouldn't be able to set that, or anything other than C flag (bit 0). Do the same thing other architectures with protected bits in flags register do - preserve everything that shouldn't be settable in user mode, picking the rest from the value saved is sigcontext. Signed-off-by: Al Viro Signed-off-by: Guo Ren Cc: stable@vger.kernel.org commit 0857d6f8c759d95f89d0436f86cdfd189ef99f20 Author: Stephen Suryaputra Date: Thu Oct 14 09:08:45 2021 -0400 ipv6: When forwarding count rx stats on the orig netdev Commit bdb7cc643fc9 ("ipv6: Count interface receive statistics on the ingress netdev") does not work when ip6_forward() executes on the skbs with vrf-enslaved netdev. Use IP6CB(skb)->iif to get to the right one. Add a selftest script to verify. Fixes: bdb7cc643fc9 ("ipv6: Count interface receive statistics on the ingress netdev") Signed-off-by: Stephen Suryaputra Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20211014130845.410602-1-ssuryaextr@gmail.com Signed-off-by: Jakub Kicinski commit 011ace4a7fadcbe8670b615e0db1e8d7b813ee6c Merge: 0f0f80d9d5db0 a1467faa10414 Author: Arnd Bergmann Date: Fri Oct 15 20:48:06 2021 +0200 Merge tag 'imx-fixes-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.15, round 3: - Add platform device for i.MX System Reset Controller (SRC) to fix a regression caused by fw_devlink change. * tag 'imx-fixes-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx: register reset controller from a platform driver Link: https://lore.kernel.org/r/20211015070017.GI22881@dragon Signed-off-by: Arnd Bergmann commit eadeb06e7645f7a7ddbcfac39480be3892a60ae3 Merge: d94befbb5ae37 6b9b546dc0079 Author: Takashi Iwai Date: Fri Oct 15 17:43:46 2021 +0200 Merge tag 'asoc-fix-v5.15-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.15 A colletion of smallish mostly driver specific fixes, the biggest thing here is fixing some of the core code to generate change notifications properly when writing to controls which will fix issues with UIs not showing the correct values. There's one build fix here with a slightly misleading changelog saying it's adding IRQ config support, it's adding a missing select of the regmap-irq code rather than adding a feature. commit 8fe31e0995f048d16b378b90926793a0aa4af1e5 Merge: 985f6ab93fc98 6fda593f3082e Author: Linus Torvalds Date: Fri Oct 15 10:27:20 2021 -0400 Merge tag 'gpio-fixes-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix module autoloading on gpio-74x164 after a revert of OF modaliases - fix problems with the bias setting in gpio-pca953x - fix a use-after-free bug in gpio-mockup by using software nodes * tag 'gpio-fixes-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mockup: Convert to use software nodes gpio: pca953x: Improve bias setting gpio: 74x164: Add SPI device ID table commit 985f6ab93fc986f339654b5cb2e6825839bf3bc5 Merge: ccb6a666d5556 16a8e2fbb2d49 Author: Linus Torvalds Date: Fri Oct 15 10:21:46 2021 -0400 Merge tag 'spi-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few small fixes. Mostly driver specific but there's one in the core which fixes a deadlock when adding devices on spi-mux that's triggered because spi-mux is a SPI device which is itself a SPI controller and so can instantiate devices when registered. We were using a global lock to protect against reusing chip selects but they're a per controller thing so moving the lock per controller resolves that" * tag 'spi-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi-mux: Fix false-positive lockdep splats spi: Fix deadlock when adding SPI controllers on SPI buses spi: bcm-qspi: clear MSPI spifie interrupt during probe spi: spi-nxp-fspi: don't depend on a specific node name erratum workaround spi: mediatek: skip delays if they are 0 spi: atmel: Fix PDC transfer setup bug spi: spidev: Add SPI ID table spi: Use 'flash' node name instead of 'spi-flash' in example commit ccb6a666d555652232e845352b9ff7217aca85cb Merge: 9e795d94deafd beb76cb4eebf9 Author: Linus Torvalds Date: Fri Oct 15 10:20:18 2021 -0400 Merge tag 'regulator-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Just a trivial fix to the MAINTAINERS file for an update missed during conversion of the DT bindings to YAML format" * tag 'regulator-fix-v5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: MAINTAINERS: rectify entry for SY8106A REGULATOR DRIVER commit 7a33488705008b5bb5f8d95d05326dcc64fc55f4 Author: Ralph Boehme Date: Fri Oct 15 12:52:58 2021 +0900 ksmbd: validate credit charge after validating SMB2 PDU body size smb2_validate_credit_charge() accesses fields in the SMB2 PDU body, but until smb2_calc_size() is called the PDU has not yet been verified to be large enough to access the PDU dynamic part length field. Acked-by: Namjae Jeon Signed-off-by: Ralph Boehme Signed-off-by: Steve French commit 2ea086e35c3d726a3bacd0a971c1f02a50e98206 Author: Hyunchul Lee Date: Fri Oct 15 06:02:50 2021 +0900 ksmbd: add buffer validation for smb direct Add buffer validation for smb direct. Acked-by: Namjae Jeon Signed-off-by: Hyunchul Lee Signed-off-by: Steve French commit 4bc59477c3298b191c72b5d99feb54a1dc8c254d Author: Namjae Jeon Date: Fri Oct 15 17:14:02 2021 +0900 ksmbd: limit read/write/trans buffer size not to exceed 8MB ksmbd limit read/write/trans buffer size not to exceed maximum 8MB. And set the minimum value of max response buffer size to 64KB. Windows client doesn't send session setup request if ksmbd set max trans/read/write size lower than 64KB in smb2 negotiate. It means windows allow at least 64 KB or more about this value. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9e795d94deafd007bd6702679a02b82facc6e7ea Merge: 591a495d440ff f60f5741002b9 Author: Linus Torvalds Date: Fri Oct 15 10:13:00 2021 -0400 Merge tag 'mtd/fixes-for-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fix from Miquel Raynal: "Raw NAND controller driver fix: - Qcom: Update code word value for raw reads (QPIC v2+)" * tag 'mtd/fixes-for-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: qcom: Update code word value for raw read commit 591a495d440ff8dd2b51a47eb6053c83f68a7f6b Merge: 86a44e9067c95 a14bc107edd0c Author: Linus Torvalds Date: Fri Oct 15 10:09:09 2021 -0400 Merge tag 'drm-fixes-2021-10-15-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "It has a few scattered msm and i915 fixes, a few core fixes and a mediatek feature revert. I've had to pick a bunch of patches into this, as the drm-misc-fixes tree had a bunch of vc4 patches I wasn't comfortable with sending to you at least as part of this, they were delayed due to your reverts. If it's really useful as fixes I'll do a separate pull. Summary: Core: - clamp fbdev size - edid cap blocks read to avoid out of bounds panel: - fix missing crc32 dependency msm: - Fix a new crash on dev file close if the dev file was opened when GPU is not loaded (such as missing fw in initrd) - Switch to single drm_sched_entity per priority level per drm_file to unbreak multi-context userspace - Serialize GMU access to fix GMU OOB errors - Various error path fixes - A couple integer overflow fixes - Fix mdp5 cursor plane WARNs i915: - Fix ACPI object leak - Fix context leak in user proto-context creation - Fix missing i915_sw_fence_fini call hyperv: - hide hw pointer nouveau: - fix engine selection bit r128: - fix UML build rcar-du: - unconncted LVDS regression fix mediatek: - revert CMDQ refinement patches" * tag 'drm-fixes-2021-10-15-1' of git://anongit.freedesktop.org/drm/drm: (34 commits) drm/panel: olimex-lcd-olinuxino: select CRC32 drm/r128: fix build for UML drm/nouveau/fifo: Reinstate the correct engine bit programming drm/hyperv: Fix double mouse pointers drm/fbdev: Clamp fbdev surface size if too large drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read drm/i915: Free the returned object of acpi_evaluate_dsm() drm/i915: Fix bug in user proto-context creation that leaked contexts drm: rcar-du: Don't create encoder for unconnected LVDS outputs drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() drm/msm/dsi: dsi_phy_14nm: Take ready-bit into account in poll_for_ready drm/msm/dsi/phy: fix clock names in 28nm_8960 phy drm/msm/dpu: Fix address of SM8150 PINGPONG5 IRQ register drm/msm: Do not run snapshot on non-DPU devices drm/msm/a3xx: fix error handling in a3xx_gpu_init() drm/msm/a4xx: fix error handling in a4xx_gpu_init() drm/msm: Fix null pointer dereference on pointer edp drm/msm/mdp5: fix cursor-related warnings drm/msm: Avoid potential overflow in timeout_to_jiffies() ... commit 86a44e9067c95083d5dbf5a140e3f4560e5af1ca Merge: ec681c53f8d2d 8607954cf2553 Author: Linus Torvalds Date: Fri Oct 15 09:58:11 2021 -0400 Merge tag 'ntfs3_for_5.15' of git://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 fixes from Konstantin Komarov: "Use the new api for mounting as requested by Christoph. Also fixed: - some memory leaks and panic - xfstests (tested on x86_64) generic/016 generic/021 generic/022 generic/041 generic/274 generic/423 - some typos, wrong returned error codes, dead code, etc" * tag 'ntfs3_for_5.15' of git://github.com/Paragon-Software-Group/linux-ntfs3: (70 commits) fs/ntfs3: Check for NULL pointers in ni_try_remove_attr_list fs/ntfs3: Refactor ntfs_read_mft fs/ntfs3: Refactor ni_parse_reparse fs/ntfs3: Refactor ntfs_create_inode fs/ntfs3: Refactor ntfs_readlink_hlp fs/ntfs3: Rework ntfs_utf16_to_nls fs/ntfs3: Fix memory leak if fill_super failed fs/ntfs3: Keep prealloc for all types of files fs/ntfs3: Remove unnecessary functions fs/ntfs3: Forbid FALLOC_FL_PUNCH_HOLE for normal files fs/ntfs3: Refactoring of ntfs_set_ea fs/ntfs3: Remove locked argument in ntfs_set_ea fs/ntfs3: Use available posix_acl_release instead of ntfs_posix_acl_release fs/ntfs3: Check for NULL if ATTR_EA_INFO is incorrect fs/ntfs3: Refactoring of ntfs_init_from_boot fs/ntfs3: Reject mount if boot's cluster size < media sector size fs/ntfs3: Refactoring lock in ntfs_init_acl fs/ntfs3: Change posix_acl_equiv_mode to posix_acl_update_mode fs/ntfs3: Pass flags to ntfs_set_ea in ntfs_set_acl_ex fs/ntfs3: Refactor ntfs_get_acl_ex for better readability ... commit cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 Author: Michael Ellerman Date: Fri Oct 15 23:02:08 2021 +1100 KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest We call idle_kvm_start_guest() from power7_offline() if the thread has been requested to enter KVM. We pass it the SRR1 value that was returned from power7_idle_insn() which tells us what sort of wakeup we're processing. Depending on the SRR1 value we pass in, the KVM code might enter the guest, or it might return to us to do some host action if the wakeup requires it. If idle_kvm_start_guest() is able to handle the wakeup, and enter the guest it is supposed to indicate that by returning a zero SRR1 value to us. That was the behaviour prior to commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C"), however in that commit the handling of SRR1 was reworked, and the zeroing behaviour was lost. Returning from idle_kvm_start_guest() without zeroing the SRR1 value can confuse the host offline code, causing the guest to crash and other weirdness. Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211015133929.832061-2-mpe@ellerman.id.au commit 9b4416c5095c20e110c82ae602c254099b83b72f Author: Michael Ellerman Date: Fri Oct 15 23:01:48 2021 +1100 KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame. idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack. The emergency stack for a given CPU is allocated with: paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use. idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation. The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 bytes above the emergency stack allocation. In practice this has gone unnoticed because the memory immediately above the emergency stack happens to be used for other stack allocations, either another CPUs mc_emergency_sp or an IRQ stack. See the order of calls to irqstack_early_init() and emergency_stack_init(). The low addresses of another stack are the top of that stack, and so are only used if that stack is under extreme pressue, which essentially never happens in practice - and if it did there's a high likelyhood we'd crash due to that stack overflowing. Still, we shouldn't be corrupting someone else's stack, and it is purely luck that we aren't corrupting something else. To fix it we save CR/LR into the caller's frame using the existing r1 on entry, we then create a SWITCH_FRAME_SIZE frame (which has space for pt_regs) on the emergency stack with the backchain pointing to the existing stack, and then finally we switch to the new frame on the emergency stack. Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211015133929.832061-1-mpe@ellerman.id.au commit 4884ddba7f124da65cafa983b49b27daa460b91d Merge: 46393d61a328d 64e4017778bea Author: David S. Miller Date: Fri Oct 15 14:36:57 2021 +0100 Merge branch 'tcp-md5-vrf-fix' Leonard Crestez says: ==================== tcp: md5: Fix overlap between vrf and non-vrf keys With net.ipv4.tcp_l3mdev_accept=1 it is possible for a listen socket to accept connection from the same client address in different VRFs. It is also possible to set different MD5 keys for these clients which differ only in the tcpm_l3index field. This appears to work when distinguishing between different VRFs but not between non-VRF and VRF connections. In particular: * tcp_md5_do_lookup_exact will match a non-vrf key against a vrf key. This means that adding a key with l3index != 0 after a key with l3index == 0 will cause the earlier key to be deleted. Both keys can be present if the non-vrf key is added later. * _tcp_md5_do_lookup can match a non-vrf key before a vrf key. This casues failures if the passwords differ. This can be fixed by making tcp_md5_do_lookup_exact perform an actual exact comparison on l3index and by making __tcp_md5_do_lookup perfer vrf-bound keys above other considerations like prefixlen. The fact that keys with l3index==0 affect VRF connections is usually not desirable, VRFs are meant to be completely independent. This behavior needs to preserved for backwards compatibility. Also, applications can just bind listen sockets to VRF and never specify TCP_MD5SIG_FLAG_IFINDEX at all. So far the combination of TCP_MD5SIG_FLAG_IFINDEX with tcpm_ifindex == 0 was an error, accept this to mean "key only applies to default VRF". This is what applications using VRFs for traffic separation want. This also contains tests for the second part. It does not contain tests for overlapping keys, that would require more changes in nettest to add multiple keys. These scenarios are also covered by my tests for TCP-AO, especially around this area: https://github.com/cdleonard/tcp-authopt-test/blob/main/tcp_authopt_test/test_vrf_bind.py Changes since V2: * Rename --do-bind-key-ifindex to --force-bind-key-ifindex * Fix referencing TCP_MD5SIG_FLAG_IFINDEX as TCP_MD5SIG_IFINDEX Link to v2: https://lore.kernel.org/netdev/cover.1634107317.git.cdleonard@gmail.com/ Changes since V1: * Accept (TCP_MD5SIG_IFINDEX with tcpm_ifindex == 0) * Add flags for explicitly including or excluding TCP_MD5SIG_FLAG_IFINDEX to nettest * Add few more tests in fcnal-test.sh. Link to v1: https://lore.kernel.org/netdev/3d8387d499f053dba5cd9184c0f7b8445c4470c6.1633542093.git.cdleonard@gmail.com/ ==================== Signed-off-by: David S. Miller commit 64e4017778bea04a50ed564615339801e02d2d32 Author: Leonard Crestez Date: Fri Oct 15 10:26:07 2021 +0300 selftests: net/fcnal: Test --{force,no}-bind-key-ifindex Test that applications binding listening sockets to VRFs without specifying TCP_MD5SIG_FLAG_IFINDEX will work as expected. This would be broken if __tcp_md5_do_lookup always made a strict comparison on l3index. See this email: https://lore.kernel.org/netdev/209548b5-27d2-2059-f2e9-2148f5a0291b@gmail.com/ Applications using tcp_l3mdev_accept=1 and a single global socket (not bound to any interface) also should have a way to specify keys that are only for the default VRF, this is done by --force-bind-key-ifindex without otherwise binding to a device. Signed-off-by: Leonard Crestez Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 78a9cf6143e2d4fb4dd48dde529b24cd5b6bf0e0 Author: Leonard Crestez Date: Fri Oct 15 10:26:06 2021 +0300 selftests: nettest: Add --{force,no}-bind-key-ifindex These options allow explicit control over the TCP_MD5SIG_FLAG_IFINDEX flag instead of always setting it based on binding to an interface. Do this by converting to getopt_long because nettest has too many single-character flags already and getopt_long is widely used in selftests. Signed-off-by: Leonard Crestez Reviewed-by: David Ahern Signed-off-by: David S. Miller commit a76c2315bec7afeb9bafe776fe532106fa0a8b05 Author: Leonard Crestez Date: Fri Oct 15 10:26:05 2021 +0300 tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 Multiple VRFs are generally meant to be "separate" but right now md5 keys for the default VRF also affect connections inside VRFs if the IP addresses happen to overlap. So far the combination of TCP_MD5SIG_FLAG_IFINDEX with tcpm_ifindex == 0 was an error, accept this to mean "key only applies to default VRF". This is what applications using VRFs for traffic separation want. Signed-off-by: Leonard Crestez Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 86f1e3a8489f6a0232c1f3bc2bdb379f5ccdecec Author: Leonard Crestez Date: Fri Oct 15 10:26:04 2021 +0300 tcp: md5: Fix overlap between vrf and non-vrf keys With net.ipv4.tcp_l3mdev_accept=1 it is possible for a listen socket to accept connection from the same client address in different VRFs. It is also possible to set different MD5 keys for these clients which differ only in the tcpm_l3index field. This appears to work when distinguishing between different VRFs but not between non-VRF and VRF connections. In particular: * tcp_md5_do_lookup_exact will match a non-vrf key against a vrf key. This means that adding a key with l3index != 0 after a key with l3index == 0 will cause the earlier key to be deleted. Both keys can be present if the non-vrf key is added later. * _tcp_md5_do_lookup can match a non-vrf key before a vrf key. This casues failures if the passwords differ. Fix this by making tcp_md5_do_lookup_exact perform an actual exact comparison on l3index and by making __tcp_md5_do_lookup perfer vrf-bound keys above other considerations like prefixlen. Fixes: dea53bb80e07 ("tcp: Add l3index to tcp_md5sig_key and md5 functions") Signed-off-by: Leonard Crestez Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 46393d61a328d7c4e3264252dae891921126c674 Author: Vegard Nossum Date: Fri Oct 15 15:07:54 2021 +0200 lan78xx: select CRC32 Fix the following build/link error by adding a dependency on the CRC32 routines: ld: drivers/net/usb/lan78xx.o: in function `lan78xx_set_multicast': lan78xx.c:(.text+0x48cf): undefined reference to `crc32_le' The actual use of crc32_le() comes indirectly through ether_crc(). Fixes: 55d7de9de6c30 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Vegard Nossum Signed-off-by: David S. Miller commit cd932c2a1ecc8f261ecb8d140fa431c16379931f Merge: c2115b2b16421 11c52d250b34a Author: Greg Kroah-Hartman Date: Fri Oct 15 15:04:02 2021 +0200 Merge tag 'usb-serial-5.15-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.15-rc6 Here are some new modem device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-5.15-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: qcserial: add EM9191 QDL support USB: serial: option: add Quectel EC200S-CN module support USB: serial: option: add prod. id for Quectel EG91 USB: serial: option: add Telit LE910Cx composition 0x1204 commit 075718fdaf0efe20223571236c1bf14ca35a7aa1 Author: Xin Long Date: Thu Oct 14 00:50:55 2021 -0400 sctp: fix transport encap_port update in sctp_vtag_verify transport encap_port update should be updated when sctp_vtag_verify() succeeds, namely, returns 1, not returns 0. Correct it in this patch. While at it, also fix the indentation. Fixes: a1dd2cf2f1ae ("sctp: allow changing transport encap_port by peer packets") Signed-off-by: Xin Long Signed-off-by: David S. Miller commit c2402d43d183b11445aed921e7bebcd47ef222f1 Author: Kele Huang Date: Thu Oct 14 11:19:52 2021 +0800 ptp: fix error print of ptp_kvm on X86_64 platform Commit a86ed2cfa13c5 ("ptp: Don't print an error if ptp_kvm is not supported") fixes the error message print on ARM platform by only concerning about the case that the error returned from kvm_arch_ptp_init() is not -EOPNOTSUPP. Although the ARM platform returns -EOPNOTSUPP if ptp_kvm is not supported while X86_64 platform returns -KVM_EOPNOTSUPP, both error codes share the same value 95. Actually kvm_arch_ptp_init() on X86_64 platform can return three kinds of errors (-KVM_ENOSYS, -KVM_EOPNOTSUPP and -KVM_EFAULT). The problem is that -KVM_EOPNOTSUPP is masked out and -KVM_EFAULT is ignored among them. This patch fixes this by returning them to ptp_kvm_init() respectively. Signed-off-by: Kele Huang Signed-off-by: David S. Miller commit 71920ea97d6d1d800ee8b51951dc3fda3f5dc698 Author: Kan Liang Date: Wed Oct 6 13:12:17 2021 -0700 perf/x86/msr: Add Sapphire Rapids CPU support SMI_COUNT MSR is supported on Sapphire Rapids CPU. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/1633551137-192083-1-git-send-email-kan.liang@linux.intel.com commit f42752729e2068a92c7d8b576d0dbbc9c1464149 Author: Arnd Bergmann Date: Thu Oct 14 17:37:18 2021 +0200 eeprom: 93xx46: fix MODULE_DEVICE_TABLE The newly added SPI device ID table does not work because the entry is incorrectly copied from the OF device table. During build testing, this shows as a compile failure when building it as a loadable module: drivers/misc/eeprom/eeprom_93xx46.c:424:1: error: redefinition of '__mod_of__eeprom_93xx46_of_table_device_table' MODULE_DEVICE_TABLE(of, eeprom_93xx46_of_table); Change the entry to refer to the correct symbol. Fixes: 137879f7ff23 ("eeprom: 93xx46: Add SPI device ID table") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20211014153730.3821376-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit e2b6d941ec3876d3c44b1dfed596a2cc78477da2 Merge: 019057bd73d17 6e6a8ef088e12 Author: Paolo Bonzini Date: Fri Oct 15 04:47:55 2021 -0400 Merge tag 'kvmarm-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 5.15, take #2 - Properly refcount pages used as a concatenated stage-2 PGD - Fix missing unlock when detecting the use of MTE+VM_SHARED commit 019057bd73d1751fdfec41e43148baf3303d98f9 Author: Paolo Bonzini Date: Tue Oct 12 11:07:59 2021 -0400 KVM: SEV-ES: fix length of string I/O The size of the data in the scratch buffer is not divided by the size of each port I/O operation, so vcpu->arch.pio.count ends up being larger than it should be by a factor of size. Cc: stable@vger.kernel.org Fixes: 7ed9abfe8e9f ("KVM: SVM: Support string IO operations for an SEV-ES guest") Acked-by: Tom Lendacky Signed-off-by: Paolo Bonzini commit d94befbb5ae379f6dfd4fa6d460eacc09fa7b9c3 Author: Davide Baldo Date: Fri Oct 15 09:21:22 2021 +0200 ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and rear speakers are silent, this patch fixes that by overriding the pin layout and by initializing the amplifier which needs a GPIO pin to be set to 1 then 0, similar to the existing HP Spectre x360 14 model. In order to have volume control, both front and rear speakers were forced to use the DAC1. This patch also correctly map the mute LED but since there is no microphone on/off switch exposed by the alsa subsystem it never turns on by itself. There are still known audio issues in this laptop: headset microphone doesn't work, the button to mute/unmute microphone is not yet mapped, the LED of the mute/unmute speakers doesn't seems to be exposed via GPIO and never turns on. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213953 Signed-off-by: Davide Baldo Link: https://lore.kernel.org/r/20211015072121.5287-1-davide@baldo.me Signed-off-by: Takashi Iwai commit 3c414eb65c294719a91a746260085363413f91c1 Author: Brendan Grieve Date: Fri Oct 15 10:53:35 2021 +0800 ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset As per discussion at: https://github.com/szszoke/sennheiser-gsp670-pulseaudio-profile/issues/13 The GSP670 has 2 playback and 1 recording device that by default are detected in an incompatible order for alsa. This may have been done to make it compatible for the console by the manufacturer and only affects the latest firmware which uses its own ID. This quirk will resolve this by reordering the channels. Signed-off-by: Brendan Grieve Cc: Link: https://lore.kernel.org/r/20211015025335.196592-1-brendan@grieve.com.au Signed-off-by: Takashi Iwai commit a14bc107edd0c108bda2245e50daa22f91c95d20 Author: Vegard Nossum Date: Tue Oct 12 13:52:42 2021 +0200 drm/panel: olimex-lcd-olinuxino: select CRC32 Fix the following build/link error by adding a dependency on the CRC32 routines: ld: drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.o: in function `lcd_olinuxino_probe': panel-olimex-lcd-olinuxino.c:(.text+0x303): undefined reference to `crc32_le' Fixes: 17fd7a9d324fd ("drm/panel: Add support for Olimex LCD-OLinuXino panel") Cc: Arnd Bergmann Signed-off-by: Vegard Nossum Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211012115242.10325-1-vegard.nossum@oracle.com Signed-off-by: Dave Airlie commit 1a361b41c1a1c399399cd2a83e449c452d9d8115 Author: Randy Dunlap Date: Mon Oct 11 01:00:06 2021 -0700 drm/r128: fix build for UML Fix a build error on CONFIG_UML, which does not support (provide) wbinvd(). UML can use the generic mb() instead. ../drivers/gpu/drm/r128/ati_pcigart.c: In function ‘drm_ati_pcigart_init’: ../drivers/gpu/drm/r128/ati_pcigart.c:218:2: error: implicit declaration of function ‘wbinvd’ [-Werror=implicit-function-declaration] wbinvd(); ^~~~~~ Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: linux-um@lists.infradead.org Cc: Sam Ravnborg Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20211011080006.31081-1-rdunlap@infradead.org Signed-off-by: Dave Airlie commit d1d94b0129dccd226784633c60b7df90e8a051b5 Author: Marek Vasut Date: Thu Oct 7 23:41:17 2021 +0200 drm/nouveau/fifo: Reinstate the correct engine bit programming Commit 64f7c698bea9 ("drm/nouveau/fifo: add engine_id hook") replaced fifo/chang84.c g84_fifo_chan_engine() call with an indirect call of fifo/g84.c g84_fifo_engine_id(). The G84_FIFO_ENGN_* values returned from the later g84_fifo_engine_id() are incremented by 1 compared to the previous g84_fifo_chan_engine() return values. This is fine either way for most of the code, except this one line where an engine bit programmed into the hardware is derived from the return value. Decrement the return value accordingly, otherwise the wrong engine bit is programmed into the hardware and that leads to the following failure: nouveau 0000:01:00.0: gr: 00000030 [ILLEGAL_MTHD ILLEGAL_CLASS] ch 1 [003fbce000 DRM] subc 3 class 0000 mthd 085c data 00000420 On the following hardware: lspci -s 01:00.0 01:00.0 VGA compatible controller: NVIDIA Corporation GT216GLM [Quadro FX 880M] (rev a2) lspci -ns 01:00.0 01:00.0 0300: 10de:0a3c (rev a2) Fixes: 64f7c698bea9 ("drm/nouveau/fifo: add engine_id hook") Signed-off-by: Marek Vasut Cc: # 5.12+ Cc: Ben Skeggs Cc: Karol Herbst Cc: Lyude Paul Reviewed-by: Karol Herbst Reviewed-by: Ben Skeggs Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20211007214117.231472-1-marex@denx.de Signed-off-by: Dave Airlie commit b253c3026c29d4231099d3cf8d984d25787793af Author: Dexuan Cui Date: Thu Sep 16 12:36:44 2021 -0700 drm/hyperv: Fix double mouse pointers Hyper-V supports a hardware cursor feature. It is not used by Linux VM, but the Hyper-V host still draws a point as an extra mouse pointer, which is unwanted, especially when Xorg is running. The hyperv_fb driver uses synthvid_send_ptr() to hide the unwanted pointer. When the hyperv_drm driver was developed, the function synthvid_send_ptr() was not copied from the hyperv_fb driver. Fix the issue by adding the function into hyperv_drm. Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Signed-off-by: Dexuan Cui Reviewed-by: Haiyang Zhang Reviewed-by: Deepak Rawat Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210916193644.45650-1-decui@microsoft.com Signed-off-by: Dave Airlie commit b693e42921e0220c0d564c55c6cdc680b0f85390 Author: Thomas Zimmermann Date: Tue Oct 5 09:03:55 2021 +0200 drm/fbdev: Clamp fbdev surface size if too large Clamp the fbdev surface size of the available maximumi height to avoid failing to init console emulation. An example error is shown below. bad framebuffer height 2304, should be >= 768 && <= 768 [drm] Initialized simpledrm 1.0.0 20200625 for simple-framebuffer.0 on minor 0 simple-framebuffer simple-framebuffer.0: [drm] *ERROR* fbdev: Failed to setup generic emulation (ret=-22) This is especially a problem with drivers that have very small screen sizes and cannot over-allocate at all. v2: * reduce warning level (Ville) Signed-off-by: Thomas Zimmermann Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Reviewed-by: Ville Syrjälä Reviewed-by: Alex Deucher Reported-by: Amanoel Dawod Reported-by: Zoltán Kővágó Reported-by: Michael Stapelberg Cc: Daniel Vetter Cc: Maxime Ripard Cc: dri-devel@lists.freedesktop.org Cc: # v5.14+ Link: https://patchwork.freedesktop.org/patch/msgid/20211005070355.7680-1-tzimmermann@suse.de Signed-off-by: Dave Airlie commit 97794170b696856483f74b47bfb6049780d2d3a0 Author: Douglas Anderson Date: Tue Oct 5 19:29:08 2021 -0700 drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read In commit e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid corruption test") the function connector_bad_edid() started assuming that the memory for the EDID passed to it was big enough to hold `edid[0x7e] + 1` blocks of data (1 extra for the base block). It completely ignored the fact that the function was passed `num_blocks` which indicated how much memory had been allocated for the EDID. Let's fix this by adding a bounds check. This is important for handling the case where there's an error in the first block of the EDID. In that case we will call connector_bad_edid() without having re-allocated memory based on `edid[0x7e]`. Fixes: e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid corruption test") Reported-by: Ville Syrjälä Signed-off-by: Douglas Anderson Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20211005192905.v2.1.Ib059f9c23c2611cb5a9d760e7d0a700c1295928d@changeid Signed-off-by: Dave Airlie commit 6011106d129d8249baad3426fae13f147d9ffa65 Merge: 1483f0a427fe7 4157a441ff068 Author: Dave Airlie Date: Fri Oct 15 15:02:52 2021 +1000 Merge tag 'mediatek-drm-fixes-5.15' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes for Linux 5.15 1. Revert series "CMDQ refinement of Mediatek DRM driver" Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patchwork.freedesktop.org/patch/msgid/20211013235044.5488-1-chunkuang.hu@kernel.org commit a1467faa10414ab3d91be7ef6d2b11272ec00e95 Author: Philipp Zabel Date: Tue Oct 5 12:06:18 2021 +0200 ARM: imx: register reset controller from a platform driver Starting with commit 6b2117ad65f1 ("of: property: fw_devlink: Add support for "resets" and "pwms""), the imx-drm driver fails to load due to forever dormant devlinks to the reset-controller node. This node was never associated with a struct device. Add a platform device to allow fw_devnode to activate the devlinks. Fixes: 6b2117ad65f1 ("of: property: fw_devlink: Add support for "resets" and "pwms"") Signed-off-by: Philipp Zabel Tested-by: Fabio Estevam Reviewed-by: Saravana Kannan Signed-off-by: Shawn Guo commit 1483f0a427fe7d3f505923d0293436067bbd8646 Merge: 0dee6f70fd40e 82a59c7f456db Author: Dave Airlie Date: Fri Oct 15 10:00:48 2021 +1000 Merge tag 'drm-intel-fixes-2021-10-14' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15-rc6: - Fix ACPI object leak - Fix context leak in user proto-context creation - Fix missing i915_sw_fence_fini call Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87zgrbvgls.fsf@intel.com commit ec681c53f8d2d0ee362ff67f5b98dd8263c15002 Merge: 26d6574109838 1fcd794518b76 Author: Linus Torvalds Date: Thu Oct 14 18:21:39 2021 -0400 Merge tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Quite calm. The noisy DSA driver (embedded switches) changes, and adjustment to IPv6 IOAM behavior add to diffstat's bottom line but are not scary. Current release - regressions: - af_unix: rename UNIX-DGRAM to UNIX to maintain backwards compatibility - procfs: revert "add seq_puts() statement for dev_mcast", minor format change broke user space Current release - new code bugs: - dsa: fix bridge_num not getting cleared after ports leaving the bridge, resource leak - dsa: tag_dsa: send packets with TX fwd offload from VLAN-unaware bridges using VID 0, prevent packet drops if pvid is removed - dsa: mv88e6xxx: keep the pvid at 0 when VLAN-unaware, prevent HW getting confused about station to VLAN mapping Previous releases - regressions: - virtio-net: fix for skb_over_panic inside big mode - phy: do not shutdown PHYs in READY state - dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's, fix link LED staying lit after ifdown - mptcp: fix possible infinite wait on recvmsg(MSG_WAITALL) - mqprio: Correct stats in mqprio_dump_class_stats() - ice: fix deadlock for Tx timestamp tracking flush - stmmac: fix feature detection on old hardware Previous releases - always broken: - sctp: account stream padding length for reconf chunk - icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe() - isdn: cpai: check ctr->cnr to avoid array index out of bound - isdn: mISDN: fix sleeping function called from invalid context - nfc: nci: fix potential UAF of rf_conn_info object - dsa: microchip: prevent ksz_mib_read_work from kicking back in after it's canceled in .remove and crashing - dsa: mv88e6xxx: isolate the ATU databases of standalone and bridged ports - dsa: sja1105, ocelot: break circular dependency between switch and tag drivers - dsa: felix: improve timestamping in presence of packe loss - mlxsw: thermal: fix out-of-bounds memory accesses Misc: - ipv6: ioam: move the check for undefined bits to improve interoperability" * tag 'net-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits) icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe MAINTAINERS: Update the devicetree documentation path of imx fec driver sctp: account stream padding length for reconf chunk mlxsw: thermal: Fix out-of-bounds memory accesses ethernet: s2io: fix setting mac address during resume NFC: digital: fix possible memory leak in digital_in_send_sdd_req() NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() nfc: fix error handling of nfc_proto_register() Revert "net: procfs: add seq_puts() statement for dev_mcast" net: encx24j600: check error in devm_regmap_init_encx24j600 net: korina: select CRC32 net: arc: select CRC32 net: dsa: felix: break at first CPU port during init and teardown net: dsa: tag_ocelot_8021q: fix inability to inject STP BPDUs into BLOCKING ports net: dsa: felix: purge skb from TX timestamping queue if it cannot be sent net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib net: dsa: tag_ocelot: break circular dependency with ocelot switch lib driver net: mscc: ocelot: cross-check the sequence id from the timestamp FIFO with the skb PTP header net: mscc: ocelot: deny TX timestamping of non-PTP packets net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb ... commit 3e6ed7703dae6838c104d73d3e76e9b79f5c0528 Author: Florian Westphal Date: Tue Oct 12 18:37:09 2021 +0200 selftests: netfilter: remove stray bash debug line This should not be there. Fixes: 2de03b45236f ("selftests: netfilter: add flowtable test script") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 174c376278949c44aad89c514a6b5db6cee8db59 Author: Antoine Tenart Date: Tue Oct 12 16:54:37 2021 +0200 netfilter: ipvs: make global sysctl readonly in non-init netns Because the data pointer of net/ipv4/vs/debug_level is not updated per netns, it must be marked as read-only in non-init netns. Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.") Signed-off-by: Antoine Tenart Acked-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit a482c5e00a9b5a194085bcd372ac36141028becb Author: Xin Long Date: Tue Oct 12 08:18:13 2021 -0400 netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6 In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer() only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to. The access by ((const struct rt0_hdr *)rh)->reserved will overflow the buffer. So this access should be moved below the 2nd call to skb_header_pointer(). Besides, after the 2nd skb_header_pointer(), its return value should also be checked, othersize, *rp may cause null-pointer-ref. v1->v2: - clean up some old debugging log. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Dan Carpenter Signed-off-by: Xin Long Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 3ff6d64e68abc231955d216236615918797614ae Author: Shunsuke Nakamura Date: Mon Oct 11 17:37:04 2021 +0900 libperf tests: Fix test_stat_cpu The `cpu` argument of perf_evsel__read() must specify the cpu index. perf_cpu_map__for_each_cpu() is for iterating the cpu number (not index) and is thus not appropriate for use with perf_evsel__read(). So, if there is an offline CPU, the cpu number specified in the argument may point out of range because the cpu number and the cpu index are different. Fix test_stat_cpu(). Testing it: # make tests -C tools/lib/perf/ make: Entering directory '/home/nakamura/kernel_src/linux-5.15-rc4_fix/tools/lib/perf' running static: - running tests/test-cpumap.c...OK - running tests/test-threadmap.c...OK - running tests/test-evlist.c...OK - running tests/test-evsel.c...OK running dynamic: - running tests/test-cpumap.c...OK - running tests/test-threadmap.c...OK - running tests/test-evlist.c...OK - running tests/test-evsel.c...OK make: Leaving directory '/home/nakamura/kernel_src/linux-5.15-rc4_fix/tools/lib/perf' Signed-off-by: Shunsuke Nakamura Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20211011083704.4108720-1-nakamura.shun@fujitsu.com Signed-off-by: Arnaldo Carvalho de Melo commit f304c8d949f9adc2ef51304b63e49d5ea1c2d288 Author: Shunsuke Nakamura Date: Wed Oct 6 18:57:03 2021 +0900 libperf test evsel: Fix build error on !x86 architectures In test_stat_user_read, following build error occurs except i386 and x86_64 architectures: tests/test-evsel.c:129:31: error: variable 'pc' set but not used [-Werror=unused-but-set-variable] struct perf_event_mmap_page *pc; Fix build error. Signed-off-by: Shunsuke Nakamura Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20211006095703.477826-1-nakamura.shun@fujitsu.com Signed-off-by: Arnaldo Carvalho de Melo commit 8e820f962345e6ce6f4677044209f23dde39d76d Author: Alexey Bayduraev Date: Wed Sep 29 12:14:45 2021 +0300 perf report: Output non-zero offset for decompressed records Print offset of PERF_RECORD_COMPRESSED record instead of zero for decompressed records in raw trace dump (-D option of perf-report): 0x17cf08 [0x28]: event: 9 instead of: 0 [0x28]: event: 9 The fix is not critical, because currently file_pos for compressed events is used in perf_session__process_event only to show offsets in the raw dump. This patch was separated from patchset: https://lore.kernel.org/lkml/cover.1629186429.git.alexey.v.bayduraev@linux.intel.com/ and was already rewieved. Reviewed-by: Riccardo Mancini Signed-off-by: Alexey Bayduraev Tested-by: Riccardo Mancini Acked-by: Andi Kleen Acked-by: Jiri Olsa Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Antonov Cc: Alexander Shishkin Cc: Alexei Budankov Cc: Ingo Molnar Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20210929091445.18274-1-alexey.v.bayduraev@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b726ddf984a56a385c9df406a66c221f3a77c951 Author: Brett Creeley Date: Mon Sep 27 11:21:50 2021 -0700 ice: Print the api_patch as part of the fw.mgmt.api Currently when a user uses "devlink dev info", the fw.mgmt.api will be the major.minor numbers as shown below: devlink dev info pci/0000:3b:00.0 pci/0000:3b:00.0: driver ice serial_number 00-01-00-ff-ff-00-00-00 versions: fixed: board.id K91258-000 running: fw.mgmt 6.1.2 fw.mgmt.api 1.7 <--- No patch number included fw.mgmt.build 0xd75e7d06 fw.mgmt.srev 5 fw.undi 1.2992.0 fw.undi.srev 5 fw.psid.api 3.10 fw.bundle_id 0x800085cc fw.app.name ICE OS Default Package fw.app 1.3.27.0 fw.app.bundle_id 0xc0000001 fw.netlist 3.10.2000-3.1e.0 fw.netlist.build 0x2a76e110 stored: fw.mgmt.srev 5 fw.undi 1.2992.0 fw.undi.srev 5 fw.psid.api 3.10 fw.bundle_id 0x800085cc fw.netlist 3.10.2000-3.1e.0 fw.netlist.build 0x2a76e110 There are many features in the driver that depend on the major, minor, and patch version of the FW. Without the patch number in the output for fw.mgmt.api debugging issues related to the FW API version is difficult. Also, using major.minor.patch aligns with the existing firmware version which uses a 3 digit value. Fix this by making the fw.mgmt.api print the major.minor.patch versions. Shown below is the result: devlink dev info pci/0000:3b:00.0 pci/0000:3b:00.0: driver ice serial_number 00-01-00-ff-ff-00-00-00 versions: fixed: board.id K91258-000 running: fw.mgmt 6.1.2 fw.mgmt.api 1.7.9 <--- patch number included fw.mgmt.build 0xd75e7d06 fw.mgmt.srev 5 fw.undi 1.2992.0 fw.undi.srev 5 fw.psid.api 3.10 fw.bundle_id 0x800085cc fw.app.name ICE OS Default Package fw.app 1.3.27.0 fw.app.bundle_id 0xc0000001 fw.netlist 3.10.2000-3.1e.0 fw.netlist.build 0x2a76e110 stored: fw.mgmt.srev 5 fw.undi 1.2992.0 fw.undi.srev 5 fw.psid.api 3.10 fw.bundle_id 0x800085cc fw.netlist 3.10.2000-3.1e.0 fw.netlist.build 0x2a76e110 Fixes: ff2e5c700e08 ("ice: add basic handler for devlink .info_get") Signed-off-by: Brett Creeley Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit e4c2efa1393c6f1fbfabf91d1d83fcb4ae691ccb Author: Michal Swiatkowski Date: Tue Sep 14 19:25:05 2021 -0400 ice: fix getting UDP tunnel entry Correct parameters order in call to ice_tunnel_idx_to_entry function. Entry in sparse port table is correct when the idx is 0. For idx 1 one correct entry should be skipped, for idx 2 two of them should be skipped etc. Change if condition to be true when idx is 0, which means that previous valid entry of this tunnel type were skipped. Fixes: b20e6c17c468 ("ice: convert to new udp_tunnel infrastructure") Signed-off-by: Michal Swiatkowski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 73e30a62b19b9fbb4e6a3465c59da186630d5f2e Author: Dave Ertman Date: Mon Oct 4 05:15:25 2021 -0700 ice: Avoid crash from unnecessary IDA free In the remove path, there is an attempt to free the aux_idx IDA whether it was allocated or not. This can potentially cause a crash when unloading the driver on systems that do not initialize support for RDMA. But, this free cannot be gated by the status bit for RDMA, since it is allocated if the driver detects support for RDMA at probe time, but the driver can enter into a state where RDMA is not supported after the IDA has been allocated at probe time and this would lead to a memory leak. Initialize aux_idx to an invalid value and check for a valid value when unloading to determine if an IDA free is necessary. Fixes: d25a0fc41c1f9 ("ice: Initialize RDMA support") Reported-by: Jun Miao Signed-off-by: Dave Ertman Tested-by: Jesse Brandeburg Signed-off-by: Tony Nguyen commit ff7e93219442f5ac5b2cfd33e4fe4b7d5942f957 Author: Brett Creeley Date: Mon Jun 28 10:53:45 2021 -0700 ice: Fix failure to re-add LAN/RDMA Tx queues Currently if the VSI is rebuilt/removed and the RDMA PF driver is active the RDMA Tx queue scheduler node configuration will not be cleaned up. This will cause the rebuild/re-add of the VSI to fail due to the software structures not being correctly cleaned up for the VSI index. Fix this by always calling ice_rm_vsi_rdma_cfg() for all VSI. If there are no RDMA scheduler nodes created, then there is no harm in calling ice_rm_vsi_rdma_cfg(). This change applies to all VSI types, so if RDMA support is added for other VSI types they will also get this change. Fixes: 348048e724a0 ("ice: Implement iidc operations") Signed-off-by: Brett Creeley Tested-by: Jerzy Wiktor Jurkowski Signed-off-by: Tony Nguyen commit baa0ab2ba22395d85854e8d818beb1763b48f7dc Merge: 7904022decc26 be5eb93354262 Author: Jens Axboe Date: Thu Oct 14 09:07:14 2021 -0600 Merge tag 'nvme-5.15-2021-10-14' of git://git.infradead.org/nvme into block-5.15 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.15: - fix the abort command id (Keith Busch) - nvme: fix per-namespace chardev deletion (Adam Manzanares)" * tag 'nvme-5.15-2021-10-14' of git://git.infradead.org/nvme: nvme: fix per-namespace chardev deletion nvme-pci: Fix abort command id commit 14cfbb7a7856f190035f8e53045bdbfa648fae41 Author: Hao Xu Date: Thu Oct 14 22:04:00 2021 +0800 io_uring: fix wrong condition to grab uring lock Grab uring lock when we are in io-worker rather than in the original or system-wq context since we already hold it in these two situation. Signed-off-by: Hao Xu Fixes: b66ceaf324b3 ("io_uring: move iopoll reissue into regular IO path") Link: https://lore.kernel.org/r/20211014140400.50235-1-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 1fcd794518b7644169595c66b1bfe726d1f498ab Author: Xin Long Date: Thu Oct 14 05:50:50 2021 -0400 icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe In icmp_build_probe(), the icmp_ext_echo_iio parsing should be done step by step and skb_header_pointer() return value should always be checked, this patch fixes 3 places in there: - On case ICMP_EXT_ECHO_CTYPE_NAME, it should only copy ident.name from skb by skb_header_pointer(), its len is ident_len. Besides, the return value of skb_header_pointer() should always be checked. - On case ICMP_EXT_ECHO_CTYPE_INDEX, move ident_len check ahead of skb_header_pointer(), and also do the return value check for skb_header_pointer(). - On case ICMP_EXT_ECHO_CTYPE_ADDR, before accessing iio->ident.addr. ctype3_hdr.addrlen, skb_header_pointer() should be called first, then check its return value and ident_len. On subcases ICMP_AFI_IP and ICMP_AFI_IP6, also do check for ident. addr.ctype3_hdr.addrlen and skb_header_pointer()'s return value. On subcase ICMP_AFI_IP, the len for skb_header_pointer() should be "sizeof(iio->extobj_hdr) + sizeof(iio->ident.addr.ctype3_hdr) + sizeof(struct in_addr)" or "ident_len". v1->v2: - To make it more clear, call skb_header_pointer() once only for iio->indent's parsing as Jakub Suggested. v2->v3: - The extobj_hdr.length check against sizeof(_iio) should be done before calling skb_header_pointer(), as Eric noticed. Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") Reported-by: Dan Carpenter Signed-off-by: Xin Long Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/31628dd76657ea62f5cf78bb55da6b35240831f1.1634205050.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit ea142b09a6399fb2c35c07198e3f0e2423273540 Author: Cai Huoqing Date: Thu Oct 14 19:02:14 2021 +0800 MAINTAINERS: Update the devicetree documentation path of imx fec driver Change the devicetree documentation path to "Documentation/devicetree/bindings/net/fsl,fec.yaml" since 'fsl-fec.txt' has been converted to 'fsl,fec.yaml' already. Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20211014110214.3254-1-caihuoqing@baidu.com Signed-off-by: Jakub Kicinski commit a2d859e3fc97e79d907761550dbc03ff1b36479c Author: Eiichi Tsukata Date: Wed Oct 13 17:27:29 2021 -0300 sctp: account stream padding length for reconf chunk sctp_make_strreset_req() makes repeated calls to sctp_addto_chunk() which will automatically account for padding on each call. inreq and outreq are already 4 bytes aligned, but the payload is not and doing SCTP_PAD4(a + b) (which _sctp_make_chunk() did implicitly here) is different from SCTP_PAD4(a) + SCTP_PAD4(b) and not enough. It led to possible attempt to use more buffer than it was allocated and triggered a BUG_ON. Cc: Vlad Yasevich Cc: Neil Horman Cc: Greg KH Fixes: cc16f00f6529 ("sctp: add support for generating stream reconf ssn reset request chunk") Reported-by: Eiichi Tsukata Signed-off-by: Eiichi Tsukata Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: Marcelo Ricardo Leitner Reviewed-by: Xin Long Link: https://lore.kernel.org/r/b97c1f8b0c7ff79ac4ed206fc2c49d3612e0850c.1634156849.git.mleitner@redhat.com Signed-off-by: Jakub Kicinski commit 332fdf951df8b870e3da86b122ae304e2aabe88c Author: Ido Schimmel Date: Tue Oct 12 20:49:55 2021 +0300 mlxsw: thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver: # cat /sys/class/thermal/thermal_zone2/cdev0/type mlxsw_fan # cat /sys/class/thermal/thermal_zone2/cdev0/max_state 10 # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state # echo $? 0 This results in out-of-bounds memory accesses when thermal state transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the transition table is accessed with a too large index (state) [1]. According to the thermal maintainer, it is the responsibility of the driver to reject such operations [2]. Therefore, return an error when the state to be set exceeds the maximum cooling state supported by the driver. To avoid dead code, as suggested by the thermal maintainer [3], partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") that tried to interpret these invalid cooling states (above the maximum) in a special way. The cooling levels array is not removed in order to prevent the fans going below 20% PWM, which would cause them to get stuck at 0% PWM. [1] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290 Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5 CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122 Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016 Workqueue: events_freezable_power_ thermal_zone_device_check Call Trace: dump_stack_lvl+0x8b/0xb3 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b thermal_cooling_device_stats_update+0x271/0x290 __thermal_cdev_update+0x15e/0x4e0 thermal_cdev_update+0x9f/0xe0 step_wise_throttle+0x770/0xee0 thermal_zone_device_update+0x3f6/0xdf0 process_one_work+0xa42/0x1770 worker_thread+0x62f/0x13e0 kthread+0x3ee/0x4e0 ret_from_fork+0x1f/0x30 Allocated by task 1: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 thermal_cooling_device_setup_sysfs+0x153/0x2c0 __thermal_cooling_device_register.part.0+0x25b/0x9c0 thermal_cooling_device_register+0xb3/0x100 mlxsw_thermal_init+0x5c5/0x7e0 __mlxsw_core_bus_device_register+0xcb3/0x19c0 mlxsw_core_bus_device_register+0x56/0xb0 mlxsw_pci_probe+0x54f/0x710 local_pci_probe+0xc6/0x170 pci_device_probe+0x2b2/0x4d0 really_probe+0x293/0xd10 __driver_probe_device+0x2af/0x440 driver_probe_device+0x51/0x1e0 __driver_attach+0x21b/0x530 bus_for_each_dev+0x14c/0x1d0 bus_add_driver+0x3ac/0x650 driver_register+0x241/0x3d0 mlxsw_sp_module_init+0xa2/0x174 do_one_initcall+0xee/0x5f0 kernel_init_freeable+0x45a/0x4de kernel_init+0x1f/0x210 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff8881052f7800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 1016 bytes inside of 1024-byte region [ffff8881052f7800, ffff8881052f7c00) The buggy address belongs to the page: page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0 head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/ [3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/ CC: Daniel Lezcano Fixes: a50c1e35650b ("mlxsw: core: Implement thermal zone") Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") Signed-off-by: Ido Schimmel Tested-by: Vadim Pasternak Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.org Signed-off-by: Jakub Kicinski commit 40507e7aada8422c38aafa0c8a1a09e4623c712a Author: Arnd Bergmann Date: Wed Oct 13 16:35:49 2021 +0200 ethernet: s2io: fix setting mac address during resume After recent cleanups, gcc started warning about a suspicious memcpy() call during the s2io_io_resume() function: In function '__dev_addr_set', inlined from 'eth_hw_addr_set' at include/linux/etherdevice.h:318:2, inlined from 's2io_set_mac_addr' at drivers/net/ethernet/neterion/s2io.c:5205:2, inlined from 's2io_io_resume' at drivers/net/ethernet/neterion/s2io.c:8569:7: arch/x86/include/asm/string_32.h:182:25: error: '__builtin_memcpy' accessing 6 bytes at offsets 0 and 2 overlaps 4 bytes at offset 2 [-Werror=restrict] 182 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:4648:9: note: in expansion of macro 'memcpy' 4648 | memcpy(dev->dev_addr, addr, len); | ^~~~~~ What apparently happened is that an old cleanup changed the calling conventions for s2io_set_mac_addr() from taking an ethernet address as a character array to taking a struct sockaddr, but one of the callers was not changed at the same time. Change it to instead call the low-level do_s2io_prog_unicast() function that still takes the old argument type. Fixes: 2fd376884558 ("S2io: Added support set_mac_address driver entry point") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20211013143613.2049096-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 26d6574109838b8fa40a8261421693015bab0579 Author: Dinh Nguyen Date: Tue Oct 12 22:40:56 2021 -0500 MAINTAINERS: Update entry for the Stratix10 firmware Richard Gong is no longer at Intel, so update the MAINTAINER's entry for the Stratix10 firmware drivers. Signed-off-by: Dinh Nguyen Signed-off-by: Linus Torvalds commit 1626d9a35eb7aa68fe6f8097628753c8ef733e9b Merge: 348949d9a4440 48827e1d6af58 Author: Linus Torvalds Date: Thu Oct 14 09:53:36 2021 -0400 Merge tag 'sound-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This contains quite a few device-specific fixes for usual HD- and USB-audio in addition to a couple of ALSA core fixes (a UAF fix in sequencer and a fix for a misplaced PCM 32bit compat ioctl). Nothing really stands out" * tag 'sound-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add quirk for VF0770 ALSA: hda: avoid write to STATESTS if controller is in reset ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2 ALSA: hda: intel: Allow repeatedly probing on codec configuration errors ALSA: hda/realtek: Add quirk for TongFang PHxTxX1 ALSA: hda/realtek - ALC236 headset MIC recording issue ALSA: usb-audio: Enable rate validation for Scarlett devices ALSA: hda/realtek: Add quirk for Clevo X170KM-G ALSA: hda/realtek: Complete partial device name to avoid ambiguity ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254 ALSA: seq: Fix a potential UAF by wrong private_free call order ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop ALSA: usb-audio: Fix a missing error check in scarlett gen2 mixer commit aef454b40288158b850aab13e3d2a8c406779401 Author: Steven Clarkson Date: Thu Oct 14 06:35:54 2021 -0700 ALSA: hda/realtek: Add quirk for Clevo PC50HS Apply existing PCI quirk to the Clevo PC50HS and related models to fix audio output on the built in speakers. Signed-off-by: Steven Clarkson Cc: Link: https://lore.kernel.org/r/20211014133554.1326741-1-sc@lambdal.com Signed-off-by: Takashi Iwai commit 22390ce786c59328ccd13c329959dee1e8757487 Author: Greg Kroah-Hartman Date: Thu Oct 14 13:17:50 2021 +0200 ALSA: usb-audio: add Schiit Hel device to quirk table The Shciit Hel device responds to the ctl message for the mic capture switch with a timeout of -EPIPE: usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 This seems safe to ignore as the device works properly with the control message quirk, so add it to the quirk table so all is good. Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: alsa-devel@alsa-project.org Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/YWgR3nOI1osvr5Yo@kroah.com Signed-off-by: Takashi Iwai commit 16a8e2fbb2d49111004efc1c7342e083eafabeb0 Author: Uwe Kleine-König Date: Wed Oct 13 15:37:10 2021 +0200 spi-mux: Fix false-positive lockdep splats io_mutex is taken by spi_setup() and spi-mux's .setup() callback calls spi_setup() which results in a nested lock of io_mutex. add_lock is taken by spi_add_device(). The device_add() call in there can result in calling spi-mux's .probe() callback which registers its own spi controller which in turn results in spi_add_device() being called again. To fix this initialize the controller's locks already in spi_alloc_controller() to give spi_mux_probe() a chance to set the lockdep subclass. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20211013133710.2679703-2-u.kleine-koenig@pengutronix.de Signed-off-by: Mark Brown commit 6098475d4cb48d821bdf453c61118c56e26294f0 Author: Mark Brown Date: Fri Oct 8 14:31:57 2021 +0100 spi: Fix deadlock when adding SPI controllers on SPI buses Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock. This can be easily triggered in the case of spi-mux. Reported-by: Uwe Kleine-König Signed-off-by: Mark Brown commit 6ab4e2eb5e956a61e4d53cea3ab8c866ba79a830 Author: Andy Shevchenko Date: Wed Oct 13 23:17:18 2021 +0300 mmc: sdhci-pci: Read card detect from ACPI for Intel Merrifield Intel Merrifield platform had been converted to use ACPI enumeration. However, the driver missed an update to retrieve card detect GPIO. Fix it here. Unfortunately we can't rely on CD GPIO state because there are two different PCB designs in the wild that are using the opposite card detection sense and there is no way to distinguish those platforms, that's why ignore CD GPIO completely and use it only as an event. Fixes: 4590d98f5a4f ("sfi: Remove framework for deprecated firmware") BugLink: https://github.com/edison-fw/meta-intel-edison/issues/135 Signed-off-by: Andy Shevchenko Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211013201723.52212-2-andriy.shevchenko@linux.intel.com Signed-off-by: Ulf Hansson commit d9b7748ffc45250b4d7bcf22404383229bc495f5 Author: Hans Potsch Date: Wed Oct 6 14:13:32 2021 +0200 EDAC/armada-xp: Fix output of uncorrectable error counter The number of correctable errors is displayed as uncorrectable errors because the "SBE" error count is passed to both calls of edac_mc_handle_error(). Pass the correct uncorrectable error count to the second edac_mc_handle_error() call when logging uncorrectable errors. [ bp: Massage commit message. ] Fixes: 7f6998a41257 ("ARM: 8888/1: EDAC: Add driver for the Marvell Armada XP SDRAM and L2 cache ECC") Signed-off-by: Hans Potsch Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20211006121332.58788-1-hans.potsch@nokia.com commit be5eb933542629ad6a7d4c92097b1b472b1612d0 Author: Adam Manzanares Date: Wed Oct 13 15:04:19 2021 +0000 nvme: fix per-namespace chardev deletion Decrease reference count of chardevice during char device deletion in order to fix a memory leak. Add a release callabck for the device associated chardev and move ida_simple_remove into the release function. Fixes: 2637baed7801 ("nvme: introduce generic per-namespace chardev") Reported-by: Yi Zhang Suggested-by: Sagi Grimberg Signed-off-by: Adam Manzanares Reviewed-by: Javier González Tested-by: Yi Zhang Signed-off-by: Christoph Hellwig commit dbad63001eac3abeeb2b66ddf71504e8ab128c5c Author: Namjae Jeon Date: Mon Oct 11 19:15:25 2021 +0900 ksmbd: validate compound response buffer Add the check to validate compound response buffer. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9a63b999ae5435d82a5c353c6b1467100f857742 Author: Namjae Jeon Date: Mon Oct 11 12:48:31 2021 +0900 ksmbd: fix potencial 32bit overflow from data area check in smb2_write DataOffset and Length validation can be potencial 32bit overflow. This patch fix it. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit bf8acc9e10e21c28452dfa067a7d31e6067104b1 Author: Hyunchul Lee Date: Thu Oct 7 16:26:58 2021 +0900 ksmbd: improve credits management * Requests except READ, WRITE, IOCTL, INFO, QUERY DIRECOTRY, CANCEL must consume one credit. * If client's granted credits are insufficient, refuse to handle requests. * Windows server 2016 or later grant up to 8192 credits to clients at once. Acked-by: Namjae Jeon Signed-off-by: Hyunchul Lee Signed-off-by: Steve French commit f7db8fd03a4bc5baf70ccf8978fe17cb54368b97 Author: Namjae Jeon Date: Fri Oct 8 07:31:03 2021 +0900 ksmbd: add validation in smb2_ioctl Add validation for request/response buffer size check in smb2_ioctl and fsctl_copychunk() take copychunk_ioctl_req pointer and the other arguments instead of smb2_ioctl_req structure and remove an unused smb2_ioctl_req argument of fsctl_validate_negotiate_info. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Cc: Sergey Senozhatsky Acked-by: Hyunchul Lee Signed-off-by: Colin Ian King Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 776c75010803849c1cc4f11031a2b3960ab05202 Author: Wang Hai Date: Wed Oct 13 14:16:31 2021 +0800 ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() I got a null-ptr-deref report: KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] ... RIP: 0010:regulator_enable+0x84/0x260 ... Call Trace: ahci_platform_enable_regulators+0xae/0x320 ahci_platform_enable_resources+0x1a/0x120 ahci_probe+0x4f/0x1b9 platform_probe+0x10b/0x280 ... entry_SYSCALL_64_after_hwframe+0x44/0xae If devm_regulator_get() in ahci_platform_get_resources() fails, hpriv->phy_regulator will point to NULL, when enabling or disabling it, null-ptr-deref will occur. ahci_probe() ahci_platform_get_resources() devm_regulator_get(, "phy") // failed, let phy_regulator = NULL ahci_platform_enable_resources() ahci_platform_enable_regulators() regulator_enable(hpriv->phy_regulator) // null-ptr-deref commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() misuse") replaces devm_regulator_get_optional() with devm_regulator_get(), but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI. Delete it like AHCI regulator to fix this bug. Fixes: commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() misuse") Reported-by: Hulk Robot Signed-off-by: Wang Hai Reviewed-by: Hans de Goede Signed-off-by: Damien Le Moal commit cbcc5072c228cca6b060143159f3ca8d485778d7 Merge: 0911ab31896f0 291c932fc3692 Author: Jakub Kicinski Date: Wed Oct 13 17:44:32 2021 -0700 Merge branch 'fix-two-possible-memory-leak-problems-in-nfc-digital-module' Ziyang Xuan says: ==================== Fix two possible memory leak problems in NFC digital module. ==================== Link: https://lore.kernel.org/r/cover.1634111083.git.william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski commit 291c932fc3692e4d211a445ba8aa35663831bac7 Author: Ziyang Xuan Date: Wed Oct 13 15:50:32 2021 +0800 NFC: digital: fix possible memory leak in digital_in_send_sdd_req() 'skb' is allocated in digital_in_send_sdd_req(), but not free when digital_in_send_cmd() failed, which will cause memory leak. Fix it by freeing 'skb' if digital_in_send_cmd() return failed. Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Signed-off-by: Ziyang Xuan Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 Author: Ziyang Xuan Date: Wed Oct 13 15:50:12 2021 +0800 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() 'params' is allocated in digital_tg_listen_mdaa(), but not free when digital_send_cmd() failed, which will cause memory leak. Fix it by freeing 'params' if digital_send_cmd() return failed. Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support") Signed-off-by: Ziyang Xuan Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit 0911ab31896f0e908540746414a77dd63912748d Author: Ziyang Xuan Date: Wed Oct 13 11:49:32 2021 +0800 nfc: fix error handling of nfc_proto_register() When nfc proto id is using, nfc_proto_register() return -EBUSY error code, but forgot to unregister proto. Fix it by adding proto_unregister() in the error handling case. Fixes: c7fe3b52c128 ("NFC: add NFC socket family") Signed-off-by: Ziyang Xuan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20211013034932.2833737-1-william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski commit 1f922d9e374f0ca7d1b241666c792f403c6120aa Author: Vladimir Oltean Date: Wed Oct 13 03:19:09 2021 +0300 Revert "net: procfs: add seq_puts() statement for dev_mcast" This reverts commit ec18e8455484370d633a718c6456ddbf6eceef21. It turns out that there are user space programs which got broken by that change. One example is the "ifstat" program shipped by Debian: https://packages.debian.org/source/bullseye/ifstat which, confusingly enough, seems to not have anything in common with the much more familiar (at least to me) ifstat program from iproute2: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/misc/ifstat.c root@debian:~# ifstat ifstat: /proc/net/dev: unsupported format. This change modified the header (first two lines of text) in /proc/net/dev so that it looks like this: root@debian:~# cat /proc/net/dev Interface| Receive | Transmit | bytes packets errs drop fifo frame compressed multicast| bytes packets errs drop fifo colls carrier compressed lo: 97400 1204 0 0 0 0 0 0 97400 1204 0 0 0 0 0 0 bond0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sit0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 eno2: 5002206 6651 0 0 0 0 0 0 105518642 1465023 0 0 0 0 0 0 swp0: 134531 2448 0 0 0 0 0 0 99599598 1464381 0 0 0 0 0 0 swp1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 swp2: 4867675 4203 0 0 0 0 0 0 58134 631 0 0 0 0 0 0 sw0p0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw0p1: 124739 2448 0 1422 0 0 0 0 93741184 1464369 0 0 0 0 0 0 sw0p2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p0: 4850863 4203 0 0 0 0 0 0 54722 619 0 0 0 0 0 0 sw2p1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p3: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 br0: 10508 212 0 212 0 0 0 212 61369558 958857 0 0 0 0 0 0 whereas before it looked like this: root@debian:~# cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed lo: 13160 164 0 0 0 0 0 0 13160 164 0 0 0 0 0 0 bond0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sit0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 eno2: 30824 268 0 0 0 0 0 0 3332 37 0 0 0 0 0 0 swp0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 swp1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 swp2: 30824 268 0 0 0 0 0 0 2428 27 0 0 0 0 0 0 sw0p0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw0p1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw0p2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p0: 29752 268 0 0 0 0 0 0 1564 17 0 0 0 0 0 0 sw2p1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 sw2p3: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 The reason why the ifstat shipped by Debian (v1.1, with a Debian patch upgrading it to 1.1-8.1 at the time of writing) is broken is because its "proc" driver/backend parses the header very literally: main/drivers.c#L825 if (!data->checked && strncmp(buf, "Inter-|", 7)) goto badproc; and there's no way in which the header can be changed such that programs parsing like that would not get broken. Even if we fix this ancient and very "lightly" maintained program to parse the text output of /proc/net/dev in a more sensible way, this story seems bound to repeat again with other programs, and modifying them all could cause more trouble than it's worth. On the other hand, the reverted patch had no other reason than an aesthetic one, so reverting it is the simplest way out. I don't know what other distributions would be affected; the fact that Debian doesn't ship the iproute2 version of the program (a different code base altogether, which uses netlink and not /proc/net/dev) is surprising in itself. Fixes: ec18e8455484 ("net: procfs: add seq_puts() statement for dev_mcast") Link: https://lore.kernel.org/netdev/20211009163511.vayjvtn3rrteglsu@skbuf/ Cc: Yajun Deng Cc: Matthieu Baerts Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20211013001909.3164185-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0282b0f0126489af5b3993e52d1a05e6c7ebc4e8 Author: Steven Rostedt (VMware) Date: Wed Oct 13 16:51:13 2021 -0400 selftests/ftrace: Update test for more eprobe removal process The removal of eprobes was broken and missed in testing. Add various ways to remove eprobes that are considered acceptable to the testing process to catch when/if they break again. Link: https://lkml.kernel.org/r/20211013205533.836644549@goodmis.org Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 7d5fda1c841f9f3930eed61b92d542137f93fc30 Author: Steven Rostedt (VMware) Date: Wed Oct 13 16:51:12 2021 -0400 tracing: Fix event probe removal from dynamic events When an event probe is to be removed via the API that created it via the dynamic events, an -ENOENT error is returned. This is because the removal of the event probe does not expect to see the event system and name that the event probe is attached to, even though that's part of the API to create it. As the removal of probes is to use the same API as they are created. In fact, the removal is not consistent with the kprobes and uprobes removal. Fix that by allowing various ways to remove the eprobe. The eprobe is created with: e:[GROUP/]NAME SYSTEM/EVENT [OPTIONS] Have it get removed by echoing in the following into dynamic_events: # Remove all eprobes with NAME echo '-:NAME' >> dynamic_events # Remove a specific eprobe echo '-:GROUP/NAME' >> dynamic_events echo '-:GROUP/NAME SYSTEM/EVENT' >> dynamic_events echo '-:NAME SYSTEM/EVENT' >> dynamic_events echo '-:GROUP/NAME SYSTEM/EVENT OPTIONS' >> dynamic_events echo '-:NAME SYSTEM/EVENT OPTIONS' >> dynamic_events Link: https://lkml.kernel.org/r/20211012081925.0e19cc4f@gandalf.local.home Link: https://lkml.kernel.org/r/20211013205533.630722129@goodmis.org Suggested-by: Masami Hiramatsu Acked-by: Masami Hiramatsu Fixes: 7491e2c442781 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Steven Rostedt (VMware) commit c370bb474016ab9edfdabd7c08a88dd13a71ddbd Author: Fabien Dessenne Date: Fri Oct 8 14:25:17 2021 +0200 pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() When resuming from low power, the driver attempts to restore the configuration of some pins. This is done by a call to: stm32_pinctrl_restore_gpio_regs(struct stm32_pinctrl *pctl, u32 pin) where 'pin' must be a valid pin value (i.e. matching some 'groups->pin'). Fix the current implementation which uses some wrong 'pin' value. Fixes: e2f3cf18c3e2 ("pinctrl: stm32: add suspend/resume management") Signed-off-by: Fabien Dessenne Link: https://lore.kernel.org/r/20211008122517.617633-1-fabien.dessenne@foss.st.com Signed-off-by: Linus Walleij commit 6dba4bdfd7a30e77b848a45404b224588bf989e5 Author: Rafał Miłecki Date: Fri Oct 8 22:59:38 2021 +0200 Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" This reverts commit a49d784d5a8272d0f63c448fe8dc69e589db006e. The updated binding was wrong / invalid and has been reverted. There isn't any upstream kernel DTS using it and Broadcom isn't known to use it neither. There is close to zero chance this will cause regression for anyone. Actually in-kernel bcm5301x.dtsi still uses the old good binding and so it's broken since the driver update. This revert fixes it. Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20211008205938.29925-3-zajec5@gmail.com Signed-off-by: Linus Walleij commit 1d0a779892e8aae484e11bf5f28fb41d49e8b0f6 Author: Rafał Miłecki Date: Fri Oct 8 22:59:37 2021 +0200 dt-bindings: pinctrl: brcm,ns-pinmux: drop unneeded CRU from example There is no need to include CRU in example of this binding. It wasn't complete / correct anyway. The proper binding can be find in the mfd/brcm,cru.yaml . Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20211008205938.29925-2-zajec5@gmail.com Signed-off-by: Linus Walleij commit 0398adaec3419bdfa93baae70a3b696b4abdd7ad Author: Rafał Miłecki Date: Fri Oct 8 22:59:36 2021 +0200 Revert "dt-bindings: pinctrl: bcm4708-pinmux: rework binding to use syscon" This reverts commit 2ae80900f239484069569380e1fc4340fd6e0089. My rework was unneeded & wrong. It replaced a clear & correct "reg" property usage with a custom "offset" one. Back then I didn't understand how to properly handle CRU block binding. I heard / read about syscon and tried to use it in a totally invalid way. That change also missed Rob's review (obviously). Northstar's pin controller is a simple consistent hardware block that can be cleanly mapped using a 0x24 long reg space. Since the rework commit there wasn't any follow up modifying in-kernel DTS files to use the new binding. Broadcom also isn't known to use that bugged binding. There is close to zero chance this revert may actually cause problems / regressions. This commit is a simple revert. Example binding may (should) be updated / cleaned up but that can be handled separately. Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20211008205938.29925-1-zajec5@gmail.com Signed-off-by: Linus Walleij commit f03dca0c9e2297c84a018e306f8a9cd534ee4287 Author: Nanyong Sun Date: Tue Oct 12 20:59:01 2021 +0800 net: encx24j600: check error in devm_regmap_init_encx24j600 devm_regmap_init may return error which caused by like out of memory, this will results in null pointer dereference later when reading or writing register: general protection fault in encx24j600_spi_probe KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540 Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00 RSP: 0018:ffffc900010476b8 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000 RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094 RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001 R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08 FS: 00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459 spi_probe drivers/spi/spi.c:397 really_probe drivers/base/dd.c:517 __driver_probe_device drivers/base/dd.c:751 driver_probe_device drivers/base/dd.c:782 __device_attach_driver drivers/base/dd.c:899 bus_for_each_drv drivers/base/bus.c:427 __device_attach drivers/base/dd.c:971 bus_probe_device drivers/base/bus.c:487 device_add drivers/base/core.c:3364 __spi_add_device drivers/spi/spi.c:599 spi_add_device drivers/spi/spi.c:641 spi_new_device drivers/spi/spi.c:717 new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e] dev_attr_store drivers/base/core.c:2074 sysfs_kf_write fs/sysfs/file.c:139 kernfs_fop_write_iter fs/kernfs/file.c:300 new_sync_write fs/read_write.c:508 (discriminator 4) vfs_write fs/read_write.c:594 ksys_write fs/read_write.c:648 do_syscall_64 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113 Add error check in devm_regmap_init_encx24j600 to avoid this situation. Fixes: 04fbfce7a222 ("net: Microchip encx24j600 driver") Reported-by: Hulk Robot Signed-off-by: Nanyong Sun Link: https://lore.kernel.org/r/20211012125901.3623144-1-sunnanyong@huawei.com Signed-off-by: Jakub Kicinski commit b70b15217383e0e1c2ee9793e84f6b7957a33db9 Merge: 427f974d9727c 84c8a87402cf0 Author: Jakub Kicinski Date: Wed Oct 13 13:39:54 2021 -0700 Merge tag 'mlx5-fixes-2021-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2021-10-12 * tag 'mlx5-fixes-2021-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Fix division by 0 in mlx5e_select_queue for representors net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp net/mlx5e: Switchdev representors are not vlan challenged net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: Allow only complete TXQs partition in MQPRIO channel mode net/mlx5: Fix cleanup of bridge delayed work ==================== Link: https://lore.kernel.org/r/20211012205323.20123-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 427f974d9727ca681085ddcd0530c97ab5811ae0 Author: Vegard Nossum Date: Tue Oct 12 17:25:09 2021 +0200 net: korina: select CRC32 Fix the following build/link error by adding a dependency on the CRC32 routines: ld: drivers/net/ethernet/korina.o: in function `korina_multicast_list': korina.c:(.text+0x1af): undefined reference to `crc32_le' Fixes: ef11291bcd5f9 ("Add support the Korina (IDT RC32434) Ethernet MAC") Cc: Arnd Bergmann Signed-off-by: Vegard Nossum Acked-by: Florian fainelli Link: https://lore.kernel.org/r/20211012152509.21771-1-vegard.nossum@oracle.com Signed-off-by: Jakub Kicinski commit 0f0f80d9d5db0b9a78a6ec74714f08b7b8bda0de Author: Arnd Bergmann Date: Sun Oct 10 19:27:03 2021 +0200 iommu/arm: fix ARM_SMMU_QCOM compilation My previous bugfix ended up making things worse for the QCOM IOMMU driver when it forgot to add the Kconfig symbol that is getting used to control the compilation of the SMMU implementation specific code for Qualcomm. Fixes: 424953cf3c66 ("qcom_scm: hide Kconfig symbol") Reported-by: Daniel Lezcano Reported-by: Dmitry Baryshkov Reported-by: John Stultz Link: https://lore.kernel.org/lkml/20211010023350.978638-1-dmitry.baryshkov@linaro.org/ Acked-by: Will Deacon Signed-off-by: Arnd Bergmann commit 3536ac5d771bf7c68e70b08f7a7ec85ff56c6b6d Merge: 047051295201d 7f565d0ead264 Author: Arnd Bergmann Date: Wed Oct 13 21:17:07 2021 +0200 Merge tag 'optee-fix2-for-v5.15' of git://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fix missing devices unregister during optee_remove Unregisters OP-TEE client devices (UUIDs of some known Trusted Applications) from the TEE bus when the OP-TEE driver is unloaded. * tag 'optee-fix2-for-v5.15' of git://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: Fix missing devices unregister during optee_remove Link: https://lore.kernel.org/r/20211013122854.GA1542549@jade Signed-off-by: Arnd Bergmann commit 047051295201def0bd95936b67cc683658d3ddc2 Merge: 209ee634bc0d2 bc22b6208f416 Author: Arnd Bergmann Date: Wed Oct 13 20:57:12 2021 +0200 Merge tag 'arm-soc/for-5.15/devicetree' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 5.15, please pull the following: - Stefan fixes the VEC (video encoder) bus address for 2711, fixes the MDIO bus controller #address-cells/#size-cells inversion and the SDIO regulator voltage ranges - Nicolas fixes DTC warnings for the PCIe host bridge and its child USB device * tag 'arm-soc/for-5.15/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states ARM: dts: bcm2711: fix MDIO #address- and #size-cells ARM: dts: bcm283x: Fix VEC address for BCM2711 Link: https://lore.kernel.org/r/20211012213841.1872021-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 92c02ff1a43edce37cf1b092bfad37d84d7e4ea6 Author: Luca Weiss Date: Thu Oct 7 23:24:28 2021 +0200 clk: qcom: add select QCOM_GDSC for SM6350 QCOM_GDSC is needed for the gcc driver to probe. Fixes: 131abae905df ("clk: qcom: Add SM6350 GCC driver") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20211007212444.328034-2-luca@z3ntu.xyz Signed-off-by: Stephen Boyd commit e41bdd18644a5dde1f344b70eb262b5c426e6f16 Author: Shawn Guo Date: Sun Sep 19 10:23:08 2021 +0800 clk: qcom: gcc-sm6115: Fix offset for hlos1_vote_turing_mmu_tbu0_gdsc It looks that the offset 0x7d060 is a copy & paste from above hlos1_vote_turing_mmu_tbu1_gdsc. Correct it to 0x7d07c as per downstream kernel. Fixes: cbe63bfdc54f ("clk: qcom: Add Global Clock controller (GCC) driver for SM6115") Signed-off-by: Shawn Guo Link: https://lore.kernel.org/r/20210919022308.24046-1-shawn.guo@linaro.org Signed-off-by: Stephen Boyd commit 663991f32857b3b63c94c97de9dbb0ec8600144f Author: Dan Carpenter Date: Wed Oct 13 11:06:45 2021 +0300 RDMA/rdmavt: Fix error code in rvt_create_qp() Return negative -ENOMEM instead of positive ENOMEM. Returning a postive value will cause an Oops because it becomes an ERR_PTR() in the create_qp() function. Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Link: https://lore.kernel.org/r/20211013080645.GD6010@kili Signed-off-by: Dan Carpenter Acked-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 13bac861952a78664907a0f927d3e874e9a59034 Author: Mike Marciniszyn Date: Wed Oct 13 10:18:52 2021 -0400 IB/hfi1: Fix abba locking issue with sc_disable() sc_disable() after having disabled the send context wakes up any waiters by calling hfi1_qp_wakeup() while holding the waitlock for the sc. This is contrary to the model for all other calls to hfi1_qp_wakeup() where the waitlock is dropped and a local is used to drive calls to hfi1_qp_wakeup(). Fix by moving the sc->piowait into a local list and driving the wakeup calls from the list. Fixes: 099a884ba4c0 ("IB/hfi1: Handle wakeup of orphaned QPs for pio") Link: https://lore.kernel.org/r/20211013141852.128104.2682.stgit@awfm-01.cornelisnetworks.com Signed-off-by: Mike Marciniszyn Reported-by: TOTE Robot Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit d39bf40e55e666b5905fdbd46a0dced030ce87be Author: Mike Marciniszyn Date: Tue Oct 12 13:55:19 2021 -0400 IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers. Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") Link: https://lore.kernel.org/r/20211012175519.7298.77738.stgit@awfm-01.cornelisnetworks.com Reported-by: Ilja Van Sprundel Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit e599ee234ad4fdfe241d937bbabd96e0d8f9d868 Author: Vegard Nossum Date: Tue Oct 12 11:34:46 2021 +0200 net: arc: select CRC32 Fix the following build/link error by adding a dependency on the CRC32 routines: ld: drivers/net/ethernet/arc/emac_main.o: in function `arc_emac_set_rx_mode': emac_main.c:(.text+0xb11): undefined reference to `crc32_le' The crc32_le() call comes through the ether_crc_le() call in arc_emac_set_rx_mode(). [v2: moved the select to ARC_EMAC_CORE; the Makefile is a bit confusing, but the error comes from emac_main.o, which is part of the arc_emac module, which in turn is enabled by CONFIG_ARC_EMAC_CORE. Note that arc_emac is different from emac_arc...] Fixes: 775dd682e2b0ec ("arc_emac: implement promiscuous mode and multicast filtering") Cc: Arnd Bergmann Signed-off-by: Vegard Nossum Link: https://lore.kernel.org/r/20211012093446.1575-1-vegard.nossum@oracle.com Signed-off-by: Jakub Kicinski commit 6b9b546dc00797c74bef491668ce5431ff54e1e2 Author: Shengjiu Wang Date: Wed Oct 13 13:17:04 2021 +0800 ASoC: wm8960: Fix clock configuration on slave mode There is a noise issue for 8kHz sample rate on slave mode. Compared with master mode, the difference is the DACDIV setting, after correcting the DACDIV, the noise is gone. There is no noise issue for 48kHz sample rate, because the default value of DACDIV is correct for 48kHz. So wm8960_configure_clocking() should be functional for ADC and DAC function even if it is slave mode. In order to be compatible for old use case, just add condition for checking that sysclk is zero with slave mode. Fixes: 0e50b51aa22f ("ASoC: wm8960: Let wm8960 driver configure its bit clock and frame clock") Signed-off-by: Shengjiu Wang Acked-by: Charles Keepax Link: https://lore.kernel.org/r/1634102224-3922-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 348949d9a4440abdab3b1dc99a9bb660e8c7da7c Merge: f4d0cc426f77d 0d67e332e6df7 Author: Linus Torvalds Date: Wed Oct 13 07:42:07 2021 -0700 Merge tag 'modules-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules fix from Jessica Yu: - Build fix for cfi_init() when CONFIG_MODULE_UNLOAD=n * tag 'modules-for-v5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: module: fix clang CFI with MODULE_UNLOAD=n commit 5d388fa01fa6eb310ac023a363a6cb216d9d8fe9 Author: Stephen Boyd Date: Wed Oct 13 13:45:11 2021 +0100 nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we subtract one from that making a large number that is then shifted more than the number of bits that fit into an unsigned long. UBSAN reports this problem: UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9 Hardware name: Google Lazor (rev3+) with KB Backlight (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x0/0x170 show_stack+0x24/0x30 dump_stack_lvl+0x64/0x7c dump_stack+0x18/0x38 ubsan_epilogue+0x10/0x54 __ubsan_handle_shift_out_of_bounds+0x180/0x194 __nvmem_cell_read+0x1ec/0x21c nvmem_cell_read+0x58/0x94 nvmem_cell_read_variable_common+0x4c/0xb0 nvmem_cell_read_variable_le_u32+0x40/0x100 a6xx_gpu_init+0x170/0x2f4 adreno_bind+0x174/0x284 component_bind_all+0xf0/0x264 msm_drm_bind+0x1d8/0x7a0 try_to_bring_up_master+0x164/0x1ac __component_add+0xbc/0x13c component_add+0x20/0x2c dp_display_probe+0x340/0x384 platform_probe+0xc0/0x100 really_probe+0x110/0x304 __driver_probe_device+0xb8/0x120 driver_probe_device+0x4c/0xfc __device_attach_driver+0xb0/0x128 bus_for_each_drv+0x90/0xdc __device_attach+0xc8/0x174 device_initial_probe+0x20/0x2c bus_probe_device+0x40/0xa4 deferred_probe_work_func+0x7c/0xb8 process_one_work+0x128/0x21c process_scheduled_works+0x40/0x54 worker_thread+0x1ec/0x2a8 kthread+0x138/0x158 ret_from_fork+0x10/0x20 Fix it by making sure there are any bits to mask out. Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers") Cc: Douglas Anderson Cc: stable@vger.kernel.org Signed-off-by: Stephen Boyd Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20211013124511.18726-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit bcef9356fc2e1302daf373c83c826aa27954d128 Author: Cindy Lu Date: Wed Sep 29 17:09:33 2021 +0800 vhost-vdpa: Fix the wrong input in config_cb Fix the wrong input in for config_cb. In function vhost_vdpa_config_cb, the input cb.private was used as struct vhost_vdpa, so the input was wrong here, fix this issue Fixes: 776f395004d8 ("vhost_vdpa: Support config interrupt in vdpa") Signed-off-by: Cindy Lu Link: https://lore.kernel.org/r/20210929090933.20465-1-lulu@redhat.com Signed-off-by: Michael S. Tsirkin commit 09b6addf64860bf7b0e3dddf03229c8c20eda4b5 Author: Randy Dunlap Date: Wed Oct 6 13:29:04 2021 -0700 VDUSE: fix documentation underline warning Fix a VDUSE documentation build warning: Documentation/userspace-api/vduse.rst:21: WARNING: Title underline too short. Fixes: 7bc7f61897b6 ("Documentation: Add documentation for VDUSE") Signed-off-by: Randy Dunlap Cc: Xie Yongji Cc: Jason Wang Cc: Michael S. Tsirkin Cc: virtualization@lists.linux-foundation.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/20211006202904.30241-1-rdunlap@infradead.org Signed-off-by: Michael S. Tsirkin Reviewed-by: Xie Yongji Acked-by: Jason Wang commit 8b7216439e2e2128f6f1a19ad4b6be94d8b0e23d Author: Heiko Carstens Date: Wed Oct 13 11:45:38 2021 +0200 s390: add Alexander Gordeev as reviewer Alexander Gordeev will help reviewing s390 code. Acked-by: Alexander Gordeev Acked-by: Vasily Gorbik Acked-by: Christian Borntraeger Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ff63198850f33eab54b2da6905380fd4d4fc0739 Author: Michael S. Tsirkin Date: Mon Oct 4 11:31:00 2021 -0400 Revert "virtio-blk: Add validation for block size in config space" It turns out that access to config space before completing the feature negotiation is broken for big endian guests at least with QEMU hosts up to 6.1 inclusive. This affects any device that accesses config space in the validate callback: at the moment that is virtio-net with VIRTIO_NET_F_MTU but since 82e89ea077b9 ("virtio-blk: Add validation for block size in config space") that also started affecting virtio-blk with VIRTIO_BLK_F_BLK_SIZE. Further, unlike VIRTIO_NET_F_MTU which is off by default on QEMU, VIRTIO_BLK_F_BLK_SIZE is on by default, which resulted in lots of people not being able to boot VMs on BE. The spec is very clear that what we are doing is legal so QEMU needs to be fixed, but given it's been broken for so many years and no one noticed, we need to give QEMU a bit more time before applying this. Further, this patch is incomplete (does not check blk size is a power of two) and it duplicates the logic from nbd. Revert for now, and we'll reapply a cleaner logic in the next release. Cc: stable@vger.kernel.org Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in config space") Cc: Xie Yongji Signed-off-by: Michael S. Tsirkin commit 97f854be203883b61d24f230445bd533bbdf770c Author: Wu Zongyong Date: Wed Sep 15 14:39:32 2021 +0800 vhost_vdpa: unset vq irq before freeing irq Currently we unset vq irq after freeing irq and that will result in error messages: pi_update_irte: failed to update PI IRTE irq bypass consumer (token 000000005a07a12b) unregistration fails: -22 This patch solves this. Signed-off-by: Wu Zongyong Link: https://lore.kernel.org/r/02637d38dcf4e4b836c5b3a65055fe92bf812b3b.1631687872.git.wuzongyong@linux.alibaba.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 2f9a174f918e29608564c7a4e8329893ab604fb4 Author: Halil Pasic Date: Mon Oct 11 07:39:21 2021 +0200 virtio: write back F_VERSION_1 before validate The virtio specification virtio-v1.1-cs01 states: "Transitional devices MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not been acknowledged by the driver." This is exactly what QEMU as of 6.1 has done relying solely on VIRTIO_F_VERSION_1 for detecting that. However, the specification also says: "... the driver MAY read (but MUST NOT write) the device-specific configuration fields to check that it can support the device ..." before setting FEATURES_OK. In that case, any transitional device relying solely on VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in legacy format. In particular, this implies that it is in big endian format for big endian guests. This naturally confuses the driver which expects little endian in the modern mode. It is probably a good idea to amend the spec to clarify that VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation is complete. Before validate callback existed, config space was only read after FEATURES_OK. However, we already have two regressions, so let's address this here as well. The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when virtio 1.0 is used on both sides. The latter renders virtio-blk unusable with DASD backing, because things simply don't work with the default. See Fixes tags for relevant commits. For QEMU, we can work around the issue by writing out the feature bits with VIRTIO_F_VERSION_1 bit set. We (ab)use the finalize_features config op for this. This isn't enough to address all vhost devices since these do not get the features until FEATURES_OK, however it looks like the affected devices actually never handled the endianness for legacy mode correctly, so at least that's not a regression. No devices except virtio net and virtio blk seem to be affected. Long term the right thing to do is to fix the hypervisors. Cc: #v4.11 Signed-off-by: Halil Pasic Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in config space") Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range") Reported-by: markver@us.ibm.com Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20211011053921.1198936-1-pasic@linux.ibm.com Signed-off-by: Michael S. Tsirkin commit c2115b2b16421d93d4993f3fe4c520e91d6fe801 Author: Miquel Raynal Date: Wed Oct 6 00:16:31 2021 +0200 usb: musb: dsps: Fix the probe error path Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after initializing musb") has inverted the calls to dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without updating correctly the error path. dsps_create_musb_pdev() allocates and registers a new platform device which must be unregistered and freed with platform_device_unregister(), and this is missing upon dsps_setup_optional_vbus_irq() error. While on the master branch it seems not to trigger any issue, I observed a kernel crash because of a NULL pointer dereference with a v5.10.70 stable kernel where the patch mentioned above was backported. With this kernel version, -EPROBE_DEFER is returned the first time dsps_setup_optional_vbus_irq() is called which triggers the probe to error out without unregistering the platform device. Unfortunately, on the Beagle Bone Black Wireless, the platform device still living in the system is being used by the USB Ethernet gadget driver, which during the boot phase triggers the crash. My limited knowledge of the musb world prevents me to revert this commit which was sent to silence a robot warning which, as far as I understand, does not make sense. The goal of this patch was to prevent an IRQ to fire before the platform device being registered. I think this cannot ever happen due to the fact that enabling the interrupts is done by the ->enable() callback of the platform musb device, and this platform device must be already registered in order for the core or any other user to use this callback. Hence, I decided to fix the error path, which might prevent future errors on mainline kernels while also fixing older ones. Fixes: 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after initializing musb") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20211005221631.1529448-1-miquel.raynal@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 82a59c7f456db9f2874e9f1e9cb4cc19e71e95c5 Author: Zenghui Yu Date: Mon Sep 6 11:35:41 2021 +0800 drm/i915: Free the returned object of acpi_evaluate_dsm() As per the comment on top of acpi_evaluate_dsm(): | * Evaluate device's _DSM method with specified GUID, revision id and | * function number. Caller needs to free the returned object. We should free the returned object of acpi_evaluate_dsm() to avoid memory leakage. Otherwise the kmemleak splat will be triggered at boot time (if we compile kernel with CONFIG_DEBUG_TEST_DRIVER_REMOVE=y). Fixes: 8e55f99c510f ("drm/i915: Invoke another _DSM to enable MUX on HP Workstation laptops") Cc: Kai-Heng Feng Signed-off-by: Zenghui Yu Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20210906033541.862-1-yuzenghui@huawei.com (cherry picked from commit 149ac2e7ae1845191bd18b66a725392ac83a0c47) Signed-off-by: Jani Nikula commit af628cdd64e11f03181a5a19645768ed4687bda4 Author: Matthew Brost Date: Fri Oct 1 08:58:25 2021 -0700 drm/i915: Fix bug in user proto-context creation that leaked contexts Set number of engines before attempting to create contexts so the function free_engines can clean up properly. Also check return of alloc_engines for NULL. v2: (Tvrtko) - Send as stand alone patch (John Harrison) - Check for alloc_engines returning NULL v3: (Checkpatch / Tvrtko) - Remove braces around single line if statement Cc: Jason Ekstrand Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Reviewed-by: Tvrtko Ursulin Signed-off-by: Matthew Brost Cc: Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20211001155825.6762-1-matthew.brost@intel.com (cherry picked from commit 84edf53776343d6b5bf5fa59a6f600a22ca23c40) Signed-off-by: Jani Nikula commit 6d7163f2c49fda5658e43105a96b555c89a4548d Author: Alexander Usyskin Date: Wed Oct 13 10:45:52 2021 +0300 mei: hbm: drop hbm responses on early shutdown Drop HBM responses also in the early shutdown phase where the usual traffic is allowed. Extend the rule that drop HBM responses received during the shutdown phase by also in MEI_DEV_POWERING_DOWN state. This resolves the stall if the driver is stopping in the middle of the link init or link reset. Fixes: da3eb47c90d4 ("mei: hbm: drop hbm responses on shutdown") Fixes: 36edb1407c3c ("mei: allow clients on bus to communicate in remove callback") Cc: # v5.12+ Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20211013074552.2278419-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman commit 6f779e1d359b8d5801f677c1d49dcfa10bf95674 Author: Cédric Le Goater Date: Mon Oct 11 09:02:03 2021 +0200 powerpc/xive: Discard disabled interrupts in get_irqchip_state() When an interrupt is passed through, the KVM XIVE device calls the set_vcpu_affinity() handler which raises the P bit to mask the interrupt and to catch any in-flight interrupts while routing the interrupt to the guest. On the guest side, drivers (like some Intels) can request at probe time some MSIs and call synchronize_irq() to check that there are no in flight interrupts. This will call the XIVE get_irqchip_state() handler which will always return true as the interrupt P bit has been set on the host side and lock the CPU in an infinite loop. Fix that by discarding disabled interrupts in get_irqchip_state(). Fixes: da15c03b047d ("powerpc/xive: Implement get_irqchip_state method for XIVE to fix shutdown race") Cc: stable@vger.kernel.org #v5.4+ Signed-off-by: Cédric Le Goater Tested-by: seeteena Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211011070203.99726-1-clg@kaod.org commit 6e44bd6d34d659c44cd8e7fc925c8a97f49b3c33 Author: Mike Rapoport Date: Wed Oct 13 08:36:59 2021 +0300 memblock: exclude NOMAP regions from kmemleak Vladimir Zapolskiy reports: commit a7259df76702 ("memblock: make memblock_find_in_range method private") invokes a kernel panic while running kmemleak on OF platforms with nomaped regions: Unable to handle kernel paging request at virtual address fff000021e00000 [...] scan_block+0x64/0x170 scan_gray_list+0xe8/0x17c kmemleak_scan+0x270/0x514 kmemleak_write+0x34c/0x4ac Indeed, NOMAP regions don't have linear map entries so an attempt to scan these areas would fault. Prevent such faults by excluding NOMAP regions from kmemleak. Link: https://lore.kernel.org/all/8ade5174-b143-d621-8c8e-dc6a1898c6fb@linaro.org Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Mike Rapoport Tested-by: Vladimir Zapolskiy commit f2b85040acec9a928b4eb1b57a989324e8e38d3f Author: Ming Lei Date: Fri Oct 8 13:01:18 2021 +0800 scsi: core: Put LLD module refcnt after SCSI device is released SCSI host release is triggered when SCSI device is freed. We have to make sure that the low-level device driver module won't be unloaded before SCSI host instance is released because shost->hostt is required in the release handler. Make sure to put LLD module refcnt after SCSI device is released. Fixes a kernel panic of 'BUG: unable to handle page fault for address' reported by Changhui and Yi. Link: https://lore.kernel.org/r/20211008050118.1440686-1-ming.lei@redhat.com Cc: Greg Kroah-Hartman Reported-by: Changhui Zhong Reported-by: Yi Zhang Tested-by: Yi Zhang Signed-off-by: Ming Lei Signed-off-by: Martin K. Petersen commit 6fd13d699d24beaa28310848fe65fd898fbb9043 Author: Andrea Parri (Microsoft) Date: Thu Oct 7 14:28:28 2021 +0200 scsi: storvsc: Fix validation for unsolicited incoming packets The validation on the length of incoming packets performed in storvsc_on_channel_callback() does not apply to unsolicited packets with ID of 0 sent by Hyper-V. Adjust the validation for such unsolicited packets. Link: https://lore.kernel.org/r/20211007122828.469289-1-parri.andrea@gmail.com Fixes: 91b1b640b834b2 ("scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()") Reported-by: Dexuan Cui Reviewed-by: Michael Kelley Reviewed-by: Haiyang Zhang Signed-off-by: Andrea Parri (Microsoft) Signed-off-by: Martin K. Petersen commit 2b94b6b79b7c24092a6169db9e83c4565be0db42 Author: Wang Hai Date: Tue Oct 12 15:15:56 2021 +0800 PCI/MSI: Handle msi_populate_sysfs() errors correctly Previously, when msi_populate_sysfs() failed, we saved the error return value as dev->msi_irq_groups, which leads to a page fault when free_msi_irqs() calls msi_destroy_sysfs(). To prevent this, leave dev->msi_irq_groups alone when msi_populate_sysfs() fails. Found by the Hulk Robot when injecting a memory allocation fault in msi_populate_sysfs(): BUG: unable to handle page fault for address: fffffffffffffff4 ... Call Trace: msi_destroy_sysfs+0x30/0xa0 free_msi_irqs+0x11d/0x1b0 Fixes: 2f170814bdd2 ("genirq/msi: Move MSI sysfs handling from PCI to MSI core") Link: https://lore.kernel.org/r/20211012071556.939137-1-wanghai38@huawei.com Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Bjorn Helgaas Acked-by: Barry Song commit 847c6bdba833115e07376584024b2cb43ef7914b Merge: 3af760e4d3b0a 8d5f7954b7c8d Author: Jakub Kicinski Date: Tue Oct 12 17:35:21 2021 -0700 Merge branch 'felix-dsa-driver-fixes' Vladimir Oltean says: ==================== Felix DSA driver fixes This is an assorted collection of fixes for issues seen on the NXP LS1028A switch. - PTP packet drops due to switch congestion result in catastrophic damage to the driver's state - loops are not blocked by STP if using the ocelot-8021q tagger - driver uses the wrong CPU port when two of them are defined in DT - module autoloading is broken* with both tagging protocol drivers (ocelot and ocelot-8021q) Changes in v2: - Stop printing that we aren't going to take TX timestamps if we don't have TX timestamping anyway, and we are just carrying PTP frames for a cascaded DSA switch. - Shorten the deferred xmit kthread name so that it fits the 16 character limit (TASK_COMM_LEN) ==================== Link: https://lore.kernel.org/r/20211012114044.2526146-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8d5f7954b7c8de54902a8beda141064a7e2e6ee0 Author: Vladimir Oltean Date: Tue Oct 12 14:40:44 2021 +0300 net: dsa: felix: break at first CPU port during init and teardown The NXP LS1028A switch has two Ethernet ports towards the CPU, but only one of them is capable of acting as an NPI port at a time (inject and extract packets using DSA tags). However, using the alternative ocelot-8021q tagging protocol, it should be possible to use both CPU ports symmetrically, but for that we need to mark both ports in the device tree as DSA masters. In the process of doing that, it can be seen that traffic to/from the network stack gets broken, and this is because the Felix driver iterates through all DSA CPU ports and configures them as NPI ports. But since there can only be a single NPI port, we effectively end up in a situation where DSA thinks the default CPU port is the first one, but the hardware port configured to be an NPI is the last one. I would like to treat this as a bug, because if the updated device trees are going to start circulating, it would be really good for existing kernels to support them, too. Fixes: adb3dccf090b ("net: dsa: felix: convert to the new .change_tag_protocol DSA API") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 43ba33b4f143965a451cfdc1e826b61f6933c887 Author: Vladimir Oltean Date: Tue Oct 12 14:40:43 2021 +0300 net: dsa: tag_ocelot_8021q: fix inability to inject STP BPDUs into BLOCKING ports When setting up a bridge with stp_state 1, topology changes are not detected and loops are not blocked. This is because the standard way of transmitting a packet, based on VLAN IDs redirected by VCAP IS2 to the right egress port, does not override the port STP state (in the case of Ocelot switches, that's really the PGID_SRC masks). To force a packet to be injected into a port that's BLOCKING, we must send it as a control packet, which means in the case of this tagger to send it using the manual register injection method. We already do this for PTP frames, extend the logic to apply to any link-local MAC DA. Fixes: 7c83a7c539ab ("net: dsa: add a second tagger for Ocelot switches based on tag_8021q") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 1328a883258b4507909090ed0a9ad63771f9f780 Author: Vladimir Oltean Date: Tue Oct 12 14:40:42 2021 +0300 net: dsa: felix: purge skb from TX timestamping queue if it cannot be sent At present, when a PTP packet which requires TX timestamping gets dropped under congestion by the switch, things go downhill very fast. The driver keeps a clone of that skb in a queue of packets awaiting TX timestamp interrupts, but interrupts will never be raised for the dropped packets. Moreover, matching timestamped packets to timestamps is done by a 2-bit timestamp ID, and this can wrap around and we can match on the wrong skb. Since with the default NPI-based tagging protocol, we get no notification about packet drops, the best we can do is eventually recover from the drop of a PTP frame: its skb will be dead memory until another skb which was assigned the same timestamp ID happens to find it. However, with the ocelot-8021q tagger which injects packets using the manual register interface, it appears that we can check for more information, such as: - whether the input queue has reached the high watermark or not - whether the injection group's FIFO can accept additional data or not so we know that a PTP frame is likely to get dropped before actually sending it, and drop it ourselves (because DSA uses NETIF_F_LLTX, so it can't return NETDEV_TX_BUSY to ask the qdisc to requeue the packet). But when we do that, we can also remove the skb from the timestamping queue, because there surely won't be any timestamp that matches it. Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 49f885b2d97093451410e7279aa29d81e094e108 Author: Vladimir Oltean Date: Tue Oct 12 14:40:41 2021 +0300 net: dsa: tag_ocelot_8021q: break circular dependency with ocelot switch lib Michael reported that when using the "ocelot-8021q" tagging protocol, the switch driver module must be manually loaded before the tagging protocol can be loaded/is available. This appears to be the same problem described here: https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/ where due to the fact that DSA tagging protocols make use of symbols exported by the switch drivers, circular dependencies appear and this breaks module autoloading. The ocelot_8021q driver needs the ocelot_can_inject() and ocelot_port_inject_frame() functions from the switch library. Previously the wrong approach was taken to solve that dependency: shims were provided for the case where the ocelot switch library was compiled out, but that turns out to be insufficient, because the dependency when the switch lib _is_ compiled is problematic too. We cannot declare ocelot_can_inject() and ocelot_port_inject_frame() as static inline functions, because these access I/O functions like __ocelot_write_ix() which is called by ocelot_write_rix(). Making those static inline basically means exposing the whole guts of the ocelot switch library, not ideal... We already have one tagging protocol driver which calls into the switch driver during xmit but not using any exported symbol: sja1105_defer_xmit. We can do the same thing here: create a kthread worker and one work item per skb, and let the switch driver itself do the register accesses to send the skb, and then consume it. Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") Reported-by: Michael Walle Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit deab6b1cd9789bb9bd466d5e76aecb8b336259b4 Author: Vladimir Oltean Date: Tue Oct 12 14:40:40 2021 +0300 net: dsa: tag_ocelot: break circular dependency with ocelot switch lib driver As explained here: https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/ DSA tagging protocol drivers cannot depend on symbols exported by switch drivers, because this creates a circular dependency that breaks module autoloading. The tag_ocelot.c file depends on the ocelot_ptp_rew_op() function exported by the common ocelot switch lib. This function looks at OCELOT_SKB_CB(skb) and computes how to populate the REW_OP field of the DSA tag, for PTP timestamping (the command: one-step/two-step, and the TX timestamp identifier). None of that requires deep insight into the driver, it is quite stateless, as it only depends upon the skb->cb. So let's make it a static inline function and put it in include/linux/dsa/ocelot.h, a file that despite its name is used by the ocelot switch driver for populating the injection header too - since commit 40d3f295b5fe ("net: mscc: ocelot: use common tag parsing code with DSA"). With that function declared as static inline, its body is expanded inside each call site, so the dependency is broken and the DSA tagger can be built without the switch library, upon which the felix driver depends. Fixes: 39e5308b3250 ("net: mscc: ocelot: support PTP Sync one-step timestamping") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit ebb4c6a990f786d7e0e4618a0d3766cd660125d8 Author: Vladimir Oltean Date: Tue Oct 12 14:40:39 2021 +0300 net: mscc: ocelot: cross-check the sequence id from the timestamp FIFO with the skb PTP header The sad reality is that when a PTP frame with a TX timestamping request is transmitted, it isn't guaranteed that it will make it all the way to the wire (due to congestion inside the switch), and that a timestamp will be taken by the hardware and placed in the timestamp FIFO where an IRQ will be raised for it. The implication is that if enough PTP frames are silently dropped by the hardware such that the timestamp ID has rolled over, it is possible to match a timestamp to an old skb. Furthermore, nobody will match on the real skb corresponding to this timestamp, since we stupidly matched on a previous one that was stale in the queue, and stopped there. So PTP timestamping will be broken and there will be no way to recover. It looks like the hardware parses the sequenceID from the PTP header, and also provides that metadata for each timestamp. The driver currently ignores this, but it shouldn't. As an extra resiliency measure, do the following: - check whether the PTP sequenceID also matches between the skb and the timestamp, treat the skb as stale otherwise and free it - if we see a stale skb, don't stop there and try to match an skb one more time, chances are there's one more skb in the queue with the same timestamp ID, otherwise we wouldn't have ever found the stale one (it is by timestamp ID that we matched it). While this does not prevent PTP packet drops, it at least prevents the catastrophic consequences of incorrect timestamp matching. Since we already call ptp_classify_raw in the TX path, save the result in the skb->cb of the clone, and just use that result in the interrupt code path. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit fba01283d85a09e0e2ef552c6e764b903111d90a Author: Vladimir Oltean Date: Tue Oct 12 14:40:38 2021 +0300 net: mscc: ocelot: deny TX timestamping of non-PTP packets It appears that Ocelot switches cannot timestamp non-PTP frames, I tested this using the isochron program at: https://github.com/vladimiroltean/tsn-scripts with the result that the driver increments the ocelot_port->ts_id counter as expected, puts it in the REW_OP, but the hardware seems to not timestamp these packets at all, since no IRQ is emitted. Therefore check whether we are sending PTP frames, and refuse to populate REW_OP otherwise. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 9fde506e0c53b8309f69b18b4b8144c544b4b3b1 Author: Vladimir Oltean Date: Tue Oct 12 14:40:37 2021 +0300 net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb When skb_match is NULL, it means we received a PTP IRQ for a timestamp ID that the kernel has no idea about, since there is no skb in the timestamping queue with that timestamp ID. This is a grave error and not something to just "continue" over. So print a big warning in case this happens. Also, move the check above ocelot_get_hwtimestamp(), there is no point in reading the full 64-bit current PTP time if we're not going to do anything with it anyway for this skb. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 52849bcf0029ccc553be304e4f804938a39112e2 Author: Vladimir Oltean Date: Tue Oct 12 14:40:36 2021 +0300 net: mscc: ocelot: avoid overflowing the PTP timestamp FIFO PTP packets with 2-step TX timestamp requests are matched to packets based on the egress port number and a 6-bit timestamp identifier. All PTP timestamps are held in a common FIFO that is 128 entry deep. This patch ensures that back-to-back timestamping requests cannot exceed the hardware FIFO capacity. If that happens, simply send the packets without requesting a TX timestamp to be taken (in the case of felix, since the DSA API has a void return code in ds->ops->port_txtstamp) or drop them (in the case of ocelot). I've moved the ts_id_lock from a per-port basis to a per-switch basis, because we need separate accounting for both numbers of PTP frames in flight. And since we need locking to inc/dec the per-switch counter, that also offers protection for the per-port counter and hence there is no reason to have a per-port counter anymore. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit c57fe0037a4e3863d9b740f8c14df9c51ac31aa1 Author: Vladimir Oltean Date: Tue Oct 12 14:40:35 2021 +0300 net: mscc: ocelot: make use of all 63 PTP timestamp identifiers At present, there is a problem when user space bombards a port with PTP event frames which have TX timestamping requests (or when a tc-taprio offload is installed on a port, which delays the TX timestamps by a significant amount of time). The driver will happily roll over the 2-bit timestamp ID and this will cause incorrect matches between an skb and the TX timestamp collected from the FIFO. The Ocelot switches have a 6-bit PTP timestamp identifier, and the value 63 is reserved, so that leaves identifiers 0-62 to be used. The timestamp identifiers are selected by the REW_OP packet field, and are actually shared between CPU-injected frames and frames which match a VCAP IS2 rule that modifies the REW_OP. The hardware supports partitioning between the two uses of the REW_OP field through the PTP_ID_LOW and PTP_ID_HIGH registers, and by default reserves the PTP IDs 0-3 for CPU-injected traffic and the rest for VCAP IS2. The driver does not use VCAP IS2 to set REW_OP for 2-step timestamping, and it also writes 0xffffffff to both PTP_ID_HIGH and PTP_ID_LOW in ocelot_init_timestamp() which makes all timestamp identifiers available to CPU injection. Therefore, we can make use of all 63 timestamp identifiers, which should allow more timestampable packets to be in flight on each port. This is only part of the solution, more issues will be addressed in future changes. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 3af760e4d3b0a32448decb8ea068a221cbd24fe3 Merge: 43a4b4dbd48c9 4ac0567e40b33 Author: Jakub Kicinski Date: Tue Oct 12 17:33:39 2021 -0700 Merge branch 'fix-circular-dependency-between-sja1105-and-tag_sja1105' Vladimir Oltean says: ==================== Fix circular dependency between sja1105 and tag_sja1105 As discussed here: https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/ DSA tagging protocols cannot use symbols exported by switch drivers. Eliminate the two instances of that from tag_sja1105, and that allows us to have a working setup with modules again. ==================== Re-applying to net, this was mistakenly applied to net-next, see first Link. Link: https://lore.kernel.org/r/20211012114044.2526146-1-vladimir.oltean@nxp.com/ Link: https://lore.kernel.org/r/20210922143726.2431036-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4ac0567e40b334b54988e3c28a2425ff9c8bdd35 Author: Vladimir Oltean Date: Wed Sep 22 17:37:26 2021 +0300 net: dsa: sja1105: break dependency between dsa_port_is_sja1105 and switch driver It's nice to be able to test a tagging protocol with dsa_loop, but not at the cost of losing the ability of building the tagging protocol and switch driver as modules, because as things stand, there is a circular dependency between the two. Tagging protocol drivers cannot depend on switch drivers, that is a hard fact. The reasoning behind the blamed patch was that accessing dp->priv should first make sure that the structure behind that pointer is what we really think it is. Currently the "sja1105" and "sja1110" tagging protocols only operate with the sja1105 switch driver, just like any other tagging protocol and switch combination. The only way to mix and match them is by modifying the code, and this applies to dsa_loop as well (by default that uses DSA_TAG_PROTO_NONE). So while in principle there is an issue, in practice there isn't one. Until we extend dsa_loop to allow user space configuration, treat the problem as a non-issue and just say that DSA ports found by tag_sja1105 are always sja1105 ports, which is in fact true. But keep the dsa_port_is_sja1105 function so that it's easy to patch it during testing, and rely on dead code elimination. Fixes: 994d2cbb08ca ("net: dsa: tag_sja1105: be dsa_loop-safe") Link: https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/ Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 28da0555c3b542d605e4ca26eea6a740cf2c9174 Author: Vladimir Oltean Date: Wed Sep 22 17:37:25 2021 +0300 net: dsa: move sja1110_process_meta_tstamp inside the tagging protocol driver The problem is that DSA tagging protocols really must not depend on the switch driver, because this creates a circular dependency at insmod time, and the switch driver will effectively not load when the tagging protocol driver is missing. The code was structured in the way it was for a reason, though. The DSA driver-facing API for PTP timestamping relies on the assumption that two-step TX timestamps are provided by the hardware in an out-of-band manner, typically by raising an interrupt and making that timestamp available inside some sort of FIFO which is to be accessed over SPI/MDIO/etc. So the API puts .port_txtstamp into dsa_switch_ops, because it is expected that the switch driver needs to save some state (like put the skb into a queue until its TX timestamp arrives). On SJA1110, TX timestamps are provided by the switch as Ethernet packets, so this makes them be received and processed by the tagging protocol driver. This in itself is great, because the timestamps are full 64-bit and do not require reconstruction, and since Ethernet is the fastest I/O method available to/from the switch, PTP timestamps arrive very quickly, no matter how bottlenecked the SPI connection is, because SPI interaction is not needed at all. DSA's code structure and strict isolation between the tagging protocol driver and the switch driver break the natural code organization. When the tagging protocol driver receives a packet which is classified as a metadata packet containing timestamps, it passes those timestamps one by one to the switch driver, which then proceeds to compare them based on the recorded timestamp ID that was generated in .port_txtstamp. The communication between the tagging protocol and the switch driver is done through a method exported by the switch driver, sja1110_process_meta_tstamp. To satisfy build requirements, we force a dependency to build the tagging protocol driver as a module when the switch driver is a module. However, as explained in the first paragraph, that causes the circular dependency. To solve this, move the skb queue from struct sja1105_private :: struct sja1105_ptp_data to struct sja1105_private :: struct sja1105_tagger_data. The latter is a data structure for which hacks have already been put into place to be able to create persistent storage per switch that is accessible from the tagging protocol driver (see sja1105_setup_ports). With the skb queue directly accessible from the tagging protocol driver, we can now move sja1110_process_meta_tstamp into the tagging driver itself, and avoid exporting a symbol. Fixes: 566b18c8b752 ("net: dsa: sja1105: implement TX timestamping for SJA1110") Link: https://lore.kernel.org/netdev/20210908220834.d7gmtnwrorhharna@skbuf/ Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 43a4b4dbd48c9006ef64df3a12acf33bdfe11c61 Author: Alvin Šipraga Date: Tue Oct 12 13:27:31 2021 +0200 net: dsa: fix spurious error message when unoffloaded port leaves bridge Flip the sign of a return value check, thereby suppressing the following spurious error: port 2 failed to notify DSA_NOTIFIER_BRIDGE_LEAVE: -EOPNOTSUPP ... which is emitted when removing an unoffloaded DSA switch port from a bridge. Fixes: d371b7c92d19 ("net: dsa: Unset vlan_filtering when ports leave the bridge") Signed-off-by: Alvin Šipraga Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20211012112730.3429157-1-alvin@pqrs.dk Signed-off-by: Jakub Kicinski commit 60d950f443a52d950126ad664fbd4a1eb8353dc9 Author: Baowen Zheng Date: Tue Oct 12 14:48:50 2021 +0200 nfp: flow_offload: move flow_indr_dev_register from app init to app start In commit 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation"), it adds a process to trigger the callback to setup the bo callback when the driver regists a callback. In our current implement, we are not ready to run the callback when nfp call the function flow_indr_dev_register, then there will be error message as: kernel: Oops: 0000 [#1] SMP PTI kernel: CPU: 0 PID: 14119 Comm: kworker/0:0 Tainted: G kernel: Workqueue: events work_for_cpu_fn kernel: RIP: 0010:nfp_flower_indr_setup_tc_cb+0x258/0x410 kernel: RSP: 0018:ffffbc1e02c57bf8 EFLAGS: 00010286 kernel: RAX: 0000000000000000 RBX: ffff9c761fabc000 RCX: 0000000000000001 kernel: RDX: 0000000000000001 RSI: fffffffffffffff0 RDI: ffffffffc0be9ef1 kernel: RBP: ffffbc1e02c57c58 R08: ffffffffc08f33aa R09: ffff9c6db7478800 kernel: R10: 0000009c003f6e00 R11: ffffbc1e02800000 R12: ffffbc1e000d9000 kernel: R13: ffffbc1e000db428 R14: ffff9c6db7478800 R15: ffff9c761e884e80 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: fffffffffffffff0 CR3: 00000009e260a004 CR4: 00000000007706f0 kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 kernel: PKRU: 55555554 kernel: Call Trace: kernel: ? flow_indr_dev_register+0xab/0x210 kernel: ? __cond_resched+0x15/0x30 kernel: ? kmem_cache_alloc_trace+0x44/0x4b0 kernel: ? nfp_flower_setup_tc+0x1d0/0x1d0 [nfp] kernel: flow_indr_dev_register+0x158/0x210 kernel: ? tcf_block_unbind+0xe0/0xe0 kernel: nfp_flower_init+0x40b/0x650 [nfp] kernel: nfp_net_pci_probe+0x25f/0x960 [nfp] kernel: ? nfp_rtsym_read_le+0x76/0x130 [nfp] kernel: nfp_pci_probe+0x6a9/0x820 [nfp] kernel: local_pci_probe+0x45/0x80 So we need to call flow_indr_dev_register in app start process instead of init stage. Fixes: 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation") Signed-off-by: Baowen Zheng Signed-off-by: Simon Horman Signed-off-by: Louis Peens Link: https://lore.kernel.org/r/20211012124850.13025-1-louis.peens@corigine.com Signed-off-by: Jakub Kicinski commit 0dee6f70fd40e3375d45d3f93abdf6a57fc0e549 Author: Laurent Pinchart Date: Sun Aug 22 02:44:27 2021 +0300 drm: rcar-du: Don't create encoder for unconnected LVDS outputs On R-Car D3 and E3, the LVDS encoders provide the pixel clock to the DU, even when LVDS outputs are not used. For this reason, the rcar-lvds driver probes successfully on those platforms even if no further bridge or panel is connected to the LVDS output, in order to provide the rcar_lvds_clk_enable() and rcar_lvds_clk_disable() functions to the DU driver. If an LVDS output isn't connected, trying to create a DRM connector for the output will fail. Fix this by skipping connector creation in that case, and also skip creation of the DRM encoder as there's no point in an encoder without a connector. Fixes: e9e056949c92 ("drm: rcar-du: lvds: Convert to DRM panel bridge helper") Reported-by: Geert Uytterhoeven Signed-off-by: Laurent Pinchart Tested-by: Geert Uytterhoeven (cherry picked from commit 187502afe87a0fc96832056558978fa423920ee0) Signed-off-by: Dave Airlie commit 84c8a87402cf073ba7948dd62d4815a3f4a224c8 Author: Maxim Mikityanskiy Date: Mon Oct 11 18:39:35 2021 +0300 net/mlx5e: Fix division by 0 in mlx5e_select_queue for representors Commit 846d6da1fcdb ("net/mlx5e: Fix division by 0 in mlx5e_select_queue") makes mlx5e_build_nic_params assign a non-zero initial value to priv->num_tc_x_num_ch, so that mlx5e_select_queue doesn't fail with division by 0 if called before the first activation of channels. However, the initialization flow of representors doesn't call mlx5e_build_nic_params, so this bug can still happen with representors. This commit fixes the bug by adding the missing assignment to mlx5e_build_rep_params. Fixes: 846d6da1fcdb ("net/mlx5e: Fix division by 0 in mlx5e_select_queue") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 0bc73ad46a76ed6ece4dcacb28858e7b38561e1c Author: Aya Levin Date: Sun Sep 26 17:55:41 2021 +0300 net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp Due to current HW arch limitations, RX-FCS (scattering FCS frame field to software) and RX-port-timestamp (improved timestamp accuracy on the receive side) can't work together. RX-port-timestamp is not controlled by the user and it is enabled by default when supported by the HW/FW. This patch sets RX-port-timestamp opposite to RX-FCS configuration. Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit b2107cdc43d8601f2cadfba990ae844cc1f44e68 Author: Saeed Mahameed Date: Mon Oct 4 21:20:25 2021 -0700 net/mlx5e: Switchdev representors are not vlan challenged Before this patch, mlx5 representors advertised the NETIF_F_VLAN_CHALLENGED bit, this could lead to missing features when using reps with vxlan/bridge and maybe other virtual interfaces, when such interfaces inherit this bit and block vlan usage in their topology. Example: $ip link add dev bridge type bridge # add representor interface to the bridge $ip link set dev pf0hpf master $ip link add link bridge name vlan10 type vlan id 10 protocol 802.1q Error: 8021q: VLANs not supported on device. Reps are perfectly capable of handling vlan traffic, although they don't implement vlan_{add,kill}_vid ndos, hence, remove NETIF_F_VLAN_CHALLENGED advertisement. Fixes: cb67b832921c ("net/mlx5e: Introduce SRIOV VF representors") Reported-by: Roopa Prabhu Signed-off-by: Saeed Mahameed Reviewed-by: Roi Dayan commit 94b960b9deffc02fc0747afc01f72cc62ab099e3 Author: Valentine Fatiev Date: Sun Aug 15 17:43:19 2021 +0300 net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path Prior to this patch in case mlx5_core_destroy_cq() failed it returns without completing all destroy operations and that leads to memory leak. Instead, complete the destroy flow before return error. Also move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq() to be symmetrical with mlx5_core_create_cq(). kmemleak complains on: unreferenced object 0xc000000038625100 (size 64): comm "ethtool", pid 28301, jiffies 4298062946 (age 785.380s) hex dump (first 32 bytes): 60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0 `.H.......4..... 02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0 ..........}..... backtrace: [<000000009e8643cb>] add_res_tree+0xd0/0x270 [mlx5_core] [<00000000e7cb8e6c>] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core] [<000000002a12918f>] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core] [<00000000cef0a696>] mlx5e_create_cq+0x210/0x3f0 [mlx5_core] [<000000009c642c26>] mlx5e_open_cq+0xb4/0x130 [mlx5_core] [<0000000058dfa578>] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core] [<0000000081839561>] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core] [<0000000009cf05d4>] mlx5e_switch_priv_channels+0xa4/0x230 [mlx5_core] [<0000000042bbedd8>] mlx5e_safe_switch_params+0x14c/0x300 [mlx5_core] [<0000000004bc9db8>] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core] [<00000000a0553443>] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core] [<00000000a8f3d84b>] ethnl_set_privflags+0x234/0x2d0 [<00000000fd27f27c>] genl_family_rcv_msg_doit+0x108/0x1d0 [<00000000f495e2bb>] genl_family_rcv_msg+0xe4/0x1f0 [<00000000646c5c2c>] genl_rcv_msg+0x78/0x120 [<00000000d53e384e>] netlink_rcv_skb+0x74/0x1a0 Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Valentine Fatiev Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit ca20dfda05ae0531c8f5117b6ac989816f6cf658 Author: Tariq Toukan Date: Mon Oct 4 15:04:25 2021 +0300 net/mlx5e: Allow only complete TXQs partition in MQPRIO channel mode Do not allow configurations of MQPRIO channel mode that do not fully define and utilize the channels txqs. Fixes: ec60c4581bd9 ("net/mlx5e: Support MQPRIO channel mode") Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit 2266bb1e122a4f7cdf3427defcfb48e5c6a8f205 Author: Shay Drory Date: Mon Sep 13 15:48:11 2021 +0300 net/mlx5: Fix cleanup of bridge delayed work Currently, bridge cleanup is calling to cancel_delayed_work(). When this function is finished, there is a chance that the delayed work is still running. Also, the delayed work is queueing itself. As a result, we might execute the delayed work after the bridge cleanup have finished and hit a null-ptr oops[1]. Fix it by using cancel_delayed_work_sync(), which is waiting until the work is done and will cancel the queue work. [1] [ 8202.143043 ] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 8202.144438 ] #PF: supervisor write access in kernel mode [ 8202.145476 ] #PF: error_code(0x0002) - not-present page [ 8202.146520 ] PGD 0 P4D 0 [ 8202.147126 ] Oops: 0002 [#1] SMP NOPTI [ 8202.147899 ] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.14.0-rc6_for_upstream_min_debug_2021_08_25_16_06 #1 [ 8202.149741 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 8202.151908 ] RIP: 0010:_raw_spin_lock+0xc/0x20 [ 8202.156234 ] RSP: 0018:ffff88846f885ea0 EFLAGS: 00010046 [ 8202.157289 ] RAX: 0000000000000000 RBX: ffff88846f880000 RCX: 0000000000000000 [ 8202.158731 ] RDX: 0000000000000001 RSI: ffff8881004000c8 RDI: 0000000000000000 [ 8202.160177 ] RBP: ffff8881fe684978 R08: ffff888100140000 R09: ffffffff824455b8 [ 8202.161569 ] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 8202.163004 ] R13: 0000000000000012 R14: 0000000000000200 R15: ffff88812992d000 [ 8202.164018 ] FS: 0000000000000000(0000) GS:ffff88846f880000(0000) knlGS:0000000000000000 [ 8202.164960 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8202.165634 ] CR2: 0000000000000000 CR3: 0000000108cac004 CR4: 0000000000370ea0 [ 8202.166450 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8202.167807 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8202.168852 ] Call Trace: [ 8202.169421 ] [ 8202.169792 ] __queue_work+0xf2/0x3d0 [ 8202.170481 ] ? queue_work_node+0x40/0x40 [ 8202.171270 ] call_timer_fn+0x2b/0x100 [ 8202.171932 ] __run_timers.part.0+0x152/0x220 [ 8202.172717 ] ? __hrtimer_run_queues+0x171/0x290 [ 8202.173526 ] ? kvm_clock_get_cycles+0xd/0x10 [ 8202.174232 ] ? ktime_get+0x35/0x90 [ 8202.174943 ] run_timer_softirq+0x26/0x50 [ 8202.175745 ] __do_softirq+0xc7/0x271 [ 8202.176373 ] irq_exit_rcu+0x93/0xb0 [ 8202.176983 ] sysvec_apic_timer_interrupt+0x72/0x90 [ 8202.177755 ] [ 8202.178245 ] asm_sysvec_apic_timer_interrupt+0x12/0x20 Fixes: c636a0f0f3f0 ("net/mlx5: Bridge, dynamic entry ageing") Signed-off-by: Shay Drory Reviewed-by: Vlad Buslov Reviewed-by: Leon Romanovsky Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 48827e1d6af58f219e89c7ec08dccbca28c7694e Author: Jonas Hahnfeld Date: Tue Oct 12 22:09:07 2021 +0200 ALSA: usb-audio: Add quirk for VF0770 The device advertises 8 formats, but only a rate of 48kHz is honored by the hardware and 24 bits give chopped audio, so only report the one working combination. This fixes out-of-the-box audio experience with PipeWire which otherwise attempts to choose S24_3LE (while PulseAudio defaulted to S16_LE). Signed-off-by: Jonas Hahnfeld Cc: Link: https://lore.kernel.org/r/20211012200906.3492-1-hahnjo@hahnjo.de Signed-off-by: Takashi Iwai commit f4d0cc426f77df6890aa868f96c2de89686aae8a Merge: ed47291911d37 596143e3aec35 Author: Linus Torvalds Date: Tue Oct 12 11:16:38 2021 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Fix CMA gigantic page order for 16K/64K page sizes - Fix section mismatch error in drivers/acpi/arm64/gtdt.c * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: acpi/arm64: fix next_platform_timer() section mismatch error arm64/hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE commit ed47291911d375f7d0bf63b9afb7516988305d94 Merge: fa5878760579a 7df227847ab56 Author: Linus Torvalds Date: Tue Oct 12 11:11:39 2021 -0700 Merge tag 'platform-drivers-x86-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "A second (small) set of pdx86 bug-fixes and new hardware ids for 5.15" * tag 'platform-drivers-x86-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: int1092: Fix non sequential device mode handling platform/x86: intel_skl_int3472: Correct null check platform/x86: gigabyte-wmi: add support for B550 AORUS ELITE AX V2 platform/x86: amd-pmc: Add alternative acpi id for PMC controller platform/x86: intel_scu_ipc: Update timeout value in comment platform/x86: intel_scu_ipc: Increase virtual timeout to 10s platform/x86: intel_scu_ipc: Fix busy loop expiry time platform/x86: dell: Make DELL_WMI_PRIVACY depend on DELL_WMI platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call commit d208b89401e073de986dc891037c5a668f5d5d95 Author: Jiazi Li Date: Wed Sep 29 19:59:28 2021 +0800 dm: fix mempool NULL pointer race when completing IO dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li Signed-off-by: Mike Snitzer commit b4459b11e84092658fa195a2587aff3b9637f0e7 Author: Ming Lei Date: Thu Sep 23 17:11:31 2021 +0800 dm rq: don't queue request to blk-mq during DM suspend DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue. But blk-mq's unquiesce may come from outside events, such as elevator switch, updating nr_requests or others, and request may come during suspend, so simply ask for blk-mq to requeue it. Fixes one kernel panic issue when running updating nr_requests and dm-mpath suspend/resume stress test. Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Signed-off-by: Mike Snitzer commit ec132ef2d1d94d43d9dce1400521526bbed89a8b Author: Colin Ian King Date: Wed Sep 15 12:14:40 2021 +0100 dm clone: make array 'descs' static Don't populate the read-only array descs on the stack but instead it static and add extra const. Also makes the object code smaller by 66 bytes: Before: text data bss dec hex filename 42382 11140 512 54034 d312 ./drivers/md/dm-clone-target.o After: text data bss dec hex filename 42220 11236 512 53968 d2d0 ./drivers/md/dm-clone-target.o (gcc version 11.2.0) Signed-off-by: Colin Ian King Signed-off-by: Mike Snitzer commit 2c0468e054c0adb660ac055fc396622ec7235df9 Author: Akilesh Kailash Date: Mon Sep 13 09:26:42 2021 +0000 dm verity: skip redundant verity_handle_err() on I/O errors Without FEC, dm-verity won't call verity_handle_err() when I/O fails, but with FEC enabled, it currently does even if an I/O error has occurred. If there is an I/O error and FEC correction fails, return the error instead of calling verity_handle_err() again. Suggested-by: Sami Tolvanen Signed-off-by: Akilesh Kailash Reviewed-by: Sami Tolvanen Signed-off-by: Mike Snitzer commit 187a580c9e7895978dcd1e627b9c9e7e3d13ca96 Author: Mike Christie Date: Sun Oct 10 11:19:04 2021 -0500 scsi: iscsi: Fix set_param() handling In commit 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread") we meant to add a check where before we call ->set_param() we make sure the iscsi_cls_connection is bound. The problem is that between versions 4 and 5 of the patch the deletion of the unchecked set_param() call was dropped so we ended up with 2 calls. As a result we can still hit a crash where we access the unbound connection on the first call. This patch removes that first call. Fixes: 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread") Link: https://lore.kernel.org/r/20211010161904.60471-1-michael.christie@oracle.com Reviewed-by: Lee Duncan Reviewed-by: Li Feng Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen commit 596143e3aec35c93508d6b7a05ddc999ee209b61 Author: Jackie Liu Date: Mon Aug 23 17:25:26 2021 +0800 acpi/arm64: fix next_platform_timer() section mismatch error Fix modpost Section mismatch error in next_platform_timer(). [...] WARNING: modpost: vmlinux.o(.text.unlikely+0x26e60): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc The function next_platform_timer() references the variable __initdata acpi_gtdt_desc. This is often because next_platform_timer lacks a __initdata annotation or the annotation of acpi_gtdt_desc is wrong. WARNING: modpost: vmlinux.o(.text.unlikely+0x26e64): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc The function next_platform_timer() references the variable __initdata acpi_gtdt_desc. This is often because next_platform_timer lacks a __initdata annotation or the annotation of acpi_gtdt_desc is wrong. ERROR: modpost: Section mismatches detected. Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them. make[1]: *** [scripts/Makefile.modpost:59: vmlinux.symvers] Error 1 make[1]: *** Deleting file 'vmlinux.symvers' make: *** [Makefile:1176: vmlinux] Error 2 [...] Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver") Signed-off-by: Jackie Liu Acked-by: Hanjun Guo Link: https://lore.kernel.org/r/20210823092526.2407526-1-liu.yun@linux.dev Signed-off-by: Catalin Marinas commit 7904022decc260a19dd65b56ac896387f5da6f8c Author: Dan Carpenter Date: Tue Oct 12 11:44:43 2021 +0300 block/rnbd-clt-sysfs: fix a couple uninitialized variable bugs These variables are printed on the error path if match_int() fails so they have to be initialized. Fixes: 2958a995edc9 ("block/rnbd-clt: Support polling mode for IO latency optimization") Fixes: 1eb54f8f5dd8 ("block/rnbd: client: sysfs interface functions") Signed-off-by: Dan Carpenter Acked-by: Gioh Kim Link: https://lore.kernel.org/r/20211012084443.GA31472@kili Signed-off-by: Jens Axboe commit 50b6cb3516365cb69753b006be2b61c966b70588 Author: Dexuan Cui Date: Thu Oct 7 21:35:46 2021 -0700 scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() After commit ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue"), a 416-CPU VM running on Hyper-V hangs during boot because the hv_storvsc driver sets scsi_driver.can_queue to an integer value that exceeds SHRT_MAX, and hence scsi_add_host_with_dma() sets shost->cmd_per_lun to a negative "short" value. Use min_t(int, ...) to work around the issue. Link: https://lore.kernel.org/r/20211008043546.6006-1-decui@microsoft.com Fixes: ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue") Cc: stable@vger.kernel.org Reviewed-by: Haiyang Zhang Reviewed-by: Ming Lei Reviewed-by: John Garry Signed-off-by: Dexuan Cui Signed-off-by: Martin K. Petersen commit bc22b6208f416ba702c17a93c9af6474f19e8212 Merge: 6880fa6c56601 3f32472854614 Author: Florian Fainelli Date: Fri Oct 8 15:28:46 2021 -0700 Merge tag 'tags/bcm2835-dt-fixes-2021-10-06' into devicetree/fixes A series of devicetree fixes for the Raspberry Pi 4: - Fix VEC reg address - Fix MDIO address/size cells - Fix regulator states - Fix PCIe address formatting Signed-off-by: Florian Fainelli commit 3f32472854614d6f53b09b4812372dba9fc5c7de Author: Nicolas Saenz Julienne Date: Tue Aug 31 14:58:43 2021 +0200 ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address The unit address is supposed to represent ','. Which are both 0 for RPi4b's XHCI controller. On top of that although OpenFirmware states bus number goes in the high part of the last reg parameter, FDT doesn't seem to care for it[1], so remove it. [1] https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210830103909.323356-1-nsaenzju@redhat.com/#24414633 Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node") Suggested-by: Rob Herring Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210831125843.1233488-2-nsaenzju@redhat.com Signed-off-by: Nicolas Saenz Julienne commit 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b Author: Nicolas Saenz Julienne Date: Tue Aug 31 14:58:42 2021 +0200 ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address formatting dtbs_check currently complains that: arch/arm/boot/dts/bcm2711-rpi-4-b.dts:220.10-231.4: Warning (pci_device_reg): /scb/pcie@7d500000/pci@1,0: PCI unit address format error, expected "0,0" Unsurprisingly pci@0,0 is the right address, as illustrated by its reg property: &pcie0 { pci@0,0 { /* * As defined in the IEEE Std 1275-1994 document, * reg is a five-cell address encoded as (phys.hi * phys.mid phys.lo size.hi size.lo). phys.hi * should contain the device's BDF as 0b00000000 * bbbbbbbb dddddfff 00000000. The other cells * should be zero. */ reg = <0 0 0 0 0>; }; }; The device is clearly 0. So fix it. Also add a missing 'device_type = "pci"'. Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node") Suggested-by: Rob Herring Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210831125843.1233488-1-nsaenzju@redhat.com Signed-off-by: Nicolas Saenz Julienne commit b37a15188eae9d4c49c5bb035e0c8d4058e4d9b3 Author: Kai Vehmanen Date: Tue Oct 12 17:29:35 2021 +0300 ALSA: hda: avoid write to STATESTS if controller is in reset The snd_hdac_bus_reset_link() contains logic to clear STATESTS register before performing controller reset. This code dates back to an old bugfix in commit e8a7f136f5ed ("[ALSA] hda-intel - Improve HD-audio codec probing robustness"). Originally the code was added to azx_reset(). The code was moved around in commit a41d122449be ("ALSA: hda - Embed bus into controller object") and ended up to snd_hdac_bus_reset_link() and called primarily via snd_hdac_bus_init_chip(). The logic to clear STATESTS is correct when snd_hdac_bus_init_chip() is called when controller is not in reset. In this case, STATESTS can be cleared. This can be useful e.g. when forcing a controller reset to retry codec probe. A normal non-power-on reset will not clear the bits. However, this old logic is problematic when controller is already in reset. The HDA specification states that controller must be taken out of reset before writing to registers other than GCTL.CRST (1.0a spec, 3.3.7). The write to STATESTS in snd_hdac_bus_reset_link() will be lost if the controller is already in reset per the HDA specification mentioned. This has been harmless on older hardware. On newer generation of Intel PCIe based HDA controllers, if configured to report issues, this write will emit an unsupported request error. If ACPI Platform Error Interface (APEI) is enabled in kernel, this will end up to kernel log. Fix the code in snd_hdac_bus_reset_link() to only clear the STATESTS if the function is called when controller is not in reset. Otherwise clearing the bits is not possible and should be skipped. Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20211012142935.3731820-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 8607954cf255329d1c6dfc073ff1508b7585573c Author: Konstantin Komarov Date: Mon Oct 11 19:43:29 2021 +0300 fs/ntfs3: Check for NULL pointers in ni_try_remove_attr_list Check for potential NULL pointers. Print error message if found. Thread, that leads to this commit: https://lore.kernel.org/ntfs3/227c13e3-5a22-0cba-41eb-fcaf41940711@paragon-software.com/ Reported-by: Mohammad Rasim Signed-off-by: Konstantin Komarov commit 1ea1dbf1f54c3345072c963b3acf8830e2468c1b Author: Sachi King Date: Sat Oct 2 14:18:40 2021 +1000 ACPI: PM: Include alternate AMDI0005 id in special behaviour The Surface Laptop 4 AMD has used the AMD0005 to identify this controller instead of using the appropriate ACPI ID AMDI0005. The AMD0005 needs the same special casing as AMDI0005. Link: https://github.com/linux-surface/acpidumps/tree/master/surface_laptop_4_amd Link: https://gist.github.com/nakato/2a1a7df1a45fe680d7a08c583e1bf863 Signed-off-by: Sachi King Reviewed-by: Mario Limonciello Cc: 5.14+ # 5.14+ Signed-off-by: Rafael J. Wysocki commit a3fd1a986e499a06ac5ef95c3a39aa4611e7444c Author: Hui Wang Date: Tue Oct 12 19:47:48 2021 +0800 ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW We need to define the codec pin 0x1b to be the mic, but somehow the mic doesn't support hot plugging detection, and Windows also has this issue, so we set it to phantom headset-mic. Also the determine_headset_type() often returns the omtp type by a mistake when we plug a ctia headset, this makes the mic can't record sound at all. Because most of the headset are ctia type nowadays and some machines have the fixed ctia type audio jack, it is possible this machine has the fixed ctia jack too. Here we set this mic jack to fixed ctia type, this could avoid the mic type detection mistake and make the ctia headset work stable. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214537 Reported-and-tested-by: msd Cc: Signed-off-by: Hui Wang Link: https://lore.kernel.org/r/20211012114748.5238-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai commit 7f565d0ead264329749c0da488de9c8dfa2f18ce Author: Sumit Garg Date: Tue Oct 12 13:01:16 2021 +0530 tee: optee: Fix missing devices unregister during optee_remove When OP-TEE driver is built as a module, OP-TEE client devices registered on TEE bus during probe should be unregistered during optee_remove. So implement optee_unregister_devices() accordingly. Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support") Reported-by: Sudeep Holla Signed-off-by: Sumit Garg Signed-off-by: Jens Wiklander commit 4d4a223a86afe658cd878800f09458e8bb54415d Author: Jacob Keller Date: Mon Oct 11 13:48:06 2021 -0700 ice: fix locking for Tx timestamp tracking flush Commit 4dd0d5c33c3e ("ice: add lock around Tx timestamp tracker flush") added a lock around the Tx timestamp tracker flow which is used to cleanup any left over SKBs and prepare for device removal. This lock is problematic because it is being held around a call to ice_clear_phy_tstamp. The clear function takes a mutex to send a PHY write command to firmware. This could lead to a deadlock if the mutex actually sleeps, and causes the following warning on a kernel with preemption debugging enabled: [ 715.419426] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:573 [ 715.427900] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3100, name: rmmod [ 715.435652] INFO: lockdep is turned off. [ 715.439591] Preemption disabled at: [ 715.439594] [<0000000000000000>] 0x0 [ 715.446678] CPU: 52 PID: 3100 Comm: rmmod Tainted: G W OE 5.15.0-rc4+ #42 bdd7ec3018e725f159ca0d372ce8c2c0e784891c [ 715.458058] Hardware name: Intel Corporation S2600STQ/S2600STQ, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ 715.468483] Call Trace: [ 715.470940] dump_stack_lvl+0x6a/0x9a [ 715.474613] ___might_sleep.cold+0x224/0x26a [ 715.478895] __mutex_lock+0xb3/0x1440 [ 715.482569] ? stack_depot_save+0x378/0x500 [ 715.486763] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.494979] ? kfree+0xc1/0x520 [ 715.498128] ? mutex_lock_io_nested+0x12a0/0x12a0 [ 715.502837] ? kasan_set_free_info+0x20/0x30 [ 715.507110] ? __kasan_slab_free+0x10b/0x140 [ 715.511385] ? slab_free_freelist_hook+0xc7/0x220 [ 715.516092] ? kfree+0xc1/0x520 [ 715.519235] ? ice_deinit_lag+0x16c/0x220 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.527359] ? ice_remove+0x1cf/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.535133] ? pci_device_remove+0xab/0x1d0 [ 715.539318] ? __device_release_driver+0x35b/0x690 [ 715.544110] ? driver_detach+0x214/0x2f0 [ 715.548035] ? bus_remove_driver+0x11d/0x2f0 [ 715.552309] ? pci_unregister_driver+0x26/0x250 [ 715.556840] ? ice_module_exit+0xc/0x2f [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.564799] ? __do_sys_delete_module.constprop.0+0x2d8/0x4e0 [ 715.570554] ? do_syscall_64+0x3b/0x90 [ 715.574303] ? entry_SYSCALL_64_after_hwframe+0x44/0xae [ 715.579529] ? start_flush_work+0x542/0x8f0 [ 715.583719] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.591923] ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.599960] ? wait_for_completion_io+0x250/0x250 [ 715.604662] ? lock_acquire+0x196/0x200 [ 715.608504] ? do_raw_spin_trylock+0xa5/0x160 [ 715.612864] ice_sbq_rw_reg+0x1e6/0x2f0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.620813] ? ice_reset+0x130/0x130 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.628497] ? __debug_check_no_obj_freed+0x1e8/0x3c0 [ 715.633550] ? trace_hardirqs_on+0x1c/0x130 [ 715.637748] ice_write_phy_reg_e810+0x70/0xf0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.646220] ? do_raw_spin_trylock+0xa5/0x160 [ 715.650581] ? ice_ptp_release+0x910/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.658797] ? ice_ptp_release+0x255/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.667013] ice_clear_phy_tstamp+0x2c/0x110 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.675403] ice_ptp_release+0x408/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.683440] ice_remove+0x560/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.691037] ? _raw_spin_unlock_irqrestore+0x46/0x73 [ 715.696005] pci_device_remove+0xab/0x1d0 [ 715.700018] __device_release_driver+0x35b/0x690 [ 715.704637] driver_detach+0x214/0x2f0 [ 715.708389] bus_remove_driver+0x11d/0x2f0 [ 715.712489] pci_unregister_driver+0x26/0x250 [ 715.716857] ice_module_exit+0xc/0x2f [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d] [ 715.724637] __do_sys_delete_module.constprop.0+0x2d8/0x4e0 [ 715.730210] ? free_module+0x6d0/0x6d0 [ 715.733963] ? task_work_run+0xe1/0x170 [ 715.737803] ? exit_to_user_mode_loop+0x17f/0x1d0 [ 715.742509] ? rcu_read_lock_sched_held+0x12/0x80 [ 715.747215] ? trace_hardirqs_on+0x1c/0x130 [ 715.751401] do_syscall_64+0x3b/0x90 [ 715.754981] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 715.760033] RIP: 0033:0x7f4dfe59000b [ 715.763612] Code: 73 01 c3 48 8b 0d 6d 1e 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 1e 0c 00 f7 d8 64 89 01 48 [ 715.782357] RSP: 002b:00007ffe8c891708 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 715.789923] RAX: ffffffffffffffda RBX: 00005558a20468b0 RCX: 00007f4dfe59000b [ 715.797054] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005558a2046918 [ 715.804189] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 715.811319] R10: 00007f4dfe603ac0 R11: 0000000000000206 R12: 00007ffe8c891940 [ 715.818455] R13: 00007ffe8c8920a3 R14: 00005558a20462a0 R15: 00005558a20468b0 Notice that this is the only case where we use the lock in this way. In the cleanup kthread and work kthread the lock is only taken around the bit accesses. This was done intentionally to avoid this kind of issue. The way the lock is used, we only protect ordering of bit sets vs bit clears. The Tx writers in the hot path don't need to be protected against the entire kthread loop. The Tx queues threads only need to ensure that they do not re-use an index that is currently in use. The cleanup loop does not need to block all new set bits, since it will re-queue itself if new timestamps are present. Fix the tracker flow so that it uses the same flow as the standard cleanup thread. In addition, ensure the in_use bitmap actually gets cleared properly. This fixes the warning and also avoids the potential deadlock that might have occurred otherwise. Fixes: 4dd0d5c33c3e ("ice: add lock around Tx timestamp tracker flush") Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 8e0ab8e26b72a80e991c66a8abc16e6c856abe3d Author: Roberto Sassu Date: Tue Oct 5 14:08:36 2021 +0200 s390: fix strrchr() implementation Fix two problems found in the strrchr() implementation for s390 architectures: evaluate empty strings (return the string address instead of NULL, if '\0' is passed as second argument); evaluate the first character of non-empty strings (the current implementation stops at the second). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Heiko Carstens (incorrect behavior with empty strings) Signed-off-by: Roberto Sassu Link: https://lore.kernel.org/r/20211005120836.60630-1-roberto.sassu@huawei.com Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 4540938952d47eec558ae69e190e0fe3076ec8ad Author: Cornelia Huck Date: Wed Oct 6 18:01:20 2021 +0200 vfio-ccw: step down as maintainer I currently don't have time to act as vfio-ccw maintainer anymore, but I trust that I leave it in capable hands. Signed-off-by: Cornelia Huck Acked-by: Eric Farman Acked-by: Matthew Rosato Acked-by: Christian Borntraeger Link: https://lore.kernel.org/r/20211006160120.217636-3-cohuck@redhat.com Signed-off-by: Vasily Gorbik commit 1606520a24542d6566077f99f3678e18d05bdd28 Author: Cornelia Huck Date: Wed Oct 6 18:01:19 2021 +0200 KVM: s390: remove myself as reviewer I currently don't have time anymore to review KVM/s390 code. Signed-off-by: Cornelia Huck Acked-by: Janosch Frank Acked-by: Christian Borntraeger Link: https://lore.kernel.org/r/20211006160120.217636-2-cohuck@redhat.com Signed-off-by: Vasily Gorbik commit 7389074ced34091b12ca5ee65ceed9194224a7f6 Merge: ef1100ef20f29 7b1700e009cc1 Author: David S. Miller Date: Tue Oct 12 11:49:50 2021 +0100 Merge branch 'ioam-fixes' Justin Iurman says: ==================== Correct the IOAM behavior for undefined trace type bits (@Jakub @David: there will be a conflict for #2 when merging net->net-next, due to commit [1]. The conflict is only 5-10 lines for #2 (#1 should be fine) inside the file tools/testing/selftests/net/ioam6.sh, so quite short though possibly ugly. Sorry for that, I didn't expect to post this one... Had I known, I'd have made the opposite.) Modify both the input and output behaviors regarding the trace type when one of the undefined bits is set. The goal is to keep the interoperability when new fields (aka new bits inside the range 12-21) will be defined. The draft [2] says the following: --------------------------------------------------------------- "Bit 12-21 Undefined. These values are available for future assignment in the IOAM Trace-Type Registry (Section 8.2). Every future node data field corresponding to one of these bits MUST be 4-octets long. An IOAM encapsulating node MUST set the value of each undefined bit to 0. If an IOAM transit node receives a packet with one or more of these bits set to 1, it MUST either: 1. Add corresponding node data filled with the reserved value 0xFFFFFFFF, after the node data fields for the IOAM-Trace-Type bits defined above, such that the total node data added by this node in units of 4-octets is equal to NodeLen, or 2. Not add any node data fields to the packet, even for the IOAM-Trace-Type bits defined above." --------------------------------------------------------------- The output behavior has been modified to respect the fact that "an IOAM encap node MUST set the value of each undefined bit to 0" (i.e., undefined bits can't be set anymore). As for the input behavior, current implementation is based on the second choice (i.e., "not add any data fields to the packet [...]"). With this solution, any interoperability is lost (i.e., if a new bit is defined, then an "old" kernel implementation wouldn't fill IOAM data when such new bit is set inside the trace type). The input behavior is therefore relaxed and these undefined bits are now allowed to be set. It is only possible thanks to the sentence "every future node data field corresponding to one of these bits MUST be 4-octets long". Indeed, the default empty value (the one for 4-octet fields) is inserted whenever an undefined bit is set. [1] cfbe9b002109621bf9a282a4a24f9415ef14b57b [2] https://datatracker.ietf.org/doc/html/draft-ietf-ippm-ioam-data#section-5.4.1 ==================== Signed-off-by: David S. Miller commit 7b1700e009cc17702e8db3af1d983860c0eb7164 Author: Justin Iurman Date: Mon Oct 11 20:04:12 2021 +0200 selftests: net: modify IOAM tests for undef bits The output behavior for undefined bits is now directly tested inside the bash script. Trying to set an undefined bit should be refused. The input behavior for undefined bits has been removed due to the fact that we would need another sender allowed to set undefined bits. Signed-off-by: Justin Iurman Signed-off-by: David S. Miller commit 2bbc977ca689e5e18e8cf98f68854f92bd053c97 Author: Justin Iurman Date: Mon Oct 11 20:04:11 2021 +0200 ipv6: ioam: move the check for undefined bits The check for undefined bits in the trace type is moved from the input side to the output side, while the input side is relaxed and now inserts default empty values when an undefined bit is set. Signed-off-by: Justin Iurman Signed-off-by: David S. Miller commit 55e6d8037805b3400096d621091dfbf713f97e83 Author: Yang Yingliang Date: Tue Oct 12 10:37:35 2021 +0800 regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails. Reported-by: Hulk Robot Fixes: 3f4ff561bc88b ("regmap: rbtree: Make cache_present bitmap per node") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20211012023735.1632786-1-yangyingliang@huawei.com Signed-off-by: Mark Brown commit aa18457c4af7a9dad1f2b150b11beae1d8ab57aa Author: Stefan Binding Date: Mon Oct 11 15:49:03 2021 +0100 ASoC: cs42l42: Ensure 0dB full scale volume is used for headsets Ensure the default 0dB playback path is always used. The code that set FULL_SCALE_VOL based on LOAD_DET_RCSTAT was spurious, and resulted in a -6dB attenuation being accidentally inserted into the playback path. Signed-off-by: Stefan Binding Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20211011144903.28915-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ef1100ef20f29aec4e62abeccdb5bdbebba1e378 Author: Arun Ramadoss Date: Mon Oct 11 21:18:08 2021 +0530 net: dsa: microchip: Added the condition for scheduling ksz_mib_read_work When the ksz module is installed and removed using rmmod, kernel crashes with null pointer dereferrence error. During rmmod, ksz_switch_remove function tries to cancel the mib_read_workqueue using cancel_delayed_work_sync routine and unregister switch from dsa. During dsa_unregister_switch it calls ksz_mac_link_down, which in turn reschedules the workqueue since mib_interval is non-zero. Due to which queue executed after mib_interval and it tries to access dp->slave. But the slave is unregistered in the ksz_switch_remove function. Hence kernel crashes. To avoid this crash, before canceling the workqueue, resetted the mib_interval to 0. v1 -> v2: -Removed the if condition in ksz_mib_read_work Fixes: 469b390e1ba3 ("net: dsa: microchip: use delayed_work instead of timer + work") Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit 9973a43012b6ad1720dbc4d5faf5302c28635b8c Author: Vegard Nossum Date: Mon Oct 11 17:22:49 2021 +0200 r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 Fix the following build/link errors by adding a dependency on CRYPTO, CRYPTO_HASH, CRYPTO_SHA256 and CRC32: ld: drivers/net/usb/r8152.o: in function `rtl8152_fw_verify_checksum': r8152.c:(.text+0x2b2a): undefined reference to `crypto_alloc_shash' ld: r8152.c:(.text+0x2bed): undefined reference to `crypto_shash_digest' ld: r8152.c:(.text+0x2c50): undefined reference to `crypto_destroy_tfm' ld: drivers/net/usb/r8152.o: in function `_rtl8152_set_rx_mode': r8152.c:(.text+0xdcb0): undefined reference to `crc32_le' Fixes: 9370f2d05a2a1 ("r8152: support request_firmware for RTL8153") Fixes: ac718b69301c7 ("net/usb: new driver for RTL8152") Signed-off-by: Vegard Nossum Signed-off-by: David S. Miller commit 4a3e0aeddf091f00974b02627c157843ce382a24 Author: Maarten Zanders Date: Mon Oct 11 16:27:20 2021 +0200 net: dsa: mv88e6xxx: don't use PHY_DETECT on internal PHY's mv88e6xxx_port_ppu_updates() interpretes data in the PORT_STS register incorrectly for internal ports (ie no PPU). In these cases, the PHY_DETECT bit indicates link status. This results in forcing the MAC state whenever the PHY link goes down which is not intended. As a side effect, LED's configured to show link status stay lit even though the physical link is down. Add a check in mac_link_down and mac_link_up to see if it concerns an external port and only then, look at PPU status. Fixes: 5d5b231da7ac (net: dsa: mv88e6xxx: use PHY_DETECT in mac_link_up/mac_link_down) Reported-by: Maarten Zanders Reviewed-by: Maxime Chevallier Signed-off-by: Maarten Zanders Signed-off-by: David S. Miller commit 74a3bc42fe514098030a78c1ad5e6024463dd378 Author: Wan Jiabing Date: Mon Oct 11 10:27:41 2021 +0800 net: mscc: ocelot: Fix dumplicated argument in ocelot Fix the following coccicheck warning: drivers/net/ethernet/mscc/ocelot.c:474:duplicated argument to & or | drivers/net/ethernet/mscc/ocelot.c:476:duplicated argument to & or | drivers/net/ethernet/mscc/ocelot_net.c:1627:duplicated argument to & or | These DEV_CLOCK_CFG_MAC_TX_RST are duplicate here. Here should be DEV_CLOCK_CFG_MAC_RX_RST. Fixes: e6e12df625f2 ("net: mscc: ocelot: convert to phylink") Signed-off-by: Wan Jiabing Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 0edf0824e0dc359ed76bf96af986e6570ca2c0b9 Author: Stephen Boyd Date: Fri Oct 8 14:59:45 2021 -0700 af_unix: Rename UNIX-DGRAM to UNIX to maintain backwards compatability Then name of this protocol changed in commit 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") because that commit added stream support to the af_unix protocol. Renaming the existing protocol makes a ChromeOS protocol test[1] fail now that the name has changed in /proc/net/protocols from "UNIX" to "UNIX-DGRAM". Let's put the name back to how it was while keeping the stream protocol as "UNIX-STREAM" so that the procfs interface doesn't change. This fixes the test and maintains backwards compatibility in proc. Cc: Jiang Wang Cc: Andrii Nakryiko Cc: Cong Wang Cc: Jakub Sitnicki Cc: John Fastabend Cc: Dmitry Osipenko Link: https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:src/platform/tast-tests/src/chromiumos/tast/local/bundles/cros/network/supported_protocols.go;l=50;drc=e8b1c3f94cb40a054f4aa1ef1aff61e75dc38f18 [1] Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") Signed-off-by: Stephen Boyd Signed-off-by: David S. Miller commit 4217d07b9fb328751f877d3bd9550122014860a2 Author: Shawn Guo Date: Mon Oct 4 10:49:35 2021 +0800 mmc: sdhci: Map more voltage level to SDHCI_POWER_330 On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V), which is being treated as an invalid value by sdhci_set_power_noreg(). And thus eMMC is totally broken on the platform. [ 1.436599] ------------[ cut here ]------------ [ 1.436606] mmc0: Invalid vdd 0x17 [ 1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4 [ 1.436655] Modules linked in: [ 1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G W 5.15.0-rc1+ #137 [ 1.436669] Hardware name: Thundercomm TurboX CM2290 (DT) [ 1.436674] Workqueue: events_unbound async_run_entry_fn [ 1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4 [ 1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4 [ 1.436703] sp : ffff800010803a60 [ 1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70 [ 1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280 [ 1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000 [ 1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020 [ 1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff [ 1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc [ 1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60 [ 1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159 [ 1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff [ 1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80 [ 1.436797] Call trace: [ 1.436800] sdhci_set_power_noreg+0x168/0x2b4 [ 1.436805] sdhci_set_ios+0xa0/0x7fc [ 1.436811] mmc_power_up.part.0+0xc4/0x164 [ 1.436818] mmc_start_host+0xa0/0xb0 [ 1.436824] mmc_add_host+0x60/0x90 [ 1.436830] __sdhci_add_host+0x174/0x330 [ 1.436836] sdhci_msm_probe+0x7c0/0x920 [ 1.436842] platform_probe+0x68/0xe0 [ 1.436850] really_probe.part.0+0x9c/0x31c [ 1.436857] __driver_probe_device+0x98/0x144 [ 1.436863] driver_probe_device+0xc8/0x15c [ 1.436869] __device_attach_driver+0xb4/0x120 [ 1.436875] bus_for_each_drv+0x78/0xd0 [ 1.436881] __device_attach_async_helper+0xac/0xd0 [ 1.436888] async_run_entry_fn+0x34/0x110 [ 1.436895] process_one_work+0x1d0/0x354 [ 1.436903] worker_thread+0x13c/0x470 [ 1.436910] kthread+0x150/0x160 [ 1.436915] ret_from_fork+0x10/0x20 [ 1.436923] ---[ end trace fcfac44cb045c3a8 ]--- Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to SDHCI_POWER_330 as well. Signed-off-by: Shawn Guo Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org Signed-off-by: Ulf Hansson commit 013923477cb311293df9079332cf8b806ed0e6f2 Author: Dan Carpenter Date: Wed Oct 6 10:34:19 2021 +0300 pata_legacy: fix a couple uninitialized variable bugs The last byte of "pad" is used without being initialized. Fixes: 55dba3120fbc ("libata: update ->data_xfer hook for ATAPI") Signed-off-by: Dan Carpenter Signed-off-by: Damien Le Moal commit ff01a6220400a944e8c27ae599d9da8e1e3610d9 Merge: 64570fbc14f8d c8f01ffc83923 Author: Dave Airlie Date: Tue Oct 12 10:31:07 2021 +1000 Merge tag 'drm-msm-fixes-2021-10-11' of https://gitlab.freedesktop.org/drm/msm into drm-fixes * Fix a new crash on dev file close if the dev file was opened when GPU is not loaded (such as missing fw in initrd) * Switch to single drm_sched_entity per priority level per drm_file to unbreak multi-context userspace * Serialize GMU access to fix GMU OOB errors * Various error path fixes * A couple integer overflow fixes * Fix mdp5 cursor plane WARNs Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGtD4u7yyiy+BQLmibUCbn=AdDRu7FrmdViHVx0QrcGf8g@mail.gmail.com commit c8f01ffc83923a91e8087aaa077de13354a7aa59 Author: Dan Carpenter Date: Fri Oct 1 15:34:09 2021 +0300 drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling This disables a lock which wasn't enabled and it does not disable the first lock in the array. Fixes: 6e0eb52eba9e ("drm/msm/dsi: Parse bus clocks from a list") Signed-off-by: Dan Carpenter Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20211001123409.GG2283@kili Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit 739b4e7756d3301dd673ca517afca46a5f635562 Author: Dan Carpenter Date: Fri Oct 1 15:33:08 2021 +0300 drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() Return an error code if msm_dsi_manager_validate_current_config(). Don't return success. Fixes: 8b03ad30e314 ("drm/msm/dsi: Use one connector for dual DSI mode") Signed-off-by: Dan Carpenter Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20211001123308.GF2283@kili Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit 90b7c1c66132c20e8a550006011a3cbfb73dbfc1 Author: Marijn Suijten Date: Mon Sep 6 22:25:51 2021 +0200 drm/msm/dsi: dsi_phy_14nm: Take ready-bit into account in poll_for_ready The downstream driver models this PLL lock check as an if-elseif-else. The only way to reach the else case where pll_locked=true [1] is by succeeding both readl_poll_timeout_atomic calls (which return zero on success) in the if _and_ elseif condition. Hence both the "lock" and "ready" bit need to be tested in the SM_READY_STATUS register before considering the PLL locked and ready to go. Tested on the Sony Xperia XA2 Ultra (nile-discovery, sdm630). [1]: https://source.codeaurora.org/quic/la/kernel/msm-4.19/tree/drivers/clk/qcom/mdss/mdss-dsi-pll-14nm-util.c?h=LA.UM.9.2.1.r1-08000-sdm660.0#n302 Fixes: f079f6d999cb ("drm/msm/dsi: Add PHY/PLL for 8x96") Signed-off-by: Marijn Suijten Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210906202552.824598-1-marijn.suijten@somainline.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit ad69b73add8967bc92b62a1cf23a911705781488 Author: Dmitry Baryshkov Date: Tue Sep 21 19:22:45 2021 +0300 drm/msm/dsi/phy: fix clock names in 28nm_8960 phy The commit 9f91f22aafcd ("drm/msm/dsi: remove duplicate fields from dsi_pll_Nnm instances") mistakenly changed registered clock names. While the platform is in progress of migration to using clock properties in the dts rather than the global clock names, we should provide backwards compatibility. Thus restore registerd global clock names. Fixes: 9f91f22aafcd ("drm/msm/dsi: remove duplicate fields from dsi_pll_Nnm instances") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Link: https://lore.kernel.org/r/20210921162245.1858118-1-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit 3431c17b75c62f8a28db887441bced2007bd3ffc Author: Robert Foss Date: Thu Aug 19 15:36:36 2021 +0200 drm/msm/dpu: Fix address of SM8150 PINGPONG5 IRQ register Both PINGPONG4 and PINGPONG5 IRQ registers are using the same address, which is incorrect. PINGPONG4 should use the register offset 30, and PINGPONG5 should use the register offset 31 according to the downstream driver. Fixes: 667e9985ee24 ("drm/msm/dpu: replace IRQ lookup with the data in hw catalog") Signed-off-by: Robert Foss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210819133636.2045766-1-robert.foss@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit 6a7e0b0e9fb839caa7c7f25bcf91a95b1c2cbef1 Author: Fabio Estevam Date: Tue Sep 14 14:48:31 2021 -0300 drm/msm: Do not run snapshot on non-DPU devices Since commit 98659487b845 ("drm/msm: add support to take dpu snapshot") the following NULL pointer dereference is seen on i.MX53: [ 3.275493] msm msm: bound 30000000.gpu (ops a3xx_ops) [ 3.287174] [drm] Initialized msm 1.8.0 20130625 for msm on minor 0 [ 3.293915] 8<--- cut here --- [ 3.297012] Unable to handle kernel NULL pointer dereference at virtual address 00000028 [ 3.305244] pgd = (ptrval) [ 3.307989] [00000028] *pgd=00000000 [ 3.311624] Internal error: Oops: 805 [#1] SMP ARM [ 3.316430] Modules linked in: [ 3.319503] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.14.0+g682d702b426b #1 [ 3.326652] Hardware name: Freescale i.MX53 (Device Tree Support) [ 3.332754] PC is at __mutex_init+0x14/0x54 [ 3.336969] LR is at msm_disp_snapshot_init+0x24/0xa0 i.MX53 does not use the DPU controller. Fix the problem by only calling msm_disp_snapshot_init() on platforms that use the DPU controller. Cc: stable@vger.kernel.org Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20210914174831.2044420-1-festevam@gmail.com Signed-off-by: Rob Clark commit 3eda901995371d390ef82d0b6462f4ea8efbcfdf Author: Dan Carpenter Date: Fri Oct 1 15:59:04 2021 +0300 drm/msm/a3xx: fix error handling in a3xx_gpu_init() These error paths returned 1 on failure, instead of a negative error code. This would lead to an Oops in the caller. A second problem is that the check for "if (ret != -ENODATA)" did not work because "ret" was set to 1. Fixes: 5785dd7a8ef0 ("drm/msm: Fix duplicate gpu node in icc summary") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20211001125904.GK2283@kili Signed-off-by: Rob Clark commit 980d74e7d03ccf2eaa11d133416946bd880c7c08 Author: Dan Carpenter Date: Fri Oct 1 15:57:59 2021 +0300 drm/msm/a4xx: fix error handling in a4xx_gpu_init() This code returns 1 on error instead of a negative error. It leads to an Oops in the caller. A second problem is that the check for "if (ret != -ENODATA)" cannot be true because "ret" is set to 1. Fixes: 5785dd7a8ef0 ("drm/msm: Fix duplicate gpu node in icc summary") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20211001125759.GJ2283@kili Signed-off-by: Rob Clark commit 2133c4fc8e1348dcb752f267a143fe2254613b34 Author: Colin Ian King Date: Wed Sep 29 13:18:57 2021 +0100 drm/msm: Fix null pointer dereference on pointer edp The initialization of pointer dev dereferences pointer edp before edp is null checked, so there is a potential null pointer deference issue. Fix this by only dereferencing edp after edp has been null checked. Addresses-Coverity: ("Dereference before null check") Fixes: ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)") Signed-off-by: Colin Ian King Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210929121857.213922-1-colin.king@canonical.com Signed-off-by: Rob Clark commit c491a0c7bbf3a64732cb8414021429d15ec08eec Author: Dmitry Baryshkov Date: Sat Sep 25 22:28:24 2021 +0300 drm/msm/mdp5: fix cursor-related warnings Since f35a2a99100f ("drm/encoder: make encoder control functions optional") drm_mode_config_validate would print warnings if both cursor plane and cursor functions are provided. Restore separate set of drm_crtc_funcs to be used if separate cursor plane is provided. [ 6.556046] ------------[ cut here ]------------ [ 6.556071] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_set func [ 6.556091] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:648 drm_mode_config_validate+0x238/0x4d0 [ 6.567453] Modules linked in: [ 6.577604] CPU: 1 PID: 76 Comm: kworker/u8:2 Not tainted 5.15.0-rc1-dirty #43 [ 6.580557] Hardware name: Qualcomm Technologies, Inc. DB820c (DT) [ 6.587763] Workqueue: events_unbound deferred_probe_work_func [ 6.593926] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 6.599740] pc : drm_mode_config_validate+0x238/0x4d0 [ 6.606596] lr : drm_mode_config_validate+0x238/0x4d0 [ 6.611804] sp : ffff8000121b3980 [ 6.616838] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001 [ 6.620140] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8 [ 6.627258] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001 [ 6.634376] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff [ 6.641494] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c78709 [ 6.648613] x14: 0000000000000000 x13: ffff800011a22850 x12: 00000000000009ab [ 6.655730] x11: 0000000000000339 x10: ffff800011a22850 x9 : ffff800011a22850 [ 6.662848] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850 [ 6.669966] x5 : 000000000000bff4 x4 : 40000000fffff339 x3 : 0000000000000000 [ 6.677084] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800 [ 6.684205] Call trace: [ 6.691319] drm_mode_config_validate+0x238/0x4d0 [ 6.693577] drm_dev_register+0x17c/0x210 [ 6.698435] msm_drm_bind+0x4b4/0x694 [ 6.702429] try_to_bring_up_master+0x164/0x1d0 [ 6.706075] __component_add+0xa0/0x170 [ 6.710415] component_add+0x14/0x20 [ 6.714234] msm_hdmi_dev_probe+0x1c/0x2c [ 6.718053] platform_probe+0x68/0xe0 [ 6.721959] really_probe.part.0+0x9c/0x30c [ 6.725606] __driver_probe_device+0x98/0x144 [ 6.729600] driver_probe_device+0xc8/0x15c [ 6.734114] __device_attach_driver+0xb4/0x120 [ 6.738106] bus_for_each_drv+0x78/0xd0 [ 6.742619] __device_attach+0xdc/0x184 [ 6.746351] device_initial_probe+0x14/0x20 [ 6.750172] bus_probe_device+0x9c/0xa4 [ 6.754337] deferred_probe_work_func+0x88/0xc0 [ 6.758158] process_one_work+0x1d0/0x370 [ 6.762671] worker_thread+0x2c8/0x470 [ 6.766839] kthread+0x15c/0x170 [ 6.770483] ret_from_fork+0x10/0x20 [ 6.773870] ---[ end trace 5884eb76cd26d274 ]--- [ 6.777500] ------------[ cut here ]------------ [ 6.782043] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_move func [ 6.782063] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:654 drm_mode_config_validate+0x290/0x4d0 [ 6.794362] Modules linked in: [ 6.804600] CPU: 1 PID: 76 Comm: kworker/u8:2 Tainted: G W 5.15.0-rc1-dirty #43 [ 6.807555] Hardware name: Qualcomm Technologies, Inc. DB820c (DT) [ 6.816148] Workqueue: events_unbound deferred_probe_work_func [ 6.822311] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 6.828126] pc : drm_mode_config_validate+0x290/0x4d0 [ 6.834981] lr : drm_mode_config_validate+0x290/0x4d0 [ 6.840189] sp : ffff8000121b3980 [ 6.845223] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001 [ 6.848525] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8 [ 6.855643] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001 [ 6.862763] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff [ 6.869879] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c790c2 [ 6.876998] x14: 0000000000000000 x13: ffff800011a22850 x12: 0000000000000a2f [ 6.884116] x11: 0000000000000365 x10: ffff800011a22850 x9 : ffff800011a22850 [ 6.891234] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850 [ 6.898351] x5 : 000000000000bff4 x4 : 40000000fffff365 x3 : 0000000000000000 [ 6.905470] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800 [ 6.912590] Call trace: [ 6.919702] drm_mode_config_validate+0x290/0x4d0 [ 6.921960] drm_dev_register+0x17c/0x210 [ 6.926821] msm_drm_bind+0x4b4/0x694 [ 6.930813] try_to_bring_up_master+0x164/0x1d0 [ 6.934459] __component_add+0xa0/0x170 [ 6.938799] component_add+0x14/0x20 [ 6.942619] msm_hdmi_dev_probe+0x1c/0x2c [ 6.946438] platform_probe+0x68/0xe0 [ 6.950345] really_probe.part.0+0x9c/0x30c [ 6.953991] __driver_probe_device+0x98/0x144 [ 6.957984] driver_probe_device+0xc8/0x15c [ 6.962498] __device_attach_driver+0xb4/0x120 [ 6.966492] bus_for_each_drv+0x78/0xd0 [ 6.971004] __device_attach+0xdc/0x184 [ 6.974737] device_initial_probe+0x14/0x20 [ 6.978556] bus_probe_device+0x9c/0xa4 [ 6.982722] deferred_probe_work_func+0x88/0xc0 [ 6.986543] process_one_work+0x1d0/0x370 [ 6.991057] worker_thread+0x2c8/0x470 [ 6.995223] kthread+0x15c/0x170 [ 6.998869] ret_from_fork+0x10/0x20 [ 7.002255] ---[ end trace 5884eb76cd26d275 ]--- Fixes: aa649e875daf ("drm/msm/mdp5: mdp5_crtc: Restore cursor state only if LM cursors are enabled") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210925192824.3416259-1-dmitry.baryshkov@linaro.org Signed-off-by: Rob Clark commit 171316a68d9a8e0d9e28b7cf4c15afc4c6244a4e Author: Marek Vasut Date: Fri Sep 17 02:59:13 2021 +0200 drm/msm: Avoid potential overflow in timeout_to_jiffies() The return type of ktime_divns() is s64. The timeout_to_jiffies() currently assigns the result of this ktime_divns() to unsigned long, which on 32 bit systems may overflow. Furthermore, the result of this function is sometimes also passed to functions which expect signed long, dma_fence_wait_timeout() is one such example. Fix this by adjusting the type of remaining_jiffies to s64, so we do not suffer overflow there, and return a value limited to range of 0..INT_MAX, which is safe for all usecases of this timeout. The above overflow can be triggered if userspace passes in too large timeout value, larger than INT_MAX / HZ seconds. The kernel detects it and complains about "schedule_timeout: wrong timeout value %lx" and generates a warning backtrace. Note that this fixes commit 6cedb8b377bb ("drm/msm: avoid using 'timespec'"), because the previously used timespec_to_jiffies() function returned unsigned long instead of s64: static inline unsigned long timespec_to_jiffies(const struct timespec *value) Fixes: 6cedb8b377bb ("drm/msm: avoid using 'timespec'") Signed-off-by: Marek Vasut Cc: Arnd Bergmann Cc: Jordan Crouse Cc: Rob Clark Cc: stable@vger.kernel.org # 5.6+ Acked-by: Arnd Bergmann Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210917005913.157379-1-marex@denx.de Signed-off-by: Rob Clark commit efb8a170a367fa898d7848c4e74c1c20222e0d91 Author: Stephan Gerhold Date: Mon Sep 13 18:45:56 2021 +0200 drm/msm: Fix devfreq NULL pointer dereference on a3xx There is no devfreq on a3xx at the moment since gpu_busy is not implemented. This means that msm_devfreq_init() will return early and the entire devfreq setup is skipped. However, msm_devfreq_active() and msm_devfreq_idle() are still called unconditionally later, causing a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Internal error: Oops: 96000004 [#1] PREEMPT SMP CPU: 0 PID: 133 Comm: ring0 Not tainted 5.15.0-rc1 #4 Hardware name: Longcheer L8150 (DT) pc : mutex_lock_io+0x2bc/0x2f0 lr : msm_devfreq_active+0x3c/0xe0 [msm] Call trace: mutex_lock_io+0x2bc/0x2f0 msm_gpu_submit+0x164/0x180 [msm] msm_job_run+0x54/0xe0 [msm] drm_sched_main+0x2b0/0x4a0 [gpu_sched] kthread+0x154/0x160 ret_from_fork+0x10/0x20 Fix this by adding a check in msm_devfreq_active/idle() which ensures that devfreq was actually initialized earlier. Fixes: 9bc95570175a ("drm/msm: Devfreq tuning") Reported-by: Nikita Travkin Tested-by: Nikita Travkin Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20210913164556.16284-1-stephan@gerhold.net Signed-off-by: Rob Clark commit 9463b64d1a34fc4d18f9de63f07b2400c86f8da8 Author: Kuogee Hsieh Date: Wed Sep 29 09:17:04 2021 -0700 drm/msm/dp: only signal audio when disconnected detected at dp_pm_resume Currently there is audio not working problem after system resume from suspend if hdmi monitor stay plugged in at DUT. However this problem does not happen at normal operation but at a particular test case. The root cause is DP driver signal audio with connected state at resume which trigger audio trying to setup audio data path through DP main link but failed due to display port is not setup and enabled by upper layer framework yet. This patch only have DP driver signal audio only when DP is in disconnected state so that audio option shows correct state after system resume. DP driver will not signal audio with connected state until display enabled executed by upper layer framework where display port is setup completed and main link is running. Changes in V2: -- add details commit text Fixes: afc9b8b6bab8 ("drm/msm/dp: signal audio plugged change at dp_pm_resume") Signed-off-by: Kuogee Hsieh Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1632932224-25102-1-git-send-email-khsieh@codeaurora.org Signed-off-by: Rob Clark commit fa5878760579a9feaa1de3bb2396cd23beb439ca Merge: 459ea72c6cb98 361b57df62de2 Author: Linus Torvalds Date: Mon Oct 11 17:25:08 2021 -0700 Merge tag 'linux-kselftest-kunit-fixes-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kunit fixes from Shuah Khan: - Fixes to address the structleak plugin causing the stack frame size to grow immensely when used with KUnit. Fixes include adding a new makefile to disable structleak and using it from KUnit iio, device property, thunderbolt, and bitfield tests to disable it. - KUnit framework reference count leak in kfree_at_end - KUnit tool fix to resolve conflict between --json and --raw_output and generate correct test output in either case. - kernel-doc warnings due to mismatched arg names * tag 'linux-kselftest-kunit-fixes-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: fix kernel-doc warnings due to mismatched arg names bitfield: build kunit tests without structleak plugin thunderbolt: build kunit tests without structleak plugin device property: build kunit tests without structleak plugin iio/test-format: build kunit tests without structleak plugin gcc-plugins/structleak: add makefile var for disabling structleak kunit: fix reference count leak in kfree_at_end kunit: tool: better handling of quasi-bool args (--json, --raw_output) commit 459ea72c6cb98164ccacd6d06e3121554c13ba5e Merge: 0a5d6c641b671 c0002d11d7990 Author: Linus Torvalds Date: Mon Oct 11 17:16:41 2021 -0700 Merge branch 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "All documentation / comment updates" * 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroupv2, docs: fix misinformation in "device controller" section cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem docs/cgroup: remove some duplicate words commit 4157a441ff068cc406513e7b8069efa19bba89d0 Author: Chun-Kuang Hu Date: Fri Oct 8 07:28:40 2021 +0800 Revert "drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb" This reverts commit c1ec54b7b5af25c779192253f5a9f05e95cb43d7. Commit c1ec54b7b5af ("drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb") would cause numerous mtk cmdq mailbox driver warning: WARNING: CPU: 0 PID: 0 at drivers/mailbox/mtk-cmdq-mailbox.c:198 cmdq_task_exec_done+0xb8/0xe0 So revert that patch. Reported-by: Enric Balletbo Serra Tested-by: Enric Balletbo Serra Signed-off-by: Chun-Kuang Hu commit 8a4a099f843890504d4942b93b3290a53a53ff3a Author: Chun-Kuang Hu Date: Fri Oct 8 07:27:11 2021 +0800 Revert "drm/mediatek: Remove struct cmdq_client" This reverts commit f4be17cd5b14dd73545b0e014a63ebe9ab5ef837. Commit c1ec54b7b5af ("drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb") would cause numerous mtk cmdq mailbox driver warning: WARNING: CPU: 0 PID: 0 at drivers/mailbox/mtk-cmdq-mailbox.c:198 cmdq_task_exec_done+0xb8/0xe0 So revert that patch and all the patches depend on that patch. Reported-by: Enric Balletbo Serra Tested-by: Enric Balletbo Serra Signed-off-by: Chun-Kuang Hu commit 0cf54fff9bcffa69bb96f2da8539858402aea404 Author: Chun-Kuang Hu Date: Fri Oct 8 07:25:32 2021 +0800 Revert "drm/mediatek: Detect CMDQ execution timeout" This reverts commit 8cdcb365342402fdeb664479b0a04e9debef8efb. Commit c1ec54b7b5af ("drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb") would cause numerous mtk cmdq mailbox driver warning: WARNING: CPU: 0 PID: 0 at drivers/mailbox/mtk-cmdq-mailbox.c:198 cmdq_task_exec_done+0xb8/0xe0 So revert that patch and all the patches depend on that patch. Reported-by: Enric Balletbo Serra Tested-by: Enric Balletbo Serra Signed-off-by: Chun-Kuang Hu commit be7d2d837363e2d36bc9d87b89207f1b8f5c997d Author: Chun-Kuang Hu Date: Fri Oct 8 07:23:02 2021 +0800 Revert "drm/mediatek: Add cmdq_handle in mtk_crtc" This reverts commit bc9241be73d9b2b3bcb7033598521fd669639848. Commit c1ec54b7b5af ("drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb") would cause numerous mtk cmdq mailbox driver warning: WARNING: CPU: 0 PID: 0 at drivers/mailbox/mtk-cmdq-mailbox.c:198 cmdq_task_exec_done+0xb8/0xe0 So revert that patch and all the patches depend on that patch. Reported-by: Enric Balletbo Serra Tested-by: Enric Balletbo Serra Signed-off-by: Chun-Kuang Hu commit bdefc6b23be33add5e075fb76b97271dad4f813c Author: Chun-Kuang Hu Date: Fri Oct 8 07:11:20 2021 +0800 Revert "drm/mediatek: Clear pending flag when cmdq packet is done" This reverts commit 9efb16c2fdd647d3888fd8dae84509f485cd554e. Commit c1ec54b7b5af ("drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb") would cause numerous mtk cmdq mailbox driver warning: WARNING: CPU: 0 PID: 0 at drivers/mailbox/mtk-cmdq-mailbox.c:198 cmdq_task_exec_done+0xb8/0xe0 So revert that patch and all the patches depend on that patch. Reported-by: Enric Balletbo Serra Tested-by: Enric Balletbo Serra Signed-off-by: Chun-Kuang Hu commit 0a5d6c641b671370f019cbe20fe51ee3ef00264c Merge: 1986c10acc9c9 57116ce17b04f Author: Linus Torvalds Date: Mon Oct 11 16:59:49 2021 -0700 Merge branch 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: "One patch to add a missing __printf annotation and the other to enable deferred printing for debug dumps to avoid deadlocks when triggered from some contexts (e.g. console drivers)" * 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix state-dump console deadlock workqueue: annotate alloc_workqueue() as printf commit 1986c10acc9c906e453fb19d86e6342e8e525824 Merge: 64570fbc14f8d 4afb912f439c4 Author: Linus Torvalds Date: Mon Oct 11 16:48:19 2021 -0700 Merge tag 'for-5.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more error handling fixes, stemming from code inspection, error injection or fuzzing" * tag 'for-5.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix abort logic in btrfs_replace_file_extents btrfs: check for error when looking up inode during dir entry replay btrfs: unify lookup return value when dir entry is missing btrfs: deal with errors when adding inode reference during log replay btrfs: deal with errors when replaying dir entry during log replay btrfs: deal with errors when checking if a dir entry exists during log replay btrfs: update refs for any root except tree log roots btrfs: unlock newly allocated extent buffer after error commit 465f15a6d1a8f51f7e09fba12678b39031f63ca9 Author: Florian Westphal Date: Thu Sep 23 15:12:42 2021 +0200 selftests: nft_nat: add udp hole punch test case Add a test case that demonstrates port shadowing via UDP. ns2 sends packet to ns1, from source port used by a udp service on the router, ns0. Then, ns1 sends packet to ns0:service, but that ends up getting forwarded to ns2. Also add three test cases that demonstrate mitigations: 1. disable use of $port as source from 'unstrusted' origin 2. make the service untracked. This prevents masquerade entries from having any effects. 3. add forced PAT via 'random' mode to translate the "wrong" sport into an acceptable range. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2e5809a4ddb15969503e43b06662a9a725f613ea Author: Mike Kravetz Date: Tue Oct 5 13:25:29 2021 -0700 arm64/hugetlb: fix CMA gigantic page order for non-4K PAGE_SIZE For non-4K PAGE_SIZE configs, the largest gigantic huge page size is CONT_PMD_SHIFT order. On arm64 with 64K PAGE_SIZE, the gigantic page is 16G. Therefore, one should be able to specify 'hugetlb_cma=16G' on the kernel command line so that one gigantic page can be allocated from CMA. However, when adding such an option the following message is produced: hugetlb_cma: cma area should be at least 8796093022208 MiB This is because the calculation for non-4K gigantic page order is incorrect in the arm64 specific routine arm64_hugetlb_cma_reserve(). Fixes: abb7962adc80 ("arm64/hugetlb: Reserve CMA areas for gigantic pages on 16K and 64K configs") Cc: # 5.9.x Signed-off-by: Mike Kravetz Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20211005202529.213812-1-mike.kravetz@oracle.com Signed-off-by: Catalin Marinas commit 711885906b5c2df90746a51f4cd674f1ab9fbb1d Author: Borislav Petkov Date: Wed Oct 6 19:34:55 2021 +0200 x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically This Kconfig option was added initially so that memory encryption is enabled by default on machines which support it. However, devices which have DMA masks that are less than the bit position of the encryption bit, aka C-bit, require the use of an IOMMU or the use of SWIOTLB. If the IOMMU is disabled or in passthrough mode, the kernel would switch to SWIOTLB bounce-buffering for those transfers. In order to avoid that, 2cc13bb4f59f ("iommu: Disable passthrough mode when SME is active") disables the default IOMMU passthrough mode so that devices for which the default 256K DMA is insufficient, can use the IOMMU instead. However 2, there are cases where the IOMMU is disabled in the BIOS, etc. (think the usual hardware folk "oops, I dropped the ball there" cases) or a driver doesn't properly use the DMA APIs or a device has a firmware or hardware bug, e.g.: ea68573d408f ("drm/amdgpu: Fail to load on RAVEN if SME is active") However 3, in the above GPU use case, there are APIs like Vulkan and some OpenGL/OpenCL extensions which are under the assumption that user-allocated memory can be passed in to the kernel driver and both the GPU and CPU can do coherent and concurrent access to the same memory. That cannot work with SWIOTLB bounce buffers, of course. So, in order for those devices to function, drop the "default y" for the SME by default active option so that users who want to have SME enabled, will need to either enable it in their config or use "mem_encrypt=on" on the kernel command line. [ tlendacky: Generalize commit message. ] Fixes: 7744ccdbc16f ("x86/mm: Add Secure Memory Encryption (SME) support") Reported-by: Paul Menzel Signed-off-by: Borislav Petkov Acked-by: Alex Deucher Acked-by: Tom Lendacky Cc: Link: https://lkml.kernel.org/r/8bbacd0e-4580-3194-19d2-a0ecad7df09c@molgen.mpg.de commit 57116ce17b04fde2fe30f0859df69d8dbe5809f6 Author: Johan Hovold Date: Wed Oct 6 13:58:52 2021 +0200 workqueue: fix state-dump console deadlock Console drivers often queue work while holding locks also taken in their console write paths, something which can lead to deadlocks on SMP when dumping workqueue state (e.g. sysrq-t or on suspend failures). For serial console drivers this could look like: CPU0 CPU1 ---- ---- show_workqueue_state(); lock(&pool->lock); lock(&port->lock); schedule_work(); lock(&pool->lock); printk(); lock(console_owner); lock(&port->lock); where workqueues are, for example, used to push data to the line discipline, process break signals and handle modem-status changes. Line disciplines and serdev drivers can also queue work on write-wakeup notifications, etc. Reworking every console driver to avoid queuing work while holding locks also taken in their write paths would complicate drivers and is neither desirable or feasible. Instead use the deferred-printk mechanism to avoid printing while holding pool locks when dumping workqueue state. Note that there are a few WARN_ON() assertions in the workqueue code which could potentially also trigger a deadlock. Hopefully the ongoing printk rework will provide a general solution for this eventually. This was originally reported after a lockdep splat when executing sysrq-t with the imx serial driver. Fixes: 3494fc30846d ("workqueue: dump workqueues on sysrq-t") Cc: stable@vger.kernel.org # 4.0 Reported-by: Fabio Estevam Tested-by: Fabio Estevam Signed-off-by: Johan Hovold Reviewed-by: John Ogness Signed-off-by: Tejun Heo commit 22b05f1ac0332cb47701649206997d8d9a1a7f24 Author: Konstantin Komarov Date: Tue Oct 5 19:33:26 2021 +0300 fs/ntfs3: Refactor ntfs_read_mft Don't save size of attribute reparse point as size of symlink. Signed-off-by: Konstantin Komarov commit cd4c76ff807c1afeed89f1b7e311760c0e296349 Author: Konstantin Komarov Date: Tue Oct 5 19:08:08 2021 +0300 fs/ntfs3: Refactor ni_parse_reparse Change argument from void* to struct REPARSE_DATA_BUFFER* We copy data to buffer, so we can read it later in ntfs_read_mft. Signed-off-by: Konstantin Komarov commit 14a981193e409d8ca3f89768cfbd7a9a516d9927 Author: Konstantin Komarov Date: Mon Oct 4 18:52:24 2021 +0300 fs/ntfs3: Refactor ntfs_create_inode Set size for symlink, so we don't need to calculate it on the fly. Signed-off-by: Konstantin Komarov commit 4dbe8e4413d70ac4f163592d69eef74d7824783a Author: Konstantin Komarov Date: Mon Oct 4 18:59:55 2021 +0300 fs/ntfs3: Refactor ntfs_readlink_hlp Rename some variables. Returned err by default is EINVAL. Signed-off-by: Konstantin Komarov commit 2c69078851b3d7495eb191158d0bcb9c91a6d148 Author: Konstantin Komarov Date: Mon Oct 4 18:22:45 2021 +0300 fs/ntfs3: Rework ntfs_utf16_to_nls Now ntfs_utf16_to_nls takes length as one of arguments. If length of symlink > 255, then we tried to convert length of symlink +- some random number. Now 255 symbols limit was removed. Signed-off-by: Konstantin Komarov commit e02083f0bcc250c0556ec9e6f7ddb74220c72572 Author: Matthew Auld Date: Mon Oct 11 17:13:38 2021 +0100 drm/i915: remember to call i915_sw_fence_fini Seems to fix some object-debug splat which appeared while debugging something unrelated. v2: s/guc_blocked/guc_state.blocked/ Signed-off-by: Matthew Auld Cc: Ville Syrjälä Cc: Matthew Brost Tested-by: Ville Syrjälä Reviewed-by: Matthew Brost Fixes: 62eaf0ae217d ("drm/i915/guc: Support request cancellation") Link: https://patchwork.freedesktop.org/patch/msgid/20210924144646.4096402-1-matthew.auld@intel.com (cherry picked from commit d576b31bdece7b5034047cbe21170e948198d32f) Signed-off-by: Jani Nikula commit 9b75450d6c580100611743fa7e690ea3cb47cd4a Author: Konstantin Komarov Date: Tue Sep 28 19:00:30 2021 +0300 fs/ntfs3: Fix memory leak if fill_super failed In ntfs_init_fs_context we allocate memory in fc->s_fs_info. In case of failed mount we must free it in ntfs_fill_super. We can't do it in ntfs_fs_free, because ntfs_fs_free called with fc->s_fs_info == NULL. fc->s_fs_info became NULL in sget_fc. Signed-off-by: Konstantin Komarov commit 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf Author: Takashi Iwai Date: Sun Oct 10 09:55:46 2021 +0200 ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl Michael Forney reported an incorrect padding type that was defined in the commit 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control") for PCM control mmap data. His analysis is correct, and this caused the misplacements of PCM control data on 32bit arch and 32bit compat mode. The bug is that the __pad2 definition in __snd_pcm_mmap_control64 struct was wrongly with __pad_before_uframe, which should have been __pad_after_uframe instead. This struct is used in SYNC_PTR ioctl and control mmap. Basically this bug leads to two problems: - The offset of avail_min field becomes wrong, it's placed right after appl_ptr without padding on little-endian - When appl_ptr and avail_min are read as 64bit values in kernel side, the values become either zero or corrupted (mixed up) One good news is that, because both user-space and kernel misunderstand the wrong offset, at least, 32bit application running on 32bit kernel works as is. Also, 64bit applications are unaffected because the padding size is zero. The remaining problem is the 32bit compat mode; as mentioned in the above, avail_min is placed right after appl_ptr on little-endian archs, 64bit kernel reads bogus values for appl_ptr updates, which may lead to streaming bugs like jumping, XRUN or whatever unexpected. (However, we haven't heard any serious bug reports due to this over years, so practically seen, it's fairly safe to assume that the impact by this bug is limited.) Ideally speaking, we should correct the wrong mmap status control definition. But this would cause again incompatibility with the existing binaries, and fixing it (e.g. by renumbering ioctls) would be really messy. So, as of this patch, we only correct the behavior of 32bit compat mode and keep the rest as is. Namely, the SYNC_PTR ioctl is now handled differently in compat mode to read/write the 32bit values at the right offsets. The control mmap of 32bit apps on 64bit kernels has been already disabled (which is likely rather an overlook, but this worked fine at this time :), so covering SYNC_PTR ioctl should suffice as a fallback. Fixes: 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control") Reported-by: Michael Forney Reviewed-by: Arnd Bergmann Cc: Cc: Rich Felker Link: https://lore.kernel.org/r/29QBMJU8DE71E.2YZSH8IHT5HMH@mforney.org Link: https://lore.kernel.org/r/20211010075546.23220-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit ce46ae0c3e31400dc89d1e4620a812647cab9c72 Author: Konstantin Komarov Date: Fri Oct 1 18:48:49 2021 +0300 fs/ntfs3: Keep prealloc for all types of files Before we haven't kept prealloc for sparse files because we thought that it will speed up create / write operations. It lead to situation, when user reserved some space for sparse file, filled volume, and wasn't able to write in reserved file. With this commit we keep prealloc. Now xfstest generic/274 pass. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Signed-off-by: Konstantin Komarov commit 7df227847ab562c42d318bceccebb0c911c87b04 Author: Shravan S Date: Wed Oct 6 13:05:25 2021 +0530 platform/x86: int1092: Fix non sequential device mode handling SAR information from BIOS may come in non sequential pattern. To overcome the issue, a check is made to extract the right SAR information using the device mode which is currently being used. Remove .owner field if calls are used which set it automatically. Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: Shravan S Link: https://lore.kernel.org/r/20211006073525.1332925-1-s.shravan@intel.com Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit c005828744f584bfcd2cf3ed64dfef15a5078960 Author: Daniel Scally Date: Fri Oct 8 23:46:08 2021 +0100 platform/x86: intel_skl_int3472: Correct null check The int3472-discrete driver can enter an error path after initialising int3472->clock.ena_gpio, but before it has registered the clock. This will cause a NULL pointer dereference, because clkdev_drop() is not null aware. Instead of guarding the call to skl_int3472_unregister_clock() by checking for .ena_gpio, check specifically for the presence of the clk_lookup, which will guarantee clkdev_create() has already been called. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214453 Fixes: 7540599a5ef1 ("platform/x86: intel_skl_int3472: Provide skl_int3472_unregister_clock()") Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20211008224608.415949-1-djrscally@gmail.com Signed-off-by: Hans de Goede commit 0f607d6b227470456a69a37d7c7badea51d52844 Author: Zephaniah E. Loss-Cutler-Hull Date: Mon Oct 4 21:48:55 2021 -0700 platform/x86: gigabyte-wmi: add support for B550 AORUS ELITE AX V2 This works just fine on my system. Signed-off-by: Zephaniah E. Loss-Cutler-Hull Cc: Link: https://lore.kernel.org/r/20211005044855.1429724-1-zephaniah@gmail.com Signed-off-by: Hans de Goede commit c0d84d2c7c23e9cf23a5abdda40eeaa79eabfe69 Author: Sachi King Date: Sat Oct 2 14:18:39 2021 +1000 platform/x86: amd-pmc: Add alternative acpi id for PMC controller The Surface Laptop 4 AMD has used the AMD0005 to identify this controller instead of using the appropriate ACPI ID AMDI0005. Include AMD0005 in the acpi id list. Link: https://github.com/linux-surface/acpidumps/tree/master/surface_laptop_4_amd Link: https://gist.github.com/nakato/2a1a7df1a45fe680d7a08c583e1bf863 Cc: # 5.14+ Signed-off-by: Sachi King Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20211002041840.2058647-1-nakato@nakato.io Signed-off-by: Hans de Goede commit a0c5814b9933f25ecb6de169483c5b88cf632bca Author: Prashant Malani Date: Tue Sep 28 03:19:34 2021 -0700 platform/x86: intel_scu_ipc: Update timeout value in comment The comment decribing the IPC timeout hadn't been updated when the actual timeout was changed from 3 to 5 seconds in commit a7d53dbbc70a ("platform/x86: intel_scu_ipc: Increase virtual timeout from 3 to 5 seconds") . Since the value is anyway updated to 10s now, take this opportunity to update the value in the comment too. Signed-off-by: Prashant Malani Cc: Benson Leung Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20210928101932.2543937-4-pmalani@chromium.org Signed-off-by: Hans de Goede commit 5c02b581ce84eea240d25c8318a1f65133a04415 Author: Prashant Malani Date: Tue Sep 28 03:19:32 2021 -0700 platform/x86: intel_scu_ipc: Increase virtual timeout to 10s Commit a7d53dbbc70a ("platform/x86: intel_scu_ipc: Increase virtual timeout from 3 to 5 seconds") states that the recommended timeout range is 5-10 seconds. Adjust the timeout value to the higher of those i.e 10 seconds, to account for situations where the 5 seconds is insufficient for disconnect command success. Signed-off-by: Prashant Malani Cc: Benson Leung Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20210928101932.2543937-3-pmalani@chromium.org Signed-off-by: Hans de Goede commit 41512e4dc0b84525495e784295092592adb87f1b Author: Prashant Malani Date: Tue Sep 28 03:19:30 2021 -0700 platform/x86: intel_scu_ipc: Fix busy loop expiry time The macro IPC_TIMEOUT is already in jiffies (it is also used like that elsewhere in the file when calling wait_for_completion_timeout()). Don’t convert it using helper functions for the purposes of calculating the busy loop expiry time. Fixes: e7b7ab3847c9 (“platform/x86: intel_scu_ipc: Sleeping is fine when polling”) Signed-off-by: Prashant Malani Cc: Benson Leung Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20210928101932.2543937-2-pmalani@chromium.org Signed-off-by: Hans de Goede commit 92813dafcd8cae40b6256fd9392a44ecd5c9f505 Author: Hans de Goede Date: Mon Oct 11 15:23:38 2021 +0200 platform/x86: dell: Make DELL_WMI_PRIVACY depend on DELL_WMI DELL_WMI_PRIVACY is a feature toggle for the main dell-wmi driver, so it must depend on the Kconfig option which enables the main dell-wmi driver. Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") Reported-by: Randy Dunlap Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20211011132338.407571-1-hdegoede@redhat.com commit db9cc7d6f95e7d89b0ce57e785cfd9d67a7505d8 Author: Vadim Pasternak Date: Mon Sep 27 17:22:14 2021 +0300 platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes Fix shift argument for function rol32(). It should be provided in bits, while was provided in bytes. Fixes: 86148190a7db ("platform/mellanox: mlxreg-io: Add support for complex attributes") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20210927142214.2613929-3-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 9b024201693e397441668cca0d2df7055fe572eb Author: Vadim Pasternak Date: Mon Sep 27 17:22:13 2021 +0300 platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call Change kstrtou32() argument 'base' to be zero instead of 'len'. It works by chance for setting one bit value, but it is not supposed to work in case value passed to mlxreg_io_attr_store() is greater than 1. It works for example, for: echo 1 > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable But it will fail for: echo n > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable, where n > 1. The flow for input buffer conversion is as below: _kstrtoull(const char *s, unsigned int base, unsigned long long *res) calls: rv = _parse_integer(s, base, &_res); For the second case, where n > 1: - _parse_integer() converts 's' to 'val'. For n=2, 'len' is set to 2 (string buffer is 0x32 0x0a), for n=3 'len' is set to 3 (string buffer 0x33 0x0a), etcetera. - 'base' is equal or greater then '2' (length of input buffer). As a result, _parse_integer() exits with result zero (rv): rv = 0; while (1) { ... if (val >= base)-> (2 >= 2) break; ... rv++; ... } And _kstrtoull() in their turn will fail: if (rv == 0) return -EINVAL; Fixes: 5ec4a8ace06c ("platform/mellanox: Introduce support for Mellanox register access driver") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20210927142214.2613929-2-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 75b3cb97eb1f05042745c0655a7145b0262d4c5c Author: Kamal Dasu Date: Fri Oct 8 16:36:02 2021 -0400 spi: bcm-qspi: clear MSPI spifie interrupt during probe Intermittent Kernel crash has been observed on probe in bcm_qspi_mspi_l2_isr() handler when the MSPI spifie interrupt bit has not been cleared before registering for interrupts. Fix the driver to move SoC specific custom interrupt handling code before we register IRQ in probe. Also clear MSPI interrupt status resgiter prior to registering IRQ handlers. Fixes: cc20a38612db ("spi: iproc-qspi: Add Broadcom iProc SoCs support") Signed-off-by: Kamal Dasu Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20211008203603.40915-3-kdasu.kdev@gmail.com Signed-off-by: Mark Brown commit c448b7aa3e66042fc0f849d9a0fb90d1af82e948 Author: Yang Yingliang Date: Sat Oct 9 14:58:40 2021 +0800 ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() 'component' is allocated in snd_soc_register_component(), but component->list is not initalized, this may cause snd_soc_del_component_unlocked() deref null ptr in the error handing case. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__list_del_entry_valid+0x81/0xf0 Call Trace: snd_soc_del_component_unlocked+0x69/0x1b0 [snd_soc_core] snd_soc_add_component.cold+0x54/0x6c [snd_soc_core] snd_soc_register_component+0x70/0x90 [snd_soc_core] devm_snd_soc_register_component+0x5e/0xd0 [snd_soc_core] tas2552_probe+0x265/0x320 [snd_soc_tas2552] ? tas2552_component_probe+0x1e0/0x1e0 [snd_soc_tas2552] i2c_device_probe+0xa31/0xbe0 Fix by adding INIT_LIST_HEAD() to snd_soc_component_initialize(). Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20211009065840.3196239-1-yangyingliang@huawei.com Signed-off-by: Mark Brown commit 293d92cbbd2418ca2ba43fed07f1b92e884d1c77 Author: Gerald Schaefer Date: Wed Oct 6 22:19:43 2021 +0200 dma-debug: fix sg checks in debug_dma_map_sg() The following warning occurred sporadically on s390: DMA-API: nvme 0006:00:00.0: device driver maps memory from kernel text or rodata [addr=0000000048cc5e2f] [len=131072] WARNING: CPU: 4 PID: 825 at kernel/dma/debug.c:1083 check_for_illegal_area+0xa8/0x138 It is a false-positive warning, due to broken logic in debug_dma_map_sg(). check_for_illegal_area() checks for overlay of sg elements with kernel text or rodata. It is called with sg_dma_len(s) instead of s->length as parameter. After the call to ->map_sg(), sg_dma_len() will contain the length of possibly combined sg elements in the DMA address space, and not the individual sg element length, which would be s->length. The check will then use the physical start address of an sg element, and add the DMA length for the overlap check, which could result in the false warning, because the DMA length can be larger than the actual single sg element length. In addition, the call to check_for_illegal_area() happens in the iteration over mapped_ents, which will not include all individual sg elements if any of them were combined in ->map_sg(). Fix this by using s->length instead of sg_dma_len(s). Also put the call to check_for_illegal_area() in a separate loop, iterating over all the individual sg elements ("nents" instead of "mapped_ents"). While at it, as suggested by Robin Murphy, also move check_for_stack() inside the new loop, as it is similarly concerned with validating the individual sg elements. Link: https://lore.kernel.org/lkml/20210705185252.4074653-1-gerald.schaefer@linux.ibm.com Fixes: 884d05970bfb ("dma-debug: use sg_dma_len accessor") Signed-off-by: Gerald Schaefer Signed-off-by: Christoph Hellwig commit 011a9ce80763141e7fa613934e76bef8948e4a4f Author: Logan Gunthorpe Date: Tue Oct 5 10:48:12 2021 -0600 dma-mapping: fix the kerneldoc for dma_map_sgtable() htmldocs began producing the following warnings: kernel/dma/mapping.c:256: WARNING: Definition list ends without a blank line; unexpected unindent. kernel/dma/mapping.c:257: WARNING: Bullet list ends without a blank line; unexpected unindent. Reformatting the list without hyphens fixes the warnings and produces both a readable text and HTML output. Fixes: fffe3cc8c219 ("dma-mapping: allow map_sg() ops to return negative error code") Reported-by: Stephen Rothwell Signed-off-by: Logan Gunthorpe Signed-off-by: Christoph Hellwig commit 023a062f238129e8a542b5163c4350ceb076283e Author: Cameron Berkenpas Date: Sun Oct 10 15:54:11 2021 -0700 ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2 The previous patch's HDA verb initialization for the Lenovo 13s sequence was slightly off. This updated verb sequence has been tested and confirmed working. Fixes: ad7cc2d41b7a ("ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555 Cc: Signed-off-by: Cameron Berkenpas Link: https://lore.kernel.org/r/20211010225410.23423-1-cam@neo-zeon.de Signed-off-by: Takashi Iwai commit 209ee634bc0d2fa10ac8f799abf09207b5ce489a Merge: 64570fbc14f8d eb7b52e6db7c2 Author: Arnd Bergmann Date: Mon Oct 11 10:04:23 2021 +0200 Merge tag 'ffa-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A driver fixes for v5.15 Couple of fixes addressing issues when FFA driver is build as a module. One adds the device unregistration which was missing and causes issue when loading the module second time after unloading once. Another one adds the missing remove callback on the ffa bus which was missing due to which modules depending on FFA(e.g. OPTEE) will fail to remove the device and faults next time that module is loaded again. * tag 'ffa-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Fix __ffa_devices_unregister firmware: arm_ffa: Add missing remove callback to ffa_bus_type Link: https://lore.kernel.org/r/20211006153231.4061789-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit ea0f69d8211963c4b2cc1998b86779a500adb502 Author: Nikolay Martynov Date: Fri Oct 8 12:25:47 2021 +0300 xhci: Enable trust tx length quirk for Fresco FL11 USB controller Tested on SD5200T TB3 dock which has Fresco Logic FL1100 USB 3.0 Host Controller. Before this patch streaming video from USB cam made mouse and keyboard connected to the same USB bus unusable. Also video was jerky. With this patch streaming video doesn't have any effect on other periferals and video is smooth. Cc: stable@vger.kernel.org Signed-off-by: Nikolay Martynov Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20211008092547.3996295-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ff0e50d3564f33b7f4b35cadeabd951d66cfc570 Author: Pavankumar Kondeti Date: Fri Oct 8 12:25:46 2021 +0300 xhci: Fix command ring pointer corruption while aborting a command The command ring pointer is located at [6:63] bits of the command ring control register (CRCR). All the control bits like command stop, abort are located at [0:3] bits. While aborting a command, we read the CRCR and set the abort bit and write to the CRCR. The read will always give command ring pointer as all zeros. So we essentially write only the control bits. Since we split the 64 bit write into two 32 bit writes, there is a possibility of xHC command ring stopped before the upper dword (all zeros) is written. If that happens, xHC updates the upper dword of its internal command ring pointer with all zeros. Next time, when the command ring is restarted, we see xHC memory access failures. Fix this issue by only writing to the lower dword of CRCR where all control bits are located. Cc: stable@vger.kernel.org Signed-off-by: Pavankumar Kondeti Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20211008092547.3996295-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 880de403777376e50bdf60def359fa50a722006f Author: Johan Hovold Date: Fri Oct 8 12:25:45 2021 +0300 USB: xhci: dbc: fix tty registration race Make sure to allocate resources before registering the tty device to avoid having a racing open() and write() fail to enable rx or dereference a NULL pointer when accessing the uninitialised fifo. Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Cc: stable@vger.kernel.org # 4.16 Cc: Lu Baolu Signed-off-by: Johan Hovold Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20211008092547.3996295-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 5255660b208aebfdb71d574f3952cf48392f4306 Author: Jonathan Bell Date: Fri Oct 8 12:25:44 2021 +0300 xhci: add quirk for host controllers that don't update endpoint DCS Seen on a VLI VL805 PCIe to USB controller. For non-stream endpoints at least, if the xHC halts on a particular TRB due to an error then the DCS field in the Out Endpoint Context maintained by the hardware is not updated with the current cycle state. Using the quirk XHCI_EP_CTX_BROKEN_DCS and instead fetch the DCS bit from the TRB that the xHC stopped on. [ bjorn: rebased to v5.14-rc2 ] Link: https://github.com/raspberrypi/linux/issues/3060 Cc: stable@vger.kernel.org Signed-off-by: Jonathan Bell Signed-off-by: Bjørn Mork Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20211008092547.3996295-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a01ba2a3378be85538e0183ae5367c1bc1d5aaf3 Author: Jonathan Bell Date: Fri Oct 8 12:25:43 2021 +0300 xhci: guard accesses to ep_state in xhci_endpoint_reset() See https://github.com/raspberrypi/linux/issues/3981 Two read-modify-write cycles on ep->ep_state are not guarded by xhci->lock. Fix these. Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset") Cc: stable@vger.kernel.org Signed-off-by: Jonathan Bell Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20211008092547.3996295-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b26503b15631229583e925de774e95b11d8144e8 Author: Colin Ian King Date: Wed Oct 6 18:28:30 2021 +0100 tracing: Fix missing * in comment block There is a missing * in a comment block, add it in. Link: https://lkml.kernel.org/r/20211006172830.1025336-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (VMware) commit 1ae43851b18afe861120ebd7c426dc44f06bb2bd Author: Masami Hiramatsu Date: Thu Sep 16 15:23:12 2021 +0900 bootconfig: init: Fix memblock leak in xbc_make_cmdline() Free unused memblock in a error case to fix memblock leak in xbc_make_cmdline(). Link: https://lkml.kernel.org/r/163177339181.682366.8713781325929549256.stgit@devnote2 Fixes: 51887d03aca1 ("bootconfig: init: Allow admin to use bootconfig for kernel command line") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 6675880fc4b7c5137a2640b0725505c21b1ac525 Author: Vamshi K Sthambamkadi Date: Fri Oct 8 12:48:06 2021 +0530 tracing: Fix memory leak in eprobe_register() kmemleak report: unreferenced object 0xffff900a70ec7ec0 (size 32): comm "ftracetest", pid 2770, jiffies 4295042510 (age 311.464s) hex dump (first 32 bytes): c8 31 23 45 0a 90 ff ff 40 85 c7 6e 0a 90 ff ff .1#E....@..n.... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009d3751fd>] kmem_cache_alloc_trace+0x2a2/0x440 [<0000000088b8124b>] eprobe_register+0x1e3/0x350 [<000000002a9a0517>] __ftrace_event_enable_disable+0x7c/0x240 [<0000000019109321>] event_enable_write+0x93/0xe0 [<000000007d85b320>] vfs_write+0xb9/0x260 [<00000000b94c5e41>] ksys_write+0x67/0xe0 [<000000005a08c81d>] __x64_sys_write+0x1a/0x20 [<00000000240bf576>] do_syscall_64+0x3b/0xc0 [<0000000043d5d9f6>] entry_SYSCALL_64_after_hwframe+0x44/0xae unreferenced object 0xffff900a56bbf280 (size 128): comm "ftracetest", pid 2770, jiffies 4295042510 (age 311.464s) hex dump (first 32 bytes): ff ff ff ff ff ff ff ff 00 00 00 00 01 00 00 00 ................ 80 69 3b b2 ff ff ff ff 20 69 3b b2 ff ff ff ff .i;..... i;..... backtrace: [<000000009d3751fd>] kmem_cache_alloc_trace+0x2a2/0x440 [<00000000c4e90fad>] eprobe_register+0x1fc/0x350 [<000000002a9a0517>] __ftrace_event_enable_disable+0x7c/0x240 [<0000000019109321>] event_enable_write+0x93/0xe0 [<000000007d85b320>] vfs_write+0xb9/0x260 [<00000000b94c5e41>] ksys_write+0x67/0xe0 [<000000005a08c81d>] __x64_sys_write+0x1a/0x20 [<00000000240bf576>] do_syscall_64+0x3b/0xc0 [<0000000043d5d9f6>] entry_SYSCALL_64_after_hwframe+0x44/0xae In new_eprobe_trigger(), allocated edata and trigger variables are never freed. To fix, free memory in disable_eprobe(). Link: https://lkml.kernel.org/r/20211008071802.GA2098@cosmos Fixes: 7491e2c442781 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Vamshi K Sthambamkadi Signed-off-by: Steven Rostedt (VMware) commit 64570fbc14f8d7cb3fe3995f20e26bc25ce4b2cc Author: Linus Torvalds Date: Sun Oct 10 17:01:59 2021 -0700 Linux 5.15-rc5 commit efb52a7d9511df818391f1afa459507425833438 Merge: 75cd9b0152d9a eb8257a12192f Author: Linus Torvalds Date: Sun Oct 10 10:12:42 2021 -0700 Merge tag 'powerpc-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "A bit of a big batch, partly because I didn't send any last week, and also just because the BPF fixes happened to land this week. Summary: - Fix a regression hit by the IPR SCSI driver, introduced by the recent addition of MSI domains on pseries. - A big series including 8 BPF fixes, some with potential security impact and the rest various code generation issues. - Fix our program check assembler entry path, which was accidentally jumping into a gas macro and generating strange stack frames, which could confuse find_bug(). - A couple of fixes, and related changes, to fix corner cases in our machine check handling. - Fix our DMA IOMMU ops, which were not always returning the optimal DMA mask, leading to at least one device falling back to 32-bit DMA when it shouldn't. - A fix for KUAP handling on 32-bit Book3S. - Fix crashes seen when kdumping on some pseries systems. Thanks to Naveen N. Rao, Nicholas Piggin, Alexey Kardashevskiy, Cédric Le Goater, Christophe Leroy, Mahesh Salgaonkar, Abdul Haleem, Christoph Hellwig, Johan Almbladh, Stan Johnson" * tag 'powerpc-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init powerpc/32s: Fix kuap_kernel_restore() powerpc/pseries/msi: Add an empty irq_write_msi_msg() handler powerpc/64s: Fix unrecoverable MCE calling async handler from NMI powerpc/64/interrupt: Reconcile soft-mask state in NMI and fix false BUG powerpc/64: warn if local irqs are enabled in NMI or hardirq context powerpc/traps: do not enable irqs in _exception powerpc/64s: fix program check interrupt emergency stack path powerpc/bpf ppc32: Fix BPF_SUB when imm == 0x80000000 powerpc/bpf ppc32: Do not emit zero extend instruction for 64-bit BPF_END powerpc/bpf ppc32: Fix JMP32_JSET_K powerpc/bpf ppc32: Fix ALU32 BPF_ARSH operation powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/bpf: Fix BPF_MOD when imm == 1 powerpc/bpf: Validate branch ranges powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/iommu: Report the correct most efficient DMA mask for PCI devices commit 75cd9b0152d9a46017eddfc3b80b1a00c921196a Merge: c22ccc4a3ef19 fe255fe6ad976 Author: Linus Torvalds Date: Sun Oct 10 10:05:39 2021 -0700 Merge tag 'objtool_urgent_for_v5.15_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Borislav Petkov: - Remove an extra section.len member in favour of section.sh_size - Align .altinstructions section creation with the kernel's by creating them with entry size of 0 - Fix objtool to convert a reloc symbol to a section offset and not to not warn about not knowing how * tag 'objtool_urgent_for_v5.15_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Remove redundant 'len' field from struct section objtool: Make .altinstructions section entry size consistent objtool: Remove reloc symbol type checks in get_alt_entry() commit c22ccc4a3ef198752855f44e9279732260c889d5 Merge: 7fd2bf83d59a2 d298b03506d3e Author: Linus Torvalds Date: Sun Oct 10 10:00:51 2021 -0700 Merge tag 'x86_urgent_for_v5.15_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - A FPU fix to properly handle invalid MXCSR values: 32-bit masks them out due to historical reasons and 64-bit kernels reject them - A fix to clear X86_FEATURE_SMAP when support for is not config-enabled - Three fixes correcting misspelled Kconfig symbols used in code - Two resctrl object cleanup fixes - Yet another attempt at fixing the neverending saga of botched x86 timers, this time because some incredibly smart hardware decides to turn off the HPET timer in a low power state - who cares if the OS is relying on it... - Check the full return value range of an SEV VMGEXIT call to determine whether it returned an error * tag 'x86_urgent_for_v5.15_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Restore the masking out of reserved MXCSR bits x86/Kconfig: Correct reference to MWINCHIP3D x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n x86/entry: Correct reference to intended CONFIG_64_BIT x86/resctrl: Fix kfree() of the wrong type in domain_add_cpu() x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails x86/hpet: Use another crystalball to evaluate HPET usability x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0] commit 7fd2bf83d59a2d32e0d596c5d3e623b9a0e7e2d5 Merge: 0950fcbf992f5 fa1049135c15b Author: Linus Torvalds Date: Sat Oct 9 15:03:48 2021 -0700 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Three driver bugfixes and one leak fix for the core" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: mlxcpld: Modify register setting for 400KHz frequency i2c: mlxcpld: Fix criteria for frequency setting i2c: mediatek: Add OFFSET_EXT_CONF setting back i2c: acpi: fix resource leak in reconfiguration device addition commit 0950fcbf992f578575f5387decb06f6496aab594 Merge: 50eb0a06e6cae 258aad75c6214 Author: Linus Torvalds Date: Sat Oct 9 14:57:26 2021 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five fixes, all in drivers. The big change is the UFS task management rework, with lpfc next and the rest being fairly minor and obvious fixes" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: iscsi: Fix iscsi_task use after free scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling scsi: elx: efct: Delete stray unlock statement scsi: ufs: core: Fix task management completion scsi: acornscsi: Remove scsi_cmd_to_tag() reference commit 50eb0a06e6cae01d8a8d63770030d01ac2fb572a Merge: c75de8453c3e2 1dbdd99b511c9 Author: Linus Torvalds Date: Sat Oct 9 14:51:59 2021 -0700 Merge tag 'block-5.15-2021-10-09' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Two small fixes for this release: - Add missing QUEUE_FLAG_HCTX_ACTIVE in the debugfs handling (Johannes) - Fix double free / UAF issue in __alloc_disk_node (Tetsuo)" * tag 'block-5.15-2021-10-09' of git://git.kernel.dk/linux-block: block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output block: genhd: fix double kfree() in __alloc_disk_node() commit c75de8453c3e2f8a8fcee9171118b7da29d3fb9c Merge: 717478d89fe22 64e7875560270 Author: Linus Torvalds Date: Sat Oct 9 10:17:17 2021 -0700 Merge tag '5.15-rc4-ksmbd-fixes' of git://git.samba.org/ksmbd Pull ksmbd fixes from Steve French: "Six fixes for the ksmbd kernel server, including two additional overflow checks, a fix for oops, and some cleanup (e.g. remove dead code for less secure dialects that has been removed)" * tag '5.15-rc4-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: fix oops from fuse driver ksmbd: fix version mismatch with out of tree ksmbd: use buf_data_size instead of recalculation in smb3_decrypt_req() ksmbd: remove the leftover of smb2.0 dialect support ksmbd: check strictly data area in ksmbd_smb2_check_message() ksmbd: add the check to vaildate if stream protocol length exceeds maximum value commit 717478d89fe22df61a4ecf73b1adb31b5f8d1bba Merge: f84fc4e36cd81 3ef6ca4f354c5 Author: Linus Torvalds Date: Sat Oct 9 09:07:58 2021 -0700 Merge tag 'riscv-for-linus-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A pair of fixes (along with the necessory cleanup) to our VDSO, to avoid a locking during OOM and to prevent the text from overflowing into the data page - A fix to checksyscalls to teach it about our rv32 UABI - A fix to add clone3() to the rv32 UABI, which was pointed out by checksyscalls - A fix to properly flush the icache on the local CPU in addition to the remote CPUs * tag 'riscv-for-linus-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: checksyscalls: Unconditionally ignore fstat{,at}64 riscv: Flush current cpu icache before other cpus RISC-V: Include clone3() on rv32 riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable riscv/vdso: Move vdso data page up front riscv/vdso: Refactor asm/vdso.h commit 732b74d647048668f0f8dc0c848f0746c69e2e2f Author: Xuan Zhuo Date: Sat Oct 9 05:17:53 2021 -0400 virtio-net: fix for skb_over_panic inside big mode commit 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") accidentally reverted the effect of commit 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") on drivers/net/virtio_net.c As a result, users of crosvm (which is using large packet mode) are experiencing crashes with 5.14-rc1 and above that do not occur with 5.13. Crash trace: [ 61.346677] skbuff: skb_over_panic: text:ffffffff881ae2c7 len:3762 put:3762 head:ffff8a5ec8c22000 data:ffff8a5ec8c22010 tail:0xec2 end:0xec0 dev: [ 61.369192] kernel BUG at net/core/skbuff.c:111! [ 61.372840] invalid opcode: 0000 [#1] SMP PTI [ 61.374892] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.14.0-rc1 linux-v5.14-rc1-for-mesa-ci.tar.bz2 #1 [ 61.376450] Hardware name: ChromiumOS crosvm, BIOS 0 .. [ 61.393635] Call Trace: [ 61.394127] [ 61.394488] skb_put.cold+0x10/0x10 [ 61.395095] page_to_skb+0xf7/0x410 [ 61.395689] receive_buf+0x81/0x1660 [ 61.396228] ? netif_receive_skb_list_internal+0x1ad/0x2b0 [ 61.397180] ? napi_gro_flush+0x97/0xe0 [ 61.397896] ? detach_buf_split+0x67/0x120 [ 61.398573] virtnet_poll+0x2cf/0x420 [ 61.399197] __napi_poll+0x25/0x150 [ 61.399764] net_rx_action+0x22f/0x280 [ 61.400394] __do_softirq+0xba/0x257 [ 61.401012] irq_exit_rcu+0x8e/0xb0 [ 61.401618] common_interrupt+0x7b/0xa0 [ 61.402270] See https://lore.kernel.org/r/5edaa2b7c2fe4abd0347b8454b2ac032b6694e2c.camel%40collabora.com for the report. Apply the original 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") again, the original logic still holds: In virtio-net's large packet mode, there is a hole in the space behind buf. hdr_padded_len - hdr_len We must take this into account when calculating tailroom. Cc: Greg KH Fixes: fb32856b16ad ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom") Fixes: 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") Signed-off-by: Xuan Zhuo Reported-by: Corentin Noël Tested-by: Corentin Noël Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit f49823939e41121fdffada4d583e3e38d28336f9 Author: Florian Fainelli Date: Fri Oct 8 14:42:52 2021 -0700 net: phy: Do not shutdown PHYs in READY state In case a PHY device was probed thus in the PHY_READY state, but not configured and with no network device attached yet, we should not be trying to shut it down because it has been brought back into reset by phy_device_reset() towards the end of phy_probe() and anyway we have not configured the PHY yet. Fixes: e2f016cf7751 ("net: phy: add a shutdown procedure") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 Author: chongjiapeng Date: Sat Oct 9 16:09:26 2021 +0800 qed: Fix missing error code in qed_slowpath_start() The error code is missing in this code scenario, add the error code '-EINVAL' to the return value 'rc'. Eliminate the follow smatch warning: drivers/net/ethernet/qlogic/qed/qed_main.c:1298 qed_slowpath_start() warn: missing error code 'rc'. Reported-by: Abaci Robot Fixes: d51e4af5c209 ("qed: aRFS infrastructure support") Signed-off-by: chongjiapeng Signed-off-by: David S. Miller commit 1951b3f19cfe822709c890a337906823c223c7c3 Author: Vladimir Oltean Date: Sat Oct 9 15:26:07 2021 +0300 net: dsa: hold rtnl_lock in dsa_switch_setup_tag_protocol It was a documented fact that ds->ops->change_tag_protocol() offered rtnetlink mutex protection to the switch driver, since there was an ASSERT_RTNL right before the call in dsa_switch_change_tag_proto() (initiated from sysfs). The blamed commit introduced another call path for ds->ops->change_tag_protocol() which does not hold the rtnl_mutex. This is: dsa_tree_setup -> dsa_tree_setup_switches -> dsa_switch_setup -> dsa_switch_setup_tag_protocol -> ds->ops->change_tag_protocol() -> dsa_port_setup -> dsa_slave_create -> register_netdevice(slave_dev) -> dsa_tree_setup_master -> dsa_master_setup -> dev->dsa_ptr = cpu_dp The reason why the rtnl_mutex is held in the sysfs call path is to ensure that, once the master and all the DSA interfaces are down (which is required so that no packets flow), they remain down during the tagging protocol change. The above calling order illustrates the fact that it should not be risky to change the initial tagging protocol to the one specified in the device tree at the given time: - packets cannot enter the dsa_switch_rcv() packet type handler since netdev_uses_dsa() for the master will not yet return true, since dev->dsa_ptr has not yet been populated - packets cannot enter the dsa_slave_xmit() function because no DSA interface has yet been registered So from the DSA core's perspective, holding the rtnl_mutex is indeed not necessary. Yet, drivers may need to do things which need rtnl_mutex protection. For example: felix_set_tag_protocol -> felix_setup_tag_8021q -> dsa_tag_8021q_register -> dsa_tag_8021q_setup -> dsa_tag_8021q_port_setup -> vlan_vid_add -> ASSERT_RTNL These drivers do not really have a choice to take the rtnl_mutex themselves, since in the sysfs case, the rtnl_mutex is already held. Fixes: deff710703d8 ("net: dsa: Allow default tag protocol to be overridden from DT") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 6510e80a0b81b5d814e3aea6297ba42f5e76f73c Author: Zheyu Ma Date: Sat Oct 9 11:33:49 2021 +0000 isdn: mISDN: Fix sleeping function called from invalid context The driver can call card->isac.release() function from an atomic context. Fix this by calling this function after releasing the lock. The following log reveals it: [ 44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018 [ 44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe [ 44.169574 ] INFO: lockdep is turned off. [ 44.169899 ] irq event stamp: 0 [ 44.170160 ] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 44.170627 ] hardirqs last disabled at (0): [] copy_process+0x132d/0x3e00 [ 44.171240 ] softirqs last enabled at (0): [] copy_process+0x135a/0x3e00 [ 44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 44.172318 ] Preemption disabled at: [ 44.172320 ] [] nj_release+0x69/0x500 [netjet] [ 44.174441 ] Call Trace: [ 44.174630 ] dump_stack_lvl+0xa8/0xd1 [ 44.174912 ] dump_stack+0x15/0x17 [ 44.175166 ] ___might_sleep+0x3a2/0x510 [ 44.175459 ] ? nj_release+0x69/0x500 [netjet] [ 44.175791 ] __might_sleep+0x82/0xe0 [ 44.176063 ] ? start_flush_work+0x20/0x7b0 [ 44.176375 ] start_flush_work+0x33/0x7b0 [ 44.176672 ] ? trace_irq_enable_rcuidle+0x85/0x170 [ 44.177034 ] ? kasan_quarantine_put+0xaa/0x1f0 [ 44.177372 ] ? kasan_quarantine_put+0xaa/0x1f0 [ 44.177711 ] __flush_work+0x11a/0x1a0 [ 44.177991 ] ? flush_work+0x20/0x20 [ 44.178257 ] ? lock_release+0x13c/0x8f0 [ 44.178550 ] ? __kasan_check_write+0x14/0x20 [ 44.178872 ] ? do_raw_spin_lock+0x148/0x360 [ 44.179187 ] ? read_lock_is_recursive+0x20/0x20 [ 44.179530 ] ? __kasan_check_read+0x11/0x20 [ 44.179846 ] ? do_raw_spin_unlock+0x55/0x900 [ 44.180168 ] ? ____kasan_slab_free+0x116/0x140 [ 44.180505 ] ? _raw_spin_unlock_irqrestore+0x41/0x60 [ 44.180878 ] ? skb_queue_purge+0x1a3/0x1c0 [ 44.181189 ] ? kfree+0x13e/0x290 [ 44.181438 ] flush_work+0x17/0x20 [ 44.181695 ] mISDN_freedchannel+0xe8/0x100 [ 44.182006 ] isac_release+0x210/0x260 [mISDNipac] [ 44.182366 ] nj_release+0xf6/0x500 [netjet] [ 44.182685 ] nj_remove+0x48/0x70 [netjet] [ 44.182989 ] pci_device_remove+0xa9/0x250 Signed-off-by: Zheyu Ma Signed-off-by: David S. Miller commit 5c976a56570f29aaf4a2f9a1bf99789c252183c9 Author: Shannon Nelson Date: Fri Oct 8 12:38:01 2021 -0700 ionic: don't remove netdev->dev_addr when syncing uc list Bridging, and possibly other upper stack gizmos, adds the lower device's netdev->dev_addr to its own uc list, and then requests it be deleted when the upper bridge device is removed. This delete request also happens with the bridging vlan_filtering is enabled and then disabled. Bonding has a similar behavior with the uc list, but since it also uses set_mac to manage netdev->dev_addr, it doesn't have the same the failure case. Because we store our netdev->dev_addr in our uc list, we need to ignore the delete request from dev_uc_sync so as to not lose the address and all hope of communicating. Note that ndo_set_mac_address is expressly changing netdev->dev_addr, so no limitation is set there. Fixes: 2a654540be10 ("ionic: Add Rx filter and rx_mode ndo support") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit be0499369d6376e70b5b80bbced94c0c32d508b1 Author: Haiyang Zhang Date: Fri Oct 8 06:11:31 2021 -0700 net: mana: Fix error handling in mana_create_rxq() Fix error handling in mana_create_rxq() when cq->gdma_id >= gc->max_num_cqs. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Haiyang Zhang Link: https://lore.kernel.org/r/1633698691-31721-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d Author: Xiaolong Huang Date: Fri Oct 8 14:58:30 2021 +0800 isdn: cpai: check ctr->cnr to avoid array index out of bound The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp. __module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num); During this process, the kernel thread would call detach_capi_ctr() to detach a register controller. if the controller was not attached yet, detach_capi_ctr() would trigger an array-index-out-bounds bug. [ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c:483:21 [ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' [ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted 5.15.0-rc2+ #8 [ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 46.870107][ T6479] Call Trace: [ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d [ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 [ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 [ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 [ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 [ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 [ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 [ 46.874256][ T6479] kthread+0x147/0x170 [ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 [ 46.875248][ T6479] ret_from_fork+0x1f/0x30 [ 46.875773][ T6479] Signed-off-by: Xiaolong Huang Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com Signed-off-by: Jakub Kicinski commit f84fc4e36cd816d2d5dff0541f32fed411b0355f Merge: 5d6ab0bb408ff a46044a92add6 Author: Linus Torvalds Date: Fri Oct 8 16:46:09 2021 -0700 Merge tag 's390-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix potential memory leak on a error path in eBPF - Fix handling of zpci device on reserve * tag 's390-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pci: fix zpci_zdev_put() on reserve bpf, s390: Fix potential memory leak about jit_data commit 14132690860e4d06aa3e1c4d7d8e9866ba7756dd Author: Sebastian Andrzej Siewior Date: Thu Oct 7 19:49:57 2021 +0200 mqprio: Correct stats in mqprio_dump_class_stats(). Introduction of lockless subqueues broke the class statistics. Before the change stats were accumulated in `bstats' and `qstats' on the stack which was then copied to struct gnet_dump. After the change the `bstats' and `qstats' are initialized to 0 and never updated, yet still fed to gnet_dump. The code updates the global qdisc->cpu_bstats and qdisc->cpu_qstats instead, clobbering them. Most likely a copy-paste error from the code in mqprio_dump(). __gnet_stats_copy_basic() and __gnet_stats_copy_queue() accumulate the values for per-CPU case but for global stats they overwrite the value, so only stats from the last loop iteration / tc end up in sch->[bq]stats. Use the on-stack [bq]stats variables again and add the stats manually in the global case. Fixes: ce679e8df7ed2 ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio") Cc: John Fastabend Signed-off-by: Sebastian Andrzej Siewior https://lore.kernel.org/all/20211007175000.2334713-2-bigeasy@linutronix.de/ Signed-off-by: Jakub Kicinski commit bccf56c4cbf18db7170350f18fa7d0530cce0ddc Merge: 1b1499a817c90 5bded8259ee38 Author: Jakub Kicinski Date: Fri Oct 8 15:47:48 2021 -0700 Merge branch 'dsa-bridge-tx-forwarding-offload-fixes-part-1' Vladimir Oltean says: ==================== DSA bridge TX forwarding offload fixes - part 1 This is part 1 of a series of fixes to the bridge TX forwarding offload feature introduced for v5.15. Sadly, the other fixes are so intrusive that they cannot be reasonably be sent to the "net" tree, as they also include API changes. So they are left as part 2 for net-next. ==================== Link: https://lore.kernel.org/r/20211007164711.2897238-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5bded8259ee3815a91791462dfb3312480779c3d Author: Vladimir Oltean Date: Thu Oct 7 19:47:11 2021 +0300 net: dsa: mv88e6xxx: isolate the ATU databases of standalone and bridged ports Similar to commit 6087175b7991 ("net: dsa: mt7530: use independent VLAN learning on VLAN-unaware bridges"), software forwarding between an unoffloaded LAG port (a bonding interface with an unsupported policy) and a mv88e6xxx user port directly under a bridge is broken. We adopt the same strategy, which is to make the standalone ports not find any ATU entry learned on a bridge port. Theory: the mv88e6xxx ATU is looked up by FID and MAC address. There are as many FIDs as VIDs (4096). The FID is derived from the VID when possible (the VTU maps a VID to a FID), with a fallback to the port based default FID value when not (802.1Q Mode is disabled on the port, or the classified VID isn't present in the VTU). The mv88e6xxx driver makes the following use of FIDs and VIDs: - the port's DefaultVID (to which untagged & pvid-tagged packets get classified) is 0 and is absent from the VTU, so this kind of packets is processed in FID 0, the default FID assigned by mv88e6xxx_setup_port. - every time a bridge VLAN is created, mv88e6xxx_port_vlan_join() -> mv88e6xxx_atu_new() associates a FID with that VID which increases linearly starting from 1. Like this: bridge vlan add dev lan0 vid 100 # FID 1 bridge vlan add dev lan1 vid 100 # still FID 1 bridge vlan add dev lan2 vid 1024 # FID 2 The FID allocation made by the driver is sub-optimal for the following reasons: (a) A standalone port has a DefaultPVID of 0 and a default FID of 0 too. A VLAN-unaware bridged port has a DefaultPVID of 0 and a default FID of 0 too. The difference is that the bridged ports may learn ATU entries, while the standalone port has the requirement that it must not, and must not find them either. Standalone ports must not use the same FID as ports belonging to a bridge. All standalone ports can use the same FID, since the ATU will never have an entry in that FID. (b) Multiple VLAN-unaware bridges will all use a DefaultPVID of 0 and a default FID of 0 on all their ports. The FDBs will not be isolated between these bridges. Every VLAN-unaware bridge must use the same FID on all its ports, different from the FID of other bridge ports. (c) Each bridge VLAN uses a unique FID which is useful for Independent VLAN Learning, but the same VLAN ID on multiple VLAN-aware bridges will result in the same FID being used by mv88e6xxx_atu_new(). The correct behavior is for VLAN 1 in br0 to have a different FID compared to VLAN 1 in br1. This patch cannot fix all the above. Traditionally the DSA framework did not care about this, and the reality is that DSA core involvement is needed for the aforementioned issues to be solved. The only thing we can solve here is an issue which does not require API changes, and that is issue (a), aka use a different FID for standalone ports vs ports under VLAN-unaware bridges. The first step is deciding what VID and FID to use for standalone ports, and what VID and FID for bridged ports. The 0/0 pair for standalone ports is what they used up till now, let's keep using that. For bridged ports, there are 2 cases: - VLAN-aware ports will never end up using the port default FID, because packets will always be classified to a VID in the VTU or dropped otherwise. The FID is the one associated with the VID in the VTU. - On VLAN-unaware ports, we _could_ leave their DefaultVID (pvid) at zero (just as in the case of standalone ports), and just change the port's default FID from 0 to a different number (say 1). However, Tobias points out that there is one more requirement to cater to: cross-chip bridging. The Marvell DSA header does not carry the FID in it, only the VID. So once a packet crosses a DSA link, if it has a VID of zero it will get classified to the default FID of that cascade port. Relying on a port default FID for upstream cascade ports results in contradictions: a default FID of 0 breaks ATU isolation of bridged ports on the downstream switch, a default FID of 1 breaks standalone ports on the downstream switch. So not only must standalone ports have different FIDs compared to bridged ports, they must also have different DefaultVID values. IEEE 802.1Q defines two reserved VID values: 0 and 4095. So we simply choose 4095 as the DefaultVID of ports belonging to VLAN-unaware bridges, and VID 4095 maps to FID 1. For the xmit operation to look up the same ATU database, we need to put VID 4095 in DSA tags sent to ports belonging to VLAN-unaware bridges too. All shared ports are configured to map this VID to the bridging FID, because they are members of that VLAN in the VTU. Shared ports don't need to have 802.1QMode enabled in any way, they always parse the VID from the DSA header, they don't need to look at the 802.1Q header. We install VID 4095 to the VTU in mv88e6xxx_setup_port(), with the mention that mv88e6xxx_vtu_setup() which was located right below that call was flushing the VTU so those entries wouldn't be preserved. So we need to relocate the VTU flushing prior to the port initialization during ->setup(). Also note that this is why it is safe to assume that VID 4095 will get associated with FID 1: the user ports haven't been created, so there is no avenue for the user to create a bridge VLAN which could otherwise race with the creation of another FID which would otherwise use up the non-reserved FID value of 1. [ Currently mv88e6xxx_port_vlan_join() doesn't have the option of specifying a preferred FID, it always calls mv88e6xxx_atu_new(). ] mv88e6xxx_port_db_load_purge() is the function to access the ATU for FDB/MDB entries, and it used to determine the FID to use for VLAN-unaware FDB entries (VID=0) using mv88e6xxx_port_get_fid(). But the driver only called mv88e6xxx_port_set_fid() once, during probe, so no surprises, the port FID was always 0, the call to get_fid() was redundant. As much as I would have wanted to not touch that code, the logic is broken when we add a new FID which is not the port-based default. Now the port-based default FID only corresponds to standalone ports, and FDB/MDB entries belong to the bridging service. So while in the future, when the DSA API will support FDB isolation, we will have to figure out the FID based on the bridge number, for now there's a single bridging FID, so hardcode that. Lastly, the tagger needs to check, when it is transmitting a VLAN untagged skb, whether it is sending it towards a bridged or a standalone port. When we see it is bridged we assume the bridge is VLAN-unaware. Not because it cannot be VLAN-aware but: - if we are transmitting from a VLAN-aware bridge we are likely doing so using TX forwarding offload. That code path guarantees that skbs have a vlan hwaccel tag in them, so we would not enter the "else" branch of the "if (skb->protocol == htons(ETH_P_8021Q))" condition. - if we are transmitting on behalf of a VLAN-aware bridge but with no TX forwarding offload (no PVT support, out of space in the PVT, whatever), we would indeed be transmitting with VLAN 4095 instead of the bridge device's pvid. However we would be injecting a "From CPU" frame, and the switch won't learn from that - it only learns from "Forward" frames. So it is inconsequential for address learning. And VLAN 4095 is absolutely enough for the frame to exit the switch, since we never remove that VLAN from any port. Fixes: 57e661aae6a8 ("net: dsa: mv88e6xxx: Link aggregation support") Reported-by: Tobias Waldekranz Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 8b6836d824702cacf68190982181f8ca3aff9c3e Author: Vladimir Oltean Date: Thu Oct 7 19:47:10 2021 +0300 net: dsa: mv88e6xxx: keep the pvid at 0 when VLAN-unaware The VLAN support in mv88e6xxx has a loaded history. Commit 2ea7a679ca2a ("net: dsa: Don't add vlans when vlan filtering is disabled") noticed some issues with VLAN and decided the best way to deal with them was to make the DSA core ignore VLANs added by the bridge while VLAN awareness is turned off. Those issues were never explained, just presented as "at least one corner case". That approach had problems of its own, presented by commit 54a0ed0df496 ("net: dsa: provide an option for drivers to always receive bridge VLANs") for the DSA core, followed by commit 1fb74191988f ("net: dsa: mv88e6xxx: fix vlan setup") which applied ds->configure_vlan_while_not_filtering = true for mv88e6xxx in particular. We still don't know what corner case Andrew saw when he wrote commit 2ea7a679ca2a ("net: dsa: Don't add vlans when vlan filtering is disabled"), but Tobias now reports that when we use TX forwarding offload, pinging an external station from the bridge device is broken if the front-facing DSA user port has flooding turned off. The full description is in the link below, but for short, when a mv88e6xxx port is under a VLAN-unaware bridge, it inherits that bridge's pvid. So packets ingressing a user port will be classified to e.g. VID 1 (assuming that value for the bridge_default_pvid), whereas when tag_dsa.c xmits towards a user port, it always sends packets using a VID of 0 if that port is standalone or under a VLAN-unaware bridge - or at least it did so prior to commit d82f8ab0d874 ("net: dsa: tag_dsa: offload the bridge forwarding process"). In any case, when there is a conversation between the CPU and a station connected to a user port, the station's MAC address is learned in VID 1 but the CPU tries to transmit through VID 0. The packets reach the intended station, but via flooding and not by virtue of matching the existing ATU entry. DSA has established (and enforced in other drivers: sja1105, felix, mt7530) that a VLAN-unaware port should use a private pvid, and not inherit the one from the bridge. The bridge's pvid should only be inherited when that bridge is VLAN-aware, so all state transitions need to be handled. On the other hand, all bridge VLANs should sit in the VTU starting with the moment when the bridge offloads them via switchdev, they are just not used. This solves the problem that Tobias sees because packets ingressing on VLAN-unaware user ports now get classified to VID 0, which is also the VID used by tag_dsa.c on xmit. Fixes: d82f8ab0d874 ("net: dsa: tag_dsa: offload the bridge forwarding process") Link: https://patchwork.kernel.org/project/netdevbpf/patch/20211003222312.284175-2-vladimir.oltean@nxp.com/#24491503 Reported-by: Tobias Waldekranz Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit c7709a02c18aabebc3b2988d24661763a0449443 Author: Vladimir Oltean Date: Thu Oct 7 19:47:09 2021 +0300 net: dsa: tag_dsa: send packets with TX fwd offload from VLAN-unaware bridges using VID 0 The present code is structured this way due to an incomplete thought process. In Documentation/networking/switchdev.rst we document that if a bridge is VLAN-unaware, then the presence or lack of a pvid on a bridge port (or on the bridge itself, for that matter) should not affect the ability to receive and transmit tagged or untagged packets. If the bridge on behalf of which we are sending this packet is VLAN-aware, then the TX forwarding offload API ensures that the skb will be VLAN-tagged (if the packet was sent by user space as untagged, it will get transmitted town to the driver as tagged with the bridge device's pvid). But if the bridge is VLAN-unaware, it may or may not be VLAN-tagged. In fact the logic to insert the bridge's PVID came from the idea that we should emulate what is being done in the VLAN-aware case. But we shouldn't. It appears that injecting packets using a VLAN ID of 0 serves the purpose of forwarding the packets to the egress port with no VLAN tag added or stripped by the hardware, and no filtering being performed. So we can simply remove the superfluous logic. One reason why this logic is broken is that when CONFIG_BRIDGE_VLAN_FILTERING=n, we call br_vlan_get_pvid_rcu() but that returns an error and we do error out, dropping all packets on xmit. Not really smart. This is also an issue when the user deletes the bridge pvid: $ bridge vlan del dev br0 vid 1 self As mentioned, in both cases, packets should still flow freely, and they do just that on any net device where the bridge is not offloaded, but on mv88e6xxx they don't. Fixes: d82f8ab0d874 ("net: dsa: tag_dsa: offload the bridge forwarding process") Reported-by: Andrew Lunn Link: https://patchwork.kernel.org/project/netdevbpf/patch/20211003155141.2241314-1-andrew@lunn.ch/ Link: https://patchwork.kernel.org/project/netdevbpf/patch/20210928233708.1246774-1-vladimir.oltean@nxp.com/ Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 1bec0f05062cf21e78093b1c4a2ae744e2873b8a Author: Vladimir Oltean Date: Thu Oct 7 19:47:08 2021 +0300 net: dsa: fix bridge_num not getting cleared after ports leaving the bridge The dp->bridge_num is zero-based, with -1 being the encoding for an invalid value. But dsa_bridge_num_put used to check for an invalid value by comparing bridge_num with 0, which is of course incorrect. The result is that the bridge_num will never get cleared by dsa_bridge_num_put, and further port joins to other bridges will get a bridge_num larger than the previous one, and once all the available bridges with TX forwarding offload supported by the hardware get exhausted, the TX forwarding offload feature is simply disabled. In the case of sja1105, 7 iterations of the loop below are enough to exhaust the TX forwarding offload bits, and further bridge joins operate without that feature. ip link add br0 type bridge vlan_filtering 1 while :; do ip link set sw0p2 master br0 && sleep 1 ip link set sw0p2 nomaster && sleep 1 done This issue is enough of an indication that having the dp->bridge_num invalid encoding be a negative number is prone to bugs, so this will be changed to a one-based value, with the dp->bridge_num of zero being the indication of no bridge. However, that is material for net-next. Fixes: f5e165e72b29 ("net: dsa: track unique bridge numbers across all DSA switch trees") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 5d6ab0bb408ffdaac585982faa9ec8c7d5cc349f Merge: 3946b46cab8b4 012e974501a27 Author: Linus Torvalds Date: Fri Oct 8 13:05:39 2021 -0700 Merge tag 'xtensa-20211008' of git://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix build/boot issues caused by CONFIG_OF vs CONFIC_USE_OF usage - fix reset handler for xtfpga boards * tag 'xtensa-20211008' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: xtfpga: Try software restart before simulating CPU reset xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF xtensa: call irqchip_init only when CONFIG_USE_OF is selected xtensa: use CONFIG_USE_OF instead of CONFIG_OF commit 3946b46cab8b4714a9274af91772b9ad17a10e12 Merge: 0dcf60d001400 319933a80fd4f Author: Linus Torvalds Date: Fri Oct 8 12:55:23 2021 -0700 Merge tag 'for-linus-5.15b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - fix two minor issues in the Xen privcmd driver plus a cleanup patch for that driver - fix multiple issues related to running as PVH guest and some related earlyprintk fixes for other Xen guest types - fix an issue introduced in 5.15 the Xen balloon driver * tag 'for-linus-5.15b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/balloon: fix cancelled balloon action xen/x86: adjust data placement x86/PVH: adjust function/data placement xen/x86: hook up xen_banner() also for PVH xen/x86: generalize preferred console model from PV to PVH Dom0 xen/x86: make "earlyprintk=xen" work for HVM/PVH DomU xen/x86: allow "earlyprintk=xen" to work for PV Dom0 xen/x86: make "earlyprintk=xen" work better for PVH Dom0 xen/x86: allow PVH Dom0 without XEN_PV=y xen/x86: prevent PVH type from getting clobbered xen/privcmd: drop "pages" parameter from xen_remap_pfn() xen/privcmd: fix error handling in mmap-resource processing xen/privcmd: replace kcalloc() by kvcalloc() when allocating empty pages commit 0dcf60d0014001a2dcae61169c8f72b775c2e48a Merge: cdc726fb35ede 2fbc349911e45 Author: Linus Torvalds Date: Fri Oct 8 11:57:54 2021 -0700 Merge tag 'asm-generic-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "There is one build fix for Arm platforms that ended up impacting most architectures because of the way the drivers/firmware Kconfig file is wired up: The CONFIG_QCOM_SCM dependency have caused a number of randconfig regressions over time, and some still remain in v5.15-rc4. The fix we agreed on in the end is to make this symbol selected by any driver using it, and then building it even for non-Arm platforms with CONFIG_COMPILE_TEST. To make this work on all architectures, the drivers/firmware/Kconfig file needs to be included for all architectures to make the symbol itself visible. In a separate discussion, we found that a sound driver patch that is pending for v5.16 needs the same change to include this Kconfig file, so the easiest solution seems to have my Kconfig rework included in v5.15. Finally, the branch also includes a small unrelated build fix for NOMMU architectures" Link: https://lore.kernel.org/all/20210928153508.101208f8@canb.auug.org.au/ Link: https://lore.kernel.org/all/20210928075216.4193128-1-arnd@kernel.org/ Link: https://lore.kernel.org/all/20211007151010.333516-1-arnd@kernel.org/ * tag 'asm-generic-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic/io.h: give stub iounmap() on !MMU same prototype as elsewhere qcom_scm: hide Kconfig symbol firmware: include drivers/firmware/Kconfig unconditionally commit cdc726fb35ede5dad4ae362e35f3ee5507299030 Merge: 741668ef78320 3fb937f441c64 Author: Linus Torvalds Date: Fri Oct 8 11:49:30 2021 -0700 Merge tag 'acpi-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a recent ACPI-related regression in the PCI subsystem that introduced a NULL pointer dereference possible to trigger from user space via sysfs on some systems" * tag 'acpi-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PCI: ACPI: Check parent pointer in acpi_pci_find_companion() commit 741668ef78320a2c1aacbfecea43ac884d989ec1 Merge: 9c7e7050f8769 58fc1daa4d2e9 Author: Linus Torvalds Date: Fri Oct 8 10:16:01 2021 -0700 Merge tag 'usb-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 5.15-rc5 that resolve a number of reported issues: - gadget driver fixes - xhci build warning fixes - build configuration fix - cdc-acm tty handling fixes - cdc-wdm fix - typec fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: cdc-acm: fix break reporting USB: cdc-acm: fix racy tty buffer accesses usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize usb: cdc-wdm: Fix check for WWAN usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle usb: typec: tcpm: handle SRC_STARTUP state if cc changes usb: typec: tcpci: don't handle vSafe0V event if it's not enabled usb: typec: tipd: Remove dependency on "connector" child fwnode Partially revert "usb: Kconfig: using select for USB_COMMON dependency" usb: dwc3: gadget: Revert "set gadgets parent to the right controller" usb: xhci: tegra: mark PM functions as __maybe_unused commit 9c7e7050f876904e632cc57f7e842ae3874121df Merge: 0068dc8c96688 8a38a4d51c505 Author: Linus Torvalds Date: Fri Oct 8 10:08:58 2021 -0700 Merge tag 'mmc-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "A couple of MMC host fixes: - meson-gx: Fix read/write access for dram-access-quirk - sdhci-of-at91: Fix calibration sequence" * tag 'mmc-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk mmc: sdhci-of-at91: replace while loop with read_poll_timeout mmc: sdhci-of-at91: wait for calibration done before proceed commit 0068dc8c96688b72cc99470530b384429129950c Merge: 1da38549dd64c bf79045e0ef5f Author: Linus Torvalds Date: Fri Oct 8 09:58:50 2021 -0700 Merge tag 'drm-fixes-2021-10-08' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "I've returned from my tropical island retreat, even managed to bring one of my kids on a dive with some turtles. Thanks to Daniel for doing last week's work. Otherwise this is the weekly fixes pull, it's a bit bigger because the vc4 reverts in your tree caused some problems with fixes in the drm-misc tree so it got left out last week, so this week has the misc fixes rebased without the vc4 pieces. Otherwise it's i915, amdgpu with the usual fixes and a scattering over other drivers. I expect things should calm down a bit more next week. core: - Kconfig fix for fb_simple vs simpledrm. i915: - Fix RKL HDMI audio - Fix runtime pm imbalance on i915_gem_shrink() error path - Fix Type-C port access before hw/sw state sync - Fix VBT backlight struct version/size check - Fix VT-d async flip on SKL/BXT with plane stretch workaround amdgpu: - DCN 3.1 DP alt mode fixes - S0ix gfxoff fix - Fix DRM_AMD_DC_SI dependencies - PCIe DPC handling fix - DCN 3.1 scaling fix - Documentation fix amdkfd: - Fix potential memory leak - IOMMUv2 init fixes vc4 (there were some hdmi fixes but things got reverted, sort it out later): - compiler fix nouveau: - Cursor fix - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support. - memory leak fixes rockchip: - crtc/clk fixup panel: - ili9341 Fix DT bindings indent - y030xx067a - yellow tint init seq fix gbefb: - Fix gbefb when built with COMPILE_TEST" * tag 'drm-fixes-2021-10-08' of git://anongit.freedesktop.org/drm/drm: (33 commits) drm/amd/display: Fix detection of 4 lane for DPALT drm/amd/display: Limit display scaling to up to 4k for DCN 3.1 drm/amd/display: Skip override for preferred link settings during link training drm/nouveau/debugfs: fix file release memory leak drm/nouveau/kms/nv50-: fix file release memory leak drm/nouveau: avoid a use-after-free when BO init fails DRM: delete DRM IRQ legacy midlayer docs video: fbdev: gbefb: Only instantiate device when built for IP32 fbdev: simplefb: fix Kconfig dependencies drm/panel: abt-y030xx067a: yellow tint fix dt-bindings: panel: ili9341: correct indentation drm/nouveau/fifo/ga102: initialise chid on return from channel creation drm/rockchip: Update crtc fixup to account for fractional clk change drm/nouveau/ga102-: support ttm buffer moves via copy engine drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup drm/vc4: hdmi: Remove unused struct drm/kmb: Enable alpha blended second plane drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume drm/amdgpu: init iommu after amdkfd device init ... commit 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 Author: Lin Ma Date: Thu Oct 7 19:44:30 2021 +0200 nfc: nci: fix the UAF of rf_conn_info object The nci_core_conn_close_rsp_packet() function will release the conn_info with given conn_id. However, it needs to set the rf_conn_info to NULL to prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger the UAF. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lin Ma Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a Author: Karsten Graul Date: Thu Oct 7 16:14:40 2021 +0200 net/smc: improved fix wait on already cleared link Commit 8f3d65c16679 ("net/smc: fix wait on already cleared link") introduced link refcounting to avoid waits on already cleared links. This patch extents and improves the refcounting to cover all remaining possible cases for this kind of error situation. Fixes: 15e1b99aadfb ("net/smc: no WR buffer wait for terminating link group") Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 097657c9a478df029e1d9b3602c3351e28927043 Merge: 612f71d7328c1 6636fec29cdf6 Author: David S. Miller Date: Fri Oct 8 16:22:55 2021 +0100 Merge branch 'stmmac-regression-fix' Merge branch 'stmmac-regression-fix' Herve Codina says: ==================== net: stmmac: fix regression on SPEAr3xx SOC The ethernet driver used on old SPEAr3xx soc was previously supported on old kernel. Some regressions were introduced during the different updates leading to a broken driver for this soc. This series fixes these regressions and brings back ethernet on SPEAr3xx. Tested on a SPEAr320 board. ==================== Signed-off-by: David S. Miller commit 6636fec29cdf6665bd219564609e8651f6ddc142 Author: Herve Codina Date: Fri Oct 8 12:34:40 2021 +0200 ARM: dts: spear3xx: Fix gmac node On SPEAr3xx, ethernet driver is not compatible with the SPEAr600 one. Indeed, SPEAr3xx uses an earlier version of this IP (v3.40) and needs some driver tuning compare to SPEAr600. The v3.40 IP support was added to stmmac driver and this patch fixes this issue and use the correct compatible string for SPEAr3xx Signed-off-by: Herve Codina Signed-off-by: David S. Miller commit 9cb1d19f47fafad7dcf7c8564e633440c946cfd7 Author: Herve Codina Date: Fri Oct 8 12:34:39 2021 +0200 net: stmmac: add support for dwmac 3.40a dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc. Signed-off-by: Herve Codina Signed-off-by: David S. Miller commit 3781b6ad2ee1b1c3cf8b6523ac22a58f44c2c337 Author: Herve Codina Date: Fri Oct 8 12:34:38 2021 +0200 dt-bindings: net: snps,dwmac: add dwmac 3.40a IP version dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc. Signed-off-by: Herve Codina Signed-off-by: David S. Miller commit 075da584bae2da6a37428d59a477b6bdad430ac3 Author: Herve Codina Date: Fri Oct 8 12:34:37 2021 +0200 net: stmmac: fix get_hw_feature() on old hardware Some old IPs do not provide the hardware feature register. On these IPs, this register is read 0x00000000. In old driver version, this feature was handled but a regression came with the commit f10a6a3541b4 ("stmmac: rework get_hw_feature function"). Indeed, this commit removes the return value in dma->get_hw_feature(). This return value was used to indicate the validity of retrieved information and used later on in stmmac_hw_init() to override priv->plat data if this hardware feature were valid. This patch restores the return code in ->get_hw_feature() in order to indicate the hardware feature validity and override priv->plat data only if this hardware feature is valid. Fixes: f10a6a3541b4 ("stmmac: rework get_hw_feature function") Signed-off-by: Herve Codina Signed-off-by: David S. Miller commit 612f71d7328c14369924384ad2170aae2a6abd92 Author: Paolo Abeni Date: Thu Oct 7 15:05:00 2021 -0700 mptcp: fix possible stall on recvmsg() recvmsg() can enter an infinite loop if the caller provides the MSG_WAITALL, the data present in the receive queue is not sufficient to fulfill the request, and no more data is received by the peer. When the above happens, mptcp_wait_data() will always return with no wait, as the MPTCP_DATA_READY flag checked by such function is set and never cleared in such code path. Leveraging the above syzbot was able to trigger an RCU stall: rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-...!: (10499 ticks this GP) idle=0af/1/0x4000000000000000 softirq=10678/10678 fqs=1 (t=10500 jiffies g=13089 q=109) rcu: rcu_preempt kthread starved for 10497 jiffies! g13089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28696 pid: 14 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4955 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6236 schedule+0xd3/0x270 kernel/sched/core.c:6315 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8510 Comm: syz-executor827 Not tainted 5.15.0-rc2-next-20210920-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:84 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0xc8/0x180 mm/kasan/generic.c:189 Code: 38 00 74 ed 48 8d 50 08 eb 09 48 83 c0 01 48 39 d0 74 7a 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 <48> 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 80 38 00 RSP: 0018:ffffc9000cd676c8 EFLAGS: 00000283 RAX: ffffed100e9a110e RBX: ffffed100e9a110f RCX: ffffffff88ea062a RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff888074d08870 RBP: ffffed100e9a110e R08: 0000000000000001 R09: ffff888074d08877 R10: ffffed100e9a110e R11: 0000000000000000 R12: ffff888074d08000 R13: ffff888074d08000 R14: ffff888074d08088 R15: ffff888074d08000 FS: 0000555556d8e300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 S: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 0000000068909000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: instrument_atomic_read_write include/linux/instrumented.h:101 [inline] test_and_clear_bit include/asm-generic/bitops/instrumented-atomic.h:83 [inline] mptcp_release_cb+0x14a/0x210 net/mptcp/protocol.c:3016 release_sock+0xb4/0x1b0 net/core/sock.c:3204 mptcp_wait_data net/mptcp/protocol.c:1770 [inline] mptcp_recvmsg+0xfd1/0x27b0 net/mptcp/protocol.c:2080 inet6_recvmsg+0x11b/0x5e0 net/ipv6/af_inet6.c:659 sock_recvmsg_nosec net/socket.c:944 [inline] ____sys_recvmsg+0x527/0x600 net/socket.c:2626 ___sys_recvmsg+0x127/0x200 net/socket.c:2670 do_recvmmsg+0x24d/0x6d0 net/socket.c:2764 __sys_recvmmsg net/socket.c:2843 [inline] __do_sys_recvmmsg net/socket.c:2866 [inline] __se_sys_recvmmsg net/socket.c:2859 [inline] __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2859 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc200d2dc39 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc5758e5a8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc200d2dc39 RDX: 0000000000000002 RSI: 00000000200017c0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000f0b5ff R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ffc5758e5d0 R14: 00007ffc5758e5c0 R15: 0000000000000003 Fix the issue by replacing the MPTCP_DATA_READY bit with direct inspection of the msk receive queue. Reported-and-tested-by: syzbot+3360da629681aa0d22fe@syzkaller.appspotmail.com Fixes: 7a6a6cbc3e59 ("mptcp: recvmsg() can drain data from multiple subflow") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 2fbc349911e45d4ea5187b608c8d58db66496260 Author: Adam Borowski Date: Sun Sep 12 23:26:06 2021 +0200 asm-generic/io.h: give stub iounmap() on !MMU same prototype as elsewhere It made -Werror sad. Signed-off-by: Adam Borowski Signed-off-by: Arnd Bergmann commit d298b03506d3e161f7492c440babb0bfae35e650 Author: Borislav Petkov Date: Wed Oct 6 18:33:52 2021 +0200 x86/fpu: Restore the masking out of reserved MXCSR bits Ser Olmy reported a boot failure: init[1] bad frame in sigreturn frame:(ptrval) ip:b7c9fbe6 sp:bf933310 orax:ffffffff \ in libc-2.33.so[b7bed000+156000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 0 PID: 1 Comm: init Tainted: G W 5.14.9 #1 Hardware name: Hewlett-Packard HP PC/HP Board, BIOS JD.00.06 12/06/2001 Call Trace: dump_stack_lvl dump_stack panic do_exit.cold do_group_exit get_signal arch_do_signal_or_restart ? force_sig_info_to_task ? force_sig exit_to_user_mode_prepare syscall_exit_to_user_mode do_int80_syscall_32 entry_INT80_32 on an old 32-bit Intel CPU: vendor_id : GenuineIntel cpu family : 6 model : 6 model name : Celeron (Mendocino) stepping : 5 microcode : 0x3 Ser bisected the problem to the commit in Fixes. tglx suggested reverting the rejection of invalid MXCSR values which this commit introduced and replacing it with what the old code did - simply masking them out to zero. Further debugging confirmed his suggestion: fpu->state.fxsave.mxcsr: 0xb7be13b4, mxcsr_feature_mask: 0xffbf WARNING: CPU: 0 PID: 1 at arch/x86/kernel/fpu/signal.c:384 __fpu_restore_sig+0x51f/0x540 so restore the original behavior only for 32-bit kernels where you have ancient machines with buggy hardware. For 32-bit programs on 64-bit kernels, user space which supplies wrong MXCSR values is considered malicious so fail the sigframe restoration there. Fixes: 6f9866a166cd ("x86/fpu/signal: Let xrstor handle the features to init") Reported-by: Ser Olmy Signed-off-by: Borislav Petkov Tested-by: Ser Olmy Cc: Link: https://lkml.kernel.org/r/YVtA67jImg3KlBTw@zn.tnic commit bf79045e0ef5f0fb2a0619f9d0782665d07b2d66 Merge: b28a130f0bc6e 5a1fef027846e Author: Dave Airlie Date: Fri Oct 8 11:40:21 2021 +1000 Merge tag 'amd-drm-fixes-5.15-2021-10-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-10-06: amdgpu: - DCN 3.1 DP alt mode fixes - S0ix gfxoff fix - Fix DRM_AMD_DC_SI dependencies - PCIe DPC handling fix - DCN 3.1 scaling fix - Documentation fix amdkfd: - Fix potential memory leak - IOMMUv2 init fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20211006203828.4818-1-alexander.deucher@amd.com commit b28a130f0bc6e79ba9b02fcc639bca2abd3b8361 Merge: 7d80cc702f046 f5a8703a9c418 Author: Dave Airlie Date: Fri Oct 8 11:34:31 2021 +1000 Merge tag 'drm-misc-fixes-2021-10-06' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Rebased drm-misc-fixes for v5.15-rc5: - Dropped vc4 patches. - Compiler fix for vc4. - Cursor fix for nouveau. - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support. - Small rockchip fixes. - Fix DT bindings indent for ili9341. - Fix y030xx067a init sequence to not get a yellow tint. - Kconfig fix for fb_simple vs simpledrm. - Assorted nouvaeu memory leaks. - Fix gbefb when built with COMPILE_TEST. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/3272bf72-2c37-31eb-404e-cf7edd485c7d@linux.intel.com commit 7d80cc702f046f34f346dcb0a45c439ef4044dcd Merge: 9e1ff307c779c b2d73debfdc16 Author: Dave Airlie Date: Fri Oct 8 10:53:12 2021 +1000 Merge tag 'drm-intel-fixes-2021-10-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15-rc5: - Fix RKL HDMI audio - Fix runtime pm imbalance on i915_gem_shrink() error path - Fix Type-C port access before hw/sw state sync - Fix VBT backlight struct version/size check - Fix VT-d async flip on SKL/BXT with plane stretch workaround Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87k0ipywo4.fsf@intel.com commit 3ef6ca4f354c53abf263cbeb51e7272523c294d8 Author: Palmer Dabbelt Date: Sat Oct 2 16:57:13 2021 -0700 checksyscalls: Unconditionally ignore fstat{,at}64 These can be replaced by statx(). Since rv32 has a 64-bit time_t we just never ended up with them in the first place. This is now an error due to -Werror. Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Signed-off-by: Palmer Dabbelt commit 1da38549dd64c7f5dd22427f12dfa8db3d8a722b Merge: 3e899c7209dd8 c20106944eb67 Author: Linus Torvalds Date: Thu Oct 7 14:11:40 2021 -0700 Merge tag 'nfsd-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Bug fixes for NFSD error handling paths" * tag 'nfsd-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Keep existing listeners on portlist error SUNRPC: fix sign error causing rpcsec_gss drops nfsd: Fix a warning for nfsd_file_close_inode nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero nfsd: fix error handling of register_pernet_subsys() in init_nfsd() commit 3e899c7209dd8f7afca59518c5ace0f03385dbc3 Merge: 7041503d3a5c8 897c2e746cc79 Author: Linus Torvalds Date: Thu Oct 7 14:01:29 2021 -0700 Merge tag 'armsoc-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "This is a larger than normal update for Arm SoC specific code, most of it in device trees, but also drivers and the omap and at91/sama7 platforms: - There are four new entries to the MAINTAINERS file: Sven Peter and Alyssa Rosenzweig for Apple M1, Romain Perier for Mstar/sigmastar, and Vignesh Raghavendra for TI K3 - Build fixes to address randconfig warnings in sharpsl, dove, omap1, and qcom platforms as well as the scmi and op-tee subsystems - Regression fixes for missing CONFIG_FB and other options for several defconfigs - Several bug fixes for the newly added Microchip SAMA7 platform, mostly regarding power management - Missing SMP barriers to protect accesses to SCMI virtio device - Regression fixes for TI OMAP, including a boot-time hang on am335x. - Lots of bug fixes for NXP i.MX, mostly addressing incorrect settings in devicetree files, and one revert for broken suspend. - Fixes for ARM Juno/Vexpress devicetree files, addressing a couple of schema warnings. - Regression fixes for qualcomm SoC specific drivers and devicetree files, reverting an mdt_loader change and at least pastially reverting some of the 5.15 DTS changes, plus some minor bugfixes" * tag 'armsoc-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (64 commits) MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer firmware: arm_scmi: Add proper barriers to scmi virtio device firmware: arm_scmi: Simplify spinlocks in virtio transport ARM: dts: omap3430-sdp: Fix NAND device node bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 ARM: sharpsl_param: work around -Wstringop-overread warning ARM: defconfig: gemini: Restore framebuffer ARM: dove: mark 'putc' as inline ARM: omap1: move omap15xx local bus handling to usb.c MAINTAINERS: Add Vignesh to TI K3 platform maintainership arm64: dts: imx8m*-venice-gw7902: fix M2_RST# gpio ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence arm64: dts: ls1028a: fix eSDHC2 node arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2 ARM: dts: at91: sama7g5ek: to not touch slew-rate for SDMMC pins ARM: dts: at91: sama7g5ek: use proper slew-rate settings for GMACs ARM: at91: pm: preload base address of controllers in tlb ARM: at91: pm: group constants and addresses loading ARM: dts: at91: sama7g5ek: add suspend voltage for ddr3l rail ... commit 4afb912f439c4bc4e6a4f3e7547f2e69e354108f Author: Josef Bacik Date: Tue Oct 5 16:35:27 2021 -0400 btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this case is if we got a ret != -EOPNOTSUPP and we called from the file clone code. However the prealloc code uses this path too. Instead we need to abort if there is an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only if we came from the clone file code. CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Nikolay Borisov Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit cfd312695b71df04c3a2597859ff12c470d1e2e4 Author: Filipe Manana Date: Fri Oct 1 13:48:18 2021 +0100 btrfs: check for error when looking up inode during dir entry replay At replay_one_name(), we are treating any error from btrfs_lookup_inode() as if the inode does not exists. Fix this by checking for an error and returning it to the caller. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8dcbc26194eb872cc3430550fb70bb461424d267 Author: Filipe Manana Date: Fri Oct 1 13:52:33 2021 +0100 btrfs: unify lookup return value when dir entry is missing btrfs_lookup_dir_index_item() and btrfs_lookup_dir_item() lookup for dir entries and both are used during log replay or when updating a log tree during an unlink. However when the dir item does not exists, btrfs_lookup_dir_item() returns NULL while btrfs_lookup_dir_index_item() returns PTR_ERR(-ENOENT), and if the dir item exists but there is no matching entry for a given name or index, both return NULL. This makes the call sites during log replay to be more verbose than necessary and it makes it easy to miss this slight difference. Since we don't need to distinguish between those two cases, make btrfs_lookup_dir_index_item() always return NULL when there is no matching directory entry - either because there isn't any dir entry or because there is one but it does not match the given name and index. Also rename the argument 'objectid' of btrfs_lookup_dir_index_item() to 'index' since it is supposed to match an index number, and the name 'objectid' is not very good because it can easily be confused with an inode number (like the inode number a dir entry points to). CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 52db77791fe24538c8aa2a183248399715f6b380 Author: Filipe Manana Date: Fri Oct 1 13:52:32 2021 +0100 btrfs: deal with errors when adding inode reference during log replay At __inode_add_ref(), we treating any error returned from btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning that there is no existing directory entry in the fs/subvolume tree. This is not correct since we can get errors such as, for example, -EIO when reading extent buffers while searching the fs/subvolume's btree. So fix that and return the error to the caller when it is not -ENOENT. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e15ac6413745e3def00e663de00aea5a717311c1 Author: Filipe Manana Date: Fri Oct 1 13:52:31 2021 +0100 btrfs: deal with errors when replaying dir entry during log replay At replay_one_one(), we are treating any error returned from btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning that there is no existing directory entry in the fs/subvolume tree. This is not correct since we can get errors such as, for example, -EIO when reading extent buffers while searching the fs/subvolume's btree. So fix that and return the error to the caller when it is not -ENOENT. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 77a5b9e3d14cbce49ceed2766b2003c034c066dc Author: Filipe Manana Date: Fri Oct 1 13:52:30 2021 +0100 btrfs: deal with errors when checking if a dir entry exists during log replay Currently inode_in_dir() ignores errors returned from btrfs_lookup_dir_index_item() and from btrfs_lookup_dir_item(), treating any errors as if the directory entry does not exists in the fs/subvolume tree, which is obviously not correct, as we can get errors such as -EIO when reading extent buffers while searching the fs/subvolume's tree. Fix that by making inode_in_dir() return the errors and making its only caller, add_inode_ref(), deal with returned errors as well. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d175209be04d7d263fa1a54cde7608c706c9d0d7 Author: Josef Bacik Date: Fri Oct 1 13:57:18 2021 -0400 btrfs: update refs for any root except tree log roots I hit a stuck relocation on btrfs/061 during my overnight testing. This turned out to be because we had left over extent entries in our extent root for a data reloc inode that no longer existed. This happened because in btrfs_drop_extents() we only update refs if we have SHAREABLE set or we are the tree_root. This regression was introduced by aeb935a45581 ("btrfs: don't set SHAREABLE flag for data reloc tree") where we stopped setting SHAREABLE for the data reloc tree. The problem here is we actually do want to update extent references for data extents in the data reloc tree, in fact we only don't want to update extent references if the file extents are in the log tree. Update this check to only skip updating references in the case of the log tree. This is relatively rare, because you have to be running scrub at the same time, which is what btrfs/061 does. The data reloc inode has its extents pre-allocated, and then we copy the extent into the pre-allocated chunks. We theoretically should never be calling btrfs_drop_extents() on a data reloc inode. The exception of course is with scrub, if our pre-allocated extent falls inside of the block group we are scrubbing, then the block group will be marked read only and we will be forced to cow that extent. This means we will call btrfs_drop_extents() on that range when we COW that file extent. This isn't really problematic if we do this, the data reloc inode requires that our extent lengths match exactly with the extent we are copying, thankfully we validate the extent is correct with get_new_location(), so if we happen to COW only part of the extent we won't link it in when we do the relocation, so we are safe from any other shenanigans that arise because of this interaction with scrub. Fixes: aeb935a45581 ("btrfs: don't set SHAREABLE flag for data reloc tree") CC: stable@vger.kernel.org # 5.8+ Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 19ea40dddf1833db868533958ca066f368862211 Author: Qu Wenruo Date: Tue Sep 14 14:57:59 2021 +0800 btrfs: unlock newly allocated extent buffer after error [BUG] There is a bug report that injected ENOMEM error could leave a tree block locked while we return to user-space: BTRFS info (device loop0): enabling ssd optimizations FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 7579 Comm: syz-executor Not tainted 5.15.0-rc1 #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 fail_dump lib/fault-inject.c:52 [inline] should_fail+0x13c/0x160 lib/fault-inject.c:146 should_failslab+0x5/0x10 mm/slab_common.c:1328 slab_pre_alloc_hook.constprop.99+0x4e/0xc0 mm/slab.h:494 slab_alloc_node mm/slub.c:3120 [inline] slab_alloc mm/slub.c:3214 [inline] kmem_cache_alloc+0x44/0x280 mm/slub.c:3219 btrfs_alloc_delayed_extent_op fs/btrfs/delayed-ref.h:299 [inline] btrfs_alloc_tree_block+0x38c/0x670 fs/btrfs/extent-tree.c:4833 __btrfs_cow_block+0x16f/0x7d0 fs/btrfs/ctree.c:415 btrfs_cow_block+0x12a/0x300 fs/btrfs/ctree.c:570 btrfs_search_slot+0x6b0/0xee0 fs/btrfs/ctree.c:1768 btrfs_insert_empty_items+0x80/0xf0 fs/btrfs/ctree.c:3905 btrfs_new_inode+0x311/0xa60 fs/btrfs/inode.c:6530 btrfs_create+0x12b/0x270 fs/btrfs/inode.c:6783 lookup_open+0x660/0x780 fs/namei.c:3282 open_last_lookups fs/namei.c:3352 [inline] path_openat+0x465/0xe20 fs/namei.c:3557 do_filp_open+0xe3/0x170 fs/namei.c:3588 do_sys_openat2+0x357/0x4a0 fs/open.c:1200 do_sys_open+0x87/0xd0 fs/open.c:1216 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x34/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x46ae99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f46711b9c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 000000000078c0a0 RCX: 000000000046ae99 RDX: 0000000000000000 RSI: 00000000000000a1 RDI: 0000000020005800 RBP: 00007f46711b9c80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017 R13: 0000000000000000 R14: 000000000078c0a0 R15: 00007ffc129da6e0 ================================================ WARNING: lock held when returning to user space! 5.15.0-rc1 #16 Not tainted ------------------------------------------------ syz-executor/7579 is leaving the kernel with locks still held! 1 lock held by syz-executor/7579: #0: ffff888104b73da8 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x2e/0x1a0 fs/btrfs/locking.c:112 [CAUSE] In btrfs_alloc_tree_block(), after btrfs_init_new_buffer(), the new extent buffer @buf is locked, but if later operations like adding delayed tree ref fail, we just free @buf without unlocking it, resulting above warning. [FIX] Unlock @buf in out_free_buf: label. Reported-by: Hao Sun Link: https://lore.kernel.org/linux-btrfs/CACkBjsZ9O6Zr0KK1yGn=1rQi6Crh1yeCRdTSBxx9R99L4xdn-Q@mail.gmail.com/ CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 897c2e746cc795870361fcf9cbf282524589fa5f Merge: 6aaa84343895a 56dd05023675a Author: Arnd Bergmann Date: Thu Oct 7 21:14:12 2021 +0200 Merge tag 'asahi-soc-fixes-5.15' of https://github.com/AsahiLinux/linux into arm/fixes Apple SoC fixes for 5.15; just two MAINTAINERS updates. - MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer - MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer * tag 'asahi-soc-fixes-5.15' of https://github.com/AsahiLinux/linux: MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer Link: https://lore.kernel.org/r/a50a9015-0e62-c451-4d0d-668233b35b85@marcan.st Signed-off-by: Arnd Bergmann commit 6aaa84343895a62add33c992b219f65be0d65c93 Merge: 3c7f58b35305b bf1acf809d569 Author: Arnd Bergmann Date: Thu Oct 7 21:14:03 2021 +0200 Merge tag 'scmi-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes SCMI fixes for v5.15 A few fixes addressing: - Kconfig dependency between VIRTIO and ARM_SCMI_PROTOCOL - Link-time error with __exit annotation for virtio_scmi_exit - Unnecessary nested irqsave/irqrestore spinlocks in virtio transport - Missing SMP barriers to protect accesses to SCMI virtio device * tag 'scmi-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Add proper barriers to scmi virtio device firmware: arm_scmi: Simplify spinlocks in virtio transport firmware: arm_scmi: Remove __exit annotation firmware: arm_scmi: Fix virtio transport Kconfig dependency Link: https://lore.kernel.org/r/20211007102822.27886-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 3c7f58b35305b51920cf98c328d6d1ab98670f79 Merge: 2250596374f5b 80d680fdccba2 Author: Arnd Bergmann Date: Thu Oct 7 21:13:57 2021 +0200 Merge tag 'omap-for-v5.15/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omaps for v5.15 Few regression fixes for omaps for the v5.15-rc cycle. There is a fix for boot time hangs that can happen on some am335x devices that started when the pruss devicetree nodes were added. The other fixes are less critical: - Fix compiler warning for sysc_init_soc() that got recently introduced - Fix external abort for am335x pruss as otherwise some am335x will hang - Use CLKDM_NOAUTO quirk also for dra7 dcan1 - Fix older NAND device node regression for omap3-sdp * tag 'omap-for-v5.15/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: omap3430-sdp: Fix NAND device node bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 soc: ti: omap-prm: Fix external abort for am335x pruss bus: ti-sysc: Add break in switch statement in sysc_init_soc() Link: https://lore.kernel.org/r/pull-1633609552-789682@atomide.com Signed-off-by: Arnd Bergmann commit 7041503d3a5c869e4b4934df57112ef90ce7e307 Merge: 14df9235aa99e 5c0522484eb54 Author: Linus Torvalds Date: Thu Oct 7 11:20:08 2021 -0700 Merge tag 'misc-fixes-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull netfslib, cachefiles and afs fixes from David Howells: - Fix another couple of oopses in cachefiles tracing stemming from the possibility of passing in a NULL object pointer - Fix netfs_clear_unread() to set READ on the iov_iter so that source it is passed to doesn't do the wrong thing (some drivers look at the flag on iov_iter rather than other available information to determine the direction) - Fix afs_launder_page() to write back at the correct file position on the server so as not to corrupt data * tag 'misc-fixes-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix afs_launder_page() to set correct start file position netfs: Fix READ/WRITE confusion when calling iov_iter_xarray() cachefiles: Fix oops with cachefiles_cull() due to NULL object commit 14df9235aa99e43ddeb78b8d2a78cf20c21a1114 Merge: 4a16df549d232 0b6c5371c03c2 Author: Linus Torvalds Date: Thu Oct 7 10:58:42 2021 -0700 Merge tag 'perf-tools-fixes-for-v5.15-2021-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix plugin static linking with libopencsd on ARM and ARM64 - Add missing -lstdc++ when linking with libopencsd - Add missing topdown metrics events to 'perf test attr' - Plug leak sys_event_tables list after processing JSON vendor events entries - Sync sound/asound.h copy with the kernel sources * tag 'perf-tools-fixes-for-v5.15-2021-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf tests attr: Add missing topdown metrics events tools include UAPI: Sync sound/asound.h copy with the kernel sources perf build: Fix plugin static linking with libopencsd on ARM and ARM64 perf build: Add missing -lstdc++ when linking with libopencsd perf jevents: Free the sys_event_tables list after processing entries commit 68a3765c659f809dcaac20030853a054646eb739 Author: Florian Westphal Date: Wed Oct 6 16:20:34 2021 +0200 netfilter: nf_tables: skip netdev events generated on netns removal syzbot reported following (harmless) WARN: WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468 nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline] nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline] __nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524 nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline] nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382 reproducer: unshare -n bash -c 'ip link add br0 type bridge; nft add table netdev t ; \ nft add chain netdev t ingress \{ type filter hook ingress device "br0" \ priority 0\; policy drop\; \}' Problem is that when netns device exit hooks create the UNREGISTER event, the .pre_exit hook for nf_tables core has already removed the base hook. Notifier attempts to do this again. The need to do base hook unregister unconditionally was needed in the past, because notifier was last stage where reg->dev dereference was safe. Now that nf_tables does the hook removal in .pre_exit, this isn't needed anymore. Reported-and-tested-by: syzbot+154bd5be532a63aa778b@syzkaller.appspotmail.com Fixes: 767d1216bff825 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 77076934afdcd46516caf18ed88b2f88025c9ddb Author: Vegard Nossum Date: Tue Oct 5 22:54:54 2021 +0200 netfilter: Kconfig: use 'default y' instead of 'm' for bool config option This option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'. Fixes: 33b8e77605620 ("[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option") Signed-off-by: Vegard Nossum Signed-off-by: Pablo Neira Ayuso commit 902c0b1887522a099aa4e1e6b4b476c2fe5dd13e Author: Juhee Kang Date: Mon Oct 4 21:14:38 2021 +0900 netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value Currently, when the rule related to IDLETIMER is added, idletimer_tg timer structure is initialized by kmalloc on executing idletimer_tg_create function. However, in this process timer->timer_type is not defined to a specific value. Thus, timer->timer_type has garbage value and it occurs kernel panic. So, this commit fixes the panic by initializing timer->timer_type using kzalloc instead of kmalloc. Test commands: # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test $ cat /sys/class/xt_idletimer/timers/test Killed Splat looks like: BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70 Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917 CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x9c kasan_report.cold+0x112/0x117 ? alarm_expires_remaining+0x49/0x70 __asan_load8+0x86/0xb0 alarm_expires_remaining+0x49/0x70 idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d] dev_attr_show+0x3c/0x60 sysfs_kf_seq_show+0x11d/0x1f0 ? device_remove_bin_file+0x20/0x20 kernfs_seq_show+0xa4/0xb0 seq_read_iter+0x29c/0x750 kernfs_fop_read_iter+0x25a/0x2c0 ? __fsnotify_parent+0x3d1/0x570 ? iov_iter_init+0x70/0x90 new_sync_read+0x2a7/0x3d0 ? __x64_sys_llseek+0x230/0x230 ? rw_verify_area+0x81/0x150 vfs_read+0x17b/0x240 ksys_read+0xd9/0x180 ? vfs_write+0x460/0x460 ? do_syscall_64+0x16/0xc0 ? lockdep_hardirqs_on+0x79/0x120 __x64_sys_read+0x43/0x50 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0cdc819142 Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142 RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003 RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target") Signed-off-by: Juhee Kang Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 136f282028dae7d9dd68469b197aa2b36b410992 Author: Miguel Bernal Marin Date: Wed Oct 6 00:13:18 2021 -0500 ACPI: tools: fix compilation error When ACPI tools are compiled, the following error is showed: $ cd tools/power/acpi $ make DESCEND tools/acpidbg MKDIR include CP include CC tools/acpidbg/acpidbg.o In file included from /home/linux/tools/power/acpi/include/acpi/platform/acenv.h:152, from /home/linux/tools/power/acpi/include/acpi/acpi.h:22, from acpidbg.c:9: /home/linux/tools/power/acpi/include/acpi/platform/acgcc.h:25:10: fatal error: linux/stdarg.h: No such file or directory 29 | #include | ^~~~~~~~~~~~~~~~ compilation terminated. Use the ACPICA logic: just identify when it is used inside the kernel or by an ACPI tool. Fixes: c0891ac15f04 ("isystem: ship and use stdarg.h") Signed-off-by: Miguel Bernal Marin [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 4a16df549d2326344bf4d669c5f70d3da447e207 Merge: 52bf8031c0646 8d6c414cd2fb7 Author: Linus Torvalds Date: Thu Oct 7 09:50:31 2021 -0700 Merge tag 'net-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from xfrm, bpf, netfilter, and wireless. Current release - regressions: - xfrm: fix XFRM_MSG_MAPPING ABI breakage caused by inserting a new value in the middle of an enum - unix: fix an issue in unix_shutdown causing the other end read/write failures - phy: mdio: fix memory leak Current release - new code bugs: - mlx5e: improve MQPRIO resiliency against bad configs Previous releases - regressions: - bpf: fix integer overflow leading to OOB access in map element pre-allocation - stmmac: dwmac-rk: fix ethernet on rk3399 based devices - netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1 - brcmfmac: revert using ISO3166 country code and 0 rev as fallback - i40e: fix freeing of uninitialized misc IRQ vector - iavf: fix double unlock of crit_lock Previous releases - always broken: - bpf, arm: fix register clobbering in div/mod implementation - netfilter: nf_tables: correct issues in netlink rule change event notifications - dsa: tag_dsa: fix mask for trunked packets - usb: r8152: don't resubmit rx immediately to avoid soft lockup on device unplug - i40e: fix endless loop under rtnl if FW fails to correctly respond to capability query - mlx5e: fix rx checksum offload coexistence with ipsec offload - mlx5: force round second at 1PPS out start time and allow it only in supported clock modes - phy: pcs: xpcs: fix incorrect CL37 AN sequence, EEE disable sequence Misc: - xfrm: slightly rejig the new policy uAPI to make it less cryptic" * tag 'net-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits) net: prefer socket bound to interface when not in VRF iavf: fix double unlock of crit_lock i40e: Fix freeing of uninitialized misc IRQ vector i40e: fix endless loop under rtnl dt-bindings: net: dsa: marvell: fix compatible in example ionic: move filter sync_needed bit set gve: report 64bit tx_bytes counter from gve_handle_report_stats() gve: fix gve_get_stats() rtnetlink: fix if_nlmsg_stats_size() under estimation gve: Properly handle errors in gve_assign_qpl gve: Avoid freeing NULL pointer gve: Correct available tx qpl check unix: Fix an issue in unix_shutdown causing the other end read/write failures net: stmmac: trigger PCS EEE to turn off on link down net: pcs: xpcs: fix incorrect steps on disable EEE netlink: annotate data races around nlk->bound net: pcs: xpcs: fix incorrect CL37 AN sequence net: sfp: Fix typo in state machine debug string net/sched: sch_taprio: properly cancel timer from taprio_destroy() net: bridge: fix under estimation in br_get_linkxstats_size() ... commit 52bf8031c06464268b1a7810946a54de5b088e81 Merge: 5af4055fa8133 f5c20e4a5f186 Author: Linus Torvalds Date: Thu Oct 7 09:44:48 2021 -0700 Merge tag 'hyperv-fixes-signed-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Replace uuid.h with types.h in a header (Andy Shevchenko) - Avoid sleeping in atomic context in PCI driver (Long Li) - Avoid sending IPI to self when it shouldn't (Vitaly Kuznetsov) * tag 'hyperv-fixes-signed-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Avoid erroneously sending IPI to 'self' hyper-v: Replace uuid.h with types.h PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus commit 3fb937f441c64af1eec60bfd3732f64001fcc534 Author: Rafael J. Wysocki Date: Fri Oct 1 15:58:10 2021 +0200 PCI: ACPI: Check parent pointer in acpi_pci_find_companion() If acpi_pci_find_companion() is called for a device whose parent pointer is NULL, it will crash when attempting to get the ACPI companion of the parent due to a NULL pointer dereference in the ACPI_COMPANION() macro. This was not a problem before commit 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") that made pci_setup_device() call pci_set_acpi_fwnode() and so it allowed devices with NULL parent pointers to be passed to acpi_pci_find_companion() which is the case in pci_iov_add_virtfn(), for instance. Fix this issue by making acpi_pci_find_companion() check the device's parent pointer upfront and bail out if it is NULL. While pci_iov_add_virtfn() can be changed to set the device's parent pointer before calling pci_setup_device() for it, checking pointers against NULL before dereferencing them is prudent anyway and looking for ACPI companions of virtual functions isn't really useful. Fixes: 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") Link: https://lore.kernel.org/linux-acpi/8e4bbd5c59de31db71f718556654c0aa077df03d.camel@linux.ibm.com/ Reported-by: Niklas Schnelle Tested-by: Niklas Schnelle Signed-off-by: Rafael J. Wysocki Acked-by: Bjorn Helgaas commit 56dd05023675a35541e9baeba868bd0472eb97f9 Author: Sven Peter Date: Thu Oct 7 07:34:30 2021 +0200 MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer Hector suggested I should add myself to help him maintain the platform. Acked-by: Hector Martin Signed-off-by: Sven Peter commit e47e3fa17c43180f9e147ba35a30c731d7648f7a Author: Alyssa Rosenzweig Date: Mon Aug 23 11:17:38 2021 -0400 MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer Add myself as a reviewer for Asahi Linux (Apple M1) patches. I would like to be CC'ed on Asahi Linux patches for review and testing. I am also collecting Asahi Linux patches downstream, rebasing on linux-next periodically, and would like to be notified of what to cherry-pick from lists. Cc: Hector Martin Cc: Sven Peter Acked-by: Hector Martin Acked-by: Sven Peter Signed-off-by: Alyssa Rosenzweig commit 64e7875560270b8f669fca9fcd6a689fea56fbeb Author: Namjae Jeon Date: Sun Oct 3 13:19:00 2021 +0900 ksmbd: fix oops from fuse driver Marios reported kernel oops from fuse driver when ksmbd call mark_inode_dirty(). This patch directly update ->i_ctime after removing mark_inode_ditry() and notify_change will put inode to dirty list. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Hyunchul Lee Reported-by: Marios Makassikis Tested-by: Marios Makassikis Acked-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 2db72604f3eaebd6175548bf64372e163724ebe3 Author: Namjae Jeon Date: Fri Oct 1 11:53:49 2021 +0900 ksmbd: fix version mismatch with out of tree Fix version mismatch with out of tree, This updated version will be matched with ksmbd-tools. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Cc: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit c7705eec78c999485609274c7ac5c27def8b84f1 Author: Namjae Jeon Date: Mon Oct 4 20:44:52 2021 +0900 ksmbd: use buf_data_size instead of recalculation in smb3_decrypt_req() Tom suggested to use buf_data_size that is already calculated, to verify these offsets. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Suggested-by: Tom Talpey Acked-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 51a1387393d98c2ba52d53d089720fa9f1463178 Author: Namjae Jeon Date: Wed Sep 29 13:09:24 2021 +0900 ksmbd: remove the leftover of smb2.0 dialect support Although ksmbd doesn't send SMB2.0 support in supported dialect list of smb negotiate response, There is the leftover of smb2.0 dialect. This patch remove it not to support SMB2.0 in ksmbd. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit c2e99d47973796c3fafd13079337dcadecd49d8a Author: Namjae Jeon Date: Sun Sep 26 21:55:02 2021 +0900 ksmbd: check strictly data area in ksmbd_smb2_check_message() When invalid data offset and data length in request, ksmbd_smb2_check_message check strictly and doesn't allow to process such requests. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Acked-by: Hyunchul Lee Reviewed-by: Ralph Boehme Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 85f74acf097a63a07f5a7c215db6883e5c35e3ff Author: Keith Busch Date: Wed Oct 6 23:50:31 2021 -0700 nvme-pci: Fix abort command id The request tag is no longer the only component of the command id. Fixes: e7006de6c2380 ("nvme: code command_id with a genctr for use-after-free validation") Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 424953cf3c6657f1e67e1a2c5d6e3bb518ea4e9a Author: Arnd Bergmann Date: Tue Sep 28 09:50:27 2021 +0200 qcom_scm: hide Kconfig symbol Now that SCM can be a loadable module, we have to add another dependency to avoid link failures when ipa or adreno-gpu are built-in: aarch64-linux-ld: drivers/net/ipa/ipa_main.o: in function `ipa_probe': ipa_main.c:(.text+0xfc4): undefined reference to `qcom_scm_is_available' ld.lld: error: undefined symbol: qcom_scm_is_available >>> referenced by adreno_gpu.c >>> gpu/drm/msm/adreno/adreno_gpu.o:(adreno_zap_shader_load) in archive drivers/built-in.a This can happen when CONFIG_ARCH_QCOM is disabled and we don't select QCOM_MDT_LOADER, but some other module selects QCOM_SCM. Ideally we'd use a similar dependency here to what we have for QCOM_RPROC_COMMON, but that causes dependency loops from other things selecting QCOM_SCM. This appears to be an endless problem, so try something different this time: - CONFIG_QCOM_SCM becomes a hidden symbol that nothing 'depends on' but that is simply selected by all of its users - All the stubs in include/linux/qcom_scm.h can go away - arm-smccc.h needs to provide a stub for __arm_smccc_smc() to allow compile-testing QCOM_SCM on all architectures. - To avoid a circular dependency chain involving RESET_CONTROLLER and PINCTRL_SUNXI, drop the 'select RESET_CONTROLLER' statement. According to my testing this still builds fine, and the QCOM platform selects this symbol already. Acked-by: Kalle Valo Acked-by: Alex Elder Signed-off-by: Arnd Bergmann commit 951cd3a0866d29cb9c01ebc1d9c17590e598226e Author: Arnd Bergmann Date: Tue Sep 28 09:50:26 2021 +0200 firmware: include drivers/firmware/Kconfig unconditionally Compile-testing drivers that require access to a firmware layer fails when that firmware symbol is unavailable. This happened twice this week: - My proposed to change to rework the QCOM_SCM firmware symbol broke on ppc64 and others. - The cs_dsp firmware patch added device specific firmware loader into drivers/firmware, which broke on the same set of architectures. We should probably do the same thing for other subsystems as well, but fix this one first as this is a dependency for other patches getting merged. Reviewed-by: Bjorn Andersson Reviewed-by: Charles Keepax Acked-by: Will Deacon Acked-by: Bjorn Andersson Cc: Mark Brown Cc: Liam Girdwood Cc: Charles Keepax Cc: Simon Trimmer Cc: Michael Ellerman Reviewed-by: Mark Brown Signed-off-by: Arnd Bergmann commit 214174d9f56c7f81f4860a26b6b8b961a6b92654 Author: Srinivasa Rao Mandadapu Date: Thu Oct 7 19:21:15 2021 +0530 ASoC: codec: wcd938x: Add irq config support This patch fixes compilation error in wcd98x codec driver. Fixes: 045442228868 ("ASoC: codecs: wcd938x: add audio routing and Kconfig") Signed-off-by: Venkata Prasad Potturu Signed-off-by: Srinivasa Rao Mandadapu Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/1633614675-27122-1-git-send-email-srivasam@codeaurora.org Signed-off-by: Mark Brown commit 5af82c81b2c49cfb1cad84d9eb6eab0e3d1c4842 Author: Takashi Iwai Date: Wed Oct 6 16:17:12 2021 +0200 ASoC: DAPM: Fix missing kctl change notifications The put callback of a kcontrol is supposed to return 1 when the value is changed, and this will be notified to user-space. However, some DAPM kcontrols always return 0 (except for errors), hence the user-space misses the update of a control value. This patch corrects the behavior by properly returning 1 when the value gets updated. Reported-and-tested-by: Hans de Goede Cc: Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20211006141712.2439-1-tiwai@suse.de Signed-off-by: Mark Brown commit c25d4546ca452b2e8c03bc735e4c65bc6dd751dd Author: Andy Shevchenko Date: Wed Oct 6 18:04:28 2021 +0300 ASoC: Intel: bytcht_es8316: Utilize dev_err_probe() to avoid log saturation dev_err_probe() avoids printing into log when the deferred probe is invoked. This is possible when clock provider is pending to appear. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20211006150428.16434-4-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 10f4a96543b744c8cc7ef8b0799af21d911dd37d Author: Andy Shevchenko Date: Wed Oct 6 18:04:27 2021 +0300 ASoC: Intel: bytcht_es8316: Switch to use gpiod_get_optional() First of all, replace indexed API by plain one since we have index 0. Second, switch to optional variant and drop duplicated code. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20211006150428.16434-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 6f32c521061b704c0198be3ba9834f5a64ea5605 Author: Andy Shevchenko Date: Wed Oct 6 18:04:26 2021 +0300 ASoC: Intel: bytcht_es8316: Use temporary variable for struct device Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20211006150428.16434-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 2577b868a48ef3601116908738efbe570451e605 Author: Andy Shevchenko Date: Wed Oct 6 18:04:25 2021 +0300 ASoC: Intel: bytcht_es8316: Get platform data via dev_get_platdata() Access to platform data via dev_get_platdata() getter to make code cleaner. Signed-off-by: Andy Shevchenko Acked-by: Pierre-Louis Bossart Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20211006150428.16434-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit db0767b8a6e620b99459d2e688c1983c2e5add0d Author: Srinivasa Rao Mandadapu Date: Thu Oct 7 19:20:19 2021 +0530 ASoC: wcd938x: Fix jack detection issue This patch is to fix audio 3.5mm jack detection failure on wcd938x codec based target. Fixes: bcee7ed09b8e (ASoC: codecs: wcd938x: add Multi Button Headset Control support) Signed-off-by: Venkata Prasad Potturu Signed-off-by: Srinivasa Rao Mandadapu Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/1633614619-27026-1-git-send-email-srivasam@codeaurora.org Signed-off-by: Mark Brown commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a Author: Mike Manning Date: Tue Oct 5 14:03:42 2021 +0100 net: prefer socket bound to interface when not in VRF The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") modified compute_score() so that a device match is always made, not just in the case of an l3mdev skb, then increments the score also for unbound sockets. This ensures that sockets bound to an l3mdev are never selected when not in a VRF. But as unbound and bound sockets are now scored equally, this results in the last opened socket being selected if there are matches in the default VRF for an unbound socket and a socket bound to a dev that is not an l3mdev. However, handling prior to this commit was to always select the bound socket in this case. Reinstate this handling by incrementing the score only for bound sockets. The required isolation due to choosing between an unbound socket and a socket bound to an l3mdev remains in place due to the device match always being made. The same approach is taken for compute_score() for stream sockets. Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") Fixes: e78190581aff ("net: ensure unbound stream socket to be chosen when not in a VRF") Signed-off-by: Mike Manning Reviewed-by: David Ahern Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com Signed-off-by: Jakub Kicinski commit 7671b026bb389a5a01722dd3ecf80b44703e9e84 Merge: 578f3932273ff d0c6416bd7091 Author: Jakub Kicinski Date: Thu Oct 7 07:11:32 2021 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2021-10-07 We've added 7 non-merge commits during the last 8 day(s) which contain a total of 8 files changed, 38 insertions(+), 21 deletions(-). The main changes are: 1) Fix ARM BPF JIT to preserve caller-saved regs for DIV/MOD JIT-internal helper call, from Johan Almbladh. 2) Fix integer overflow in BPF stack map element size calculation when used with preallocation, from Tatsuhiko Yasumatsu. 3) Fix an AF_UNIX regression due to added BPF sockmap support related to shutdown handling, from Jiang Wang. 4) Fix a segfault in libbpf when generating light skeletons from objects without BTF, from Kumar Kartikeya Dwivedi. 5) Fix a libbpf memory leak in strset to free the actual struct strset itself, from Andrii Nakryiko. 6) Dual-license bpf_insn.h similarly as we did for libbpf and bpftool, with ACKs from all contributors, from Luca Boccassi. ==================== Link: https://lore.kernel.org/r/20211007135010.21143-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 424b650f35c77defbb3cbd6e5221d3697af42250 Author: Jackie Liu Date: Wed Sep 22 10:51:22 2021 +0800 tracing: Fix missing osnoise tracer on max_latency The compiler warns when the data are actually unused: kernel/trace/trace.c:1712:13: error: ‘trace_create_maxlat_file’ defined but not used [-Werror=unused-function] 1712 | static void trace_create_maxlat_file(struct trace_array *tr, | ^~~~~~~~~~~~~~~~~~~~~~~~ [Why] CONFIG_HWLAT_TRACER=n, CONFIG_TRACER_MAX_TRACE=n, CONFIG_OSNOISE_TRACER=y gcc report warns. [How] Now trace_create_maxlat_file will only take effect when CONFIG_HWLAT_TRACER=y or CONFIG_TRACER_MAX_TRACE=y. In fact, after adding osnoise trace, it also needs to take effect. Link: https://lore.kernel.org/all/c1d9e328-ad7c-920b-6c24-9e1598a6421c@infradead.org/ Link: https://lkml.kernel.org/r/20210922025122.3268022-1-liu.yun@linux.dev Fixes: bce29ac9ce0b ("trace: Add osnoise tracer") Cc: Daniel Bristot de Oliveira Suggested-by: Steven Rostedt Reviewed-by: Daniel Bristot de Oliveira Tested-by: Randy Dunlap # build-tested Signed-off-by: Jackie Liu Signed-off-by: Steven Rostedt (VMware) commit 11c52d250b34a0862edc29db03fbec23b30db6da Author: Aleksander Morgado Date: Thu Oct 7 14:25:01 2021 +0200 USB: serial: qcserial: add EM9191 QDL support When the module boots into QDL download mode it exposes the 1199:90d2 ids, which can be mapped to the qcserial driver, and used to run firmware upgrades (e.g. with the qmi-firmware-update program). T: Bus=01 Lev=03 Prnt=08 Port=03 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1199 ProdID=90d2 Rev=00.00 S: Manufacturer=Sierra Wireless, Incorporated S: Product=Sierra Wireless EM9191 S: SerialNumber=8W0382004102A109 C: #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=2mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=qcserial Signed-off-by: Aleksander Morgado Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit eb8257a12192f43ffd41bd90932c39dade958042 Author: Mahesh Salgaonkar Date: Mon Sep 20 22:03:26 2021 +0530 pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init On pseries LPAR when an empty slot is assigned to partition OR in single LPAR mode, kdump kernel crashes during issuing PHB reset. In the kdump scenario, we traverse all PHBs and issue reset using the pe_config_addr of the first child device present under each PHB. However the code assumes that none of the PHB slots can be empty and uses list_first_entry() to get the first child device under the PHB. Since list_first_entry() expects the list to be non-empty, it returns an invalid pci_dn entry and ends up accessing NULL phb pointer under pci_dn->phb causing kdump kernel crash. This patch fixes the below kdump kernel crash by skipping empty slots: audit: initializing netlink subsys (disabled) thermal_sys: Registered thermal governor 'fair_share' thermal_sys: Registered thermal governor 'step_wise' cpuidle: using governor menu pstore: Registered nvram as persistent store backend Issue PHB reset ... audit: type=2000 audit(1631267818.000:1): state=initialized audit_enabled=0 res=1 BUG: Kernel NULL pointer dereference on read at 0x00000268 Faulting instruction address: 0xc000000008101fb0 Oops: Kernel access of bad area, sig: 7 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 7 PID: 1 Comm: swapper/7 Not tainted 5.14.0 #1 NIP: c000000008101fb0 LR: c000000009284ccc CTR: c000000008029d70 REGS: c00000001161b840 TRAP: 0300 Not tainted (5.14.0) MSR: 8000000002009033 CR: 28000224 XER: 20040002 CFAR: c000000008101f0c DAR: 0000000000000268 DSISR: 00080000 IRQMASK: 0 ... NIP pseries_eeh_get_pe_config_addr+0x100/0x1b0 LR __machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350 Call Trace: 0xc00000001161bb80 (unreliable) __machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350 do_one_initcall+0x60/0x2d0 kernel_init_freeable+0x350/0x3f8 kernel_init+0x3c/0x17c ret_from_kernel_thread+0x5c/0x64 Fixes: 5a090f7c363fd ("powerpc/pseries: PCIE PHB reset") Signed-off-by: Mahesh Salgaonkar [mpe: Tweak wording and trim oops] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/163215558252.413351.8600189949820258982.stgit@jupiter commit d93f9e23744b7bf11a98b2ddb091d129482ae179 Author: Christophe Leroy Date: Wed Sep 15 16:12:24 2021 +0200 powerpc/32s: Fix kuap_kernel_restore() At interrupt exit, kuap_kernel_restore() calls kuap_unlock() with the value contained in regs->kuap. However, when regs->kuap contains 0xffffffff it means that KUAP was not unlocked so calling kuap_unlock() is unrelevant and results in jeopardising the contents of kernel space segment registers. So check that regs->kuap doesn't contain KUAP_NONE before calling kuap_unlock(). In the meantime it also means that if KUAP has not been correcly locked back at interrupt exit, it must be locked before continuing. This is done by checking the content of current->thread.kuap which was returned by kuap_get_and_assert_locked() Fixes: 16132529cee5 ("powerpc/32s: Rework Kernel Userspace Access Protection") Reported-by: Stan Johnson Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0d0c4d0f050a637052287c09ba521bad960a2790.1631715131.git.christophe.leroy@csgroup.eu commit 5a4b0320783a19f877dd595813569b3c25f4ff81 Author: Cédric Le Goater Date: Thu Sep 30 12:25:35 2021 +0200 powerpc/pseries/msi: Add an empty irq_write_msi_msg() handler The IPR drivers tests for MSI support at probe time with MSI vector 0 and when done, frees the IRQ with free_irq(). This test was introduced by 95fecd90397e ("ipr: add test for MSI interrupt support") as an improvement of commit 5a9ef25b14d3 ("[SCSI] ipr: add MSI support") because a boot failure was reported on a Bimini PowerPC system: https://lore.kernel.org/r/1242926159.3007.5.camel@localhost.localdomain It was finally decided to remove MSI support on Bimini systems in 6eb0ac03899a ("powerpc/maple: Add a quirk to disable MSI for IPR on Bimini"). Linux 5.15-rc1 added MSI domain support to the pseries machine and when free_irq is called() in the driver, msi_domain_deactivate() also is. This resets the MSI table entry of the associate vector by calling __pci_write_msi_msg() with an empty message and breaks any further activation of the same vector. In the case of the IPR driver, it breaks the initialization sequence of the IOA. Introduce an empty irq_write_msi_msg() handler in the MSI domain of the pseries machine to avoid clearing the MSI vector entry. Updating the entry is not strictly necessary since it is initialized by the underlying hypervisor, PowerVM or QEMU/KVM. Fixes: a5f3d2c17b07 ("powerpc/pseries/pci: Add MSI domains") Signed-off-by: Cédric Le Goater Reported-by: Abdul Haleem Tested-by: Mahesh Salgaonkar [mpe: Tweak comment wording and formatting slightly] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210930102535.1047230-1-clg@kaod.org commit 578f3932273ff577f532c54a45248b791089cbf0 Merge: 65f280bb65e60 93ec1320b0170 Author: David S. Miller Date: Thu Oct 7 12:44:41 2021 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2021-10-07 1) Fix a sysbot reported shift-out-of-bounds in xfrm_get_default. From Pavel Skripkin. 2) Fix XFRM_MSG_MAPPING ABI breakage. The new XFRM_MSG_MAPPING messages were accidentally not paced at the end. Fix by Eugene Syromiatnikov. 3) Fix the uapi for the default policy, use explicit field and macros and make it accessible to userland. From Nicolas Dichtel. 4) Fix a missing rcu lock in xfrm_notify_userpolicy(). From Nicolas Dichtel. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 65f280bb65e60fd75ca6cca51c4311a4fc7af222 Merge: a50a0595230d3 54ee39439acd9 Author: David S. Miller Date: Thu Oct 7 12:38:15 2021 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net- queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-10-06 This series contains updates to i40e and iavf drivers. Jiri Benc expands an error check to prevent infinite loop for i40e. Sylwester prevents freeing of uninitialized IRQ vector to resolve a kernel oops for i40e. Stefan Assmann fixes a double mutex unlock for iavf. ==================== Signed-off-by: David S. Miller commit f08fb25bc66986b0952724530a640d9970fa52c1 Author: Nicholas Piggin Date: Tue Oct 5 00:56:42 2021 +1000 powerpc/64s: Fix unrecoverable MCE calling async handler from NMI The machine check handler is not considered NMI on 64s. The early handler is the true NMI handler, and then it schedules the machine_check_exception handler to run when interrupts are enabled. This works fine except the case of an unrecoverable MCE, where the true NMI is taken when MSR[RI] is clear, it can not recover, so it calls machine_check_exception directly so something might be done about it. Calling an async handler from NMI context can result in irq state and other things getting corrupted. This can also trigger the BUG at arch/powerpc/include/asm/interrupt.h:168 BUG_ON(!arch_irq_disabled_regs(regs) && !(regs->msr & MSR_EE)); Fix this by making an _async version of the handler which is called in the normal case, and a NMI version that is called for unrecoverable interrupts. Fixes: 2b43dd7653cc ("powerpc/64: enable MSR[EE] in irq replay pt_regs") Signed-off-by: Nicholas Piggin Tested-by: Cédric Le Goater Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211004145642.1331214-6-npiggin@gmail.com commit 768c47010392ece9766a56479b4e0cf04a536916 Author: Nicholas Piggin Date: Tue Oct 5 00:56:41 2021 +1000 powerpc/64/interrupt: Reconcile soft-mask state in NMI and fix false BUG If a NMI hits early in an interrupt handler before the irq soft-mask state is reconciled, that can cause a false-positive BUG with a CONFIG_PPC_IRQ_SOFT_MASK_DEBUG assertion. Remove that assertion and instead check the case that if regs->msr has EE clear, then regs->softe should be marked as disabled so the irq state looks correct to NMI handlers, the same as how it's fixed up in the case it was implicit soft-masked. This doesn't fix a known problem -- the change that was fixed by commit 4ec5feec1ad02 ("powerpc/64s: Make NMI record implicitly soft-masked code as irqs disabled") was the addition of a warning in the soft-nmi watchdog interrupt which can never actually fire when MSR[EE]=0. However it may be important if NMI handlers grow more code, and it's less surprising to anything using 'regs' - (I tripped over this when working in the area). Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211004145642.1331214-5-npiggin@gmail.com commit ff058a8ada5df0d84e5537cfaf89d06d71501580 Author: Nicholas Piggin Date: Tue Oct 5 00:56:40 2021 +1000 powerpc/64: warn if local irqs are enabled in NMI or hardirq context This can help catch bugs such as the one fixed by the previous change to prevent _exception() from enabling irqs. ppc32 could have a similar warning but it has no good config option to debug this stuff (the test may be overkill to add for production kernels). Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211004145642.1331214-4-npiggin@gmail.com commit d0afd44c05f8f4e4c91487c02d43c87a31552462 Author: Nicholas Piggin Date: Tue Oct 5 00:56:39 2021 +1000 powerpc/traps: do not enable irqs in _exception _exception can be called by machine check handlers when the MCE hits user code (e.g., pseries and powernv). This will enable local irqs because, which is a dicey thing to do in NMI or hard irq context. This seemed to worked out okay because a userspace MCE can basically be treated like a synchronous interrupt (after async / imprecise MCEs are filtered out). Since NMI and hard irq handlers have started growing nmi_enter / irq_enter, and more irq state sanity checks, this has started to cause problems (or at least trigger warnings). The Fixes tag to the commit which introduced this rather than try to work out exactly which commit was the first that could possibly cause a problem because that may be difficult to prove. Fixes: 9f2f79e3a3c1 ("powerpc: Disable interrupts in 64-bit kernel FP and vector faults") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211004145642.1331214-3-npiggin@gmail.com commit 3e607dc4df180b72a38e75030cb0f94d12808712 Author: Nicholas Piggin Date: Tue Oct 5 00:56:38 2021 +1000 powerpc/64s: fix program check interrupt emergency stack path Emergency stack path was jumping into a 3: label inside the __GEN_COMMON_BODY macro for the normal path after it had finished, rather than jumping over it. By a small miracle this is the correct place to build up a new interrupt frame with the existing stack pointer, so things basically worked okay with an added weird looking 700 trap frame on top (which had the wrong ->nip so it didn't decode bug messages either). Fix this by avoiding using numeric labels when jumping over non-trivial macros. Before: LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637 NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3a50 TRAP: 0700 Not tainted MSR: 9000000000021031 CR: 00000700 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [7265677368657265] 0x7265677368657265 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 Call Trace: [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable) --- interrupt: 700 at decrementer_common_virt+0xb8/0x230 NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 CR: 22424282 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 --- interrupt: 700 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 6d28218e0cc3c949 ]--- After: ------------[ cut here ]------------ kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638 NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 CR: 24482227 XER: 00040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90 GPR20: 00000000100eed90 0000000010000000 000000001000a49c 00000000100f1430 GPR24: c000000001271868 0000000002000000 0000000000000215 0000000000000300 GPR28: c000000001271800 0000000042000000 00000000100f0d29 c000000080647860 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006bf04] ___do_page_fault+0x234/0xb10 Call Trace: Instruction dump: 4182000c 39400001 48000008 894d0932 714a0001 39400008 408225fc 718a4000 7c2a0b78 3821fcf0 41c20008 e82d0910 <0981fcf0> f92101a0 f9610170 f9810178 ---[ end trace a5dbd1f5ea4ccc51 ]--- Fixes: 0a882e28468f4 ("powerpc/64s/exception: remove bad stack branch") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211004145642.1331214-2-npiggin@gmail.com commit 548b762763b885b81850db676258df47c55dd5f9 Author: Naveen N. Rao Date: Wed Oct 6 01:55:29 2021 +0530 powerpc/bpf ppc32: Fix BPF_SUB when imm == 0x80000000 Special case handling of the smallest 32-bit negative number for BPF_SUB. Fixes: 51c66ad849a703 ("powerpc/bpf: Implement extended BPF on PPC32") Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/7135360a0cdf70adedbccf9863128b8daef18764.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 48164fccdff6d5cc11308126c050bd25a329df25 Author: Naveen N. Rao Date: Wed Oct 6 01:55:28 2021 +0530 powerpc/bpf ppc32: Do not emit zero extend instruction for 64-bit BPF_END Suppress emitting zero extend instruction for 64-bit BPF_END_FROM_[L|B]E operation. Fixes: 51c66ad849a703 ("powerpc/bpf: Implement extended BPF on PPC32") Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b4e3c3546121315a8e2059b19a1bda84971816e4.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit e8278d44443207bb6609c7b064073f353e6f4978 Author: Naveen N. Rao Date: Wed Oct 6 01:55:27 2021 +0530 powerpc/bpf ppc32: Fix JMP32_JSET_K 'andi' only takes an unsigned 16-bit value. Correct the imm range used when emitting andi. Fixes: 51c66ad849a703 ("powerpc/bpf: Implement extended BPF on PPC32") Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b94489f52831305ec15aca4dd04a3527236be7e8.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit c9b8da77f22d28348d1f89a6c4d3fec102e9b1c4 Author: Naveen N. Rao Date: Wed Oct 6 01:55:26 2021 +0530 powerpc/bpf ppc32: Fix ALU32 BPF_ARSH operation Correct the destination register used for ALU32 BPF_ARSH operation. Fixes: 51c66ad849a703 ("powerpc/bpf: Implement extended BPF on PPC32") Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/6d24c1f9e79b6f61f5135eaf2ea1e8bcd4dac87b.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit b7540d62509453263604a155bf2d5f0ed450cba2 Author: Naveen N. Rao Date: Wed Oct 6 01:55:25 2021 +0530 powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC Emit similar instruction sequences to commit a048a07d7f4535 ("powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit") when encountering BPF_NOSPEC. Mitigations are enabled depending on what the firmware advertises. In particular, we do not gate these mitigations based on current settings, just like in x86. Due to this, we don't need to take any action if mitigations are enabled or disabled at runtime. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/956570cbc191cd41f8274bed48ee757a86dac62a.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 030905920f32e91a52794937f67434ac0b3ea41a Author: Naveen N. Rao Date: Wed Oct 6 01:55:24 2021 +0530 powerpc/security: Add a helper to query stf_barrier type Add a helper to return the stf_barrier type for the current processor. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/3bd5d7f96ea1547991ac2ce3137dc2b220bae285.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 5855c4c1f415ca3ba1046e77c0b3d3dfc96c9025 Author: Naveen N. Rao Date: Wed Oct 6 01:55:23 2021 +0530 powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 We aren't handling subtraction involving an immediate value of 0x80000000 properly. Fix the same. Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF") Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy [mpe: Fold in fix from Naveen to use imm <= 32768] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/fc4b1276eb10761fd7ce0814c8dd089da2815251.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 2263eb7370060bdb0013bc14e1a7c9bf33617a55 Author: Yu-Tung Chang Date: Thu Sep 30 10:11:12 2021 +0800 USB: serial: option: add Quectel EC200S-CN module support Add usb product id of the Quectel EC200S-CN module. usb-devices output for 0x6002: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6002 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber=0000 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) Signed-off-by: Yu-Tung Chang Link: https://lore.kernel.org/r/20210930021112.330396-1-mtwget@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit c184accc4a42c7872dc8e8d0fc97a740dc61fe24 Author: Tomaz Solc Date: Wed Oct 6 14:57:50 2021 +0200 USB: serial: option: add prod. id for Quectel EG91 Adding support for Quectel EG91 LTE module. The interface layout is same as for EG95. usb-devices output: T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0191 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan Interfaces: 0: Diag 1: GNSS 2: AT-command interface/modem 3: Modem 4: QMI Signed-off-by: Tomaz Solc Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 8bbc9d822421d9ac8ff9ed26a3713c9afc69d6c8 Author: Naveen N. Rao Date: Wed Oct 6 01:55:22 2021 +0530 powerpc/bpf: Fix BPF_MOD when imm == 1 Only ignore the operation if dividing by 1. Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF") Signed-off-by: Naveen N. Rao Tested-by: Johan Almbladh Reviewed-by: Christophe Leroy Acked-by: Song Liu Acked-by: Johan Almbladh Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c674ca18c3046885602caebb326213731c675d06.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 3832ba4e283d7052b783dab8311df7e3590fed93 Author: Naveen N. Rao Date: Wed Oct 6 01:55:21 2021 +0530 powerpc/bpf: Validate branch ranges Add checks to ensure that we never emit branch instructions with truncated branch offsets. Suggested-by: Michael Ellerman Signed-off-by: Naveen N. Rao Tested-by: Johan Almbladh Reviewed-by: Christophe Leroy Acked-by: Song Liu Acked-by: Johan Almbladh Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit 4549c3ea3160fa8b3f37dfe2f957657bb265eda9 Author: Naveen N. Rao Date: Wed Oct 6 01:55:20 2021 +0530 powerpc/lib: Add helper to check if offset is within conditional branch range Add a helper to check if a given offset is within the branch range for a powerpc conditional branch instruction, and update some sites to use the new helper. Signed-off-by: Naveen N. Rao Reviewed-by: Christophe Leroy Acked-by: Song Liu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/442b69a34ced32ca346a0d9a855f3f6cfdbbbd41.1633464148.git.naveen.n.rao@linux.vnet.ibm.com commit f5a8a07edafed8bede17a95ef8940fe3a57a77d5 Author: Daniele Palmas Date: Mon Oct 4 12:56:55 2021 +0200 USB: serial: option: add Telit LE910Cx composition 0x1204 Add the following Telit LE910Cx composition: 0x1204: tty, adb, mbim, tty, tty, tty, tty Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20211004105655.8515-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit c0f1886de7e173865f1a0fa7680a1c07954a987f Author: Takashi Iwai Date: Wed Oct 6 16:19:40 2021 +0200 ALSA: hda: intel: Allow repeatedly probing on codec configuration errors It seems that a few recent AMD systems show the codec configuration errors at the early boot, while loading the driver at a later stage works magically. Although the root cause of the error isn't clear, it's certainly not bad to allow retrying the codec probe in such a case if that helps. This patch adds the capability for retrying the probe upon codec probe errors on the certain AMD platforms. The probe_work is changed to a delayed work, and at the secondary call, it'll jump to the codec probing. Note that, not only adding the re-probing, this includes the behavior changes in the codec configuration function. Namely, snd_hda_codec_configure() won't unregister the codec at errors any longer. Instead, its caller, azx_codec_configure() unregisters the codecs with the probe failures *if* any codec has been successfully configured. If all codec probe failed, it doesn't unregister but let it re-probed -- which is the most case we're seeing and this patch tries to improve. Even if the driver doesn't re-probe or give up, it will go to the "free-all" error path, hence the leftover codecs shall be disabled / deleted in anyway. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1190801 Link: https://lore.kernel.org/r/20211006141940.2897-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 86e1e054e0d2105cf32b0266cf1a64e6c26424f7 Author: Michael Forney Date: Sat May 8 17:01:03 2021 -0700 objtool: Update section header before relocations The libelf implementation from elftoolchain has a safety check in gelf_update_rel[a] to check that the data corresponds to a section that has type SHT_REL[A] [0]. If the relocation is updated before the section header is updated with the proper type, this check fails. To fix this, update the section header first, before the relocations. Previously, the section size was calculated in elf_rebuild_reloc_section by counting the number of entries in the reloc_list. However, we now need the size during elf_write so instead keep a running total and add to it for every new relocation. [0] https://sourceforge.net/p/elftoolchain/mailman/elftoolchain-developers/thread/CAGw6cBtkZro-8wZMD2ULkwJ39J+tHtTtAWXufMjnd3cQ7XG54g@mail.gmail.com/ Signed-off-by: Michael Forney Reviewed-by: Miroslav Benes Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20210509000103.11008-2-mforney@mforney.org commit b46179d6bb3182c020f2bf9bb4df6ba5463b0495 Author: Michael Forney Date: Sat May 8 17:01:02 2021 -0700 objtool: Check for gelf_update_rel[a] failures Otherwise, if these fail we end up with garbage data in the .rela.orc_unwind_ip section, leading to errors like ld: fs/squashfs/namei.o: bad reloc symbol index (0x7f16 >= 0x12) for offset 0x7f16d5c82cc8 in section `.orc_unwind_ip' Signed-off-by: Michael Forney Reviewed-by: Miroslav Benes Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20210509000103.11008-1-mforney@mforney.org commit 5af4055fa8133662831ae2fb6e188e8f6c172688 Merge: 60a9483534ed0 b2d70c0dbf273 Author: Linus Torvalds Date: Wed Oct 6 18:26:36 2021 -0700 Merge tag 'devicetree-fixes-for-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Add another allowed address for TI sn65dsi86 - Drop more redundant minItems/maxItems - Fix more graph 'unevaluatedProperties' warnings in media bindings * tag 'devicetree-fixes-for-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value dt-bindings: Drop more redundant 'maxItems/minItems' dt-bindings: media: Fix more graph 'unevaluatedProperties' related warnings commit 361b57df62de249dc0b2acbf48823662a5001bcd Author: Daniel Latypov Date: Tue Oct 5 13:46:32 2021 -0700 kunit: fix kernel-doc warnings due to mismatched arg names Commit 7122debb4367 ("kunit: introduce kunit_kmalloc_array/kunit_kcalloc() helpers") added new functions but called last arg `flags`, unlike the existing code that used `gfp`. This only is an issue in test.h, test.c still used `gfp`. But the documentation was copy-pasted with the old names, leading to kernel-doc warnings. Do s/flags/gfp to make the names consistent and fix the warnings. Fixes: 7122debb4367 ("kunit: introduce kunit_kmalloc_array/kunit_kcalloc() helpers") Reported-by: Randy Dunlap Signed-off-by: Daniel Latypov Reviewed-by: Randy Dunlap Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit a8cf90332ae3e2b53813a146a99261b6a5e16a73 Author: Arnd Bergmann Date: Wed Sep 29 14:27:13 2021 -0700 bitfield: build kunit tests without structleak plugin The structleak plugin causes the stack frame size to grow immensely: lib/bitfield_kunit.c: In function 'test_bitfields_constants': lib/bitfield_kunit.c:93:1: error: the frame size of 7440 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Turn it off in this file. Signed-off-by: Arnd Bergmann Signed-off-by: Brendan Higgins Reviewed-by: Kees Cook Signed-off-by: Shuah Khan commit 33d4951e021bb67ebd6bdb01f3d437c0f45b3c0c Author: Brendan Higgins Date: Wed Sep 29 14:27:12 2021 -0700 thunderbolt: build kunit tests without structleak plugin The structleak plugin causes the stack frame size to grow immensely when used with KUnit: drivers/thunderbolt/test.c:1529:1: error: the frame size of 1176 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Turn it off in this file. Linus already split up tests in this file, so this change *should* be redundant now. Signed-off-by: Brendan Higgins Suggested-by: Arnd Bergmann Acked-by: Mika Westerberg Reviewed-by: Kees Cook Signed-off-by: Shuah Khan commit 6a1e2d93d55b000962b82b9a080006446150b022 Author: Brendan Higgins Date: Wed Sep 29 14:27:11 2021 -0700 device property: build kunit tests without structleak plugin The structleak plugin causes the stack frame size to grow immensely when used with KUnit: ../drivers/base/test/property-entry-test.c:492:1: warning: the frame size of 2832 bytes is larger than 2048 bytes [-Wframe-larger-than=] ../drivers/base/test/property-entry-test.c:322:1: warning: the frame size of 2080 bytes is larger than 2048 bytes [-Wframe-larger-than=] ../drivers/base/test/property-entry-test.c:250:1: warning: the frame size of 4976 bytes is larger than 2048 bytes [-Wframe-larger-than=] ../drivers/base/test/property-entry-test.c:115:1: warning: the frame size of 3280 bytes is larger than 2048 bytes [-Wframe-larger-than=] Turn it off in this file. Signed-off-by: Brendan Higgins Suggested-by: Arnd Bergmann Reviewed-by: Kees Cook Signed-off-by: Shuah Khan commit 2326f3cdba1d105b68cc1295e78f17ae8faa5a76 Author: Brendan Higgins Date: Wed Sep 29 14:27:10 2021 -0700 iio/test-format: build kunit tests without structleak plugin The structleak plugin causes the stack frame size to grow immensely when used with KUnit: ../drivers/iio/test/iio-test-format.c: In function ‘iio_test_iio_format_value_fixedpoint’: ../drivers/iio/test/iio-test-format.c:98:1: warning: the frame size of 2336 bytes is larger than 2048 bytes [-Wframe-larger-than=] Turn it off in this file. Signed-off-by: Brendan Higgins Suggested-by: Arnd Bergmann Reviewed-by: Kees Cook Acked-by: Jonathan Cameron Signed-off-by: Shuah Khan commit 554afc3b9797511e3245864e32aebeb6abbab1e3 Author: Brendan Higgins Date: Wed Sep 29 14:27:09 2021 -0700 gcc-plugins/structleak: add makefile var for disabling structleak KUnit and structleak don't play nice, so add a makefile variable for enabling structleak when it complains. Co-developed-by: Kees Cook Signed-off-by: Kees Cook Signed-off-by: Brendan Higgins Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 5a1fef027846e7635b9d320b2cc0b416fd11a3be Author: Hansen Date: Fri Oct 1 22:36:15 2021 +0800 drm/amd/display: Fix detection of 4 lane for DPALT [Why] DPALT detection for B0 PHY has its own set of RDPCSPIPE registers [How] Use RDPCSPIPE registers to detect if DPALT lane is 4 lane Reviewed-by: Charlene Liu Acked-by: Solomon Chiu Signed-off-by: Hansen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a7e397b7c45377e20542146be10231b8afa948d1 Author: Nikola Cornij Date: Fri Oct 1 22:36:14 2021 +0800 drm/amd/display: Limit display scaling to up to 4k for DCN 3.1 [why] The existing limit was mistakenly bigger than 4k for DCN 3.1 Reviewed-by: Zhan Liu Acked-by: Solomon Chiu Signed-off-by: Nikola Cornij Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2387033ac0db3235f3fa9d9976aeeeb50349550e Author: George Shen Date: Fri Oct 1 22:36:09 2021 +0800 drm/amd/display: Skip override for preferred link settings during link training [Why] Overriding link setting inside override_training_settings result in fallback link settings being ignored. This can potentially cause link training to always fail and consequently result in an infinite loop of link training to occur in dp_verify_link_cap during detection. [How] Since preferred link settings are already considered inside decide_link_settings, skip the check in override_training_settings to avoid infinite link training loops. Reviewed-by: Wenjing Liu Acked-by: Solomon Chiu Signed-off-by: George Shen Signed-off-by: Alex Deucher commit 1ab52ac1e9bc9391f592c9fa8340a6e3e9c36286 Author: Patrisious Haddad Date: Wed Oct 6 12:31:53 2021 +0300 RDMA/mlx5: Set user priority for DCT Currently, the driver doesn't set the PCP-based priority for DCT, hence DCT response packets are transmitted without user priority. Fix it by setting user provided priority in the eth_prio field in the DCT context, which in turn sets the value in the transmitted packet. Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") Link: https://lore.kernel.org/r/5fd2d94a13f5742d8803c218927322257d53205c.1633512672.git.leonro@nvidia.com Signed-off-by: Patrisious Haddad Reviewed-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e93c7d8e8c4cf80c6afe56e71c83c1cd31b4fce1 Author: Shiraz Saleem Date: Tue Oct 5 13:23:02 2021 -0500 RDMA/irdma: Process extended CQ entries correctly The valid bit for extended CQE's written by HW is retrieved from the incorrect quad-word. This leads to missed completions for any UD traffic particularly after a wrap-around. Get the valid bit for extended CQE's from the correct quad-word in the descriptor. Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") Link: https://lore.kernel.org/r/20211005182302.374-1-shiraz.saleem@intel.com Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit c20106944eb679fa3ab7e686fe5f6ba30fbc51e5 Author: Benjamin Coddington Date: Wed Oct 6 13:20:44 2021 -0400 NFSD: Keep existing listeners on portlist error If nfsd has existing listening sockets without any processes, then an error returned from svc_create_xprt() for an additional transport will remove those existing listeners. We're seeing this in practice when userspace attempts to create rpcrdma transports without having the rpcrdma modules present before creating nfsd kernel processes. Fix this by checking for existing sockets before calling nfsd_destroy(). Signed-off-by: Benjamin Coddington Signed-off-by: Chuck Lever commit 54ee39439acd9f8b161703c6ad4f4e1835585277 Author: Stefan Assmann Date: Tue Aug 24 12:06:39 2021 +0200 iavf: fix double unlock of crit_lock The crit_lock mutex could be unlocked twice as reported here https://lists.osuosl.org/pipermail/intel-wired-lan/Week-of-Mon-20210823/025525.html Remove the superfluous unlock. Technically the problem was already present before 5ac49f3c2702 as that commit only replaced the locking primitive, but no functional change. Reported-by: Dan Carpenter Fixes: 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections") Fixes: bac8486116b0 ("iavf: Refactor the watchdog state machine") Signed-off-by: Stefan Assmann Signed-off-by: Tony Nguyen commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e Author: Sylwester Dziedziuch Date: Fri Sep 24 11:40:41 2021 +0200 i40e: Fix freeing of uninitialized misc IRQ vector When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops: Trying to free already-free IRQ 266 WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 Workqueue: events work_for_cpu_fn RIP: 0010:__free_irq+0x9a/0x300 Call Trace: ? synchronize_irq+0x3a/0xa0 free_irq+0x2e/0x60 i40e_clear_interrupt_scheme+0x53/0x190 [i40e] i40e_probe.part.108+0x134b/0x1a40 [i40e] ? kmem_cache_alloc+0x158/0x1c0 ? acpi_ut_update_ref_count.part.1+0x8e/0x345 ? acpi_ut_update_object_reference+0x15e/0x1e2 ? strstr+0x21/0x70 ? irq_get_irq_data+0xa/0x20 ? mp_check_pin_attr+0x13/0xc0 ? irq_get_irq_data+0xa/0x20 ? mp_map_pin_to_irq+0xd3/0x2f0 ? acpi_register_gsi_ioapic+0x93/0x170 ? pci_conf1_read+0xa4/0x100 ? pci_bus_read_config_word+0x49/0x70 ? do_pci_enable_device+0xcc/0x100 local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40 The problem is that at that point misc IRQ vectors were not allocated yet and we get a call trace that driver is trying to free already free IRQ vectors. Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED PF state before calling i40e_free_misc_vector. This state is set only if misc IRQ vectors were properly initialized. Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup") Reported-by: PJ Waskiewicz Signed-off-by: Sylwester Dziedziuch Signed-off-by: Mateusz Palczewski Tested-by: Dave Switzer Signed-off-by: Tony Nguyen commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 Author: Jiri Benc Date: Tue Sep 14 10:54:42 2021 +0200 i40e: fix endless loop under rtnl The loop in i40e_get_capabilities can never end. The problem is that although i40e_aq_discover_capabilities returns with an error if there's a firmware problem, the returned error is not checked. There is a check for pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most firmware problems. When i40e_aq_discover_capabilities encounters a firmware problem, it will encounter the same problem on its next invocation. As the result, the loop becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking at the code, it can happen with a range of other firmware errors. I don't know what the correct behavior should be: whether the firmware should be retried a few times, or whether pf->hw.aq.asq_last_status should be always set to the encountered firmware error (but then it would be pointless and can be just replaced by the i40e_aq_discover_capabilities return value). However, the current behavior with an endless loop under the rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we explained the bug to them 7 months ago. This may not be the best possible fix but it's better than hanging the whole system on a firmware bug. Fixes: 56a62fc86895 ("i40e: init code and hardware support") Tested-by: Stefan Assmann Signed-off-by: Jiri Benc Reviewed-by: Jesse Brandeburg Tested-by: Dave Switzer Signed-off-by: Tony Nguyen commit 225bac2dc5d192e55f2c50123ee539b1edf8a411 Author: Lukas Bulwahn Date: Tue Aug 3 13:35:25 2021 +0200 x86/Kconfig: Correct reference to MWINCHIP3D Commit in Fixes intended to exclude the Winchip series and referred to CONFIG_WINCHIP3D, but the config symbol is called CONFIG_MWINCHIP3D. Hence, scripts/checkkconfigsymbols.py warns: WINCHIP3D Referencing files: arch/x86/Kconfig Correct the reference to the intended config symbol. Fixes: 69b8d3fcabdc ("x86/Kconfig: Exclude i586-class CPUs lacking PAE support from the HIGHMEM64G Kconfig group") Suggested-by: Randy Dunlap Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20210803113531.30720-4-lukas.bulwahn@gmail.com commit 4758fd801f919b8b9acad78d2e49a195ec2be46b Author: Lukas Bulwahn Date: Tue Aug 3 13:35:24 2021 +0200 x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI The refactoring in the commit in Fixes introduced an ifdef CONFIG_OLPC_XO1_5_SCI, however the config symbol is actually called "CONFIG_OLPC_XO15_SCI". Fortunately, ./scripts/checkkconfigsymbols.py warns: OLPC_XO1_5_SCI Referencing files: arch/x86/platform/olpc/olpc.c Correct this ifdef condition to the intended config symbol. Fixes: ec9964b48033 ("Platform: OLPC: Move EC-specific functionality out from x86") Suggested-by: Randy Dunlap Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20210803113531.30720-3-lukas.bulwahn@gmail.com commit 3958b9c34c2729597e182cc606cc43942fd19f7c Author: Vegard Nossum Date: Mon Oct 4 00:34:23 2021 +0200 x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n Commit 3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks") added a warning if AC is set when in the kernel. Commit 662a0221893a3d ("x86/entry: Fix AC assertion") changed the warning to only fire if the CPU supports SMAP. However, the warning can still trigger on a machine that supports SMAP but where it's disabled in the kernel config and when running the syscall_nt selftest, for example: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode CPU: 0 PID: 49 Comm: init Tainted: G T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:irqentry_enter_from_user_mode ... Call Trace: ? irqentry_enter ? exc_general_protection ? asm_exc_general_protection ? asm_exc_general_protectio IS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but even this would not be enough in case SMAP is disabled at boot time with the "nosmap" parameter. To be consistent with "nosmap" behaviour, clear X86_FEATURE_SMAP when !CONFIG_X86_SMAP. Found using entry-fuzz + satrandconfig. [ bp: Massage commit message. ] Fixes: 3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks") Fixes: 662a0221893a ("x86/entry: Fix AC assertion") Signed-off-by: Vegard Nossum Signed-off-by: Borislav Petkov Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20211003223423.8666-1-vegard.nossum@oracle.com commit 2c861f2b859385e9eaa6e464a8a7435b5a6bf564 Author: Lukas Bulwahn Date: Tue Aug 3 13:35:23 2021 +0200 x86/entry: Correct reference to intended CONFIG_64_BIT Commit in Fixes adds a condition with IS_ENABLED(CONFIG_64_BIT), but the intended config item is called CONFIG_64BIT, as defined in arch/x86/Kconfig. Fortunately, scripts/checkkconfigsymbols.py warns: 64_BIT Referencing files: arch/x86/include/asm/entry-common.h Correct the reference to the intended config symbol. Fixes: 662a0221893a ("x86/entry: Fix AC assertion") Suggested-by: Randy Dunlap Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20210803113531.30720-2-lukas.bulwahn@gmail.com commit d4ebfca26dfab2803c31d68a30225be31b2f9ecf Author: James Morse Date: Fri Sep 17 16:59:24 2021 +0000 x86/resctrl: Fix kfree() of the wrong type in domain_add_cpu() Commit in Fixes separated the architecture specific and filesystem parts of the resctrl domain structures. This left the error paths in domain_add_cpu() kfree()ing the memory with the wrong type. This will cause a problem if someone adds a new member to struct rdt_hw_domain meaning d_resctrl is no longer the first member. Fixes: 792e0f6f789b ("x86/resctrl: Split struct rdt_domain") Signed-off-by: James Morse Signed-off-by: Borislav Petkov Acked-by: Reinette Chatre Link: https://lkml.kernel.org/r/20210917165924.28254-1-james.morse@arm.com commit 64e87d4bd3201bf8a4685083ee4daf5c0d001452 Author: James Morse Date: Fri Sep 17 16:59:58 2021 +0000 x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails domain_add_cpu() is called whenever a CPU is brought online. The earlier call to domain_setup_ctrlval() allocates the control value arrays. If domain_setup_mon_state() fails, the control value arrays are not freed. Add the missing kfree() calls. Fixes: 1bd2a63b4f0de ("x86/intel_rdt/mba_sc: Add initialization support") Fixes: edf6fa1c4a951 ("x86/intel_rdt/cqm: Add RMID (Resource monitoring ID) management") Signed-off-by: James Morse Signed-off-by: Borislav Petkov Acked-by: Reinette Chatre Cc: Link: https://lkml.kernel.org/r/20210917165958.28313-1-james.morse@arm.com commit f5c20e4a5f18677e22d8dd2846066251b006a62d Author: Vitaly Kuznetsov Date: Wed Oct 6 14:50:16 2021 +0200 x86/hyperv: Avoid erroneously sending IPI to 'self' __send_ipi_mask_ex() uses an optimization: when the target CPU mask is equal to 'cpu_present_mask' it uses 'HV_GENERIC_SET_ALL' format to avoid converting the specified cpumask to VP_SET. This case was overlooked when 'exclude_self' parameter was added. As the result, a spurious IPI to 'self' can be send. Reported-by: Thomas Gleixner Fixes: dfb5c1e12c28 ("x86/hyperv: remove on-stack cpumask from hv_send_ipi_mask_allbutself") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20211006125016.941616-1-vkuznets@redhat.com Signed-off-by: Wei Liu commit 2250596374f5b0f774dd03103eb93893c5d05dbd Merge: 34186b48d29bb 3518441dda666 Author: Arnd Bergmann Date: Wed Oct 6 17:36:33 2021 +0200 Merge tag 'imx-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.15, round 2: - A couple of fixes from Haibo Chen to update SPI NOR TX bus width for i.MX6 and i.MX8 boards. This becomes necessary because spi-nor driver starts using the setting in DT. - Mark buck2 always-on for i.MX8MM Kontron-n801x-som board to avoid the core supply being turned off unexpectedly. - Fix eSDHC2 device tree settings for LS1028A SoC. - Disable GIC CPU interface before calling stby-poweroff sequence to fix power-off failure on i.MX6. - Fix M2_RST# GPIO pinmux on i.MX8M venice-gw7902 boards. * tag 'imx-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8m*-venice-gw7902: fix M2_RST# gpio ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence arm64: dts: ls1028a: fix eSDHC2 node arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2 arm64: dts: imx8: change the spi-nor tx ARM: dts: imx: change the spi-nor tx Link: https://lore.kernel.org/r/20211006125734.GA10197@dragon Signed-off-by: Arnd Bergmann commit 8a38a4d51c5055d0201542e5ea3c0cb287f6e223 Author: Neil Armstrong Date: Tue Sep 28 09:36:52 2021 +0200 mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk The memory at the end of the controller only accepts 32bit read/write accesses, but the arm64 memcpy_to/fromio implementation only uses 64bit (which will be split into two 32bit access) and 8bit leading to incomplete copies to/from this memory when the buffer is not multiple of 8bytes. Add a local copy using writel/readl accesses to make sure we use the right memory access width. The switch to memcpy_to/fromio was done because of 285133040e6c ("arm64: Import latest memcpy()/memmove() implementation"), but using memcpy worked before since it mainly used 32bit memory acceses. Fixes: 103a5348c22c ("mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk") Reported-by: Christian Hewitt Suggested-by: Martin Blumenstingl Signed-off-by: Neil Armstrong Tested-by: Martin Blumenstingl Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210928073652.434690-1-narmstrong@baylibre.com Signed-off-by: Ulf Hansson commit 30d4b990ec644e8bd49ef0a2f074fabc0d189e53 Author: Claudiu Beznea Date: Fri Sep 24 11:28:51 2021 +0300 mmc: sdhci-of-at91: replace while loop with read_poll_timeout Replace while loop with read_poll_timeout(). Signed-off-by: Claudiu Beznea Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210924082851.2132068-3-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit af467fad78f03a42de8b72190f6a595366b870db Author: Claudiu Beznea Date: Fri Sep 24 11:28:50 2021 +0300 mmc: sdhci-of-at91: wait for calibration done before proceed Datasheet specifies that at the end of calibration the SDMMC_CALCR_EN bit will be cleared. No commands should be send before calibration is done. Fixes: dbdea70f71d67 ("mmc: sdhci-of-at91: fix CALCR register being rewritten") Fixes: 727d836a375ad ("mmc: sdhci-of-at91: add DT property to enable calibration on full reset") Signed-off-by: Claudiu Beznea Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210924082851.2132068-2-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit a50a0595230d38be15183699f7bbc963bf3d127a Author: Marcel Ziswiler Date: Wed Oct 6 08:31:04 2021 +0200 dt-bindings: net: dsa: marvell: fix compatible in example While the MV88E6390 switch chip exists, one is supposed to use a compatible of "marvell,mv88e6190" for it. Fix this in the given example. Signed-off-by: Marcel Ziswiler Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 3707428ddabadde4086eb7c592e988f584344857 Author: Shannon Nelson Date: Tue Oct 5 16:11:05 2021 -0700 ionic: move filter sync_needed bit set Move the setting of the filter-sync-needed bit to the error case in the filter add routine to be sure we're checking the live filter status rather than a copy of the pre-sync status. Fixes: 969f84394604 ("ionic: sync the filters in the work task") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 17c37d748f2b122a95b6d0524d410302ff89a2b1 Author: Eric Dumazet Date: Tue Oct 5 18:01:38 2021 -0700 gve: report 64bit tx_bytes counter from gve_handle_report_stats() Each tx queue maintains a 64bit counter for bytes, there is no reason to truncate this to 32bit (or this has not been documented) Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.") Signed-off-by: Eric Dumazet Cc: Yangchun Fu Cc: Kuo Zhao Cc: David Awogbemila Signed-off-by: David S. Miller commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 Author: Eric Dumazet Date: Tue Oct 5 17:30:30 2021 -0700 gve: fix gve_get_stats() gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry() returns true. What is needed here is to sample values in temporary variables, and only use them after each loop is ended. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Eric Dumazet Cc: Catherine Sullivan Cc: Sagi Shahar Cc: Jon Olson Cc: Willem de Bruijn Cc: Luigi Rizzo Cc: Jeroen de Borst Cc: Tao Liu Signed-off-by: David S. Miller commit d34367991933d28bd7331f67a759be9a8c474014 Author: Eric Dumazet Date: Tue Oct 5 14:04:17 2021 -0700 rtnetlink: fix if_nlmsg_stats_size() under estimation rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure. nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags); But if_nlmsg_stats_size() never considered the needed storage. This bug did not show up because alloc_skb(X) allocates skb with extra tailroom, because of added alignments. This could very well be changed in the future to have deterministic behavior. Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats") Signed-off-by: Eric Dumazet Cc: Roopa Prabhu Acked-by: Roopa Prabhu Signed-off-by: David S. Miller commit d4b111fda69a01e0a7439d05993f5dad567c93aa Author: Catherine Sullivan Date: Tue Oct 5 19:42:21 2021 -0700 gve: Properly handle errors in gve_assign_qpl Ignored errors would result in crash. Fixes: ede3fcf5ec67f ("gve: Add support for raw addressing to the rx path") Signed-off-by: Catherine Sullivan Signed-off-by: Jeroen de Borst Signed-off-by: David S. Miller commit 922aa9bcac92b3ab6a423526a8e785b35a60b441 Author: Tao Liu Date: Tue Oct 5 19:42:20 2021 -0700 gve: Avoid freeing NULL pointer Prevent possible crashes when cleaning up after unsuccessful initializations. Fixes: 893ce44df5658 ("gve: Add basic driver framework for Compute Engine Virtual NIC") Signed-off-by: Tao Liu Signed-off-by: Catherine Sully Signed-off-by: David S. Miller commit d03477ee10f4bc35d3573cf1823814378ef2dca2 Author: Catherine Sullivan Date: Tue Oct 5 19:42:19 2021 -0700 gve: Correct available tx qpl check The qpl_map_size is rounded up to a multiple of sizeof(long), but the number of qpls doesn't have to be. Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support") Signed-off-by: Catherine Sullivan Signed-off-by: Jeroen de Borst Signed-off-by: David S. Miller commit dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce Author: Werner Sembach Date: Wed Oct 6 15:04:15 2021 +0200 ALSA: hda/realtek: Add quirk for TongFang PHxTxX1 This applies a SND_PCI_QUIRK(...) to the TongFang PHxTxX1 barebone. This fixes the issue of the internal Microphone not working after booting another OS. When booting a certain another OS this barebone keeps some coeff settings even after a cold shutdown. These coeffs prevent the microphone detection from working in Linux, making the Laptop think that there is always an external microphone plugged-in and therefore preventing the use of the internal one. The relevant indexes and values where gathered by naively diff-ing and reading a working and a non-working coeff dump. Signed-off-by: Werner Sembach Cc: Link: https://lore.kernel.org/r/20211006130415.538243-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit d0c6416bd7091647f6041599f396bfa19ae30368 Author: Jiang Wang Date: Mon Oct 4 23:25:28 2021 +0000 unix: Fix an issue in unix_shutdown causing the other end read/write failures Commit 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") sets unix domain socket peer state to TCP_CLOSE in unix_shutdown. This could happen when the local end is shutdown but the other end is not. Then, the other end will get read or write failures which is not expected. Fix the issue by setting the local state to shutdown. Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") Reported-by: Casey Schaufler Suggested-by: Cong Wang Signed-off-by: Jiang Wang Signed-off-by: Daniel Borkmann Tested-by: Casey Schaufler Reviewed-by: Casey Schaufler Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20211004232530.2377085-1-jiang.wang@bytedance.com commit 95a13ee858c9e426e63c97063677736f74af7163 Author: Andy Shevchenko Date: Fri Oct 1 16:55:44 2021 +0300 hyper-v: Replace uuid.h with types.h There is no user of anything in uuid.h in the hyperv.h. Replace it with more appropriate types.h. Fixes: f081bbb3fd03 ("hyper-v: Remove internal types from UAPI header") Reported-by: Greg Kroah-Hartman Signed-off-by: Andy Shevchenko Reviewed-by: Haiyang Zhang Link: https://lore.kernel.org/r/20211001135544.1823-1-andriy.shevchenko@linux.intel.com Signed-off-by: Wei Liu commit 6fda593f3082ef1aa783ac13e89f673fd69a2cb6 Author: Andy Shevchenko Date: Tue Oct 5 15:24:49 2021 +0300 gpio: mockup: Convert to use software nodes The gpio-mockup driver creates the properties that are shared between platform and GPIO devices. Because of that, the properties may not be removed at the proper point of time without provoking a use-after-free as shown in the following backtrace: refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 103 at lib/refcount.c:28 refcount_warn_saturate+0xd1/0x120 ... Call Trace: kobject_put+0xdc/0xf0 software_node_notify_remove+0xa8/0xc0 device_del+0x15a/0x3e0 That's why the driver has to manage the lifetime of the software nodes by itself. The problem originates from the old device_add_properties() API, but has been only revealed after the commit bd1e336aa853 ("driver core: platform: Remove platform_device_add_properties()"). Hence, it's used as a landmark for backporting. Fixes: bd1e336aa853 ("driver core: platform: Remove platform_device_add_properties()") Reported-by: Kent Gibson Tested-by: Kent Gibson Signed-off-by: Andy Shevchenko [Bartosz: tweaked local variable placement] Signed-off-by: Bartosz Golaszewski commit 55a9968c7e139209a9e93d4ca4321731bea5fc95 Author: Andy Shevchenko Date: Fri Sep 24 01:46:40 2021 +0300 gpio: pca953x: Improve bias setting The commit 15add06841a3 ("gpio: pca953x: add ->set_config implementation") introduced support for bias setting. However this, due to being half-baked, brought potential issues: - the turning bias via disabling makes the pin floating for a while; - once enabled, bias can't be disabled. Fix all these by adding support for bias disabling and move the disabling part under the corresponding conditional. While at it, add support for default setting, since it's cheap to add. Fixes: 15add06841a3 ("gpio: pca953x: add ->set_config implementation") Cc: Thomas Petazzoni Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit be4491838359e78e42e88db4ac479e21c5eda1e0 Author: Mark Brown Date: Wed Sep 22 17:17:36 2021 +0100 gpio: 74x164: Add SPI device ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding a SPI device ID table. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 9997080df0350ac69988ff92c5a6a0bd0b6bf9bc Merge: 7707a4d01a648 d4aeaed80b0eb Author: David S. Miller Date: Wed Oct 6 11:18:27 2021 +0100 Merge branch 'stmmac-eee-fix' Wong Vee Khee says: ==================== net: stmmac: Turn off EEE on MAC link down This patch series ensure PCS EEE is turned off on the event of MAC link down. Tested on Intel AlderLake-S (STMMAC + MaxLinear GPY211 PHY). ==================== Signed-off-by: David S. Miller commit d4aeaed80b0ebb020fadf2073b23462928dbdc17 Author: Wong Vee Khee Date: Tue Oct 5 19:51:00 2021 +0800 net: stmmac: trigger PCS EEE to turn off on link down The current implementation enable PCS EEE feature in the event of link up, but PCS EEE feature is not disabled on link down. This patch makes sure PCE EEE feature is disabled on link down. Fixes: 656ed8b015f1 ("net: stmmac: fix EEE init issue when paired with EEE capable PHYs") Signed-off-by: Wong Vee Khee Signed-off-by: David S. Miller commit 590df78bc7d1d0425196a8e11ce6676d7023fb26 Author: Wong Vee Khee Date: Tue Oct 5 19:50:59 2021 +0800 net: pcs: xpcs: fix incorrect steps on disable EEE When Energy-Efficient Ethernet(EEE) is disable from the MAC side, we need to clear the DW_VR_MII_EEE_TRN_LPI bit of DW_VR_MII_EEE_MCTRL1 register. Fixes: 7617af3d1a5e ("net: pcs: Introducing support for DWC xpcs Energy Efficient Ethernet") Cc: Michael Sit Wei Hong Signed-off-by: Wong Vee Khee Signed-off-by: David S. Miller commit bf1acf809d5694a942e113dfca6ef076d3904bb4 Author: Cristian Marussi Date: Thu Sep 16 11:33:36 2021 +0100 firmware: arm_scmi: Add proper barriers to scmi virtio device Only one single SCMI Virtio device is currently supported by this driver and it is referenced using a static global variable which is initialized once for all during probing and nullified at virtio device removal. Add proper SMP barriers to protect accesses to such device reference to ensure that the initialzation state of such device is correctly observed by all PEs at any time. Return -EBUSY, instead of -EINVAL, and a descriptive error message if more than one SCMI Virtio device is ever found and probed. Link: https://lore.kernel.org/r/20210916103336.7243-3-cristian.marussi@arm.com Cc: "Michael S. Tsirkin" Cc: Sudeep Holla Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit a14a14595dcade4bf31e50909a6958ed2566c058 Author: Cristian Marussi Date: Thu Sep 16 11:33:35 2021 +0100 firmware: arm_scmi: Simplify spinlocks in virtio transport Remove unneeded nested irqsave/irqrestore spinlocks. Add also a few descriptive comments to explain better the system behaviour at shutdown time. Link: https://lore.kernel.org/r/20210916103336.7243-2-cristian.marussi@arm.com Cc: "Michael S. Tsirkin" Cc: Sudeep Holla Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit f5a8703a9c418c6fc54eb772712dfe7641e3991c Author: Yang Yingliang Date: Sat Sep 11 15:50:23 2021 +0800 drm/nouveau/debugfs: fix file release memory leak When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yangyingliang@huawei.com Signed-off-by: Maarten Lankhorst commit 0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5 Author: Yang Yingliang Date: Sat Sep 11 15:50:22 2021 +0800 drm/nouveau/kms/nv50-: fix file release memory leak When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. Fixes: 12885ecbfe62 ("drm/nouveau/kms/nvd9-: Add CRC support") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-1-yangyingliang@huawei.com Signed-off-by: Maarten Lankhorst commit bcf34aa5082ee2343574bc3f4d1c126030913e54 Author: Jeremy Cline Date: Wed Dec 2 19:02:20 2020 -0500 drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm_bo_init() invokes the provided destructor which should de-initialize and free the memory. Thus, when nouveau_bo_init() returns an error the gem object has already been released and the memory freed by nouveau_bo_del_ttm(). Fixes: 019cbd4a4feb ("drm/nouveau: Initialize GEM object before TTM object") Cc: Thierry Reding Signed-off-by: Jeremy Cline Reviewed-by: Lyude Paul Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20201203000220.18238-1-jcline@redhat.com Signed-off-by: Maarten Lankhorst commit b67929808fe46d67cc9357b0112e4549076db4c5 Author: Randy Dunlap Date: Mon Oct 4 19:53:12 2021 -0700 DRM: delete DRM IRQ legacy midlayer docs Remove documentation associated with the removal of the DRM IRQ legacy midlayer. Eliminates these documentation warnings: ../drivers/gpu/drm/drm_irq.c:1: warning: 'irq helpers' not found ../drivers/gpu/drm/drm_irq.c:1: warning: no structured comments found Fixes: c1736b9008cb ("drm: IRQ midlayer is now legacy") Signed-off-by: Randy Dunlap Cc: Thomas Zimmermann Cc: Sam Ravnborg Cc: dri-devel@lists.freedesktop.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20211005025312.20913-1-rdunlap@infradead.org Signed-off-by: Maarten Lankhorst commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 Author: Mark Brown Date: Tue Sep 21 22:21:02 2021 +0100 video: fbdev: gbefb: Only instantiate device when built for IP32 The gbefb driver not only registers a driver but also the device for that driver. This is all well and good when run on the IP32 machines that are supported by the driver but since the driver supports building with COMPILE_TEST we might also be building on other platforms which do not have this hardware and will crash instantiating the driver. Add an IS_ENABLED() check so we compile out the device registration if we don't have the Kconfig option for the machine enabled. Fixes: 552ccf6b259d290c0c ("video: fbdev: gbefb: add COMPILE_TEST support") Signed-off-by: Mark Brown Cc: Bartlomiej Zolnierkiewicz Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210921212102.30803-1-broonie@kernel.org Signed-off-by: Maarten Lankhorst commit ec7cc3f74b4236860ce612656aa5be7936d1c594 Author: Arnd Bergmann Date: Tue Sep 28 16:52:10 2021 +0200 fbdev: simplefb: fix Kconfig dependencies Configurations with both CONFIG_FB_SIMPLE=y and CONFIG_DRM_SIMPLEDRM=m are allowed by Kconfig because the 'depends on !DRM_SIMPLEDRM' dependency does not disallow FB_SIMPLE as long as SIMPLEDRM is not built-in. This can however result in a build failure when cfb_fillrect() etc are then also in loadable modules: x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x1f8): undefined reference to `cfb_fillrect' x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x200): undefined reference to `cfb_copyarea' x86_64-linux-ld: drivers/video/fbdev/simplefb.o:(.rodata+0x208): undefined reference to `cfb_imageblit' To work around this, change FB_SIMPLE to be a 'tristate' symbol, which still allows both to be =m together, but not one of them to be =y if the other one is =m. If a distro kernel picks this configuration, it can be determined by local policy which of the two modules gets loaded. The 'of_chosen' export is needed as this is the first loadable module referencing it. Alternatively, the Kconfig dependency could be changed to 'depends on DRM_SIMPLEDRM=n', which would forbid the configuration with both drivers. Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Acked-by: Rob Herring # for drivers/of/ Link: https://lore.kernel.org/all/20210721151839.2484245-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann Cc: Thomas Zimmermann Cc: Daniel Vetter # fbdev support Cc: Maxime Ripard Cc: Liam Girdwood Cc: Mark Brown Cc: Daniel Vetter Cc: Borislav Petkov Cc: Javier Martinez Canillas Cc: Randy Dunlap Cc: Geert Uytterhoeven Cc: Peter Collingbourne Cc: Andy Shevchenko Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Cc: # v5.14+ Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210928145243.1098064-1-arnd@kernel.org Signed-off-by: Maarten Lankhorst commit 413e8d06ad896dae9bbc6f97b0abea5eae5495f1 Author: Christophe Branchereau Date: Tue Sep 14 11:27:16 2021 +0200 drm/panel: abt-y030xx067a: yellow tint fix The previous parameters caused an unbalanced yellow tint. Fixes: 7467389bdafb ("drm/panel: Add ABT Y030XX067A 3.0" 320x480 panel") Signed-off-by: Christophe Branchereau Acked-by: Sam Ravnborg [Paul: Add Fixes: tag, and fix case and punctuation in commit message] Signed-off-by: Paul Cercueil Link: https://patchwork.freedesktop.org/patch/msgid/20210914092716.2370039-1-cbranchereau@gmail.com Signed-off-by: Maarten Lankhorst commit 990a9ff072776908bf0654e23df69c30aa9ff945 Author: Krzysztof Kozlowski Date: Thu Aug 19 12:10:19 2021 +0200 dt-bindings: panel: ili9341: correct indentation Correct indentation warning: ilitek,ili9341.yaml:25:9: [warning] wrong indentation: expected 10 but found 8 (indentation) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20210819101020.26368-1-krzysztof.kozlowski@canonical.com (cherry picked from commit 333ba0d9d5d5a2cf1f6bbb754045e4f2cb3ed22d) Link: https://lore.kernel.org/dri-devel/CAL_JsqKcTfgnXNYzGDSFhKS2udhw2Dvk04ODwTxUdDRQjKdT0Q@mail.gmail.com/ Signed-off-by: Maxime Ripard Signed-off-by: Maarten Lankhorst commit 0689ea432a85ad1a108f47c3d90b6feae322c7f9 Author: Ben Skeggs Date: Tue Sep 21 19:07:35 2021 +1000 drm/nouveau/fifo/ga102: initialise chid on return from channel creation Turns out caller isn't zero-initialised after-all. Fixes: 49b2dfc08182 ("drm/nouveau/ga102-: support ttm buffer moves via copy engine") Reported-by: Karol Herbst Signed-off-by: Ben Skeggs Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20210921090735.247236-1-skeggsb@gmail.com Signed-off-by: Maarten Lankhorst commit 64ec4912c51ad782067e56b106735eaf62ea035c Author: Chris Morgan Date: Thu Sep 16 15:29:07 2021 -0500 drm/rockchip: Update crtc fixup to account for fractional clk change After commit 928f9e268611 ("clk: fractional-divider: Hide clk_fractional_divider_ops from wide audience") was merged it appears that the DSI panel on my Odroid Go Advance stopped working. Upon closer examination of the problem, it looks like it was the fixup in the rockchip_drm_vop.c file was causing the issue. The changes made to the clk driver appear to change some assumptions made in the fixup. After debugging the working 5.14 kernel and the no-longer working 5.15 kernel, it looks like this was broken all along but still worked, whereas after the fractional clock change it stopped working despite the issue (it went from sort-of broken to very broken). In the 5.14 kernel the dclk_vopb_frac was being requested to be set to 17000999 on my board. The clock driver was taking the value of the parent clock and attempting to divide the requested value from it (17000000/17000999 = 0), then subtracting 1 from it (making it -1), and running it through fls_long to get 64. It would then subtract the value of fd->mwidth from it to get 48, and then bit shift 17000999 to the left by 48, coming up with a very large number of 7649082492112076800. This resulted in a numerator of 65535 and a denominator of 1 from the clk driver. The driver seemingly would try again and get a correct 1:1 value later, and then move on. Output from my 5.14 kernel (with some printfs for good measure): [ 2.830066] rockchip-drm display-subsystem: bound ff460000.vop (ops vop_component_ops) [ 2.839431] rockchip-drm display-subsystem: bound ff450000.dsi (ops dw_mipi_dsi_rockchip_ops) [ 2.855980] Clock is dclk_vopb_frac [ 2.856004] Scale 64, Rate 7649082492112076800, Oldrate 17000999, Parent Rate 17000000, Best Numerator 65535, Best Denominator 1, fd->mwidth 16 [ 2.903529] Clock is dclk_vopb_frac [ 2.903556] Scale 0, Rate 17000000, Oldrate 17000000, Parent Rate 17000000, Best Numerator 1, Best Denominator 1, fd->mwidth 16 [ 2.903579] Clock is dclk_vopb_frac [ 2.903583] Scale 0, Rate 17000000, Oldrate 17000000, Parent Rate 17000000, Best Numerator 1, Best Denominator 1, fd->mwidth 16 Contrast this with 5.15 after the clk change where the rate of 17000999 was getting passed and resulted in numerators/denomiators of 17001/ 17000. Output from my 5.15 kernel (with some printfs added for good measure): [ 2.817571] rockchip-drm display-subsystem: bound ff460000.vop (ops vop_component_ops) [ 2.826975] rockchip-drm display-subsystem: bound ff450000.dsi (ops dw_mipi_dsi_rockchip_ops) [ 2.843430] Rate 17000999, Parent Rate 17000000, Best Numerator 17018, Best Denominator 17017 [ 2.891073] Rate 17001000, Parent Rate 17000000, Best Numerator 17001, Best Denominator 17000 [ 2.891269] Rate 17001000, Parent Rate 17000000, Best Numerator 17001, Best Denominator 17000 [ 2.891281] Rate 17001000, Parent Rate 17000000, Best Numerator 17001, Best Denominator 17000 I have tested the change extensively on my Odroid Go Advance (Rockchip RK3326) and it appears to work well. However, this change will affect all Rockchip SoCs that use this driver so I believe further testing is warranted. Please note that without this change I can confirm at least all PX30s with DSI panels will stop working with the 5.15 kernel. Upon advice from Doug Anderson it was decided that we would first check if the clock rate can be set exactly as requested, and only if it could not would we then add 999 to it and attempt the process again. This way we can preserve the behavior for clocks that still need it while resolving the specific issue for the PX30 and DSI panels (since it is using a fractional clock). Changes since v2: - Moved fixes to correct location. Changes since v1: - Made the addition of 999 conditional based on whether the clock subsystem can set the actual clock rate as requested. - Updated the notes in the fixup routine to reflect this new behavior. - Added reference to original commit, as this has technically been broken since then however only now is it an issue due to the clock changes. Fixes: 4e7cf74fa3b2 ("clk: fractional-divider: Export approximation algorithm to the CCF users") Signed-off-by: Chris Morgan Reviewed-by: Douglas Anderson Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20210916202907.18394-1-macroalpha82@gmail.com Signed-off-by: Maarten Lankhorst commit 49b2dfc081826874705b27f7970631319628ee7f Author: Ben Skeggs Date: Fri Sep 17 08:04:06 2021 +1000 drm/nouveau/ga102-: support ttm buffer moves via copy engine We don't currently have any kind of real acceleration on Ampere GPUs, but the TTM memcpy() fallback paths aren't really designed to handle copies between different devices, such as on Optimus systems, and result in a kernel OOPS. A few options were investigated to try and fix this, but didn't work out, and likely would have resulted in a very unpleasant experience for users anyway. This commit adds just enough support for setting up a single channel connected to a copy engine, which the kernel can use to accelerate the buffer copies between devices. Userspace has no access to this incomplete channel support, but it's suitable for TTM's needs. A more complete implementation of host(fifo) for Ampere GPUs is in the works, but the required changes are far too invasive that they would be unsuitable to backport to fix this issue on current kernels. v2: fix GPFIFO length in RAMFC (reported by Karol) Signed-off-by: Ben Skeggs Cc: Lyude Paul Cc: Karol Herbst Cc: # v5.12+ Reviewed-by: Karol Herbst Tested-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20210916220406.666454-1-skeggsb@gmail.com Signed-off-by: Maarten Lankhorst commit f732e2e34aa08493fdd762f3daa4e5f16bbf1e45 Author: Ben Skeggs Date: Mon Sep 6 10:56:28 2021 +1000 drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows Prevent NVD core channel error code 67 occuring and hanging display, managed to reproduce on GA102 while testing suspend/resume scenarios. Required extension of earlier commit to fix interactions with EFI. Fixes: e78b1b545c6c ("drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences") Signed-off-by: Ben Skeggs Cc: Lyude Paul Cc: Karol Herbst Cc: # v5.12+ Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20210906005628.11499-2-skeggsb@gmail.com Signed-off-by: Maarten Lankhorst commit c64c8e04a12ed3e2238761e26cda78e72550dc98 Author: Jernej Skrabec Date: Wed Sep 15 19:58:36 2021 +0200 drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup Recent rework, which made HDMI PHY driver a platform device, inadvertely reversed clock setup order. HW is very touchy about it. Proper way is to handle controllers resets and clocks first and HDMI PHYs second. Currently, without this fix, first mode set completely fails (nothing on HDMI monitor) on H3 era PHYs. On H6, it still somehow work. Move HDMI PHY reset & clocks handling to sun8i_hdmi_phy_init() which will assure that code is executed after controllers reset & clocks are handled. Additionally, add sun8i_hdmi_phy_deinit() which will deinit them at controllers driver unload. Tested on A64, H3, H6 and R40. Fixes: 9bf3797796f5 ("drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device") Signed-off-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20210915175836.3158839-1-jernej.skrabec@gmail.com Signed-off-by: Maarten Lankhorst commit 5e2e412d47f21c1682e701f946d4114f9885c23f Author: Maxime Ripard Date: Thu Aug 19 16:07:53 2021 +0200 drm/vc4: hdmi: Remove unused struct Commitc7d30623540b ("drm/vc4: hdmi: Remove unused struct") removed the references to the vc4_hdmi_audio_widgets and vc4_hdmi_audio_routes structures, but not the structures themselves resulting in two warnings. Remove it. Fixes: c7d30623540b ("drm/vc4: hdmi: Remove unused struct") Reported-by: kernel test robot Signed-off-by: Maxime Ripard Reviewed-by: Dave Stevenson Link: https://patchwork.freedesktop.org/patch/msgid/20210819140753.930751-1-maxime@cerno.tech Signed-off-by: Maarten Lankhorst commit c026565fe9be813fe826f7e5533ed763283af5f0 Author: Edmund Dea Date: Fri Dec 4 14:34:29 2020 -0800 drm/kmb: Enable alpha blended second plane Enable one additional plane that is alpha blended on top of the primary plane. This also fixes the below warnings when building with -Warray-bounds: drivers/gpu/drm/kmb/kmb_plane.c:135:20: warning: array subscript 3 is above array bounds of 'struct layer_status[1]' [-Warray-bounds] drivers/gpu/drm/kmb/kmb_plane.c:132:20: warning: array subscript 2 is above array bounds of 'struct layer_status[1]' [-Warray-bounds] drivers/gpu/drm/kmb/kmb_plane.c:129:20: warning: array subscript 1 is above array bounds of 'struct layer_status[1]' [-Warray-bounds] v2: corrected previous patch dependecies so it builds Signed-off-by: Edmund Dea Signed-off-by: Anitha Chrisanthus Acked-by: Sam Ravnborg Link: https://patchwork.kernel.org/project/dri-devel/patch/20210728003126.1425028-13-anitha.chrisanthus@intel.com/ Signed-off-by: Maarten Lankhorst commit b55ec7528879a822a4d350248daa04bbb27f25fd Author: Stefan Wahren Date: Sat Aug 7 13:06:33 2021 +0200 ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg regulator states DT schema check complains at sd_io_1v8_reg about the following: [1800000, 1, 3300000, 0] is too long Additional items are not allowed (3300000, 0 were unexpected) So fix the states definition. Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/1628334401-6577-3-git-send-email-stefan.wahren@i2se.com Signed-off-by: Nicolas Saenz Julienne commit 2faff6737a8a684b077264f0aed131526c99eec4 Author: Stefan Wahren Date: Sat Aug 7 13:06:32 2021 +0200 ARM: dts: bcm2711: fix MDIO #address- and #size-cells The values of #address-cells and #size-cells are swapped. Fix this and avoid the following DT schema warnings for mdio@e14: #address-cells:0:0: 1 was expected #size-cells:0:0: 0 was expected Fixes: be8af7a9e3cc ("ARM: dts: bcm2711-rpi-4: Enable GENET support") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/1628334401-6577-2-git-send-email-stefan.wahren@i2se.com Signed-off-by: Nicolas Saenz Julienne commit 9287e91e9019d4bc1018adb55ab791ae672e0b14 Author: Mateusz Kwiatkowski Date: Thu Jul 22 21:02:08 2021 +0200 ARM: dts: bcm283x: Fix VEC address for BCM2711 The VEC has a different address (0x7ec13000) on the BCM2711 (used in e.g. Raspberry Pi 4) compared to BCM283x (e.g. Pi 3 and earlier). This was erroneously not taken account for. Definition of the VEC in the devicetrees had to be moved from bcm283x.dtsi to bcm2711.dtsi and bcm2835-common.dtsi to allow for this differentiation. Fixes: 7894bdc6228f ("ARM: boot: dts: bcm2711: Add BCM2711 VEC compatible") Signed-off-by: Mateusz Kwiatkowski Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/1626980528-3835-1-git-send-email-stefan.wahren@i2se.com Signed-off-by: Nicolas Saenz Julienne commit ff53c4f6a668ee952c8a2fb494914c97ddbdaf87 Merge: dfffaf0238e5a 57b44817a8d63 Author: Greg Kroah-Hartman Date: Wed Oct 6 09:34:35 2021 +0200 Merge tag 'fpga-maintainer-update' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-linus Moritz writes: FPGA Manager changes for 5.16 The first patch adds Hao and Yilun as additional maintainers for the FPGA Manager subsystem. The second patch removes a now stale reference to a product specific website that no longer reflects the FPGA Manager subsystem. All patches have been reviewed on the mailing list, and have been in the last few linux-next releases (as part of my for-next branch) without issues. Signed-off-by: Moritz Fischer * tag 'fpga-maintainer-update' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga: MAINTAINERS: Drop outdated FPGA Manager website MAINTAINERS: Add Hao and Yilun as maintainers commit 319933a80fd4f07122466a77f93e5019d71be74c Author: Juergen Gross Date: Tue Oct 5 15:34:33 2021 +0200 xen/balloon: fix cancelled balloon action In case a ballooning action is cancelled the new kernel thread handling the ballooning might end up in a busy loop. Fix that by handling the cancelled action gracefully. While at it introduce a short wait for the BP_WAIT case. Cc: stable@vger.kernel.org Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Tested-by: Jason Andryuk Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20211005133433.32008-1-jgross@suse.com Signed-off-by: Juergen Gross commit 363999901116ffa9a5462215fef25ea9c7f2823c Author: Namjae Jeon Date: Fri Sep 24 09:17:30 2021 +0900 ksmbd: add the check to vaildate if stream protocol length exceeds maximum value This patch add MAX_STREAM_PROT_LEN macro and check if stream protocol length exceeds maximum value. opencode pdu size check in ksmbd_pdu_size_has_room(). Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Acked-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 80d680fdccba214e8106dc1aa33de5207ad75394 Author: Roger Quadros Date: Thu Sep 2 12:58:28 2021 +0300 ARM: dts: omap3430-sdp: Fix NAND device node Nand is on CS1 so reg properties first field should be 1 not 0. Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes") Cc: stable@vger.kernel.org # v4.6+ Signed-off-by: Roger Quadros Signed-off-by: Tony Lindgren commit b13a270ace2e4c70653aa1d1d0394c553905802f Author: Tony Lindgren Date: Wed Sep 8 08:49:36 2021 +0300 bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in addition to dcan2 for errata i893 handling. Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods" dts property is used with related dcan hwmod data. This should be only needed if anybody needs to git bisect earlier stable trees though. Fixes: 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO") Signed-off-by: Tony Lindgren commit e700ac213a0f793fb4f83098413303e3dd080892 Merge: e879f855e590b b232537074fca Author: Tony Lindgren Date: Wed Oct 6 07:55:44 2021 +0300 Merge branch 'pruss-fix' into fixes Merge in a fix for pruss reset issue caused by enabling pruss for am335x. commit 012e974501a270d8dfd4ee2039e1fdf7579c907e Author: Guenter Roeck Date: Sun Aug 1 10:36:59 2021 -0700 xtensa: xtfpga: Try software restart before simulating CPU reset Rebooting xtensa images loaded with the '-kernel' option in qemu does not work. When executing a reboot command, the qemu session either hangs or experiences an endless sequence of error messages. Kernel panic - not syncing: Unrecoverable error in exception handler Reset code jumps to the CPU restart address, but Linux can not recover from there because code and data in the kernel init sections have been discarded and overwritten at this point. XTFPGA platforms have a means to reset the CPU by writing 0xdead into a specific FPGA IO address. When used in QEMU the kernel image loaded with the '-kernel' option gets restored to its original state allowing the machine to boot successfully. Use that mechanism to attempt a platform reset. If it does not work, fall back to the existing mechanism. Signed-off-by: Guenter Roeck Signed-off-by: Max Filippov commit f3d7c2cdf6dc0d5402ec29c3673893b3542c5ad1 Author: Max Filippov Date: Tue Oct 5 11:36:01 2021 -0700 xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF Use platform data to initialize xtfpga device drivers when CONFIG_USE_OF is not selected. This fixes xtfpga networking when CONFIG_USE_OF is not selected but CONFIG_OF is. Signed-off-by: Max Filippov commit fe255fe6ad97685e5a4be0d871f43288dbc10ad6 Author: Joe Lawrence Date: Sun Aug 22 18:50:37 2021 -0400 objtool: Remove redundant 'len' field from struct section The section structure already contains sh_size, so just remove the extra 'len' member that requires extra mirroring and potential confusion. Suggested-by: Josh Poimboeuf Signed-off-by: Joe Lawrence Reviewed-by: Miroslav Benes Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20210822225037.54620-3-joe.lawrence@redhat.com Cc: Andy Lavr Cc: Peter Zijlstra Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org commit dc02368164bd0ec603e3f5b3dd8252744a667b8a Author: Joe Lawrence Date: Sun Aug 22 18:50:36 2021 -0400 objtool: Make .altinstructions section entry size consistent Commit e31694e0a7a7 ("objtool: Don't make .altinstructions writable") aligned objtool-created and kernel-created .altinstructions section flags, but there remains a minor discrepency in their use of a section entry size: objtool sets one while the kernel build does not. While sh_entsize of sizeof(struct alt_instr) seems intuitive, this small deviation can cause failures with external tooling (kpatch-build). Fix this by creating new .altinstructions sections with sh_entsize of 0 and then later updating sec->sh_size as alternatives are added to the section. An added benefit is avoiding the data descriptor and buffer created by elf_create_section(), but previously unused by elf_add_alternative(). Fixes: 9bc0bb50727c ("objtool/x86: Rewrite retpoline thunk calls") Signed-off-by: Joe Lawrence Reviewed-by: Miroslav Benes Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20210822225037.54620-2-joe.lawrence@redhat.com Cc: Andy Lavr Cc: Peter Zijlstra Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org commit 4d8b35968bbf9e42b6b202eedb510e2c82ad8b38 Author: Josh Poimboeuf Date: Mon Oct 4 10:07:50 2021 -0700 objtool: Remove reloc symbol type checks in get_alt_entry() Converting a special section's relocation reference to a symbol is straightforward. No need for objtool to complain that it doesn't know how to handle it. Just handle it. This fixes the following warning: arch/x86/kvm/emulate.o: warning: objtool: __ex_table+0x4: don't know how to handle reloc symbol type: kvm_fastop_exception Fixes: 24ff65257375 ("objtool: Teach get_alt_entry() about more relocation types") Reported-by: Linus Torvalds Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/feadbc3dfb3440d973580fad8d3db873cbfe1694.1633367242.git.jpoimboe@redhat.com Cc: Peter Zijlstra Cc: x86@kernel.org Cc: Miroslav Benes Cc: linux-kernel@vger.kernel.org commit dfffaf0238e5aad7b8c1c5362829f5dfed0902dd Merge: 75c10c5e7a715 2a2a79577ddae Author: Greg Kroah-Hartman Date: Tue Oct 5 20:29:44 2021 +0200 Merge tag 'fpga-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-next Moritz writes: FPGA Manager fixes for 5.15 Mark's fix adds a MODULE_DEVICE_TABLE to ensure module autoloading works for the Lattice ice-40-spi FPGA Manager driver. All patches have been reviewed on the mailing list, and have been in the last few linux-next releases (as part of my fixes branch) without issues. Signed-off-by: Moritz Fischer * tag 'fpga-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga: fpga: ice40-spi: Add SPI device ID table commit 0b6c5371c03c2b17963e1abd7ed0e3f1f950cba9 Author: Kan Liang Date: Thu Sep 30 12:52:46 2021 -0700 perf tests attr: Add missing topdown metrics events The Topdown metrics events were added as 'perf stat' default events since commit 42641d6f4d15e6db ("perf stat: Add Topdown metrics events as default events"). However, the perf attr tests were not updated accordingly. The perf attr test fails on the platform which supports Topdown metrics. # perf test 17 17: Setup struct perf_event_attr :FAILED! Add Topdown metrics events into perf attr test cases. Make them optional since they are only available on newer platforms. Fixes: 42641d6f4d15e6db ("perf stat: Add Topdown metrics events as default events") Reported-by: kernel test robot Signed-off-by: Kan Liang Cc: Andi Kleen Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/1633031566-176517-1-git-send-email-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 60a9483534ed0d99090a2ee1d4bb0b8179195f51 Merge: f6274b06e326d ef31499a87cf8 Author: Linus Torvalds Date: Tue Oct 5 10:52:53 2021 -0700 Merge tag 'warning-fixes-20211005' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull misc fs warning fixes from David Howells: "The first four patches fix kerneldoc warnings in fscache, afs, 9p and nfs - they're mostly just comment changes, though there's one place in 9p where a comment got detached from the function it was attached to (v9fs_fid_add) and has to switch places with a function that got inserted between (__add_fid). The patch on the end removes an unused symbol in fscache" * tag 'warning-fixes-20211005' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: Remove an unused static variable fscache: Fix some kerneldoc warnings shown up by W=1 9p: Fix a bunch of kerneldoc warnings shown up by W=1 afs: Fix kerneldoc warning shown up by W=1 nfs: Fix kerneldoc warning shown up by W=1 commit 9fce636e5c7dd84873f096ae4d094fb6bd797f9f Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 11:04:23 2020 -0300 tools include UAPI: Sync sound/asound.h copy with the kernel sources Picking the changes from: 09d23174402da0f1 ("ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION") Which entails no changes in the tooling side as it doesn't introduce new SNDRV_PCM_IOCTL_ ioctls. To silence this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/sound/asound.h' differs from latest version at 'include/uapi/sound/asound.h' diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Cc: Jaroslav Kysela Cc: Takashi Iwai Signed-off-by: Arnaldo Carvalho de Melo commit 35c46bf545b31c961f216dd228bf9cba5499e5f0 Author: Branislav Rankov Date: Wed Jul 21 11:32:58 2021 +0100 perf build: Fix plugin static linking with libopencsd on ARM and ARM64 Filter out -static flag when building plugins as they are always built as dynamic libraries and -static and -dynamic don't work well together on arm and arm64. Signed-off-by: Branislav Rankov Acked-by: Jiri Olsa Cc: Ingo Molnar Cc: Mark Brown Cc: Peter Zijlstra Cc: coresight@lists.linaro.org Cc: nd@arm.com Link: https://lore.kernel.org/r/e88952b3-2470-da96-dee9-e247a1759cd0@arm.com Signed-off-by: Tamas Zsoldos [ Split from a larger patch ] Signed-off-by: Arnaldo Carvalho de Melo commit 573cf5c9a152da1569b993600daa21ede30eeccb Author: Branislav Rankov Date: Wed Jul 21 11:32:58 2021 +0100 perf build: Add missing -lstdc++ when linking with libopencsd Add -lstdc++ to perf when linking libopencsd as it is a dependency. It does not hurt to add it when dynamic linking. Signed-off-by: Branislav Rankov Acked-by: Jiri Olsa Cc: Ingo Molnar Cc: Mark Brown Cc: Peter Zijlstra Cc: coresight@lists.linaro.org Cc: nd@arm.com Link: https://lore.kernel.org/r/e88952b3-2470-da96-dee9-e247a1759cd0@arm.com Signed-off-by: Tamas Zsoldos [ Split from a larger patch ] Signed-off-by: Arnaldo Carvalho de Melo commit b94729919db2c6737501c36ea6526a36d5d63fa2 Author: Like Xu Date: Tue Sep 28 18:29:38 2021 +0800 perf jevents: Free the sys_event_tables list after processing entries The compiler reports that free_sys_event_tables() is dead code. But according to the semantics, the "LIST_HEAD(sys_event_tables)" should also be released, just like we do with 'arch_std_events' in main(). Fixes: e9d32c1bf0cd7a98 ("perf vendor events: Add support for arch standard events") Signed-off-by: Like Xu Reviewed-by: John Garry Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210928102938.69681-1-likexu@tencent.com Signed-off-by: Arnaldo Carvalho de Melo commit 248b061689a40f4fed05252ee2c89f87cf26d7d8 Author: Guchun Chen Date: Fri Oct 1 09:48:50 2021 +0800 drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen. Fixes: c9a6b82f45e2 ("drm/amdgpu: Implement DPC recovery") Suggested-by: Andrey Grodzovsky Signed-off-by: Guchun Chen Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit 714d9e4574d54596973ee3b0624ee4a16264d700 Author: Yifan Zhang Date: Tue Sep 28 15:42:35 2021 +0800 drm/amdgpu: init iommu after amdkfd device init This patch is to fix clinfo failure in Raven/Picasso: Number of platforms: 1 Platform Profile: FULL_PROFILE Platform Version: OpenCL 2.2 AMD-APP (3364.0) Platform Name: AMD Accelerated Parallel Processing Platform Vendor: Advanced Micro Devices, Inc. Platform Extensions: cl_khr_icd cl_amd_event_callback Platform Name: AMD Accelerated Parallel Processing Number of devices: 0 Signed-off-by: Yifan Zhang Reviewed-by: James Zhu Tested-by: James Zhu Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit 0dd10a961f2aa39d02e9aa2194946713cb36d403 Author: Yifan Zhang Date: Fri Sep 24 11:15:35 2021 +0800 drm/amdkfd: remove redundant iommu cleanup code kfd_resume doesn't involve iommu operation, remove redundant iommu cleanup code. Signed-off-by: Yifan Zhang Reviewed-by: James Zhu Tested-by: James Zhu Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit 81967efb5f3966e8692f9173c7fa2964034ece5d Author: Saravana Kannan Date: Tue Sep 28 17:07:34 2021 -0700 drivers: bus: Delete CONFIG_SIMPLE_PM_BUS The simple-pm-bus driver is mandatory for CONFIG_OF based platforms to work with fw_devlink. So, always compile it in for CONFIG_OF and delete the config since it's no longer necessary. Tested-by: Ulf Hansson Tested-by: Geert Uytterhoeven Tested-by: Damien Le Moal Cc: Rob Herring Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210929000735.585237-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 98e96cf80045a383fcc47c58dd4e87b3ae587b3e Author: Saravana Kannan Date: Tue Sep 28 17:07:33 2021 -0700 drivers: bus: simple-pm-bus: Add support for probing simple bus only devices fw_devlink could end up creating device links for bus only devices. However, bus only devices don't get probed and can block probe() or sync_state() [1] call backs of other devices. To avoid this, probe these devices using the simple-pm-bus driver. However, there are instances of devices that are not simple buses (they get probed by their specific drivers) that also list the "simple-bus" (or other bus only compatible strings) in their compatible property to automatically populate their child devices. We still want these devices to get probed by their specific drivers. So, we make sure this driver only probes devices that are only buses. [1] - https://lore.kernel.org/lkml/CAPDyKFo9Bxremkb1dDrr4OcXSpE0keVze94Cm=zrkOVxHHxBmQ@mail.gmail.com/ Fixes: c442a0d18744 ("driver core: Set fw_devlink to "permissive" behavior by default") Cc: stable Cc: Rob Herring Tested-by: Saravana Kannan Tested-by: Ulf Hansson Tested-by: Geert Uytterhoeven Tested-by: Damien Le Moal Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210929000735.585237-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit f729a592adb6760013c3e48622a5bf256b992452 Author: Saravana Kannan Date: Wed Sep 29 12:05:49 2021 -0700 driver core: Reject pointless SYNC_STATE_ONLY device links SYNC_STATE_ONLY device links intentionally allow cycles because cyclic sync_state() dependencies are valid and necessary. However a SYNC_STATE_ONLY device link where the consumer and the supplier are the same device is pointless because the device link would be deleted as soon as the device probes (because it's also the consumer) and won't affect when the sync_state() callback is called. It's a waste of CPU cycles and memory to create this device link. So reject any attempts to create such a device link. Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag") Cc: stable Reported-by: Ulf Hansson Reviewed-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210929190549.860541-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 4702b34d1de9582df9dfa0e583ea28fff7de29df Author: Alex Deucher Date: Fri Oct 1 15:40:00 2021 -0400 drm/amdgpu/display: fix dependencies for DRM_AMD_DC_SI Depends on DRM_AMDGPU_SI and DRM_AMD_DC Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1d617c029fd9c960f8ba7a8d1a10699d820bd6b9 Author: Lijo Lazar Date: Fri Oct 1 16:49:07 2021 +0800 drm/amdgpu: During s0ix don't wait to signal GFXOFF In the rare event when GFX IP suspend coincides with a s0ix entry, don't schedule a delayed work, instead signal PMFW immediately to allow GFXOFF entry. GFXOFF is a prerequisite for s0ix entry. PMFW needs to be signaled about GFXOFF status before amd-pmc module passes OS HINT to PMFW telling that everything is ready for a safe s0ix entry. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1712 Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit d08ce8c6d29f8cc7493b781be282604b10fc6e1e Author: Alex Deucher Date: Wed Sep 29 13:42:08 2021 -0400 Documentation/gpu: remove spurious "+" in amdgpu.rst Not sure why that was there. Remove it. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit b072ef1215aca33186e3a10109e872e528a9e516 Author: Lang Yu Date: Wed Sep 29 14:54:39 2021 +0800 drm/amdkfd: fix a potential ttm->sg memory leak Memory is allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr, but isn't freed by kfree in kfd_mem_dmaunmap_userptr. Free it! Fixes: 264fb4d332f5 ("drm/amdgpu: Add multi-GPU DMA mapping helpers") Signed-off-by: Lang Yu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 7ab0965079bbc0e39fe0e1df4dcdf931c9d25372 Author: Jude Shih Date: Mon Oct 4 22:40:50 2021 +0800 drm/amd/display: USB4 bring up set correct address [Why] YELLOW_CARP_B0 address was not correct [How] Set YELLOW_CARP_B0 to 0x1A. Reviewed-by: Nicholas Kazlauskas Acked-by: Wayne Lin Signed-off-by: Jude Shih Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 95dd8b2c1ed00c76aaf41b552041c90724749a53 Author: Konstantin Komarov Date: Tue Oct 5 17:22:29 2021 +0300 fs/ntfs3: Remove unnecessary functions We don't need ntfs_xattr_get_acl and ntfs_xattr_set_acl. There are ntfs_get_acl_ex and ntfs_set_acl_ex. Signed-off-by: Konstantin Komarov commit 75c10c5e7a715550afdd51ef8cfd1d975f48f9e1 Author: Andy Shevchenko Date: Fri Oct 1 20:36:44 2021 +0300 mei: me: add Ice Lake-N device id. Add Ice Lake-N device ID. The device can be found on MacBookPro16,2 [1]. [1]: https://linux-hardware.org/?probe=f1c5cf0c43 Signed-off-by: Andy Shevchenko Cc: stable Link: https://lore.kernel.org/r/20211001173644.16068-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2fe9a0e1173f4805669e7af34ea25af835274426 Author: Liu, Zhan Date: Thu Sep 2 15:08:29 2021 -0400 drm/amd/display: Fix DCN3 B0 DP Alt Mapping [Why] DCN3 B0 has a mux, which redirects PHYC and PHYD to PHYF and PHYG. [How] Fix DIG mapping. Reviewed-by: Charlene Liu Acked-by: Rodrigo Siqueira Signed-off-by: Zhan Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org (cherry picked from commit 4b7786d87fb3adf3e534c4f1e4f824d8700b786b) commit 45d65c0f09aaa6cdd21fe0743f317d4bbdfd1466 Author: Liu, Zhan Date: Thu Sep 9 13:26:37 2021 -0400 drm/amd/display: Fix B0 USB-C DP Alt mode [Why] Starting from B0, along with RDPCSTX, RDPCSPIPE registers are also used. [How] Make sure RDPCSPIPE registers are programmed correctly. Reviewed-by: Charlene Liu Acked-by: Rodrigo Siqueira Signed-off-by: Zhan Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org (cherry picked from commit bdd1a21b52557ea8f61d0a5dc2f77151b576eb70) commit 137879f7ff23c635d2c6b2e43f4b39e2d305c3e2 Author: Mark Brown Date: Wed Sep 22 19:40:48 2021 +0100 eeprom: 93xx46: Add SPI device ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding a SPI device ID table. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210922184048.34770-1-broonie@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9e2cd444909b3c93f5cc83463d12291e3e0f990b Author: Mark Brown Date: Thu Sep 23 18:24:53 2021 +0100 eeprom: at25: Add SPI ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding an id_table listing the SPI IDs for everything. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210923172453.4921-1-broonie@kernel.org Signed-off-by: Greg Kroah-Hartman commit 97d8ebead87b7457ba5c4f4e7860b8fc8cf013fd Author: Randy Dunlap Date: Sun Oct 3 17:16:41 2021 -0700 misc: HI6421V600_IRQ should depend on HAS_IOMEM MFD_CORE depends on HAS_IOMEM so anything that selects MFD_CORE should also depend on HAS_IOMEM since 'select' does not check any dependencies of the symbol that is being selected. Prevents this kconfig warning: WARNING: unmet direct dependencies detected for MFD_CORE Depends on [n]: HAS_IOMEM [=n] Selected by [m]: - HI6421V600_IRQ [=m] && OF [=y] && SPMI [=m] Fixes: bb3b6552a5b0 ("staging: hikey9xx: split hi6421v600 irq into a separate driver") Cc: Mauro Carvalho Chehab Cc: Greg Kroah-Hartman Cc: Arnd Bergmann Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20211004001641.23180-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 8241fffae7c8bab5cec5fc8bcaceccd03079e3aa Author: Konstantin Komarov Date: Tue Sep 28 20:04:10 2021 +0300 fs/ntfs3: Forbid FALLOC_FL_PUNCH_HOLE for normal files FALLOC_FL_PUNCH_HOLE isn't allowed with normal files. Filesystem must remember info about hole, but for normal file we can only zero it and forget. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Now xfstests generic/016 generic/021 generic/022 pass. Signed-off-by: Konstantin Komarov commit f9a470db2736b01538ad193c316eb3f26be37d58 Author: Srinivas Kandagatla Date: Wed Sep 22 16:43:26 2021 +0100 misc: fastrpc: Add missing lock before accessing find_vma() fastrpc driver is using find_vma() without any protection, as a result we see below warning due to recent patch 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()") which added mmap_assert_locked() in find_vma() function. This bug went un-noticed in previous versions. Fix this issue by adding required protection while calling find_vma(). CPU: 0 PID: 209746 Comm: benchmark_model Not tainted 5.15.0-rc2-00445-ge14fe2bf817a-dirty #969 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : find_vma+0x64/0xd0 lr : find_vma+0x60/0xd0 sp : ffff8000158ebc40 ... Call trace: find_vma+0x64/0xd0 fastrpc_internal_invoke+0x570/0xda8 fastrpc_device_ioctl+0x3e0/0x928 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x44/0x100 el0_svc_common.constprop.3+0x70/0xf8 do_el0_svc+0x24/0x88 el0_svc+0x3c/0x138 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20210922154326.8927-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 42641042c10c757fe10cc09088cf3f436cec5007 Author: Arnd Bergmann Date: Mon Sep 27 14:13:57 2021 +0200 cb710: avoid NULL pointer subtraction clang-14 complains about an unusual way of converting a pointer to an integer: drivers/misc/cb710/sgbuf2.c:50:15: error: performing pointer subtraction with a null pointer has undefined behavior [-Werror,-Wnull-pointer-subtraction] return ((ptr - NULL) & 3) != 0; Replace this with a normal cast to uintptr_t. Fixes: 5f5bac8272be ("mmc: Driver for CB710/720 memory card reader (MMC part)") Cc: stable Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210927121408.939246-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit a3e16937319aea285c64ab5bf8464470afac8dd3 Author: Mark Brown Date: Thu Sep 23 20:46:09 2021 +0100 misc: gehc: Add SPI ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding a SPI ID table entry for the device name part of the compatible - currently only the full compatible is listed which isn't very idiomatic and won't match the modalias that is generated. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Cc: stable Tested-by: Martyn Welch Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210923194609.52647-1-broonie@kernel.org Signed-off-by: Greg Kroah-Hartman commit 34186b48d29bb961b24ece417170e74289550a13 Author: Arnd Bergmann Date: Mon Sep 27 16:53:25 2021 +0200 ARM: sharpsl_param: work around -Wstringop-overread warning gcc warns that accessing a pointer based on a numeric constant may be an offset into a NULL pointer, and would therefore has zero accessible bytes: arch/arm/common/sharpsl_param.c: In function ‘sharpsl_save_param’: arch/arm/common/sharpsl_param.c:43:9: error: ‘memcpy’ reading 64 bytes from a region of size 0 [-Werror=stringop-overread] 43 | memcpy(&sharpsl_param, param_start(PARAM_BASE), sizeof(struct sharpsl_param_info)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In this particular case, the warning is bogus since this is the actual pointer, not an offset on a NULL pointer. Add a local variable to shut up the warning and hope it doesn't come back. Signed-off-by: Arnd Bergmann Acked-by: Daniel Mack Cc: Daniel Mack Cc: Haojian Zhuang Cc: Robert Jarzmik Cc: Russell King Cc: Linus Walleij Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 Link: https://lore.kernel.org/r/20210927145332.2784005-1-arnd@kernel.org' Signed-off-by: Arnd Bergmann commit efa767b37229775fc09a4f5a2b27f72a79afa860 Merge: a6949059318a0 c54467482ffd4 Author: Arnd Bergmann Date: Tue Oct 5 15:41:15 2021 +0200 Merge tag 'imx-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.15: - Revert cc8870bf4c3a to fix the regression on i.MX6 that suspend support becomes broken. - Add `qca,clk-out-frequency` property to fix Ethernet support on imx6qdl-pico board. - Re-enable FB support in imx_v6_v7_defconfig. It gets lost due to f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB"). - Fix LP5562 LED support on imx6dl-yapp4 board. - Add missing pinctrl-names for panel on M53Menlo board. - Fix USB host power regulator polarity on M53Menlo board. * tag 'imx-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx_v6_v7_defconfig: enable fb ARM: dts: imx6qdl-pico: Fix Ethernet support ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo Revert "ARM: imx6q: drop of_platform_default_populate() from init_machine" ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe Link: https://lore.kernel.org/r/20210923063356.GK13480@dragon Signed-off-by: Arnd Bergmann commit a6949059318a064880050c76a9d8fb070156385f Author: Linus Walleij Date: Wed Sep 22 22:09:33 2021 +0200 ARM: defconfig: gemini: Restore framebuffer The framebuffer is gone on the D-Link DIR-685, restore it. Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") Signed-off-by: Linus Walleij Cc: Kees Cook Link: https://lore.kernel.org/r/20210922200933.1825752-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit b9af50bcbcd2344640e4c2937bd2af1f856a4ced Author: Arnd Bergmann Date: Mon Sep 27 11:53:33 2021 +0200 ARM: dove: mark 'putc' as inline This can cause a randconfig warning without the 'inline' flag that every other platform uses: In file included from arch/arm/boot/compressed/misc.c:29: arch/arm/mach-dove/include/mach/uncompress.h:14:13: error: 'putc' defined but not used [-Werror=unused-function] 14 | static void putc(const char c) | ^~~~ Signed-off-by: Arnd Bergmann Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20210927095343.1015422-1-arnd@kernel.org' Signed-off-by: Arnd Bergmann commit 94ad8aacbc2d4908b052c8bdb5ae13bc702f77ea Author: Arnd Bergmann Date: Mon Sep 27 16:40:50 2021 +0200 ARM: omap1: move omap15xx local bus handling to usb.c Commit 38225f2ef2f4 ("ARM/omap1: switch to use dma_direct_set_offset for lbus DMA offsets") removed a lot of mach/memory.h, but left the USB offset handling split into arch/arm/mach-omap1/usb.c and drivers/usb/host/ohci-omap.c. This can cause a randconfig build warning that now fails the build with -Werror: arch/arm/mach-omap1/usb.c:561:30: error: 'omap_1510_usb_ohci_nb' defined but not used [-Werror=unused-variable] 561 | static struct notifier_block omap_1510_usb_ohci_nb = { | ^~~~~~~~~~~~~~~~~~~~~ Move it all into the platform file to get rid of the final location that relies on mach/memory.h. Acked-by: Felipe Balbi Acked-by: Alan Stern Acked-by: Tony Lindgren Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20210927144118.2464881-1-arnd@kernel.org' Signed-off-by: Arnd Bergmann commit cff32466bf851bf29cd491d8a3cbeb4dc4a36ab6 Author: Konstantin Komarov Date: Fri Sep 24 17:53:56 2021 +0300 fs/ntfs3: Refactoring of ntfs_set_ea Make code more readable. Don't try to read zero bytes. Add warning when size of exteneded attribute exceeds limit. Signed-off-by: Konstantin Komarov commit d81e06be921f90d5f1bada59d4549ca6f1bedc61 Author: Konstantin Komarov Date: Fri Sep 24 17:50:22 2021 +0300 fs/ntfs3: Remove locked argument in ntfs_set_ea We always need to lock now, because locks became smaller (see d562e901f25d "fs/ntfs3: Move ni_lock_dir and ni_unlock into ntfs_create_inode"). Signed-off-by: Konstantin Komarov commit b1e0c55a409955aba2d5a151f3f3a8bda8e45193 Author: Konstantin Komarov Date: Fri Sep 24 17:47:04 2021 +0300 fs/ntfs3: Use available posix_acl_release instead of ntfs_posix_acl_release We don't need to maintain ntfs_posix_acl_release. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 6147eb53bb80a8d12f1c9de4e3474bc9524053ec Merge: 04e0ae8d2b96a 4382c73a12b4c Author: Arnd Bergmann Date: Tue Oct 5 15:38:03 2021 +0200 Merge tag 'qcom-drivers-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v5.15 This restricts the QCOM_SCM driver to depend on ARCH_QCOM, to reduce it's presence after becoming a loadable module. It then fixes a regression in the mdt_loader, where firmware with the hash segment marked as PT_LOAD would no longer be accepted, preventing several MSM8974 and SDM660 devices from loading remoteproc firmware. Lastly it corrects the drvdata associated with the socinfo device during probe, to match that expected by the remove function. * tag 'qcom-drivers-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: firmware: qcom_scm: QCOM_SCM should depend on ARCH_QCOM soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment soc: qcom: socinfo: Fixed argument passed to platform_set_data() Link: https://lore.kernel.org/r/20210930025456.1035-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 04e0ae8d2b96a3d992e1024b215071c61e45512f Merge: 2ecfddb105b68 1878f4b7ec9ed Author: Arnd Bergmann Date: Tue Oct 5 15:37:02 2021 +0200 Merge tag 'qcom-arm64-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DTS fixes for 5.15 This starts by reverting the SC7280 CPUfreq update, which was merged before concensus about the associated drivers changes was reached. It then moves the reserved-memory changes done to get IPA working on the Lenovo Yoga C630 into the Yoga specific DTS, as changing the memory map on the platform level did break a couple of the other boards. It fixes the HDMI audio on Trogdor and add missing Aggre2 NOC qos clocks on SDM6{30,36,60} which prevented some boards from booting. Lastly it enables the PON module on SM8250/QRB5165, as the lack thereof is blocking automated testing in LKFT. * tag 'qcom-arm64-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sdm630: Add missing a2noc qos clocks arm64: dts: qcom: qrb5165-rb5: enabled pwrkey and resin nodes arm64: dts: qcom: pm8150: specify reboot mode magics arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding arm64: dts: qcom: sc7180-trogdor: Fix lpass dai link for HDMI arm64: dts: qcom: sdm850-yoga: Reshuffle IPA memory mappings Revert "arm64: dts: qcom: sc7280: Fixup the cpufreq node" Link: https://lore.kernel.org/r/20210930025509.1091-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 2ecfddb105b6815c4baee7055b137667ff0b26f6 Merge: c147392b652b6 319aeaf69c85d Author: Arnd Bergmann Date: Tue Oct 5 15:36:02 2021 +0200 Merge tag 'juno-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Juno/Vexpress fixes for v5.15 Bunch of DTS fixes to resolve addressing issues with some of the device nodes, dropping unused/undocumented properties in various nodes, and aligning node names with dtschema. * tag 'juno-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm: dts: vexpress: Fix motherboard bus 'interrupt-map' arm: dts: vexpress: Fix addressing issues with 'motherboard-bus' nodes arm: dts: vexpress-v2p-ca9: Fix the SMB unit-address arm: dts: vexpress: Drop unused properties from motherboard node arm64: dts: arm: drop unused interrupt-names in MHU ARM: dts: arm: align watchdog and mmc node names with dtschema arm64: dts: arm: align watchdog and mmc node names with dtschema arm64: dts: fvp: Remove panel timings Link: https://lore.kernel.org/r/20210927105249.3583380-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit c147392b652b6af7d96f1f844a4938a6bb4921b8 Merge: 325c81e3fd52c ecf5b34cd5182 Author: Arnd Bergmann Date: Tue Oct 5 15:33:31 2021 +0200 Merge tag 'qcom-dts-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm DTS fixes for v5.15 This corrects the use of depricated chipid and clock names, for which support was finally dropped from the driver. It also ensures that the DSI PLL is fed by the correct clock, now that it's being migrated to not rely on global clock names. * tag 'qcom-dts-fixes-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: apq8064: update Adreno clock names ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference ARM: dts: qcom: apq8064: use compatible which contains chipid Link: https://lore.kernel.org/r/20210930025526.1146-1-bjorn.andersson@linaro.org Signed-off-by: Arnd Bergmann commit 325c81e3fd52cb4dce1f5e7cc789bc82f2772ab2 Merge: dd6a2ed801db6 dbe68bc9e82b6 Author: Arnd Bergmann Date: Tue Oct 5 15:32:30 2021 +0200 Merge tag 'at91-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes #2 for 5.15: - More fixes for AT91 platform power management code related to the introduction of sama7g5: - management of DDR3L regulator rails for sama7g5ek - loading of TLB on different cores - PIO controller slew-rate settings for sama7g5ek: be aligned with datasheet requirements. * tag 'at91-fixes-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama7g5ek: to not touch slew-rate for SDMMC pins ARM: dts: at91: sama7g5ek: use proper slew-rate settings for GMACs ARM: at91: pm: preload base address of controllers in tlb ARM: at91: pm: group constants and addresses loading ARM: dts: at91: sama7g5ek: add suspend voltage for ddr3l rail Link: https://lore.kernel.org/r/20211004114344.19304-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit dd6a2ed801db6afde68330cb529cf78550b7a937 Author: Nishanth Menon Date: Wed Sep 15 07:13:08 2021 -0500 MAINTAINERS: Add Vignesh to TI K3 platform maintainership Add Vignesh to TI K3 platform maintainership. We will rotate roles for each kernel version to help spread the work load a little better. Signed-off-by: Nishanth Menon Link: https://lore.kernel.org/r/20210915121308.26795-1-nm@ti.com' Signed-off-by: Arnd Bergmann commit f81fd21476187275b0d8181fbe8c18a6f47d9139 Merge: d0c624c03012e 88a3856c0a8c0 Author: Arnd Bergmann Date: Tue Oct 5 15:30:43 2021 +0200 Merge tag 'optee-fix-for-v5.15' of git://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fix OP-TEE shm_pool lint warning * tag 'optee-fix-for-v5.15' of git://git.linaro.org/people/jens.wiklander/linux-tee: tee/optee/shm_pool: fix application of sizeof to pointer Link: https://lore.kernel.org/r/20210915113813.GA509196@jade Signed-off-by: Arnd Bergmann commit cb2282213e84f04ab7e93fd4537815da5db2f010 Author: Johan Hovold Date: Fri Sep 24 16:12:32 2021 +0200 serial: 8250: allow disabling of Freescale 16550 compile test The SERIAL_8250_FSL option is used to enable a workaround for a break-detection erratum for Freescale 16550 UARTs in the 8250 driver and is currently also used to enable support for ACPI enumeration. It is enabled on PPC, ARM and ARM64 whenever 8250 console support is enabled (since the quirk is needed for sysrq handling). Commit b1442c55ce89 ("serial: 8250: extend compile-test coverage") enabled compile testing of the code in question but did not provide a means to disable the option when COMPILE_TEST is enabled. Add a conditional input prompt instead so that SERIAL_8250_FSL is no longer enabled by default when compile testing while continuing to always enable the quirk for platforms that may need it. Fixes: b1442c55ce89 ("serial: 8250: extend compile-test coverage") Reported-by: Geert Uytterhoeven Signed-off-by: Johan Hovold Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20210924141232.4419-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6e6a8ef088e1222cb1250942f51ad9c1ab219ab2 Author: Quentin Perret Date: Tue Oct 5 13:20:31 2021 +0100 KVM: arm64: Release mmap_lock when using VM_SHARED with MTE VM_SHARED mappings are currently forbidden in a memslot with MTE to prevent two VMs racing to sanitise the same page. However, this check is performed while holding current->mm's mmap_lock, but fails to release it. Fix this by releasing the lock when needed. Fixes: ea7fc1bb1cd1 ("KVM: arm64: Introduce MTE VM feature") Signed-off-by: Quentin Perret Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20211005122031.809857-1-qperret@google.com commit 7707a4d01a648e4c655101a469c956cb11273655 Author: Eric Dumazet Date: Mon Oct 4 14:24:15 2021 -0700 netlink: annotate data races around nlk->bound While existing code is correct, KCSAN is reporting a data-race in netlink_insert / netlink_sendmsg [1] It is correct to read nlk->bound without a lock, as netlink_autobind() will acquire all needed locks. [1] BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0: netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597 netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842 netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 ___sys_sendmsg net/socket.c:2446 [inline] __sys_sendmsg+0x1ed/0x270 net/socket.c:2475 __do_sys_sendmsg net/socket.c:2484 [inline] __se_sys_sendmsg net/socket.c:2482 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1: netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] __sys_sendto+0x2a8/0x370 net/socket.c:2019 __do_sys_sendto net/socket.c:2031 [inline] __se_sys_sendto net/socket.c:2027 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2027 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00 -> 0x01 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: da314c9923fe ("netlink: Replace rhash_portid with bound") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit e3cf002d5a4452f8adc5543df341cf96fd702fcf Author: Wong Vee Khee Date: Tue Oct 5 11:45:21 2021 +0800 net: pcs: xpcs: fix incorrect CL37 AN sequence According to Synopsys DesignWare Cores Ethernet PCS databook, it is required to disable Clause 37 auto-negotiation by programming bit-12 (AN_ENABLE) to 0 if it is already enabled, before programming various fields of VR_MII_AN_CTRL registers. After all these programming are done, it is then required to enable Clause 37 auto-negotiation by programming bit-12 (AN_ENABLE) to 1. Fixes: b97b5331b8ab ("net: pcs: add C37 SGMII AN support for intel mGbE controller") Cc: Vladimir Oltean Signed-off-by: Wong Vee Khee Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Signed-off-by: David S. Miller commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 Author: Sean Anderson Date: Mon Oct 4 17:50:02 2021 -0400 net: sfp: Fix typo in state machine debug string The string should be "tx_disable" to match the state enum. Fixes: 4005a7cb4f55 ("net: phy: sftp: print debug message with text, not numbers") Signed-off-by: Sean Anderson Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit beb76cb4eebf9ac4ff15312e33f97db621b46da7 Author: Lukas Bulwahn Date: Tue Oct 5 09:54:50 2021 +0200 MAINTAINERS: rectify entry for SY8106A REGULATOR DRIVER Commit b1c36aae51c9 ("regulator: Convert SY8106A binding to a schema") converts sy8106a-regulator.txt to silergy,sy8106a.yaml, but missed to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in SY8106A REGULATOR DRIVER. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20211005075451.29691-11-lukas.bulwahn@gmail.com Signed-off-by: Mark Brown commit 7615c2a514788559c6684234b8fc27f3a843c2c6 Author: Quentin Perret Date: Tue Oct 5 10:01:42 2021 +0100 KVM: arm64: Report corrupted refcount at EL2 Some of the refcount manipulation helpers used at EL2 are instrumented to catch a corrupted state, but not all of them are treated equally. Let's make things more consistent by instrumenting hyp_page_ref_dec_and_test() as well. Acked-by: Will Deacon Suggested-by: Will Deacon Signed-off-by: Quentin Perret Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20211005090155.734578-6-qperret@google.com commit 1d58a17ef54599506d44c45ac95be27273a4d2b1 Author: Quentin Perret Date: Tue Oct 5 10:01:41 2021 +0100 KVM: arm64: Fix host stage-2 PGD refcount The KVM page-table library refcounts the pages of concatenated stage-2 PGDs individually. However, when running KVM in protected mode, the host's stage-2 PGD is currently managed by EL2 as a single high-order compound page, which can cause the refcount of the tail pages to reach 0 when they shouldn't, hence corrupting the page-table. Fix this by introducing a new hyp_split_page() helper in the EL2 page allocator (matching the kernel's split_page() function), and make use of it from host_s2_zalloc_pages_exact(). Fixes: 1025c8c0c6ac ("KVM: arm64: Wrap the host with a stage 2") Acked-by: Will Deacon Suggested-by: Will Deacon Signed-off-by: Quentin Perret Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20211005090155.734578-5-qperret@google.com commit 58fc1daa4d2e9789b9ffc880907c961ea7c062cc Author: Johan Hovold Date: Wed Sep 29 11:09:37 2021 +0200 USB: cdc-acm: fix break reporting A recent change that started reporting break events forgot to push the event to the line discipline, which meant that a detected break would not be reported until further characters had been receive (the port could even have been closed and reopened in between). Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") Cc: stable@vger.kernel.org Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210929090937.7410-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 65a205e6113506e69a503b61d97efec43fc10fd7 Author: Johan Hovold Date: Wed Sep 29 11:09:36 2021 +0200 USB: cdc-acm: fix racy tty buffer accesses A recent change that started reporting break events to the line discipline caused the tty-buffer insertions to no longer be serialised by inserting events also from the completion handler for the interrupt endpoint. Completion calls for distinct endpoints are not guaranteed to be serialised. For example, in case a host-controller driver uses bottom-half completion, the interrupt and bulk-in completion handlers can end up running in parallel on two CPUs (high-and low-prio tasklets, respectively) thereby breaking the tty layer's single producer assumption. Fix this by holding the read lock also when inserting characters from the bulk endpoint. Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") Cc: stable@vger.kernel.org Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210929090937.7410-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0560c9c552c1815e7b480bc11fd785fefc82bb27 Author: Pavel Hofman Date: Fri Sep 24 10:00:27 2021 +0200 usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize Async feedback patches broke enumeration on Windows 10 previously fixed by commit 789ea77310f0 ("usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot"). While the existing calculation for EP OUT capture for async mode yields size+1 frame due to uac2_opts->fb_max > 0, playback side lost the +1 feature. Therefore the +1 frame addition must be re-introduced for playback. Win10 enumerates the device only when both EP IN and EP OUT max packet sizes are (at least) +1 frame. Fixes: e89bb4288378 ("usb: gadget: u_audio: add real feedback implementation") Cc: stable Tested-by: Henrik Enquist Tested-by: Jack Pham Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20210924080027.5362-1-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman commit 04d2b75537085cb0c85d73a2e0e50317bffa883f Author: Rikard Falkeborn Date: Wed Sep 29 21:45:46 2021 +0200 usb: cdc-wdm: Fix check for WWAN CONFIG_WWAN_CORE was with CONFIG_WWAN in commit 89212e160b81 ("net: wwan: Fix WWAN config symbols"), but did not update all users of it. Change it back to use CONFIG_WWAN instead. Fixes: 89212e160b81 ("net: wwan: Fix WWAN config symbols") Cc: Signed-off-by: Rikard Falkeborn Acked-by: Oliver Neukum Link: https://lore.kernel.org/r/20210929194547.46954-2-rikard.falkeborn@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8253a34bfae3278baca52fc1209b7c29270486ca Author: Fabio Estevam Date: Tue Sep 21 08:37:54 2021 -0300 usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle When passing 'phys' in the devicetree to describe the USB PHY phandle (which is the recommended way according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the following NULL pointer dereference is observed on i.MX7 and i.MX8MM: [ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 [ 1.498170] Mem abort info: [ 1.500966] ESR = 0x96000044 [ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.509356] SET = 0, FnV = 0 [ 1.512416] EA = 0, S1PTW = 0 [ 1.515569] FSC = 0x04: level 0 translation fault [ 1.520458] Data abort info: [ 1.523349] ISV = 0, ISS = 0x00000044 [ 1.527196] CM = 0, WnR = 1 [ 1.530176] [0000000000000098] user address but active_mm is swapper [ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 1.542125] Modules linked in: [ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3 [ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT) [ 1.557133] Workqueue: events_unbound deferred_probe_work_func [ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) [ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510 [ 1.573973] lr : imx7d_charger_detection+0x22c/0x510 This happens because the charger functions check for the phy presence inside the imx_usbmisc_data structure (data->usb_phy), but the chipidea core populates the usb_phy passed via 'phys' inside 'struct ci_hdrc' (ci->usb_phy) instead. This causes the NULL pointer dereference inside imx7d_charger_detection(). Fix it by also searching for 'phys' in case 'fsl,usbphy' is not found. Tested on a imx7s-warp board. Fixes: 746f316b753a ("usb: chipidea: introduce imx7d USB charger detection") Cc: stable@vger.kernel.org Reported-by: Heiko Thiery Tested-by: Frieder Schrempf Reviewed-by: Frieder Schrempf Acked-by: Peter Chen Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20210921113754.767631-1-festevam@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6d91017a295e9790eec02c4e43f020cdb55f5d98 Author: Xu Yang Date: Tue Sep 28 19:16:39 2021 +0800 usb: typec: tcpm: handle SRC_STARTUP state if cc changes TCPM for DRP should do the same action as SRC_ATTACHED when cc changes in SRC_STARTUP state. Otherwise, TCPM will transition to SRC_UNATTACHED state which is not satisfied with the Type-C spec. Per Type-C spec: DRP port should move to Unattached.SNK instead of Unattached.SRC if sink removed. Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") cc: Reviewed-by: Guenter Roeck Acked-by: Heikki Krogerus Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20210928111639.3854174-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 05300871c0e21c288bd5c30ac6f9b1da6ddeed22 Author: Xu Yang Date: Sun Sep 26 18:14:15 2021 +0800 usb: typec: tcpci: don't handle vSafe0V event if it's not enabled USB TCPCI Spec, 4.4.3 Mask Registers: "A masked register will still indicate in the ALERT register, but shall not set the Alert# pin low." Thus, the Extended Status will still indicate in ALERT register if vSafe0V is detected by TCPC even though being masked. In current code, howerer, this event will not be handled in detection time. Rather it will be handled when next ALERT event coming(CC evnet, PD event, etc). Tcpm might transition to a wrong state in this situation. Thus, the vSafe0V event should not be handled when it's masked. Fixes: 766c485b86ef ("usb: typec: tcpci: Add support to report vSafe0V") cc: Reviewed-by: Guenter Roeck Acked-by: Heikki Krogerus Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20210926101415.3775058-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit b87d8d0d4c43c29ccdc57d15b2ebc1df886a34b4 Author: Heikki Krogerus Date: Thu Sep 30 15:47:58 2021 +0300 usb: typec: tipd: Remove dependency on "connector" child fwnode There is no "connector" child node available on every platform, so the driver can't fail to probe when it's missing. Fixes: 57560ee95cb7 ("usb: typec: tipd: Don't block probing of consumer of "connector" nodes") Cc: stable@vger.kernel.org # 5.14+ Reported-by: "Regupathy, Rajaram" Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20210930124758.23233-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 Author: Eric Dumazet Date: Mon Oct 4 12:55:22 2021 -0700 net/sched: sch_taprio: properly cancel timer from taprio_destroy() There is a comment in qdisc_create() about us not calling ops->reset() in some cases. err_out4: /* * Any broken qdiscs that would require a ops->reset() here? * The qdisc was never in action so it shouldn't be necessary. */ As taprio sets a timer before actually receiving a packet, we need to cancel it from ops->destroy, just in case ops->reset has not been called. syzbot reported: ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22 WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Modules linked in: CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc9000130f330 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020 R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000 FS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __debug_check_no_obj_freed lib/debugobjects.c:987 [inline] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018 slab_free_hook mm/slub.c:1603 [inline] slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653 slab_free mm/slub.c:3213 [inline] kfree+0xe4/0x540 mm/slub.c:4267 qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299 tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403 ___sys_sendmsg+0xf3/0x170 net/socket.c:2457 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") Signed-off-by: Eric Dumazet Cc: Davide Caratti Reported-by: syzbot Acked-by: Vinicius Costa Gomes Acked-by: Davide Caratti Signed-off-by: David S. Miller commit 4d1aa9112c8e6995ef2c8a76972c9671332ccfea Author: Ben Hutchings Date: Tue Sep 21 16:34:42 2021 +0200 Partially revert "usb: Kconfig: using select for USB_COMMON dependency" This reverts commit cb9c1cfc86926d0e86d19c8e34f6c23458cd3478 for USB_LED_TRIG. This config symbol has bool type and enables extra code in usb_common itself, not a separate driver. Enabling it should not force usb_common to be built-in! Fixes: cb9c1cfc8692 ("usb: Kconfig: using select for USB_COMMON dependency") Cc: stable Signed-off-by: Ben Hutchings Signed-off-by: Salvatore Bonaccorso Link: https://lore.kernel.org/r/20210921143442.340087-1-carnil@debian.org Signed-off-by: Greg Kroah-Hartman commit 268bbde716e3a79a747a0f4ebbeb9f63d861737d Author: Andy Shevchenko Date: Mon Oct 4 17:18:39 2021 +0300 usb: dwc3: gadget: Revert "set gadgets parent to the right controller" The commit c6e23b89a95d ("usb: dwc3: gadget: set gadgets parent to the right controller") changed the device for the UDC and broke the user space scripts that instantiate the USB gadget(s) via ConfigFS. Revert it for now until the better solution will be proposed. Fixes: c6e23b89a95d ("usb: dwc3: gadget: set gadgets parent to the right controller") Tested-by: Ferry Toth Cc: Michael Grzeschik Cc: Felipe Balbi Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20211004141839.49079-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 64506cb92833b313cbc7f19ad51b0850e0972984 Merge: baf33d7a75642 0854a0513321c Author: David S. Miller Date: Tue Oct 5 12:39:19 2021 +0100 Merge branch 'bridge-fixes' Eric Dumazet says: ==================== net: bridge: br_get_linkxstats_size() fixes This patch series attempts to fix the following syzbot report. WARNING: CPU: 1 PID: 21425 at net/core/rtnetlink.c:5388 rtnl_stats_get+0x80f/0x8c0 net/core/rtnetlink.c:5388 Modules linked in: CPU: 1 PID: 21425 Comm: syz-executor394 Not tainted 5.13.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:rtnl_stats_get+0x80f/0x8c0 net/core/rtnetlink.c:5388 Code: e9 9c fc ff ff 4c 89 e7 89 0c 24 e8 ab 8b a8 fa 8b 0c 24 e9 bc fc ff ff 4c 89 e7 e8 9b 8b a8 fa e9 df fe ff ff e8 61 85 63 fa <0f> 0b e9 f7 fc ff ff 41 be ea ff ff ff e9 f9 fc ff ff 41 be 97 ff RSP: 0018:ffffc9000cf77688 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000012c RCX: 0000000000000000 RDX: ffff8880211754c0 RSI: ffffffff8711571f RDI: 0000000000000003 RBP: ffff8880175aa780 R08: 00000000ffffffa6 R09: ffff88823bd5c04f R10: ffffffff87115413 R11: 0000000000000001 R12: ffff8880175aab74 R13: ffff8880175aab40 R14: 00000000ffffffa6 R15: 0000000000000006 FS: 0000000001ff9300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005cfd58 CR3: 000000002cd43000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4440d9 ==================== Signed-off-by: David S. Miller commit 0854a0513321cf70bea5fa483ebcaa983cc7c62e Author: Eric Dumazet Date: Mon Oct 4 18:05:08 2021 -0700 net: bridge: fix under estimation in br_get_linkxstats_size() Commit de1799667b00 ("net: bridge: add STP xstats") added an additional nla_reserve_64bit() in br_fill_linkxstats(), but forgot to update br_get_linkxstats_size() accordingly. This can trigger the following in rtnl_stats_get() WARN_ON(err == -EMSGSIZE); Fixes: de1799667b00 ("net: bridge: add STP xstats") Signed-off-by: Eric Dumazet Cc: Vivien Didelot Cc: Nikolay Aleksandrov Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 Author: Eric Dumazet Date: Mon Oct 4 18:05:07 2021 -0700 net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() bridge_fill_linkxstats() is using nla_reserve_64bit(). We must use nla_total_size_64bit() instead of nla_total_size() for corresponding data structure. Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink") Signed-off-by: Eric Dumazet Cc: Nikolay Aleksandrov Cc: Vivien Didelot Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 3ea75b3f57e5b2837b980a2cbcf014773d00ae51 Author: Arnd Bergmann Date: Tue Oct 5 13:20:28 2021 +0200 usb: xhci: tegra: mark PM functions as __maybe_unused The added #ifdefs in the PM rework were almost correct, but still cause warnings in some randconfig builds: drivers/usb/host/xhci-tegra.c:2147:12: error: 'tegra_xusb_resume' defined but not used [-Werror=unused-function] 2147 | static int tegra_xusb_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~ drivers/usb/host/xhci-tegra.c:2105:12: error: 'tegra_xusb_suspend' defined but not used [-Werror=unused-function] 2105 | static int tegra_xusb_suspend(struct device *dev) Replace the #ifdef checks with simpler __maybe_unused annotations to reliably shut up these warnings. Link: https://lore.kernel.org/all/20210421135613.3560777-2-arnd@kernel.org/ Fixes: 971ee247060d ("usb: xhci: tegra: Enable ELPG for runtime/system PM") Reviewed-by: JC Kuo Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20211005112057.2700888-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit baf33d7a75642b4b38a87fdf1cd96b506df4849f Author: Hayes Wang Date: Mon Oct 4 14:28:58 2021 +0800 r8152: avoid to resubmit rx immediately For the situation that the disconnect event comes very late when the device is unplugged, the driver would resubmit the RX bulk transfer after getting the callback with -EPROTO immediately and continually. Finally, soft lockup occurs. This patch avoids to resubmit RX immediately. It uses a workqueue to schedule the RX NAPI. And the NAPI would resubmit the RX. It let the disconnect event have opportunity to stop the submission before soft lockup. Reported-by: Jason-ch Chen Tested-by: Jason-ch Chen Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 3f6cffb8604b537e3d7ea040d7f4368689638eaf Author: Jakub Kicinski Date: Mon Oct 4 16:01:40 2021 -0700 etherdevice: use __dev_addr_set() Andrew points out that eth_hw_addr_set() replaces memcpy() calls so we can't use ether_addr_copy() which assumes both arguments are 2-bytes aligned. Reported-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 38fa3206bf441911258e5001ac8b6738693f8d82 Author: Zhang Jianhua Date: Thu Sep 23 10:53:40 2021 +0800 efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() While reboot the system by sysrq, the following bug will be occur. BUG: sleeping function called from invalid context at kernel/locking/semaphore.c:90 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 10052, name: rc.shutdown CPU: 3 PID: 10052 Comm: rc.shutdown Tainted: G W O 5.10.0 #1 Call trace: dump_backtrace+0x0/0x1c8 show_stack+0x18/0x28 dump_stack+0xd0/0x110 ___might_sleep+0x14c/0x160 __might_sleep+0x74/0x88 down_interruptible+0x40/0x118 virt_efi_reset_system+0x3c/0xd0 efi_reboot+0xd4/0x11c machine_restart+0x60/0x9c emergency_restart+0x1c/0x2c sysrq_handle_reboot+0x1c/0x2c __handle_sysrq+0xd0/0x194 write_sysrq_trigger+0xbc/0xe4 proc_reg_write+0xd4/0xf0 vfs_write+0xa8/0x148 ksys_write+0x6c/0xd8 __arm64_sys_write+0x18/0x28 el0_svc_common.constprop.3+0xe4/0x16c do_el0_svc+0x1c/0x2c el0_svc+0x20/0x30 el0_sync_handler+0x80/0x17c el0_sync+0x158/0x180 The reason for this problem is that irq has been disabled in machine_restart() and then it calls down_interruptible() in virt_efi_reset_system(), which would occur sleep in irq context, it is dangerous! Commit 99409b935c9a("locking/semaphore: Add might_sleep() to down_*() family") add might_sleep() in down_interruptible(), so the bug info is here. down_trylock() can solve this problem, cause there is no might_sleep. -------- Cc: Signed-off-by: Zhang Jianhua Signed-off-by: Ard Biesheuvel commit b3a72ca80351917cc23f9e24c35f3c3979d3c121 Author: Ard Biesheuvel Date: Wed Sep 1 08:33:19 2021 +0200 efi/cper: use stack buffer for error record decoding Joe reports that using a statically allocated buffer for converting CPER error records into human readable text is probably a bad idea. Even though we are not aware of any actual issues, a stack buffer is clearly a better choice here anyway, so let's move the buffer into the stack frames of the two functions that refer to it. Cc: Reported-by: Joe Perches Signed-off-by: Ard Biesheuvel commit 68c9cdf37a0456b7ba25a50b1ea8794f305da17f Author: Heinrich Schuchardt Date: Sun Aug 29 15:23:10 2021 +0200 efi/libstub: Simplify "Exiting bootservices" message The message "Exiting boot services and installing virtual address map...\n" is even shown if we have efi=novamap on the command line or the firmware does not provide EFI_RT_SUPPORTED_SET_VIRTUAL_ADDRESS_MAP. To avoid confusion just print "Exiting boot services...\n" Signed-off-by: Heinrich Schuchardt Signed-off-by: Ard Biesheuvel commit 37f12202c5d28291ba5f83ce229771447ce9148f Author: Dan Carpenter Date: Thu Sep 30 15:26:04 2021 +0300 staging: r8188eu: prevent array underflow in rtw_hal_update_ra_mask() The problem is that "mac_id" is a u32 so this check for underflow does not work when "mac_id" is zero. In that situation, "mac_id - 1" is UINT_MAX instead of -1 so the condition is true. It leads to an array underflow on the next line. Fixes: 8cd574e6af54 ("staging: r8188eu: introduce new hal dir for RTL8188eu driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210930122604.GB10068@kili Signed-off-by: Greg Kroah-Hartman commit 7ff4034e910fe00a90d985f0d05bacf60c162f02 Author: Arnd Bergmann Date: Mon Sep 27 13:36:56 2021 +0200 staging: vc04_services: shut up out-of-range warning The comparison against SIZE_MAX produces a harmless warning on 64-bit architectures: drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:185:16: error: result of comparison of constant 419244183493398898 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if (num_pages > (SIZE_MAX - sizeof(struct pagelist) - ~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Shut up that warning by adding a cast to a longer type. Fixes: ca641bae6da9 ("staging: vc04_services: prevent integer overflow in create_pagelist()") Cc: stable Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210927113702.3866843-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3ad60b4b3570937f3278509fe6797a5093ce53f8 Author: Paweł Anikiel Date: Mon Sep 20 14:41:41 2021 +0200 reset: socfpga: add empty driver allowing consumers to probe The early reset driver doesn't ever probe, which causes consuming devices to be unable to probe. Add an empty driver to set this device as available, allowing consumers to probe. Signed-off-by: Paweł Anikiel Link: https://lore.kernel.org/r/20210920124141.1166544-4-pan@semihalf.com Signed-off-by: Philipp Zabel commit 5c0522484eb54b90f2e46a5db8d7a4ff3ff86e5d Author: David Howells Date: Thu Aug 12 23:08:54 2021 +0100 afs: Fix afs_launder_page() to set correct start file position Fix afs_launder_page() to set the starting position of the StoreData RPC at the offset into the page at which the modified data starts instead of at the beginning of the page (the iov_iter is correctly offset). The offset got lost during the conversion to passing an iov_iter into afs_store_data(). Changes: ver #2: - Use page_offset() rather than manually calculating it[1]. Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/YST/0e92OdSH0zjg@casper.infradead.org/ [1] Link: https://lore.kernel.org/r/162880783179.3421678.7795105718190440134.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/162937512409.1449272.18441473411207824084.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/162981148752.1901565.3663780601682206026.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/163005741670.2472992.2073548908229887941.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/163221839087.3143591.14278359695763025231.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/163292980654.4004896.7134735179887998551.stgit@warthog.procyon.org.uk/ # v2 commit 330de47d14af0c3995db81cc03cf5ca683d94d81 Author: David Howells Date: Mon Jul 26 10:37:57 2021 +0100 netfs: Fix READ/WRITE confusion when calling iov_iter_xarray() Fix netfs_clear_unread() to pass READ to iov_iter_xarray() instead of WRITE (the flag is about the operation accessing the buffer, not what sort of access it is doing to the buffer). Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers") Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com cc: linux-afs@lists.infradead.org cc: ceph-devel@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: v9fs-developer@lists.sourceforge.net cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Link: https://lore.kernel.org/r/162729351325.813557.9242842205308443901.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/162886603464.3940407.3790841170414793899.stgit@warthog.procyon.org.uk Link: https://lore.kernel.org/r/163239074602.1243337.14154704004485867017.stgit@warthog.procyon.org.uk commit a0e25f0a0d39d66c048d5dbac1e7ebaa6ec885d7 Author: Dave Wysochanski Date: Sun Oct 3 12:14:00 2021 -0400 cachefiles: Fix oops with cachefiles_cull() due to NULL object When cachefiles_cull() calls cachefiles_bury_object(), it passes a NULL object. When this occurs, either trace_cachefiles_unlink() or trace_cachefiles_rename() may oops due to the NULL object. Check for NULL object in the tracepoint and if so, set debug_id to MAX_UINT as was done in 2908f5e101e3. The following oops was seen with xfstests generic/100. BUG: kernel NULL pointer dereference, address: 0000000000000010 ... RIP: 0010:trace_event_raw_event_cachefiles_unlink+0x4e/0xa0 [cachefiles] ... Call Trace: cachefiles_bury_object+0x242/0x430 [cachefiles] ? __vfs_removexattr_locked+0x10f/0x150 ? vfs_removexattr+0x51/0xd0 cachefiles_cull+0x84/0x120 [cachefiles] cachefiles_daemon_cull+0xd1/0x120 [cachefiles] cachefiles_daemon_write+0x158/0x190 [cachefiles] vfs_write+0xbc/0x260 ksys_write+0x4f/0xc0 do_syscall_64+0x3b/0x90 The following oops was seen with xfstests generic/290. BUG: kernel NULL pointer dereference, address: 0000000000000010 ... RIP: 0010:trace_event_raw_event_cachefiles_rename+0x54/0xa0 [cachefiles] ... Call Trace: cachefiles_bury_object+0x35c/0x430 [cachefiles] cachefiles_cull+0x84/0x120 [cachefiles] cachefiles_daemon_cull+0xd1/0x120 [cachefiles] cachefiles_daemon_write+0x158/0x190 [cachefiles] vfs_write+0xbc/0x260 ksys_write+0x4f/0xc0 do_syscall_64+0x3b/0x90 Fixes: 2908f5e101e3 ("fscache: Add a cookie debug ID and use that in traces") Signed-off-by: Dave Wysochanski Signed-off-by: David Howells Link: https://listman.redhat.com/archives/linux-cachefs/2021-October/msg00009.html commit eb7b52e6db7c21400b9b2d539f9343fb6e94bd94 Author: Sudeep Holla Date: Fri Sep 24 10:28:59 2021 +0100 firmware: arm_ffa: Fix __ffa_devices_unregister When arm_ffa firmware driver module is unloaded or removed we call __ffa_devices_unregister on all the devices on the ffa bus. It must unregister all the devices instead it is currently just releasing the devices without unregistering. That is pure wrong as when we try to load the module back again, it will result in the kernel crash something like below. -->8 CPU: 2 PID: 232 Comm: modprobe Not tainted 5.15.0-rc2+ #169 Hardware name: FVP Base RevC (DT) Call trace: dump_backtrace+0x0/0x1cc show_stack+0x18/0x64 dump_stack_lvl+0x64/0x7c dump_stack+0x18/0x38 sysfs_create_dir_ns+0xe4/0x140 kobject_add_internal+0x170/0x358 kobject_add+0x94/0x100 device_add+0x178/0x5f0 device_register+0x20/0x30 ffa_device_register+0x80/0xcc [ffa_module] ffa_setup_partitions+0x7c/0x108 [ffa_module] init_module+0x290/0x2dc [ffa_module] do_one_initcall+0xbc/0x230 do_init_module+0x58/0x304 load_module+0x15e0/0x1f68 __arm64_sys_finit_module+0xb8/0xf4 invoke_syscall+0x44/0x140 el0_svc_common+0xb4/0xf0 do_el0_svc+0x24/0x80 el0_svc+0x20/0x50 el0t_64_sync_handler+0x84/0xe4 el0t_64_sync+0x1a0/0x1a4 kobject_add_internal failed for arm-ffa-8001 with -EEXIST, don't try to register things with the same name in the same directory. ---- Fix the issue by calling device_unregister in __ffa_devices_unregister which will also take care of calling device_release(which is mapped to ffa_release_device) Link: https://lore.kernel.org/r/20210924092859.3057562-2-sudeep.holla@arm.com Fixes: e781858488b9 ("firmware: arm_ffa: Add initial FFA bus support for device enumeration") Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla commit 244f5d597e1ea519c2085fbd9819458688775e42 Author: Sudeep Holla Date: Fri Sep 24 10:28:58 2021 +0100 firmware: arm_ffa: Add missing remove callback to ffa_bus_type Currently the arm_ffa firmware driver can be built as module and hence all the users of FFA driver. If any driver on the ffa bus is removed or unregistered, the remove callback on all the device bound to the driver being removed should be callback. For that to happen, we must register a remove callback on the ffa_bus which is currently missing. This results in the probe getting called again without the previous remove callback on a device which may result in kernel crash. Fix the issue by registering the remove callback on the FFA bus. Link: https://lore.kernel.org/r/20210924092859.3057562-1-sudeep.holla@arm.com Fixes: e781858488b9 ("firmware: arm_ffa: Add initial FFA bus support for device enumeration") Reported-by: Jens Wiklander Tested-by: Jens Wiklander Signed-off-by: Sudeep Holla commit 85a877801618adc1312e4d5a6c844482c3e4b913 Merge: 5816b3e6577ea 26d90b5590579 Author: Greg Kroah-Hartman Date: Tue Oct 5 11:20:52 2021 +0200 Merge tag 'iio-fixes-for-5.15a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next Jonathan writes: 1st set of IIO fixes for the 5.15 cycle Usual mixed back of minor bug fixes. adi,ad7192, ad7780, ad7793 * Fix incorrect IRQ_FLAG types. As the IRQ line is shared with the data line we can be sure of the polarity and edge like nature. They were previously either left unspecified or as level interrupts which may cause problems on power up. adi,adis16475 * Fix a deadlock by calling unlocked function when lock already held. Also deal with making sure lock is released correctly. adi,adis16480 * Fix assumption that all devices support sleep mode. aspeed,adc * Add missing platform_set_drvdata() so we can get the indio_dev in remove as was being assumed. fsl,fxls8962af * Return IRQ_HANDLED on flush rather than a positive 'error' code. maxim,max1207 * Fix a wrong shift on 12-bit devices that will lead to incorrect scale. * Fix wrong number of channels on max1X31 devices due to allocating them twice. mediatek,mt6577 * Fix a failure to apply scaling to IIO_CHAN_INFO_PROCESSED renesas,rzg2l * Fix failure to return -EBUSY on timeout due to ignored error code. * Add a missing clk_disable_unprepare() on error in runtime_resume. samsung,ssp_spi * Fix an error code to always be returned on invalid length. * Add some range checking to ensure resilience against bad data leading to potential overflow. ti,adc128s052 * Fix an error handling path that leaves regulator on if probe fails. ti,dac5571 * Add missing return value in a switch default. ti,opt3001 * Fix case where sensor returns 0 lux and we were previously accidentally returning that this was a timeout. * tag 'iio-fixes-for-5.15a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: light: opt3001: Fixed timeout error when 0 lux iio: adis16480: fix devices that do not support sleep mode iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED iio: adis16475: fix deadlock on frequency set iio: ssp_sensors: add more range checking in ssp_parse_dataframe() iio: ssp_sensors: fix error code in ssp_print_mcu_debug() iio: adc: ad7793: Fix IRQ flag iio: adc: ad7780: Fix IRQ flag iio: adc: ad7192: Add IRQ flag iio: adc: aspeed: set driver data when adc probe. iio: adc: rzg2l_adc: add missing clk_disable_unprepare() in rzg2l_adc_pm_runtime_resume() iio: adc: max1027: Fix the number of max1X31 channels iio: adc: max1027: Fix wrong shift with 12-bit devices iio: adc128s052: Fix the error handling path of 'adc128_probe()' iio: adc: rzg2l_adc: Fix -EBUSY timeout error return iio: accel: fxls8962af: return IRQ_HANDLED when fifo is flushed iio: dac: ti-dac5571: fix an error code in probe() commit c045ceb5a145d2a9a4bf33cbc55185ddf99f60ab Author: Mikko Perttunen Date: Wed Sep 15 11:55:14 2021 +0300 reset: tegra-bpmp: Handle errors in BPMP response The return value from tegra_bpmp_transfer indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code. Add code to do this. Signed-off-by: Mikko Perttunen Link: https://lore.kernel.org/r/20210915085517.1669675-2-mperttunen@nvidia.com Signed-off-by: Philipp Zabel commit b2d73debfdc16b742e64948dc4461876af3f8c10 Author: Ville Syrjälä Date: Thu Sep 30 22:09:42 2021 +0300 drm/i915: Extend the async flip VT-d w/a to skl/bxt Looks like skl/bxt/derivatives also need the plane stride stretch w/a when using async flips and VT-d is enabled, or else we get corruption on screen. To my surprise this was even documented in bspec, but only as a note on the CHICHKEN_PIPESL register description rather than on the w/a list. So very much the same thing as on HSW/BDW, except the bits moved yet again. Cc: stable@vger.kernel.org Cc: Karthik B S Fixes: 55ea1cb178ef ("drm/i915: Enable async flips in i915") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20210930190943.17547-1-ville.syrjala@linux.intel.com Reviewed-by: Matt Roper (cherry picked from commit d08df3b0bdb25546e86dc9a6c4e3ec0c43832299) Signed-off-by: Jani Nikula commit fdddf8c3a477f77b3a623f220e78d45e89fc50d5 Author: Lukasz Majczak Date: Thu Sep 30 15:46:06 2021 +0200 drm/i915/bdb: Fix version check With patch "drm/i915/vbt: Fix backlight parsing for VBT 234+" the size of bdb_lfp_backlight_data structure has been increased, causing if-statement in the parse_lfp_backlight function that comapres this structure size to the one retrieved from BDB, always to fail for older revisions. This patch calculates expected size of the structure for a given BDB version and compares it with the value gathered from BDB. Tested on Chromebook Pixelbook (Nocturne) (reports bdb->version = 221) Fixes: d381baad29b4 ("drm/i915/vbt: Fix backlight parsing for VBT 234+") Tested-by: Lukasz Majczak Signed-off-by: Lukasz Majczak Reviewed-by: José Roberto de Souza Signed-off-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20210930134606.227234-1-lma@semihalf.com (cherry picked from commit 4378daf5d04eed59724e6d0e74755e17dce2e105) Signed-off-by: Jani Nikula commit a532cde31de3cae6ed60e60d6f9379771f652809 Author: Imre Deak Date: Wed Sep 29 16:28:27 2021 +0300 drm/i915/tc: Fix TypeC port init/resume time sanitization Atm during driver loading and system resume TypeC ports are accessed before their HW/SW state is synced. Move the TypeC port sanitization to the encoder's sync_state hook to fix this. v2: Handle the encoder disabled case in gen11_dsi_sync_state() as well (Jose, Jani) Fixes: f9e76a6e68d3 ("drm/i915: Add an encoder hook to sanitize its state during init/resume") Cc: José Roberto de Souza Cc: Ville Syrjälä Signed-off-by: Imre Deak Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20210929132833.2253961-1-imre.deak@intel.com (cherry picked from commit 7194dc998dfffca096c30b3cd39625158608992d) Signed-off-by: Jani Nikula commit 0c94777386495d6e0a9735d48ffd2abb8d680d7f Author: Maarten Lankhorst Date: Wed Jul 28 14:41:31 2021 +0200 drm/i915: Fix runtime pm handling in i915_gem_shrink We forgot to call intel_runtime_pm_put on error, fix it! Signed-off-by: Maarten Lankhorst Fixes: cf41a8f1dc1e ("drm/i915: Finally remove obj->mm.lock.") Cc: Thomas Hellström Cc: Daniel Vetter Cc: # v5.13+ Reviewed-by: Thomas Hellström Reviewed-by: Niranjana Vishwanathapura Link: https://patchwork.freedesktop.org/patch/msgid/20210830121006.2978297-9-maarten.lankhorst@linux.intel.com (cherry picked from commit 239f3c2ee18376587026efecaea5250fa5926d20) Signed-off-by: Jani Nikula commit ffac30be2a06b2516b2ce2afa2dcb2cf8af65a52 Author: Kai-Heng Feng Date: Mon Sep 6 12:12:59 2021 +0800 drm/i915/audio: Use BIOS provided value for RKL HDA link Commit 989634fb49ad ("drm/i915/audio: set HDA link parameters in driver") makes HDMI audio on Lenovo P350 disappear. So in addition to TGL, extend the logic to RKL to use BIOS provided value to fix the regression. Fixes: 989634fb49ad ("drm/i915/audio: set HDA link parameters in driver") Reviewed-by: Kai Vehmanen Signed-off-by: Kai-Heng Feng Link: https://patchwork.freedesktop.org/patch/msgid/20210906041300.508458-1-kai.heng.feng@canonical.com (cherry picked from commit c6b40ee330fe09b332715bb7ec1467e4fcbe2e65) Signed-off-by: Jani Nikula commit 4af160707d7197d671a5b0ad9899383b6cb7c067 Author: Geert Uytterhoeven Date: Tue Sep 14 11:15:59 2021 +0200 reset: pistachio: Re-enable driver selection After the retirement of MACH_PISTACHIO, the Pistachio Reset Driver is no longer auto-enabled when building a kernel for Pistachio systems. Worse, the driver cannot be enabled by the user at all (unless compile-testing), as the config symbol is invisible. Fix this partially by making the symbol visible again when compiling for MIPS, and dropping the useless default. The user still has to enable the driver manually when building a kernel for Pistachio systems, though. Fixes: 104f942b2832ab13 ("MIPS: Retire MACH_PISTACHIO") Signed-off-by: Geert Uytterhoeven Reviewed-by: Rahul Bedarkar Reviewed-by: Jiaxun Yang Link: https://lore.kernel.org/r/2c399e52540536df9c4006e46ef93fbccdde88db.1631610825.git.geert+renesas@glider.be Signed-off-by: Philipp Zabel commit f33eb7f29c16ba78db3221ee02346fd832274cdd Author: Jim Quinlan Date: Tue Sep 14 15:11:21 2021 -0700 reset: brcmstb-rescal: fix incorrect polarity of status bit The readl_poll_timeout() should complete when the status bit is a 1, not 0. Fixes: 4cf176e52397 ("reset: Add Broadcom STB RESCAL reset controller") Signed-off-by: Jim Quinlan Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20210914221122.62315-1-f.fainelli@gmail.com Signed-off-by: Philipp Zabel commit 5aec98913095ed3b4424ed6c5fdeb6964e9734da Author: Kailang Yang Date: Tue Oct 5 14:35:14 2021 +0800 ALSA: hda/realtek - ALC236 headset MIC recording issue In power save mode, the recording voice from headset mic will 2s more delay. Add this patch will solve this issue. [ minor coding style fix by tiwai ] Signed-off-by: Kailang Yang Tested-by: Kai-Heng Feng Cc: Link: https://lore.kernel.org/r/ccb0cdd5bbd7486eabbd8d987d384cb0@realtek.com Signed-off-by: Takashi Iwai commit 9c11112c0ec7ec322cd495320c3ab9fa8bdc1bbc Author: Jan Beulich Date: Thu Sep 30 14:21:13 2021 +0200 xen/x86: adjust data placement Both xen_pvh and xen_start_flags get written just once early during init. Using the respective annotation then allows the open-coded placing in .data to go away. Additionally the former, like the latter, wants exporting, or else xen_pvh_domain() can't be used from modules. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/8155ed26-5a1d-c06f-42d8-596d26e75849@suse.com Signed-off-by: Juergen Gross commit 59f7e5374175ce5d776efeb12a1e61cd6b1f82fb Author: Jan Beulich Date: Thu Sep 30 14:20:42 2021 +0200 x86/PVH: adjust function/data placement Two of the variables can live in .init.data, allowing the open-coded placing in .data to go away. Another "variable" is used to communicate a size value only to very early assembly code, which hence can be both const and live in .init.*. Additionally two functions were lacking __init annotations. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/3b0bb22e-43f4-e459-c5cb-169f996b5669@suse.com Signed-off-by: Juergen Gross commit 079c4baa2aad05e8007faa24b2411c1457f60d74 Author: Jan Beulich Date: Thu Sep 30 14:19:48 2021 +0200 xen/x86: hook up xen_banner() also for PVH This was effectively lost while dropping PVHv1 code. Move the function and arrange for it to be called the same way as done in PV mode. Clearly this then needs re-introducing the XENFEAT_mmu_pt_update_preserve_ad check that was recently removed, as that's a PV-only feature. Since the string pointed at by pv_info.name describes the mode, drop "paravirtualized" from the log message while moving the code. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/de03054d-a20d-2114-bb86-eec28e17b3b8@suse.com Signed-off-by: Juergen Gross commit 4d1ab432acc9391a5ae13c629dbb5882c29fd1b0 Author: Jan Beulich Date: Thu Sep 30 14:19:16 2021 +0200 xen/x86: generalize preferred console model from PV to PVH Dom0 Without announcing hvc0 as preferred it won't get used as long as tty0 gets registered earlier. This is particularly problematic with there not being any screen output for PVH Dom0 when the screen is in graphics mode, as the necessary information doesn't get conveyed yet from the hypervisor. Follow PV's model, but be conservative and do this for Dom0 only for now. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/582328b6-c86c-37f3-d802-5539b7a86736@suse.com Signed-off-by: Juergen Gross commit 42bc9716bc1df21b55b303fe243f8575b3af24f9 Author: Jan Beulich Date: Thu Sep 30 14:18:45 2021 +0200 xen/x86: make "earlyprintk=xen" work for HVM/PVH DomU xenboot_write_console() is dealing with these quite fine so I don't see why xenboot_console_setup() would return -ENOENT in this case. Adjust documentation accordingly. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/3d212583-700e-8b2d-727a-845ef33ac265@suse.com Signed-off-by: Juergen Gross commit 8e24d9bfc44d3bd884669ef8b344112fe41c9826 Author: Jan Beulich Date: Thu Sep 30 14:18:12 2021 +0200 xen/x86: allow "earlyprintk=xen" to work for PV Dom0 With preferred consoles "tty" and "hvc" announced as preferred, registering "xenboot" early won't result in use of the console: It also needs to be registered as preferred. Generalize this from being DomU- only so far. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/d4a34540-a476-df2c-bca6-732d0d58c5f0@suse.com Signed-off-by: Juergen Gross commit adf330a7cd64a8bb959dc48a9c282285c1d5b4d5 Author: Jan Beulich Date: Thu Sep 30 14:17:41 2021 +0200 xen/x86: make "earlyprintk=xen" work better for PVH Dom0 The xen_hvm_early_write() path better wouldn't be taken in this case; while port 0xE9 can be used, the hypercall path is quite a bit more efficient. Put that first, as it may also work for DomU-s (see also xen_raw_console_write()). While there also bail from the function when the first domU_write_console() failed - later ones aren't going to succeed. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/4fd89dcb-cfc5-c740-2e94-bb271e432d3e@suse.com Signed-off-by: Juergen Gross commit cae7d81a3730dfe08623f8c1083230c8d0987639 Author: Jan Beulich Date: Thu Sep 30 14:16:47 2021 +0200 xen/x86: allow PVH Dom0 without XEN_PV=y Decouple XEN_DOM0 from XEN_PV, converting some existing uses of XEN_DOM0 to a new XEN_PV_DOM0. (I'm not convinced all are really / should really be PV-specific, but for starters I've tried to be conservative.) For PVH Dom0 the hypervisor populates MADT with only x2APIC entries, so without x2APIC support enabled in the kernel things aren't going to work very well. (As opposed, DomU-s would only ever see LAPIC entries in MADT as of now.) Note that this then requires PVH Dom0 to be 64-bit, as X86_X2APIC depends on X86_64. In the course of this xen_running_on_version_or_later() needs to be available more broadly. Move it from a PV-specific to a generic file, considering that what it does isn't really PV-specific at all anyway. Note that xen/interface/version.h cannot be included on its own; in enlighten.c, which uses SCHEDOP_* anyway, include xen/interface/sched.h first to resolve the apparently sole missing type (xen_ulong_t). Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/983bb72f-53df-b6af-14bd-5e088bd06a08@suse.com Signed-off-by: Juergen Gross commit 9172b5c4a778da1f855b2e3780b1afabb3cfd523 Author: Jan Beulich Date: Thu Sep 30 14:16:15 2021 +0200 xen/x86: prevent PVH type from getting clobbered Like xen_start_flags, xen_domain_type gets set before .bss gets cleared. Hence this variable also needs to be prevented from getting put in .bss, which is possible because XEN_NATIVE is an enumerator evaluating to zero. Any use prior to init_hvm_pv_info() setting the variable again would lead to wrong decisions; one such case is xenboot_console_setup() when called as a result of "earlyprintk=xen". Use __ro_after_init as more applicable than either __section(".data") or __read_mostly. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/d301677b-6f22-5ae6-bd36-458e1f323d0b@suse.com Signed-off-by: Juergen Gross commit 3518441dda666696707afe933586151c0fb29db0 Author: Tim Harvey Date: Mon Oct 4 15:23:41 2021 -0700 arm64: dts: imx8m*-venice-gw7902: fix M2_RST# gpio Fix invalid M2_RST# gpio pinmux. Fixes: ef484dfcf6f7 ("arm64: dts: imx: Add i.mx8mm/imx8mn Gateworks gw7902 dts support") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 97315723c463679a9ecf803d6479fca24c3efda0 Author: Jan Beulich Date: Wed Sep 22 12:18:25 2021 +0200 xen/privcmd: drop "pages" parameter from xen_remap_pfn() The function doesn't use it and all of its callers say in a comment that their respective arguments are to be non-NULL only in auto-translated mode. Since xen_remap_domain_mfn_array() isn't supposed to be used by non-PV, drop the parameter there as well. It was bogusly passed as non- NULL (PRIV_VMA_LOCKED) by its only caller anyway. For xen_remap_domain_gfn_range(), otoh, it's not clear at all why this wouldn't want / might not need to gain auto-translated support down the road, so the parameter is retained there despite now remaining unused (and the only caller passing NULL); correct a respective comment as well. Signed-off-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/036ad8a2-46f9-ac3d-6219-bdc93ab9e10b@suse.com Signed-off-by: Juergen Gross commit e11423d6721dd63b23fb41ade5e8d0b448b17780 Author: Jan Beulich Date: Wed Sep 22 12:17:48 2021 +0200 xen/privcmd: fix error handling in mmap-resource processing xen_pfn_t is the same size as int only on 32-bit builds (and not even on Arm32). Hence pfns[] can't be used directly to read individual error values returned from xen_remap_domain_mfn_array(); every other error indicator would be skipped/ignored on 64-bit. Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE") Cc: stable@vger.kernel.org Signed-off-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/aa6d6a67-6889-338a-a910-51e889f792d5@suse.com Signed-off-by: Juergen Gross commit 0432523f4807a83902857347bd73eb817ef0a742 Author: Jan Beulich Date: Wed Sep 22 12:16:35 2021 +0200 xen/privcmd: replace kcalloc() by kvcalloc() when allocating empty pages Osstest has been suffering test failures for a little while from order-4 allocation failures, resulting from alloc_empty_pages() calling kcalloc(). As there's no need for physically contiguous space here, switch to kvcalloc(). Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/6d698901-98a4-05be-c421-bcd0713f5335@suse.com Signed-off-by: Juergen Gross commit 783f3db030563f7bcdfe2d26428af98ea1699a8e Author: Oleksij Rempel Date: Tue Sep 28 15:49:40 2021 +0200 ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence Any pending interrupt can prevent entering standby based power off state. To avoid it, disable the GIC CPU interface. Fixes: 8148d2136002 ("ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set") Signed-off-by: Oleksij Rempel Signed-off-by: Shawn Guo commit 5963e5262180129f1be7556bd96994b6e52f3178 Author: Takashi Iwai Date: Mon Oct 4 09:40:50 2021 +0200 ALSA: usb-audio: Enable rate validation for Scarlett devices The Scarlett device series from Focusrite Novation seem requiring the sample rate validations as we've done for MOTU devices; otherwise the driver probes invalid audioformat entries that contain the sample rates that actually don't work, and this may result in an incomplete setup as reported recently. This patch adds the needed quirk flag for enabling the sample rate validation for Focusrite Novation devices. Fixes: fe773b8711e3 ("ALSA: usb-audio: workaround for iface reset issue") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214493 Link: https://lore.kernel.org/r/20211004074050.28241-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 258aad75c62146453d03028a44f2f1590d58e1f6 Author: Mike Christie Date: Mon Oct 4 16:06:08 2021 -0500 scsi: iscsi: Fix iscsi_task use after free Commit d39df158518c ("scsi: iscsi: Have abort handler get ref to conn") added iscsi_get_conn()/iscsi_put_conn() calls during abort handling but then also changed the handling of the case where we detect an already completed task where we now end up doing a goto to the common put/cleanup code. This results in a iscsi_task use after free, because the common cleanup code will do a put on the iscsi_task. This reverts the goto and moves the iscsi_get_conn() to after we've checked if the iscsi_task is valid. Link: https://lore.kernel.org/r/20211004210608.9962-1-michael.christie@oracle.com Fixes: d39df158518c ("scsi: iscsi: Have abort handler get ref to conn") Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen commit 69a3a7bc7239170557dfc2c4ad5786a0c3d8759a Author: James Smart Date: Mon Oct 4 16:12:10 2021 -0700 scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling When an FC-GS I/O is aborted by lpfc, the driver requires a node pointer for a dereference operation. In the abort I/O routine, the driver miscasts a context pointer to the wrong data type and overwrites a single byte outside of the allocated space. This miscast is done in the abort I/O function handler because the handler works on both FC-GS and FC-LS commands. However, the code neglected to get the correct job location for the node. Fix this by acquiring the necessary node pointer from the correct job structure depending on the I/O type. Link: https://lore.kernel.org/r/20211004231210.35524-1-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit a013c71c6315d6e9d6364d12251b98c75c9a2861 Author: Dan Carpenter Date: Mon Oct 4 13:38:51 2021 +0300 scsi: elx: efct: Delete stray unlock statement It's not holding the lock at this stage and the IRQ "flags" are not correct so it would restore something bogus. Delete the unlock statement. Link: https://lore.kernel.org/r/20211004103851.GE25015@kili Fixes: 3e6414003bf9 ("scsi: elx: efct: SCSI I/O handling routines") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit f5ef336fd2e4c36dedae4e7ca66cf5349d6fda62 Author: Adrian Hunter Date: Wed Sep 22 12:10:59 2021 +0300 scsi: ufs: core: Fix task management completion The UFS driver uses blk_mq_tagset_busy_iter() when identifying task management requests to complete, however blk_mq_tagset_busy_iter() doesn't work. blk_mq_tagset_busy_iter() only iterates requests dispatched by the block layer. That appears as if it might have started since commit 37f4a24c2469 ("blk-mq: centralise related handling into blk_mq_get_driver_tag") which removed 'data->hctx->tags->rqs[rq->tag] = rq' from blk_mq_rq_ctx_init() which gets called: blk_get_request blk_mq_alloc_request __blk_mq_alloc_request blk_mq_rq_ctx_init Since UFS task management requests are not dispatched by the block layer, hctx->tags->rqs[rq->tag] remains NULL, and since blk_mq_tagset_busy_iter() relies on finding requests using hctx->tags->rqs[rq->tag], UFS task management requests are never found by blk_mq_tagset_busy_iter(). By using blk_mq_tagset_busy_iter(), the UFS driver was relying on internal details of the block layer, which was fragile and subsequently got broken. Fix by removing the use of blk_mq_tagset_busy_iter() and having the driver keep track of task management requests. Link: https://lore.kernel.org/r/20210922091059.4040-1-adrian.hunter@intel.com Fixes: 1235fc569e0b ("scsi: ufs: core: Fix task management request completion timeout") Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs") Cc: stable@vger.kernel.org Tested-by: Bart Van Assche Reviewed-by: Bart Van Assche Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit c5336400ca8b5f83123d965ce1eb9ac4a604cc95 Author: John Garry Date: Thu Sep 30 19:51:57 2021 +0800 scsi: acornscsi: Remove scsi_cmd_to_tag() reference Commit 756fb6a895af ("scsi: acornscsi: Remove tagged queuing vestiges") mistakenly introduced a reference to function scsi_cmd_to_tag(). This function does not exist as it was removed from an earlier series version when I upstreamed the named commit - originally authored By Hannes - but this reference still remained. Fix by replacing the reference to scsi_cmd_to_tag() with scsi_cmd_to_rq(scsi_scmd)->tag, which scsi_cmd_to_tag() was a wrapper for. Link: https://lore.kernel.org/r/1633002717-79765-1-git-send-email-john.garry@huawei.com Fixes: 756fb6a895af ("scsi: acornscsi: Remove tagged queuing vestiges") Reported-by: Arnd Bergmann Tested-by: Arnd Bergmann Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit bb8958d5dc79acbd071397abb57b8756375fe1ce Author: Alexandre Ghiti Date: Sat Sep 18 18:02:21 2021 +0200 riscv: Flush current cpu icache before other cpus On SiFive Unmatched, I recently fell onto the following BUG when booting: [ 0.000000] ftrace: allocating 36610 entries in 144 pages [ 0.000000] Oops - illegal instruction [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5 [ 0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT) [ 0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae [ 0.000000] ra : __sbi_rfence_v02+0xc8/0x10a [ 0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10 [ 0.000000] gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000 [ 0.000000] t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60 [ 0.000000] s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10 [ 0.000000] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.000000] a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43 [ 0.000000] s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000 [ 0.000000] s5 : 0000000000000000 s6 : 0000000200000100 s7 : 0000000000000001 [ 0.000000] s8 : ffffffe07fe04040 s9 : ffffffff81a22c80 s10: 0000000000001000 [ 0.000000] s11: 0000000000000004 t3 : 0000000000000001 t4 : 0000000000000008 [ 0.000000] t5 : ffffffcf04000808 t6 : ffffffe3ffddf188 [ 0.000000] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000002 [ 0.000000] [] riscv_cpuid_to_hartid_mask+0x6/0xae [ 0.000000] [] sbi_remote_fence_i+0x1e/0x26 [ 0.000000] [] flush_icache_all+0x12/0x1a [ 0.000000] [] patch_text_nosync+0x26/0x32 [ 0.000000] [] ftrace_init_nop+0x52/0x8c [ 0.000000] [] ftrace_process_locs.isra.0+0x29c/0x360 [ 0.000000] [] ftrace_init+0x80/0x130 [ 0.000000] [] start_kernel+0x5c4/0x8f6 [ 0.000000] ---[ end trace f67eb9af4d8d492b ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- While ftrace is looping over a list of addresses to patch, it always failed when patching the same function: riscv_cpuid_to_hartid_mask. Looking at the backtrace, the illegal instruction is encountered in this same function. However, patch_text_nosync, after patching the instructions, calls flush_icache_range. But looking at what happens in this function: flush_icache_range -> flush_icache_all -> sbi_remote_fence_i -> __sbi_rfence_v02 -> riscv_cpuid_to_hartid_mask The icache and dcache of the current cpu are never synchronized between the patching of riscv_cpuid_to_hartid_mask and calling this same function. So fix this by flushing the current cpu's icache before asking for the other cpus to do the same. Signed-off-by: Alexandre Ghiti Fixes: fab957c11efe ("RISC-V: Atomic and Locking Code") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 9246320672be813b5d653bb8b1b4e4206503ece9 Merge: 5155cf7b6aaef 59a4e0d5511ba Author: Palmer Dabbelt Date: Mon Oct 4 16:02:04 2021 -0700 Merge remote-tracking branch 'palmer/riscv-clone3' into fixes This contains a single patch to properly implement clone3() on rv32, which was missing before. In theory this is a new feature, but it's fixing a warning in checksyscalls that's now causing my build to fail so I'm calling it a fix. commit 59a4e0d5511ba61353ea9a4efdb1b86c23ecf134 Author: Palmer Dabbelt Date: Sat Oct 2 17:21:20 2021 -0700 RISC-V: Include clone3() on rv32 As far as I can tell this should be enabled on rv32 as well, I'm not sure why it's rv64-only. checksyscalls is complaining about our lack of clone3() on rv32. Fixes: 56ac5e213933 ("riscv: enable sys_clone3 syscall for rv64") Signed-off-by: Palmer Dabbelt Reviewed-by: Arnd Bergmann Acked-by: Christian Brauner Signed-off-by: Palmer Dabbelt commit f6274b06e326d8471cdfb52595f989a90f5e888f Merge: 84b3e42564acc 2f9602870886a Author: Linus Torvalds Date: Mon Oct 4 14:33:30 2021 -0700 Merge tag 'linux-kselftest-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "A fix to implicit declaration warns in drivers/dma-buf test" * tag 'linux-kselftest-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: drivers/dma-buf: Fix implicit declaration warns commit ef31499a87cf842bdf6719f44473d93e99d09fe2 Author: David Howells Date: Mon Sep 20 10:33:55 2021 +0100 fscache: Remove an unused static variable The fscache object CREATE_OBJECT work state isn't ever referred to, so remove it and avoid the unused variable warning caused by W=1. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-fsdevel@vger.kernel.org cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/163214005516.2945267.7000234432243167892.stgit@warthog.procyon.org.uk/ # rfc v1 Link: https://lore.kernel.org/r/163281899704.2790286.9177774252843775348.stgit@warthog.procyon.org.uk/ # rfc v2 commit d9e3f82279bfe8419f437a637ff37c075598bd91 Author: David Howells Date: Mon Oct 4 22:08:50 2021 +0100 fscache: Fix some kerneldoc warnings shown up by W=1 Fix some kerneldoc warnings in the fscache driver that are shown up by W=1. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: Mauro Carvalho Chehab cc: linux-fsdevel@vger.kernel.org cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/163214005516.2945267.7000234432243167892.stgit@warthog.procyon.org.uk/ # rfc v1 Link: https://lore.kernel.org/r/163281899704.2790286.9177774252843775348.stgit@warthog.procyon.org.uk/ # rfc v2 commit bc868036569e1d1bc21a5ba110430b03ac0fdb9e Author: David Howells Date: Mon Oct 4 22:07:22 2021 +0100 9p: Fix a bunch of kerneldoc warnings shown up by W=1 Fix a bunch of kerneldoc warnings shown up by W=1 in the 9p filesystem: (1) Add/remove/fix kerneldoc parameters descriptions. (2) Move __add_fid() from between v9fs_fid_add() and its comment. (3) 9p's caches_show() doesn't really make sense as an API function, so remove the kerneldoc annotation. It's also not prefixed with 'v9fs_'. Also remove the kerneldoc markers from the 9p fscache wrappers. Signed-off-by: David Howells Reviewed-by: Dominique Martinet Reviewed-by: Jeff Layton cc: Mauro Carvalho Chehab cc: v9fs-developer@lists.sourceforge.net cc: linux-fsdevel@vger.kernel.org cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/163214005516.2945267.7000234432243167892.stgit@warthog.procyon.org.uk/ # rfc v1 Link: https://lore.kernel.org/r/163281899704.2790286.9177774252843775348.stgit@warthog.procyon.org.uk/ # rfc v2 commit dcb442b133642c507c81da6990860549b19d4e78 Author: David Howells Date: Mon Oct 4 22:04:33 2021 +0100 afs: Fix kerneldoc warning shown up by W=1 Fix a kerneldoc warning in afs due to a partially documented internal function by removing the kerneldoc marker. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/163214005516.2945267.7000234432243167892.stgit@warthog.procyon.org.uk/ # rfc v1 Link: https://lore.kernel.org/r/163281899704.2790286.9177774252843775348.stgit@warthog.procyon.org.uk/ # rfc v2 commit c0b27c4869702bce47b5b4cd5ef6da833b36496d Author: David Howells Date: Mon Oct 4 22:02:01 2021 +0100 nfs: Fix kerneldoc warning shown up by W=1 Fix a kerneldoc warning in nfs due to documentation for a parameter that isn't present. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: Trond Myklebust cc: Anna Schumaker cc: Mauro Carvalho Chehab cc: linux-nfs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/163214005516.2945267.7000234432243167892.stgit@warthog.procyon.org.uk/ # rfc v1 Link: https://lore.kernel.org/r/163281899704.2790286.9177774252843775348.stgit@warthog.procyon.org.uk/ # rfc v2 commit fa1049135c15b4930ce7ea757a81b1b78908f304 Author: Vadim Pasternak Date: Mon Aug 23 17:45:02 2021 +0300 i2c: mlxcpld: Modify register setting for 400KHz frequency Change setting for 400KHz frequency support by more accurate value. Fixes: 66b0c2846ba8 ("i2c: mlxcpld: Add support for I2C bus frequency setting") Signed-off-by: Vadim Pasternak Signed-off-by: Wolfram Sang commit 52f57396c75acd77ebcdf3d20aed24ed248e9f79 Author: Vadim Pasternak Date: Mon Aug 23 17:45:01 2021 +0300 i2c: mlxcpld: Fix criteria for frequency setting Value for getting frequency capability wrongly has been taken from register offset instead of register value. Fixes: 66b0c2846ba8 ("i2c: mlxcpld: Add support for I2C bus frequency setting") Signed-off-by: Vadim Pasternak Signed-off-by: Wolfram Sang commit b2d70c0dbf2731a37d1c7bcc86ab2387954d5f56 Author: Geert Uytterhoeven Date: Fri Sep 24 14:35:12 2021 +0200 dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value make dtbs_check: arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dt.yaml: bridge@2c: reg:0:0: 45 was expected According to the datasheet, the I2C address can be either 0x2c or 0x2d, depending on the ADDR control input. Fixes: e3896e6dddf0b821 ("dt-bindings: drm/bridge: Document sn65dsi86 bridge bindings") Signed-off-by: Geert Uytterhoeven Reviewed-by: Kieran Bingham Link: https://lore.kernel.org/r/08f73c2aa0d4e580303357dfae107d084d962835.1632486753.git.geert+renesas@glider.be Signed-off-by: Rob Herring commit 84b3e42564accd94c2680e3ba42717c32c8b5fc4 Merge: b60be028fc1a0 206704a1fe0bc Author: Linus Torvalds Date: Mon Oct 4 09:53:40 2021 -0700 Merge tag 'media/v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "There's just one patch here, fixing a -Werror issue at staging/atomisp" * tag 'media/v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: atomisp: restore missing 'return' statement commit b60be028fc1a07a88a391aa4ff3304d9dcb3d66e Merge: df5c18838ea82 1dc1eed46f9fa Author: Linus Torvalds Date: Mon Oct 4 09:46:36 2021 -0700 Merge tag 'ovl-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix two bugs, both of them corner cases not affecting most users" * tag 'ovl-fixes-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO ovl: fix missing negative dentry check in ovl_rename() commit df5c18838ea82bd528a09ce1e7fa158e8eba7293 Merge: 9e1ff307c779c 740da9d7ca4e2 Author: Linus Torvalds Date: Mon Oct 4 09:38:55 2021 -0700 Merge tag 'mips-fixes_5.15_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Revert workaround for buggy cpu detection because regressions" * tag 'mips-fixes_5.15_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Revert "add support for buggy MT7621S core detection" commit 206704a1fe0bcaaa036d3e90358bb168fac8bea1 Author: Arnd Bergmann Date: Mon Aug 2 16:38:14 2021 +0200 media: atomisp: restore missing 'return' statement The input_system_configure_channel_sensor() function lost its final return code in a previous patch: drivers/staging/media/atomisp/pci/hive_isp_css_common/host/input_system.c: In function 'input_system_configure_channel_sensor': drivers/staging/media/atomisp/pci/hive_isp_css_common/host/input_system.c:1649:1: error: control reaches end of non-void function [-Werror=return-type] Restore what was there originally. Link: https://lore.kernel.org/linux-media/20210802143820.1150099-1-arnd@kernel.org Fixes: 728a5c64ae5f ("media: atomisp: remove dublicate code") Signed-off-by: Arnd Bergmann Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 1dbdd99b511c966be9147ad72991a2856ac76f22 Author: Johannes Thumshirn Date: Mon Oct 4 16:22:07 2021 +0900 block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs output While debugging an issue we've found that $DEBUGFS/block/$disk/state doesn't decode QUEUE_FLAG_HCTX_ACTIVE but only displays its numerical value. Add QUEUE_FLAG(HCTX_ACTIVE) to the blk_queue_flag_name array so it'll get decoded properly. Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/4351076388918075bd80ef07756f9d2ce63be12c.1633332053.git.johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit b44d52a50bc6f191f0ae03f65de8401f3ef039b3 Author: Andrew Lunn Date: Sun Oct 3 17:50:53 2021 +0200 dsa: tag_dsa: Fix mask for trunked packets A packet received on a trunk will have bit 2 set in Forward DSA tagged frame. Bit 1 can be either 0 or 1 and is otherwise undefined and bit 0 indicates the frame CFI. Masking with 7 thus results in frames as being identified as being from a trunk when in fact they are not. Fix the mask to just look at bit 2. Fixes: 5b60dadb71db ("net: dsa: tag_dsa: Support reception of packets from LAG devices") Signed-off-by: Andrew Lunn Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 8b94aa318aa746fbbc668d6b9b3ad812c835230c Author: Michael Walle Date: Wed Sep 15 22:22:59 2021 +0200 arm64: dts: ls1028a: fix eSDHC2 node On the LS1028A this instance of the eSDHC controller is intended for either an eMMC or eSDIO card. It doesn't provide a card detect pin and its IO voltage is fixed at 1.8V. Remove the bogus broken-cd property, instead add the non-removable property. Fix the voltage-ranges property and set it to 1.8V only. Fixes: 491d3a3fc113 ("arm64: dts: ls1028a: Add esdhc node in dts") Signed-off-by: Michael Walle Signed-off-by: Shawn Guo commit 9786cca4b477f2b2f9d573d474c929d87579b501 Author: Heiko Thiery Date: Wed Sep 15 14:03:26 2021 +0200 arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2 The buck2 output of the PMIC is the VDD core voltage of the cpu. Switching off this will poweroff the CPU. Add the 'regulator-always-on' property to avoid this. Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") Signed-off-by: Heiko Thiery Reviewed-by: Frieder Schrempf Signed-off-by: Shawn Guo commit dbe68bc9e82b6951ff88285ccffc191d872d9a01 Author: Claudiu Beznea Date: Wed Sep 15 10:48:36 2021 +0300 ARM: dts: at91: sama7g5ek: to not touch slew-rate for SDMMC pins With commit c709135e576b ("pinctrl: at91-pio4: add support for slew-rate") and commit cbde6c823bfa ("pinctrl: at91-pio4: Fix slew rate disablement") the slew-rate is enabled by default for each configured pin. The datasheet specifies at chapter "Output Driver AC Characteristics" that HSIO drivers (use in SDMMCx and QSPI0 peripherals), don't have a slewrate setting but are rather calibrated against an external 1% resistor mounted on the SDMMCx_CAL or QSPI0_CAL pins. Depending on the target signal frequency and the external load, it is possible to adjust their target output impedance. Thus set slew-rate = <0> for SDMMC (QSPI is not enabled at the moment in device tree). Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210915074836.6574-3-claudiu.beznea@microchip.com commit 968f6e9d51e2da6eade2afb65629ab87a8a0faf3 Author: Claudiu Beznea Date: Wed Sep 15 10:48:35 2021 +0300 ARM: dts: at91: sama7g5ek: use proper slew-rate settings for GMACs Datasheet chapter "EMAC Timings" specifies that while in 3.3V domain GMAC's MDIO pins should be configured with slew-rate enabled, while the data + signaling pins should be configured with slew-rate disabled when GMAC works in RGMII or RMII modes. The pin controller for SAMA7G5 sets the slew-rate as enabled for all pins. Adapt the device tree to comply with these. Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210915074836.6574-2-claudiu.beznea@microchip.com commit d8d667ee0236dec6d717f27eec690d1324e7f322 Author: Claudiu Beznea Date: Thu Sep 30 18:42:19 2021 +0300 ARM: at91: pm: preload base address of controllers in tlb In suspend/resume procedure for AT91 architecture different controllers (PMC, SHDWC, RAM, RAM PHY, SFRBU) are accessed to do the proper settings for power saving. Commit f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5") introduced the access to RAMC PHY controller for SAMA7G5. The access to this controller is done after RAMC ports are closed, thus any TLB walk necessary for RAMC PHY virtual address will fail. In the development branch this was not encountered. However, on current kernel the issue is reproducible. To solve the issue the previous mechanism of pre-loading the TLB with the RAMC PHY virtual address has been used. However, only the addition of this new pre-load breaks the functionality for ARMv5 based devices (SAM9X60). This behavior has been encountered previously while debugging this code and using the same mechanism for pre-loading address for different controllers (e.g. pin controller, the assumption being that other requested translations are replaced from TLB). To solve this new issue the TLB flush + the extension of pre-loading the rest of controllers to TLB (e.g. PMC, RAMC) has been added. The rest of the controllers should have been pre-loaded previously, anyway. Fixes: f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5") Depends-on: e42cbbe5c9a2 ("ARM: at91: pm: group constants and addresses loading") Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210930154219.2214051-4-claudiu.beznea@microchip.com commit e42cbbe5c9a2a8423db4b1c32ec2a443d4de6323 Author: Claudiu Beznea Date: Thu Sep 30 18:42:18 2021 +0300 ARM: at91: pm: group constants and addresses loading Group constants and addresses loading. This commit prepares the field for the next one. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210930154219.2214051-3-claudiu.beznea@microchip.com commit ef162ac50d5512e51da53b4c971597aabac7ea1f Author: Claudiu Beznea Date: Thu Sep 30 18:42:17 2021 +0300 ARM: dts: at91: sama7g5ek: add suspend voltage for ddr3l rail SAMA7G5-EK board has DDR3L type of memory soldered. This needs 1.35V. The 1.35V for DDR3L rail at run-time is selected by the proper configuration on SELV2 pin (for 1.35V it needs to be in high-z state). When suspended the MCP16502 PMIC soldered on SAMA7G5-EK will use different sets of configuration registers to provide proper voltages on its rail. Run-time configuration registers could be configured differently than suspend configuration register for MCP16502 (VSEL2 affects only run-time configuration). In suspend states the DDR3L memory soldered on SAMA7G5-EK switches to self-refresh. Even on self-refresh it needs to be powered by a 1.35V rail. Thus, make sure the PMIC is configured properly when system is suspended. Fixes: 7540629e2fc7 (ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210930154219.2214051-2-claudiu.beznea@microchip.com commit 410d591a19543f1347bc2b4b4ec3399cb548ba47 Author: Ian Kent Date: Mon Oct 4 09:03:53 2021 +0800 kernfs: don't create a negative dentry if inactive node exists It's been reported that doing stress test for module insertion and removal can result in an ENOENT from libkmod for a valid module. In kernfs_iop_lookup() a negative dentry is created if there's no kernfs node associated with the dentry or the node is inactive. But inactive kernfs nodes are meant to be invisible to the VFS and creating a negative dentry for these can have unexpected side effects when the node transitions to an active state. The point of creating negative dentries is to avoid the expensive alloc/free cycle that occurs if there are frequent lookups for kernfs attributes that don't exist. So kernfs nodes that are not yet active should not result in a negative dentry being created so when they transition to an active state VFS lookups can create an associated dentry is a natural way. It's also been reported that https://github.com/osandov/blktests.git test block/001 hangs during the test. It was suggested that recent changes to blktests might have caused it but applying this patch resolved the problem without change to blktests. Fixes: c7e7c04274b1 ("kernfs: use VFS negative dentry caching") Tested-by: Yi Zhang ACKed-by: Al Viro Signed-off-by: Ian Kent Link: https://lore.kernel.org/r/163330943316.19450.15056895533949392922.stgit@mickey.themaw.net Signed-off-by: Greg Kroah-Hartman commit 2353e593a13ba76c82921940471ce442fe498927 Merge: 7b0035eaa7dab 25b5476a294cd Author: Paolo Bonzini Date: Mon Oct 4 03:58:25 2021 -0400 Merge tag 'kvm-s390-master-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: allow to compile without warning with W=1 commit a46044a92add6a400f4dada7b943b30221f7cc80 Author: Niklas Schnelle Date: Wed Sep 22 15:55:12 2021 +0200 s390/pci: fix zpci_zdev_put() on reserve Since commit 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev") the reference count of a zpci_dev is incremented between pcibios_add_device() and pcibios_release_device() which was supposed to prevent the zpci_dev from being freed while the common PCI code has access to it. It was missed however that the handling of zPCI availability events assumed that once zpci_zdev_put() was called no later availability event would still see the device. With the previously mentioned commit however this assumption no longer holds and we must make sure that we only drop the initial long-lived reference the zPCI subsystem holds exactly once. Do so by introducing a zpci_device_reserved() function that handles when a device is reserved. Here we make sure the zpci_dev will not be considered for further events by removing it from the zpci_list. This also means that the device actually stays in the ZPCI_FN_STATE_RESERVED state between the time we know it has been reserved and the final reference going away. We thus need to consider it a real state instead of just a conceptual state after the removal. The final cleanup of PCI resources, removal from zbus, and destruction of the IOMMU stays in zpci_release_device() to make sure holders of the reference do see valid data until the release. Fixes: 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev") Cc: stable@vger.kernel.org Signed-off-by: Niklas Schnelle Signed-off-by: Vasily Gorbik commit 686cb8b9f6b46787f035afe8fbd132a74e6b1bdd Author: Tiezhu Yang Date: Mon Sep 27 15:06:14 2021 +0800 bpf, s390: Fix potential memory leak about jit_data Make sure to free jit_data through kfree() in the error path. Fixes: 1c8f9b91c456 ("bpf: s390: add JIT support for multi-function programs") Signed-off-by: Tiezhu Yang Acked-by: Ilya Leoshkevich Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit cc03069a397005da24f6783835c274d5aedf6043 Author: Werner Sembach Date: Fri Oct 1 15:31:11 2021 +0200 ALSA: hda/realtek: Add quirk for Clevo X170KM-G This applies a SND_PCI_QUIRK(...) to the Clevo X170KM-G barebone. This fixes the issue of the devices internal Speaker not working. Signed-off-by: Werner Sembach Cc: Link: https://lore.kernel.org/r/20211001133111.428249-3-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab Author: Werner Sembach Date: Fri Oct 1 15:31:10 2021 +0200 ALSA: hda/realtek: Complete partial device name to avoid ambiguity The string "Clevo X170" is not enough to unambiguously identify the correct device. Fixing it so another Clevo barebone name starting with "X170" can be added without causing confusion. Signed-off-by: Werner Sembach Cc: Link: https://lore.kernel.org/r/20211001133111.428249-2-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit ad2b502bc5e65632104ef89372abd6691de8851c Merge: 9e1ff307c779c 4ca57d5139a0b Author: Greg Kroah-Hartman Date: Mon Oct 4 09:22:55 2021 +0200 Merge tag 'misc-habanalabs-fixes-2021-09-29' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux into char-misc-linus Oded writes: This tag contains the following fix for 5.15-rc4: - Prevent memset of ioctl arguments in case driver returns -EINTR * tag 'misc-habanalabs-fixes-2021-09-29' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux: habanalabs: fix resetting args in wait for CS IOCTL commit 04aa946d57b20c40e541fb4ba2bcb390a22f404c Author: Haibo Chen Date: Fri Aug 20 17:29:50 2021 +0800 arm64: dts: imx8: change the spi-nor tx Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), for all PP command, it only support 1-1-1 mode, no matter the tx setting in dts. But after the upper commit, the logic change. It will choose the best mode(fastest mode) which flash device and spi-nor host controller both support. qspi and fspi host controller do not support read 1-4-4 mode. so need to set the tx to 1, let the common code finally select read 1-1-4 mode. Signed-off-by: Haibo Chen Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") Signed-off-by: Shawn Guo commit b2a4f4a302b83976ad0d2930abe0f38e6119a144 Author: Haibo Chen Date: Fri Aug 20 17:29:49 2021 +0800 ARM: dts: imx: change the spi-nor tx Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), for all PP command, it only support 1-1-1 mode, no matter the tx setting in dts. But after the upper commit, the logic change. It will choose the best mode(fastest mode) which flash device and spi-nor host controller both support. Though the spi-nor device on imx6sx-sdb/imx6ul(l/z)-14x14-evk board do not support PP-1-4-4/PP-1-1-4, but if tx is 4 in dts file, it will also impact the read mode selection. For the spi-nor device on the upper mentioned boards, they support read 1-4-4 mode and read 1-1-4 mode according to the device internal sfdp register. But qspi host controller do not support read 1-4-4 mode. so need to set the tx to 1, let the common code finally select read 1-1-4 mode, PP-1-1-1 mode. Signed-off-by: Haibo Chen Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") Signed-off-by: Shawn Guo commit 9e1ff307c779ce1f0f810c7ecce3d95bbae40896 Author: Linus Torvalds Date: Sun Oct 3 14:08:47 2021 -0700 Linux 5.15-rc4 commit 9b2f72cc0aa4bb444541bb87581c35b7508b37d3 Author: Chen Jingwen Date: Tue Sep 28 20:56:57 2021 +0800 elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings In commit b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings") we still leave MAP_FIXED_NOREPLACE in place for load_elf_interp. Unfortunately, this will cause kernel to fail to start with: 1 (init): Uhuuh, elf segment at 00003ffff7ffd000 requested but the memory is mapped already Failed to execute /init (error -17) The reason is that the elf interpreter (ld.so) has overlapping segments. readelf -l ld-2.31.so Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x000000000002c94c 0x000000000002c94c R E 0x10000 LOAD 0x000000000002dae0 0x000000000003dae0 0x000000000003dae0 0x00000000000021e8 0x0000000000002320 RW 0x10000 LOAD 0x000000000002fe00 0x000000000003fe00 0x000000000003fe00 0x00000000000011ac 0x0000000000001328 RW 0x10000 The reason for this problem is the same as described in commit ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments"). Not only executable binaries, elf interpreters (e.g. ld.so) can have overlapping elf segments, so we better drop MAP_FIXED_NOREPLACE and go back to MAP_FIXED in load_elf_interp. Fixes: 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map") Cc: # v4.19 Cc: Andrew Morton Cc: Michal Hocko Signed-off-by: Chen Jingwen Signed-off-by: Linus Torvalds commit ca3cef466feaaf296c8519e2cc5ccf6565e3e7e9 Merge: 7fab1c12bde92 f2c77973507fd Author: Linus Torvalds Date: Sun Oct 3 13:56:53 2021 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix a number of ext4 bugs in fast_commit, inline data, and delayed allocation. Also fix error handling code paths in ext4_dx_readdir() and ext4_fill_super(). Finally, avoid a grabbing a journal head in the delayed allocation write in the common cases where we are overwriting a pre-existing block or appending to an inode" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: recheck buffer uptodate bit under buffer lock ext4: fix potential infinite loop in ext4_dx_readdir() ext4: flush s_error_work before journal destroy in ext4_fill_super ext4: fix loff_t overflow in ext4_max_bitmap_size() ext4: fix reserved space counter leakage ext4: limit the number of blocks in one ADD_RANGE TLV ext4: enforce buffer head state assertion in ext4_da_map_blocks ext4: remove extent cache entries when truncating inline data ext4: drop unnecessary journal handle in delalloc write ext4: factor out write end code of inline file ext4: correct the error path of ext4_write_inline_data_end() ext4: check and update i_disksize properly ext4: add error checking to ext4_ext_replay_set_iblocks() commit 7fab1c12bde926c5a8c7d5984c551d0854d7e0b3 Author: Linus Torvalds Date: Sun Oct 3 13:45:48 2021 -0700 objtool: print out the symbol type when complaining about it The objtool warning that the kvm instruction emulation code triggered wasn't very useful: arch/x86/kvm/emulate.o: warning: objtool: __ex_table+0x4: don't know how to handle reloc symbol type: kvm_fastop_exception in that it helpfully tells you which symbol name it had trouble figuring out the relocation for, but it doesn't actually say what the unknown symbol type was that triggered it all. In this case it was because of missing type information (type 0, aka STT_NOTYPE), but on the whole it really should just have printed that out as part of the message. Because if this warning triggers, that's very much the first thing you want to know - why did reloc2sec_off() return failure for that symbol? So rather than just saying you can't handle some type of symbol without saying what the type _was_, just print out the type number too. Fixes: 24ff65257375 ("objtool: Teach get_alt_entry() about more relocation types") Link: https://lore.kernel.org/lkml/CAHk-=wiZwq-0LknKhXN4M+T8jbxn_2i9mcKpO+OaBSSq_Eh7tg@mail.gmail.com/ Signed-off-by: Linus Torvalds commit 291073a566b2094c7192872cc0f17ce73d83cb76 Author: Linus Torvalds Date: Sun Oct 3 13:34:19 2021 -0700 kvm: fix objtool relocation warning The recent change to make objtool aware of more symbol relocation types (commit 24ff65257375: "objtool: Teach get_alt_entry() about more relocation types") also added another check, and resulted in this objtool warning when building kvm on x86: arch/x86/kvm/emulate.o: warning: objtool: __ex_table+0x4: don't know how to handle reloc symbol type: kvm_fastop_exception The reason seems to be that kvm_fastop_exception() is marked as a global symbol, which causes the relocation to ke kept around for objtool. And at the same time, the kvm_fastop_exception definition (which is done as an inline asm statement) doesn't actually set the type of the global, which then makes objtool unhappy. The minimal fix is to just not mark kvm_fastop_exception as being a global symbol. It's only used in that one compilation unit anyway, so it was always pointless. That's how all the other local exception table labels are done. I'm not entirely happy about the kinds of games that the kvm code plays with doing its own exception handling, and the fact that it confused objtool is most definitely a symptom of the code being a bit too subtle and ad-hoc. But at least this trivial one-liner makes objtool no longer upset about what is going on. Fixes: 24ff65257375 ("objtool: Teach get_alt_entry() about more relocation types") Link: https://lore.kernel.org/lkml/CAHk-=wiZwq-0LknKhXN4M+T8jbxn_2i9mcKpO+OaBSSq_Eh7tg@mail.gmail.com/ Cc: Borislav Petkov Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Vitaly Kuznetsov Cc: Wanpeng Li Cc: Jim Mattson Cc: Joerg Roedel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nathan Chancellor Signed-off-by: Linus Torvalds commit 6761a0ae9895fce67536510396bfa63158b0b8ec Merge: 84928ce3bb4e2 bb8a4fcb21365 Author: Linus Torvalds Date: Sun Oct 3 11:19:02 2021 -0700 Merge tag 'char-misc-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small misc driver fixes for 5.15-rc4. They are in two "groups": - ipack driver fixes for issues found by Johan Hovold - interconnect driver fixes for reported problems All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: ipack: ipoctal: fix module reference leak ipack: ipoctal: fix missing allocation-failure check ipack: ipoctal: fix tty-registration error handling ipack: ipoctal: fix tty registration race ipack: ipoctal: fix stack information leak interconnect: qcom: sdm660: Add missing a2noc qos clocks dt-bindings: interconnect: sdm660: Add missing a2noc qos clocks interconnect: qcom: sdm660: Correct NOC_QOS_PRIORITY shift and mask interconnect: qcom: sdm660: Fix id of slv_cnoc_mnoc_cfg commit 84928ce3bb4e20ec7ef0e990630a690855dd44cc Merge: 777feabaea776 df38d852c6814 Author: Linus Torvalds Date: Sun Oct 3 11:10:09 2021 -0700 Merge tag 'driver-core-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some driver core and kernfs fixes for reported issues for 5.15-rc4. These fixes include: - kernfs positive dentry bugfix - debugfs_create_file_size error path fix - cpumask sysfs file bugfix to preserve the user/kernel abi (has been reported multiple times.) - devlink fixes for mdiobus devices as reported by the subsystem maintainers. Also included in here are some devlink debugging changes to make it easier for people to report problems when asked. They have already helped with the mdiobus and other subsystems reporting issues. All of these have been linux-next for a while with no reported issues" * tag 'driver-core-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: kernfs: also call kernfs_set_rev() for positive dentry driver core: Add debug logs when fwnode links are added/deleted driver core: Create __fwnode_link_del() helper function driver core: Set deferred probe reason when deferred by driver core net: mdiobus: Set FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for mdiobus parents driver core: fw_devlink: Add support for FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD driver core: fw_devlink: Improve handling of cyclic dependencies cpumask: Omit terminating null byte in cpumap_print_{list,bitmask}_to_buf debugfs: debugfs_create_file_size(): use IS_ERR to check for error commit 777feabaea776a6bff3d198edfe931b0b45c45d9 Merge: 3a399a2bc465e 83d40a61046f7 Author: Linus Torvalds Date: Sun Oct 3 10:49:00 2021 -0700 Merge tag 'sched_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Tell the compiler to always inline is_percpu_thread() - Make sure tunable_scaling buffer is null-terminated after an update in sysfs - Fix LTP named regression due to cgroup list ordering * tag 'sched_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Always inline is_percpu_thread() sched/fair: Null terminate buffer when updating tunable_scaling sched/fair: Add ancestors of unthrottled undecayed cfs_rq commit 3a399a2bc465e7fb0e788bfbffefc9399d628a25 Merge: 52c3c170623d9 f792565326825 Author: Linus Torvalds Date: Sun Oct 3 10:32:27 2021 -0700 Merge tag 'perf_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Make sure the destroy callback is reset when a event initialization fails - Update the event constraints for Icelake - Make sure the active time of an event is updated even for inactive events * tag 'perf_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: fix userpage->time_enabled of inactive events perf/x86/intel: Update event constraints for ICX perf/x86: Reset destroy callback on event init failure commit 52c3c170623d994c468c1ee9cc36c56bbd6d6e56 Merge: 7b66f4393ad42 24ff652573754 Author: Linus Torvalds Date: Sun Oct 3 10:23:54 2021 -0700 Merge tag 'objtool_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Borislav Petkov: - Handle symbol relocations properly due to changes in the toolchains which remove section symbols now * tag 'objtool_urgent_for_v5.15_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Teach get_alt_entry() about more relocation types commit 26d90b5590579def54382a2fc34cfbe8518a9851 Author: Jiri Valek - 2N Date: Mon Sep 20 14:53:48 2021 +0200 iio: light: opt3001: Fixed timeout error when 0 lux Reading from sensor returned timeout error under zero light conditions. Signed-off-by: Jiri Valek - 2N Fixes: ac663db3678a ("iio: light: opt3001: enable operation w/o IRQ") Link: https://lore.kernel.org/r/20210920125351.6569-1-valek@2n.cz Cc: Signed-off-by: Jonathan Cameron commit 7b66f4393ad421e425ba643fde0493fa64346a43 Merge: e25ca045c32a0 dd4d747ef05ad Author: Linus Torvalds Date: Sat Oct 2 17:51:01 2021 -0700 Merge tag 'hwmon-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fixed various potential NULL pointer accesses in w8379* drivers - Improved error handling, fault reporting, and fixed rounding in thmp421 driver - Fixed error handling in ltc2947 driver - Added missing attribute to pmbus/mp2975 driver - Fixed attribute values in pbus/ibm-cffps, occ, and mlxreg-fan drivers - Removed unused residual code from k10temp driver * tag 'hwmon-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller hwmon: (pmbus/ibm-cffps) max_power_out swap changes hwmon: (occ) Fix P10 VRM temp sensors hwmon: (ltc2947) Properly handle errors when looking for the external clock hwmon: (tmp421) fix rounding for negative values hwmon: (tmp421) report /PVLD condition as fault hwmon: (tmp421) handle I2C errors hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs hwmon: (k10temp) Remove residues of current and voltage commit e25ca045c32a0d787b143fef0acc5a43cc9ccc66 Merge: 9904468fb0b72 87ffb310d5e8a Author: Linus Torvalds Date: Sat Oct 2 17:43:54 2021 -0700 Merge tag '5.15-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: "Eleven fixes for the ksmbd kernel server, mostly security related: - an important fix for disabling weak NTLMv1 authentication - seven security (improved buffer overflow checks) fixes - fix for wrong infolevel struct used in some getattr/setattr paths - two small documentation fixes" * tag '5.15-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: missing check for NULL in convert_to_nt_pathname() ksmbd: fix transform header validation ksmbd: add buffer validation for SMB2_CREATE_CONTEXT ksmbd: add validation in smb2 negotiate ksmbd: add request buffer validation in smb2_set_info ksmbd: use correct basic info level in set_file_basic_info() ksmbd: remove NTLMv1 authentication ksmbd: fix documentation for 2 functions MAINTAINERS: rename cifs_common to smbfs_common in cifs and ksmbd entry ksmbd: fix invalid request buffer access in compound ksmbd: remove RFC1002 check in smb2 request commit 5155cf7b6aaefe64d7d7e1f8ca1871fce55444c4 Merge: 6880fa6c56601 8bb0ab3ae7a4d Author: Palmer Dabbelt Date: Sat Oct 2 14:51:40 2021 -0700 Merge remote-tracking branch 'palmer/riscv-vdso-cleanup' into fixes This contains a VDSO cleanup, along with a handful of VDSO fixes. * palmer/riscv-vdso-cleanup: riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable riscv/vdso: Move vdso data page up front riscv/vdso: Refactor asm/vdso.h commit 8bb0ab3ae7a4dbe6cf32deb830cf2bdbf5736867 Author: Tong Tiangen Date: Wed Sep 1 02:46:21 2021 +0000 riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable riscv architectures relying on mmap_sem for write in their arch_setup_additional_pages. If the waiting task gets killed by the oom killer it would block oom_reaper from asynchronous address space reclaim and reduce the chances of timely OOM resolving. Wait for the lock in the killable mode and return with EINTR if the task got killed while waiting. Signed-off-by: Tong Tiangen Reviewed-by: Kefeng Wang Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") Signed-off-by: Palmer Dabbelt commit 78a743cd82a35ca0724179fc22834f06a2151fc2 Author: Tong Tiangen Date: Wed Sep 1 02:46:20 2021 +0000 riscv/vdso: Move vdso data page up front As commit 601255ae3c98 ("arm64: vdso: move data page before code pages"), the same issue exists on riscv, testcase is shown below, make sure that vdso.so is bigger than page size, struct timespec tp; clock_gettime(5, &tp); printf("tv_sec: %ld, tv_nsec: %ld\n", tp.tv_sec, tp.tv_nsec); without this patch, test result : tv_sec: 0, tv_nsec: 0 with this patch, test result : tv_sec: 1629271537, tv_nsec: 748000000 Move the vdso data page in front of the VDSO area to fix the issue. Fixes: ad5d1122b82fb ("riscv: use vDSO common flow to reduce the latency of the time-related functions") Signed-off-by: Tong Tiangen Reviewed-by: Kefeng Wang Signed-off-by: Palmer Dabbelt commit bb4a23c994aebcd96c567a0be8e964d516bd4a61 Author: Tong Tiangen Date: Wed Sep 1 02:46:19 2021 +0000 riscv/vdso: Refactor asm/vdso.h The asm/vdso.h will be included in vdso.lds.S in the next patch, the following cleanup is needed to avoid syntax error: 1.the declaration of sys_riscv_flush_icache() is moved into asm/syscall.h. 2.the definition of struct vdso_data is moved into kernel/vdso.c. 2.the definition of VDSO_SYMBOL is placed under "#ifndef __ASSEMBLY__". Also remove the redundant linux/types.h include. Signed-off-by: Tong Tiangen Reviewed-by: Kefeng Wang Signed-off-by: Palmer Dabbelt commit 9904468fb0b72a59a10753a86ce121fbdd2e9b3d Merge: ab2a7a35c4e7e 79a7482249a73 Author: Linus Torvalds Date: Sat Oct 2 12:56:03 2021 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five fairly minor fixes and spelling updates, all in drivers. Even though the ufs fix is in tracing, it's a potentially exploitable use beyond end of array bug" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: csiostor: Add module softdep on cxgb4 scsi: qla2xxx: Fix excessive messages during device logout scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" scsi: ses: Fix unsigned comparison with less than zero scsi: ufs: Fix illegal offset in UPIU event trace commit ab2a7a35c4e7e848de9a7cf70f36b62584154140 Merge: 65893b49d868b 41e76c6a3c83c Author: Linus Torvalds Date: Sat Oct 2 11:00:36 2021 -0700 Merge tag 'block-5.15-2021-10-01' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few block fixes for this release: - Revert a BFQ commit that causes breakage for people. Unfortunately it was auto-selected for stable as well, so now 5.14.7 suffers from it too. Hopefully stable will pick up this revert quickly too, so we can remove the issue on that end as well. - Add a quirk for Apple NVMe controllers, which due to their non-compliance broke due to the introduction of command sequences (Keith) - Use shifts in nbd, fixing a __divdi3 issue (Nick)" * tag 'block-5.15-2021-10-01' of git://git.kernel.dk/linux-block: nbd: use shifts rather than multiplies Revert "block, bfq: honor already-setup queue merges" nvme: add command id quirk for apple controllers commit 65893b49d868bd2de5fbac41744d1eaecc739629 Merge: f05c643743a43 3f008385d46d3 Author: Linus Torvalds Date: Sat Oct 2 10:26:19 2021 -0700 Merge tag 'io_uring-5.15-2021-10-01' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Two fixes in here: - The signal issue that was discussed start of this week (me). - Kill dead fasync support in io_uring. Looks like it was broken since io_uring was initially merged, and given that nobody has ever complained about it, let's just kill it (Pavel)" * tag 'io_uring-5.15-2021-10-01' of git://git.kernel.dk/linux-block: io_uring: kill fasync io-wq: exclusively gate signal based exit on get_signal() return commit f05c643743a43b42e7603a520ad052e5218f4e53 Merge: 6e9bfdcf0a3b1 d55174cccac2e Author: Linus Torvalds Date: Sat Oct 2 10:08:35 2021 -0700 Merge tag 'libnvdimm-fixes-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A fix for a regression added this cycle in the pmem driver, and for a long standing bug for failed NUMA node lookups on ARM64. This has appeared in -next for several days with no reported issues. Summary: - Fix a regression that caused the sysfs ABI for pmem block devices to not be registered. This fails the nvdimm unit tests and dax xfstests. - Fix numa node lookups for dax-kmem memory (device-dax memory assigned to the page allocator) on ARM64" * tag 'libnvdimm-fixes-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm/pmem: fix creating the dax group ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect commit 6e9bfdcf0a3b1c8126878c21adcfc343f89d4a6a Author: Dave Wysochanski Date: Fri Oct 1 15:37:31 2021 +0100 cachefiles: Fix oops in trace_cachefiles_mark_buried due to NULL object In cachefiles_mark_object_buried, the dentry in question may not have an owner, and thus our cachefiles_object pointer may be NULL when calling the tracepoint, in which case we will also not have a valid debug_id to print in the tracepoint. Check for NULL object in the tracepoint and if so, just set debug_id to MAX_UINT as was done in 2908f5e101e3 ("fscache: Add a cookie debug ID and use that in traces"). This fixes the following oops: FS-Cache: Cache "mycache" added (type cachefiles) CacheFiles: File cache on vdc registered ... Workqueue: fscache_object fscache_object_work_func [fscache] RIP: 0010:trace_event_raw_event_cachefiles_mark_buried+0x4e/0xa0 [cachefiles] .... Call Trace: cachefiles_mark_object_buried+0xa5/0xb0 [cachefiles] cachefiles_bury_object+0x270/0x430 [cachefiles] cachefiles_walk_to_object+0x195/0x9c0 [cachefiles] cachefiles_lookup_object+0x5a/0xc0 [cachefiles] fscache_look_up_object+0xd7/0x160 [fscache] fscache_object_work_func+0xb2/0x340 [fscache] process_one_work+0x1f1/0x390 worker_thread+0x53/0x3e0 kthread+0x127/0x150 Fixes: 2908f5e101e3 ("fscache: Add a cookie debug ID and use that in traces") Signed-off-by: Dave Wysochanski Signed-off-by: David Howells cc: linux-cachefs@redhat.com Signed-off-by: Linus Torvalds commit cdc1e6e225e3256d56dc6648411630e71d7c776b Author: Hugh Dickins Date: Sat Oct 2 03:17:29 2021 -0700 drm/i915: fix blank screen booting crashes 5.15-rc1 crashes with blank screen when booting up on two ThinkPads using i915. Bisections converge convincingly, but arrive at different and suprising "culprits", none of them the actual culprit. netconsole (with init_netconsole() hacked to call i915_init() when logging has started, instead of by module_init()) tells the story: kernel BUG at drivers/gpu/drm/i915/i915_sw_fence.c:245! with RSI: ffffffff814d408b pointing to sw_fence_dummy_notify(). I've been building with CONFIG_CC_OPTIMIZE_FOR_SIZE=y, and that function needs to be 4-byte aligned. Fixes: 62eaf0ae217d ("drm/i915/guc: Support request cancellation") Signed-off-by: Hugh Dickins Tested-by: Steven Rostedt (VMware) Signed-off-by: Linus Torvalds commit 57b44817a8d63e75394bc21849f585ded53de8bb Author: Moritz Fischer Date: Tue Sep 28 07:57:53 2021 -0700 MAINTAINERS: Drop outdated FPGA Manager website The rocketboards website no longer really reflects a good landing place for people interested in FPGA Manager. Cc: Xu Yilun Cc: Wu Hao Acked-by: Xu Yilun Signed-off-by: Moritz Fischer commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b Author: Andy Shevchenko Date: Fri Oct 1 19:20:33 2021 +0300 ptp_pch: Load module automatically if ID matches The driver can't be loaded automatically because it misses module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() call to the driver. Fixes: 863d08ece9bf ("supports eg20t ptp clock") Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit 06cc978d3ff226072780f74897800b33e78abb57 Author: Tetsuo Handa Date: Sat Oct 2 18:23:02 2021 +0900 block: genhd: fix double kfree() in __alloc_disk_node() syzbot is reporting use-after-free read at bdev_free_inode() [1], for kfree() from __alloc_disk_node() is called before bdev_free_inode() (which is called after RCU grace period) reads bdev->bd_disk and calls kfree(bdev->bd_disk). Fix use-after-free read followed by double kfree() problem by making sure that bdev->bd_disk is NULL when calling iput(). Link: https://syzkaller.appspot.com/bug?extid=8281086e8a6fbfbd952a [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/e6dd13c5-8db0-4392-6e78-a42ee5d2a1c4@i-love.sakura.ne.jp Signed-off-by: Jens Axboe commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 Author: Pali Rohár Date: Sat Oct 2 11:04:09 2021 +0200 powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 Property phy-connection-type contains invalid value "sgmii-2500" per scheme defined in file ethernet-controller.yaml. Correct phy-connection-type value should be "2500base-x". Signed-off-by: Pali Rohár Fixes: 84e0f1c13806 ("powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)") Acked-by: Scott Wood Signed-off-by: David S. Miller commit dade7f9d819d89ba2da5f72a07cb4b91a1e1f74a Merge: 5cfe5109a1d7f 6fb721cf78180 Author: David S. Miller Date: Sat Oct 2 13:55:02 2021 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net (v2) The following patchset contains Netfilter fixes for net: 1) Move back the defrag users fields to the global netns_nf area. Kernel fails to boot if conntrack is builtin and kernel is booted with: nf_conntrack.enable_hooks=1. From Florian Westphal. 2) Rule event notification is missing relevant context such as the position handle and the NLM_F_APPEND flag. 3) Rule replacement is expanded to add + delete using the existing rule handle, reverse order of this operation so it makes sense from rule notification standpoint. 4) Propagate to userspace the NLM_F_CREATE and NLM_F_EXCL flags from the rule notification path. Patches #2, #3 and #4 are used by 'nft monitor' and 'iptables-monitor' userspace utilities which are not correctly representing the following operations through netlink notifications: - rule insertions - rule addition/insertion from position handle - create table/chain/set/map/flowtable/... ==================== Signed-off-by: David S. Miller commit dd4d747ef05addab887dc8ff0d6ab9860bbcd783 Author: Nadezda Lutovinova Date: Tue Sep 21 18:51:53 2021 +0300 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). Cc: stable@vger.kernel.org Signed-off-by: Nadezda Lutovinova Link: https://lore.kernel.org/r/20210921155153.28098-3-lutovinova@ispras.ru [groeck: Dropped unnecessary continuation lines, fixed multi-line alignments] Signed-off-by: Guenter Roeck commit 0f36b88173f028e372668ae040ab1a496834d278 Author: Nadezda Lutovinova Date: Tue Sep 21 18:51:52 2021 +0300 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). Cc: stable@vger.kernel.org Signed-off-by: Nadezda Lutovinova Link: https://lore.kernel.org/r/20210921155153.28098-2-lutovinova@ispras.ru [groeck: Dropped unnecessary continuation lines, fixed multipline alignment] Signed-off-by: Guenter Roeck commit 943c15ac1b84d378da26bba41c83c67e16499ac4 Author: Nadezda Lutovinova Date: Tue Sep 21 18:51:51 2021 +0300 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). Cc: stable@vger.kernel.org Signed-off-by: Nadezda Lutovinova Link: https://lore.kernel.org/r/20210921155153.28098-1-lutovinova@ispras.ru [groeck: Dropped unnecessary continuation lines, fixed multi-line alignment] Signed-off-by: Guenter Roeck commit 2292e2f685cd5c65e3f47bbcf9f469513acc3195 Author: Vadim Pasternak Date: Mon Sep 27 10:07:40 2021 +0300 hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller Add missed attribute for reading POUT from page 1. It is supported by device, but has been missed in initial commit. Fixes: 2c6fcbb21149 ("hwmon: (pmbus) Add support for MPS Multi-phase mp2975 controller") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20210927070740.2149290-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit f067d5585cda2de1e47dde914a8a4f151659e0ad Author: Brandon Wyman Date: Tue Sep 28 20:50:51 2021 +0000 hwmon: (pmbus/ibm-cffps) max_power_out swap changes The bytes for max_power_out from the ibm-cffps devices differ in byte order for some power supplies. The Witherspoon power supply returns the bytes in MSB/LSB order. The Rainier power supply returns the bytes in LSB/MSB order. The Witherspoon power supply uses version cffps1. The Rainier power supply should use version cffps2. If version is cffps1, swap the bytes before output to max_power_out. Tested: Witherspoon before: 3148. Witherspoon after: 3148. Rainier before: 53255. Rainier after: 2000. Signed-off-by: Brandon Wyman Reviewed-by: Eddie James Link: https://lore.kernel.org/r/20210928205051.1222815-1-bjwyman@gmail.com [groeck: Replaced yoda programming] Signed-off-by: Guenter Roeck commit ffa2600044979aff4bd6238edb9af815a47d7c32 Author: Eddie James Date: Wed Sep 29 10:36:04 2021 -0500 hwmon: (occ) Fix P10 VRM temp sensors The P10 (temp sensor version 0x10) doesn't do the same VRM status reporting that was used on P9. It just reports the temperature, so drop the check for VRM fru type in the sysfs show function, and don't set the name to "alarm". Fixes: db4919ec86 ("hwmon: (occ) Add new temperature sensor type") Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20210929153604.14968-1-eajames@linux.ibm.com Signed-off-by: Guenter Roeck commit 6fb721cf781808ee2ca5e737fb0592cc68de3381 Author: Pablo Neira Ayuso Date: Sun Sep 26 09:59:35 2021 +0200 netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification Include the NLM_F_CREATE and NLM_F_EXCL flags in netlink event notifications, otherwise userspace cannot distiguish between create and add commands. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit 740da9d7ca4e25f5d87db9f80d75432681b61305 Author: Ilya Lipnitskiy Date: Thu Sep 30 09:57:41 2021 -0700 MIPS: Revert "add support for buggy MT7621S core detection" This reverts commit 6decd1aad15f56b169217789630a0098b496de0e. CPULAUNCH register is not set properly by some bootloaders, causing a regression until a bootloader change is made, which is hard if not impossible on some embedded devices. Revert the change until a more robust core detection mechanism that works on MT7621S routers such as Netgear R6220 as well as platforms like Digi EX15 can be made. Link: https://lore.kernel.org/lkml/4d9e3b39-7caa-d372-5d7b-42dcec36fec7@kernel.org Fixes: 6decd1aad15f ("MIPS: add support for buggy MT7621S core detection") Signed-off-by: Ilya Lipnitskiy Acked-by: Sergio Paracuellos Acked-by: Greg Ungerer Signed-off-by: Thomas Bogendoerfer commit 3bce7703c7ba648bd9e174dc1413f422b7998833 Author: Kewei Xu Date: Fri Sep 17 18:14:14 2021 +0800 i2c: mediatek: Add OFFSET_EXT_CONF setting back In the commit be5ce0e97cc7 ("i2c: mediatek: Add i2c ac-timing adjust support"), we miss setting OFFSET_EXT_CONF register if i2c->dev_comp->timing_adjust is false, now add it back. Fixes: be5ce0e97cc7 ("i2c: mediatek: Add i2c ac-timing adjust support") Signed-off-by: Kewei Xu Reviewed-by: Qii Wang Signed-off-by: Wolfram Sang commit 6558b646ce1c2a872fe1c2c7cb116f05a2c1950f Author: Jamie Iles Date: Wed Sep 22 17:57:18 2021 +0100 i2c: acpi: fix resource leak in reconfiguration device addition acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a reference on the adapter which is never released which will result in a reference count leak and render the adapter unremovable. Make sure to put the adapter after creating the client in the same manner that we do for OF. Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications") Signed-off-by: Jamie Iles Acked-by: Mika Westerberg [wsa: fixed title] Signed-off-by: Wolfram Sang commit 67a12ae52599c9f2f24ef14adb43fc3b164792b5 Author: Michael Walle Date: Fri Oct 1 23:27:26 2021 +0200 spi: spi-nxp-fspi: don't depend on a specific node name erratum workaround In commit 7e71b85473f8 ("arm64: dts: ls1028a: fix node name for the sysclk") the sysclk node name was renamed and broke the erratum workaround because it tries to fetch a device tree node by its name, which is very fragile in general. We don't even need the sysclk node because the only possible sysclk frequency input is 100MHz. In fact, the erratum says it applies if SYS_PLL_RAT is 3, not that the platform clock is 300 MHz. Make the workaround more reliable and just drop the unneeded sysclk lookup. For reference, the error during the bootup is the following: [ 4.898400] nxp-fspi 20c0000.spi: Errata cannot be executed. Read via IP bus may not work Fixes: 82ce7d0e74b6 ("spi: spi-nxp-fspi: Implement errata workaround for LS1028A") Cc: Vladimir Oltean Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20211001212726.159437-1-michael@walle.cc Signed-off-by: Mark Brown commit 67006e30e27e80fd9403a91ae3c0c85391c6c2cc Author: Rob Herring Date: Tue Sep 28 17:29:20 2021 -0500 dt-bindings: Drop more redundant 'maxItems/minItems' Another round of removing redundant minItems/maxItems from new schema in the recent merge window. If a property has an 'items' list, then a 'minItems' or 'maxItems' with the same size as the list is redundant and can be dropped. Note that is DT schema specific behavior and not standard json-schema behavior. The tooling will fixup the final schema adding any unspecified minItems/maxItems. Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Evgeniy Polyakov Cc: Marek Vasut Cc: Joakim Zhang Cc: dri-devel@lists.freedesktop.org Cc: netdev@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20210928222920.2204761-1-robh@kernel.org commit 55442e6af03434c500541782f01730a89162eb27 Author: Rob Herring Date: Thu Aug 19 19:14:57 2021 -0500 dt-bindings: media: Fix more graph 'unevaluatedProperties' related warnings The graph schema doesn't allow custom properties on endpoint nodes for '#/properties/port' and '#/$defs/port-base' should be used instead. This doesn't matter until 'unevaluatedProperties' support is implemented. Cc: Dave Stevenson Cc: Jacopo Mondi Cc: Mauro Carvalho Chehab Cc: "Paul J. Murphy" Cc: Daniele Alessandrelli Cc: linux-media@vger.kernel.org Signed-off-by: Rob Herring Reviewed-by: Daniele Alessandrelli Link: https://lore.kernel.org/r/20210820001457.1705142-1-robh@kernel.org commit 5cfe5109a1d7fd9686d5c695827216788bf0b1ec Author: Leon Romanovsky Date: Thu Sep 30 08:12:43 2021 +0300 MAINTAINERS: Remove Bin Luo as his email bounces The emails sent to luobin9@huawei.com bounce with error: "Recipient address rejected: Failed recipient validation check." So let's remove his entry and change the status of hinic driver till someone in Huawei will step-in to maintain it again. Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/045a32ccf394de66b7899c8b732f44dc5f4a1154.1632978665.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit aec3f415f7244b7747a7952596971adb0df2f568 Author: Punit Agrawal Date: Wed Sep 29 22:50:49 2021 +0900 net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices Commit 2d26f6e39afb ("net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings") while getting rid of a runtime PM warning ended up breaking ethernet on rk3399 based devices. By dropping an extra reference to the device, the commit ends up enabling suspend / resume of the ethernet device - which appears to be broken. While the issue with runtime pm is being investigated, partially revert commit 2d26f6e39afb to restore the network on rk3399. Fixes: 2d26f6e39afb ("net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings") Suggested-by: Heiko Stuebner Signed-off-by: Punit Agrawal Cc: Michael Riesch Tested-by: Heiko Stuebner Link: https://lore.kernel.org/r/20210929135049.3426058-1-punitagrawal@gmail.com Signed-off-by: Jakub Kicinski commit 019d9329e7481cfaccbd8ed17b1e04ca76970f13 Author: Vladimir Oltean Date: Thu Sep 30 15:53:30 2021 +0300 net: mscc: ocelot: fix VCAP filters remaining active after being deleted When ocelot_flower.c calls ocelot_vcap_filter_add(), the filter has a given filter->id.cookie. This filter is added to the block->rules list. However, when ocelot_flower.c calls ocelot_vcap_block_find_filter_by_id() which passes the cookie as argument, the filter is never found by filter->id.cookie when searching through the block->rules list. This is unsurprising, since the filter->id.cookie is an unsigned long, but the cookie argument provided to ocelot_vcap_block_find_filter_by_id() is a signed int, and the comparison fails. Fixes: 50c6cc5b9283 ("net: mscc: ocelot: store a namespaced VCAP filter ID") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20210930125330.2078625-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc Author: Eric Dumazet Date: Thu Sep 30 14:22:39 2021 -0700 net_sched: fix NULL deref in fifo_set_limit() syzbot reported another NULL deref in fifo_set_limit() [1] I could repro the issue with : unshare -n tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit tc qd replace dev lo parent 1:0 pfifo_fast tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit pfifo_fast does not have a change() operation. Make fifo_set_limit() more robust about this. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000 RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910 R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800 FS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: fifo_set_limit net/sched/sch_fifo.c:242 [inline] fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227 tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418 qdisc_change net/sched/sch_api.c:1332 [inline] tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: fb0305ce1b03 ("net-sched: consolidate default fifo qdisc setup") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20210930212239.3430364-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit 95c58291ee709424557996891926a05a32c5b13a Author: Arnd Bergmann Date: Mon Sep 27 13:36:23 2021 +0200 drm/msm/submit: fix overflow check on 64-bit architectures The overflow check does causes a warning from clang-14 when 'sz' is a type that is smaller than size_t: drivers/gpu/drm/msm/msm_gem_submit.c:217:10: error: result of comparison of constant 18446744073709551615 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if (sz == SIZE_MAX) { Change the type accordingly. Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos") Signed-off-by: Arnd Bergmann Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20210927113632.3849987-1-arnd@kernel.org Signed-off-by: Rob Clark commit 53d5fc89d66a778577295020dc57bb3ccec84354 Merge: f5b667ded0756 172da89ed0eaf Author: Linus Torvalds Date: Fri Oct 1 14:45:23 2021 -0700 Merge tag 's390-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Vasily Gorbik: "One fix for 5.15-rc4: Avoid CIO excessive path-verification requests, which might cause unwanted delays" * tag 's390-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/cio: avoid excessive path-verification requests commit b0e875bac0fab3e7a7431c2eee36a8ccc0c712ac Author: Andrii Nakryiko Date: Fri Oct 1 11:59:10 2021 -0700 libbpf: Fix memory leak in strset Free struct strset itself, not just its internal parts. Fixes: 90d76d3ececc ("libbpf: Extract internal set-of-strings datastructure APIs") Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20211001185910.86492-1-andrii@kernel.org commit 68002469e571ae3db095e4ade1cfef64903f8fa1 Author: Rob Clark Date: Fri Oct 1 09:42:05 2021 -0700 drm/msm: One sched entity per process per priority Some userspace apps make assumptions that rendering against multiple contexts within the same process (from the same thread, with appropriate MakeCurrent() calls) provides sufficient synchronization without any external synchronization (ie. glFenceSync()/glWaitSync()). Since a submitqueue maps to a gl/vk context, having multiple sched entities of the same priority only works with implicit sync enabled. To fix this, limit things to a single sched entity per priority level per process. An alternative would be sharing submitqueues between contexts in userspace, but tracking of per-context faults (ie. GL_EXT_robustness) is already done at the submitqueue level, so this is not an option. Signed-off-by: Rob Clark commit 4cd82aa39bda20a9237b8f42676796d0a5ee9bfc Author: Rob Clark Date: Fri Oct 1 08:58:15 2021 -0700 drm/msm: A bit more docs + cleanup msm_file_private is more gpu related, and in the next commit it will need access to other GPU specific #defines. While we're at it, add some comments. Signed-off-by: Rob Clark commit 14eb0cb4e9a7323c8735cf6c681ed8423ce6ae06 Author: Rob Clark Date: Thu Sep 30 10:43:20 2021 -0700 drm/msm/a6xx: Track current ctx by seqno In theory a context can be destroyed and a new one allocated at the same address, making the pointer comparision to detect when we don't need to update the current pagetables invalid. Instead assign a sequence number to each context on creation, and use this for the check. Fixes: 84c31ee16f90 ("drm/msm/a6xx: Add support for per-instance pagetables") Signed-off-by: Rob Clark commit f6f59072e821901d96c791864a07d57d8ec8d312 Author: Rob Clark Date: Mon Sep 27 11:00:04 2021 -0700 drm/msm/a6xx: Serialize GMU communication I've seen some crashes in our crash reporting that *look* like multiple threads stomping on each other while communicating with GMU. So wrap all those paths in a lock. Signed-off-by: Rob Clark commit 654e9c18dfab02c8e5f9c5877c7a2f3264fa520a Author: Rob Clark Date: Sun Sep 26 11:56:58 2021 -0700 drm/msm: Fix crash on dev file close If the device file was opened prior to fw being available (such as from initrd before rootfs is mounted, when the initrd does not contain GPU fw), that would cause a later crash when the dev file is closed due to unitialized submitqueues list: CPU: 4 PID: 263 Comm: plymouthd Tainted: G W 5.15.0-rc2-next-20210924 #2 Hardware name: LENOVO 81JL/LNVNB161216, BIOS 9UCN33WW(V2.06) 06/ 4/2019 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : msm_submitqueue_close+0x30/0x190 [msm] lr : msm_postclose+0x54/0xf0 [msm] sp : ffff80001074bb80 x29: ffff80001074bb80 x28: ffff03ad80c4db80 x27: ffff03ad80dc5ab0 x26: 0000000000000000 x25: ffff03ad80dc5af8 x24: ffff03ad81e90800 x23: 0000000000000000 x22: ffff03ad81e90800 x21: ffff03ad8b35e788 x20: ffff03ad81e90878 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: ffffda15f14f7940 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000040 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffda15cd18ff88 x8 : ffff03ad80c4db80 x7 : 0000000000000228 x6 : 0000000000000000 x5 : 1793a4e807e636bd x4 : ffff03ad80c4db80 x3 : ffff03ad81e90878 x2 : 0000000000000000 x1 : ffff03ad80c4db80 x0 : 0000000000000000 Call trace: msm_submitqueue_close+0x30/0x190 [msm] msm_postclose+0x54/0xf0 [msm] drm_file_free.part.0+0x1cc/0x2e0 [drm] drm_close_helper.isra.0+0x74/0x84 [drm] drm_release+0x78/0x120 [drm] __fput+0x78/0x23c ____fput+0x1c/0x30 task_work_run+0xcc/0x22c do_exit+0x304/0x9f4 do_group_exit+0x44/0xb0 __wake_up_parent+0x0/0x3c invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x4c/0xf4 do_el0_svc+0x30/0x9c el0_svc+0x20/0x60 el0t_64_sync_handler+0xe8/0xf0 el0t_64_sync+0x1a0/0x1a4 Code: aa0003f5 a90153f3 f8408eb3 aa1303e0 (f85e8674) ---[ end trace 39b2fa37509a2be2 ]--- Fixing recursive fault but reboot is needed! Fixes: 86c2a0f000c1 drm/msm: ("Small submitqueue creation cleanup") Reported-by: Steev Klimaszewski Signed-off-by: Rob Clark commit f62314b1ced25c58b86e044fc951cd6a1ea234cf Author: Xiyu Yang Date: Thu Sep 9 15:24:36 2021 +0800 kunit: fix reference count leak in kfree_at_end The reference counting issue happens in the normal path of kfree_at_end(). When kunit_alloc_and_get_resource() is invoked, the function forgets to handle the returned resource object, whose refcount increased inside, causing a refcount leak. Fix this issue by calling kunit_alloc_resource() instead of kunit_alloc_and_get_resource(). Fixed the following when applying: Shuah Khan CHECK: Alignment should match open parenthesis + kunit_alloc_resource(test, NULL, kfree_res_free, GFP_KERNEL, (void *)to_free); Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Reviewed-by: Daniel Latypov Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit d8c23ead708b40a16413163f5f93e07fbd4f077d Author: Daniel Latypov Date: Wed Sep 22 09:39:21 2021 -0700 kunit: tool: better handling of quasi-bool args (--json, --raw_output) Problem: What does this do? $ kunit.py run --json Well, it runs all the tests and prints test results out as JSON. And next is $ kunit.py run my-test-suite --json This runs just `my-test-suite` and prints results out as JSON. But what about? $ kunit.py run --json my-test-suite This runs all the tests and stores the json results in a "my-test-suite" file. Why: --json, and now --raw_output are actually string flags. They just have a default value. --json in particular takes the name of an output file. It was intended that you'd do $ kunit.py run --json=my_output_file my-test-suite if you ever wanted to specify the value. Workaround: It doesn't seem like there's a way to make https://docs.python.org/3/library/argparse.html only accept arg values after a '='. I believe that `--json` should "just work" regardless of where it is. So this patch automatically rewrites a bare `--json` to `--json=stdout`. That makes the examples above work the same way. Add a regression test that can catch this for --raw_output. Fixes: 6a499c9c42d0 ("kunit: tool: make --raw_output support only showing kunit output") Signed-off-by: Daniel Latypov Tested-by: David Gow Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit 5fb14d20f8241461d351bef73e49871e4b2330ab Author: Eric Dumazet Date: Fri Oct 1 09:46:22 2021 -0700 net: add kerneldoc comment for sk_peer_lock Fixes following warning: include/net/sock.h:533: warning: Function parameter or member 'sk_peer_lock' not described in 'sock' Fixes: 35306eb23814 ("af_unix: fix races in sk_peer_pid and sk_peer_cred accesses") Signed-off-by: Eric Dumazet Reported-by: Stephen Rothwell Link: https://lore.kernel.org/r/20211001164622.58520-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit 3672bb820f3292b6f035469f863c020317a3dd28 Author: Dafna Hirschfeld Date: Fri Oct 1 17:21:53 2021 +0200 spi: mediatek: skip delays if they are 0 In the function 'mtk_spi_set_hw_cs_timing' the 'setup', 'hold' and 'inactive' delays are configured. In case those values are 0 it causes errors on mt8173: cros-ec-i2c-tunnel 1100a000.spi:ec@0:i2c-tunnel0: Error transferring EC i2c message -71 cros-ec-spi spi0.0: EC failed to respond in time. This patch fixes that issues by setting only the values that are not 0. Fixes: 04e6bb0d6bb1 ("spi: modify set_cs_timing parameter") Signed-off-by: Dafna Hirschfeld Link: https://lore.kernel.org/r/20211001152153.4604-1-dafna.hirschfeld@collabora.com Signed-off-by: Mark Brown commit 75e33c55ae8fb4a177fe07c284665e1d61b02560 Author: Ville Baillie Date: Tue Sep 21 07:21:32 2021 +0000 spi: atmel: Fix PDC transfer setup bug atmel_spi_dma_map_xfer to never be called in PDC mode. This causes the driver to silently fail. This patch changes the conditional to match the behaviour of the previous commit before the refactor. Fixes: 5fa5e6dec762 ("spi: atmel: Switch to transfer_one transfer method") Signed-off-by: Ville Baillie Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210921072132.21831-1-villeb@bytesnap.co.uk Signed-off-by: Mark Brown commit f5b667ded07569dd6e33885cffd35fd519cfc942 Author: Rafael J. Wysocki Date: Fri Oct 1 19:14:28 2021 +0200 thermal: Update information in MAINTAINERS Because Rui is now going to focus on work that is not related to the maintenance of the thermal subsystem in the kernel, Rafael will start to help Daniel with handling the development process as a new member of the thermal maintainers team. Rui will continue to review patches in that area. The thermal development process flow will change so that the material from the thermal git tree will be merged into the thermal branch of the linux-pm.git tree before going into the mainline. Update the information in MAINTAINERS accordingly. Signed-off-by: Rafael J. Wysocki Acked-by: Zhang Rui Acked-by: Daniel Lezcano Signed-off-by: Linus Torvalds commit b2626f1e3245ddd810b69df86514774d6cb655ee Merge: 24f67d82c43c9 7b0035eaa7dab Author: Linus Torvalds Date: Fri Oct 1 11:08:07 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more kvm fixes from Paolo Bonzini: "Small x86 fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Ensure all migrations are performed when test is affined KVM: x86: Swap order of CPUID entry "index" vs. "significant flag" checks ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm x86/kvmclock: Move this_cpu_pvti into kvmclock.h selftests: KVM: Don't clobber XMM register when read KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue commit 24f67d82c43c9c594821ee1bc4367a23d89d9f8b Merge: 89e503592385f 78ea81417944f Author: Linus Torvalds Date: Fri Oct 1 10:27:44 2021 -0700 Merge tag 'drm-fixes-2021-10-01' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Dave is out on a long w/e, should be back next week. Nothing nefarious, just a bunch of driver fixes: amdgpu, i915, tegra, and one exynos driver fix" * tag 'drm-fixes-2021-10-01' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: force exit gfxoff on sdma resume for rmb s0ix drm/amdgpu: check tiling flags when creating FB on GFX8- drm/amd/display: Pass PCI deviceid into DC drm/amd/display: initialize backlight_ramping_override to false drm/amdgpu: correct initial cp_hqd_quantum for gfx9 drm/amd/display: Fix Display Flicker on embedded panels drm/amdgpu: fix gart.bo pin_count leak drm/i915: Remove warning from the rps worker drm/i915/request: fix early tracepoints drm/i915/guc, docs: Fix pdfdocs build error by removing nested grid gpu: host1x: Plug potential memory leak gpu/host1x: fence: Make spinlock static drm/tegra: uapi: Fix wrong mapping end address in case of disabled IOMMU drm/tegra: dc: Remove unused variables drm/exynos: Make use of the helper function devm_platform_ioremap_resource() drm/i915/gvt: fix the usage of ww lock in gvt scheduler. commit 3f008385d46d3cea4a097d2615cd485f2184ba26 Author: Pavel Begunkov Date: Fri Oct 1 10:39:33 2021 +0100 io_uring: kill fasync We have never supported fasync properly, it would only fire when there is something polling io_uring making it useless. The original support came in through the initial io_uring merge for 5.1. Since it's broken and nobody has reported it, get rid of the fasync bits. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2f7ca3d344d406d34fa6713824198915c41cea86.1633080236.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 89e503592385fbed872c7ea1fb89931ece3409a5 Merge: 4de593fb965fc f0b636804c7c4 Author: Linus Torvalds Date: Fri Oct 1 10:14:29 2021 -0700 Merge tag 'iommu-fixes-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Two fixes for the new Apple DART driver to fix a kernel panic and a stale data usage issue - Intel VT-d fix for how PCI device ids are printed * tag 'iommu-fixes-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/dart: Clear sid2group entry when a group is freed iommu/vt-d: Drop "0x" prefix from PCI bus & device addresses iommu/dart: Remove iommu_flush_ops commit 78ea81417944fe03f48648eddeb8e8a8e513c4ad Merge: 3ff43f9df8b0e 17ac76e050c51 Author: Daniel Vetter Date: Fri Oct 1 18:14:38 2021 +0200 Merge tag 'exynos-drm-fixes-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes One cleanup - Use devm_platform_ioremap_resource() helper function instead of old one. Signed-off-by: Daniel Vetter From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20210928074158.2942-1-inki.dae@samsung.com commit 2ba5acfb34957e8a7fe47cd78c77ca88e9cc2b03 Author: J. Bruce Fields Date: Fri Oct 1 09:59:21 2021 -0400 SUNRPC: fix sign error causing rpcsec_gss drops If sd_max is unsigned, then sd_max - GSS_SEQ_WIN is a very large number whenever sd_max is less than GSS_SEQ_WIN, and the comparison: seq_num <= sd->sd_max - GSS_SEQ_WIN in gss_check_seq_num is pretty much always true, even when that's clearly not what was intended. This was causing pynfs to hang when using krb5, because pynfs uses zero as the initial gss sequence number. That's perfectly legal, but this logic error causes knfsd to drop the rpc in that case. Out-of-order sequence IDs in the first GSS_SEQ_WIN (128) calls will also cause this. Fixes: 10b9d99a3dbb ("SUNRPC: Augment server-side rpcgss tracepoints") Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields Signed-off-by: Chuck Lever commit 19598141f40dff728dd50799e510805261f48850 Author: Trond Myklebust Date: Thu Sep 30 15:44:42 2021 -0400 nfsd: Fix a warning for nfsd_file_close_inode Signed-off-by: Trond Myklebust Signed-off-by: Chuck Lever commit 3ff43f9df8b0ea779d2413c5244b72cfea12824d Merge: abb7700d4631f 26db706a6d77b Author: Daniel Vetter Date: Fri Oct 1 16:59:21 2021 +0200 Merge tag 'amd-drm-fixes-5.15-2021-09-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-09-29: amdgpu: - gart pin count fix - eDP flicker fix - GFX9 MQD fix - Display fixes - Tiling flags fix for pre-GFX9 - SDMA resume fix for S0ix Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210930023013.5207-1-alexander.deucher@amd.com commit abb7700d4631f4e050df1d578ca88d984012a3a0 Merge: 05812b971c6d6 4b8bcaf8a6d6a Author: Daniel Vetter Date: Fri Oct 1 16:47:18 2021 +0200 Merge tag 'drm-intel-fixes-2021-09-30' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15-rc4: - Fix GVT scheduler ww lock usage - Fix pdfdocs documentation build - Fix request early tracepoints - Fix an invalid warning from rps worker Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87lf3ev44z.fsf@intel.com commit 78764f450bd9649e03b7a3012ab52075c0b60a5e Merge: 5abab4982d5b3 3bf1742f3c695 Author: David S. Miller Date: Fri Oct 1 14:16:52 2021 +0100 Merge tag 'mlx5-fixes-2021-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-fixes-2021-09-30 commit 5abab4982d5b3bfe33d318b621951a13bbe6ae77 Merge: ca6e11c337daf 603a1621caa09 Author: David S. Miller Date: Fri Oct 1 14:16:29 2021 +0100 Merge tag 'wireless-drivers-2021-10-01' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers wireless-drivers fixes for v5.15 Second set of fixes for v5.15, nothing major this time. Most important here are reverting a brcmfmac regression and a fix for an old rare ath5k build error. iwlwifi * fixes to NULL dereference, off by one and missing unlock * add support for Killer AX1650 on Dell XPS 15 (9510) laptop ath5k * build fix with LEDS=m brcmfmac * revert a regression causing BCM4359/9 devices stop working as access point mwifiex * fix clang warning about null pointer arithmetic commit 83d40a61046f73103b4e5d8f1310261487ff63b0 Author: Peter Zijlstra Date: Mon Sep 20 15:31:11 2021 +0200 sched: Always inline is_percpu_thread() vmlinux.o: warning: objtool: check_preemption_disabled()+0x81: call to is_percpu_thread() leaves .noinstr.text section Reported-by: Stephen Rothwell Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210928084218.063371959@infradead.org commit 703066188f63d66cc6b9d678e5b5ef1213c5938e Author: Mel Gorman Date: Mon Sep 27 12:46:35 2021 +0100 sched/fair: Null terminate buffer when updating tunable_scaling This patch null-terminates the temporary buffer in sched_scaling_write() so kstrtouint() does not return failure and checks the value is valid. Before: $ cat /sys/kernel/debug/sched/tunable_scaling 1 $ echo 0 > /sys/kernel/debug/sched/tunable_scaling -bash: echo: write error: Invalid argument $ cat /sys/kernel/debug/sched/tunable_scaling 1 After: $ cat /sys/kernel/debug/sched/tunable_scaling 1 $ echo 0 > /sys/kernel/debug/sched/tunable_scaling $ cat /sys/kernel/debug/sched/tunable_scaling 0 $ echo 3 > /sys/kernel/debug/sched/tunable_scaling -bash: echo: write error: Invalid argument Fixes: 8a99b6833c88 ("sched: Move SCHED_DEBUG sysctl to debugfs") Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Acked-by: Vincent Guittot Link: https://lore.kernel.org/r/20210927114635.GH3959@techsingularity.net commit 2630cde26711dab0d0b56a8be1616475be646d13 Author: Michal Koutný Date: Fri Sep 17 17:30:37 2021 +0200 sched/fair: Add ancestors of unthrottled undecayed cfs_rq Since commit a7b359fc6a37 ("sched/fair: Correctly insert cfs_rq's to list on unthrottle") we add cfs_rqs with no runnable tasks but not fully decayed into the load (leaf) list. We may ignore adding some ancestors and therefore breaking tmp_alone_branch invariant. This broke LTP test cfs_bandwidth01 and it was partially fixed in commit fdaba61ef8a2 ("sched/fair: Ensure that the CFS parent is added after unthrottling"). I noticed the named test still fails even with the fix (but with low probability, 1 in ~1000 executions of the test). The reason is when bailing out of unthrottle_cfs_rq early, we may miss adding ancestors of the unthrottled cfs_rq, thus, not joining tmp_alone_branch properly. Fix this by adding ancestors if we notice the unthrottled cfs_rq was added to the load list. Fixes: a7b359fc6a37 ("sched/fair: Correctly insert cfs_rq's to list on unthrottle") Signed-off-by: Michal Koutný Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Reviewed-by: Odin Ugedal Link: https://lore.kernel.org/r/20210917153037.11176-1-mkoutny@suse.com commit f792565326825ed806626da50c6f9a928f1079c1 Author: Song Liu Date: Wed Sep 29 12:43:13 2021 -0700 perf/core: fix userpage->time_enabled of inactive events Users of rdpmc rely on the mmapped user page to calculate accurate time_enabled. Currently, userpage->time_enabled is only updated when the event is added to the pmu. As a result, inactive event (due to counter multiplexing) does not have accurate userpage->time_enabled. This can be reproduced with something like: /* open 20 task perf_event "cycles", to create multiplexing */ fd = perf_event_open(); /* open task perf_event "cycles" */ userpage = mmap(fd); /* use mmap and rdmpc */ while (true) { time_enabled_mmap = xxx; /* use logic in perf_event_mmap_page */ time_enabled_read = read(fd).time_enabled; if (time_enabled_mmap > time_enabled_read) BUG(); } Fix this by updating userpage for inactive events in merge_sched_in. Suggested-by: Peter Zijlstra (Intel) Reported-and-tested-by: Lucian Grijincu Signed-off-by: Song Liu Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210929194313.2398474-1-songliubraving@fb.com commit ecc2123e09f9e71ddc6c53d71e283b8ada685fe2 Author: Kan Liang Date: Tue Sep 28 08:19:03 2021 -0700 perf/x86/intel: Update event constraints for ICX According to the latest event list, the event encoding 0xEF is only available on the first 4 counters. Add it into the event constraints table. Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support") Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/1632842343-25862-1-git-send-email-kan.liang@linux.intel.com commit 02d029a41dc986e2d5a77ecca45803857b346829 Author: Anand K Mistry Date: Wed Sep 29 17:04:21 2021 +1000 perf/x86: Reset destroy callback on event init failure perf_init_event tries multiple init callbacks and does not reset the event state between tries. When x86_pmu_event_init runs, it unconditionally sets the destroy callback to hw_perf_event_destroy. On the next init attempt after x86_pmu_event_init, in perf_try_init_event, if the pmu's capabilities includes PERF_PMU_CAP_NO_EXCLUDE, the destroy callback will be run. However, if the next init didn't set the destroy callback, hw_perf_event_destroy will be run (since the callback wasn't reset). Looking at other pmu init functions, the common pattern is to only set the destroy callback on a successful init. Resetting the callback on failure tries to replicate that pattern. This was discovered after commit f11dd0d80555 ("perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op") when the second (and only second) run of the perf tool after a reboot results in 0 samples being generated. The extra run of hw_perf_event_destroy results in active_events having an extra decrement on each perf run. The second run has active_events == 0 and every subsequent run has active_events < 0. When active_events == 0, the NMI handler will early-out and not record any samples. Signed-off-by: Anand K Mistry Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210929170405.1.I078b98ee7727f9ae9d6df8262bad7e325e40faf0@changeid commit 24ff652573754fe4c03213ebd26b17e86842feb3 Author: Peter Zijlstra Date: Thu Sep 30 12:43:10 2021 +0200 objtool: Teach get_alt_entry() about more relocation types Occasionally objtool encounters symbol (as opposed to section) relocations in .altinstructions. Typically they are the alternatives written by elf_add_alternative() as encountered on a noinstr validation run on vmlinux after having already ran objtool on the individual .o files. Basically this is the counterpart of commit 44f6a7c0755d ("objtool: Fix seg fault with Clang non-section symbols"), because when these new assemblers (binutils now also does this) strip the section symbols, elf_add_reloc_to_insn() is forced to emit symbol based relocations. As such, teach get_alt_entry() about different relocation types. Fixes: 9bc0bb50727c ("objtool/x86: Rewrite retpoline thunk calls") Reported-by: Stephen Rothwell Reported-by: Borislav Petkov Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/YVWUvknIEVNkPvnP@hirez.programming.kicks-ass.net commit 6e3cd95234dc1eda488f4f487c281bac8fef4d9b Author: Thomas Gleixner Date: Thu Sep 30 19:21:39 2021 +0200 x86/hpet: Use another crystalball to evaluate HPET usability On recent Intel systems the HPET stops working when the system reaches PC10 idle state. The approach of adding PCI ids to the early quirks to disable HPET on these systems is a whack a mole game which makes no sense. Check for PC10 instead and force disable HPET if supported. The check is overbroad as it does not take ACPI, intel_idle enablement and command line parameters into account. That's fine as long as there is at least PMTIMER available to calibrate the TSC frequency. The decision can be overruled by adding "hpet=force" on the kernel command line. Remove the related early PCI quirks for affected Ice Cake and Coffin Lake systems as they are not longer required. That should also cover all other systems, i.e. Tiger Rag and newer generations, which are most likely affected by this as well. Fixes: Yet another hardware trainwreck Reported-by: Jakub Kicinski Signed-off-by: Thomas Gleixner Tested-by: Jakub Kicinski Reviewed-by: Rafael J. Wysocki Cc: stable@vger.kernel.org Cc: Kai-Heng Feng Cc: Bjorn Helgaas commit 06f2ac3d4219bbbfd93d79e01966a42053084f11 Author: Tom Lendacky Date: Thu Sep 30 23:42:01 2021 -0500 x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0] After returning from a VMGEXIT NAE event, SW_EXITINFO1[31:0] is checked for a value of 1, which indicates an error and that SW_EXITINFO2 contains exception information. However, future versions of the GHCB specification may define new values for SW_EXITINFO1[31:0], so really any non-zero value should be treated as an error. Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Cc: # 5.10+ Link: https://lkml.kernel.org/r/efc772af831e9e7f517f0439b13b41f56bad8784.1633063321.git.thomas.lendacky@amd.com commit a2083eeb119fb9307258baea9b7c243ca9a2e0b6 Author: Johannes Berg Date: Thu Sep 30 13:11:21 2021 +0200 cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() The SSID pointer is pointing to RCU protected data, so we need to have it under rcu_read_lock() for the entire use. Fix this. Cc: stable@vger.kernel.org Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning") Link: https://lore.kernel.org/r/20210930131120.6ddfc603aa1d.I2137344c4e2426525b1a8e4ce5fca82f8ecbfe7e@changeid Signed-off-by: Johannes Berg commit 636707e593120c9fa35f6a908c0d052f6154910d Author: Johannes Berg Date: Thu Sep 30 13:11:20 2021 +0200 mac80211: mesh: fix HE operation element length check The length check here was bad, if the length doesn't at least include the length of the fixed part, we cannot call ieee80211_he_oper_size() to determine the total. Fix this, and convert to cfg80211_find_ext_elem() while at it. Cc: stable@vger.kernel.org Fixes: 70debba3ab7d ("mac80211: save HE oper info in BSS config for mesh") Link: https://lore.kernel.org/r/20210930131120.b0f940976c56.I954e1be55e9f87cc303165bff5c906afe1e54648@changeid Signed-off-by: Johannes Berg commit 2b987fe84429361c7f189568c476d1bd00d2ff7e Author: Chris Chiu Date: Fri Oct 1 14:28:56 2021 +0800 ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254 The headphone mic is not working on Dell Latitude laptops with ALC3254. The codec vendor id is 0x10ec0295 and share the same pincfg as defined in ALC295_STANDARD_PINS. So the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE will be applied per alc269_pin_fixup_tbl[] but actually the headphone mic is using NID 0x1b instead of 0x1a. The ALC269_FIXUP_DELL4_MIC_NO_PRESENCE need to be applied instead. Use ALC269_FIXUP_DELL4_MIC_NO_PRESENCE for particular models before a generic fixup comes out. Signed-off-by: Chris Chiu Cc: Link: https://lore.kernel.org/r/20211001062856.1037901-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit f2c77973507fd116c3657df1dc048864a2b16a1c Author: Zhang Yi Date: Fri Sep 10 16:03:16 2021 +0800 ext4: recheck buffer uptodate bit under buffer lock Commit 8e33fadf945a ("ext4: remove an unnecessary if statement in __ext4_get_inode_loc()") forget to recheck buffer's uptodate bit again under buffer lock, which may overwrite the buffer if someone else have already brought it uptodate and changed it. Fixes: 8e33fadf945a ("ext4: remove an unnecessary if statement in __ext4_get_inode_loc()") Cc: stable@kernel.org Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210910080316.70421-1-yi.zhang@huawei.com commit 42cb447410d024e9d54139ae9c21ea132a8c384c Author: yangerkun Date: Tue Sep 14 19:14:15 2021 +0800 ext4: fix potential infinite loop in ext4_dx_readdir() When ext4_htree_fill_tree() fails, ext4_dx_readdir() can run into an infinite loop since if info->last_pos != ctx->pos this will reset the directory scan and reread the failing entry. For example: 1. a dx_dir which has 3 block, block 0 as dx_root block, block 1/2 as leaf block which own the ext4_dir_entry_2 2. block 1 read ok and call_filldir which will fill the dirent and update the ctx->pos 3. block 2 read fail, but we has already fill some dirent, so we will return back to userspace will a positive return val(see ksys_getdents64) 4. the second ext4_dx_readdir will reset the world since info->last_pos != ctx->pos, and will also init the curr_hash which pos to block 1 5. So we will read block1 too, and once block2 still read fail, we can only fill one dirent because the hash of the entry in block1(besides the last one) won't greater than curr_hash 6. this time, we forget update last_pos too since the read for block2 will fail, and since we has got the one entry, ksys_getdents64 can return success 7. Latter we will trapped in a loop with step 4~6 Cc: stable@kernel.org Signed-off-by: yangerkun Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210914111415.3921954-1-yangerkun@huawei.com commit bb9464e08309f6befe80866f5be51778ca355ee9 Author: yangerkun Date: Fri Sep 24 17:39:17 2021 +0800 ext4: flush s_error_work before journal destroy in ext4_fill_super The error path in ext4_fill_super forget to flush s_error_work before journal destroy, and it may trigger the follow bug since flush_stashed_error_work can run concurrently with journal destroy without any protection for sbi->s_journal. [32031.740193] EXT4-fs (loop66): get root inode failed [32031.740484] EXT4-fs (loop66): mount failed [32031.759805] ------------[ cut here ]------------ [32031.759807] kernel BUG at fs/jbd2/transaction.c:373! [32031.760075] invalid opcode: 0000 [#1] SMP PTI [32031.760336] CPU: 5 PID: 1029268 Comm: kworker/5:1 Kdump: loaded 4.18.0 [32031.765112] Call Trace: [32031.765375] ? __switch_to_asm+0x35/0x70 [32031.765635] ? __switch_to_asm+0x41/0x70 [32031.765893] ? __switch_to_asm+0x35/0x70 [32031.766148] ? __switch_to_asm+0x41/0x70 [32031.766405] ? _cond_resched+0x15/0x40 [32031.766665] jbd2__journal_start+0xf1/0x1f0 [jbd2] [32031.766934] jbd2_journal_start+0x19/0x20 [jbd2] [32031.767218] flush_stashed_error_work+0x30/0x90 [ext4] [32031.767487] process_one_work+0x195/0x390 [32031.767747] worker_thread+0x30/0x390 [32031.768007] ? process_one_work+0x390/0x390 [32031.768265] kthread+0x10d/0x130 [32031.768521] ? kthread_flush_work_fn+0x10/0x10 [32031.768778] ret_from_fork+0x35/0x40 static int start_this_handle(...) BUG_ON(journal->j_flags & JBD2_UNMOUNT); <---- Trigger this Besides, after we enable fast commit, ext4_fc_replay can add work to s_error_work but return success, so the latter journal destroy in ext4_load_journal can trigger this problem too. Fix this problem with two steps: 1. Call ext4_commit_super directly in ext4_handle_error for the case that called from ext4_fc_replay 2. Since it's hard to pair the init and flush for s_error_work, we'd better add a extras flush_work before journal destroy in ext4_fill_super Besides, this patch will call ext4_commit_super in ext4_handle_error for any nojournal case too. But it seems safe since the reason we call schedule_work was that we should save error info to sb through journal if available. Conversely, for the nojournal case, it seems useless delay commit superblock to s_error_work. Fixes: c92dc856848f ("ext4: defer saving error info from atomic context") Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") Cc: stable@kernel.org Signed-off-by: yangerkun Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210924093917.1953239-1-yangerkun@huawei.com commit 75ca6ad408f459f00b09a64f04c774559848c097 Author: Ritesh Harjani Date: Sat Jun 5 10:39:32 2021 +0530 ext4: fix loff_t overflow in ext4_max_bitmap_size() We should use unsigned long long rather than loff_t to avoid overflow in ext4_max_bitmap_size() for comparison before returning. w/o this patch sbi->s_bitmap_maxbytes was becoming a negative value due to overflow of upper_limit (with has_huge_files as true) Below is a quick test to trigger it on a 64KB pagesize system. sudo mkfs.ext4 -b 65536 -O ^has_extents,^64bit /dev/loop2 sudo mount /dev/loop2 /mnt sudo echo "hello" > /mnt/hello -> This will error out with "echo: write error: File too large" Signed-off-by: Ritesh Harjani Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Link: https://lore.kernel.org/r/594f409e2c543e90fd836b78188dfa5c575065ba.1622867594.git.riteshh@linux.ibm.com Signed-off-by: Theodore Ts'o commit 6fed83957f21eff11c8496e9f24253b03d2bc1dc Author: Jeffle Xu Date: Mon Aug 23 14:13:58 2021 +0800 ext4: fix reserved space counter leakage When ext4_insert_delayed block receives and recovers from an error from ext4_es_insert_delayed_block(), e.g., ENOMEM, it does not release the space it has reserved for that block insertion as it should. One effect of this bug is that s_dirtyclusters_counter is not decremented and remains incorrectly elevated until the file system has been unmounted. This can result in premature ENOSPC returns and apparent loss of free space. Another effect of this bug is that /sys/fs/ext4//delayed_allocation_blocks can remain non-zero even after syncfs has been executed on the filesystem. Besides, add check for s_dirtyclusters_counter when inode is going to be evicted and freed. s_dirtyclusters_counter can still keep non-zero until inode is written back in .evict_inode(), and thus the check is delayed to .destroy_inode(). Fixes: 51865fda28e5 ("ext4: let ext4 maintain extent status tree") Cc: stable@kernel.org Suggested-by: Gao Xiang Signed-off-by: Jeffle Xu Reviewed-by: Eric Whitney Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210823061358.84473-1-jefflexu@linux.alibaba.com commit a2c2f0826e2b75560b31daf1cd9a755ab93cf4c6 Author: Hou Tao Date: Fri Aug 20 12:45:05 2021 +0800 ext4: limit the number of blocks in one ADD_RANGE TLV Now EXT4_FC_TAG_ADD_RANGE uses ext4_extent to track the newly-added blocks, but the limit on the max value of ee_len field is ignored, and it can lead to BUG_ON as shown below when running command "fallocate -l 128M file" on a fast_commit-enabled fs: kernel BUG at fs/ext4/ext4_extents.h:199! invalid opcode: 0000 [#1] SMP PTI CPU: 3 PID: 624 Comm: fallocate Not tainted 5.14.0-rc6+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:ext4_fc_write_inode_data+0x1f3/0x200 Call Trace: ? ext4_fc_write_inode+0xf2/0x150 ext4_fc_commit+0x93b/0xa00 ? ext4_fallocate+0x1ad/0x10d0 ext4_sync_file+0x157/0x340 ? ext4_sync_file+0x157/0x340 vfs_fsync_range+0x49/0x80 do_fsync+0x3d/0x70 __x64_sys_fsync+0x14/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Simply fixing it by limiting the number of blocks in one EXT4_FC_TAG_ADD_RANGE TLV. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Cc: stable@kernel.org Signed-off-by: Hou Tao Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210820044505.474318-1-houtao1@huawei.com commit 8001f21fcd03253ba0eeac6f91f79239ac03ee60 Author: Moritz Fischer Date: Mon Sep 27 21:27:24 2021 -0700 MAINTAINERS: Add Hao and Yilun as maintainers Hao and Yilun have agreed to help out with maintenance. Both have been active in the Linux FPGA community for a long time and we need backups for vacation and load-balancing. Cc: Xu Yilun Cc: Wu Hao Cc: Greg Kroah-Hartman Acked-by: Xu Yilun Acked-by: Wu Hao Signed-off-by: Moritz Fischer commit 87ffb310d5e8a441721a9d04dfa7c90cd9da3916 Author: Dan Carpenter Date: Thu Sep 30 15:24:56 2021 +0300 ksmbd: missing check for NULL in convert_to_nt_pathname() The kmalloc() does not have a NULL check. This code can be re-written slightly cleaner to just use the kstrdup(). Fixes: 265fd1991c1d ("ksmbd: use LOOKUP_BENEATH to prevent the out of share access") Signed-off-by: Dan Carpenter Acked-by: Namjae Jeon Acked-by: Hyunchul Lee Signed-off-by: Steve French commit ca6e11c337daf7925ff8a2aac8e84490a8691905 Author: Pavel Skripkin Date: Thu Sep 30 20:50:28 2021 +0300 phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure. Link: https://lore.kernel.org/netdev/YVMRWNDZDUOvQjHL@shell.armlinux.org.uk/ Fixes: 46abc02175b3 ("phylib: give mdio buses a device tree presence") Reported-and-tested-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com Reviewed-by: Dan Carpenter Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/eceae1429fbf8fa5c73dd2a0d39d525aa905074d.1633024062.git.paskripkin@gmail.com Signed-off-by: Jakub Kicinski commit 10eff1f5788b6ffac212c254e2f3666219576889 Author: Pavel Skripkin Date: Thu Sep 30 20:49:42 2021 +0300 Revert "net: mdiobus: Fix memory leak in __mdiobus_register" This reverts commit ab609f25d19858513919369ff3d9a63c02cd9e2e. This patch is correct in the sense that we _should_ call device_put() in case of device_register() failure, but the problem in this code is more vast. We need to set bus->state to UNMDIOBUS_REGISTERED before calling device_register() to correctly release the device in mdiobus_free(). This patch prevents us from doing it, since in case of device_register() failure put_device() will be called 2 times and it will cause UAF or something else. Also, Reported-by: tag in revered commit was wrong, since syzbot reported different leak in same function. Link: https://lore.kernel.org/netdev/20210928092657.GI2048@kadam/ Acked-by: Yanfei Xu Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/f12fb1faa4eccf0f355788225335eb4309ff2599.1633024062.git.paskripkin@gmail.com Signed-off-by: Jakub Kicinski commit 4de593fb965fc2bd11a0b767e0c65ff43540a6e4 Merge: 115f6134a050b 35306eb238144 Author: Linus Torvalds Date: Thu Sep 30 14:28:05 2021 -0700 Merge tag 'net-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Networking fixes, including fixes from mac80211, netfilter and bpf. Current release - regressions: - bpf, cgroup: assign cgroup in cgroup_sk_alloc when called from interrupt - mdio: revert mechanical patches which broke handling of optional resources - dev_addr_list: prevent address duplication Previous releases - regressions: - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb (NULL deref) - Revert "mac80211: do not use low data rates for data frames with no ack flag", fixing broadcast transmissions - mac80211: fix use-after-free in CCMP/GCMP RX - netfilter: include zone id in tuple hash again, minimize collisions - netfilter: nf_tables: unlink table before deleting it (race -> UAF) - netfilter: log: work around missing softdep backend module - mptcp: don't return sockets in foreign netns - sched: flower: protect fl_walk() with rcu (race -> UAF) - ixgbe: fix NULL pointer dereference in ixgbe_xdp_setup - smsc95xx: fix stalled rx after link change - enetc: fix the incorrect clearing of IF_MODE bits - ipv4: fix rtnexthop len when RTA_FLOW is present - dsa: mv88e6xxx: 6161: use correct MAX MTU config method for this SKU - e100: fix length calculation & buffer overrun in ethtool::get_regs Previous releases - always broken: - mac80211: fix using stale frag_tail skb pointer in A-MSDU tx - mac80211: drop frames from invalid MAC address in ad-hoc mode - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses (race -> UAF) - bpf, x86: Fix bpf mapping of atomic fetch implementation - bpf: handle return value of BPF_PROG_TYPE_STRUCT_OPS prog - netfilter: ip6_tables: zero-initialize fragment offset - mhi: fix error path in mhi_net_newlink - af_unix: return errno instead of NULL in unix_create1() when over the fs.file-max limit Misc: - bpf: exempt CAP_BPF from checks against bpf_jit_limit - netfilter: conntrack: make max chain length random, prevent guessing buckets by attackers - netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic, defer conntrack walk to work queue (prevent hogging RTNL lock)" * tag 'net-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits) af_unix: fix races in sk_peer_pid and sk_peer_cred accesses net: stmmac: fix EEE init issue when paired with EEE capable PHYs net: dev_addr_list: handle first address in __hw_addr_add_ex net: sched: flower: protect fl_walk() with rcu net: introduce and use lock_sock_fast_nested() net: phy: bcm7xxx: Fixed indirect MMD operations net: hns3: disable firmware compatible features when uninstall PF net: hns3: fix always enable rx vlan filter problem after selftest net: hns3: PF enable promisc for VF when mac table is overflow net: hns3: fix show wrong state when add existing uc mac address net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE net: hns3: don't rollback when destroy mqprio fail net: hns3: remove tc enable checking net: hns3: do not allow call hns3_nic_net_open repeatedly ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup net: bridge: mcast: Associate the seqcount with its protecting lock. net: mdio-ipq4019: Fix the error for an optional regs resource net: hns3: fix hclge_dbg_dump_tm_pg() stack usage net: mdio: mscc-miim: Fix the mdio controller af_unix: Return errno instead of NULL in unix_create1(). ... commit 4729445b47efebf089da4ccbcd1b116ffa2ad4af Author: Kumar Kartikeya Dwivedi Date: Thu Sep 30 11:46:34 2021 +0530 libbpf: Fix segfault in light skeleton for objects without BTF When fed an empty BPF object, bpftool gen skeleton -L crashes at btf__set_fd() since it assumes presence of obj->btf, however for the sequence below clang adds no .BTF section (hence no BTF). Reproducer: $ touch a.bpf.c $ clang -O2 -g -target bpf -c a.bpf.c $ bpftool gen skeleton -L a.bpf.o /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ /* THIS FILE IS AUTOGENERATED! */ struct a_bpf { struct bpf_loader_ctx ctx; Segmentation fault (core dumped) The same occurs for files compiled without BTF info, i.e. without clang's -g flag. Fixes: 67234743736a (libbpf: Generate loader program out of BPF ELF file.) Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210930061634.1840768-1-memxor@gmail.com commit 3bf1742f3c69501dec300b55917b9352428cb4dd Author: Aya Levin Date: Mon Sep 13 16:49:47 2021 +0300 net/mlx5e: Mutually exclude setting of TX-port-TS and MQPRIO in channel mode TX-port-TS hijacks the PTP traffic to a specific HW TX-queue. This conflicts with MQPRIO in channel mode, which specifies explicitly which TC accepts the packet. This patch mutually excludes the above configuration. Fixes: ec60c4581bd9 ("net/mlx5e: Support MQPRIO channel mode") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit dd1979cf3c710398a9eeba4853b908fe16426814 Author: Lama Kayal Date: Sun Aug 29 11:26:03 2021 +0300 net/mlx5e: Fix the presented RQ index in PTP stats PTP-RQ counters title format contains PTP-RQ identifier, which is mistakenly not passed to sprinft(). This leads to unexpected garbage values instead. This patch fixes it. Before applying the patch: ethtool -S eth3 | grep ptp_rq ptp_rq15_packets: 0 ptp_rq8_bytes: 0 ptp_rq6_csum_complete: 0 ptp_rq14_csum_complete_tail: 0 ptp_rq3_csum_complete_tail_slow : 0 ptp_rq9_csum_unnecessary: 0 ptp_rq1_csum_unnecessary_inner: 0 ptp_rq7_csum_none: 0 ptp_rq10_xdp_drop: 0 ptp_rq9_xdp_redirect: 0 ptp_rq13_lro_packets: 0 ptp_rq12_lro_bytes: 0 ptp_rq10_ecn_mark: 0 ptp_rq9_removed_vlan_packets: 0 ptp_rq5_wqe_err: 0 ptp_rq8_mpwqe_filler_cqes: 0 ptp_rq2_mpwqe_filler_strides: 0 ptp_rq5_oversize_pkts_sw_drop: 0 ptp_rq6_buff_alloc_err: 0 ptp_rq15_cqe_compress_blks: 0 ptp_rq2_cqe_compress_pkts: 0 ptp_rq2_cache_reuse: 0 ptp_rq12_cache_full: 0 ptp_rq11_cache_empty: 256 ptp_rq12_cache_busy: 0 ptp_rq11_cache_waive: 0 ptp_rq12_congst_umr: 0 ptp_rq11_arfs_err: 0 ptp_rq9_recover: 0 After applying the patch: ethtool -S eth3 | grep ptp_rq ptp_rq0_packets: 0 ptp_rq0_bytes: 0 ptp_rq0_csum_complete: 0 ptp_rq0_csum_complete_tail: 0 ptp_rq0_csum_complete_tail_slow : 0 ptp_rq0_csum_unnecessary: 0 ptp_rq0_csum_unnecessary_inner: 0 ptp_rq0_csum_none: 0 ptp_rq0_xdp_drop: 0 ptp_rq0_xdp_redirect: 0 ptp_rq0_lro_packets: 0 ptp_rq0_lro_bytes: 0 ptp_rq0_ecn_mark: 0 ptp_rq0_removed_vlan_packets: 0 ptp_rq0_wqe_err: 0 ptp_rq0_mpwqe_filler_cqes: 0 ptp_rq0_mpwqe_filler_strides: 0 ptp_rq0_oversize_pkts_sw_drop: 0 ptp_rq0_buff_alloc_err: 0 ptp_rq0_cqe_compress_blks: 0 ptp_rq0_cqe_compress_pkts: 0 ptp_rq0_cache_reuse: 0 ptp_rq0_cache_full: 0 ptp_rq0_cache_empty: 256 ptp_rq0_cache_busy: 0 ptp_rq0_cache_waive: 0 ptp_rq0_congst_umr: 0 ptp_rq0_arfs_err: 0 ptp_rq0_recover: 0 Fixes: a28359e922c6 ("net/mlx5e: Add PTP-RX statistics") Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit f88c4876347400a577598e06f1b230a7b19ee0e9 Author: Shay Drory Date: Tue Sep 14 10:13:02 2021 +0300 net/mlx5: Fix setting number of EQs of SFs When setting number of completion EQs of the SF, consider number of online CPUs. Without this consideration, when number of online cpus are less than 8, unnecessary 8 completion EQs are allocated. Fixes: c36326d38d93 ("net/mlx5: Round-Robin EQs over IRQs") Signed-off-by: Shay Drory Reviewed-by: Parav Pandit Signed-off-by: Saeed Mahameed commit ac8b7d50ae4c3f5325c599f3d6e939ecef6a585a Author: Shay Drory Date: Thu Aug 19 16:01:28 2021 +0300 net/mlx5: Fix length of irq_index in chars The maximum irq_index can be 2047, This means irq_name should have 4 characters reserve for the irq_index. Hence, increase it to 4. Fixes: 3af26495a247 ("net/mlx5: Enlarge interrupt field in CREATE_EQ") Signed-off-by: Shay Drory Reviewed-by: Parav Pandit Signed-off-by: Saeed Mahameed commit 99b9a678b2e474756770900595cb09c94498bfca Author: Aya Levin Date: Thu Sep 23 15:30:01 2021 +0300 net/mlx5: Avoid generating event after PPS out in Real time mode When in Real-time mode, HW clock is synced with the PTP daemon. Hence driver should not re-calibrate the next pulse (via MTPPSE repetitive events mechanism). This patch arms repetitive events only in free-running mode. Fixes: 432119de33d9 ("net/mlx5: Add cyc2time HW translation mode support") Signed-off-by: Aya Levin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 64728294703e77827cc31a1b164ca867400067f5 Author: Aya Levin Date: Thu Sep 23 16:56:09 2021 +0300 net/mlx5: Force round second at 1PPS out start time Allow configuration of 1PPS start time only with time-stamp representing a round second. Prior to this patch driver allowed setting of a non-round-second which is not supported by the device. Avoid unexpected behavior by restricting start-time configuration to a round-second. Fixes: 4272f9b88db9 ("net/mlx5e: Change 1PPS out scheme") Signed-off-by: Aya Levin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit a586775f83bd729ad60b56352dbe067f4bb0beee Author: Moshe Shemesh Date: Thu Sep 23 17:57:47 2021 +0300 net/mlx5: E-Switch, Fix double allocation of acl flow counter Flow counter is allocated in eswitch legacy acl setting functions without checking if already allocated by previous setting. Add a check to avoid such double allocation. Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes") Fixes: ea651a86d468 ("net/mlx5: E-Switch, Refactor eswitch egress acl codes") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 7dbc849b2ab3b8ea8f767361c46f914bb2b7779d Author: Tariq Toukan Date: Wed Sep 29 15:51:26 2021 +0300 net/mlx5e: Improve MQPRIO resiliency * Add netdev->tc_to_txq rollback in case of failure in mlx5e_update_netdev_queues(). * Fix broken transition between the two modes: MQPRIO DCB mode with tc==8, and MQPRIO channel mode. * Disable MQPRIO channel mode if re-attaching with a different number of channels. * Improve code sharing. Fixes: ec60c4581bd9 ("net/mlx5e: Support MQPRIO channel mode") Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit 9d758d4a3a039b9d7086d4759ed255b748713eee Author: Tariq Toukan Date: Thu Sep 2 10:33:32 2021 +0300 net/mlx5e: Keep the value for maximum number of channels in-sync The value for maximum number of channels is first calculated based on the netdev's profile and current function resources (specifically, number of MSIX vectors, which depends among other things on the number of online cores in the system). This value is then used to calculate the netdev's number of rxqs/txqs. Once created (by alloc_etherdev_mqs), the number of netdev's rxqs/txqs is constant and we must not exceed it. To achieve this, keep the maximum number of channels in sync upon any netdevice re-attach. Use mlx5e_get_max_num_channels() for calculating the number of netdev's rxqs/txqs. After netdev is created, use mlx5e_calc_max_nch() (which coinsiders core device resources, profile, and netdev) to init or update priv->max_nch. Before this patch, the value of priv->max_nch might get out of sync, mistakenly allowing accesses to out-of-bounds objects, which would crash the system. Track the number of channels stats structures used in a separate field, as they are persistent to suspend/resume operations. All the collected stats of every channel index that ever existed should be preserved. They are reset only when struct mlx5e_priv is, in mlx5e_priv_cleanup(), which is part of the profile changing flow. There is no point anymore in blocking a profile change due to max_nch mismatch in mlx5e_netdev_change_profile(). Remove the limitation. Fixes: a1f240f18017 ("net/mlx5e: Adjust to max number of channles when re-attaching") Signed-off-by: Tariq Toukan Reviewed-by: Aya Levin Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit f9a10440f0b1f33faa792af26f4e9823a9b8b6a4 Author: Raed Salem Date: Thu Aug 26 17:07:17 2021 +0300 net/mlx5e: IPSEC RX, enable checksum complete Currently in Rx data path IPsec crypto offloaded packets uses csum_none flag, so checksum is handled by the stack, this naturally have some performance/cpu utilization impact on such flows. As Nvidia NIC starting from ConnectX6DX provides checksum complete value out of the box also for such flows there is no sense in taking csum_none path, furthermore the stack (xfrm) have the method to handle checksum complete corrections for such flows i.e. IPsec trailer removal and consequently checksum value adjustment. Because of the above and in addition the ConnectX6DX is the first HW which supports IPsec crypto offload then it is safe to report csum complete for IPsec offloaded traffic. Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload") Signed-off-by: Raed Salem Signed-off-by: Saeed Mahameed commit f2e717d655040d632c9015f19aa4275f8b16e7f2 Author: Trond Myklebust Date: Thu Sep 30 15:44:41 2021 -0400 nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero RFC3530 notes that the 'dircount' field may be zero, in which case the recommendation is to ignore it, and only enforce the 'maxcount' field. In RFC5661, this recommendation to ignore a zero valued field becomes a requirement. Fixes: aee377644146 ("nfsd4: fix rd_dircount enforcement") Cc: Signed-off-by: Trond Myklebust Signed-off-by: Chuck Lever commit 115f6134a050bb098414f38555a5ab780ebbfef0 Merge: 78c56e53821a7 040d985e27dc3 Author: Linus Torvalds Date: Thu Sep 30 12:11:35 2021 -0700 Merge tag 'gpio-fixes-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "A single fix for the gpio-pca953x driver and two commits updating the MAINTAINERS entries for Mun Yew Tham (GPIO specific) and myself (treewide after a change in professional situation). Summary: - don't ignore I2C errors in gpio-pca953x - update MAINTAINERS entries for Mun Yew Tham and myself" * tag 'gpio-fixes-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: Update Mun Yew Tham as Altera Pio Driver maintainer MAINTAINERS: update my email address gpio: pca953x: do not ignore i2c errors commit 78c56e53821a7ec3462ce448c1fe6a8d44358831 Merge: 02d5e016800d0 e671f0ecfece1 Author: Linus Torvalds Date: Thu Sep 30 12:00:46 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Not much too exciting here, although two syzkaller bugs that seem to have 9 lives may have finally been squashed. Several core bugs and a batch of driver bug fixes: - Fix compilation problems in qib and hfi1 - Do not corrupt the joined multicast group state when using SEND_ONLY - Several CMA bugs, a reference leak for listening and two syzkaller crashers - Various bug fixes for irdma - Fix a Sleeping while atomic bug in usnic - Properly sanitize kernel pointers in dmesg - Two bugs in the 64b CQE support for hns" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Add the check of the CQE size of the user space RDMA/hns: Fix the size setting error when copying CQE in clean_cq() RDMA/hfi1: Fix kernel pointer leak RDMA/usnic: Lock VF with mutex instead of spinlock RDMA/hns: Work around broken constant propagation in gcc 8 RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests RDMA/cma: Do not change route.addr.src_addr.ss_family RDMA/irdma: Report correct WC error when there are MW bind errors RDMA/irdma: Report correct WC error when transport retry counter is exceeded RDMA/irdma: Validate number of CQ entries on create CQ RDMA/irdma: Skip CQP ring during a reset MAINTAINERS: Update Broadcom RDMA maintainers RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure IB/cma: Do not send IGMP leaves for sendonly Multicast groups IB/qib: Fix clang confusion of NULL pointer comparison commit 35afb70dcfe4eb445060dd955e5b67d962869ce5 Author: Konstantin Komarov Date: Wed Sep 29 19:29:52 2021 +0300 fs/ntfs3: Check for NULL if ATTR_EA_INFO is incorrect This can be reason for reported panic https://lore.kernel.org/ntfs3/f9de5807-2311-7374-afb0-bc5dffb522c0@gmail.com/ Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Reported-by: Mohammad Rasim Signed-off-by: Konstantin Komarov commit dbf59e2a33d2cb5ae0534523fd3d6d8bda808be8 Author: Konstantin Komarov Date: Tue Sep 28 19:19:49 2021 +0300 fs/ntfs3: Refactoring of ntfs_init_from_boot Remove ntfs_sb_info members sector_size and sector_bits. Print details why mount failed. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 09f7c338da7818fd33af401d855b895550e7c170 Author: Konstantin Komarov Date: Tue Sep 28 19:19:17 2021 +0300 fs/ntfs3: Reject mount if boot's cluster size < media sector size If we continue to work in this case, then we can corrupt fs. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block"). Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 1d625050c7c2dd877e108e382b8aaf1ae3cfe1f4 Author: Patrick Ho Date: Sat Aug 21 02:56:26 2021 -0400 nfsd: fix error handling of register_pernet_subsys() in init_nfsd() init_nfsd() should not unregister pernet subsys if the register fails but should instead unwind from the last successful operation which is register_filesystem(). Unregistering a failed register_pernet_subsys() call can result in a kernel GPF as revealed by programmatically injecting an error in register_pernet_subsys(). Verified the fix handled failure gracefully with no lingering nfsd entry in /proc/filesystems. This change was introduced by the commit bd5ae9288d64 ("nfsd: register pernet ops last, unregister first"), the original error handling logic was correct. Fixes: bd5ae9288d64 ("nfsd: register pernet ops last, unregister first") Cc: stable@vger.kernel.org Signed-off-by: Patrick Ho Acked-by: J. Bruce Fields Signed-off-by: Chuck Lever commit 4227f811cdeb4d85db91ea6b9adf9ac049cec12e Author: Namjae Jeon Date: Wed Sep 29 19:52:51 2021 +0900 ksmbd: fix transform header validation Validate that the transform and smb request headers are present before checking OriginalMessageSize and SessionId fields. Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Sergey Senozhatsky Reviewed-by: Tom Talpey Acked-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 8f77150c15f87796570125a43509f9a81a3d9e49 Author: Hyunchul Lee Date: Fri Sep 24 22:22:22 2021 +0900 ksmbd: add buffer validation for SMB2_CREATE_CONTEXT Add buffer validation for SMB2_CREATE_CONTEXT. Cc: Ronnie Sahlberg Reviewed-by: Ralph Boehme Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 442ff9ebeb0129e90483356f3d79c732e632a7a6 Author: Namjae Jeon Date: Wed Sep 29 15:44:32 2021 +0900 ksmbd: add validation in smb2 negotiate This patch add validation to check request buffer check in smb2 negotiate and fix null pointer deferencing oops in smb3_preauth_hash_rsp() that found from manual test. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Hyunchul Lee Cc: Sergey Senozhatsky Reviewed-by: Ralph Boehme Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9496e268e3af78a92778bf635488a8ec2dca8996 Author: Namjae Jeon Date: Wed Sep 29 15:41:48 2021 +0900 ksmbd: add request buffer validation in smb2_set_info Add buffer validation in smb2_set_info, and remove unused variable in set_file_basic_info. and smb2_set_info infolevel functions take structure pointer argument. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Sergey Senozhatsky Acked-by: Hyunchul Lee Reviewed-by: Ralph Boehme Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 88d300522cbb2827b679359e98cbadfb46e8226c Author: Namjae Jeon Date: Wed Sep 29 15:37:18 2021 +0900 ksmbd: use correct basic info level in set_file_basic_info() Use correct basic info level in set/get_file_basic_info(). Reviewed-by: Ralph Boehme Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 30e29a9a2bc6a4888335a6ede968b75cd329657a Author: Tatsuhiko Yasumatsu Date: Thu Sep 30 22:55:45 2021 +0900 bpf: Fix integer overflow in prealloc_elems_and_freelist() In prealloc_elems_and_freelist(), the multiplication to calculate the size passed to bpf_map_area_alloc() could lead to an integer overflow. As a result, out-of-bounds write could occur in pcpu_freelist_populate() as reported by KASAN: [...] [ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 [ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 [ 16.970038] [ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 [ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 16.972026] Call Trace: [ 16.972306] dump_stack_lvl+0x34/0x44 [ 16.972687] print_address_description.constprop.0+0x21/0x140 [ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 [ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 [ 16.974257] kasan_report.cold+0x7f/0x11b [ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 [ 16.975190] pcpu_freelist_populate+0xd9/0x100 [ 16.975669] stack_map_alloc+0x209/0x2a0 [ 16.976106] __sys_bpf+0xd83/0x2ce0 [...] The possibility of this overflow was originally discussed in [0], but was overlooked. Fix the integer overflow by changing elem_size to u64 from u32. [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/ Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") Signed-off-by: Tatsuhiko Yasumatsu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b Author: Eric Dumazet Date: Wed Sep 29 15:57:50 2021 -0700 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred. In order to fix this issue, this patch adds a new spinlock that needs to be used whenever these fields are read or written. Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently reading sk->sk_peer_pid which makes no sense, as this field is only possibly set by AF_UNIX sockets. We will have to clean this in a separate patch. This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback" or implementing what was truly expected. Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.") Signed-off-by: Eric Dumazet Reported-by: Jann Horn Cc: Eric W. Biederman Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Signed-off-by: David S. Miller commit 656ed8b015f19bf3f6e6b3ddd9a4bb4aa5ca73e1 Author: Wong Vee Khee Date: Thu Sep 30 14:44:36 2021 +0800 net: stmmac: fix EEE init issue when paired with EEE capable PHYs When STMMAC is paired with Energy-Efficient Ethernet(EEE) capable PHY, and the PHY is advertising EEE by default, we need to enable EEE on the xPCS side too, instead of having user to manually trigger the enabling config via ethtool. Fixed this by adding xpcs_config_eee() call in stmmac_eee_init(). Fixes: 7617af3d1a5e ("net: pcs: Introducing support for DWC xpcs Energy Efficient Ethernet") Cc: Michael Sit Wei Hong Signed-off-by: Wong Vee Khee Signed-off-by: David S. Miller commit a5b8fd657881003ea11c193d147c8f4ba143725d Author: Jakub Kicinski Date: Wed Sep 29 08:32:24 2021 -0700 net: dev_addr_list: handle first address in __hw_addr_add_ex struct dev_addr_list is used for device addresses, unicast addresses and multicast addresses. The first of those needs special handling of the main address - netdev->dev_addr points directly the data of the entry and drivers write to it freely, so we can't maintain it in the rbtree (for now, at least, to be fixed in net-next). Current work around sprinkles special handling of the first address on the list throughout the code but it missed the case where address is being added. First address will not be visible during subsequent adds. Syzbot found a warning where unicast addresses are modified without holding the rtnl lock, tl;dr is that team generates the same modification multiple times, not necessarily when right locks are held. In the repro we have: macvlan -> team -> veth macvlan adds a unicast address to the team. Team then pushes that address down to its memebers (veths). Next something unrelated makes team sync member addrs again, and because of the bug the addr entries get duplicated in the veths. macvlan gets removed, removes its addr from team which removes only one of the duplicated addresses from veths. This removal is done under rtnl. Next syzbot uses iptables to add a multicast addr to team (which does not hold rtnl lock). Team syncs veth addrs, but because veths' unicast list still has the duplicate it will also get sync, even though this update is intended for mc addresses. Again, uc address updates need rtnl lock, boom. Reported-by: syzbot+7a2ab2cdc14d134de553@syzkaller.appspotmail.com Fixes: 406f42fa0d3c ("net-next: When a bond have a massive amount of VLANs with IPv6 addresses, performance of changing link state, attaching a VRF, changing an IPv6 address, etc. go down dramtically.") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 42871e95a3afea8956d8cc567ea725b33a837775 Author: Hans de Goede Date: Wed Sep 29 22:15:12 2021 +0200 ASoC: nau8824: Fix headphone vs headset, button-press detection no longer working Commit 1d25684e2251 ("ASoC: nau8824: Fix open coded prefix handling") replaced the nau8824_dapm_enable_pin() helper with direct calls to snd_soc_dapm_enable_pin(), but the helper was using snd_soc_dapm_force_enable_pin() and not forcing the MICBIAS + SAR supplies on breaks headphone vs headset and button-press detection. Replace the snd_soc_dapm_enable_pin() calls with snd_soc_dapm_force_enable_pin() to fix this. Cc: stable@vger.kernel.org Fixes: 1d25684e2251 ("ASoC: nau8824: Fix open coded prefix handling") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20210929201512.460360-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit d5ef190693a7d76c5c192d108e8dec48307b46ee Author: Vlad Buslov Date: Wed Sep 29 18:08:49 2021 +0300 net: sched: flower: protect fl_walk() with rcu Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep. KASAN trace: [ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987 [ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 352.781022] Call Trace: [ 352.781573] dump_stack_lvl+0x46/0x5a [ 352.782332] print_address_description.constprop.0+0x1f/0x140 [ 352.783400] ? fl_walk+0x159/0x240 [cls_flower] [ 352.784292] ? fl_walk+0x159/0x240 [cls_flower] [ 352.785138] kasan_report.cold+0x83/0xdf [ 352.785851] ? fl_walk+0x159/0x240 [cls_flower] [ 352.786587] kasan_check_range+0x145/0x1a0 [ 352.787337] fl_walk+0x159/0x240 [cls_flower] [ 352.788163] ? fl_put+0x10/0x10 [cls_flower] [ 352.789007] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.790102] tcf_chain_dump+0x231/0x450 [ 352.790878] ? tcf_chain_tp_delete_empty+0x170/0x170 [ 352.791833] ? __might_sleep+0x2e/0xc0 [ 352.792594] ? tfilter_notify+0x170/0x170 [ 352.793400] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.794477] tc_dump_tfilter+0x385/0x4b0 [ 352.795262] ? tc_new_tfilter+0x1180/0x1180 [ 352.796103] ? __mod_node_page_state+0x1f/0xc0 [ 352.796974] ? __build_skb_around+0x10e/0x130 [ 352.797826] netlink_dump+0x2c0/0x560 [ 352.798563] ? netlink_getsockopt+0x430/0x430 [ 352.799433] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.800542] __netlink_dump_start+0x356/0x440 [ 352.801397] rtnetlink_rcv_msg+0x3ff/0x550 [ 352.802190] ? tc_new_tfilter+0x1180/0x1180 [ 352.802872] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.803668] ? tc_new_tfilter+0x1180/0x1180 [ 352.804344] ? _copy_from_iter_nocache+0x800/0x800 [ 352.805202] ? kasan_set_track+0x1c/0x30 [ 352.805900] netlink_rcv_skb+0xc6/0x1f0 [ 352.806587] ? rht_deferred_worker+0x6b0/0x6b0 [ 352.807455] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.808324] ? netlink_ack+0x4d0/0x4d0 [ 352.809086] ? netlink_deliver_tap+0x62/0x3d0 [ 352.809951] netlink_unicast+0x353/0x480 [ 352.810744] ? netlink_attachskb+0x430/0x430 [ 352.811586] ? __alloc_skb+0xd7/0x200 [ 352.812349] netlink_sendmsg+0x396/0x680 [ 352.813132] ? netlink_unicast+0x480/0x480 [ 352.813952] ? __import_iovec+0x192/0x210 [ 352.814759] ? netlink_unicast+0x480/0x480 [ 352.815580] sock_sendmsg+0x6c/0x80 [ 352.816299] ____sys_sendmsg+0x3a5/0x3c0 [ 352.817096] ? kernel_sendmsg+0x30/0x30 [ 352.817873] ? __ia32_sys_recvmmsg+0x150/0x150 [ 352.818753] ___sys_sendmsg+0xd8/0x140 [ 352.819518] ? sendmsg_copy_msghdr+0x110/0x110 [ 352.820402] ? ___sys_recvmsg+0xf4/0x1a0 [ 352.821110] ? __copy_msghdr_from_user+0x260/0x260 [ 352.821934] ? _raw_spin_lock+0x81/0xd0 [ 352.822680] ? __handle_mm_fault+0xef3/0x1b20 [ 352.823549] ? rb_insert_color+0x2a/0x270 [ 352.824373] ? copy_page_range+0x16b0/0x16b0 [ 352.825209] ? perf_event_update_userpage+0x2d0/0x2d0 [ 352.826190] ? __fget_light+0xd9/0xf0 [ 352.826941] __sys_sendmsg+0xb3/0x130 [ 352.827613] ? __sys_sendmsg_sock+0x20/0x20 [ 352.828377] ? do_user_addr_fault+0x2c5/0x8a0 [ 352.829184] ? fpregs_assert_state_consistent+0x52/0x60 [ 352.830001] ? exit_to_user_mode_prepare+0x32/0x160 [ 352.830845] do_syscall_64+0x35/0x80 [ 352.831445] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 352.832331] RIP: 0033:0x7f7bee973c17 [ 352.833078] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 352.836202] RSP: 002b:00007ffcbb368e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 352.837524] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7bee973c17 [ 352.838715] RDX: 0000000000000000 RSI: 00007ffcbb368e50 RDI: 0000000000000003 [ 352.839838] RBP: 00007ffcbb36d090 R08: 00000000cea96d79 R09: 00007f7beea34a40 [ 352.841021] R10: 00000000004059bb R11: 0000000000000246 R12: 000000000046563f [ 352.842208] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffcbb36d088 [ 352.843784] Allocated by task 2960: [ 352.844451] kasan_save_stack+0x1b/0x40 [ 352.845173] __kasan_kmalloc+0x7c/0x90 [ 352.845873] fl_change+0x282/0x22db [cls_flower] [ 352.846696] tc_new_tfilter+0x6cf/0x1180 [ 352.847493] rtnetlink_rcv_msg+0x471/0x550 [ 352.848323] netlink_rcv_skb+0xc6/0x1f0 [ 352.849097] netlink_unicast+0x353/0x480 [ 352.849886] netlink_sendmsg+0x396/0x680 [ 352.850678] sock_sendmsg+0x6c/0x80 [ 352.851398] ____sys_sendmsg+0x3a5/0x3c0 [ 352.852202] ___sys_sendmsg+0xd8/0x140 [ 352.852967] __sys_sendmsg+0xb3/0x130 [ 352.853718] do_syscall_64+0x35/0x80 [ 352.854457] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 352.855830] Freed by task 7: [ 352.856421] kasan_save_stack+0x1b/0x40 [ 352.857139] kasan_set_track+0x1c/0x30 [ 352.857854] kasan_set_free_info+0x20/0x30 [ 352.858609] __kasan_slab_free+0xed/0x130 [ 352.859348] kfree+0xa7/0x3c0 [ 352.859951] process_one_work+0x44d/0x780 [ 352.860685] worker_thread+0x2e2/0x7e0 [ 352.861390] kthread+0x1f4/0x220 [ 352.862022] ret_from_fork+0x1f/0x30 [ 352.862955] Last potentially related work creation: [ 352.863758] kasan_save_stack+0x1b/0x40 [ 352.864378] kasan_record_aux_stack+0xab/0xc0 [ 352.865028] insert_work+0x30/0x160 [ 352.865617] __queue_work+0x351/0x670 [ 352.866261] rcu_work_rcufn+0x30/0x40 [ 352.866917] rcu_core+0x3b2/0xdb0 [ 352.867561] __do_softirq+0xf6/0x386 [ 352.868708] Second to last potentially related work creation: [ 352.869779] kasan_save_stack+0x1b/0x40 [ 352.870560] kasan_record_aux_stack+0xab/0xc0 [ 352.871426] call_rcu+0x5f/0x5c0 [ 352.872108] queue_rcu_work+0x44/0x50 [ 352.872855] __fl_put+0x17c/0x240 [cls_flower] [ 352.873733] fl_delete+0xc7/0x100 [cls_flower] [ 352.874607] tc_del_tfilter+0x510/0xb30 [ 352.886085] rtnetlink_rcv_msg+0x471/0x550 [ 352.886875] netlink_rcv_skb+0xc6/0x1f0 [ 352.887636] netlink_unicast+0x353/0x480 [ 352.888285] netlink_sendmsg+0x396/0x680 [ 352.888942] sock_sendmsg+0x6c/0x80 [ 352.889583] ____sys_sendmsg+0x3a5/0x3c0 [ 352.890311] ___sys_sendmsg+0xd8/0x140 [ 352.891019] __sys_sendmsg+0xb3/0x130 [ 352.891716] do_syscall_64+0x35/0x80 [ 352.892395] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 352.893666] The buggy address belongs to the object at ffff8881c8251000 which belongs to the cache kmalloc-2k of size 2048 [ 352.895696] The buggy address is located 1152 bytes inside of 2048-byte region [ffff8881c8251000, ffff8881c8251800) [ 352.897640] The buggy address belongs to the page: [ 352.898492] page:00000000213bac35 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8250 [ 352.900110] head:00000000213bac35 order:3 compound_mapcount:0 compound_pincount:0 [ 352.901541] flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff) [ 352.902908] raw: 002ffff800010200 0000000000000000 dead000000000122 ffff888100042f00 [ 352.904391] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 352.905861] page dumped because: kasan: bad access detected [ 352.907323] Memory state around the buggy address: [ 352.908218] ffff8881c8251380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.909471] ffff8881c8251400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.910735] >ffff8881c8251480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.912012] ^ [ 352.912642] ffff8881c8251500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.913919] ffff8881c8251580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.915185] ================================================================== Fixes: d39d714969cd ("idr: introduce idr_for_each_entry_continue_ul()") Signed-off-by: Vlad Buslov Acked-by: Cong Wang Signed-off-by: David S. Miller commit 1f8763c59c4ec6254d629fe77c0a52220bd907aa Author: Takashi Iwai Date: Thu Sep 30 13:41:14 2021 +0200 ALSA: seq: Fix a potential UAF by wrong private_free call order John Keeping reported and posted a patch for a potential UAF in rawmidi sequencer destruction: the snd_rawmidi_dev_seq_free() may be called after the associated rawmidi object got already freed. After a deeper look, it turned out that the bug is rather the incorrect private_free call order for a snd_seq_device. The snd_seq_device private_free gets called at the release callback of the sequencer device object, while this was rather expected to be executed at the snd_device call chains that runs at the beginning of the whole card-free procedure. It's been broken since the rewrite of sequencer-device binding (although it hasn't surfaced because the sequencer device release happens usually right along with the card device release). This patch corrects the private_free call to be done in the right place, at snd_seq_device_dev_free(). Fixes: 7c37ae5c625a ("ALSA: seq: Rewrite sequencer device binding with standard bus") Reported-and-tested-by: John Keeping Cc: Link: https://lore.kernel.org/r/20210930114114.8645-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 49054556289e8787501630b7c7a9d407da02e296 Author: Paolo Abeni Date: Wed Sep 29 11:59:17 2021 +0200 net: introduce and use lock_sock_fast_nested() Syzkaller reported a false positive deadlock involving the nl socket lock and the subflow socket lock: MPTCP: kernel_bind error, err=-98 ============================================ WARNING: possible recursive locking detected 5.15.0-rc1-syzkaller #0 Not tainted -------------------------------------------- syz-executor998/6520 is trying to acquire lock: ffff8880795718a0 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x267/0x7b0 net/mptcp/protocol.c:2738 but task is already holding lock: ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1612 [inline] ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x23/0x7b0 net/mptcp/protocol.c:2720 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(k-sk_lock-AF_INET); lock(k-sk_lock-AF_INET); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by syz-executor998/6520: #0: ffffffff8d176c50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802 #1: ffffffff8d176d08 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8d176d08 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x3e0/0x580 net/netlink/genetlink.c:790 #2: ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1612 [inline] #2: ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x23/0x7b0 net/mptcp/protocol.c:2720 stack backtrace: CPU: 1 PID: 6520 Comm: syz-executor998 Not tainted 5.15.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2944 [inline] check_deadlock kernel/locking/lockdep.c:2987 [inline] validate_chain kernel/locking/lockdep.c:3776 [inline] __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 lock_sock_fast+0x36/0x100 net/core/sock.c:3229 mptcp_close+0x267/0x7b0 net/mptcp/protocol.c:2738 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 __sock_release net/socket.c:649 [inline] sock_release+0x87/0x1b0 net/socket.c:677 mptcp_pm_nl_create_listen_socket+0x238/0x2c0 net/mptcp/pm_netlink.c:900 mptcp_nl_cmd_add_addr+0x359/0x930 net/mptcp/pm_netlink.c:1170 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_no_sendpage+0x101/0x150 net/core/sock.c:2980 kernel_sendpage.part.0+0x1a0/0x340 net/socket.c:3504 kernel_sendpage net/socket.c:3501 [inline] sock_sendpage+0xe5/0x140 net/socket.c:1003 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0xd4/0x140 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x110/0x180 fs/splice.c:936 splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891 do_splice_direct+0x1b3/0x280 fs/splice.c:979 do_sendfile+0xae9/0x1240 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1314 [inline] __se_sys_sendfile64 fs/read_write.c:1300 [inline] __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1300 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f215cb69969 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc96bb3868 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f215cbad072 RCX: 00007f215cb69969 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 RBP: 0000000000000000 R08: 00007ffc96bb3a08 R09: 00007ffc96bb3a08 R10: 0000000100000002 R11: 0000000000000246 R12: 00007ffc96bb387c R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 the problem originates from uncorrect lock annotation in the mptcp code and is only visible since commit 2dcb96bacce3 ("net: core: Correct the sock::sk_lock.owned lockdep annotations"), but is present since the port-based endpoint support initial implementation. This patch addresses the issue introducing a nested variant of lock_sock_fast() and using it in the relevant code path. Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port") Fixes: 2dcb96bacce3 ("net: core: Correct the sock::sk_lock.owned lockdep annotations") Suggested-by: Thomas Gleixner Reported-and-tested-by: syzbot+1dd53f7a89b299d59eaf@syzkaller.appspotmail.com Signed-off-by: Paolo Abeni Reviewed-by: Thomas Gleixner Signed-off-by: David S. Miller commit eb676622846b34a751e2ff9b5910a5322a4e0000 Author: John Liu Date: Thu Sep 30 13:53:16 2021 +0200 ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop The Dell Precision 5560 laptop appears to use the 4-speakers-on-ALC289 audio just like its sibling product XPS 9510, so it requires the same quirk to enable woofer output. Tested on my Dell Precision 5560. Signed-off-by: John Liu Cc: Link: https://lore.kernel.org/r/20210930115316.659-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 8ec59ac3ad29891c0afef627640df36f2daa0349 Author: Takashi Iwai Date: Wed Sep 29 09:35:40 2021 +0200 ALSA: usb-audio: Fix a missing error check in scarlett gen2 mixer The check of the returned error code is missing in scarlett2_update_monitor_other(). Let's fix it. Fixes: d5bda7e03982 ("ALSA: usb-audio: scarlett2: Add support for the talkback feature") Reported-by: kernel test robot Cc: Link: https://lore.kernel.org/r/202109131831.9IodEzRx-lkp@intel.com Link: https://lore.kernel.org/r/20210929073540.9611-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b232537074fcaf0c2837abbb217429c097bb7598 Author: Tony Lindgren Date: Thu Sep 30 11:30:03 2021 +0300 soc: ti: omap-prm: Fix external abort for am335x pruss Starting with v5.15-rc1, we may now see some am335x beaglebone black device produce the following error on pruss probe: Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000 This has started with the enabling of pruss for am335x in the dts files. Turns out the is caused by the PRM reset handling not waiting for the reset bit to clear. To fix the issue, let's always wait for the reset bit to clear, even if there is a separate reset status register. We attempted to fix a similar issue for dra7 iva with a udelay() in commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva"). There is no longer a need for the udelay() for dra7 iva reset either with the check added for reset bit clearing. Cc: Drew Fustini Cc: Grygorii Strashko Cc: "H. Nikolaus Schaller" Cc: Robert Nelson Cc: Yongqin Liu Fixes: effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva") Reported-by: Matti Vaittinen Tested-by: Matti Vaittinen Signed-off-by: Tony Lindgren commit 7b0035eaa7dab9fd33d6658ad6a755024bdce26c Author: Sean Christopherson Date: Wed Sep 29 16:41:12 2021 -0700 KVM: selftests: Ensure all migrations are performed when test is affined Rework the CPU selection in the migration worker to ensure the specified number of migrations are performed when the test iteslf is affined to a subset of CPUs. The existing logic skips iterations if the target CPU is not in the original set of possible CPUs, which causes the test to fail if too many iterations are skipped. ==== Test Assertion Failure ==== rseq_test.c:228: i > (NR_TASK_MIGRATIONS / 2) pid=10127 tid=10127 errno=4 - Interrupted system call 1 0x00000000004018e5: main at rseq_test.c:227 2 0x00007fcc8fc66bf6: ?? ??:0 3 0x0000000000401959: _start at ??:? Only performed 4 KVM_RUNs, task stalled too much? Calculate the min/max possible CPUs as a cheap "best effort" to avoid high runtimes when the test is affined to a small percentage of CPUs. Alternatively, a list or xarray of the possible CPUs could be used, but even in a horrendously inefficient setup, such optimizations are not needed because the runtime is completely dominated by the cost of migrating the task, and the absolute runtime is well under a minute in even truly absurd setups, e.g. running on a subset of vCPUs in a VM that is heavily overcommited (16 vCPUs per pCPU). Fixes: 61e52f1630f5 ("KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs") Reported-by: Dongli Zhang Signed-off-by: Sean Christopherson Message-Id: <20210929234112.1862848-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit e8a747d0884e554a8c1872da6c8f680a4f893c6d Author: Sean Christopherson Date: Wed Sep 29 15:24:25 2021 -0700 KVM: x86: Swap order of CPUID entry "index" vs. "significant flag" checks Check whether a CPUID entry's index is significant before checking for a matching index to hack-a-fix an undefined behavior bug due to consuming uninitialized data. RESET/INIT emulation uses kvm_cpuid() to retrieve CPUID.0x1, which does _not_ have a significant index, and fails to initialize the dummy variable that doubles as EBX/ECX/EDX output _and_ ECX, a.k.a. index, input. Practically speaking, it's _extremely_ unlikely any compiler will yield code that causes problems, as the compiler would need to inline the kvm_cpuid() call to detect the uninitialized data, and intentionally hose the kernel, e.g. insert ud2, instead of simply ignoring the result of the index comparison. Although the sketchy "dummy" pattern was introduced in SVM by commit 66f7b72e1171 ("KVM: x86: Make register state after reset conform to specification"), it wasn't actually broken until commit 7ff6c0350315 ("KVM: x86: Remove stateful CPUID handling") arbitrarily swapped the order of operations such that "index" was checked before the significant flag. Avoid consuming uninitialized data by reverting to checking the flag before the index purely so that the fix can be easily backported; the offending RESET/INIT code has been refactored, moved, and consolidated from vendor code to common x86 since the bug was introduced. A future patch will directly address the bad RESET/INIT behavior. The undefined behavior was detected by syzbot + KernelMemorySanitizer. BUG: KMSAN: uninit-value in cpuid_entry2_find arch/x86/kvm/cpuid.c:68 BUG: KMSAN: uninit-value in kvm_find_cpuid_entry arch/x86/kvm/cpuid.c:1103 BUG: KMSAN: uninit-value in kvm_cpuid+0x456/0x28f0 arch/x86/kvm/cpuid.c:1183 cpuid_entry2_find arch/x86/kvm/cpuid.c:68 [inline] kvm_find_cpuid_entry arch/x86/kvm/cpuid.c:1103 [inline] kvm_cpuid+0x456/0x28f0 arch/x86/kvm/cpuid.c:1183 kvm_vcpu_reset+0x13fb/0x1c20 arch/x86/kvm/x86.c:10885 kvm_apic_accept_events+0x58f/0x8c0 arch/x86/kvm/lapic.c:2923 vcpu_enter_guest+0xfd2/0x6d80 arch/x86/kvm/x86.c:9534 vcpu_run+0x7f5/0x18d0 arch/x86/kvm/x86.c:9788 kvm_arch_vcpu_ioctl_run+0x245b/0x2d10 arch/x86/kvm/x86.c:10020 Local variable ----dummy@kvm_vcpu_reset created at: kvm_vcpu_reset+0x1fb/0x1c20 arch/x86/kvm/x86.c:10812 kvm_apic_accept_events+0x58f/0x8c0 arch/x86/kvm/lapic.c:2923 Reported-by: syzbot+f3985126b746b3d59c9d@syzkaller.appspotmail.com Reported-by: Alexander Potapenko Fixes: 2a24be79b6b7 ("KVM: VMX: Set EDX at INIT with CPUID.0x1, Family-Model-Stepping") Fixes: 7ff6c0350315 ("KVM: x86: Remove stateful CPUID handling") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Message-Id: <20210929222426.1855730-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 773e89ab0056aaa2baa1ffd9f044551654410104 Author: Zelin Deng Date: Wed Sep 29 13:13:49 2021 +0800 ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements; if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is 64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with "src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to be valid. Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable") Signed-off-by: Zelin Deng Cc: Message-Id: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com> Signed-off-by: Paolo Bonzini commit ad9af930680bb396c87582edc172b3a7cf2a3fbf Author: Zelin Deng Date: Wed Sep 29 13:13:48 2021 +0800 x86/kvmclock: Move this_cpu_pvti into kvmclock.h There're other modules might use hv_clock_per_cpu variable like ptp_kvm, so move it into kvmclock.h and export the symbol to make it visiable to other modules. Signed-off-by: Zelin Deng Cc: Message-Id: <1632892429-101194-2-git-send-email-zelin.deng@linux.alibaba.com> Signed-off-by: Paolo Bonzini commit 23c216b335d1fbd716076e8263b54a714ea3cf0e Author: Alexey Kardashevskiy Date: Thu Sep 30 13:44:54 2021 +1000 powerpc/iommu: Report the correct most efficient DMA mask for PCI devices According to dma-api.rst, the dma_get_required_mask() helper should return "the mask that the platform requires to operate efficiently". Which in the case of PPC64 means the bypass mask and not a mask from an IOMMU table which is shorter and slower to use due to map/unmap operations (especially expensive on "pseries"). However the existing implementation ignores the possibility of bypassing and returns the IOMMU table mask on the pseries platform which makes some drivers (mpt3sas is one example) choose 32bit DMA even though bypass is supported. The powernv platform sort of handles it by having a bigger default window with a mask >=40 but it only works as drivers choose 63/64bit if the required mask is >32 which is rather pointless. This reintroduces the bypass capability check to let drivers make a better choice of the DMA mask. Fixes: f1565c24b596 ("powerpc: use the generic dma_ops_bypass mode") Signed-off-by: Alexey Kardashevskiy Reviewed-by: Christoph Hellwig Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210930034454.95794-1-aik@ozlabs.ru commit 41e76c6a3c83c85e849f10754b8632ea763d9be4 Author: Nick Desaulniers Date: Mon Sep 20 16:25:33 2021 -0700 nbd: use shifts rather than multiplies commit fad7cd3310db ("nbd: add the check to prevent overflow in __nbd_ioctl()") raised an issue from the fallback helpers added in commit f0907827a8a9 ("compiler.h: enable builtin overflow checkers and add fallback code") ERROR: modpost: "__divdi3" [drivers/block/nbd.ko] undefined! As Stephen Rothwell notes: The added check_mul_overflow() call is being passed 64 bit values. COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW is not set for this build (see include/linux/overflow.h). Specifically, the helpers for checking whether the results of a multiplication overflowed (__unsigned_mul_overflow, __signed_add_overflow) use the division operator when !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW. This is problematic for 64b operands on 32b hosts. This was fixed upstream by commit 76ae847497bc ("Documentation: raise minimum supported version of GCC to 5.1") which is not suitable to be backported to stable. Further, __builtin_mul_overflow() would emit a libcall to a compiler-rt-only symbol when compiling with clang < 14 for 32b targets. ld.lld: error: undefined symbol: __mulodi4 In order to keep stable buildable with GCC 4.9 and clang < 14, modify struct nbd_config to instead track the number of bits of the block size; reconstructing the block size using runtime checked shifts that are not problematic for those compilers and in a ways that can be backported to stable. In nbd_set_size, we do validate that the value of blksize must be a power of two (POT) and is in the range of [512, PAGE_SIZE] (both inclusive). This does modify the debugfs interface. Cc: stable@vger.kernel.org Cc: Arnd Bergmann Cc: Rasmus Villemoes Link: https://github.com/ClangBuiltLinux/linux/issues/1438 Link: https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/ Link: https://lore.kernel.org/stable/CAHk-=whiQBofgis_rkniz8GBP9wZtSZdcDEffgSLO62BUGV3gg@mail.gmail.com/ Reported-by: Naresh Kamboju Reported-by: Nathan Chancellor Reported-by: Stephen Rothwell Suggested-by: Kees Cook Suggested-by: Linus Torvalds Suggested-by: Pavel Machek Signed-off-by: Nick Desaulniers Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20210920232533.4092046-1-ndesaulniers@google.com Signed-off-by: Jens Axboe commit ce812992f239f45e13c820a52455fec6eacbce1e Author: Namjae Jeon Date: Mon Sep 27 21:47:48 2021 +0900 ksmbd: remove NTLMv1 authentication Remove insecure NTLMv1 authentication. Cc: Ronnie Sahlberg Cc: Ralph Böhme Reviewed-by: Tom Talpey Acked-by: Steve French Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 040d985e27dc39353d50d0f75a6be3330f4fece2 Author: Mun Yew Tham Date: Wed Sep 29 08:49:11 2021 +0800 MAINTAINERS: Update Mun Yew Tham as Altera Pio Driver maintainer Update Altera Pio Driver maintainer's email from to Signed-off-by: Mun Yew Tham Acked-by: Joyce Ooi Signed-off-by: Bartosz Golaszewski commit d1d598104336075e7475d932d200b33108399225 Author: Bartosz Golaszewski Date: Mon Sep 20 09:18:37 2021 +0200 MAINTAINERS: update my email address My professional situation changes soon. Update my email address. Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Acked-by: Andy Shevchenko commit 540cffbab8b8e6c52a4121666ca18d6e94586ed2 Author: Andrey Gusakov Date: Thu Sep 23 20:22:16 2021 +0300 gpio: pca953x: do not ignore i2c errors Per gpio_chip interface, error shall be proparated to the caller. Attempt to silent diagnostics by returning zero (as written in the comment) is plain wrong, because the zero return can be interpreted by the caller as the gpio value. Cc: stable@vger.kernel.org Signed-off-by: Andrey Gusakov Signed-off-by: Nikita Yushchenko Signed-off-by: Bartosz Golaszewski commit 02d5e016800d082058b3d3b7c3ede136cdc6ddcb Merge: 6e439bbd436e3 f2ff7147c6834 Author: Linus Torvalds Date: Wed Sep 29 07:48:00 2021 -0700 Merge tag 'sound-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became a slightly large collection of changes, partly because I've been off in the last weeks. Most of changes are small and scattered while a bit big change is found in HD-audio Realtek codec driver; it's a very device-specific fix that has been long wanted, so I decided to pick up although it's in the middle RC. Some highlights: - A new guard ioctl for ALSA rawmidi API to avoid the misuse of the new timestamp framing mode; it's for a regression fix - HD-audio: a revert of the 5.15 change that might work badly, new quirks for Lenovo Legion & co, a follow-up fix for CS8409 - ASoC: lots of SOF-related fixes, fsl component fixes, corrections of mediatek drivers - USB-audio: fix for the PM resume - FireWire: oxfw and motu fixes" * tag 'sound-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (25 commits) ALSA: pcsp: Make hrtimer forwarding more robust ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION ALSA: firewire-motu: fix truncated bytes in message tracepoints ASoC: SOF: trace: Omit error print when waking up trace sleepers ASoC: mediatek: mt8195: remove wrong fixup assignment on HDMITX ASoC: SOF: loader: Re-phrase the missing firmware error to avoid duplication ASoC: SOF: loader: release_firmware() on load failure to avoid batching ALSA: hda/cs8409: Setup Dolphin Headset Mic as Phantom Jack ALSA: pcxhr: "fix" PCXHR_REG_TO_PORT definition ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM types ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types ASoC: SOF: Fix DSP oops stack dump output contents ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops. ALSA: usb-audio: Unify mixer resume and reset_resume procedure Revert "ALSA: hda: Drop workaround for a hang at shutdown again" ALSA: oxfw: fix transmission method for Loud models based on OXFW971 ASoC: mediatek: common: handle NULL case in suspend/resume function ASoC: fsl_xcvr: register platform component before registering cpu dai ASoC: fsl_spdif: register platform component before registering cpu dai ASoC: fsl_micfil: register platform component before registering cpu dai ... commit 6e439bbd436e39f15abc9587cdd23d56257780cb Merge: a4e6f95a891ac 0e14ef38669ce Author: Linus Torvalds Date: Wed Sep 29 07:37:46 2021 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This contains fixes for a resource leak in ccp as well as stack corruption in x86/sm4" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/sm4 - Fix frame pointer stack corruption crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() commit 79e3445b38e0cab94264a3894c0c3d57c930b97e Author: Johan Almbladh Date: Tue Sep 28 11:13:10 2021 +0200 bpf, arm: Fix register clobbering in div/mod implementation On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are implemented using a call to a helper function. Before, the emitted code for those function calls failed to preserve caller-saved ARM registers. Since some of those registers happen to be mapped to BPF registers, it resulted in eBPF register values being overwritten. This patch emits code to push and pop the remaining caller-saved ARM registers r2-r3 into the stack during the div/mod function call. ARM registers r0-r1 are used as arguments and return value, and those were already saved and restored correctly. Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") Signed-off-by: Johan Almbladh Signed-off-by: Daniel Borkmann commit d75fe9cb1dd062684c9fb8a4581738170365dc06 Author: Luca Boccassi Date: Thu Sep 23 01:05:40 2021 +0100 samples/bpf: Relicense bpf_insn.h as GPL-2.0-only OR BSD-2-Clause libbpf and bpftool have been dual-licensed to facilitate inclusion in software that is not compatible with GPL2-only (ie: Apache2), but the samples are still GPL2-only. Given these files are samples, they get naturally copied around. For example, it is the case for samples/bpf/bpf_insn.h which was copied into the systemd tree: https://github.com/systemd/systemd/blob/main/src/shared/linux/bpf_insn.h Some more context on systemd's needs specifically: Most of systemd is (L)GPL2-or-later, which means there is no perceived incompatibility with Apache2 software and can thus be linked with OpenSSL 3.0. But given this GPL2-only header is included this is currently not possible. Dual-licensing this header solves this problem for us as we are scoping a move to OpenSSL 3.0, see: https://lists.freedesktop.org/archives/systemd-devel/2021-September/046882.html Dual-license this header as GPL-2.0-only OR BSD-2-Clause to follow the same licensing used by libbpf and bpftool: 1bc38b8ff6cc ("libbpf: relicense libbpf as LGPL-2.1 OR BSD-2-Clause") 907b22365115 ("tools: bpftool: dual license all files") Signed-off-by: Luca Boccassi Signed-off-by: Daniel Borkmann Acked-by: Simon Horman Acked-by: Daniel Mack Acked-by: Josef Bacik Acked-by: Joe Stringer Acked-by: Chenbo Feng Acked-by: Björn Töpel Acked-by: Magnus Karlsson Acked-by: Brendan Jackman Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210923000540.47344-1-luca.boccassi@gmail.com commit d88fd1b546ff19c8040cfaea76bf16aed1c5a0bb Author: Florian Fainelli Date: Tue Sep 28 13:32:33 2021 -0700 net: phy: bcm7xxx: Fixed indirect MMD operations When EEE support was added to the 28nm EPHY it was assumed that it would be able to support the standard clause 45 over clause 22 register access method. It turns out that the PHY does not support that, which is the very reason for using the indirect shadow mode 2 bank 3 access method. Implement {read,write}_mmd to allow the standard PHY library routines pertaining to EEE querying and configuration to work correctly on these PHYs. This forces us to implement a __phy_set_clr_bits() function that does not grab the MDIO bus lock since the PHY driver's {read,write}_mmd functions are always called with that lock held. Fixes: 83ee102a6998 ("net: phy: bcm7xxx: add support for 28nm EPHY") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 251ffc07730305c0dd9b0786240577319cc560e0 Merge: 513e605d7a9ce 0178839ccca36 Author: David S. Miller Date: Wed Sep 29 11:03:54 2021 +0100 Merge branch 'hns3-fixes' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 0178839ccca36dee238a57e7f4c3c252f5dbbba6 Author: Guangbin Huang Date: Wed Sep 29 17:35:56 2021 +0800 net: hns3: disable firmware compatible features when uninstall PF Currently, the firmware compatible features are enabled in PF driver initialization process, but they are not disabled in PF driver deinitialization process and firmware keeps these features in enabled status. In this case, if load an old PF driver (for example, in VM) which not support the firmware compatible features, firmware will still send mailbox message to PF when link status changed and PF will print "un-supported mailbox message, code = 201". To fix this problem, disable these firmware compatible features in PF driver deinitialization process. Fixes: ed8fb4b262ae ("net: hns3: add link change event report") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 27bf4af69fcb9845fb2f0076db5d562ec072e70f Author: Guangbin Huang Date: Wed Sep 29 17:35:55 2021 +0800 net: hns3: fix always enable rx vlan filter problem after selftest Currently, the rx vlan filter will always be disabled before selftest and be enabled after selftest as the rx vlan filter feature is fixed on in old device earlier than V3. However, this feature is not fixed in some new devices and it can be disabled by user. In this case, it is wrong if rx vlan filter is enabled after selftest. So fix it. Fixes: bcc26e8dc432 ("net: hns3: remove unused code in hns3_self_test()") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 276e60421668d019dc655973b1832ea354c0f36c Author: Guangbin Huang Date: Wed Sep 29 17:35:54 2021 +0800 net: hns3: PF enable promisc for VF when mac table is overflow If unicast mac address table is full, and user add a new mac address, the unicast promisc needs to be enabled for the new unicast mac address can be used. So does the multicast promisc. Now this feature has been implemented for PF, and VF should be implemented too. When the mac table of VF is overflow, PF will enable promisc for this VF. Fixes: 1e6e76101fd9 ("net: hns3: configure promisc mode for VF asynchronously") Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 108b3c7810e14892c4a1819b1d268a2c785c087c Author: Jian Shen Date: Wed Sep 29 17:35:53 2021 +0800 net: hns3: fix show wrong state when add existing uc mac address Currently, if function adds an existing unicast mac address, eventhough driver will not add this address into hardware, but it will return 0 in function hclge_add_uc_addr_common(). It will cause the state of this unicast mac address is ACTIVE in driver, but it should be in TO-ADD state. To fix this problem, function hclge_add_uc_addr_common() returns -EEXIST if mac address is existing, and delete two error log to avoid printing them all the time after this modification. Fixes: 72110b567479 ("net: hns3: return 0 and print warning when hit duplicate MAC") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 0472e95ffeac8e61259eec17ab61608c6b35599d Author: Jian Shen Date: Wed Sep 29 17:35:52 2021 +0800 net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE HCLGE_FLAG_MQPRIO_ENABLE is supposed to set when enable multiple TCs with tc mqprio, and HCLGE_FLAG_DCB_ENABLE is supposed to set when enable multiple TCs with ets. But the driver mixed the flags when updating the tm configuration. Furtherly, PFC should be available when HCLGE_FLAG_MQPRIO_ENABLE too, so remove the unnecessary limitation. Fixes: 5a5c90917467 ("net: hns3: add support for tc mqprio offload") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit d82650be60ee92e7486f755f5387023278aa933f Author: Jian Shen Date: Wed Sep 29 17:35:51 2021 +0800 net: hns3: don't rollback when destroy mqprio fail For destroy mqprio is irreversible in stack, so it's unnecessary to rollback the tc configuration when destroy mqprio failed. Otherwise, it may cause the configuration being inconsistent between driver and netstack. As the failure is usually caused by reset, and the driver will restore the configuration after reset, so it can keep the configuration being consistent between driver and hardware. Fixes: 5a5c90917467 ("net: hns3: add support for tc mqprio offload") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit a8e76fefe3de9b8e609cf192af75e7878d21fa3a Author: Jian Shen Date: Wed Sep 29 17:35:50 2021 +0800 net: hns3: remove tc enable checking Currently, in function hns3_nic_set_real_num_queue(), the driver doesn't report the queue count and offset for disabled tc. If user enables multiple TCs, but only maps user priorities to partial of them, it may cause the queue range of the unmapped TC being displayed abnormally. Fix it by removing the tc enable checking, ensure the queue count is not zero. With this change, the tc_en is useless now, so remove it. Fixes: a75a8efa00c5 ("net: hns3: Fix tc setup when netdev is first up") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 5b09e88e1bf7fe86540fab4b5f3eece8abead39e Author: Jian Shen Date: Wed Sep 29 17:35:49 2021 +0800 net: hns3: do not allow call hns3_nic_net_open repeatedly hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice. The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3] [ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]--- Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set. Fixes: e888402789b9 ("net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 513e605d7a9ce136886cb42ebb2c40e9a6eb6333 Author: Feng Zhou Date: Tue Sep 28 15:23:59 2021 -0700 ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup The ixgbe driver currently generates a NULL pointer dereference with some machine (online cpus < 63). This is due to the fact that the maximum value of num_xdp_queues is nr_cpu_ids. Code is in "ixgbe_set_rss_queues"". Here's how the problem repeats itself: Some machine (online cpus < 63), And user set num_queues to 63 through ethtool. Code is in the "ixgbe_set_channels", adapter->ring_feature[RING_F_FDIR].limit = count; It becomes 63. When user use xdp, "ixgbe_set_rss_queues" will set queues num. adapter->num_rx_queues = rss_i; adapter->num_tx_queues = rss_i; adapter->num_xdp_queues = ixgbe_xdp_queues(adapter); And rss_i's value is from f = &adapter->ring_feature[RING_F_FDIR]; rss_i = f->indices = f->limit; So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup", for (i = 0; i < adapter->num_rx_queues; i++) if (adapter->xdp_ring[i]->xsk_umem) It leads to panic. Call trace: [exception RIP: ixgbe_xdp+368] RIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297 RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90 RBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000 R10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000 R13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235 10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384 11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd 12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb 13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88 14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319 15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290 16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8 17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64 18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9 19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c So I fix ixgbe_max_channels so that it will not allow a setting of queues to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup, take the smaller value of num_rx_queues and num_xdp_queues. Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP") Signed-off-by: Feng Zhou Tested-by: Sandeep Penigalapati Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 4ca57d5139a0be3cf76c1667a4c0afb16d4a3b02 Author: Rajaravi Krishna Katta Date: Tue Sep 14 18:28:48 2021 +0300 habanalabs: fix resetting args in wait for CS IOCTL In wait for CS IOCTL code, the driver resets the incoming args structure before returning to the user, regardless of the return value of the IOCTL. In case the IOCTL returns EINTR, resetting the args will result in error in case the userspace will repeat the ioctl call immediately (which is the behavior in the hl-thunk userspace library). The solution is to reset the args only if the driver returns success (0) as a return value for the IOCTL. Signed-off-by: Rajaravi Krishna Katta Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 79a7482249a7353bc86aff8127954d5febf02472 Author: Rahul Lakkireddy Date: Mon Sep 27 21:44:08 2021 +0530 scsi: csiostor: Add module softdep on cxgb4 Both cxgb4 and csiostor drivers run on their own independent Physical Function. But when cxgb4 and csiostor are both being loaded in parallel via modprobe, there is a race when firmware upgrade is attempted by both the drivers. When the cxgb4 driver initiates the firmware upgrade, it halts the firmware and the chip until upgrade is complete. When the csiostor driver is coming up in parallel, the firmware mailbox communication fails with timeouts and the csiostor driver probe fails. Add a module soft dependency on cxgb4 driver to ensure loading csiostor triggers cxgb4 to load first when available to avoid the firmware upgrade race. Link: https://lore.kernel.org/r/1632759248-15382-1-git-send-email-rahul.lakkireddy@chelsio.com Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver") Signed-off-by: Rahul Lakkireddy Signed-off-by: Martin K. Petersen commit 8e2d81c6b5be0d7629fb50b6f678fc07a4c58fae Author: Arun Easi Date: Fri Sep 24 20:51:54 2021 -0700 scsi: qla2xxx: Fix excessive messages during device logout Disable default logging of some I/O path messages. If desired, the messages can be turned back on by setting ql2xextended_error_logging. Link: https://lore.kernel.org/r/20210925035154.29815-1-njavali@marvell.com Reviewed-by: Ewan D. Milne Reviewed-by: Himanshu Madhani Signed-off-by: Arun Easi Signed-off-by: Nilesh Javali Signed-off-by: Martin K. Petersen commit cced4c0ec7c06f5230a2958907a409c849762293 Author: Colin Ian King Date: Sat Sep 25 00:03:30 2021 +0100 scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" There are a couple of spelling mistakes in pr_info and pr_err messages. Fix them. Link: https://lore.kernel.org/r/20210924230330.143785-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit dd689ed5aa905daf4ba4c99319a52aad6ea0a796 Author: Jiapeng Chong Date: Fri Sep 24 17:51:53 2021 +0800 scsi: ses: Fix unsigned comparison with less than zero Fix the following coccicheck warning: ./drivers/scsi/ses.c:137:10-16: WARNING: Unsigned expression compared with zero: result > 0. Link: https://lore.kernel.org/r/1632477113-90378-1-git-send-email-jiapeng.chong@linux.alibaba.com Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Martin K. Petersen commit e8c2da7e329ce004fee748b921e4c765dc2fa338 Author: Jonathan Hsu Date: Fri Sep 24 16:58:48 2021 +0800 scsi: ufs: Fix illegal offset in UPIU event trace Fix incorrect index for UTMRD reference in ufshcd_add_tm_upiu_trace(). Link: https://lore.kernel.org/r/20210924085848.25500-1-jonathan.hsu@mediatek.com Fixes: 4b42d557a8ad ("scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs") Cc: stable@vger.kernel.org Reviewed-by: Stanley Chu Reviewed-by: Bart Van Assche Signed-off-by: Jonathan Hsu Signed-off-by: Martin K. Petersen commit 1018bf24550fd0feec14648309a0aeb62401f4dc Author: Enzo Matsumiya Date: Tue Sep 28 19:56:34 2021 -0300 ksmbd: fix documentation for 2 functions ksmbd_kthread_fn() and create_socket() returns 0 or error code, and not task_struct/ERR_PTR. Signed-off-by: Enzo Matsumiya Acked-by: Namjae Jeon Signed-off-by: Steve French commit f936bb42aeb94a069bec7c9e04100d199c372956 Author: Thomas Gleixner Date: Tue Sep 28 16:10:49 2021 +0200 net: bridge: mcast: Associate the seqcount with its protecting lock. The sequence count bridge_mcast_querier::seq is protected by net_bridge::multicast_lock but seqcount_init() does not associate the seqcount with the lock. This leads to a warning on PREEMPT_RT because preemption is still enabled. Let seqcount_init() associate the seqcount with lock that protects the write section. Remove lockdep_assert_held_once() because lockdep already checks whether the associated lock is held. Fixes: 67b746f94ff39 ("net: bridge: mcast: make sure querier port/address updates are consistent") Reported-by: Mike Galbraith Signed-off-by: Thomas Gleixner Signed-off-by: Sebastian Andrzej Siewior Tested-by: Mike Galbraith Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20210928141049.593833-1-bigeasy@linutronix.de Signed-off-by: Jakub Kicinski commit 9e28cfead2f8f5aba7df03c74c9ec645b5ffc5fd Author: Cai Huoqing Date: Tue Sep 28 21:48:49 2021 +0800 net: mdio-ipq4019: Fix the error for an optional regs resource The second resource is optional which is only provided on the chipset IPQ5018. But the blamed commit ignores that and if the resource is not there it just fails. the resource is used like this, if (priv->eth_ldo_rdy) { val = readl(priv->eth_ldo_rdy); val |= BIT(0); writel(val, priv->eth_ldo_rdy); fsleep(IPQ_PHY_SET_DELAY_US); } This patch reverts that to still allow the second resource to be optional because other SoC have the some MDIO controller and doesn't need to second resource. Fixes: fa14d03e014a ("net: mdio-ipq4019: Make use of devm_platform_ioremap_resource()") Signed-off-by: Cai Huoqing Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20210928134849.2092-1-caihuoqing@baidu.com Signed-off-by: Jakub Kicinski commit 571fa247ab411f3233eeaaf837c6e646a513b9f8 Author: Kumar Kartikeya Dwivedi Date: Tue Sep 28 11:16:08 2021 +0530 samples: bpf: Fix vmlinux.h generation for XDP samples Generate vmlinux.h only from the in-tree vmlinux, and remove enum declarations that would cause a build failure in case of version mismatches. There are now two options when building the samples: 1. Compile the kernel to use in-tree vmlinux for vmlinux.h 2. Override VMLINUX_BTF for samples using something like this: make VMLINUX_BTF=/sys/kernel/btf/vmlinux -C samples/bpf This change was tested with relative builds, e.g. cases like: * make O=build -C samples/bpf * make KBUILD_OUTPUT=build -C samples/bpf * make -C samples/bpf * cd samples/bpf && make When a suitable VMLINUX_BTF is not found, the following message is printed: /home/kkd/src/linux/samples/bpf/Makefile:333: *** Cannot find a vmlinux for VMLINUX_BTF at any of " ./vmlinux", build the kernel or set VMLINUX_BTF variable. Stop. Fixes: 384b6b3bbf0d (samples: bpf: Add vmlinux.h generation support) Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Andrii Nakryiko Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/bpf/20210928054608.1799021-1-memxor@gmail.com commit a4e6f95a891ac08bd09d62e3e6dae239b150f4c1 Merge: 62da74a735702 28406a2199915 Author: Linus Torvalds Date: Tue Sep 28 16:10:42 2021 -0700 Merge tag 'pinctrl-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some few pin control fixes for the v5.15 kernel cycle. The most critical is the AMD fixes. - Fix wakeup interrupts in the AMD driver affecting AMD laptops. - Fix parent irqspec translation in the Qualcomm SPMI GPIO driver. - Fix deferred probe handling in the Rockchip driver, this is a stopgap solution while we look for something more elegant. - Add PM suspend callbacks to the Qualcomm SC7280 driver. - Some minor doc fix (should have come in earlier, sorry)" * tag 'pinctrl-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: sc7280: Add PM suspend callbacks gpio/rockchip: fetch deferred output settings on probe pinctrl/rockchip: add a queue for deferred pin output settings on probe pinctrl: qcom: spmi-gpio: correct parent irqspec translation pinctrl: amd: Handle wake-up interrupt pinctrl: amd: Add irq field data pinctrl: core: Remove duplicated word from devm_pinctrl_unregister() commit 62da74a735702e62ca910d41b4bb760bbd968e3a Merge: e7bd807e8c9e3 42de956ca7e5f Author: Linus Torvalds Date: Tue Sep 28 16:06:31 2021 -0700 Merge tag 'vfio-v5.15-rc4' of git://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Fix vfio-ap leak on uninit (Jason Gunthorpe) - Add missing prototype arg name (Colin Ian King) * tag 'vfio-v5.15-rc4' of git://github.com/awilliam/linux-vfio: vfio/ap_ops: Add missed vfio_uninit_group_dev() vfio/pci: add missing identifier name in argument of function prototype commit 4b65021a63a21791790960001b79dc5fd4af9ced Merge: 09540fa337196 fa2a30f8e0aa9 Author: Stephen Boyd Date: Tue Sep 28 15:16:48 2021 -0700 Merge tag 'renesas-clk-for-v5.15-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-fixes Pull Renesas clk driver fixes from Geert Uytterhoeven: - Fix inverted logic in RZ/G2L .is_enabled() function * tag 'renesas-clk-for-v5.15-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: rzg2l: Fix clk status function clk: renesas: r9a07g044: Mark IA55_CLK and DMAC_ACLK critical commit e7bd807e8c9e37b0eef24e13df1f0619c39dc559 Merge: dca50f08a03eb 9fde034864025 Author: Linus Torvalds Date: Tue Sep 28 13:24:43 2021 -0700 Merge tag 'm68k-for-v5.15-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull more m68k updates from Geert Uytterhoeven: - signal handling fixes - removal of set_fs() [ The set_fs removal isn't strictly a fix, but it's been pending for a while and is very welcome. The signal handling fixes resolved an issue that was incorrectly attributed to the set_fs changes - Linus ] * tag 'm68k-for-v5.15-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Remove set_fs() m68k: Provide __{get,put}_kernel_nofault m68k: Factor the 8-byte lowlevel {get,put}_user code into helpers m68k: Use BUILD_BUG for passing invalid sizes to get_user/put_user m68k: Remove the 030 case in virt_to_phys_slow m68k: Document that access_ok is broken for !CONFIG_CPU_HAS_ADDRESS_SPACES m68k: Leave stack mangling to asm wrapper of sigreturn() m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal m68k: Handle arrivals of multiple signals correctly commit dca50f08a03eba5bc7a6afecca3f8ab0029b7a6e Merge: 6fd3ec5c7af58 9523b33cc31cf Author: Linus Torvalds Date: Tue Sep 28 13:16:52 2021 -0700 Merge tag 'nios2_fixes_for_v5.15_part1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 fixes from Dinh Nguyen: - Fix build warning for unmet dependency for EARLY_PRINTK - Remove unused dram_start() function * tag 'nios2_fixes_for_v5.15_part1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: NIOS2: setup.c: drop unused variable 'dram_start' NIOS2: fix kconfig unmet dependency warning for SERIAL_CORE_CONSOLE commit 26db706a6d77b9e184feb11725e97e53b7a89519 Author: Prike Liang Date: Wed Aug 25 13:36:38 2021 +0800 drm/amdgpu: force exit gfxoff on sdma resume for rmb s0ix In the s2idle stress test sdma resume fail occasionally,in the failed case GPU is in the gfxoff state.This issue may introduce by firmware miss handle doorbell S/R and now temporary fix the issue by forcing exit gfxoff for sdma resume. Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 98122e63a7ecc08c4172a17d97a06ef5536eb268 Author: Simon Ser Date: Mon Sep 27 15:08:44 2021 +0000 drm/amdgpu: check tiling flags when creating FB on GFX8- On GFX9+, format modifiers are always enabled and ensure the frame-buffers can be scanned out at ADDFB2 time. On GFX8-, format modifiers are not supported and no other check is performed. This means ADDFB2 IOCTLs will succeed even if the tiling isn't supported for scan-out, and will result in garbage displayed on screen [1]. Fix this by adding a check for tiling flags for GFX8 and older. The check is taken from radeonsi in Mesa (see how is_displayable is populated in gfx6_compute_surface). Changes in v2: use drm_WARN_ONCE instead of drm_WARN (Michel) [1]: https://github.com/swaywm/wlroots/issues/3185 Signed-off-by: Simon Ser Acked-by: Michel Dänzer Cc: Alex Deucher Cc: Harry Wentland Cc: Nicholas Kazlauskas Cc: Bas Nieuwenhuizen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit d942856865c733ff60450de9691af796ad71d7bc Author: Charlene Liu Date: Mon Sep 20 14:30:02 2021 -0400 drm/amd/display: Pass PCI deviceid into DC [why] pci deviceid not passed to dal dc, without proper break, dcn2.x falls into dcn3.x code path [how] pass in pci deviceid, and break once dal_version initialized. Reviewed-by: Zhan Liu Acked-by: Anson Jacob Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 467a51b69d0828887fb1b6719159a6b16da688f8 Author: Josip Pavic Date: Fri Sep 17 11:01:47 2021 -0400 drm/amd/display: initialize backlight_ramping_override to false [Why] Stack variable params.backlight_ramping_override is uninitialized, so it contains junk data [How] Initialize the variable to false Reviewed-by: Roman Li Acked-by: Anson Jacob Signed-off-by: Josip Pavic Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 9f52c25f59b504a29dda42d83ac1e24d2af535d4 Author: Hawking Zhang Date: Sun Sep 26 22:19:35 2021 +0800 drm/amdgpu: correct initial cp_hqd_quantum for gfx9 didn't read the value of mmCP_HQD_QUANTUM from correct register offset Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 083fa05bbaf65a01866b5440031c822e32ad7510 Author: Praful Swarnakar Date: Wed Sep 22 23:01:29 2021 +0530 drm/amd/display: Fix Display Flicker on embedded panels [Why] ASSR is dependent on Signed PSP Verstage to enable Content Protection for eDP panels. Unsigned PSP verstage is used during development phase causing ASSR to FAIL. As a result, link training is performed with DP_PANEL_MODE_DEFAULT instead of DP_PANEL_MODE_EDP for eDP panels that causes display flicker on some panels. [How] - Do not change panel mode, if ASSR is disabled - Just report and continue to perform eDP link training with right settings further. Signed-off-by: Praful Swarnakar Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 66805763a97f8f7bdf742fc0851d85c02ed9411f Author: Leslie Shi Date: Thu Sep 23 16:05:31 2021 +0800 drm/amdgpu: fix gart.bo pin_count leak gmc_v{9,10}_0_gart_disable() isn't called matched with correspoding gart_enbale function in SRIOV case. This will lead to gart.bo pin_count leak on driver unload. Cc: Hawking Zhang Signed-off-by: Leslie Shi Signed-off-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher commit df38d852c6814cbbd010d81e84efb9dc057d5ba6 Author: Hou Tao Date: Tue Sep 28 22:07:50 2021 +0800 kernfs: also call kernfs_set_rev() for positive dentry A KMSAN warning is reported by Alexander Potapenko: BUG: KMSAN: uninit-value in kernfs_dop_revalidate+0x61f/0x840 fs/kernfs/dir.c:1053 kernfs_dop_revalidate+0x61f/0x840 fs/kernfs/dir.c:1053 d_revalidate fs/namei.c:854 lookup_dcache fs/namei.c:1522 __lookup_hash+0x3a6/0x590 fs/namei.c:1543 filename_create+0x312/0x7c0 fs/namei.c:3657 do_mkdirat+0x103/0x930 fs/namei.c:3900 __do_sys_mkdir fs/namei.c:3931 __se_sys_mkdir fs/namei.c:3929 __x64_sys_mkdir+0xda/0x120 fs/namei.c:3929 do_syscall_x64 arch/x86/entry/common.c:51 It seems a positive dentry in kernfs becomes a negative dentry directly through d_delete() in vfs_rmdir(). dentry->d_time is uninitialized when accessing it in kernfs_dop_revalidate(), because it is only initialized when created as negative dentry in kernfs_iop_lookup(). The problem can be reproduced by the following command: cd /sys/fs/cgroup/pids && mkdir hi && stat hi && rmdir hi && stat hi A simple fixes seems to be initializing d->d_time for positive dentry in kernfs_iop_lookup() as well. The downside is the negative dentry will be revalidated again after it becomes negative in d_delete(), because the revison of its parent must have been increased due to its removal. Alternative solution is implement .d_iput for kernfs, and assign d_time for the newly-generated negative dentry in it. But we may need to take kernfs_rwsem to protect again the concurrent kernfs_link_sibling() on the parent directory, it is a little over-killing. Now the simple fix is chosen. Link: https://marc.info/?l=linux-fsdevel&m=163249838610499 Fixes: c7e7c04274b1 ("kernfs: use VFS negative dentry caching") Reported-by: Alexander Potapenko Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20210928140750.1274441-1-houtao1@huawei.com Signed-off-by: Greg Kroah-Hartman commit 25b5476a294cd5f7c7730f334f6b400d30bb783d Author: Janosch Frank Date: Fri Sep 10 08:04:20 2021 +0000 KVM: s390: Function documentation fixes The latest compile changes pointed us to a few instances where we use the kernel documentation style but don't explain all variables or don't adhere to it 100%. It's easy to fix so let's do that. Signed-off-by: Janosch Frank Signed-off-by: Christian Borntraeger commit e02c16b9cd24925ea627f007df9ca9ee00eaaa62 Author: Oliver Upton Date: Mon Sep 27 22:36:21 2021 +0000 selftests: KVM: Don't clobber XMM register when read There is no need to clobber a register that is only being read from. Oops. Drop the XMM register from the clobbers list. Signed-off-by: Oliver Upton Message-Id: <20210927223621.50178-1-oupton@google.com> Signed-off-by: Paolo Bonzini commit 6fd3ec5c7af58d5d6b598fba22ac387645af33f4 Merge: d33bec7b3dfa3 80f6e3080bfcf Author: Linus Torvalds Date: Tue Sep 28 07:53:53 2021 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity fix from Eric Biggers: "Fix an integer overflow when computing the Merkle tree layout of extremely large files, exposed by btrfs adding support for fs-verity" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fs-verity: fix signed integer overflow with i_size near S64_MAX commit 603a1621caa097be23c7784e36cb8edf23cd31db Author: Arnd Bergmann Date: Mon Sep 27 14:16:35 2021 +0200 mwifiex: avoid null-pointer-subtraction warning clang complains about some NULL pointer arithmetic in this driver: drivers/net/wireless/marvell/mwifiex/sta_tx.c:65:59: error: performing pointer subtraction with a null pointer has undefined behavior [-Werror,-Wnull-pointer-subtraction] pad = ((void *)skb->data - (sizeof(*local_tx_pd) + hroom)- ^ drivers/net/wireless/marvell/mwifiex/uap_txrx.c:478:53: error: performing pointer subtraction with a null pointer has undefined behavior [-Werror,-Wnull-pointer-subtraction] pad = ((void *)skb->data - (sizeof(*txpd) + hroom) - NULL) & Rework that expression to do the same thing using a uintptr_t. Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210927121656.940304-1-arnd@kernel.org commit d33bec7b3dfa36691ed53ccaaf187d90b53be852 Merge: 0c72b292de0b2 be9c6bad9b464 Author: Linus Torvalds Date: Tue Sep 28 07:27:29 2021 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vdpa fixes from Michael Tsirkin: "Fixes up some issues in rc1" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vdpa: potential uninitialized return in vhost_vdpa_va_map() vdpa/mlx5: Avoid executing set_vq_ready() if device is reset vdpa/mlx5: Clear ready indication for control VQ vduse: Cleanup the old kernel states after reset failure vduse: missing error code in vduse_init() virtio: don't fail on !of_device_is_compatible commit 0c72b292de0b2865f21e5ffc9bed2b36b8c8e693 Merge: 0513e464f9007 b81bede4d138c Author: Linus Torvalds Date: Tue Sep 28 07:24:47 2021 -0700 Merge tag 'mmc-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - renesas_sdhi: Fix regression with hard reset on old SDHIs - dw_mmc: Only inject fault before done/error * tag 'mmc-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: renesas_sdhi: fix regression with hard reset on old SDHIs mmc: dw_mmc: Only inject fault before done/error commit 4ccb9f03fee7b20484187ba7e25a7b9b79fe63d5 Merge: c894b51e2a23c ced185824c89b Author: David S. Miller Date: Tue Sep 28 13:52:46 2021 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2021-09-28 The following pull-request contains BPF updates for your *net* tree. We've added 10 non-merge commits during the last 14 day(s) which contain a total of 11 files changed, 139 insertions(+), 53 deletions(-). The main changes are: 1) Fix MIPS JIT jump code emission for too large offsets, from Piotr Krysiuk. 2) Fix x86 JIT atomic/fetch emission when dst reg maps to rax, from Johan Almbladh. 3) Fix cgroup_sk_alloc corner case when called from interrupt, from Daniel Borkmann. 4) Fix segfault in libbpf's linker for objects without BTF, from Kumar Kartikeya Dwivedi. 5) Fix bpf_jit_charge_modmem for applications with CAP_BPF, from Lorenz Bauer. 6) Fix return value handling for struct_ops BPF programs, from Hou Tao. 7) Various fixes to BPF selftests, from Jiri Benc. ==================== Signed-off-by: David S. Miller , commit ebc69e897e17373fbe1daaff1debaa77583a5284 Author: Jens Axboe Date: Tue Sep 28 06:33:15 2021 -0600 Revert "block, bfq: honor already-setup queue merges" This reverts commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b. We have had several folks complain that this causes hangs for them, which is especially problematic as the commit has also hit stable already. As no resolution seems to be forthcoming right now, revert the patch. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214503 Fixes: 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") Signed-off-by: Jens Axboe commit c894b51e2a23c8c00acb3cea5045c5b70691e790 Author: Arnd Bergmann Date: Tue Sep 28 10:58:34 2021 +0200 net: hns3: fix hclge_dbg_dump_tm_pg() stack usage This function copies strings around between multiple buffers including a large on-stack array that causes a build warning on 32-bit systems: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c: In function 'hclge_dbg_dump_tm_pg': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c:782:1: error: the frame size of 1424 bytes is larger than 1400 bytes [-Werror=frame-larger-than=] The function can probably be cleaned up a lot, to go back to printing directly into the output buffer, but dynamically allocating the structure is a simpler workaround for now. Fixes: 04d96139ddb3 ("net: hns3: refine function hclge_dbg_dump_tm_pri()") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit c6995117b60ef3f7afca8fb41f906e9f459d869a Author: Horatiu Vultur Date: Tue Sep 28 09:17:20 2021 +0200 net: mdio: mscc-miim: Fix the mdio controller According to the documentation the second resource is optional. But the blamed commit ignores that and if the resource is not there it just fails. This patch reverts that to still allow the second resource to be optional because other SoC have the some MDIO controller and doesn't need to second resource. Fixes: 672a1c394950 ("net: mdio: mscc-miim: Make use of the helper function devm_platform_ioremap_resource()") Signed-off-by: Horatiu Vultur Reviewed-by: Cai Huoqing Signed-off-by: David S. Miller commit f4bd73b5a950866f6c6fc98a7b684d307c5d586a Author: Kuniyuki Iwashima Date: Tue Sep 28 09:42:27 2021 +0900 af_unix: Return errno instead of NULL in unix_create1(). unix_create1() returns NULL on error, and the callers assume that it never fails for reasons other than out of memory. So, the callers always return -ENOMEM when unix_create1() fails. However, it also returns NULL when the number of af_unix sockets exceeds twice the limit controlled by sysctl: fs.file-max. In this case, the callers should return -ENFILE like alloc_empty_file(). This patch changes unix_create1() to return the correct error value instead of NULL on error. Out of curiosity, the assumption has been wrong since 1999 due to this change introduced in 2.2.4 [0]. diff -u --recursive --new-file v2.2.3/linux/net/unix/af_unix.c linux/net/unix/af_unix.c --- v2.2.3/linux/net/unix/af_unix.c Tue Jan 19 11:32:53 1999 +++ linux/net/unix/af_unix.c Sun Mar 21 07:22:00 1999 @@ -388,6 +413,9 @@ { struct sock *sk; + if (atomic_read(&unix_nr_socks) >= 2*max_files) + return NULL; + MOD_INC_USE_COUNT; sk = sk_alloc(PF_UNIX, GFP_KERNEL, 1); if (!sk) { [0]: https://cdn.kernel.org/pub/linux/kernel/v2.2/patch-2.2.4.gz Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit a9f5970767d11eadc805d5283f202612c7ba1f59 Author: Eric Dumazet Date: Mon Sep 27 17:29:24 2021 -0700 net: udp: annotate data race around udp_sk(sk)->corkflag up->corkflag field can be read or written without any lock. Annotate accesses to avoid possible syzbot/KCSAN reports. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 103bde372f084206c6972be543ecc247ebbff9f3 Author: Randy Dunlap Date: Mon Sep 27 14:48:23 2021 -0700 net: sun: SUNVNET_COMMON should depend on INET When CONFIG_INET is not set, there are failing references to IPv4 functions, so make this driver depend on INET. Fixes these build errors: sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_start_xmit_common': sunvnet_common.c:(.text+0x1a68): undefined reference to `__icmp_send' sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_poll_common': sunvnet_common.c:(.text+0x358c): undefined reference to `ip_send_check' Signed-off-by: Randy Dunlap Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Aaron Young Cc: Rashmi Narasimhan Signed-off-by: David S. Miller commit c23bb54f28d61a48008428e8cd320c947993919b Author: Shannon Nelson Date: Mon Sep 27 14:07:18 2021 -0700 ionic: fix gathering of debug stats Don't print stats for which we haven't reserved space as it can cause nasty memory bashing and related bad behaviors. Fixes: aa620993b1e5 ("ionic: pull per-q stats work out of queue loops") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 3fb2a54b414f493a0c83a085cad78d72bfb49d60 Merge: 05e97b3d33cb2 51032e6f17ce9 Author: David S. Miller Date: Tue Sep 28 13:18:33 2021 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/t nguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-09-27 This series contains updates to e100 driver only. Jake corrects under allocation of register buffer due to incorrect calculations and fixes buffer overrun of register dump. ==================== Signed-off-by: David S. Miller commit 05e97b3d33cb25b9d9580b33ea0dd69aa922c529 Author: Arnd Bergmann Date: Mon Sep 27 16:15:24 2021 +0200 dmascc: add CONFIG_VIRT_TO_BUS dependency Many architectures don't define virt_to_bus() any more, as drivers should be using the dma-mapping interfaces where possible: In file included from drivers/net/hamradio/dmascc.c:27: drivers/net/hamradio/dmascc.c: In function 'tx_on': drivers/net/hamradio/dmascc.c:976:30: error: implicit declaration of function 'virt_to_bus'; did you mean 'virt_to_fix'? [-Werror=implicit-function-declaration] 976 | virt_to_bus(priv->tx_buf[priv->tx_tail]) + n); | ^~~~~~~~~~~ arch/arm/include/asm/dma.h:109:52: note: in definition of macro 'set_dma_addr' 109 | __set_dma_addr(chan, (void *)__bus_to_virt(addr)) | ^~~~ Add the Kconfig dependency to prevent this from being built on architectures without virt_to_bus(). Fixes: bc1abb9e55ce ("dmascc: use proper 'virt_to_bus()' rather than casting to 'int'") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 51bb08dd04a05035a64504faa47651d36b0f3125 Author: Arnd Bergmann Date: Mon Sep 27 16:13:02 2021 +0200 net: ks8851: fix link error An object file cannot be built for both loadable module and built-in use at the same time: arm-linux-gnueabi-ld: drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common': ks8851_common.c:(.text+0xf80): undefined reference to `__this_module' Change the ks8851_common code to be a standalone module instead, and use Makefile logic to ensure this is built-in if at least one of its two users is. Fixes: 797047f875b5 ("net: ks8851: Implement Parallel bus operations") Link: https://lore.kernel.org/netdev/20210125121937.3900988-1-arnd@kernel.org/ Reviewed-by: Andrew Lunn Acked-by: Marek Vasut Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 2c964c558641a3bddaee5719c9e6d8805f777812 Author: Pablo Neira Ayuso Date: Sat Sep 25 00:27:38 2021 +0200 netfilter: nf_tables: reverse order in rule replacement expansion Deactivate old rule first, then append the new rule, so rule replacement notification via netlink first reports the deletion of the old rule with handle X in first place, then it adds the new rule (reusing the handle X of the replaced old rule). Note that the abort path releases the transaction that has been created by nft_delrule() on error. Fixes: ca08987885a1 ("netfilter: nf_tables: deactivate expressions in rule replecement routine") Signed-off-by: Pablo Neira Ayuso commit e189ae161dd784aa5d454b0832f818cacc0e131b Author: Pablo Neira Ayuso Date: Tue Sep 21 00:37:03 2021 +0200 netfilter: nf_tables: add position handle in event notification Add position handle to allow to identify the rule location from netlink events. Otherwise, userspace cannot incrementally update a userspace cache through monitoring events. Skip handle dump if the rule has been either inserted (at the beginning of the ruleset) or appended (at the end of the ruleset), the NLM_F_APPEND netlink flag is sufficient in these two cases. Handle NLM_F_REPLACE as NLM_F_APPEND since the rule replacement expansion appends it after the specified rule handle. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit 339031bafe6b281cf2dcb8364217288b9fdab555 Author: Florian Westphal Date: Thu Sep 23 16:44:34 2021 +0200 netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1 This is a revert of 7b1957b049 ("netfilter: nf_defrag_ipv4: use net_generic infra") and a partial revert of 8b0adbe3e3 ("netfilter: nf_defrag_ipv6: use net_generic infra"). If conntrack is builtin and kernel is booted with: nf_conntrack.enable_hooks=1 .... kernel will fail to boot due to a NULL deref in nf_defrag_ipv4_enable(): Its called before the ipv4 defrag initcall is made, so net_generic() returns NULL. To resolve this, move the user refcount back to struct net so calls to those functions are possible even before their initcalls have run. Fixes: 7b1957b04956 ("netfilter: nf_defrag_ipv4: use net_generic infra") Fixes: 8b0adbe3e38d ("netfilter: nf_defrag_ipv6: use net_generic infra"). Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0d67e332e6df72f43eaa21228daa3a79e23093f3 Author: Arnd Bergmann Date: Mon Sep 27 14:15:10 2021 +0200 module: fix clang CFI with MODULE_UNLOAD=n When CONFIG_MODULE_UNLOAD is disabled, the module->exit member is not defined, causing a build failure: kernel/module.c:4493:8: error: no member named 'exit' in 'struct module' mod->exit = *exit; add an #ifdef block around this. Fixes: cf68fffb66d6 ("add support for Clang CFI") Acked-by: Kees Cook Reviewed-by: Sami Tolvanen Reviewed-by: Miroslav Benes Signed-off-by: Arnd Bergmann Signed-off-by: Jessica Yu commit ced185824c89b60e65b5a2606954c098320cdfb8 Author: Johan Almbladh Date: Mon Sep 27 13:11:57 2021 +0000 bpf, x86: Fix bpf mapping of atomic fetch implementation Fix the case where the dst register maps to %rax as otherwise this produces an incorrect mapping with the implementation in 981f94c3e921 ("bpf: Add bitwise atomic instructions") as %rax is clobbered given it's part of the cmpxchg as operand. The issue is similar to b29dd96b905f ("bpf, x86: Fix BPF_FETCH atomic and/or/ xor with r0 as src") just that the case of dst register was missed. Before, dst=r0 (%rax) src=r2 (%rsi): [...] c5: mov %rax,%r10 c8: mov 0x0(%rax),%rax <---+ (broken) cc: mov %rax,%r11 | cf: and %rsi,%r11 | d2: lock cmpxchg %r11,0x0(%rax) <---+ d8: jne 0x00000000000000c8 | da: mov %rax,%rsi | dd: mov %r10,%rax | [...] | | After, dst=r0 (%rax) src=r2 (%rsi): | | [...] | da: mov %rax,%r10 | dd: mov 0x0(%r10),%rax <---+ (fixed) e1: mov %rax,%r11 | e4: and %rsi,%r11 | e7: lock cmpxchg %r11,0x0(%r10) <---+ ed: jne 0x00000000000000dd ef: mov %rax,%rsi f2: mov %r10,%rax [...] The remaining combinations were fine as-is though: After, dst=r9 (%r15) src=r0 (%rax): [...] dc: mov %rax,%r10 df: mov 0x0(%r15),%rax e3: mov %rax,%r11 e6: and %r10,%r11 e9: lock cmpxchg %r11,0x0(%r15) ef: jne 0x00000000000000df _ f1: mov %rax,%r10 | (unneeded, but f4: mov %r10,%rax _| not a problem) [...] After, dst=r9 (%r15) src=r4 (%rcx): [...] de: mov %rax,%r10 e1: mov 0x0(%r15),%rax e5: mov %rax,%r11 e8: and %rcx,%r11 eb: lock cmpxchg %r11,0x0(%r15) f1: jne 0x00000000000000e1 f3: mov %rax,%rcx f6: mov %r10,%rax [...] The case of dst == src register is rejected by the verifier and therefore not supported, but x86 JIT also handles this case just fine. After, dst=r0 (%rax) src=r0 (%rax): [...] eb: mov %rax,%r10 ee: mov 0x0(%r10),%rax f2: mov %rax,%r11 f5: and %r10,%r11 f8: lock cmpxchg %r11,0x0(%r10) fe: jne 0x00000000000000ee 100: mov %rax,%r10 103: mov %r10,%rax [...] Fixes: 981f94c3e921 ("bpf: Add bitwise atomic instructions") Reported-by: Johan Almbladh Signed-off-by: Johan Almbladh Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Brendan Jackman Acked-by: Alexei Starovoitov commit f0b636804c7c4c564efbca5981e3c56b5c6fe0c5 Author: Sven Peter Date: Fri Sep 24 15:45:02 2021 +0200 iommu/dart: Clear sid2group entry when a group is freed sid2groups keeps track of which stream id combinations belong to a iommu_group to assign those correctly to devices. When a iommu_group is freed a stale pointer will however remain in sid2groups. This prevents devices with the same stream id combination to ever be attached again (see below). Fix that by creating a shadow copy of the stream id configuration when a group is allocated for the first time and clear the sid2group entry when that group is freed. # echo 1 >/sys/bus/pci/devices/0000\:03\:00.0/remove pci 0000:03:00.0: Removing from iommu group 1 # echo 1 >/sys/bus/pci/rescan [...] pci 0000:03:00.0: BAR 0: assigned [mem 0x6a0000000-0x6a000ffff 64bit pref] pci 0000:03:00.0: BAR 2: assigned [mem 0x6a0010000-0x6a001ffff 64bit pref] pci 0000:03:00.0: BAR 6: assigned [mem 0x6c0100000-0x6c01007ff pref] tg3 0000:03:00.0: Failed to add to iommu group 1: -2 [...] Fixes: 46d1fb072e76b161 ("iommu/dart: Add DART iommu driver") Reported-by: Marc Zyngier Signed-off-by: Sven Peter Tested-by: Marc Zyngier Link: https://lore.kernel.org/r/20210924134502.15589-1-sven@svenpeter.dev Signed-off-by: Joerg Roedel commit 0b482d0c75bf321b2fd87d215c3d6df095a601d1 Author: Bjorn Helgaas Date: Wed Sep 22 13:47:26 2021 +0800 iommu/vt-d: Drop "0x" prefix from PCI bus & device addresses 719a19335692 ("iommu/vt-d: Tweak the description of a DMA fault") changed the DMA fault reason from hex to decimal. It also added "0x" prefixes to the PCI bus/device, e.g., - DMAR: [INTR-REMAP] Request device [00:00.5] + DMAR: [INTR-REMAP] Request device [0x00:0x00.5] These no longer match dev_printk() and other similar messages in dmar_match_pci_path() and dmar_acpi_insert_dev_scope(). Drop the "0x" prefixes from the bus and device addresses. Fixes: 719a19335692 ("iommu/vt-d: Tweak the description of a DMA fault") Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20210903193711.483999-1-helgaas@kernel.org Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20210922054726.499110-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 6f87d4e637327b1da3294a7cdad60d49faa32742 Author: Sven Peter Date: Tue Sep 21 17:39:34 2021 +0200 iommu/dart: Remove iommu_flush_ops apple_dart_tlb_flush_{all,walk} expect to get a struct apple_dart_domain but instead get a struct iommu_domain right now. This breaks those two functions and can lead to kernel panics like the one below. DART can only invalidate the entire TLB and apple_dart_iotlb_sync will already flush everything. There's no need to do that again inside those two functions. Let's just drop them. pci 0000:03:00.0: Removing from iommu group 1 Unable to handle kernel paging request at virtual address 0000000100000023 [...] Call trace: _raw_spin_lock_irqsave+0x54/0xbc apple_dart_hw_stream_command.constprop.0+0x2c/0x130 apple_dart_tlb_flush_all+0x48/0x90 free_io_pgtable_ops+0x40/0x70 apple_dart_domain_free+0x2c/0x44 iommu_group_release+0x68/0xac kobject_cleanup+0x4c/0x1fc kobject_cleanup+0x14c/0x1fc kobject_put+0x64/0x84 iommu_group_remove_device+0x110/0x180 iommu_release_device+0x50/0xa0 [...] Fixes: 46d1fb072e76b161 ("iommu/dart: Add DART iommu driver") Reported-by: Marc Zyngier Signed-off-by: Sven Peter Acked-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://lore.kernel.org/r/20210921153934.35647-1-sven@svenpeter.dev Signed-off-by: Joerg Roedel commit f2ff7147c6834f244b8ce636b12e71a3bd044629 Author: Thomas Gleixner Date: Thu Sep 23 18:04:25 2021 +0200 ALSA: pcsp: Make hrtimer forwarding more robust The hrtimer callback pcsp_do_timer() prepares rearming of the timer with hrtimer_forward(). hrtimer_forward() is intended to provide a mechanism to forward the expiry time of the hrtimer by a multiple of the period argument so that the expiry time greater than the time provided in the 'now' argument. pcsp_do_timer() invokes hrtimer_forward() with the current timer expiry time as 'now' argument. That's providing a periodic timer expiry, but is not really robust when the timer callback is delayed so that the resulting new expiry time is already in the past which causes the callback to be invoked immediately again. If the timer is delayed then the back to back invocation is not really making it better than skipping the missed periods. Sound is distorted in any case. Use hrtimer_forward_now() which ensures that the next expiry is in the future. This prevents hogging the CPU in the timer expiry code and allows later on to remove hrtimer_forward() from the public interfaces. Signed-off-by: Thomas Gleixner Cc: alsa-devel@alsa-project.org Cc: Takashi Iwai Cc: Jaroslav Kysela Link: https://lore.kernel.org/r/20210923153339.623208460@linutronix.de Signed-off-by: Takashi Iwai commit ebd6823af378c7d91f80cbe83ce07b5f166744e4 Author: Saravana Kannan Date: Wed Sep 15 10:28:07 2021 -0700 driver core: Add debug logs when fwnode links are added/deleted This will help with debugging fw_devlink issues. Reviewed-by: Geert Uytterhoeven Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915172808.620546-4-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 76f130810b477243ce1312bf5754dc41ce7f91a8 Author: Saravana Kannan Date: Wed Sep 15 10:28:06 2021 -0700 driver core: Create __fwnode_link_del() helper function The same code is repeated in multiple locations. Create a helper function for it. Reviewed-by: Geert Uytterhoeven Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915172808.620546-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 68223eeec70898cd5e42451a9168cd9b2808e248 Author: Saravana Kannan Date: Wed Sep 15 10:28:05 2021 -0700 driver core: Set deferred probe reason when deferred by driver core When the driver core defers the probe of a device, set the deferred probe reason so that it's easier to debug. The deferred probe reason is available in debugfs under devices_deferred. Reviewed-by: Geert Uytterhoeven Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915172808.620546-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 79e2c306667542b8ee2d9a9d947eadc7039f0a3c Author: Jiri Benc Date: Thu Sep 23 10:40:22 2021 +0200 selftests, bpf: test_lwt_ip_encap: Really disable rp_filter It's not enough to set net.ipv4.conf.all.rp_filter=0, that does not override a greater rp_filter value on the individual interfaces. We also need to set net.ipv4.conf.default.rp_filter=0 before creating the interfaces. That way, they'll also get their own rp_filter value of zero. Fixes: 0fde56e4385b0 ("selftests: bpf: add test_lwt_ip_encap selftest") Signed-off-by: Jiri Benc Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/b1cdd9d469f09ea6e01e9c89a6071c79b7380f89.1632386362.git.jbenc@redhat.com commit d888eaac4fb1df30320bb1305a8f78efe86524c6 Author: Jiri Benc Date: Mon Sep 27 18:01:36 2021 +0200 selftests, bpf: Fix makefile dependencies on libbpf When building bpf selftest with make -j, I'm randomly getting build failures such as this one: In file included from progs/bpf_flow.c:19: [...]/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:11:10: fatal error: 'bpf_helper_defs.h' file not found #include "bpf_helper_defs.h" ^~~~~~~~~~~~~~~~~~~ The file that fails the build varies between runs but it's always in the progs/ subdir. The reason is a missing make dependency on libbpf for the .o files in progs/. There was a dependency before commit 3ac2e20fba07e but that commit removed it to prevent unneeded rebuilds. However, that only works if libbpf has been built already; the 'wildcard' prerequisite does not trigger when there's no bpf_helper_defs.h generated yet. Keep the libbpf as an order-only prerequisite to satisfy both goals. It is always built before the progs/ objects but it does not trigger unnecessary rebuilds by itself. Fixes: 3ac2e20fba07e ("selftests/bpf: BPF object files should depend only on libbpf headers") Signed-off-by: Jiri Benc Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/ee84ab66436fba05a197f952af23c98d90eb6243.1632758415.git.jbenc@redhat.com commit 435b08ec0094ac1e128afe6cfd0d9311a8c617a7 Author: Daniel Borkmann Date: Mon Sep 27 14:39:21 2021 +0200 bpf, test, cgroup: Use sk_{alloc,free} for test cases BPF test infra has some hacks in place which kzalloc() a socket and perform minimum init via sock_net_set() and sock_init_data(). As a result, the sk's skcd->cgroup is NULL since it didn't go through proper initialization as it would have been the case from sk_alloc(). Rather than re-adding a NULL test in sock_cgroup_ptr() just for this, use sk_{alloc,free}() pair for the test socket. The latter also allows to get rid of the bpf_sk_storage_free() special case. Fixes: 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode") Fixes: b7a1848e8398 ("bpf: add BPF_PROG_TEST_RUN support for flow dissector") Fixes: 2cb494a36c98 ("bpf: add tests for direct packet access from CGROUP_SKB") Reported-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com Reported-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Tested-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com Tested-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/20210927123921.21535-2-daniel@iogearbox.net commit 78cc316e9583067884eb8bd154301dc1e9ee945c Author: Daniel Borkmann Date: Mon Sep 27 14:39:20 2021 +0200 bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt If cgroup_sk_alloc() is called from interrupt context, then just assign the root cgroup to skcd->cgroup. Prior to commit 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode") we would just return, and later on in sock_cgroup_ptr(), we were NULL-testing the cgroup in fast-path, and iff indeed NULL returning the root cgroup (v ?: &cgrp_dfl_root.cgrp). Rather than re-adding the NULL-test to the fast-path we can just assign it once from cgroup_sk_alloc() given v1/v2 handling has been simplified. The migration from NULL test with returning &cgrp_dfl_root.cgrp to assigning &cgrp_dfl_root.cgrp directly does /not/ change behavior for callers of sock_cgroup_ptr(). syzkaller was able to trigger a splat in the legacy netrom code base, where the RX handler in nr_rx_frame() calls nr_make_new() which calls sk_alloc() and therefore cgroup_sk_alloc() with in_interrupt() condition. Thus the NULL skcd->cgroup, where it trips over on cgroup_sk_free() side given it expects a non-NULL object. There are a few other candidates aside from netrom which have similar pattern where in their accept-like implementation, they just call to sk_alloc() and thus cgroup_sk_alloc() instead of sk_clone_lock() with the corresponding cgroup_sk_clone() which then inherits the cgroup from the parent socket. None of them are related to core protocols where BPF cgroup programs are running from. However, in future, they should follow to implement a similar inheritance mechanism. Additionally, with a !CONFIG_CGROUP_NET_PRIO and !CONFIG_CGROUP_NET_CLASSID configuration, the same issue was exposed also prior to 8520e224f547 due to commit e876ecc67db8 ("cgroup: memcg: net: do not associate sock with unrelated cgroup") which added the early in_interrupt() return back then. Fixes: 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode") Fixes: e876ecc67db8 ("cgroup: memcg: net: do not associate sock with unrelated cgroup") Reported-by: syzbot+df709157a4ecaf192b03@syzkaller.appspotmail.com Reported-by: syzbot+533f389d4026d86a2a95@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Tested-by: syzbot+df709157a4ecaf192b03@syzkaller.appspotmail.com Tested-by: syzbot+533f389d4026d86a2a95@syzkaller.appspotmail.com Acked-by: Tejun Heo Link: https://lore.kernel.org/bpf/20210927123921.21535-1-daniel@iogearbox.net commit bcfd367c2839f2126c048fe59700ec1b538e2b06 Author: Kumar Kartikeya Dwivedi Date: Fri Sep 24 08:07:25 2021 +0530 libbpf: Fix segfault in static linker for objects without BTF When a BPF object is compiled without BTF info (without -g), trying to link such objects using bpftool causes a SIGSEGV due to btf__get_nr_types accessing obj->btf which is NULL. Fix this by checking for the NULL pointer, and return error. Reproducer: $ cat a.bpf.c extern int foo(void); int bar(void) { return foo(); } $ cat b.bpf.c int foo(void) { return 0; } $ clang -O2 -target bpf -c a.bpf.c $ clang -O2 -target bpf -c b.bpf.c $ bpftool gen obj out a.bpf.o b.bpf.o Segmentation fault (core dumped) After fix: $ bpftool gen obj out a.bpf.o b.bpf.o libbpf: failed to find BTF info for object 'a.bpf.o' Error: failed to link 'a.bpf.o': Unknown error -22 (-22) Fixes: a46349227cd8 (libbpf: Add linker extern resolution support for functions and global variables) Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210924023725.70228-1-memxor@gmail.com commit b3aa173d58b437cde5aae5fdce7071212628731b Author: Dave Marchevsky Date: Fri Sep 24 12:35:57 2021 -0700 MAINTAINERS: Add btf headers to BPF BPF folks maintain these and they're not picked up by the current MAINTAINERS entries. Files caught by the added globs: include/linux/btf.h include/linux/btf_ids.h include/uapi/linux/btf.h Signed-off-by: Dave Marchevsky Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210924193557.3081469-1-davemarchevsky@fb.com commit 8a98ae12fbefdb583a7696de719a1d57e5e940a2 Author: Lorenz Bauer Date: Wed Sep 22 12:11:52 2021 +0100 bpf: Exempt CAP_BPF from checks against bpf_jit_limit When introducing CAP_BPF, bpf_jit_charge_modmem() was not changed to treat programs with CAP_BPF as privileged for the purpose of JIT memory allocation. This means that a program without CAP_BPF can block a program with CAP_BPF from loading a program. Fix this by checking bpf_capable() in bpf_jit_charge_modmem(). Fixes: 2c78ee898d8f ("bpf: Implement CAP_BPF") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210922111153.19843-1-lmb@cloudflare.com commit 1dc1eed46f9fa4cb8a07baa24fb44c96d6dd35c9 Author: Miklos Szeredi Date: Mon Sep 27 11:23:57 2021 +0200 ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO Normally the check at open time suffices, but e.g loop device does set IOCB_DIRECT after doing its own checks (which are not sufficent for overlayfs). Make sure we don't call the underlying filesystem read/write method with the IOCB_DIRECT if it's not supported. Reported-by: Huang Jianan Fixes: 16914e6fc7e1 ("ovl: add ovl_read_iter()") Cc: # v4.19 Tested-by: Huang Jianan Signed-off-by: Miklos Szeredi commit 05812b971c6d605c00987750f422918589aa4486 Merge: 5816b3e6577ea c3dbfb9c49eef Author: Dave Airlie Date: Tue Sep 28 17:05:58 2021 +1000 Merge tag 'drm/tegra/for-5.15-rc3' of ssh://git.freedesktop.org/git/tegra/linux into drm-fixes drm/tegra: Fixes for v5.15-rc3 This contains a fix for an UAPI error that happens when no IOMMU is enabled, as well as a few build warning fixes and plugs a potential memory leak. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20210924143537.1341882-1-thierry.reding@gmail.com commit 151a7c12c4fc8340b51e849e4d1fcb7d794777a5 Author: Soeren Moch Date: Sun Sep 26 22:19:05 2021 +0200 Revert "brcmfmac: use ISO3166 country code and 0 rev as fallback" This reverts commit b0b524f079a23e440dd22b04e369368dde847533. Commit b0b524f079a2 ("brcmfmac: use ISO3166 country code and 0 rev as fallback") changes country setup to directly use ISO3166 country codes if no more specific code is configured. This was done under the assumption that brcmfmac firmwares can handle such simple direct mapping from country codes to firmware ccode values. Unfortunately this is not true for all chipset/firmware combinations. E.g. BCM4359/9 devices stop working as access point with this change, so revert the offending commit to avoid the regression. Signed-off-by: Soeren Moch Cc: stable@vger.kernel.org # 5.14.x Acked-by: Shawn Guo Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210926201905.211605-1-smoch@web.de commit fe5c735d0d47b495be6753d6aea4f8f78c909a0a Author: Vladimir Zapolskiy Date: Fri Sep 24 15:21:54 2021 +0300 iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15 There is a Killer AX1650 2x2 Wi-Fi 6 and Bluetooth 5.1 wireless adapter found on Dell XPS 15 (9510) laptop, its configuration was present on Linux v5.7, however accidentally it has been removed from the list of supported devices, let's add it back. The problem is manifested on driver initialization: Intel(R) Wireless WiFi driver for Linux iwlwifi 0000:00:14.3: enabling device (0000 -> 0002) iwlwifi: No config found for PCI dev 43f0/1651, rev=0x354, rfid=0x10a100 iwlwifi: probe of 0000:00:14.3 failed with error -22 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=213939 Fixes: 3f910a25839b ("iwlwifi: pcie: convert all AX101 devices to the device tables") Cc: Julien Wajsberg Signed-off-by: Vladimir Zapolskiy Acked-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210924122154.2376577-1-vladimir.zapolskiy@linaro.org commit b8cf5584ec5b8c67359328b8b03b46657620f304 Author: Namjae Jeon Date: Tue Sep 28 15:04:04 2021 +0900 MAINTAINERS: rename cifs_common to smbfs_common in cifs and ksmbd entry commit 23e91d8b7c5a("cifs: rename cifs_common to smbfs_common") cause the following warning from get_maintainer.pl. ./scripts/get_maintainer.pl --self-test=patterns complains: warning: no file matches F: fs/cifs_common/ This patch rename cifs_common to smbfs_common in cifs and ksmbd entry. Reported-by: Lukas Bulwahn Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0513e464f9007b70b96740271a948ca5ab6e7dd7 Merge: 9cccec2bf32fa 4da8b121884d8 Author: Linus Torvalds Date: Mon Sep 27 14:06:42 2021 -0700 Merge tag 'perf-tools-fixes-for-v5.15-2021-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tools fixes from Arnaldo Carvalho de Melo: - Fix 'perf test' DWARF unwind for optimized builds. - Fix 'perf test' 'Object code reading' when dealing with samples in @plt symbols. - Fix off-by-one directory paths in the ARM support code. - Fix error message to eliminate confusion in 'perf config' when first creating a config file. - 'perf iostat' fix for system wide operation. - Fix printing of metrics when 'perf iostat' is used with one or more iio_root_ports and unconnected cpus (using -C). - Fix several typos in the documentation files. - Fix spelling mistake "icach" -> "icache" in the power8 JSON vendor files. * tag 'perf-tools-fixes-for-v5.15-2021-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf iostat: Fix Segmentation fault from NULL 'struct perf_counts_values *' perf iostat: Use system-wide mode if the target cpu_list is unspecified perf config: Refine error message to eliminate confusion perf doc: Fix typos all over the place perf arm: Fix off-by-one directory paths. perf vendor events powerpc: Fix spelling mistake "icach" -> "icache" perf tests: Fix flaky test 'Object code reading' perf test: Fix DWARF unwind for optimized builds. commit 2a2a79577ddae7d5314b2f57ca86b44d794403d5 Author: Mark Brown Date: Mon Sep 27 14:44:03 2021 +0100 fpga: ice40-spi: Add SPI device ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding a SPI ID table. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Signed-off-by: Moritz Fischer commit 9cccec2bf32fa2a8039cfcd228b9f3a4f0a4f5aa Merge: e6609f2c07de0 50b078184604f Author: Linus Torvalds Date: Mon Sep 27 13:58:23 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "A bit late... I got sidetracked by back-from-vacation routines and conferences. But most of these patches are already a few weeks old and things look more calm on the mailing list than what this pull request would suggest. x86: - missing TLB flush - nested virtualization fixes for SMM (secure boot on nested hypervisor) and other nested SVM fixes - syscall fuzzing fixes - live migration fix for AMD SEV - mirror VMs now work for SEV-ES too - fixes for reset - possible out-of-bounds access in IOAPIC emulation - fix enlightened VMCS on Windows 2022 ARM: - Add missing FORCE target when building the EL2 object - Fix a PMU probe regression on some platforms Generic: - KCSAN fixes selftests: - random fixes, mostly for clang compilation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (43 commits) selftests: KVM: Explicitly use movq to read xmm registers selftests: KVM: Call ucall_init when setting up in rseq_test KVM: Remove tlbs_dirty KVM: X86: Synchronize the shadow pagetable before link it KVM: X86: Fix missed remote tlb flush in rmap_write_protect() KVM: x86: nSVM: don't copy virt_ext from vmcb12 KVM: x86: nSVM: test eax for 4K alignment for GP errata workaround KVM: x86: selftests: test simultaneous uses of V_IRQ from L1 and L0 KVM: x86: nSVM: restore int_vector in svm_clear_vintr kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[] KVM: x86: nVMX: re-evaluate emulation_required on nested VM exit KVM: x86: nVMX: don't fail nested VM entry on invalid guest state if !from_vmentry KVM: x86: VMX: synthesize invalid VM exit when emulating invalid guest state KVM: x86: nSVM: refactor svm_leave_smm and smm_enter_smm KVM: x86: SVM: call KVM_REQ_GET_NESTED_STATE_PAGES on exit from SMM mode KVM: x86: reset pdptrs_from_userspace when exiting smm KVM: x86: nSVM: restore the L1 host state prior to resuming nested guest on SMM exit KVM: nVMX: Filter out all unsupported controls when eVMCS was activated KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs KVM: Clean up benign vcpu->cpu data races when kicking vCPUs ... commit e6609f2c07de03b948fd6c37c5eb4ade3a6d785c Merge: c388a18957efd f0c15b360fb65 Author: Linus Torvalds Date: Mon Sep 27 13:05:12 2021 -0700 Merge tag 'media/v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A couple of driver fixes: - hantro: Fix check for single irq - cedrus: Fix SUNXI tile size calculation - s5p-jpeg: rename JPEG marker constants to prevent build warnings - ir_toy: prevent device from hanging during transmit" * tag 'media/v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: ir_toy: prevent device from hanging during transmit media: s5p-jpeg: rename JPEG marker constants to prevent build warnings media: cedrus: Fix SUNXI tile size calculation media: hantro: Fix check for single irq commit c388a18957efdf31db8e97ec4d2d4b7dc1ca9a44 Author: Jackie Liu Date: Mon Sep 13 15:32:20 2021 +0800 watchdog/sb_watchdog: fix compilation problem due to COMPILE_TEST Compiling sb_watchdog needs to clearly define SIBYTE_HDR_FEATURES. In arch/mips/sibyte/Platform like: cflags-$(CONFIG_SIBYTE_BCM112X) += \ -I$(srctree)/arch/mips/include/asm/mach-sibyte \ -DSIBYTE_HDR_FEATURES=SIBYTE_HDR_FMASK_1250_112x_ALL Otherwise, SIBYTE_HDR_FEATURES is SIBYTE_HDR_FMASK_ALL. SIBYTE_HDR_FMASK_ALL is mean: #define SIBYTE_HDR_FMASK_ALL SIBYTE_HDR_FMASK_1250_ALL | SIBYTE_HDR_FMASK_112x_ALL \ | SIBYTE_HDR_FMASK_1480_ALL) So, If not limited to CPU_SB1, we will get such an error: arch/mips/include/asm/sibyte/bcm1480_scd.h:261: error: "M_SPC_CFG_CLEAR" redefined [-Werror] arch/mips/include/asm/sibyte/bcm1480_scd.h:262: error: "M_SPC_CFG_ENABLE" redefined [-Werror] Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") Signed-off-by: Jackie Liu Reviewed-by: Guenter Roeck Signed-off-by: Linus Torvalds commit d55174cccac2e4c2a58ff68b6b573fc0836f73bd Author: Christoph Hellwig Date: Wed Sep 22 19:34:29 2021 +0200 nvdimm/pmem: fix creating the dax group The recent block layer refactoring broke the way how the pmem driver abused device_add_disk. Fix this by properly passing the attribute groups to device_add_disk. Fixes: 52b85909f85d ("block: fold register_disk into device_add_disk") Signed-off-by: Christoph Hellwig Reviewed-by: Ira Weiny Reviewed-by: Dan Williams Tested-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210922173431.2454024-2-hch@lst.de Signed-off-by: Dan Williams commit f060db99374e80e853ac4916b49f0a903f65e9dc Author: Jia He Date: Wed Sep 22 23:29:19 2021 +0800 ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect When ACPI NFIT table is failing to populate correct numa information on arm64, dax_kmem will get NUMA_NO_NODE from the NFIT driver. Without this patch, pmem can't be probed as RAM devices on arm64 guest: $ndctl create-namespace -fe namespace0.0 --mode=devdax --map=dev -s 1g -a 128M kmem dax0.0: rejecting DAX region [mem 0x240400000-0x2bfffffff] with invalid node: -1 kmem: probe of dax0.0 failed with error -22 Suggested-by: Dan Williams Signed-off-by: Jia He Cc: Fixes: c221c0b0308f ("device-dax: "Hotplug" persistent memory for use like normal RAM") Link: https://lore.kernel.org/r/20210922152919.6940-1-justin.he@arm.com Signed-off-by: Dan Williams commit 9b3b353ef330e20bc2d99bf3165cc044cff26a09 Author: Linus Torvalds Date: Mon Sep 27 11:26:21 2021 -0700 vboxfs: fix broken legacy mount signature checking Commit 9d682ea6bcc7 ("vboxsf: Fix the check for the old binary mount-arguments struct") was meant to fix a build error due to sign mismatch in 'char' and the use of character constants, but it just moved the error elsewhere, in that on some architectures characters and signed and on others they are unsigned, and that's just how the C standard works. The proper fix is a simple "don't do that then". The code was just being silly and odd, and it should never have cared about signed vs unsigned characters in the first place, since what it is testing is not four "characters", but four bytes. And the way to compare four bytes is by using "memcmp()". Which compilers will know to just turn into a single 32-bit compare with a constant, as long as you don't have crazy debug options enabled. Link: https://lore.kernel.org/lkml/20210927094123.576521-1-arnd@kernel.org/ Cc: Arnd Bergmann Cc: Hans de Goede Signed-off-by: Linus Torvalds commit e671f0ecfece14940a9bb81981098910ea278cf7 Author: Wenpeng Liang Date: Mon Sep 27 20:55:57 2021 +0800 RDMA/hns: Add the check of the CQE size of the user space If the CQE size of the user space is not the size supported by the hardware, the creation of CQ should be stopped. Fixes: 09a5f210f67e ("RDMA/hns: Add support for CQE in size of 64 Bytes") Link: https://lore.kernel.org/r/20210927125557.15031-3-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit cc26aee100588a3f293921342a307b6309ace193 Author: Wenpeng Liang Date: Mon Sep 27 20:55:56 2021 +0800 RDMA/hns: Fix the size setting error when copying CQE in clean_cq() The size of CQE is different for different versions of hardware, so the driver needs to specify the size of CQE explicitly. Fixes: 09a5f210f67e ("RDMA/hns: Add support for CQE in size of 64 Bytes") Link: https://lore.kernel.org/r/20210927125557.15031-2-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 59c4e190b10cd2d6edccb5c238a3d2bda071a018 Merge: 6840615f85f60 5816b3e6577ea Author: Mark Brown Date: Mon Sep 27 18:38:10 2021 +0100 Merge tag 'v5.15-rc3' into spi-5.15 Linux 5.15-rc3 commit 7d5cfafe8b4006a75b55c2f1fdfdb363f9a5cc98 Author: Guo Zhi Date: Wed Sep 22 21:48:57 2021 +0800 RDMA/hfi1: Fix kernel pointer leak Pointers should be printed with %p or %px rather than cast to 'unsigned long long' and printed with %llx. Change %llx to %p to print the secured pointer. Fixes: 042a00f93aad ("IB/{ipoib,hfi1}: Add a timeout handler for rdma_netdev") Link: https://lore.kernel.org/r/20210922134857.619602-1-qtxuning1999@sjtu.edu.cn Signed-off-by: Guo Zhi Acked-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe commit 78f8876c2d9f6fdeb9ff62ed1911505156cd7b3d Author: Jens Axboe Date: Mon Sep 27 10:04:10 2021 -0600 io-wq: exclusively gate signal based exit on get_signal() return io-wq threads block all signals, except SIGKILL and SIGSTOP. We should not need any extra checking of signal_pending or fatal_signal_pending, rely exclusively on whether or not get_signal() tells us to exit. The original debugging of this issue led to the false positive that we were exiting on non-fatal signals, but that is not the case. The issue was around races with nr_workers accounting. Fixes: 87c169665578 ("io-wq: ensure we exit if thread group is exiting") Fixes: 15e20db2e0ce ("io-wq: only exit on fatal signals") Reported-by: Eric W. Biederman Reported-by: Linus Torvalds Acked-by: "Eric W. Biederman" Signed-off-by: Jens Axboe commit 42d43c92fc577dca59ed74aec7868abec8d6ca6e Merge: 5816b3e6577ea 88a04049c08cd Author: Linus Torvalds Date: Mon Sep 27 09:51:31 2021 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - NULL pointer dereference fixes in amd_sfh driver (Basavaraj Natikar, Evgeny Novikov) - data processing fix for hid-u2fzero (Andrej Shadura) - fix for out-of-bounds write in hid-betop (F.A.Sulaiman) - new device IDs / device-specific quirks * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: amd_sfh: Fix potential NULL pointer dereference HID: u2fzero: ignore incomplete packets without data HID: amd_sfh: Fix potential NULL pointer dereference HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS HID: betop: fix slab-out-of-bounds Write in betop_probe commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 Author: Max Filippov Date: Mon Sep 27 09:46:33 2021 -0700 xtensa: call irqchip_init only when CONFIG_USE_OF is selected During boot time kernel configured with OF=y but USE_OF=n displays the following warnings and hangs shortly after starting userspace: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0 irq_create_mapping_affinity(, 6) called with NULL domain CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30 Call Trace: __warn+0x69/0xc4 warn_slowpath_fmt+0x6c/0x94 irq_create_mapping_affinity+0x29/0xc0 local_timer_setup+0x40/0x88 time_init+0xb1/0xe8 start_kernel+0x31d/0x3f4 _startup+0x13b/0x13b ---[ end trace 1e6630e1c5eda35b ]--- ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88 error: can't map timer irq CPU: 0 PID: 0 Comm: swapper Tainted: G W 5.15.0-rc3-00001-gd67ed2510d28 #30 Call Trace: __warn+0x69/0xc4 warn_slowpath_fmt+0x6c/0x94 local_timer_setup+0x58/0x88 time_init+0xb1/0xe8 start_kernel+0x31d/0x3f4 _startup+0x13b/0x13b ---[ end trace 1e6630e1c5eda35c ]--- Failed to request irq 0 (timer) Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and calling legacy interrupt controller init otherwise. Fixes: da844a81779e ("xtensa: add device trees support") Signed-off-by: Max Filippov commit a2941f6aa71a72be2c82c0a168523a492d093530 Author: Keith Busch Date: Mon Sep 27 08:43:06 2021 -0700 nvme: add command id quirk for apple controllers Some apple controllers use the command id as an index to implementation specific data structures and will fail if the value is out of bounds. The nvme driver's recently introduced command sequence number breaks this controller. Provide a quirk so these spec incompliant controllers can function as before. The driver will not have the ability to detect bad completions when this quirk is used, but we weren't previously checking this anyway. The quirk bit was selected so that it can readily apply to stable. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214509 Cc: Sven Peter Reported-by: Orlando Chamberlain Reported-by: Aditya Garg Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Tested-by: Sven Peter Link: https://lore.kernel.org/r/20210927154306.387437-1-kbusch@kernel.org Signed-off-by: Jens Axboe commit 51032e6f17ce990d06123ad7307f258c50d25aa7 Author: Jacob Keller Date: Wed Sep 8 10:52:37 2021 -0700 e100: fix buffer overrun in e100_get_regs The e100_get_regs function is used to implement a simple register dump for the e100 device. The data is broken into a couple of MAC control registers, and then a series of PHY registers, followed by a memory dump buffer. The total length of the register dump is defined as (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf). The logic for filling in the PHY registers uses a convoluted inverted count for loop which counts from E100_PHY_REGS (0x1C) down to 0, and assigns the slots 1 + E100_PHY_REGS - i. The first loop iteration will fill in [1] and the final loop iteration will fill in [1 + 0x1C]. This is actually one more than the supposed number of PHY registers. The memory dump buffer is then filled into the space at [2 + E100_PHY_REGS] which will cause that memcpy to assign 4 bytes past the total size. The end result is that we overrun the total buffer size allocated by the kernel, which could lead to a panic or other issues due to memory corruption. It is difficult to determine the actual total number of registers here. The only 8255x datasheet I could find indicates there are 28 total MDI registers. However, we're reading 29 here, and reading them in reverse! In addition, the ethtool e100 register dump interface appears to read the first PHY register to determine if the device is in MDI or MDIx mode. This doesn't appear to be documented anywhere within the 8255x datasheet. I can only assume it must be in register 28 (the extra register we're reading here). Lets not change any of the intended meaning of what we copy here. Just extend the space by 4 bytes to account for the extra register and continue copying the data out in the same order. Change the E100_PHY_REGS value to be the correct total (29) so that the total register dump size is calculated properly. Fix the offset for where we copy the dump buffer so that it doesn't overrun the total size. Re-write the for loop to use counting up instead of the convoluted down-counting. Correct the mdio_read offset to use the 0-based register offsets, but maintain the bizarre reverse ordering so that we have the ABI expected by applications like ethtool. This requires and additional subtraction of 1. It seems a bit odd but it makes the flow of assignment into the register buffer easier to follow. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Felicitas Hetzelt Signed-off-by: Jacob Keller Tested-by: Jacob Keller Signed-off-by: Tony Nguyen commit 4329c8dc110b25d5f04ed20c6821bb60deff279f Author: Jacob Keller Date: Wed Sep 8 10:52:36 2021 -0700 e100: fix length calculation in e100_get_regs_len commit abf9b902059f ("e100: cleanup unneeded math") tried to simplify e100_get_regs_len and remove a double 'divide and then multiply' calculation that the e100_reg_regs_len function did. This change broke the size calculation entirely as it failed to account for the fact that the numbered registers are actually 4 bytes wide and not 1 byte. This resulted in a significant under allocation of the register buffer used by e100_get_regs. Fix this by properly multiplying the register count by u32 first before adding the size of the dump buffer. Fixes: abf9b902059f ("e100: cleanup unneeded math") Reported-by: Felicitas Hetzelt Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen commit 2f9602870886af74d97bac23ee6db5f5466d0a49 Author: Shuah Khan Date: Fri Sep 17 17:58:13 2021 -0600 selftests: drivers/dma-buf: Fix implicit declaration warns udmabuf has the following implicit declaration warns: udmabuf.c:30:10: warning: implicit declaration of function 'open'; udmabuf.c:42:8: warning: implicit declaration of function 'fcntl' These are caused due to not including fcntl.h and including just linux/fcntl.h. Fix it to include fcntl.h which will bring in the linux/fcntl.h. In addition, define __EXPORTED_HEADERS__ to bring in F_ADD_SEALS and F_SEAL_SHRINK defines and fix the following error that show up when just fcntl.h is included. udmabuf.c:45:21: error: 'F_ADD_SEALS' undeclared 45 | ret = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK); | ^~~~~~~~~~~ udmabuf.c:45:34: error: 'F_SEAL_SHRINK' undeclared 45 | ret = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK); | ^~~~~~~~~~~~~ Signed-off-by: Shuah Khan commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 Author: Johan Hovold Date: Fri Sep 17 13:46:21 2021 +0200 ipack: ipoctal: fix module reference leak A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped. Fix this by taking the module reference and initialising the tty driver data when installing the tty. Fixes: 82a82340bab6 ("ipoctal: get carrier driver to avoid rmmod") Cc: stable@vger.kernel.org # 3.18 Cc: Federico Vaga Acked-by: Samuel Iglesias Gonsalvez Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917114622.5412-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 445c8132727728dc297492a7d9fc074af3e94ba3 Author: Johan Hovold Date: Fri Sep 17 13:46:20 2021 +0200 ipack: ipoctal: fix missing allocation-failure check Add the missing error handling when allocating the transmit buffer to avoid dereferencing a NULL pointer in write() should the allocation ever fail. Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board") Cc: stable@vger.kernel.org # 3.5 Acked-by: Samuel Iglesias Gonsalvez Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917114622.5412-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit cd20d59291d1790dc74248476e928f57fc455189 Author: Johan Hovold Date: Fri Sep 17 13:46:19 2021 +0200 ipack: ipoctal: fix tty-registration error handling Registration of the ipoctal tty devices is unlikely to fail, but if it ever does, make sure not to deregister a never registered tty device (and dereference a NULL pointer) when the driver is later unbound. Fixes: 2afb41d9d30d ("Staging: ipack/devices/ipoctal: Check tty_register_device return value.") Cc: stable@vger.kernel.org # 3.7 Acked-by: Samuel Iglesias Gonsalvez Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917114622.5412-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 65c001df517a7bf9be8621b53d43c89f426ce8d6 Author: Johan Hovold Date: Fri Sep 17 13:46:18 2021 +0200 ipack: ipoctal: fix tty registration race Make sure to set the tty class-device driver data before registering the tty to avoid having a racing open() dereference a NULL pointer. Fixes: 9c1d784afc6f ("Staging: ipack/devices/ipoctal: Get rid of ipoctal_list.") Cc: stable@vger.kernel.org # 3.7 Acked-by: Samuel Iglesias Gonsalvez Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917114622.5412-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit a89936cce87d60766a75732a9e7e25c51164f47c Author: Johan Hovold Date: Fri Sep 17 13:46:17 2021 +0200 ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops). Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice. Fixing the ABI is a separate issue, but this at least plugs the security hole. Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board") Cc: stable@vger.kernel.org # 3.5 Acked-by: Samuel Iglesias Gonsalvez Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917114622.5412-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5c49d1850ddd3240d20dc40b01f593e35a184f38 Author: Zhenzhong Duan Date: Sun Sep 26 09:55:45 2021 +0800 KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue When updating the host's mask for its MSR_IA32_TSX_CTRL user return entry, clear the mask in the found uret MSR instead of vmx->guest_uret_msrs[i]. Modifying guest_uret_msrs directly is completely broken as 'i' does not point at the MSR_IA32_TSX_CTRL entry. In fact, it's guaranteed to be an out-of-bounds accesses as is always set to kvm_nr_uret_msrs in a prior loop. By sheer dumb luck, the fallout is limited to "only" failing to preserve the host's TSX_CTRL_CPUID_CLEAR. The out-of-bounds access is benign as it's guaranteed to clear a bit in a guest MSR value, which are always zero at vCPU creation on both x86-64 and i386. Cc: stable@vger.kernel.org Fixes: 8ea8b8d6f869 ("KVM: VMX: Use common x86's uret MSR list as the one true list") Signed-off-by: Zhenzhong Duan Reviewed-by: Sean Christopherson Message-Id: <20210926015545.281083-1-zhenzhong.duan@intel.com> Signed-off-by: Paolo Bonzini commit 913581b8ae0646ebe2f23c57dab3c3ce69e980c3 Merge: 5816b3e6577ea 13404ac8882f5 Author: Greg Kroah-Hartman Date: Mon Sep 27 17:22:16 2021 +0200 Merge tag 'icc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v5.15 This contains a few fixes for the sdm660 driver: - sdm660: Fix id of slv_cnoc_mnoc_cfg - sdm660: Correct NOC_QOS_PRIORITY shift and mask - sdm660: Add missing a2noc qos clocks Signed-off-by: Georgi Djakov * tag 'icc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: sdm660: Add missing a2noc qos clocks dt-bindings: interconnect: sdm660: Add missing a2noc qos clocks interconnect: qcom: sdm660: Correct NOC_QOS_PRIORITY shift and mask interconnect: qcom: sdm660: Fix id of slv_cnoc_mnoc_cfg commit 9523b33cc31cf8ce703f8facee9fd16cba36d5ad Author: Randy Dunlap Date: Fri Sep 24 14:05:25 2021 -0700 NIOS2: setup.c: drop unused variable 'dram_start' This is a nuisance when CONFIG_WERROR is set, so drop the variable declaration since the code that used it was removed. ../arch/nios2/kernel/setup.c: In function 'setup_arch': ../arch/nios2/kernel/setup.c:152:13: warning: unused variable 'dram_start' [-Wunused-variable] 152 | int dram_start; Fixes: 7f7bc20bc41a ("nios2: Don't use _end for calculating min_low_pfn") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Reviewed-by: Mike Rapoport Cc: Andreas Oetken Signed-off-by: Dinh Nguyen commit d67ed2510d28a1eb33171010d35cf52178cfcbdd Author: Randy Dunlap Date: Fri Sep 24 20:29:51 2021 -0700 xtensa: use CONFIG_USE_OF instead of CONFIG_OF CONFIG_OF can be set by a randconfig or by a user -- without setting the early flattree option (OF_EARLY_FLATTREE). This causes build errors. However, if randconfig or a user sets USE_OF in the Xtensa config, the right kconfig symbols are set to fix the build. Fixes these build errors: ../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’? 67 | void *dtb_start = __dtb_start; | ^~~~~~~~~~~ ../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area': ../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration] 201 | if (!of_flat_dt_is_compatible(node, "simple-bus")) ../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration] 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); ../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion] 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); | ^ ../arch/xtensa/kernel/setup.c: In function 'early_init_devtree': ../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration] 228 | early_init_dt_scan(params); ../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration] 229 | of_scan_flat_dt(xtensa_dt_io_area, NULL); xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr' Fixes: da844a81779e ("xtensa: add device trees support") Fixes: 6cb971114f63 ("xtensa: remap io area defined in device tree") Signed-off-by: Randy Dunlap Signed-off-by: Max Filippov commit 3b1b6e82fb5e08e2cb355d7b2ee8644ec289de66 Author: Xu Liang Date: Mon Sep 27 15:03:02 2021 +0800 net: phy: enhance GPY115 loopback disable function GPY115 need reset PHY when it comes out from loopback mode if the firmware version number (lower 8 bits) is equal to or below 0x76. Fixes: 7d901a1e878a ("net: phy: add Maxlinear GPY115/21x/24x driver") Signed-off-by: Xu Liang Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 4da8b121884d84476f3d50d46a471471af1aa9df Author: Like Xu Date: Mon Sep 27 16:11:15 2021 +0800 perf iostat: Fix Segmentation fault from NULL 'struct perf_counts_values *' If the 'perf iostat' user specifies two or more iio_root_ports and also specifies the cpu(s) by -C which is not *connected to all* the above iio ports, the iostat_print_metric() will run into trouble: For example: $ perf iostat list S0-uncore_iio_0<0000:16> S1-uncore_iio_0<0000:97> # <--- CPU 1 is located in the socket S0 $ perf iostat 0000:16,0000:97 -C 1 -- ls port Inbound Read(MB) Inbound Write(MB) Outbound Read(MB) Outbound Write(MB) ../perf-iostat: line 12: 104418 Segmentation fault (core dumped) perf stat --iostat$DELIMITER$* The core-dump stack says, in the above corner case, the returned (struct perf_counts_values *) count will be NULL, and the caller iostat_print_metric() apparently doesn't not handle this case. 433 struct perf_counts_values *count = perf_counts(evsel->counts, die, 0); 434 435 if (count->run && count->ena) { (gdb) p count $1 = (struct perf_counts_values *) 0x0 The deeper reason is that there are actually no statistics from the user specified pair "iostat 0000:X, -C (disconnected) Y ", but let's fix it with minimum cost by adding a NULL check in the user space. Fixes: f9ed693e8bc0e7de ("perf stat: Enable iostat mode for x86 platforms") Signed-off-by: Like Xu Cc: Alexander Antonov Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210927081115.39568-2-likexu@tencent.com Signed-off-by: Arnaldo Carvalho de Melo commit ca48aa4ab8bfe0c235cf86cd0d3c11db0808132e Merge: 3ebaaad4bf47e 33092aca857bf Author: David S. Miller Date: Mon Sep 27 13:39:39 2021 +0100 Merge tag 'mac80211-for-net-2021-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes berg says: ==================== Some fixes: * potential use-after-free in CCMP/GCMP RX processing * potential use-after-free in TX A-MSDU processing * revert to low data rates for no-ack as the commit broke other things * limit VHT MCS/NSS in radiotap injection * drop frames with invalid addresses in IBSS mode * check rhashtable_init() return value in mesh * fix potentially unaligned access in mesh * fix late beacon hrtimer handling in hwsim (syzbot) * fix documentation for PTK0 rekeying ==================== Signed-off-by: David S. Miller commit e4fe5d7349e0b1c0d3da5b6b3e1efce591e85bd2 Author: Like Xu Date: Mon Sep 27 16:11:14 2021 +0800 perf iostat: Use system-wide mode if the target cpu_list is unspecified An iostate use case like "perf iostat 0000:16,0000:97 -- ls" should be implemented to work in system-wide mode to ensure that the output from print_header() is consistent with the user documentation perf-iostat.txt, rather than incorrectly assuming that the kernel does not support it: Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) \ for event (uncore_iio_0/event=0x83,umask=0x04,ch_mask=0xF,fc_mask=0x07/). /bin/dmesg | grep -i perf may provide additional information. This error is easily fixed by assigning system-wide mode by default for IOSTAT_RUN only when the target cpu_list is unspecified. Fixes: f07952b179697771 ("perf stat: Basic support for iostat in perf") Signed-off-by: Like Xu Cc: Alexander Antonov Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210927081115.39568-1-likexu@tencent.com Signed-off-by: Arnaldo Carvalho de Melo commit a827c007c75be4f6038f3d879045fb1ab6385d6b Author: Like Xu Date: Fri Sep 24 19:58:17 2021 +0800 perf config: Refine error message to eliminate confusion If there is no configuration file at first, the user can write any pair of "key.subkey=value" to the newly created configuration file, while value validation against a valid configurable key is *deferred* until the next execution or the implied execution of "perf config ... ". For example: $ rm ~/.perfconfig $ perf config call-graph.dump-size=65529 $ cat ~/.perfconfig # this file is auto-generated. [call-graph] dump-size = 65529 $ perf config call-graph.dump-size=2048 callchain: Incorrect stack dump size (max 65528): 65529 Error: wrong config key-value pair call-graph.dump-size=65529 The user might expect that the second value 2048 is valid and can be updated to the configuration file, but the error message is very confusing because the first value 65529 is not reported as an error during the last configuration. It is recommended not to change the current behavior of delayed validation (as more effort is needed), but to refine the original error message to *clearly indicate* that the cause of the error is the configuration file. Signed-off-by: Like Xu Acked-by: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210924115817.58689-1-likexu@tencent.com Signed-off-by: Arnaldo Carvalho de Melo commit 4da6552c5d07bfc88576ed9ad7fc81fce4c3ba41 Author: Like Xu Date: Fri Sep 24 16:19:42 2021 +0800 perf doc: Fix typos all over the place Considering that perf and its subcommands have so many parameters, the documentation is always the first stop for perf beginners. Fixing some spelling errors will relax the eyes of some readers a little bit. s/specicfication/specification/ s/caheline/cacheline/ s/tranasaction/transaction/ s/complan/complain/ s/sched_wakep/sched_wakeup/ s/possble/possible/ s/methology/methodology/ Signed-off-by: Like Xu Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Jonathan Corbet Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210924081942.38368-1-likexu@tencent.com Signed-off-by: Arnaldo Carvalho de Melo commit c6613bd4a57798ef0aefbcdb28d8c90d4c9cecd8 Author: Ian Rogers Date: Thu Sep 23 08:42:54 2021 -0700 perf arm: Fix off-by-one directory paths. Relative path include works in the regular build due to -I paths but may fail in other situations. v2. Rebase. Comments on v1 were that we should handle include paths differently and it is agreed that can be a sensible refactor but beyond the scope of this change. https://lore.kernel.org/lkml/20210504191227.793712-1-irogers@google.com/ Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Stephane Eranian Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20210923154254.737657-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 774f2c0890f8aab5d436276ec52a03532256afc7 Author: Colin Ian King Date: Thu Sep 16 09:13:14 2021 +0100 perf vendor events powerpc: Fix spelling mistake "icach" -> "icache" There is a spelling mistake in the description text, fix it. Signed-off-by: Colin King Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: kernel-janitors@vger.kernel.org Link: http://lore.kernel.org/lkml/20210916081314.41751-1-colin.king@canonical.com Signed-off-by: Arnaldo Carvalho de Melo commit 0f892fd1bd29a25a62c236c5d4f942ee3295ef49 Author: James Clark Date: Mon Sep 6 16:22:38 2021 +0100 perf tests: Fix flaky test 'Object code reading' This test occasionally fails on aarch64 when a sample is taken in free@plt and it fails with "Bytes read differ from those read by objdump". This is because that symbol is near a section boundary in the elf file. Despite the -z option to always output zeros, objdump uses bfd_map_over_sections() to iterate through the elf file so it doesn't see outside of the sections where these zeros are and can't print them. For example this boundary proceeds free@plt in libc with a gap of 48 bytes between .plt and .text: objdump -d -z --start-address=0x23cc8 --stop-address=0x23d08 libc-2.30.so libc-2.30.so: file format elf64-littleaarch64 Disassembly of section .plt: 0000000000023cc8 <*ABS*+0x7fd00@plt+0x8>: 23cc8: 91018210 add x16, x16, #0x60 23ccc: d61f0220 br x17 Disassembly of section .text: 0000000000023d00 : 23d00: a9bf7bfd stp x29, x30, [sp, #-16]! 23d04: 910003fd mov x29, sp Taking a sample in free@plt is very rare because it is so small, but the test can be forced to fail almost every time on any platform by linking the test with a shared library that has a single empty function and calling it in a loop. The fix is to zero the buffers so that when there is a jump in the addresses output by objdump, zeros are already filled in between. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/20210906152238.3415467-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 5c34aea341b16e29fde6e6c8d4b18866cd99754d Author: Ian Rogers Date: Wed Sep 22 10:38:12 2021 -0700 perf test: Fix DWARF unwind for optimized builds. To ensure the stack frames are on the stack tail calls optimizations need to be inhibited. If your compiler supports an attribute use it, otherwise use an asm volatile barrier. The barrier fix was suggested here: https://lore.kernel.org/lkml/20201028081123.GT2628@hirez.programming.kicks-ass.net/ Tested with an optimized clang build and by forcing the asm barrier route with an optimized clang build. A GCC bug tracking a proper disable_tail_calls is: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97831 Fixes: 9ae1e990f1ab ("perf tools: Remove broken __no_tail_call attribute") v2. is a rebase. The original fix patch generated quite a lot of discussion over the right place for the fix: https://lore.kernel.org/lkml/20201114000803.909530-1-irogers@google.com/ The patch reflects my preference of it being near the use, so that future code cleanups don't break this somewhat special usage. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Ard Biesheuvel Cc: Mark Rutland Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20210922173812.456348-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3ebaaad4bf47e17e6c4bec81f0143657b0eb93f9 Merge: ab609f25d1985 b9c587fed61cf Author: David S. Miller Date: Mon Sep 27 13:31:10 2021 +0100 Merge branch 'mv88e6xxx-mtu-fixes' Andrew Lunn says: ==================== mv88e6xxx: MTU fixes These three patches fix MTU issues reported by 曹煜. There are two different ways of configuring the MTU in the hardware. The 6161 family is using the wrong method. Some of the marvell switch enforce the MTU when the port is used for CPU/DSA, some don't. Because of the extra header, the MTU needs increasing with this overhead. ==================== Signed-off-by: David S. Miller commit b9c587fed61cf88bd45822c3159644445f6d5aa6 Author: Andrew Lunn Date: Sun Sep 26 19:41:26 2021 +0200 dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports Same members of the Marvell Ethernet switches impose MTU restrictions on ports used for connecting to the CPU or another switch for DSA. If the MTU is set too low, tagged frames will be discarded. Ensure the worst case tagger overhead is included in setting the MTU for DSA and CPU ports. Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") Reported by: 曹煜 Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit b92ce2f54c0f0ff781e914ec189c25f7bf1b1ec2 Author: Andrew Lunn Date: Sun Sep 26 19:41:25 2021 +0200 dsa: mv88e6xxx: Fix MTU definition The MTU passed to the DSA driver is the payload size, typically 1500. However, the switch uses the frame size when applying restrictions. Adjust the MTU with the size of the Ethernet header and the frame checksum. The VLAN header also needs to be included when the frame size it per port, but not when it is global. Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") Reported by: 曹煜 Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit fe23036192c95b66e60d019d2ec1814d0d561ffd Author: Andrew Lunn Date: Sun Sep 26 19:41:24 2021 +0200 dsa: mv88e6xxx: 6161: Use chip wide MAX MTU The datasheets suggests the 6161 uses a per port setting for jumbo frames. Testing has however shown this is not correct, it uses the old style chip wide MTU control. Change the ops in the 6161 structure to reflect this. Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") Reported by: 曹煜 Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit ab609f25d19858513919369ff3d9a63c02cd9e2e Author: Yanfei Xu Date: Sun Sep 26 12:53:13 2021 +0800 net: mdiobus: Fix memory leak in __mdiobus_register Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it will cause memory leak. BUG: memory leak unreferenced object 0xffff888114032e00 (size 256): comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................ 08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve..... backtrace: [] kmalloc include/linux/slab.h:591 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] device_private_init drivers/base/core.c:3203 [inline] [] device_add+0x89b/0xdf0 drivers/base/core.c:3253 [] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537 [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87 [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline] [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786 [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:517 [inline] [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596 [] really_probe drivers/base/dd.c:558 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781 [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x122/0x260 drivers/base/dd.c:969 [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [] device_add+0x5fb/0xdf0 drivers/base/core.c:3359 [] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170 [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 BUG: memory leak unreferenced object 0xffff888116f06900 (size 32): comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s) hex dump (first 32 bytes): 75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kstrdup+0x36/0x70 mm/util.c:60 [] kstrdup_const+0x53/0x80 mm/util.c:83 [] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48 [] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289 [] dev_set_name+0x63/0x90 drivers/base/core.c:3147 [] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535 [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87 [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline] [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786 [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:517 [inline] [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596 [] really_probe drivers/base/dd.c:558 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781 [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x122/0x260 drivers/base/dd.c:969 Reported-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com Signed-off-by: Yanfei Xu Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 2974b8a691a94ad5bf29b584dd4fb03829aa43d1 Author: Desnes A. Nunes do Rosario Date: Sat Sep 25 12:14:18 2021 -0300 Revert "ibmvnic: check failover_pending in login response" This reverts commit d437f5aa23aa2b7bd07cd44b839d7546cc17166f. Code has been duplicated through commit <273c29e944bd> "ibmvnic: check failover_pending in login response" Signed-off-by: Desnes A. Nunes do Rosario Signed-off-by: David S. Miller commit 6840615f85f6046039ebc4989870ddb12892b7fc Author: Mark Brown Date: Thu Sep 23 18:00:23 2021 +0100 spi: spidev: Add SPI ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding an id_table listing the SPI IDs for everything. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210923170023.1683-1-broonie@kernel.org Signed-off-by: Mark Brown commit 0cc3687eadd0971d5d38ff90d14819d88f854960 Author: Mark Brown Date: Fri Sep 24 20:48:44 2021 +0100 ASoC: cs4341: Add SPI device ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding SPI IDs for parts that only have a compatible listed. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Cc: patches@opensource.cirrus.com Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20210924194844.45974-1-broonie@kernel.org Signed-off-by: Mark Brown commit ceef3240f9b7e592dd8d10d619c312c7336117fa Author: Mark Brown Date: Fri Sep 24 20:49:56 2021 +0100 ASoC: pcm179x: Add missing entries SPI to device ID table Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding SPI IDs for parts that only have a compatible listed. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210924194956.46079-1-broonie@kernel.org Signed-off-by: Mark Brown commit 172da89ed0eaf9d9348f5decb86ad04c624b39d1 Author: Vineeth Vijayan Date: Fri Sep 10 13:45:24 2021 +0200 s390/cio: avoid excessive path-verification requests Currently when removing a device from cio_ignore list, we trigger a path-verification for all the subchannels available in the system. This could lead to path-verification requests on subchannels with an online device, which could cause unwanted delay. Instead of all the subchannels, trigger the path-verifications to those without an online device. Reported-by: Julian Wiedmann Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") Signed-off-by: Vineeth Vijayan Reviewed-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 763716a55cb1f480ffe1a9702e6b5d9ea1a80a24 Author: Matthew Hagan Date: Sat Sep 25 11:36:27 2021 +0000 net: bgmac-platform: handle mac-address deferral This patch is a replication of Christian Lamparter's "net: bgmac-bcma: handle deferred probe error due to mac-address" patch for the bgmac-platform driver [1]. As is the case with the bgmac-bcma driver, this change is to cover the scenario where the MAC address cannot yet be discovered due to reliance on an nvmem provider which is yet to be instantiated, resulting in a random address being assigned that has to be manually overridden. [1] https://lore.kernel.org/netdev/20210919115725.29064-1-chunkeey@gmail.com Signed-off-by: Matthew Hagan Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 44b6aa2ef69f5b0edf595810236f4ff61503b7e9 Author: Colin Ian King Date: Fri Sep 24 23:31:46 2021 +0100 net: hns: Fix spelling mistake "maped" -> "mapped" There is a spelling mistake in a dev_err error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 33092aca857bf35a8e9cac0e8340c685a4796e90 Author: Alexander Wetzel Date: Fri Sep 24 22:05:14 2021 +0200 mac80211: Fix Ptk0 rekey documentation @IEEE80211_KEY_FLAG_GENERATE_IV setting is irrelevant for RX. Move the requirement to the correct section in the PTK0 rekey documentation. Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20210924200514.7936-1-alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 111461d573741c17eafad029ac93474fa9adcce0 Author: MichelleJin Date: Mon Sep 27 03:34:57 2021 +0000 mac80211: check return value of rhashtable_init When rhashtable_init() fails, it returns -EINVAL. However, since error return value of rhashtable_init is not checked, it can cause use of uninitialized pointers. So, fix unhandled errors of rhashtable_init. Signed-off-by: MichelleJin Link: https://lore.kernel.org/r/20210927033457.1020967-4-shjy180909@gmail.com Signed-off-by: Johannes Berg commit 94513069eb549737bcfc3d988d6ed4da948a2de8 Author: Johannes Berg Date: Mon Sep 27 11:58:39 2021 +0200 mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame"). Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame. Fix this by reloading the variable after the code that results in the reallocations, if any. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401. Cc: stable@vger.kernel.org Fixes: bf30ca922a0c ("mac80211: check defrag PN against current frame") Link: https://lore.kernel.org/r/20210927115838.12b9ac6bb233.I1d066acd5408a662c3b6e828122cd314fcb28cdb@changeid Signed-off-by: Johannes Berg commit 4b8bcaf8a6d6ab5db51e30865def5cb694eb2966 Author: Tejas Upadhyay Date: Tue Sep 14 14:34:12 2021 +0530 drm/i915: Remove warning from the rps worker In commit 4e5c8a99e1cb ("drm/i915: Drop i915_request.lock requirement for intel_rps_boost()"), we decoupled the rps worker from the pm so that we could avoid the synchronization penalty which makes the assertion liable to run too early. Which makes warning invalid hence removed. Fixes: 4e5c8a99e1cb ("drm/i915: Drop i915_request.lock requirement for intel_rps_boost()") Reviewed-by: Chris Wilson Signed-off-by: Tejas Upadhyay Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20210914090412.1393498-1-tejaskumarx.surendrakumar.upadhyay@intel.com (cherry picked from commit a837a0686308d95ad9c48d32b4dfe86a17dc98c2) Signed-off-by: Jani Nikula commit c83ff0186401169eb27ce5057d820b7a863455c3 Author: Matthew Auld Date: Tue Sep 21 14:42:02 2021 +0100 drm/i915/request: fix early tracepoints Currently we blow up in trace_dma_fence_init, when calling into get_driver_name or get_timeline_name, since both the engine and context might be NULL(or contain some garbage address) in the case of newly allocated slab objects via the request ctor. Note that we also use SLAB_TYPESAFE_BY_RCU here, which allows requests to be immediately freed, but delay freeing the underlying page by an RCU grace period. With this scheme requests can be re-allocated, at the same time as they are also being read by some lockless RCU lookup mechanism. In the ctor case, which is only called for new slab objects(i.e allocate new page and call the ctor for each object) it's safe to reset the context/engine prior to calling into dma_fence_init, since we can be certain that no one is doing an RCU lookup which might depend on peeking at the engine/context, like in active_engine(), since the object can't yet be externally visible. In the recycled case(which might also be externally visible) the request refcount always transitions from 0->1 after we set the context/engine etc, which should ensure it's valid to dereference the engine for example, when doing an RCU list-walk, so long as we can also increment the refcount first. If the refcount is already zero, then the request is considered complete/released. If it's non-zero, then the request might be in the process of being re-allocated, or potentially still in flight, however after successfully incrementing the refcount, it's possible to carefully inspect the request state, to determine if the request is still what we were looking for. Note that all externally visible requests returned to the cache must have zero refcount. One possible fix then is to move dma_fence_init out from the request ctor. Originally this was how it was done, but it was moved in: commit 855e39e65cfc33a73724f1cc644ffc5754864a20 Author: Chris Wilson Date: Mon Feb 3 09:41:48 2020 +0000 drm/i915: Initialise basic fence before acquiring seqno where it looks like intel_timeline_get_seqno() relied on some of the rq->fence state, but that is no longer the case since: commit 12ca695d2c1ed26b2dcbb528b42813bd0f216cfc Author: Maarten Lankhorst Date: Tue Mar 23 16:49:50 2021 +0100 drm/i915: Do not share hwsp across contexts any more, v8. intel_timeline_get_seqno() could also be cleaned up slightly by dropping the request argument. Moving dma_fence_init back out of the ctor, should ensure we have enough of the request initialised in case of trace_dma_fence_init. Functionally this should be the same, and is effectively what we were already open coding before, except now we also assign the fence->lock and fence->ops, but since these are invariant for recycled requests(which might be externally visible), and will therefore already hold the same value, it shouldn't matter. An alternative fix, since we don't yet have a fully initialised request when in the ctor, is just setting the context/engine as NULL, but this does require adding some extra handling in get_driver_name etc. v2(Daniel): - Try to make the commit message less confusing Fixes: 855e39e65cfc ("drm/i915: Initialise basic fence before acquiring seqno") Signed-off-by: Matthew Auld Cc: Michael Mason Cc: Daniel Vetter Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210921134202.3803151-1-matthew.auld@intel.com (cherry picked from commit be988eaee1cb208c4445db46bc3ceaf75f586f0b) Signed-off-by: Jani Nikula commit da0468a744501065d9ce3891f8ba35be2969ae4d Author: Akira Yokosawa Date: Mon Sep 20 16:05:00 2021 +0900 drm/i915/guc, docs: Fix pdfdocs build error by removing nested grid Nested grids in grid-table cells are not specified as proper ReST constructs. Commit 572f2a5cd974 ("drm/i915/guc: Update firmware to v62.0.0") added a couple of kerneldoc tables of the form: +---+-------+------------------------------------------------------+ | 1 | 31:0 | +------------------------------------------------+ | +---+-------+ | | | |...| | | Embedded `HXG Message`_ | | +---+-------+ | | | | n | 31:0 | +------------------------------------------------+ | +---+-------+------------------------------------------------------+ For "make htmldocs", they happen to work as one might expect, but they are incompatible with "make latexdocs" and "make pdfdocs", and cause the generated gpu.tex file to become incomplete and unbuildable by xelatex. Restore the compatibility by removing those nested grids in the tables. Size comparison of generated gpu.tex: Sphinx 2.4.4 Sphinx 4.2.0 v5.14: 3238686 3841631 v5.15-rc1: 376270 432729 with this fix: 3377846 3998095 Fixes: 572f2a5cd974 ("drm/i915/guc: Update firmware to v62.0.0") Cc: John Harrison Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Daniele Ceraolo Spurio Cc: Matt Roper Cc: Jonathan Corbet Signed-off-by: Akira Yokosawa Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/4a227569-074f-c501-58bb-d0d8f60a8ae9@gmail.com (cherry picked from commit 017792a041183c4f5ec595f386e76a40ed728cfc) Signed-off-by: Jani Nikula commit 5cb8742774d2f376732ab0becaa46d033319db6b Merge: 5816b3e6577ea d168cd797982d Author: Jani Nikula Date: Mon Sep 27 11:59:08 2021 +0300 Merge tag 'gvt-fixes-2021-09-18' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2021-09-18 - ww locking fix from Zhi Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20210918071105.GY14689@zhen-hp.sh.intel.com commit 88a04049c08cd62e698bc1b1af2d09574b9e0aee Author: Basavaraj Natikar Date: Thu Sep 23 17:59:27 2021 +0530 HID: amd_sfh: Fix potential NULL pointer dereference The cl_data field of a privdata must be allocated and updated before using in amd_sfh_hid_client_init() function. Hence handling NULL pointer cl_data accordingly. Fixes: d46ef750ed58 ("HID: amd_sfh: Fix potential NULL pointer dereference") Signed-off-by: Basavaraj Natikar Signed-off-by: Jiri Kosina commit d72a9c158893d537d769a669a5837bc80b0f851c Author: Namjae Jeon Date: Fri Sep 24 09:24:08 2021 +0900 ksmbd: fix invalid request buffer access in compound Ronnie reported invalid request buffer access in chained command when inserting garbage value to NextCommand of compound request. This patch add validation check to avoid this issue. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Tested-by: Steve French Reviewed-by: Steve French Acked-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 18d46769d54aba03c2c3fa666fe810f264b5d7b8 Author: Ronnie Sahlberg Date: Tue Sep 21 14:45:27 2021 +0900 ksmbd: remove RFC1002 check in smb2 request In smb_common.c you have this function : ksmbd_smb_request() which is called from connection.c once you have read the initial 4 bytes for the next length+smb2 blob. It checks the first byte of this 4 byte preamble for valid values, i.e. a NETBIOSoverTCP SESSION_MESSAGE or a SESSION_KEEP_ALIVE. We don't need to check this for ksmbd since it only implements SMB2 over TCP port 445. The netbios stuff was only used in very old servers when SMB ran over TCP port 139. Now that we run over TCP port 445, this is actually not a NB header anymore and you can just treat it as a 4 byte length field that must be less than 16Mbyte. and remove the references to the RFC1002 constants that no longer applies. Cc: Tom Talpey Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Cc: Sergey Senozhatsky Acked-by: Hyunchul Lee Signed-off-by: Ronnie Sahlberg Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5816b3e6577eaa676ceb00a848f0fd65fe2adc29 Author: Linus Torvalds Date: Sun Sep 26 14:08:19 2021 -0700 Linux 5.15-rc3 commit 5e5d7597637c64588f5cf4db798664a560fbec67 Merge: 996148ee05d08 265fd1991c1db Author: Linus Torvalds Date: Sun Sep 26 12:46:45 2021 -0700 Merge tag '5.15-rc2-ksmbd-fixes' of git://git.samba.org/ksmbd Pull ksmbd fixes from Steve French: "Five fixes for the ksmbd kernel server, including three security fixes: - remove follow symlinks support - use LOOKUP_BENEATH to prevent out of share access - SMB3 compounding security fix - fix for returning the default streams correctly, fixing a bug when writing ppt or doc files from some clients - logging more clearly that ksmbd is experimental (at module load time)" * tag '5.15-rc2-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: use LOOKUP_BENEATH to prevent the out of share access ksmbd: remove follow symlinks support ksmbd: check protocol id in ksmbd_verify_smb_message() ksmbd: add default data stream name in FILE_STREAM_INFORMATION ksmbd: log that server is experimental at module load commit 996148ee05d08ef5163cad99c33a7b5e844ac494 Merge: 299d6e47e8f86 54607282fae61 Author: Linus Torvalds Date: Sun Sep 26 12:18:10 2021 -0700 Merge tag 'edac_urgent_for_v5.15_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: "Fix two EDAC drivers using the wrong value type for the DIMM mode" * tag 'edac_urgent_for_v5.15_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/dmc520: Assign the proper type to dimm->edac_mode EDAC/synopsys: Fix wrong value type assignment for edac_mode commit 299d6e47e8f8665904b9c8c321edb3876c92f68b Merge: 5bb7b2107f8c8 cf96921876dce Author: Linus Torvalds Date: Sun Sep 26 12:11:58 2021 -0700 Merge tag 'thermal-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal fixes from Daniel Lezcano: - Fix thermal shutdown after a suspend/resume due to a wrong TCC value restored on Intel platform (Antoine Tenart) - Fix potential buffer overflow when building the list of policies. The buffer size is not updated after writing to it (Dan Carpenter) - Fix wrong check against IS_ERR instead of NULL (Ansuel Smith) * tag 'thermal-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/tsens: Fix wrong check for tzd in irq handlers thermal/core: Potential buffer overflow in thermal_build_list_of_policies() thermal/drivers/int340x: Do not set a wrong tcc offset on resume commit 5bb7b2107f8c8e97750a36a723f3f74f819f6ff1 Merge: 3a398acc56dd7 5ba1071f7554c Author: Linus Torvalds Date: Sun Sep 26 10:09:20 2021 -0700 Merge tag 'x86-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of fixes for X86: - Prevent sending the wrong signal when protection keys are enabled and the kernel handles a fault in the vsyscall emulation. - Invoke early_reserve_memory() before invoking e820_memory_setup() which is required to make the Xen dom0 e820 hooks work correctly. - Use the correct data type for the SETZ operand in the EMQCMDS instruction wrapper. - Prevent undefined behaviour to the potential unaligned accesss in the instruction decoder library" * tag 'x86-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/insn, tools/x86: Fix undefined behavior due to potential unaligned accesses x86/asm: Fix SETZ size enqcmds() build failure x86/setup: Call early_reserve_memory() earlier x86/fault: Fix wrong signal when vsyscall fails with pkey commit 3a398acc56dd7592eba081ce1ea356151ab90e2d Merge: dc0f97c2613d0 8cd9da85d2bd8 Author: Linus Torvalds Date: Sun Sep 26 10:00:16 2021 -0700 Merge tag 'timers-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix for the recently introduced regression in posix CPU timers which failed to stop the timer when requested. That caused unexpected signals to be sent to the process/thread causing malfunction" * tag 'timers-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Prevent spuriously armed 0-value itimer commit dc0f97c2613d09734719ef89d99d06417d92337d Merge: a3b397b4fffb7 f9bfed3ad5b16 Author: Linus Torvalds Date: Sun Sep 26 09:55:22 2021 -0700 Merge tag 'irq-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A set of fixes for interrupt chip drivers: - Work around a bad GIC integration on a Renesas platform which can't handle byte-sized MMIO access - Plug a potential memory leak in the GICv4 driver - Fix a regression in the Armada 370-XP IPI code which was caused by issuing EOI instack of ACK. - A couple of small fixes here and there" * tag 'irq-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic: Work around broken Renesas integration irqchip/renesas-rza1: Use semicolons instead of commas irqchip/gic-v3-its: Fix potential VPE leak on error irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build irqchip/mbigen: Repair non-kernel-doc notation irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent irqchip/armada-370-xp: Fix ack/eoi breakage Documentation: Fix irq-domain.rst build warning commit ea1945c2f72d7bd253e2ebaa97cdd8d9ffcde076 Author: Nuno Sá Date: Fri Sep 3 16:14:23 2021 +0200 iio: adis16480: fix devices that do not support sleep mode Not all devices supported by this driver support being put to sleep mode. For those devices, when calling 'adis16480_stop_device()' on the unbind path, we where actually writing in the SYNC_SCALE register. Fixes: 80cbc848c4fa0 ("iio: imu: adis16480: Add support for ADIS16490") Fixes: 82e7a1b250170 ("iio: imu: adis16480: Add support for ADIS1649x family of devices") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20210903141423.517028-6-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron commit 319aeaf69c85dc39768b3754c1786225e38e2871 Author: Rob Herring Date: Fri Sep 24 16:42:21 2021 -0500 arm: dts: vexpress: Fix motherboard bus 'interrupt-map' Commit 078fb7aa6a83 ("arm: dts: vexpress: Fix addressing issues with 'motherboard-bus' nodes") broke booting on a couple of 32-bit VExpress boards. The problem is #address-cells size changed, but interrupt-map was not updated. This results in the timer interrupt (and all the other motherboard interrupts) not getting mapped. As the 'interrupt-map' properties are all just duplicates across boards, just move them into vexpress-v2m.dtsi and vexpress-v2m-rs1.dtsi. Strictly speaking, 'interrupt-map' is dependent on the parent interrupt controller, but it's not likely we'll ever have a different parent than GICv2 on these old platforms. If there was one, 'interrupt-map' can still be overridden. Link: https://lore.kernel.org/r/20210924214221.1877686-1-robh@kernel.org Fixes: 078fb7aa6a83 ("arm: dts: vexpress: Fix addressing issues with 'motherboard-bus' nodes") Cc: Guillaume Tucker Cc: Liviu Dudau Cc: Sudeep Holla Cc: Lorenzo Pieralisi Cc: linux-arm-kernel@lists.infradead.org Reported-by: Reported-by: "kernelci.org bot" Signed-off-by: Rob Herring Signed-off-by: Sudeep Holla commit c2980c64c7fd4585d684574c92d1624d44961edd Author: Hui Liu Date: Sun Sep 26 15:30:28 2021 +0800 iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED The previous driver does't apply the necessary scaling to take the voltage range into account. We change readback value from raw data to input voltage to fix case IIO_CHAN_INFO_PROCESSED. Fixes: ace4cdfe67be ("iio: adc: mt2701: Add Mediatek auxadc driver for mt2701.") Signed-off-by: Hui Liu Link: https://lore.kernel.org/r/20210926073028.11045-2-hui.liu@mediatek.com Cc: Signed-off-by: Jonathan Cameron commit b193e15ac69d56f35e1d8e2b5d16cbd47764d053 Author: 王贇 Date: Fri Sep 24 10:35:58 2021 +0800 net: prevent user from passing illegal stab size We observed below report when playing with netlink sock: UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10 shift exponent 249 is too large for 32-bit type CPU: 0 PID: 685 Comm: a.out Not tainted Call Trace: dump_stack_lvl+0x8d/0xcf ubsan_epilogue+0xa/0x4e __ubsan_handle_shift_out_of_bounds+0x161/0x182 __qdisc_calculate_pkt_len+0xf0/0x190 __dev_queue_xmit+0x2ed/0x15b0 it seems like kernel won't check the stab log value passing from user, and will use the insane value later to calculate pkt_len. This patch just add a check on the size/cell_log to avoid insane calculation. Reported-by: Abaci Signed-off-by: Michael Wang Signed-off-by: David S. Miller commit a3b397b4fffb799d25658defafd962f0fb3e9fe0 Merge: bb19237bf6eb7 bcbda81020c3e Author: Linus Torvalds Date: Sat Sep 25 16:20:34 2021 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "16 patches. Subsystems affected by this patch series: xtensa, sh, ocfs2, scripts, lib, and mm (memory-failure, kasan, damon, shmem, tools, pagecache, debug, and pagemap)" * emailed patches from Andrew Morton : mm: fix uninitialized use in overcommit_policy_handler mm/memory_failure: fix the missing pte_unmap() call kasan: always respect CONFIG_KASAN_STACK sh: pgtable-3level: fix cast to pointer from integer of different size mm/debug: sync up latest migrate_reason to migrate_reason_names mm/debug: sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN mm: fs: invalidate bh_lrus for only cold path lib/zlib_inflate/inffast: check config in C to avoid unused function warning tools/vm/page-types: remove dependency on opt_file for idle page tracking scripts/sorttable: riscv: fix undeclared identifier 'EM_RISCV' error ocfs2: drop acl cache for directories too mm/shmem.c: fix judgment error in shmem_is_huge() xtensa: increase size of gcc stack frame check mm/damon: don't use strnlen() with known-bogus source length kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable() commit bb19237bf6eb760802bf28d9274e1af1ef1b84e2 Merge: f6f360aef0e70 fbdac19e64289 Author: Linus Torvalds Date: Sat Sep 25 16:05:56 2021 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Thirty-three fixes, I'm afraid. Essentially the build up from the last couple of weeks while I've been dealling with Linux Plumbers conference infrastructure issues. It's mostly the usual assortment of spelling fixes and minor corrections. The only core relevant changes are to the sd driver to reduce the spin up message spew and fix a small memory leak on the freeing path" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (33 commits) scsi: ses: Retry failed Send/Receive Diagnostic commands scsi: target: Fix spelling mistake "CONFLIFT" -> "CONFLICT" scsi: lpfc: Fix gcc -Wstringop-overread warning, again scsi: lpfc: Use correct scnprintf() limit scsi: lpfc: Fix sprintf() overflow in lpfc_display_fpin_wwpn() scsi: core: Remove 'current_tag' scsi: acornscsi: Remove tagged queuing vestiges scsi: fas216: Kill scmd->tag scsi: qla2xxx: Restore initiator in dual mode scsi: ufs: core: Unbreak the reset handler scsi: sd_zbc: Support disks with more than 2**32 logical blocks scsi: ufs: core: Revert "scsi: ufs: Synchronize SCSI and UFS error handling" scsi: bsg: Fix device unregistration scsi: sd: Make sd_spinup_disk() less noisy scsi: ufs: ufs-pci: Fix Intel LKF link stability scsi: mpt3sas: Clean up some inconsistent indenting scsi: megaraid: Clean up some inconsistent indenting scsi: sr: Fix spelling mistake "does'nt" -> "doesn't" scsi: Remove SCSI CDROM MAINTAINERS entry scsi: megaraid: Fix Coccinelle warning ... commit f6f360aef0e70a45cbf43db1dd9df5a5e96d9836 Merge: 2d70de4ee5931 7df778be2f61e Author: Linus Torvalds Date: Sat Sep 25 15:51:08 2021 -0700 Merge tag 'io_uring-5.15-2021-09-25' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "This one looks a bit bigger than it is, but that's mainly because 2/3 of it is enabling IORING_OP_CLOSE to close direct file descriptors. We've had a few folks using them and finding it confusing that the way to close them is through using -1 for file update, this just brings API symmetry for direct descriptors. Hence I think we should just do this now and have a better API for 5.15 release. There's some room for de-duplicating the close code, but we're leaving that for the next merge window. Outside of that, just small fixes: - Poll race fixes (Hao) - io-wq core dump exit fix (me) - Reschedule around potentially intensive tctx and buffer iterators on teardown (me) - Fix for always ending up punting files update to io-wq (me) - Put the provided buffer meta data under memcg accounting (me) - Tweak for io_write(), removing dead code that was added with the iterator changes in this release (Pavel)" * tag 'io_uring-5.15-2021-09-25' of git://git.kernel.dk/linux-block: io_uring: make OP_CLOSE consistent with direct open io_uring: kill extra checks in io_write() io_uring: don't punt files update to io-wq unconditionally io_uring: put provided buffer meta data under memcg accounting io_uring: allow conditional reschedule for intensive iterators io_uring: fix potential req refcount underflow io_uring: fix missing set of EPOLLONESHOT for CQ ring overflow io_uring: fix race between poll completion and cancel_hash insertion io-wq: ensure we exit if thread group is exiting commit 2d70de4ee5931455811cd0ce692230785ae1c3ce Merge: 5739844347518 f278eb3d8178f Author: Linus Torvalds Date: Sat Sep 25 15:44:05 2021 -0700 Merge tag 'block-5.15-2021-09-25' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - keep ctrl->namespaces ordered (Christoph Hellwig) - fix incorrect h2cdata pdu offset accounting in nvme-tcp (Sagi Grimberg) - handled updated hw_queues in nvme-fc more carefully (Daniel Wagner, James Smart) - md lock order fix (Christoph) - fallocate locking fix (Ming) - blktrace UAF fix (Zhihao) - rq-qos bio tracking fix (Ming) * tag 'block-5.15-2021-09-25' of git://git.kernel.dk/linux-block: block: hold ->invalidate_lock in blkdev_fallocate blktrace: Fix uaf in blk_trace access after removing by sysfs block: don't call rq_qos_ops->done_bio if the bio isn't tracked md: fix a lock order reversal in md_alloc nvme: keep ctrl->namespaces ordered nvme-tcp: fix incorrect h2cdata pdu offset accounting nvme-fc: remove freeze/unfreeze around update_nr_hw_queues nvme-fc: avoid race between time out and tear down nvme-fc: update hardware queues before using them commit 5739844347518a0f4c327ae79e73fb101d864726 Merge: 90316e6ea0f0d 0594c58161b6e Author: Linus Torvalds Date: Sat Sep 25 15:37:31 2021 -0700 Merge tag 'for-linus-5.15b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Some minor cleanups and fixes of some theoretical bugs, as well as a fix of a bug introduced in 5.15-rc1" * tag 'for-linus-5.15b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/x86: fix PV trap handling on secondary processors xen/balloon: fix balloon kthread freezing swiotlb-xen: this is PV-only on x86 xen/pci-swiotlb: reduce visibility of symbols PCI: only build xen-pcifront in PV-enabled environments swiotlb-xen: ensure to issue well-formed XENMEM_exchange requests Xen/gntdev: don't ignore kernel unmapping error xen/x86: drop redundant zeroing from cpu_initialize_context() commit 90316e6ea0f0d63dab4cc84f71a8e199ee4b9b6c Merge: a5e0aceabef61 f5013d412a436 Author: Linus Torvalds Date: Sat Sep 25 15:30:29 2021 -0700 Merge tag 'linux-kselftest-fixes-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: - fix to Kselftest common framework header install to run before other targets for it work correctly in parallel build case. - fixes to kvm test to not ignore fscanf() returns which could result in inconsistent test behavior and failures. * tag 'linux-kselftest-fixes-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: kvm: fix get_run_delay() ignoring fscanf() return warn selftests: kvm: move get_run_delay() into lib/test_util selftests:kvm: fix get_trans_hugepagesz() ignoring fscanf() return warn selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn selftests: be sure to make khdr before other targets commit a5e0aceabef618e2bb3d96c096002d8326d46a83 Merge: b8f4296560e33 c40dd3ca2a45d Author: Linus Torvalds Date: Sat Sep 25 11:31:48 2021 -0700 Merge tag 'erofs-for-5.15-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Two bugfixes to fix the 4KiB blockmap chunk format availability and a dangling pointer usage. There is also a trivial cleanup to clarify compacted_2b if compacted_4b_initial > totalidx. Summary: - fix the dangling pointer use in erofs_lookup tracepoint - fix unsupported chunk format check - zero out compacted_2b if compacted_4b_initial > totalidx" * tag 'erofs-for-5.15-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: clear compacted_2b if compacted_4b_initial > totalidx erofs: fix misbehavior of unsupported chunk format check erofs: fix up erofs_lookup tracepoint commit b8f4296560e33e4e3cbed17a674d1b6dd23191af Merge: 85736168463db 9ed38fd4a1541 Author: Linus Torvalds Date: Sat Sep 25 11:08:12 2021 -0700 Merge tag '5.15-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Six small cifs/smb3 fixes, two for stable: - important fix for deferred close (found by a git functional test) related to attribute caching on close. - four (two cosmetic, two more serious) small fixes for problems pointed out by smatch via Dan Carpenter - fix for comment formatting problems pointed out by W=1" * tag '5.15-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix incorrect check for null pointer in header_assemble smb3: correct server pointer dereferencing check to be more consistent smb3: correct smb3 ACL security descriptor cifs: Clear modified attribute bit from inode flags cifs: Deal with some warnings from W=1 cifs: fix a sign extension bug commit 85736168463db124e1c4f382c7c2fca64c3acb80 Merge: 9cbef30886192 bb509a6ffed2c Author: Linus Torvalds Date: Sat Sep 25 10:29:14 2021 -0700 Merge tag 'char-misc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and misc driver fixes for 5.15-rc3. Nothing huge in here, just fixes for a number of small issues that have been reported. These include: - habanalabs race conditions and other bugs fixed - binder driver fixes - fpga driver fixes - coresight build warning fix - nvmem driver fix - comedi memory leak fix - bcm-vk tty race fix - other tiny driver fixes All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits) comedi: Fix memory leak in compat_insnlist() nvmem: NVMEM_NINTENDO_OTP should depend on WII misc: bcm-vk: fix tty registration race fpga: dfl: Avoid reads to AFU CSRs during enumeration fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() fpga: machxo2-spi: Return an error on failure habanalabs: expose a single cs seq in staged submissions habanalabs: fix wait offset handling habanalabs: rate limit multi CS completion errors habanalabs/gaudi: fix LBW RR configuration habanalabs: Fix spelling mistake "FEADBACK" -> "FEEDBACK" habanalabs: fail collective wait when not supported habanalabs/gaudi: use direct MSI in single mode habanalabs: fix kernel OOPs related to staged cs habanalabs: fix potential race in interrupt wait ioctl mcb: fix error handling in mcb_alloc_bus() misc: genwqe: Fixes DMA mask setting coresight: syscfg: Fix compiler warning nvmem: core: Add stubs for nvmem_cell_read_variable_le_u32/64 if !CONFIG_NVMEM binder: make sure fd closes complete ... commit 9cbef3088619286de66f587e0c770f83f524925b Merge: f9d4be2507cfe aa3233ea7bdb6 Author: Linus Torvalds Date: Sat Sep 25 10:19:49 2021 -0700 Merge tag 'staging-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 5.15-rc3: - greybus tty use-after-free bugfix - r8188eu ioctl overlap build warning fix Note, the r8188eu ioctl has been entirely removed for 5.16-rc1, but it's good to get this fixed now for people using this in 5.15. Both of these have been in linux-next for a while with no reported issues" * tag 'staging-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: r8188eu: fix -Wrestrict warnings staging: greybus: uart: fix tty use after free commit f9d4be2507cfec4d4878fac7d3b85ae9a77da2ce Merge: 2c4e969c38434 7049d853cfb92 Author: Linus Torvalds Date: Sat Sep 25 10:15:55 2021 -0700 Merge tag 'tty-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are four small tty/serial driver fixes for 5.15-rc3. They include: - remove an export now that no one is using it anymore - mvebu-uart tx_empty callback fix - 8250_omap bugfix - synclink_gt build fix All of these have been in linux-next for a while with no reported issues" * tag 'tty-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: unexport tty_ldisc_release tty: synclink_gt: rename a conflicting function name serial: mvebu-uart: fix driver's tx_empty callback serial: 8250: 8250_omap: Fix RX_LVL register offset commit 2c4e969c38434546322097e41d8bfe7376347460 Merge: 7d42e98182586 0292dbd7bd779 Author: Linus Torvalds Date: Sat Sep 25 10:10:38 2021 -0700 Merge tag 'usb-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some USB driver fixes and new device ids for 5.15-rc3. They include: - usb-storage quirk additions - usb-serial new device ids - usb-serial driver fixes - USB roothub registration bugfix to resolve a long-reported issue - usb gadget driver fixes for a large number of small things - dwc2 driver fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (28 commits) USB: serial: option: add device id for Foxconn T99W265 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter USB: serial: cp210x: add part-number debug printk USB: serial: cp210x: fix dropped characters with CP2102 MAINTAINERS: usb, update Peter Korsgaard's entries usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c Re-enable UAS for LaCie Rugged USB3-FW with fk quirk USB: serial: option: remove duplicate USB device ID USB: serial: mos7840: remove duplicated 0xac24 device ID arm64: dts: qcom: ipq8074: remove USB tx-fifo-resize property usb: gadget: f_uac2: Populate SS descriptors' wBytesPerInterval usb: gadget: f_uac2: Add missing companion descriptor for feedback EP usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA usb: core: hcd: Modularize HCD stop configuration in usb_stop_hcd() xhci: Set HCD flag to defer primary roothub registration usb: core: hcd: Add support for deferring roothub registration usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave usb: dwc3: core: balance phy init and exit Revert "USB: bcma: Add a check for devm_gpiod_get" ... commit 9da1b86865ab4376408c58cd9fec332c8bdb5c73 Author: Nuno Sá Date: Mon Sep 20 11:00:47 2021 +0200 iio: adis16475: fix deadlock on frequency set With commit 39c024b51b560 ("iio: adis16475: improve sync scale mode handling"), two deadlocks were introduced: 1) The call to 'adis_write_reg_16()' was not changed to it's unlocked version. 2) The lock was not being released on the success path of the function. This change fixes both these issues. Fixes: 39c024b51b560 ("iio: adis16475: improve sync scale mode handling") Signed-off-by: Nuno Sá Reviewed-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20210920090047.74903-1-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron commit 265fd1991c1db85fbabaad4946ca0e63e2ae688d Author: Hyunchul Lee Date: Sat Sep 25 00:06:16 2021 +0900 ksmbd: use LOOKUP_BENEATH to prevent the out of share access instead of removing '..' in a given path, call kern_path with LOOKUP_BENEATH flag to prevent the out of share access. ran various test on this: smb2-cat-async smb://127.0.0.1/homes/../out_of_share smb2-cat-async smb://127.0.0.1/homes/foo/../../out_of_share smbclient //127.0.0.1/homes -c "mkdir ../foo2" smbclient //127.0.0.1/homes -c "rename bar ../bar" Cc: Ronnie Sahlberg Cc: Ralph Boehme Tested-by: Steve French Tested-by: Namjae Jeon Acked-by: Namjae Jeon Signed-off-by: Hyunchul Lee Signed-off-by: Steve French commit 7fe7f3182a0dd8f9bad463598ed103b3d8cfa739 Merge: 4526fe74c3c50 e9edc188fc764 Author: Jakub Kicinski Date: Fri Sep 24 17:27:19 2021 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net 1) ipset limits the max allocatable memory via kvmalloc() to MAX_INT, from Jozsef Kadlecsik. 2) Check ip_vs_conn_tab_bits value to be in the range specified in Kconfig, from Andrea Claudi. 3) Initialize fragment offset in ip6tables, from Jeremy Sowden. 4) Make conntrack hash chain length random, from Florian Westphal. 5) Add zone ID to conntrack and NAT hashtuple again, also from Florian. 6) Add selftests for bidirectional zone support and colliding tuples, from Florian Westphal. 7) Unlink table before synchronize_rcu when cleaning tables with owner, from Florian. 8) ipset limits the max allocatable memory via kvmalloc() to MAX_INT. 9) Release conntrack entries via workqueue in masquerade, from Florian. 10) Fix bogus net_init in iptables raw table definition, also from Florian. 11) Work around missing softdep in log extensions, from Florian Westphal. 12) Serialize hash resizes and cleanups with mutex, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf: netfilter: conntrack: serialize hash resizes and cleanups netfilter: log: work around missing softdep backend module netfilter: iptable_raw: drop bogus net_init annotation netfilter: nf_nat_masquerade: defer conntrack walk to work queue netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic netfilter: nf_tables: Fix oversized kvmalloc() calls netfilter: nf_tables: unlink table before deleting it selftests: netfilter: add zone stress test with colliding tuples selftests: netfilter: add selftest for directional zone support netfilter: nat: include zone id in nat table hash again netfilter: conntrack: include zone id in tuple hash again netfilter: conntrack: make max chain length random netfilter: ip6_tables: zero-initialize fragment offset ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 netfilter: ipset: Fix oversized kvmalloc() calls ==================== Link: https://lore.kernel.org/r/20210924221113.348767-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit bcbda81020c3ee77e2c098cadf3e84f99ca3de17 Author: Chen Jun Date: Fri Sep 24 15:44:06 2021 -0700 mm: fix uninitialized use in overcommit_policy_handler We get an unexpected value of /proc/sys/vm/overcommit_memory after running the following program: int main() { int fd = open("/proc/sys/vm/overcommit_memory", O_RDWR); write(fd, "1", 1); write(fd, "2", 1); close(fd); } write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax. proc_dointvec_minmax will return 0 without setting new_policy. t.data = &new_policy; ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos) -->do_proc_dointvec -->__do_proc_dointvec if (write) { if (proc_first_pos_non_zero_ignore(ppos, table)) goto out; sysctl_overcommit_memory = new_policy; so sysctl_overcommit_memory will be set to an uninitialized value. Check whether new_policy has been changed by proc_dointvec_minmax. Link: https://lkml.kernel.org/r/20210923020524.13289-1-chenjun102@huawei.com Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy") Signed-off-by: Chen Jun Acked-by: Michal Hocko Reviewed-by: Feng Tang Reviewed-by: Kefeng Wang Cc: Rui Xiang Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5c91c0e77b8f2681e2b269c8abb4c5acef434d5b Author: Qi Zheng Date: Fri Sep 24 15:44:03 2021 -0700 mm/memory_failure: fix the missing pte_unmap() call The paired pte_unmap() call is missing before the dev_pagemap_mapping_shift() returns. So fix it. David says: "I guess this code never runs on 32bit / highmem, that's why we didn't notice so far". [akpm@linux-foundation.org: cleanup] Link: https://lkml.kernel.org/r/20210923122642.4999-1-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Reviewed-by: David Hildenbrand Cc: Naoya Horiguchi Cc: Muchun Song Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19532869feb9b0a97d17ddc14609d1e53a5b60db Author: Nathan Chancellor Date: Fri Sep 24 15:44:00 2021 -0700 kasan: always respect CONFIG_KASAN_STACK Currently, the asan-stack parameter is only passed along if CFLAGS_KASAN_SHADOW is not empty, which requires KASAN_SHADOW_OFFSET to be defined in Kconfig so that the value can be checked. In RISC-V's case, KASAN_SHADOW_OFFSET is not defined in Kconfig, which means that asan-stack does not get disabled with clang even when CONFIG_KASAN_STACK is disabled, resulting in large stack warnings with allmodconfig: drivers/video/fbdev/omap2/omapfb/displays/panel-lgphilips-lb035q02.c:117:12: error: stack frame size (14400) exceeds limit (2048) in function 'lb035q02_connect' [-Werror,-Wframe-larger-than] static int lb035q02_connect(struct omap_dss_device *dssdev) ^ 1 error generated. Ensure that the value of CONFIG_KASAN_STACK is always passed along to the compiler so that these warnings do not happen when CONFIG_KASAN_STACK is disabled. Link: https://github.com/ClangBuiltLinux/linux/issues/1453 References: 6baec880d7a5 ("kasan: turn off asan-stack for clang-8 and earlier") Link: https://lkml.kernel.org/r/20210922205525.570068-1-nathan@kernel.org Signed-off-by: Nathan Chancellor Reviewed-by: Marco Elver Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Nick Desaulniers Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e8e9f1e6327005be9656aa135aeb9dfdaf6b3032 Author: Geert Uytterhoeven Date: Fri Sep 24 15:43:57 2021 -0700 sh: pgtable-3level: fix cast to pointer from integer of different size If X2TLB=y (CPU_SHX2=y or CPU_SHX3=y, e.g. migor_defconfig), pgd_t.pgd is "unsigned long long", causing: In file included from arch/sh/include/asm/pgtable.h:13, from include/linux/pgtable.h:6, from include/linux/mm.h:33, from arch/sh/kernel/asm-offsets.c:14: arch/sh/include/asm/pgtable-3level.h: In function `pud_pgtable': arch/sh/include/asm/pgtable-3level.h:37:9: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 37 | return (pmd_t *)pud_val(pud); | ^ Fix this by adding an intermediate cast to "unsigned long", which is basically what the old code did before. Link: https://lkml.kernel.org/r/2c2eef3c9a2f57e5609100a4864715ccf253d30f.1631713483.git.geert+renesas@glider.be Fixes: 9cf6fa2458443118 ("mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t *") Signed-off-by: Geert Uytterhoeven Tested-by: Daniel Palmer Acked-by: Rob Landley Cc: Yoshinori Sato Cc: Rich Felker Cc: "Aneesh Kumar K . V" Cc: Jacopo Mondi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 57ed7b4303a1c4d1885019fef03e6a5af2e8468a Author: Weizhao Ouyang Date: Fri Sep 24 15:43:53 2021 -0700 mm/debug: sync up latest migrate_reason to migrate_reason_names Sync up MR_DEMOTION to migrate_reason_names and add a synch prompt. Link: https://lkml.kernel.org/r/20210921064553.293905-3-o451686892@gmail.com Fixes: 26aa2d199d6f ("mm/migrate: demote pages during reclaim") Signed-off-by: Weizhao Ouyang Reviewed-by: "Huang, Ying" Reviewed-by: John Hubbard Cc: Anshuman Khandual Cc: Michal Hocko Cc: Pavel Tatashin Cc: Yang Shi Cc: Zi Yan Cc: Dave Hansen Cc: Minchan Kim Cc: Mina Almasry Cc: "Matthew Wilcox (Oracle)" Cc: Oscar Salvador Cc: Wei Xu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4ce73910427e960b2c7f4d83229153c327d0ee7 Author: Weizhao Ouyang Date: Fri Sep 24 15:43:50 2021 -0700 mm/debug: sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN Sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN to migrate_reason_names. Link: https://lkml.kernel.org/r/20210921064553.293905-2-o451686892@gmail.com Fixes: 310253514bbf ("mm/migrate: rename migration reason MR_CMA to MR_CONTIG_RANGE") Fixes: d1e153fea2a8 ("mm/gup: migrate pinned pages out of movable zone") Signed-off-by: Weizhao Ouyang Reviewed-by: "Huang, Ying" Reviewed-by: John Hubbard Cc: Anshuman Khandual Cc: Michal Hocko Cc: Pavel Tatashin Cc: Yang Shi Cc: Zi Yan Cc: Dave Hansen Cc: Minchan Kim Cc: Mina Almasry Cc: "Matthew Wilcox (Oracle)" Cc: Oscar Salvador Cc: Wei Xu Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 243418e3925d5b5b0657ae54c322d43035e97eed Author: Minchan Kim Date: Fri Sep 24 15:43:47 2021 -0700 mm: fs: invalidate bh_lrus for only cold path The kernel test robot reported the regression of fio.write_iops[1] with commit 8cc621d2f45d ("mm: fs: invalidate BH LRU during page migration"). Since lru_add_drain is called frequently, invalidate bh_lrus there could increase bh_lrus cache miss ratio, which needs more IO in the end. This patch moves the bh_lrus invalidation from the hot path( e.g., zap_page_range, pagevec_release) to cold path(i.e., lru_add_drain_all, lru_cache_disable). Zhengjun Xing confirmed "I test the patch, the regression reduced to -2.9%" [1] https://lore.kernel.org/lkml/20210520083144.GD14190@xsang-OptiPlex-9020/ [2] 8cc621d2f45d, mm: fs: invalidate BH LRU during page migration Link: https://lkml.kernel.org/r/20210907212347.1977686-1-minchan@kernel.org Signed-off-by: Minchan Kim Reported-by: kernel test robot Reviewed-by: Chris Goldsworthy Tested-by: "Xing, Zhengjun" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b7cd9fa5ccc392d9f2269edc4cb82508632c28da Author: Paul Menzel Date: Fri Sep 24 15:43:44 2021 -0700 lib/zlib_inflate/inffast: check config in C to avoid unused function warning Building Linux for ppc64le with Ubuntu clang version 12.0.0-3ubuntu1~21.04.1 shows the warning below. arch/powerpc/boot/inffast.c:20:1: warning: unused function 'get_unaligned16' [-Wunused-function] get_unaligned16(const unsigned short *p) ^ 1 warning generated. Fix it by moving the check from the preprocessor to C, so the compiler sees the use. Link: https://lkml.kernel.org/r/20210920084332.5752-1-pmenzel@molgen.mpg.de Signed-off-by: Paul Menzel Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Cc: Nick Desaulniers Cc: Christophe Leroy Cc: Zhen Lei Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ebaeab2fe87987cef28eb5ab174c42cd28594387 Author: Changbin Du Date: Fri Sep 24 15:43:41 2021 -0700 tools/vm/page-types: remove dependency on opt_file for idle page tracking Idle page tracking can also be used for process address space, not only file mappings. Without this change, using with '-i' option for process address space encounters below errors reported. $ sudo ./page-types -p $(pidof bash) -i mark page idle: Bad file descriptor mark page idle: Bad file descriptor mark page idle: Bad file descriptor mark page idle: Bad file descriptor ... Link: https://lkml.kernel.org/r/20210917032826.10669-1-changbin.du@gmail.com Signed-off-by: Changbin Du Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d09c38726c78effaf910a1e3f31e247b5b031d56 Author: Miles Chen Date: Fri Sep 24 15:43:38 2021 -0700 scripts/sorttable: riscv: fix undeclared identifier 'EM_RISCV' error Fix the following build failure reported in [1] by adding a conditional definition of EM_RISCV in order to allow cross-compilation on machines which do not have EM_RISCV definition in their host. scripts/sorttable.c:352:7: error: use of undeclared identifier 'EM_RISCV' EM_RISCV was added to in glibc 2.24 so builds on systems with glibc headers < 2.24 should show this error. [mkubecek@suse.cz: changelog addition] Link: https://lore.kernel.org/lkml/e8965b25-f15b-c7b4-748c-d207dda9c8e8@i2se.com/ [1] Link: https://lkml.kernel.org/r/20210913030625.4525-1-miles.chen@mediatek.com Fixes: 54fed35fd393 ("riscv: Enable BUILDTIME_TABLE_SORT") Signed-off-by: Miles Chen Reported-by: Stefan Wahren Tested-by: Stefan Wahren Reviewed-by: Jisheng Zhang Cc: Michal Kubecek Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Markus Mayer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9c0f0a03e386f4e1df33db676401547e1b7800c6 Author: Wengang Wang Date: Fri Sep 24 15:43:35 2021 -0700 ocfs2: drop acl cache for directories too ocfs2_data_convert_worker() is currently dropping any cached acl info for FILE before down-converting meta lock. It should also drop for DIRECTORY. Otherwise the second acl lookup returns the cached one (from VFS layer) which could be already stale. The problem we are seeing is that the acl changes on one node doesn't get refreshed on other nodes in the following case: Node 1 Node 2 -------------- ---------------- getfacl dir1 getfacl dir1 <-- this is OK setfacl -m u:user1:rwX dir1 getfacl dir1 <-- see the change for user1 getfacl dir1 <-- can't see change for user1 Link: https://lkml.kernel.org/r/20210903012631.6099-1-wen.gang.wang@oracle.com Signed-off-by: Wengang Wang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit de6ee659684b1a2b149e0780d3c5e8032f3647d6 Author: Liu Yuntao Date: Fri Sep 24 15:43:32 2021 -0700 mm/shmem.c: fix judgment error in shmem_is_huge() In the case of SHMEM_HUGE_WITHIN_SIZE, the page index is not rounded up correctly. When the page index points to the first page in a huge page, round_up() cannot bring it to the end of the huge page, but to the end of the previous one. An example: HPAGE_PMD_NR on my machine is 512(2 MB huge page size). After allcoating a 3000 KB buffer, I access it at location 2050 KB. In shmem_is_huge(), the corresponding index happens to be 512. After rounded up by HPAGE_PMD_NR, it will still be 512 which is smaller than i_size, and shmem_is_huge() will return true. As a result, my buffer takes an additional huge page, and that shouldn't happen when shmem_enabled is set to within_size. Link: https://lkml.kernel.org/r/20210909032007.18353-1-liuyuntao10@huawei.com Fixes: f3f0e1d2150b2b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Liu Yuntao Acked-by: Kirill A. Shutemov Acked-by: Hugh Dickins Cc: wuxu.wu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 867050247e295cf20fce046a92a7e6491fcfe066 Author: Guenter Roeck Date: Fri Sep 24 15:43:29 2021 -0700 xtensa: increase size of gcc stack frame check xtensa frame size is larger than the frame size for almost all other architectures. This results in more than 50 "the frame size of is larger than 1024 bytes" errors when trying to build xtensa:allmodconfig. Increase frame size for xtensa to 1536 bytes to avoid compile errors due to frame size limits. Link: https://lkml.kernel.org/r/20210912025235.3514761-1-linux@roeck-us.net Signed-off-by: Guenter Roeck Reviewed-by: Max Filippov Cc: Chris Zankel Cc: David Laight Cc: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 892ab4bbd063cfe7f6bbb183e6be69d9907a61de Author: Adam Borowski Date: Fri Sep 24 15:43:26 2021 -0700 mm/damon: don't use strnlen() with known-bogus source length gcc knows the true length too, and rightfully complains. Link: https://lkml.kernel.org/r/20210912204447.10427-1-kilobyte@angband.pl Signed-off-by: Adam Borowski Cc: SeongJae Park Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa360beac4b62d54879a88b182afef4b369c9700 Author: Marco Elver Date: Fri Sep 24 15:43:23 2021 -0700 kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS In the main KASAN config option CC_HAS_WORKING_NOSANITIZE_ADDRESS is checked for instrumentation-based modes. However, if HAVE_ARCH_KASAN_HW_TAGS is true all modes may still be selected. To fix, also make the software modes depend on CC_HAS_WORKING_NOSANITIZE_ADDRESS. Link: https://lkml.kernel.org/r/20210910084240.1215803-1-elver@google.com Fixes: 6a63a63ff1ac ("kasan: introduce CONFIG_KASAN_HW_TAGS") Signed-off-by: Marco Elver Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Aleksandr Nogikh Cc: Taras Madan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit acfa299a4a63a58e5e81a87cb16798f20d35f7d7 Author: Naoya Horiguchi Date: Fri Sep 24 15:43:20 2021 -0700 mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable() Commit fcc00621d88b ("mm/hwpoison: retry with shake_page() for unhandlable pages") changed the return value of __get_hwpoison_page() to retry for transiently unhandlable cases. However, __get_hwpoison_page() currently fails to properly judge buddy pages as handlable, so hard/soft offline for buddy pages always fail as "unhandlable page". This is totally regrettable. So let's add is_free_buddy_page() in HWPoisonHandlable(), so that __get_hwpoison_page() returns different return values between buddy pages and unhandlable pages as intended. Link: https://lkml.kernel.org/r/20210909004131.163221-1-naoya.horiguchi@linux.dev Fixes: fcc00621d88b ("mm/hwpoison: retry with shake_page() for unhandlable pages") Signed-off-by: Naoya Horiguchi Acked-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Tony Luck Cc: Oscar Salvador Cc: Mike Kravetz Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09540fa337196be20e9f0241652364f09275d374 Author: Dinh Nguyen Date: Thu Sep 16 17:51:26 2021 -0500 clk: socfpga: agilex: fix duplicate s2f_user0_clk Remove the duplicate s2f_user0_clk and the unused s2f_usr0_mux define. Fixes: f817c132db67 ("clk: socfpga: agilex: fix up s2f_user0_clk representation") Cc: stable@vger.kernel.org Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20210916225126.1427700-1-dinguyen@kernel.org Signed-off-by: Stephen Boyd commit 7df778be2f61e1a23002d1f2f5d6aaf702771eb8 Author: Pavel Begunkov Date: Fri Sep 24 20:04:29 2021 +0100 io_uring: make OP_CLOSE consistent with direct open From recently open/accept are now able to manipulate fixed file table, but it's inconsistent that close can't. Close the gap, keep API same as with open/accept, i.e. via sqe->file_slot. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a295aef603e109a47af355477326bd41151765b6 Author: Zheng Liang Date: Fri Sep 24 09:16:27 2021 +0800 ovl: fix missing negative dentry check in ovl_rename() The following reproducer mkdir lower upper work merge touch lower/old touch lower/new mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge rm merge/new mv merge/old merge/new & unlink upper/new may result in this race: PROCESS A: rename("merge/old", "merge/new"); overwrite=true,ovl_lower_positive(old)=true, ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE PROCESS B: unlink("upper/new"); PROCESS A: lookup newdentry in new_upperdir call vfs_rename() with negative newdentry and RENAME_EXCHANGE Fix by adding the missing check for negative newdentry. Signed-off-by: Zheng Liang Fixes: e9be9d5e76e3 ("overlay filesystem") Cc: # v3.18 Signed-off-by: Miklos Szeredi commit 7d42e98182586f57f376406d033f05fe135edb75 Merge: 47d7e65d64cc7 b22a4705e2e60 Author: Linus Torvalds Date: Fri Sep 24 11:22:55 2021 -0700 Merge tag 'gpio-fixes-for-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a regression in GPIO ACPI on HP ElitePad 1000 G2 where the gpio_set_debounce_timeout() now returns a fatal error if the specific debounce period is not supported by the driver instead of just emitting a warning - fix return values of irq_mask/unmask() callbacks in gpio-uniphier - fix hwirq calculation in gpio-aspeed-sgpio - fix two issues in gpio-rockchip: only make the extended debounce support available for v2 and remove a redundant BIT() usage * tag 'gpio-fixes-for-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio/rockchip: fix get_direction value handling gpio/rockchip: extended debounce support is only available on v2 gpio: gpio-aspeed-sgpio: Fix wrong hwirq in irq handler. gpio: uniphier: Fix void functions to remove return value gpiolib: acpi: Make set-debounce-timeout failures non fatal commit 47d7e65d64cc72756b1aa0ccfa3dcbd38c638507 Merge: ea1f9163ac83f 5aeb05b27f812 Author: Linus Torvalds Date: Fri Sep 24 11:20:29 2021 -0700 Merge tag 'devprop-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework fix from Rafael Wysocki: "Fix software node refcount imbalance on device removal (Laurentiu Tudor)" * tag 'devprop-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: software node: balance refcount for managed software nodes commit ea1f9163ac83fa537f58e00a81028844702279e4 Merge: 1b7eaf5701402 12064c1768439 Author: Linus Torvalds Date: Fri Sep 24 11:17:32 2021 -0700 Merge tag 'acpi-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a recent commit related to memory management that turned out to be problematic (Jia He)" * tag 'acpi-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: Add memory semantics to acpi_os_map_memory()" commit 1b7eaf570140281a1aa898a875aa587d48d96958 Merge: 4c4f0c2bf3415 22b70e6f2da0a Author: Linus Torvalds Date: Fri Sep 24 11:12:17 2021 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - It turns out that the optimised string routines merged in 5.14 are not safe with in-kernel MTE (KASAN_HW_TAGS) because of reading beyond the end of a string (strcmp, strncmp). Such reading may go across a 16 byte tag granule and cause a tag check fault. When KASAN_HW_TAGS is enabled, use the generic strcmp/strncmp C implementation. - An errata workaround for ThunderX relied on the CPU capabilities being enabled in a specific order. This disappeared with the automatic generation of the cpucaps.h file (sorted alphabetically). Fix it by checking the current CPU only rather than the system-wide capability. - Add system_supports_mte() checks on the kernel entry/exit path and thread switching to avoid unnecessary barriers and function calls on systems where MTE is not supported. - kselftests: skip arm64 tests if the required features are missing. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Restore forced disabling of KPTI on ThunderX kselftest/arm64: signal: Skip tests if required features are missing arm64: Mitigate MTE issues with str{n}cmp() arm64: add MTE supported check to thread switching and syscall entry/exit commit 4c4f0c2bf3415a5fe7512d17d841bc1f8020b2cb Merge: e655c81ade7b8 708c87168b612 Author: Linus Torvalds Date: Fri Sep 24 10:28:18 2021 -0700 Merge tag 'ceph-for-5.15-rc3' of git://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix for a potential array out of bounds access from Dan" * tag 'ceph-for-5.15-rc3' of git://github.com/ceph/ceph-client: ceph: fix off by one bugs in unsafe_request_wait() commit e655c81ade7b877cb5ee31c85e88928ec3f77db6 Merge: a801695f68f40 372d1f3e1bfed Author: Linus Torvalds Date: Fri Sep 24 10:22:35 2021 -0700 Merge tag 'fixes_for_v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull misc filesystem fixes from Jan Kara: "A for ext2 sleep in atomic context in case of some fs problems and a cleanup of an invalidate_lock initialization" * tag 'fixes_for_v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: fix sleeping in atomic bugs on error mm: Fully initialize invalidate_lock, amend lock class later commit a801695f68f40e75e47ed292bc9aaab815814b53 Merge: e61b2ad3e1914 40c8ee67cfc49 Author: Linus Torvalds Date: Fri Sep 24 10:18:07 2021 -0700 Merge branch 'work.init' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Followups to nodev root stuff from this merge window" * 'work.init' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: init: don't panic if mount_nodev_root failed init/do_mounts.c: Harden split_fs_names() against buffer overflow commit e61b2ad3e1914b70c657a8fd7524078ae37a7da4 Merge: f9e36107ec704 ef88d7a8a5c94 Author: Linus Torvalds Date: Fri Sep 24 10:14:19 2021 -0700 Merge tag 'drm-fixes-2021-09-24' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Quiet week this week, just some i915 and amd fixes, just getting ready for my all nighter maintainer summit! Summary: i915: - Fix ADL-P memory bandwidth parameters - Fix memory corruption due to a double free - Fix memory leak in DMC firmware handling amdgpu: - Update MAINTAINERS entry for powerplay - Fix empty macros - SI DPM fix amdkfd: - SVM fixes - DMA mapping fix" * tag 'drm-fixes-2021-09-24' of git://anongit.freedesktop.org/drm/drm: drm/amdkfd: fix svm_migrate_fini warning drm/amdkfd: handle svm migrate init error drm/amd/pm: Update intermediate power state for SI drm/amdkfd: fix dma mapping leaking warning drm/amdkfd: SVM map to gpus check vma boundary MAINTAINERS: fix up entry for AMD Powerplay drm/amd/display: fix empty debug macros drm/i915: Free all DMC payloads drm/i915: Move __i915_gem_free_object to ttm_bo_destroy drm/i915: Update memory bandwidth parameters commit f278eb3d8178f9c31f8dfad7e91440e603dd7f1a Author: Ming Lei Date: Thu Sep 23 10:37:51 2021 +0800 block: hold ->invalidate_lock in blkdev_fallocate When running ->fallocate(), blkdev_fallocate() should hold mapping->invalidate_lock to prevent page cache from being accessed, otherwise stale data may be read in page cache. Without this patch, blktests block/009 fails sometimes. With this patch, block/009 can pass always. Also as Jan pointed out, no pages can be created in the discarded area while you are holding the invalidate_lock, so remove the 2nd truncate_bdev_range(). Cc: Jan Kara Signed-off-by: Ming Lei Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20210923023751.1441091-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 Author: Zhihao Cheng Date: Thu Sep 23 21:49:21 2021 +0800 blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock [ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART) echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state. Fixes: c71a896154119f ("blktrace: add ftrace plugin") Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20210923134921.109194-1-chengzhihao1@huawei.com Signed-off-by: Jens Axboe commit a647a524a46736786c95cdb553a070322ca096e3 Author: Ming Lei Date: Fri Sep 24 19:07:04 2021 +0800 block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn't to be called for bio based driver 2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code. Especially in bio_endio(): 1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases 2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio() Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked. Reported-by: Yu Kuai Cc: tj@kernel.org Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20210924110704.1541818-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9f3a2cb228c28606895d15f13b30d1f7402dc745 Author: Pavel Begunkov Date: Fri Sep 24 17:14:48 2021 +0100 io_uring: kill extra checks in io_write() We don't retry short writes and so we would never get to async setup in io_write() in that case. Thus ret2 > 0 is always false and iov_iter_advance() is never used. Apparently, the same is found by Coverity, which complains on the code. Fixes: cd65869512ab ("io_uring: use iov_iter state save/restore helpers") Reported-by: Dave Jones Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/5b33e61034748ef1022766efc0fb8854cfcf749c.1632500058.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit cdb31c29d397a8076d81fd1458d091c647ef94ba Author: Jens Axboe Date: Fri Sep 24 08:43:54 2021 -0600 io_uring: don't punt files update to io-wq unconditionally There's no reason to punt it unconditionally, we just need to ensure that the submit lock grabbing is conditional. Fixes: 05f3fb3c5397 ("io_uring: avoid ring quiesce for fixed file set unregister and update") Signed-off-by: Jens Axboe commit 9990da93d2bf9892c2c14c958bef050d4e461a1a Author: Jens Axboe Date: Fri Sep 24 07:39:08 2021 -0600 io_uring: put provided buffer meta data under memcg accounting For each provided buffer, we allocate a struct io_buffer to hold the data associated with it. As a large number of buffers can be provided, account that data with memcg. Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") Signed-off-by: Jens Axboe commit 8bab4c09f24ec8d4a7a78ab343620f89d3a24804 Author: Jens Axboe Date: Fri Sep 24 07:12:27 2021 -0600 io_uring: allow conditional reschedule for intensive iterators If we have a lot of threads and rings, the tctx list can get quite big. This is especially true if we keep creating new threads and rings. Likewise for the provided buffers list. Be nice and insert a conditional reschedule point while iterating the nodes for deletion. Link: https://lore.kernel.org/io-uring/00000000000064b6b405ccb41113@google.com/ Reported-by: syzbot+111d2a03f51f5ae73775@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 5b7aa38d86f348847a48f71e9ac7715406de900e Author: Hao Xu Date: Wed Sep 22 18:12:38 2021 +0800 io_uring: fix potential req refcount underflow For multishot mode, there may be cases like: iowq original context io_poll_add _arm_poll() mask = vfs_poll() is not 0 if mask (2) io_poll_complete() compl_unlock (interruption happens tw queued to original context) io_poll_task_func() compl_lock (3) done = io_poll_complete() is true compl_unlock put req ref (1) if (poll->flags & EPOLLONESHOT) put req ref EPOLLONESHOT flag in (1) may be from (2) or (3), so there are multiple combinations that can cause ref underfow. Let's address it by: - check the return value in (2) as done - change (1) to if (done) in this way, we only do ref put in (1) if 'oneshot flag' is from (2) - do poll.done check in io_poll_task_func(), so that we won't put ref for the second time. Signed-off-by: Hao Xu Link: https://lore.kernel.org/r/20210922101238.7177-4-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit a62682f92eedb41c1cd8290fa875a4b85624fb9a Author: Hao Xu Date: Wed Sep 22 18:12:37 2021 +0800 io_uring: fix missing set of EPOLLONESHOT for CQ ring overflow We should set EPOLLONESHOT if cqring_fill_event() returns false since io_poll_add() decides to put req or not by it. Fixes: 5082620fb2ca ("io_uring: terminate multishot poll for CQ ring overflow") Signed-off-by: Hao Xu Link: https://lore.kernel.org/r/20210922101238.7177-3-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit bd99c71bd14072ce2920f6d0c2fe43df072c653c Author: Hao Xu Date: Wed Sep 22 18:12:36 2021 +0800 io_uring: fix race between poll completion and cancel_hash insertion If poll arming and poll completion runs in parallel, there maybe races. For instance, run io_poll_add in iowq and io_poll_task_func in original context, then: iowq original context io_poll_add vfs_poll (interruption happens tw queued to original context) io_poll_task_func generate cqe del from cancel_hash[] if !poll.done insert to cancel_hash[] The entry left in cancel_hash[], similar case for fast poll. Fix it by set poll.done = true when del from cancel_hash[]. Fixes: 5082620fb2ca ("io_uring: terminate multishot poll for CQ ring overflow") Signed-off-by: Hao Xu Link: https://lore.kernel.org/r/20210922101238.7177-2-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 87c1696655787895689618c8b63c5efe66b8f2ab Author: Jens Axboe Date: Tue Sep 21 08:24:57 2021 -0600 io-wq: ensure we exit if thread group is exiting Dave reports that a coredumping workload gets stuck in 5.15-rc2, and identified the culprit in the Fixes line below. The problem is that relying solely on fatal_signal_pending() to gate whether to exit or not fails miserably if a process gets eg SIGILL sent. Don't exclusively rely on fatal signals, also check if the thread group is exiting. Fixes: 15e20db2e0ce ("io-wq: only exit on fatal signals") Reported-by: Dave Chinner Signed-off-by: Jens Axboe commit 42de956ca7e5f6c47048dde640f797e783b23198 Author: Jason Gunthorpe Date: Tue Sep 21 09:11:59 2021 -0300 vfio/ap_ops: Add missed vfio_uninit_group_dev() Without this call an xarray entry is leaked when the vfio_ap device is unprobed. It was missed when the below patch was rebased across the dev_set patch. Keep the remove function in the same order as the error unwind in probe. Fixes: eb0feefd4c02 ("vfio/ap_ops: Convert to use vfio_register_group_dev()") Reviewed-by: Christoph Hellwig Tested-by: Tony Krowiak Signed-off-by: Jason Gunthorpe Reviewed-by: Tony Krowiak Link: https://lore.kernel.org/r/0-v3-f9b50340cdbb+e4-ap_uninit_jgg@nvidia.com Signed-off-by: Alex Williamson commit 1878f4b7ec9ed013da8a7efb63fed1fbae0215ae Author: Shawn Guo Date: Tue Aug 24 12:34:35 2021 +0800 arm64: dts: qcom: sdm630: Add missing a2noc qos clocks It adds the missing a2noc clocks required for QoS registers programming per downstream kernel[1]. [1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/arch/arm/boot/dts/qcom/sdm660-bus.dtsi?h=LA.UM.8.2.r1-04800-sdm660.0#n43 Fixes: 045547a02252 ("arm64: dts: qcom: sdm630: Add interconnect provider nodes") Signed-off-by: Shawn Guo Acked-by: Georgi Djakov Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210824043435.23190-4-shawn.guo@linaro.org commit 30b83220aa009b8654f17a8ad6cf8b08959110f2 Author: Dmitry Baryshkov Date: Thu Sep 16 18:13:41 2021 +0300 arm64: dts: qcom: qrb5165-rb5: enabled pwrkey and resin nodes Enable powerkey and resin nodes to let the board handle POWER and Volume- keys properly. Signed-off-by: Dmitry Baryshkov Tested-by: Amit Pundir Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210916151341.1797512-3-dmitry.baryshkov@linaro.org commit c5c24373ad0cb412002fe543683eab34189ec5ba Author: Dmitry Baryshkov Date: Thu Sep 16 18:13:40 2021 +0300 arm64: dts: qcom: pm8150: specify reboot mode magics Specify recovery and bootloader magic values to be programmed by the qcom-pon driver. This allows the bootloader to handle reboot-to-bootloader functionality. Signed-off-by: Dmitry Baryshkov Tested-by: Amit Pundir Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210916151341.1797512-2-dmitry.baryshkov@linaro.org commit a153d317168aa3d61a204fadc85bac3995381d33 Author: Dmitry Baryshkov Date: Thu Sep 16 18:13:39 2021 +0300 arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding Change pm8150 to use the qcom,pm8998-pon compatible string for the pon in order to pass reboot mode properly. Fixes: 5101f22a5c37 ("arm64: dts: qcom: pm8150: Add base dts file") Signed-off-by: Dmitry Baryshkov Tested-by: Amit Pundir Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210916151341.1797512-1-dmitry.baryshkov@linaro.org commit 66019837a5563e1f80a4228b7d110d8c52bfdd8b Author: Konstantin Komarov Date: Wed Sep 22 18:50:58 2021 +0300 fs/ntfs3: Refactoring lock in ntfs_init_acl This is possible because of moving lock into ntfs_create_inode. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit ba77237ef880320105e681b93d596b2fb13860f9 Author: Konstantin Komarov Date: Wed Sep 22 18:46:14 2021 +0300 fs/ntfs3: Change posix_acl_equiv_mode to posix_acl_update_mode Right now ntfs3 uses posix_acl_equiv_mode instead of posix_acl_update_mode like all other fs. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 398c35f4d78410725e154c2fc0a51ecac05a3f1f Author: Konstantin Komarov Date: Wed Sep 22 18:33:38 2021 +0300 fs/ntfs3: Pass flags to ntfs_set_ea in ntfs_set_acl_ex In case of removing of xattr there must be XATTR_REPLACE flag and zero length. We already check XATTR_REPLACE in ntfs_set_ea, so now we pass XATTR_REPLACE to ntfs_set_ea. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0bd5fdb811b0449fcef948a100099cc3197f1b73 Author: Konstantin Komarov Date: Wed Sep 22 18:28:36 2021 +0300 fs/ntfs3: Refactor ntfs_get_acl_ex for better readability We can safely move set_cached_acl because it works with NULL acl too. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit d562e901f25d275b55b0496fe01935beeff0ed37 Author: Konstantin Komarov Date: Thu Sep 23 18:04:26 2021 +0300 fs/ntfs3: Move ni_lock_dir and ni_unlock into ntfs_create_inode Now ntfs3 locks mutex for smaller time. Theoretically in successful cases those locks aren't needed at all. But proving the same for error cases is difficult. So instead of removing them we just move them. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 6c1ee4d304983d2f68bf7639d5912f781398d5ac Author: Konstantin Komarov Date: Thu Sep 23 18:05:36 2021 +0300 fs/ntfs3: Fix logical error in ntfs_create_inode We need to always call indx_delete_entry after indx_insert_entry if error occurred. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit a86cd017a40a66b1a3db005bfee4e76a1ae9a432 Author: Leon Romanovsky Date: Mon Sep 13 11:04:42 2021 +0300 RDMA/usnic: Lock VF with mutex instead of spinlock Usnic VF doesn't need lock in atomic context to create QPs, so it is safe to use mutex instead of spinlock. Such change fixes the following smatch error. Smatch static checker warning: lib/kobject.c:289 kobject_set_name_vargs() warn: sleeping in atomic context Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Link: https://lore.kernel.org/r/2a0e295786c127e518ebee8bb7cafcb819a625f6.1631520231.git.leonro@nvidia.com Reported-by: Dan Carpenter Signed-off-by: Leon Romanovsky Reviewed-by: Håkon Bugge Signed-off-by: Jason Gunthorpe commit adfc8f9d2f9fefd880abc82cfbf62cbfe6539c97 Author: Randy Dunlap Date: Thu Sep 23 17:29:39 2021 -0700 NIOS2: fix kconfig unmet dependency warning for SERIAL_CORE_CONSOLE SERIAL_CORE_CONSOLE depends on TTY so EARLY_PRINTK should also depend on TTY so that it does not select SERIAL_CORE_CONSOLE inadvertently. WARNING: unmet direct dependencies detected for SERIAL_CORE_CONSOLE Depends on [n]: TTY [=n] && HAS_IOMEM [=y] Selected by [y]: - EARLY_PRINTK [=y] Fixes: e8bf5bc776ed ("nios2: add early printk support") Signed-off-by: Randy Dunlap Cc: Dinh Nguyen Signed-off-by: Dinh Nguyen commit 4526fe74c3c5095cc55931a3a6fb4932f9e06002 Author: Daniele Palmas Date: Fri Sep 24 11:26:52 2021 +0200 drivers: net: mhi: fix error path in mhi_net_newlink Fix double free_netdev when mhi_prepare_for_transfer fails. Fixes: 3ffec6a14f24 ("net: Add mhi-net driver") Signed-off-by: Daniele Palmas Reviewed-by: Manivannan Sadhasivam Reviewed-by: Loic Poulain Signed-off-by: David S. Miller commit 5ab8a447bcfee1ded709e7ff5dc7608ca9f66ae2 Author: Aaro Koskinen Date: Fri Sep 24 01:00:16 2021 +0300 smsc95xx: fix stalled rx after link change After commit 05b35e7eb9a1 ("smsc95xx: add phylib support"), link changes are no longer propagated to usbnet. As a result, rx URB allocation won't happen until there is a packet sent out first (this might never happen, e.g. running just ssh server with a static IP). Fix by triggering usbnet EVENT_LINK_CHANGE. Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support") Signed-off-by: Aaro Koskinen Signed-off-by: David S. Miller commit 5cad87569164fbdd5279504d7bc089aea51bf0f4 Merge: cd586d213e583 298ba0e3d4af5 Author: Jens Axboe Date: Fri Sep 24 07:15:21 2021 -0600 Merge tag 'nvme-5.15-2021-09-24' of git://git.infradead.org/nvme into block-5.15 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.15: - keep ctrl->namespaces ordered (me) - fix incorrect h2cdata pdu offset accounting in nvme-tcp (Sagi Grimberg) - handled updated hw_queues in nvme-fc more carefully (Daniel Wagner, James Smart)" * tag 'nvme-5.15-2021-09-24' of git://git.infradead.org/nvme: nvme: keep ctrl->namespaces ordered nvme-tcp: fix incorrect h2cdata pdu offset accounting nvme-fc: remove freeze/unfreeze around update_nr_hw_queues nvme-fc: avoid race between time out and tear down nvme-fc: update hardware queues before using them commit fa2a30f8e0aa9304919750b116a9e9e322465299 Author: Biju Das Date: Wed Sep 22 12:24:05 2021 +0100 clk: renesas: rzg2l: Fix clk status function As per RZ/G2L HW(Rev.0.50) manual, clock monitor register value 0 means clock is not supplied and 1 means clock is supplied. This patch fixes the issue by removing the inverted logic. Fixing the above, triggered following 2 issues 1) GIC interrupts don't work if we disable IA55_CLK and DMAC_ACLK. Fixed this issue by adding these clocks as critical clocks. 2) DMA is not working, since the DMA driver is not turning on DMAC_PCLK. So will provide a fix in the DMA driver to turn on DMA_PCLK. Fixes: ef3c613ccd68 ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC") Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20210922112405.26413-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 664bb2e45b89cd8213e3c9772713323f75e21892 Author: Biju Das Date: Wed Sep 22 12:24:04 2021 +0100 clk: renesas: r9a07g044: Mark IA55_CLK and DMAC_ACLK critical Add IA55_CLK and DMAC_ACLK as critical clocks. Previously it worked ok, because of a bug in clock status function and the following patch in this series fixes the original bug. Fixes: c3e67ad6f5a2 ("dt-bindings: clock: r9a07g044-cpg: Update clock/reset definitions") Fixes: eb829e549ba6 ("clk: renesas: r9a07g044: Add DMAC clocks/resets") Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20210922112405.26413-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 597aa16c782496bf74c5dc3b45ff472ade6cee64 Author: Xiao Liang Date: Thu Sep 23 23:03:19 2021 +0800 net: ipv4: Fix rtnexthop len when RTA_FLOW is present Multipath RTA_FLOW is embedded in nexthop. Dump it in fib_add_nexthop() to get the length of rtnexthop correct. Fixes: b0f60193632e ("ipv4: Refactor nexthop attributes in fib_dump_info") Signed-off-by: Xiao Liang Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 325fd36ae76a6d089983b2d2eccb41237d35b221 Author: Vladimir Oltean Date: Thu Sep 23 16:23:33 2021 +0300 net: enetc: fix the incorrect clearing of IF_MODE bits The enetc phylink .mac_config handler intends to clear the IFMODE field (bits 1:0) of the PM0_IF_MODE register, but incorrectly clears all the other fields instead. For normal operation, the bug was inconsequential, due to the fact that we write the PM0_IF_MODE register in two stages, first in phylink .mac_config (which incorrectly cleared out a bunch of stuff), then we update the speed and duplex to the correct values in phylink .mac_link_up. Judging by the code (not tested), it looks like maybe loopback mode was broken, since this is one of the settings in PM0_IF_MODE which is incorrectly cleared. Fixes: c76a97218dcb ("net: enetc: force the RGMII speed and duplex instead of operating in inband mode") Reported-by: Pavel Machek (CIP) Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit f9bfed3ad5b1662426479be2c7b26a608560b7d4 Merge: e4e737bb5c170 b78f26926b17c Author: Thomas Gleixner Date: Fri Sep 24 14:11:04 2021 +0200 Merge tag 'irqchip-fixes-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - Work around a bad GIC integration on a Renesas platform, where the interconnect cannot deal with byte-sized MMIO accesses - Cleanup another Renesas driver abusing the comma operator - Fix a potential GICv4 memory leak on an error path - Make the type of 'size' consistent with the rest of the code in __irq_domain_add() - Fix a regression in the Armada 370-XP IPI path - Fix the build for the obviously unloved goldfish-pic - Some documentation fixes Link: https://lore.kernel.org/r/20210924090933.2766857-1-maz@kernel.org commit 6f7d70467121f790b36af2d84bc02b5c236bf5e6 Author: Uwe Kleine-König Date: Thu Sep 23 22:11:13 2021 +0200 hwmon: (ltc2947) Properly handle errors when looking for the external clock The return value of devm_clk_get should in general be propagated to upper layer. In this case the clk is optional, use the appropriate wrapper instead of interpreting all errors as "The optional clk is not available". Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20210923201113.398932-1-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck commit 724e8af85854c4d3401313b6dd7d79cf792d8990 Author: Paul Fertser Date: Fri Sep 24 12:30:11 2021 +0300 hwmon: (tmp421) fix rounding for negative values Old code produces -24999 for 0b1110011100000000 input in standard format due to always rounding up rather than "away from zero". Use the common macro for division, unify and simplify the conversion code along the way. Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips") Signed-off-by: Paul Fertser Link: https://lore.kernel.org/r/20210924093011.26083-3-fercerpav@gmail.com Signed-off-by: Guenter Roeck commit 540effa7f283d25bcc13c0940d808002fee340b8 Author: Paul Fertser Date: Fri Sep 24 12:30:10 2021 +0300 hwmon: (tmp421) report /PVLD condition as fault For both local and remote sensors all the supported ICs can report an "undervoltage lockout" condition which means the conversion wasn't properly performed due to insufficient power supply voltage and so the measurement results can't be trusted. Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips") Signed-off-by: Paul Fertser Link: https://lore.kernel.org/r/20210924093011.26083-2-fercerpav@gmail.com Signed-off-by: Guenter Roeck commit 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b Author: Paul Fertser Date: Fri Sep 24 12:30:09 2021 +0300 hwmon: (tmp421) handle I2C errors Function i2c_smbus_read_byte_data() can return a negative error number instead of the data read if I2C transaction failed for whatever reason. Lack of error checking can lead to serious issues on production hardware, e.g. errors treated as temperatures produce spurious critical temperature-crossed-threshold errors in BMC logs for OCP server hardware. The patch was tested with Mellanox OCP Mezzanine card emulating TMP421 protocol for temperature sensing which sometimes leads to I2C protocol error during early boot up stage. Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips") Cc: stable@vger.kernel.org Signed-off-by: Paul Fertser Link: https://lore.kernel.org/r/20210924093011.26083-1-fercerpav@gmail.com [groeck: dropped unnecessary line breaks] Signed-off-by: Guenter Roeck commit 14351f08ed5c8b888cdd95651152db7e096ee27f Author: Jason Gunthorpe Date: Thu Sep 16 12:05:28 2021 -0300 RDMA/hns: Work around broken constant propagation in gcc 8 gcc 8.3 and 5.4 throw this: In function 'modify_qp_init_to_rtr', ././include/linux/compiler_types.h:322:38: error: call to '__compiletime_assert_1859' declared with attribute error: FIELD_PREP: value too large for the field _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) [..] drivers/infiniband/hw/hns/hns_roce_common.h:91:52: note: in expansion of macro 'FIELD_PREP' *((__le32 *)ptr + (field_h) / 32) |= cpu_to_le32(FIELD_PREP( \ ^~~~~~~~~~ drivers/infiniband/hw/hns/hns_roce_common.h:95:39: note: in expansion of macro '_hr_reg_write' #define hr_reg_write(ptr, field, val) _hr_reg_write(ptr, field, val) ^~~~~~~~~~~~~ drivers/infiniband/hw/hns/hns_roce_hw_v2.c:4412:2: note: in expansion of macro 'hr_reg_write' hr_reg_write(context, QPC_LP_PKTN_INI, lp_pktn_ini); Because gcc has miscalculated the constantness of lp_pktn_ini: mtu = ib_mtu_enum_to_int(ib_mtu); if (WARN_ON(mtu < 0)) [..] lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / mtu); Since mtu is limited to {256,512,1024,2048,4096} lp_pktn_ini is between 4 and 8 which is compatible with the 4 bit field in the FIELD_PREP. Work around this broken compiler by adding a 'can never be true' constraint on lp_pktn_ini's value which clears out the problem. Fixes: f0cb411aad23 ("RDMA/hns: Use new interface to modify QP context") Link: https://lore.kernel.org/r/0-v1-c773ecb137bc+11f-hns_gcc8_jgg@nvidia.com Reported-by: Geert Uytterhoeven Signed-off-by: Jason Gunthorpe commit 9fde0348640252c79d462c4d29a09a14e8741f5c Author: Christoph Hellwig Date: Thu Sep 16 09:04:05 2021 +0200 m68k: Remove set_fs() Add a m68k-only set_fc helper to set the SFC and DFC registers for the few places that need to override it for special MM operations, but disconnect that from the deprecated kernel-wide set_fs() API. Note that the SFC/DFC registers are context switched, so there is no need to disable preemption. Partially based on an earlier patch from Linus Torvalds . Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-7-hch@lst.de Signed-off-by: Geert Uytterhoeven commit 8ade83390930d61c64fe3ab49081990c9d43d0d2 Author: Christoph Hellwig Date: Thu Sep 16 09:04:04 2021 +0200 m68k: Provide __{get,put}_kernel_nofault Allow non-faulting access to kernel addresses without overriding the address space. Implemented by passing the instruction name to the low-level assembly macros as an argument, and force the use of the normal move instructions for kernel access. Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-6-hch@lst.de Signed-off-by: Geert Uytterhoeven commit 01eec1af5ec49b331948ace8f2287580e1594383 Author: Christoph Hellwig Date: Thu Sep 16 09:04:03 2021 +0200 m68k: Factor the 8-byte lowlevel {get,put}_user code into helpers Add new helpers for doing the grunt work of the 8-byte {get,put}_user routines to allow for better reuse. Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-5-hch@lst.de Signed-off-by: Geert Uytterhoeven commit 25d2cae4a5578695f667e868ada38b0b73eb1080 Author: Christoph Hellwig Date: Thu Sep 16 09:04:02 2021 +0200 m68k: Use BUILD_BUG for passing invalid sizes to get_user/put_user Simplify the handling a bit by using the common helper instead of referencing undefined symbols. Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-4-hch@lst.de Signed-off-by: Geert Uytterhoeven commit c4f607c3124e4d2f33604f933b29496ce4111753 Author: Christoph Hellwig Date: Thu Sep 16 09:04:01 2021 +0200 m68k: Remove the 030 case in virt_to_phys_slow The 030 case in virt_to_phys_slow can't ever be reached, so remove it. Suggested-by: Michael Schmitz Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-3-hch@lst.de Signed-off-by: Geert Uytterhoeven commit 1dc4027bc8b524ed03c4db391cd7910eb4ee19d2 Author: Christoph Hellwig Date: Thu Sep 16 09:04:00 2021 +0200 m68k: Document that access_ok is broken for !CONFIG_CPU_HAS_ADDRESS_SPACES Document that access_ok is completely broken for coldfire and friends at the moment. Signed-off-by: Christoph Hellwig Reviewed-by: Michael Schmitz Tested-by: Michael Schmitz Link: https://lore.kernel.org/r/20210916070405.52750-2-hch@lst.de Signed-off-by: Geert Uytterhoeven commit 0d20abde987bed05a8963c8aa4276019d54ff9e7 Author: Al Viro Date: Sun Jul 25 17:20:13 2021 +0000 m68k: Leave stack mangling to asm wrapper of sigreturn() sigreturn has to deal with an unpleasant problem - exception stack frames have different sizes, depending upon the exception (and processor model, as well) and variable-sized part of exception frame may contain information needed for instruction restart. So when signal handler terminates and calls sigreturn to resume the execution at the place where we'd been when we caught the signal, it has to rearrange the frame at the bottom of kernel stack. Worse, it might need to open a gap in the kernel stack, shifting pt_regs towards lower addresses. Doing that from C is insane - we'd need to shift stack frames (return addresses, local variables, etc.) of C call chain, right under the nose of compiler and hope it won't fall apart horribly. What had been actually done is only slightly less insane - an inline asm in mangle_kernel_stack() moved the stuff around, then reset stack pointer and jumped to label in asm glue. However, we can avoid all that mess if the asm wrapper we have to use anyway would reserve some space on the stack between switch_stack and the C stack frame of do_{rt_,}sigreturn(). Then C part can simply memmove() pt_regs + switch_stack, memcpy() the variable part of exception frame into the opened gap - all of that without inline asm, buggering C call chain, magical jumps to asm labels, etc. Asm wrapper would need to know where the moved switch_stack has ended up - it might have been shifted into the gap we'd reserved before do_rt_sigreturn() call. That's where it needs to set the stack pointer to. So let the C part return just that and be done with that. While we are at it, the call of berr_040cleanup() we need to do when returning via 68040 bus error exception frame can be moved into C part as well. Signed-off-by: Al Viro Tested-by: Michael Schmitz Reviewed-by: Michael Schmitz Tested-by: Finn Thain Link: https://lore.kernel.org/r/YP2dTQPm1wGPWFgD@zeniv-ca.linux.org.uk Signed-off-by: Geert Uytterhoeven commit 50e43a57334400668952f8e551c9d87d3ed2dfef Author: Al Viro Date: Sun Jul 25 17:19:45 2021 +0000 m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal We get there when sigreturn has performed obscene acts on kernel stack; in particular, the location of pt_regs has shifted. We are about to call syscall_trace(), which might stop for tracer. If that happens, we'd better have task_pt_regs() returning correct result... Fucked-up-by: Al Viro Fixes: bd6f56a75bb2 ("m68k: Missing syscall_trace() on sigreturn") Signed-off-by: Al Viro Tested-by: Michael Schmitz Reviewed-by: Michael Schmitz Tested-by: Finn Thain Link: https://lore.kernel.org/r/YP2dMWeV1LkHiOpr@zeniv-ca.linux.org.uk Signed-off-by: Geert Uytterhoeven commit 4bb0bd81ce5e97092dfda6a106d414b703ec0ee8 Author: Al Viro Date: Sun Jul 25 17:19:00 2021 +0000 m68k: Handle arrivals of multiple signals correctly When we have several pending signals, have entered with the kernel with large exception frame *and* have already built at least one sigframe, regs->stkadj is going to be non-zero and regs->format/sr/pc are going to be junk - the real values are in shifted exception stack frame we'd built when putting together the first sigframe. If that happens, subsequent sigframes are going to be garbage. Not hard to fix - just need to find the "adjusted" frame first and look for format/vector/sr/pc in it. Signed-off-by: Al Viro Tested-by: Michael Schmitz Reviewed-by: Michael Schmitz Tested-by: Finn Thain Link: https://lore.kernel.org/r/YP2dBIAPTaVvHiZ6@zeniv-ca.linux.org.uk Signed-off-by: Geert Uytterhoeven commit fb8c3a3c52400512fc8b3b61150057b888c30b0d Author: Arnd Bergmann Date: Mon Sep 20 14:23:44 2021 +0200 ath5k: fix building with LEDS=m Randconfig builds still show a failure for the ath5k driver, similar to the one that was fixed for ath9k earlier: WARNING: unmet direct dependencies detected for MAC80211_LEDS Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y]) Selected by [m]: - ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y] net/mac80211/led.c: In function 'ieee80211_alloc_led_names': net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name' 34 | local->rx_led.name = kasprintf(GFP_KERNEL, "%srx", | ^ Copying the same logic from my ath9k patch makes this one work as well, stubbing out the calls to the LED subsystem. Fixes: b64acb28da83 ("ath9k: fix build error with LEDS_CLASS=m") Fixes: 72cdab808714 ("ath9k: Do not select MAC80211_LEDS by default") Fixes: 3a078876caee ("ath5k: convert LED code to use mac80211 triggers") Link: https://lore.kernel.org/all/20210722105501.1000781-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210920122359.353810-1-arnd@kernel.org commit 5ba1071f7554c4027bdbd712a146111de57918de Author: Numfor Mbiziwo-Tiapo Date: Thu Sep 23 09:18:43 2021 -0700 x86/insn, tools/x86: Fix undefined behavior due to potential unaligned accesses Don't perform unaligned loads in __get_next() and __peek_nbyte_next() as these are forms of undefined behavior: "A pointer to an object or incomplete type may be converted to a pointer to a different object or incomplete type. If the resulting pointer is not correctly aligned for the pointed-to type, the behavior is undefined." (from http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf) These problems were identified using the undefined behavior sanitizer (ubsan) with the tools version of the code and perf test. [ bp: Massage commit message. ] Signed-off-by: Numfor Mbiziwo-Tiapo Signed-off-by: Ian Rogers Signed-off-by: Borislav Petkov Acked-by: Masami Hiramatsu Link: https://lkml.kernel.org/r/20210923161843.751834-1-irogers@google.com commit 50b078184604fea95adbb144ff653912fb0e48c6 Merge: 386ca9d7fd189 e840f42a49925 Author: Paolo Bonzini Date: Fri Sep 24 06:04:42 2021 -0400 Merge tag 'kvmarm-fixes-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/arm64 fixes for 5.15, take #1 - Add missing FORCE target when building the EL2 object - Fix a PMU probe regression on some platforms commit 420070197b11a0525591116326178794c1f7b9d0 Merge: f7e745f8e9449 3f4a08909e2c7 Author: David S. Miller Date: Fri Sep 24 10:51:36 2021 +0100 Merge branch 'mptcp-fixes' Mat Martineau says: ==================== mptcp: Bug fixes This patch set includes two separate fixes for the net tree: Patch 1 makes sure that MPTCP token searches are always limited to the appropriate net namespace. Patch 2 allows userspace to always change the backup settings for configured endpoints even if those endpoints are not currently in use. ==================== Signed-off-by: David S. Miller commit 3f4a08909e2c740f8045efc74c4cf82eeaae3e36 Author: Davide Caratti Date: Thu Sep 23 17:04:12 2021 -0700 mptcp: allow changing the 'backup' bit when no sockets are open current Linux refuses to change the 'backup' bit of MPTCP endpoints, i.e. using MPTCP_PM_CMD_SET_FLAGS, unless it finds (at least) one subflow that matches the endpoint address. There is no reason for that, so we can just ignore the return value of mptcp_nl_addr_backup(). In this way, endpoints can reconfigure their 'backup' flag even if no MPTCP sockets are open (or more generally, in case the MP_PRIO message is not sent out). Fixes: 0f9f696a502e ("mptcp: add set_flags command in PM netlink") Signed-off-by: Davide Caratti Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit ea1300b9df7c8e8b65695a08b8f6aaf4b25fec9c Author: Florian Westphal Date: Thu Sep 23 17:04:11 2021 -0700 mptcp: don't return sockets in foreign netns mptcp_token_get_sock() may return a mptcp socket that is in a different net namespace than the socket that received the token value. The mptcp syncookie code path had an explicit check for this, this moves the test into mptcp_token_get_sock() function. Eventually token.c should be converted to pernet storage, but such change is not suitable for net tree. Fixes: 2c5ebd001d4f0 ("mptcp: refactor token container") Signed-off-by: Florian Westphal Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit f7e745f8e94492a8ac0b0a26e25f2b19d342918f Author: Xin Long Date: Thu Sep 23 00:05:04 2021 -0400 sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297 Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize") Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit 41608b64b10b80fe00dd253cd8326ec8ad85930f Author: Long Li Date: Mon Aug 30 16:13:27 2021 -0700 PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus In hv_pci_bus_exit, the code is holding a spinlock while calling pci_destroy_slot(), which takes a mutex. This is not safe for spinlock. Fix this by moving the children to be deleted to a list on the stack, and removing them after spinlock is released. Fixes: 94d22763207a ("PCI: hv: Fix a race condition when removing the device") Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Wei Liu Cc: Dexuan Cui Cc: Lorenzo Pieralisi Cc: Rob Herring Cc: "Krzysztof Wilczyński" Cc: Bjorn Helgaas Cc: Michael Kelley Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-hyperv/20210823152130.GA21501@kili/ Signed-off-by: Long Li Reviewed-by: Wei Liu Link: https://lore.kernel.org/r/1630365207-20616-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu commit 0292dbd7bd779b878942c3977507459f8a3e4e78 Merge: f7d848e0fdfa5 9e3eed534f823 Author: Greg Kroah-Hartman Date: Fri Sep 24 10:22:53 2021 +0200 Merge tag 'usb-serial-5.15-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.15-rc3 Here's a fix for a regression affecting some CP2102 devices and a host of new device ids. Included are also a couple of cleanups of duplicate device ids, which are also tagged for stable to keep the tables in sync, and a trivial patch to help debugging cp210x issues. All have been in linux-next with no reported issues. Note however that the last last two device-id commits were rebased to fix up a lore link in a commit message (as the patch itself never made it to the list). * tag 'usb-serial-5.15-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add device id for Foxconn T99W265 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter USB: serial: cp210x: add part-number debug printk USB: serial: cp210x: fix dropped characters with CP2102 USB: serial: option: remove duplicate USB device ID USB: serial: mos7840: remove duplicated 0xac24 device ID USB: serial: option: add Telit LN920 compositions commit 0e14ef38669ce4faa80589247fe8ed8a3780f414 Author: Josh Poimboeuf Date: Tue Sep 21 22:40:26 2021 -0700 crypto: x86/sm4 - Fix frame pointer stack corruption sm4_aesni_avx_crypt8() sets up the frame pointer (which includes pushing RBP) before doing a conditional sibling call to sm4_aesni_avx_crypt4(), which sets up an additional frame pointer. Things will not go well when sm4_aesni_avx_crypt4() pops only the innermost single frame pointer and then tries to return to the outermost frame pointer. Sibling calls need to occur with an empty stack frame. Do the conditional sibling call *before* setting up the stack pointer. This fixes the following warning: arch/x86/crypto/sm4-aesni-avx-asm_64.o: warning: objtool: sm4_aesni_avx_crypt8()+0x8: sibling call from callable instruction with modified stack frame Fixes: a7ee22ee1445 ("crypto: x86/sm4 - add AES-NI/AVX/x86_64 implementation") Reported-by: kernel test robot Reported-by: Arnd Bergmann Acked-by: Peter Zijlstra (Intel) Reviewed-by: Tianjia Zhang Signed-off-by: Josh Poimboeuf Signed-off-by: Herbert Xu commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 Author: Dan Carpenter Date: Thu Aug 26 16:04:27 2021 +0300 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() There are three bugs in this code: 1) If we ccp_init_data() fails for &src then we need to free aad. Use goto e_aad instead of goto e_ctx. 2) The label to free the &final_wa was named incorrectly as "e_tag" but it should have been "e_final_wa". One error path leaked &final_wa. 3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block. Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Reported-by: "minihanshen(沈明航)" Signed-off-by: Dan Carpenter Reviewed-by: John Allen Tested-by: John Allen Signed-off-by: Herbert Xu commit 9e3eed534f8235a4a596a9dae5b8a6425d81ea1a Author: Slark Xiao Date: Fri Sep 17 19:01:06 2021 +0800 USB: serial: option: add device id for Foxconn T99W265 Adding support for Foxconn device T99W265 for enumeration with PID 0xe0db. usb-devices output for 0xe0db T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 19 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=0489 ProdID=e0db Rev=05.04 S: Manufacturer=Microsoft S: Product=Generic Mobile Broadband Adapter S: SerialNumber=6c50f452 C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option if0/1: MBIM, if2:Diag, if3:GNSS, if4: Modem Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20210917110106.9852-1-slark_xiao@163.com [ johan: use USB_DEVICE_INTERFACE_CLASS(), amend comment ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 3bd18ba7d859eb1fbef3beb1e80c24f6f7d7596c Author: Uwe Brandt Date: Tue Sep 21 19:54:46 2021 +0200 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter Add the USB serial device ID for the GW Instek GDM-834x Digital Multimeter. Signed-off-by: Uwe Brandt Link: https://lore.kernel.org/r/YUxFl3YUCPGJZd8Y@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 Author: Bastien Roucariès Date: Thu Sep 16 08:17:21 2021 +0000 ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config") sets the RX/TX delay according to the phy-mode property in the device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is the wrong setting. Following the example of a900cac3750b ("ARM: dts: sun7i: a20: bananapro: Fix ethernet phy-mode") the phy-mode is changed to "rgmii-id" which gets the Ethernet working again on this board. Signed-off-by: Bastien Roucariès Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20210916081721.237137-1-rouca@debian.org commit 386ca9d7fd189b641bc5a82871e38dea9f67af85 Author: Oliver Upton Date: Fri Sep 24 00:51:47 2021 +0000 selftests: KVM: Explicitly use movq to read xmm registers Compiling the KVM selftests with clang emits the following warning: >> include/x86_64/processor.h:297:25: error: variable 'xmm0' is uninitialized when used here [-Werror,-Wuninitialized] >> return (unsigned long)xmm0; where xmm0 is accessed via an uninitialized register variable. Indeed, this is a misuse of register variables, which really should only be used for specifying register constraints on variables passed to inline assembly. Rather than attempting to read xmm registers via register variables, just explicitly perform the movq from the desired xmm register. Fixes: 783e9e51266e ("kvm: selftests: add API testing infrastructure") Signed-off-by: Oliver Upton Message-Id: <20210924005147.1122357-1-oupton@google.com> Reviewed-by: Ricardo Koller Signed-off-by: Paolo Bonzini commit fbf094ce524113c694acabf3d385883f88372829 Author: Oliver Upton Date: Thu Sep 23 22:00:33 2021 +0000 selftests: KVM: Call ucall_init when setting up in rseq_test While x86 does not require any additional setup to use the ucall infrastructure, arm64 needs to set up the MMIO address used to signal a ucall to userspace. rseq_test does not initialize the MMIO address, resulting in the test spinning indefinitely. Fix the issue by calling ucall_init() during setup. Fixes: 61e52f1630f5 ("KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs") Signed-off-by: Oliver Upton Message-Id: <20210923220033.4172362-1-oupton@google.com> Signed-off-by: Paolo Bonzini commit 9ed38fd4a15417cac83967360cf20b853bfab9b6 Author: Steve French Date: Thu Sep 23 19:18:37 2021 -0500 cifs: fix incorrect check for null pointer in header_assemble Although very unlikely that the tlink pointer would be null in this case, get_next_mid function can in theory return null (but not an error) so need to check for null (not for IS_ERR, which can not be returned here). Address warning: fs/smbfs_client/connect.c:2392 cifs_match_super() warn: 'tlink' isn't an ERR_PTR Pointed out by Dan Carpenter via smatch code analysis tool CC: stable@vger.kernel.org Reported-by: Dan Carpenter Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 1db1aa98871defd9316d13f59708f2277c4f9232 Author: Steve French Date: Thu Sep 23 18:52:40 2021 -0500 smb3: correct server pointer dereferencing check to be more consistent Address warning: fs/smbfs_client/misc.c:273 header_assemble() warn: variable dereferenced before check 'treeCon->ses->server' Pointed out by Dan Carpenter via smatch code analysis tool Although the check is likely unneeded, adding it makes the code more consistent and easier to read, as the same check is done elsewhere in the function. Reported-by: Dan Carpenter Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit ef88d7a8a5c94d063311a5581d9a8f0c0e3a99cb Merge: 22a94600e28b5 b875fb313a10b Author: Dave Airlie Date: Fri Sep 24 09:39:16 2021 +1000 Merge tag 'drm-intel-fixes-2021-09-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15-rc3: - Fix ADL-P memory bandwidth parameters - Fix memory corruption due to a double free - Fix memory leak in DMC firmware handling Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87o88jbk3o.fsf@intel.com commit 22a94600e28b5d52cda03abd8cf34d281f6db1db Merge: e4e737bb5c170 197ae17722e98 Author: Dave Airlie Date: Fri Sep 24 08:39:02 2021 +1000 Merge tag 'amd-drm-fixes-5.15-2021-09-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-09-23: amdgpu: - Update MAINTAINERS entry for powerplay - Fix empty macros - SI DPM fix amdkfd: - SVM fixes - DMA mapping fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210923211330.20725-1-alexander.deucher@amd.com commit f9e36107ec70445fbdc2562ba5b60c0a7ed57c20 Merge: 831c9bd3dafc8 0619b7901473c Author: Linus Torvalds Date: Thu Sep 23 14:39:41 2021 -0700 Merge tag 'for-5.15-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - regression fix for leak of transaction handle after verity rollback failure - properly reset device last error between mounts - improve one error handling case when checksumming bios - fixup confusing displayed size of space info free space * tag 'for-5.15-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: prevent __btrfs_dump_space_info() to underflow its free space btrfs: fix mount failure due to past and transient device flush error btrfs: fix transaction handle leak after verity rollback failure btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling commit b06d893ef2492245d0319b4136edb4c346b687a3 Author: Steve French Date: Thu Sep 23 16:00:31 2021 -0500 smb3: correct smb3 ACL security descriptor Address warning: fs/smbfs_client/smb2pdu.c:2425 create_sd_buf() warn: struct type mismatch 'smb3_acl vs cifs_acl' Pointed out by Dan Carpenter via smatch code analysis tool Reported-by: Dan Carpenter Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 831c9bd3dafc811bd5f740777fd1ef92b08bb0e4 Merge: f10f0481a5b58 a3727a8bac0a9 Author: Linus Torvalds Date: Thu Sep 23 14:17:06 2021 -0700 Merge tag 'selinux-pr-20210923' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux/Smack fixes from Paul Moore: "Another single-patch pull request for SELinux, as well as Smack. This fixes some credential misuse and is explained reasonably well in the patch description" * tag 'selinux-pr-20210923' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux,smack: fix subjective/objective credential use mixups commit 4f22262280ccb5c0a18a42029313938aabfaff12 Author: Steve French Date: Thu Sep 23 12:42:35 2021 -0500 cifs: Clear modified attribute bit from inode flags Clear CIFS_INO_MODIFIED_ATTR bit from inode flags after updating mtime and ctime Signed-off-by: Rohith Surabattula Reviewed-by: Paulo Alcantara (SUSE) Acked-by: Ronnie Sahlberg Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Steve French commit 28406a21999152ff7faa30b194f734565bdd8e0d Author: Rajendra Nayak Date: Thu Sep 23 15:01:27 2021 +0530 pinctrl: qcom: sc7280: Add PM suspend callbacks Use PM suspend callbacks from msm core, without this the hog_sleep pins don't change state in suspend. Signed-off-by: Rajendra Nayak Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/1632389487-11283-1-git-send-email-rnayak@codeaurora.org Signed-off-by: Linus Walleij commit 197ae17722e989942b36e33e044787877f158574 Author: Philip Yang Date: Mon Sep 20 17:25:52 2021 -0400 drm/amdkfd: fix svm_migrate_fini warning Device manager releases device-specific resources when a driver disconnects from a device, devm_memunmap_pages and devm_release_mem_region calls in svm_migrate_fini are redundant. It causes below warning trace after patch "drm/amdgpu: Split amdgpu_device_fini into early and late", so remove function svm_migrate_fini. BUG: https://gitlab.freedesktop.org/drm/amd/-/issues/1718 WARNING: CPU: 1 PID: 3646 at drivers/base/devres.c:795 devm_release_action+0x51/0x60 Call Trace: ? memunmap_pages+0x360/0x360 svm_migrate_fini+0x2d/0x60 [amdgpu] kgd2kfd_device_exit+0x23/0xa0 [amdgpu] amdgpu_amdkfd_device_fini_sw+0x1d/0x30 [amdgpu] amdgpu_device_fini_sw+0x45/0x290 [amdgpu] amdgpu_driver_release_kms+0x12/0x30 [amdgpu] drm_dev_release+0x20/0x40 [drm] release_nodes+0x196/0x1e0 device_release_driver_internal+0x104/0x1d0 driver_detach+0x47/0x90 bus_remove_driver+0x7a/0xd0 pci_unregister_driver+0x3d/0x90 amdgpu_exit+0x11/0x20 [amdgpu] Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 7d6687200a939176847090bbde5cb79a82792a2f Author: Philip Yang Date: Fri Sep 17 14:32:14 2021 -0400 drm/amdkfd: handle svm migrate init error If svm migration init failed to create pgmap for device memory, set pgmap type to 0 to disable device SVM support capability. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit ab39d3cef526ba09c4c6923b4cd7e6ec1c5d4faa Author: Lijo Lazar Date: Thu Sep 23 11:58:43 2021 +0800 drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, set_power_state gets called to transition to the final power state. set_power_state refers to values from the current state and without current state populated, it could result in NULL pointer dereference. For ex: on platforms where PCI speed change is supported through ACPI ATCS method, the link speed of current state needs to be queried before deciding on changing to final power state's link speed. The logic to query ATCS-support was broken on certain platforms. The issue became visible when broken ATCS-support logic got fixed with commit f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)"). Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698 Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8bd8d1dff9eb90255c030d2e52a4f65a7fef33a9 Author: Colin Ian King Date: Thu Sep 2 22:26:31 2021 +0100 vfio/pci: add missing identifier name in argument of function prototype The function prototype is missing an identifier name. Add one. Signed-off-by: Colin Ian King Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20210902212631.54260-1-colin.king@canonical.com Signed-off-by: Alex Williamson commit 305d568b72f17f674155a2a8275f865f207b3808 Author: Jason Gunthorpe Date: Thu Sep 16 15:34:46 2021 -0300 RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path. Link: https://lore.kernel.org/r/0-v1-3bc675b8006d+22-syz_cancel_uaf_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager") Reported-by: syzbot+dc3dfba010d7671e05f5@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit f63251184a81039ebc805306505838c2a073e51a Author: Philip Yang Date: Tue Sep 14 16:33:40 2021 -0400 drm/amdkfd: fix dma mapping leaking warning For xnack off, restore work dma unmap previous system memory page, and dma map the updated system memory page to update GPU mapping, this is not dma mapping leaking, remove the WARN_ONCE for dma mapping leaking. prange->dma_addr store the VRAM page pfn after the range migrated to VRAM, should not dma unmap VRAM page when updating GPU mapping or remove prange. Add helper svm_is_valid_dma_mapping_addr to check VRAM page and error cases. Mask out SVM_RANGE_VRAM_DOMAIN flag in dma_addr before calling amdgpu vm update to avoid BUG_ON(*addr & 0xFFFF00000000003FULL), and set it again immediately after. This flag is used to know the type of page later to dma unmapping system memory page. Fixes: 1d5dbfe6c06a ("drm/amdkfd: classify and map mixed svm range pages in GPU") Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 7beb26dcedaa977ece5be7c712a66b7b6c66fc2b Author: Philip Yang Date: Mon Sep 13 10:03:36 2021 -0400 drm/amdkfd: SVM map to gpus check vma boundary SVM range may includes multiple VMAs with different vm_flags, if prange page index is the last page of the VMA offset + npages, update GPU mapping to create GPU page table with same VMA access permission. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 6de0653f7719bd0aa61f683fba16ae0e2c4ead64 Author: Alex Deucher Date: Fri Sep 17 12:05:30 2021 -0400 MAINTAINERS: fix up entry for AMD Powerplay Fix the path to cover both the older powerplay infrastructure and the newer SwSMU infrastructure. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit c48977f020d5846215e2ff7e8172e7b46b3d64b4 Author: Arnd Bergmann Date: Mon Sep 20 14:16:00 2021 +0200 drm/amd/display: fix empty debug macros Using an empty macro expansion as a conditional expression produces a W=1 warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.c: In function 'dce_aux_transfer_with_retries': drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.c:775:156: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 775 | "dce_aux_transfer_with_retries: AUX_RET_SUCCESS: AUX_TRANSACTION_REPLY_I2C_OVER_AUX_DEFER"); | ^ drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dce_aux.c:783:155: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 783 | "dce_aux_transfer_with_retries: AUX_RET_SUCCESS: AUX_TRANSACTION_REPLY_I2C_OVER_AUX_NACK"); | ^ Expand it to "do { } while (0)" instead to make the expression more robust and avoid the warning. Fixes: 56aca2309301 ("drm/amd/display: Add AUX I2C tracing.") Signed-off-by: Arnd Bergmann Signed-off-by: Alex Deucher commit 03ab9cb982b622239cc2542ce7617b98a9ea159e Author: David Howells Date: Mon Sep 20 13:14:15 2021 +0100 cifs: Deal with some warnings from W=1 Deal with some warnings generated from make W=1: (1) Add/remove/fix kerneldoc parameters descriptions. (2) Turn cifs' rqst_page_get_length()'s banner comment into a kerneldoc comment. It should probably be prefixed with "cifs_" though. Signed-off-by: David Howells Signed-off-by: Steve French commit 12064c1768439fa0882547010afae6b52aafa7af Author: Jia He Date: Thu Sep 23 11:35:57 2021 +0800 Revert "ACPI: Add memory semantics to acpi_os_map_memory()" This reverts commit 437b38c51162f8b87beb28a833c4d5dc85fa864e. The memory semantics added in commit 437b38c51162 causes SystemMemory Operation region, whose address range is not described in the EFI memory map to be mapped as NormalNC memory on arm64 platforms (through acpi_os_map_memory() in acpi_ex_system_memory_space_handler()). This triggers the following abort on an ARM64 Ampere eMAG machine, because presumably the physical address range area backing the Opregion does not support NormalNC memory attributes driven on the bus. Internal error: synchronous external abort: 96000410 [#1] SMP Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.14.0+ #462 Hardware name: MiTAC RAPTOR EV-883832-X3-0001/RAPTOR, BIOS 0.14 02/22/2019 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [...snip...] Call trace: acpi_ex_system_memory_space_handler+0x26c/0x2c8 acpi_ev_address_space_dispatch+0x228/0x2c4 acpi_ex_access_region+0x114/0x268 acpi_ex_field_datum_io+0x128/0x1b8 acpi_ex_extract_from_field+0x14c/0x2ac acpi_ex_read_data_from_field+0x190/0x1b8 acpi_ex_resolve_node_to_value+0x1ec/0x288 acpi_ex_resolve_to_value+0x250/0x274 acpi_ds_evaluate_name_path+0xac/0x124 acpi_ds_exec_end_op+0x90/0x410 acpi_ps_parse_loop+0x4ac/0x5d8 acpi_ps_parse_aml+0xe0/0x2c8 acpi_ps_execute_method+0x19c/0x1ac acpi_ns_evaluate+0x1f8/0x26c acpi_ns_init_one_device+0x104/0x140 acpi_ns_walk_namespace+0x158/0x1d0 acpi_ns_initialize_devices+0x194/0x218 acpi_initialize_objects+0x48/0x50 acpi_init+0xe0/0x498 If the Opregion address range is not present in the EFI memory map there is no way for us to determine the memory attributes to use to map it - defaulting to NormalNC does not work (and it is not correct on a memory region that may have read side-effects) and therefore commit 437b38c51162 should be reverted, which means reverting back to the original behavior whereby address ranges that are mapped using acpi_os_map_memory() default to the safe devicenGnRnE attributes on ARM64 if the mapped address range is not defined in the EFI memory map. Fixes: 437b38c51162 ("ACPI: Add memory semantics to acpi_os_map_memory()") Signed-off-by: Jia He Acked-by: Lorenzo Pieralisi Acked-by: Catalin Marinas Signed-off-by: Rafael J. Wysocki commit f10f0481a5b58f8986f626d43f8534472f7776c2 Merge: 9bc62afe03afd 2da4a23599c26 Author: Linus Torvalds Date: Thu Sep 23 11:24:12 2021 -0700 Merge tag 'for-linus-rseq' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull rseq fixes from Paolo Bonzini: "A fix for a bug with restartable sequences and KVM. KVM's handling of TIF_NOTIFY_RESUME, e.g. for task migration, clears the flag without informing rseq and leads to stale data in userspace's rseq struct" * tag 'for-linus-rseq' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Remove __NR_userfaultfd syscall fallback KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs tools: Move x86 syscall number fallbacks to .../uapi/ entry: rseq: Call rseq_handle_notify_resume() in tracehook_notify_resume() KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest commit 9bc62afe03afdf33904f5e784e1ad68c50ff00bb Merge: 1f828223b7991 4d88c339c423e Author: Linus Torvalds Date: Thu Sep 23 10:30:31 2021 -0700 Merge tag 'net-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Current release - regressions: - dsa: bcm_sf2: fix array overrun in bcm_sf2_num_active_ports() Previous releases - regressions: - introduce a shutdown method to mdio device drivers, and make DSA switch drivers compatible with masters disappearing on shutdown; preventing infinite reference wait - fix issues in mdiobus users related to ->shutdown vs ->remove - virtio-net: fix pages leaking when building skb in big mode - xen-netback: correct success/error reporting for the SKB-with-fraglist - dsa: tear down devlink port regions when tearing down the devlink port on error - nexthop: fix division by zero while replacing a resilient group - hns3: check queue, vf, vlan ids range before using Previous releases - always broken: - napi: fix race against netpoll causing NAPI getting stuck - mlx4_en: ensure link operstate is updated even if link comes up before netdev registration - bnxt_en: fix TX timeout when TX ring size is set to the smallest - enetc: fix illegal access when reading affinity_hint; prevent oops on sysfs access - mtk_eth_soc: avoid creating duplicate offload entries Misc: - core: correct the sock::sk_lock.owned lockdep annotations" * tag 'net-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (51 commits) atlantic: Fix issue in the pm resume flow. net/mlx4_en: Don't allow aRFS for encapsulated packets net: mscc: ocelot: fix forwarding from BLOCKING ports remaining enabled net: ethernet: mtk_eth_soc: avoid creating duplicate offload entries nfc: st-nci: Add SPI ID matching DT compatible MAINTAINERS: remove Guvenc Gulce as net/smc maintainer nexthop: Fix memory leaks in nexthop notification chain listeners mptcp: ensure tx skbs always have the MPTCP ext qed: rdma - don't wait for resources under hw error recovery flow s390/qeth: fix deadlock during failing recovery s390/qeth: Fix deadlock in remove_discipline s390/qeth: fix NULL deref in qeth_clear_working_pool_list() net: dsa: realtek: register the MDIO bus under devres net: dsa: don't allocate the slave_mii_bus using devres Doc: networking: Fox a typo in ice.rst net: dsa: fix dsa_tree_setup error path net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work net/smc: add missing error check in smc_clc_prfx_set() net: hns3: fix a return value error in hclge_get_reset_status() net: hns3: check vlan id before using it ... commit 04f41c68f18886aea5afc68be945e7195ea1d598 Author: Saravana Kannan Date: Wed Sep 15 10:09:39 2021 -0700 net: mdiobus: Set FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for mdiobus parents There are many instances of PHYs that depend on a switch to supply a resource (Eg: interrupts). Switches also expects the PHYs to be probed by their specific drivers as soon as they are added. If that doesn't happen, then the switch would force the use of generic PHY drivers for the PHY even if the PHY might have specific driver available. fw_devlink=on by design can cause delayed probes of PHY. To avoid, this we need to set the FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for the switch's fwnode before the PHYs are added. The most generic way to do this is to set this flag for the parent of MDIO busses which is typically the switch. For more context: https://lore.kernel.org/lkml/YTll0i6Rz3WAAYzs@lunn.ch/#t Fixes: ea718c699055 ("Revert "Revert "driver core: Set fw_devlink=on by default""") Suggested-by: Andrew Lunn Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915170940.617415-4-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 5501765a02a6c324f78581e6bb8209d054fe13ae Author: Saravana Kannan Date: Wed Sep 15 10:09:38 2021 -0700 driver core: fw_devlink: Add support for FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD If a parent device is also a supplier to a child device, fw_devlink=on by design delays the probe() of the child device until the probe() of the parent finishes successfully. However, some drivers of such parent devices (where parent is also a supplier) expect the child device to finish probing successfully as soon as they are added using device_add() and before the probe() of the parent device has completed successfully. One example of such a case is discussed in the link mentioned below. Add a flag to make fw_devlink=on not enforce these supplier-consumer relationships, so these drivers can continue working. Link: https://lore.kernel.org/netdev/CAGETcx_uj0V4DChME-gy5HGKTYnxLBX=TH2rag29f_p=UcG+Tg@mail.gmail.com/ Fixes: ea718c699055 ("Revert "Revert "driver core: Set fw_devlink=on by default""") Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915170940.617415-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 1f828223b7991a228bc2aef837b78737946d44b2 Author: Shakeel Butt Date: Wed Sep 22 15:49:06 2021 -0700 memcg: flush lruvec stats in the refault Prior to the commit 7e1c0d6f5820 ("memcg: switch lruvec stats to rstat") and the commit aa48e47e3906 ("memcg: infrastructure to flush memcg stats"), each lruvec memcg stats can be off by (nr_cgroups * nr_cpus * 32) at worst and for unbounded amount of time. The commit aa48e47e3906 moved the lruvec stats to rstat infrastructure and the commit 7e1c0d6f5820 bounded the error for all the lruvec stats to (nr_cpus * 32) at worst for at most 2 seconds. More specifically it decoupled the number of stats and the number of cgroups from the error rate. However this reduction in error comes with the cost of triggering the slowpath of stats update more frequently. Previously in the slowpath the kernel adds the stats up the memcg tree. After aa48e47e3906, the kernel triggers the asyn lruvec stats flush through queue_work(). This causes regression reports from 0day kernel bot [1] as well as from phoronix test suite [2]. We tried two options to fix the regression: 1) Increase the threshold to trigger the slowpath in lruvec stats update codepath from 32 to 512. 2) Remove the slowpath from lruvec stats update codepath and instead flush the stats in the page refault codepath. The assumption is that the kernel timely flush the stats, so, the update tree would be small in the refault codepath to not cause the preformance impact. Following are the results of will-it-scale/page_fault[1|2|3] benchmark on four settings i.e. (1) 5.15-rc1 as baseline (2) 5.15-rc1 with aa48e47e3906 and 7e1c0d6f5820 reverted (3) 5.15-rc1 with option-1 (4) 5.15-rc1 with option-2. test (1) (2) (3) (4) pg_f1 368563 406277 (10.23%) 399693 (8.44%) 416398 (12.97%) pg_f2 338399 372133 (9.96%) 369180 (9.09%) 381024 (12.59%) pg_f3 500853 575399 (14.88%) 570388 (13.88%) 576083 (15.02%) From the above result, it seems like the option-2 not only solves the regression but also improves the performance for at least these benchmarks. Feng Tang (intel) ran the aim7 benchmark with these two options and confirms that option-1 reduces the regression but option-2 removes the regression. Michael Larabel (phoronix) ran multiple benchmarks with these options and reported the results at [3] and it shows for most benchmarks option-2 removes the regression introduced by the commit aa48e47e3906 ("memcg: infrastructure to flush memcg stats"). Based on the experiment results, this patch proposed the option-2 as the solution to resolve the regression. Link: https://lore.kernel.org/all/20210726022421.GB21872@xsang-OptiPlex-9020 [1] Link: https://www.phoronix.com/scan.php?page=article&item=linux515-compile-regress [2] Link: https://openbenchmarking.org/result/2109226-DEBU-LINUX5104 [3] Fixes: aa48e47e3906 ("memcg: infrastructure to flush memcg stats") Signed-off-by: Shakeel Butt Tested-by: Michael Larabel Cc: Johannes Weiner Cc: Roman Gushchin Cc: Feng Tang Cc: Michal Hocko Cc: Hillf Danton , Cc: Michal Koutný Cc: Andrew Morton , Signed-off-by: Linus Torvalds commit a3727a8bac0a9e77c70820655fd8715523ba3db7 Author: Paul Moore Date: Thu Sep 23 09:50:11 2021 -0400 selinux,smack: fix subjective/objective credential use mixups Jann Horn reported a problem with commit eb1231f73c4d ("selinux: clarify task subjective and objective credentials") where some LSM hooks were attempting to access the subjective credentials of a task other than the current task. Generally speaking, it is not safe to access another task's subjective credentials and doing so can cause a number of problems. Further, while looking into the problem, I realized that Smack was suffering from a similar problem brought about by a similar commit 1fb057dcde11 ("smack: differentiate between subjective and objective task credentials"). This patch addresses this problem by restoring the use of the task's objective credentials in those cases where the task is other than the current executing task. Not only does this resolve the problem reported by Jann, it is arguably the correct thing to do in these cases. Cc: stable@vger.kernel.org Fixes: eb1231f73c4d ("selinux: clarify task subjective and objective credentials") Fixes: 1fb057dcde11 ("smack: differentiate between subjective and objective task credentials") Reported-by: Jann Horn Acked-by: Eric W. Biederman Acked-by: Casey Schaufler Signed-off-by: Paul Moore commit 82cb875313188ccbd3ac174b471c86dcb97b8626 Author: Kari Argillander Date: Tue Sep 21 20:19:01 2021 +0300 fs/ntfs3: Remove deprecated mount options nls Some discussion has been spoken that this deprecated mount options should be removed before 5.15 lands. This driver is not never seen day light so it was decided that nls mount option has to be removed. We have always possibility to add this if needed. One possible need is example if current ntfs driver will be taken out of kernel and ntfs3 needs to support mount options what it has. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 808bc0a82bcd2cbe32a139613325b1a3e03f35f1 Author: Christophe JAILLET Date: Sat Sep 18 21:56:28 2021 +0200 fs/ntfs3: Remove a useless shadowing variable There is already a 'u8 mask' defined at the top of the function. There is no need to define a new one here. Remove the useless and shadowing new 'mask' variable. Signed-off-by: Christophe JAILLET Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit d2846bf33c1423ff872c7a7c2afde292ad502c04 Author: Christophe JAILLET Date: Sat Sep 18 21:56:19 2021 +0200 fs/ntfs3: Remove a useless test in 'indx_find()' 'fnd' has been dereferenced several time before, so testing it here is pointless. Moreover, all callers of 'indx_find()' already have some error handling code that makes sure that no NULL 'fnd' is passed. So, remove the useless test. Signed-off-by: Christophe JAILLET Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit c40dd3ca2a45d5bd6e8b3f4ace5cb81493096263 Author: Yue Hu Date: Tue Sep 14 11:59:15 2021 +0800 erofs: clear compacted_2b if compacted_4b_initial > totalidx Currently, the whole indexes will only be compacted 4B if compacted_4b_initial > totalidx. So, the calculated compacted_2b is worthless for that case. It may waste CPU resources. No need to update compacted_4b_initial as mkfs since it's used to fulfill the alignment of the 1st compacted_2b pack and would handle the case above. We also need to clarify compacted_4b_end here. It's used for the last lclusters which aren't fitted in the previous compacted_2b packs. Some messages are from Xiang. Link: https://lore.kernel.org/r/20210914035915.1190-1-zbestahu@gmail.com Signed-off-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu [ Gao Xiang: it's enough to use "compacted_4b_initial < totalidx". ] Signed-off-by: Gao Xiang commit d705117ddd724a9d4877e338e4587010ab6a1c62 Author: Gao Xiang Date: Wed Sep 22 17:51:41 2021 +0800 erofs: fix misbehavior of unsupported chunk format check Unsupported chunk format should be checked with "if (vi->chunkformat & ~EROFS_CHUNK_FORMAT_ALL)" Found when checking with 4k-byte blockmap (although currently mkfs uses inode chunk indexes format by default.) Link: https://lore.kernel.org/r/20210922095141.233938-1-hsiangkao@linux.alibaba.com Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files") Reviewed-by: Liu Bo Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 93368aab0efc87288cac65e99c9ed2e0ffc9e7d0 Author: Gao Xiang Date: Tue Sep 21 22:35:30 2021 +0800 erofs: fix up erofs_lookup tracepoint Fix up a misuse that the filename pointer isn't always valid in the ring buffer, and we should copy the content instead. Link: https://lore.kernel.org/r/20210921143531.81356-1-hsiangkao@linux.alibaba.com Fixes: 13f06f48f7bf ("staging: erofs: support tracepoint") Cc: stable@vger.kernel.org # 4.19+ Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 6bc6db000295332bae2c1e8815d7450b72923d23 Author: Lai Jiangshan Date: Sat Sep 18 08:56:29 2021 +0800 KVM: Remove tlbs_dirty There is no user of tlbs_dirty. Signed-off-by: Lai Jiangshan Signed-off-by: Paolo Bonzini Message-Id: <20210918005636.3675-4-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit 65855ed8b03437e79e42f2a89a993206981ac6cb Author: Lai Jiangshan Date: Sat Sep 18 08:56:28 2021 +0800 KVM: X86: Synchronize the shadow pagetable before link it If gpte is changed from non-present to present, the guest doesn't need to flush tlb per SDM. So the host must synchronze sp before link it. Otherwise the guest might use a wrong mapping. For example: the guest first changes a level-1 pagetable, and then links its parent to a new place where the original gpte is non-present. Finally the guest can access the remapped area without flushing the tlb. The guest's behavior should be allowed per SDM, but the host kvm mmu makes it wrong. Fixes: 4731d4c7a077 ("KVM: MMU: out of sync shadow core") Signed-off-by: Lai Jiangshan Signed-off-by: Paolo Bonzini Message-Id: <20210918005636.3675-3-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit 22b70e6f2da0a4c8b1421b00cfc3016bc9d4d9d4 Author: dann frazier Date: Thu Sep 23 08:50:02 2021 -0600 arm64: Restore forced disabling of KPTI on ThunderX A noted side-effect of commit 0c6c2d3615ef ("arm64: Generate cpucaps.h") is that cpucaps are now sorted, changing the enumeration order. This assumed no dependencies between cpucaps, which turned out not to be true in one case. UNMAP_KERNEL_AT_EL0 currently needs to be processed after WORKAROUND_CAVIUM_27456. ThunderX systems are incompatible with KPTI, so unmap_kernel_at_el0() bails if WORKAROUND_CAVIUM_27456 is set. But because of the sorting, WORKAROUND_CAVIUM_27456 will not yet have been considered when unmap_kernel_at_el0() checks for it, so the kernel tries to run w/ KPTI - and quickly falls over. Because all ThunderX implementations have homogeneous CPUs, we can remove this dependency by just checking the current CPU for the erratum. Fixes: 0c6c2d3615ef ("arm64: Generate cpucaps.h") Cc: # 5.13.x Signed-off-by: dann frazier Suggested-by: Suzuki K Poulose Reviewed-by: Suzuki K Poulose Reviewed-by: Mark Brown Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20210923145002.3394558-1-dann.frazier@canonical.com Signed-off-by: Catalin Marinas commit f81602958c115fc7c87b985f71574042a20ff858 Author: Lai Jiangshan Date: Sat Sep 18 08:56:27 2021 +0800 KVM: X86: Fix missed remote tlb flush in rmap_write_protect() When kvm->tlbs_dirty > 0, some rmaps might have been deleted without flushing tlb remotely after kvm_sync_page(). If @gfn was writable before and it's rmaps was deleted in kvm_sync_page(), and if the tlb entry is still in a remote running VCPU, the @gfn is not safely protected. To fix the problem, kvm_sync_page() does the remote flush when needed to avoid the problem. Fixes: a4ee1ca4a36e ("KVM: MMU: delay flush all tlbs on sync_page path") Signed-off-by: Lai Jiangshan Signed-off-by: Paolo Bonzini Message-Id: <20210918005636.3675-2-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit faf6b755629627f19feafa75b32e81cd7738f12d Author: Maxim Levitsky Date: Tue Sep 14 18:48:16 2021 +0300 KVM: x86: nSVM: don't copy virt_ext from vmcb12 These field correspond to features that we don't expose yet to L2 While currently there are no CVE worthy features in this field, if AMD adds more features to this field, that could allow guest escapes similar to CVE-2021-3653 and CVE-2021-3656. Signed-off-by: Maxim Levitsky Message-Id: <20210914154825.104886-6-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit d1cba6c9223751f580dcd97501f513a8a9bf88bc Author: Maxim Levitsky Date: Tue Sep 14 18:48:14 2021 +0300 KVM: x86: nSVM: test eax for 4K alignment for GP errata workaround GP SVM errata workaround made the #GP handler always emulate the SVM instructions. However these instructions #GP in case the operand is not 4K aligned, but the workaround code didn't check this and we ended up emulating these instructions anyway. This is only an emulation accuracy check bug as there is no harm for KVM to read/write unaligned vmcb images. Fixes: 82a11e9c6fa2 ("KVM: SVM: Add emulation support for #GP triggered by SVM instructions") Signed-off-by: Maxim Levitsky Message-Id: <20210914154825.104886-4-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 1ad32105d78e4b5da60688eca014bcd45271318f Author: Maxim Levitsky Date: Tue Sep 14 18:48:13 2021 +0300 KVM: x86: selftests: test simultaneous uses of V_IRQ from L1 and L0 Test that if: * L1 disables virtual interrupt masking, and INTR intercept. * L1 setups a virtual interrupt to be injected to L2 and enters L2 with interrupts disabled, thus the virtual interrupt is pending. * Now an external interrupt arrives in L1 and since L1 doesn't intercept it, it should be delivered to L2 when it enables interrupts. to do this L0 (abuses) V_IRQ to setup an interrupt window, and returns to L2. * L2 enables interrupts. This should trigger the interrupt window, injection of the external interrupt and delivery of the virtual interrupt that can now be done. * Test that now L2 gets those interrupts. This is the test that demonstrates the issue that was fixed in the previous patch. Signed-off-by: Maxim Levitsky Message-Id: <20210914154825.104886-3-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit aee77e1169c1900fe4248dc186962e745b479d9e Author: Maxim Levitsky Date: Tue Sep 14 18:48:12 2021 +0300 KVM: x86: nSVM: restore int_vector in svm_clear_vintr In svm_clear_vintr we try to restore the virtual interrupt injection that might be pending, but we fail to restore the interrupt vector. Signed-off-by: Maxim Levitsky Message-Id: <20210914154825.104886-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 4d88c339c423eefe2fd48215016cb0c75fcb4c4d Author: Sudarsana Reddy Kalluru Date: Thu Sep 23 03:16:05 2021 -0700 atlantic: Fix issue in the pm resume flow. After fixing hibernation resume flow, another usecase was found which should be explicitly handled - resume when device is in "down" state. Invoke aq_nic_init jointly with aq_nic_start only if ndev was already up during suspend/hibernate. We still need to perform nic_deinit() if caller requests for it, to handle the freeze/resume scenarios. Fixes: 57f780f1c433 ("atlantic: Fix driver resume flow.") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit fdbccea419dc782079ce5881d2705cc9e3881480 Author: Aya Levin Date: Thu Sep 23 09:51:45 2021 +0300 net/mlx4_en: Don't allow aRFS for encapsulated packets Driver doesn't support aRFS for encapsulated packets, return early error in such a case. Fixes: 1eb8c695bda9 ("net/mlx4_en: Add accelerated RFS support") Signed-off-by: Aya Levin Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit acc64f52afac15e9e44d9b5253271346841786e0 Author: Vladimir Oltean Date: Wed Sep 22 19:03:38 2021 -0700 net: mscc: ocelot: fix forwarding from BLOCKING ports remaining enabled The blamed commit made the fatally incorrect assumption that ports which aren't in the FORWARDING STP state should not have packets forwarded towards them, and that is all that needs to be done. However, that logic alone permits BLOCKING ports to forward to FORWARDING ports, which of course allows packet storms to occur when there is an L2 loop. The ocelot_get_bridge_fwd_mask should not only ask "what can the bridge do for you", but "what can you do for the bridge". This way, only FORWARDING ports forward to the other FORWARDING ports from the same bridging domain, and we are still compatible with the idea of multiple bridges. Fixes: df291e54ccca ("net: ocelot: support multiple bridges") Suggested-by: Colin Foster Reported-by: Colin Foster Signed-off-by: Vladimir Oltean Signed-off-by: Colin Foster Signed-off-by: David S. Miller commit e68daf61ed13832aef8892200a874139700ca754 Author: Felix Fietkau Date: Wed Sep 22 16:55:48 2021 -0700 net: ethernet: mtk_eth_soc: avoid creating duplicate offload entries Sometimes multiple CLS_REPLACE calls are issued for the same connection. rhashtable_insert_fast does not check for these duplicates, so multiple hardware flow entries can be created. Fix this by checking for an existing entry early Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") Signed-off-by: Felix Fietkau Signed-off-by: Ilya Lipnitskiy Signed-off-by: David S. Miller commit 31339440b2d0a4987030aac026adbaba44e22490 Author: Mark Brown Date: Wed Sep 22 19:30:37 2021 +0100 nfc: st-nci: Add SPI ID matching DT compatible Currently autoloading for SPI devices does not use the DT ID table, it uses SPI modalises. Supporting OF modalises is going to be difficult if not impractical, an attempt was made but has been reverted, so ensure that module autoloading works for this driver by adding the part name used in the compatible to the list of SPI IDs. Fixes: 96c8395e2166 ("spi: Revert modalias changes") Signed-off-by: Mark Brown Signed-off-by: David S. Miller commit 5b099870c8e0eb026a1560894d94f827832491cf Author: Guvenc Gulce Date: Wed Sep 22 19:21:29 2021 +0200 MAINTAINERS: remove Guvenc Gulce as net/smc maintainer Remove myself as net/smc maintainer, as I am leaving IBM soon and can not maintain net/smc anymore. Cc: Julian Wiedmann Acked-by: Karsten Graul Signed-off-by: Guvenc Gulce Signed-off-by: David S. Miller commit 3106a0847525befe3e22fc723909d1b21eb0d520 Author: Ido Schimmel Date: Wed Sep 22 13:25:40 2021 +0300 nexthop: Fix memory leaks in nexthop notification chain listeners syzkaller discovered memory leaks [1] that can be reduced to the following commands: # ip nexthop add id 1 blackhole # devlink dev reload pci/0000:06:00.0 As part of the reload flow, mlxsw will unregister its netdevs and then unregister from the nexthop notification chain. Before unregistering from the notification chain, mlxsw will receive delete notifications for nexthop objects using netdevs registered by mlxsw or their uppers. mlxsw will not receive notifications for nexthops using netdevs that are not dismantled as part of the reload flow. For example, the blackhole nexthop above that internally uses the loopback netdev as its nexthop device. One way to fix this problem is to have listeners flush their nexthop tables after unregistering from the notification chain. This is error-prone as evident by this patch and also not symmetric with the registration path where a listener receives a dump of all the existing nexthops. Therefore, fix this problem by replaying delete notifications for the listener being unregistered. This is symmetric to the registration path and also consistent with the netdev notification chain. The above means that unregister_nexthop_notifier(), like register_nexthop_notifier(), will have to take RTNL in order to iterate over the existing nexthops and that any callers of the function cannot hold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN driver. To avoid a deadlock, change the latter to unregister its nexthop listener without holding RTNL, making it symmetric to the registration path. [1] unreferenced object 0xffff88806173d600 (size 512): comm "syz-executor.0", pid 1290, jiffies 4295583142 (age 143.507s) hex dump (first 32 bytes): 41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff A..`......sa.... 08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00 ..sa............ backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522 [] slab_alloc_node mm/slub.c:3206 [inline] [] slab_alloc mm/slub.c:3214 [inline] [] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231 [] kmalloc include/linux/slab.h:591 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline] [] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline] [] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239 [] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83 [] blocking_notifier_call_chain kernel/notifier.c:318 [inline] [] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306 [] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244 [] insert_nexthop net/ipv4/nexthop.c:2336 [inline] [] nexthop_add net/ipv4/nexthop.c:2644 [inline] [] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913 [] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572 [] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504 [] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590 [] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] [] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340 [] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929 [] sock_sendmsg_nosec net/socket.c:704 [inline] [] sock_sendmsg net/socket.c:724 [inline] [] ____sys_sendmsg+0x874/0x9f0 net/socket.c:2409 [] ___sys_sendmsg+0x104/0x170 net/socket.c:2463 [] __sys_sendmsg+0x111/0x1f0 net/socket.c:2492 [] __do_sys_sendmsg net/socket.c:2501 [inline] [] __se_sys_sendmsg net/socket.c:2499 [inline] [] __x64_sys_sendmsg+0x7d/0xc0 net/socket.c:2499 Fixes: 2a014b200bbd ("mlxsw: spectrum_router: Add support for nexthop objects") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 Author: Johannes Berg Date: Wed Sep 15 11:29:37 2021 +0200 mac80211-hwsim: fix late beacon hrtimer handling Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already: 1 2 3 N N+1 | | | ... | | ^ intended to fire here (1) ^ next deadline here (2) ^ actually fired here The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc. Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point. Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time. Suggested-by: Thomas Gleixner Reported-by: Dmitry Vyukov Reported-by: syzbot+0e964fad69a9c462bc1e@syzkaller.appspotmail.com Fixes: 01e59e467ecf ("mac80211_hwsim: hrtimer beacon") Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210915112936.544f383472eb.I3f9712009027aa09244b65399bf18bf482a8c4f1@changeid Signed-off-by: Johannes Berg commit b9731062ce8afd35cf723bf3a8ad55d208f915a5 Author: Johannes Berg Date: Mon Sep 20 15:40:05 2021 +0200 mac80211: mesh: fix potentially unaligned access The pointer here points directly into the frame, so the access is potentially unaligned. Use get_unaligned_le16 to avoid that. Fixes: 3f52b7e328c5 ("mac80211: mesh power save basics") Link: https://lore.kernel.org/r/20210920154009.3110ff75be0c.Ib6a2ff9e9cc9bc6fca50fce631ec1ce725cc926b@changeid Signed-off-by: Johannes Berg commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 Author: Lorenzo Bianconi Date: Mon Sep 20 14:45:22 2021 +0200 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap routine in order to fix the following warning reported by syzbot: WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 Modules linked in: CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216 RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000 RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8 R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004 FS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165 __bpf_tx_skb net/core/filter.c:2114 [inline] __bpf_redirect_no_mac net/core/filter.c:2139 [inline] __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162 ____bpf_clone_redirect net/core/filter.c:2429 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline] __bpf_prog_run include/linux/filter.h:624 [inline] bpf_prog_run include/linux/filter.h:631 [inline] bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline] __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Reported-by: syzbot+0196ac871673f0c20f68@syzkaller.appspotmail.com Fixes: 646e76bb5daf4 ("mac80211: parse VHT info in injected frames") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/c26c3f02dcb38ab63b2f2534cb463d95ee81bb13.1632141760.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit a6555f844549cd190eb060daef595f94d3de1582 Author: YueHaibing Date: Fri Aug 27 22:42:30 2021 +0800 mac80211: Drop frames from invalid MAC address in ad-hoc mode WARNING: CPU: 1 PID: 9 at net/mac80211/sta_info.c:554 sta_info_insert_rcu+0x121/0x12a0 Modules linked in: CPU: 1 PID: 9 Comm: kworker/u8:1 Not tainted 5.14.0-rc7+ #253 Workqueue: phy3 ieee80211_iface_work RIP: 0010:sta_info_insert_rcu+0x121/0x12a0 ... Call Trace: ieee80211_ibss_finish_sta+0xbc/0x170 ieee80211_ibss_work+0x13f/0x7d0 ieee80211_iface_work+0x37a/0x500 process_one_work+0x357/0x850 worker_thread+0x41/0x4d0 If an Ad-Hoc node receives packets with invalid source MAC address, it hits a WARN_ON in sta_info_insert_check(), this can spam the log. Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20210827144230.39944-1-yuehaibing@huawei.com Signed-off-by: Johannes Berg commit fe94bac626d9c1c5bc98ab32707be8a9d7f8adba Author: Chih-Kang Chang Date: Mon Aug 30 15:32:40 2021 +0800 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the end of skb_shinfo(head)->frag_list, and use it to bind other skb in the end of this function. But when execute ieee80211_amsdu_aggregate() ->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of skb_shinfo(head)->frag_list will be changed. However, the ieee80211_amsdu_aggregate() not update frag_tail after call pskb_expand_head(). That will cause the second skb can't bind to the head skb appropriately.So we update the address of frag_tail to fix it. Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support") Signed-off-by: Chih-Kang Chang Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://lore.kernel.org/r/20210830073240.12736-1-pkshih@realtek.com [reword comment] Signed-off-by: Johannes Berg commit 98d46b021f6ee246c7a73f9d490d4cddb4511a3b Author: Felix Fietkau Date: Mon Sep 6 10:35:59 2021 +0200 Revert "mac80211: do not use low data rates for data frames with no ack flag" This reverts commit d333322361e7 ("mac80211: do not use low data rates for data frames with no ack flag"). Returning false early in rate_control_send_low breaks sending broadcast packets, since rate control will not select a rate for it. Before re-introducing a fixed version of this patch, we should probably also make some changes to rate control to be more conservative in selecting rates for no-ack packets and also prevent using probing rates on them, since we won't get any feedback. Fixes: d333322361e7 ("mac80211: do not use low data rates for data frames with no ack flag") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20210906083559.9109-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 8cd9da85d2bd87ce889043e7b1735723dd10eb89 Author: Frederic Weisbecker Date: Mon Sep 13 16:53:32 2021 +0200 posix-cpu-timers: Prevent spuriously armed 0-value itimer Resetting/stopping an itimer eventually leads to it being reprogrammed with an actual "0" value. As a result the itimer expires on the next tick, triggering an unexpected signal. To fix this, make sure that struct signal_struct::it[CPUCLOCK_PROF/VIRT]::expires is set to 0 when setitimer() passes a 0 it_value, indicating that the timer must stop. Fixes: 406dd42bd1ba ("posix-cpu-timers: Force next expiration recalc after itimer reset") Reported-by: Victor Stinner Reported-by: Chris Hixon Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210913145332.232023-1-frederic@kernel.org commit 90ca6e7db83a06e9173bee5bb34ded3b37f4948d Author: Johan Hovold Date: Wed Sep 22 13:31:00 2021 +0200 USB: serial: cp210x: add part-number debug printk Add a part-number debug printk to facilitate debugging. Signed-off-by: Johan Hovold commit c32dfec6c1c36bbbcd5d33e949d99aeb215877ec Author: Johan Hovold Date: Wed Sep 22 13:30:59 2021 +0200 USB: serial: cp210x: fix dropped characters with CP2102 Some CP2102 do not support event-insertion mode but return no error when attempting to enable it. This means that any event escape characters in the input stream will not be escaped by the device and consequently regular data may be interpreted as escape sequences and be removed from the stream by the driver. The reporter's device has batch number DCL00X etched into it and as discovered by the SHA2017 Badge team, counterfeit devices with that marking can be detected by sending malformed vendor requests. [1][2] Tests confirm that the possibly counterfeit CP2102 returns a single byte in response to a malformed two-byte part-number request, while an original CP2102 returns two bytes. Assume that every CP2102 that behaves this way also does not support event-insertion mode (e.g. cannot report parity errors). [1] https://mobile.twitter.com/sha2017badge/status/1167902087289532418 [2] https://hackaday.com/2017/08/14/hands-on-with-the-shacamp-2017-badge/#comment-3903376 Reported-by: Malte Di Donato Tested-by: Malte Di Donato Fixes: a7207e9835a4 ("USB: serial: cp210x: add support for line-status events") Cc: stable@vger.kernel.org # 5.9 Link: https://lore.kernel.org/r/20210922113100.20888-1-johan@kernel.org Signed-off-by: Johan Hovold commit 93ec1320b0170d7a207eda2d119c669b673401ed Author: Nicolas Dichtel Date: Wed Sep 22 10:50:06 2021 +0200 xfrm: fix rcu lock in xfrm_notify_userpolicy() As stated in the comment above xfrm_nlmsg_multicast(), rcu read lock must be held before calling this function. Reported-by: syzbot+3d9866419b4aa8f985d6@syzkaller.appspotmail.com Fixes: 703b94b93c19 ("xfrm: notify default policy on update") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 09d23174402da0f10e98da2c61bb5ac8e7d79fdd Author: Jaroslav Kysela Date: Mon Sep 20 19:18:50 2021 +0200 ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION The new framing mode causes the user space regression, because the alsa-lib code does not initialize the reserved space in the params structure when the device is opened. This change adds SNDRV_RAWMIDI_IOCTL_USER_PVERSION like we do for the PCM interface for the protocol acknowledgment. Cc: David Henningsson Cc: Fixes: 08fdced60ca0 ("ALSA: rawmidi: Add framing mode") BugLink: https://github.com/alsa-project/alsa-lib/issues/178 Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20210920171850.154186-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 4ea477988c423a57241ea4840b12832de6fabdfd Author: Namjae Jeon Date: Tue Sep 21 14:19:33 2021 +0900 ksmbd: remove follow symlinks support Use LOOKUP_NO_SYMLINKS flags for default lookup to prohibit the middle of symlink component lookup and remove follow symlinks parameter support. We re-implement it as reparse point later. Test result: smbclient -Ulinkinjeon%1234 //172.30.1.42/share -c "get hacked/passwd passwd" NT_STATUS_OBJECT_NAME_NOT_FOUND opening remote file \hacked\passwd Cc: Ralph Böhme Cc: Steve French Acked-by: Ronnie Sahlberg Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 18a015bccf9e8927008d0a255c9f14b8ec15a648 Author: Namjae Jeon Date: Wed Sep 22 21:00:57 2021 +0900 ksmbd: check protocol id in ksmbd_verify_smb_message() When second smb2 pdu has invalid protocol id, ksmbd doesn't detect it and allow to process smb2 request. This patch add the check it in ksmbd_verify_smb_message() and don't use protocol id of smb2 request as protocol id of response. Reviewed-by: Ronnie Sahlberg Reviewed-by: Ralph Böhme Reported-by: Ronnie Sahlberg Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 58e2cf5d794616b84f591d4d1276c8953278ce24 Author: Geert Uytterhoeven Date: Wed Sep 1 09:09:28 2021 +0200 init: Revert accidental changes to print irqs_disabled() Commit f8ade8dddb16 ("xsurf100: drop include of lib8390.c") accidentally changed init/main.c. Revert that part. Fixes: f8ade8dddb16 ("xsurf100: drop include of lib8390.c") Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 4057525736b159bd456732d11270af2cc49ec21f Author: Konrad Rzeszutek Wilk Date: Fri Sep 17 12:16:52 2021 -0400 MAINTAINERS: Update Xen-[PCI,SWIOTLB,Block] maintainership Konrad's new job role is putting a serious cramp on him being a responsive maintainer and as such he is handing off the reins to Juergen, Roger, and Stefano. Thank you! Acked-by: Juergen Gross Acked-by: Roger Pau Monné Acked-by: Stefano Stabellini Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Linus Torvalds commit 2e36a964ada4f7bda24f3caa971a33500e23af36 Author: Konrad Rzeszutek Wilk Date: Fri Sep 17 12:16:51 2021 -0400 MAINTAINERS: Update SWIOTLB maintainership Konrad's new job role is putting a serious cramp on him being a responsive maintainer and as such he is handing off the reins to Christoph Hellwig. Thank you! Acked-by: Christoph Hellwig Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Linus Torvalds commit c4aa1eeb093b09fbae9329a080172c58ace8da8c Author: Dinh Nguyen Date: Wed Sep 22 14:30:01 2021 -0500 MAINTAINERS: update entry for NIOS2 Ley Foon has left Intel and will no longer be able to maintain NIOS2. Update the MAINTAINER's entry to Dinh Nguyen. Acked-by: Ley Foon Tan Signed-off-by: Dinh Nguyen Signed-off-by: Linus Torvalds commit 9bedf10b5797a4660c2acc6c3573376f7e5d1c97 Merge: cf1d2c3e7e2f3 96c8395e2166e Author: Linus Torvalds Date: Wed Sep 22 11:58:24 2021 -0700 Merge tag 'spi-fix-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi modalias fix from Mark Brown: "Fix modalias issues As reported by Russell King the change to use OF style modaliases for DT enumerated broke at least the spi-nor driver, the patch here reverts that change to fix the regression. Sadly this will mean that anything that started loading since the change to OF modaliases will run into issues, there doesn't seem to be any approach which doesn't cause some problems and thi seems like the least bad approach - gory details are in the commit log for the change. I'm currently working through the SPI drivers to add ID tables and missing IDs to tables which should address things from the other end, this seems more straightforward and robust than any other options" * tag 'spi-fix-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Revert modalias changes commit cd586d213e583c74594c9c357a18c4c290df3b92 Merge: 858560b27645e 7df835a32a8be Author: Jens Axboe Date: Wed Sep 22 12:43:18 2021 -0600 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-5.15 Pull MD fix from Song. * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix a lock order reversal in md_alloc commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 Author: Eric Biggers Date: Thu Sep 16 13:34:24 2021 -0700 fs-verity: fix signed integer overflow with i_size near S64_MAX If the file size is almost S64_MAX, the calculated number of Merkle tree levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to fail. This is unintentional, since as the comment above the definition of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.) The bug is actually that when the number of blocks in the first level is calculated from i_size, there is a signed integer overflow due to i_size being signed. Fix this by treating i_size as unsigned. This was found by the new test "generic: test fs-verity EFBIG scenarios" (https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io). This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to S64_MAX bytes. Reported-by: Boris Burkov Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl") Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()") Cc: # v5.4+ Reviewed-by: Boris Burkov Link: https://lore.kernel.org/r/20210916203424.113376-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d81ff5fe14a950f53e2833cfa196e7bb3fd5d4e3 Author: Kees Cook Date: Fri Sep 10 15:33:32 2021 -0700 x86/asm: Fix SETZ size enqcmds() build failure When building under GCC 4.9 and 5.5: arch/x86/include/asm/special_insns.h: Assembler messages: arch/x86/include/asm/special_insns.h:286: Error: operand size mismatch for `setz' Change the type to "bool" for condition code arguments, as documented. Fixes: 7f5933f81bd8 ("x86/asm: Add an enqcmds() wrapper for the ENQCMDS instruction") Co-developed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Signed-off-by: Kees Cook Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20210910223332.3224851-1-keescook@chromium.org commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d Author: Jason Gunthorpe Date: Wed Sep 15 17:21:43 2021 -0300 RDMA/cma: Do not change route.addr.src_addr.ss_family If the state is not idle then rdma_bind_addr() will immediately fail and no change to global state should happen. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4 family, failing the test. This would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae Which is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address build one explicitly on the stack and bind to that as any other normal flow would do. Link: https://lore.kernel.org/r/0-v1-9fbb33f5e201+2a-cma_listen_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear") Reported-by: syzbot+6bb0528b13611047209c@syzkaller.appspotmail.com Tested-by: Hao Sun Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit cf1d2c3e7e2f3754fe3d6dc747f7a092b168d9cf Merge: bee42512c4a0e 02579b2ff8b0b Author: Linus Torvalds Date: Wed Sep 22 09:21:02 2021 -0700 Merge tag 'nfsd-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Critical bug fixes: - Fix crash in NLM TEST procedure - NFSv4.1+ backchannel not restored after PATH_DOWN" * tag 'nfsd-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN NLM: Fix svcxdr_encode_owner() commit bee42512c4a0e6253d6b196445f9091438b264b5 Merge: 8f1b7ba55c61d 6f6aab1caf6c7 Author: Linus Torvalds Date: Wed Sep 22 09:16:18 2021 -0700 Merge tag 'platform-drivers-x86-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "The first round of bug-fixes for platform-drivers-x86 for 5.15, highlights: - amd-pmc fix for some suspend/resume issues - intel-hid fix to avoid false-positive SW_TABLET_MODE=1 reporting - some build error/warning fixes - various DMI quirk additions" * tag 'platform-drivers-x86-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: gigabyte-wmi: add support for B550I Aorus Pro AX platform/x86/intel: hid: Add DMI switches allow list platform/x86: dell: fix DELL_WMI_PRIVACY dependencies & build error platform/x86: amd-pmc: Increase the response register timeout platform/x86: touchscreen_dmi: Update info for the Chuwi Hi10 Plus (CWI527) tablet platform/x86: touchscreen_dmi: Add info for the Chuwi HiBook (CWI514) tablet lg-laptop: Correctly handle dmi_get_system_info() returning NULL platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() commit 8f1b7ba55c61d2c9f3a47a4759db43abfb59fc16 Author: Jiri Slaby Date: Wed Sep 22 08:35:58 2021 +0200 MAINTAINERS: ARM/VT8500, remove defunct e-mail linux@prisktech.co.nz is defunct: 4.1.2 : Recipient address rejected: Domain not found Remove it from MAINTAINERS and mark the ARM/VT8500 entry orphan. Signed-off-by: Jiri Slaby Signed-off-by: Linus Torvalds commit 7df835a32a8bedf7ce88efcfa7c9b245b52ff139 Author: Christoph Hellwig Date: Wed Sep 1 13:38:29 2021 +0200 md: fix a lock order reversal in md_alloc Commit b0140891a8cea3 ("md: Fix race when creating a new md device.") not only moved assigning mddev->gendisk before calling add_disk, which fixes the races described in the commit log, but also added a mddev->open_mutex critical section over add_disk and creation of the md kobj. Adding a kobject after add_disk is racy vs deleting the gendisk right after adding it, but md already prevents against that by holding a mddev->active reference. On the other hand taking this lock added a lock order reversal with what is not disk->open_mutex (used to be bdev->bd_mutex when the commit was added) for partition devices, which need that lock for the internal open for the partition scan, and a recent commit also takes it for non-partitioned devices, leading to further lockdep splatter. Fixes: b0140891a8ce ("md: Fix race when creating a new md device.") Fixes: d62633873590 ("block: support delayed holder registration") Reported-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Tested-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com Reviewed-by: NeilBrown Signed-off-by: Song Liu commit e1fc1553cd78292ab3521c94c9dd6e3e70e606a1 Author: Fares Mehanna Date: Wed Sep 15 13:39:50 2021 +0000 kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[] Intel PMU MSRs is in msrs_to_save_all[], so add AMD PMU MSRs to have a consistent behavior between Intel and AMD when using KVM_GET_MSRS, KVM_SET_MSRS or KVM_GET_MSR_INDEX_LIST. We have to add legacy and new MSRs to handle guests running without X86_FEATURE_PERFCTR_CORE. Signed-off-by: Fares Mehanna Message-Id: <20210915133951.22389-1-faresx@amazon.de> Signed-off-by: Paolo Bonzini commit dbab610a5be69c2c5e4fdd7135d14b6bab2667a5 Author: Maxim Levitsky Date: Mon Sep 13 17:09:54 2021 +0300 KVM: x86: nVMX: re-evaluate emulation_required on nested VM exit If L1 had invalid state on VM entry (can happen on SMM transactions when we enter from real mode, straight to nested guest), then after we load 'host' state from VMCS12, the state has to become valid again, but since we load the segment registers with __vmx_set_segment we weren't always updating emulation_required. Update emulation_required explicitly at end of load_vmcs12_host_state. Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-8-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit c8607e4a086fae05efe5bffb47c5199c65e7216e Author: Maxim Levitsky Date: Mon Sep 13 17:09:53 2021 +0300 KVM: x86: nVMX: don't fail nested VM entry on invalid guest state if !from_vmentry It is possible that when non root mode is entered via special entry (!from_vmentry), that is from SMM or from loading the nested state, the L2 state could be invalid in regard to non unrestricted guest mode, but later it can become valid. (for example when RSM emulation restores segment registers from SMRAM) Thus delay the check to VM entry, where we will check this and fail. Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-7-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit c42dec148b3e1a88835e275b675e5155f99abd43 Author: Maxim Levitsky Date: Mon Sep 13 17:09:52 2021 +0300 KVM: x86: VMX: synthesize invalid VM exit when emulating invalid guest state Since no actual VM entry happened, the VM exit information is stale. To avoid this, synthesize an invalid VM guest state VM exit. Suggested-by: Sean Christopherson Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-6-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 136a55c054ca03b44b74efe03f136d495dd84ec8 Author: Maxim Levitsky Date: Wed Sep 22 10:28:43 2021 -0400 KVM: x86: nSVM: refactor svm_leave_smm and smm_enter_smm Use return statements instead of nested if, and fix error path to free all the maps that were allocated. Suggested-by: Sean Christopherson Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit e85d3e7b495bb6c0b847a693f5f6d4bd429fae55 Author: Maxim Levitsky Date: Mon Sep 13 17:09:51 2021 +0300 KVM: x86: SVM: call KVM_REQ_GET_NESTED_STATE_PAGES on exit from SMM mode Currently the KVM_REQ_GET_NESTED_STATE_PAGES on SVM only reloads PDPTRs, and MSR bitmap, with former not really needed for SMM as SMM exit code reloads them again from SMRAM'S CR3, and later happens to work since MSR bitmap isn't modified while in SMM. Still it is better to be consistient with VMX. Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-5-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 37687c403a641f251cb2ef2e7830b88aa0647ba9 Author: Maxim Levitsky Date: Mon Sep 13 17:09:50 2021 +0300 KVM: x86: reset pdptrs_from_userspace when exiting smm When exiting SMM, pdpts are loaded again from the guest memory. This fixes a theoretical bug, when exit from SMM triggers entry to the nested guest which re-uses some of the migration code which uses this flag as a workaround for a legacy userspace. Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-4-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit e2e6e449d68ddf4ccb0bf72cc50fbc6c69fe7f63 Author: Maxim Levitsky Date: Mon Sep 13 17:09:49 2021 +0300 KVM: x86: nSVM: restore the L1 host state prior to resuming nested guest on SMM exit Otherwise guest entry code might see incorrect L1 state (e.g paging state). Fixes: 37be407b2ce8 ("KVM: nSVM: Fix L1 state corruption upon return from SMM") Signed-off-by: Maxim Levitsky Message-Id: <20210913140954.165665-3-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 8d68bad6d869fae8f4d50ab6423538dec7da72d1 Author: Vitaly Kuznetsov Date: Tue Sep 7 18:35:30 2021 +0200 KVM: nVMX: Filter out all unsupported controls when eVMCS was activated Windows Server 2022 with Hyper-V role enabled failed to boot on KVM when enlightened VMCS is advertised. Debugging revealed there are two exposed secondary controls it is not happy with: SECONDARY_EXEC_ENABLE_VMFUNC and SECONDARY_EXEC_SHADOW_VMCS. These controls are known to be unsupported, as there are no corresponding fields in eVMCSv1 (see the comment above EVMCS1_UNSUPPORTED_2NDEXEC definition). Previously, commit 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs()") introduced the required filtering mechanism for VMX MSRs but for some reason put only known to be problematic (and not full EVMCS1_UNSUPPORTED_* lists) controls there. Note, Windows Server 2022 seems to have gained some sanity check for VMX MSRs: it doesn't even try to launch a guest when there's something it doesn't like, nested_evmcs_check_controls() mechanism can't catch the problem. Let's be bold this time and instead of playing whack-a-mole just filter out all unsupported controls from VMX MSRs. Fixes: 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs()") Signed-off-by: Vitaly Kuznetsov Message-Id: <20210907163530.110066-1-vkuznets@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 0bbc2ca8515f9cdf11df84ccb63dc7c44bc3d8f4 Author: Sean Christopherson Date: Fri Aug 27 11:25:10 2021 +0200 KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs Check for a NULL cpumask_var_t when kicking multiple vCPUs via cpumask_available(), which performs a !NULL check if and only if cpumasks are configured to be allocated off-stack. This is a meaningless optimization, e.g. avoids a TEST+Jcc and TEST+CMOV on x86, but more importantly helps document that the NULL check is necessary even though all callers pass in a local variable. No functional change intended. Cc: Lai Jiangshan Signed-off-by: Sean Christopherson Signed-off-by: Vitaly Kuznetsov Message-Id: <20210827092516.1027264-3-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit 85b640450ddcfa09cf72771b69a9c3daf0ddc772 Author: Sean Christopherson Date: Fri Aug 27 11:25:09 2021 +0200 KVM: Clean up benign vcpu->cpu data races when kicking vCPUs Fix a benign data race reported by syzbot+KCSAN[*] by ensuring vcpu->cpu is read exactly once, and by ensuring the vCPU is booted from guest mode if kvm_arch_vcpu_should_kick() returns true. Fix a similar race in kvm_make_vcpus_request_mask() by ensuring the vCPU is interrupted if kvm_request_needs_ipi() returns true. Reading vcpu->cpu before vcpu->mode (via kvm_arch_vcpu_should_kick() or kvm_request_needs_ipi()) means the target vCPU could get migrated (change vcpu->cpu) and enter !OUTSIDE_GUEST_MODE between reading vcpu->cpud and reading vcpu->mode. If that happens, the kick/IPI will be sent to the old pCPU, not the new pCPU that is now running the vCPU or reading SPTEs. Although failing to kick the vCPU is not exactly ideal, practically speaking it cannot cause a functional issue unless there is also a bug in the caller, and any such bug would exist regardless of kvm_vcpu_kick()'s behavior. The purpose of sending an IPI is purely to get a vCPU into the host (or out of reading SPTEs) so that the vCPU can recognize a change in state, e.g. a KVM_REQ_* request. If vCPU's handling of the state change is required for correctness, KVM must ensure either the vCPU sees the change before entering the guest, or that the sender sees the vCPU as running in guest mode. All architectures handle this by (a) sending the request before calling kvm_vcpu_kick() and (b) checking for requests _after_ setting vcpu->mode. x86's READING_SHADOW_PAGE_TABLES has similar requirements; KVM needs to ensure it kicks and waits for vCPUs that started reading SPTEs _before_ MMU changes were finalized, but any vCPU that starts reading after MMU changes were finalized will see the new state and can continue on uninterrupted. For uses of kvm_vcpu_kick() that are not paired with a KVM_REQ_*, e.g. x86's kvm_arch_sync_dirty_log(), the order of the kick must not be relied upon for functional correctness, e.g. in the dirty log case, userspace cannot assume it has a 100% complete log if vCPUs are still running. All that said, eliminate the benign race since the cost of doing so is an "extra" atomic cmpxchg() in the case where the target vCPU is loaded by the current pCPU or is not loaded at all. I.e. the kick will be skipped due to kvm_vcpu_exiting_guest_mode() seeing a compatible vcpu->mode as opposed to the kick being skipped because of the cpu checks. Keep the "cpu != me" checks even though they appear useless/impossible at first glance. x86 processes guest IPI writes in a fast path that runs in IN_GUEST_MODE, i.e. can call kvm_vcpu_kick() from IN_GUEST_MODE. And calling kvm_vm_bugged()->kvm_make_vcpus_request_mask() from IN_GUEST or READING_SHADOW_PAGE_TABLES is perfectly reasonable. Note, a race with the cpu_online() check in kvm_vcpu_kick() likely persists, e.g. the vCPU could exit guest mode and get offlined between the cpu_online() check and the sending of smp_send_reschedule(). But, the online check appears to exist only to avoid a WARN in x86's native_smp_send_reschedule() that fires if the target CPU is not online. The reschedule WARN exists because CPU offlining takes the CPU out of the scheduling pool, i.e. the WARN is intended to detect the case where the kernel attempts to schedule a task on an offline CPU. The actual sending of the IPI is a non-issue as at worst it will simpy be dropped on the floor. In other words, KVM's usurping of the reschedule IPI could theoretically trigger a WARN if the stars align, but there will be no loss of functionality. [*] https://syzkaller.appspot.com/bug?extid=cd4154e502f43f10808a Cc: Venkatesh Srinivas Cc: Vitaly Kuznetsov Fixes: 97222cc83163 ("KVM: Emulate local APIC in kernel") Signed-off-by: Sean Christopherson Signed-off-by: Vitaly Kuznetsov Message-Id: <20210827092516.1027264-2-vkuznets@redhat.com> Signed-off-by: Paolo Bonzini commit 2f9b68f57c6278c322793a06063181deded0ad69 Author: Vitaly Kuznetsov Date: Fri Aug 27 11:25:14 2021 +0200 KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() KASAN reports the following issue: BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798 CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm] The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs). Fixes: 7ee30bc132c6 ("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs") Fixes: 9a2ae9f6b6bb ("KVM: x86: Zero the IOAPIC scan request dest vCPUs bitmap") Reported-by: Dr. David Alan Gilbert Signed-off-by: Vitaly Kuznetsov Reviewed-by: Maxim Levitsky Reviewed-by: Sean Christopherson Message-Id: <20210827092516.1027264-7-vkuznets@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 7c236b816ef16c2969a88ced658dab667e9dd4ee Author: David Matlack Date: Fri Sep 17 17:36:57 2021 +0000 KVM: selftests: Create a separate dirty bitmap per slot The calculation to get the per-slot dirty bitmap was incorrect leading to a buffer overrun. Fix it by splitting out the dirty bitmap into a separate bitmap per slot. Fixes: 609e6202ea5f ("KVM: selftests: Support multiple slots in dirty_log_perf_test") Signed-off-by: David Matlack Reviewed-by: Andrew Jones Message-Id: <20210917173657.44011-4-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 9f2fc5554a4093e80084389f760d0b06ec2ff782 Author: David Matlack Date: Fri Sep 17 17:36:56 2021 +0000 KVM: selftests: Refactor help message for -s backing_src All selftests that support the backing_src option were printing their own description of the flag and then calling backing_src_help() to dump the list of available backing sources. Consolidate the flag printing in backing_src_help() to align indentation, reduce duplicated strings, and improve consistency across tests. Note: Passing "-s" to backing_src_help is unnecessary since every test uses the same flag. However I decided to keep it for code readability at the call sites. While here this opportunistically fixes the incorrectly interleaved printing -x help message and list of backing source types in dirty_log_perf_test. Fixes: 609e6202ea5f ("KVM: selftests: Support multiple slots in dirty_log_perf_test") Reviewed-by: Ben Gardon Reviewed-by: Andrew Jones Signed-off-by: David Matlack Message-Id: <20210917173657.44011-3-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit a1e638da1ba4078caa0374507cf0d9ec140a255f Author: David Matlack Date: Fri Sep 17 17:36:55 2021 +0000 KVM: selftests: Change backing_src flag to -s in demand_paging_test Every other KVM selftest uses -s for the backing_src, so switch demand_paging_test to match. Reviewed-by: Ben Gardon Reviewed-by: Andrew Jones Signed-off-by: David Matlack Message-Id: <20210917173657.44011-2-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 5b92b6ca92b65bef811048c481e4446f4828500a Author: Peter Gonda Date: Tue Sep 21 08:03:45 2021 -0700 KVM: SEV: Allow some commands for mirror VM A mirrored SEV-ES VM will need to call KVM_SEV_LAUNCH_UPDATE_VMSA to setup its vCPUs and have them measured, and their VMSAs encrypted. Without this change, it is impossible to have mirror VMs as part of SEV-ES VMs. Also allow the guest status check and debugging commands since they do not change any guest state. Signed-off-by: Peter Gonda Cc: Marc Orr Cc: Nathan Tempelman Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Steve Rutherford Cc: Brijesh Singh Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 54526d1fd593 ("KVM: x86: Support KVM VMs sharing SEV context", 2021-04-21) Message-Id: <20210921150345.2221634-3-pgonda@google.com> Signed-off-by: Paolo Bonzini commit f43c887cb7cb5b66c4167d40a4209027f5fdb5ce Author: Peter Gonda Date: Tue Sep 21 08:03:44 2021 -0700 KVM: SEV: Update svm_vm_copy_asid_from for SEV-ES For mirroring SEV-ES the mirror VM will need more then just the ASID. The FD and the handle are required to all the mirror to call psp commands. The mirror VM will need to call KVM_SEV_LAUNCH_UPDATE_VMSA to setup its vCPUs' VMSAs for SEV-ES. Signed-off-by: Peter Gonda Cc: Marc Orr Cc: Nathan Tempelman Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Steve Rutherford Cc: Brijesh Singh Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 54526d1fd593 ("KVM: x86: Support KVM VMs sharing SEV context", 2021-04-21) Message-Id: <20210921150345.2221634-2-pgonda@google.com> Signed-off-by: Paolo Bonzini commit 24a996ade34d00deef5dee2c33aacd8fda91ec31 Author: Chenyi Qiang Date: Tue Sep 14 17:50:41 2021 +0800 KVM: nVMX: Fix nested bus lock VM exit Nested bus lock VM exits are not supported yet. If L2 triggers bus lock VM exit, it will be directed to L1 VMM, which would cause unexpected behavior. Therefore, handle L2's bus lock VM exits in L0 directly. Fixes: fe6b6bc802b4 ("KVM: VMX: Enable bus lock VM exit") Signed-off-by: Chenyi Qiang Reviewed-by: Sean Christopherson Reviewed-by: Xiaoyao Li Message-Id: <20210914095041.29764-1-chenyi.qiang@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 94c245a245ff6552a320257f97d5171d03f7ee3a Author: Sean Christopherson Date: Fri Sep 10 11:32:20 2021 -0700 KVM: x86: Identify vCPU0 by its vcpu_idx instead of its vCPUs array entry Use vcpu_idx to identify vCPU0 when updating HyperV's TSC page, which is shared by all vCPUs and "owned" by vCPU0 (because vCPU0 is the only vCPU that's guaranteed to exist). Using kvm_get_vcpu() to find vCPU works, but it's a rather odd and suboptimal method to check the index of a given vCPU. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Reviewed-by: Maxim Levitsky Reviewed-by: Vitaly Kuznetsov Message-Id: <20210910183220.2397812-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4eeef2424153e79910d65248b5e1abf137d050e9 Author: Sean Christopherson Date: Fri Sep 10 11:32:19 2021 -0700 KVM: x86: Query vcpu->vcpu_idx directly and drop its accessor Read vcpu->vcpu_idx directly instead of bouncing through the one-line wrapper, kvm_vcpu_get_idx(), and drop the wrapper. The wrapper is a remnant of the original implementation and serves no purpose; remove it before it gains more users. Back when kvm_vcpu_get_idx() was added by commit 497d72d80a78 ("KVM: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus"), the implementation was more than just a simple wrapper as vcpu->vcpu_idx did not exist and retrieving the index meant walking over the vCPU array to find the given vCPU. When vcpu_idx was introduced by commit 8750e72a79dd ("KVM: remember position in kvm->vcpus array"), the helper was left behind, likely to avoid extra thrash (but even then there were only two users, the original arm usage having been removed at some point in the past). No functional change intended. Suggested-by: Vitaly Kuznetsov Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Reviewed-by: Vitaly Kuznetsov Message-Id: <20210910183220.2397812-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit e9337c843c4b4eaa4afb752a7272ef3d04c46381 Author: Hou Wenlong Date: Wed Aug 18 11:36:31 2021 +0800 kvm: fix wrong exception emulation in check_rdtsc According to Intel's SDM Vol2 and AMD's APM Vol3, when CR4.TSD is set, use rdtsc/rdtscp instruction above privilege level 0 should trigger a #GP. Fixes: d7eb82030699e ("KVM: SVM: Add intercept checks for remaining group7 instructions") Signed-off-by: Hou Wenlong Message-Id: <1297c0dd3f1bb47a6d089f850b629c7aa0247040.1629257115.git.houwenlong93@linux.alibaba.com> Reviewed-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 50c038018d6be20361e8a2890262746a4ac5b11f Author: Sean Christopherson Date: Tue Sep 14 14:09:50 2021 -0700 KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA Require the target guest page to be writable when pinning memory for RECEIVE_UPDATE_DATA. Per the SEV API, the PSP writes to guest memory: The result is then encrypted with GCTX.VEK and written to the memory pointed to by GUEST_PADDR field. Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Cc: stable@vger.kernel.org Cc: Peter Gonda Cc: Marc Orr Cc: Tom Lendacky Cc: Brijesh Singh Signed-off-by: Sean Christopherson Message-Id: <20210914210951.2994260-2-seanjc@google.com> Reviewed-by: Brijesh Singh Reviewed-by: Peter Gonda Signed-off-by: Paolo Bonzini commit f1815e0aa770f2127c5df31eb5c2f0e37b60fa77 Author: Mingwei Zhang Date: Sun Sep 12 18:18:15 2021 +0000 KVM: SVM: fix missing sev_decommission in sev_receive_start DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest context and thus needs to be paired with DECOMMISSION: The RECEIVE_START command is the only command other than the LAUNCH_START command that generates a new guest context and guest handle. The missing DECOMMISSION can result in subsequent SEV launch failures, as the firmware leaks memory and might not able to allocate more SEV guest contexts in the future. Note, LAUNCH_START suffered the same bug, but was previously fixed by commit 934002cd660b ("KVM: SVM: Call SEV Guest Decommission if ASID binding fails"). Cc: Alper Gun Cc: Borislav Petkov Cc: Brijesh Singh Cc: David Rienjes Cc: Marc Orr Cc: John Allen Cc: Peter Gonda Cc: Sean Christopherson Cc: Tom Lendacky Cc: Vipin Sharma Cc: stable@vger.kernel.org Reviewed-by: Marc Orr Acked-by: Brijesh Singh Fixes: af43cbbf954b ("KVM: SVM: Add support for KVM_SEV_RECEIVE_START command") Signed-off-by: Mingwei Zhang Reviewed-by: Sean Christopherson Message-Id: <20210912181815.3899316-1-mizhang@google.com> Signed-off-by: Paolo Bonzini commit bb18a677746543e7f5eeb478129c92cedb0f9658 Author: Peter Gonda Date: Wed Sep 15 10:17:55 2021 -0700 KVM: SEV: Acquire vcpu mutex when updating VMSA The update-VMSA ioctl touches data stored in struct kvm_vcpu, and therefore should not be performed concurrently with any VCPU ioctl that might cause KVM or the processor to use the same data. Adds vcpu mutex guard to the VMSA updating code. Refactors out __sev_launch_update_vmsa() function to deal with per vCPU parts of sev_launch_update_vmsa(). Fixes: ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest") Signed-off-by: Peter Gonda Cc: Marc Orr Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Brijesh Singh Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Message-Id: <20210915171755.3773766-1-pgonda@google.com> Signed-off-by: Paolo Bonzini commit ae232ea460888dc5a8b37e840c553b02521fbf18 Author: Sergey Senozhatsky Date: Thu Sep 2 12:11:00 2021 +0900 KVM: do not shrink halt_poll_ns below grow_start grow_halt_poll_ns() ignores values between 0 and halt_poll_ns_grow_start (10000 by default). However, when we shrink halt_poll_ns we may fall way below halt_poll_ns_grow_start and endup with halt_poll_ns values that don't make a lot of sense: like 1 or 9, or 19. VCPU1 trace (halt_poll_ns_shrink equals 2): VCPU1 grow 10000 VCPU1 shrink 5000 VCPU1 shrink 2500 VCPU1 shrink 1250 VCPU1 shrink 625 VCPU1 shrink 312 VCPU1 shrink 156 VCPU1 shrink 78 VCPU1 shrink 39 VCPU1 shrink 19 VCPU1 shrink 9 VCPU1 shrink 4 Mirror what grow_halt_poll_ns() does and set halt_poll_ns to 0 as soon as new shrink-ed halt_poll_ns value falls below halt_poll_ns_grow_start. Signed-off-by: Sergey Senozhatsky Signed-off-by: Paolo Bonzini Message-Id: <20210902031100.252080-1-senozhatsky@chromium.org> Signed-off-by: Paolo Bonzini commit ed7023a11bd820fca50e61911a670ddf3e01f73f Author: Yu Zhang Date: Thu Sep 9 01:17:31 2021 +0800 KVM: nVMX: fix comments of handle_vmon() "VMXON pointer" is saved in vmx->nested.vmxon_ptr since commit 3573e22cfeca ("KVM: nVMX: additional checks on vmxon region"). Also, handle_vmptrld() & handle_vmclear() now have logic to check the VMCS pointer against the VMXON pointer. So just remove the obsolete comments of handle_vmon(). Signed-off-by: Yu Zhang Message-Id: <20210908171731.18885-1-yu.c.zhang@linux.intel.com> Signed-off-by: Paolo Bonzini commit eb7511bf9182292ef1df1082d23039e856d1ddfb Author: Haimin Zhang Date: Fri Sep 3 10:37:06 2021 +0800 KVM: x86: Handle SRCU initialization failure during page track init Check the return of init_srcu_struct(), which can fail due to OOM, when initializing the page track mechanism. Lack of checking leads to a NULL pointer deref found by a modified syzkaller. Reported-by: TCS Robot Signed-off-by: Haimin Zhang Message-Id: <1630636626-12262-1-git-send-email-tcs_kernel@tencent.com> [Move the call towards the beginning of kvm_arch_init_vm. - Paolo] Signed-off-by: Paolo Bonzini commit cd36ae8761775e78154ba6bd7a3bd2ab538c589f Author: Sean Christopherson Date: Tue Sep 7 17:24:01 2021 -0700 KVM: VMX: Remove defunct "nr_active_uret_msrs" field Remove vcpu_vmx.nr_active_uret_msrs and its associated comment, which are both defunct now that KVM keeps the list constant and instead explicitly tracks which entries need to be loaded into hardware. No functional change intended. Fixes: ee9d22e08d13 ("KVM: VMX: Use flag to indicate "active" uret MSRs instead of sorting list") Signed-off-by: Sean Christopherson Message-Id: <20210908002401.1947049-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 01f91acb55be7aac3950b89c458bcea9ef6e4f49 Author: Oliver Upton Date: Tue Sep 21 17:11:21 2021 +0000 selftests: KVM: Align SMCCC call with the spec in steal_time The SMC64 calling convention passes a function identifier in w0 and its parameters in x1-x17. Given this, there are two deviations in the SMC64 call performed by the steal_time test: the function identifier is assigned to a 64 bit register and the parameter is only 32 bits wide. Align the call with the SMCCC by using a 32 bit register to handle the function identifier and increasing the parameter width to 64 bits. Suggested-by: Andrew Jones Signed-off-by: Oliver Upton Reviewed-by: Andrew Jones Message-Id: <20210921171121.2148982-3-oupton@google.com> Signed-off-by: Paolo Bonzini commit 90b54129e8df909ccca527b2d69bcb1f0216aa8f Author: Oliver Upton Date: Tue Sep 21 17:11:20 2021 +0000 selftests: KVM: Fix check for !POLLIN in demand_paging_test The logical not operator applies only to the left hand side of a bitwise operator. As such, the check for POLLIN not being set in revents wrong. Fix it by adding parentheses around the bitwise expression. Fixes: 4f72180eb4da ("KVM: selftests: Add demand paging content to the demand paging test") Reviewed-by: Andrew Jones Signed-off-by: Oliver Upton Message-Id: <20210921171121.2148982-2-oupton@google.com> Signed-off-by: Paolo Bonzini commit 03a6e84069d1870f5b3d360e64cb330b66f76dee Author: Sean Christopherson Date: Mon Sep 20 17:02:55 2021 -0700 KVM: x86: Clear KVM's cached guest CR3 at RESET/INIT Explicitly zero the guest's CR3 and mark it available+dirty at RESET/INIT. Per Intel's SDM and AMD's APM, CR3 is zeroed at both RESET and INIT. For RESET, this is a nop as vcpu is zero-allocated. For INIT, the bug has likely escaped notice because no firmware/kernel puts its page tables root at PA=0, let alone relies on INIT to get the desired CR3 for such page tables. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20210921000303.400537-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 7117003fe4e3c8977744f2ad33bb95fd3e10023f Author: Sean Christopherson Date: Mon Sep 20 17:02:54 2021 -0700 KVM: x86: Mark all registers as avail/dirty at vCPU creation Mark all registers as available and dirty at vCPU creation, as the vCPU has obviously not been loaded into hardware, let alone been given the chance to be modified in hardware. On SVM, reading from "uninitialized" hardware is a non-issue as VMCBs are zero allocated (thus not truly uninitialized) and hardware does not allow for arbitrary field encoding schemes. On VMX, backing memory for VMCSes is also zero allocated, but true initialization of the VMCS _technically_ requires VMWRITEs, as the VMX architectural specification technically allows CPU implementations to encode fields with arbitrary schemes. E.g. a CPU could theoretically store the inverted value of every field, which would result in VMREAD to a zero-allocated field returns all ones. In practice, only the AR_BYTES fields are known to be manipulated by hardware during VMREAD/VMREAD; no known hardware or VMM (for nested VMX) does fancy encoding of cacheable field values (CR0, CR3, CR4, etc...). In other words, this is technically a bug fix, but practically speakings it's a glorified nop. Failure to mark registers as available has been a lurking bug for quite some time. The original register caching supported only GPRs (+RIP, which is kinda sorta a GPR), with the masks initialized at ->vcpu_reset(). That worked because the two cacheable registers, RIP and RSP, are generally speaking not read as side effects in other flows. Arguably, commit aff48baa34c0 ("KVM: Fetch guest cr3 from hardware on demand") was the first instance of failure to mark regs available. While _just_ marking CR3 available during vCPU creation wouldn't have fixed the VMREAD from an uninitialized VMCS bug because ept_update_paging_mode_cr0() unconditionally read vmcs.GUEST_CR3, marking CR3 _and_ intentionally not reading GUEST_CR3 when it's available would have avoided VMREAD to a technically-uninitialized VMCS. Fixes: aff48baa34c0 ("KVM: Fetch guest cr3 from hardware on demand") Fixes: 6de4f3ada40b ("KVM: Cache pdptrs") Fixes: 6de12732c42c ("KVM: VMX: Optimize vmx_get_rflags()") Fixes: 2fb92db1ec08 ("KVM: VMX: Cache vmcs segment fields") Fixes: bd31fe495d0d ("KVM: VMX: Add proper cache tracking for CR0") Fixes: f98c1e77127d ("KVM: VMX: Add proper cache tracking for CR4") Fixes: 5addc235199f ("KVM: VMX: Cache vmcs.EXIT_QUALIFICATION using arch avail_reg flags") Fixes: 8791585837f6 ("KVM: VMX: Cache vmcs.EXIT_INTR_INFO using arch avail_reg flags") Signed-off-by: Sean Christopherson Message-Id: <20210921000303.400537-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 2da4a23599c263bd4a7658c2fe561cb3a73ea6ae Author: Sean Christopherson Date: Wed Sep 1 13:30:30 2021 -0700 KVM: selftests: Remove __NR_userfaultfd syscall fallback Revert the __NR_userfaultfd syscall fallback added for KVM selftests now that x86's unistd_{32,63}.h overrides are under uapi/ and thus not in KVM selftests' search path, i.e. now that KVM gets x86 syscall numbers from the installed kernel headers. No functional change intended. Reviewed-by: Ben Gardon Signed-off-by: Sean Christopherson Message-Id: <20210901203030.1292304-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 61e52f1630f54713f5dffa1ab4bb49772235aa5a Author: Sean Christopherson Date: Wed Sep 1 13:30:29 2021 -0700 KVM: selftests: Add a test for KVM_RUN+rseq to detect task migration bugs Add a test to verify an rseq's CPU ID is updated correctly if the task is migrated while the kernel is handling KVM_RUN. This is a regression test for a bug introduced by commit 72c3c0fe54a3 ("x86/kvm: Use generic xfer to guest work function"), where TIF_NOTIFY_RESUME would be cleared by KVM without updating rseq, leading to a stale CPU ID and other badness. Signed-off-by: Sean Christopherson Acked-by: Mathieu Desnoyers Message-Id: <20210901203030.1292304-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit de5f4213dafa8f8b0b52cdaf06bb35ad4cab1681 Author: Sean Christopherson Date: Wed Sep 1 13:30:28 2021 -0700 tools: Move x86 syscall number fallbacks to .../uapi/ Move unistd_{32,64}.h from x86/include/asm to x86/include/uapi/asm so that tools/selftests that install kernel headers, e.g. KVM selftests, can include non-uapi tools headers, e.g. to get 'struct list_head', without effectively overriding the installed non-tool uapi headers. Swapping KVM's search order, e.g. to search the kernel headers before tool headers, is not a viable option as doing results in linux/type.h and other core headers getting pulled from the kernel headers, which do not have the kernel-internal typedefs that are used through tools, including many files outside of selftests/kvm's control. Prior to commit cec07f53c398 ("perf tools: Move syscall number fallbacks from perf-sys.h to tools/arch/x86/include/asm/"), the handcoded numbers were actual fallbacks, i.e. overriding unistd_{32,64}.h from the kernel headers was unintentional. Signed-off-by: Sean Christopherson Message-Id: <20210901203030.1292304-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a68de80f61f6af397bc06fb391ff2e571c9c4d80 Author: Sean Christopherson Date: Wed Sep 1 13:30:27 2021 -0700 entry: rseq: Call rseq_handle_notify_resume() in tracehook_notify_resume() Invoke rseq_handle_notify_resume() from tracehook_notify_resume() now that the two function are always called back-to-back by architectures that have rseq. The rseq helper is stubbed out for architectures that don't support rseq, i.e. this is a nop across the board. Note, tracehook_notify_resume() is horribly named and arguably does not belong in tracehook.h as literally every line of code in it has nothing to do with tracing. But, that's been true since commit a42c6ded827d ("move key_repace_session_keyring() into tracehook_notify_resume()") first usurped tracehook_notify_resume() back in 2012. Punt cleaning that mess up to future patches. No functional change intended. Acked-by: Mathieu Desnoyers Signed-off-by: Sean Christopherson Message-Id: <20210901203030.1292304-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 8646e53633f314e4d746a988240d3b951a92f94a Author: Sean Christopherson Date: Wed Sep 1 13:30:26 2021 -0700 KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest Invoke rseq's NOTIFY_RESUME handler when processing the flag prior to transferring to a KVM guest, which is roughly equivalent to an exit to userspace and processes many of the same pending actions. While the task cannot be in an rseq critical section as the KVM path is reachable only by via ioctl(KVM_RUN), the side effects that apply to rseq outside of a critical section still apply, e.g. the current CPU needs to be updated if the task is migrated. Clearing TIF_NOTIFY_RESUME without informing rseq can lead to segfaults and other badness in userspace VMMs that use rseq in combination with KVM, e.g. due to the CPU ID being stale after task migration. Fixes: 72c3c0fe54a3 ("x86/kvm: Use generic xfer to guest work function") Reported-by: Peter Foley Bisected-by: Doug Evans Acked-by: Mathieu Desnoyers Cc: Shakeel Butt Cc: Thomas Gleixner Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20210901203030.1292304-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit b78f26926b17cc289e4f16b63363abe0aa2e8efc Author: Marc Zyngier Date: Fri Sep 10 18:29:25 2021 +0100 irqchip/gic: Work around broken Renesas integration Geert reported that the GIC driver locks up on a Renesas system since 005c34ae4b44f085 ("irqchip/gic: Atomically update affinity") fixed the driver to use writeb_relaxed() instead of writel_relaxed(). As it turns out, the interconnect used on this system mandates 32bit wide accesses for all MMIO transactions, even if the GIC architecture specifically mandates for some registers to be byte accessible. Gahhh... Work around the issue by crudly detecting the offending system, and falling back to an inefficient RMW+lock implementation. Reported-by: Geert Uytterhoeven Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/CAMuHMdV+Ev47K5NO8XHsanSq5YRMCHn2gWAQyV-q2LpJVy9HiQ@mail.gmail.com commit 977d293e23b48a1129830d7968605f61c4af71a0 Author: Paolo Abeni Date: Wed Sep 22 13:12:17 2021 +0200 mptcp: ensure tx skbs always have the MPTCP ext Due to signed/unsigned comparison, the expression: info->size_goal - skb->len > 0 evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache refill, so that the skb allocated by the core TCP code lacks the required MPTCP skb extensions. Due to the above, syzbot is able to trigger the following WARN_ON(): WARNING: CPU: 1 PID: 810 at net/mptcp/protocol.c:1366 mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Modules linked in: CPU: 1 PID: 810 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:mptcp_sendmsg_frag+0x1362/0x1bc0 net/mptcp/protocol.c:1366 Code: ff 4c 8b 74 24 50 48 8b 5c 24 58 e9 0f fb ff ff e8 13 44 8b f8 4c 89 e7 45 31 ed e8 98 57 2e fe e9 81 f4 ff ff e8 fe 43 8b f8 <0f> 0b 41 bd ea ff ff ff e9 6f f4 ff ff 4c 89 e7 e8 b9 8e d2 f8 e9 RSP: 0018:ffffc9000531f6a0 EFLAGS: 00010216 RAX: 000000000000697f RBX: 0000000000000000 RCX: ffffc90012107000 RDX: 0000000000040000 RSI: ffffffff88eac9e2 RDI: 0000000000000003 RBP: ffff888078b15780 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff88eac017 R11: 0000000000000000 R12: ffff88801de0a280 R13: 0000000000006b58 R14: ffff888066278280 R15: ffff88803c2fe9c0 FS: 00007fd9f866e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faebcb2f718 CR3: 00000000267cb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __mptcp_push_pending+0x1fb/0x6b0 net/mptcp/protocol.c:1547 mptcp_release_cb+0xfe/0x210 net/mptcp/protocol.c:3003 release_sock+0xb4/0x1b0 net/core/sock.c:3206 sk_stream_wait_memory+0x604/0xed0 net/core/stream.c:145 mptcp_sendmsg+0xc39/0x1bc0 net/mptcp/protocol.c:1749 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:643 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x2a0/0x3e0 net/socket.c:1057 call_write_iter include/linux/fs.h:2163 [inline] new_sync_write+0x40b/0x640 fs/read_write.c:507 vfs_write+0x7cf/0xae0 fs/read_write.c:594 ksys_write+0x1ee/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9f866e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 RDX: 00000000000e7b78 RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c038 R13: 0000000000a9fb1f R14: 00007fd9f866e300 R15: 0000000000022000 Fix the issue rewriting the relevant expression to avoid sign-related problems - note: size_goal is always >= 0. Additionally, ensure that the skb in the tx cache always carries the relevant extension. Reported-and-tested-by: syzbot+263a248eec3e875baa7b@syzkaller.appspotmail.com Fixes: 1094c6fe7280 ("mptcp: fix possible divide by zero") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 1ea7812326004afd2803cc968a4776ae5120a597 Author: Shai Malin Date: Wed Sep 22 13:53:26 2021 +0300 qed: rdma - don't wait for resources under hw error recovery flow If the HW device is during recovery, the HW resources will never return, hence we shouldn't wait for the CID (HW context ID) bitmaps to clear. This fix speeds up the error recovery flow. Fixes: 64515dc899df ("qed: Add infrastructure for error detection and recovery") Signed-off-by: Michal Kalderon Signed-off-by: Ariel Elior Signed-off-by: Shai Malin Signed-off-by: David S. Miller commit 3ce8c70ecedb4e1f1d36301afb0281be40390f13 Author: Geert Uytterhoeven Date: Wed Sep 15 11:47:30 2021 +0200 irqchip/renesas-rza1: Use semicolons instead of commas This code works, but it is cleaner to use semicolons at the end of statements instead of commas. Extracted from a big anonymous patch by Julia Lawall . Signed-off-by: Geert Uytterhoeven Reviewed-by: Ulrich Hecht Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/b1710bb6ea5faa7a7fe74404adb0beb951e0bf8c.1631699160.git.geert+renesas@glider.be commit 280bef512933b2dda01d681d8cbe499b98fc5bdd Author: Kaige Fu Date: Wed Sep 15 10:20:55 2021 +0800 irqchip/gic-v3-its: Fix potential VPE leak on error In its_vpe_irq_domain_alloc, when its_vpe_init() returns an error, there is an off-by-one in the number of VPEs to be freed. Fix it by simply passing the number of VPEs allocated, which is the index of the loop iterating over the VPEs. Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Kaige Fu [maz: fixed commit message] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/d9e36dee512e63670287ed9eff884a5d8d6d27f2.1631672311.git.kaige.fu@linux.alibaba.com commit 969ac78db78c723a24e9410666b457cc1b0cb3c3 Author: Randy Dunlap Date: Sun Sep 5 09:25:19 2021 -0700 irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build irq-goldfish-pic uses GENERIC_IRQ_CHIP interfaces so select that symbol to fix build errors. Fixes these build errors: mips-linux-ld: drivers/irqchip/irq-goldfish-pic.o: in function `goldfish_pic_of_init': irq-goldfish-pic.c:(.init.text+0xc0): undefined reference to `irq_alloc_generic_chip' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0xf4): undefined reference to `irq_gc_unmask_enable_reg' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0xf8): undefined reference to `irq_gc_unmask_enable_reg' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x100): undefined reference to `irq_gc_mask_disable_reg' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x104): undefined reference to `irq_gc_mask_disable_reg' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x11c): undefined reference to `irq_setup_generic_chip' mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x168): undefined reference to `irq_remove_generic_chip' Fixes: 4235ff50cf98 ("irqchip/irq-goldfish-pic: Add Goldfish PIC driver") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Miodrag Dinic Cc: Geert Uytterhoeven Cc: Bartosz Golaszewski Cc: Thomas Gleixner Cc: Marc Zyngier Cc: Goran Ferenc Cc: Aleksandar Markovic Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210905162519.21507-1-rdunlap@infradead.org commit b99948836162b0cfb03007d9b2c2da9babc057b5 Author: Randy Dunlap Date: Sat Sep 4 20:36:44 2021 -0700 irqchip/mbigen: Repair non-kernel-doc notation Fix kernel-doc warnings in irq-mbigen.c: irq-mbigen.c:29: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * In mbigen vector register irq-mbigen.c:43: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * offset of clear register in mbigen node irq-mbigen.c:50: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * offset of interrupt type register Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Jun Ma Cc: Yun Wu Cc: Thomas Gleixner Cc: Marc Zyngier Cc: Aditya Srivastava Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210905033644.15988-1-rdunlap@infradead.org commit 20c36ce2164f1774b487d443ece99b754bc6ad43 Author: Bixuan Cui Date: Thu Sep 16 10:52:03 2021 +0800 irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent The 'size' is used in struct_size(domain, revmap, size) and its input parameter type is 'size_t'(unsigned int). Changing the size to 'unsigned int' to make the type consistent. Signed-off-by: Bixuan Cui Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210916025203.44841-1-cuibixuan@huawei.com commit 2a7313dc81e88adc7bb09d0f056985fa8afc2b89 Author: Marc Zyngier Date: Wed Sep 22 14:19:41 2021 +0100 irqchip/armada-370-xp: Fix ack/eoi breakage When converting the driver to using handle_percpu_devid_irq, we forgot to repaint the irq_eoi() callback into irq_ack(), as handle_percpu_devid_fasteoi_ipi() was actually using EOI really early in the handling. Yes this was a stupid idea. Fix this by using the HW ack method as irq_ack(). Fixes: e52e73b7e9f7 ("irqchip/armada-370-xp: Make IPIs use handle_percpu_devid_irq()") Reported-by: Steffen Trumtrar Tested-by: Steffen Trumtrar Signed-off-by: Marc Zyngier Cc: Valentin Schneider Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87tuiexq5f.fsf@pengutronix.de commit 372d1f3e1bfede719864d0d1fbf3146b1e638c88 Author: Dan Carpenter Date: Tue Sep 21 23:32:33 2021 +0300 ext2: fix sleeping in atomic bugs on error The ext2_error() function syncs the filesystem so it sleeps. The caller is holding a spinlock so it's not allowed to sleep. ext2_statfs() <- disables preempt -> ext2_count_free_blocks() -> ext2_get_group_desc() Fix this by using WARN() to print an error message and a stack trace instead of using ext2_error(). Link: https://lore.kernel.org/r/20210921203233.GA16529@kili Signed-off-by: Dan Carpenter Signed-off-by: Jan Kara commit b22a4705e2e60f342b1b851c9ebdb3ea02f21f8f Author: Heiko Stuebner Date: Tue Sep 14 00:49:24 2021 +0200 gpio/rockchip: fix get_direction value handling The function uses the newly introduced rockchip_gpio_readl_bit() which directly returns the actual value of the requeste bit. So using the existing bit-wise check for the bit inside the value will always return 0. Fix this by dropping the bit manipulation on the result. Fixes: 3bcbd1a85b68 ("gpio/rockchip: support next version gpio controller") Signed-off-by: Heiko Stuebner Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 0f562b7de99085935d76b00c41ab5caa26ff5c74 Author: Heiko Stuebner Date: Tue Sep 14 00:49:23 2021 +0200 gpio/rockchip: extended debounce support is only available on v2 The gpio driver runs into issues on v1 gpio blocks, as the db_clk and the whole extended debounce support is only ever defined on v2. So checking for the IS_ERR on the db_clk is not enough, as it will be NULL on v1. Fix this by adding the needed condition for v2 first before checking the existence of the db_clk. This caused my rk3288-veyron-pinky to enter a reboot loop when it tried to enable the power-key as adc-key device. Fixes: 3bcbd1a85b68 ("gpio/rockchip: support next version gpio controller") Signed-off-by: Heiko Stuebner Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit f6c35df22708438c94605b8896d2b4e4d5f342a3 Author: Steven Lee Date: Tue Sep 7 17:55:25 2021 +0800 gpio: gpio-aspeed-sgpio: Fix wrong hwirq in irq handler. The current hwirq is calculated based on the old GPIO pin order(input GPIO range is from 0 to ngpios - 1). It should be calculated based on the current GPIO input pin order(input GPIOs are 0, 2, 4, ..., (ngpios - 1) * 2). Signed-off-by: Steven Lee Signed-off-by: Bartosz Golaszewski commit 2dd824cca3407bc9a2bd11b00f6e117b66fcfcf1 Author: Kunihiko Hayashi Date: Thu Sep 16 20:19:35 2021 +0900 gpio: uniphier: Fix void functions to remove return value The return type of irq_chip.irq_mask() and irq_chip.irq_unmask() should be void. Fixes: dbe776c2ca54 ("gpio: uniphier: add UniPhier GPIO controller driver") Signed-off-by: Kunihiko Hayashi Signed-off-by: Bartosz Golaszewski commit cef0d022f55364d69017daeb9443bd31510ad6a2 Author: Hans de Goede Date: Mon Aug 16 12:41:19 2021 +0200 gpiolib: acpi: Make set-debounce-timeout failures non fatal Commit 8dcb7a15a585 ("gpiolib: acpi: Take into account debounce settings") made the gpiolib-acpi code call gpio_set_debounce_timeout() when requesting GPIOs. This in itself is fine, but it also made gpio_set_debounce_timeout() errors fatal, causing the requesting of the GPIO to fail. This is causing regressions. E.g. on a HP ElitePad 1000 G2 various _AEI specified GPIO ACPI event sources specify a debouncy timeout of 20 ms, but the pinctrl-baytrail.c only supports certain fixed values, the closest ones being 12 or 24 ms and pinctrl-baytrail.c responds with -EINVAL when specified a value which is not one of the fixed values. This is causing the acpi_request_own_gpiod() call to fail for 3 ACPI event sources on the HP ElitePad 1000 G2, which in turn is causing e.g. the battery charging vs discharging status to never get updated, even though a charger has been plugged-in or unplugged. Make gpio_set_debounce_timeout() errors non fatal, warning about the failure instead, to fix this regression. Note we should probably also fix various pinctrl drivers to just pick the first bigger discrete value rather then returning -EINVAL but this will need to be done on a per driver basis, where as this fix at least gets us back to where things were before and thus restores functionality on devices where this was lost due to gpio_set_debounce_timeout() errors. Fixes: 8dcb7a15a585 ("gpiolib: acpi: Take into account debounce settings") Depends-on: 2e2b496cebef ("gpiolib: acpi: Extract acpi_request_own_gpiod() helper") Reviewed-by: Mika Westerberg Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit c54467482ffd407a4404c990697f432bfcb6cdc4 Author: Marcel Ziswiler Date: Mon Sep 20 16:49:31 2021 +0200 ARM: imx_v6_v7_defconfig: enable fb Enable CONFIG_FB which is nowadays required for CONFIG_DRM_PANEL_LVDS, CONFIG_DRM_PANEL_SIMPLE, CONFIG_DRM_PANEL_SEIKO_43WVF1G, CONFIG_FB_MODE_HELPERS, CONFIG_BACKLIGHT_PWM, CONFIG_BACKLIGHT_GPIO, CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_LOGO, CONFIG_FONTS, CONFIG_FONT_8x8 and CONFIG_FONT_8x16. Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") Reviewed-by: Fabio Estevam Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo commit 450e7fe9b1b3c90eeed74a2fe0eeb13a7b57f3da Author: Fabio Estevam Date: Tue Sep 14 14:17:15 2021 -0300 ARM: dts: imx6qdl-pico: Fix Ethernet support Currently, it is no longer possible to retrieve a DHCP address on the imx6qdl-pico board. This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q: remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs"). Fix it by describing the qca,clk-out-frequency property as suggested by the commit above. Fixes: 98670a0bb0ef14bbb3 ("ARM: dts: imx6qdl: Add imx6qdl-pico support") Signed-off-by: Fabio Estevam Reviewed-by: Andrew Lunn Signed-off-by: Shawn Guo commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e Author: Marek Vasut Date: Sun Sep 5 02:01:37 2021 +0200 ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo The MIC2025 switch input signal nEN is active low, describe it as such in the DT. The previous change to this regulator polarity was incorrectly influenced by broken quirks in gpiolib-of.c, which is now long fixed. So fix this regulator polarity setting here once and for all. Fixes: 3c3601cd6a6d3 ("ARM: dts: imx53: Update USB configuration on M53Menlo") Signed-off-by: Marek Vasut Cc: Shawn Guo Cc: Fabio Estevam Cc: NXP Linux Team Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 22d65765f211cc83186fd8b87521159f354c0da9 Author: Andrej Shadura Date: Thu Sep 16 17:33:11 2021 +0100 HID: u2fzero: ignore incomplete packets without data Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437 Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura Signed-off-by: Jiri Kosina commit f7d848e0fdfa557f181955a769cbb163d54fd292 Author: Jiri Slaby Date: Wed Sep 22 08:30:08 2021 +0200 MAINTAINERS: usb, update Peter Korsgaard's entries Peter's e-mail in MAINTAINERS is defunct: This is the qmail-send program at a.mx.sunsite.dk. : Sorry, no mailbox here by that name. (#5.1.1) Peter says: ** Ahh yes, it should be changed to peter@korsgaard.com. However he also says: ** I haven't had access to c67x00 hw for quite some years though, so maybe ** it should be marked Orphan instead? So change as he wishes. Cc: Peter Korsgaard Cc: Linus Torvalds Cc: linux-usb@vger.kernel.org Acked-by: Peter Korsgaard Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20210922063008.25758-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 Author: Marek Vasut Date: Sun Sep 5 02:00:48 2021 +0200 ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo The panel already contains pinctrl-0 phandle, but it is missing the default pinctrl-names property, so the pin configuration is ignored. Fill in the missing pinctrl-names property, so the pin configuration is applied. Fixes: d81765d693db6 ("ARM: dts: imx53: Update LCD panel node on M53Menlo") Signed-off-by: Marek Vasut Cc: Shawn Guo Cc: Fabio Estevam Cc: NXP Linux Team Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit fbdac19e642899455b4e64c63aafe2325df7aafa Author: Wen Xiong Date: Thu Sep 16 22:24:21 2021 -0500 scsi: ses: Retry failed Send/Receive Diagnostic commands Setting SCSI logging level with error=3, we saw some errors from enclosues: [108017.360833] ses 0:0:9:0: tag#641 Done: NEEDS_RETRY Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [108017.360838] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00 [108017.427778] ses 0:0:9:0: Power-on or device reset occurred [108017.427784] ses 0:0:9:0: tag#641 Done: SUCCESS Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [108017.427788] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00 [108017.427791] ses 0:0:9:0: tag#641 Sense Key : Unit Attention [current] [108017.427793] ses 0:0:9:0: tag#641 Add. Sense: Bus device reset function occurred [108017.427801] ses 0:0:9:0: Failed to get diagnostic page 0x1 [108017.427804] ses 0:0:9:0: Failed to bind enclosure -19 [108017.427895] ses 0:0:10:0: Attached Enclosure device [108017.427942] ses 0:0:10:0: Attached scsi generic sg18 type 13 Retry if the Send/Receive Diagnostic commands complete with a transient error status (NOT_READY or UNIT_ATTENTION with ASC 0x29). Link: https://lore.kernel.org/r/1631849061-10210-2-git-send-email-wenxiong@linux.ibm.com Reviewed-by: Brian King Reviewed-by: James Bottomley Signed-off-by: Wen Xiong Signed-off-by: Martin K. Petersen commit 9a8ef2c73c727a3c64b70c01697c578c7b10fed2 Author: Colin Ian King Date: Mon Sep 20 19:32:06 2021 +0100 scsi: target: Fix spelling mistake "CONFLIFT" -> "CONFLICT" There is a spelling mistake in a dev_err message. Fix it. Link: https://lore.kernel.org/r/20210920183206.17477-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit a38923f2d088d1a5cbaa86818abe039b2f87093d Author: Arnd Bergmann Date: Mon Sep 20 11:56:22 2021 +0200 scsi: lpfc: Fix gcc -Wstringop-overread warning, again I fixed a stringop-overread warning earlier this year, now a second copy of the original code was added and the warning came back: drivers/scsi/lpfc/lpfc_attr.c: In function 'lpfc_cmf_info_show': drivers/scsi/lpfc/lpfc_attr.c:289:25: error: 'strnlen' specified bound 4095 exceeds source size 24 [-Werror=stringop-overread] 289 | strnlen(LPFC_INFO_MORE_STR, PAGE_SIZE - 1), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix it the same way as the other copy. Link: https://lore.kernel.org/r/20210920095628.1191676-1-arnd@kernel.org Fixes: ada48ba70f6b ("scsi: lpfc: Fix gcc -Wstringop-overread warning") Fixes: 74a7baa2a3ee ("scsi: lpfc: Add cmf_info sysfs entry") Reviewed-by: James Smart Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen commit 6dacc371b77f473770ec646e220303a84fe96c11 Author: Dan Carpenter Date: Thu Sep 16 16:23:31 2021 +0300 scsi: lpfc: Use correct scnprintf() limit The limit should be "PAGE_SIZE - len" instead of "PAGE_SIZE". We're not going to hit the limit so this fix will not affect runtime. Link: https://lore.kernel.org/r/20210916132331.GE25094@kili Fixes: 5b9e70b22cc5 ("scsi: lpfc: raise sg count for nvme to use available sg resources") Reviewed-by: James Smart Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit cdbc16c552f27ac211a44f9959d813b4f3188223 Author: Dan Carpenter Date: Thu Sep 16 16:22:51 2021 +0300 scsi: lpfc: Fix sprintf() overflow in lpfc_display_fpin_wwpn() This scnprintf() uses the wrong limit. It should be "LPFC_FPIN_WWPN_LINE_SZ - len" instead of LPFC_FPIN_WWPN_LINE_SZ. Link: https://lore.kernel.org/r/20210916132251.GD25094@kili Fixes: 428569e66fa7 ("scsi: lpfc: Expand FPIN and RDF receive logging") Reviewed-by: James Smart Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit a4869faf9642518145a8aa4b52e0d5ab0e7ee896 Author: Hannes Reinecke Date: Wed Sep 15 17:07:15 2021 +0800 scsi: core: Remove 'current_tag' The 'current_tag' field in struct scsi_device is unused now; remove it. Link: https://lore.kernel.org/r/1631696835-136198-4-git-send-email-john.garry@huawei.com Reviewed-by: Bart Van Assche Signed-off-by: Hannes Reinecke Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 756fb6a895afbf1f0615d93ebdd14863a00b1198 Author: Hannes Reinecke Date: Wed Sep 15 17:07:14 2021 +0800 scsi: acornscsi: Remove tagged queuing vestiges The acornscsi driver has a config option to enable tagged queuing, but this option gets disabled in the driver itself with the comment 'needs to be debugged'. As this is a _really_ old driver I doubt anyone will be wanting to invest time here, so remove the tagged queue vestiges and make our lives easier. [jpg: Use scsi_cmd_to_rq()] Link: https://lore.kernel.org/r/1631696835-136198-3-git-send-email-john.garry@huawei.com Signed-off-by: Hannes Reinecke Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit bc41fcbffd5759c9610f7de211420eae6b379503 Author: Hannes Reinecke Date: Wed Sep 15 17:07:13 2021 +0800 scsi: fas216: Kill scmd->tag The driver is attempting to allocate a tag internally which is a no-go with blk-mq. Switch the driver to use the request tag and kill usage of scmd->tag and scmd->device->current_tag. [jpg: Change to use scsi_cmd_to_rq()] Link: https://lore.kernel.org/r/1631696835-136198-2-git-send-email-john.garry@huawei.com Signed-off-by: Hannes Reinecke Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 5f8579038842d77e6ce05e1df6bf9dd493b0e3ef Author: Dmitry Bogdanov Date: Wed Sep 15 18:32:39 2021 +0300 scsi: qla2xxx: Restore initiator in dual mode In dual mode in case of disabling the target, the whole port goes offline and initiator is turned off too. Fix restoring initiator mode after disabling target in dual mode. Link: https://lore.kernel.org/r/20210915153239.8035-1-d.bogdanov@yadro.com Fixes: 0645cb8350cd ("scsi: qla2xxx: Add mode control for each physical port") Reviewed-by: Himanshu Madhani Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit d04a968c33684b15d1206e23fc1119ce0f0587fb Author: Bart Van Assche Date: Thu Sep 16 10:54:04 2021 -0700 scsi: ufs: core: Unbreak the reset handler A command tag is passed as the second argument of the __ufshcd_transfer_req_compl() call in ufshcd_eh_device_reset_handler() instead of a bitmask. Fix this by passing a bitmask as argument instead of a command tag. Link: https://lore.kernel.org/r/20210916175408.2260084-1-bvanassche@acm.org Fixes: a45f937110fa ("scsi: ufs: Optimize host lock on transfer requests send/compl paths") Cc: Can Guo Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 1d479e6c9cb2b40abfb455863a4e9335db882e33 Author: Bart Van Assche Date: Fri Sep 17 14:23:14 2021 -0700 scsi: sd_zbc: Support disks with more than 2**32 logical blocks This patch addresses the following Coverity report about the zno * sdkp->zone_blocks expression: CID 1475514 (#1 of 1): Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN) overflow_before_widen: Potentially overflowing expression zno * sdkp->zone_blocks with type unsigned int (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type sector_t (64 bits, unsigned). Link: https://lore.kernel.org/r/20210917212314.2362324-1-bvanassche@acm.org Fixes: 5795eb443060 ("scsi: sd_zbc: emulate ZONE_APPEND commands") Cc: Johannes Thumshirn Cc: Damien Le Moal Cc: Hannes Reinecke Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Himanshu Madhani Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 4497b40ca8217fce9f33c9886f5a1b0408661e03 Author: Fabio Estevam Date: Mon Sep 20 20:43:11 2021 -0300 Revert "ARM: imx6q: drop of_platform_default_populate() from init_machine" This reverts commit cc8870bf4c3ab0af385538460500a9d342ed945f. Since commit cc8870bf4c3a ("ARM: imx6q: drop of_platform_default_populate() from init_machine") the following errors are seen on boot: [ 0.123372] imx6q_suspend_init: failed to find ocram device! [ 0.123537] imx6_pm_common_init: No DDR LPM support with suspend -19! , which break suspend/resume on imx6q/dl. Revert the offeding commit to avoid the regression. Thanks to Tim Harvey for bisecting this problem. Cc: stable@vger.kernel.org Fixes: cc8870bf4c3a ("ARM: imx6q: drop of_platform_default_populate() from init_machine") Signed-off-by: Fabio Estevam Acked-by: Russell King (Oracle) Signed-off-by: Shawn Guo commit 88b099006d83b0bf452379cad4ce494329084726 Author: Adrian Hunter Date: Fri Sep 17 17:43:49 2021 +0300 scsi: ufs: core: Revert "scsi: ufs: Synchronize SCSI and UFS error handling" This reverts commit a113eaaf86373362b053279049907ff82b5df6c8. There are a couple of issues with the commit: 1. It causes deadlocks. 2. It causes the shost->eh_cmd_q list of failed requests not to be processed, ever. So revert it. 1. Deadlocks The SCSI error handler runs with requests blocked beginning when scsi_schedule_eh() sets SHOST_RECOVERY state, continuing through scsi_error_handler() callback ->eh_strategy_handler() until scsi_restart_operations() is called. By setting eh_strategy_handler to ufshcd_err_handler, the patch changed the UFS error handler to run with requests blocked, including PM requests, for the entire run of the error handler. That conflicts with UFS error handler existing synchronization with UFS device PM operations. The UFS error handler synchronizes with runtime PM by doing pm_runtime_get_sync() prior to blocking requests itself. It synchronizes with system PM by use of hba->host_sem, again before blocking requests itself. However, if requests are already blocked, then PM operations will block. So: the UFS error handler blocks waiting on PM + PM blocks waiting on SCSI PM requests to process or fail + PM requests are blocked waiting on error handling to finish = deadlock This happens both for runtime PM and system PM. Prior to the patch, these deadlocks could not happen even if SCSI error handling was running, because the presence of requests in shost->eh_cmd_q would mean the queues could not be suspended, which would mean that, should the UFS error handler run at the same time, it would not need to wait for PM or vice versa. Please note these scenarios are not just theoretical, they were found during testing on a Samsung Galaxy Book S. 2. ->eh_strategy_handler() must process shost->eh_cmd_q list of failed requests, as all other eh_strategy_handler's do except UFS error handler. Refer for example: scsi_unjam_host(), ata_scsi_error() and sas_scsi_recover_host(). Link: https://lore.kernel.org/r/20210917144349.14058-1-adrian.hunter@intel.com Fixes: a113eaaf8637 ("scsi: ufs: Synchronize SCSI and UFS error handling") Reviewed-by: Bart Van Assche Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit 9b663b34c94a78f39fa2c7a8271b1f828b546e16 Author: Michal Vokáč Date: Wed Aug 18 09:02:08 2021 +0200 ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe Since the LED multicolor framework support was added in commit 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") LEDs on this platform stopped working. Author of the framework attempted to accommodate this DT to the framework in commit b86d3d21cd4c ("ARM: dts: imx6dl-yapp4: Add reg property to the lp5562 channel node") but that is not sufficient. A color property is now required even if the multicolor framework is not used, otherwise the driver probe fails: lp5562: probe of 1-0030 failed with error -22 Add the color property to fix this. Fixes: 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") Cc: Cc: linux-leds@vger.kernel.org Signed-off-by: Michal Vokáč Acked-by: Pavel Machek Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit b52d3161c23f8944a4050874d3556c8ed148927f Merge: b3f98404bd629 d2b59bd4b06d8 Author: Jakub Kicinski Date: Tue Sep 21 20:02:27 2021 -0700 Merge branch 's390-qeth-fixes-2021-09-21' Julian Wiedmann says: ==================== s390/qeth: fixes 2021-09-21 This brings two fixes for deadlocks when a device is removed while it has certain types of async work pending. And one additional fix for a missing NULL check in an error case. ==================== Link: https://lore.kernel.org/r/20210921145217.1584654-1-jwi@linux.ibm.com Signed-off-by: Jakub Kicinski commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 Author: Alexandra Winter Date: Tue Sep 21 16:52:17 2021 +0200 s390/qeth: fix deadlock during failing recovery Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside qeth_do_reset(), fixing potential deadlocks. An error path was missed though, that still takes discipline_mutex and thus has the original deadlock potential. Intermittent deadlocks were seen when a qeth channel path is configured offline, causing a race between qeth_do_reset and ccwgroup_remove. Call qeth_set_offline() directly in the qeth_do_reset() error case and then a new variant of ccwgroup_set_offline(), without taking discipline_mutex. Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") Signed-off-by: Alexandra Winter Reviewed-by: Julian Wiedmann Signed-off-by: Julian Wiedmann Signed-off-by: Jakub Kicinski commit ee909d0b1dac8632eeb78cbf17661d6c7674bbd0 Author: Alexandra Winter Date: Tue Sep 21 16:52:16 2021 +0200 s390/qeth: Fix deadlock in remove_discipline Problem: qeth_close_dev_handler is a worker that tries to acquire card->discipline_mutex via drv->set_offline() in ccwgroup_set_offline(). Since commit b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") qeth_remove_discipline() is called under card->discipline_mutex and cancels the work and waits for it to finish. STOPLAN reception with reason code IPA_RC_VEPA_TO_VEB_TRANSITION is the only situation that schedules close_dev_work. In that situation scheduling qeth recovery will also result in an offline interface, when resetting the isolation mode fails, if the external switch is still set to VEB. And since commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") qeth recovery does not aquire card->discipline_mutex anymore. So we accept the longer pathlength of qeth_schedule_recovery in this error situation and re-use the existing function. As a side-benefit this changes the hwtrap to behave like during recovery instead of like during a user-triggered set_offline. Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") Signed-off-by: Alexandra Winter Acked-by: Julian Wiedmann Signed-off-by: Julian Wiedmann Signed-off-by: Jakub Kicinski commit 248f064af222a1f97ee02c84a98013dfbccad386 Author: Julian Wiedmann Date: Tue Sep 21 16:52:15 2021 +0200 s390/qeth: fix NULL deref in qeth_clear_working_pool_list() When qeth_set_online() calls qeth_clear_working_pool_list() to roll back after an error exit from qeth_hardsetup_card(), we are at risk of accessing card->qdio.in_q before it was allocated by qeth_alloc_qdio_queues() via qeth_mpc_initialize(). qeth_clear_working_pool_list() then dereferences NULL, and by writing to queue->bufs[i].pool_entry scribbles all over the CPU's lowcore. Resulting in a crash when those lowcore areas are used next (eg. on the next machine-check interrupt). Such a scenario would typically happen when the device is first set online and its queues aren't allocated yet. An early IO error or certain misconfigs (eg. mismatched transport mode, bad portno) then cause us to error out from qeth_hardsetup_card() with card->qdio.in_q still being NULL. Fix it by checking the pointer for NULL before accessing it. Note that we also have (rare) paths inside qeth_mpc_initialize() where a configuration change can cause us to free the existing queues, expecting that subsequent code will allocate them again. If we then error out before that re-allocation happens, the same bug occurs. Fixes: eff73e16ee11 ("s390/qeth: tolerate pre-filled RX buffer") Reported-by: Stefan Raspl Root-caused-by: Heiko Carstens Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Signed-off-by: Jakub Kicinski commit e946d3c887a9dc33aa82a349c6284f4a084163f4 Author: Dan Carpenter Date: Tue Sep 21 23:33:35 2021 +0300 cifs: fix a sign extension bug The problem is the mismatched types between "ctx->total_len" which is an unsigned int, "rc" which is an int, and "ctx->rc" which is a ssize_t. The code does: ctx->rc = (rc == 0) ? ctx->total_len : rc; We want "ctx->rc" to store the negative "rc" error code. But what happens is that "rc" is type promoted to a high unsigned int and 'ctx->rc" will store the high positive value instead of a negative value. The fix is to change "rc" from an int to a ssize_t. Fixes: c610c4b619e5 ("CIFS: Add asynchronous write support through kernel AIO") Signed-off-by: Dan Carpenter Signed-off-by: Steve French commit 96c8395e2166efa86082f3b71567ffd84936439b Author: Mark Brown Date: Tue Sep 21 15:44:06 2021 +0100 spi: Revert modalias changes During the v5.13 cycle we updated the SPI subsystem to generate OF style modaliases for SPI devices, replacing the old Linux style modalises we used to generate based on spi_device_id which are the DT style name with the vendor removed. Unfortunately this means that we start only reporting OF style modalises and not the old ones and there is nothing that ensures that drivers list every possible OF compatible string in their OF ID table. The result is that there are systems which have been relying on loading modules based on the old style that are now broken, as found by Russell King with spi-nor on Macchiatobin. spi-nor is a particularly problematic case for this, it only lists a single generic DT compatible jedec,spi-nor in the driver but supports a huge raft of device specific compatibles, with a large set of part numbers many of which are offered by multiple vendors. Russell's searches of upstream device trees has turned up examples with vendor names written in non-standard ways too. To make matters worse up until 8ff16cf77ce3 ("Documentation: devicetree: m25p80: add "nor-jedec" binding") the generic compatible was not part of the binding so there are device trees out there written to that binding version which don't list it all. The sheer number of parts supported together with our previous approach of ignoring the vendor ID makes robustly fixing this by adding compatibles to the spi-nor driver seem problematic, the current DT binding document does not list all the parts supported by the driver at the minute (further patches will fix this). I've also investigated supporting both formats of modalias simultaneously but that doesn't seem possible, especially without breaking our userspace ABI which is obviously not viable. Instead revert the relevant changes for now: e09f2ab8eecc ("spi: update modalias_show after of_device_uevent_modalias support") 3ce6c9e2617e ("spi: add of_device_uevent_modalias support") This will unfortunately mean that any system which had started having modules autoload based on the OF compatibles for drivers that list things there but not in the spi_device_ids will now not have those modules load which is itself a regression. Since it affects a narrower time window and the particularly problematic spi-nor driver may be critical to system boot on smaller systems this seems the best of a series of bad options. I will start an audit of SPI drivers to identify and fix cases where things won't autoload using spi_device_id, this is not great but seems to be the best way forward that anyone has been able to identify. Thanks to Russell for both his report and the additional diagnostic and analysis work he has done here, the detailed research above was his work. Fixes: e09f2ab8eecc ("spi: update modalias_show after of_device_uevent_modalias support") Fixes: 3ce6c9e2617e ("spi: add of_device_uevent_modalias support") Reported-by: Russell King (Oracle) Suggested-by: Russell King (Oracle) Signed-off-by: Mark Brown Tested-by: Russell King (Oracle) Cc: Andreas Schwab Cc: Marco Felsch commit 9f6323311c7064414bfd1edb28e0837baf6b3c7f Author: Namjae Jeon Date: Sat Sep 18 21:02:39 2021 +0900 ksmbd: add default data stream name in FILE_STREAM_INFORMATION Windows client expect to get default stream name(::DATA) in FILE_STREAM_INFORMATION response even if there is no stream data in file. This patch fix update failure when writing ppt or doc files. Signed-off-by: Namjae Jeon Reviewed-By: Tom Talpey Signed-off-by: Steve French commit e44fd5081c50b0ffdb75ce6c83452e60173d791b Author: Steve French Date: Mon Sep 20 19:01:42 2021 -0500 ksmbd: log that server is experimental at module load While we are working through detailed security reviews of ksmbd server code we should remind users that it is an experimental module by adding a warning when the module loads. Currently the module shows as experimental in Kconfig and is disabled by default, but we don't want to confuse users. Although ksmbd passes a wide variety of the important functional tests (since initial focus had been largely on functional testing such as smbtorture, xfstests etc.), and ksmbd has added key security features (e.g. GCM256 encryption, Kerberos support), there are ongoing detailed reviews of the code base for path processing and network buffer decoding, and this patch reminds users that the module should be considered "experimental." Reviewed-by: Namjae Jeon Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 0e3dbf765fe22060acbcb8eb8c4d256e655a1247 Author: Cristian Marussi Date: Mon Sep 20 13:12:28 2021 +0100 kselftest/arm64: signal: Skip tests if required features are missing During initialization of a signal testcase, features declared as required are properly checked against the running system but no action is then taken to effectively skip such a testcase. Fix core signals test logic to abort initialization and report such a testcase as skipped to the KSelfTest framework. Fixes: f96bf4340316 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils") Signed-off-by: Cristian Marussi Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20210920121228.35368-1-cristian.marussi@arm.com Signed-off-by: Catalin Marinas commit cb1bcf5ed536747013fe2b3f9bd56ce3242c295a Author: Takashi Sakamoto Date: Mon Sep 20 20:07:34 2021 +0900 ALSA: firewire-motu: fix truncated bytes in message tracepoints In MOTU protocol v2/v3, first two data chunks across 2nd and 3rd data channels includes message bytes from device. The total size of message is 48 bits per data block. The 'data_block_message' tracepoints event produced by ALSA firewire-motu driver exposes the sequence of messages to userspace in 64 bit storage, however lower 32 bits are actually available since current implementation truncates 16 bits in upper of the message as a result of bit shift operation within 32 bit storage. This commit fixes the bug by perform the bit shift in 64 bit storage. Fixes: c6b0b9e65f09 ("ALSA: firewire-motu: add tracepoints for messages for unique protocol") Cc: Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20210920110734.27161-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 77ff9e7be0d420bd0555ef51612e8ce241f3e78f Merge: 94d508fa3186d cfacfefd382af Author: Takashi Iwai Date: Tue Sep 21 18:42:14 2021 +0200 Merge tag 'asoc-fix-v5.15-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.15 A crop of mostly device specific fixes that have been applied since the merge window, nothing particularly standout here. commit 92477dd1faa650e50bd3bb35a6c0b8d09198cc35 Merge: d5f6545934c47 db7bee653859e Author: Linus Torvalds Date: Tue Sep 21 09:36:11 2021 -0700 Merge tag 's390-5.15-ebpf-jit-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 eBPF fixes from Vasily Gorbik: "Johan Almbladh has implemented a number of new testcases for eBPF [1], which uncovered three miscompilation issues in the s390 eBPF JIT" Link: https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/ [1] * tag 's390-5.15-ebpf-jit-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/bpf: Fix optimizing out zero-extensions s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant s390/bpf: Fix branch shortening during codegen pass commit 2de9d8e0d2fe3a1eb632def2245529067cb35db5 Author: Saravana Kannan Date: Wed Sep 15 10:09:37 2021 -0700 driver core: fw_devlink: Improve handling of cyclic dependencies When we have a dependency of the form: Device-A -> Device-C Device-B Device-C -> Device-B Where, * Indentation denotes "child of" parent in previous line. * X -> Y denotes X is consumer of Y based on firmware (Eg: DT). We have cyclic dependency: device-A -> device-C -> device-B -> device-A fw_devlink current treats device-C -> device-B dependency as an invalid dependency and doesn't enforce it but leaves the rest of the dependencies as is. While the current behavior is necessary, it is not sufficient if the false dependency in this example is actually device-A -> device-C. When this is the case, device-C will correctly probe defer waiting for device-B to be added, but device-A will be incorrectly probe deferred by fw_devlink waiting on device-C to probe successfully. Due to this, none of the devices in the cycle will end up probing. To fix this, we need to go relax all the dependencies in the cycle like we already do in the other instances where fw_devlink detects cycles. A real world example of this was reported[1] and analyzed[2]. [1] - https://lore.kernel.org/lkml/0a2c4106-7f48-2bb5-048e-8c001a7c3fda@samsung.com/ [2] - https://lore.kernel.org/lkml/CAGETcx8peaew90SWiux=TyvuGgvTQOmO4BFALz7aj0Za5QdNFQ@mail.gmail.com/ Fixes: f9aa460672c9 ("driver core: Refactor fw_devlink feature") Cc: stable Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915170940.617415-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit bb509a6ffed2c8b0950f637ab5779aa818ed1596 Author: Ian Abbott Date: Thu Sep 16 15:50:23 2021 +0100 comedi: Fix memory leak in compat_insnlist() `compat_insnlist()` handles the 32-bit version of the `COMEDI_INSNLIST` ioctl (whenwhen `CONFIG_COMPAT` is enabled). It allocates memory to temporarily hold an array of `struct comedi_insn` converted from the 32-bit version in user space. This memory is only being freed if there is a fault while filling the array, otherwise it is leaked. Add a call to `kfree()` to fix the leak. Fixes: b8d47d881305 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_INSNLIST compat") Cc: Al Viro Cc: Greg Kroah-Hartman Cc: linux-staging@lists.linux.dev Cc: # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20210916145023.157479-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 708c87168b6121abc74b2a57d0c498baaf70cbea Author: Dan Carpenter Date: Mon Sep 6 12:43:01 2021 +0300 ceph: fix off by one bugs in unsafe_request_wait() The "> max" tests should be ">= max" to prevent an out of bounds access on the next lines. Fixes: e1a4541ec0b9 ("ceph: flush the mdlog before waiting on unsafe reqs") Signed-off-by: Dan Carpenter Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 7af526c740bdbd5b4dcebba04ace5b3b0c07801f Author: Geert Uytterhoeven Date: Tue Sep 14 11:29:49 2021 +0200 nvmem: NVMEM_NINTENDO_OTP should depend on WII The Nintendo Wii and Wii U OTP is only present on Nintendo Wii and Wii U consoles. Hence add a dependency on WII, to prevent asking the user about this driver when configuring a kernel without Nintendo Wii and Wii U console support. Fixes: 3683b761fe3a10ad ("nvmem: nintendo-otp: Add new driver for the Wii and Wii U OTP") Reviewed-by: Emmanuel Gil Peyrot Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/01318920709dddc4d85fe895e2083ca0eee234d8.1631611652.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 6354467245ff8dd04b54e39790f2ee4d21d5419e Author: Konstantin Komarov Date: Thu Sep 9 13:15:20 2021 +0300 fs/ntfs3: Add sync flag to ntfs_sb_write_run and al_update This allows to wait only when it's requested. It speeds up creation of hardlinks. Signed-off-by: Konstantin Komarov commit 56eaeb10e2619081cc383febf6740a4c3e806777 Author: Konstantin Komarov Date: Thu Sep 9 13:12:41 2021 +0300 fs/ntfs3: Change max hardlinks limit to 4000 xfstest generic/041 works with 3003 hardlinks. Because of this we raise hardlinks limit to 4000. There are no drawbacks or regressions. Theoretically we can raise all the way up to ffff, but there is no practical use for this. Signed-off-by: Konstantin Komarov commit d5f6545934c47e97c0b48a645418e877b452a992 Author: Linus Torvalds Date: Mon Sep 20 10:26:21 2021 -0700 qnx4: work around gcc false positive warning bug In commit b7213ffa0e58 ("qnx4: avoid stringop-overread errors") I tried to teach gcc about how the directory entry structure can be two different things depending on a status flag. It made the code clearer, and it seemed to make gcc happy. However, Arnd points to a gcc bug, where despite using two different members of a union, gcc then gets confused, and uses the size of one of the members to decide if a string overrun happens. And not necessarily the rigth one. End result: with some configurations, gcc-11 will still complain about the source buffer size being overread: fs/qnx4/dir.c: In function 'qnx4_readdir': fs/qnx4/dir.c:76:32: error: 'strnlen' specified bound [16, 48] exceeds source size 1 [-Werror=stringop-overread] 76 | size = strnlen(name, size); | ^~~~~~~~~~~~~~~~~~~ fs/qnx4/dir.c:26:22: note: source object declared here 26 | char de_name; | ^~~~~~~ because gcc will get confused about which union member entry is actually getting accessed, even when the source code is very clear about it. Gcc internally will have combined two "redundant" pointers (pointing to different union elements that are at the same offset), and takes the size checking from one or the other - not necessarily the right one. This is clearly a gcc bug, but we can work around it fairly easily. The biggest thing here is the big honking comment about why we do what we do. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6 Reported-and-tested-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit ee9d4810aab95208541d2807f9d114f1d5edcee0 Author: Konstantin Komarov Date: Wed Sep 8 18:39:53 2021 +0300 fs/ntfs3: Fix insertion of attr in ni_ins_attr_ext Do not try to insert attribute if there is no room in record. Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit c86a2d9058c5a4a05d20ef89e699b7a6b2c89da6 Author: Tobias Klauser Date: Fri Sep 17 00:27:05 2021 +0200 cpumask: Omit terminating null byte in cpumap_print_{list,bitmask}_to_buf The changes in the patch series [1] introduced a terminating null byte when reading from cpulist or cpumap sysfs files, for example: $ xxd /sys/devices/system/node/node0/cpulist 00000000: 302d 310a 00 0-1.. Before this change, the output looked as follows: $ xxd /sys/devices/system/node/node0/cpulist 00000000: 302d 310a 0-1. Fix this regression by excluding the terminating null byte from the returned length in cpumap_print_list_to_buf and cpumap_print_bitmask_to_buf. [1] https://lore.kernel.org/all/20210806110251.560-1-song.bao.hua@hisilicon.com/ Fixes: 1fae562983ca ("cpumask: introduce cpumap_print_list/bitmask_to_buf to support large bitmask and list") Acked-by: Barry Song Acked-by: Yury Norov Signed-off-by: Tobias Klauser Link: https://lore.kernel.org/r/20210916222705.13554-1-tklauser@distanz.ch Signed-off-by: Greg Kroah-Hartman commit 517c7bf99bad3d6b9360558414aae634b7472d80 Author: Dan Carpenter Date: Thu Sep 16 16:57:37 2021 +0300 usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() This is writing to the first 1 - 3 bytes of "val" and then writing all four bytes to musb_writel(). The last byte is always going to be garbage. Zero out the last bytes instead. Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") Signed-off-by: Dan Carpenter Cc: stable Link: https://lore.kernel.org/r/20210916135737.GI25094@kili Signed-off-by: Greg Kroah-Hartman commit b55d37ef6b7db3eda9b4495a8d9b0a944ee8c67d Author: Ondrej Zary Date: Mon Sep 13 23:01:06 2021 +0200 usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c ScanLogic SL11R-IDE with firmware older than 2.6c (the latest one) has broken tag handling, preventing the device from working at all: usb 1-1: new full-speed USB device number 2 using uhci_hcd usb 1-1: New USB device found, idVendor=04ce, idProduct=0002, bcdDevice= 2.60 usb 1-1: New USB device strings: Mfr=1, Product=1, SerialNumber=0 usb 1-1: Product: USB Device usb 1-1: Manufacturer: USB Device usb-storage 1-1:1.0: USB Mass Storage device detected scsi host2: usb-storage 1-1:1.0 usbcore: registered new interface driver usb-storage usb 1-1: reset full-speed USB device number 2 using uhci_hcd usb 1-1: reset full-speed USB device number 2 using uhci_hcd usb 1-1: reset full-speed USB device number 2 using uhci_hcd usb 1-1: reset full-speed USB device number 2 using uhci_hcd Add US_FL_BULK_IGNORE_TAG to fix it. Also update my e-mail address. 2.6c is the only firmware that claims Linux compatibility. The firmware can be upgraded using ezotgdbg utility: https://github.com/asciilifeform/ezotgdbg Acked-by: Alan Stern Signed-off-by: Ondrej Zary Cc: stable Link: https://lore.kernel.org/r/20210913210106.12717-1-linux@zary.sk Signed-off-by: Greg Kroah-Hartman commit ce1c42b4dacfe7d71c852d8bf3371067ccba865c Author: Julian Sikorski Date: Mon Sep 13 20:14:55 2021 +0200 Re-enable UAS for LaCie Rugged USB3-FW with fk quirk Further testing has revealed that LaCie Rugged USB3-FW does work with uas as long as US_FL_NO_REPORT_OPCODES and US_FL_NO_SAME are enabled. Link: https://lore.kernel.org/linux-usb/2167ea48-e273-a336-a4e0-10a4e883e75e@redhat.com/ Cc: stable Suggested-by: Hans de Goede Reviewed-by: Hans de Goede Acked-by: Oliver Neukum Signed-off-by: Julian Sikorski Link: https://lore.kernel.org/r/20210913181454.7365-1-belegdol+github@gmail.com Signed-off-by: Greg Kroah-Hartman commit d7a48e27b38a94bf73c973c236461234610256d5 Author: Apurva Nandan Date: Mon Sep 20 19:57:13 2021 +0530 spi: Use 'flash' node name instead of 'spi-flash' in example Change the nodename in the example with spi-nand from 'spi-flash@1' to 'flash@1' to make the schema uniform with both spi-nand and spi-nor flashes. jedec,spi-nor.yaml uses 'flash@' nodename for spi-nor flashes, so make the spi-nand examples in dt-bindings use it too for uniformity. Signed-off-by: Apurva Nandan Reviewed-by: Serge Semin Acked-by: Rob Herring Link: https://lore.kernel.org/r/20210920142713.129295-3-a-nandan@ti.com Signed-off-by: Mark Brown commit ffb1e76f4f32d2b8ea4189df0484980370476395 Merge: 2bab94090b01b e4e737bb5c170 Author: Mark Brown Date: Mon Sep 20 15:56:58 2021 +0100 Merge tag 'v5.15-rc2' into spi-5.15 Linux 5.15-rc2 commit d9d1232b48344c6c72dbdf89fae1e7638e5df757 Author: Johan Hovold Date: Fri Sep 17 13:57:36 2021 +0200 misc: bcm-vk: fix tty registration race Make sure to set the tty class-device driver data before registering the tty to avoid having a racing open() dereference a NULL pointer. Fixes: 91ca10d6fa07 ("misc: bcm-vk: add ttyVK support") Cc: stable@vger.kernel.org # 5.12 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210917115736.5816-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 59a68d4138086c015ab8241c3267eec5550fbd44 Author: Robin Murphy Date: Fri Sep 17 15:59:30 2021 +0100 arm64: Mitigate MTE issues with str{n}cmp() As with strlen(), the patches importing the updated str{n}cmp() implementations were originally developed and tested before the advent of CONFIG_KASAN_HW_TAGS, and have subsequently revealed not to be MTE-safe. Since in-kernel MTE is still a rather niche case, let it temporarily fall back to the generic C versions for correctness until we can figure out the best fix. Fixes: 758602c04409 ("arm64: Import latest version of Cortex Strings' strcmp") Fixes: 020b199bc70d ("arm64: Import latest version of Cortex Strings' strncmp") Cc: # 5.14.x Reported-by: Branislav Rankov Signed-off-by: Robin Murphy Acked-by: Mark Rutland Link: https://lore.kernel.org/r/34dc4d12eec0adae49b0ac927df642ed10089d40.1631890770.git.robin.murphy@arm.com Signed-off-by: Catalin Marinas commit 6f6aab1caf6c7fef46852aaab03f4e8250779e52 Author: Tobias Jakobi Date: Tue Sep 21 12:07:02 2021 +0200 platform/x86: gigabyte-wmi: add support for B550I Aorus Pro AX Tested with a AMD Ryzen 7 5800X. Signed-off-by: Tobias Jakobi Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20210921100702.3838-1-tjakobi@math.uni-bielefeld.de Signed-off-by: Hans de Goede commit b201cb0ebe87b209e252d85668e517ac1929e250 Author: José Expósito Date: Mon Sep 20 18:03:12 2021 +0200 platform/x86/intel: hid: Add DMI switches allow list Some devices, even non convertible ones, can send incorrect SW_TABLET_MODE reports. Add an allow list and accept such reports only from devices in it. Bug reported for Dell XPS 17 9710 on: https://gitlab.freedesktop.org/libinput/libinput/-/issues/662 Reported-by: Tobias Gurtzick Suggested-by: Hans de Goede Tested-by: Tobias Gurtzick Signed-off-by: José Expósito Link: https://lore.kernel.org/r/20210920160312.9787-1-jose.exposito89@gmail.com [hdegoede@redhat.com: Check dmi_switches_auto_add_allow_list only once] Signed-off-by: Hans de Goede commit 5b72dafaca73b33416c82457ae615e6f2022e901 Author: Randy Dunlap Date: Fri Sep 17 21:48:29 2021 -0700 platform/x86: dell: fix DELL_WMI_PRIVACY dependencies & build error When DELL_WMI=y, DELL_WMI_PRIVACY=y, and LEDS_TRIGGER_AUDIO=m, there is a linker error since the LEDS trigger code is built as a loadable module. This happens because DELL_WMI_PRIVACY is a bool that depends on a tristate (LEDS_TRIGGER_AUDIO=m), which can be dangerous. ld: drivers/platform/x86/dell/dell-wmi-privacy.o: in function `dell_privacy_wmi_probe': dell-wmi-privacy.c:(.text+0x3df): undefined reference to `ledtrig_audio_get' Fixes: 8af9fa37b8a3 ("platform/x86: dell-privacy: Add support for Dell hardware privacy") Signed-off-by: Randy Dunlap Cc: Perry Yuan Cc: Dell.Client.Kernel@dell.com Cc: platform-driver-x86@vger.kernel.org Cc: Hans de Goede Cc: Mark Gross Link: https://lore.kernel.org/r/20210918044829.19222-1-rdunlap@infradead.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit cf96921876dcee4d6ac07b9de470368a075ba9ad Author: Ansuel Smith Date: Tue Sep 7 23:25:42 2021 +0200 thermal/drivers/tsens: Fix wrong check for tzd in irq handlers Some devices can have some thermal sensors disabled from the factory. The current two irq handler functions check all the sensor by default and the check if the sensor was actually registered is wrong. The tzd is actually never set if the registration fails hence the IS_ERR check is wrong. Signed-off-by: Ansuel Smith Reviewed-by: Matthias Kaehlcke Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20210907212543.20220-1-ansuelsmth@gmail.com commit 1bb30b20b49773369c299d4d6c65227201328663 Author: Dan Carpenter Date: Thu Sep 16 16:13:42 2021 +0300 thermal/core: Potential buffer overflow in thermal_build_list_of_policies() After printing the list of thermal governors, then this function prints a newline character. The problem is that "size" has not been updated after printing the last governor. This means that it can write one character (the NUL terminator) beyond the end of the buffer. Get rid of the "size" variable and just use "PAGE_SIZE - count" directly. Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling") Signed-off-by: Dan Carpenter Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20210916131342.GB25094@kili commit b3f98404bd629a243c0a15a3ade32b1cf9fbe0da Merge: 3e95cfa24e24f 74b6d7d13307b Author: David S. Miller Date: Tue Sep 21 13:52:16 2021 +0100 Merge branch 'dsa-devres' Vladimir Oltean says: ==================== Fix mdiobus users with devres Commit ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") by Bartosz Golaszewski has introduced two classes of potential bugs by making the devres callback of devm_mdiobus_alloc stop calling mdiobus_unregister. The exact buggy circumstances are presented in the individual commit messages. I have searched the tree for other occurrences, but at the moment: - for issue (a) I have no concrete proof that other buses except SPI and I2C suffer from it, and the only SPI or I2C device drivers that call of_mdiobus_alloc are the DSA drivers that leave a NULL ds->slave_mii_bus and a non-NULL ds->ops->phy_read, aka ksz9477, ksz8795, lan9303_i2c, vsc73xx-spi. - for issue (b), all drivers which call of_mdiobus_alloc either use of_mdiobus_register too, or call mdiobus_unregister sometime within the ->remove path. Although at this point I've seen enough strangeness caused by this "device_del during ->shutdown" that I'm just going to copy the SPI and I2C subsystem maintainers to this patch series, to get their feedback whether they've had reports about things like this before. I don't think other buses behave in this way, it forces SPI and I2C devices to have to protect themselves from a really strange set of issues. ==================== Signed-off-by: David S. Miller commit 74b6d7d13307b016f4b5bba8198297824c0ee6df Author: Vladimir Oltean Date: Tue Sep 21 00:42:09 2021 +0300 net: dsa: realtek: register the MDIO bus under devres The Linux device model permits both the ->shutdown and ->remove driver methods to get called during a shutdown procedure. Example: a DSA switch which sits on an SPI bus, and the SPI bus driver calls this on its ->shutdown method: spi_unregister_controller -> device_for_each_child(&ctlr->dev, NULL, __unregister); -> spi_unregister_device(to_spi_device(dev)); -> device_del(&spi->dev); So this is a simple pattern which can theoretically appear on any bus, although the only other buses on which I've been able to find it are I2C: i2c_del_adapter -> device_for_each_child(&adap->dev, NULL, __unregister_client); -> i2c_unregister_device(client); -> device_unregister(&client->dev); The implication of this pattern is that devices on these buses can be unregistered after having been shut down. The drivers for these devices might choose to return early either from ->remove or ->shutdown if the other callback has already run once, and they might choose that the ->shutdown method should only perform a subset of the teardown done by ->remove (to avoid unnecessary delays when rebooting). So in other words, the device driver may choose on ->remove to not do anything (therefore to not unregister an MDIO bus it has registered on ->probe), because this ->remove is actually triggered by the device_shutdown path, and its ->shutdown method has already run and done the minimally required cleanup. This used to be fine until the blamed commit, but now, the following BUG_ON triggers: void mdiobus_free(struct mii_bus *bus) { /* For compatibility with error handling in drivers. */ if (bus->state == MDIOBUS_ALLOCATED) { kfree(bus); return; } BUG_ON(bus->state != MDIOBUS_UNREGISTERED); bus->state = MDIOBUS_RELEASED; put_device(&bus->dev); } In other words, there is an attempt to free an MDIO bus which was not unregistered. The attempt to free it comes from the devres release callbacks of the SPI device, which are executed after the device is unregistered. I'm not saying that the fact that MDIO buses allocated using devres would automatically get unregistered wasn't strange. I'm just saying that the commit didn't care about auditing existing call paths in the kernel, and now, the following code sequences are potentially buggy: (a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device located on a bus that unregisters its children on shutdown. After the blamed patch, either both the alloc and the register should use devres, or none should. (b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no mdiobus_unregister at all in the remove path. After the blamed patch, nobody unregisters the MDIO bus anymore, so this is even more buggy than the previous case which needs a specific bus configuration to be seen, this one is an unconditional bug. In this case, the Realtek drivers fall under category (b). To solve it, we can register the MDIO bus under devres too, which restores the previous behavior. Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") Reported-by: Lino Sanfilippo Reported-by: Alvin Šipraga Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 5135e96a3dd2f4555ae6981c3155a62bcf3227f6 Author: Vladimir Oltean Date: Tue Sep 21 00:42:08 2021 +0300 net: dsa: don't allocate the slave_mii_bus using devres The Linux device model permits both the ->shutdown and ->remove driver methods to get called during a shutdown procedure. Example: a DSA switch which sits on an SPI bus, and the SPI bus driver calls this on its ->shutdown method: spi_unregister_controller -> device_for_each_child(&ctlr->dev, NULL, __unregister); -> spi_unregister_device(to_spi_device(dev)); -> device_del(&spi->dev); So this is a simple pattern which can theoretically appear on any bus, although the only other buses on which I've been able to find it are I2C: i2c_del_adapter -> device_for_each_child(&adap->dev, NULL, __unregister_client); -> i2c_unregister_device(client); -> device_unregister(&client->dev); The implication of this pattern is that devices on these buses can be unregistered after having been shut down. The drivers for these devices might choose to return early either from ->remove or ->shutdown if the other callback has already run once, and they might choose that the ->shutdown method should only perform a subset of the teardown done by ->remove (to avoid unnecessary delays when rebooting). So in other words, the device driver may choose on ->remove to not do anything (therefore to not unregister an MDIO bus it has registered on ->probe), because this ->remove is actually triggered by the device_shutdown path, and its ->shutdown method has already run and done the minimally required cleanup. This used to be fine until the blamed commit, but now, the following BUG_ON triggers: void mdiobus_free(struct mii_bus *bus) { /* For compatibility with error handling in drivers. */ if (bus->state == MDIOBUS_ALLOCATED) { kfree(bus); return; } BUG_ON(bus->state != MDIOBUS_UNREGISTERED); bus->state = MDIOBUS_RELEASED; put_device(&bus->dev); } In other words, there is an attempt to free an MDIO bus which was not unregistered. The attempt to free it comes from the devres release callbacks of the SPI device, which are executed after the device is unregistered. I'm not saying that the fact that MDIO buses allocated using devres would automatically get unregistered wasn't strange. I'm just saying that the commit didn't care about auditing existing call paths in the kernel, and now, the following code sequences are potentially buggy: (a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device located on a bus that unregisters its children on shutdown. After the blamed patch, either both the alloc and the register should use devres, or none should. (b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no mdiobus_unregister at all in the remove path. After the blamed patch, nobody unregisters the MDIO bus anymore, so this is even more buggy than the previous case which needs a specific bus configuration to be seen, this one is an unconditional bug. In this case, DSA falls into category (a), it tries to be helpful and registers an MDIO bus on behalf of the switch, which might be on such a bus. I've no idea why it does it under devres. It does this on probe: if (!ds->slave_mii_bus && ds->ops->phy_read) alloc and register mdio bus and this on remove: if (ds->slave_mii_bus && ds->ops->phy_read) unregister mdio bus I _could_ imagine using devres because the condition used on remove is different than the condition used on probe. So strictly speaking, DSA cannot determine whether the ds->slave_mii_bus it sees on remove is the ds->slave_mii_bus that _it_ has allocated on probe. Using devres would have solved that problem. But nonetheless, the existing code already proceeds to unregister the MDIO bus, even though it might be unregistering an MDIO bus it has never registered. So I can only guess that no driver that implements ds->ops->phy_read also allocates and registers ds->slave_mii_bus itself. So in that case, if unregistering is fine, freeing must be fine too. Stop using devres and free the MDIO bus manually. This will make devres stop attempting to free a still registered MDIO bus on ->shutdown. Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") Reported-by: Lino Sanfilippo Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Tested-by: Lino Sanfilippo Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 74b7ee0e7b61838a0a161a84d105aeff0d042646 Author: Shengjiu Wang Date: Fri Sep 10 17:18:30 2021 +0800 ASoC: fsl_xcvr: Fix channel swap issue with ARC With pause and resume test for ARC, there is occasionally channel swap issue. The reason is that currently driver set the DPATH out of reset first, then start the DMA, the first data got from FIFO may not be the Left channel. Moving DPATH out of reset operation after the dma enablement to fix this issue. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1631265510-27384-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 3f4b57ad07d9237acf1b8cff3f8bf530cacef87a Author: Peter Rosin Date: Mon Sep 20 16:49:39 2021 +0200 ASoC: pcm512x: Mend accesses to the I2S_1 and I2S_2 registers Commit 25d27c4f68d2 ("ASoC: pcm512x: Add support for more data formats") breaks the TSE-850 device, which is using a pcm5142 in I2S and CBM_CFS mode (maybe not relevant). Without this fix, the result is: pcm512x 0-004c: Failed to set data format: -16 And after that, no sound. This fix is not 100% correct. The datasheet of at least the pcm5142 states that four bits (0xcc) in the I2S_1 register are "RSV" ("Reserved. Do not access.") and no hint is given as to what the initial values are supposed to be. So, specifying defaults for these bits is wrong. But perhaps better than a broken driver? Fixes: 25d27c4f68d2 ("ASoC: pcm512x: Add support for more data formats") Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Kirill Marinushkin Cc: Peter Ujfalusi Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Peter Rosin Signed-off-by: Peter Ujfalusi Reviewed-by: Peter Ujfalusi Link: https://lore.kernel.org/r/2d221984-7a2e-7006-0f8a-ffb5f64ee885@axentia.se Signed-off-by: Mark Brown commit 8c8a3b5bd960cd88f7655b5251dc28741e11f139 Author: Peter Collingbourne Date: Wed Sep 15 12:03:35 2021 -0700 arm64: add MTE supported check to thread switching and syscall entry/exit This lets us avoid doing unnecessary work on hardware that does not support MTE, and will allow us to freely use MTE instructions in the code called by mte_thread_switch(). Since this would mean that we do a redundant check in mte_check_tfsr_el1(), remove it and add two checks now required in its callers. This also avoids an unnecessary DSB+ISB sequence on the syscall exit path for hardware not supporting MTE. Fixes: 65812c6921cc ("arm64: mte: Enable async tag check fault") Cc: # 5.13.x Signed-off-by: Peter Collingbourne Link: https://linux-review.googlesource.com/id/I02fd000d1ef2c86c7d2952a7f099b254ec227a5d Link: https://lore.kernel.org/r/20210915190336.398390-1-pcc@google.com [catalin.marinas@arm.com: adjust the commit log slightly] Signed-off-by: Catalin Marinas commit b875fb313a10bf816b5d49d8d7642d1cc9905f2f Author: Chris Wilson Date: Mon Aug 9 12:48:05 2021 -0700 drm/i915: Free all DMC payloads Free all the DMC payloads, not just DMC_MAIN. unreferenced object 0xffff88ff32d4d800 (size 1024): comm "kworker/1:5", pid 701, jiffies 4294904239 (age 109.736s) hex dump (first 32 bytes): 40 40 00 0c 03 00 00 00 00 00 00 00 00 00 00 00 @@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000ba9d0d95>] dmc_load_work_fn+0x34d/0x510 [i915] [<000000001049fcab>] process_one_work+0x261/0x550 [<00000000eeb995ac>] worker_thread+0x49/0x3c0 [<0000000021031dc3>] kthread+0x10b/0x140 [<000000004a0f69ee>] ret_from_fork+0x1f/0x30 unreferenced object 0xffff88ff0bde4000 (size 1024): comm "kworker/0:3", pid 708, jiffies 4294904469 (age 108.816s) hex dump (first 32 bytes): 40 40 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 @@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000ba9d0d95>] dmc_load_work_fn+0x34d/0x510 [i915] [<000000001049fcab>] process_one_work+0x261/0x550 [<00000000eeb995ac>] worker_thread+0x49/0x3c0 [<0000000021031dc3>] kthread+0x10b/0x140 [<000000004a0f69ee>] ret_from_fork+0x1f/0x30 Fixes: 3d5928a168a9 ("drm/i915/xelpd: Pipe A DMC plugging") Cc: Anusha Srivatsa Cc: José Roberto de Souza Signed-off-by: Chris Wilson Signed-off-by: Lucas De Marchi Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20210809194805.3793060-1-lucas.demarchi@intel.com (cherry picked from commit 064b877dff4252ced91a1c8b1f129073f2991f6e) Signed-off-by: Jani Nikula commit f9b23c157a78c77545099312394d484ce4f35b8b Author: Maarten Lankhorst Date: Mon Aug 30 14:09:48 2021 +0200 drm/i915: Move __i915_gem_free_object to ttm_bo_destroy When we implement delayed destroy, we may have a second call to the delete_mem_notify() handler, while free_object() only should be called once. Move it to bo->destroy(), to ensure it's only called once. This fixes some weird memory corruption issues with delayed destroy when async eviction is used. Signed-off-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20210830121006.2978297-2-maarten.lankhorst@linux.intel.com Fixes: 213d50927763 ("drm/i915/ttm: Introduce a TTM i915 gem object backend") Cc: Thomas Hellström Reviewed-by: Thomas Hellström (cherry picked from commit 48b0961269546716c3232748bf37e64e49fb866c) Signed-off-by: Jani Nikula commit 2566fffd6011df17dfba0b216fe9a154d3eb3f75 Author: Radhakrishna Sripada Date: Tue Sep 14 15:07:44 2021 -0700 drm/i915: Update memory bandwidth parameters Earlier while calculating derated bw we would use 90% of the calculated bw. Starting ADL-P we use a non standard derating. Updating the formulae to reflect the same. Bspec: 64631 v2: Use the new derating value only for ADL-P(MattR) Fixes: 4d32fe2f14a7 ("drm/i915/adl_p: Update memory bandwidth parameters") Cc: Matt Roper Signed-off-by: Radhakrishna Sripada Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20210914220744.16042-1-radhakrishna.sripada@intel.com (cherry picked from commit f6d66fc8cf5f673ea76407be84dc17dbb3eda108) Signed-off-by: Jani Nikula commit 3e95cfa24e24fbd7fb7675ab972a5aa507c7a89c Author: Masanari Iida Date: Tue Sep 21 15:41:23 2021 +0900 Doc: networking: Fox a typo in ice.rst This patch fixes a spelling typo in ice.rst Signed-off-by: Masanari Iida Signed-off-by: David S. Miller commit e5845aa0eadda3d8a950eb8845c1396827131f30 Author: Vladimir Oltean Date: Tue Sep 21 01:49:18 2021 +0300 net: dsa: fix dsa_tree_setup error path Since the blamed commit, dsa_tree_teardown_switches() was split into two smaller functions, dsa_tree_teardown_switches and dsa_tree_teardown_ports. However, the error path of dsa_tree_setup stopped calling dsa_tree_teardown_ports. Fixes: a57d8c217aad ("net: dsa: flush switchdev workqueue before tearing down CPU/DSA ports") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 431db53c73c901aaf6239378c24e4823443b214c Merge: 36747c96ed496 a18cee4791b11 Author: David S. Miller Date: Tue Sep 21 10:54:17 2021 +0100 Merge branch 'smc-fixes' Karsten Graul says: ==================== net/smc: fixes 2021-09-20 Please apply the following patches for smc to netdev's net tree. The first patch adds a missing error check, and the second patch fixes a possible leak of a lock in a worker. ==================== Signed-off-by: David S. Miller commit a18cee4791b1123d0a6579a7c89f4b87e48abe03 Author: Karsten Graul Date: Mon Sep 20 21:18:15 2021 +0200 net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work The abort_work is scheduled when a connection was detected to be out-of-sync after a link failure. The work calls smc_conn_kill(), which calls smc_close_active_abort() and that might end up calling smc_close_cancel_work(). smc_close_cancel_work() cancels any pending close_work and tx_work but needs to release the sock_lock before and acquires the sock_lock again afterwards. So when the sock_lock was NOT acquired before then it may be held after the abort_work completes. Thats why the sock_lock is acquired before the call to smc_conn_kill() in __smc_lgr_terminate(), but this is missing in smc_conn_abort_work(). Fix that by acquiring the sock_lock first and release it after the call to smc_conn_kill(). Fixes: b286a0651e44 ("net/smc: handle incoming CDC validation message") Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 6c90731980655280ea07ce4b21eb97457bf86286 Author: Karsten Graul Date: Mon Sep 20 21:18:14 2021 +0200 net/smc: add missing error check in smc_clc_prfx_set() Coverity stumbled over a missing error check in smc_clc_prfx_set(): *** CID 1475954: Error handling issues (CHECKED_RETURN) /net/smc/smc_clc.c: 233 in smc_clc_prfx_set() >>> CID 1475954: Error handling issues (CHECKED_RETURN) >>> Calling "kernel_getsockname" without checking return value (as is done elsewhere 8 out of 10 times). 233 kernel_getsockname(clcsock, (struct sockaddr *)&addrs); Add the return code check in smc_clc_prfx_set(). Fixes: c246d942eabc ("net/smc: restructure netinfo for CLC proposal msgs") Reported-by: Julian Wiedmann Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 8aa83e6395ce047a506f0b16edca45f36c1ae7f8 Author: Juergen Gross Date: Mon Sep 20 14:04:21 2021 +0200 x86/setup: Call early_reserve_memory() earlier Commit in Fixes introduced early_reserve_memory() to do all needed initial memblock_reserve() calls in one function. Unfortunately, the call of early_reserve_memory() is done too late for Xen dom0, as in some cases a Xen hook called by e820__memory_setup() will need those memory reservations to have happened already. Move the call of early_reserve_memory() before the call of e820__memory_setup() in order to avoid such problems. Fixes: a799c2bd29d1 ("x86/setup: Consolidate early memory reservations") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Tested-by: Marek Marczykowski-Górecki Tested-by: Nathan Chancellor Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20210920120421.29276-1-jgross@suse.com commit 0594c58161b6e0f3da8efa9c6e3d4ba52b652717 Author: Jan Beulich Date: Mon Sep 20 18:15:11 2021 +0200 xen/x86: fix PV trap handling on secondary processors The initial observation was that in PV mode under Xen 32-bit user space didn't work anymore. Attempts of system calls ended in #GP(0x402). All of the sudden the vector 0x80 handler was not in place anymore. As it turns out up to 5.13 redundant initialization did occur: Once from cpu_initialize_context() (through its VCPUOP_initialise hypercall) and a 2nd time while each CPU was brought fully up. This 2nd initialization is now gone, uncovering that the 1st one was flawed: Unlike for the set_trap_table hypercall, a full virtual IDT needs to be specified here; the "vector" fields of the individual entries are of no interest. With many (kernel) IDT entries still(?) (i.e. at that point at least) empty, the syscall vector 0x80 ended up in slot 0x20 of the virtual IDT, thus becoming the domain's handler for vector 0x20. Make xen_convert_trap_info() fit for either purpose, leveraging the fact that on the xen_copy_trap_info() path the table starts out zero-filled. This includes moving out the writing of the sentinel, which would also have lead to a buffer overrun in the xen_copy_trap_info() case if all (kernel) IDT entries were populated. Convert the writing of the sentinel to clearing of the entire table entry rather than just the address field. (I didn't bother trying to identify the commit which uncovered the issue in 5.14; the commit named below is the one which actually introduced the bad code.) Fixes: f87e4cac4f4e ("xen: SMP guest support") Cc: stable@vger.kernel.org Signed-off-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/7a266932-092e-b68f-f2bb-1473b61adc6e@suse.com Signed-off-by: Juergen Gross commit 96f5bd03e1be606987644b71899ea56a8d05f825 Author: Juergen Gross Date: Mon Sep 20 12:03:45 2021 +0200 xen/balloon: fix balloon kthread freezing Commit 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue") switched the Xen balloon driver to use a kernel thread. Unfortunately the patch omitted to call try_to_freeze() or to use wait_event_freezable_timeout(), causing a system suspend to fail. Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue") Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210920100345.21939-1-jgross@suse.com Signed-off-by: Juergen Gross commit 298ba0e3d4af539cc37f982d4c011a0f07fca48c Author: Christoph Hellwig Date: Tue Sep 14 08:38:20 2021 +0200 nvme: keep ctrl->namespaces ordered Various places in the nvme code that rely on ctrl->namespace to be ordered. Ensure that the namespae is inserted into the list at the right position from the start instead of sorting it after the fact. Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning") Reported-by: Anton Eidelman Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal commit e371af033c560b9dd1e861f8f0b503142bf0a06c Author: Sagi Grimberg Date: Tue Sep 14 18:38:55 2021 +0300 nvme-tcp: fix incorrect h2cdata pdu offset accounting When the controller sends us multiple r2t PDUs in a single request we need to account for it correctly as our send/recv context run concurrently (i.e. we get a new r2t with r2t_offset before we updated our iterator and req->data_sent marker). This can cause wrong offsets to be sent to the controller. To fix that, we will first know that this may happen only in the send sequence of the last page, hence we will take the r2t_offset to the h2c PDU data_offset, and in nvme_tcp_try_send_data loop, we make sure to increment the request markers also when we completed a PDU but we are expecting more r2t PDUs as we still did not send the entire data of the request. Fixes: 825619b09ad3 ("nvme-tcp: fix possible use-after-completion") Reported-by: Nowak, Lukasz Tested-by: Nowak, Lukasz Signed-off-by: Sagi Grimberg Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit bdaa1365667103e7a754e87c08b846a979ce322b Author: James Smart Date: Tue Sep 14 11:20:08 2021 +0200 nvme-fc: remove freeze/unfreeze around update_nr_hw_queues Remove the freeze/unfreeze around changes to the number of hardware queues. Study and retest has indicated there are no ios that can be active at this point so there is nothing to freeze. nvme-fc is draining the queues in the shutdown and error recovery path in __nvme_fc_abort_outstanding_ios. This patch primarily reverts 88e837ed0f1f "nvme-fc: wait for queues to freeze before calling update_hr_hw_queues". It's not an exact revert as it leaves the adjusting of hw queues only if the count changes. Signed-off-by: James Smart [dwagner: added explanation why no IO is pending] Signed-off-by: Daniel Wagner Reviewed-by: Ming Lei Reviewed-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit e5445dae29d25d7b03e0a10d3d4277a1d0c8119b Author: James Smart Date: Tue Sep 14 11:20:07 2021 +0200 nvme-fc: avoid race between time out and tear down To avoid race between time out and tear down, in tear down process, first we quiesce the queue, and then delete the timer and cancel the time out work for the queue. This patch merges the admin and io sync ops into the queue teardown logic as shown in the RDMA patch 3017013dcc "nvme-rdma: avoid race between time out and tear down". There is no teardown_lock in nvme-fc. Signed-off-by: James Smart Tested-by: Daniel Wagner Reviewed-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Reviewed-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit 555f66d0f8a38537456acc77043d0e4469fcbe8e Author: Daniel Wagner Date: Tue Sep 14 11:20:06 2021 +0200 nvme-fc: update hardware queues before using them In case the number of hardware queues changes, we need to update the tagset and the mapping of ctx to hctx first. If we try to create and connect the I/O queues first, this operation will fail (target will reject the connect call due to the wrong number of queues) and hence we bail out of the recreate function. Then we will to try the very same operation again, thus we don't make any progress. Signed-off-by: Daniel Wagner Reviewed-by: Ming Lei Reviewed-by: Himanshu Madhani Reviewed-by: Hannes Reinecke Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit af505cad9567f7a500d34bf183696d570d7f6810 Author: Nirmoy Das Date: Thu Sep 2 12:29:17 2021 +0200 debugfs: debugfs_create_file_size(): use IS_ERR to check for error debugfs_create_file() returns encoded error so use IS_ERR for checking return value. Reviewed-by: Christian König Signed-off-by: Nirmoy Das Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Cc: stable References: https://gitlab.freedesktop.org/drm/amd/-/issues/1686 Link: https://lore.kernel.org/r/20210902102917.2233-1-nirmoy.das@amd.com Signed-off-by: Greg Kroah-Hartman commit 91dab18f0df171984688d0da258c4c9d95836416 Author: Krzysztof Kozlowski Date: Fri Sep 17 12:28:34 2021 +0200 MAINTAINERS: Move Daniel Drake to credits Daniel Drake's @gentoo.org email bounces (is listed as retired Gentoo developer) and there was no activity from him regarding zd1211rw driver. Also his second address @laptop.org bounces. Cc: Daniel Drake Signed-off-by: Krzysztof Kozlowski Acked-by: Greg Kroah-Hartman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210917102834.25649-1-krzysztof.kozlowski@canonical.com commit e9edc188fc76499b0b9bd60364084037f6d03773 Author: Eric Dumazet Date: Fri Sep 17 15:15:56 2021 -0700 netfilter: conntrack: serialize hash resizes and cleanups Syzbot was able to trigger the following warning [1] No repro found by syzbot yet but I was able to trigger similar issue by having 2 scripts running in parallel, changing conntrack hash sizes, and: for j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done It would take more than 5 minutes for net_namespace structures to be cleaned up. This is because nf_ct_iterate_cleanup() has to restart everytime a resize happened. By adding a mutex, we can serialize hash resizes and cleanups and also make get_next_corpse() faster by skipping over empty buckets. Even without resizes in the picture, this patch considerably speeds up network namespace dismantles. [1] INFO: task syz-executor.0:8312 can't die for more than 144 seconds. task:syz-executor.0 state:R running task stack:25672 pid: 8312 ppid: 6573 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:4955 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6236 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390 local_bh_enable include/linux/bottom_half.h:32 [inline] get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline] nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275 nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171 setup_net+0x639/0xa30 net/core/net_namespace.c:349 copy_net_ns+0x319/0x760 net/core/net_namespace.c:470 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3128 __do_sys_unshare kernel/fork.c:3202 [inline] __se_sys_unshare kernel/fork.c:3200 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f63da68e739 RSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80 R13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 2 locks held by kworker/u4:2/153: #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 1 lock held by systemd-udevd/2970: 1 lock held by in:imklog/6258: #0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 3 locks held by kworker/1:6/8158: 1 lock held by syz-executor.0/8312: 2 locks held by kworker/u4:13/9320: 1 lock held by syz-executor.5/10178: 1 lock held by syz-executor.4/10217: Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: Pablo Neira Ayuso commit b53deef054e58fe4f37c66211b8ece9f8fc1aa13 Author: Florian Westphal Date: Fri Sep 17 18:50:17 2021 +0200 netfilter: log: work around missing softdep backend module iptables/nftables has two types of log modules: 1. backend, e.g. nf_log_syslog, which implement the functionality 2. frontend, e.g. xt_LOG or nft_log, which call the functionality provided by backend based on nf_tables or xtables rule set. Problem is that the request_module() call to load the backed in nf_logger_find_get() might happen with nftables transaction mutex held in case the call path is via nf_tables/nft_compat. This can cause deadlocks (see 'Fixes' tags for details). The chosen solution as to let modprobe deal with this by adding 'pre: ' soft dep tag to xt_LOG (to load the syslog backend) and xt_NFLOG (to load nflog backend). Eric reports that this breaks on systems with older modprobe that doesn't support softdeps. Another, similar issue occurs when someone either insmods xt_(NF)LOG directly or unloads the backend module (possible if no log frontend is in use): because the frontend module is already loaded, modprobe is not invoked again so the softdep isn't evaluated. Add a workaround: If nf_logger_find_get() returns -ENOENT and call is not via nft_compat, load the backend explicitly and try again. Else, let nft_compat ask for deferred request_module via nf_tables infra. Softdeps are kept in-place, so with newer modprobe the dependencies are resolved from userspace. Fixes: cefa31a9d461 ("netfilter: nft_log: perform module load from nf_tables") Fixes: a38b5b56d6f4 ("netfilter: nf_log: add module softdeps") Reported-and-tested-by: Eric Dumazet Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit cc8072153aafd65bff1b3679a112cb6ba71ab375 Author: Florian Westphal Date: Fri Sep 17 11:56:25 2021 +0200 netfilter: iptable_raw: drop bogus net_init annotation This is a leftover from the times when this function was wired up via pernet_operations. Now its called when userspace asks for the table. With CONFIG_NET_NS=n, iptable_raw_table_init memory has been discarded already and we get a kernel crash. Other tables are fine, __net_init annotation was removed already. Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Reported-by: youling 257 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 7970a19b71044bf4dc2c1becc200275bdf1884d4 Author: Florian Westphal Date: Wed Sep 15 16:46:39 2021 +0200 netfilter: nf_nat_masquerade: defer conntrack walk to work queue The ipv4 and device notifiers are called with RTNL mutex held. The table walk can take some time, better not block other RTNL users. 'ip a' has been reported to block for up to 20 seconds when conntrack table has many entries and device down events are frequent (e.g., PPP). Reported-and-tested-by: Martin Zaharinov Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 30db406923b9285a9bac06a6af5e74bd6d0f1d06 Author: Florian Westphal Date: Wed Sep 15 16:46:38 2021 +0200 netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic masq_inet6_event is called asynchronously from system work queue, because the inet6 notifier is atomic and nf_iterate_cleanup can sleep. The ipv4 and device notifiers call nf_iterate_cleanup directly. This is legal, but these notifiers are called with RTNL mutex held. A large conntrack table with many devices coming and going will have severe impact on the system usability, with 'ip a' blocking for several seconds. This change places the defer code into a helper and makes it more generic so ipv4 and ifdown notifiers can be converted to defer the cleanup walk as well in a follow patch. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 45928afe94a094bcda9af858b96673d59bc4a0e9 Author: Pablo Neira Ayuso Date: Mon Sep 13 20:38:52 2021 +0200 netfilter: nf_tables: Fix oversized kvmalloc() calls The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") limits the max allocatable memory via kvmalloc() to MAX_INT. Reported-by: syzbot+cd43695a64bcd21b8596@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso commit a499b03bf36b0c2e3b958a381d828678ab0ffc5e Author: Florian Westphal Date: Mon Sep 13 14:42:33 2021 +0200 netfilter: nf_tables: unlink table before deleting it syzbot reports following UAF: BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nla_strcmp+0xf2/0x130 lib/nlattr.c:836 nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570 nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline] nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064 nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 Problem is that all get operations are lockless, so the commit_mutex held by nft_rcv_nl_event() isn't enough to stop a parallel GET request from doing read-accesses to the table object even after synchronize_rcu(). To avoid this, unlink the table first and store the table objects in on-stack scratch space. Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership") Reported-and-tested-by: syzbot+f31660cf279b0557160c@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit cb89f63ba662d2b56583f4dd3dd2b7f03b6d6587 Author: Florian Westphal Date: Wed Sep 8 14:28:39 2021 +0200 selftests: netfilter: add zone stress test with colliding tuples Add 20k entries to the connection tracking table, once from the data plane, once via ctnetlink. In both cases, each entry lives in a different conntrack zone and addresses/ports are identical. Expectation is that insertions work and occurs in constant time: PASS: added 10000 entries in 1215 ms (now 10000 total, loop 1) PASS: added 10000 entries in 1214 ms (now 20000 total, loop 2) PASS: inserted 20000 entries from packet path in 2434 ms total PASS: added 10000 entries in 57631 ms (now 10000 total) PASS: added 10000 entries in 58572 ms (now 20000 total) PASS: inserted 20000 entries via ctnetlink in 116205 ms Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0f1148abb226f3639845738cdf3d2534ceb1d059 Author: Florian Westphal Date: Wed Sep 8 14:28:38 2021 +0200 selftests: netfilter: add selftest for directional zone support Add a script to exercise NAT port clash resolution with directional zones. Add net namespaces that use the same IP address and connect them to a gateway. Gateway uses policy routing based on iif/mark and conntrack zones to isolate the client namespaces. In server direction, same zone with NAT to single address is used. Then, connect to a server from each client netns, using identical connection id, i.e. saddr:sport -> daddr:dport. Expectation is for all connections to succeeed: NAT gatway is supposed to do port reallocation for each of the (clashing) connections. This is based on the description/use case provided in the commit message of deedb59039f111 ("netfilter: nf_conntrack: add direction support for zones"). Cc: Daniel Borkmann Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d2966dc77ba7b2678f7aee97bf9a65702ec8e2b6 Author: Florian Westphal Date: Wed Sep 8 14:28:37 2021 +0200 netfilter: nat: include zone id in nat table hash again Similar to the conntrack change, also use the zone id for the nat source lists if the zone id is valid in both directions. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b16ac3c4c886f323b06ae942f02ebd2a70bf8840 Author: Florian Westphal Date: Wed Sep 8 14:28:36 2021 +0200 netfilter: conntrack: include zone id in tuple hash again commit deedb59039f111 ("netfilter: nf_conntrack: add direction support for zones") removed the zone id from the hash value. This has implications on hash chain lengths with overlapping tuples, which can hit 64k entries on released kernels, before upper droplimit was added in d7e7747ac5c ("netfilter: refuse insertion if chain has grown too large"). With that change reverted, test script coming with this series shows linear insertion time growth: 10000 entries in 3737 ms (now 10000 total, loop 1) 10000 entries in 16994 ms (now 20000 total, loop 2) 10000 entries in 47787 ms (now 30000 total, loop 3) 10000 entries in 72731 ms (now 40000 total, loop 4) 10000 entries in 95761 ms (now 50000 total, loop 5) 10000 entries in 96809 ms (now 60000 total, loop 6) inserted 60000 entries from packet path in 333825 ms With d7e7747ac5c in place, the test fails. There are three supported zone use cases: 1. Connection is in the default zone (zone 0). This means to special config (the default). 2. Connection is in a different zone (1 to 2**16). This means rules are in place to put packets in the desired zone, e.g. derived from vlan id or interface. 3. Original direction is in zone X and Reply is in zone 0. 3) allows to use of the existing NAT port collision avoidance to provide connectivity to internet/wan even when the various zones have overlapping source networks separated via policy routing. In case the original zone is 0 all three cases are identical. There is no way to place original direction in zone x and reply in zone y (with y != 0). Zones need to be assigned manually via the iptables/nftables ruleset, before conntrack lookup occurs (raw table in iptables) using the "CT" target conntrack template support (-j CT --{zone,zone-orig,zone-reply} X). Normally zone assignment happens based on incoming interface, but could also be derived from packet mark, vlan id and so on. This means that when case 3 is used, the ruleset will typically not even assign a connection tracking template to the "reply" packets, so lookup happens in zone 0. However, it is possible that reply packets also match a ct zone assignment rule which sets up a template for zone X (X > 0) in original direction only. Therefore, after making the zone id part of the hash, we need to do a second lookup using the reply zone id if we did not find an entry on the first lookup. In practice, most deployments will either not use zones at all or the origin and reply zones are the same, no second lookup is required in either case. After this change, packet path insertion test passes with constant insertion times: 10000 entries in 1064 ms (now 10000 total, loop 1) 10000 entries in 1074 ms (now 20000 total, loop 2) 10000 entries in 1066 ms (now 30000 total, loop 3) 10000 entries in 1079 ms (now 40000 total, loop 4) 10000 entries in 1081 ms (now 50000 total, loop 5) 10000 entries in 1082 ms (now 60000 total, loop 6) inserted 60000 entries from packet path in 6452 ms Cc: Daniel Borkmann Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c9c3b6811f7429b8c292de5774cea67f3a033eb2 Author: Florian Westphal Date: Wed Sep 8 14:28:35 2021 +0200 netfilter: conntrack: make max chain length random Similar to commit 67d6d681e15b ("ipv4: make exception cache less predictible"): Use a random drop length to make it harder to detect when entries were hashed to same bucket list. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d9fb678414c048e185eaddadd18d75f5e8832ff3 Merge: 707a63e9a9dd5 9d37e1cab2a9d Author: Linus Torvalds Date: Mon Sep 20 15:49:02 2021 -0700 Merge tag 'afs-fixes-20210913' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: "Fixes for AFS problems that can cause data corruption due to interaction with another client modifying data cached locally: - When d_revalidating a dentry, don't look at the inode to which it points. Only check the directory to which the dentry belongs. This was confusing things and causing the silly-rename cleanup code to remove the file now at the dentry of a file that got deleted. - Fix mmap data coherency. When a callback break is received that relates to a file that we have cached, the data content may have been changed (there are other reasons, such as the user's rights having been changed). However, we're checking it lazily, only on entry to the kernel, which doesn't happen if we have a writeable shared mapped page on that file. We make the kernel keep track of mmapped files and clear all PTEs mapping to that file as soon as the callback comes in by calling unmap_mapping_pages() (we don't necessarily want to zap the pagecache). This causes the kernel to be reentered when userspace tries to access the mmapped address range again - and at that point we can query the server and, if we need to, zap the page cache. Ideally, I would check each file at the point of notification, but that involves poking the server[*] - which is holding an exclusive lock on the vnode it is changing, waiting for all the clients it notified to reply. This could then deadlock against the server. Further, invalidating the pagecache might call ->launder_page(), which would try to write to the file, which would definitely deadlock. (AFS doesn't lease file access). [*] Checking to see if the file content has changed is a matter of comparing the current data version number, but we have to ask the server for that. We also need to get a new callback promise and we need to poke the server for that too. - Add some more points at which the inode is validated, since we're doing it lazily, notably in ->read_iter() and ->page_mkwrite(), but also when performing some directory operations. Ideally, checking in ->read_iter() would be done in some derivation of filemap_read(). If we're going to call the server to read the file, then we get the file status fetch as part of that. - The above is now causing us to make a lot more calls to afs_validate() to check the inode - and afs_validate() takes the RCU read lock each time to make a quick check (ie. afs_check_validity()). This is entirely for the purpose of checking cb_s_break to see if the server we're using reinitialised its list of callbacks - however this isn't a very common event, so most of the time we're taking this needlessly. Add a new cell-wide counter to count the number of reinitialisations done by any server and check that - and only if that changes, take the RCU read lock and check the server list (the server list may change, but the cell a file is part of won't). - Don't update vnode->cb_s_break and ->cb_v_break inside the validity checking loop. The cb_lock is done with read_seqretry, so we might go round the loop a second time after resetting those values - and that could cause someone else checking validity to miss something (I think). Also included are patches for fixes for some bugs encountered whilst debugging this: - Fix a leak of afs_read objects and fix a leak of keys hidden by that. - Fix a leak of pages that couldn't be added to extend a writeback. - Fix the maintenance of i_blocks when i_size is changed by a local write or a local dir edit" Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217 [1] Link: https://lore.kernel.org/r/163111665183.283156.17200205573146438918.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/163113612442.352844.11162345591911691150.stgit@warthog.procyon.org.uk/ # i_blocks patch * tag 'afs-fixes-20210913' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix updating of i_blocks on file/dir extension afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server afs: Try to avoid taking RCU read lock when checking vnode validity afs: Fix mmap coherency vs 3rd-party changes afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation afs: Add missing vnode validation checks afs: Fix page leak afs: Fix missing put on afs_read objects and missing get on the key therein commit 707a63e9a9dd55432d47bf40457d4a3413888dcc Merge: fdf5078458793 6d56262c3d224 Author: Linus Torvalds Date: Mon Sep 20 15:35:17 2021 -0700 Merge tag '5.15-rc1-ksmbd' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: "Three ksmbd fixes, including an important security fix for path processing, and a buffer overflow check, and a trivial fix for incorrect header inclusion" * tag '5.15-rc1-ksmbd' of git://git.samba.org/ksmbd: ksmbd: add validation for FILE_FULL_EA_INFORMATION of smb2_get_info ksmbd: prevent out of share access ksmbd: transport_rdma: Don't include rwlock.h directly commit fdf5078458793fca9e9c0fb5e58a1a970ca0fdef Merge: 4c17ca27923c1 35866f3f779ae Author: Linus Torvalds Date: Mon Sep 20 15:30:29 2021 -0700 Merge tag '5.15-rc1-smb3' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: - two deferred close fixes (for bugs found with xfstests 478 and 461) - a deferred close improvement in rename - two trivial fixes for incorrect Linux comment formatting of multiple cifs files (pointed out by automated kernel test robot and checkpatch) * tag '5.15-rc1-smb3' of git://git.samba.org/sfrench/cifs-2.6: cifs: Not to defer close on file when lock is set cifs: Fix soft lockup during fsstress cifs: Deferred close performance improvements cifs: fix incorrect kernel doc comments cifs: remove pathname for file from SPDX header commit d4ffd5df9d18031b6a53f934388726775b4452d3 Author: Jiashuo Liang Date: Fri Jul 30 11:01:52 2021 +0800 x86/fault: Fix wrong signal when vsyscall fails with pkey The function __bad_area_nosemaphore() calls kernelmode_fixup_or_oops() with the parameter @signal being actually @pkey, which will send a signal numbered with the argument in @pkey. This bug can be triggered when the kernel fails to access user-given memory pages that are protected by a pkey, so it can go down the do_user_addr_fault() path and pass the !user_mode() check in __bad_area_nosemaphore(). Most cases will simply run the kernel fixup code to make an -EFAULT. But when another condition current->thread.sig_on_uaccess_err is met, which is only used to emulate vsyscall, the kernel will generate the wrong signal. Add a new parameter @pkey to kernelmode_fixup_or_oops() to fix this. [ bp: Massage commit message, fix build error as reported by the 0day bot: https://lkml.kernel.org/r/202109202245.APvuT8BX-lkp@intel.com ] Fixes: 5042d40a264c ("x86/fault: Bypass no_context() for implicit kernel faults from usermode") Reported-by: kernel test robot Signed-off-by: Jiashuo Liang Signed-off-by: Borislav Petkov Acked-by: Dave Hansen Link: https://lkml.kernel.org/r/20210730030152.249106-1-liangjs@pku.edu.cn commit 4c17ca27923c16fd73bbb9ad033c7d749c3bcfcc Merge: 2ff59bad6f248 2bab94090b01b Author: Linus Torvalds Date: Mon Sep 20 12:14:33 2021 -0700 Merge tag 'spi-fix-v5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark BrownL "This contains a couple of fixes, one fix for handling of zero length transfers on Rockchip devices and a warning fix which will conflict with a version you did but cleans up some extra unneeded forward declarations as well which seems a bit neater" * tag 'spi-fix-v5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: tegra20-slink: Declare runtime suspend and resume functions conditionally spi: rockchip: handle zero length transfers without timing out commit 2ff59bad6f24813e4c9e8f2022684010ec0e58d2 Merge: e8f71f89236ef dc9660590d106 Author: Linus Torvalds Date: Mon Sep 20 11:47:41 2021 -0700 Merge tag 'regulator-fix-v5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small device specific fixes that have been sent since the merge window, neither of which stands out particularly" * tag 'regulator-fix-v5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: max14577: Revert "regulator: max14577: Add proper module aliases strings" regulator: qcom-rpmh-regulator: fix pm8009-1 ldo7 resource name commit e8f71f89236ef82d449991bfbc237e3cb6ea584f Author: Guenter Roeck Date: Wed Sep 8 12:08:17 2021 -0700 drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV nvkm test builds fail with the following error. drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c: In function 'nvkm_control_mthd_pstate_info': drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c:60:35: error: overflow in conversion from 'int' to '__s8' {aka 'signed char'} changes value from '-251' to '5' The code builds on most architectures, but fails on parisc where ENOSYS is defined as 251. Replace the error code with -ENODEV (-19). The actual error code does not really matter and is not passed to userspace - it just has to be negative. Fixes: 7238eca4cf18 ("drm/nouveau: expose pstate selection per-power source in sysfs") Signed-off-by: Guenter Roeck Cc: Ben Skeggs Cc: David Airlie Cc: Daniel Vetter Signed-off-by: Linus Torvalds commit d8b1e10a2b8efaf71d151aa756052fbf2f3b6d57 Author: Linus Torvalds Date: Mon Sep 20 10:56:32 2021 -0700 sparc64: fix pci_iounmap() when CONFIG_PCI is not set Guenter reported [1] that the pci_iounmap() changes remain problematic, with sparc64 allnoconfig and tinyconfig still not building due to the header file changes and confusion with the arch-specific pci_iounmap() implementation. I'm pretty convinced that sparc should just use GENERIC_IOMAP instead of doing its own thing, since it turns out that the sparc64 version of pci_iounmap() is somewhat buggy (see [2]). But in the meantime, this just fixes the build by avoiding the trivial re-definition of the empty case. Link: https://lore.kernel.org/lkml/20210920134424.GA346531@roeck-us.net/ [1] Link: https://lore.kernel.org/lkml/CAHk-=wgheheFx9myQyy5osh79BAazvmvYURAtub2gQtMvLrhqQ@mail.gmail.com/ [2] Reported-by: Guenter Roeck Cc: David Miller Signed-off-by: Linus Torvalds commit 9f7fa37a6bd90f2749c67f8524334c387d972eb9 Author: Sindhu Devale Date: Thu Sep 16 14:12:22 2021 -0500 RDMA/irdma: Report correct WC error when there are MW bind errors Report the correct WC error when MW bind error related asynchronous events are generated by HW. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20210916191222.824-5-shiraz.saleem@intel.com Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit d3bdcd59633907ee306057b6bb70f06dce47dddc Author: Sindhu Devale Date: Thu Sep 16 14:12:21 2021 -0500 RDMA/irdma: Report correct WC error when transport retry counter is exceeded When the retry counter exceeds, as the remote QP didn't send any Ack or Nack an asynchronous event (AE) for too many retries is generated. Add code to handle the AE and set the correct IB WC error code IB_WC_RETRY_EXC_ERR. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20210916191222.824-4-shiraz.saleem@intel.com Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit f4475f249445b3c1fb99919b0514a075b6d6b3d4 Author: Sindhu Devale Date: Thu Sep 16 14:12:20 2021 -0500 RDMA/irdma: Validate number of CQ entries on create CQ Add lower bound check for CQ entries at creation time. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20210916191222.824-3-shiraz.saleem@intel.com Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit 5b1e985f7626307c451f98883f5e2665ee208e1c Author: Sindhu Devale Date: Thu Sep 16 14:12:19 2021 -0500 RDMA/irdma: Skip CQP ring during a reset Due to duplicate reset flags, CQP commands are processed during reset. This leads CQP failures such as below: irdma0: [Delete Local MAC Entry Cmd Error][op_code=49] status=-27 waiting=1 completion_err=0 maj=0x0 min=0x0 Remove the redundant flag and set the correct reset flag so CPQ is paused during reset Fixes: 8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and implement private channel OPs") Link: https://lore.kernel.org/r/20210916191222.824-2-shiraz.saleem@intel.com Reported-by: LiLiang Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Signed-off-by: Jason Gunthorpe commit ebcc36ea1960d79406d417cb6b107946da8b5210 Author: Selvin Xavier Date: Wed Sep 15 05:32:43 2021 -0700 MAINTAINERS: Update Broadcom RDMA maintainers Updating the bnxt_re maintainers as Naresh decided to leave Broadcom. Link: https://lore.kernel.org/r/1631709163-2287-13-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 880301bb313295a65523e79bc5666f5cf49eb3ed Author: Colin Ian King Date: Fri Sep 10 11:02:02 2021 +0100 fs/ntfs3: Fix a memory leak on object opts Currently a failed allocation on sbi->upcase will cause an exit via the label free_sbi causing a memory leak on object opts. Fix this by re-ordering the exit paths free_opts and free_sbi so that kfree's occur in the reverse allocation order. Addresses-Coverity: ("Resource leak") Fixes: 27fac77707a1 ("fs/ntfs3: Init spi more in init_fs_context than fill_super") Signed-off-by: Colin Ian King Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit a0fc05a37cae9e61aa29f7e283662ce70f7df342 Author: Kari Argillander Date: Fri Sep 10 00:57:53 2021 +0300 Doc/fs/ntfs3: Fix rst format and make it cleaner Current ntfs3 rst documentation is broken. I turn table to list table as this is current Linux documentation quide line. Simple table also did not quite work in our situation as we need to span rows together. It still look quite good as text so we did not loss anything. This will also make diffing quite bit more pleasure. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 28861e3bbd9e7ac4cd9c811aad71b4d116e27930 Author: Kari Argillander Date: Thu Sep 9 21:09:42 2021 +0300 fs/ntfs3: Initiliaze sb blocksize only in one place + refactor Right now sb blocksize first get initiliazed in fill_super but in can be changed in helper function. It makes more sense to that this happened only in one place. Because we move this to helper function it makes more sense that s_maxbytes will also be there. I rather have every sb releted thing in fill_super, but because there is already sb releted stuff in this helper. This will have to do for now. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0e59a87ee619915c2eb189eb232a972c276681fb Author: Kari Argillander Date: Thu Sep 9 21:09:41 2021 +0300 fs/ntfs3: Initialize pointer before use place in fill_super Initializing should be as close as possible when we use it so that we do not need to scroll up to see what is happening. Also bdev_get_queue() can never return NULL so we do not need to check for !rq. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0056b273757b3057a5aff73f96a7fa134641caf4 Author: Kari Argillander Date: Thu Sep 9 21:09:40 2021 +0300 fs/ntfs3: Remove tmp pointer upcase in fill_super We can survive without this tmp point upcase. So remove it we don't have so many tmp pointer in this function. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 4ea41b3eb5fd51b47742c6fa2ac1851a51ab0c69 Author: Kari Argillander Date: Thu Sep 9 21:09:39 2021 +0300 fs/ntfs3: Remove tmp pointer bd_inode in fill_super Drop tmp pointer bd_inode because this is only used ones in fill_super. Also we have so many initializing happening at the beginning that it is already way too much to follow. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0cde7e81cd448a5df01a3960f6608b15dc3f12a3 Author: Kari Argillander Date: Thu Sep 9 21:09:38 2021 +0300 fs/ntfs3: Remove tmp var is_ro in ntfs_fill_super We only use this in two places so we do not really need it. Also wrapper sb_rdonly() is pretty self explanatory. This will make little bit easier to read this super long variable list in the beginning of ntfs_fill_super(). Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit b4f110d65e21bf937fc5d3d894ec1cd540c85a71 Author: Kari Argillander Date: Thu Sep 9 21:09:37 2021 +0300 fs/ntfs3: Use sb instead of sbi->sb in fill_super Use sb instead of sbi->sb in fill_super. We have sb so why not use it. Also makes code more readable. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 10b4f12c7028399007aaebc25810b18d8f7731a7 Author: Kari Argillander Date: Thu Sep 9 21:09:36 2021 +0300 fs/ntfs3: Remove unnecessary variable loading in fill_super Remove some unnecessary variable loading. These look like copy paste work and they are not used to anything. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit bce1828f6d82ad0ffa3b7259d6f1769ffbcec30c Author: Kari Argillander Date: Thu Sep 9 21:09:35 2021 +0300 fs/ntfs3: Return straight without goto in fill_super In many places it is not needed to use goto out. We can just return right away. This will make code little bit more cleaner as we won't need to check error path. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 5d7d6b16bc1dbe0f84997e639c49b5ed98a562f7 Author: Kari Argillander Date: Thu Sep 9 21:09:34 2021 +0300 fs/ntfs3: Remove impossible fault condition in fill_super Remove root drop when we fault out. This can never happened because when we allocate root we eather fault when no root or success. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 7ea04817866a5ac369f1a33d1b86d06a695aaedb Author: Kari Argillander Date: Thu Sep 9 21:09:33 2021 +0300 fs/ntfs3: Change EINVAL to ENOMEM when d_make_root fails Change EINVAL to ENOMEM when d_make_root fails because that is right errno. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0412016e48076f5f9dbdcc6613436e3c6db89523 Author: Kari Argillander Date: Thu Sep 9 21:09:32 2021 +0300 fs/ntfs3: Fix wrong error message $Logfile -> $UpCase Fix wrong error message $Logfile -> $UpCase. Probably copy paste. Fixes: 203c2b3a406a ("fs/ntfs3: Add initialization of super block") Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 794d5b8a497ff053f56856472e2fae038fa761aa Author: Jan Beulich Date: Fri Sep 17 12:50:38 2021 +0200 swiotlb-xen: this is PV-only on x86 The code is unreachable for HVM or PVH, and it also makes little sense in auto-translated environments. On Arm, with xen_{create,destroy}_contiguous_region() both being stubs, I have a hard time seeing what good the Xen specific variant does - the generic one ought to be fine for all purposes there. Still Arm code explicitly references symbols here, so the code will continue to be included there. Instead of making PCI_XEN's "select" conditional, simply drop it - SWIOTLB_XEN will be available unconditionally in the PV case anyway, and is - as explained above - dead code in non-PV environments. This in turn allows dropping the stubs for xen_{create,destroy}_contiguous_region(), the former of which was broken anyway - it failed to set the DMA handle output. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/5947b8ae-fdc7-225c-4838-84712265fc1e@suse.com Signed-off-by: Juergen Gross commit 8e1034a526652f265ed993fab7f659eb8ae4b6f0 Author: Jan Beulich Date: Fri Sep 17 12:49:04 2021 +0200 xen/pci-swiotlb: reduce visibility of symbols xen_swiotlb and pci_xen_swiotlb_init() are only used within the file defining them, so make them static and remove the stubs. Otoh pci_xen_swiotlb_detect() has a use (as function pointer) from the main pci-swiotlb.c file - convert its stub to a #define to NULL. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/aef5fc33-9c02-4df0-906a-5c813142e13c@suse.com Signed-off-by: Juergen Gross commit e243ae953b5926eba1a8fbea64cbf68094f86a44 Author: Jan Beulich Date: Fri Sep 17 12:48:03 2021 +0200 PCI: only build xen-pcifront in PV-enabled environments The driver's module init function, pcifront_init(), invokes xen_pv_domain() first thing. That construct produces constant "false" when !CONFIG_XEN_PV. Hence there's no point building the driver in non-PV configurations. Drop the (now implicit and generally wrong) X86 dependency: At present, XEN_PV can only be set when X86 is also enabled. In general an architecture supporting Xen PV (and PCI) would want to have this driver built. Signed-off-by: Jan Beulich Reviewed-by: Stefano Stabellini Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/3a7f6c9b-215d-b593-8056-b5fe605dafd7@suse.com Signed-off-by: Juergen Gross commit 9074c79b62b6e0d91d7f716c6e4e9968eaf9e043 Author: Jan Beulich Date: Fri Sep 17 12:45:49 2021 +0200 swiotlb-xen: ensure to issue well-formed XENMEM_exchange requests While the hypervisor hasn't been enforcing this, we would still better avoid issuing requests with GFNs not aligned to the requested order. Instead of altering the value also in the call to panic(), drop it there for being static and hence easy to determine without being part of the panic message. Signed-off-by: Jan Beulich Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/7b3998e3-1233-4e5a-89ec-d740e77eb166@suse.com Signed-off-by: Juergen Gross commit f28347cc66395e96712f5c2db0a302ee75bafce6 Author: Jan Beulich Date: Fri Sep 17 08:13:08 2021 +0200 Xen/gntdev: don't ignore kernel unmapping error While working on XSA-361 and its follow-ups, I failed to spot another place where the kernel mapping part of an operation was not treated the same as the user space part. Detect and propagate errors and add a 2nd pr_debug(). Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/c2513395-74dc-aea3-9192-fd265aa44e35@suse.com Signed-off-by: Juergen Gross commit 4403f8062abecf24794e0fd3a3e424cc63ba6662 Author: Jan Beulich Date: Thu Sep 16 17:05:29 2021 +0200 xen/x86: drop redundant zeroing from cpu_initialize_context() Just after having obtained the pointer from kzalloc() there's no reason at all to set part of the area to all zero yet another time. Similarly there's no point explicitly clearing "ldt_ents". Signed-off-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/14881835-a48e-29fa-0870-e177b10fcf65@suse.com Signed-off-by: Juergen Gross commit 36747c96ed496f62dabd1dce9b0f0d5b58495b66 Merge: 42a99a0be3075 5126b9d3d4acd Author: David S. Miller Date: Mon Sep 20 13:28:50 2021 +0100 Merge branch 'hns3-fixes' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 5126b9d3d4acdebc12b9d436282f88d8a1b5146c Author: Yufeng Mo Date: Wed Sep 15 21:52:11 2021 +0800 net: hns3: fix a return value error in hclge_get_reset_status() hclge_get_reset_status() should return the tqp reset status. However, if the CMDQ fails, the caller will take it as tqp reset success status by mistake. Therefore, uses a parameters to get the tqp reset status instead. Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit ef39d632608e66f428c1246836fd060cf4818d67 Author: liaoguojia Date: Wed Sep 15 21:52:10 2021 +0800 net: hns3: check vlan id before using it The input parameters may not be reliable, so check the vlan id before using it, otherwise may set wrong vlan id into hardware. Fixes: dc8131d846d4 ("net: hns3: Fix for packet loss due wrong filter config in VLAN tbls") Signed-off-by: liaoguojia Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 63b1279d9905100a14da9e043de7b28e99dba3f8 Author: Yufeng Mo Date: Wed Sep 15 21:52:09 2021 +0800 net: hns3: check queue id range before using The input parameters may not be reliable. Before using the queue id, we should check this parameter. Otherwise, memory overwriting may occur. Fixes: d34100184685 ("net: hns3: refactor the mailbox message between PF and VF") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 311c0aaa9b4bb8dc65f22634e15963316b17c921 Author: Jiaran Zhang Date: Wed Sep 15 21:52:08 2021 +0800 net: hns3: fix misuse vf id and vport id in some logs vport_id include PF and VFs, vport_id = 0 means PF, other values mean VFs. So the actual vf id is equal to vport_id minus 1. Some VF print logs are actually vport, and logs of vf id actually use vport id, so this patch fixes them. Fixes: ac887be5b0fe ("net: hns3: change print level of RAS error log from warning to error") Fixes: adcf738b804b ("net: hns3: cleanup some print format warning") Signed-off-by: Jiaran Zhang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 91bc0d5272d3a4dc3d4fd2a74387c7e7361bbe96 Author: Jian Shen Date: Wed Sep 15 21:52:07 2021 +0800 net: hns3: fix inconsistent vf id print The vf id from ethtool is added 1 before configured to driver. So it's necessary to minus 1 when printing it, in order to keep consistent with user's configuration. Fixes: dd74f815dd41 ("net: hns3: Add support for rule add/delete for flow director") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e184cec5e29d8eb3c3435b12a9074b75e2d69e4a Author: Jian Shen Date: Wed Sep 15 21:52:06 2021 +0800 net: hns3: fix change RSS 'hfunc' ineffective issue When user change rss 'hfunc' without set rss 'hkey' by ethtool -X command, the driver will ignore the 'hfunc' for the hkey is NULL. It's unreasonable. So fix it. Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Fixes: 374ad291762a ("net: hns3: Add RSS general configuration support for VF") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e840f42a49925707fca90e6c7a4095118fdb8c4d Author: Marc Zyngier Date: Sun Sep 19 14:09:49 2021 +0100 KVM: arm64: Fix PMU probe ordering Russell reported that since 5.13, KVM's probing of the PMU has started to fail on his HW. As it turns out, there is an implicit ordering dependency between the architectural PMU probing code and and KVM's own probing. If, due to probe ordering reasons, KVM probes before the PMU driver, it will fail to detect the PMU and prevent it from being advertised to guests as well as the VMM. Obviously, this is one probing too many, and we should be able to deal with any ordering. Add a callback from the PMU code into KVM to advertise the registration of a host CPU PMU, allowing for any probing order. Fixes: 5421db1be3b1 ("KVM: arm64: Divorce the perf code from oprofile helpers") Reported-by: "Russell King (Oracle)" Tested-by: Russell King (Oracle) Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/YUYRKVflRtUytzy5@shell.armlinux.org.uk Cc: stable@vger.kernel.org commit a49b50a3c1c3226d26e1dd11e8b763f27e477623 Author: Zenghui Yu Date: Tue Sep 7 13:21:37 2021 +0800 KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule Add FORCE so that if_changed can detect the command line change. We'll otherwise see a compilation warning since commit e1f86d7b4b2a ("kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and filechk"). arch/arm64/kvm/hyp/nvhe/Makefile:58: FORCE prerequisite is missing Cc: David Brazdil Cc: Masahiro Yamada Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210907052137.1059-1-yuzenghui@huawei.com commit 1cd73200dad2d53d839b3323596dbf8a2b949d86 Author: Arnd Bergmann Date: Mon Sep 20 12:02:52 2021 +0200 firmware: arm_scmi: Remove __exit annotation virtio_scmi_exit() is only called from __exit function, so the annotation is correct, but when the driver is built-in, the section gets discarded and the reference from a callback pointer causes a link-time error: `virtio_scmi_exit' referenced in section `.rodata' of drivers/firmware/arm_scmi/virtio.o: defined in discarded section `.exit.text' of drivers/firmware/arm_scmi/virtio.o I could not figure out a better workaround, so let's just remove that annotation even if it wastes a couple of bytes in .text. Link: https://lore.kernel.org/r/20210920100301.1466486-2-arnd@kernel.org Fixes: 46abe13b5e3d ("firmware: arm_scmi: Add virtio transport") Signed-off-by: Arnd Bergmann Signed-off-by: Sudeep Holla commit c90521a0e94f00a2e40889b7d7d99f1494fa9381 Author: Cristian Marussi Date: Mon Aug 16 15:16:09 2021 +0100 firmware: arm_scmi: Fix virtio transport Kconfig dependency ARM_SCMI_TRANSPORT_VIRTIO is a 'bool' Kconfig used to include support for the SCMI virtio transport inside the core SCMI stack; a bare transport dependency attached here to this option, though, cannot be properly propagated to the parent ARM_SCMI_PROTOCOL option and, as a result, it is currently possible to configure a Kernel where SCMI core is builtin and includes support for virtio while VirtIO core is =m. This allowed combination breaks linking: ARM_SCMI_PROTOCOL=y ARM_SCMI_TRANSPORT_VIRTIO=y VIRTIO=m Bind the dependency in ARM_SCMI_TRANSPORT_VIRTIO to the chosen kind of compilation of ARM_SCMI_PROTOCOL. Link: https://lore.kernel.org/r/20210816141609.41751-1-cristian.marussi@arm.com Fixes: 46abe13b5e3d ("firmware: arm_scmi: Add virtio transport") Reported-by: kernel test robot Suggested-by: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit aa3233ea7bdb6c4004f5032a3a07417ea51dc409 Author: Arnd Bergmann Date: Mon Sep 20 11:55:09 2021 +0200 staging: r8188eu: fix -Wrestrict warnings Adding back the nonstandard ioctl commands caused -Wrestrict warnings when building with 'make W=1': drivers/staging/r8188eu/os_dep/ioctl_linux.c: In function 'rtw_mp_read_rf': drivers/staging/r8188eu/os_dep/ioctl_linux.c:5515:27: error: 'sprintf' argument 3 overlaps destination object 'extra' [-Werror=restrict] 5515 | sprintf(extra, "%s %d", extra, strtou); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/r8188eu/os_dep/ioctl_linux.c:5470:54: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 5470 | struct iw_point *wrqu, char *extra) | ~~~~~~^~~~~ Change these to the same construct used elsewhere in that driver, with an offset to the string to make the warning go away. The ioctl commands were previously removed, and it's unlikely that anything is actually using them, so ideally I would prefer to have them removed again. The lack of range checking of the 'extra' output buffer is also slightly worrying, but I did not check whether this could cause harm. Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210920095525.1150678-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 42a99a0be307562c1bfef32bad8f89aa3c428edd Author: Arnd Bergmann Date: Mon Sep 20 11:57:49 2021 +0200 ptp: ocp: add COMMON_CLK dependency Without CONFIG_COMMON_CLK, this fails to link: arm-linux-gnueabi-ld: drivers/ptp/ptp_ocp.o: in function `ptp_ocp_register_i2c': ptp_ocp.c:(.text+0xcc0): undefined reference to `__clk_hw_register_fixed_rate' arm-linux-gnueabi-ld: ptp_ocp.c:(.text+0xcf4): undefined reference to `devm_clk_hw_register_clkdev' arm-linux-gnueabi-ld: drivers/ptp/ptp_ocp.o: in function `ptp_ocp_detach': ptp_ocp.c:(.text+0x1c24): undefined reference to `clk_hw_unregister_fixed_rate' Fixes: a7e1abad13f3 ("ptp: Add clock driver for the OpenCompute TimeCard.") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 1ca200a8c6f079950a04ea3c3380fe8cf78e95a2 Author: Krzysztof Kozlowski Date: Fri Sep 17 11:18:48 2021 +0200 USB: serial: option: remove duplicate USB device ID The device ZTE 0x0094 is already on the list. Signed-off-by: Krzysztof Kozlowski Fixes: b9e44fe5ecda ("USB: option: cleanup zte 3g-dongle's pid in option.c") Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 211f323768a25b30c106fd38f15a0f62c7c2b5f4 Author: Krzysztof Kozlowski Date: Fri Sep 17 11:18:47 2021 +0200 USB: serial: mos7840: remove duplicated 0xac24 device ID 0xac24 device ID is already defined and used via BANDB_DEVICE_ID_USO9ML2_4. Remove the duplicate from the list. Fixes: 27f1281d5f72 ("USB: serial: Extra device/vendor ID for mos7840 driver") Signed-off-by: Krzysztof Kozlowski Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 5bed8b0704c9ecccc8f4a2c377d7c8e21090a82e Author: Michael Chan Date: Mon Sep 20 02:51:52 2021 -0400 bnxt_en: Fix TX timeout when TX ring size is set to the smallest The smallest TX ring size we support must fit a TX SKB with MAX_SKB_FRAGS + 1. Because the first TX BD for a packet is always a long TX BD, we need an extra TX BD to fit this packet. Define BNXT_MIN_TX_DESC_CNT with this value to make this more clear. The current code uses a minimum that is off by 1. Fix it using this constant. The tx_wake_thresh to determine when to wake up the TX queue is half the ring size but we must have at least BNXT_MIN_TX_DESC_CNT for the next packet which may have maximum fragments. So the comparison of the available TX BDs with tx_wake_thresh should be >= instead of > in the current code. Otherwise, at the smallest ring size, we will never wake up the TX queue and will cause TX timeout. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 563f23b002534176f49524b5ca0e1d94d8906c40 Author: Ido Schimmel Date: Fri Sep 17 16:02:18 2021 +0300 nexthop: Fix division by zero while replacing a resilient group The resilient nexthop group torture tests in fib_nexthop.sh exposed a possible division by zero while replacing a resilient group [1]. The division by zero occurs when the data path sees a resilient nexthop group with zero buckets. The tests replace a resilient nexthop group in a loop while traffic is forwarded through it. The tests do not specify the number of buckets while performing the replacement, resulting in the kernel allocating a stub resilient table (i.e, 'struct nh_res_table') with zero buckets. This table should never be visible to the data path, but the old nexthop group (i.e., 'oldg') might still be used by the data path when the stub table is assigned to it. Fix this by only assigning the stub table to the old nexthop group after making sure the group is no longer used by the data path. Tested with fib_nexthops.sh: Tests passed: 222 Tests failed: 0 [1] divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1850 Comm: ping Not tainted 5.14.0-custom-10271-ga86eb53057fe #1107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:nexthop_select_path+0x2d2/0x1a80 [...] Call Trace: fib_select_multipath+0x79b/0x1530 fib_select_path+0x8fb/0x1c10 ip_route_output_key_hash_rcu+0x1198/0x2da0 ip_route_output_key_hash+0x190/0x340 ip_route_output_flow+0x21/0x120 raw_sendmsg+0x91d/0x2e10 inet_sendmsg+0x9e/0xe0 __sys_sendto+0x23d/0x360 __x64_sys_sendto+0xe1/0x1b0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Cc: stable@vger.kernel.org Fixes: 283a72a5599e ("nexthop: Add implementation of resilient next-hop groups") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 3765996e4f0b8a755cab215a08df744490c76052 Author: Xuan Zhuo Date: Sat Sep 18 16:52:32 2021 +0800 napi: fix race inside napi_enable The process will cause napi.state to contain NAPI_STATE_SCHED and not in the poll_list, which will cause napi_disable() to get stuck. The prefix "NAPI_STATE_" is removed in the figure below, and NAPI_STATE_HASHED is ignored in napi.state. CPU0 | CPU1 | napi.state =============================================================================== napi_disable() | | SCHED | NPSVC napi_enable() | | { | | smp_mb__before_atomic(); | | clear_bit(SCHED, &n->state); | | NPSVC | napi_schedule_prep() | SCHED | NPSVC | napi_poll() | | napi_complete_done() | | { | | if (n->state & (NPSVC | | (1) | _BUSY_POLL))) | | return false; | | ................ | | } | SCHED | NPSVC | | clear_bit(NPSVC, &n->state); | | SCHED } | | | | napi_schedule_prep() | | SCHED | MISSED (2) (1) Here return direct. Because of NAPI_STATE_NPSVC exists. (2) NAPI_STATE_SCHED exists. So not add napi.poll_list to sd->poll_list Since NAPI_STATE_SCHED already exists and napi is not in the sd->poll_list queue, NAPI_STATE_SCHED cannot be cleared and will always exist. 1. This will cause this queue to no longer receive packets. 2. If you encounter napi_disable under the protection of rtnl_lock, it will cause the entire rtnl_lock to be locked, affecting the overall system. This patch uses cmpxchg to implement napi_enable(), which ensures that there will be no race due to the separation of clear two bits. Fixes: 2d8bff12699abc ("netpoll: Close race condition between poll_one_napi and napi_disable") Signed-off-by: Xuan Zhuo Reviewed-by: Dust Li Signed-off-by: David S. Miller commit 50c7ad36e65498802a4015d987d92445ecfb5d00 Merge: 3e1d5b0f58a5e e9a9970bf520c Author: Greg Kroah-Hartman Date: Mon Sep 20 09:04:54 2021 +0200 Merge tag 'fpga-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-linus FPGA Manager fixes for 5.15 Tom and Jiapeng's fixes address smatch warnings around missing return values in error cases. Russ' change addresses an issue where registers are being accessed too early resulting in invalid data being read. All patches have been reviewed on the mailing list, and have been in the last few linux-next releases (as part of my fixes branch) without issues. Signed-off-by: Moritz Fischer * tag 'fpga-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga: fpga: dfl: Avoid reads to AFU CSRs during enumeration fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() fpga: machxo2-spi: Return an error on failure commit 3e1d5b0f58a5ecda37f4b4fe37c6436315ae9ac5 Merge: 25a1433216489 c8fee41957f03 Author: Greg Kroah-Hartman Date: Mon Sep 20 09:02:36 2021 +0200 Merge tag 'misc-habanalabs-fixes-2021-09-19' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux into char-misc-linus Oded writes: This tag contains the following fixes for 5.15-rc3: - Fix potential race when user waiting for interrupt ioctl - Prevent possible kernel oops in staged CS ioctl - Use direct MSI mechanism in Gaudi as a WA for a H/W issue regarding FLR - Don't support collective wait ioctl operation when it is not supported. e.g. when the NIC ports are disabled - Fix configuration of one of the security mechanism. - Change error print to be rate-limited as it can be initiated by the user and spam the kernel log - Fix return value of CS ioctl when doing staged CS - Fix CS ioctl code when user doesn't supply an offset for the memory area that we use as fence. - Spelling mistake fix * tag 'misc-habanalabs-fixes-2021-09-19' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux: habanalabs: expose a single cs seq in staged submissions habanalabs: fix wait offset handling habanalabs: rate limit multi CS completion errors habanalabs/gaudi: fix LBW RR configuration habanalabs: Fix spelling mistake "FEADBACK" -> "FEEDBACK" habanalabs: fail collective wait when not supported habanalabs/gaudi: use direct MSI in single mode habanalabs: fix kernel OOPs related to staged cs habanalabs: fix potential race in interrupt wait ioctl commit 0a91cacee897eb83cf9539bd739f98899e31af85 Author: Stephen Boyd Date: Wed Aug 11 15:41:41 2021 -0700 arm64: dts: qcom: sc7180-trogdor: Fix lpass dai link for HDMI This should be the dai for display port. Without this set properly we fail to get audio routed through external displays on trogdor. It looks like we picked up v4[1] of this patch when there was a v7[2]. The v7 patch still had the wrong sound-dai but at least we can fix all this up and audio works. Cc: Srinivasa Rao Mandadapu Cc: Srinivas Kandagatla Cc: Douglas Anderson Fixes: b22d313e1772 ("arm64: dts: qcom: sc7180-trogdor: Add lpass dai link for HDMI") Link: https://lore.kernel.org/r/20210721080549.28822-3-srivasam@qti.qualcomm.com [1] Link: https://lore.kernel.org/r/20210726120910.20335-3-srivasam@codeaurora.org [2] Signed-off-by: Stephen Boyd Reviewed-by: Douglas Anderson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210811224141.1110495-1-swboyd@chromium.org commit ecf5b34cd5182180ff47ca14ecaca0a90db7fd1d Author: David Heidelberg Date: Sun Aug 29 15:39:17 2021 +0200 ARM: dts: qcom: apq8064: update Adreno clock names The legacy clock names (including the _clk suffix) was dropped from the driver, so update the dts accordingly). Tested on Nexus 7 2013, no functional changes. Signed-off-by: David Heidelberg [bjorn: Updated commit message] Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210829133918.57780-2-david@ixit.cz commit 40c8ee67cfc49d00a13ccbf542e307b6b5421ad3 Author: Leon Romanovsky Date: Tue Sep 14 12:12:10 2021 +0300 init: don't panic if mount_nodev_root failed Attempt to mount 9p file system as root gives the following kernel panic: 9pnet_virtio: no channels available for device root Kernel panic - not syncing: VFS: Unable to mount root "root" (9p), err=-2 CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc1+ #127 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 panic+0x1e2/0x44b ? __warn_printk+0xf3/0xf3 ? free_unref_page+0x2d4/0x4a0 ? trace_hardirqs_on+0x32/0x120 ? free_unref_page+0x2d4/0x4a0 mount_root+0x189/0x1e0 prepare_namespace+0x136/0x165 kernel_init_freeable+0x3b8/0x3cb ? rest_init+0x2e0/0x2e0 kernel_init+0x19/0x130 ret_from_fork+0x1f/0x30 Kernel Offset: disabled ---[ end Kernel panic - not syncing: VFS: Unable to mount root "root" (9p), err=-2 ]--- QEMU command line: "qemu-system-x86_64 -append root=/dev/root rw rootfstype=9p rootflags=trans=virtio ..." This error is because root_device_name is truncated in prepare_namespace() from being "/dev/root" to be "root" prior to call to mount_nodev_root(). As a solution, don't treat errors in mount_nodev_root() as errors that require panics and allow failback to the mount flow that existed before patch citied in Fixes tag. Fixes: f9259be6a9e7 ("init: allow mounting arbitrary non-blockdevice filesystems as root") Signed-off-by: Leon Romanovsky Reviewed-by: Christoph Hellwig Signed-off-by: Al Viro commit b51593c4cd739dff7fc40bbed368572d98b19ae8 Author: Vivek Goyal Date: Fri Sep 17 09:13:23 2021 -0400 init/do_mounts.c: Harden split_fs_names() against buffer overflow split_fs_names() currently takes comma separate list of filesystems and converts it into individual filesystem strings. Pleaces these strings in the input buffer passed by caller and returns number of strings. If caller manages to pass input string bigger than buffer, then we can write beyond the buffer. Or if string just fits buffer, we will still write beyond the buffer as we append a '\0' byte at the end. Pass size of input buffer to split_fs_names() and put enough checks in place so such buffer overrun possibilities do not occur. This patch does few things. - Add a parameter "size" to split_fs_names(). This specifies size of input buffer. - Use strlcpy() (instead of strcpy()) so that we can't go beyond buffer size. If input string "names" is larger than passed in buffer, input string will be truncated to fit in buffer. - Stop appending extra '\0' character at the end and avoid one possibility of going beyond the input buffer size. - Do not use extra loop to count number of strings. - Previously if one passed "rootfstype=foo,,bar", split_fs_names() will return only 1 string "foo" (and "bar" will be truncated due to extra ,). After this patch, now split_fs_names() will return 3 strings ("foo", zero-sized-string, and "bar"). Callers of split_fs_names() have been modified to check for zero sized string and skip to next one. Reported-by: xu xin Signed-off-by: Vivek Goyal Reviewed-by: Jan Kara Signed-off-by: Al Viro commit 4382c73a12b4cab537176011a36a3c019cb2a04e Author: Geert Uytterhoeven Date: Tue Aug 24 14:27:41 2021 +0200 firmware: qcom_scm: QCOM_SCM should depend on ARCH_QCOM The Qualcomm Secure Channel Manager (SCM) is only present on Qualcomm SoCs. All drivers using it select QCOM_SCM, and depend on ARCH_QCOM. Until recently, QCOM_SCM was an invisible symbol, but this was changed by adding loadable module support, exposing it to all ARM and ARM64 users. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm SoC support. While at it, drop the dependency on ARM || ARM64, as that is implied by HAVE_ARM_SMCCC. Fixes: b42000e4b8741bf6 ("firmware: qcom_scm: Allow qcom_scm driver to be loadable as a permenent module") Fixes: 2954a6f12f250890 ("firmware: qcom-scm: Fix QCOM_SCM configuration") Signed-off-by: Geert Uytterhoeven Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/5cda77085c07dc2e8d2195507b287457cb2f09e9.1629807831.git.geert+renesas@glider.be commit 833d51d7c66d6708abbc02398892b96b950167b9 Author: Shawn Guo Date: Sat Aug 28 15:02:02 2021 +0800 soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment PT_LOAD type denotes that the segment should be loaded into the final firmware memory region. Hash segment is not one such, because it's only needed for PAS init and shouldn't be in the final firmware memory region. That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and hash segment. This actually makes the hash segment type check in qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment, it won't be loaded into firmware memory region anyway, due to the QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD type for some reason (misusing or abusing?). Some firmware files on Sony phones are such examples, e.g WCNSS firmware of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD. Drop the unnecessary hash segment type check in qcom_mdt_read_metadata() to fix firmware loading failure on these phones, while hash segment is still kept away from the final firmware memory region. Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images") Signed-off-by: Shawn Guo Reviewed-by: Marijn Suijten Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org commit e4e737bb5c170df6135a127739a9e6148ee3da82 Author: Linus Torvalds Date: Sun Sep 19 17:28:22 2021 -0700 Linux 5.15-rc2 commit 4420a0dec79428eabe631269ba0408f79658e0d3 Author: Amit Pundir Date: Fri Sep 17 01:35:54 2021 +0530 arm64: dts: qcom: sdm850-yoga: Reshuffle IPA memory mappings Upstream commit 2e01e0c21459 ("arm64: dts: qcom: sdm850-yoga: Enable IPA") shuffled reserved memory regions in sdm845.dtsi to make firmware loading succeed and enable the ipa device on sdm845-yoga but it broke the other common users of those memory regions like Xiaomi Pocophone F1. So this patch effectively revert those upstream commit changes and move all the relevant changes to sdm850-lenovo-yoga-c630.dts instead. Fixes: 2e01e0c21459 ("arm64: dts: qcom: sdm850-yoga: Enable IPA") Signed-off-by: Amit Pundir Tested-by: Steev Klimaszewski Tested-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210916200554.2434439-1-amit.pundir@linaro.org commit 316e8d79a0959c302b0c462ab64b069599f10eef Author: Linus Torvalds Date: Sun Sep 19 17:13:35 2021 -0700 pci_iounmap'2: Electric Boogaloo: try to make sense of it all Nathan Chancellor reports that the recent change to pci_iounmap in commit 9caea0007601 ("parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled") causes build errors on arm64. It took me about two hours to convince myself that I think I know what the logic of that mess of #ifdef's in the header file really aim to do, and rewrite it to be easier to follow. Famous last words. Anyway, the code has now been lifted from that grotty header file into lib/pci_iomap.c, and has fairly extensive comments about what the logic is. It also avoids indirecting through another confusing (and badly named) helper function that has other preprocessor config conditionals. Let's see what odd architecture did something else strange in this area to break things. But my arm64 cross build is clean. Fixes: 9caea0007601 ("parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled") Reported-by: Nathan Chancellor Cc: Helge Deller Cc: Arnd Bergmann Cc: Guenter Roeck Cc: Ulrich Teichert Cc: James Bottomley Signed-off-by: Linus Torvalds commit 20621d2f27a0163b81dc2b74fd4c0b3e6aa5fa12 Merge: fec3036200b7d 81065b35e2486 Author: Linus Torvalds Date: Sun Sep 19 13:29:36 2021 -0700 Merge tag 'x86_urgent_for_v5.15_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Prevent a infinite loop in the MCE recovery on return to user space, which was caused by a second MCE queueing work for the same page and thereby creating a circular work list. - Make kern_addr_valid() handle existing PMD entries, which are marked not present in the higher level page table, correctly instead of blindly dereferencing them. - Pass a valid address to sanitize_phys(). This was caused by the mixture of inclusive and exclusive ranges. memtype_reserve() expect 'end' being exclusive, but sanitize_phys() wants it inclusive. This worked so far, but with end being the end of the physical address space the fail is exposed. - Increase the maximum supported GPIO numbers for 64bit. Newer SoCs exceed the previous maximum. * tag 'x86_urgent_for_v5.15_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Avoid infinite loop for copy from user recovery x86/mm: Fix kern_addr_valid() to cope with existing but not present entries x86/platform: Increase maximum GPIO number for X86_64 x86/pat: Pass valid address to sanitize_phys() commit fec3036200b7d9df32c94eb2616447eb2f6e09ac Merge: f5e29a26c42b2 b89a05b21f461 Author: Linus Torvalds Date: Sun Sep 19 13:22:40 2021 -0700 Merge tag 'perf-urgent-2021-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Thomas Gleixner: "A single fix for the perf core where a value read with READ_ONCE() was checked and then reread which makes all the checks invalid. Reuse the already read value instead" * tag 'perf-urgent-2021-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: events: Reuse value read using READ_ONCE instead of re-reading it commit f5e29a26c42b2c1b149118319a03bf937f168298 Merge: 62453a460a000 81121524f1c79 Author: Linus Torvalds Date: Sun Sep 19 13:11:19 2021 -0700 Merge tag 'locking-urgent-2021-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Thomas Gleixner: "A set of updates for the RT specific reader/writer locking base code: - Make the fast path reader ordering guarantees correct. - Code reshuffling to make the fix simpler" [ This plays ugly games with atomic_add_return_release() because we don't have a plain atomic_add_release(), and should really be cleaned up, I think - Linus ] * tag 'locking-urgent-2021-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwbase: Take care of ordering guarantee for fastpath reader locking/rwbase: Extract __rwbase_write_trylock() locking/rwbase: Properly match set_and_save_state() to restore_state() commit 62453a460a000156b100bf20ab78cf77232284d0 Merge: 2f629969b01da c006a06508db4 Author: Linus Torvalds Date: Sun Sep 19 13:00:23 2021 -0700 Merge tag 'powerpc-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix crashes when scv (System Call Vectored) is used to make a syscall when a transaction is active, on Power9 or later. - Fix bad interactions between rfscv (Return-from scv) and Power9 fake-suspend mode. - Fix crashes when handling machine checks in LPARs using the Hash MMU. - Partly revert a recent change to our XICS interrupt controller code, which broke the recently added Microwatt support. Thanks to Cédric Le Goater, Eirik Fuller, Ganesh Goudar, Gustavo Romero, Joel Stanley, Nicholas Piggin. * tag 'powerpc-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/xics: Set the IRQ chip data for the ICS native backend powerpc/mce: Fix access error in mce handler KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers powerpc/64s: system call rfscv workaround for TM bugs selftests/powerpc: Add scv versions of the basic TM syscall tests powerpc/64s: system call scv tabort fix for corrupt irq soft-mask state commit 2f629969b01dab4ef6254fdfcfda3d82b1ad5420 Merge: d94f395772aee 0664684e1ebd7 Author: Linus Torvalds Date: Sun Sep 19 12:55:12 2021 -0700 Merge tag 'kbuild-fixes-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix bugs in checkkconfigsymbols.py - Fix missing sys import in gen_compile_commands.py - Fix missing FORCE warning for ARCH=sh builds - Fix -Wignored-optimization-argument warnings for Clang builds - Turn -Wignored-optimization-argument into an error in order to stop building instead of sprinkling warnings * tag 'kbuild-fixes-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: Add -Werror=ignored-optimization-argument to CLANG_FLAGS x86/build: Do not add -falign flags unconditionally for clang kbuild: Fix comment typo in scripts/Makefile.modpost sh: Add missing FORCE prerequisites in Makefile gen_compile_commands: fix missing 'sys' package checkkconfigsymbols.py: Remove skipping of help lines in parse_kconfig_file checkkconfigsymbols.py: Forbid passing 'HEAD' to --commit commit d94f395772aeee64325d8b2f279560f08ac06fac Merge: bc1abb9e55ced 219d720e6df71 Author: Linus Torvalds Date: Sun Sep 19 12:49:17 2021 -0700 Merge tag 'perf-tools-fixes-for-v5.15-2021-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix ip display in 'perf script' when output type != attr->type. - Ignore deprecation warning when using libbpf'sg btf__get_from_id(), fixing the build with libbpf v0.6+. - Make use of FD() robust in libperf, fixing a segfault with 'perf stat --iostat list'. - Initialize addr_location:srcline pointer to NULL when resolving callchain addresses. - Fix fused instruction logic for assembly functions in 'perf annotate'. * tag 'perf-tools-fixes-for-v5.15-2021-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf bpf: Ignore deprecation warning when using libbpf's btf__get_from_id() libperf evsel: Make use of FD robust. perf machine: Initialize srcline string member in add_location struct perf script: Fix ip display when type != attr->type perf annotate: Fix fused instr logic for assembly functions commit bc1abb9e55cedaeac4602426f8fc83fb3a5b1c35 Author: Linus Torvalds Date: Sun Sep 19 10:49:42 2021 -0700 dmascc: use proper 'virt_to_bus()' rather than casting to 'int' The old dmascc driver depends on the legacy ISA_DMA_API, and blindly just casts the kernel virtual address to 'int' for set_dma_addr(). That works only incidentally, and because the high bits of the address will be ignored anyway. And on 64-bit architectures it causes warnings. Admittedly, 64-bit architectures with ISA are basically dead - I think the only example of this is alpha, and nobody would ever use the dmascc driver there. But hey, the fix is easy enough, the end result is cleaner, and it's yet another configuration that now builds without warnings. If somebody actually uses this driver on an alpha and this fixes it for you, please email me. Because that is just incredibly bizarre. Signed-off-by: Linus Torvalds commit 4fef6115903afed5a7f21b387ad132b4c8838bc7 Author: Linus Torvalds Date: Sun Sep 19 10:37:00 2021 -0700 alpha: enable GENERIC_PCI_IOMAP unconditionally With the previous commit (9caea0007601: "parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled") we can now enable GENERIC_PCI_IOMAP unconditionally on alpha, and if PCI is not enabled we will just get the nice empty helper functions that allow mixed-bus drivers to build. Example driver: the old 3com/3c59x.c driver works with either the PCI or the EISA version of the 3x59x card, but wouldn't build in an EISA-only configuration because of missing pci_iomap() and pci_iounmap() dummy wrappers. Most of the other PCI infrastructure just becomes empty wrappers even without GENERIC_PCI_IOMAP, and it's not obvious that the pci_iomap functionality shouldn't do the same, but this works. Cc: Ulrich Teichert Signed-off-by: Linus Torvalds commit 9caea0007601d3bc6debec04f8b4cd6f4c2394be Author: Helge Deller Date: Sun Sep 19 10:36:09 2021 -0700 parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled Linus noticed odd declaration rules for pci_iounmap() in iomap.h and pci_iomap.h, where it dependend on either NO_GENERIC_PCI_IOPORT_MAP or GENERIC_IOMAP when CONFIG_PCI was disabled. Testing on parisc seems to indicate that we need pci_iounmap() only when CONFIG_PCI is enabled, so the declaration of pci_iounmap() can be moved cleanly into pci_iomap.h in sync with the declarations of pci_iomap(). Link: https://lore.kernel.org/all/CAHk-=wjRrh98pZoQ+AzfWmsTZacWxTJKXZ9eKU2X_0+jM=O8nw@mail.gmail.com/ Signed-off-by: Helge Deller Suggested-by: Linus Torvalds Fixes: 97a29d59fc22 ("[PARISC] fix compile break caused by iomap: make IOPORT/PCI mapping functions conditional") Cc: Arnd Bergmann Cc: Guenter Roeck Cc: Ulrich Teichert Cc: James Bottomley Signed-off-by: Linus Torvalds commit 31ad37bd6faf871c070650f72ac9488ceeeceeb0 Author: Linus Torvalds Date: Sun Sep 19 10:11:53 2021 -0700 Revert "drm/vc4: hdmi: Remove drm_encoder->crtc usage" This reverts commit 27da370e0fb343a0baf308f503bb3e5dcdfe3362. Sudip Mukherjee reports that this broke pulseaudio with a NULL pointer dereference in vc4_hdmi_audio_prepare(), bisected it to this commit, and confirmed that a revert fixed the problem. Revert the problematic commit until fixed. Link: https://lore.kernel.org/all/CADVatmPB9-oKd=ypvj25UYysVo6EZhQ6bCM7EvztQBMyiZfAyw@mail.gmail.com/ Link: https://lore.kernel.org/all/CADVatmN5EpRshGEPS_JozbFQRXg5w_8LFB3OMP1Ai-ghxd3w4g@mail.gmail.com/ Reported-and-tested-by: Sudip Mukherjee Cc: Maxime Ripard Cc: Emma Anholt Cc: Dave Airlie Signed-off-by: Linus Torvalds commit b1044a9b8100a0cc5c9d2e1e2f9ca4bb8e32b23a Author: Linus Torvalds Date: Sun Sep 19 10:06:46 2021 -0700 Revert drm/vc4 hdmi runtime PM changes This reverts commits 9984d6664ce9 ("drm/vc4: hdmi: Make sure the controller is powered in detect") 411efa18e4b0 ("drm/vc4: hdmi: Move the HSM clock enable to runtime_pm") as Michael Stapelberg reports that the new runtime PM changes cause his Raspberry Pi 3 to hang on boot, probably due to interactions with other changes in the DRM tree (because a bisect points to the merge in commit e058a84bfddc: "Merge tag 'drm-next-2021-07-01' of git://.../drm"). Revert these two commits until it's been resolved. Link: https://lore.kernel.org/all/871r5mp7h2.fsf@midna.i-did-not-set--mail-host-address--so-tickle-me/ Reported-and-tested-by: Michael Stapelberg Cc: Maxime Ripard Cc: Dave Stevenson Cc: Dave Airlie Signed-off-by: Linus Torvalds commit b6a46b4f6e4b35868e33930acaa7c50bf6cab821 Author: Dan Carpenter Date: Tue Aug 31 11:18:49 2021 +0300 iwlwifi: mvm: d3: missing unlock in iwl_mvm_wowlan_program_keys() This code was refactored and the mutex_unlock(&mvm->mutex); was accidentally deleted. Fixes: af3aab9ce298 ("iwlwifi: mvm: d3: make key reprogramming iteration optional") Signed-off-by: Dan Carpenter Acked-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210831081849.GB9846@kili commit 27a221f433b7ac6604845b09696e60e803972d3c Author: Dan Carpenter Date: Tue Aug 31 11:18:02 2021 +0300 iwlwifi: mvm: d3: Fix off by ones in iwl_mvm_wowlan_get_rsc_v5_data() These should be >= ARRAY_SIZE() instead of > ARRAY_SIZE() to prevent an out of bounds write on the next line. Fixes: 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5") Signed-off-by: Dan Carpenter Acked-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210831081802.GA9846@kili commit e30cd812dffadc58241ae378e48728e6a161becd Author: Shuah Khan Date: Fri Sep 17 15:53:56 2021 -0600 selftests: net: af_unix: Fix makefile to use TEST_GEN_PROGS Makefile uses TEST_PROGS instead of TEST_GEN_PROGS to define executables. TEST_PROGS is for shell scripts that need to be installed and run by the common lib.mk framework. The common framework doesn't touch TEST_PROGS when it does build and clean. As a result "make kselftest-clean" and "make clean" fail to remove executables. Run and install work because the common framework runs and installs TEST_PROGS. Build works because the Makefile defines "all" rule which is unnecessary if TEST_GEN_PROGS is used. Use TEST_GEN_PROGS so the common framework can handle build/run/ install/clean properly. Signed-off-by: Shuah Khan Signed-off-by: David S. Miller commit 72a3c58d18fd780eecd80178bb2132ce741a0a74 Author: Lama Kayal Date: Sun Sep 19 14:55:45 2021 +0300 net/mlx4_en: Resolve bad operstate value Any link state change that's done prior to net device registration isn't reflected on the state, thus the operational state is left obsolete, with 'UNKNOWN' status. To resolve the issue, query link state from FW upon open operations to ensure operational state is updated. Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC") Signed-off-by: Lama Kayal Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 48514a22333099b93c33ea1c7c97dad3f7a611ce Author: Shuah Khan Date: Fri Sep 17 13:26:14 2021 -0600 selftests: net: af_unix: Fix incorrect args in test result msg Fix the args to fprintf(). Splitting the message ends up passing incorrect arg for "sigurg %d" and an extra arg overall. The test result message ends up incorrect. test_unix_oob.c: In function ‘main’: test_unix_oob.c:274:43: warning: format ‘%d’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=] 274 | fprintf(stderr, "Test 3 failed, sigurg %d len %d OOB %c ", | ~^ | | | int | %s 275 | "atmark %d\n", signal_recvd, len, oob, atmark); | ~~~~~~~~~~~~~ | | | char * test_unix_oob.c:274:19: warning: too many arguments for format [-Wformat-extra-args] 274 | fprintf(stderr, "Test 3 failed, sigurg %d len %d OOB %c ", Signed-off-by: Shuah Khan Signed-off-by: David S. Miller commit 029497e66bdc762e001880e4c85a91f35a54b1e2 Author: Christian Lamparter Date: Sun Sep 19 13:57:25 2021 +0200 net: bgmac-bcma: handle deferred probe error due to mac-address Due to the inclusion of nvmem handling into the mac-address getter function of_get_mac_address() by commit d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") it is now possible to get a -EPROBE_DEFER return code. Which did cause bgmac to assign a random ethernet address. This exact issue happened on my Meraki MR32. The nvmem provider is an EEPROM (at24c64) which gets instantiated once the module driver is loaded... This happens once the filesystem becomes available. With this patch, bgmac_probe() will propagate the -EPROBE_DEFER error. Then the driver subsystem will reschedule the probe at a later time. Cc: Petr Štetiar Cc: Michael Walle Fixes: d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") Signed-off-by: Christian Lamparter Signed-off-by: David S. Miller commit fd292c189a979838622d5e03e15fa688c81dd50b Author: Vladimir Oltean Date: Fri Sep 17 17:29:16 2021 +0300 net: dsa: tear down devlink port regions when tearing down the devlink port on error Commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal") decided it was fine to ignore errors on certain ports that fail to probe, and go on with the ports that do probe fine. Commit fb6ec87f7229 ("net: dsa: Fix type was not set for devlink port") noticed that devlink_port_type_eth_set(dlp, dp->slave); does not get called, and devlink notices after a timeout of 3600 seconds and prints a WARN_ON. So it went ahead to unregister the devlink port. And because there exists an UNUSED port flavour, we actually re-register the devlink port as UNUSED. Commit 08156ba430b4 ("net: dsa: Add devlink port regions support to DSA") added devlink port regions, which are set up by the driver and not by DSA. When we trigger the devlink port deregistration and reregistration as unused, devlink now prints another WARN_ON, from here: devlink_port_unregister: WARN_ON(!list_empty(&devlink_port->region_list)); So the port still has regions, which makes sense, because they were set up by the driver, and the driver doesn't know we're unregistering the devlink port. Somebody needs to tear them down, and optionally (actually it would be nice, to be consistent) set them up again for the new devlink port. But DSA's layering stays in our way quite badly here. The options I've considered are: 1. Introduce a function in devlink to just change a port's type and flavour. No dice, devlink keeps a lot of state, it really wants the port to not be registered when you set its parameters, so changing anything can only be done by destroying what we currently have and recreating it. 2. Make DSA cache the parameters passed to dsa_devlink_port_region_create, and the region returned, keep those in a list, then when the devlink port unregister needs to take place, the existing devlink regions are destroyed by DSA, and we replay the creation of new regions using the cached parameters. Problem: mv88e6xxx keeps the region pointers in chip->ports[port].region, and these will remain stale after DSA frees them. There are many things DSA can do, but updating mv88e6xxx's private pointers is not one of them. 3. Just let the driver do it (i.e. introduce a very specific method called ds->ops->port_reinit_as_unused, which unregisters its devlink port devlink regions, then the old devlink port, then registers the new one, then the devlink port regions for it). While it does work, as opposed to the others, it's pretty horrible from an API perspective and we can do better. 4. Introduce a new pair of methods, ->port_setup and ->port_teardown, which in the case of mv88e6xxx must register and unregister the devlink port regions. Call these 2 methods when the port must be reinitialized as unused. Naturally, I went for the 4th approach. Fixes: 08156ba430b4 ("net: dsa: Add devlink port regions support to DSA") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit fdb475838539cb516caeeeaed06b4b5bc62c9179 Author: Krzysztof Kozlowski Date: Fri Sep 17 11:20:58 2021 +0200 net: freescale: drop unneeded MODULE_ALIAS The MODULE_DEVICE_TABLE already creates proper alias for platform driver. Having another MODULE_ALIAS causes the alias to be duplicated. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit d614489f6bc8de28efb347ded5360896b87c9496 Merge: 2dcb96bacce36 ba68e99419847 Author: David S. Miller Date: Sun Sep 19 12:59:52 2021 +0100 Merge branch 'ocelot-phylink-fixes' Colin Foster says: ==================== ocelot phylink fixes When the ocelot driver was migrated to phylink, e6e12df625f2 ("net: mscc: ocelot: convert to phylink") there were two additional writes to registers that became stale. One write was to DEV_CLOCK_CFG and one was to ANA_PFC_PCF_CFG. Both of these writes referenced the variable "speed" which originally was set to OCELOT_SPEED_{10,100,1000,2500}. These macros expand to values of 3, 2, 1, or 0, respectively. After the update, the variable speed is set to SPEED_{10,100,1000,2500} which expand to 10, 100, 1000, and 2500. So invalid values were getting written to the two registers, which would lead to either a lack of functionality or undefined funcationality. Fixing these values was the intent of v1 of this patch set - submitted as "[PATCH v1 net] net: ethernet: mscc: ocelot: bug fix when writing MAC speed" During that review it was determined that both writes were actually unnecessary. DEV_CLOCK_CFG is a duplicate write, so can be removed entirely. This was accidentally submitted as as a new, lone patch titled "[PATCH v1 net] net: mscc: ocelot: remove buggy duplicate write to DEV_CLOCK_CFG". This is part of what is considered v2 of this patch set. Additionally, the write to ANA_PFC_PFC_CFG is also unnecessary. Priority flow contol is disabled, so configuring it is useless and should be removed. This was also submitted as a new, lone patch titled "[PATCH v1 net] net: mscc: ocelot: remove buggy and useless write to ANA_PFC_PFC_CFG". This is the rest of what is considered v2 of this patch set. v3 Identical to v2, but fixes the patch numbering to v3 and submitting the two changes as a patch set. v2 Note: I misunderstood and submitted two new "v1" patches instead of a single "v2" patch set. - Remove the buggy writes altogher ==================== Signed-off-by: David S. Miller commit ba68e9941984792f7e8a7be90b8245eb0d2b4d7b Author: Colin Foster Date: Fri Sep 17 08:39:05 2021 -0700 net: mscc: ocelot: remove buggy duplicate write to DEV_CLOCK_CFG When updating ocelot to use phylink, a second write to DEV_CLOCK_CFG was mistakenly left in. It used the variable "speed" which, previously, would would have been assigned a value of OCELOT_SPEED_1000. In phylink the variable is be SPEED_1000, which is invalid for the DEV_CLOCK_LINK_SPEED macro. Removing it as unnecessary and buggy. Fixes: e6e12df625f2 ("net: mscc: ocelot: convert to phylink") Signed-off-by: Colin Foster Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 163957c43d96c2409d9d9d2e94823f7300f6e52c Author: Colin Foster Date: Fri Sep 17 08:39:04 2021 -0700 net: mscc: ocelot: remove buggy and useless write to ANA_PFC_PFC_CFG A useless write to ANA_PFC_PFC_CFG was left in while refactoring ocelot to phylink. Since priority flow control is disabled, writing the speed has no effect. Further, it was using ethtool.h SPEED_ instead of OCELOT_SPEED_ macros, which are incorrectly offset for GENMASK. Lastly, for priority flow control to properly function, some scenarios would rely on the rate adaptation from the PCS while the MAC speed would be fixed. So it isn't used, and even if it was, neither "speed" nor "mac_speed" are necessarily the correct values to be used. Fixes: e6e12df625f2 ("net: mscc: ocelot: convert to phylink") Signed-off-by: Colin Foster Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 2dcb96bacce36021c2f3eaae0cef607b5bb71ede Author: Thomas Gleixner Date: Sat Sep 18 14:42:35 2021 +0200 net: core: Correct the sock::sk_lock.owned lockdep annotations lock_sock_fast() and lock_sock_nested() contain lockdep annotations for the sock::sk_lock.owned 'mutex'. sock::sk_lock.owned is not a regular mutex. It is just lockdep wise equivalent. In fact it's an open coded trivial mutex implementation with some interesting features. sock::sk_lock.slock is a regular spinlock protecting the 'mutex' representation sock::sk_lock.owned which is a plain boolean. If 'owned' is true, then some other task holds the 'mutex', otherwise it is uncontended. As this locking construct is obviously endangered by lock ordering issues as any other locking primitive it got lockdep annotated via a dedicated dependency map sock::sk_lock.dep_map which has to be updated at the lock and unlock sites. lock_sock_nested() is a straight forward 'mutex' lock operation: might_sleep(); spin_lock_bh(sock::sk_lock.slock) while (!try_lock(sock::sk_lock.owned)) { spin_unlock_bh(sock::sk_lock.slock); wait_for_release(); spin_lock_bh(sock::sk_lock.slock); } The lockdep annotation for sock::sk_lock.owned is for unknown reasons _after_ the lock has been acquired, i.e. after the code block above and after releasing sock::sk_lock.slock, but inside the bottom halves disabled region: spin_unlock(sock::sk_lock.slock); mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_); local_bh_enable(); The placement after the unlock is obvious because otherwise the mutex_acquire() would nest into the spin lock held region. But that's from the lockdep perspective still the wrong place: 1) The mutex_acquire() is issued _after_ the successful acquisition which is pointless because in a dead lock scenario this point is never reached which means that if the deadlock is the first instance of exposing the wrong lock order lockdep does not have a chance to detect it. 2) It only works because lockdep is rather lax on the context from which the mutex_acquire() is issued. Acquiring a mutex inside a bottom halves and therefore non-preemptible region is obviously invalid, except for a trylock which is clearly not the case here. This 'works' stops working on RT enabled kernels where the bottom halves serialization is done via a local lock, which exposes this misplacement because the 'mutex' and the local lock nest the wrong way around and lockdep complains rightfully about a lock inversion. The placement is wrong since the initial commit a5b5bb9a053a ("[PATCH] lockdep: annotate sk_locks") which introduced this. Fix it by moving the mutex_acquire() in front of the actual lock acquisition, which is what the regular mutex_lock() operation does as well. lock_sock_fast() is not that straight forward. It looks at the first glance like a convoluted trylock operation: spin_lock_bh(sock::sk_lock.slock) if (!sock::sk_lock.owned) return false; while (!try_lock(sock::sk_lock.owned)) { spin_unlock_bh(sock::sk_lock.slock); wait_for_release(); spin_lock_bh(sock::sk_lock.slock); } spin_unlock(sock::sk_lock.slock); mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_); local_bh_enable(); return true; But that's not the case: lock_sock_fast() is an interesting optimization for short critical sections which can run with bottom halves disabled and sock::sk_lock.slock held. This allows to shortcut the 'mutex' operation in the non contended case by preventing other lockers to acquire sock::sk_lock.owned because they are blocked on sock::sk_lock.slock, which in turn avoids the overhead of doing the heavy processing in release_sock() including waking up wait queue waiters. In the contended case, i.e. when sock::sk_lock.owned == true the behavior is the same as lock_sock_nested(). Semantically this shortcut means, that the task acquired the 'mutex' even if it does not touch the sock::sk_lock.owned field in the non-contended case. Not telling lockdep about this shortcut acquisition is hiding potential lock ordering violations in the fast path. As a consequence the same reasoning as for the above lock_sock_nested() case vs. the placement of the lockdep annotation applies. The current placement of the lockdep annotation was just copied from the original lock_sock(), now renamed to lock_sock_nested(), implementation. Fix this by moving the mutex_acquire() in front of the actual lock acquisition and adding the corresponding mutex_release() into unlock_sock_fast(). Also document the fast path return case with a comment. Reported-by: Sebastian Siewior Signed-off-by: Thomas Gleixner Cc: netdev@vger.kernel.org Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Eric Dumazet Signed-off-by: David S. Miller commit 48e6d083b3aa006052db687fb26eeceef1d325b6 Author: Alejandro Concepcion-Rodriguez Date: Fri Sep 17 18:49:59 2021 +0000 docs: net: dsa: sja1105: fix reference to sja1105.txt The file sja1105.txt was converted to nxp,sja1105.yaml. Signed-off-by: Alejandro Concepcion-Rodriguez Signed-off-by: David S. Miller commit 87758511075ec961486fe78d7548dd709b524433 Author: Randy Dunlap Date: Fri Sep 17 14:05:47 2021 -0700 igc: fix build errors for PTP When IGC=y and PTP_1588_CLOCK=m, the ptp_*() interface family is not available to the igc driver. Make this driver depend on PTP_1588_CLOCK_OPTIONAL so that it will build without errors. Various igc commits have used ptp_*() functions without checking that PTP_1588_CLOCK is enabled. Fix all of these here. Fixes these build errors: ld: drivers/net/ethernet/intel/igc/igc_main.o: in function `igc_msix_other': igc_main.c:(.text+0x6494): undefined reference to `ptp_clock_event' ld: igc_main.c:(.text+0x64ef): undefined reference to `ptp_clock_event' ld: igc_main.c:(.text+0x6559): undefined reference to `ptp_clock_event' ld: drivers/net/ethernet/intel/igc/igc_ethtool.o: in function `igc_ethtool_get_ts_info': igc_ethtool.c:(.text+0xc7a): undefined reference to `ptp_clock_index' ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_feature_enable_i225': igc_ptp.c:(.text+0x330): undefined reference to `ptp_find_pin' ld: igc_ptp.c:(.text+0x36f): undefined reference to `ptp_find_pin' ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_init': igc_ptp.c:(.text+0x11cd): undefined reference to `ptp_clock_register' ld: drivers/net/ethernet/intel/igc/igc_ptp.o: in function `igc_ptp_stop': igc_ptp.c:(.text+0x12dd): undefined reference to `ptp_clock_unregister' ld: drivers/platform/x86/dell/dell-wmi-privacy.o: in function `dell_privacy_wmi_probe': Fixes: 64433e5bf40ab ("igc: Enable internal i225 PPS") Fixes: 60dbede0c4f3d ("igc: Add support for ethtool GET_TS_INFO command") Fixes: 87938851b6efb ("igc: enable auxiliary PHC functions for the i225") Fixes: 5f2958052c582 ("igc: Add basic skeleton for PTP") Signed-off-by: Randy Dunlap Cc: Ederson de Souza Cc: Tony Nguyen Cc: Vinicius Costa Gomes Cc: Jeff Kirsher Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Jesse Brandeburg Cc: intel-wired-lan@lists.osuosl.org Acked-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 9f7afa05c9522b086327929ae622facab0f0f72b Author: Claudiu Manoil Date: Fri Sep 17 13:22:06 2021 +0300 enetc: Fix uninitialized struct dim_sample field usage The only struct dim_sample member that does not get initialized by dim_update_sample() is comp_ctr. (There is special API to initialize comp_ctr: dim_update_sample_with_comps(), and it is currently used only for RDMA.) comp_ctr is used to compute curr_stats->cmps and curr_stats->cpe_ratio (see dim_calc_stats()) which in turn are consumed by the rdma_dim_*() API. Therefore, functionally, the net_dim*() API consumers are not affected. Nevertheless, fix the computation of statistics based on an uninitialized variable, even if the mentioned statistics are not used at the moment. Fixes: ae0e6a5d1627 ("enetc: Add adaptive interrupt coalescing") Signed-off-by: Claudiu Manoil Signed-off-by: David S. Miller commit 7237a494decfa17d0b9d0076e6cee3235719de90 Author: Claudiu Manoil Date: Fri Sep 17 13:22:05 2021 +0300 enetc: Fix illegal access when reading affinity_hint irq_set_affinity_hit() stores a reference to the cpumask_t parameter in the irq descriptor, and that reference can be accessed later from irq_affinity_hint_proc_show(). Since the cpu_mask parameter passed to irq_set_affinity_hit() has only temporary storage (it's on the stack memory), later accesses to it are illegal. Thus reads from the corresponding procfs affinity_hint file can result in paging request oops. The issue is fixed by the get_cpu_mask() helper, which provides a permanent storage for the cpumask_t parameter. Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: Claudiu Manoil Signed-off-by: David S. Miller commit afd92d82c9d715fb97565408755acad81573591a Author: Jason Wang Date: Fri Sep 17 16:34:06 2021 +0800 virtio-net: fix pages leaking when building skb in big mode We try to use build_skb() if we had sufficient tailroom. But we forget to release the unused pages chained via private in big mode which will leak pages. Fixing this by release the pages after building the skb in big mode. Cc: Xuan Zhuo Fixes: fb32856b16ad ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom") Signed-off-by: Jason Wang Reviewed-by: Xuan Zhuo Signed-off-by: David S. Miller commit 3ede7f84c7c21f93c5eac611d60eba3f2c765e0f Author: Jan Beulich Date: Fri Sep 17 08:27:10 2021 +0200 xen-netback: correct success/error reporting for the SKB-with-fraglist case When re-entering the main loop of xenvif_tx_check_gop() a 2nd time, the special considerations for the head of the SKB no longer apply. Don't mistakenly report ERROR to the frontend for the first entry in the list, even if - from all I can tell - this shouldn't matter much as the overall transmit will need to be considered failed anyway. Signed-off-by: Jan Beulich Reviewed-by: Paul Durrant Signed-off-by: David S. Miller commit 564df7ab10ad900c1494dc99d9d3710258d07ba2 Merge: 02319bf15acf5 a68e9da48568a Author: David S. Miller Date: Sun Sep 19 12:08:37 2021 +0100 Merge branch 'dsa-shutdown' Vladimir Oltean says: ==================== Make DSA switch drivers compatible with masters which unregister on shutdown Changes in v2: - fix build for b53_mmap - use unregister_netdevice_many It was reported by Lino here: https://lore.kernel.org/netdev/20210909095324.12978-1-LinoSanfilippo@gmx.de/ that when the DSA master attempts to unregister its net_device on shutdown, DSA should prevent that operation from succeeding because it holds a reference to it. This hangs the shutdown process. This issue was essentially introduced in commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"). The present series patches all DSA drivers to handle that case, depending on whether those drivers were introduced before or after the offending commit, a different Fixes: tag is specified for them. The approach taken by this series solves the issue in essentially the same way as Lino's patches, except for three key differences: - this series takes a more minimal approach in what is done on shutdown, we do not attempt a full tree teardown as that is not strictly necessary. I might revisit this if there are compelling reasons to do otherwise - this series fixes the issues for all DSA drivers, not just KSZ9897 - this series works even if the ->remove driver method gets called for the same device too, not just ->shutdown. This is really possible to happen for SPI device drivers, and potentially possible for other bus device drivers too. ==================== Signed-off-by: David S. Miller commit a68e9da48568a0adf5dc817ef81971c0d1aa0672 Author: Vladimir Oltean Date: Fri Sep 17 16:34:36 2021 +0300 net: dsa: xrs700x: be compatible with masters which unregister on shutdown Since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), DSA gained a requirement which it did not fulfill, which is to unlink itself from the DSA master at shutdown time. Since the Arrow SpeedChips XRS700x driver was introduced after the bad commit, it has never worked with DSA masters which decide to unregister their net_device on shutdown, effectively hanging the reboot process. To fix that, we need to call dsa_switch_shutdown. These devices can be connected by I2C or by MDIO, and if I search for I2C or MDIO bus drivers that implement their ->shutdown by redirecting it to ->remove I don't see any, however this does not mean it would not be possible. To be compatible with that pattern, it is necessary to implement an "if this then not that" scheme, to avoid ->remove and ->shutdown from being called both for the same struct device. Fixes: ee00b24f32eb ("net: dsa: add Arrow SpeedChips XRS700x driver") Link: https://lore.kernel.org/netdev/20210909095324.12978-1-LinoSanfilippo@gmx.de/ Reported-by: Lino Sanfilippo Signed-off-by: Vladimir Oltean Reviewed-by: George McCollister Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit fe4053078cd0f02a3fa140c43660f327702a9f10 Author: Vladimir Oltean Date: Fri Sep 17 16:34:35 2021 +0300 net: dsa: microchip: ksz8863: be compatible with masters which unregister on shutdown Since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), DSA gained a requirement which it did not fulfill, which is to unlink itself from the DSA master at shutdown time. Since the Microchip sub-driver for KSZ8863 was introduced after the bad commit, it has never worked with DSA masters which decide to unregister their net_device on shutdown, effectively hanging the reboot process. To fix that, we need to call dsa_switch_shutdown. Since this driver expects the MDIO bus to be backed by mdio_bitbang, I don't think there is currently any MDIO bus driver which implements its ->shutdown by redirecting it to ->remove, but in any case, to be compatible with that pattern, it is necessary to implement an "if this then not that" scheme, to avoid ->remove and ->shutdown from being called both for the same struct device. Fixes: 60a364760002 ("net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support") Link: https://lore.kernel.org/netdev/20210909095324.12978-1-LinoSanfilippo@gmx.de/ Reported-by: Lino Sanfilippo Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 46baae56e1001a771a5d132aa883cb5605013ae2 Author: Vladimir Oltean Date: Fri Sep 17 16:34:34 2021 +0300 net: dsa: hellcreek: be compatible with masters which unregister on shutdown Since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), DSA gained a requirement which it did not fulfill, which is to unlink itself from the DSA master at shutdown time. Since the hellcreek driver was introduced after the bad commit, it has never worked with DSA masters which decide to unregister their net_device on shutdown, effectively hanging the reboot process. Hellcreek is a platform device driver, so we probably cannot have the oddities of ->shutdown and ->remove getting both called for the exact same struct device. But to be in line with the pattern from the other device drivers which are on slow buses, implement the same "if this then not that" pattern of either running the ->shutdown or the ->remove hook. The driver's current ->remove implementation makes that very easy because it already zeroes out its device_drvdata on ->remove. Fixes: e4b27ebc780f ("net: dsa: Add DSA driver for Hirschmann Hellcreek switches") Link: https://lore.kernel.org/netdev/20210909095324.12978-1-LinoSanfilippo@gmx.de/ Reported-by: Lino Sanfilippo Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Acked-by: Kurt Kanzenbach Signed-off-by: David S. Miller commit 0650bf52b31ff35dc6430fc2e37969c36baba724 Author: Vladimir Oltean Date: Fri Sep 17 16:34:33 2021 +0300 net: dsa: be compatible with masters which unregister on shutdown Lino reports that on his system with bcmgenet as DSA master and KSZ9897 as a switch, rebooting or shutting down never works properly. What does the bcmgenet driver have special to trigger this, that other DSA masters do not? It has an implementation of ->shutdown which simply calls its ->remove implementation. Otherwise said, it unregisters its network interface on shutdown. This message can be seen in a loop, and it hangs the reboot process there: unregister_netdevice: waiting for eth0 to become free. Usage count = 3 So why 3? A usage count of 1 is normal for a registered network interface, and any virtual interface which links itself as an upper of that will increment it via dev_hold. In the case of DSA, this is the call path: dsa_slave_create -> netdev_upper_dev_link -> __netdev_upper_dev_link -> __netdev_adjacent_dev_insert -> dev_hold So a DSA switch with 3 interfaces will result in a usage count elevated by two, and netdev_wait_allrefs will wait until they have gone away. Other stacked interfaces, like VLAN, watch NETDEV_UNREGISTER events and delete themselves, but DSA cannot just vanish and go poof, at most it can unbind itself from the switch devices, but that must happen strictly earlier compared to when the DSA master unregisters its net_device, so reacting on the NETDEV_UNREGISTER event is way too late. It seems that it is a pretty established pattern to have a driver's ->shutdown hook redirect to its ->remove hook, so the same code is executed regardless of whether the driver is unbound from the device, or the system is just shutting down. As Florian puts it, it is quite a big hammer for bcmgenet to unregister its net_device during shutdown, but having a common code path with the driver unbind helps ensure it is well tested. So DSA, for better or for worse, has to live with that and engage in an arms race of implementing the ->shutdown hook too, from all individual drivers, and do something sane when paired with masters that unregister their net_device there. The only sane thing to do, of course, is to unlink from the master. However, complications arise really quickly. The pattern of redirecting ->shutdown to ->remove is not unique to bcmgenet or even to net_device drivers. In fact, SPI controllers do it too (see dspi_shutdown -> dspi_remove), and presumably, I2C controllers and MDIO controllers do it too (this is something I have not researched too deeply, but even if this is not the case today, it is certainly plausible to happen in the future, and must be taken into consideration). Since DSA switches might be SPI devices, I2C devices, MDIO devices, the insane implication is that for the exact same DSA switch device, we might have both ->shutdown and ->remove getting called. So we need to do something with that insane environment. The pattern I've come up with is "if this, then not that", so if either ->shutdown or ->remove gets called, we set the device's drvdata to NULL, and in the other hook, we check whether the drvdata is NULL and just do nothing. This is probably not necessary for platform devices, just for devices on buses, but I would really insist for consistency among drivers, because when code is copy-pasted, it is not always copy-pasted from the best sources. So depending on whether the DSA switch's ->remove or ->shutdown will get called first, we cannot really guarantee even for the same driver if rebooting will result in the same code path on all platforms. But nonetheless, we need to do something minimally reasonable on ->shutdown too to fix the bug. Of course, the ->remove will do more (a full teardown of the tree, with all data structures freed, and this is why the bug was not caught for so long). The new ->shutdown method is kept separate from dsa_unregister_switch not because we couldn't have unregistered the switch, but simply in the interest of doing something quick and to the point. The big question is: does the DSA switch's ->shutdown get called earlier than the DSA master's ->shutdown? If not, there is still a risk that we might still trigger the WARN_ON in unregister_netdevice that says we are attempting to unregister a net_device which has uppers. That's no good. Although the reference to the master net_device won't physically go away even if DSA's ->shutdown comes afterwards, remember we have a dev_hold on it. The answer to that question lies in this comment above device_link_add: * A side effect of the link creation is re-ordering of dpm_list and the * devices_kset list by moving the consumer device and all devices depending * on it to the ends of these lists (that does not happen to devices that have * not been registered when this function is called). so the fact that DSA uses device_link_add towards its master is not exactly for nothing. device_shutdown() walks devices_kset from the back, so this is our guarantee that DSA's shutdown happens before the master's shutdown. Fixes: 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings") Link: https://lore.kernel.org/netdev/20210909095324.12978-1-LinoSanfilippo@gmx.de/ Reported-by: Lino Sanfilippo Signed-off-by: Vladimir Oltean Tested-by: Andrew Lunn Signed-off-by: David S. Miller commit cf9579976f724ad517cc15b7caadea728c7e245c Author: Vladimir Oltean Date: Fri Sep 17 16:34:32 2021 +0300 net: mdio: introduce a shutdown method to mdio device drivers MDIO-attached devices might have interrupts and other things that might need quiesced when we kexec into a new kernel. Things are even more creepy when those interrupt lines are shared, and in that case it is absolutely mandatory to disable all interrupt sources. Moreover, MDIO devices might be DSA switches, and DSA needs its own shutdown method to unlink from the DSA master, which is a new requirement that appeared after commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"). So introduce a ->shutdown method in the MDIO device driver structure. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit f0c15b360fb65ee39849afe987c16eb3d0175d0d Author: Sean Young Date: Tue Sep 14 16:57:46 2021 +0200 media: ir_toy: prevent device from hanging during transmit If the IR Toy is receiving IR while a transmit is done, it may end up hanging. We can prevent this from happening by re-entering sample mode just before issuing the transmit command. Link: https://github.com/bengtmartensson/HarcHardware/discussions/25 Cc: stable@vger.kernel.org Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab commit 0664684e1ebd7875e120d0cecd525bac4805f8ed Author: Nathan Chancellor Date: Thu Sep 16 11:40:17 2021 -0700 kbuild: Add -Werror=ignored-optimization-argument to CLANG_FLAGS Similar to commit 589834b3a009 ("kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS"). Clang ignores certain GCC flags that it has not implemented, only emitting a warning: $ echo | clang -fsyntax-only -falign-jumps -x c - clang-14: warning: optimization flag '-falign-jumps' is not supported [-Wignored-optimization-argument] When one of these flags gets added to KBUILD_CFLAGS unconditionally, all subsequent cc-{disable-warning,option} calls fail because -Werror was added to these invocations to turn the above warning and the equivalent -W flag warning into errors. To catch the presence of these flags earlier, turn -Wignored-optimization-argument into an error so that the flags can either be implemented or ignored via cc-option and there are no more weird errors. Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 7fa6a2746616c8de4c40b748c2bb0656e00624ff Author: Nathan Chancellor Date: Thu Sep 16 11:40:16 2021 -0700 x86/build: Do not add -falign flags unconditionally for clang clang does not support -falign-jumps and only recently gained support for -falign-loops. When one of the configuration options that adds these flags is enabled, clang warns and all cc-{disable-warning,option} that follow fail because -Werror gets added to test for the presence of this warning: clang-14: warning: optimization flag '-falign-jumps=0' is not supported [-Wignored-optimization-argument] To resolve this, add a couple of cc-option calls when building with clang; gcc has supported these options since 3.2 so there is no point in testing for their support. -falign-functions was implemented in clang-7, -falign-loops was implemented in clang-14, and -falign-jumps has not been implemented yet. Link: https://lore.kernel.org/r/YSQE2f5teuvKLkON@Ryzen-9-3900X.localdomain/ Link: https://lore.kernel.org/r/20210824022640.2170859-2-nathan@kernel.org/ Reported-by: kernel test robot Reviewed-by: Nick Desaulniers Acked-by: Borislav Petkov Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 7c80144626db460bc3969027810a540741865fb1 Author: Ramji Jiyani Date: Thu Sep 16 09:21:22 2021 +0000 kbuild: Fix comment typo in scripts/Makefile.modpost Change comment "create one .mod.c file pr. module" to "create one .mod.c file per module" Signed-off-by: Ramji Jiyani Signed-off-by: Masahiro Yamada commit 4e70b646bae578bb51c89204b5b81ef499436482 Author: Geert Uytterhoeven Date: Thu Sep 16 10:43:53 2021 +0200 sh: Add missing FORCE prerequisites in Makefile make: arch/sh/boot/Makefile:87: FORCE prerequisite is missing Add the missing FORCE prerequisites for all build targets identified by "make help". Fixes: e1f86d7b4b2a5213 ("kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and filechk") Signed-off-by: Geert Uytterhoeven Signed-off-by: Masahiro Yamada commit ec783c7cb2495c5a3b8ca10db8056d43c528f940 Author: Kortan Date: Wed Sep 8 11:28:48 2021 +0800 gen_compile_commands: fix missing 'sys' package We need to import the 'sys' package since the script has called sys.exit() method. Fixes: 6ad7cbc01527 ("Makefile: Add clang-tidy and static analyzer support to makefile") Signed-off-by: Kortan Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit aa0f5ea12e477b2940a57fcda4908627e0beed0f Author: Ariel Marcovitch Date: Wed Sep 1 19:49:52 2021 +0300 checkkconfigsymbols.py: Remove skipping of help lines in parse_kconfig_file When parsing Kconfig files to find symbol definitions and references, lines after a 'help' line are skipped until a new config definition starts. However, Kconfig statements can actually be after a help section, as long as these have shallower indentation. These are skipped by the parser. This means that symbols referenced in this kind of statements are ignored by this function and thus are not considered undefined references in case the symbol is not defined. Remove the 'skip' logic entirely, as it is not needed if we just use the STMT regex to find the end of help lines. However, this means that keywords that appear as part of the help message (i.e. with the same indentation as the help lines) it will be considered as a reference/definition. This can happen now as well, but only with REGEX_KCONFIG_DEF lines. Also, the keyword must have a SYMBOL after it, which probably means that someone referenced a config in the help so it seems like a bonus :) The real solution is to keep track of the indentation when a the first help line in encountered and then handle DEF and STMT lines only if the indentation is shallower. Signed-off-by: Ariel Marcovitch Signed-off-by: Masahiro Yamada commit d62d5aed3354ae57d57fae1e59948913f360d4eb Author: Ariel Marcovitch Date: Wed Sep 1 17:52:12 2021 +0300 checkkconfigsymbols.py: Forbid passing 'HEAD' to --commit As opposed to the --diff option, --commit can get ref names instead of commit hashes. When using the --commit option, the script resets the working directory to the commit before the given ref, by adding '~' to the end of the ref. However, the 'HEAD' ref is relative, and so when the working directory is reset to 'HEAD~', 'HEAD' points to what was 'HEAD~'. Then when the script resets to 'HEAD' it actually stays in the same commit. In this case, the script won't report any cases because there is no diff between the cases of the two refs. Prevent the user from using HEAD refs. A better solution might be to resolve the refs before doing the reset, but for now just disallow such refs. Signed-off-by: Ariel Marcovitch Signed-off-by: Masahiro Yamada commit d4d016caa4b85b9aa98d7ec8c84e928621a614bc Author: Linus Torvalds Date: Sat Sep 18 14:45:48 2021 -0700 alpha: move __udiv_qrnnd library function to arch/alpha/lib/ We already had the implementation for __udiv_qrnnd (unsigned divide for multi-precision arithmetic) as part of the alpha math emulation code. But you can disable the math emulation code - even if you shouldn't - and then the MPI code that actually wants this functionality (and is needed by various crypto functions) will fail to build. So move the extended-precision divide code to be a regular library function, just like all the regular division code is. That way ie is available regardless of math-emulation. Signed-off-by: Linus Torvalds commit ab41f75ee6a06fa9b947a59c8f9de92370463e40 Author: Linus Torvalds Date: Sat Sep 18 14:12:39 2021 -0700 alpha: mark 'Jensen' platform as no longer broken Ok, it almost certainly is still broken on actual hardware, but the immediate reason for it having been marked BROKEN was a build error that is fixed by just making sure the low-level IO header file is included sufficiently early that the __EXTERN_INLINE hackery takes effect. This was marked broken back in 2017 by commit 1883c9f49d02 ("alpha: mark jensen as broken"), but Ulrich Teichert made me look at it as part of my cross-build work to make sure -Werror actually does the right thing. There are lots of alpha configurations that do not build cleanly, but now it's no longer because Jensen wouldn't be buildable. That said, because the Jensen platform doesn't force PCI to be enabled (Jensen only had EISA), it ends up being somewhat interesting as a source of odd configs. Reported-by: Ulrich Teichert Signed-off-by: Linus Torvalds commit 219d720e6df71c2607d7120d6b9281614863e5b1 Author: Andrii Nakryiko Date: Tue Sep 14 10:00:04 2021 -0700 perf bpf: Ignore deprecation warning when using libbpf's btf__get_from_id() Perf code re-implements libbpf's btf__load_from_kernel_by_id() API as a weak function, presumably to dynamically link against old version of libbpf shared library. Unfortunately this causes compilation warning when perf is compiled against libbpf v0.6+. For now, just ignore deprecation warning, but there might be a better solution, depending on perf's needs. Signed-off-by: Andrii Nakryiko Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: kernel-team@fb.com LPU-Reference: 20210914170004.4185659-1-andrii@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit aba5daeb645181ee5a046bc00c231fd045882aaa Author: Ian Rogers Date: Fri Sep 17 22:44:40 2021 -0700 libperf evsel: Make use of FD robust. FD uses xyarray__entry that may return NULL if an index is out of bounds. If NULL is returned then a segv happens as FD unconditionally dereferences the pointer. This was happening in a case of with perf iostat as shown below. The fix is to make FD an "int*" rather than an int and handle the NULL case as either invalid input or a closed fd. $ sudo gdb --args perf stat --iostat list ... Breakpoint 1, perf_evsel__alloc_fd (evsel=0x5555560951a0, ncpus=1, nthreads=1) at evsel.c:50 50 { (gdb) bt #0 perf_evsel__alloc_fd (evsel=0x5555560951a0, ncpus=1, nthreads=1) at evsel.c:50 #1 0x000055555585c188 in evsel__open_cpu (evsel=0x5555560951a0, cpus=0x555556093410, threads=0x555556086fb0, start_cpu=0, end_cpu=1) at util/evsel.c:1792 #2 0x000055555585cfb2 in evsel__open (evsel=0x5555560951a0, cpus=0x0, threads=0x555556086fb0) at util/evsel.c:2045 #3 0x000055555585d0db in evsel__open_per_thread (evsel=0x5555560951a0, threads=0x555556086fb0) at util/evsel.c:2065 #4 0x00005555558ece64 in create_perf_stat_counter (evsel=0x5555560951a0, config=0x555555c34700 , target=0x555555c2f1c0 , cpu=0) at util/stat.c:590 #5 0x000055555578e927 in __run_perf_stat (argc=1, argv=0x7fffffffe4a0, run_idx=0) at builtin-stat.c:833 #6 0x000055555578f3c6 in run_perf_stat (argc=1, argv=0x7fffffffe4a0, run_idx=0) at builtin-stat.c:1048 #7 0x0000555555792ee5 in cmd_stat (argc=1, argv=0x7fffffffe4a0) at builtin-stat.c:2534 #8 0x0000555555835ed3 in run_builtin (p=0x555555c3f540 , argc=3, argv=0x7fffffffe4a0) at perf.c:313 #9 0x0000555555836154 in handle_internal_command (argc=3, argv=0x7fffffffe4a0) at perf.c:365 #10 0x000055555583629f in run_argv (argcp=0x7fffffffe2ec, argv=0x7fffffffe2e0) at perf.c:409 #11 0x0000555555836692 in main (argc=3, argv=0x7fffffffe4a0) at perf.c:539 ... (gdb) c Continuing. Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (uncore_iio_0/event=0x83,umask=0x04,ch_mask=0xF,fc_mask=0x07/). /bin/dmesg | grep -i perf may provide additional information. Program received signal SIGSEGV, Segmentation fault. 0x00005555559b03ea in perf_evsel__close_fd_cpu (evsel=0x5555560951a0, cpu=1) at evsel.c:166 166 if (FD(evsel, cpu, thread) >= 0) v3. fixes a bug in perf_evsel__run_ioctl where the sense of a branch was backward. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210918054440.2350466-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 57f0ff059e3daa4e70a811cb1d31a49968262d20 Author: Michael Petlan Date: Mon Jul 19 16:53:32 2021 +0200 perf machine: Initialize srcline string member in add_location struct It's later supposed to be either a correct address or NULL. Without the initialization, it may contain an undefined value which results in the following segmentation fault: # perf top --sort comm -g --ignore-callees=do_idle terminates with: #0 0x00007ffff56b7685 in __strlen_avx2 () from /lib64/libc.so.6 #1 0x00007ffff55e3802 in strdup () from /lib64/libc.so.6 #2 0x00005555558cb139 in hist_entry__init (callchain_size=, sample_self=true, template=0x7fffde7fb110, he=0x7fffd801c250) at util/hist.c:489 #3 hist_entry__new (template=template@entry=0x7fffde7fb110, sample_self=sample_self@entry=true) at util/hist.c:564 #4 0x00005555558cb4ba in hists__findnew_entry (hists=hists@entry=0x5555561d9e38, entry=entry@entry=0x7fffde7fb110, al=al@entry=0x7fffde7fb420, sample_self=sample_self@entry=true) at util/hist.c:657 #5 0x00005555558cba1b in __hists__add_entry (hists=hists@entry=0x5555561d9e38, al=0x7fffde7fb420, sym_parent=, bi=bi@entry=0x0, mi=mi@entry=0x0, sample=sample@entry=0x7fffde7fb4b0, sample_self=true, ops=0x0, block_info=0x0) at util/hist.c:288 #6 0x00005555558cbb70 in hists__add_entry (sample_self=true, sample=0x7fffde7fb4b0, mi=0x0, bi=0x0, sym_parent=, al=, hists=0x5555561d9e38) at util/hist.c:1056 #7 iter_add_single_cumulative_entry (iter=0x7fffde7fb460, al=) at util/hist.c:1056 #8 0x00005555558cc8a4 in hist_entry_iter__add (iter=iter@entry=0x7fffde7fb460, al=al@entry=0x7fffde7fb420, max_stack_depth=, arg=arg@entry=0x7fffffff7db0) at util/hist.c:1231 #9 0x00005555557cdc9a in perf_event__process_sample (machine=, sample=0x7fffde7fb4b0, evsel=, event=, tool=0x7fffffff7db0) at builtin-top.c:842 #10 deliver_event (qe=, qevent=) at builtin-top.c:1202 #11 0x00005555558a9318 in do_flush (show_progress=false, oe=0x7fffffff80e0) at util/ordered-events.c:244 #12 __ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP, timestamp=timestamp@entry=0) at util/ordered-events.c:323 #13 0x00005555558a9789 in __ordered_events__flush (timestamp=, how=, oe=) at util/ordered-events.c:339 #14 ordered_events__flush (how=OE_FLUSH__TOP, oe=0x7fffffff80e0) at util/ordered-events.c:341 #15 ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP) at util/ordered-events.c:339 #16 0x00005555557cd631 in process_thread (arg=0x7fffffff7db0) at builtin-top.c:1114 #17 0x00007ffff7bb817a in start_thread () from /lib64/libpthread.so.0 #18 0x00007ffff5656dc3 in clone () from /lib64/libc.so.6 If you look at the frame #2, the code is: 488 if (he->srcline) { 489 he->srcline = strdup(he->srcline); 490 if (he->srcline == NULL) 491 goto err_rawdata; 492 } If he->srcline is not NULL (it is not NULL if it is uninitialized rubbish), it gets strdupped and strdupping a rubbish random string causes the problem. Also, if you look at the commit 1fb7d06a509e, it adds the srcline property into the struct, but not initializing it everywhere needed. Committer notes: Now I see, when using --ignore-callees=do_idle we end up here at line 2189 in add_callchain_ip(): 2181 if (al.sym != NULL) { 2182 if (perf_hpp_list.parent && !*parent && 2183 symbol__match_regex(al.sym, &parent_regex)) 2184 *parent = al.sym; 2185 else if (have_ignore_callees && root_al && 2186 symbol__match_regex(al.sym, &ignore_callees_regex)) { 2187 /* Treat this symbol as the root, 2188 forgetting its callees. */ 2189 *root_al = al; 2190 callchain_cursor_reset(cursor); 2191 } 2192 } And the al that doesn't have the ->srcline field initialized will be copied to the root_al, so then, back to: 1211 int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, 1212 int max_stack_depth, void *arg) 1213 { 1214 int err, err2; 1215 struct map *alm = NULL; 1216 1217 if (al) 1218 alm = map__get(al->map); 1219 1220 err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, 1221 iter->evsel, al, max_stack_depth); 1222 if (err) { 1223 map__put(alm); 1224 return err; 1225 } 1226 1227 err = iter->ops->prepare_entry(iter, al); 1228 if (err) 1229 goto out; 1230 1231 err = iter->ops->add_single_entry(iter, al); 1232 if (err) 1233 goto out; 1234 That al at line 1221 is what hist_entry_iter__add() (called from sample__resolve_callchain()) saw as 'root_al', and then: iter->ops->add_single_entry(iter, al); will go on with al->srcline with a bogus value, I'll add the above sequence to the cset and apply, thanks! Signed-off-by: Michael Petlan CC: Milian Wolff Cc: Jiri Olsa Fixes: 1fb7d06a509e ("perf report Use srcline from callchain for hist entries") Link: https //lore.kernel.org/r/20210719145332.29747-1-mpetlan@redhat.com Reported-by: Juri Lelli Signed-off-by: Arnaldo Carvalho de Melo commit ff6f41fbcee9830f88413cbb08dc45e543243b55 Author: Adrian Hunter Date: Sat Sep 11 16:30:53 2021 +0300 perf script: Fix ip display when type != attr->type set_print_ip_opts() was not being called when type != attr->type because there is not a one-to-one relationship between output types and attr->type. That resulted in ip not printing. The attr_type() function is removed, and the match of attr->type to output type is corrected. Example on ADL using taskset to select an atom cpu: # perf record -e cpu_atom/cpu-cycles/ taskset 0x1000 uname Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.003 MB perf.data (7 samples) ] Before: # perf script | head taskset 428 [-01] 10394.179041: 1 cpu_atom/cpu-cycles/: taskset 428 [-01] 10394.179043: 1 cpu_atom/cpu-cycles/: taskset 428 [-01] 10394.179044: 11 cpu_atom/cpu-cycles/: taskset 428 [-01] 10394.179045: 407 cpu_atom/cpu-cycles/: taskset 428 [-01] 10394.179046: 16789 cpu_atom/cpu-cycles/: taskset 428 [-01] 10394.179052: 676300 cpu_atom/cpu-cycles/: uname 428 [-01] 10394.179278: 4079859 cpu_atom/cpu-cycles/: After: # perf script | head taskset 428 10394.179041: 1 cpu_atom/cpu-cycles/: ffffffff95a0bb97 __intel_pmu_enable_all.constprop.48+0x47 ([kernel.kallsyms]) taskset 428 10394.179043: 1 cpu_atom/cpu-cycles/: ffffffff95a0bb97 __intel_pmu_enable_all.constprop.48+0x47 ([kernel.kallsyms]) taskset 428 10394.179044: 11 cpu_atom/cpu-cycles/: ffffffff95a0bb97 __intel_pmu_enable_all.constprop.48+0x47 ([kernel.kallsyms]) taskset 428 10394.179045: 407 cpu_atom/cpu-cycles/: ffffffff95a0bb97 __intel_pmu_enable_all.constprop.48+0x47 ([kernel.kallsyms]) taskset 428 10394.179046: 16789 cpu_atom/cpu-cycles/: ffffffff95a0bb97 __intel_pmu_enable_all.constprop.48+0x47 ([kernel.kallsyms]) taskset 428 10394.179052: 676300 cpu_atom/cpu-cycles/: 7f829ef73800 cfree+0x0 (/lib/libc-2.32.so) uname 428 10394.179278: 4079859 cpu_atom/cpu-cycles/: ffffffff95bae912 vma_interval_tree_remove+0x1f2 ([kernel.kallsyms]) Signed-off-by: Adrian Hunter Reviewed-by: Kan Liang Cc: Jin Yao Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20210911133053.15682-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7efbcc8c075c5e9ef69b2379b75b58a699f23eb3 Author: Ravi Bangoria Date: Sat Sep 11 10:08:53 2021 +0530 perf annotate: Fix fused instr logic for assembly functions Some x86 microarchitectures fuse a subset of cmp/test/ALU instructions with branch instructions, and thus perf annotate highlight such valid pairs as fused. When annotated with source, perf uses struct disasm_line to contain either source or instruction line from objdump output. Usually, a C statement generates multiple instructions which include such cmp/test/ALU + branch instruction pairs. But in case of assembly function, each individual assembly source line generate one instruction. The 'perf annotate' instruction fusion logic assumes the previous disasm_line as the previous instruction line, which is wrong because, for assembly function, previous disasm_line contains source line. And thus perf fails to highlight valid fused instruction pairs for assembly functions. Fix it by searching backward until we find an instruction line and consider that disasm_line as fused with current branch instruction. Before: │ cmpq %rcx, RIP+8(%rsp) 0.00 │ cmp %rcx,0x88(%rsp) │ je .Lerror_bad_iret <--- Source line 0.14 │ ┌──je b4 <--- Instruction line │ │movl %ecx, %eax After: │ cmpq %rcx, RIP+8(%rsp) 0.00 │ ┌──cmp %rcx,0x88(%rsp) │ │je .Lerror_bad_iret 0.14 │ ├──je b4 │ │movl %ecx, %eax Reviewed-by: Jin Yao Signed-off-by: Ravi Bangoria Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Kim Phillips Cc: Mark Rutland Cc: Namhyung Kim Link: https //lore.kernel.org/r/20210911043854.8373-1-ravi.bangoria@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 93ff9f13be91c5f36bb3e5d23237702155deae74 Merge: d1a88690cea38 f5711f9df9242 Author: Linus Torvalds Date: Sat Sep 18 12:46:14 2021 -0700 Merge tag 's390-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix potential out-of-range access during secure boot facility detection. - Fully validate the VMA before calling follow_pte() in pci code. - Remove arch specific WARN_DYNAMIC_STACK config option. - Fix zcrypto kernel doc comments. - Update defconfigs. * tag 's390-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: remove WARN_DYNAMIC_STACK s390/ap: fix kernel doc comments s390: update defconfigs s390/sclp: fix Secure-IPL facility detection s390/pci_mmio: fully validate the VMA before calling follow_pte() commit d1a88690cea3872f83a1004b1a08a39879715fa1 Merge: cd395d529faf4 55c21d57eafb7 Author: Linus Torvalds Date: Sat Sep 18 12:40:55 2021 -0700 Merge tag 'devicetree-fixes-for-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Revert fw_devlink tracking 'phy-handle' links. This broke at least a few platforms. A better solution is being worked on. - Add Samsung UFS binding which fell thru the cracks - Doc reference fixes from Mauro - Fix for restricted DMA error handling * tag 'devicetree-fixes-for-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: arm: Fix Toradex compatible typo of: restricted dma: Fix condition for rmem init dt-bindings: arm: mediatek: mmsys: update mediatek,mmsys.yaml reference dt-bindings: net: dsa: sja1105: update nxp,sja1105.yaml reference dt-bindings: ufs: Add bindings for Samsung ufs host Revert "of: property: fw_devlink: Add support for "phy-handle" property" commit cd395d529faf46bd7fd799852a659ca1bd650a27 Author: Linus Torvalds Date: Sat Sep 18 11:15:01 2021 -0700 tgafb: clarify dependencies The TGA boards were based on the DECchip 21030 PCI graphics accelerator used mainly for alpha, and existed in a TURBOchannel (TC) version for the DECstation (MIPS) workstations. However, the config option for the TGA code is a bit confused, and says depends on FB && (ALPHA || TC) because people didn't really want to enable the option for random PCI environments, so the "ALPHA" stands in for that case (while the TC case is then the MIPS DECstation case). So that config dependency is kind of a mixture of architecture and bus choices. But it's incorrect, in that there were non-PCI-based alpha hardware, and then the driver just causes warnings: drivers/video/fbdev/tgafb.c:1532:13: error: ‘tgafb_unregister’ defined but not used [-Werror=unused-function] 1532 | static void tgafb_unregister(struct device *dev) | ^~~~~~~~~~~~~~~~ drivers/video/fbdev/tgafb.c:1387:12: error: ‘tgafb_register’ defined but not used [-Werror=unused-function] 1387 | static int tgafb_register(struct device *dev) | ^~~~~~~~~~~~~~ so let's make the config option dependencies a bit more explict: depends on FB depends on PCI || TC depends on ALPHA || TC where that first "FB" is the software configuration dependency, the second "PCI || TC" is the hardware bus dependency, while that final "ALPHA || TC" dependency is the "don't bother asking except for these situations. We could make that third case have "COMPILE_TEST" as an option, and mark the register/unregister functions as __maybe_unused, but I'm not sure it's really worth it. Signed-off-by: Linus Torvalds commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 Author: Dan Carpenter Date: Thu Sep 9 12:13:36 2021 +0300 iio: ssp_sensors: add more range checking in ssp_parse_dataframe() The "idx" is validated at the start of the loop but it gets incremented during the iteration so it needs to be checked again. Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210909091336.GA26312@kili Cc: Signed-off-by: Jonathan Cameron commit 4170d3dd1467e9d78cb9af374b19357dc324b328 Author: Dan Carpenter Date: Tue Sep 14 13:53:33 2021 +0300 iio: ssp_sensors: fix error code in ssp_print_mcu_debug() The ssp_print_mcu_debug() function should return negative error codes on error. Returning "length" is meaningless. This change does not affect runtime because the callers only care about zero/non-zero. Reported-by: Jonathan Cameron Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210914105333.GA11657@kili Cc: Signed-off-by: Jonathan Cameron commit cc9d3aaa5331577a8658e25473a27ba5949023d8 Author: Linus Torvalds Date: Sat Sep 18 10:57:10 2021 -0700 alpha: make 'Jensen' IO functions build again The Jensen IO functions are overly copmplicated because some of the IO addresses refer to special 'local IO' ports, and they get accessed differently. That then makes gcc not actually inline them, and since they were marked "extern inline" when included through the regular path, and then only marked "inline" when included from sys_jensen.c, you never necessarily got a body for the IO functions at all. The intent of the sys_jensen.c code is to actually get the non-inlined copy generated, so remove the 'inline' from the magic macro that is supposed to sort this all out. Also, do not mix 'extern inline' functions (that may or may not be inlined and will not generate a function body if they are not) with 'static inline' (that _will_ generate a function body when not inlined). Because gcc will complain about this situation: error: ‘jensen_bus_outb’ is static but used in inline function ‘jensen_outb’ which is not static because gcc basically doesn't know whether to generate a body for that static inline function or not for that call site. So make all of these use that __EXTERN_INLINE marker. Gcc will generally not inline these things on use, and then generate the function body out-of-line in sys_jensen.c. This makes the core IO functions build for the alpha Jensen config. Not that the rest then builds, because it turns out Jensen also doesn't enable PCI, which then makes other drievrs very unhappy, but that's a separate issue. Signed-off-by: Linus Torvalds commit efafec27c5658ed987e720130772f8933c685e87 Author: Linus Torvalds Date: Sat Sep 18 10:05:06 2021 -0700 spi: Fix tegra20 build with CONFIG_PM=n Without CONFIG_PM enabled, the SET_RUNTIME_PM_OPS() macro ends up being empty, and the only use of tegra_slink_runtime_{resume,suspend} goes away, resulting in drivers/spi/spi-tegra20-slink.c:1200:12: error: ‘tegra_slink_runtime_resume’ defined but not used [-Werror=unused-function] 1200 | static int tegra_slink_runtime_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/spi/spi-tegra20-slink.c:1188:12: error: ‘tegra_slink_runtime_suspend’ defined but not used [-Werror=unused-function] 1188 | static int tegra_slink_runtime_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ mark the functions __maybe_unused to make the build happy. This hits the alpha allmodconfig build (and others). Reported-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 6d56262c3d224699b29b9bb6b4ace8bab7d692c2 Author: Namjae Jeon Date: Sat Sep 18 18:45:12 2021 +0900 ksmbd: add validation for FILE_FULL_EA_INFORMATION of smb2_get_info Add validation to check whether req->InputBufferLength is smaller than smb2_ea_info_req structure size. Cc: Ronnie Sahlberg Cc: Ralph Böhme Cc: Steve French Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 59dd178e1d7cb6cac03b32aba7ed9bbce6761b6f Author: Heiko Stuebner Date: Tue Sep 14 00:49:26 2021 +0200 gpio/rockchip: fetch deferred output settings on probe Fetch the output settings the pinctrl driver may have created for pinctrl hogs and set the relevant pins as requested. Fixes: 9ce9a02039de ("pinctrl/rockchip: drop the gpio related codes") Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20210913224926.1260726-5-heiko@sntech.de Signed-off-by: Linus Walleij commit e7165b1dff06b6e4373ab7758b21f3d9ed8a64ca Author: Heiko Stuebner Date: Tue Sep 14 00:49:25 2021 +0200 pinctrl/rockchip: add a queue for deferred pin output settings on probe The separation of pinctrl and gpio drivers created a tiny window where a pinconfig setting might produce a null-pointer dereference. The affected device were rk3288-veyron devices in this case. Pinctrl-hogs are claimed when the pinctrl driver is registered, at which point their pinconfig settings will be applied. At this time the now separate gpio devices will not have been created yet and the matching driver won't have probed yet, making the gpio->foo() call run into a null-ptr. As probing is not really guaranteed to have been completed at a specific time, introduce a queue that can hold the output settings until the gpio driver has probed and will (in a separate patch) fetch the elements of the list. We expect the gpio driver to empty the list, but will nevertheless empty it ourself on remove if that didn't happen. Fixes: 9ce9a02039de ("pinctrl/rockchip: drop the gpio related codes") Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20210913224926.1260726-4-heiko@sntech.de Signed-off-by: Linus Walleij commit f58eae6c5fa882d6d0a6b7587a099602a59d57b5 Author: Hyunchul Lee Date: Fri Sep 17 22:14:08 2021 +0900 ksmbd: prevent out of share access Because of .., files outside the share directory could be accessed. To prevent this, normalize the given path and remove all . and .. components. In addition to the usual large set of regression tests (smbtorture and xfstests), ran various tests on this to specifically check path name validation including libsmb2 tests to verify path normalization: ./examples/smb2-ls-async smb://172.30.1.15/homes2/../ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/../ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/../../ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/../ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/..bar/ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/bar../ ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/bar.. ./examples/smb2-ls-async smb://172.30.1.15/homes2/foo/bar../../../../ Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 35866f3f779aef5e7ba84e4d1023fe2e2a0e219e Author: Rohith Surabattula Date: Fri Sep 17 16:50:40 2021 -0500 cifs: Not to defer close on file when lock is set Close file immediately when lock is set. Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Rohith Surabattula Signed-off-by: Steve French commit 71826b068884050d5fdd37fda857ba1539c513d3 Author: Rohith Surabattula Date: Fri Sep 17 17:29:42 2021 +0000 cifs: Fix soft lockup during fsstress Below traces are observed during fsstress and system got hung. [ 130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s! Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Rohith Surabattula Signed-off-by: Steve French commit e3fc065682ebbbd15b0ce0036800f4acbf765d46 Author: Rohith Surabattula Date: Fri Sep 17 18:14:26 2021 +0000 cifs: Deferred close performance improvements During unlink/rename instead of closing all the deferred handles under tcon, close only handles under the requested dentry. Signed-off-by: Rohith Surabattula Signed-off-by: Steve French commit 55c21d57eafb7b379bb7b3e93baf9ca2695895b0 Author: David Heidelberg Date: Sun Sep 12 18:51:20 2021 +0200 dt-bindings: arm: Fix Toradex compatible typo Fix board compatible typo reported by dtbs_check. Fixes: f4d1577e9bc6 ("dt-bindings: arm: Convert Tegra board/soc bindings to json-schema") Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20210912165120.188490-1-david@ixit.cz Signed-off-by: Rob Herring commit 31c8025fac3d8bbff7ce4602338d88efc2d7972c Author: David Brazdil Date: Fri Sep 17 14:14:23 2021 +0100 of: restricted dma: Fix condition for rmem init of_dma_set_restricted_buffer fails to handle negative return values from of_property_count_elems_of_size, e.g. when the property does not exist. This results in an attempt to assign a non-existent reserved memory region to the device and a warning being printed. Fix the condition to take negative values into account. Fixes: f3cfd136aef0 ("of: restricted dma: Don't fail device probe on rmem init failure") Cc: Will Deacon Signed-off-by: David Brazdil Acked-by: Will Deacon Link: https://lore.kernel.org/r/20210917131423.2760155-1-dbrazdil@google.com Signed-off-by: Rob Herring commit 4357f03d6611753936e4d52fc251b54a6afb1b54 Merge: b9b11b133b4a0 cdef119660889 Author: Linus Torvalds Date: Fri Sep 17 12:05:04 2021 -0700 Merge tag 'pm-5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two cpufreq issues, one in the intel_pstate driver and one in the core. Specifics: - Prevent intel_pstate from avoiding to use HWP, even if instructed to do so via the kernel command line, when HWP has been enabled already by the platform firmware (Doug Smythies). - Prevent use-after-free from occurring in the schedutil cpufreq governor on exit by fixing a core helper function that attempts to access memory associated with a kobject after calling kobject_put() on it (James Morse)" * tag 'pm-5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory cpufreq: intel_pstate: Override parameters if HWP forced by BIOS commit b9b11b133b4a0b4f8dc36ec04d81d630f763eaa6 Merge: 7639afad8b8d6 59583f7476640 Author: Linus Torvalds Date: Fri Sep 17 11:54:48 2021 -0700 Merge tag 'dma-mapping-5.15-1' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - page align size in sparc32 arch_dma_alloc (Andreas Larsson) - tone down a new dma-debug message (Hamza Mahfooz) - fix the kerneldoc for dma_map_sg_attrs (me) * tag 'dma-mapping-5.15-1' of git://git.infradead.org/users/hch/dma-mapping: sparc32: page align size in arch_dma_alloc dma-debug: prevent an error message from causing runtime problems dma-mapping: fix the kerneldoc for dma_map_sg_attrs commit 7639afad8b8d6671a645fb3d6e6fd1432dcdf6ac Merge: ddf21bd8ab984 e042a4533fc34 Author: Linus Torvalds Date: Fri Sep 17 11:42:31 2021 -0700 Merge tag 'pci-v5.15-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Defer VPD sizing until we actually need the contents; fixes a boot-time slowdown reported by Dave Jones (Bjorn Helgaas) - Stop clobbering OF fwnodes when we look for an ACPI fwnode; fixes a virtio-iommu boot regression (Jean-Philippe Brucker) - Add AMD GPU multi-function power dependencies; fixes runtime power management, including GPU resume and temp and fan sensor issues (Evan Quan) - Update VMD maintainer to Nirmal Patel (Jon Derrick) * tag 'pci-v5.15-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: MAINTAINERS: Add Nirmal Patel as VMD maintainer PCI: Add AMD GPU multi-function power dependencies PCI/ACPI: Don't reset a fwnode set by OF PCI/VPD: Defer VPD sizing until first access commit 0619b7901473c380abc05d45cf9c70bee0707db3 Author: Qu Wenruo Date: Thu Sep 16 20:43:29 2021 +0800 btrfs: prevent __btrfs_dump_space_info() to underflow its free space It's not uncommon where __btrfs_dump_space_info() gets called under over-commit situations. In that case free space would underflow as total allocated space is not enough to handle all the over-committed space. Such underflow values can sometimes cause confusion for users enabled enospc_debug mount option, and takes some seconds for developers to convert the underflow value to signed result. Just output the free space as s64 to avoid such problem. Reported-by: Eli V Link: https://lore.kernel.org/linux-btrfs/CAJtFHUSy4zgyhf-4d9T+KdJp9w=UgzC2A0V=VtmaeEpcGgm1-Q@mail.gmail.com/ CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6b225baababf1e3d41a4250e802cbd193e1343fb Author: Filipe Manana Date: Wed Sep 8 19:05:44 2021 +0100 btrfs: fix mount failure due to past and transient device flush error When we get an error flushing one device, during a super block commit, we record the error in the device structure, in the field 'last_flush_error'. This is used to later check if we should error out the super block commit, depending on whether the number of flush errors is greater than or equals to the maximum tolerated device failures for a raid profile. However if we get a transient device flush error, unmount the filesystem and later try to mount it, we can fail the mount because we treat that past error as critical and consider the device is missing. Even if it's very likely that the error will happen again, as it's probably due to a hardware related problem, there may be cases where the error might not happen again. One example is during testing, and a test case like the new generic/648 from fstests always triggers this. The test cases generic/019 and generic/475 also trigger this scenario, but very sporadically. When this happens we get an error like this: $ mount /dev/sdc /mnt mount: /mnt wrong fs type, bad option, bad superblock on /dev/sdc, missing codepage or helper program, or other error. $ dmesg (...) [12918.886926] BTRFS warning (device sdc): chunk 13631488 missing 1 devices, max tolerance is 0 for writable mount [12918.888293] BTRFS warning (device sdc): writable mount is not allowed due to too many missing devices [12918.890853] BTRFS error (device sdc): open_ctree failed The failure happens because when btrfs_check_rw_degradable() is called at mount time, or at remount from RO to RW time, is sees a non zero value in a device's ->last_flush_error attribute, and therefore considers that the device is 'missing'. Fix this by setting a device's ->last_flush_error to zero when we close a device, making sure the error is not seen on the next mount attempt. We only need to track flush errors during the current mount, so that we never commit a super block if such errors happened. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit acbee9aff8aea4b9b66ab3d5cee6b8dbc153dc38 Author: Filipe Manana Date: Wed Sep 8 16:29:26 2021 +0100 btrfs: fix transaction handle leak after verity rollback failure During a verity rollback, if we fail to update the inode or delete the orphan, we abort the transaction and return without releasing our transaction handle. Fix that by releasing the handle. Fixes: 146054090b0859 ("btrfs: initial fsverity support") Fixes: 705242538ff348 ("btrfs: verity metadata orphan items") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bbc9a6eb5eec03dcafee266b19f56295e3b2aa8f Author: Qu Wenruo Date: Tue Aug 17 07:55:40 2021 +0800 btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling There is a BUG_ON() in btrfs_csum_one_bio() to catch code logic error. It has indeed caught several bugs during subpage development. But the BUG_ON() itself will bring down the whole system which is an overkill. Replace it with a WARN() and exit gracefully, so that it won't crash the whole system while we can still catch the code logic error. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ddf21bd8ab984ccaa924f090fc7f515bb6d51414 Merge: 0bc7eb03cbd3e b66ceaf324b39 Author: Linus Torvalds Date: Fri Sep 17 09:23:44 2021 -0700 Merge tag 'iov_iter.3-5.15-2021-09-17' of git://git.kernel.dk/linux-block Pull io_uring iov_iter retry fixes from Jens Axboe: "This adds a helper to save/restore iov_iter state, and modifies io_uring to use it. After that is done, we can now kill the iter->truncated addition that we added for this release. The io_uring change is being overly cautious with the save/restore/advance, but better safe than sorry and we can always improve that and reduce the overhead if it proves to be of concern. The only case to be worried about in this regard is huge IO, where iteration can take a while to iterate segments. I spent some time writing test cases, and expanded the coverage quite a bit from the last posting of this. liburing carries this regression test case now: https://git.kernel.dk/cgit/liburing/tree/test/file-verify.c which exercises all of this. It now also supports provided buffers, and explicitly tests for end-of-file/device truncation as well. On top of that, Pavel sanitized the IOPOLL retry path to follow the exact same pattern as normal IO" * tag 'iov_iter.3-5.15-2021-09-17' of git://git.kernel.dk/linux-block: io_uring: move iopoll reissue into regular IO path Revert "iov_iter: track truncated size" io_uring: use iov_iter state save/restore helpers iov_iter: add helper to save iov_iter state commit 0bc7eb03cbd3e5d057cbe2ee15ddedf168f25a8d Merge: 36d6753bc205b 5d329e1286b0a Author: Linus Torvalds Date: Fri Sep 17 09:19:59 2021 -0700 Merge tag 'io_uring-5.15-2021-09-17' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Mostly fixes for regressions in this cycle, but also a few fixes that predate this release. The odd one out is a tweak to the direct files added in this release, where attempting to reuse a slot is allowed instead of needing an explicit removal of that slot first. It's a considerable improvement in usability to that API, hence I'm sending it for -rc2. - io-wq race fix and cleanup (Hao) - loop_rw_iter() type fix - SQPOLL max worker race fix - Allow poll arm for O_NONBLOCK files, fixing a case where it's impossible to properly use io_uring if you cannot modify the file flags - Allow direct open to simply reuse a slot, instead of needing it explicitly removed first (Pavel) - Fix a case where we missed signal mask restoring in cqring_wait, if we hit -EFAULT (Xiaoguang)" * tag 'io_uring-5.15-2021-09-17' of git://git.kernel.dk/linux-block: io_uring: allow retry for O_NONBLOCK if async is supported io_uring: auto-removal for direct open/accept io_uring: fix missing sigmask restore in io_cqring_wait() io_uring: pin SQPOLL data before unlocking ring lock io-wq: provide IO_WQ_* constants for IORING_REGISTER_IOWQ_MAX_WORKERS arg items io-wq: fix potential race of acct->nr_workers io-wq: code clean of io_wqe_create_worker() io_uring: ensure symmetry in handling iter types in loop_rw_iter() commit 36d6753bc205b6e8588cb49631642455165333ab Merge: 7f2cd14129f02 858560b27645e Author: Linus Torvalds Date: Fri Sep 17 09:16:59 2021 -0700 Merge tag 'block-5.15-2021-09-17' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - fix ANA state updates when a namespace is not present (Anton Eidelman) - nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show (Dan Carpenter) - avoid race in shutdown namespace removal (Daniel Wagner) - fix io_work priority inversion in nvme-tcp (Keith Busch) - destroy cm id before destroy qp to avoid use after free (Ruozhu Li) - blk-integrity profile registration fixes (Christoph, Lihong) - blk-cgroup UAF fix (Li) - blk-mq tag iterator fix (Ming) - blkcg memory leak fix (Yanfei) * tag 'block-5.15-2021-09-17' of git://git.kernel.dk/linux-block: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd blkcg: fix memory leak in blk_iolatency_init nvme: remove the call to nvme_update_disk_info in nvme_ns_remove block: flush the integrity workqueue in blk_integrity_unregister block: check if a profile is actually registered in blk_integrity_unregister nvme-tcp: fix io_work priority inversion nvme-rdma: destroy cm id before destroy qp to avoid use after free nvme-multipath: fix ANA state updates when a namespace is not present nvme: avoid race in shutdown namespace removal nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show() blk-mq: avoid to iterate over stale request commit 7f2cd14129f0272a3ae983625a1adf2545bdad52 Merge: c6460daea23dc 9fcb2e93f41c0 Author: Linus Torvalds Date: Fri Sep 17 08:59:27 2021 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes and cleanups from Catalin Marinas: - Fix the memset() size when re-initialising the SVE state. - Mark __stack_chk_guard as __ro_after_init. - Remove duplicate include. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Mark __stack_chk_guard as __ro_after_init arm64/kernel: remove duplicate include in process.c arm64/sve: Use correct size when reinitialising SVE state commit c6460daea23dcd160f2dc497c64b4c882ea1de69 Merge: bdb575f872175 d859ed25b2428 Author: Linus Torvalds Date: Fri Sep 17 08:31:49 2021 -0700 Merge tag 'for-linus-5.15b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - The first hunk of a Xen swiotlb fixup series fixing multiple minor issues and doing some small cleanups - Some further Xen related fixes avoiding WARN() splats when running as Xen guests or dom0 - A Kconfig fix allowing the pvcalls frontend to be built as a module * tag 'for-linus-5.15b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: swiotlb-xen: drop DEFAULT_NSLABS swiotlb-xen: arrange to have buffer info logged swiotlb-xen: drop leftover __ref swiotlb-xen: limit init retries swiotlb-xen: suppress certain init retries swiotlb-xen: maintain slab count properly swiotlb-xen: fix late init retry swiotlb-xen: avoid double free xen/pvcalls: backend can be a module xen: fix usage of pmd_populate in mremap for pv guests xen: reset legacy rtc flag for PV domU PM: base: power: don't try to use non-existing RTC for storing data xen/balloon: use a kernel thread instead a workqueue commit 02579b2ff8b0becfb51d85a975908ac4ab15fba8 Author: Dai Ngo Date: Thu Sep 16 14:22:12 2021 -0400 nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN When the back channel enters SEQ4_STATUS_CB_PATH_DOWN state, the client recovers by sending BIND_CONN_TO_SESSION but the server fails to recover the back channel and leaves it as NFSD4_CB_DOWN. Fix by enhancing nfsd4_bind_conn_to_session to probe the back channel by calling nfsd4_probe_callback. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 89c485c7a3ecbc2ebd568f9c9c2edf3a8cf7485b Author: Chuck Lever Date: Thu Sep 16 17:24:54 2021 -0400 NLM: Fix svcxdr_encode_owner() Dai Ngo reports that, since the XDR overhaul, the NLM server crashes when the TEST procedure wants to return NLM_DENIED. There is a bug in svcxdr_encode_owner() that none of our standard test cases found. Replace the open-coded function with a call to an appropriate pre-fabricated XDR helper. Reported-by: Dai Ngo Fixes: a6a63ca5652e ("lockd: Common NLM XDR helpers") Signed-off-by: Chuck Lever commit a9b3043de47b7f8cbe38c36aee572526665b6315 Author: Mike Galbraith Date: Sun Sep 12 11:56:26 2021 +0900 ksmbd: transport_rdma: Don't include rwlock.h directly rwlock.h specifically asks to not be included directly. In fact, the proper spinlock.h include isn't needed either, it comes with the huge pile that kthread.h ends up pulling in, so just drop it entirely. Signed-off-by: Mike Galbraith Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 02319bf15acf54004216e40ac9c171437f24be24 Author: Florian Fainelli Date: Thu Sep 16 14:33:35 2021 -0700 net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports() After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS, which created an off by one error between the statically allocated bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When dsa_is_cpu_port() is used, we end-up accessing an out of bounds member and causing a NPD. Fix this by iterating with the appropriate port count using ds->num_ports. Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 3c9cfb5269f76d447dbadb67835368f3111a91d7 Author: Vladimir Oltean Date: Fri Sep 17 14:17:35 2021 +0300 net: update NXP copyright text NXP Legal insists that the following are not fine: - Saying "NXP Semiconductors" instead of "NXP", since the company's registered name is "NXP" - Putting a "(c)" sign in the copyright string - Putting a comma in the copyright string The only accepted copyright string format is "Copyright NXP". This patch changes the copyright headers in the networking files that were sent by me, or derived from code sent by me. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit dc9660590d106bb58d145233fffca4efadad3655 Author: Krzysztof Kozlowski Date: Thu Sep 16 16:41:02 2021 +0200 regulator: max14577: Revert "regulator: max14577: Add proper module aliases strings" This reverts commit 0da6736ecd10b45e535b100acd58df2db4c099d8. The MODULE_DEVICE_TABLE already creates proper alias. Having another MODULE_ALIAS causes the alias to be duplicated: $ modinfo max14577-regulator.ko alias: platform:max77836-regulator alias: platform:max14577-regulator description: Maxim 14577/77836 regulator driver alias: platform:max77836-regulator alias: platform:max14577-regulator Cc: Marek Szyprowski Fixes: 0da6736ecd10 ("regulator: max14577: Add proper module aliases strings") Signed-off-by: Krzysztof Kozlowski Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20210916144102.120980-1-krzysztof.kozlowski@canonical.com Signed-off-by: Mark Brown commit cfacfefd382af3b42905108b54f02820dca225c4 Author: Peter Ujfalusi Date: Fri Sep 17 11:51:08 2021 +0300 ASoC: SOF: trace: Omit error print when waking up trace sleepers Do not print error message from snd_sof_trace_notify_for_error() when possible sleeping trace work is woken up to flush the remaining debug information. This action by itself is not an error, it is just an action we take when an error occurs to make sure that all information have been fed to the userspace (if we have trace in use). Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20210917085108.25532-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3abe2eec87059260bf31033a8863c67c5d45b9d0 Author: Trevor Wu Date: Fri Sep 17 16:28:05 2021 +0800 ASoC: mediatek: mt8195: remove wrong fixup assignment on HDMITX S24_LE params fixup is only required for DPTX. Remove fixup ops assignment for HDMITX. Fixes: 40d605df0a7b ("ASoC: mediatek: mt8195: add machine driver with mt6359, rt1019 and rt5682") Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210917082805.30898-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 23ca067b3295d935835b71f743235f9e5ab31cc5 Author: Sebastian Andrzej Siewior Date: Wed Sep 1 10:44:03 2021 +0200 mm: Fully initialize invalidate_lock, amend lock class later The function __init_rwsem() is not part of the official API, it just a helper function used by init_rwsem(). Changing the lock's class and name should be done by using lockdep_set_class_and_name() after the has been fully initialized. The overhead of the additional class struct and setting it twice is negligible and it works across all locks. Fully initialize the lock with init_rwsem() and then set the custom class and name for the lock. Fixes: 730633f0b7f95 ("mm: Protect operations adding pages to page cache with invalidate_lock") Link: https://lore.kernel.org/r/20210901084403.g4fezi23cixemlhh@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jan Kara commit e8f69b16ee776da88589b5271e3f46020efc8f6c Author: Johan Hovold Date: Fri Sep 17 12:12:04 2021 +0200 net: hso: fix muxed tty registration If resource allocation and registration fail for a muxed tty device (e.g. if there are no more minor numbers) the driver should not try to deregister the never-registered (or already-deregistered) tty. Fix up the error handling to avoid dereferencing a NULL pointer when attempting to remove the character device. Fixes: 72dc1c096c70 ("HSO: add option hso driver") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold Signed-off-by: David S. Miller commit 078fb7aa6a8305bce09cdfbe77b4c987934442ba Author: Rob Herring Date: Thu Aug 19 13:42:39 2021 -0500 arm: dts: vexpress: Fix addressing issues with 'motherboard-bus' nodes The 'motherboard-bus' node in Arm Ltd boards fails schema checks as 'simple-bus' child nodes must have a unit-address. The 'ranges' handling is also wrong (or at least strange) as the mapping of SMC chip selects should be in the 'arm,vexpress,v2m-p1' node rather than a generic 'simple-bus' node. Either there's 1 too many levels of 'simple-bus' nodes or 'ranges' should be moved down a level. The latter change is more simple, so let's do that. As the 'ranges' value doesn't vary for a given motherboard instance, we can move 'ranges' into the motherboard dtsi files. Link: https://lore.kernel.org/r/20210819184239.1192395-6-robh@kernel.org Cc: Andre Przywara Cc: Sudeep Holla Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Rob Herring Signed-off-by: Sudeep Holla commit 047a749d231e4faccaf5f473cf73dc5732425f81 Merge: 844f7eaaed926 88d0adb5f13b1 Author: Steffen Klassert Date: Fri Sep 17 08:58:24 2021 +0200 Merge branch 'xfrm: fix uapi for the default policy' Nicolas Dichtel says: ==================== This feature has just been merged after the last release, thus it's still time to fix the uapi. As stated in the thread, the uapi is based on some magic values (from the userland POV). Here is a proposal to simplify this uapi and make it clear how to use it. The other problem was the notification: changing the default policy may radically change the packets flows. v2 -> v3: rebase on top of ipsec tree v1 -> v2: fix warnings reported by the kernel test robot ==================== Signed-off-by: Steffen Klassert commit c8087adc8865c76500dbc072a46b61d35f6c908b Author: Mauro Carvalho Chehab Date: Thu Sep 16 11:55:02 2021 +0200 dt-bindings: arm: mediatek: mmsys: update mediatek,mmsys.yaml reference Changeset cba3c40d1f97 ("dt-bindings: arm: mediatek: mmsys: convert to YAML format") renamed: Documentation/devicetree/bindings/arm/mediatek/mediatek,mmsys.txt to: Documentation/devicetree/bindings/arm/mediatek/mediatek,mmsys.yaml. Update its cross-reference accordingly. Fixes: cba3c40d1f97 ("dt-bindings: arm: mediatek: mmsys: convert to YAML format") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/a87eb079a73e8ab41cdf6e40e80b1d1f868da6bd.1631785820.git.mchehab+huawei@kernel.org commit a11de92523f75a8140cf8eea3ce9b628f7a3cc77 Author: Mauro Carvalho Chehab Date: Thu Sep 16 11:55:01 2021 +0200 dt-bindings: net: dsa: sja1105: update nxp,sja1105.yaml reference Changeset 62568bdbe6f6 ("dt-bindings: net: dsa: sja1105: convert to YAML schema") renamed: Documentation/devicetree/bindings/net/dsa/sja1105.txt to: Documentation/devicetree/bindings/net/dsa/nxp,sja1105.yaml. Update its cross-reference accordingly. Fixes: 62568bdbe6f6 ("dt-bindings: net: dsa: sja1105: convert to YAML schema") Reviewed-by: Vladimir Oltean Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/994ce6c6358746ff600459822b9f6e336db933c9.1631785820.git.mchehab+huawei@kernel.org commit d36a97736b2cc9b13db0dfdf6f32b115ec193614 Author: David Collins Date: Thu Sep 16 18:51:37 2021 +0530 pinctrl: qcom: spmi-gpio: correct parent irqspec translation pmic_gpio_child_to_parent_hwirq() and gpiochip_populate_parent_fwspec_fourcell() translate a pinctrl- spmi-gpio irqspec to an SPMI controller irqspec. When they do this, they use a fixed SPMI slave ID of 0 and a fixed GPIO peripheral offset of 0xC0 (corresponding to SPMI address 0xC000). This translation results in an incorrect irqspec for secondary PMICs that don't have a slave ID of 0 as well as for PMIC chips which have GPIO peripherals located at a base address other than 0xC000. Correct this issue by passing the slave ID of the pinctrl-spmi- gpio device's parent in the SPMI controller irqspec and by calculating the peripheral ID base from the device tree 'reg' property of the pinctrl-spmi-gpio device. Signed-off-by: David Collins Signed-off-by: satya priya Fixes: ca69e2d165eb ("qcom: spmi-gpio: add support for hierarchical IRQ chip") Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/1631798498-10864-2-git-send-email-skakit@codeaurora.org Signed-off-by: Linus Walleij commit acd47b9f28e55b505aedb842131b40904e151d7c Author: Basavaraj Natikar Date: Tue Aug 31 17:36:13 2021 +0530 pinctrl: amd: Handle wake-up interrupt Enable/disable power management wakeup mode, which is disabled by default. enable_irq_wake enables wakes the system from sleep. Hence added enable/disable irq_wake to handle wake-up interrupt. Signed-off-by: Basavaraj Natikar Tested-by: Mario Limonciello Acked-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20210831120613.1514899-3-Basavaraj.Natikar@amd.com Signed-off-by: Linus Walleij commit 7e6f8d6f4a42ef9b693ff1b49267c546931d4619 Author: Basavaraj Natikar Date: Tue Aug 31 17:36:12 2021 +0530 pinctrl: amd: Add irq field data pinctrl_amd use gpiochip_get_data() to get their local state containers back from the gpiochip passed as amd_gpio chip data. Hence added irq field data to get directly using amd_gpio chip data. Signed-off-by: Basavaraj Natikar Tested-by: Mario Limonciello Acked-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20210831120613.1514899-2-Basavaraj.Natikar@amd.com Signed-off-by: Linus Walleij commit e9a9970bf520c99e530d8f1fa5b5c22671fad4ef Author: Russ Weight Date: Thu Sep 16 14:07:33 2021 -0700 fpga: dfl: Avoid reads to AFU CSRs during enumeration CSR address space for Accelerator Functional Units (AFU) is not available during the early Device Feature List (DFL) enumeration. Early access to this space results in invalid data and port errors. This change adds a condition to prevent an early read from the AFU CSR space. Fixes: 1604986c3e6b ("fpga: dfl: expose feature revision from struct dfl_device") Cc: stable@vger.kernel.org Signed-off-by: Russ Weight Signed-off-by: Moritz Fischer commit 129803e642ac3d828b3c73ff10f570c42d962ef8 Author: Michal Simek Date: Wed Aug 25 09:41:22 2021 +0200 pinctrl: core: Remove duplicated word from devm_pinctrl_unregister() Remove duplicated "which" from devm_pinctrl_unregister() kernel doc description. Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/8b75e5dfd9363f35ebdd7812e119757379678f97.1629877281.git.michal.simek@xilinx.com Signed-off-by: Linus Walleij commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 Author: Vadim Pasternak Date: Thu Sep 16 21:31:51 2021 +0300 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS. Here is the trace from KASAN: [ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc .. Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20210916183151.869427-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit bdb575f872175ed0ecf2638369da1cb7a6e86a14 Merge: fc0c0548c1a2e 109f7ea9aedce Author: Linus Torvalds Date: Thu Sep 16 13:28:52 2021 -0700 Merge tag 'drm-fixes-2021-09-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Slightly busier than usual rc2, but mostly scattered amdgpu fixes, some i915 and etnaviv resolves an MMU/runtime PM blowup. amdgpu: - UBSAN fix - Powerplay table update fix - Fix use after free in BO moves - Debugfs init fixes - vblank workqueue fixes for headless devices - FPU fixes - sysfs_emit fixes - SMU updates for cyan skillfish - Backlight fixes when DMCU is not initialized - DP MST fixes - HDCP compliance fix - Link training fix - Runtime pm fix - Panel orientation fixes - Display GPUVM fix for yellow carp - Add missing license amdkfd: - Drop PCI atomics requirement if proper firmware is available - Suspend/resume fixes for IOMMUv2 cases radeon: - AGP fix i915: - Propagate DP link training error returns - Use max link params for eDP 1.3 and earlier - Build warning fixes - Gem selftest fixes - Ensure wakeref is held before hardware access etnaviv: - MMU context vs runtime PM fix" * tag 'drm-fixes-2021-09-17' of git://anongit.freedesktop.org/drm/drm: (44 commits) drm/amdgpu/display: add a proper license to dc_link_dp.c drm/amd/display: Fix white screen page fault for gpuvm amd/display: enable panel orientation quirks drm/amdgpu: Demote TMZ unsupported log message from warning to info drm/amdgpu: Drop inline from amdgpu_ras_eeprom_max_record_count drm/amd/pm: fix runpm hang when amdgpu loaded prior to sound driver drm/radeon: pass drm dev radeon_agp_head_init directly drm/amdgpu: move iommu_resume before ip init/resume drm/amdgpu: add amdgpu_amdkfd_resume_iommu drm/amdkfd: separate kfd_iommu_resume from kfd_resume drm/amd/display: Link training retry fix for abort case drm/amd/display: Fix unstable HPCP compliance on Chrome Barcelo drm/amd/display: dsc mst 2 4K displays go dark with 2 lane HBR3 drm/amd/display: Get backlight from PWM if DMCU is not initialized drm/amdkfd: make needs_pcie_atomics FW-version dependent drm/amdgpu: add manual sclk/vddc setting support for cyan skilfish(v3) drm/amdgpu: add some pptable funcs for cyan skilfish(v3) drm/amdgpu: update SMU driver interface for cyan skilfish(v3) drm/amdgpu: update SMU PPSMC for cyan skilfish drm/amdgpu: fix sysfs_emit/sysfs_emit_at warnings(v2) ... commit fc0c0548c1a2e676d3a928aaed70f2d4d254e395 Merge: 3c0d2a46c0141 ee8a9600b5391 Author: Linus Torvalds Date: Thu Sep 16 13:05:42 2021 -0700 Merge tag 'net-5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf. Current release - regressions: - vhost_net: fix OoB on sendmsg() failure - mlx5: bridge, fix uninitialized variable usage - bnxt_en: fix error recovery regression Current release - new code bugs: - bpf, mm: fix lockdep warning triggered by stack_map_get_build_id_offset() Previous releases - regressions: - r6040: restore MDIO clock frequency after MAC reset - tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() - dsa: flush switchdev workqueue before tearing down CPU/DSA ports Previous releases - always broken: - ptp: dp83640: don't define PAGE0, avoid compiler warning - igc: fix tunnel segmentation offloads - phylink: update SFP selected interface on advertising changes - stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume - mlx5e: fix mutual exclusion between CQE compression and HW TS Misc: - bpf, cgroups: fix cgroup v2 fallback on v1/v2 mixed mode - sfc: fallback for lack of xdp tx queues - hns3: add option to turn off page pool feature" * tag 'net-5.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (67 commits) mlxbf_gige: clear valid_polarity upon open igc: fix tunnel offloading net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock assert net: wan: wanxl: define CROSS_COMPILE_M68K selftests: nci: replace unsigned int with int net: dsa: flush switchdev workqueue before tearing down CPU/DSA ports Revert "net: phy: Uniform PHY driver access" net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup ptp: dp83640: don't define PAGE0 bnx2x: Fix enabling network interfaces without VFs Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers"" tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() net-caif: avoid user-triggerable WARN_ON(1) bpf, selftests: Add test case for mixed cgroup v1/v2 bpf, selftests: Add cgroup v1 net_cls classid helpers bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode bpf: Add oversize check before call kvcalloc() net: hns3: fix the timing issue of VF clearing interrupt sources net: hns3: fix the exception when query imp info net: hns3: disable mac in flr process ... commit 109f7ea9aedce437b4b7737ab60bfea65d9dbdd3 Merge: 11654b3763cc0 92554cbe0a364 Author: Dave Airlie Date: Fri Sep 17 05:58:55 2021 +1000 Merge tag 'amd-drm-fixes-5.15-2021-09-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-5.15-2021-09-16: amdgpu: - UBSAN fix - Powerplay table update fix - Fix use after free in BO moves - Debugfs init fixes - vblank workqueue fixes for headless devices - FPU fixes - sysfs_emit fixes - SMU updates for cyan skillfish - Backlight fixes when DMCU is not initialized - DP MST fixes - HDCP compliance fix - Link training fix - Runtime pm fix - Panel orientation fixes - Display GPUVM fix for yellow carp - Add missing license amdkfd: - Drop PCI atomics requirement if proper firmware is available - Suspend/resume fixes for IOMMUv2 cases radeon: - AGP fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210916140611.59816-1-alexander.deucher@amd.com commit 11654b3763cc0625283753f41c3404ec666a9854 Merge: da4ce47e146ac 7889367d7795b Author: Dave Airlie Date: Fri Sep 17 05:53:52 2021 +1000 Merge tag 'drm-intel-fixes-2021-09-16' of ssh://git.freedesktop.org/git/drm/drm-intel into drm-fixes drm/i915 fixes for v5.15-rc2: - Propagate DP link training error returns - Use max link params for eDP 1.3 and earlier - Build warning fixes - Gem selftest fixes - Ensure wakeref is held before hardware access Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/8735q4wsu7.fsf@intel.com commit 3c0d2a46c0141913dc6fd126c57d0615677d946e Author: Guenter Roeck Date: Wed Sep 8 20:57:43 2021 -0700 net: 6pack: Fix tx timeout and slot time tx timeout and slot time are currently specified in units of HZ. On Alpha, HZ is defined as 1024. When building alpha:allmodconfig, this results in the following error message. drivers/net/hamradio/6pack.c: In function 'sixpack_open': drivers/net/hamradio/6pack.c:71:41: error: unsigned conversion from 'int' to 'unsigned char' changes value from '256' to '0' In the 6PACK protocol, tx timeout is specified in units of 10 ms and transmitted over the wire: https://www.linux-ax25.org/wiki/6PACK Defining a value dependent on HZ doesn't really make sense, and presumably comes from the (very historical) situation where HZ was originally 100. Note that the SIXP_SLOTTIME use explicitly is about 10ms granularity: mod_timer(&sp->tx_t, jiffies + ((when + 1) * HZ) / 100); and the SIXP_TXDELAY walue is sent as a byte over the wire. Signed-off-by: Guenter Roeck Signed-off-by: Linus Torvalds commit da4ce47e146ace5af54198230aa3ed9431f0bbd4 Merge: 6880fa6c56601 f2faea8b64125 Author: Dave Airlie Date: Fri Sep 17 05:30:56 2021 +1000 Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes Fixes a very annoying issue where the driver view of the MMU state gets out of sync with the actual hardware state across a runtime PM cycle, so we end up restarting the GPU with the wrong (potentially already freed) MMU context. Hilarity ensues. Signed-off-by: Dave Airlie From: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/729a561b6cfed090457bcc856a9e14ed6209fe21.camel@pengutronix.de commit 040b8907ccf1c78d020aca29800036565d761d73 Author: Arnd Bergmann Date: Tue Apr 28 23:31:24 2020 +0200 drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume __maybe_unused With the new static annotation, the compiler warns when the functions are actually unused: drivers/gpu/drm/rockchip/cdn-dp-core.c:1123:12: error: 'cdn_dp_resume' defined but not used [-Werror=unused-function] 1123 | static int cdn_dp_resume(struct device *dev) | ^~~~~~~~~~~~~ Mark them __maybe_unused to suppress that warning as well. [ Not so 'new' static annotations any more, and I removed the part of the patch that added __maybe_unused to cdn_dp_suspend(), because it's used by the shutdown/remove code. So only the resume function ends up possibly unused if CONFIG_PM isn't set - Linus ] Fixes: 7c49abb4c2f8 ("drm/rockchip: cdn-dp-core: Make cdn_dp_core_suspend/resume static") Signed-off-by: Arnd Bergmann Reviewed-by: Enric Balletbo i Serra Signed-off-by: Linus Torvalds commit f5013d412a43662b63f3d5f3a804d63213acd471 Author: Shuah Khan Date: Wed Sep 15 15:28:09 2021 -0600 selftests: kvm: fix get_run_delay() ignoring fscanf() return warn Fix get_run_delay() to check fscanf() return value to get rid of the following warning. When fscanf() fails return MIN_RUN_DELAY_NS from get_run_delay(). Move MIN_RUN_DELAY_NS from steal_time.c to test_util.h so get_run_delay() and steal_time.c can use it. lib/test_util.c: In function ‘get_run_delay’: lib/test_util.c:316:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result] 316 | fscanf(fp, "%ld %ld ", &val[0], &val[1]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Shuah Khan Acked-by: Paolo Bonzini Signed-off-by: Shuah Khan commit 20175d5eac5bb94a7a3719ef275337fc9abf26ac Author: Shuah Khan Date: Wed Sep 15 15:28:08 2021 -0600 selftests: kvm: move get_run_delay() into lib/test_util get_run_delay() is defined static in xen_shinfo_test and steal_time test. Move it to lib and remove code duplication. Signed-off-by: Shuah Khan Acked-by: Paolo Bonzini Signed-off-by: Shuah Khan commit 3a4f0cc693cd3d80e66a255f0bff0e2c0461eef1 Author: Shuah Khan Date: Wed Sep 15 15:28:07 2021 -0600 selftests:kvm: fix get_trans_hugepagesz() ignoring fscanf() return warn Fix get_trans_hugepagesz() to check fscanf() return value to get rid of the following warning: lib/test_util.c: In function ‘get_trans_hugepagesz’: lib/test_util.c:138:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result] 138 | fscanf(f, "%ld", &size); | ^~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Shuah Khan Acked-by: Paolo Bonzini Signed-off-by: Shuah Khan commit 39a71f712d8a13728febd8f3cb3f6db7e1fa7221 Author: Shuah Khan Date: Wed Sep 15 15:28:06 2021 -0600 selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn Fix get_warnings_count() to check fscanf() return value to get rid of the following warning: x86_64/mmio_warning_test.c: In function ‘get_warnings_count’: x86_64/mmio_warning_test.c:85:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result] 85 | fscanf(f, "%d", &warnings); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Shuah Khan Acked-by: Paolo Bonzini Signed-off-by: Shuah Khan commit b60cee5bae733f49ba33840804c159a8e474cfda Author: Guenter Roeck Date: Thu Sep 9 11:47:14 2021 -0700 cpufreq: vexpress: Drop unused variable arm:allmodconfig fails to build with the following error. drivers/cpufreq/vexpress-spc-cpufreq.c:454:13: error: unused variable 'cur_cluster' Remove the unused variable. Fixes: bb8c26d9387f ("cpufreq: vexpress: Set CPUFREQ_IS_COOLING_DEV flag") Cc: Viresh Kumar Signed-off-by: Guenter Roeck Reviewed-by: Kees Cook Signed-off-by: Linus Torvalds commit 35a3f4ef0ab543daa1725b0c963eb8c05e3376f8 Author: Guenter Roeck Date: Wed Sep 8 22:00:33 2021 -0700 alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile Some drivers pass a pointer to volatile data to virt_to_bus() and virt_to_phys(), and that works fine. One exception is alpha. This results in a number of compile errors such as drivers/net/wan/lmc/lmc_main.c: In function 'lmc_softreset': drivers/net/wan/lmc/lmc_main.c:1782:50: error: passing argument 1 of 'virt_to_bus' discards 'volatile' qualifier from pointer target type drivers/atm/ambassador.c: In function 'do_loader_command': drivers/atm/ambassador.c:1747:58: error: passing argument 1 of 'virt_to_bus' discards 'volatile' qualifier from pointer target type Declare the parameter of virt_to_phys and virt_to_bus as pointer to volatile to fix the problem. Signed-off-by: Guenter Roeck Acked-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit db71f8fb44956714249a526647c143bac5bb96a1 Author: Linus Torvalds Date: Thu Sep 16 11:14:47 2021 -0700 3com 3c515: make it compile on 64-bit architectures This driver isn't enabled most places because of the ISA config dependency, but alpha still has it. And I think the 'Jensen' actually did have an ISA slot. However, it doesn't build cleanly, because the "Vortex bus master" code just casts the skb->data pointer to 'int': outl((int) (skb->data), ioaddr + Wn7_MasterAddr); which is all kinds of broken. Even on a good old traditional PC/AT it would be broken because the high bits will be random kernel address bits, but presumably the hardware ignores those bits. I mean, it's ISA. We're talking 16MB dma limits. The "good old days". Make the build happy with this kind of craziness by using the proper isa_virt_to_bus() handling that the full bus master code uses anyway (the Vortex bus mastering is a limited special case). Who knows, this might even work. Reported-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 5fe983d3f1a5b103fc00a24f9e0408302e60c39c Merge: 077a6ccf2588c 90cc7bed1ed19 Author: Linus Torvalds Date: Thu Sep 16 10:32:00 2021 -0700 Merge tag 'for-5.15/parisc-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Fix a build warning when using the PAGE0 pointer" * tag 'for-5.15/parisc-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Use absolute_pointer() to define PAGE0 commit 077a6ccf2588c7c893b443fad62d0f8ed342cafc Merge: ff1ffd71d5f06 a7b68ed15d1fd Author: Linus Torvalds Date: Thu Sep 16 10:26:48 2021 -0700 Merge tag 'm68k-for-v5.15-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fixes from Geert Uytterhoeven: - Warning fixes to mitigate CONFIG_WERROR=y * tag 'm68k-for-v5.15-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: mvme: Remove overdue #warnings in RTC handling m68k: Double cast io functions to unsigned long commit 24d5f16e407b75bc59d5419b957a9cab423b2681 Author: Ilan Peer Date: Tue Sep 7 14:32:14 2021 +0300 iwlwifi: mvm: Fix possible NULL dereference In __iwl_mvm_remove_time_event() check that 'te_data->vif' is NULL before dereferencing it. Fixes: 7b3954a1d69a ("iwlwifi: mvm: Explicitly stop session protection before unbinding") Reported-by: Dan Carpenter Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/iwlwifi.20210907143156.e80e52167d93.Ie2247f43f8acb2cee6dff5b07a3947c79a772835@changeid commit 9fcb2e93f41c07a400885325e7dbdfceba6efaec Author: Dan Li Date: Tue Sep 14 17:44:02 2021 +0800 arm64: Mark __stack_chk_guard as __ro_after_init __stack_chk_guard is setup once while init stage and never changed after that. Although the modification of this variable at runtime will usually cause the kernel to crash (so does the attacker), it should be marked as __ro_after_init, and it should not affect performance if it is placed in the ro_after_init section. Signed-off-by: Dan Li Acked-by: Mark Rutland Link: https://lore.kernel.org/r/1631612642-102881-1-git-send-email-ashimida@linux.alibaba.com Signed-off-by: Catalin Marinas commit 861dc4f52e6992c933998fb4dd03fefe1fa5ce27 Author: Lv Ruyi Date: Wed Sep 1 18:11:26 2021 -0700 arm64/kernel: remove duplicate include in process.c Remove all but the first include of linux/sched.h from process.c Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20210902011126.29828-1-lv.ruyi@zte.com.cn Signed-off-by: Catalin Marinas commit e35ac9d0b56e9efefaeeb84b635ea26c2839ea86 Author: Mark Brown Date: Thu Sep 9 17:53:56 2021 +0100 arm64/sve: Use correct size when reinitialising SVE state When we need a buffer for SVE register state we call sve_alloc() to make sure that one is there. In order to avoid repeated allocations and frees we keep the buffer around unless we change vector length and just memset() it to ensure a clean register state. The function that deals with this takes the task to operate on as an argument, however in the case where we do a memset() we initialise using the SVE state size for the current task rather than the task passed as an argument. This is only an issue in the case where we are setting the register state for a task via ptrace and the task being configured has a different vector length to the task tracing it. In the case where the buffer is larger in the traced process we will leak old state from the traced process to itself, in the case where the buffer is smaller in the traced process we will overflow the buffer and corrupt memory. Fixes: bc0ee4760364 ("arm64/sve: Core task context handling") Cc: # 4.15.x Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210909165356.10675-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit c3dbfb9c49eef7d07904e5fd5e158dd6688bbab3 Author: Thierry Reding Date: Thu Sep 2 22:33:09 2021 +0200 gpu: host1x: Plug potential memory leak The memory allocated for a DMA fence could be leaked if the code failed to allocate the waiter object. Make sure to release the fence allocation on failure. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Thierry Reding commit a81cf839a064af27349b857fe347e97dd98c12a0 Author: Dmitry Osipenko Date: Tue Aug 17 05:01:53 2021 +0300 gpu/host1x: fence: Make spinlock static The DEFINE_SPINLOCK macro creates a global spinlock symbol that is visible to the whole kernel. This is unintended in the code, fix it. Fixes: 687db2207b1b ("gpu: host1x: Add DMA fence implementation") Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 8a44924e1400d75db5c6fdaf199038580df4f79f Author: Dmitry Osipenko Date: Tue Aug 17 05:01:52 2021 +0300 drm/tegra: uapi: Fix wrong mapping end address in case of disabled IOMMU All jobs are failing on Tegra20 because it doesn't use IOMMU and mapping function uses size of mapping that is zero instead of BO size, fix it. Fixes: d7c591bc1a3f ("drm/tegra: Implement new UAPI") Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 71eabafac1eb67d590d4500eaf38177537ea6d4a Author: Dmitry Osipenko Date: Tue Aug 17 05:01:51 2021 +0300 drm/tegra: dc: Remove unused variables Remove unused variables from tegra_crtc_update_memory_bandwidth(). Fixes: 04d5d5df9df7 ("drm/tegra: dc: Support memory bandwidth management") Reported-by: kernel test robot Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit e22e509c1cd90b48ae31099905418de74515e56f Author: Alim Akhtar Date: Wed Sep 15 20:18:44 2021 +0900 dt-bindings: ufs: Add bindings for Samsung ufs host This patch adds DT bindings for Samsung ufs hci Signed-off-by: Alim Akhtar Signed-off-by: Chanho Park Link: https://lore.kernel.org/r/20210915111844.42752-1-chanho61.park@samsung.com Signed-off-by: Rob Herring commit 6e3331ee34461be37f50912295a2e924a673dbc6 Author: Kari Argillander Date: Tue Sep 7 17:28:42 2021 +0300 fs/ntfs3: Use min/max macros instated of ternary operators We can make code little bit more readable by using min/max macros. These were found with Coccinelle. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit b5322eb1ae94572f5a52e804857e641b846059f4 Author: Kari Argillander Date: Tue Sep 7 17:28:41 2021 +0300 fs/ntfs3: Use clamp/max macros instead of comparisons We can make code little more readable by using kernel macros clamp/max. This were found with kernel included Coccinelle minmax script. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit f162f7b8dbc29742896f8a7e678bb31192716ae0 Author: Kari Argillander Date: Tue Sep 7 17:28:40 2021 +0300 fs/ntfs3: Remove always false condition check We do not need this check as this is same thing as NTFS_MIN_MFT_ZONE > zlen. We already check NTFS_MIN_MFT_ZONE <= zlen and exit because is too big request. Remove it so code is cleaner. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit edb853ff3dc01c22577ea5d0383d067b68a6d663 Author: Kari Argillander Date: Tue Sep 7 17:28:39 2021 +0300 fs/ntfs3: Fix ntfs_look_for_free_space() does only report -ENOSPC If ntfs_refresh_zone() returns error it will be changed to -ENOSPC. It is not right. Also caller of this functions also check other errors. Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit cffb5152eea82de890dd418a90612aede96068d6 Author: Kari Argillander Date: Tue Sep 7 11:34:41 2021 +0300 fs/ntfs3: Remove tabs before spaces from comment Remove tabs before spaces from comment as recommended by kernel coding style. Checkpatch also warn about these. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 2829e39e0e8add377508b3c6ef4cf48e6db324fb Author: Kari Argillander Date: Tue Sep 7 11:34:40 2021 +0300 fs/ntfs3: Remove braces from single statment block Remove braces from single statment block as they are not needed. Also Linux kernel coding style guide recommend this and checkpatch warn about this. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 4ca7fe57f21a25afc4a651db5145bfe090c6248f Author: Kari Argillander Date: Tue Sep 7 11:34:39 2021 +0300 fs/ntfs3: Place Comparisons constant right side of the test For better code readability place constant always right side of the test. This will also address checkpatch warning. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 7d95995ab4de07ee642c925aa6dbf6d07069a751 Author: Kari Argillander Date: Tue Sep 7 11:34:38 2021 +0300 fs/ntfs3: Remove '+' before constant in ni_insert_resident() No need for plus sign here. So remove it. Checkpatch will also be happy. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 92554cbe0a36494f6dd760bc25ce5e5cdc60fc47 Author: Alex Deucher Date: Tue Sep 14 10:50:47 2021 -0400 drm/amdgpu/display: add a proper license to dc_link_dp.c Was missing. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit a70939851f9ced298dc7d523374b8c4d05239caf Author: Nicholas Kazlauskas Date: Mon Sep 13 14:56:44 2021 -0400 drm/amd/display: Fix white screen page fault for gpuvm [Why] The "base_addr_is_mc_addr" field was added for dcn3.1 support but pa_config was never updated to set it to false. Uninitialized memory causes it to be set to true which results in address mistranslation and white screen. [How] Use memset to ensure all fields are initialized to 0 by default. Fixes: 64b1d0e8d500 ("drm/amd/display: Add DCN3.1 HWSEQ") Signed-off-by: Nicholas Kazlauskas Acked-by: Alex Deucher Acked-by: Aaron Liu Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit cd51a57eb59fd56f3fe7ce9cadef444451bcf804 Author: Simon Ser Date: Fri Sep 10 15:37:41 2021 +0000 amd/display: enable panel orientation quirks This patch allows panel orientation quirks from DRM core to be used. They attach a DRM connector property "panel orientation" which indicates in which direction the panel has been mounted. Some machines have the internal screen mounted with a rotation. Since the panel orientation quirks need the native mode from the EDID, check for it in amdgpu_dm_connector_ddc_get_modes. Signed-off-by: Simon Ser Cc: Alex Deucher Cc: Harry Wentland Cc: Nicholas Kazlauskas Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit b287e4946873d706f94d95bdb2bf099dc8902181 Author: Paul Menzel Date: Mon Sep 13 10:34:11 2021 +0200 drm/amdgpu: Demote TMZ unsupported log message from warning to info As the user cannot do anything about the unsupported Trusted Memory Zone (TMZ) feature, do not warn about it, but make it informational, so demote the log level from warning to info. Signed-off-by: Paul Menzel Signed-off-by: Alex Deucher commit 114518ff3b30a3f0611f384fb58e0a968fdf7f5e Author: Michel Dänzer Date: Thu Sep 9 18:56:28 2021 +0200 drm/amdgpu: Drop inline from amdgpu_ras_eeprom_max_record_count This was unusual; normally, inline functions are declared static as well, and defined in a header file if used by multiple compilation units. The latter would be more involved in this case, so just drop the inline declaration for now. Fixes compile failure building for ppc64le on RHEL 8: In file included from ../drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h:32, from ../drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:33: ../drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c: In function ‘amdgpu_ras_recovery_init’: ../drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.h:90:17: error: inlining failed in call to ‘always_inline’ ‘amdgpu_ras_eeprom_max_record_count’: function body not available 90 | inline uint32_t amdgpu_ras_eeprom_max_record_count(void); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1985:34: note: called from here 1985 | max_eeprom_records_len = amdgpu_ras_eeprom_max_record_count(); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: c84d46707ebb "drm/amdgpu: validate bad page threshold in ras(v3)" Reviewed-by: Lyude Paul Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher commit 8b514e898ee7f861eb8863c647d258f71053af40 Author: Evan Quan Date: Thu Sep 9 11:01:00 2021 +0800 drm/amd/pm: fix runpm hang when amdgpu loaded prior to sound driver Current RUNPM mechanism relies on PMFW to master the timing for BACO in/exit. And that needs cooperation from sound driver for dstate change notification for function 1(audio). Otherwise(on sound driver missing), BACO cannot be kicked in correctly and hang will be observed on RUNPM exit. By switching back to legacy message way on sound driver missing, we are able to fix the runpm hang observed for the scenario below: amdgpu driver loaded -> runpm suspend kicked -> sound driver loaded Signed-off-by: Evan Quan Reported-and-tested-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Lijo Lazar Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 93def70cf8b23de5049d101b7dd5367864694bd3 Author: Nirmoy Das Date: Mon Sep 13 10:08:23 2021 +0200 drm/radeon: pass drm dev radeon_agp_head_init directly Pass drm dev directly as rdev->ddev gets initialized later on at radeon_device_init(). Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214375 Signed-off-by: Nirmoy Das Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f02abeb0779700c308e661a412451b38962b8a0b Author: James Zhu Date: Tue Sep 7 11:32:22 2021 -0400 drm/amdgpu: move iommu_resume before ip init/resume Separate iommu_resume from kfd_resume, and move it before other amdgpu ip init/resume. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211277 Signed-off-by: James Zhu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8066008482e533e91934bee49765bf8b4a7c40db Author: James Zhu Date: Tue Sep 7 11:27:31 2021 -0400 drm/amdgpu: add amdgpu_amdkfd_resume_iommu Add amdgpu_amdkfd_resume_iommu for amdgpu. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211277 Signed-off-by: James Zhu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit fefc01f042f44ede373ee66773b8238dd8fdcb55 Author: James Zhu Date: Tue Sep 7 11:13:02 2021 -0400 drm/amdkfd: separate kfd_iommu_resume from kfd_resume Separate kfd_iommu_resume from kfd_resume for fine-tuning of amdgpu device init/resume/reset/recovery sequence. v2: squash in fix for !CONFIG_HSA_AMD Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211277 Signed-off-by: James Zhu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 71ae30997a8f1791835167d3ceb8d1fab32407db Author: Meenakshikumar Somasundaram Date: Mon Aug 30 14:01:10 2021 -0400 drm/amd/display: Link training retry fix for abort case [Why] If link training is aborted, it shall be retried if sink is present. [How] Check hpd status to find out whether sink is present or not. If sink is present, then link training shall be tried again with same settings. Otherwise, link training shall be aborted. Reviewed-by: Jimmy Kizito Acked-by: Mikita Lipski Signed-off-by: Meenakshikumar Somasundaram Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4e00a434a08e0654a4dd9347485d9ec85deee1ef Author: Qingqing Zhuo Date: Fri Aug 27 06:58:38 2021 -0400 drm/amd/display: Fix unstable HPCP compliance on Chrome Barcelo [Why] Intermittently, there presents two occurrences of 0 stream commits in a single HPD event. Current HDCP sequence does not consider such scenerio, and will thus disable HDCP. [How] Add condition check to include stream remove and re-enable case for HDCP enable. Reviewed-by: Bhawanpreet Lakha Acked-by: Mikita Lipski Signed-off-by: Qingqing Zhuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 90517c9838602846daa0feec7b37382fed61b001 Author: Hersen Wu Date: Wed Aug 25 16:27:47 2021 -0400 drm/amd/display: dsc mst 2 4K displays go dark with 2 lane HBR3 [Why] call stack of amdgpu dsc mst pbn, slot num calculation is as below: -compute_bpp_x16_from_target_bandwidth -decide_dsc_target_bpp_x16 -setup_dsc_config -dc_dsc_compute_bandwidth_range -compute_mst_dsc_configs_for_link -compute_mst_dsc_configs_for_state from pbn -> dsc target bpp_x16 bpp_x16 is calulated by compute_bpp_x16_from_target_bandwidth. Beside pixel clock and bpp, num_slices_h and bpp_increment_div will also affect bpp_x16. from dsc target bpp_x16 -> pbn within dm_update_mst_vcpi_slots_for_dsc, pbn = drm_dp_calc_pbn_mode(clock, bpp_x16, true); drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc) { return DIV_ROUND_UP_ULL(mul_u32_u32(clock * (bpp / 16), 64 * 1006), 8 * 54 * 1000 * 1000); } bpp / 16 trunc digits after decimal point. This will cause calculation delta. drm_dp_calc_pbn_mode does not have other informations, like num_slices_h, bpp_increment_div. therefore, it does not do revese calcuation properly from bpp_x16 to pbn. pbn from drm_dp_calc_pbn_mode is less than pbn from compute_mst_dsc_configs_for_state. This cause not enough mst slot allocated to display. display could not visually light up. [How] pass pbn from compute_mst_dsc_configs_for_state to dm_update_mst_vcpi_slots_for_dsc Cc: stable@vger.kernel.org Reviewed-by: Scott Foster Acked-by: Mikita Lipski Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9987fbb368038d41bfdcda2a3f7f4945d7daa9a5 Author: Harry Wentland Date: Mon Aug 16 15:57:12 2021 -0400 drm/amd/display: Get backlight from PWM if DMCU is not initialized On Carrizo/Stoney systems we set backlight through panel_cntl, i.e. directly via the PWM registers, if DMCU is not initialized. We always read it back through ABM registers which leads to a mismatch and forces atomic_commit to program the backlight each time. Instead make sure we use the same logic for backlight readback, i.e. read it from panel_cntl if DMCU is not initialized. We also need to remove some extraneous and incorrect calculations at the end of dce_get_16_bit_backlight_from_pwm. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1666 Cc: stable@vger.kernel.org Reviewed-by: Josip Pavic Acked-by: Mikita Lipski Signed-off-by: Harry Wentland Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fb932dfeb87411a8a01c995576198bfc302df339 Author: Felix Kuehling Date: Tue Aug 31 17:42:15 2021 -0400 drm/amdkfd: make needs_pcie_atomics FW-version dependent On some GPUs the PCIe atomic requirement for KFD depends on the MEC firmware version. Add a firmware version check for this. The minimum firmware version that works without atomics can be updated in the device_info structure for each GPU type. Move PCIe atomic detection from kgd2kfd_probe into kgd2kfd_device_init because the MEC firmware is not loaded yet at the probe stage. Signed-off-by: Felix Kuehling Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit abd0a16ac72c98c46e7a1a91d591121b9c95cf97 Author: Lang Yu Date: Fri Aug 27 15:20:51 2021 +0800 drm/amdgpu: add manual sclk/vddc setting support for cyan skilfish(v3) Add manual sclk/vddc setting supoort via pp_od_clk_voltage sysfs to maintain consistency with other asics. As cyan skillfish doesn't support DPM, there is only a single frequency and voltage to adjust. v2: maintain consistency and add command guide. v3: adjust user settings storage and coding style. Command guide: echo vc point sclk vddc > pp_od_clk_voltage "vc" - sclk voltage curve "point" - must be 0 "sclk" - target value of sclk(MHz), should be in safe range "vddc" - target value of vddc(mV), a 6.25(mV) stepping is recommended and should be in safe range (the real vddc is an approximation of target value) echo c > pp_od_clk_voltage "c" - commit the changes of sclk and vddc, only after the commit command, the target values set by "vc" command will take effect echo r > pp_od_clk_voltage "r" - reset sclk and vddc to default value, a subsequent commit command is needed to take effect Example: 1) Check default sclk and vddc $ cat pp_od_clk_voltage OD_SCLK: 0: 1800Mhz * OD_VDDC: 0: 862mV * OD_RANGE: SCLK: 1000Mhz 2000Mhz VDDC: 700mV 1129mV 2) Set sclk to 1500MHz and vddc to 700mV $ echo vc 0 1500 700 > pp_od_clk_voltage $ echo c > pp_od_clk_voltage $ cat pp_od_clk_voltage OD_SCLK: 0: 1500Mhz * OD_VDDC: 0: 693mV * OD_RANGE: SCLK: 1000Mhz 2000Mhz VDDC: 700mV 1129mV 3) Reset sclk and vddc to default $ echo r > pp_od_clk_voltage $ echo c > pp_od_clk_voltage $ cat pp_od_clk_voltage OD_SCLK: 0: 1800Mhz * OD_VDDC: 0: 874mV * OD_RANGE: SCLK: 1000Mhz 2000Mhz VDDC: 700mV 1129mV NOTE: We don't specify an explicit safe range, you can set any values between min and max at your own risk. Enjoy! Signed-off-by: Lang Yu Reviewed-by: Lijo Lazar Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 3061fe937ea9990524e73af6d04baca60ad5b137 Author: Lang Yu Date: Fri Aug 27 15:03:50 2021 +0800 drm/amdgpu: add some pptable funcs for cyan skilfish(v3) Add print_clk_levels and read_sensor pptable funcs for cyan skilfish. v2: keep consitency and add get_gpu_metrics callback. v3: use sysfs_emit_at() in sysfs show function. Signed-off-by: Lang Yu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit c007e17c8476cb3c1032864f60936f2b7586010b Author: Lang Yu Date: Fri Aug 27 14:16:31 2021 +0800 drm/amdgpu: update SMU driver interface for cyan skilfish(v3) Add SmuMetrics_t definition for cyan skilfish. v2: update SmuMetrics_t definition. v3: cleanup and rearrange the order of fields. Signed-off-by: Lang Yu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 8492d3a07d3c7a0c69df0dec2ae835f5557b8835 Author: Lang Yu Date: Tue Aug 24 17:02:57 2021 +0800 drm/amdgpu: update SMU PPSMC for cyan skilfish Add some PPSMC MSGs for cyan skilfish. Signed-off-by: Lang Yu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 8f48ba303dfb15dc354e95a3ade59dea4614123a Author: Lang Yu Date: Wed Sep 8 13:34:26 2021 +0800 drm/amdgpu: fix sysfs_emit/sysfs_emit_at warnings(v2) sysfs_emit and sysfs_emit_at requrie a page boundary aligned buf address. Make them happy! v2: use an inline function. Warning Log: [ 492.545174] invalid sysfs_emit_at: buf:00000000f19bdfde at:0 [ 492.546416] WARNING: CPU: 7 PID: 1304 at fs/sysfs/file.c:765 sysfs_emit_at+0x4a/0xa0 [ 492.654805] Call Trace: [ 492.655353] ? smu_cmn_get_metrics_table+0x40/0x50 [amdgpu] [ 492.656780] vangogh_print_clk_levels+0x369/0x410 [amdgpu] [ 492.658245] vangogh_common_print_clk_levels+0x77/0x80 [amdgpu] [ 492.659733] ? preempt_schedule_common+0x18/0x30 [ 492.660713] smu_print_ppclk_levels+0x65/0x90 [amdgpu] [ 492.662107] amdgpu_get_pp_od_clk_voltage+0x13d/0x190 [amdgpu] [ 492.663620] dev_attr_show+0x1d/0x40 Signed-off-by: Lang Yu Acked-by: Huang Rui Signed-off-by: Alex Deucher commit 2a54d110bd4393fe412ef2c9c2d05fcd92785d1a Author: Anson Jacob Date: Thu Sep 9 12:48:29 2021 -0400 drm/amd/display: dc_assert_fp_enabled assert only if FPU is not enabled Assert only when FPU is not enabled. Fixes: 0ea7ee821701 ("drm/amd/display: Add DC_FP helper to check FPU state") Signed-off-by: Anson Jacob Cc: Christian König Cc: Hersen Wu Cc: Harry Wentland Cc: Rodrigo Siqueira Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit b3a7b268c147119a9776185b4f37e1555ead9d68 Author: Nicholas Kazlauskas Date: Tue Sep 7 09:53:03 2021 -0400 drm/amd/display: Add NULL checks for vblank workqueue [Why] If we're running a headless config with 0 links then the vblank workqueue will be NULL - causing a NULL pointer exception during any commit. [How] Guard access to the workqueue if it's NULL and don't queue or flush work if it is. Reported-by: Mike Lothian BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1700 Fixes: 58aa1c50e5a231 ("drm/amd/display: Use vblank control events for PSR enable/disable") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit ee8a9600b5391f434905c46bec7f77d34505083e Author: David Thompson Date: Wed Sep 15 14:08:48 2021 -0400 mlxbf_gige: clear valid_polarity upon open The network interface managed by the mlxbf_gige driver can get into a problem state where traffic does not flow. In this state, the interface will be up and enabled, but will stop processing received packets. This problem state will happen if three specific conditions occur: 1) driver has received more than (N * RxRingSize) packets but less than (N+1 * RxRingSize) packets, where N is an odd number Note: the command "ethtool -g " will display the current receive ring size, which currently defaults to 128 2) the driver's interface was disabled via "ifconfig oob_net0 down" during the window described in #1. 3) the driver's interface is re-enabled via "ifconfig oob_net0 up" This patch ensures that the driver's "valid_polarity" field is cleared during the open() method so that it always matches the receive polarity used by hardware. Without this fix, the driver needs to be unloaded and reloaded to correct this problem state. Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") Reviewed-by: Asmaa Mnebhi Signed-off-by: David Thompson Signed-off-by: David S. Miller commit 40ee363c844fcb6ae0f1f5cfea68aed7e268c2f4 Author: Paolo Abeni Date: Wed Sep 15 10:19:07 2021 -0700 igc: fix tunnel offloading Checking tunnel offloading, it turns out that offloading doesn't work as expected. The following script allows to reproduce the issue. Call it as `testscript DEVICE LOCALIP REMOTEIP NETMASK' === SNIP === if [ $# -ne 4 ] then echo "Usage $0 DEVICE LOCALIP REMOTEIP NETMASK" exit 1 fi DEVICE="$1" LOCAL_ADDRESS="$2" REMOTE_ADDRESS="$3" NWMASK="$4" echo "Driver: $(ethtool -i ${DEVICE} | awk '/^driver:/{print $2}') " ethtool -k "${DEVICE}" | grep tx-udp echo echo "Set up NIC and tunnel..." ip addr add "${LOCAL_ADDRESS}/${NWMASK}" dev "${DEVICE}" ip link set "${DEVICE}" up sleep 2 ip link add vxlan1 type vxlan id 42 \ remote "${REMOTE_ADDRESS}" \ local "${LOCAL_ADDRESS}" \ dstport 0 \ dev "${DEVICE}" ip addr add fc00::1/64 dev vxlan1 ip link set vxlan1 up sleep 2 rm -f vxlan.pcap echo "Running tcpdump and iperf3..." ( nohup tcpdump -i any -w vxlan.pcap >/dev/null 2>&1 ) & sleep 2 iperf3 -c fc00::2 >/dev/null pkill tcpdump echo echo -n "Max. Paket Size: " tcpdump -r vxlan.pcap -nnle 2>/dev/null \ | grep "${LOCAL_ADDRESS}.*> ${REMOTE_ADDRESS}.*OTV" \ | awk '{print $8}' | awk -F ':' '{print $1}' \ | sort -n | tail -1 echo ip link del vxlan1 ip addr del ${LOCAL_ADDRESS}/${NWMASK} dev "${DEVICE}" === SNAP === The expected outcome is Max. Paket Size: 64904 This is what you see on igb, the code igc has been taken from. However, on igc the output is Max. Paket Size: 1516 so the GSO aggregate packets are segmented by the kernel before calling igc_xmit_frame. Inside the subsequent call to igc_tso, the check for skb_is_gso(skb) fails and the function returns prematurely. It turns out that this occurs because the feature flags aren't set entirely correctly in igc_probe. In contrast to the original code from igb_probe, igc_probe neglects to set the flags required to allow tunnel offloading. Setting the same flags as igb fixes the issue on igc. Fixes: 34428dff3679 ("igc: Add GSO partial support") Signed-off-by: Paolo Abeni Tested-by: Corinna Vinschen Acked-by: Sasha Neftin Tested-by: Nechama Kraus Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 7c3a0a018e672a9723a79b128227272562300055 Author: Eli Cohen Date: Wed Sep 15 07:47:27 2021 +0300 net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock assert Remove the assert from the callback priv lookup function since it does not require RTNL lock and is already protected by flow_indr_block_lock. This will avoid warnings from being emitted to dmesg if the driver registers its callback after an ingress qdisc was created for a netdevice. The warnings started after the following patch was merged: commit 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation") Signed-off-by: Eli Cohen Signed-off-by: David S. Miller commit 84fb7dfc7463afcba61281f36535576a7f7b0626 Author: Adam Borowski Date: Sun Sep 12 23:23:21 2021 +0200 net: wan: wanxl: define CROSS_COMPILE_M68K It was used but never set. The hardcoded value from before the dawn of time was non-standard; the usual name for cross-tools is $TRIPLET-$TOOL Signed-off-by: Adam Borowski Signed-off-by: David S. Miller commit 25766ee44ff8db4cdf8471b587dffb28b7b9d17f Author: Peter Ujfalusi Date: Thu Sep 16 11:53:42 2021 +0300 ASoC: SOF: loader: Re-phrase the missing firmware error to avoid duplication In case the firmware is missing we will have the following in the kernel log: 1 | Direct firmware load for intel/sof/sof-tgl-h.ri failed with error -2 2 | error: request firmware intel/sof/sof-tgl-h.ri failed err: -2 3 | you may need to download the firmware from https://github.com/thesofproject/sof-bin/ 4 | error: failed to load DSP firmware -2 5 | error: sof_probe_work failed err: -2 The first line is the standard, request_firmware() warning. The second and third line is printed in snd_sof_load_firmware_raw() Note that the first and second line is mostly identical. With this patch the log will be changed to: 1 | Direct firmware load for intel/sof/sof-tgl-h.ri failed with error -2 2 | error: sof firmware file is missing, you might need to 3 | download it from https://github.com/thesofproject/sof-bin/ 4 | error: failed to load DSP firmware -2 5 | error: sof_probe_work failed err: -2 Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20210916085342.29993-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 8a8e1813ffc35111fc0b6db49968ceb0e1615ced Author: Marc Herbert Date: Thu Sep 16 11:50:08 2021 +0300 ASoC: SOF: loader: release_firmware() on load failure to avoid batching Invoke release_firmware() when the firmware fails to boot in sof_probe_continue(). The request_firmware() framework must be informed of failures in sof_probe_continue() otherwise its internal "batching" feature (different from caching) cached the firmware image forever. Attempts to correct the file in /lib/firmware/ were then silently and confusingly ignored until the next reboot. Unloading the drivers did not help because from their disconnected perspective the firmware had failed so there was nothing to release. Also leverage the new snd_sof_fw_unload() function to simplify the snd_sof_device_remove() function. Signed-off-by: Marc Herbert Reviewed-by: Pierre-Louis Bossart Reviewed-by: Guennadi Liakhovetski Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20210916085008.28929-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 98dc68f8b0c2248bdc3688c90d2499247b9432e4 Author: Xiang wangx Date: Thu Sep 16 20:24:42 2021 +0800 selftests: nci: replace unsigned int with int Should not use comparison of unsigned expressions < 0. Signed-off-by: Xiang wangx Signed-off-by: David S. Miller commit 5aeb05b27f81269a2bf2e15eab9fc0f9a400d3a8 Author: Laurentiu Tudor Date: Wed Sep 15 11:09:39 2021 +0300 software node: balance refcount for managed software nodes software_node_notify(), on KOBJ_REMOVE drops the refcount twice on managed software nodes, thus leading to underflow errors. Balance the refcount by bumping it in the device_create_managed_software_node() function. The error [1] was encountered after adding a .shutdown() op to our fsl-mc-bus driver. [1] pc : refcount_warn_saturate+0xf8/0x150 lr : refcount_warn_saturate+0xf8/0x150 sp : ffff80001009b920 x29: ffff80001009b920 x28: ffff1a2420318000 x27: 0000000000000000 x26: ffffccac15e7a038 x25: 0000000000000008 x24: ffffccac168e0030 x23: ffff1a2428a82000 x22: 0000000000080000 x21: ffff1a24287b5000 x20: 0000000000000001 x19: ffff1a24261f4400 x18: ffffffffffffffff x17: 6f72645f726f7272 x16: 0000000000000000 x15: ffff80009009b607 x14: 0000000000000000 x13: ffffccac16602670 x12: 0000000000000a17 x11: 000000000000035d x10: ffffccac16602670 x9 : ffffccac16602670 x8 : 00000000ffffefff x7 : ffffccac1665a670 x6 : ffffccac1665a670 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1a2420318000 Call trace: refcount_warn_saturate+0xf8/0x150 kobject_put+0x10c/0x120 software_node_notify+0xd8/0x140 device_platform_notify+0x4c/0xb4 device_del+0x188/0x424 fsl_mc_device_remove+0x2c/0x4c rebofind sp.c__fsl_mc_device_remove+0x14/0x2c device_for_each_child+0x5c/0xac dprc_remove+0x9c/0xc0 fsl_mc_driver_remove+0x28/0x64 __device_release_driver+0x188/0x22c device_release_driver+0x30/0x50 bus_remove_device+0x128/0x134 device_del+0x16c/0x424 fsl_mc_bus_remove+0x8c/0x114 fsl_mc_bus_shutdown+0x14/0x20 platform_shutdown+0x28/0x40 device_shutdown+0x15c/0x330 __do_sys_reboot+0x218/0x2a0 __arm64_sys_reboot+0x28/0x34 invoke_syscall+0x48/0x114 el0_svc_common+0x40/0xdc do_el0_svc+0x2c/0x94 el0_svc+0x2c/0x54 el0t_64_sync_handler+0xa8/0x12c el0t_64_sync+0x198/0x19c ---[ end trace 32eb1c71c7d86821 ]--- Fixes: 151f6ff78cdf ("software node: Provide replacement for device_add_properties()") Reported-by: Jon Nettleton Suggested-by: Heikki Krogerus Reviewed-by: Heikki Krogerus Signed-off-by: Laurentiu Tudor Cc: 5.12+ # 5.12+ [ rjw: Fix up the software_node_notify() invocation ] Signed-off-by: Rafael J. Wysocki commit 94d508fa3186d0cbc63765aa94d5cf3bd847694c Author: Stefan Binding Date: Thu Sep 16 10:56:46 2021 +0100 ALSA: hda/cs8409: Setup Dolphin Headset Mic as Phantom Jack Dell's requirement to have headset mic as phantom jack on this specific dolphin hardware platform. Signed-off-by: Stefan Binding Signed-off-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20210916095646.7631-1-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit be830389bd49d3f1f8737bd45513361628641c08 Author: Alexey Dobriyan Date: Tue Sep 14 14:08:47 2021 +0300 ALSA: pcxhr: "fix" PCXHR_REG_TO_PORT definition The following preprocessor directive is non-compliant: #undef PCXHR_REG_TO_PORT(x) gcc warns about extra tokens but nobody sees them as they are under if branch which is never parsed. Make it an #error, it is not clear to me what the author meant. Signed-off-by: Alexey Dobriyan Link: https://lore.kernel.org/r/YUCCv47sm4zf9OVO@localhost.localdomain Signed-off-by: Takashi Iwai commit 54607282fae6148641a08d81a6e0953b541249c7 Author: Borislav Petkov Date: Thu Sep 16 10:44:06 2021 +0200 EDAC/dmc520: Assign the proper type to dimm->edac_mode dimm->edac_mode contains values of type enum edac_type - not the corresponding capability flags. Fix that. Fixes: 1088750d7839 ("EDAC: Add EDAC driver for DMC520") Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20210916085258.7544-1-bp@alien8.de commit db7bee653859ef7179be933e7d1384644f795f26 Author: Ilya Leoshkevich Date: Mon Sep 6 15:04:14 2021 +0200 s390/bpf: Fix optimizing out zero-extensions Currently the JIT completely removes things like `reg32 += 0`, however, the BPF_ALU semantics requires the target register to be zero-extended in such cases. Fix by optimizing out only the arithmetic operation, but not the subsequent zero-extension. Reported-by: Johan Almbladh Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend") Reviewed-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit 6e61dc9da0b7a0d91d57c2e20b5ea4fd2d4e7e53 Author: Ilya Leoshkevich Date: Tue Sep 7 13:41:16 2021 +0200 s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant The JIT uses agfi for subtracting constants, but -(-0x80000000) cannot be represented as a 32-bit signed binary integer. Fix by using algfi in this particular case. Reported-by: Johan Almbladh Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend") Reviewed-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit 1511df6f5e9ef32826f20db2ee81f8527154dc14 Author: Ilya Leoshkevich Date: Tue Sep 7 11:58:59 2021 +0200 s390/bpf: Fix branch shortening during codegen pass EMIT6_PCREL() macro assumes that the previous pass generated 6 bytes of code, which is not the case if branch shortening took place. Fix by using jit->prg, like all the other EMIT6_PCREL_*() macros. Reported-by: Johan Almbladh Fixes: 4e9b4a6883dd ("s390/bpf: Use relative long branches") Signed-off-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit f2faea8b64125852fa9acc6771c07fc0311a039b Author: Lucas Stach Date: Fri Aug 20 22:18:30 2021 +0200 drm/etnaviv: add missing MMU context put when reaping MMU mapping When we forcefully evict a mapping from the the address space and thus the MMU context, the MMU context is leaked, as the mapping no longer points to it, so it doesn't get freed when the GEM object is destroyed. Add the mssing context put to fix the leak. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit d6408538f091fb22d47f792d4efa58143d56c3fb Author: Lucas Stach Date: Fri Aug 20 22:18:29 2021 +0200 drm/etnaviv: reference MMU context when setting up hardware state Move the refcount manipulation of the MMU context to the point where the hardware state is programmed. At that point it is also known if a previous MMU state is still there, or the state needs to be reprogrammed with a potentially different context. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit f978a5302f5566480c58ffae64a16d34456801bd Author: Lucas Stach Date: Fri Aug 20 22:18:28 2021 +0200 drm/etnaviv: fix MMU context leak on GPU reset After a reset the GPU is no longer using the MMU context and may be restarted with a different context. While the mmu_state proeprly was cleared, the context wasn't unreferenced, leading to a memory leak. Cc: stable@vger.kernel.org # 5.4 Reported-by: Michael Walle Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit 725cbc7884c37f3b4f1777bc1aea6432cded8ca5 Author: Lucas Stach Date: Fri Aug 20 22:18:27 2021 +0200 drm/etnaviv: exec and MMU state is lost when resetting the GPU When the GPU is reset both the current exec state, as well as all MMU state is lost. Move the driver side state tracking into the reset function to keep hardware and software state from diverging. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit 8f3eea9d01d7b0f95b0fe04187c0059019ada85b Author: Lucas Stach Date: Fri Aug 20 22:18:26 2021 +0200 drm/etnaviv: keep MMU context across runtime suspend/resume The MMU state may be kept across a runtime suspend/resume cycle, as we avoid a full hardware reset to keep the latency of the runtime PM small. Don't pretend that the MMU state is lost in driver state. The MMU context is pushed out when new HW jobs with a different context are coming in. The only exception to this is when the GPU is unbound, in which case we need to make sure to also free the last active context. Cc: stable@vger.kernel.org # 5.4 Reported-by: Michael Walle Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit 23e0f5a57d0ecec86e1fc82194acd94aede21a46 Author: Lucas Stach Date: Fri Aug 20 22:18:25 2021 +0200 drm/etnaviv: stop abusing mmu_context as FE running marker While the DMA frontend can only be active when the MMU context is set, the reverse isn't necessarily true, as the frontend can be stopped while the MMU state is kept. Stop treating mmu_context being set as a indication that the frontend is running and instead add a explicit property. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit cda7532916f7bc860b36a1806cb8352e6f63dacb Author: Lucas Stach Date: Fri Aug 20 22:18:24 2021 +0200 drm/etnaviv: put submit prev MMU context when it exists The prev context is the MMU context at the time of the job queueing in hardware. As a job might be queued multiple times due to recovery after a GPU hang, we need to make sure to put the stale prev MMU context from a prior queuing, to avoid the reference and thus the MMU context leaking. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit 78edefc05e41352099ffb8f06f8d9b2d091e29cd Author: Lucas Stach Date: Fri Aug 20 22:18:23 2021 +0200 drm/etnaviv: return context from etnaviv_iommu_context_get Being able to have the refcount manipulation in an assignment makes it much easier to parse the code. Cc: stable@vger.kernel.org # 5.4 Signed-off-by: Lucas Stach Tested-by: Michael Walle Tested-by: Marek Vasut Reviewed-by: Christian Gmeiner commit 5297cfa6bdf93e3889f78f9b482e2a595a376083 Author: Sai Krishna Potthuri Date: Wed Aug 18 12:53:14 2021 +0530 EDAC/synopsys: Fix wrong value type assignment for edac_mode dimm->edac_mode contains values of type enum edac_type - not the corresponding capability flags. Fix that. Issue caught by Coverity check "enumerated type mixed with another type." [ bp: Rewrite commit message, add tags. ] Fixes: ae9b56e3996d ("EDAC, synps: Add EDAC support for zynq ddr ecc controller") Signed-off-by: Sai Krishna Potthuri Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/20210818072315.15149-1-shubhrajyoti.datta@xilinx.com commit d46ef750ed58cbeeba2d9a55c99231c30a172764 Author: Evgeny Novikov Date: Tue Jun 1 19:38:01 2021 +0300 HID: amd_sfh: Fix potential NULL pointer dereference devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset(). Found by Linux Driver Verification project (linuxtesting.org). [jkosina@suse.cz: rebase] Signed-off-by: Evgeny Novikov Acked-by: Basavaraj Natikar Signed-off-by: Jiri Kosina commit 90cc7bed1ed19f869ae7221a6b41887fe762a6a3 Author: Helge Deller Date: Thu Sep 16 08:35:42 2021 +0200 parisc: Use absolute_pointer() to define PAGE0 Use absolute_pointer() wrapper for PAGE0 to avoid this compiler warning: arch/parisc/kernel/setup.c: In function 'start_parisc': error: '__builtin_memcmp_eq' specified bound 8 exceeds source size 0 Signed-off-by: Helge Deller Co-Developed-by: Guenter Roeck Suggested-by: Linus Torvalds commit 17ac76e050c51497e75871a43aa3328ba54cdafd Author: Cai Huoqing Date: Tue Aug 31 15:49:58 2021 +0800 drm/exynos: Make use of the helper function devm_platform_ioremap_resource() Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately Signed-off-by: Cai Huoqing Signed-off-by: Inki Dae commit ff1ffd71d5f0612cf194f5705c671d6b64bf5f91 Merge: 453fa43cdb8e0 dfb5c1e12c28e Author: Linus Torvalds Date: Wed Sep 15 17:18:56 2021 -0700 Merge tag 'hyperv-fixes-signed-20210915' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix kernel crash caused by uio driver (Vitaly Kuznetsov) - Remove on-stack cpumask from HV APIC code (Wei Liu) * tag 'hyperv-fixes-signed-20210915' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: remove on-stack cpumask from hv_send_ipi_mask_allbutself asm-generic/hyperv: provide cpumask_to_vpset_noself Drivers: hv: vmbus: Fix kernel crash upon unbinding a device from uio_hv_generic driver commit 453fa43cdb8e0f4231ab84755fd2fc562823541b Merge: b7213ffa0e585 13be2efc390ac Author: Linus Torvalds Date: Wed Sep 15 17:06:01 2021 -0700 Merge tag 'rtc-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fix from Alexandre Belloni: "Fix a locking issue in the cmos rtc driver" * tag 'rtc-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: cmos: Disable irq around direct invocation of cmos_interrupt() commit a57d8c217aadac75530b8e7ffb3a3e1b7bfd0330 Author: Vladimir Oltean Date: Tue Sep 14 16:47:26 2021 +0300 net: dsa: flush switchdev workqueue before tearing down CPU/DSA ports Sometimes when unbinding the mv88e6xxx driver on Turris MOX, these error messages appear: mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete be:79:b4:9e:9e:96 vid 1 from fdb: -2 mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete be:79:b4:9e:9e:96 vid 0 from fdb: -2 mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 100 from fdb: -2 mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 1 from fdb: -2 mv88e6085 d0032004.mdio-mii:12: port 1 failed to delete d8:58:d7:00:ca:6d vid 0 from fdb: -2 (and similarly for other ports) What happens is that DSA has a policy "even if there are bugs, let's at least not leak memory" and dsa_port_teardown() clears the dp->fdbs and dp->mdbs lists, which are supposed to be empty. But deleting that cleanup code, the warnings go away. => the FDB and MDB lists (used for refcounting on shared ports, aka CPU and DSA ports) will eventually be empty, but are not empty by the time we tear down those ports. Aka we are deleting them too soon. The addresses that DSA complains about are host-trapped addresses: the local addresses of the ports, and the MAC address of the bridge device. The problem is that offloading those entries happens from a deferred work item scheduled by the SWITCHDEV_FDB_DEL_TO_DEVICE handler, and this races with the teardown of the CPU and DSA ports where the refcounting is kept. In fact, not only it races, but fundamentally speaking, if we iterate through the port list linearly, we might end up tearing down the shared ports even before we delete a DSA user port which has a bridge upper. So as it turns out, we need to first tear down the user ports (and the unused ones, for no better place of doing that), then the shared ports (the CPU and DSA ports). In between, we need to ensure that all work items scheduled by our switchdev handlers (which only run for user ports, hence the reason why we tear them down first) have finished. Fixes: 161ca59d39e9 ("net: dsa: reference count the MDB entries at the cross-chip notifier level") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20210914134726.2305133-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 301de697d869be6564aebeb5ab811c84c0a7abed Author: Vladimir Oltean Date: Tue Sep 14 17:05:15 2021 +0300 Revert "net: phy: Uniform PHY driver access" This reverts commit 3ac8eed62596387214869319379c1fcba264d8c6, which did more than it said on the box, and not only it replaced to_phy_driver with phydev->drv, but it also removed the "!drv" check, without actually explaining why that is fine. That patch in fact breaks suspend/resume on any system which has PHY devices with no drivers bound. The stack trace is: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 pc : mdio_bus_phy_suspend+0xd8/0xec lr : dpm_run_callback+0x38/0x90 Call trace: mdio_bus_phy_suspend+0xd8/0xec dpm_run_callback+0x38/0x90 __device_suspend+0x108/0x3cc dpm_suspend+0x140/0x210 dpm_suspend_start+0x7c/0xa0 suspend_devices_and_enter+0x13c/0x540 pm_suspend+0x2a4/0x330 Examples why that assumption is not fine: - There is an MDIO bus with a PHY device that doesn't have a specific PHY driver loaded, because mdiobus_register() automatically creates a PHY device for it but there is no specific PHY driver in the system. Normally under those circumstances, the generic PHY driver will be bound lazily to it (at phy_attach_direct time). But some Ethernet drivers attach to their PHY at .ndo_open time. Until then it, the to-be-driven-by-genphy PHY device will not have a driver. The blamed patch amounts to saying "you need to open all net devices before the system can suspend, to avoid the NULL pointer dereference". - There is any raw MDIO device which has 'plausible' values in the PHY ID registers 2 and 3, which is located on an MDIO bus whose driver does not set bus->phy_mask = ~0 (which prevents auto-scanning of PHY devices). An example could be a MAC's internal MDIO bus with PCS devices on it, for serial links such as SGMII. PHY devices will get created for those PCSes too, due to that MDIO bus auto-scanning, and although those PHY devices are not used, they do not bother anybody either. PCS devices are usually managed in Linux as raw MDIO devices. Nonetheless, they do not have a PHY driver, nor does anybody attempt to connect to them (because they are not a PHY), and therefore this patch breaks that. The goal itself of the patch is questionable, so I am going for a straight revert. to_phy_driver does not seem to have a need to be replaced by phydev->drv, in fact that might even trigger code paths which were not given too deep of a thought. For instance: phy_probe populates phydev->drv at the beginning, but does not clean it up on any error (including EPROBE_DEFER). So if the phydev driver requests probe deferral, phydev->drv will remain populated despite there being no driver bound. If a system suspend starts in between the initial probe deferral request and the subsequent probe retry, we will be calling the phydev->drv->suspend method, but _before_ any phydev->drv->probe call has succeeded. That is to say, if the phydev->drv is allocating any driver-private data structure in ->probe, it pretty much expects that data structure to be available in ->suspend. But it may not. That is a pretty insane environment to present to PHY drivers. In the code structure before the blamed patch, mdio_bus_phy_may_suspend would just say "no, don't suspend" to any PHY device which does not have a driver pointer _in_the_device_structure_ (not the phydev->drv). That would essentially ensure that ->suspend will never get called for a device that has not yet successfully completed probe. This is the code structure the patch is returning to, via the revert. Fixes: 3ac8eed62596 ("net: phy: Uniform PHY driver access") Signed-off-by: Vladimir Oltean Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20210914140515.2311548-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6a52e73368038f47f6618623d75061dc263b26ae Author: Vladimir Oltean Date: Tue Sep 14 16:43:31 2021 +0300 net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup DSA supports connecting to a phy-handle, and has a fallback to a non-OF based method of connecting to an internal PHY on the switch's own MDIO bus, if no phy-handle and no fixed-link nodes were present. The -ENODEV error code from the first attempt (phylink_of_phy_connect) is what triggers the second attempt (phylink_connect_phy). However, when the first attempt returns a different error code than -ENODEV, this results in an unbalance of calls to phylink_create and phylink_destroy by the time we exit the function. The phylink instance has leaked. There are many other error codes that can be returned by phylink_of_phy_connect. For example, phylink_validate returns -EINVAL. So this is a practical issue too. Fixes: aab9c4067d23 ("net: dsa: Plug in PHYLINK support") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Reviewed-by: Russell King (Oracle) Link: https://lore.kernel.org/r/20210914134331.2303380-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e042a4533fc346a655de7f1b8ac1fa01a2ed96e5 Author: Jon Derrick Date: Thu Sep 9 15:02:21 2021 -0500 MAINTAINERS: Add Nirmal Patel as VMD maintainer Change my email to my unaffiliated address and move me to reviewer status. Link: https://lore.kernel.org/r/20210909200221.29981-1-jonathan.derrick@intel.com Signed-off-by: Jon Derrick Signed-off-by: Jon Derrick Signed-off-by: Bjorn Helgaas Cc: Nirmal Patel commit 60b78ed088ebe1a872ee1320b6c5ad6ee2c4bd9a Author: Evan Quan Date: Fri Sep 3 14:33:11 2021 +0800 PCI: Add AMD GPU multi-function power dependencies Some AMD GPUs have built-in USB xHCI and USB Type-C UCSI controllers with power dependencies between the GPU and the other functions as in 6d2e369f0d4c ("PCI: Add NVIDIA GPU multi-function power dependencies"). Add device link support for the AMD integrated USB xHCI and USB Type-C UCSI controllers. Without this, runtime power management, including GPU resume and temp and fan sensors don't work correctly. Reported-at: https://gitlab.freedesktop.org/drm/amd/-/issues/1704 Link: https://lore.kernel.org/r/20210903063311.3606226-1-evan.quan@amd.com Signed-off-by: Evan Quan Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org commit 6bd65974dedd1e8638e6665e92ccbf26e8a67cbf Author: Jean-Philippe Brucker Date: Mon Sep 13 18:23:59 2021 +0100 PCI/ACPI: Don't reset a fwnode set by OF Commit 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") added a call to pci_set_acpi_fwnode() in pci_setup_device(), which unconditionally clears any fwnode previously set by pci_set_of_node(). pci_set_acpi_fwnode() looks for ACPI_COMPANION(), which only returns the existing fwnode if it was set by ACPI_COMPANION_SET(). If it was set by OF instead, ACPI_COMPANION() returns NULL and pci_set_acpi_fwnode() accidentally clears the fwnode. To fix this, look for any fwnode instead of just ACPI companions. Fixes a virtio-iommu boot regression in v5.15-rc1. Fixes: 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") Link: https://lore.kernel.org/r/20210913172358.1775381-1-jean-philippe@linaro.org Signed-off-by: Jean-Philippe Brucker Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring Acked-by: Rafael J. Wysocki commit 00e1a5d21b4ff514593554167b28a8caeda1497f Author: Bjorn Helgaas Date: Mon Sep 13 16:13:26 2021 -0500 PCI/VPD: Defer VPD sizing until first access 7bac54497c3e ("PCI/VPD: Determine VPD size in pci_vpd_init()") reads VPD at enumeration-time to find the size. But this is quite slow, and we don't need the size until we actually need data from VPD. Dave reported a boot slowdown of more than two minutes [1]. Defer the VPD sizing until a driver or the user (via sysfs) requests information from VPD. If devices are quirked because VPD is known not to work, don't bother even looking for the VPD capability. The VPD will not be accessible at all. [1] https://lore.kernel.org/r/20210913141818.GA27911@codemonkey.org.uk/ Link: https://lore.kernel.org/r/20210914215543.GA1437800@bjorn-Precision-5520 Fixes: 7bac54497c3e ("PCI/VPD: Determine VPD size in pci_vpd_init()") Signed-off-by: Bjorn Helgaas commit a1e4470823d99e75b596748086e120dea169ed3c Author: Jiapeng Chong Date: Fri Aug 13 14:40:42 2021 +0800 fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() The error code is missing in this code scenario, add the error code '-EINVAL' to the return value 'ret'. Eliminate the follow smatch warning: drivers/fpga/machxo2-spi.c:341 machxo2_write_complete() warn: missing error code 'ret'. [mdf@kernel.org: Reworded commit message] Fixes: 88fb3a002330 ("fpga: lattice machxo2: Add Lattice MachXO2 support") Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Moritz Fischer commit 34331739e19fd6a293d488add28832ad49c9fc54 Author: Tom Rix Date: Tue Aug 10 09:40:36 2021 -0700 fpga: machxo2-spi: Return an error on failure Earlier successes leave 'ret' in a non error state, so these errors are not reported. Set ret to -EINVAL before going to the error handler. This addresses two issues reported by smatch: drivers/fpga/machxo2-spi.c:229 machxo2_write_init() warn: missing error code 'ret' drivers/fpga/machxo2-spi.c:316 machxo2_write_complete() warn: missing error code 'ret' [mdf@kernel.org: Reworded commit message] Fixes: 88fb3a002330 ("fpga: lattice machxo2: Add Lattice MachXO2 support") Reported-by: Dan Carpenter Signed-off-by: Tom Rix Signed-off-by: Moritz Fischer commit b7213ffa0e585feb1aee3e7173e965e66ee0abaa Author: Linus Torvalds Date: Wed Sep 15 13:56:37 2021 -0700 qnx4: avoid stringop-overread errors The qnx4 directory entries are 64-byte blocks that have different contents depending on the a status byte that is in the last byte of the block. In particular, a directory entry can be either a "link info" entry with a 48-byte name and pointers to the real inode information, or an "inode entry" with a smaller 16-byte name and the full inode information. But the code was written to always just treat the directory name as if it was part of that "inode entry", and just extend the name to the longer case if the status byte said it was a link entry. That work just fine and gives the right results, but now that gcc is tracking data structure accesses much more, the code can trigger a compiler error about using up to 48 bytes (the long name) in a structure that only has that shorter name in it: fs/qnx4/dir.c: In function ‘qnx4_readdir’: fs/qnx4/dir.c:51:32: error: ‘strnlen’ specified bound 48 exceeds source size 16 [-Werror=stringop-overread] 51 | size = strnlen(de->di_fname, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from fs/qnx4/qnx4.h:3, from fs/qnx4/dir.c:16: include/uapi/linux/qnx4_fs.h:45:25: note: source object declared here 45 | char di_fname[QNX4_SHORT_NAME_MAX]; | ^~~~~~~~ which is because the source code doesn't really make this whole "one of two different types" explicit. Fix this by introducing a very explicit union of the two types, and basically explaining to the compiler what is really going on. Signed-off-by: Linus Torvalds commit fc7c028dcdbfe981bca75d2a7b95f363eb691ef3 Author: Linus Torvalds Date: Mon Sep 6 16:06:04 2021 -0700 sparc: avoid stringop-overread errors The sparc mdesc code does pointer games with 'struct mdesc_hdr', but didn't describe to the compiler how that header is then followed by the data that the header describes. As a result, gcc is now unhappy since it does stricter pointer range tracking, and doesn't understand about how these things work. This results in various errors like: arch/sparc/kernel/mdesc.c: In function ‘mdesc_node_by_name’: arch/sparc/kernel/mdesc.c:647:22: error: ‘strcmp’ reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread] 647 | if (!strcmp(names + ep[ret].name_offset, name)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ which are easily avoided by just describing 'struct mdesc_hdr' better, and making the node_block() helper function look into that unsized data[] that follows the header. This makes the sparc64 build happy again at least for my cross-compiler version (gcc version 11.2.1). Link: https://lore.kernel.org/lkml/CAHk-=wi4NW3NC0xWykkw=6LnjQD6D_rtRtxY9g8gQAJXtQMi8A@mail.gmail.com/ Cc: Guenter Roeck Cc: David S. Miller Signed-off-by: Linus Torvalds commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b Author: Piotr Krysiuk Date: Wed Sep 15 17:04:37 2021 +0100 bpf, mips: Validate conditional branch offsets The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. A specific example of such a cBPF program is included in the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes anomalous machine code containing incorrect branch offsets under JIT. Furthermore, this issue can be abused to craft undesirable machine code, where the control flow is hijacked to execute arbitrary Kernel code. The following steps can be used to reproduce the issue: # echo 1 > /proc/sys/net/core/bpf_jit_enable # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH" This should produce multiple warnings from build_bimm() similar to: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590 Micro-assembler field overflow Modules linked in: test_bpf(+) CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1 Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee 82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180 00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e 6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000 00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001 [...] Call Trace: [<80108f44>] show_stack+0x38/0x118 [<807a7aac>] dump_stack_lvl+0x5c/0x7c [<807a4b3c>] __warn+0xcc/0x140 [<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8 [<8011e198>] build_insn+0x558/0x590 [<8011e358>] uasm_i_bne+0x20/0x2c [<80127b48>] build_body+0xa58/0x2a94 [<80129c98>] bpf_jit_compile+0x114/0x1e4 [<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4 [<8061423c>] bpf_prog_create+0x80/0xc4 [] test_bpf_init+0x300/0xba8 [test_bpf] [<8010051c>] do_one_initcall+0x50/0x1d4 [<801c5e54>] do_init_module+0x60/0x220 [<801c8b20>] sys_finit_module+0xc4/0xfc [<801144d0>] syscall_common+0x34/0x58 [...] ---[ end trace a287d9742503c645 ]--- Then the anomalous machine code executes: => 0xc0a18000: addiu sp,sp,-16 0xc0a18004: sw s3,0(sp) 0xc0a18008: sw s4,4(sp) 0xc0a1800c: sw s5,8(sp) 0xc0a18010: sw ra,12(sp) 0xc0a18014: move s5,a0 0xc0a18018: move s4,zero 0xc0a1801c: move s3,zero # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a18020: lui t6,0x8012 0xc0a18024: ori t4,t6,0x9e14 0xc0a18028: li a1,0 0xc0a1802c: jalr t4 0xc0a18030: move a0,s5 0xc0a18034: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a18038: move v0,zero 0xc0a1803c: andi s4,s3,0xf 0xc0a18040: b 0xc0a18048 0xc0a18044: sll s4,s4,0x2 [...] # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffa0: lui t6,0x8012 0xc0a1ffa4: ori t4,t6,0x9e14 0xc0a1ffa8: li a1,0 0xc0a1ffac: jalr t4 0xc0a1ffb0: move a0,s5 0xc0a1ffb4: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a1ffb8: move v0,zero 0xc0a1ffbc: andi s4,s3,0xf 0xc0a1ffc0: b 0xc0a1ffc8 0xc0a1ffc4: sll s4,s4,0x2 # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffc8: lui t6,0x8012 0xc0a1ffcc: ori t4,t6,0x9e14 0xc0a1ffd0: li a1,0 0xc0a1ffd4: jalr t4 0xc0a1ffd8: move a0,s5 0xc0a1ffdc: bnez v0,0xc0a3ffb8 # correct branch offset 0xc0a1ffe0: move v0,zero 0xc0a1ffe4: andi s4,s3,0xf 0xc0a1ffe8: b 0xc0a1fff0 0xc0a1ffec: sll s4,s4,0x2 [...] # epilogue 0xc0a3ffb8: lw s3,0(sp) 0xc0a3ffbc: lw s4,4(sp) 0xc0a3ffc0: lw s5,8(sp) 0xc0a3ffc4: lw ra,12(sp) 0xc0a3ffc8: addiu sp,sp,16 0xc0a3ffcc: jr ra 0xc0a3ffd0: nop To mitigate this issue, we assert the branch ranges for each emit call that could generate an out-of-range branch. Fixes: 36366e367ee9 ("MIPS: BPF: Restore MIPS32 cBPF JIT") Fixes: c6610de353da ("MIPS: net: Add BPF JIT") Signed-off-by: Piotr Krysiuk Signed-off-by: Daniel Borkmann Tested-by: Johan Almbladh Acked-by: Johan Almbladh Cc: Paul Burton Cc: Thomas Bogendoerfer Link: https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com commit d6efd3f18763ac84098fa318742cd2a3bfdf4d72 Merge: 80be5998ad633 ebdc20d7bc74e Author: Linus Torvalds Date: Wed Sep 15 12:11:48 2021 -0700 Merge branch 'absolute-pointer' (patches from Guenter) Merge absolute_pointer macro series from Guenter Roeck: "Kernel test builds currently fail for several architectures with error messages such as the following. drivers/net/ethernet/i825xx/82596.c: In function 'i82596_probe': arch/m68k/include/asm/string.h:72:25: error: '__builtin_memcpy' reading 6 bytes from a region of size 0 [-Werror=stringop-overread] Such warnings may be reported by gcc 11.x for string and memory operations on fixed addresses if gcc's builtin functions are used for those operations. This series introduces absolute_pointer() to fix the problem. absolute_pointer() disassociates a pointer from its originating symbol type and context, and thus prevents gcc from making assumptions about pointers passed to memory operations" * emailed patches from Guenter Roeck : alpha: Use absolute_pointer to define COMMAND_LINE alpha: Move setup.h out of uapi net: i825xx: Use absolute_pointer for memcpy from fixed memory location compiler.h: Introduce absolute_pointer macro commit ebdc20d7bc74e8b6a242ff1f30e9017ffca9092c Author: Guenter Roeck Date: Tue Sep 14 20:52:27 2021 -0700 alpha: Use absolute_pointer to define COMMAND_LINE alpha:allmodconfig fails to build with the following error when using gcc 11.x. arch/alpha/kernel/setup.c: In function 'setup_arch': arch/alpha/kernel/setup.c:493:13: error: 'strcmp' reading 1 or more bytes from a region of size 0 Avoid the problem by declaring COMMAND_LINE as absolute_pointer(). Signed-off-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 3cb8b1537f8a89a681d2548ded5526280846f6db Author: Guenter Roeck Date: Tue Sep 14 20:52:26 2021 -0700 alpha: Move setup.h out of uapi Most of the contents of setup.h have no value for userspace applications. The file was probably moved to uapi accidentally. Keep the file in uapi to define the alpha-specific COMMAND_LINE_SIZE. Move all other defines to arch/alpha/include/asm/setup.h. Suggested-by: Linus Torvalds Signed-off-by: Guenter Roeck Signed-off-by: Linus Torvalds commit dff2d13114f0beec448da9b3716204eb34b0cf41 Author: Guenter Roeck Date: Tue Sep 14 20:52:25 2021 -0700 net: i825xx: Use absolute_pointer for memcpy from fixed memory location gcc 11.x reports the following compiler warning/error. drivers/net/ethernet/i825xx/82596.c: In function 'i82596_probe': arch/m68k/include/asm/string.h:72:25: error: '__builtin_memcpy' reading 6 bytes from a region of size 0 [-Werror=stringop-overread] Use absolute_pointer() to work around the problem. Cc: Geert Uytterhoeven Signed-off-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit f6b5f1a56987de837f8e25cd560847106b8632a8 Author: Guenter Roeck Date: Tue Sep 14 20:52:24 2021 -0700 compiler.h: Introduce absolute_pointer macro absolute_pointer() disassociates a pointer from its originating symbol type and context. Use it to prevent compiler warnings/errors such as drivers/net/ethernet/i825xx/82596.c: In function 'i82596_probe': arch/m68k/include/asm/string.h:72:25: error: '__builtin_memcpy' reading 6 bytes from a region of size 0 [-Werror=stringop-overread] Such warnings may be reported by gcc 11.x for string and memory operations on fixed addresses. Suggested-by: Linus Torvalds Signed-off-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 858560b27645e7e97aca37ee8f232cccd658fbd2 Author: Li Jinlin Date: Tue Sep 14 12:26:05 2021 +0800 blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd KASAN reports a use-after-free report when doing fuzz test: [693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000 [693354.108278] page dumped because: kasan: bad access detected [693354.108511] Memory state around the buggy address: [693354.108671] ffff888be0a35500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [693354.116396] ffff888be0a35580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.124473] >ffff888be0a35600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.132421] ^ [693354.140284] ffff888be0a35680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.147912] ffff888be0a35700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.155281] ================================================================== blkgs are protected by both queue and blkcg locks and holding either should stabilize them. However, the path of destroying blkg policy data is only protected by queue lock in blkcg_activate_policy()/blkcg_deactivate_policy(). Other tasks can get the blkg policy data before the blkg policy data is destroyed, and use it after destroyed, which will result in a use-after-free. CPU0 CPU1 blkcg_deactivate_policy spin_lock_irq(&q->queue_lock) bfq_io_set_weight_legacy spin_lock_irq(&blkcg->lock) blkg_to_bfqg(blkg) pd_to_bfqg(blkg->pd[pol->plid]) ^^^^^^blkg->pd[pol->plid] != NULL bfqg != NULL pol->pd_free_fn(blkg->pd[pol->plid]) pd_to_bfqg(blkg->pd[pol->plid]) bfqg_put(bfqg) kfree(bfqg) blkg->pd[pol->plid] = NULL spin_unlock_irq(q->queue_lock); bfq_group_set_weight(bfqg, val, 0) bfqg->entity.new_weight ^^^^^^trigger uaf here spin_unlock_irq(&blkcg->lock); Fix by grabbing the matching blkcg lock before trying to destroy blkg policy data. Suggested-by: Tejun Heo Signed-off-by: Li Jinlin Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20210914042605.3260596-1-lijinlin3@huawei.com Signed-off-by: Jens Axboe commit 6f5ddde41069fcd1f0993ec76c9dbbf9d021fd4d Author: Yanfei Xu Date: Wed Sep 15 15:24:26 2021 +0800 blkcg: fix memory leak in blk_iolatency_init BUG: memory leak unreferenced object 0xffff888129acdb80 (size 96): comm "syz-executor.1", pid 12661, jiffies 4294962682 (age 15.220s) hex dump (first 32 bytes): 20 47 c9 85 ff ff ff ff 20 d4 8e 29 81 88 ff ff G...... ..).... 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:591 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] blk_iolatency_init+0x28/0x190 block/blk-iolatency.c:724 [] blkcg_init_queue+0xb4/0x1c0 block/blk-cgroup.c:1185 [] blk_alloc_queue+0x22a/0x2e0 block/blk-core.c:566 [] blk_mq_init_queue_data block/blk-mq.c:3100 [inline] [] __blk_mq_alloc_disk+0x25/0xd0 block/blk-mq.c:3124 [] loop_add+0x1c3/0x360 drivers/block/loop.c:2344 [] loop_control_get_free drivers/block/loop.c:2501 [inline] [] loop_control_ioctl+0x17e/0x2e0 drivers/block/loop.c:2516 [] vfs_ioctl fs/ioctl.c:51 [inline] [] __do_sys_ioctl fs/ioctl.c:874 [inline] [] __se_sys_ioctl fs/ioctl.c:860 [inline] [] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x44/0xae Once blk_throtl_init() queue init failed, blkcg_iolatency_exit() will not be invoked for cleanup. That leads a memory leak. Swap the blk_throtl_init() and blk_iolatency_init() calls can solve this. Reported-by: syzbot+01321b15cc98e6bf96d6@syzkaller.appspotmail.com Fixes: 19688d7f9592 (block/blk-cgroup: Swap the blk_throtl_init() and blk_iolatency_init() calls) Signed-off-by: Yanfei Xu Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20210915072426.4022924-1-yanfei.xu@windriver.com Signed-off-by: Jens Axboe commit 80be5998ad6339e3e804a772723390cb50b96428 Author: Masami Hiramatsu Date: Wed Sep 15 09:53:38 2021 +0900 tools/bootconfig: Define memblock_free_ptr() to fix build error The lib/bootconfig.c file is shared with the 'bootconfig' tooling, and as a result, the changes incommit 77e02cf57b6c ("memblock: introduce saner 'memblock_free_ptr()' interface") need to also be reflected in the tooling header file. So define the new memblock_free_ptr() wrapper, and remove unused __pa() and memblock_free(). Fixes: 77e02cf57b6c ("memblock: introduce saner 'memblock_free_ptr()' interface") Signed-off-by: Masami Hiramatsu Signed-off-by: Linus Torvalds commit 8914a7a247e065438a0ec86a58c1c359223d2c9e Author: Li Zhijian Date: Wed Sep 15 21:45:54 2021 +0800 selftests: be sure to make khdr before other targets LKP/0Day reported some building errors about kvm, and errors message are not always same: - lib/x86_64/processor.c:1083:31: error: ‘KVM_CAP_NESTED_STATE’ undeclared (first use in this function); did you mean ‘KVM_CAP_PIT_STATE2’? - lib/test_util.c:189:30: error: ‘MAP_HUGE_16KB’ undeclared (first use in this function); did you mean ‘MAP_HUGE_16GB’? Although kvm relies on the khdr, they still be built in parallel when -j is specified. In this case, it will cause compiling errors. Here we mark target khdr as NOTPARALLEL to make it be always built first. CC: Philip Li Reported-by: kernel test robot Signed-off-by: Li Zhijian Signed-off-by: Shuah Khan commit 81121524f1c798c9481bd7900450b72ee7ac2eef Author: Boqun Feng Date: Thu Sep 9 12:59:19 2021 +0200 locking/rwbase: Take care of ordering guarantee for fastpath reader Readers of rwbase can lock and unlock without taking any inner lock, if that happens, we need the ordering provided by atomic operations to satisfy the ordering semantics of lock/unlock. Without that, considering the follow case: { X = 0 initially } CPU 0 CPU 1 ===== ===== rt_write_lock(); X = 1 rt_write_unlock(): atomic_add(READER_BIAS - WRITER_BIAS, ->readers); // ->readers is READER_BIAS. rt_read_lock(): if ((r = atomic_read(->readers)) < 0) // True atomic_try_cmpxchg(->readers, r, r + 1); // succeed. r1 = X; // r1 may be 0, because nothing prevent the reordering // of "X=1" and atomic_add() on CPU 1. Therefore audit every usage of atomic operations that may happen in a fast path, and add necessary barriers. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20210909110203.953991276@infradead.org commit 616be87eac9fa2ab2dca1069712f7236e50f3bf6 Author: Peter Zijlstra Date: Thu Sep 9 12:59:18 2021 +0200 locking/rwbase: Extract __rwbase_write_trylock() The code in rwbase_write_lock() is a little non-obvious vs the read+set 'trylock', extract the sequence into a helper function to clarify the code. This also provides a single site to fix fast-path ordering. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Thomas Gleixner Link: https://lkml.kernel.org/r/YUCq3L+u44NDieEJ@hirez.programming.kicks-ass.net commit 7687201e37fabf2b7cf2b828f7ca46bf30e2948f Author: Peter Zijlstra Date: Thu Sep 9 12:59:17 2021 +0200 locking/rwbase: Properly match set_and_save_state() to restore_state() Noticed while looking at the readers race. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Thomas Gleixner Acked-by: Will Deacon Link: https://lkml.kernel.org/r/20210909110203.828203010@infradead.org commit b89a05b21f46150ac10a962aa50109250b56b03b Author: Baptiste Lepers Date: Mon Sep 6 11:53:10 2021 +1000 events: Reuse value read using READ_ONCE instead of re-reading it In perf_event_addr_filters_apply, the task associated with the event (event->ctx->task) is read using READ_ONCE at the beginning of the function, checked, and then re-read from event->ctx->task, voiding all guarantees of the checks. Reuse the value that was read by READ_ONCE to ensure the consistency of the task struct throughout the function. Fixes: 375637bc52495 ("perf/core: Introduce address range filtering") Signed-off-by: Baptiste Lepers Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210906015310.12802-1-baptiste.lepers@gmail.com commit d9be4a88c3627c270bbe032b623dc43f3b764565 Author: Peter Ujfalusi Date: Wed Sep 15 15:21:09 2021 +0300 ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM types i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3) bars, everything else is left as 0 in sdev->bar[] array. If a broken or purposefully crafted firmware image is loaded with other types of FW_BLK_TYPE then a kernel crash can be triggered. Make sure that only IRAM/SRAM type is converted to bar index. Fixes: afb93d716533d ("ASoC: SOF: imx: Add i.MX8M HW support") Signed-off-by: Peter Ujfalusi Reviewed-by: Daniel Baluta Reviewed-by: Ranjani Sridharan Reviewed-by: Guennadi Liakhovetski Link: https://lore.kernel.org/r/20210915122116.18317-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 10d93a98190aec2c3ff98d9472ab1bf0543aa02c Author: Peter Ujfalusi Date: Wed Sep 15 15:21:08 2021 +0300 ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3) bars, everything else is left as 0 in sdev->bar[] array. If a broken or purposefully crafted firmware image is loaded with other types of FW_BLK_TYPE then a kernel crash can be triggered. Make sure that only IRAM/SRAM type is converted to bar index. Fixes: 202acc565a1f0 ("ASoC: SOF: imx: Add i.MX8 HW support") Signed-off-by: Peter Ujfalusi Reviewed-by: Daniel Baluta Reviewed-by: Ranjani Sridharan Reviewed-by: Guennadi Liakhovetski Link: https://lore.kernel.org/r/20210915122116.18317-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b66ceaf324b394428bb47054140ddf03d8172e64 Author: Pavel Begunkov Date: Wed Sep 15 11:00:05 2021 +0100 io_uring: move iopoll reissue into regular IO path 230d50d448acb ("io_uring: move reissue into regular IO path") made non-IOPOLL I/O to not retry from ki_complete handler. Follow it steps and do the same for IOPOLL. Same problems, same implementation, same -EAGAIN assumptions. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/f80dfee2d5fa7678f0052a8ab3cfca9496a112ca.1631699928.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 7dedd3e18077f996a10c47250ac85d080e5f474e Author: Jens Axboe Date: Fri Sep 10 11:19:58 2021 -0600 Revert "iov_iter: track truncated size" This reverts commit 2112ff5ce0c1128fe7b4d19cfe7f2b8ce5b595fa. We no longer need to track the truncation count, the one user that did need it has been converted to using iov_iter_restore() instead. Signed-off-by: Jens Axboe commit cd65869512ab5668a5d16f789bc4da1319c435c4 Author: Jens Axboe Date: Fri Sep 10 11:19:14 2021 -0600 io_uring: use iov_iter state save/restore helpers Get rid of the need to do re-expand and revert on an iterator when we encounter a short IO, or failure that warrants a retry. Use the new state save/restore helpers instead. We keep the iov_iter_state persistent across retries, if we need to restart the read or write operation. If there's a pending retry, the operation will always exit with the state correctly saved. Signed-off-by: Jens Axboe commit 0c8fbaa553077630e8eae45bd9676cfc01836aeb Author: Joshua-Dickens Date: Tue Sep 14 13:28:25 2021 -0400 HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. [jkosina@suse.cz: fix changelog] Signed-off-by: Joshua Dickens Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina commit 310e2d43c3ad429c1fba4b175806cf1f55ed73a6 Author: Jeremy Sowden Date: Sun Sep 12 22:24:33 2021 +0100 netfilter: ip6_tables: zero-initialize fragment offset ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is specified (`-p tcp`, for example). However, if the flag is not set, `ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which case the fragment offset is left uninitialized and a garbage value is passed to each matcher. Signed-off-by: Jeremy Sowden Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 67fd71ba16a37c663d139f5ba5296f344d80d072 Author: Mizuho Mori Date: Thu Jul 29 20:03:25 2021 +0900 HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. Below is a report descriptor. 0x05, 0x01, /* Usage Page (Desktop), */ 0x09, 0x06, /* Usage (Keyboard), */ 0xA1, 0x01, /* Collection (Application), */ 0x85, 0x01, /* Report ID (1), */ 0x05, 0x07, /* Usage Page (Keyboard), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ 0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ 0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ 0x75, 0x01, /* Report Size (1), */ 0x95, 0x08, /* Report Count (8), */ 0x81, 0x02, /* Input (Variable), */ 0x95, 0x05, /* Report Count (5), */ 0x75, 0x01, /* Report Size (1), */ 0x05, 0x08, /* Usage Page (LED), */ 0x19, 0x01, /* Usage Minimum (01h), */ 0x29, 0x05, /* Usage Maximum (05h), */ 0x91, 0x02, /* Output (Variable), */ 0x95, 0x01, /* Report Count (1), */ 0x75, 0x03, /* Report Size (3), */ 0x91, 0x03, /* Output (Constant, Variable), */ 0x95, 0x08, /* Report Count (8), */ 0x75, 0x01, /* Report Size (1), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ here is a report descriptor which is parsed one in kernel. see sys/kernel/debug/hid//rdesc 05 01 09 06 a1 01 85 01 05 07 15 00 25 01 19 e0 29 e7 75 01 95 08 81 02 95 05 75 01 05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 08 75 01 15 00 25 01 06 00 ff 09 03 81 03 95 06 75 08 15 00 25 [65] 05 07 19 00 29 [65] 81 00 95 01 75 01 15 00 25 01 05 0c 09 b8 81 02 95 01 75 01 06 01 ff 09 03 81 02 95 01 75 06 81 03 06 02 ff 09 55 85 55 15 00 26 ff 00 75 08 95 40 b1 a2 c0 06 00 ff 09 14 a1 01 85 90 05 84 75 01 95 03 15 00 25 01 09 61 05 85 09 44 09 46 81 02 95 05 81 01 75 08 95 01 15 00 26 ff 00 09 65 81 02 c0 00 Position 64(Logical Maximum) and 70(Usage Maximum) are 101. Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. position 117 is also 101 but not related(it is Usage 65h). There are no difference of product id between JIS and ANSI. They are same 0x0267. Signed-off-by: Mizuho Mori Signed-off-by: Jiri Kosina commit ca465e1f1f9b38fe916a36f7d80c5d25f2337c81 Author: Tao Liu Date: Mon Sep 13 17:33:44 2021 +0800 RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure If cma_listen_on_all() fails it leaves the per-device ID still on the listen_list but the state is not set to RDMA_CM_ADDR_BOUND. When the cmid is eventually destroyed cma_cancel_listens() is not called due to the wrong state, however the per-device IDs are still holding the refcount preventing the ID from being destroyed, thus deadlocking: task:rping state:D stack: 0 pid:19605 ppid: 47036 flags:0x00000084 Call Trace: __schedule+0x29a/0x780 ? free_unref_page_commit+0x9b/0x110 schedule+0x3c/0xa0 schedule_timeout+0x215/0x2b0 ? __flush_work+0x19e/0x1e0 wait_for_completion+0x8d/0xf0 _destroy_id+0x144/0x210 [rdma_cm] ucma_close_id+0x2b/0x40 [rdma_ucm] __destroy_id+0x93/0x2c0 [rdma_ucm] ? __xa_erase+0x4a/0xa0 ucma_destroy_id+0x9a/0x120 [rdma_ucm] ucma_write+0xb8/0x130 [rdma_ucm] vfs_write+0xb4/0x250 ksys_write+0xb5/0xd0 ? syscall_trace_enter.isra.19+0x123/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Ensure that cma_listen_on_all() atomically unwinds its action under the lock during error. Fixes: c80a0c52d85c ("RDMA/cma: Add missing error handling of listen_id") Link: https://lore.kernel.org/r/20210913093344.17230-1-thomas.liu@ucloud.cn Signed-off-by: Tao Liu Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1e4ce418b1cb1a810256b5fb3fd33d22d1325993 Author: F.A.Sulaiman Date: Tue Aug 24 20:37:30 2021 +0530 HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN Reviewed-by: Pavel Skripkin Signed-off-by: Jiri Kosina commit 65ed1e692f2b996292a5bd973200442816dd0ec1 Merge: 9da4c7276ec5d 70f437fb4395a Author: Jens Axboe Date: Wed Sep 15 07:53:32 2021 -0600 Merge tag 'nvme-5.15-2021-09-15' of git://git.infradead.org/nvme into block-5.15 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.15 - fix ANA state updates when a namespace is not present (Anton Eidelman) - nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show (Dan Carpenter) - avoid race in shutdown namespace removal (Daniel Wagner) - fix io_work priority inversion in nvme-tcp (Keith Busch) - destroy cm id before destroy qp to avoid use after free (Ruozhu Li)" * tag 'nvme-5.15-2021-09-15' of git://git.infradead.org/nvme: nvme-tcp: fix io_work priority inversion nvme-rdma: destroy cm id before destroy qp to avoid use after free nvme-multipath: fix ANA state updates when a namespace is not present nvme: avoid race in shutdown namespace removal nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show() commit 3782326577d4b02f3d9940e1c96c3e9b31cf5309 Author: Saravana Kannan Date: Wed Sep 15 01:19:32 2021 -0700 Revert "of: property: fw_devlink: Add support for "phy-handle" property" This reverts commit cf4b94c8530d14017fbddae26aad064ddc42edd4. Some PHYs pointed to by "phy-handle" will never bind to a driver until a consumer attaches to it. And when the consumer attaches to it, they get forcefully bound to a generic PHY driver. In such cases, parsing the phy-handle property and creating a device link will prevent the consumer from ever probing. We don't want that. So revert support for "phy-handle" property until we come up with a better mechanism for binding PHYs to generic drivers before a consumer tries to attach to it. Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20210915081933.485112-1-saravanak@google.com Signed-off-by: Rob Herring commit f5711f9df9242446feccf2bdb6fdc06a72ca1010 Author: Heiko Carstens Date: Mon Sep 13 14:41:35 2021 +0200 s390: remove WARN_DYNAMIC_STACK s390 is the only architecture which allows to set the -mwarn-dynamicstack compile option. This however will also always generate a warning with system call stack randomization, which uses alloca to generate some random sized stack frame. On the other hand Linus just enabled "-Werror" by default with commit 3fe617ccafd6 ("Enable '-Werror' by default for all kernel builds"), which means compiles will always fail by default. So instead of playing once again whack-a-mole for something which is s390 specific, simply remove this option. Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 948e50551b9a07c3ab6b9d208bb8f16fa1b2ad41 Author: Heiko Carstens Date: Tue Sep 7 07:27:11 2021 +0200 s390/ap: fix kernel doc comments Get rid of warnings like: drivers/s390/crypto/ap_bus.c:216: warning: bad line: drivers/s390/crypto/ap_bus.c:444: warning: Function parameter or member 'floating' not described in 'ap_interrupt_handler' Reviewed-by: Harald Freudenberger Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 4b26ceac103be7ad71cd4cccf01f97b6017008a6 Author: Heiko Carstens Date: Wed Sep 1 14:48:07 2021 +0200 s390: update defconfigs Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit d76b14f3971a0638b6cd0da289f8b48acee287d0 Author: Alexander Egorenkov Date: Thu Sep 9 12:20:56 2021 +0200 s390/sclp: fix Secure-IPL facility detection Prevent out-of-range access if the returned SCLP SCCB response is smaller in size than the address of the Secure-IPL flag. Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute") Cc: stable@vger.kernel.org # 5.2+ Signed-off-by: Alexander Egorenkov Reviewed-by: Christian Borntraeger Signed-off-by: Vasily Gorbik commit a8b92b8c1eac8d655a97b1e90f4d83c25d9b9a18 Author: David Hildenbrand Date: Thu Sep 9 16:59:42 2021 +0200 s390/pci_mmio: fully validate the VMA before calling follow_pte() We should not walk/touch page tables outside of VMA boundaries when holding only the mmap sem in read mode. Evil user space can modify the VMA layout just before this function runs and e.g., trigger races with page table removal code since commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap"). find_vma() does not check if the address is >= the VMA start address; use vma_lookup() instead. Reviewed-by: Niklas Schnelle Reviewed-by: Liam R. Howlett Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Signed-off-by: David Hildenbrand Signed-off-by: Vasily Gorbik commit ac4dfccb96571ca03af7cac64b7a0b2952c97f3a Author: Yong Zhi Date: Wed Sep 15 09:32:30 2021 +0300 ASoC: SOF: Fix DSP oops stack dump output contents Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output. Fixes: e657c18a01c8 ('ASoC: SOF: Add xtensa support') Signed-off-by: Yong Zhi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Daniel Baluta Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20210915063230.29711-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c006a06508db4841d256d82f42da392d6391f3d9 Author: Cédric Le Goater Date: Mon Sep 13 15:40:56 2021 +0200 powerpc/xics: Set the IRQ chip data for the ICS native backend The ICS native driver relies on the IRQ chip data to find the struct 'ics_native' describing the ICS controller but it was removed by commit 248af248a8f4 ("powerpc/xics: Rename the map handler in a check handler"). Revert this change to fix the Microwatt SoC platform. Fixes: 248af248a8f4 ("powerpc/xics: Rename the map handler in a check handler") Signed-off-by: Cédric Le Goater Tested-by: Gustavo Romero Reviewed-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210913134056.3761960-1-clg@kaod.org commit 88d0adb5f13b1c52fbb7d755f6f79db18c2f0c2c Author: Nicolas Dichtel Date: Tue Sep 14 16:46:34 2021 +0200 xfrm: notify default policy on update This configuration knob is very sensible, it should be notified when changing. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit f8d858e607b2a36808ac6d4218f5f5203d7a7d63 Author: Nicolas Dichtel Date: Tue Sep 14 16:46:33 2021 +0200 xfrm: make user policy API complete >From a userland POV, this API was based on some magic values: - dirmask and action were bitfields but meaning of bits (XFRM_POL_DEFAULT_*) are not exported; - action is confusing, if a bit is set, does it mean drop or accept? Let's try to simplify this uapi by using explicit field and macros. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit d859ed25b24289c87a97889653596f8088367e16 Author: Jan Beulich Date: Tue Sep 7 14:07:47 2021 +0200 swiotlb-xen: drop DEFAULT_NSLABS It was introduced by 4035b43da6da ("xen-swiotlb: remove xen_set_nslabs") and then not removed by 2d29960af0be ("swiotlb: dynamically allocate io_tlb_default_mem"). Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/15259326-209a-1d11-338c-5018dc38abe8@suse.com Signed-off-by: Juergen Gross commit 7fd880a38cfefb2d54a912e4ae809110adec1c94 Author: Jan Beulich Date: Tue Sep 7 14:07:21 2021 +0200 swiotlb-xen: arrange to have buffer info logged I consider it unhelpful that address and size of the buffer aren't put in the log file; it makes diagnosing issues needlessly harder. The majority of callers of swiotlb_init() also passes 1 for the "verbose" parameter. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/2e3c8e68-36b2-4ae9-b829-bf7f75d39d47@suse.com Signed-off-by: Juergen Gross commit 68573c1b5c4d0ebd90c24c6055abb53c474a8fc2 Author: Jan Beulich Date: Tue Sep 7 14:06:55 2021 +0200 swiotlb-xen: drop leftover __ref Commit a98f565462f0 ("xen-swiotlb: split xen_swiotlb_init") should not only have added __init to the split off function, but also should have dropped __ref from the one left. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/7cd163e1-fe13-270b-384c-2708e8273d34@suse.com Signed-off-by: Juergen Gross commit cabb7f89b24ed40c4640dac3bca044452ab0b386 Author: Jan Beulich Date: Tue Sep 7 14:06:37 2021 +0200 swiotlb-xen: limit init retries Due to the use of max(1024, ...) there's no point retrying (and issuing bogus log messages) when the number of slabs is already no larger than this minimum value. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/984fa426-2b7b-4b77-5ce8-766619575b7f@suse.com Signed-off-by: Juergen Gross commit 79ca5f778aafbd69727d577b58d913c9ce8400be Author: Jan Beulich Date: Tue Sep 7 14:05:54 2021 +0200 swiotlb-xen: suppress certain init retries Only on the 2nd of the paths leading to xen_swiotlb_init()'s "error" label it is useful to retry the allocation; the first one did already iterate through all possible order values. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/56477481-87da-4962-9661-5e1b277efde0@suse.com Signed-off-by: Juergen Gross commit d9a688add3d412c840e31060847a6a297b552316 Author: Jan Beulich Date: Tue Sep 7 14:05:12 2021 +0200 swiotlb-xen: maintain slab count properly Generic swiotlb code makes sure to keep the slab count a multiple of the number of slabs per segment. Yet even without checking whether any such assumption is made elsewhere, it is easy to see that xen_swiotlb_fixup() might alter unrelated memory when calling xen_create_contiguous_region() for the last segment, when that's not a full one - the function acts on full order-N regions, not individual pages. Align the slab count suitably when halving it for a retry. Add a build time check and a runtime one. Replace the no longer useful local variable "slabs" by an "order" one calculated just once, outside of the loop. Re-use "order" for calculating "dma_bits", and change the type of the latter as well as the one of "i" while touching this anyway. Signed-off-by: Jan Beulich Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/dc054cb0-bec4-4db0-fc06-c9fc957b6e66@suse.com Signed-off-by: Juergen Gross commit 4c092c59015f7adf0f07685f869edb96d997a756 Author: Jan Beulich Date: Tue Sep 7 14:04:47 2021 +0200 swiotlb-xen: fix late init retry The commit referenced below removed the assignment of "bytes" from xen_swiotlb_init() without - like done for xen_swiotlb_init_early() - adding an assignment on the retry path, thus leading to excessively sized allocations upon retries. Fixes: 2d29960af0be ("swiotlb: dynamically allocate io_tlb_default_mem") Signed-off-by: Jan Beulich Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/778299d6-9cfd-1c13-026e-25ee5d14ecb3@suse.com Signed-off-by: Juergen Gross commit ce6a80d1b2f923b1839655a1cda786293feaa085 Author: Jan Beulich Date: Tue Sep 7 14:04:25 2021 +0200 swiotlb-xen: avoid double free Of the two paths leading to the "error" label in xen_swiotlb_init() one didn't allocate anything, while the other did already free what was allocated. Fixes: b82776005369 ("xen/swiotlb: Use the swiotlb_late_init_with_tbl to init Xen-SWIOTLB late when PV PCI is used") Signed-off-by: Jan Beulich Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/ce9c2adb-8a52-6293-982a-0d6ece943ac6@suse.com Signed-off-by: Juergen Gross commit 45da234467f381239d87536c86597149f189d375 Author: Jan Beulich Date: Tue Sep 7 14:17:13 2021 +0200 xen/pvcalls: backend can be a module It's not clear to me why only the frontend has been tristate. Switch the backend to be, too. Signed-off-by: Jan Beulich Acked-by: Stefano Stabellini Link: https://lore.kernel.org/r/54a6070c-92bb-36a3-2fc0-de9ccca438c5@suse.com Signed-off-by: Juergen Gross commit 36c9b5929b7094ea19a78827c0ede20d2e0e6c9c Author: Juergen Gross Date: Wed Sep 8 09:36:40 2021 +0200 xen: fix usage of pmd_populate in mremap for pv guests Commit 0881ace292b662 ("mm/mremap: use pmd/pud_poplulate to update page table entries") introduced a regression when running as Xen PV guest. Today pmd_populate() for Xen PV assumes that the PFN inserted is referencing a not yet used page table. In case of move_normal_pmd() this is not true, resulting in WARN splats like: [34321.304270] ------------[ cut here ]------------ [34321.304277] WARNING: CPU: 0 PID: 23628 at arch/x86/xen/multicalls.c:102 xen_mc_flush+0x176/0x1a0 [34321.304288] Modules linked in: [34321.304291] CPU: 0 PID: 23628 Comm: apt-get Not tainted 5.14.1-20210906-doflr-mac80211debug+ #1 [34321.304294] Hardware name: MSI MS-7640/890FXA-GD70 (MS-7640) , BIOS V1.8B1 09/13/2010 [34321.304296] RIP: e030:xen_mc_flush+0x176/0x1a0 [34321.304300] Code: 89 45 18 48 c1 e9 3f 48 89 ce e9 20 ff ff ff e8 60 03 00 00 66 90 5b 5d 41 5c 41 5d c3 48 c7 45 18 ea ff ff ff be 01 00 00 00 <0f> 0b 8b 55 00 48 c7 c7 10 97 aa 82 31 db 49 c7 c5 38 97 aa 82 65 [34321.304303] RSP: e02b:ffffc90000a97c90 EFLAGS: 00010002 [34321.304305] RAX: ffff88807d416398 RBX: ffff88807d416350 RCX: ffff88807d416398 [34321.304306] RDX: 0000000000000001 RSI: 0000000000000001 RDI: deadbeefdeadf00d [34321.304308] RBP: ffff88807d416300 R08: aaaaaaaaaaaaaaaa R09: ffff888006160cc0 [34321.304309] R10: deadbeefdeadf00d R11: ffffea000026a600 R12: 0000000000000000 [34321.304310] R13: ffff888012f6b000 R14: 0000000012f6b000 R15: 0000000000000001 [34321.304320] FS: 00007f5071177800(0000) GS:ffff88807d400000(0000) knlGS:0000000000000000 [34321.304322] CS: 10000e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [34321.304323] CR2: 00007f506f542000 CR3: 00000000160cc000 CR4: 0000000000000660 [34321.304326] Call Trace: [34321.304331] xen_alloc_pte+0x294/0x320 [34321.304334] move_pgt_entry+0x165/0x4b0 [34321.304339] move_page_tables+0x6fa/0x8d0 [34321.304342] move_vma.isra.44+0x138/0x500 [34321.304345] __x64_sys_mremap+0x296/0x410 [34321.304348] do_syscall_64+0x3a/0x80 [34321.304352] entry_SYSCALL_64_after_hwframe+0x44/0xae [34321.304355] RIP: 0033:0x7f507196301a [34321.304358] Code: 73 01 c3 48 8b 0d 76 0e 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 19 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 46 0e 0c 00 f7 d8 64 89 01 48 [34321.304360] RSP: 002b:00007ffda1eecd38 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [34321.304362] RAX: ffffffffffffffda RBX: 000056205f950f30 RCX: 00007f507196301a [34321.304363] RDX: 0000000001a00000 RSI: 0000000001900000 RDI: 00007f506dc56000 [34321.304364] RBP: 0000000001a00000 R08: 0000000000000010 R09: 0000000000000004 [34321.304365] R10: 0000000000000001 R11: 0000000000000246 R12: 00007f506dc56060 [34321.304367] R13: 00007f506dc56000 R14: 00007f506dc56060 R15: 000056205f950f30 [34321.304368] ---[ end trace a19885b78fe8f33e ]--- [34321.304370] 1 of 2 multicall(s) failed: cpu 0 [34321.304371] call 2: op=12297829382473034410 arg=[aaaaaaaaaaaaaaaa] result=-22 Fix that by modifying xen_alloc_ptpage() to only pin the page table in case it wasn't pinned already. Fixes: 0881ace292b662 ("mm/mremap: use pmd/pud_poplulate to update page table entries") Cc: Reported-by: Sander Eikelenboom Tested-by: Sander Eikelenboom Signed-off-by: Juergen Gross Link: https://lore.kernel.org/r/20210908073640.11299-1-jgross@suse.com Signed-off-by: Juergen Gross commit f68aa100d815b5b4467fd1c3abbe3b99d65fd028 Author: Juergen Gross Date: Fri Sep 3 10:49:37 2021 +0200 xen: reset legacy rtc flag for PV domU A Xen PV guest doesn't have a legacy RTC device, so reset the legacy RTC flag. Otherwise the following WARN splat will occur at boot: [ 1.333404] WARNING: CPU: 1 PID: 1 at /home/gross/linux/head/drivers/rtc/rtc-mc146818-lib.c:25 mc146818_get_time+0x1be/0x210 [ 1.333404] Modules linked in: [ 1.333404] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.14.0-rc7-default+ #282 [ 1.333404] RIP: e030:mc146818_get_time+0x1be/0x210 [ 1.333404] Code: c0 64 01 c5 83 fd 45 89 6b 14 7f 06 83 c5 64 89 6b 14 41 83 ec 01 b8 02 00 00 00 44 89 63 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 <0f> 0b 48 c7 c7 30 0e ef 82 4c 89 e6 e8 71 2a 24 00 48 c7 c0 ff ff [ 1.333404] RSP: e02b:ffffc90040093df8 EFLAGS: 00010002 [ 1.333404] RAX: 00000000000000ff RBX: ffffc90040093e34 RCX: 0000000000000000 [ 1.333404] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000d [ 1.333404] RBP: ffffffff82ef0e30 R08: ffff888005013e60 R09: 0000000000000000 [ 1.333404] R10: ffffffff82373e9b R11: 0000000000033080 R12: 0000000000000200 [ 1.333404] R13: 0000000000000000 R14: 0000000000000002 R15: ffffffff82cdc6d4 [ 1.333404] FS: 0000000000000000(0000) GS:ffff88807d440000(0000) knlGS:0000000000000000 [ 1.333404] CS: 10000e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.333404] CR2: 0000000000000000 CR3: 000000000260a000 CR4: 0000000000050660 [ 1.333404] Call Trace: [ 1.333404] ? wakeup_sources_sysfs_init+0x30/0x30 [ 1.333404] ? rdinit_setup+0x2b/0x2b [ 1.333404] early_resume_init+0x23/0xa4 [ 1.333404] ? cn_proc_init+0x36/0x36 [ 1.333404] do_one_initcall+0x3e/0x200 [ 1.333404] kernel_init_freeable+0x232/0x28e [ 1.333404] ? rest_init+0xd0/0xd0 [ 1.333404] kernel_init+0x16/0x120 [ 1.333404] ret_from_fork+0x1f/0x30 Cc: Fixes: 8d152e7a5c7537 ("x86/rtc: Replace paravirt rtc check with platform legacy quirk") Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210903084937.19392-3-jgross@suse.com Signed-off-by: Juergen Gross commit 7366c23ff492ad260776a3ee1aaabba9fc773a8b Author: Randy Dunlap Date: Mon Sep 13 15:06:05 2021 -0700 ptp: dp83640: don't define PAGE0 Building dp83640.c on arch/parisc/ produces a build warning for PAGE0 being redefined. Since the macro is not used in the dp83640 driver, just make it a comment for documentation purposes. In file included from ../drivers/net/phy/dp83640.c:23: ../drivers/net/phy/dp83640_reg.h:8: warning: "PAGE0" redefined 8 | #define PAGE0 0x0000 from ../drivers/net/phy/dp83640.c:11: ../arch/parisc/include/asm/page.h:187: note: this is the location of the previous definition 187 | #define PAGE0 ((struct zeropage *)__PAGE_OFFSET) Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") Signed-off-by: Randy Dunlap Reported-by: Geert Uytterhoeven Cc: Richard Cochran Cc: John Stultz Cc: Heiner Kallweit Cc: Russell King Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20210913220605.19682-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 52ce14c134a003fee03d8fc57442c05a55b53715 Author: Adrian Bunk Date: Sun Sep 12 22:05:23 2021 +0300 bnx2x: Fix enabling network interfaces without VFs This function is called to enable SR-IOV when available, not enabling interfaces without VFs was a regression. Fixes: 65161c35554f ("bnx2x: Fix missing error code in bnx2x_iov_init_one()") Signed-off-by: Adrian Bunk Reported-by: YunQiang Su Tested-by: YunQiang Su Cc: stable@vger.kernel.org Acked-by: Shai Malin Link: https://lore.kernel.org/r/20210912190523.27991-1-bunk@kernel.org Signed-off-by: Jakub Kicinski commit 9da4c7276ec5d167972d8f6670d64b59838b4ed2 Author: Christoph Hellwig Date: Tue Sep 14 09:06:57 2021 +0200 nvme: remove the call to nvme_update_disk_info in nvme_ns_remove There is no need to explicitly unregister the integrity profile when deleting the gendisk. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Link: https://lore.kernel.org/r/20210914070657.87677-4-hch@lst.de Signed-off-by: Jens Axboe commit 3df49967f6f1d2121b0c27c381ca1c8386b1dab9 Author: Lihong Kou Date: Tue Sep 14 09:06:56 2021 +0200 block: flush the integrity workqueue in blk_integrity_unregister When the integrity profile is unregistered there can still be integrity reads queued up which could see a NULL verify_fn as shown by the race window below: CPU0 CPU1 process_one_work nvme_validate_ns bio_integrity_verify_fn nvme_update_ns_info nvme_update_disk_info blk_integrity_unregister ---set queue->integrity as 0 bio_integrity_process --access bi->profile->verify_fn(bi is a pointer of queue->integity) Before calling blk_integrity_unregister in nvme_update_disk_info, we must make sure that there is no work item in the kintegrityd_wq. Just call blk_flush_integrity to flush the work queue so the bug can be resolved. Signed-off-by: Lihong Kou [hch: split up and shortened the changelog] Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Link: https://lore.kernel.org/r/20210914070657.87677-3-hch@lst.de Signed-off-by: Jens Axboe commit 783a40a1b3ac7f3714d2776fa8ac8cce3535e4f6 Author: Christoph Hellwig Date: Tue Sep 14 09:06:55 2021 +0200 block: check if a profile is actually registered in blk_integrity_unregister While clearing the profile itself is harmless, we really should not clear the stable writes flag if it wasn't set due to a registered integrity profile. Reported-by: Lihong Kou Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Link: https://lore.kernel.org/r/20210914070657.87677-2-hch@lst.de Signed-off-by: Jens Axboe commit be9c6bad9b46451ba5bb8d366c51e2475f374981 Author: Dan Carpenter Date: Tue Sep 7 10:32:53 2021 +0300 vdpa: potential uninitialized return in vhost_vdpa_va_map() The concern here is that "ret" can be uninitialized if we hit the "goto next" condition on every iteration through the loop. Fixes: 41ba1b5f9d4b ("vdpa: Support transferring virtual addressing during DMA mapping") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210907073253.GB18254@kili Signed-off-by: Michael S. Tsirkin Reviewed-by: Xie Yongji Acked-by: Jason Wang Reviewed-by: Stefano Garzarella commit 759be8993b1b40e05b8908583336b8e230e67b08 Author: Eli Cohen Date: Thu Sep 9 09:37:38 2021 +0300 vdpa/mlx5: Avoid executing set_vq_ready() if device is reset Avoid executing set_vq_ready() if the device has been reset. In such case, the features are cleared and cannot be used in conditional statements. Such reference happens is the function ctrl_vq_idx(). Fixes: 52893733f2c5 ("vdpa/mlx5: Add multiqueue support") Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210909063738.46970-1-elic@nvidia.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit ef12e4bf4276a07fd350179fa63d0d337ea0a867 Author: Eli Cohen Date: Thu Sep 9 09:36:52 2021 +0300 vdpa/mlx5: Clear ready indication for control VQ When clearing VQs ready indication for the data VQs, do the same for the control VQ. Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210909063652.46880-1-elic@nvidia.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 7bb5fb207334758ce6ee84345d6f08e4fb284fe6 Author: Xie Yongji Date: Mon Sep 6 22:21:58 2021 +0800 vduse: Cleanup the old kernel states after reset failure We should cleanup the old kernel states e.g. interrupt callback no matter whether the userspace handle the reset correctly or not since virtio-vdpa can't handle the reset failure now. Otherwise, the old state might be used after reset which might break something, e.g. the old interrupt callback might be triggered by userspace after reset, which can break the virtio device driver. Signed-off-by: Xie Yongji Link: https://lore.kernel.org/r/20210906142158.181-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6243e3c78ace66d337a1e43b60a1aa8f5b61bd72 Author: Dan Carpenter Date: Tue Sep 7 10:32:24 2021 +0300 vduse: missing error code in vduse_init() This should return -ENOMEM if alloc_workqueue() fails. Currently it returns success. Fixes: b66219796563 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210907073223.GA18254@kili Signed-off-by: Michael S. Tsirkin Reviewed-by: Xie Yongji Acked-by: Jason Wang commit 0d818706130e2f4e828c3fc028917677fac76a09 Author: Michael S. Tsirkin Date: Mon Sep 13 06:38:36 2021 -0400 virtio: don't fail on !of_device_is_compatible A recent change checking of_device_is_compatible on probe broke some powerpc/pseries setups. Apparently there virtio devices do not have a "compatible" property - they are matched by PCI vendor/device ids. Let's just skip of_node setup but proceed with initialization like we did previously. Fixes: 694a1116b405 ("virtio: Bind virtio device to device-tree node") Reported-by: Alexey Kardashevskiy Cc: Arnd Bergmann Cc: Viresh Kumar Tested-by: Guenter Roeck Acked-by: Jason Wang Reviewed-by: Viresh Kumar Signed-off-by: Michael S. Tsirkin commit 3ca706c189db861b2ca2019a0901b94050ca49d8 Author: Huang Rui Date: Tue Sep 7 18:03:02 2021 +0800 drm/ttm: fix type mismatch error on sparc64 On sparc64, __fls() returns an "int", but the drm TTM code expected it to be "unsigned long" as on x86. As a result, on sparc (and arc, and m68k) you get build errors because 'min()' checks that the types match. As suggested by Linus, it can use min_t instead of min to force the type to be "unsigned int". Suggested-by: Linus Torvalds Signed-off-by: Huang Rui Reviewed-by: Christian König Cc: Alex Deucher Cc: David Airlie Cc: Daniel Vetter Cc: Guenter Roeck Signed-off-by: Linus Torvalds commit 77e02cf57b6cff9919949defb7fd9b8ac16399a2 Author: Linus Torvalds Date: Tue Sep 14 13:23:22 2021 -0700 memblock: introduce saner 'memblock_free_ptr()' interface The boot-time allocation interface for memblock is a mess, with 'memblock_alloc()' returning a virtual pointer, but then you are supposed to free it with 'memblock_free()' that takes a _physical_ address. Not only is that all kinds of strange and illogical, but it actually causes bugs, when people then use it like a normal allocation function, and it fails spectacularly on a NULL pointer: https://lore.kernel.org/all/20210912140820.GD25450@xsang-OptiPlex-9020/ or just random memory corruption if the debug checks don't catch it: https://lore.kernel.org/all/61ab2d0c-3313-aaab-514c-e15b7aa054a0@suse.cz/ I really don't want to apply patches that treat the symptoms, when the fundamental cause is this horribly confusing interface. I started out looking at just automating a sane replacement sequence, but because of this mix or virtual and physical addresses, and because people have used the "__pa()" macro that can take either a regular kernel pointer, or just the raw "unsigned long" address, it's all quite messy. So this just introduces a new saner interface for freeing a virtual address that was allocated using 'memblock_alloc()', and that was kept as a regular kernel pointer. And then it converts a couple of users that are obvious and easy to test, including the 'xbc_nodes' case in lib/bootconfig.c that caused problems. Reported-by: kernel test robot Fixes: 40caa127f3c7 ("init: bootconfig: Remove all bootconfig data when the init memory is removed") Cc: Steven Rostedt Cc: Mike Rapoport Cc: Andrew Morton Cc: Ingo Molnar Cc: Masami Hiramatsu Cc: Vlastimil Babka Signed-off-by: Linus Torvalds commit b04ce53eac2fc326290817a6f64a440b5bffd2e3 Author: Nirmoy Das Date: Thu Sep 2 13:27:56 2021 +0200 drm/amdgpu: use IS_ERR for debugfs APIs debugfs APIs returns encoded error so use IS_ERR for checking return value. v2: return PTR_ERR(ent) References: https://gitlab.freedesktop.org/drm/amd/-/issues/1686 Signed-off-by: Nirmoy Das Reviewed-by: Christian König Reviewed-By: Shashank Sharma Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 7bbee36d71502ab9a341505da89a017c7ae2e6b2 Author: Simon Ser Date: Tue Sep 7 14:19:34 2021 +0000 amd/display: downgrade validation failure log level In amdgpu_dm_atomic_check, dc_validate_global_state is called. On failure this logs a warning to the kernel journal. However warnings shouldn't be used for atomic test-only commit failures: user-space might be perfoming a lot of atomic test-only commits to find the best hardware configuration. Downgrade the log to a regular DRM atomic message. While at it, use the new device-aware logging infrastructure. This fixes error messages in the kernel when running gamescope [1]. [1]: https://github.com/Plagman/gamescope/issues/245 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Simon Ser Cc: Alex Deucher Cc: Harry Wentland Cc: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit c92db8d64f9e0313e7ecdc9500db93a5040c9370 Author: Christian König Date: Tue Sep 7 09:37:52 2021 +0200 drm/amdgpu: fix use after free during BO move The memory backing old_mem is already freed at that point, move the check a bit more up. Signed-off-by: Christian König Fixes: bfa3357ef9ab ("drm/ttm: allocate resource object instead of embedding it v2") Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1699 Acked-by: Nirmoy Das Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5598d7c21a0bcab900f281dca4efbb1f80add0fe Author: Kenneth Feng Date: Mon Sep 6 07:55:01 2021 +0800 drm/amd/pm: fix the issue of uploading powerplay table fix the issue of uploading powerplay table due to the dependancy of rlc. Signed-off-by: Kenneth Feng Reviewed-by: Jack Gui Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 67a44e659888569a133a8f858c8230e9d7aad1d5 Author: Ernst Sjöstrand Date: Thu Sep 2 09:50:27 2021 +0200 drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 Seems like newer cards can have even more instances now. Found by UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:318:29 index 8 is out of range for type 'uint32_t *[8]' Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1697 Cc: stable@vger.kernel.org Signed-off-by: Ernst Sjöstrand Signed-off-by: Alex Deucher commit 2cc74e1ee31d00393b6698ec80b322fd26523da4 Author: Christoph Lameter Date: Wed Sep 8 13:43:28 2021 +0200 IB/cma: Do not send IGMP leaves for sendonly Multicast groups ROCE uses IGMP for Multicast instead of the native Infiniband system where joins are required in order to post messages on the Multicast group. On Ethernet one can send Multicast messages to arbitrary addresses without the need to subscribe to a group. So ROCE correctly does not send IGMP joins during rdma_join_multicast(). F.e. in cma_iboe_join_multicast() we see: if (addr->sa_family == AF_INET) { if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) { ib.rec.hop_limit = IPV6_DEFAULT_HOPLIMIT; if (!send_only) { err = cma_igmp_send(ndev, &ib.rec.mgid, true); } } } else { So the IGMP join is suppressed as it is unnecessary. However no such check is done in destroy_mc(). And therefore leaving a sendonly multicast group will send an IGMP leave. This means that the following scenario can lead to a multicast receiver unexpectedly being unsubscribed from a MC group: 1. Sender thread does a sendonly join on MC group X. No IGMP join is sent. 2. Receiver thread does a regular join on the same MC Group x. IGMP join is sent and the receiver begins to get messages. 3. Sender thread terminates and destroys MC group X. IGMP leave is sent and the receiver no longer receives data. This patch adds the same logic for sendonly joins to destroy_mc() that is also used in cma_iboe_join_multicast(). Fixes: ab15c95a17b3 ("IB/core: Support for CMA multicast join flags") Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2109081340540.668072@gentwo.de Signed-off-by: Christoph Lameter Signed-off-by: Jason Gunthorpe commit 356ed64991c6847a0c4f2e8fa3b1133f7a14f1fc Author: Hou Tao Date: Tue Sep 14 10:33:51 2021 +0800 bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog Currently if a function ptr in struct_ops has a return value, its caller will get a random return value from it, because the return value of related BPF_PROG_TYPE_STRUCT_OPS prog is just dropped. So adding a new flag BPF_TRAMP_F_RET_FENTRY_RET to tell bpf trampoline to save and return the return value of struct_ops prog if ret_size of the function ptr is greater than 0. Also restricting the flag to be used alone. Fixes: 85d33df357b6 ("bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS") Signed-off-by: Hou Tao Signed-off-by: Alexei Starovoitov Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20210914023351.3664499-1-houtao1@huawei.com commit 8b4bd256674720709a9d858a219fcac6f2f253b5 Author: Antoine Tenart Date: Thu Sep 9 10:56:12 2021 +0200 thermal/drivers/int340x: Do not set a wrong tcc offset on resume After upgrading to Linux 5.13.3 I noticed my laptop would shutdown due to overheat (when it should not). It turned out this was due to commit fe6a6de6692e ("thermal/drivers/int340x/processor_thermal: Fix tcc setting"). What happens is this drivers uses a global variable to keep track of the tcc offset (tcc_offset_save) and uses it on resume. The issue is this variable is initialized to 0, but is only set in tcc_offset_degree_celsius_store, i.e. when the tcc offset is explicitly set by userspace. If that does not happen, the resume path will set the offset to 0 (in my case the h/w default being 3, the offset would become too low after a suspend/resume cycle). The issue did not arise before commit fe6a6de6692e, as the function setting the offset would return if the offset was 0. This is no longer the case (rightfully). Fix this by not applying the offset if it wasn't saved before, reverting back to the old logic. A better approach will come later, but this will be easier to apply to stable kernels. The logic to restore the offset after a resume was there long before commit fe6a6de6692e, but as a value of 0 was considered invalid I'm referencing the commit that made the issue possible in the Fixes tag instead. Fixes: fe6a6de6692e ("thermal/drivers/int340x/processor_thermal: Fix tcc setting") Cc: stable@vger.kernel.org Cc: Srinivas Pandruvada Signed-off-by: Antoine Tenart Signed-off-by: Daniel Lezcano Reviewed-by: Srinivas Pandruvada Tested-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20210909085613.5577-2-atenart@kernel.org commit f60f5741002b9fde748cff65fd09bd6222c5db0c Author: Md Sadre Alam Date: Tue Sep 7 12:35:57 2021 +0530 mtd: rawnand: qcom: Update code word value for raw read From QPIC V2 onwards there is a separate register to read last code word "QPIC_NAND_READ_LOCATION_LAST_CW_n". qcom_nandc_read_cw_raw() is used to read only one code word at a time. If we will configure number of code words to 1 in in QPIC_NAND_DEV0_CFG0 register then QPIC controller thinks its reading the last code word, since from QPIC V2 onwards we are having separate register to read the last code word, we have to configure "QPIC_NAND_READ_LOCATION_LAST_CW_n" register to fetch data from controller buffer to system memory. Fixes: 503ee5aad430 ("mtd: rawnand: qcom: update last code word register") Cc: stable@kernel.org Signed-off-by: Md Sadre Alam Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/1630998357-1359-1-git-send-email-mdalam@codeaurora.org commit 6a4746ba06191e23d30230738e94334b26590a8a Author: Vasily Averin Date: Sat Sep 11 10:40:08 2021 +0300 ipc: remove memcg accounting for sops objects in do_semtimedop() Linus proposes to revert an accounting for sops objects in do_semtimedop() because it's really just a temporary buffer for a single semtimedop() system call. This object can consume up to 2 pages, syscall is sleeping one, size and duration can be controlled by user, and this allocation can be repeated by many thread at the same time. However Shakeel Butt pointed that there are much more popular objects with the same life time and similar memory consumption, the accounting of which was decided to be rejected for performance reasons. Considering at least 2 pages for task_struct and 2 pages for the kernel stack, a back of the envelope calculation gives a footprint amplification of <1.5 so this temporal buffer can be safely ignored. The factor would IMO be interesting if it was >> 2 (from the PoV of excessive (ab)use, fine-grained accounting seems to be currently unfeasible due to performance impact). Link: https://lore.kernel.org/lkml/90e254df-0dfe-f080-011e-b7c53ee7fd20@virtuozzo.com/ Fixes: 18319498fdd4 ("memcg: enable accounting of ipc resources") Signed-off-by: Vasily Averin Acked-by: Michal Hocko Reviewed-by: Michal Koutný Acked-by: Shakeel Butt Signed-off-by: Linus Torvalds commit 5d329e1286b0a040264e239b80257c937f6e685f Author: Jens Axboe Date: Tue Sep 14 11:08:37 2021 -0600 io_uring: allow retry for O_NONBLOCK if async is supported A common complaint is that using O_NONBLOCK files with io_uring can be a bit of a pain. Be a bit nicer and allow normal retry IFF the file does support async behavior. This makes it possible to use io_uring more reliably with O_NONBLOCK files, for use cases where it either isn't possible or feasible to modify the file flags. Cc: stable@vger.kernel.org Reported-and-tested-by: Dan Melnic Signed-off-by: Jens Axboe commit cdef1196608892b9a46caa5f2b64095a7f0be60c Author: James Morse Date: Tue Sep 14 16:56:23 2021 +0000 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables") kobject_put() has kfree()d the attr_set before gov_attr_set_put() returns. kobject_put() isn't the last user of attr_set in gov_attr_set_put(), the subsequent mutex_destroy() triggers a use-after-free: | BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60 | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20 | | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369 | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development | Platform, BIOS EDK II Jul 30 2018 | Call trace: | dump_backtrace+0x0/0x380 | show_stack+0x1c/0x30 | dump_stack_lvl+0x8c/0xb8 | print_address_description.constprop.0+0x74/0x2b8 | kasan_report+0x1f4/0x210 | kasan_check_range+0xfc/0x1a4 | __kasan_check_read+0x38/0x60 | mutex_is_locked+0x20/0x60 | mutex_destroy+0x80/0x100 | gov_attr_set_put+0xfc/0x150 | sugov_exit+0x78/0x190 | cpufreq_offline.isra.0+0x2c0/0x660 | cpuhp_cpufreq_offline+0x14/0x24 | cpuhp_invoke_callback+0x430/0x6d0 | cpuhp_thread_fun+0x1b0/0x624 | smpboot_thread_fn+0x5e0/0xa6c | kthread+0x3a0/0x450 | ret_from_fork+0x10/0x20 Swap the order of the calls. Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables") Cc: 4.7+ # 4.7+ Signed-off-by: James Morse Signed-off-by: Rafael J. Wysocki commit 7889367d7795b3b1766e33ac1ae8a5fbc292108b Author: Nathan Chancellor Date: Tue Aug 24 15:54:27 2021 -0700 drm/i915: Enable -Wsometimes-uninitialized This warning helps catch uninitialized variables. It should have been enabled at the same time as commit b2423184ac33 ("drm/i915: Enable -Wuninitialized") but I did not realize they were disabled separately. Enable it now that i915 is clean so that it stays that way. Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20210824225427.2065517-4-nathan@kernel.org (cherry picked from commit 43192617f7816bb74584c1df06f57363afd15337) Signed-off-by: Jani Nikula commit 347c4db2afc7f9cf536144d167579ccf1e9bf028 Author: Nathan Chancellor Date: Tue Aug 24 15:54:26 2021 -0700 drm/i915/selftests: Always initialize err in igt_dmabuf_import_same_driver_lmem() Clang warns: drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:127:13: warning: variable 'err' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] } else if (PTR_ERR(import) != -EOPNOTSUPP) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:138:9: note: uninitialized use occurs here return err; ^~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:127:9: note: remove the 'if' if its condition is always true } else if (PTR_ERR(import) != -EOPNOTSUPP) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:95:9: note: initialize the variable 'err' to silence this warning int err; ^ = 0 The test is expected to pass if i915_gem_prime_import() returns -EOPNOTSUPP so initialize err to zero in this case. Fixes: cdb35d1ed6d2 ("drm/i915/gem: Migrate to system at dma-buf attach time (v7)") Reported-by: Dan Carpenter Reviewed-by: Thomas Hellström Signed-off-by: Nathan Chancellor Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20210824225427.2065517-3-nathan@kernel.org (cherry picked from commit 46f20a353b80d02492655d99714f0566018a17e8) Signed-off-by: Jani Nikula commit 4ad3ea1c69354328edcccb83c8a4d7d2f55e3c6a Author: Nathan Chancellor Date: Tue Aug 24 15:54:25 2021 -0700 drm/i915/selftests: Do not use import_obj uninitialized Clang warns a couple of times: drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:63:6: warning: variable 'import_obj' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] if (import != &obj->base) { ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:80:22: note: uninitialized use occurs here i915_gem_object_put(import_obj); ^~~~~~~~~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:63:2: note: remove the 'if' if its condition is always false if (import != &obj->base) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:38:46: note: initialize the variable 'import_obj' to silence this warning struct drm_i915_gem_object *obj, *import_obj; ^ = NULL Shuffle the import_obj initialization above these if statements so that it is not used uninitialized. Fixes: d7b2cb380b3a ("drm/i915/gem: Correct the locking and pin pattern for dma-buf (v8)") Reported-by: Dan Carpenter Reviewed-by: Thomas Hellström Signed-off-by: Nathan Chancellor Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20210824225427.2065517-2-nathan@kernel.org (cherry picked from commit 4796054b381a586f4177a24e3d8b5a6a0a32ce62) Signed-off-by: Jani Nikula commit d0c624c03012e62ac36bf819dab120380a9ef415 Merge: 3f1c260ffddb7 4348cc10da637 Author: Arnd Bergmann Date: Tue Sep 14 18:35:12 2021 +0200 Merge tag 'at91-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes #1 for 5.15: - Fixes for newly introduced SAMA7G5 and its Power Management code. Associated core peripherals need to be instantiated in DT for benefiting from best PM support like Backup mode with DDR in Self-Refresh. - Add chip ID for SAMA7G5 for easing the kernel log identification. - Avoid Camera Sensor probe error on sama5d27 som1 ek board. * tag 'at91-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default ARM: at91: pm: switch backup area to vbat in backup mode ARM: dts: at91: sama7g5: add chipid ARM: dts: at91: sama7g5: add shdwc node ARM: dts: at91: sama7g5: add securam node ARM: dts: at91: sama7g5: add ram controllers ARM: at91: pm: do not panic if ram controllers are not enabled Link: https://lore.kernel.org/r/20210914162314.54347-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit 9c7b0ba887513b6681e7883d306df0a0fd580afa Author: Pavel Begunkov Date: Tue Sep 14 16:12:52 2021 +0100 io_uring: auto-removal for direct open/accept It might be inconvenient that direct open/accept deviates from the update semantics and fails if the slot is taken instead of removing a file sitting there. Implement this auto-removal. Note that removal might need to allocate and so may fail. However, if an empty slot is specified, it's guaraneed to not fail on the fd installation side for valid userspace programs. It's needed for users who can't tolerate such failures, e.g. accept where the other end never retries. Suggested-by: Franz-B. Tuneke Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c896f14ea46b0eaa6c09d93149e665c2c37979b4.1631632300.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 1619b69edce14c4a4665fa8ff4c587dcc77202a9 Author: Michael Ellerman Date: Tue Sep 14 22:17:23 2021 +1000 powerpc/boot: Fix build failure since GCC 4.9 removal Stephen reported that the build was broken since commit 6d2ef226f2f1 ("compiler_attributes.h: drop __has_attribute() support for gcc4"), with errors such as: include/linux/compiler_attributes.h:296:5: warning: "__has_attribute" is not defined, evaluates to 0 [-Wundef] 296 | #if __has_attribute(__warning__) | ^~~~~~~~~~~~~~~ make[2]: *** [arch/powerpc/boot/Makefile:225: arch/powerpc/boot/crt0.o] Error 1 But we expect __has_attribute() to always be defined now that we've stopped using GCC 4. Linus debugged it to the point of reading the GCC sources, and noticing that the problem is that __has_attribute() is not defined when preprocessing assembly files, which is what we're doing here. Our assembly files don't include, or need, compiler_attributes.h, but they are getting it unconditionally from the -include in BOOT_CFLAGS, which is then added in its entirety to BOOT_AFLAGS. That -include was added in commit 77433830ed16 ("powerpc: boot: include compiler_attributes.h") so that we'd have "fallthrough" and other attributes defined for the C files in arch/powerpc/boot. But it's not needed for assembly files. The minimal fix is to move the addition to BOOT_CFLAGS of -include compiler_attributes.h until after we've copied BOOT_CFLAGS into BOOT_AFLAGS. That avoids including compiler_attributes.h for asm files, but makes no other change to BOOT_CFLAGS or BOOT_AFLAGS. Reported-by: Stephen Rothwell Debugged-by: Linus Torvalds Signed-off-by: Michael Ellerman Tested-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 3f1c260ffddb7ea51d54c37343c6d500a10317eb Author: Romain Perier Date: Fri Sep 10 21:03:22 2021 +0200 MAINTAINERS: Add myself as MStar/Sigmastar Armv7 SoC maintainers As proposed by Daniel, I am going to help him to maintain the platform, so add myself as co-maintainer. Signed-off-by: Romain Perier Acked-by: Daniel Palmer Link: https://lore.kernel.org/r/20210910190322.27058-5-romain.perier@gmail.com' Signed-off-by: Arnd Bergmann commit 4348cc10da6377a86940beb20ad357933b8f91bb Author: Eugen Hristev Date: Thu Sep 2 15:13:58 2021 +0300 ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default Without a sensor node, the ISC will simply fail to probe, as the corresponding port node is missing. It is then logical to disable the node in the devicetree. If we add a port with a connection to a sensor endpoint, ISC can be enabled. Signed-off-by: Eugen Hristev Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210902121358.503589-1-eugen.hristev@microchip.com commit ac809e7879b15643105795a5f9becb5ef44abd93 Author: Claudiu Beznea Date: Mon Aug 30 13:09:27 2021 +0300 ARM: at91: pm: switch backup area to vbat in backup mode Backup area is now switched to VDDIN33 at boot (with the help of bootloader). When switching to backup mode we need to switch backup area to VBAT as all the other power sources are cut off. The resuming from backup mode is done with the help of bootloader, so there is no need to do something particular in Linux to restore backup area power source. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210830100927.22711-1-claudiu.beznea@microchip.com commit 6f34662284511a04643b25ad3032adc6fe4689ab Author: Claudiu Beznea Date: Wed Sep 8 12:43:29 2021 +0300 ARM: dts: at91: sama7g5: add chipid Add chipid node for sama7g5. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210908094329.182477-1-claudiu.beznea@microchip.com commit 16b161bcf5d491c7856effc16c8901984df4466a Author: Claudiu Beznea Date: Mon Aug 23 16:19:15 2021 +0300 ARM: dts: at91: sama7g5: add shdwc node Add shutdown controller node and enable it. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210823131915.23857-5-claudiu.beznea@microchip.com commit 2305d7ab661029f00ff49141b9ca90f736c1f9af Author: Claudiu Beznea Date: Mon Aug 23 16:19:14 2021 +0300 ARM: dts: at91: sama7g5: add securam node Add securam node. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210823131915.23857-4-claudiu.beznea@microchip.com commit 63a84d560e818f8a382a4a61bf1e59df43cdc06d Author: Claudiu Beznea Date: Mon Aug 23 16:19:13 2021 +0300 ARM: dts: at91: sama7g5: add ram controllers Add RAM and RAMC PHY controllers. These are necessary for platform specific power management code. Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210823131915.23857-3-claudiu.beznea@microchip.com commit 1605de1b3ca66e3eddbca4b3c353c13c26476fe2 Author: Claudiu Beznea Date: Mon Aug 23 16:19:12 2021 +0300 ARM: at91: pm: do not panic if ram controllers are not enabled In case PM is enabled but there is no RAM controller information in DT the code will panic. Avoid such scenarios by not initializing platform specific PM code in case RAM controller is not provided via DT. Reported-by: Eugen Hristev Fixes: 827de1f123ba0 ("ARM: at91: remove at91_dt_initialize and machine init_early()") Fixes: 892e1f4a3ae58 ("ARM: at91: pm: add sama7g5 ddr phy controller") Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20210823131915.23857-2-claudiu.beznea@microchip.com commit 44df58d441a94de40d52fca67dc60790daee4266 Author: Xiaoguang Wang Date: Tue Sep 14 22:38:52 2021 +0800 io_uring: fix missing sigmask restore in io_cqring_wait() Move get_timespec() section in io_cqring_wait() before the sigmask saving, otherwise we'll fail to restore sigmask once get_timespec() returns error. Fixes: c73ebb685fb6 ("io_uring: add timeout support for io_uring_enter()") Signed-off-by: Xiaoguang Wang Link: https://lore.kernel.org/r/20210914143852.9663-1-xiaoguang.wang@linux.alibaba.com Signed-off-by: Jens Axboe commit 8fb0f47a9d7acf620d0fd97831b69da9bc5e22ed Author: Jens Axboe Date: Fri Sep 10 11:18:36 2021 -0600 iov_iter: add helper to save iov_iter state In an ideal world, when someone is passed an iov_iter and returns X bytes, then X bytes would have been consumed/advanced from the iov_iter. But we have use cases that always consume the entire iterator, a few examples of that are iomap and bdev O_DIRECT. This means we cannot rely on the state of the iov_iter once we've called ->read_iter() or ->write_iter(). This would be easier if we didn't always have to deal with truncate of the iov_iter, as rewinding would be trivial without that. We recently added a commit to track the truncate state, but that grew the iov_iter by 8 bytes and wasn't the best solution. Implement a helper to save enough of the iov_iter state to sanely restore it after we've called the read/write iterator helpers. This currently only works for IOVEC/BVEC/KVEC as that's all we need, support for other iterator types are left as an exercise for the reader. Link: https://lore.kernel.org/linux-fsdevel/CAHk-=wiacKV4Gh-MYjteU0LwNBSGpWrK-Ov25HdqB1ewinrFPg@mail.gmail.com/ Signed-off-by: Jens Axboe commit 8c1768967e2733d55abf449d8abd6f1915ba3539 Author: Joel Stanley Date: Tue Jun 15 10:44:34 2021 +0930 ARM: config: mutli v7: Reenable FB dependency DRM_FBDEV_EMULATION previously selected FB and was default y as long as DRM was enabled. In commit f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") the select was replaced with a depends on FB, disabling the drivers that depended on it. Renable FB so we get back FB_EFI, FB_WM8505, FB_SH_MOBILE_LCDC, FB_SIMPLE and VIDEO_VIVID. It must be set to y and not a module as the test driver VIDEO_VIVID requires it to be built in. Link: https://lore.kernel.org/r/CAK8P3a18EdBKQdGDOZc9cPKsf=hY8==v2cO0DBE_tyd82Uq-Ng@mail.gmail.com Signed-off-by: Joel Stanley Reviewed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann commit cf8dd57bd0d62133e4ed9e1ad83af994fac34da5 Author: Joel Stanley Date: Tue Jun 15 10:44:33 2021 +0930 ARM: config: multi v7: Enable dependancies Some drivers have not been built as they gained dependencies in kconfig but those dependencies were not added to the defconfig. The MSM pinctrl drivers fell out of the defconfig as of commit be117ca32261 ("pinctrl: qcom: Kconfig: Rework PINCTRL_MSM to be a depenency rather then a selected config"). Add PINCTRL_MSM so these stay enabled. EDAC depends on RAS, so enable it to ensure the EDAC drivers stay enabled. Signed-off-by: Joel Stanley Reviewed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann commit d198b27762644c71362e43a7533f89c92b115bcf Author: Eric Dumazet Date: Mon Sep 13 22:18:51 2021 -0700 Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers"" This reverts commit d7807a9adf4856171f8441f13078c33941df48ab. As mentioned in https://lkml.org/lkml/2021/9/13/1819 5 years old commit 919483096bfe ("ipv4: fix memory leaks in ip_cmsg_send() callers") was a correct fix. ip_cmsg_send() can loop over multiple cmsghdr() If IP_RETOPTS has been successful, but following cmsghdr generates an error, we do not free ipc.ok If IP_RETOPTS is not successful, we have freed the allocated temporary space, not the one currently in ipc.opt. Sure, code could be refactored, but let's not bring back old bugs. Fixes: d7807a9adf48 ("Revert "ipv4: fix memory leaks in ip_cmsg_send() callers"") Signed-off-by: Eric Dumazet Cc: Yajun Deng Signed-off-by: David S. Miller commit 4f884f3962767877d7aabbc1ec124d2c307a4257 Author: zhenggy Date: Tue Sep 14 09:51:15 2021 +0800 tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() Commit 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit time") may directly retrans a multiple segments TSO/GSO packet without split, Since this commit, we can no longer assume that a retransmitted packet is a single segment. This patch fixes the tp->undo_retrans accounting in tcp_sacktag_one() that use the actual segments(pcount) of the retransmitted packet. Before that commit (10d3be569243), the assumption underlying the tp->undo_retrans-- seems correct. Fixes: 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit time") Signed-off-by: zhenggy Reviewed-by: Eric Dumazet Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Signed-off-by: David S. Miller commit 59583f747664046aaae5588d56d5954fab66cce8 Author: Andreas Larsson Date: Wed Sep 8 09:48:22 2021 +0200 sparc32: page align size in arch_dma_alloc Commit 53b7670e5735 ("sparc: factor the dma coherent mapping into helper") lost the page align for the calls to dma_make_coherent and srmmu_unmapiorange. The latter cannot handle a non page aligned len argument. Signed-off-by: Andreas Larsson Reviewed-by: Sam Ravnborg Signed-off-by: Christoph Hellwig commit 2865ba82476a6b2603db40cfc1c8c0831409fb41 Merge: 550ac9c1aaaaf 43d2b88c29f2d Author: David S. Miller Date: Tue Sep 14 13:09:54 2021 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2021-09-14 The following pull-request contains BPF updates for your *net* tree. We've added 7 non-merge commits during the last 13 day(s) which contain a total of 18 files changed, 334 insertions(+), 193 deletions(-). The main changes are: 1) Fix mmap_lock lockdep splat in BPF stack map's build_id lookup, from Yonghong Song. 2) Fix BPF cgroup v2 program bypass upon net_cls/prio activation, from Daniel Borkmann. 3) Fix kvcalloc() BTF line info splat on oversized allocation attempts, from Bixuan Cui. 4) Fix BPF selftest build of task_pt_regs test for arm64/s390, from Jean-Philippe Brucker. 5) Fix BPF's disasm.{c,h} to dual-license so that it is aligned with bpftool given the former is a build dependency for the latter, from Daniel Borkmann with ACKs from contributors. ==================== Signed-off-by: David S. Miller commit c8fee41957f036cbc8e840bd91e2087731df7f7e Author: Ofir Bitton Date: Sun Sep 12 15:49:00 2021 +0300 habanalabs: expose a single cs seq in staged submissions Staged submission consists of multiple command submissions. In order to be explicit, driver should return a single cs sequence for every cs in the submission, or else user may try to wait on an internal CS rather than waiting for the whole submission. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 42254c2a4991b98ca3f86040a1a7b7b32a0c8c4a Author: farah kassabri Date: Sun Sep 12 14:30:35 2021 +0300 habanalabs: fix wait offset handling Add handling for case where the user doesn't set wait offset, and keeps it as 0. In such a case the driver will decrement one from this zero value which will cause the code to wait for wrong number of signals. The solution is to treat this case as in legacy wait cs, and wait for the next signal. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 3d3200ae167ba048a29e0c815987a3fdc90fc8d2 Author: Ofir Bitton Date: Thu Sep 9 09:56:37 2021 +0300 habanalabs: rate limit multi CS completion errors As user can send wrong arguments to multi CS API, we rate limit the amount of errors dumped to dmesg, in addition we change the severity to warning. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 0a5ff77bf0a94468d541735f919a633f167787e9 Author: Oded Gabbay Date: Sun Sep 12 10:25:49 2021 +0300 habanalabs/gaudi: fix LBW RR configuration Couple of fixes to the LBW RR configuration: 1. Add missing configuration of the SM RR registers in the DMA_IF. 2. Remove HBW range that doesn't belong. 3. Add entire gap + DBG area, from end of TPC7 to end of entire DBG space. Signed-off-by: Oded Gabbay commit fcffb759f7d53b8e6c6e91804eec994205099dd3 Author: Colin Ian King Date: Fri Sep 3 09:02:03 2021 +0100 habanalabs: Fix spelling mistake "FEADBACK" -> "FEEDBACK" There is a spelling mistake in a literal string. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit d09ff62c820b5950ab9958e77620a8498efe9386 Author: Ofir Bitton Date: Thu Sep 2 09:47:53 2021 +0300 habanalabs: fail collective wait when not supported As collective wait operation is required only when NIC ports are available, we disable the option to submit a CS in case all the ports are disabled, which is the current situation in the upstream driver. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 3e08f157c2587fc7ada93abed41aae19bcbf8a6b Author: Omer Shpigelman Date: Wed Dec 30 08:05:18 2020 +0200 habanalabs/gaudi: use direct MSI in single mode Due to FLR scenario when running inside a VM, we must not use indirect MSI because it might cause some issues on VM destroy. In a VM we use single MSI mode in contrary to multi MSI mode which is used in bare-metal. Hence direct MSI should be used in single MSI mode only. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit beb71ee36e4de93c2b21d916fb94558333d99974 Author: farah kassabri Date: Wed Sep 1 15:48:04 2021 +0300 habanalabs: fix kernel OOPs related to staged cs In case of single staged cs with both first/last indications set, we reach a scenario where in cs_release function flow we don't cancel the TDR work before freeing the cs memory, this lead to kernel OOPs since when the timer expires the work pointer will be freed already. In addition treat wait encaps cs "not found" handle as "OK" for the user in order to keep the user interface for both legacy and encpas signal/wait features the same. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit d53c66594dc7606b191bb2976901a691d291a316 Author: Ofir Bitton Date: Mon Aug 30 15:02:09 2021 +0300 habanalabs: fix potential race in interrupt wait ioctl We have a potential race where a user interrupt can be received in between user thread value comparison and before request was added to wait list. This means that if no consecutive interrupt will be received, user thread will timeout and fail. The solution is to add the request to wait list before we perform the comparison. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 550ac9c1aaaaf51fd42e20d461f0b1cdbd55b3d2 Author: Eric Dumazet Date: Mon Sep 13 11:08:36 2021 -0700 net-caif: avoid user-triggerable WARN_ON(1) syszbot triggers this warning, which looks something we can easily prevent. If we initialize priv->list_field in chnl_net_init(), then always use list_del_init(), we can remove robust_list_del() completely. WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 robust_list_del net/caif/chnl_net.c:67 [inline] WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375 Modules linked in: CPU: 0 PID: 3233 Comm: syz-executor.3 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:robust_list_del net/caif/chnl_net.c:67 [inline] RIP: 0010:chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375 Code: 89 eb e8 3a a3 ba f8 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 bf 01 00 00 48 81 fb 00 14 4e 8d 48 8b 2b 75 d0 e8 17 a3 ba f8 <0f> 0b 5b 5d 41 5c 41 5d e9 0a a3 ba f8 4c 89 e3 e8 02 a3 ba f8 4c RSP: 0018:ffffc90009067248 EFLAGS: 00010202 RAX: 0000000000008780 RBX: ffffffff8d4e1400 RCX: ffffc9000fd34000 RDX: 0000000000040000 RSI: ffffffff88bb6e49 RDI: 0000000000000003 RBP: ffff88802cd9ee08 R08: 0000000000000000 R09: ffffffff8d0e6647 R10: ffffffff88bb6dc2 R11: 0000000000000000 R12: ffff88803791ae08 R13: dffffc0000000000 R14: 00000000e600ffce R15: ffff888073ed3480 FS: 00007fed10fa0700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2c322000 CR3: 00000000164a6000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: register_netdevice+0xadf/0x1500 net/core/dev.c:10347 ipcaif_newlink+0x4c/0x260 net/caif/chnl_net.c:468 __rtnl_newlink+0x106d/0x1750 net/core/rtnetlink.c:3458 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3506 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 __sys_sendto+0x21c/0x320 net/socket.c:2036 __do_sys_sendto net/socket.c:2048 [inline] __se_sys_sendto net/socket.c:2044 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: cc36a070b590 ("net-caif: add CAIF netdevice") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 1a913270e57a8e7f1e3789802f1f64e6d0654626 Author: Alexandru Tachici Date: Mon Sep 6 09:56:30 2021 +0300 iio: adc: ad7793: Fix IRQ flag In Sigma-Delta devices the SDO line is also used as an interrupt. Leaving IRQ on level instead of falling might trigger a sample read when the IRQ is enabled, as the SDO line is already low. Not sure if SDO line will always immediately go high in ad_sd_buffer_postenable before the IRQ is enabled. Also the datasheet seem to explicitly say the falling edge of the SDO should be used as an interrupt: >From the AD7793 datasheet: " The DOUT/RDY falling edge can be used as an interrupt to a processor" Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") Signed-off-by: Alexandru Tachici Cc: Link: https://lore.kernel.org/r/20210906065630.16325-4-alexandru.tachici@analog.com Signed-off-by: Jonathan Cameron commit e081102f3077aa716974ccebec97003c890d5641 Author: Alexandru Tachici Date: Mon Sep 6 09:56:29 2021 +0300 iio: adc: ad7780: Fix IRQ flag Correct IRQ flag here is falling. In Sigma-Delta devices the SDO line is also used as an interrupt. Leaving IRQ on level instead of falling might trigger a sample read when the IRQ is enabled, as the SDO line is already low. Not sure if SDO line will always immediately go high in ad_sd_buffer_postenable before the IRQ is enabled. Also the datasheet seem to explicitly say the falling edge of the SDO should be used as an interrupt: >From the AD7780 datasheet: " The DOUT/Figure 22 RDY falling edge can be used as an interrupt to a processor" Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") Signed-off-by: Alexandru Tachici Cc: Link: https://lore.kernel.org/r/20210906065630.16325-3-alexandru.tachici@analog.com Signed-off-by: Jonathan Cameron commit 89a86da5cb8e0ee153111fb68a719d31582c206b Author: Alexandru Tachici Date: Mon Sep 6 09:56:28 2021 +0300 iio: adc: ad7192: Add IRQ flag IRQ type in ad_sigma_delta_info struct was missing. In Sigma-Delta devices the SDO line is also used as an interrupt. Leaving IRQ on level instead of falling might trigger a sample read when the IRQ is enabled, as the SDO line is already low. Not sure if SDO line will always immediately go high in ad_sd_buffer_postenable before the IRQ is enabled. Also the datasheet seem to explicitly say the falling edge of the SDO should be used as an interrupt: >From the AD7192 datasheet: "The DOUT/RDY falling edge can be used as an interrupt to a processor," Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") Signed-off-by: Alexandru Tachici Cc: Link: https://lore.kernel.org/r/20210906065630.16325-2-alexandru.tachici@analog.com Signed-off-by: Jonathan Cameron commit eb795cd97365a3d3d9da3926d234a7bc32a3bb15 Author: Billy Tsai Date: Tue Aug 31 15:14:44 2021 +0800 iio: adc: aspeed: set driver data when adc probe. Fix the issue when adc remove will get the null driver data. Fixed: commit 573803234e72 ("iio: Aspeed ADC") Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20210831071458.2334-2-billy_tsai@aspeedtech.com Cc: Signed-off-by: Jonathan Cameron commit fa002b364981b49d04e818abbc06fd47a5ec7b51 Author: Yang Yingliang Date: Thu Aug 19 21:24:16 2021 +0800 iio: adc: rzg2l_adc: add missing clk_disable_unprepare() in rzg2l_adc_pm_runtime_resume() Add clk_disable_unprepare() on error path in rzg2l_adc_pm_runtime_resume(). Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20210819132416.175644-1-yangyingliang@huawei.com Signed-off-by: Jonathan Cameron commit f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 Author: Miquel Raynal Date: Wed Aug 18 13:11:25 2021 +0200 iio: adc: max1027: Fix the number of max1X31 channels The macro MAX1X29_CHANNELS() already calls MAX1X27_CHANNELS(). Calling MAX1X27_CHANNELS() before MAX1X29_CHANNELS() in the definition of MAX1X31_CHANNELS() declares the first 8 channels twice. So drop this extra call from the MAX1X31 channels list definition. Fixes: 7af5257d8427 ("iio: adc: max1027: Prepare the introduction of different resolutions") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Nuno Sá Link: https://lore.kernel.org/r/20210818111139.330636-3-miquel.raynal@bootlin.com Signed-off-by: Jonathan Cameron commit 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 Author: Miquel Raynal Date: Wed Aug 18 13:11:24 2021 +0200 iio: adc: max1027: Fix wrong shift with 12-bit devices 10-bit devices must shift the value twice. This is not needed anymore on 12-bit devices. Fixes: ae47d009b508 ("iio: adc: max1027: Introduce 12-bit devices support") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Nuno Sá Link: https://lore.kernel.org/r/20210818111139.330636-2-miquel.raynal@bootlin.com Signed-off-by: Jonathan Cameron commit bbcf40816b547b3c37af49168950491d20d81ce1 Author: Christophe JAILLET Date: Sat Aug 21 12:37:24 2021 +0200 iio: adc128s052: Fix the error handling path of 'adc128_probe()' A successful 'regulator_enable()' call should be balanced by a corresponding 'regulator_disable()' call in the error handling path of the probe, as already done in the remove function. Update the error handling path accordingly. Fixes: 913b86468674 ("iio: adc: Add TI ADC128S052") Signed-off-by: Christophe JAILLET Reviewed-by: Alexandru Ardelean Link: https://lore.kernel.org/r/85189f1cfcf6f5f7b42d8730966f2a074b07b5f5.1629542160.git.christophe.jaillet@wanadoo.fr Cc: Signed-off-by: Jonathan Cameron commit 9909a395e9807aa79145c9289d0c13d0133359a2 Author: Colin Ian King Date: Tue Aug 17 18:21:11 2021 +0100 iio: adc: rzg2l_adc: Fix -EBUSY timeout error return Currently when a timeout occurs in rzg2l_adc_hw_init the error -EBUSY is assigned to ret but the error code is used as the function is hard-coded to return 0. The variable ret is 0 before entering the while-loop hence the fix is just to return ret at the end of the function to return the success 0 or -EBUSY return code. Addresses-Coverity: ("Unused value") Fixes: d484c21bacfa ("iio: adc: Add driver for Renesas RZ/G2L A/D converter") Signed-off-by: Colin Ian King Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20210817172111.495897-1-colin.king@canonical.com Signed-off-by: Jonathan Cameron commit 9033c7a357481fb5bcc1737bafa4aec572dca5c6 Author: Sean Nyekjaer Date: Tue Aug 17 14:43:36 2021 +0200 iio: accel: fxls8962af: return IRQ_HANDLED when fifo is flushed fxls8962af_fifo_flush() will return the samples flushed. So return IRQ_NONE only if an error is returned. Fixes: 79e3a5bdd9ef ("iio: accel: fxls8962af: add hw buffered sampling") Signed-off-by: Sean Nyekjaer Link: https://lore.kernel.org/r/20210817124336.1672169-1-sean@geanix.com Cc: Signed-off-by: Jonathan Cameron commit f7a28df7db84eb3410e9eca37832efa5aed93338 Author: Dan Carpenter Date: Mon Aug 16 21:39:54 2021 +0300 iio: dac: ti-dac5571: fix an error code in probe() If we have an unexpected number of channels then return -EINVAL instead of returning success. Fixes: df38a4a72a3b ("iio: dac: add TI DAC5571 family support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210816183954.GB2068@kili Signed-off-by: Jonathan Cameron commit 2e9edc07df2ec6f835222151fa4e536e9e54856a Author: Rob Herring Date: Thu Aug 19 13:42:38 2021 -0500 arm: dts: vexpress-v2p-ca9: Fix the SMB unit-address Based on 'ranges', the 'bus@4000000' node unit-address is off by 1 '0'. Link: https://lore.kernel.org/r/20210819184239.1192395-5-robh@kernel.org Cc: Andre Przywara Cc: Sudeep Holla Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Rob Herring Signed-off-by: Sudeep Holla commit 55c71dc69ecb328e6212ac5154099c4230d0b83f Author: Rob Herring Date: Thu Aug 19 13:42:37 2021 -0500 arm: dts: vexpress: Drop unused properties from motherboard node Drop the '#interrupt-cells' property in the motherboard node which has no effect as the node is neither an interrupt-controller or interrupt-map (that's in the parent node). Drop 'model' as it is not used by software nor documented. Drop 'arm,v2m-memory-map' as it is not used by software. The purpose was to describe which memory map, but that's all described by the DT already. Link: https://lore.kernel.org/r/20210819184239.1192395-4-robh@kernel.org Cc: Andre Przywara Cc: Sudeep Holla Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Rob Herring Signed-off-by: Sudeep Holla commit 217cb530a30a157153878c89cfee0764a66378ec Author: Krzysztof Kozlowski Date: Fri Aug 20 10:17:33 2021 +0200 arm64: dts: arm: drop unused interrupt-names in MHU The arm,mhu bindings and driver do not define interrupt-names, so drop the property to fix warnings: arch/arm64/boot/dts/arm/juno-r2.dt.yaml: mhu@2b1f0000: 'interrupt-names' does not match any of the regexes: 'pinctrl-[0-9]+' Link: https://lore.kernel.org/r/20210820081733.83976-3-krzysztof.kozlowski@canonical.com Acked-by: Liviu Dudau Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sudeep Holla commit 5f741ef384d3cfb9967029d335a3f7c45f4ffc55 Author: Krzysztof Kozlowski Date: Fri Aug 20 10:17:32 2021 +0200 ARM: dts: arm: align watchdog and mmc node names with dtschema Align the watchdog and mmc device node names with the schema to fix warnings like: mmci@50000: $nodename:0: 'mmci@50000' does not match '^mmc(@.*)?$' wdt@f0000: $nodename:0: 'wdt@f0000' does not match '^watchdog(@.*|-[0-9a-f])?$' Link: https://lore.kernel.org/r/20210820081733.83976-2-krzysztof.kozlowski@canonical.com Acked-by: Liviu Dudau Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sudeep Holla commit b43446b4f5ffb70cd7459728ec805a9d3438b8e2 Author: Krzysztof Kozlowski Date: Fri Aug 20 10:17:31 2021 +0200 arm64: dts: arm: align watchdog and mmc node names with dtschema Align the watchdog and mmc device node names with the schema to fix warnings like: mmci@50000: $nodename:0: 'mmci@50000' does not match '^mmc(@.*)?$' wdt@f0000: $nodename:0: 'wdt@f0000' does not match '^watchdog(@.*|-[0-9a-f])?$' Link: https://lore.kernel.org/r/20210820081733.83976-1-krzysztof.kozlowski@canonical.com Acked-by: Liviu Dudau Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sudeep Holla commit 3c3c8e88c8712bfe06cd10d7ca77a94a33610cd6 Author: Mario Limonciello Date: Mon Sep 13 21:01:14 2021 -0500 platform/x86: amd-pmc: Increase the response register timeout There have been reports of approximately a 0.9%-1.7% failure rate in SMU communication timeouts with s0i3 entry on some OEM designs. Currently the design in amd-pmc is to try every 100us for up to 20ms. However the GPU driver which also communicates with the SMU using a mailbox register which the driver polls every 1us for up to 2000ms. In the GPU driver this was increased by commit 055162645a40 ("drm/amd/pm: increase time out value when sending msg to SMU") Increase the maximum timeout used by amd-pmc to 2000ms to match this behavior. This has been shown to improve the stability for machines that randomly have failures. Cc: stable@kernel.org Reported-by: Julian Sikorski BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1629 Signed-off-by: Mario Limonciello Acked-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20210914020115.655-1-mario.limonciello@amd.com Signed-off-by: Hans de Goede commit 25a1433216489de4abc889910f744e952cb6dbae Author: Dan Carpenter Date: Mon Sep 6 21:35:48 2021 +0900 mcb: fix error handling in mcb_alloc_bus() There are two bugs: 1) If ida_simple_get() fails then this code calls put_device(carrier) but we haven't yet called get_device(carrier) and probably that leads to a use after free. 2) After device_initialize() then we need to use put_device() to release the bus. This will free the internal resources tied to the device and call mcb_free_bus() which will free the rest. Fixes: 5d9e2ab9fea4 ("mcb: Implement bus->dev.release callback") Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/32e160cf6864ce77f9d62948338e24db9fd8ead9.1630931319.git.johannes.thumshirn@wdc.com Signed-off-by: Greg Kroah-Hartman commit 7049d853cfb928f50b6041cb4a5c6d6c1d8dd201 Author: Jiri Slaby Date: Tue Sep 14 11:11:19 2021 +0200 tty: unexport tty_ldisc_release Initially, tty_ldisc_release() was exported for speakup (spk_tty) while in staging. Later, the call to this function was removed as it was bogus anyway. Remove the export now. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20210914091134.17426-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit da546d6b748e570aa6e44acaa515cfc43baeaa0d Author: Robert Marko Date: Fri Sep 3 00:03:25 2021 +0200 arm64: dts: qcom: ipq8074: remove USB tx-fifo-resize property tx-fifo-resize is now added by default by the dwc3-qcom driver to the SNPS DWC3 child node. So, lets drop the tx-fifo-resize property from dwc3-qcom nodes as having it there will cause the dwc3-qcom driver to error and abort probe with: [ 1.362938] dwc3-qcom 8af8800.usb: unable to add property [ 1.368405] dwc3-qcom 8af8800.usb: failed to register DWC3 Core, err=-17 Fixes: cefdd52fa045 ("usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default") Signed-off-by: Robert Marko Link: https://lore.kernel.org/r/20210902220325.1783567-1-robimarko@gmail.com Signed-off-by: Greg Kroah-Hartman commit ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 Author: Cameron Berkenpas Date: Mon Sep 13 14:26:29 2021 -0700 ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops. This patch initializes and enables speaker output on the Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 series of laptops using the HDA verb sequence specific to each model. Speaker automute is suppressed for the Lenovo Legion 7i 15IMHG05 to avoid breaking speaker output on resume and when devices are unplugged from its headphone jack. Thanks to: Andreas Holzer, Vincent Morel, sycxyc, Max Christian Pohle and all others that helped. [ minor coding style fixes by tiwai ] BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555 Signed-off-by: Cameron Berkenpas Cc: Link: https://lore.kernel.org/r/20210913212627.339362-1-cam@neo-zeon.de Signed-off-by: Takashi Iwai commit 06e49073dfba24df4b1073a068631b13a0039c34 Author: Randy Dunlap Date: Wed Sep 1 17:38:06 2021 -0700 tty: synclink_gt: rename a conflicting function name 'set_signals()' in synclink_gt.c conflicts with an exported symbol in arch/um/, so change set_signals() to set_gtsignals(). Keep the function names similar by also changing get_signals() to get_gtsignals(). ../drivers/tty/synclink_gt.c:442:13: error: conflicting types for ‘set_signals’ static void set_signals(struct slgt_info *info); ^~~~~~~~~~~ In file included from ../include/linux/irqflags.h:16:0, from ../include/linux/spinlock.h:58, from ../include/linux/mm_types.h:9, from ../include/linux/buildid.h:5, from ../include/linux/module.h:14, from ../drivers/tty/synclink_gt.c:46: ../arch/um/include/asm/irqflags.h:6:5: note: previous declaration of ‘set_signals’ was here int set_signals(int enable); ^~~~~~~~~~~ Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt") Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Paul Fulghum Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20210902003806.17054-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 8d753db5c227d1f403c4bc9cae4ae02c862413cd Author: Christophe JAILLET Date: Wed Sep 8 21:55:56 2021 +0200 misc: genwqe: Fixes DMA mask setting Commit 505b08777d78 ("misc: genwqe: Use dma_set_mask_and_coherent to simplify code") changed the logic in the code. Instead of a ||, a && should have been used to keep the code the same. Fixes: 505b08777d78 ("misc: genwqe: Use dma_set_mask_and_coherent to simplify code") Cc: stable Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/be49835baa8ba6daba5813b399edf6300f7fdbda.1631130862.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit f0e8a206a2a53a919e1709c654cb65d519f7befb Author: Jack Pham Date: Thu Sep 9 10:48:11 2021 -0700 usb: gadget: f_uac2: Populate SS descriptors' wBytesPerInterval For Isochronous endpoints, the SS companion descriptor's wBytesPerInterval field is required to reserve bus time in order to transmit the required payload during the service interval. If left at 0, the UAC2 function is unable to transact data on its playback or capture endpoints in SuperSpeed mode. Since f_uac2 currently does not support any bursting this value can be exactly equal to the calculated wMaxPacketSize. Tested with Windows 10 as a host. Fixes: f8cb3d556be3 ("usb: f_uac2: adds support for SS and SSP") Cc: stable Signed-off-by: Jack Pham Link: https://lore.kernel.org/r/20210909174811.12534-3-jackp@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit 595091a1426a3b2625dad322f69fe569dc9d8943 Author: Jack Pham Date: Thu Sep 9 10:48:10 2021 -0700 usb: gadget: f_uac2: Add missing companion descriptor for feedback EP The f_uac2 function fails to enumerate when connected in SuperSpeed due to the feedback endpoint missing the companion descriptor. Add a new ss_epin_fback_desc_comp descriptor and append it behind the ss_epin_fback_desc both in the static definition of the ss_audio_desc structure as well as its dynamic construction in setup_headers(). Fixes: 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add feedback endpoint support") Cc: stable Signed-off-by: Jack Pham Link: https://lore.kernel.org/r/20210909174811.12534-2-jackp@codeaurora.org Signed-off-by: Greg Kroah-Hartman commit dbe2518b2d8eabffa74dbf7d9fdd7dacddab7fc0 Author: Minas Harutyunyan Date: Sat Sep 11 22:58:30 2021 +0400 usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA When last descriptor in a descriptor list completed with XferComplete interrupt, core switching to handle next descriptor and assert BNA interrupt. Both these interrupts are set while dwc2_hsotg_epint() handler called. Each interrupt should be handled separately: first XferComplete interrupt then BNA interrupt, otherwise last completed transfer will not be giveback to function driver as completed request. Fixes: 729cac693eec ("usb: dwc2: Change ISOC DDMA flow") Cc: stable Signed-off-by: Minas Harutyunyan Link: https://lore.kernel.org/r/a36981accc26cd674c5d8f8da6164344b94ec1fe.1631386531.git.Minas.Harutyunyan@synopsys.com Signed-off-by: Greg Kroah-Hartman commit 5cf86349e98b14f505f83aae45a6df2bacc15a7a Author: Kishon Vijay Abraham I Date: Thu Sep 9 12:12:00 2021 +0530 usb: core: hcd: Modularize HCD stop configuration in usb_stop_hcd() No functional change. Since configuration to stop HCD is invoked from multiple places, group all of them in usb_stop_hcd(). Tested-by: Chris Chiu Acked-by: Alan Stern Signed-off-by: Kishon Vijay Abraham I Link: https://lore.kernel.org/r/20210909064200.16216-4-kishon@ti.com Signed-off-by: Greg Kroah-Hartman commit b7a0a792f864583207c593b50fd1b752ed89f4c1 Author: Kishon Vijay Abraham I Date: Thu Sep 9 12:11:59 2021 +0530 xhci: Set HCD flag to defer primary roothub registration Set "HCD_FLAG_DEFER_RH_REGISTER" to hcd->flags in xhci_run() to defer registering primary roothub in usb_add_hcd(). This will make sure both primary roothub and secondary roothub will be registered along with the second HCD. This is required for cold plugged USB devices to be detected in certain PCIe USB cards (like Inateck USB card connected to AM64 EVM or J7200 EVM). CC: stable@vger.kernel.org # 5.4+ Suggested-by: Mathias Nyman Tested-by: Chris Chiu Signed-off-by: Kishon Vijay Abraham I Link: https://lore.kernel.org/r/20210909064200.16216-3-kishon@ti.com Signed-off-by: Greg Kroah-Hartman commit 58877b0824da15698bd85a0a9dbfa8c354e6ecb7 Author: Kishon Vijay Abraham I Date: Thu Sep 9 12:11:58 2021 +0530 usb: core: hcd: Add support for deferring roothub registration It has been observed with certain PCIe USB cards (like Inateck connected to AM64 EVM or J7200 EVM) that as soon as the primary roothub is registered, port status change is handled even before xHC is running leading to cold plug USB devices not detected. For such cases, registering both the root hubs along with the second HCD is required. Add support for deferring roothub registration in usb_add_hcd(), so that both primary and secondary roothubs are registered along with the second HCD. CC: stable@vger.kernel.org # 5.4+ Suggested-by: Mathias Nyman Tested-by: Chris Chiu Acked-by: Alan Stern Signed-off-by: Kishon Vijay Abraham I Link: https://lore.kernel.org/r/20210909064200.16216-2-kishon@ti.com Signed-off-by: Greg Kroah-Hartman commit 91bb163e1e4f88092f50dfaa5a816b658753e4b2 Author: Minas Harutyunyan Date: Thu Sep 9 14:45:15 2021 +0400 usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave According USB spec each ISOC transaction should be performed in a designated for that transaction interval. On bus errors or delays in operating system scheduling of client software can result in no packet being transferred for a (micro)frame. An error indication should be returned as status to the client software in such a case. Current implementation in case of missed/dropped interval send same data in next possible interval instead of reporting missed isoc. This fix complete requests with -ENODATA if interval elapsed. HSOTG core in BDMA and Slave modes haven't HW support for (micro)frames tracking, this is why SW should care about tracking of (micro)frames. Because of that method and consider operating system scheduling delays, added few additional checking's of elapsed target (micro)frame: 1. Immediately before enabling EP to start transfer. 2. With any transfer completion interrupt. 3. With incomplete isoc in/out interrupt. 4. With EP disabled interrupt because of incomplete transfer. 5. With OUT token received while EP disabled interrupt (for OUT transfers). 6. With NAK replied to IN token interrupt (for IN transfers). As part of ISOC flow, additionally fixed 'current' and 'target' frame calculation functions. In HS mode SOF limits provided by DSTS register is 0x3fff, but in non HS mode this limit is 0x7ff. Tested by internal tool which also using for dwc3 testing. Signed-off-by: Minas Harutyunyan Cc: stable Link: https://lore.kernel.org/r/95d1423adf4b0f68187c9894820c4b7e964a3f7f.1631175721.git.Minas.Harutyunyan@synopsys.com Signed-off-by: Greg Kroah-Hartman commit 8cfac9a6744fcb143cb3e94ce002f09fd17fadbb Author: Li Jun Date: Wed Sep 8 10:28:19 2021 +0800 usb: dwc3: core: balance phy init and exit After we start to do core soft reset while usb role switch, the phy init is invoked at every switch to device mode, but its counter part de-init is missing, this causes the actual phy init can not be done when we really want to re-init phy like system resume, because the counter maintained by phy core is not 0. considering phy init is actually redundant for role switch, so move out the phy init from core soft reset to dwc3 core init where is the only place required. Fixes: f88359e1588b ("usb: dwc3: core: Do core softreset when switch mode") Cc: Tested-by: faqiang.zhu Tested-by: John Stultz #HiKey960 Acked-by: Felipe Balbi Signed-off-by: Li Jun Link: https://lore.kernel.org/r/1631068099-13559-1-git-send-email-jun.li@nxp.com Signed-off-by: Greg Kroah-Hartman commit d91adc5322ab53df4b6d1989242bfb6c63163eb2 Author: Rafał Miłecki Date: Tue Aug 31 08:54:19 2021 +0200 Revert "USB: bcma: Add a check for devm_gpiod_get" This reverts commit f3de5d857bb2362b00e2a8d4bc886cd49dcb66db. That commit broke USB on all routers that have USB always powered on and don't require toggling any GPIO. It's a majority of devices actually. The original code worked and seemed safe: vcc GPIO is optional and bcma_hci_platform_power_gpio() takes care of checking the pointer before using it. This revert fixes: [ 10.801127] bcma_hcd: probe of bcma0:11 failed with error -2 Fixes: f3de5d857bb2 ("USB: bcma: Add a check for devm_gpiod_get") Cc: stable Cc: Chuhong Yuan Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20210831065419.18371-1-zajec5@gmail.com Signed-off-by: Greg Kroah-Hartman commit aad06846a2304e48e7a223fad8971eed16179606 Author: Guenter Roeck Date: Tue Sep 7 05:30:02 2021 -0700 usb: ehci: Simplify platform driver registration Use platform_register_drivers() and platform_unregister_drivers() to register and unregister ehci platform drivers. This simplifies the code and prevents the following build errors seen with sparc:allmodconfig. drivers/usb/host/ehci-hcd.c:1301: error: "PLATFORM_DRIVER" redefined drivers/usb/host/ehci-sh.c:173:31: error: 'ehci_hcd_sh_driver' defined but not used Acked-by: Alan Stern Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20210907123002.3951446-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman commit 91fac0741d4817945c6ee0a17591421e7f5ecb86 Author: Johan Hovold Date: Tue Sep 7 10:23:18 2021 +0200 USB: cdc-acm: fix minor-number release If the driver runs out of minor numbers it would release minor 0 and allow another device to claim the minor while still in use. Fortunately, registering the tty class device of the second device would fail (with a stack dump) due to the sysfs name collision so no memory is leaked. Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail") Cc: stable@vger.kernel.org # 4.19 Cc: Jaejoong Kim Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210907082318.7757-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 856e6e8e0f9300befa87dde09edb578555c99a82 Author: Yang Yingliang Date: Tue Aug 31 16:42:36 2021 +0800 usb: dwc2: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20210831084236.1359677-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit b69ec50b3e55c4b2a85c8bc46763eaf330605847 Author: Pawel Laszczak Date: Tue Sep 7 08:26:19 2021 +0200 usb: cdns3: fix race condition before setting doorbell For DEV_VER_V3 version there exist race condition between clearing ep_sts.EP_STS_TRBERR and setting ep_cmd.EP_CMD_DRDY bit. Setting EP_CMD_DRDY will be ignored by controller when EP_STS_TRBERR is set. So, between these two instructions we have a small time gap in which the EP_STSS_TRBERR can be set. In such case the transfer will not start after setting doorbell. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: # 5.12.x Tested-by: Aswath Govindraju Reviewed-by: Aswath Govindraju Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20210907062619.34622-1-pawell@gli-login.cadence.com Signed-off-by: Greg Kroah-Hartman commit 17956b53ebff6a490baf580a836cbd3eae94892b Author: Dan Carpenter Date: Mon Sep 6 12:42:21 2021 +0300 usb: gadget: r8a66597: fix a loop in set_feature() This loop is supposed to loop until if reads something other than CS_IDST or until it times out after 30,000 attempts. But because of the || vs && bug, it will never time out and instead it will loop a minimum of 30,000 times. This bug is quite old but the code is only used in USB_DEVICE_TEST_MODE so it probably doesn't affect regular usage. Fixes: 96fe53ef5498 ("usb: gadget: r8a66597-udc: add support for TEST_MODE") Cc: stable Reviewed-by: Yoshihiro Shimoda Acked-by: Felipe Balbi Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210906094221.GA10957@kili Signed-off-by: Greg Kroah-Hartman commit f5dfd98a80ff8d50cf4ae2820857d7f5a46cbab9 Author: Pavel Hofman Date: Mon Sep 6 15:08:22 2021 +0200 usb: gadget: u_audio: EP-OUT bInterval in fback frequency The patch increases the bitshift in feedback frequency calculation with EP-OUT bInterval value. Tests have revealed that Win10 and OSX UAC2 drivers require the feedback frequency to be based on the actual packet interval instead of on the USB2 microframe. Otherwise they ignore the feedback value. Linux snd-usb-audio driver detects the applied bitshift automatically. Tested-by: Henrik Enquist Signed-off-by: Pavel Hofman Cc: stable Link: https://lore.kernel.org/r/20210906130822.12256-1-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman commit 70f437fb4395ad4d1d16fab9a1ad9fbc9fc0579b Author: Keith Busch Date: Thu Sep 9 08:54:52 2021 -0700 nvme-tcp: fix io_work priority inversion Dispatching requests inline with the .queue_rq() call may block while holding the send_mutex. If the tcp io_work also happens to schedule, it may see the req_list is non-empty, leaving "pending" true and remaining in TASK_RUNNING. Since io_work is of higher scheduling priority, the .queue_rq task may not get a chance to run, blocking forward progress and leading to io timeouts. Instead of checking for pending requests within io_work, let the queueing restart io_work outside the send_mutex lock if there is more work to be done. Fixes: a0fdd1418007f ("nvme-tcp: rerun io_work if req_list is not empty") Reported-by: Samuel Jones Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 9817d763dbe15327b9b3ff4404fa6f27f927e744 Author: Ruozhu Li Date: Mon Sep 6 11:51:34 2021 +0800 nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. Signed-off-by: Ruozhu Li Reviewed-by: Max Gurtovoy Signed-off-by: Christoph Hellwig commit 79f528afa93918519574773ea49a444c104bc1bd Author: Anton Eidelman Date: Sun Sep 12 12:54:57 2021 -0600 nvme-multipath: fix ANA state updates when a namespace is not present nvme_update_ana_state() has a deficiency that results in a failure to properly update the ana state for a namespace in the following case: NSIDs in ctrl->namespaces: 1, 3, 4 NSIDs in desc->nsids: 1, 2, 3, 4 Loop iteration 0: ns index = 0, n = 0, ns->head->ns_id = 1, nsid = 1, MATCH. Loop iteration 1: ns index = 1, n = 1, ns->head->ns_id = 3, nsid = 2, NO MATCH. Loop iteration 2: ns index = 2, n = 2, ns->head->ns_id = 4, nsid = 4, MATCH. Where the update to the ANA state of NSID 3 is missed. To fix this increment n and retry the update with the same ns when ns->head->ns_id is higher than nsid, Signed-off-by: Anton Eidelman Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit f81c08f897adafd2ed43f86f00207ff929f0b2eb Author: Faizel K B Date: Thu Sep 2 17:14:44 2021 +0530 usb: testusb: Fix for showing the connection speed testusb' application which uses 'usbtest' driver reports 'unknown speed' from the function 'find_testdev'. The variable 'entry->speed' was not updated from the application. The IOCTL mentioned in the FIXME comment can only report whether the connection is low speed or not. Speed is read using the IOCTL USBDEVFS_GET_SPEED which reports the proper speed grade. The call is implemented in the function 'handle_testdev' where the file descriptor was availble locally. Sample output is given below where 'high speed' is printed as the connected speed. sudo ./testusb -a high speed /dev/bus/usb/001/011 0 /dev/bus/usb/001/011 test 0, 0.000015 secs /dev/bus/usb/001/011 test 1, 0.194208 secs /dev/bus/usb/001/011 test 2, 0.077289 secs /dev/bus/usb/001/011 test 3, 0.170604 secs /dev/bus/usb/001/011 test 4, 0.108335 secs /dev/bus/usb/001/011 test 5, 2.788076 secs /dev/bus/usb/001/011 test 6, 2.594610 secs /dev/bus/usb/001/011 test 7, 2.905459 secs /dev/bus/usb/001/011 test 8, 2.795193 secs /dev/bus/usb/001/011 test 9, 8.372651 secs /dev/bus/usb/001/011 test 10, 6.919731 secs /dev/bus/usb/001/011 test 11, 16.372687 secs /dev/bus/usb/001/011 test 12, 16.375233 secs /dev/bus/usb/001/011 test 13, 2.977457 secs /dev/bus/usb/001/011 test 14 --> 22 (Invalid argument) /dev/bus/usb/001/011 test 17, 0.148826 secs /dev/bus/usb/001/011 test 18, 0.068718 secs /dev/bus/usb/001/011 test 19, 0.125992 secs /dev/bus/usb/001/011 test 20, 0.127477 secs /dev/bus/usb/001/011 test 21 --> 22 (Invalid argument) /dev/bus/usb/001/011 test 24, 4.133763 secs /dev/bus/usb/001/011 test 27, 2.140066 secs /dev/bus/usb/001/011 test 28, 2.120713 secs /dev/bus/usb/001/011 test 29, 0.507762 secs Signed-off-by: Faizel K B Link: https://lore.kernel.org/r/20210902114444.15106-1-faizel.kb@dicortech.com Signed-off-by: Greg Kroah-Hartman commit 844f7eaaed9267ae17d33778efe65548cc940205 Author: Eugene Syromiatnikov Date: Sun Sep 12 14:22:34 2021 +0200 include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage Commit 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") broke ABI by changing the value of the XFRM_MSG_MAPPING enum item, thus also evading the build-time check in security/selinux/nlmsgtab.c:selinux_nlmsg_lookup for presence of proper security permission checks in nlmsg_xfrm_perms. Fix it by placing XFRM_MSG_SETDEFAULT/XFRM_MSG_GETDEFAULT to the end of the enum, right before __XFRM_MSG_MAX, and updating the nlmsg_xfrm_perms accordingly. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") References: https://lore.kernel.org/netdev/20210901151402.GA2557@altlinux.org/ Signed-off-by: Eugene Syromiatnikov Acked-by: Antony Antony Acked-by: Nicolas Dichtel Signed-off-by: Steffen Klassert commit 81065b35e2486c024c7aa86caed452e1f01a59d4 Author: Tony Luck Date: Mon Sep 13 14:52:39 2021 -0700 x86/mce: Avoid infinite loop for copy from user recovery There are two cases for machine check recovery: 1) The machine check was triggered by ring3 (application) code. This is the simpler case. The machine check handler simply queues work to be executed on return to user. That code unmaps the page from all users and arranges to send a SIGBUS to the task that triggered the poison. 2) The machine check was triggered in kernel code that is covered by an exception table entry. In this case the machine check handler still queues a work entry to unmap the page, etc. but this will not be called right away because the #MC handler returns to the fix up code address in the exception table entry. Problems occur if the kernel triggers another machine check before the return to user processes the first queued work item. Specifically, the work is queued using the ->mce_kill_me callback structure in the task struct for the current thread. Attempting to queue a second work item using this same callback results in a loop in the linked list of work functions to call. So when the kernel does return to user, it enters an infinite loop processing the same entry for ever. There are some legitimate scenarios where the kernel may take a second machine check before returning to the user. 1) Some code (e.g. futex) first tries a get_user() with page faults disabled. If this fails, the code retries with page faults enabled expecting that this will resolve the page fault. 2) Copy from user code retries a copy in byte-at-time mode to check whether any additional bytes can be copied. On the other side of the fence are some bad drivers that do not check the return value from individual get_user() calls and may access multiple user addresses without noticing that some/all calls have failed. Fix by adding a counter (current->mce_count) to keep track of repeated machine checks before task_work() is called. First machine check saves the address information and calls task_work_add(). Subsequent machine checks before that task_work call back is executed check that the address is in the same page as the first machine check (since the callback will offline exactly one page). Expected worst case is four machine checks before moving on (e.g. one user access with page faults disabled, then a repeat to the same address with page faults enabled ... repeat in copy tail bytes). Just in case there is some code that loops forever enforce a limit of 10. [ bp: Massage commit message, drop noinstr, fix typo, extend panic messages. ] Fixes: 5567d11c21a1 ("x86/mce: Send #MC singal from task work") Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Cc: Link: https://lkml.kernel.org/r/YT/IJ9ziLqmtqEPu@agluck-desk2.amr.corp.intel.com commit 13be2efc390acd2a46a69a359f6efc00ca434599 Author: Chris Wilson Date: Fri Mar 5 12:21:40 2021 +0000 rtc: cmos: Disable irq around direct invocation of cmos_interrupt() As previously noted in commit 66e4f4a9cc38 ("rtc: cmos: Use spin_lock_irqsave() in cmos_interrupt()"): <4>[ 254.192378] WARNING: inconsistent lock state <4>[ 254.192384] 5.12.0-rc1-CI-CI_DRM_9834+ #1 Not tainted <4>[ 254.192396] -------------------------------- <4>[ 254.192400] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. <4>[ 254.192409] rtcwake/5309 [HC0[0]:SC0[0]:HE1:SE1] takes: <4>[ 254.192429] ffffffff8263c5f8 (rtc_lock){?...}-{2:2}, at: cmos_interrupt+0x18/0x100 <4>[ 254.192481] {IN-HARDIRQ-W} state was registered at: <4>[ 254.192488] lock_acquire+0xd1/0x3d0 <4>[ 254.192504] _raw_spin_lock+0x2a/0x40 <4>[ 254.192519] cmos_interrupt+0x18/0x100 <4>[ 254.192536] rtc_handler+0x1f/0xc0 <4>[ 254.192553] acpi_ev_fixed_event_detect+0x109/0x13c <4>[ 254.192574] acpi_ev_sci_xrupt_handler+0xb/0x28 <4>[ 254.192596] acpi_irq+0x13/0x30 <4>[ 254.192620] __handle_irq_event_percpu+0x43/0x2c0 <4>[ 254.192641] handle_irq_event_percpu+0x2b/0x70 <4>[ 254.192661] handle_irq_event+0x2f/0x50 <4>[ 254.192680] handle_fasteoi_irq+0x9e/0x150 <4>[ 254.192693] __common_interrupt+0x76/0x140 <4>[ 254.192715] common_interrupt+0x96/0xc0 <4>[ 254.192732] asm_common_interrupt+0x1e/0x40 <4>[ 254.192750] _raw_spin_unlock_irqrestore+0x38/0x60 <4>[ 254.192767] resume_irqs+0xba/0xf0 <4>[ 254.192786] dpm_resume_noirq+0x245/0x3d0 <4>[ 254.192811] suspend_devices_and_enter+0x230/0xaa0 <4>[ 254.192835] pm_suspend.cold.8+0x301/0x34a <4>[ 254.192859] state_store+0x7b/0xe0 <4>[ 254.192879] kernfs_fop_write_iter+0x11d/0x1c0 <4>[ 254.192899] new_sync_write+0x11d/0x1b0 <4>[ 254.192916] vfs_write+0x265/0x390 <4>[ 254.192933] ksys_write+0x5a/0xd0 <4>[ 254.192949] do_syscall_64+0x33/0x80 <4>[ 254.192965] entry_SYSCALL_64_after_hwframe+0x44/0xae <4>[ 254.192986] irq event stamp: 43775 <4>[ 254.192994] hardirqs last enabled at (43775): [] asm_sysvec_apic_timer_interrupt+0x12/0x20 <4>[ 254.193023] hardirqs last disabled at (43774): [] sysvec_apic_timer_interrupt+0xa/0xb0 <4>[ 254.193049] softirqs last enabled at (42548): [] __do_softirq+0x342/0x48e <4>[ 254.193074] softirqs last disabled at (42543): [] irq_exit_rcu+0xad/0xd0 <4>[ 254.193101] other info that might help us debug this: <4>[ 254.193107] Possible unsafe locking scenario: <4>[ 254.193112] CPU0 <4>[ 254.193117] ---- <4>[ 254.193121] lock(rtc_lock); <4>[ 254.193137] <4>[ 254.193142] lock(rtc_lock); <4>[ 254.193156] *** DEADLOCK *** <4>[ 254.193161] 6 locks held by rtcwake/5309: <4>[ 254.193174] #0: ffff888104861430 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x5a/0xd0 <4>[ 254.193232] #1: ffff88810f823288 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xe7/0x1c0 <4>[ 254.193282] #2: ffff888100cef3c0 (kn->active#285 <7>[ 254.192706] i915 0000:00:02.0: [drm:intel_modeset_setup_hw_state [i915]] [CRTC:51:pipe A] hw state readout: disabled <4>[ 254.193307] ){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xf0/0x1c0 <4>[ 254.193333] #3: ffffffff82649fa8 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend.cold.8+0xce/0x34a <4>[ 254.193387] #4: ffffffff827a2108 (acpi_scan_lock){+.+.}-{3:3}, at: acpi_suspend_begin+0x47/0x70 <4>[ 254.193433] #5: ffff8881019ea178 (&dev->mutex){....}-{3:3}, at: device_resume+0x68/0x1e0 <4>[ 254.193485] stack backtrace: <4>[ 254.193492] CPU: 1 PID: 5309 Comm: rtcwake Not tainted 5.12.0-rc1-CI-CI_DRM_9834+ #1 <4>[ 254.193514] Hardware name: Google Soraka/Soraka, BIOS MrChromebox-4.10 08/25/2019 <4>[ 254.193524] Call Trace: <4>[ 254.193536] dump_stack+0x7f/0xad <4>[ 254.193567] mark_lock.part.47+0x8ca/0xce0 <4>[ 254.193604] __lock_acquire+0x39b/0x2590 <4>[ 254.193626] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 <4>[ 254.193660] lock_acquire+0xd1/0x3d0 <4>[ 254.193677] ? cmos_interrupt+0x18/0x100 <4>[ 254.193716] _raw_spin_lock+0x2a/0x40 <4>[ 254.193735] ? cmos_interrupt+0x18/0x100 <4>[ 254.193758] cmos_interrupt+0x18/0x100 <4>[ 254.193785] cmos_resume+0x2ac/0x2d0 <4>[ 254.193813] ? acpi_pm_set_device_wakeup+0x1f/0x110 <4>[ 254.193842] ? pnp_bus_suspend+0x10/0x10 <4>[ 254.193864] pnp_bus_resume+0x5e/0x90 <4>[ 254.193885] dpm_run_callback+0x5f/0x240 <4>[ 254.193914] device_resume+0xb2/0x1e0 <4>[ 254.193942] ? pm_dev_err+0x25/0x25 <4>[ 254.193974] dpm_resume+0xea/0x3f0 <4>[ 254.194005] dpm_resume_end+0x8/0x10 <4>[ 254.194030] suspend_devices_and_enter+0x29b/0xaa0 <4>[ 254.194066] pm_suspend.cold.8+0x301/0x34a <4>[ 254.194094] state_store+0x7b/0xe0 <4>[ 254.194124] kernfs_fop_write_iter+0x11d/0x1c0 <4>[ 254.194151] new_sync_write+0x11d/0x1b0 <4>[ 254.194183] vfs_write+0x265/0x390 <4>[ 254.194207] ksys_write+0x5a/0xd0 <4>[ 254.194232] do_syscall_64+0x33/0x80 <4>[ 254.194251] entry_SYSCALL_64_after_hwframe+0x44/0xae <4>[ 254.194274] RIP: 0033:0x7f07d79691e7 <4>[ 254.194293] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 <4>[ 254.194312] RSP: 002b:00007ffd9cc2c768 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 <4>[ 254.194337] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f07d79691e7 <4>[ 254.194352] RDX: 0000000000000004 RSI: 0000556ebfc63590 RDI: 000000000000000b <4>[ 254.194366] RBP: 0000556ebfc63590 R08: 0000000000000000 R09: 0000000000000004 <4>[ 254.194379] R10: 0000556ebf0ec2a6 R11: 0000000000000246 R12: 0000000000000004 which breaks S3-resume on fi-kbl-soraka presumably as that's slow enough to trigger the alarm during the suspend. Fixes: 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") References: 66e4f4a9cc38 ("rtc: cmos: Use spin_lock_irqsave() in cmos_interrupt()"): Signed-off-by: Chris Wilson Cc: Xiaofei Tan Cc: Alexandre Belloni Cc: Alessandro Zummo Cc: Ville Syrjälä Reviewed-by: Ville Syrjälä Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20210305122140.28774-1-chris@chris-wilson.co.uk commit 74e1eb3b4a1ef2e564b4bdeb6e92afe844e900de Author: Pali Rohár Date: Sat Sep 11 15:20:17 2021 +0200 serial: mvebu-uart: fix driver's tx_empty callback Driver's tx_empty callback should signal when the transmit shift register is empty. So when the last character has been sent. STAT_TX_FIFO_EMP bit signals only that HW transmit FIFO is empty, which happens when the last byte is loaded into transmit shift register. STAT_TX_EMP bit signals when the both HW transmit FIFO and transmit shift register are empty. So replace STAT_TX_FIFO_EMP check by STAT_TX_EMP in mvebu_uart_tx_empty() callback function. Fixes: 30530791a7a0 ("serial: mvebu-uart: initial support for Armada-3700 serial port") Cc: stable Signed-off-by: Pali Rohár Link: https://lore.kernel.org/r/20210911132017.25505-1-pali@kernel.org Signed-off-by: Greg Kroah-Hartman commit 79e9e30a9292a62d25ab75488d3886108db1eaad Author: Nishanth Menon Date: Fri Sep 3 00:05:50 2021 -0500 serial: 8250: 8250_omap: Fix RX_LVL register offset Commit b67e830d38fa ("serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs") introduced fixup including a register read to RX_LVL, however, we should be using word offset than byte offset since our registers are on 4 byte boundary (port.regshift = 2) for 8250_omap. Fixes: b67e830d38fa ("serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs") Cc: stable Cc: Jan Kiszka Cc: Vignesh Raghavendra Signed-off-by: Nishanth Menon Link: https://lore.kernel.org/r/20210903050550.29050-1-nm@ti.com Signed-off-by: Greg Kroah-Hartman commit 00598d5c69318a1fcb4147878e16754ba9103be6 Author: Vinay Belgaumkar Date: Tue Sep 7 16:27:04 2021 -0700 drm/i915: Get PM ref before accessing HW register Seeing these errors when GT is likely in suspend state- "RPM wakelock ref not held during HW access" Ensure GT is awake before trying to access HW registers. Avoid reading the register if that is not the case. Signed-off-by: Vinay Belgaumkar Fixes: 41e5c17ebfc2 ("drm/i915/guc/slpc: Sysfs hooks for SLPC") Reviewed-by: Tvrtko Ursulin Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20210907232704.12982-1-vinay.belgaumkar@intel.com (cherry picked from commit f25e3908b9cd4a3fe819e9bdcdde58f20bacb34c) Signed-off-by: Jani Nikula commit 031536665f64aaeb7e7439d96689a4011407abb8 Author: Daniel Vetter Date: Thu Sep 2 16:20:48 2021 +0200 drm/i915: Release ctx->syncobj on final put, not on ctx close gem context refcounting is another exercise in least locking design it seems, where most things get destroyed upon context closure (which can race with anything really). Only the actual memory allocation and the locks survive while holding a reference. This tripped up Jason when reimplementing the single timeline feature in commit 00dae4d3d35d4f526929633b76e00b0ab4d3970d Author: Jason Ekstrand Date: Thu Jul 8 10:48:12 2021 -0500 drm/i915: Implement SINGLE_TIMELINE with a syncobj (v4) We could fix the bug by holding ctx->mutex in execbuf and clear the pointer (again while holding the mutex) context_close, but it's cleaner to just make the context object actually invariant over its _entire_ lifetime. This way any other ioctl that's potentially racing, but holding a full reference, can still rely on ctx->syncobj being an immutable pointer. Which without this change, is not the case. Reviewed-by: Maarten Lankhorst Signed-off-by: Daniel Vetter Fixes: 00dae4d3d35d ("drm/i915: Implement SINGLE_TIMELINE with a syncobj (v4)") Cc: Jason Ekstrand Cc: Chris Wilson Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: Matthew Brost Cc: Matthew Auld Cc: Maarten Lankhorst Cc: "Thomas Hellström" Cc: Lionel Landwerlin Cc: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20210902142057.929669-2-daniel.vetter@ffwll.ch (cherry picked from commit c238980efd3b35af70fc926066cf7440f50a97a9) Signed-off-by: Jani Nikula commit 04a3ab6acd54b104838b3f6bd715447631c6e87d Author: Thomas Hellström Date: Tue Aug 31 14:29:31 2021 +0200 drm/i915/gem: Fix the mman selftest Using the I915_MMAP_TYPE_FIXED mmap type requires the TTM backend, so for that mmap type, use __i915_gem_object_create_user() instead of i915_gem_object_create_internal(), as we really want to tests objects mmap-able by user-space. This also means that the out-of-space error happens at object creation and returns -ENXIO rather than -ENOSPC, so fix the code up to expect that on out-of-offset-space errors. Finally only use I915_MMAP_TYPE_FIXED for LMEM and SMEM for now if testing on LMEM-capable devices. For stolen LMEM, we still take the same path as for integrated, as that haven't been moved over to TTM yet, and user-space should not be able to create out of stolen LMEM anyway. v2: - Check the presence of the obj->ops->mmap_offset callback rather than hardcoding the supported mmap regions in can_mmap() (Maarten Lankhorst) Fixes: 7961c5b60f23 ("drm/i915: Add TTM offset argument to mmap.") Cc: Maarten Lankhorst Signed-off-by: Thomas Hellström Reviewed-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20210831122931.157536-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 450cede7f3804ca7f8b3da210ebefa61c0958f22) Signed-off-by: Jani Nikula commit 415406380c29694e12b164f05e467659381feca5 Author: Daniele Ceraolo Spurio Date: Mon Aug 23 09:31:37 2021 -0700 drm/i915/guc: drop guc_communication_enabled The function is only used from within GEM_BUG_ON(), which is causing warnings with Wunneeded-internal-declaration in some builds. Since the function is a simple wrapper around a CT function, we can just call the CT function directly instead. Fixes: 1fb12c587152 ("drm/i915/guc: skip disabling CTBs before sanitizing the GuC") Reported-by: kernel test robot Signed-off-by: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: John Harrison Reviewed-by: Matthew Brost Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20210823163137.19770-1-daniele.ceraolospurio@intel.com (cherry picked from commit 5db1856781e45c9610f7652a19cc656b984235e7) Signed-off-by: Jani Nikula commit c8dead5751b81dfa6b10449b740ed1062ff670c5 Author: Kai-Heng Feng Date: Fri Aug 20 15:52:59 2021 +0800 drm/i915/dp: Use max params for panels < eDP 1.4 Users reported that after commit 2bbd6dba84d4 ("drm/i915: Try to use fast+narrow link on eDP again and fall back to the old max strategy on failure"), the screen starts to have wobbly effect. Commit a5c936add6a2 ("drm/i915/dp: Use slow and wide link training for everything") doesn't help either, that means the affected eDP 1.2 panels only work with max params. So use max params for panels < eDP 1.4 as Windows does to solve the issue. v3: - Do the eDP rev check in intel_edp_init_dpcd() v2: - Check eDP 1.4 instead of DPCD 1.1 to apply max params Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3714 Fixes: 2bbd6dba84d4 ("drm/i915: Try to use fast+narrow link on eDP again and fall back to the old max strategy on failure") Fixes: a5c936add6a2 ("drm/i915/dp: Use slow and wide link training for everything") Suggested-by: Ville Syrjälä Signed-off-by: Kai-Heng Feng Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20210820075301.693099-1-kai.heng.feng@canonical.com (cherry picked from commit d7f213c131adf0bec8b731553eb82990cdac265d) Signed-off-by: Jani Nikula commit 9af4bf2171c1a9e3f2ebb21140c0e34e60b2a22a Author: Lee Shawn C Date: Tue Jul 6 23:25:41 2021 +0800 drm/i915/dp: return proper DPRX link training result After DPRX link training, intel_dp_link_train_phy() did not return the training result properly. If link training failed, i915 driver would not run into link train fallback function. And no hotplug uevent would be received by user space application. Fixes: b30edfd8d0b4 ("drm/i915: Switch to LTTPR non-transparent mode link training") Cc: Ville Syrjala Cc: Imre Deak Cc: Jani Nikula Cc: Cooper Chiou Cc: William Tseng Signed-off-by: Lee Shawn C Reviewed-by: Imre Deak Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20210706152541.25021-1-shawn.c.lee@intel.com (cherry picked from commit dab1b47e57e053b2a02c22ead8e7449f79961335) Signed-off-by: Jani Nikula commit 0560204b360a332c321124dbc5cdfd3364533a74 Author: Juergen Gross Date: Fri Sep 3 10:49:36 2021 +0200 PM: base: power: don't try to use non-existing RTC for storing data If there is no legacy RTC device, don't try to use it for storing trace data across suspend/resume. Cc: Signed-off-by: Juergen Gross Reviewed-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20210903084937.19392-2-jgross@suse.com Signed-off-by: Juergen Gross commit 8480ed9c2bbd56fc86524998e5f2e3e22f5038f6 Author: Juergen Gross Date: Fri Aug 27 14:32:06 2021 +0200 xen/balloon: use a kernel thread instead a workqueue Today the Xen ballooning is done via delayed work in a workqueue. This might result in workqueue hangups being reported in case of large amounts of memory are being ballooned in one go (here 16GB): BUG: workqueue lockup - pool cpus=6 node=0 flags=0x0 nice=0 stuck for 64s! Showing busy workqueues and worker pools: workqueue events: flags=0x0 pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=2/256 refcnt=3 in-flight: 229:balloon_process pending: cache_reap workqueue events_freezable_power_: flags=0x84 pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: disk_events_workfn workqueue mm_percpu_wq: flags=0x8 pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: vmstat_update pool 12: cpus=6 node=0 flags=0x0 nice=0 hung=64s workers=3 idle: 2222 43 This can easily be avoided by using a dedicated kernel thread for doing the ballooning work. Reported-by: Jan Beulich Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210827123206.15429-1-jgross@suse.com Signed-off-by: Juergen Gross commit 92dc0b1f46e12cfabd28d709bb34f7a39431b44f Author: Johan Hovold Date: Mon Sep 6 14:45:38 2021 +0200 staging: greybus: uart: fix tty use after free User space can hold a tty open indefinitely and tty drivers must not release the underlying structures until the last user is gone. Switch to using the tty-port reference counter to manage the life time of the greybus tty state to avoid use after free after a disconnect. Fixes: a18e15175708 ("greybus: more uart work") Cc: stable@vger.kernel.org # 4.9 Reviewed-by: Alex Elder Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210906124538.22358-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 212b5d2d3ed9d7db2702e4805f36a346c3985e1d Author: Jian Cai Date: Mon Sep 13 10:46:13 2021 -0600 coresight: syscfg: Fix compiler warning This fixes warnings with -Wimplicit-function-declaration, e.g. drivers/hwtracing/coresight/coresight-syscfg.c:455:15: error: implicit declaration of function 'kzalloc' [-Werror, -Wimplicit-function-declaration] csdev_item = kzalloc(sizeof(struct cscfg_registered_csdev), GFP_KERNEL); Link: https://lore.kernel.org/r/20210830172820.2840433-1-jiancai@google.com Fixes: 85e2414c518a ("coresight: syscfg: Initial coresight system configuration") Reviewed-by: Guenter Roeck Signed-off-by: Jian Cai Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210913164613.1675791-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman commit 7a8aa39d44564703620d937bb54cdea2d003657f Author: Douglas Anderson Date: Mon Sep 13 17:05:51 2021 +0100 nvmem: core: Add stubs for nvmem_cell_read_variable_le_u32/64 if !CONFIG_NVMEM When I added nvmem_cell_read_variable_le_u32() and nvmem_cell_read_variable_le_u64() I forgot to add the "static inline" stub functions for when CONFIG_NVMEM wasn't defined. Add them now. This was causing problems with randconfig builds that compiled `drivers/soc/qcom/cpr.c`. Fixes: 6feba6a62c57 ("PM: AVS: qcom-cpr: Use nvmem_cell_read_variable_le_u32()") Fixes: a28e824fb827 ("nvmem: core: Add functions to make number reading easy") Reported-by: kernel test robot Reviewed-by: Bjorn Andersson Signed-off-by: Douglas Anderson Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20210913160551.12907-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 5fdb55c1ac9585eb23bb2541d5819224429e103d Author: Todd Kjos Date: Mon Aug 30 12:51:46 2021 -0700 binder: make sure fd closes complete During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object cleanup may close 1 or more fds. The close operations are completed using the task work mechanism -- which means the thread needs to return to userspace or the file object may never be dereferenced -- which can lead to hung processes. Force the binder thread back to userspace if an fd is closed during BC_FREE_BUFFER handling. Fixes: 80cd795630d6 ("binder: fix use-after-free due to ksys_close() during fdget()") Cc: stable Reviewed-by: Martijn Coenen Acked-by: Christian Brauner Signed-off-by: Todd Kjos Link: https://lore.kernel.org/r/20210830195146.587206-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman commit b564171ade70570b7f335fa8ed17adb28409e3ac Author: Li Li Date: Fri Sep 10 09:42:10 2021 -0700 binder: fix freeze race Currently cgroup freezer is used to freeze the application threads, and BINDER_FREEZE is used to freeze the corresponding binder interface. There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any existing transactions to drain out before actually freezing the binder interface. But freezing an app requires 2 steps, freezing the binder interface with ioctl(BINDER_FREEZE) and then freezing the application main threads with cgroupfs. This is not an atomic operation. The following race issue might happen. 1) Binder interface is frozen by ioctl(BINDER_FREEZE); 2) Main thread A initiates a new sync binder transaction to process B; 3) Main thread A is frozen by "echo 1 > cgroup.freeze"; 4) The response from process B reaches the frozen thread, which will unexpectedly fail. This patch provides a mechanism to check if there's any new pending transaction happening between ioctl(BINDER_FREEZE) and freezing the main thread. If there's any, the main thread freezing operation can be rolled back to finish the pending transaction. Furthermore, the response might reach the binder driver before the rollback actually happens. That will still cause failed transaction. As the other process doesn't wait for another response of the response, the response transaction failure can be fixed by treating the response transaction like an oneway/async one, allowing it to reach the frozen thread. And it will be consumed when the thread gets unfrozen later. NOTE: This patch reuses the existing definition of struct binder_frozen_status_info but expands the bit assignments of __u32 member sync_recv. To ensure backward compatibility, bit 0 of sync_recv still indicates there's an outstanding sync binder transaction. This patch adds new information to bit 1 of sync_recv, indicating the binder transaction happens exactly when there's a race. If an existing userspace app runs on a new kernel, a sync binder call will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still return the expected value (true). The app just doesn't check bit 1 intentionally so it doesn't have the ability to tell if there's a race. This behavior is aligned with what happens on an old kernel which doesn't set bit 1 at all. A new userspace app can 1) check bit 0 to know if there's a sync binder transaction happened when being frozen - same as before; and 2) check bit 1 to know if that sync binder transaction happened exactly when there's a race - a new information for rollback decision. the same time, confirmed the pending transactions succeeded. Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl") Acked-by: Todd Kjos Cc: stable Signed-off-by: Li Li Test: stress test with apps being frozen and initiating binder calls at Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman commit 88a3856c0a8c03188db7913f4d49379432fe1f93 Author: jing yangyang Date: Thu Aug 19 20:21:27 2021 -0700 tee/optee/shm_pool: fix application of sizeof to pointer sizeof when applied to a pointer typed expression gives the size of the pointer. ./drivers/tee/optee/shm_pool.c:38:28-34: ERROR application of sizeof to pointer This issue was detected with the help of Coccinelle. Reviewed-by: Daniel Thompson Reported-by: Zeal Robot Signed-off-by: jing yangyang Signed-off-by: Jens Wiklander commit 1a0db7744e453844aa2db3f2959aea4a378025ea Author: Zenghui Yu Date: Sat Sep 11 18:53:06 2021 +0800 scsi: bsg: Fix device unregistration device_initialize() is used to take a refcount on the device. However, put_device() is not called during device teardown. This leads to a leak of private data of the driver core, dev_name(), etc. This is reported by kmemleak at boot time if we compile kernel with DEBUG_TEST_DRIVER_REMOVE. Fix memory leaks during unregistration and implement a release function. Link: https://lore.kernel.org/r/20210911105306.1511-1-yuzenghui@huawei.com Fixes: ead09dd3aed5 ("scsi: bsg: Simplify device registration") Reviewed-by: Johan Hovold Signed-off-by: Zenghui Yu Signed-off-by: Martin K. Petersen commit 4521428c48118b0f5f7a637ce7dedd76c29bcdaa Author: Heiner Kallweit Date: Sat Sep 11 14:11:59 2021 +0200 scsi: sd: Make sd_spinup_disk() less noisy sd_spinup_disk() is a little bit noisy after commit 848ade90ba9c ("scsi: sd: Do not exit sd_spinup_disk() quietly"): scsi 0:0:0:0: Direct-Access Multiple Card Reader 1.00 PQ: 0 ANSI: 0 sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 0:0:0:0: [sda] Media removed, stopped polling sd 0:0:0:0: [sda] Media removed, stopped polling sd 0:0:0:0: [sda] Attached SCSI removable disk sd 0:0:0:0: [sda] Media removed, stopped polling There's not really a benefit in printing the same message multiple times. Therefore print it only if media_present was previously set. Link: https://lore.kernel.org/r/a2d0a249-6035-9697-626a-e14ec50ef6ee@gmail.com Reviewed-by: Bart Van Assche Signed-off-by: Heiner Kallweit Signed-off-by: Martin K. Petersen commit 1cbc9ad3eecd492be33b727b4606ae75bc880676 Author: Adrian Hunter Date: Tue Aug 31 17:53:17 2021 +0300 scsi: ufs: ufs-pci: Fix Intel LKF link stability Intel LKF can experience link errors. Make fixes to increase link stability, especially when switching to high speed modes. Link: https://lore.kernel.org/r/20210831145317.26306-1-adrian.hunter@intel.com Fixes: b2c57925df1f ("scsi: ufs: ufs-pci: Add support for Intel LKF") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit 04c260bdaeede8c703bddc21099e4da96f2909e2 Author: Colin Ian King Date: Thu Sep 2 23:42:15 2021 +0100 scsi: mpt3sas: Clean up some inconsistent indenting There are a couple of statements where the indentation is not correct, clean these up. Remove a redundant break statement. Link: https://lore.kernel.org/r/20210902224215.57286-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 655a68b2203e44912afe462dff9d83d68ac88333 Author: Colin Ian King Date: Thu Sep 2 23:36:43 2021 +0100 scsi: megaraid: Clean up some inconsistent indenting There are a few statements where the indentation is not correct, clean these up. Link: https://lore.kernel.org/r/20210902223643.56979-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit e699a4e1d37314eb842ba9de19a7ccee7f75da10 Author: Colin Ian King Date: Thu Aug 26 12:57:14 2021 +0100 scsi: sr: Fix spelling mistake "does'nt" -> "doesn't" There is a spelling mistake in a literal string. Fix it. Link: https://lore.kernel.org/r/20210826115714.11844-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit fc13fc07490982c89f5d9d8d671ec29a39cddc85 Author: Jens Axboe Date: Fri Sep 3 08:11:39 2021 -0600 scsi: Remove SCSI CDROM MAINTAINERS entry There's little point in keeping this one separately maintained these days, so just remove the entry and it'll fall under the SCSI subsystem where it belongs. Link: https://lore.kernel.org/r/c5e12bd1-10de-634c-d6b3-dac79ed01af5@kernel.dk Signed-off-by: Jens Axboe Signed-off-by: Martin K. Petersen commit 17dfd54d391ea9f8d136fb137962987cb2c6444c Author: jing yangyang Date: Thu Aug 19 20:08:05 2021 -0700 scsi: megaraid: Fix Coccinelle warning WARNING !A || A && B is equivalent to !A || B This issue was detected with the help of Coccinelle. Link: https://lore.kernel.org/r/20210820030805.12383-1-jing.yangyang@zte.com.cn Reported-by: Zeal Robot Acked-by: Sumit Saxena Signed-off-by: jing yangyang Signed-off-by: Martin K. Petersen commit 1f97c29beee774e407839768439b7f51831c3ea1 Author: Helge Deller Date: Tue Sep 7 23:00:44 2021 +0200 scsi: ncr53c8xx: Remove unused retrieve_from_waiting_list() function Drop retrieve_from_waiting_list() to avoid this warning: drivers/scsi/ncr53c8xx.c:8000:26: warning: ‘retrieve_from_waiting_list’ defined but not used [-Wunused-function] Link: https://lore.kernel.org/r/YTfS/LH5vCN6afDW@ls3530 Fixes: 1c22e327545c ("scsi: ncr53c8xx: Remove unused code") Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Helge Deller Signed-off-by: Martin K. Petersen commit 450907424d9ebcc28fab42a065c3cddce49ee97d Author: James Smart Date: Tue Sep 7 09:52:25 2021 -0700 scsi: elx: efct: Do not hold lock while calling fc_vport_terminate() Smatch checker reported the following error: drivers/base/power/sysfs.c:833 dpm_sysfs_remove() warn: sleeping in atomic context With a calling sequence of: efct_lio_npiv_drop_nport() <- disables preempt -> fc_vport_terminate() -> device_del() -> dpm_sysfs_remove() Issue is efct_lio_npiv_drop_nport() is making the fc_vport_terminate() call while holding a lock w/ ipl raised. It is unnecessary to hold the lock over this call, shift where the lock is taken. Link: https://lore.kernel.org/r/20210907165225.10821-1-jsmart2021@gmail.com Reported-by: Dan Carpenter Co-developed-by: Ram Vegesna Signed-off-by: Ram Vegesna Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit ef7ae7f746e95c6fa4ec2bcfacb949c36263da78 Author: Maurizio Lombardi Date: Mon Sep 6 17:18:09 2021 +0200 scsi: target: Fix the pgr/alua_support_store functions Commit 356ba2a8bc8d ("scsi: target: tcmu: Make pgr_support and alua_support attributes writable") introduced support for changeable alua_support and pgr_support target attributes. These can only be changed if the backstore is user-backed, otherwise the kernel returns -EINVAL. This triggers a warning in the targetcli/rtslib code when performing a target restore that includes non-userbacked backstores: # targetctl restore Storage Object block/storage1: Cannot set attribute alua_support: [Errno 22] Invalid argument, skipped Storage Object block/storage1: Cannot set attribute pgr_support: [Errno 22] Invalid argument, skipped Fix this warning by returning an error code only if we are really going to flip the PGR/ALUA bit in the transport_flags field, otherwise we will do nothing and return success. Return ENOSYS instead of EINVAL if the pgr/alua attributes can not be changed, this way it will be possible for userspace to understand if the operation failed because an invalid value has been passed to strtobool() or because the attributes are fixed. Fixes: 356ba2a8bc8d ("scsi: target: tcmu: Make pgr_support and alua_support attributes writable") Link: https://lore.kernel.org/r/20210906151809.52811-1-mlombard@redhat.com Reviewed-by: Bodo Stroesser Signed-off-by: Maurizio Lombardi Signed-off-by: Martin K. Petersen commit 7215e909814fed7cda33c954943a4050d8348204 Author: Naohiro Aota Date: Mon Sep 6 23:06:42 2021 +0900 scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE Reporting zones on a SCSI device sometimes fail with the following error: [76248.516390] ata16.00: invalid transfer count 131328 [76248.523618] sd 15:0:0:0: [sda] REPORT ZONES start lba 536870912 failed The error (from drivers/ata/libata-scsi.c:ata_scsi_zbc_in_xlat()) indicates that buffer size is not aligned to SECTOR_SIZE. This happens when the __vmalloc() failed. Consider we are reporting 4096 zones, then we will have "bufsize = roundup((4096 + 1) * 64, SECTOR_SIZE)" = (513 * 512) = 262656. Then, __vmalloc() failure halves the bufsize to 131328, which is no longer aligned to SECTOR_SIZE. Use rounddown() to ensure the size is always aligned to SECTOR_SIZE and fix the comment as well. Link: https://lore.kernel.org/r/20210906140642.2267569-1-naohiro.aota@wdc.com Fixes: 23a50861adda ("scsi: sd_zbc: Cleanup sd_zbc_alloc_report_buffer()") Cc: stable@vger.kernel.org # 5.5+ Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Signed-off-by: Naohiro Aota Signed-off-by: Martin K. Petersen commit 265dfe8ebbabae7959060bd1c3f75c2473b697ed Author: Ming Lei Date: Mon Sep 6 17:01:12 2021 +0800 scsi: sd: Free scsi_disk device via put_device() After a device is initialized via device_initialize() it should be freed via put_device(). sd_probe() currently gets this wrong, fix it up. Link: https://lore.kernel.org/r/20210906090112.531442-1-ming.lei@redhat.com Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Martin K. Petersen commit e4953a93104c1fb1ef7989541f9867cc276467f9 Author: Sreekanth Reddy Date: Wed Sep 1 20:55:42 2021 +0530 scsi: mpt3sas: Call cpu_relax() before calling udelay() Call cpu_relax() while waiting for the current blk-mq polling instance to complete. Link: https://lore.kernel.org/r/20210901152542.27866-1-sreekanth.reddy@broadcom.com Reviewed-by: Bart Van Assche Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 4e28550829258f7dab97383acaa477bd724c0ff4 Author: Baokun Li Date: Wed Sep 1 16:53:36 2021 +0800 scsi: iscsi: Adjust iface sysfs attr detection ISCSI_NET_PARAM_IFACE_ENABLE belongs to enum iscsi_net_param instead of iscsi_iface_param so move it to ISCSI_NET_PARAM. Otherwise, when we call into the driver, we might not match and return that we don't want attr visible in sysfs. Found in code review. Link: https://lore.kernel.org/r/20210901085336.2264295-1-libaokun1@huawei.com Fixes: e746f3451ec7 ("scsi: iscsi: Fix iface sysfs attr detection") Reviewed-by: Lee Duncan Signed-off-by: Baokun Li Signed-off-by: Martin K. Petersen commit 65ef27f7798b57138351d28fd2f61f2afa164400 Author: ChanWoo Lee Date: Wed Sep 1 11:56:17 2021 +0900 scsi: ufs: ufshpb: Remove unused parameters The following parameters are not used in the function. Remove them. *func(): ufshpb_set_hpb_read_to_upiu -> struct ufshpb_lu *hpb -> u32 lpn Link: https://lore.kernel.org/r/20210901025617.31174-1-cw9316.lee@samsung.com Reviewed-by: Daejun Park Reviewed-by: Bart Van Assche Signed-off-by: ChanWoo Lee Signed-off-by: Martin K. Petersen commit 5d1e15108b8d058d537f19cdef4170d2ae4eed08 Author: Chi Minghao Date: Tue Aug 31 04:40:58 2021 -0700 scsi: lpfc: Remove unneeded variable Fix the following coccicheck REVIEW: ./drivers/scsi/lpfc/lpfc_scsi.c:1498:9-12 REVIEW Unneeded variable Link: https://lore.kernel.org/r/20210831114058.17817-1-lv.ruyi@zte.com.cn Reported-by: Zeal Robot Reviewed-by: James Smart Signed-off-by: Chi Minghao Signed-off-by: Martin K. Petersen commit 37e384095f20cca728500fe5344cd308aa6fd7ff Author: James Smart Date: Tue Sep 7 22:09:27 2021 -0700 scsi: lpfc: Fix compilation errors on kernels with no CONFIG_DEBUG_FS The Kernel test robot flagged the following warning: ".../lpfc_init.c:7788:35: error: 'struct lpfc_sli4_hba' has no member named 'c_stat'" Reviewing this issue highlighted that one of the recent patches caused the driver to no longer compile cleanly if CONFIG_DEBUG_FS is not set. Correct the different areas that are failing to compile. Link: https://lore.kernel.org/r/20210908050927.37275-1-jsmart2021@gmail.com Fixes: 02243836ad6f ("scsi: lpfc: Add support for the CM framework") Reviewed-by: Nathan Chancellor Build-tested-by: Nathan Chancellor Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 59936430e6a6acb0ef943e9306506b2e9c2e45a8 Author: James Smart Date: Mon Aug 30 16:12:43 2021 -0700 scsi: lpfc: Fix CPU to/from endian warnings introduced by ELS processing The kernel test robot reported the following sparse warning: ".../lpfc_els.c:3984:25: sparse: sparse: cast from restricted __be16" For the error being flagged, using be32_to_cpu() on a be16 data type, it was simple enough. But a review of other elements and warnings were also evaluated. This patch corrected several items in the original patch: - Using be32_to_cpu() on a be16 data type - cpu_to_le32() used on a std uint32_t (CPU) data type. Note: This is a byte array, but stored in LE layout by hardware at 32-bit boundaries. So it possibly needed conversion. - Using cpu_to_le32() on a std uint16_t and assigned to a char typeA - Using le32_to_cpu() on a le16 type - Missing cpu_to_le16() on an assignment Link: https://lore.kernel.org/r/20210830231243.6227-1-jsmart2021@gmail.com Fixes: 9064aeb2df8e ("scsi: lpfc: Add EDC ELS support") Reported-by: kernel test robot Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 96fafe7c6523886308605d30ec92c7936abe7c2c Author: James Smart Date: Mon Aug 30 16:10:50 2021 -0700 scsi: elx: efct: Fix void-pointer-to-enum-cast warning for efc_nport_topology The kernel test robot flagged an warning for ".../efc_device.c:932:6: warning: cast to smaller integer type 'enum efc_nport_topology' from 'void *'" For the topology events, the "arg" field is generically defined as a void * and is used to pass different arguments. Most of the arguments are pointers to data structures. But for the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event, the argument is an enum value, and the code is typecasting the void * to an enum generating the warning. Fix by converting the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event to pass a pointer to the enum, thus it's a straight-forward pointer dereference in the event handler. Link: https://lore.kernel.org/r/20210830231050.5951-1-jsmart2021@gmail.com Fixes: 202bfdffae27 ("scsi: elx: libefc: FC node ELS and state handling") Reported-by: kernel test robot Co-developed-by: Ram Vegesna Signed-off-by: Ram Vegesna Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 6a2ea0d34af1ca807d5ba6a8350a037ff3cd35cc Author: Nathan Chancellor Date: Tue Aug 17 16:55:31 2021 -0700 scsi: st: Add missing break in switch statement in st_ioctl() Clang + -Wimplicit-fallthrough warns: drivers/scsi/st.c:3831:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] default: ^ drivers/scsi/st.c:3831:2: note: insert 'break;' to avoid fall-through default: ^ break; 1 warning generated. Clang's -Wimplicit-fallthrough is a little bit more pedantic than GCC's, requiring every case block to end in break, return, or fallthrough, rather than allowing implicit fallthroughs to cases that just contain break or return. Add a break so that there is no more warning, as has been done all over the tree already. Link: https://lore.kernel.org/r/20210817235531.172995-1-nathan@kernel.org Fixes: 2e27f576abc6 ("scsi: scsi_ioctl: Call scsi_cmd_ioctl() from scsi_ioctl()") Reviewed-by: Gustavo A. R. Silva Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit 41d3a6bd1d37149b18331fc4bb789c5456a7aeb0 Author: Jens Axboe Date: Mon Sep 13 13:08:51 2021 -0600 io_uring: pin SQPOLL data before unlocking ring lock We need to re-check sqd->thread after we've dropped the lock. Pin the sqd before doing the lockdep lock dance, and check if the thread is alive after that. It's either NULL or alive, as the SQPOLL thread cannot exit without holding the same sqd->lock. Reported-and-tested-by: syzbot+337de45f13a4fd54d708@syzkaller.appspotmail.com Fixes: fa84693b3c89 ("io_uring: ensure IORING_REGISTER_IOWQ_MAX_WORKERS works with SQPOLL") Signed-off-by: Jens Axboe commit 43d2b88c29f2d120b4dc22f27b3483eb14bd9815 Author: Daniel Borkmann Date: Tue Sep 14 01:07:59 2021 +0200 bpf, selftests: Add test case for mixed cgroup v1/v2 Minimal selftest which implements a small BPF policy program to the connect(2) hook which rejects TCP connection requests to port 60123 with EPERM. This is being attached to a non-root cgroup v2 path. The test asserts that this works under cgroup v2-only and under a mixed cgroup v1/v2 environment where net_classid is set in the former case. Before fix: # ./test_progs -t cgroup_v1v2 test_cgroup_v1v2:PASS:server_fd 0 nsec test_cgroup_v1v2:PASS:client_fd 0 nsec test_cgroup_v1v2:PASS:cgroup_fd 0 nsec test_cgroup_v1v2:PASS:server_fd 0 nsec run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec test_cgroup_v1v2:PASS:cgroup-v2-only 0 nsec run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec run_test:PASS:join_classid 0 nsec (network_helpers.c:219: errno: None) Unexpected success to connect to server test_cgroup_v1v2:FAIL:cgroup-v1v2 unexpected error: -1 (errno 0) #27 cgroup_v1v2:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED After fix: # ./test_progs -t cgroup_v1v2 #27 cgroup_v1v2:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20210913230759.2313-3-daniel@iogearbox.net commit d8079d8026f82e4435445297d1b77bba1c4c7960 Author: Daniel Borkmann Date: Tue Sep 14 01:07:58 2021 +0200 bpf, selftests: Add cgroup v1 net_cls classid helpers Minimal set of helpers for net_cls classid cgroupv1 management in order to set an id, join from a process, initiate setup and teardown. cgroupv2 helpers are left as-is, but reused where possible. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20210913230759.2313-2-daniel@iogearbox.net commit 8520e224f547cd070c7c8f97b1fc6d58cff7ccaa Author: Daniel Borkmann Date: Tue Sep 14 01:07:57 2021 +0200 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode Fix cgroup v1 interference when non-root cgroup v2 BPF programs are used. Back in the days, commit bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup") embedded per-socket cgroup information into sock->sk_cgrp_data and in order to save 8 bytes in struct sock made both mutually exclusive, that is, when cgroup v1 socket tagging (e.g. net_cls/net_prio) is used, then cgroup v2 falls back to the root cgroup in sock_cgroup_ptr() (&cgrp_dfl_root.cgrp). The assumption made was "there is no reason to mix the two and this is in line with how legacy and v2 compatibility is handled" as stated in bd1060a1d671. However, with Kubernetes more widely supporting cgroups v2 as well nowadays, this assumption no longer holds, and the possibility of the v1/v2 mixed mode with the v2 root fallback being hit becomes a real security issue. Many of the cgroup v2 BPF programs are also used for policy enforcement, just to pick _one_ example, that is, to programmatically deny socket related system calls like connect(2) or bind(2). A v2 root fallback would implicitly cause a policy bypass for the affected Pods. In production environments, we have recently seen this case due to various circumstances: i) a different 3rd party agent and/or ii) a container runtime such as [0] in the user's environment configuring legacy cgroup v1 net_cls tags, which triggered implicitly mentioned root fallback. Another case is Kubernetes projects like kind [1] which create Kubernetes nodes in a container and also add cgroup namespaces to the mix, meaning programs which are attached to the cgroup v2 root of the cgroup namespace get attached to a non-root cgroup v2 path from init namespace point of view. And the latter's root is out of reach for agents on a kind Kubernetes node to configure. Meaning, any entity on the node setting cgroup v1 net_cls tag will trigger the bypass despite cgroup v2 BPF programs attached to the namespace root. Generally, this mutual exclusiveness does not hold anymore in today's user environments and makes cgroup v2 usage from BPF side fragile and unreliable. This fix adds proper struct cgroup pointer for the cgroup v2 case to struct sock_cgroup_data in order to address these issues; this implicitly also fixes the tradeoffs being made back then with regards to races and refcount leaks as stated in bd1060a1d671, and removes the fallback, so that cgroup v2 BPF programs always operate as expected. [0] https://github.com/nestybox/sysbox/ [1] https://kind.sigs.k8s.io/ Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Acked-by: Stanislav Fomichev Acked-by: Tejun Heo Link: https://lore.kernel.org/bpf/20210913230759.2313-1-daniel@iogearbox.net commit 4c51de1e8f928a5b05248714d832d7d991ac319a Author: Steve French Date: Mon Sep 13 18:29:46 2021 -0500 cifs: fix incorrect kernel doc comments Correct kernel-doc comments pointed out by the automated kernel test robot. Reported-by: kernel test robot Signed-off-by: Steve French commit 0e6491b559704da720f6da09dd0a52c4df44c514 Author: Bixuan Cui Date: Sat Sep 11 08:55:57 2021 +0800 bpf: Add oversize check before call kvcalloc() Commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") add the oversize check. When the allocation is larger than what kmalloc() supports, the following warning triggered: WARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597 Modules linked in: CPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597 Call Trace: kvmalloc include/linux/mm.h:806 [inline] kvmalloc_array include/linux/mm.h:824 [inline] kvcalloc include/linux/mm.h:829 [inline] check_btf_line kernel/bpf/verifier.c:9925 [inline] check_btf_info kernel/bpf/verifier.c:10049 [inline] bpf_check+0xd634/0x150d0 kernel/bpf/verifier.c:13759 bpf_prog_load kernel/bpf/syscall.c:2301 [inline] __sys_bpf+0x11181/0x126e0 kernel/bpf/syscall.c:4587 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Reported-by: syzbot+f3e749d4c662818ae439@syzkaller.appspotmail.com Signed-off-by: Bixuan Cui Signed-off-by: Alexei Starovoitov Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20210911005557.45518-1-cuibixuan@huawei.com commit 69e73dbfda14fbfe748d3812da1244cce2928dcb Author: Andrea Claudi Date: Fri Sep 10 18:08:39 2021 +0200 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 ip_vs_conn_tab_bits may be provided by the user through the conn_tab_bits module parameter. If this value is greater than 31, or less than 0, the shift operator used to derive tab_size causes undefined behaviour. Fix this checking ip_vs_conn_tab_bits value to be in the range specified in ipvs Kconfig. If not, simply use default value. Fixes: 6f7edb4881bf ("IPVS: Allow boot time change of hash size") Reported-by: Yi Chen Signed-off-by: Andrea Claudi Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit d0ee23f9d78be5531c4b055ea424ed0b489dfe9b Author: Nathan Chancellor Date: Mon Sep 13 15:09:00 2021 -0700 tools: compiler-gcc.h: Guard error attribute use with __has_attribute When building objtool with HOSTCC=clang, there are several errors along the lines of orc_dump.c:201:28: error: unknown attribute 'error' ignored [-Werror,-Wunknown-attributes] This occurs after commit 4e59869aa655 ("compiler-gcc.h: drop checks for older GCC versions"), which removed the GCC_VERSION gating. The removed version check just so happened to prevent __compiletime_error() from being defined with clang because it pretends to be GCC 4.2.1 for compatibility but the error attribute was not added to clang until 14.0.0. Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") and commit a3f8a30f3f00 ("Compiler Attributes: use feature checks instead of version checks") refactored the handling of attributes in the main kernel to avoid situations like this but that refactoring has never been done for the tools directory. Refactoring is a rather large undertaking and this has never been an issue before so instead, just guard the definition of __compiletime_error() with __has_attribute() so that there are no more errors. Fixes: 4e59869aa655 ("compiler-gcc.h: drop checks for older GCC versions") Signed-off-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 7bbc3d385bd813077acaf0e6fdb2a86a901f5382 Author: Jozsef Kadlecsik Date: Mon Sep 6 18:26:34 2021 +0200 netfilter: ipset: Fix oversized kvmalloc() calls The commit commit 7661809d493b426e979f39ab512e3adf41fbcc69 Author: Linus Torvalds Date: Wed Jul 14 09:45:49 2021 -0700 mm: don't allow oversized kvmalloc() calls limits the max allocatable memory via kvmalloc() to MAX_INT. Apply the same limit in ipset. Reported-by: syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com Reported-by: syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com Reported-by: syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 099dd788e31b4f426ef49c2785069804925a84e1 Author: Steve French Date: Mon Sep 13 14:51:10 2021 -0500 cifs: remove pathname for file from SPDX header checkpatch complains about source files with filenames (e.g. in these cases just below the SPDX header in comments at the top of various files in fs/cifs). It also is helpful to change this now so will be less confusing when the parent directory is renamed e.g. from fs/cifs to fs/smb_client (or fs/smbfs) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 3110b942d36b961858664486d72f815d78c956c3 Author: Jason Gunthorpe Date: Mon Sep 13 16:25:56 2021 -0300 IB/qib: Fix clang confusion of NULL pointer comparison clang becomes confused due to the comparison to NULL in a integer constant expression context: >> drivers/infiniband/hw/qib/qib_sysfs.c:413:1: error: static_assert expression is not an integral constant expression QIB_DIAGC_ATTR(rc_resends); ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/qib/qib_sysfs.c:406:16: note: expanded from macro 'QIB_DIAGC_ATTR' static_assert(&((struct qib_ibport *)0)->rvp.n_##N != (u64 *)NULL); \ Nathan found __same_type that solves this problem nicely, so use it instead. Reported-by: kernel test robot Suggested-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Jason Gunthorpe commit c0002d11d79900f8aa5c8375336434940d6afedf Author: ArthurChiao Date: Wed Sep 8 16:08:15 2021 +0800 cgroupv2, docs: fix misinformation in "device controller" section Hotmail was rejected by the mailing list, switched to gmail to resend. 1. Clarify cgroup BPF program type and attach type; 2. Fix file path broken. Signed-off-by: ArthurChiao Signed-off-by: Tejun Heo commit b94f9ac79a7395c2d6171cc753cc27942df0be73 Author: Waiman Long Date: Thu Sep 9 22:42:56 2021 -0400 cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem Since commit 1243dc518c9d ("cgroup/cpuset: Convert cpuset_mutex to percpu_rwsem"), cpuset_mutex has been replaced by cpuset_rwsem which is a percpu rwsem. However, the comments in kernel/cgroup/cpuset.c still reference cpuset_mutex which are now incorrect. Change all the references of cpuset_mutex to cpuset_rwsem. Fixes: 1243dc518c9d ("cgroup/cpuset: Convert cpuset_mutex to percpu_rwsem") Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 22b1255792c033781dbe42b63e28501d38032b7e Author: Chunguang Xu Date: Mon Sep 13 13:09:14 2021 +0800 docs/cgroup: remove some duplicate words When I tried to add some new entries to cgroup-v2.rst, I found that the description of memory.events had some repetitive words, so I tried to delete them. Signed-off-by: Chunguang Xu Signed-off-by: Tejun Heo commit 80f0a1f99983296be587325004acf72dd11eccd8 Author: Rolf Eike Beer Date: Mon Sep 13 12:02:56 2021 +0200 workqueue: annotate alloc_workqueue() as printf This also enables checking of allows alloc_ordered_workqueue(). Signed-off-by: Rolf Eike Beer Signed-off-by: Tejun Heo commit 316346243be6df12799c0b64b788e06bad97c30b Merge: a69ae291e1cc2 df26327ea097e Author: Linus Torvalds Date: Mon Sep 13 10:43:04 2021 -0700 Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version) Merge patch series from Nick Desaulniers to update the minimum gcc version to 5.1. This is some of the left-overs from the merge window that I didn't want to deal with yesterday, so it comes in after -rc1 but was sent before. Gcc-4.9 support has been an annoyance for some time, and with -Werror I had the choice of applying a fairly big patch from Kees Cook to remove a fair number of initializer warnings (still leaving some), or this patch series from Nick that just removes the source of the problem. The initializer cleanups might still be worth it regardless, but honestly, I preferred just tackling the problem with gcc-4.9 head-on. We've been more aggressiuve about no longer having to care about compilers that were released a long time ago, and I think it's been a good thing. I added a couple of patches on top to sort out a few left-overs now that we no longer support gcc-4.x. As noted by Arnd, as a result of this minimum compiler version upgrade we can probably change our use of '--std=gnu89' to '--std=gnu11', and finally start using local loop declarations etc. But this series does _not_ yet do that. Link: https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/ Link: https://lore.kernel.org/lkml/CAK7LNASs6dvU6D3jL2GG3jW58fXfaj6VNOe55NJnTB8UPuk2pA@mail.gmail.com/ Link: https://github.com/ClangBuiltLinux/linux/issues/1438 * emailed patches from Nick Desaulniers : Drop some straggling mentions of gcc-4.9 as being stale compiler_attributes.h: drop __has_attribute() support for gcc4 vmlinux.lds.h: remove old check for GCC 4.9 compiler-gcc.h: drop checks for older GCC versions Makefile: drop GCC < 5 -fno-var-tracking-assignments workaround arm64: remove GCC version check for ARCH_SUPPORTS_INT128 powerpc: remove GCC version check for UPD_CONSTR riscv: remove Kconfig check for GCC version for ARCH_RV64I Kconfig.debug: drop GCC 5+ version check for DWARF5 mm/ksm: remove old GCC 4.9+ check compiler.h: drop fallback overflow checkers Documentation: raise minimum supported version of GCC to 5.1 commit a48c730a4e0bf480bcde12d795a9cd6f9ef14d1e Author: Douglas Anderson Date: Tue Sep 7 12:12:25 2021 -0700 Revert "arm64: dts: qcom: sc7280: Fixup the cpufreq node" This reverts commit 11e03d692101e484df9322f892a8b6e111a82bfd. As per discussion [1] the patch shouldn't have landed. Let's revert. [1] https://lore.kernel.org/r/fde7bac239f796b039b9be58b391fb77@codeaurora.org/ Fixes: 11e03d692101 ("arm64: dts: qcom: sc7280: Fixup the cpufreq node") Reported-by: Matthias Kaehlcke Cc: Sibi Sankar Cc: Matthias Kaehlcke Cc: Stephen Boyd Signed-off-by: Douglas Anderson Reviewed-by: Matthias Kaehlcke Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210907121220.1.I08460f490473b70de0d768db45f030a4d5c17828@changeid commit df26327ea097eb78e7967c45df6b23010c43c28d Author: Linus Torvalds Date: Mon Sep 13 10:29:44 2021 -0700 Drop some straggling mentions of gcc-4.9 as being stale Fix up the admin-guide README file to the new gcc-5.1 requirement, and remove a stale comment about gcc support for the __assume_aligned__ attribute. Signed-off-by: Linus Torvalds commit d9a7e9df731670acdc69e81748941ad338f47fab Author: Doug Smythies Date: Sun Sep 12 11:50:29 2021 -0700 cpufreq: intel_pstate: Override parameters if HWP forced by BIOS If HWP has been already been enabled by BIOS, it may be necessary to override some kernel command line parameters. Once it has been enabled it requires a reset to be disabled. Suggested-by: Rafael J. Wysocki Signed-off-by: Doug Smythies Signed-off-by: Rafael J. Wysocki commit 6d2ef226f2f18d530e48ead0cb5704505628b797 Author: Linus Torvalds Date: Mon Sep 13 10:20:01 2021 -0700 compiler_attributes.h: drop __has_attribute() support for gcc4 Now that GCC 5.1 is the minimally supported default, the manual workaround for older gcc versions not having __has_attribute() are no longer relevant and can be removed. Signed-off-by: Linus Torvalds commit 6f20fa2dfa549401860479328371f0d5cee9b114 Author: Nick Desaulniers Date: Fri Sep 10 16:40:47 2021 -0700 vmlinux.lds.h: remove old check for GCC 4.9 Now that GCC 5.1 is the minimally supported version of GCC, we can effectively revert commit 85c2ce9104eb ("sched, vmlinux.lds: Increase STRUCT_ALIGNMENT to 64 bytes for GCC-4.9") Cc: Peter Zijlstra Signed-off-by: Nick Desaulniers Acked-by: Kees Cook Signed-off-by: Linus Torvalds commit 4e59869aa6550657cb148ad49835605660ec9b88 Author: Nick Desaulniers Date: Fri Sep 10 16:40:46 2021 -0700 compiler-gcc.h: drop checks for older GCC versions Now that GCC 5.1 is the minimally supported default, drop the values we don't use. Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 156102fe0bb669f40f2fd27856b21f9fa8157090 Author: Nick Desaulniers Date: Fri Sep 10 16:40:45 2021 -0700 Makefile: drop GCC < 5 -fno-var-tracking-assignments workaround Now that GCC 5.1 is the minimally supported version, we can drop this workaround for older versions of GCC. Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 42a7ba1695fcd534216aa3712a6cf42da3340527 Author: Nick Desaulniers Date: Fri Sep 10 16:40:44 2021 -0700 arm64: remove GCC version check for ARCH_SUPPORTS_INT128 Now that GCC 5.1 is the minimally supported compiler version, this Kconfig check is no longer necessary. Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 6563139d90ad6178a990d051c7980f0998b5d2e8 Author: Nick Desaulniers Date: Fri Sep 10 16:40:43 2021 -0700 powerpc: remove GCC version check for UPD_CONSTR Now that GCC 5.1 is the minimum supported version, we can drop this workaround for older versions of GCC. This adversely affected clang, too. Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Segher Boessenkool Cc: Christophe Leroy Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Nick Desaulniers Signed-off-by: Linus Torvalds commit d20758951f8f28c0ee1b2a8a6bb8189858083895 Author: Nick Desaulniers Date: Fri Sep 10 16:40:42 2021 -0700 riscv: remove Kconfig check for GCC version for ARCH_RV64I The minimum supported version of GCC is now 5.1. The check wasn't correct as written anyways since GCC_VERSION is 0 when CC=clang. Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: linux-riscv@lists.infradead.org Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit c0a5c81ca9bedaf38356a6290bf895313fd7361c Author: Nick Desaulniers Date: Fri Sep 10 16:40:41 2021 -0700 Kconfig.debug: drop GCC 5+ version check for DWARF5 Now that the minimum supported version of GCC is 5.1, we no longer need this Kconfig version check for CONFIG_DEBUG_INFO_DWARF5. Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit adac17e3f61f54927b961d97bd303dd5795a307b Author: Nick Desaulniers Date: Fri Sep 10 16:40:40 2021 -0700 mm/ksm: remove old GCC 4.9+ check The minimum supported version of GCC has been raised to GCC 5.1. Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 4eb6bd55cfb22ffc20652732340c4962f3ac9a91 Author: Nick Desaulniers Date: Fri Sep 10 16:40:39 2021 -0700 compiler.h: drop fallback overflow checkers Once upgrading the minimum supported version of GCC to 5.1, we can drop the fallback code for !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW. This is effectively a revert of commit f0907827a8a9 ("compiler.h: enable builtin overflow checkers and add fallback code") Link: https://github.com/ClangBuiltLinux/linux/issues/1438#issuecomment-916745801 Suggested-by: Rasmus Villemoes Signed-off-by: Nick Desaulniers Acked-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 76ae847497bc5207c479de5e2ac487270008b19b Author: Nick Desaulniers Date: Fri Sep 10 16:40:38 2021 -0700 Documentation: raise minimum supported version of GCC to 5.1 commit fad7cd3310db ("nbd: add the check to prevent overflow in __nbd_ioctl()") raised an issue from the fallback helpers added in commit f0907827a8a9 ("compiler.h: enable builtin overflow checkers and add fallback code") Specifically, the helpers for checking whether the results of a multiplication overflowed (__unsigned_mul_overflow, __signed_add_overflow) use the division operator when !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW. This is problematic for 64b operands on 32b hosts. Also, because the macro is type agnostic, it is very difficult to write a similarly type generic macro that dispatches to one of: * div64_s64 * div64_u64 * div_s64 * div_u64 Raising the minimum supported versions allows us to remove all of the fallback helpers for !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW, instead dispatching the compiler builtins. arm64 has already raised the minimum supported GCC version to 5.1, do this for all targets now. See the link below for the previous discussion. Link: https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/ Link: https://lore.kernel.org/lkml/CAK7LNASs6dvU6D3jL2GG3jW58fXfaj6VNOe55NJnTB8UPuk2pA@mail.gmail.com/ Link: https://github.com/ClangBuiltLinux/linux/issues/1438 Reported-by: Stephen Rothwell Reported-by: Nathan Chancellor Suggested-by: Rasmus Villemoes Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit a69ae291e1cc2d08ae77c2029579c59c9bde5061 Author: Will Deacon Date: Mon Sep 13 17:35:47 2021 +0100 x86/uaccess: Fix 32-bit __get_user_asm_u64() when CC_HAS_ASM_GOTO_OUTPUT=y Commit 865c50e1d279 ("x86/uaccess: utilize CONFIG_CC_HAS_ASM_GOTO_OUTPUT") added an optimised version of __get_user_asm() for x86 using 'asm goto'. Like the non-optimised code, the 32-bit implementation of 64-bit get_user() expands to a pair of 32-bit accesses. Unlike the non-optimised code, the _original_ pointer is incremented to copy the high word instead of loading through a new pointer explicitly constructed to point at a 32-bit type. Consequently, if the pointer points at a 64-bit type then we end up loading the wrong data for the upper 32-bits. This was observed as a mount() failure in Android targeting i686 after b0cfcdd9b967 ("d_path: make 'prepend()' fill up the buffer exactly on overflow") because the call to copy_from_kernel_nofault() from prepend_copy() ends up in __get_kernel_nofault() and casts the source pointer to a 'u64 __user *'. An attempt to mount at "/debug_ramdisk" therefore ends up failing trying to mount "/debumdismdisk". Use the existing '__gu_ptr' source pointer to unsigned int for 32-bit __get_user_asm_u64() instead of the original pointer. Cc: Bill Wendling Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Peter Zijlstra Reported-by: Greg Kroah-Hartman Fixes: 865c50e1d279 ("x86/uaccess: utilize CONFIG_CC_HAS_ASM_GOTO_OUTPUT") Signed-off-by: Will Deacon Reviewed-by: Nick Desaulniers Tested-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 8e69212253d320d4768071086b1111e6ab91d9bd Author: Kari Argillander Date: Thu Sep 2 18:40:50 2021 +0300 fs/ntfs3: Always use binary search with entry search We do not have any reason to keep old linear search in. Before this was used for error path or if table was so big that it cannot be allocated. Current binary search implementation won't need error path. Remove old references to linear entry search. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit ef9297007e9904588682699e618c56401f61d1c2 Author: Kari Argillander Date: Thu Sep 2 18:40:49 2021 +0300 fs/ntfs3: Make binary search to search smaller chunks in beginning We could try to optimize algorithm to first fill just small table and after that use bigger table all the way up to ARRAY_SIZE(offs). This way we can use bigger search array, but not lose benefits with entry count smaller < ARRAY_SIZE(offs). Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 162333efa8dc4984d2ca0a2eb85528e13366f271 Author: Kari Argillander Date: Thu Sep 2 18:40:48 2021 +0300 fs/ntfs3: Limit binary search table size Current binary search allocates memory for table and fill whole table before we start actual binary search. This is quite inefficient because table fill will always be O(n). Also if table is huge we need to reallocate memory which is costly. This implementation use just stack memory and always when table is full we will check if last element is <= and if not start table fill again. The idea was that it would be same cost as table reallocation. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 9c2aadd0fdf88a7ebeebd1e97a9c66b07ad3e14a Author: Kari Argillander Date: Thu Sep 2 19:15:28 2021 +0300 fs/ntfs3: Remove unneeded header files from c files We have lot of unnecessary headers in these files. Remove them so that we help compiler a little bit. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 977d0558e310113767feed91fdcc618691dd2835 Author: Kari Argillander Date: Thu Sep 2 19:15:27 2021 +0300 fs/ntfs3: Change right headers to lznt.c There is lot of headers which we do not need in this file. Delete them and add what we really need. Here is list which identify why we need this header. // min() // kzalloc() // offsetof() // memcpy(), memset() // u8, size_t, etc. "debug.h" // PtrOffset() Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit f97676611937f4550a60970acadeccbd5e6f124c Author: Kari Argillander Date: Thu Sep 2 19:15:26 2021 +0300 fs/ntfs3: Change right headers to upcase.c There is no headers. They will be included through ntfs_fs.c, but that is not right thing to do. Let's include headers what this file need straight away. types.h is needed for __le16, u8 etc. kernel.h is needed for le16_to_cpu() Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit c632f639d1d9bb3e379741a30c6882342d859daf Author: Kari Argillander Date: Thu Sep 2 19:15:25 2021 +0300 fs/ntfs3: Change right headers to bitfunc.c We only need linux/types.h for types like u8 etc. So we can remove rest and help compiler a little bit. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit b6ba81034b1b74cf426abcece4becda2611504a4 Author: Kari Argillander Date: Thu Sep 2 19:15:24 2021 +0300 fs/ntfs3: Add missing header and guards to lib/ headers size_t needs header. Add missing header guards so that compiler will only include these ones. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit f239b3a95dd4f7daba26ea17f339a5b19a7d40a1 Author: Kari Argillander Date: Thu Sep 2 19:15:23 2021 +0300 fs/ntfs3: Add missing headers and forward declarations to ntfs_fs.h We do not have headers at all in this file. We should have them so that not every .c file needs to include all of the stuff which this file need for building. This way we can remove some headers from other files and get better picture what is needed. This can save some compilation time. And this can help if we sometimes want to separate this one big header. Also use forward declarations for structs and enums when it not included straight with include and it is used in function declarations input. This will prevent possible compiler warning: xxx declared inside parameter list will not be visible outside of this definition or declaration Here is list which I made when parsing this. There is not necessarily all example from this header file, but this just proofs we need it. SECTOR_SHIFT sb_bread(), put_bh put_page() struct inode (Just struct ntfs_inode need it) kunmap(), kmap() cpu_to_leXX() ALIGN kvfree() struct mutex, mutex_(un/try)lock() PageError() read_mapping_page() struct rb_root struct rw_semaphore krfree(), kzalloc() memset() struct timespec64 uXX, __leXX kuid_t, kgid_t do_div() PAGE_SIZE "debug.h" ntfs_err() (Just one entry. Maybe we can drop this) "ntfs.h" Do you even ask? Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 4dfe83320e1e9665b986840b426742ea764e08d7 Author: Kari Argillander Date: Thu Sep 2 19:15:22 2021 +0300 fs/ntfs3: Add missing header files to ntfs.h We do not have header files at all in this file. Add following headers and there is also explanation which for it was added. Note that explanation might not be complete, but it just proofs it is needed. // SECTOR_SHIFT // static_assert() // cpu_to_le64, cpu_to_le32, ALIGN // offsetof() // memcmp() //__le32, __le16 "debug.h" // PtrOffset(), Add2Ptr() Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit cde81f13ef63d47c3f0742fbe6f17a5123cf6ca4 Author: Kari Argillander Date: Thu Sep 2 19:15:21 2021 +0300 fs/ntfs3. Add forward declarations for structs to debug.h Add forward declarations for structs so that we can include this file without warnings even without linux/fs.h Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 0327c6d01a97a3242cf10717819994aa6e095a1d Author: Colin Ian King Date: Fri Sep 3 14:24:58 2021 +0100 fs/ntfs3: Remove redundant initialization of variable err The variable err is being initialized with a value that is never read, it is being updated later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit dd47c104533dedb90434a3f142e94a671ac623a6 Author: Eugene Syromiatnikov Date: Mon Sep 13 17:44:15 2021 +0200 io-wq: provide IO_WQ_* constants for IORING_REGISTER_IOWQ_MAX_WORKERS arg items The items passed in the array pointed by the arg parameter of IORING_REGISTER_IOWQ_MAX_WORKERS io_uring_register operation carry certain semantics: they refer to different io-wq worker categories; provide IO_WQ_* constants in the UAPI, so these categories can be referenced in the user space code. Suggested-by: Jens Axboe Complements: 2e480058ddc21ec5 ("io-wq: provide a way to limit max number of workers") Signed-off-by: Eugene Syromiatnikov Link: https://lore.kernel.org/r/20210913154415.GA12890@asgard.redhat.com Signed-off-by: Jens Axboe commit 510e1a724ab1bf38150be2c1acabb303f98d0047 Author: Hamza Mahfooz Date: Fri Sep 10 19:53:37 2021 -0400 dma-debug: prevent an error message from causing runtime problems For some drivers, that use the DMA API. This error message can be reached several millions of times per second, causing spam to the kernel's printk buffer and bringing the CPU usage up to 100% (so, it should be rate limited). However, since there is at least one driver that is in the mainline and suffers from the error condition, it is more useful to err_printk() here instead of just rate limiting the error message (in hopes that it will make it easier for other drivers that suffer from this issue to be spotted). Link: https://lkml.kernel.org/r/fd67fbac-64bf-f0ea-01e1-5938ccfab9d0@arm.com Reported-by: Jeremy Linton Signed-off-by: Hamza Mahfooz Signed-off-by: Christoph Hellwig commit f1db21c315f4b4f8c3fbea56aac500673132d317 Author: Marijn Suijten Date: Sun Aug 29 22:30:25 2021 +0200 ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference clock and should hence use PXO, not CXO which runs at 19.2MHz. Note that none of the DSI PHY/PLL drivers currently use this "ref" clock; they all rely on (sometimes inexistant) global clock names and usually function normally without a parent clock. This discrepancy will be corrected in a future patch, for which this change needs to be in place first. Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY") Reviewed-by: Dmitry Baryshkov Signed-off-by: Marijn Suijten Link: https://lore.kernel.org/r/20210829203027.276143-2-marijn.suijten@somainline.org Signed-off-by: Bjorn Andersson commit f5c03f131dae3f06d08464e6157dd461200f78d9 Author: David Heidelberg Date: Wed Aug 18 08:53:17 2021 +0200 ARM: dts: qcom: apq8064: use compatible which contains chipid Also resolves these kernel warnings for APQ8064: adreno 4300000.adreno-3xx: Using legacy qcom,chipid binding! adreno 4300000.adreno-3xx: Use compatible qcom,adreno-320.2 instead. Tested on Nexus 7 2013, no functional changes. Cc: Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20210818065317.19822-1-david@ixit.cz Signed-off-by: Bjorn Andersson commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 Author: Antonio Martorana Date: Mon Aug 16 17:24:39 2021 -0700 soc: qcom: socinfo: Fixed argument passed to platform_set_data() Set qcom_socinfo pointer as data being stored instead of pointer to soc_device structure. Aligns with future calls to platform_get_data() which expects qcom_socinfo pointer. Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver") Signed-off-by: Antonio Martorana Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/1629159879-95777-1-git-send-email-amartora@codeaurora.org Signed-off-by: Bjorn Andersson commit 9edceaf43050f5ba1dd7d0011bcf68a736a17743 Author: Daniel Wagner Date: Thu Sep 2 11:20:02 2021 +0200 nvme: avoid race in shutdown namespace removal When we remove the siblings entry, we update ns->head->list, hence we can't separate the removal and test for being empty. They have to be in the same critical section to avoid a race. To avoid breaking the refcounting imbalance again, add a list empty check to nvme_find_ns_head. Fixes: 5396fdac56d8 ("nvme: fix refcounting imbalance when all paths are down") Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke Tested-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 0bd46e22c5ec3dbfb81b60de475151e3f6b411c2 Author: Dan Carpenter Date: Thu Sep 9 12:14:40 2021 +0300 nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show() This was intended to limit the number of characters printed from "subsys->serial" to NVMET_SN_MAX_SIZE. But accidentally the width specifier was used instead of the precision specifier so it only affects the alignment and not the number of characters printed. Fixes: f04064814c2a ("nvmet: fixup buffer overrun in nvmet_subsys_attr_serial()") Signed-off-by: Dan Carpenter Signed-off-by: Christoph Hellwig commit d168cd797982db9db617113644c87b8f5f3cf27e Author: Zhi A Wang Date: Thu Aug 26 14:38:34 2021 +0000 drm/i915/gvt: fix the usage of ww lock in gvt scheduler. As the APIs related to ww lock in i915 was changed recently, the usage of ww lock in GVT-g scheduler needs to be changed accrodingly. We noticed a deadlock when GVT-g scheduler submits the workload to i915. After some investigation, it seems the way of how to use ww lock APIs has been changed. Releasing a ww now requires a explicit i915_gem_ww_ctx_fini(). Fixes: 67f1120381df ("drm/i915/gvt: Introduce per object locking in GVT scheduler.") Cc: Zhenyu Wang Signed-off-by: Zhi A Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20210826143834.25410-1-zhi.a.wang@intel.com Acked-by: Zhenyu Wang commit 8c0922ce4b9b0d542dcea871e54eb619661378d9 Merge: 111b64e35ea03 427900d27d86b Author: David S. Miller Date: Mon Sep 13 14:25:37 2021 +0100 Merge branch 'hns3-fixes' Guangbin Huang says: ==================== net: hns3: add some fixes for -net This series adds some fixes for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 427900d27d86b820c559037a984bd403f910860f Author: Jiaran Zhang Date: Mon Sep 13 21:08:25 2021 +0800 net: hns3: fix the timing issue of VF clearing interrupt sources Currently, the VF does not clear the interrupt source immediately after receiving the interrupt. As a result, if the second interrupt task is triggered when processing the first interrupt task, clearing the interrupt source before exiting will clear the interrupt sources of the two tasks at the same time. As a result, no interrupt is triggered for the second task. The VF detects the missed message only when the next interrupt is generated. Clearing it immediately after executing check_evt_cause ensures that: 1. Even if two interrupt tasks are triggered at the same time, they can be processed. 2. If the second task is triggered during the processing of the first task and the interrupt source is not cleared, the interrupt is reported after vector0 is enabled. Fixes: b90fcc5bd904 ("net: hns3: add reset handling for VF when doing Core/Global/IMP reset") Signed-off-by: Jiaran Zhang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 472430a7b066f19afa1b55867d621b2d6d323e0d Author: Jiaran Zhang Date: Mon Sep 13 21:08:24 2021 +0800 net: hns3: fix the exception when query imp info When the command for querying imp info is issued to the firmware, if the firmware does not support the command, the returned value of bd num is 0. Add protection mechanism before alloc memory to prevent apply for 0-length memory. Fixes: 0b198b0d80ea ("net: hns3: refactor dump m7 info of debugfs") Signed-off-by: Jiaran Zhang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit b81d8948746520f989e86d66292ff72b5056114a Author: Yufeng Mo Date: Mon Sep 13 21:08:23 2021 +0800 net: hns3: disable mac in flr process The firmware will not disable mac in flr process. Therefore, the driver needs to proactively disable mac during flr, which is the same as the function reset. Fixes: 35d93a30040c ("net: hns3: adjust the process of PF reset") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 1dc839ec09d3ab2a4156dc98328b8bc3586f2b70 Author: Yufeng Mo Date: Mon Sep 13 21:08:22 2021 +0800 net: hns3: change affinity_mask to numa node range Currently, affinity_mask is set to a single cpu. As a result, irqbalance becomes invalid in SUBSET or EXACT mode. To solve this problem, change affinity_mask to numa node range. In this way, irqbalance can be performed on the cpu of the numa node. Fixes: 0812545487ec ("net: hns3: add interrupt affinity support for misc interrupt") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit d18e81183b1cb9c309266cbbce9acd3e0c528d04 Author: Yufeng Mo Date: Mon Sep 13 21:08:21 2021 +0800 net: hns3: pad the short tunnel frame before sending to hardware The hardware cannot handle short tunnel frames below 65 bytes, and will cause vlan tag missing problem. So pads packet size to 65 bytes for tunnel frames to fix this bug. Fixes: 3db084d28dc0("net: hns3: Fix for vxlan tx checksum bug") Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit f7ec554b73c5239a96afb9a9c3eb18cb11f539b7 Author: Yunsheng Lin Date: Mon Sep 13 21:08:20 2021 +0800 net: hns3: add option to turn off page pool feature When page pool is added to the hns3 driver, it is always enabled unconditionally, which means spilt page handling in the hns3 driver is dead code. As there is a requirement to test the performance between spilt page handling in driver and page pool, so add a module param to support disabling the page pool. When the page pool is proved to perform better in most case, the spilt page handling in driver can be removed. Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool") Signed-off-by: Yunsheng Lin Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 7b9cf9036609428e845dc300aec13822ba2c4ab3 Author: Takashi Iwai Date: Fri Sep 10 12:51:55 2021 +0200 ALSA: usb-audio: Unify mixer resume and reset_resume procedure USB-audio driver assumes that the normal resume would preserve the device configuration while reset_resume wouldn't, and tries to restore the mixer elements only at reset_resume callback. However, this seems too naive, and some devices do behave differently, resetting the volume at the normal resume; this resulted in the inconsistent volume that surprised users. This patch changes the mixer resume code to handle both the normal and reset resume in the same way, always restoring the original mixer element values. This allows us to unify the both callbacks as well as dropping the no longer used reset_resume field, which ends up with a good code reduction. A slight behavior change by this patch is that now we assign restore_mixer_value() as the default resume callback, and the function is no longer called at reset-resume when the resume callback is overridden by the quirk function. That is, if needed, the quirk resume function would have to handle similarly as restore_mixer_value() by itself. Reported-by: En-Shuo Hsu Cc: Yu-Hsuan Hsu Link: https://lore.kernel.org/r/CADDZ45UPsbpAAqP6=ZkTT8BE-yLii4Y7xSDnjK550G2DhQsMew@mail.gmail.com Link: https://lore.kernel.org/r/20210910105155.12862-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6f44578430d7888ade1e3bd919c1c2c0724409e5 Author: Takashi Iwai Date: Mon Sep 13 14:43:30 2021 +0200 Revert "ALSA: hda: Drop workaround for a hang at shutdown again" This reverts commit 8fc8e903156f42c66245838441d03607e9067381. It was expected that the fixes in HD-audio codec side would make the workaround redundant, but unfortunately it doesn't seem sufficing. Resurrect the workaround for now. Fixes: 8fc8e903156f ("ALSA: hda: Drop workaround for a hang at shutdown again") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214045 Link: https://lore.kernel.org/r/20210913124330.24530-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 13404ac8882f5225af07545215f4975a564c3740 Author: Shawn Guo Date: Mon Sep 13 15:49:55 2021 +0300 interconnect: qcom: sdm660: Add missing a2noc qos clocks It adds the missing a2noc clocks required for QoS registers programming per downstream kernel[1]. Otherwise, qcom_icc_noc_set_qos_priority() call on mas_ufs or mas_usb_hs node will simply result in a hardware hang on SDM660 SoC. [1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/arch/arm/boot/dts/qcom/sdm660-bus.dtsi?h=LA.UM.8.2.r1-04800-sdm660.0#n43 Signed-off-by: Shawn Guo Tested-by: Bjorn Andersson Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20210824043435.23190-3-shawn.guo@linaro.org Signed-off-by: Georgi Djakov commit cf49e366020396ad83845c1c3bdbaa3c1406f5ce Author: Shawn Guo Date: Mon Sep 13 15:49:55 2021 +0300 dt-bindings: interconnect: sdm660: Add missing a2noc qos clocks It adds the missing a2noc clocks required for QoS registers programming per downstream kernel[1]. [1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/arch/arm/boot/dts/qcom/sdm660-bus.dtsi?h=LA.UM.8.2.r1-04800-sdm660.0#n43 Signed-off-by: Shawn Guo Reviewed-by: Rob Herring Acked-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20210824043435.23190-2-shawn.guo@linaro.org Signed-off-by: Georgi Djakov commit 5833c9b8766298e73c11766f9585d4ea4fa785ff Author: Shawn Guo Date: Mon Sep 13 15:49:55 2021 +0300 interconnect: qcom: sdm660: Correct NOC_QOS_PRIORITY shift and mask The NOC_QOS_PRIORITY shift and mask do not match what vendor kernel defines [1]. Correct them per vendor kernel. As the result of NOC_QOS_PRIORITY_P0_SHIFT being 0, the definition can be dropped and regmap_update_bits() call on P0 can be simplified a bit. [1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/drivers/soc/qcom/msm_bus/msm_bus_noc_adhoc.c?h=LA.UM.8.2.r1-04800-sdm660.0#n37 Fixes: f80a1d414328 ("interconnect: qcom: Add SDM660 interconnect provider driver") Signed-off-by: Shawn Guo Reviewed-by: Dmitry Baryshkov Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20210902054915.28689-1-shawn.guo@linaro.org Signed-off-by: Georgi Djakov commit a06c2e5c048e5e07fac9daf3073bd0b6582913c7 Author: Shawn Guo Date: Mon Sep 13 15:49:55 2021 +0300 interconnect: qcom: sdm660: Fix id of slv_cnoc_mnoc_cfg The id of slv_cnoc_mnoc_cfg node is mistakenly coded as id of slv_blsp_1. It causes the following warning on slv_blsp_1 node adding. Correct the id of slv_cnoc_mnoc_cfg node. [ 1.948180] ------------[ cut here ]------------ [ 1.954122] WARNING: CPU: 2 PID: 7 at drivers/interconnect/core.c:962 icc_node_add+0xe4/0xf8 [ 1.958994] Modules linked in: [ 1.967399] CPU: 2 PID: 7 Comm: kworker/u16:0 Not tainted 5.14.0-rc6-next-20210818 #21 [ 1.970275] Hardware name: Xiaomi Redmi Note 7 (DT) [ 1.978169] Workqueue: events_unbound deferred_probe_work_func [ 1.982945] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.988849] pc : icc_node_add+0xe4/0xf8 [ 1.995699] lr : qnoc_probe+0x350/0x438 [ 1.999519] sp : ffff80001008bb10 [ 2.003337] x29: ffff80001008bb10 x28: 000000000000001a x27: ffffb83ddc61ee28 [ 2.006818] x26: ffff2fe341d44080 x25: ffff2fe340f3aa80 x24: ffffb83ddc98f0e8 [ 2.013938] x23: 0000000000000024 x22: ffff2fe3408b7400 x21: 0000000000000000 [ 2.021054] x20: ffff2fe3408b7410 x19: ffff2fe341d44080 x18: 0000000000000010 [ 2.028173] x17: ffff2fe3bdd0aac0 x16: 0000000000000281 x15: ffff2fe3400f5528 [ 2.035290] x14: 000000000000013f x13: ffff2fe3400f5528 x12: 00000000ffffffea [ 2.042410] x11: ffffb83ddc9109d0 x10: ffffb83ddc8f8990 x9 : ffffb83ddc8f89e8 [ 2.049527] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 [ 2.056645] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffb83ddc9903b0 [ 2.063764] x2 : 1a1f6fde34d45500 x1 : ffff2fe340f3a880 x0 : ffff2fe340f3a880 [ 2.070882] Call trace: [ 2.077989] icc_node_add+0xe4/0xf8 [ 2.080247] qnoc_probe+0x350/0x438 [ 2.083718] platform_probe+0x68/0xd8 [ 2.087191] really_probe+0xb8/0x300 [ 2.091011] __driver_probe_device+0x78/0xe0 [ 2.094659] driver_probe_device+0x80/0x110 [ 2.098911] __device_attach_driver+0x90/0xe0 [ 2.102818] bus_for_each_drv+0x78/0xc8 [ 2.107331] __device_attach+0xf0/0x150 [ 2.110977] device_initial_probe+0x14/0x20 [ 2.114796] bus_probe_device+0x9c/0xa8 [ 2.118963] deferred_probe_work_func+0x88/0xc0 [ 2.122784] process_one_work+0x1a4/0x338 [ 2.127296] worker_thread+0x1f8/0x420 [ 2.131464] kthread+0x150/0x160 [ 2.135107] ret_from_fork+0x10/0x20 [ 2.138495] ---[ end trace 5eea8768cb620e87 ]--- Signed-off-by: Shawn Guo Reviewed-by: Bjorn Andersson Fixes: f80a1d414328 ("interconnect: qcom: Add SDM660 interconnect provider driver") Link: https://lore.kernel.org/r/20210823014003.31391-1-shawn.guo@linaro.org Signed-off-by: Georgi Djakov commit 3a1e92d0896e928ac2a5b58962d05a39afef2e23 Author: Ganesh Goudar Date: Thu Sep 9 12:13:30 2021 +0530 powerpc/mce: Fix access error in mce handler We queue an irq work for deferred processing of mce event in realmode mce handler, where translation is disabled. Queuing of the work may result in accessing memory outside RMO region, such access needs the translation to be enabled for an LPAR running with hash mmu else the kernel crashes. After enabling translation in mce_handle_error() we used to leave it enabled to avoid crashing here, but now with the commit 74c3354bc1d89 ("powerpc/pseries/mce: restore msr before returning from handler") we are restoring the MSR to disable translation. Hence to fix this enable the translation before queuing the work. Without this change following trace is seen on injecting SLB multihit in an LPAR running with hash mmu. Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries CPU: 5 PID: 1883 Comm: insmod Tainted: G OE 5.14.0-mce+ #137 NIP: c000000000735d60 LR: c000000000318640 CTR: 0000000000000000 REGS: c00000001ebff9a0 TRAP: 0300 Tainted: G OE (5.14.0-mce+) MSR: 8000000000001003 CR: 28008228 XER: 00000001 CFAR: c00000000031863c DAR: c00000027fa8fe08 DSISR: 40000000 IRQMASK: 0 ... NIP llist_add_batch+0x0/0x40 LR __irq_work_queue_local+0x70/0xc0 Call Trace: 0xc00000001ebffc0c (unreliable) irq_work_queue+0x40/0x70 machine_check_queue_event+0xbc/0xd0 machine_check_early_common+0x16c/0x1f4 Fixes: 74c3354bc1d89 ("powerpc/pseries/mce: restore msr before returning from handler") Signed-off-by: Ganesh Goudar [mpe: Fix comment formatting, trim oops in change log for readability] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210909064330.312432-1-ganeshgr@linux.ibm.com commit 267cdfa21385d78c794768233678756e32b39ead Author: Nicholas Piggin Date: Wed Sep 8 20:17:18 2021 +1000 KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers POWER9 DD2.2 and 2.3 hardware implements a "fake-suspend" mode where certain TM instructions executed in HV=0 mode cause softpatch interrupts so the hypervisor can emulate them and prevent problematic processor conditions. In this fake-suspend mode, the treclaim. instruction does not modify registers. Unfortunately the rfscv instruction executed by the guest do not generate softpatch interrupts, which can cause the hypervisor to lose track of the fake-suspend mode, and it can execute this treclaim. while not in fake-suspend mode. This modifies GPRs and crashes the hypervisor. It's not trivial to disable scv in the guest with HFSCR now, because they assume a POWER9 has scv available. So this fix saves and restores checkpointed registers across the treclaim. Fixes: 7854f7545bff ("KVM: PPC: Book3S: Rework TM save/restore code and make it C-callable") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210908101718.118522-2-npiggin@gmail.com commit ae7aaecc3f2f78b76ab3a8d6178610f55aadfa56 Author: Nicholas Piggin Date: Wed Sep 8 20:17:17 2021 +1000 powerpc/64s: system call rfscv workaround for TM bugs The rfscv instruction does not work correctly with the fake-suspend mode in POWER9, which can end up with the hypervisor restoring an incorrect checkpoint. Work around this by setting the _TIF_RESTOREALL flag if a system call returns to a transaction active state, causing rfid to be used instead of rfscv to return, which will do the right thing. The contents of the registers are irrelevant because they will be overwritten in this case anyway. Fixes: 7fa95f9adaee7 ("powerpc/64s: system call support for scv/rfscv instructions") Reported-by: Eirik Fuller Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210908101718.118522-1-npiggin@gmail.com commit 5379ef2a60431232b9bb01c6d3580b875123d723 Author: Nicholas Piggin Date: Fri Sep 3 22:57:07 2021 +1000 selftests/powerpc: Add scv versions of the basic TM syscall tests The basic TM vs syscall test code hard codes an sc instruction for the system call, which fails to cover scv even when the userspace libc has support for it. Duplicate the tests with hard coded scv variants so both are tested when possible. Signed-off-by: Nicholas Piggin [mpe: Fix build on old toolchains by using .long for scv] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210903125707.1601269-2-npiggin@gmail.com commit b871895b148256f1721bc565d803860242755a0b Author: Nicholas Piggin Date: Fri Sep 3 22:57:06 2021 +1000 powerpc/64s: system call scv tabort fix for corrupt irq soft-mask state If a system call is made with a transaction active, the kernel immediately aborts it and returns. scv system calls disable irqs even earlier in their interrupt handler, and tabort_syscall does not fix this up. This can result in irq soft-mask state being messed up on the next kernel entry, and crashing at BUG_ON(arch_irq_disabled_regs(regs)) in the kernel exit handlers, or possibly worse. This can't easily be fixed in asm because at this point an async irq may have hit, which is soft-masked and marked pending. The pending interrupt has to be replayed before returning to userspace. The fix is to move the tabort_syscall code to C in the main syscall handler, and just skip the system call but otherwise return as usual, which will take care of the pending irqs. This also does a bunch of other things including possible signal delivery to the process, but the doomed transaction should still be aborted when it is eventually returned to. The sc system call path is changed to use the new C function as well to reduce code and path differences. This slows down how quickly system calls are aborted when called while a transaction is active, which could potentially impact TM performance. But making any system call is already bad for performance, and TM is on the way out, so go with simpler over faster. Fixes: 7fa95f9adaee7 ("powerpc/64s: system call support for scv/rfscv instructions") Reported-by: Eirik Fuller Signed-off-by: Nicholas Piggin [mpe: Use #ifdef rather than IS_ENABLED() to fix build error on 32-bit] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210903125707.1601269-1-npiggin@gmail.com commit 111b64e35ea03d58c882832744f571a88bb2e2e2 Author: Aleksander Jan Bajkowski Date: Sun Sep 12 13:58:07 2021 +0200 net: dsa: lantiq_gswip: Add 200ms assert delay The delay is especially needed by the xRX300 and xRX330 SoCs. Without this patch, some phys are sometimes not properly detected. The patch was tested on BT Home Hub 5A and D-Link DWR-966. Fixes: a09d042b0862 ("net: dsa: lantiq: allow to use all GPHYs on xRX300 and xRX330") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Martin Blumenstingl Acked-by: Hauke Mehrtens Signed-off-by: David S. Miller commit e87b5052271e39d62337ade531992b7e5d8c2cfa Author: zhang kai Date: Thu Sep 9 16:39:18 2021 +0800 ipv6: delay fib6_sernum increase in fib6_add only increase fib6_sernum in net namespace after add fib6_info successfully. Signed-off-by: zhang kai Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 928faf5e3e8d3ec0388c9363b15355673c567966 Author: Robin Murphy Date: Wed Jul 14 18:22:38 2021 +0100 arm64: dts: fvp: Remove panel timings The simple-panel driver already has hard-coded timings for "arm,rtsm-display", and as such screams at us for trying to override a fixed mode from DT. Since the exact values probably don't matter all that much anyway, just remove the DT node to keep boot quiet. Link: https://lore.kernel.org/r/2701c187cf8e0762df38f68cc069ec2c29a3b5a9.1626283322.git.robin.murphy@arm.com Reviewed-by: Linus Walleij Signed-off-by: Robin Murphy Signed-off-by: Sudeep Holla commit f4bb62e64c88c93060c051195d3bbba804e56945 Author: Hoang Le Date: Mon Sep 13 16:28:52 2021 +0700 tipc: increase timeout in tipc_sk_enqueue() In tipc_sk_enqueue() we use hardcoded 2 jiffies to extract socket buffer from generic queue to particular socket. The 2 jiffies is too short in case there are other high priority tasks get CPU cycles for multiple jiffies update. As result, no buffer could be enqueued to particular socket. To solve this, we switch to use constant timeout 20msecs. Then, the function will be expired between 2 jiffies (CONFIG_100HZ) and 20 jiffies (CONFIG_1000HZ). Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception") Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller commit e50e711351bdc656a8e6ca1022b4293cae8dcd59 Author: Aya Levin Date: Mon Sep 13 10:53:49 2021 +0300 udp_tunnel: Fix udp_tunnel_nic work-queue type Turn udp_tunnel_nic work-queue to an ordered work-queue. This queue holds the UDP-tunnel configuration commands of the different netdevs. When the netdevs are functions of the same NIC the order of execution may be crucial. Problem example: NIC with 2 PFs, both PFs declare offload quota of up to 3 UDP-ports. $ifconfig eth2 1.1.1.1/16 up $ip link add eth2_19503 type vxlan id 5049 remote 1.1.1.2 dev eth2 dstport 19053 $ip link set dev eth2_19503 up $ip link add eth2_19504 type vxlan id 5049 remote 1.1.1.3 dev eth2 dstport 19054 $ip link set dev eth2_19504 up $ip link add eth2_19505 type vxlan id 5049 remote 1.1.1.4 dev eth2 dstport 19055 $ip link set dev eth2_19505 up $ip link add eth2_19506 type vxlan id 5049 remote 1.1.1.5 dev eth2 dstport 19056 $ip link set dev eth2_19506 up NIC RX port offload infrastructure offloads the first 3 UDP-ports (on all devices which sets NETIF_F_RX_UDP_TUNNEL_PORT feature) and not UDP-port 19056. So both PFs gets this offload configuration. $ip link set dev eth2_19504 down This triggers udp-tunnel-core to remove the UDP-port 19504 from offload-ports-list and offload UDP-port 19056 instead. In this scenario it is important that the UDP-port of 19504 will be removed from both PFs before trying to add UDP-port 19056. The NIC can stop offloading a UDP-port only when all references are removed. Otherwise the NIC may report exceeding of the offload quota. Fixes: cc4e3835eff4 ("udp_tunnel: add central NIC RX port offload infrastructure") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller commit d7807a9adf4856171f8441f13078c33941df48ab Author: Yajun Deng Date: Mon Sep 13 12:04:42 2021 +0800 Revert "ipv4: fix memory leaks in ip_cmsg_send() callers" This reverts commit 919483096bfe75dda338e98d56da91a263746a0a. There is only when ip_options_get() return zero need to free. It already called kfree() when return error. Fixes: 919483096bfe ("ipv4: fix memory leaks in ip_cmsg_send() callers") Signed-off-by: Yajun Deng Signed-off-by: David S. Miller commit 2049eb0d20de1e6533526ad209f5d1b006ed97c7 Merge: f11ee2ad25b22 985941e1dd5e9 Author: David S. Miller Date: Mon Sep 13 12:31:13 2021 +0100 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. The first patch fixes an error recovery regression just introduced about a week ago. The other two patches fix issues related to freeing rings in the bnxt_close() path under error conditions. ==================== Signed-off-by: David S. Miller commit 985941e1dd5e996311c29688ca0d3aa1ff8eb0b6 Author: Michael Chan Date: Sun Sep 12 12:34:49 2021 -0400 bnxt_en: Clean up completion ring page arrays completely We recently changed the completion ring page arrays to be dynamically allocated to better support the expanded range of ring depths. The cleanup path for this was not quite complete. It might cause the shutdown path to crash if we need to abort before the completion ring arrays have been allocated and initialized. Fix it by initializing the ring_mem->pg_arr to NULL after freeing the completion ring page array. Add a check in bnxt_free_ring() to skip referencing the rmem->pg_arr if it is NULL. Fixes: 03c7448790b8 ("bnxt_en: Don't use static arrays for completion ring pages") Reviewed-by: Andy Gospodarek Reviewed-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1affc01fdc6035189a5ab2a24948c9419ee0ecf2 Author: Edwin Peer Date: Sun Sep 12 12:34:48 2021 -0400 bnxt_en: make bnxt_free_skbs() safe to call after bnxt_free_mem() The call to bnxt_free_mem(..., false) in the bnxt_half_open_nic() error path will deallocate ring descriptor memory via bnxt_free_?x_rings(), but because irq_re_init is false, the ring info itself is not freed. To simplify error paths, deallocation functions have generally been written to be safe when called on unallocated memory. It should always be safe to call dev_close(), which calls bnxt_free_skbs() a second time, even in this semi- allocated ring state. Calling bnxt_free_skbs() a second time with the rings already freed will cause NULL pointer dereference. Fix it by checking the rings are valid before proceeding in bnxt_free_tx_skbs() and bnxt_free_one_rx_ring_skbs(). Fixes: 975bc99a4a39 ("bnxt_en: Refactor bnxt_free_rx_skbs().") Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit eca4cf12acda306f851f6d2a05b1c9ef62cf0e81 Author: Michael Chan Date: Sun Sep 12 12:34:47 2021 -0400 bnxt_en: Fix error recovery regression The recent patch has introduced a regression by not reading the reset count in the ERROR_RECOVERY async event handler. We may have just gone through a reset and the reset count has just incremented. If we don't update the reset count in the ERROR_RECOVERY event handler, the health check timer will see that the reset count has changed and will initiate an unintended reset. Restore the unconditional update of the reset count in bnxt_async_event_process() if error recovery watchdog is enabled. Also, update the reset count at the end of the reset sequence to make it even more robust. Fixes: 1b2b91831983 ("bnxt_en: Fix possible unintended driver initiated error recovery") Reviewed-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit a7b68ed15d1fd72c1e451d5eb6edebee2a624b90 Author: Geert Uytterhoeven Date: Tue Sep 7 14:45:11 2021 +0200 m68k: mvme: Remove overdue #warnings in RTC handling The warnings were introduced when converting the MVME147 and MVME16x RTC handling from gettod to hwclk. Replace the #warning by a comment, and return an error to inform the upper layer that writing to the RTC is not yet supported. Signed-off-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20210907124511.2723414-1-geert@linux-m68k.org commit b1a89856fbf63fffde6a4771d8f1ac21df549e50 Author: Guenter Roeck Date: Mon Sep 6 23:07:29 2021 -0700 m68k: Double cast io functions to unsigned long m68k builds fail widely with errors such as arch/m68k/include/asm/raw_io.h:20:19: error: cast to pointer from integer of different size arch/m68k/include/asm/raw_io.h:30:32: error: cast to pointer from integer of different size [-Werror=int-to-p On m68k, io functions are defined as macros. The problem is seen if the macro parameter variable size differs from the size of a pointer. Cast the parameter of all io macros to unsigned long before casting it to a pointer to fix the problem. Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20210907060729.2391992-1-linux@roeck-us.net Signed-off-by: Geert Uytterhoeven commit 196159d278ae3b49e7bbb7c76822e6008fd89b97 Author: Hans de Goede Date: Sun Sep 5 15:02:10 2021 +0200 platform/x86: touchscreen_dmi: Update info for the Chuwi Hi10 Plus (CWI527) tablet Add info for getting the firmware directly from the UEFI for the Chuwi Hi10 Plus (CWI527), so that the user does not need to manually install the firmware in /lib/firmware/silead. This change will make the touchscreen on these devices work OOTB, without requiring any manual setup. Also tweak the min and width/height values a bit for more accurate position reporting. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20210905130210.32810-2-hdegoede@redhat.com commit 3bf1669b0e033c885ebcb1ddc2334088dd125f2d Author: Hans de Goede Date: Sun Sep 5 15:02:09 2021 +0200 platform/x86: touchscreen_dmi: Add info for the Chuwi HiBook (CWI514) tablet Add touchscreen info for the Chuwi HiBook (CWI514) tablet. This includes info for getting the firmware directly from the UEFI, so that the user does not need to manually install the firmware in /lib/firmware/silead. This change will make the touchscreen on these devices work OOTB, without requiring any manual setup. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20210905130210.32810-1-hdegoede@redhat.com commit 4c4a3d7cffb42da21ea8891fc7e6808ae05dbcb5 Author: Matan Ziv-Av Date: Sun Aug 29 15:07:08 2021 +0300 lg-laptop: Correctly handle dmi_get_system_info() returning NULL The laptop model is identified by parsing the product name. If no product name is available, do not try to parse it. Default model is 2017. Signed-off-by: Matan Ziv-Av Link: https://lore.kernel.org/r/93ff3bb-503b-f73-bf18-87bae1699ed@svgalib.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 349bff48ae0f5f8aa2075d0bdc2091a30bd634f6 Author: Andy Shevchenko Date: Fri Aug 27 17:53:10 2021 +0300 platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() ACPI_PTR() is more harmful than helpful. For example, in this case if CONFIG_ACPI=n, the ID table left unused which is not what we want. Instead of adding ifdeffery here and there, drop ACPI_PTR() and unused acpi.h. Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver") Reported-by: kernel test robot Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20210827145310.76239-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 7bb057134d609b9c038a00b6876cf0d37d0118ce Author: Carlo Lobrano Date: Fri Sep 3 14:39:13 2021 +0200 USB: serial: option: add Telit LN920 compositions This patch adds the following Telit LN920 compositions: 0x1060: tty, adb, rmnet, tty, tty, tty, tty 0x1061: tty, adb, mbim, tty, tty, tty, tty 0x1062: rndis, tty, adb, tty, tty, tty, tty 0x1063: tty, adb, ecm, tty, tty, tty, tty Signed-off-by: Carlo Lobrano Link: https://lore.kernel.org/r/20210903123913.1086513-1-c.lobrano@gmail.com Reviewed-by: Daniele Palmas Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 9d37e1cab2a9d2cee2737973fa455e6f89eee46a Author: David Howells Date: Wed Sep 8 21:55:19 2021 +0100 afs: Fix updating of i_blocks on file/dir extension When an afs file or directory is modified locally such that the total file size is extended, i_blocks needs to be recalculated too. Fix this by making afs_write_end() and afs_edit_dir_add() call afs_set_i_size() rather than setting inode->i_size directly as that also recalculates inode->i_blocks. This can be tested by creating and writing into directories and files and then examining them with du. Without this change, directories show a 4 blocks (they start out at 2048 bytes) and files show 0 blocks; with this change, they should show a number of blocks proportional to the file size rounded up to 1024. Fixes: 31143d5d515e ("AFS: implement basic file write support") Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...") Reported-by: Markus Suvanto Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163113612442.352844.11162345591911691150.stgit@warthog.procyon.org.uk/ commit b537a3c21775075395af475dcc6ef212fcf29db8 Author: David Howells Date: Fri Sep 10 00:01:52 2021 +0100 afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server AFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and Linux's afs client switches between them when talking to a non-YFS server if the read size, the file position or the sum of the two have the upper 32 bits set of the 64-bit value. This is a problem, however, since the file position and length fields of FS.FetchData are *signed* 32-bit values. Fix this by capturing the capability bits obtained from the fileserver when it's sent an FS.GetCapabilities RPC, rather than just discarding them, and then picking out the VICED_CAPABILITY_64BITFILES flag. This can then be used to decide whether to use FS.FetchData or FS.FetchData64 - and also FS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to switch on the parameter values. This capabilities flag could also be used to limit the maximum size of the file, but all servers must be checked for that. Note that the issue does not exist with FS.StoreData - that uses *unsigned* 32-bit values. It's also not a problem with Auristor servers as its YFS.FetchData64 op uses unsigned 64-bit values. This can be tested by cloning a git repo through an OpenAFS client to an OpenAFS server and then doing "git status" on it from a Linux afs client[1]. Provided the clone has a pack file that's in the 2G-4G range, the git status will show errors like: error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index error: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index This can be observed in the server's FileLog with something like the following appearing: Sun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001 Sun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154 Sun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866 ... Sun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5 Note the file position of 18446744071815340032. This is the requested file position sign-extended. Fixes: b9b1f8d5930a ("AFS: write support fixes") Reported-by: Markus Suvanto Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org cc: openafs-devel@openafs.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c9 [1] Link: https://lore.kernel.org/r/951332.1631308745@warthog.procyon.org.uk/ commit 4fe6a946823a9bc8619fd16b7ea7d15914a30f22 Author: David Howells Date: Thu Sep 2 21:51:01 2021 +0100 afs: Try to avoid taking RCU read lock when checking vnode validity Try to avoid taking the RCU read lock when checking the validity of a vnode's callback state. The only thing it's needed for is to pin the parent volume's server list whilst we search it to find the record of the server we're currently using to see if it has been reinitialised (ie. it sent us a CB.InitCallBackState* RPC). Do this by the following means: (1) Keep an additional per-cell counter (fs_s_break) that's incremented each time any of the fileservers in the cell reinitialises. Since the new counter can be accessed without RCU from the vnode, we can check that first - and only if it differs, get the RCU read lock and check the volume's server list. (2) Replace afs_get_s_break_rcu() with afs_check_server_good() which now indicates whether the callback promise is still expected to be present on the server. This does the checks as described in (1). (3) Restructure afs_check_validity() to take account of the change in (2). We can also get rid of the valid variable and just use the need_clear variable with the addition of the afs_cb_break_no_promise reason. (4) afs_check_validity() probably shouldn't be altering vnode->cb_v_break and vnode->cb_s_break when it doesn't have cb_lock exclusively locked. Move the change to vnode->cb_v_break to __afs_break_callback(). Delegate the change to vnode->cb_s_break to afs_select_fileserver() and set vnode->cb_fs_s_break there also. (5) afs_validate() no longer needs to get the RCU read lock around its call to afs_check_validity() - and can skip the call entirely if we don't have a promise. Signed-off-by: David Howells Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163111669583.283156.1397603105683094563.stgit@warthog.procyon.org.uk/ commit 6e0e99d58a6530cf65f10e4bb16630c5be6c254d Author: David Howells Date: Thu Sep 2 16:43:10 2021 +0100 afs: Fix mmap coherency vs 3rd-party changes Fix the coherency management of mmap'd data such that 3rd-party changes become visible as soon as possible after the callback notification is delivered by the fileserver. This is done by the following means: (1) When we break a callback on a vnode specified by the CB.CallBack call from the server, we queue a work item (vnode->cb_work) to go and clobber all the PTEs mapping to that inode. This causes the CPU to trip through the ->map_pages() and ->page_mkwrite() handlers if userspace attempts to access the page(s) again. (Ideally, this would be done in the service handler for CB.CallBack, but the server is waiting for our reply before considering, and we have a list of vnodes, all of which need breaking - and the process of getting the mmap_lock and stripping the PTEs on all CPUs could be quite slow.) (2) Call afs_validate() from the ->map_pages() handler to check to see if the file has changed and to get a new callback promise from the server. Also handle the fileserver telling us that it's dropping all callbacks, possibly after it's been restarted by sending us a CB.InitCallBackState* call by the following means: (3) Maintain a per-cell list of afs files that are currently mmap'd (cell->fs_open_mmaps). (4) Add a work item to each server that is invoked if there are any open mmaps when CB.InitCallBackState happens. This work item goes through the aforementioned list and invokes the vnode->cb_work work item for each one that is currently using this server. This causes the PTEs to be cleared, causing ->map_pages() or ->page_mkwrite() to be called again, thereby calling afs_validate() again. I've chosen to simply strip the PTEs at the point of notification reception rather than invalidate all the pages as well because (a) it's faster, (b) we may get a notification for other reasons than the data being altered (in which case we don't want to clobber the pagecache) and (c) we need to ask the server to find out - and I don't want to wait for the reply before holding up userspace. This was tested using the attached test program: #include #include #include #include #include #include int main(int argc, char *argv[]) { size_t size = getpagesize(); unsigned char *p; bool mod = (argc == 3); int fd; if (argc != 2 && argc != 3) { fprintf(stderr, "Format: %s [mod]\n", argv[0]); exit(2); } fd = open(argv[1], mod ? O_RDWR : O_RDONLY); if (fd < 0) { perror(argv[1]); exit(1); } p = mmap(NULL, size, mod ? PROT_READ|PROT_WRITE : PROT_READ, MAP_SHARED, fd, 0); if (p == MAP_FAILED) { perror("mmap"); exit(1); } for (;;) { if (mod) { p[0]++; msync(p, size, MS_ASYNC); fsync(fd); } printf("%02x", p[0]); fflush(stdout); sleep(1); } } It runs in two modes: in one mode, it mmaps a file, then sits in a loop reading the first byte, printing it and sleeping for a second; in the second mode it mmaps a file, then sits in a loop incrementing the first byte and flushing, then printing and sleeping. Two instances of this program can be run on different machines, one doing the reading and one doing the writing. The reader should see the changes made by the writer, but without this patch, they aren't because validity checking is being done lazily - only on entry to the filesystem. Testing the InitCallBackState change is more complicated. The server has to be taken offline, the saved callback state file removed and then the server restarted whilst the reading-mode program continues to run. The client machine then has to poke the server to trigger the InitCallBackState call. Signed-off-by: David Howells Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163111668833.283156.382633263709075739.stgit@warthog.procyon.org.uk/ commit 63d49d843ef5fffeea069e0ffdfbd2bf40ba01c6 Author: David Howells Date: Wed Sep 1 18:11:33 2021 +0100 afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation The AFS filesystem is currently triggering the silly-rename cleanup from afs_d_revalidate() when it sees that a dentry has been changed by a third party[1]. It should not be doing this as the cleanup includes deleting the silly-rename target file on iput. Fix this by removing the places in the d_revalidate handling that validate anything other than the directory and the dirent. It probably should not be looking to validate the target inode of the dentry also. This includes removing the point in afs_d_revalidate() where the inode that a dentry used to point to was marked as being deleted (AFS_VNODE_DELETED). We don't know it got deleted. It could have been renamed or it could have hard links remaining. This was reproduced by cloning a git repo onto an afs volume on one machine, switching to another machine and doing "git status", then switching back to the first and doing "git status". The second status would show weird output due to ".git/index" getting deleted by the above mentioned mechanism. A simpler way to do it is to do: machine 1: touch a machine 2: touch b; mv -f b a machine 1: stat a on an afs volume. The bug shows up as the stat failing with ENOENT and the file server log showing that machine 1 deleted "a". Fixes: 79ddbfa500b3 ("afs: Implement sillyrename for unlink and rename") Reported-by: Markus Suvanto Signed-off-by: David Howells Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c4 [1] Link: https://lore.kernel.org/r/163111668100.283156.3851669884664475428.stgit@warthog.procyon.org.uk/ commit 3978d816523991dd86cf9aae88c295230a5ea3b2 Author: David Howells Date: Wed Sep 1 19:22:50 2021 +0100 afs: Add missing vnode validation checks afs_d_revalidate() should only be validating the directory entry it is given and the directory to which that belongs; it shouldn't be validating the inode/vnode to which that dentry points. Besides, validation need to be done even if we don't call afs_d_revalidate() - which might be the case if we're starting from a file descriptor. In order for afs_d_revalidate() to be fixed, validation points must be added in some other places. Certain directory operations, such as afs_unlink(), already check this, but not all and not all file operations either. Note that the validation of a vnode not only checks to see if the attributes we have are correct, but also gets a promise from the server to notify us if that file gets changed by a third party. Add the following checks: - Check the vnode we're going to make a hard link to. - Check the vnode we're going to move/rename. - Check the vnode we're going to read from. - Check the vnode we're going to write to. - Check the vnode we're going to sync. - Check the vnode we're going to make a mapped page writable for. Some of these aren't strictly necessary as we're going to perform a server operation that might get the attributes anyway from which we can determine if something changed - though it might not get us a callback promise. Signed-off-by: David Howells Tested-by: Markus Suvanto cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163111667354.283156.12720698333342917516.stgit@warthog.procyon.org.uk/ commit 0764e365dacd0b8f75c1736f9236be280649bd18 Author: Clément Bœsch Date: Sun Sep 5 02:20:27 2021 +0200 arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node RX and TX delay are provided by ethernet PHY. Reflect that in ethernet node. Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes") Signed-off-by: Clément Bœsch Reviewed-by: Jernej Skrabec Reviewed-by: Andrew Lunn Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20210905002027.171984-1-u@pkh.me commit 64794d6db49730d22f440aef0cf4da98a56a4ea3 Author: Takashi Sakamoto Date: Mon Sep 13 11:10:42 2021 +0900 ALSA: oxfw: fix transmission method for Loud models based on OXFW971 Loud Technologies Mackie Onyx 1640i (former model) is identified as the model which uses OXFW971. The analysis of packet dump shows that it transfers events in blocking method of IEC 61883-6, however the default behaviour of ALSA oxfw driver is for non-blocking method. This commit adds code to detect it assuming that all of loud models based on OXFW971 have such quirk. It brings no functional change except for alignment rule of PCM buffer. Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20210913021042.10085-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 67f3b2f822b7e71cfc9b42dbd9f3144fa2933e0b Author: Ming Lei Date: Mon Sep 6 14:50:03 2021 +0800 blk-mq: avoid to iterate over stale request blk-mq can't run allocating driver tag and updating ->rqs[tag] atomically, meantime blk-mq doesn't clear ->rqs[tag] after the driver tag is released. So there is chance to iterating over one stale request just after the tag is allocated and before updating ->rqs[tag]. scsi_host_busy_iter() calls scsi_host_check_in_flight() to count scsi in-flight requests after scsi host is blocked, so no new scsi command can be marked as SCMD_STATE_INFLIGHT. However, driver tag allocation still can be run by blk-mq core. One request is marked as SCMD_STATE_INFLIGHT, but this request may have been kept in another slot of ->rqs[], meantime the slot can be allocated out but ->rqs[] isn't updated yet. Then this in-flight request is counted twice as SCMD_STATE_INFLIGHT. This way causes trouble in handling scsi error. Fixes the issue by not iterating over stale request. Cc: linux-scsi@vger.kernel.org Cc: "Martin K. Petersen" Reported-by: luojiaxing Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20210906065003.439019-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 767a65e9f31789d80e41edd03a802314905e8fbf Author: Hao Xu Date: Sun Sep 12 03:40:52 2021 +0800 io-wq: fix potential race of acct->nr_workers Given max_worker is 1, and we currently have 1 running and it is exiting. There may be race like: io_wqe_enqueue worker1 no work there and timeout unlock(wqe->lock) ->insert work -->io_worker_exit lock(wqe->lock) ->if(!nr_workers) //it's still 1 unlock(wqe->lock) goto run_cancel lock(wqe->lock) nr_workers-- ->dec_running ->worker creation fails unlock(wqe->lock) We enqueued one work but there is no workers, causes hung. Signed-off-by: Hao Xu Signed-off-by: Jens Axboe commit 7a842fb589e3cdbe205bc16dc37c30cf13383159 Author: Hao Xu Date: Sun Sep 12 03:40:50 2021 +0800 io-wq: code clean of io_wqe_create_worker() Remove do_create to save a local variable. Signed-off-by: Hao Xu Signed-off-by: Jens Axboe commit 16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc Author: Jens Axboe Date: Sun Sep 12 06:45:07 2021 -0600 io_uring: ensure symmetry in handling iter types in loop_rw_iter() When setting up the next segment, we check what type the iter is and handle it accordingly. However, when incrementing and processed amount we do not, and both iter advance and addr/len are adjusted, regardless of type. Split the increment side just like we do on the setup side. Fixes: 4017eb91a9e7 ("io_uring: make loop_rw_iter() use original user supplied pointers") Cc: stable@vger.kernel.org Reported-by: Valentina Palmiotti Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 23c69b90365c8280b627aa969393d828ff47ac14 Author: suma hegde Date: Thu Sep 2 23:11:54 2021 +0530 hwmon: (k10temp) Remove residues of current and voltage Commit id "b00647c46c9d7f6ee1ff6aaf335906101755e614", adds reporting current and voltage to k10temp.c The commit id "0a4e668b5d52eed8026f5d717196b02b55fb2dc6", removed reporting current and voltage from k10temp.c The curr and in(voltage) entries are not removed from "k10temp_info" structure. Removing those residue entries. while at it, update k10temp driver documentation Signed-off-by: suma hegde Cc: Guenter Roeck Link: https://lore.kernel.org/r/20210902174155.7365-2-nchatrad@amd.com Signed-off-by: Guenter Roeck commit 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f Author: Linus Torvalds Date: Sun Sep 12 16:28:37 2021 -0700 Linux 5.15-rc1 commit b5b65f1398274fd726eca87dbebd39f3e603348a Merge: c3e46874dfb9a 17a99e521f677 Author: Linus Torvalds Date: Sun Sep 12 16:18:15 2021 -0700 Merge tag 'perf-tools-for-v5.15-2021-09-11' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tools updates from Arnaldo Carvalho de Melo: - Add missing fields and remove some duplicate fields when printing a perf_event_attr. - Fix hybrid config terms list corruption. - Update kernel header copies, some resulted in new kernel features being automagically added to 'perf trace' syscall/tracepoint argument id->string translators. - Add a file generated during the documentation build to .gitignore. - Add an option to build without libbfd, as some distros, like Debian consider its ABI unstable. - Add support to print a textual representation of IBS raw sample data in 'perf report'. - Fix bpf 'perf test' sample mismatch reporting - Fix passing arguments to stackcollapse report in a 'perf script' python script. - Allow build-id with trailing zeros. - Look for ImageBase in PE file to compute .text offset. * tag 'perf-tools-for-v5.15-2021-09-11' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (25 commits) tools headers UAPI: Update tools's copy of drm.h headers tools headers UAPI: Sync drm/i915_drm.h with the kernel sources tools headers UAPI: Sync linux/fs.h with the kernel sources tools headers UAPI: Sync linux/in.h copy with the kernel sources perf tools: Add an option to build without libbfd perf tools: Allow build-id with trailing zeros perf tools: Fix hybrid config terms list corruption perf tools: Factor out copy_config_terms() and free_config_terms() perf tools: Fix perf_event_attr__fprintf() missing/dupl. fields perf tools: Ignore Documentation dependency file perf bpf: Provide a weak btf__load_from_kernel_by_id() for older libbpf versions tools include UAPI: Update linux/mount.h copy perf beauty: Cover more flags in the move_mount syscall argument beautifier tools headers UAPI: Sync linux/prctl.h with the kernel sources tools include UAPI: Sync sound/asound.h copy with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources perf report: Add support to print a textual representation of IBS raw sample data perf report: Add tools/arch/x86/include/asm/amd-ibs.h perf env: Add perf_env__cpuid, perf_env__{nr_}pmu_mappings ... commit c3e46874dfb9a2ef08085bb147dc371e72738673 Merge: d41adc4e22c62 b83a908498d68 Author: Linus Torvalds Date: Sun Sep 12 16:09:26 2021 -0700 Merge tag 'compiler-attributes-for-linus-v5.15-rc1-v2' of git://github.com/ojeda/linux Pull compiler attributes updates from Miguel Ojeda: - Fix __has_attribute(__no_sanitize_coverage__) for GCC 4 (Marco Elver) - Add Nick as Reviewer for compiler_attributes.h (Nick Desaulniers) - Move __compiletime_{error|warning} (Nick Desaulniers) * tag 'compiler-attributes-for-linus-v5.15-rc1-v2' of git://github.com/ojeda/linux: compiler_attributes.h: move __compiletime_{error|warning} MAINTAINERS: add Nick as Reviewer for compiler_attributes.h Compiler Attributes: fix __has_attribute(__no_sanitize_coverage__) for GCC 4 commit d41adc4e22c62640fa7de93f713a3c5b3638ab2e Merge: f306b90c69ce3 24ebc044c72ee Author: Linus Torvalds Date: Sun Sep 12 16:00:49 2021 -0700 Merge tag 'auxdisplay-for-linus-v5.15-rc1' of git://github.com/ojeda/linux Pull auxdisplay updates from Miguel Ojeda: "An assortment of improvements for auxdisplay: - Replace symbolic permissions with octal permissions (Jinchao Wang) - ks0108: Switch to use module_parport_driver() (Andy Shevchenko) - charlcd: Drop unneeded initializers and switch to C99 style (Andy Shevchenko) - hd44780: Fix oops on module unloading (Lars Poeschel) - Add I2C gpio expander example (Ralf Schlatterbeck)" * tag 'auxdisplay-for-linus-v5.15-rc1' of git://github.com/ojeda/linux: auxdisplay: Replace symbolic permissions with octal permissions auxdisplay: ks0108: Switch to use module_parport_driver() auxdisplay: charlcd: Drop unneeded initializers and switch to C99 style auxdisplay: hd44780: Fix oops on module unloading auxdisplay: Add I2C gpio expander example commit f306b90c69ce3994bb8046b54374a90a27f66be6 Merge: d8e988b62f948 c9871c800f65f Author: Linus Torvalds Date: Sun Sep 12 12:42:51 2021 -0700 Merge tag 'smp-urgent-2021-09-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug updates from Thomas Gleixner: "Updates for the SMP and CPU hotplug: - Remove DEFINE_SMP_CALL_CACHE_FUNCTION() which is a left over of the original hotplug code and now causing trouble with the ARM64 cache topology setup due to the pointless SMP function call. It's not longer required as the hotplug callbacks are guaranteed to be invoked on the upcoming CPU. - Remove the deprecated and now unused CPU hotplug functions - Rewrite the CPU hotplug API documentation" * tag 'smp-urgent-2021-09-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation: core-api/cpuhotplug: Rewrite the API section cpu/hotplug: Remove deprecated CPU-hotplug functions. thermal: Replace deprecated CPU-hotplug functions. drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() commit d8e988b62f948d47dd86ec655c89d54053df1754 Merge: 1791596be2723 3a3a11e6e5a2b Author: Linus Torvalds Date: Sun Sep 12 11:56:00 2021 -0700 Merge tag 'char-misc-5.15-rc1-lkdtm' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull misc driver fix from Greg KH: "Here is a single patch for 5.15-rc1, for the lkdtm misc driver. It resolves a build issue that many people were hitting with your current tree, and Kees and others felt would be good to get merged before -rc1 comes out, to prevent them from having to constantly hit it as many development trees restart on -rc1, not older -rc releases. It has NOT been in linux-next, but has passed 0-day testing and looks 'obviously correct' when reviewing it locally :)" * tag 'char-misc-5.15-rc1-lkdtm' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: lkdtm: Use init_uts_ns.name instead of macros commit 1791596be2723f01de2f69d16a422fdba182c706 Merge: 56c244382fdb7 bf064c7bec3bf Author: Linus Torvalds Date: Sun Sep 12 11:44:58 2021 -0700 Merge tag 'for-linus-5.15-1' of git://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "A couple of very minor fixes for style and rate limiting. Nothing big, but probably needs to go in" * tag 'for-linus-5.15-1' of git://github.com/cminyard/linux-ipmi: char: ipmi: use DEVICE_ATTR helper macro ipmi: rate limit ipmi smi_event failure message commit 56c244382fdb793986097df8e29f9f9320bc2c60 Merge: 165d05d88c276 868ad33bfa3bf Author: Linus Torvalds Date: Sun Sep 12 11:37:41 2021 -0700 Merge tag 'sched_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Make sure the idle timer expires in hardirq context, on PREEMPT_RT - Make sure the run-queue balance callback is invoked only on the outgoing CPU * tag 'sched_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Prevent balance_push() on remote runqueues sched/idle: Make the idle timer expire in hard interrupt context commit 165d05d88c27697fe444a6eae4f3882834ef8826 Merge: 7bf3142625c19 e5480572706da Author: Linus Torvalds Date: Sun Sep 12 11:27:05 2021 -0700 Merge tag 'locking_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Borislav Petkov: - Fix the futex PI requeue machinery to not return to userspace in inconsistent state - Avoid a potential null pointer dereference in the ww_mutex deadlock check - Other smaller cleanups and optimizations * tag 'locking_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rtmutex: Fix ww_mutex deadlock check futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic() futex: Avoid redundant task lookup futex: Clarify comment for requeue_pi_wake_futex() futex: Prevent inconsistent state and exit race futex: Return error code instead of assigning it without effect locking/rwsem: Add missing __init_rwsem() for PREEMPT_RT commit 7bf3142625c193db2dfbd7df2176b7cd910d9e4f Merge: fdfc346302a7b 39ff83f2f6cc5 Author: Linus Torvalds Date: Sun Sep 12 11:10:31 2021 -0700 Merge tag 'timers_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Handle negative second values properly when converting a timespec64 to nanoseconds. * tag 'timers_urgent_for_v5.15_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Handle negative seconds correctly in timespec64_to_ns() commit fdfc346302a7b63e3d5b9168be74bb12b1975999 Merge: 8d4a0b5d0813c ea47ab111669b Author: Linus Torvalds Date: Sun Sep 12 10:43:51 2021 -0700 Merge branch 'misc.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull namei updates from Al Viro: "Clearing fallout from mkdirat in io_uring series. The fix in the kern_path_locked() patch plus associated cleanups" * 'misc.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: putname(): IS_ERR_OR_NULL() is wrong here namei: Standardize callers of filename_create() namei: Standardize callers of filename_lookup() rename __filename_parentat() to filename_parentat() namei: Fix use after free in kern_path_locked commit 8d4a0b5d0813c990637fa9f3c9bea5dab1fedb8f Merge: 78e709522d2c0 9351590f51cdd Author: Linus Torvalds Date: Sun Sep 12 10:10:21 2021 -0700 Merge tag '5.15-rc-cifs-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull smbfs updates from Steve French: "cifs/smb3 updates: - DFS reconnect fix - begin creating common headers for server and client - rename the cifs_common directory to smbfs_common to be more consistent ie change use of the name cifs to smb (smb3 or smbfs is more accurate, as the very old cifs dialect has long been superseded by smb3 dialects). In the future we can rename the fs/cifs directory to fs/smbfs. This does not include the set of multichannel fixes nor the two deferred close fixes (they are still being reviewed and tested)" * tag '5.15-rc-cifs-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: properly invalidate cached root handle when closing it cifs: move SMB FSCTL definitions to common code cifs: rename cifs_common to smbfs_common cifs: update FSCTL definitions commit f11ee2ad25b22c2ee587045dd6999434375532f7 Author: Len Baker Date: Sat Sep 11 12:28:18 2021 +0200 net: mana: Prefer struct_size over open coded arithmetic As noted in the "Deprecated Interfaces, Language Features, Attributes, and Conventions" documentation [1], size calculations (especially multiplication) should not be performed in memory allocator (or similar) function arguments due to the risk of them overflowing. This could lead to values wrapping around and a smaller allocation being made than the caller was expecting. Using those allocations could lead to linear overflows of heap memory and other misbehaviors. So, use the struct_size() helper to do the arithmetic instead of the argument "size + count * size" in the kzalloc() function. [1] https://www.kernel.org/doc/html/v5.14/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Signed-off-by: Len Baker Reviewed-by: Haiyang Zhang Signed-off-by: David S. Miller commit 1b704b27beb11ce147d64b21c914e57afbfb5656 Author: Andrea Claudi Date: Sat Sep 11 16:14:18 2021 +0200 selftest: net: fix typo in altname test If altname deletion of the short alternative name fails, the error message printed is: "Failed to add short alternative name". This is obviously a typo, as we are testing altname deletion. Fix this using a proper error message. Fixes: f95e6c9c4617 ("selftest: net: add alternative names test") Signed-off-by: Andrea Claudi Signed-off-by: David S. Miller commit ce062a0adbfe933b1932235fdfd874c4c91d1bb0 Author: Ansuel Smith Date: Sat Sep 11 17:50:09 2021 +0200 net: dsa: qca8k: fix kernel panic with legacy mdio mapping When the mdio legacy mapping is used the mii_bus priv registered by DSA refer to the dsa switch struct instead of the qca8k_priv struct and causes a kernel panic. Create dedicated function when the internal dedicated mdio driver is used to properly handle the 2 different implementation. Fixes: 759bafb8a322 ("net: dsa: qca8k: add support for internal phy and internal mdio") Signed-off-by: Ansuel Smith Signed-off-by: David S. Miller commit 78e709522d2c012cb0daad2e668506637bffb7c2 Merge: b79bd0d5102b4 7bc7f61897b66 Author: Linus Torvalds Date: Sat Sep 11 14:48:42 2021 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - vduse driver ("vDPA Device in Userspace") supporting emulated virtio block devices - virtio-vsock support for end of record with SEQPACKET - vdpa: mac and mq support for ifcvf and mlx5 - vdpa: management netlink for ifcvf - virtio-i2c, gpio dt bindings - misc fixes and cleanups * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (39 commits) Documentation: Add documentation for VDUSE vduse: Introduce VDUSE - vDPA Device in Userspace vduse: Implement an MMU-based software IOTLB vdpa: Support transferring virtual addressing during DMA mapping vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap() vdpa: Add an opaque pointer for vdpa_config_ops.dma_map() vhost-iotlb: Add an opaque pointer for vhost IOTLB vhost-vdpa: Handle the failure of vdpa_reset() vdpa: Add reset callback in vdpa_config_ops vdpa: Fix some coding style issues file: Export receive_fd() to modules eventfd: Export eventfd_wake_count to modules iova: Export alloc_iova_fast() and free_iova_fast() virtio-blk: remove unneeded "likely" statements virtio-balloon: Use virtio_find_vqs() helper vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro vsock_test: update message bounds test for MSG_EOR af_vsock: rename variables in receive loop virtio/vsock: support MSG_EOR bit processing vhost/vsock: support MSG_EOR bit processing ... commit b79bd0d5102b4a3ea908018fda6b84a4c8fd6235 Merge: 4e1c754472ffb 6f55ab36bef50 Author: Linus Torvalds Date: Sat Sep 11 14:29:42 2021 -0700 Merge tag 'riscv-for-linus-5.15-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - A pair of defconfig additions, for NVMe and the EFI filesystem localization options. - A larger address space for stack randomization. - A cleanup to our install rules. - A DTS update for the Microchip Icicle board, to fix the serial console. - Support for build-time table sorting, which allows us to have __ex_table read-only. * tag 'riscv-for-linus-5.15-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Move EXCEPTION_TABLE to RO_DATA segment riscv: Enable BUILDTIME_TABLE_SORT riscv: dts: microchip: mpfs-icicle: Fix serial console riscv: move the (z)install rules to arch/riscv/Makefile riscv: Improve stack randomisation on RV64 riscv: defconfig: enable NLS_CODEPAGE_437, NLS_ISO8859_1 riscv: defconfig: enable BLK_DEV_NVME commit 4e1c754472ffbf251835fc01f4cc638ffa8dd576 Merge: c605c39677b98 e71ec0bc06038 Author: Linus Torvalds Date: Sat Sep 11 14:22:28 2021 -0700 Merge branch 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccinelle updates from Julia Lawall: "These changes update some existing semantic patches with respect to some recent changes in the kernel. Specifically, the change to kvmalloc.cocci searches for kfree_sensitive rather than kzfree, and the change to use_after_iter.cocci adds list_entry_is_head as a valid use of a list iterator index variable after the end of the loop" * 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: scripts: coccinelle: allow list_entry_is_head() to use pos coccinelle: api: rename kzfree to kfree_sensitive commit 17a99e521f67743a5d3405cba0aacd8a10f9ff7d Author: Arnaldo Carvalho de Melo Date: Mon May 3 11:48:26 2021 -0300 tools headers UAPI: Update tools's copy of drm.h headers Picking the changes from: 17ce9c61c71cbc0d ("drm: document DRM_IOCTL_MODE_RMFB") Doesn't result in any tooling changes: $ tools/perf/trace/beauty/drm_ioctl.sh > before $ cp include/uapi/drm/drm.h tools/include/uapi/drm/drm.h $ tools/perf/trace/beauty/drm_ioctl.sh > after $ diff -u before after Silencing these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/drm/drm.h' differs from latest version at 'include/uapi/drm/drm.h' diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h Cc: Simon Ser Signed-off-by: Arnaldo Carvalho de Melo commit 4dc24d7cf4983ae779f4a4428e527441225315e9 Author: Arnaldo Carvalho de Melo Date: Sat Sep 11 16:18:28 2021 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick the changes in: b65a9489730a2494 ("drm/i915/userptr: Probe existence of backing struct pages upon creation") ee242ca704d38699 ("drm/i915/guc: Implement GuC priority management") 81340cf3bddded4f ("drm/i915/uapi: reject set_domain for discrete") 7961c5b60f23dff5 ("drm/i915: Add TTM offset argument to mmap.") aef7b67a79564f6c ("drm/i915/uapi: convert drm_i915_gem_userptr to kernel doc") e7737b67ab46ee0e ("drm/i915/uapi: reject caching ioctls for discrete") 3aa8c57fe25a9247 ("drm/i915/uapi: convert drm_i915_gem_set_domain to kernel doc") 289f5a72009b8f67 ("drm/i915/uapi: convert drm_i915_gem_caching to kernel doc") 4a766ae40ec83301 ("drm/i915: Drop the CONTEXT_CLONE API (v2)") 6ff6d61dd2a943bd ("drm/i915: Drop I915_CONTEXT_PARAM_NO_ZEROMAP") fe4751c3d513ff4f ("drm/i915: Drop I915_CONTEXT_PARAM_RINGSIZE") 577729533cdc4e37 ("drm/i915: Document the Virtual Engine uAPI") c649432e86ca677d ("drm/i915: Fix busy ioctl commentary") That doesn't result in any changes to tooling as no new ioctl were added (at least not perceived by tools/perf/trace/beauty/drm_ioctl.sh). Addressing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Chris Wilson Cc: Daniel Vetter Cc: Jason Ekstrand Cc: John Harrison Cc: Maarten Lankhorst Cc: Matthew Auld Cc: Matthew Brost Cc: Tvrtko Ursulin Signed-off-by: Arnaldo Carvalho de Melo commit 2bae3e64ec465cd545c5cbec74335eb44f97c177 Author: Arnaldo Carvalho de Melo Date: Fri May 21 16:00:31 2021 -0300 tools headers UAPI: Sync linux/fs.h with the kernel sources To pick the change in: 7957d93bf32bc211 ("block: add ioctl to read the disk sequence number") It adds a new ioctl, but we are still not using that to generate tables for 'perf trace', so no changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fs.h' differs from latest version at 'include/uapi/linux/fs.h' diff -u tools/include/uapi/linux/fs.h include/uapi/linux/fs.h Cc: Jens Axboe Cc: Matteo Croce Signed-off-by: Arnaldo Carvalho de Melo commit ee286c60c268aed03bac4686ebb47f1534b4b2e2 Author: Arnaldo Carvalho de Melo Date: Sat Jun 19 10:15:22 2021 -0300 tools headers UAPI: Sync linux/in.h copy with the kernel sources To pick the changes in: db243b796439c0ca ("net/ipv4/ipv6: Replace one-element arraya with flexible-array members") 2d3e5caf96b9449a ("net/ipv4: Replace one-element array with flexible-array member") That don't result in any change in tooling, the structs changed remains with the same layout. This addresses this build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Cc: David S. Miller Cc: Gustavo A. R. Silva Signed-off-by: Arnaldo Carvalho de Melo commit 0d1c50ac488ebdaeeaea8ed5069f8d435fd485ed Author: Ian Rogers Date: Fri Sep 10 15:57:56 2021 -0700 perf tools: Add an option to build without libbfd Some distributions, like debian, don't link perf with libbfd. Add a build flag to make this configuration buildable and testable. This was inspired by: https://lore.kernel.org/linux-perf-users/20210910102307.2055484-1-tonyg@leastfixedpoint.com/T/#u Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: tony garnock-jones Link: http://lore.kernel.org/lkml/20210910225756.729087-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4a86d41404005a3c7e7b6065e8169ac6202887a9 Author: Namhyung Kim Date: Fri Sep 10 15:46:30 2021 -0700 perf tools: Allow build-id with trailing zeros Currently perf saves a build-id with size but old versions assumes the size of 20. In case the build-id is less than 20 (like for MD5), it'd fill the rest with 0s. I saw a problem when old version of perf record saved a binary in the build-id cache and new version of perf reads the data. The symbols should be read from the build-id cache (as the path no longer has the same binary) but it failed due to mismatch in the build-id. symsrc__init: build id mismatch for /home/namhyung/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf. The build-id event in the data has 20 byte build-ids, but it saw a different size (16) when it reads the build-id of the elf file in the build-id cache. $ readelf -n ~/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf Displaying notes found in: .note.gnu.build-id Owner Data size Description GNU 0x00000010 NT_GNU_BUILD_ID (unique build ID bitstring) Build ID: 53e4c2f42a4c61a2d632d92a72afa08f Let's fix this by allowing trailing zeros if the size is different. Fixes: 39be8d0115b321ed ("perf tools: Pass build_id object to dso__build_id_equal()") Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Andi Kleen Cc: Ian Rogers Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210910224630.1084877-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 99fc5941b835d662eb2e91d8b61249e9a51df9f0 Author: Adrian Hunter Date: Thu Sep 9 15:55:08 2021 +0300 perf tools: Fix hybrid config terms list corruption A config terms list was spliced twice, resulting in a never-ending loop when the list was traversed. Fix by using list_splice_init() and copying and freeing the lists as necessary. This patch also depends on patch "perf tools: Factor out copy_config_terms() and free_config_terms()" Example on ADL: Before: # perf record -e '{intel_pt//,cycles/aux-sample-size=4096/pp}' uname & # jobs [1]+ Running perf record -e "{intel_pt//,cycles/aux-sample-size=4096/pp}" uname # perf top -E 10 PerfTop: 4071 irqs/sec kernel: 6.9% exact: 100.0% lost: 0/0 drop: 0/0 [4000Hz cycles], (all, 24 CPUs) --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 97.60% perf [.] __evsel__get_config_term 0.25% [kernel] [k] kallsyms_expand_symbol.constprop.13 0.24% perf [.] kallsyms__parse 0.15% [kernel] [k] _raw_spin_lock 0.14% [kernel] [k] number 0.13% [kernel] [k] advance_transaction 0.08% [kernel] [k] format_decode 0.08% perf [.] map__process_kallsym_symbol 0.08% perf [.] rb_insert_color 0.08% [kernel] [k] vsnprintf exiting. # kill %1 After: # perf record -e '{intel_pt//,cycles/aux-sample-size=4096/pp}' uname & Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.060 MB perf.data ] # perf script | head perf-exec 604 [001] 1827.312293: psb: psb offs: 0 ffffffffb8415e87 pt_config_start+0x37 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb856a3bd event_sched_in.isra.133+0xfd ([kernel.kallsyms]) => ffffffffb856a9a0 perf_pmu_nop_void+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb856b10e merge_sched_in+0x26e ([kernel.kallsyms]) => ffffffffb856a2c0 event_sched_in.isra.133+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb856a45d event_sched_in.isra.133+0x19d ([kernel.kallsyms]) => ffffffffb8568b80 perf_event_set_state.part.61+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb8568b86 perf_event_set_state.part.61+0x6 ([kernel.kallsyms]) => ffffffffb85662a0 perf_event_update_time+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb856a35c event_sched_in.isra.133+0x9c ([kernel.kallsyms]) => ffffffffb8567610 perf_log_itrace_start+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb856a377 event_sched_in.isra.133+0xb7 ([kernel.kallsyms]) => ffffffffb8403b40 x86_pmu_add+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb8403b86 x86_pmu_add+0x46 ([kernel.kallsyms]) => ffffffffb8403940 collect_events+0x0 ([kernel.kallsyms]) perf-exec 604 1827.312293: 1 branches: ffffffffb8403a7b collect_events+0x13b ([kernel.kallsyms]) => ffffffffb8402cd0 collect_event+0x0 ([kernel.kallsyms]) Fixes: 30def61f64bac5 ("perf parse-events Create two hybrid cache events") Fixes: 94da591b1c7913 ("perf parse-events Create two hybrid raw events") Fixes: 9cbfa2f64c04d9 ("perf parse-events Create two hybrid hardware events") Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Jin Yao Cc: Kan Liang Link: https //lore.kernel.org/r/20210909125508.28693-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a7d212fc6c89d1619b9441f4c801cbff8ca34197 Author: Adrian Hunter Date: Thu Sep 9 15:55:07 2021 +0300 perf tools: Factor out copy_config_terms() and free_config_terms() Factor out copy_config_terms() and free_config_terms() so that they can be reused. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Jin Yao Cc: Kan Liang Link: https //lore.kernel.org/r/20210909125508.28693-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit eb34363ae1c0f62cf3183c4697533d6c482d1598 Author: Adrian Hunter Date: Sat Sep 11 15:05:50 2021 +0300 perf tools: Fix perf_event_attr__fprintf() missing/dupl. fields Some fields are missing and text_poke is duplicated. Fix that up. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20210911120550.12203-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit da4572d62d389f6665b86466b993ccc157b40715 Author: Ian Rogers Date: Fri Sep 10 16:22:49 2021 -0700 perf tools: Ignore Documentation dependency file When building directly on the checked out repository the build process produces a file that should be ignored, so add it to .gitignore. Fixes: a81df63a5df3e195 ("perf doc: Fix doc.dep") Reported-by: Linus Torvalds Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210910232249.739661-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit c605c39677b9842b0566013e0cf30bc13e90bdbc Merge: c0f7e49fc480a 32c2d33e0b7c4 Author: Linus Torvalds Date: Sat Sep 11 10:28:14 2021 -0700 Merge tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Fix an off-by-one in a BUILD_BUG_ON() check. Not a real issue right now as we have plenty of flags left, but could become one. (Hao) - Fix lockdep issue introduced in this merge window (me) - Fix a few issues with the worker creation (me, Pavel, Qiang) - Fix regression with wq_has_sleeper() for IOPOLL (Pavel) - Timeout link error propagation fix (Pavel) * tag 'io_uring-5.15-2021-09-11' of git://git.kernel.dk/linux-block: io_uring: fix off-by-one in BUILD_BUG_ON check of __REQ_F_LAST_BIT io_uring: fail links of cancelled timeouts io-wq: fix memory leak in create_io_worker() io-wq: fix silly logic error in io_task_work_match() io_uring: drop ctx->uring_lock before acquiring sqd->lock io_uring: fix missing mb() before waitqueue_active io-wq: fix cancellation on create-worker failure commit c0f7e49fc480a97770e448e0c0493e7ba46a9852 Merge: 8177a5c96229f 221e8360834c5 Author: Linus Torvalds Date: Sat Sep 11 10:19:51 2021 -0700 Merge tag 'block-5.15-2021-09-11' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request from Christoph: - fix nvmet command set reporting for passthrough controllers (Adam Manzanares) - update a MAINTAINERS email address (Chaitanya Kulkarni) - set QUEUE_FLAG_NOWAIT for nvme-multipth (me) - handle errors from add_disk() (Luis Chamberlain) - update the keep alive interval when kato is modified (Tatsuya Sasaki) - fix a buffer overrun in nvmet_subsys_attr_serial (Hannes Reinecke) - do not reset transport on data digest errors in nvme-tcp (Daniel Wagner) - only call synchronize_srcu when clearing current path (Daniel Wagner) - revalidate paths during rescan (Hannes Reinecke) - Split out the fs/block_dev into block/fops.c and block/bdev.c, which has been long overdue. Do this now before -rc1, to avoid annoying conflicts due to this (Christoph) - blk-throtl use-after-free fix (Li) - Improve plug depth for multi-device plugs, greatly increasing md resync performance (Song) - blkdev_show() locking fix (Tetsuo) - n64cart error check fix (Yang) * tag 'block-5.15-2021-09-11' of git://git.kernel.dk/linux-block: n64cart: fix return value check in n64cart_probe() blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug for multiple_queues block: move fs/block_dev.c to block/bdev.c block: split out operations on block special files blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() block: genhd: don't call blkdev_show() with major_names_lock held nvme: update MAINTAINERS email address nvme: add error handling support for add_disk() nvme: only call synchronize_srcu when clearing current path nvme: update keep alive interval when kato is modified nvme-tcp: Do not reset transport on data digest errors nvmet: fixup buffer overrun in nvmet_subsys_attr_serial() nvmet: return bool from nvmet_passthru_ctrl and nvmet_is_passthru_req nvmet: looks at the passthrough controller when initializing CAP nvme: move nvme_multi_css into nvme.h nvme-multipath: revalidate paths during rescan nvme-multipath: set QUEUE_FLAG_NOWAIT commit 8177a5c96229ff24da1e362789e359b68b4f34f5 Merge: ce4c8f8820413 5ac749a57e0eb Author: Linus Torvalds Date: Sat Sep 11 10:18:20 2021 -0700 Merge tag 'libata-5.15-2021-09-11' of git://git.kernel.dk/linux-block Pull libata maintainer update from Jens Axboe: "Damien agreed to take over maintainership of libata, and he would be a great candidate for it. Update the MAINTAINERS entry to reflect the change in maintainer and git tree" * tag 'libata-5.15-2021-09-11' of git://git.kernel.dk/linux-block: libata: pass over maintainership to Damien Le Moal commit ce4c8f882041341cbb3f1b4632b20440692cbccc Merge: a1406e424253b 5dfe50b055880 Author: Linus Torvalds Date: Sat Sep 11 10:16:30 2021 -0700 Merge tag 'trace-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Minor fixes to the processing of the bootconfig tree" * tag 'trace-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: bootconfig: Rename xbc_node_find_child() to xbc_node_find_subkey() tracing/boot: Fix to check the histogram control param is a leaf node tracing/boot: Fix trace_boot_hist_add_array() to check array is value commit a1406e424253ba2121614377aaab274d403b08e0 Merge: 2aae0a937ad16 094b147c76628 Author: Linus Torvalds Date: Sat Sep 11 10:12:46 2021 -0700 Merge tag 'devicetree-fixes-for-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Disable fw_devlinks on x86 DT platforms to fix OLPC - More replacing oneOf+const with enum on a few new schemas - Drop unnecessary type references on Xilinx SPI binding schema * tag 'devicetree-fixes-for-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: spi: dt-bindings: xilinx: Drop type reference on *-bits properties dt-bindings: More use 'enum' instead of 'oneOf' plus 'const' entries of: property: Disable fw_devlink DT support for X86 commit 2aae0a937ad169752b5710d4f210c1ae7a49d3cf Merge: 107ccc45bb25c 2cfa946be8438 Author: Linus Torvalds Date: Sat Sep 11 10:05:56 2021 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One patch to fix an unused variable warning in a Qualcomm clk driver" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: gcc-sm6350: Remove unused variable commit 107ccc45bb25c7fdc7a744496caa4d8a52af4812 Merge: 52926229be069 0c45d3e24ef3d Author: Linus Torvalds Date: Sat Sep 11 09:54:53 2021 -0700 Merge tag 'rtc-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "The broken down time conversion is similar to what is done in the time subsystem since v5.14. The rest is fairly straightforward. Subsystem: - Switch to Neri and Schneider time conversion algorithm Drivers: - rx8025: add rx8035 support - s5m: modernize driver and set range" * tag 'rtc-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: rx8010: select REGMAP_I2C dt-bindings: rtc: add Epson RX-8025 and RX-8035 rtc: rx8025: implement RX-8035 support rtc: cmos: remove stale REVISIT comments rtc: tps65910: Correct driver module alias rtc: move RTC_LIB_KUNIT_TEST to proper location rtc: lib_test: add MODULE_LICENSE rtc: Improve performance of rtc_time64_to_tm(). Add tests. rtc: s5m: set range rtc: s5m: enable wakeup only when available rtc: s5m: signal the core when alarm are not available rtc: s5m: switch to devm_rtc_allocate_device commit 52926229be069258440c39de063fcd4a5fd75d62 Merge: 6701e7e7d8ee4 54b3bd99f094b Author: Linus Torvalds Date: Sat Sep 11 09:47:33 2021 -0700 Merge tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Stefan Richter: - Migrate the bus snooper driver 'nosy' from PCI to DMA API - Small janitorial cleanup in the IPv4/v6-over-1394 driver [ The 'nosy' change already come in as a different commit through Greg KH in the misc tree back in the previous merge window, so only the cleanup ends up being new to 5.15 - Linus ] * tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: nosy: switch from 'pci_' to 'dma_' API firewire: net: remove unused variable 'guid' commit 6701e7e7d8ee4f80d0c450aeab101e4a2a2678fa Merge: dd4703876ea83 3f2b16734914f Author: Linus Torvalds Date: Sat Sep 11 09:26:00 2021 -0700 Merge tag 'pwm/for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "The changes this time around are mostly janitorial in nature. A lot of this is simplifications of drivers using device-managed functions and improving compilation coverage. The Mediatek display PWM driver now supports the atomic API. Cleanups and minor fixes make up the remainder of this set" * tag 'pwm/for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (54 commits) pwm: mtk-disp: Implement atomic API .get_state() pwm: mtk-disp: Fix overflow in period and duty calculation pwm: mtk-disp: Implement atomic API .apply() pwm: mtk-disp: Adjust the clocks to avoid them mismatch dt-bindings: pwm: rockchip: Add description for rk3568 pwm: Make pwmchip_remove() return void pwm: sun4i: Don't check the return code of pwmchip_remove() pwm: sifive: Don't check the return code of pwmchip_remove() pwm: samsung: Don't check the return code of pwmchip_remove() pwm: renesas-tpu: Don't check the return code of pwmchip_remove() pwm: rcar: Don't check the return code of pwmchip_remove() pwm: pca9685: Don't check the return code of pwmchip_remove() pwm: omap-dmtimer: Don't check the return code of pwmchip_remove() pwm: mtk-disp: Don't check the return code of pwmchip_remove() pwm: imx-tpm: Don't check the return code of pwmchip_remove() pwm: img: Don't check the return code of pwmchip_remove() pwm: cros-ec: Don't check the return code of pwmchip_remove() pwm: brcmstb: Don't check the return code of pwmchip_remove() pwm: atmel-tcb: Don't check the return code of pwmchip_remove() pwm: atmel-hlcdc: Don't check the return code of pwmchip_remove() ... commit dd4703876ea83b5fb5f4f0a1ec58f786143f5064 Merge: 765092e4cdaa8 70ee251ded6ba Author: Linus Torvalds Date: Sat Sep 11 09:20:57 2021 -0700 Merge tag 'thermal-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal updates from Daniel Lezcano: - Add the tegra3 thermal sensor and fix the compilation testing on tegra by adding a dependency on ARCH_TEGRA along with COMPILE_TEST (Dmitry Osipenko) - Fix the error code for the exynos when devm_get_clk() fails (Dan Carpenter) - Add the TCC cooling support for AlderLake platform (Sumeet Pawnikar) - Add support for hardware trip points for the rcar gen3 thermal driver and store TSC id as unsigned int (Niklas Söderlund) - Replace the deprecated CPU-hotplug functions get_online_cpus() and put_online_cpus (Sebastian Andrzej Siewior) - Add the thermal tools directory in the MAINTAINERS file (Daniel Lezcano) - Fix the Makefile and the cross compilation flags for the userspace 'tmon' tool (Rolf Eike Beer) - Allow to use the IMOK independently from the GDDV on Int340x (Sumeet Pawnikar) - Fix the stub thermal_cooling_device_register() function prototype which does not match the real function (Arnd Bergmann) - Make the thermal trip point optional in the DT bindings (Maxime Ripard) - Fix a typo in a comment in the core code (Geert Uytterhoeven) - Reduce the verbosity of the trace in the SoC thermal tegra driver (Dmitry Osipenko) - Add the support for the LMh (Limit Management hardware) driver on the QCom platforms (Thara Gopinath) - Allow processing of HWP interrupt by adding a weak function in the Intel driver (Srinivas Pandruvada) - Prevent an abort of the sensor probe is a channel is not used (Matthias Kaehlcke) * tag 'thermal-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/qcom/spmi-adc-tm5: Don't abort probing if a sensor is not used thermal/drivers/intel: Allow processing of HWP interrupt dt-bindings: thermal: Add dt binding for QCOM LMh thermal/drivers/qcom: Add support for LMh driver firmware: qcom_scm: Introduce SCM calls to access LMh thermal/drivers/tegra-soctherm: Silence message about clamped temperature thermal: Spelling s/scallbacks/callbacks/ dt-bindings: thermal: Make trips node optional thermal/core: Fix thermal_cooling_device_register() prototype thermal/drivers/int340x: Use IMOK independently tools/thermal/tmon: Add cross compiling support thermal/tools/tmon: Improve the Makefile MAINTAINERS: Add missing userspace thermal tools to the thermal section thermal/drivers/intel_powerclamp: Replace deprecated CPU-hotplug functions. thermal/drivers/rcar_gen3_thermal: Store TSC id as unsigned int thermal/drivers/rcar_gen3_thermal: Add support for hardware trip points drivers/thermal/intel: Add TCC cooling support for AlderLake platform thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() thermal/drivers/tegra: Correct compile-testing of drivers thermal/drivers/tegra: Add driver for Tegra30 thermal sensor commit 765092e4cdaa8439b969952ec4e6de3b84241f90 Merge: 926de8c4326c1 0c5483a5778fa Author: Linus Torvalds Date: Sat Sep 11 09:08:28 2021 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - several device tree bindings for input devices have been converted to yaml - dropped no longer used ixp4xx-beeper and CSR Prima2 PWRC drivers - analog joystick has been converted to use ktime API and no longer warn about low resolution timers - a few driver fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (24 commits) Input: analog - always use ktime functions Input: mms114 - support MMS134S Input: elan_i2c - reduce the resume time for controller in Whitebox Input: edt-ft5x06 - added case for EDT EP0110M09 Input: adc-keys - drop bogus __refdata annotation Input: Fix spelling mistake in Kconfig "useable" -> "usable" Input: Fix spelling mistake in Kconfig "Modul" -> "Module" Input: remove dead CSR Prima2 PWRC driver Input: adp5589-keys - use the right header Input: adp5588-keys - use the right header dt-bindings: input: tsc2005: Convert to YAML schema Input: ep93xx_keypad - prepare clock before using it dt-bindings: input: sun4i-lradc: Add wakeup-source dt-bindings: input: Convert Regulator Haptic binding to a schema dt-bindings: input: Convert Pixcir Touchscreen binding to a schema dt-bindings: input: Convert ChipOne ICN8318 binding to a schema Input: pm8941-pwrkey - fix comma vs semicolon issue dt-bindings: power: reset: qcom-pon: Convert qcom PON binding to yaml dt-bindings: input: pm8941-pwrkey: Convert pm8941 power key binding to yaml dt-bindings: power: reset: Change 'additionalProperties' to true ... commit dfb5c1e12c28e35e4d4e5bc8022b0e9d585b89a7 Author: Wei Liu Date: Fri Sep 10 18:57:14 2021 +0000 x86/hyperv: remove on-stack cpumask from hv_send_ipi_mask_allbutself It is not a good practice to allocate a cpumask on stack, given it may consume up to 1 kilobytes of stack space if the kernel is configured to have 8192 cpus. The internal helper functions __send_ipi_mask{,_ex} need to loop over the provided mask anyway, so it is not too difficult to skip `self' there. We can thus do away with the on-stack cpumask in hv_send_ipi_mask_allbutself. Adjust call sites of __send_ipi_mask as needed. Reported-by: Linus Torvalds Suggested-by: Michael Kelley Suggested-by: Linus Torvalds Fixes: 68bb7bfb7985d ("X86/Hyper-V: Enable IPI enlightenments") Signed-off-by: Wei Liu Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20210910185714.299411-3-wei.liu@kernel.org commit 7ad9bb9d0f357dcab5eb9a0f28d1c8983c48434c Author: Wei Liu Date: Fri Sep 10 18:57:13 2021 +0000 asm-generic/hyperv: provide cpumask_to_vpset_noself This is a new variant which removes `self' cpu from the vpset. It will be used in Hyper-V enlightened IPI code. Signed-off-by: Wei Liu Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20210910185714.299411-2-wei.liu@kernel.org commit 08dad2f4d541fcfe5e7bfda72cc6314bbfd2802f Author: Jesper Nilsson Date: Fri Sep 10 21:55:34 2021 +0200 net: stmmac: allow CSR clock of 300MHz The Synopsys Ethernet IP uses the CSR clock as a base clock for MDC. The divisor used is set in the MAC_MDIO_Address register field CR (Clock Rate) The divisor is there to change the CSR clock into a clock that falls below the IEEE 802.3 specified max frequency of 2.5MHz. If the CSR clock is 300MHz, the code falls back to using the reset value in the MAC_MDIO_Address register, as described in the comment above this code. However, 300MHz is actually an allowed value and the proper divider can be estimated quite easily (it's just 1Hz difference!) A CSR frequency of 300MHz with the maximum clock rate value of 0x5 (STMMAC_CSR_250_300M, a divisor of 124) gives somewhere around ~2.42MHz which is below the IEEE 802.3 specified maximum. For the ARTPEC-8 SoC, the CSR clock is this problematic 300MHz, and unfortunately, the reset-value of the MAC_MDIO_Address CR field is 0x0. This leads to a clock rate of zero and a divisor of 42, and gives an MDC frequency of ~7.14MHz. Allow CSR clock of 300MHz by making the comparison inclusive. Signed-off-by: Jesper Nilsson Signed-off-by: David S. Miller commit 6f55ab36bef505b449723300a5a445ddc76a94d7 Author: Jisheng Zhang Date: Thu Aug 26 22:11:18 2021 +0800 riscv: Move EXCEPTION_TABLE to RO_DATA segment _ex_table section is read-only, so move it to RO_DATA. Signed-off-by: Jisheng Zhang Signed-off-by: Palmer Dabbelt commit 54fed35fd3939398be292e4090b0b1c5ff2238b4 Author: Jisheng Zhang Date: Thu Aug 26 22:10:29 2021 +0800 riscv: Enable BUILDTIME_TABLE_SORT Enable BUILDTIME_TABLE_SORT to sort the exception table at build time rather than during boot. Signed-off-by: Jisheng Zhang Signed-off-by: Palmer Dabbelt commit cbba17870881cd17bca24673ccb72859431da5bd Author: Geert Uytterhoeven Date: Thu Aug 26 15:19:39 2021 +0200 riscv: dts: microchip: mpfs-icicle: Fix serial console Currently, nothing is output on the serial console, unless "console=ttyS0,115200n8" or "earlycon" are appended to the kernel command line. Enable automatic console selection using chosen/stdout-path by adding a proper alias, and configure the expected serial rate. While at it, add aliases for the other three serial ports, which are provided on the same micro-USB connector as the first one. Fixes: 0fa6107eca4186ad ("RISC-V: Initial DTS for Microchip ICICLE board") Signed-off-by: Geert Uytterhoeven Reviewed-by: Bin Meng Reviewed-by: Conor Dooley Signed-off-by: Palmer Dabbelt commit 399c1ec8467c563ae9db4c19a40a9d5e728b1e72 Author: Masahiro Yamada Date: Thu Jul 29 23:21:47 2021 +0900 riscv: move the (z)install rules to arch/riscv/Makefile Currently, the (z)install targets in arch/riscv/Makefile descend into arch/riscv/boot/Makefile to invoke the shell script, but there is no good reason to do so. arch/riscv/Makefile can run the shell script directly. Signed-off-by: Masahiro Yamada Signed-off-by: Palmer Dabbelt commit d5935537c8256fc63c77d5f4914dfd6e3ef43241 Author: Kefeng Wang Date: Thu Aug 12 19:47:02 2021 +0800 riscv: Improve stack randomisation on RV64 This enlarges the bits availiable for stack randomisation on RV64 from the default of 8MiB to 1GiB, to match arm64 and x86. Also, update the documentation to reflect our support for stack randomisation. Signed-off-by: Kefeng Wang [Palmer: commit text] Signed-off-by: Palmer Dabbelt commit efe1e08bca9a1fab2b0ad886be4fb5335dcbf29c Author: Heinrich Schuchardt Date: Thu Aug 12 10:10:27 2021 +0200 riscv: defconfig: enable NLS_CODEPAGE_437, NLS_ISO8859_1 The EFI system partition uses the FAT file system. Many distributions add an entry in /etc/fstab for the ESP. We must ensure that mounting does not fail. The default code page for FAT is 437 (cf. CONFIG_FAT_DEFAULT_CODEPAGE). The default IO character set is "iso8859-1" (cf. CONFIG_NLS_ISO8859_1). So let's enable NLS_CODEPAGE_437 and NLS_ISO8859_1 in defconfig. Signed-off-by: Heinrich Schuchardt Signed-off-by: Palmer Dabbelt commit 3a87ff891290e1b9ef3f03396c22fd3b2f6eb955 Author: Heinrich Schuchardt Date: Thu Aug 12 10:10:26 2021 +0200 riscv: defconfig: enable BLK_DEV_NVME NVMe is a non-volatile storage media attached via PCIe. As NVMe has much higher throughput than other block devices like SATA it is a must have for RISC-V. Enable CONFIG_BLK_DEV_NVME. The HiFive Unmatched is a board providing M.2 slots for NVMe drives. Enable CONFIG_PCIE_FU740. Signed-off-by: Heinrich Schuchardt Reviewed-by: Anup Patel Signed-off-by: Palmer Dabbelt commit c9871c800f65fffed40f3df3e1eb38984f95cfcf Author: Thomas Gleixner Date: Thu Sep 9 14:34:59 2021 +0200 Documentation: core-api/cpuhotplug: Rewrite the API section Dave stumbled over the incomplete and confusing documentation of the CPU hotplug API. Rewrite it, add the missing function documentations and correct the existing ones. Reported-by: Dave Chinner Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210909123212.489059409@linutronix.de commit 8c854303ce0e38e5bbedd725ff39da7e235865d8 Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:16:21 2021 +0200 cpu/hotplug: Remove deprecated CPU-hotplug functions. No users in tree use the deprecated CPU-hotplug functions anymore. Remove them. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210803141621.780504-39-bigeasy@linutronix.de commit c122358ea1e510d3def876abb7872f1b2b7365c9 Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:16:02 2021 +0200 thermal: Replace deprecated CPU-hotplug functions. The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210803141621.780504-20-bigeasy@linutronix.de commit c2f4954c2d3fc4f77b46c67585e17a58df4ba8e4 Merge: 4b92d4add5f6d 926de8c4326c1 Author: Thomas Gleixner Date: Sat Sep 11 00:38:47 2021 +0200 Merge branch 'linus' into smp/urgent Ensure that all usage sites of get/put_online_cpus() except for the struggler in drivers/thermal are gone. So the last user and the deprecated inlines can be removed. commit 218e7b775d368f38d85d73e52900b082f004e5f1 Author: Arnaldo Carvalho de Melo Date: Fri Sep 10 17:26:53 2021 -0300 perf bpf: Provide a weak btf__load_from_kernel_by_id() for older libbpf versions The btf__get_from_id() function was deprecated in favour of btf__load_from_kernel_by_id(), but it is still avaiable, so use it to provide a weak function btf__load_from_kernel_by_id() for older libbpf when building perf with LIBBPF_DYNAMIC=1, i.e. using the system's libbpf package. Signed-off-by: Arnaldo Carvalho de Melo commit 37ce9e4fc596cf10a4d32ced741679bd1b4fa7a5 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:34:38 2021 -0300 tools include UAPI: Update linux/mount.h copy To pick the changes from: 9ffb14ef61bab83f ("move_mount: allow to add a mount into an existing group") That ends up adding support for the new MOVE_MOUNT_SET_GROUP move_mount flag. $ tools/perf/trace/beauty/move_mount_flags.sh > before $ cp include/uapi/linux/mount.h tools/include/uapi/linux/mount.h $ tools/perf/trace/beauty/move_mount_flags.sh > after $ diff -u before after --- before 2021-09-10 12:28:43.865279808 -0300 +++ after 2021-09-10 12:28:50.183429184 -0300 @@ -5,4 +5,5 @@ [ilog2(0x00000010) + 1] = "T_SYMLINKS", [ilog2(0x00000020) + 1] = "T_AUTOMOUNTS", [ilog2(0x00000040) + 1] = "T_EMPTY_PATH", + [ilog2(0x00000100) + 1] = "SET_GROUP", }; $ So now one can use it in --filter expressions for tracepoints. This silences this perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/mount.h' differs from latest version at 'include/uapi/linux/mount.h' diff -u tools/include/uapi/linux/mount.h include/uapi/linux/mount.h Cc: Christian Brauner Cc: Pavel Tikhomirov Signed-off-by: Arnaldo Carvalho de Melo commit 155ed9f1b5ff62dd78f102559298a017a7e189c5 Author: Arnaldo Carvalho de Melo Date: Fri Sep 10 12:24:19 2021 -0300 perf beauty: Cover more flags in the move_mount syscall argument beautifier Previously the regext expected MOVE_MOUNT_[FT]_*, but in the next patch a flag that doesn't match that expression will be added, MOVE_MOUNT_SET_GROUP To make this more future proof, take advantage of the fact that the only one we don't need to cover is MOVE_MOUNT__MASK and use MOVE_MOUNT_[^_]+_*_. Signed-off-by: Arnaldo Carvalho de Melo commit 2c3ef25c4a60cc18cf3f05a74c78220748f25684 Author: Arnaldo Carvalho de Melo Date: Thu Feb 11 12:50:52 2021 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources To pick the changes in: 433c38f40f6a81cf ("arm64: mte: change ASYNC and SYNC TCF settings into bitfields") e893bb1bb4d2eb63 ("x86, prctl: Hook L1D flushing in via prctl") That don't result in any changes in tooling: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after $ Just silences this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/prctl.h' differs from latest version at 'include/uapi/linux/prctl.h' diff -u tools/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Cc: Balbir Singh Cc: Catalin Marinas Cc: Peter Collingbourne Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit f9f018e4d9a45a5464861418467b21d3d2ad569c Author: Arnaldo Carvalho de Melo Date: Wed Feb 12 11:04:23 2020 -0300 tools include UAPI: Sync sound/asound.h copy with the kernel sources Picking the changes from: 81be10934949da8b ("ALSA: pcm: Add SNDRV_PCM_INFO_EXPLICIT_SYNC flag") Which entails no changes in the tooling side as it doesn't introduce new ioctls. To silence this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/sound/asound.h' differs from latest version at 'include/uapi/sound/asound.h' diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Cc: Takashi Iwai Signed-off-by: Arnaldo Carvalho de Melo commit dfa00459c6264abd282452c4878e3a9117db23bb Author: Arnaldo Carvalho de Melo Date: Sun May 9 09:39:02 2021 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: f95937ccf5bd5e0a ("KVM: stats: Support linear and logarithmic histogram statistics") f0376edb1ddcab19 ("KVM: arm64: Add ioctl to fetch/store tags in a guest") ea7fc1bb1cd1b92b ("KVM: arm64: Introduce MTE VM feature") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This is also by now used by tools/testing/selftests/kvm/, so that will pick the new KVM_STATS_TYPE_LINEAR_HIST and KVM_STATS_TYPE_LOG_HIST defines. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Jing Zhang Cc: Marc Zyngier Cc: Paolo Bonzini Cc: Steven Price Signed-off-by: Arnaldo Carvalho de Melo commit 03d6f3fe54278f8e5ec670e576b8da8b8727ec26 Author: Arnaldo Carvalho de Melo Date: Fri Sep 10 11:46:54 2021 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: 61e5f69ef08379cd ("KVM: x86: implement KVM_GUESTDBG_BLOCKIRQ") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Cc: Maxim Levitsky Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit 291dcb98d7ee5cd719f4c5991d977794b1829c16 Author: Kim Phillips Date: Tue Aug 17 17:15:09 2021 -0500 perf report: Add support to print a textual representation of IBS raw sample data Perf records IBS (Instruction Based Sampling) extra sample data when 'perf record --raw-samples' is used with an IBS-compatible event, on a machine that supports IBS. IBS support is indicated in CPUID_Fn80000001_ECX bit #10. Up until now, users have been able to see the extra sample data solely in raw hex format using 'perf report --dump-raw-trace'. From there, users could decode the data either manually, or by using an external script. Enable the built-in 'perf report --dump-raw-trace' to do the decoding of the extra sample data bits, so manual or external script decoding isn't necessary. Example usage: $ sudo perf record -c 10000001 -a --raw-samples -e ibs_fetch/rand_en=1/,ibs_op/cnt_ctl=1/ -C 0,1 taskset -c 0,1 7za b -mmt2 | perf report --dump-raw-trace Stdout contains IBS Fetch samples, e.g.: ibs_fetch_ctl: 02170007ffffffff MaxCnt 1048560 Cnt 1048560 Lat 7 En 1 Val 1 Comp 1 IcMiss 0 PhyAddrValid 1 L1TlbPgSz 4KB L1TlbMiss 0 L2TlbMiss 0 RandEn 1 L2Miss 0 IbsFetchLinAd: 000056016b2ead40 IbsFetchPhysAd: 000000115cedfd40 c_ibs_ext_ctl: 0000000000000000 IbsItlbRefillLat 0 ..and IBS Op samples, e.g.: ibs_op_ctl: 0000009e009e8968 MaxCnt 10000000 En 1 Val 1 CntCtl 1=uOps CurCnt 158 IbsOpRip: 000056016b2ea73d ibs_op_data: 00000000000b0002 CompToRetCtr 2 TagToRetCtr 11 BrnRet 0 RipInvalid 0 BrnFuse 0 Microcode 0 ibs_op_data2: 0000000000000002 CacheHitSt 0=M-state RmtNode 0 DataSrc 2=Local node cache ibs_op_data3: 0000000000c60002 LdOp 0 StOp 1 DcL1TlbMiss 0 DcL2TlbMiss 0 DcL1TlbHit2M 0 DcL1TlbHit1G 0 DcL2TlbHit2M 0 DcMiss 0 DcMisAcc 0 DcWcMemAcc 0 DcUcMemAcc 0 DcLockedOp 0 DcMissNoMabAlloc 0 DcLinAddrValid 1 DcPhyAddrValid 1 DcL2TlbHit1G 0 L2Miss 0 SwPf 0 OpMemWidth 4 bytes OpDcMissOpenMemReqs 0 DcMissLat 0 TlbRefillLat 0 IbsDCLinAd: 00007f133c319ce0 IbsDCPhysAd: 0000000270485ce0 Committer notes: Fixed up this: util/amd-sample-raw.c: In function ‘evlist__amd_sample_raw’: util/amd-sample-raw.c:125:42: error: ‘ bytes’ directive output may be truncated writing 6 bytes into a region of size between 4 and 7 [-Werror=format-truncation=] 125 | " OpMemWidth %2d bytes", 1 << (reg.op_mem_width - 1)); | ^~~~~~ In file included from /usr/include/stdio.h:866, from util/amd-sample-raw.c:7: /usr/include/bits/stdio2.h:71:10: note: ‘__builtin___snprintf_chk’ output between 21 and 24 bytes into a destination of size 21 71 | return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 72 | __glibc_objsize (__s), __fmt, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 73 | __va_arg_pack ()); | ~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors As that %2d won't limit the number of chars to 2, just state that 2 is the minimal width: $ cat printf.c #include #include int main(int argc, char *argv[]) { char bf[64]; int len = snprintf(bf, sizeof(bf), "%2d", atoi(argv[1])); printf("strlen(%s): %u\n", bf, len); return 0; } $ ./printf 1 strlen( 1): 2 $ ./printf 12 strlen(12): 2 $ ./printf 123 strlen(123): 3 $ ./printf 1234 strlen(1234): 4 $ ./printf 12345 strlen(12345): 5 $ ./printf 123456 strlen(123456): 6 $ And since we probably don't want that output to be truncated, just assume the worst case, as the compiler did, and add a few more chars to that buffer. Also use sizeof(var) instead of sizeof(dup-of-wanted-format-string) to avoid bugs when changing one but not the other. I also had to change this: -#include +#include "../../arch/x86/include/asm/amd-ibs.h" To make it build on other architectures, just like intel-pt does. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Boris Ostrovsky Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Joao Martins Cc: Konrad Rzeszutek Wilk Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Robert Richter Cc: Stephane Eranian Link: https //lore.kernel.org/r/20210817221509.88391-4-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 581b2027af0018944ba301d68e7af45c6d1128b5 Author: David Howells Date: Wed Sep 1 09:15:21 2021 +0100 afs: Fix page leak There's a loop in afs_extend_writeback() that adds extra pages to a write we want to make to improve the efficiency of the writeback by making it larger. This loop stops, however, if we hit a page we can't write back from immediately, but it doesn't get rid of the page ref we speculatively acquired. This was caused by the removal of the cleanup loop when the code switched from using find_get_pages_contig() to xarray scanning as the latter only gets a single page at a time, not a batch. Fix this by putting the page on a ref on an early break from the loop. Unfortunately, we can't just add that page to the pagevec we're employing as we'll go through that and add those pages to the RPC call. This was found by the generic/074 test. It leaks ~4GiB of RAM each time it is run - which can be observed with "top". Fixes: e87b03f5830e ("afs: Prepare for use of THPs") Reported-by: Marc Dionne Signed-off-by: David Howells Reviewed-and-tested-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163111666635.283156.177701903478910460.stgit@warthog.procyon.org.uk/ commit 345e1ae0c6ba54f6a4d32154e80cadc2ee2ef1af Author: David Howells Date: Fri Aug 27 23:22:02 2021 +0100 afs: Fix missing put on afs_read objects and missing get on the key therein The afs_read objects created by afs_req_issue_op() get leaked because afs_alloc_read() returns a ref and then afs_fetch_data() gets its own ref which is released when the operation completes, but the initial ref is never released. Fix this by discarding the initial ref at the end of afs_req_issue_op(). This leak also covered another bug whereby a ref isn't got on the key attached to the read record by afs_req_issue_op(). This isn't a problem as long as the afs_read req never goes away... Fix this by calling key_get() in afs_req_issue_op(). This was found by the generic/074 test. It leaks a bunch of kmalloc-192 objects each time it is run, which can be observed by watching /proc/slabinfo. Fixes: f7605fa869cf ("afs: Fix leak of afs_read objects") Reported-by: Marc Dionne Signed-off-by: David Howells Reviewed-and-tested-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/163010394740.3035676.8516846193899793357.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/163111665914.283156.3038561975681836591.stgit@warthog.procyon.org.uk/ commit dde994dd54fbf84f8fd14230de3477d552e42470 Author: Kim Phillips Date: Tue Aug 17 17:15:08 2021 -0500 perf report: Add tools/arch/x86/include/asm/amd-ibs.h This is a tools/-side patch for the patch that adds the original copy of the IBS header file, in arch/x86/include/asm/. We also add an entry to check-headers.sh, so future changes continue to be copied. Committer notes: Had to add this -#include +#include "msr-index.h" And change the check-headers.sh entry to ignore this line when diffing with the original kernel header. This is needed so that we can use 'perf report' on a perf.data with IBS data on a !x86 system, i.e. building on ARM fails without this as there is no asm/msr-index.h there. This was done on the next patch in this series and is done for things like Intel PT and ARM CoreSight. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Boris Ostrovsky Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Joao Martins Cc: Konrad Rzeszutek Wilk Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Robert Richter Cc: Stephane Eranian Link: https //lore.kernel.org/r/20210817221509.88391-3-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 926de8c4326c14fcf35f1de142019043597a4fac Merge: d6498af58f5c7 8fbc1c5b91133 Author: Linus Torvalds Date: Fri Sep 10 13:29:04 2021 -0700 Merge tag 'acpi-5.15-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These prevent a confusing PRMT-related message from being printed, drop an unnecessary header file include and update the list of ACPICA maintainers. Specifics: - Prevent a message about missing PRMT from being printed on systems that do not support PRM, which are the majority now (Aubrey Li). - Drop unnecessary header include from scan.c (Kari Argillander). - Update the list of ACPICA maintainers after recent departure of one of them (Rafael Wysocki)" * tag 'acpi-5.15-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Update the list of maintainers ACPI: PRM: Find PRMT table before parsing it ACPI: scan: Remove unneeded header linux/nls.h commit 2f1aaf3ea666b737ad717b3d88667225aca23149 Author: Yonghong Song Date: Thu Sep 9 08:49:59 2021 -0700 bpf, mm: Fix lockdep warning triggered by stack_map_get_build_id_offset() Currently the bpf selftest "get_stack_raw_tp" triggered the warning: [ 1411.304463] WARNING: CPU: 3 PID: 140 at include/linux/mmap_lock.h:164 find_vma+0x47/0xa0 [ 1411.304469] Modules linked in: bpf_testmod(O) [last unloaded: bpf_testmod] [ 1411.304476] CPU: 3 PID: 140 Comm: systemd-journal Tainted: G W O 5.14.0+ #53 [ 1411.304479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1411.304481] RIP: 0010:find_vma+0x47/0xa0 [ 1411.304484] Code: de 48 89 ef e8 ba f5 fe ff 48 85 c0 74 2e 48 83 c4 08 5b 5d c3 48 8d bf 28 01 00 00 be ff ff ff ff e8 2d 9f d8 00 85 c0 75 d4 <0f> 0b 48 89 de 48 8 [ 1411.304487] RSP: 0018:ffffabd440403db8 EFLAGS: 00010246 [ 1411.304490] RAX: 0000000000000000 RBX: 00007f00ad80a0e0 RCX: 0000000000000000 [ 1411.304492] RDX: 0000000000000001 RSI: ffffffff9776b144 RDI: ffffffff977e1b0e [ 1411.304494] RBP: ffff9cf5c2f50000 R08: ffff9cf5c3eb25d8 R09: 00000000fffffffe [ 1411.304496] R10: 0000000000000001 R11: 00000000ef974e19 R12: ffff9cf5c39ae0e0 [ 1411.304498] R13: 0000000000000000 R14: 0000000000000000 R15: ffff9cf5c39ae0e0 [ 1411.304501] FS: 00007f00ae754780(0000) GS:ffff9cf5fba00000(0000) knlGS:0000000000000000 [ 1411.304504] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1411.304506] CR2: 000000003e34343c CR3: 0000000103a98005 CR4: 0000000000370ee0 [ 1411.304508] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1411.304510] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1411.304512] Call Trace: [ 1411.304517] stack_map_get_build_id_offset+0x17c/0x260 [ 1411.304528] __bpf_get_stack+0x18f/0x230 [ 1411.304541] bpf_get_stack_raw_tp+0x5a/0x70 [ 1411.305752] RAX: 0000000000000000 RBX: 5541f689495641d7 RCX: 0000000000000000 [ 1411.305756] RDX: 0000000000000001 RSI: ffffffff9776b144 RDI: ffffffff977e1b0e [ 1411.305758] RBP: ffff9cf5c02b2f40 R08: ffff9cf5ca7606c0 R09: ffffcbd43ee02c04 [ 1411.306978] bpf_prog_32007c34f7726d29_bpf_prog1+0xaf/0xd9c [ 1411.307861] R10: 0000000000000001 R11: 0000000000000044 R12: ffff9cf5c2ef60e0 [ 1411.307865] R13: 0000000000000005 R14: 0000000000000000 R15: ffff9cf5c2ef6108 [ 1411.309074] bpf_trace_run2+0x8f/0x1a0 [ 1411.309891] FS: 00007ff485141700(0000) GS:ffff9cf5fae00000(0000) knlGS:0000000000000000 [ 1411.309896] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1411.311221] syscall_trace_enter.isra.20+0x161/0x1f0 [ 1411.311600] CR2: 00007ff48514d90e CR3: 0000000107114001 CR4: 0000000000370ef0 [ 1411.312291] do_syscall_64+0x15/0x80 [ 1411.312941] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1411.313803] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1411.314223] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1411.315082] RIP: 0033:0x7f00ad80a0e0 [ 1411.315626] Call Trace: [ 1411.315632] stack_map_get_build_id_offset+0x17c/0x260 To reproduce, first build `test_progs` binary: make -C tools/testing/selftests/bpf -j60 and then run the binary at tools/testing/selftests/bpf directory: ./test_progs -t get_stack_raw_tp The warning is due to commit 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()") which added mmap_assert_locked() in find_vma() function. The mmap_assert_locked() function asserts that mm->mmap_lock needs to be held. But this is not the case for bpf_get_stack() or bpf_get_stackid() helper (kernel/bpf/stackmap.c), which uses mmap_read_trylock_non_owner() instead. Since mm->mmap_lock is not held in bpf_get_stack[id]() use case, the above warning is emitted during test run. This patch fixed the issue by (1). using mmap_read_trylock() instead of mmap_read_trylock_non_owner() to satisfy lockdep checking in find_vma(), and (2). droping lockdep for mmap_lock right before the irq_work_queue(). The function mmap_read_trylock_non_owner() is also removed since after this patch nobody calls it any more. Fixes: 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()") Suggested-by: Jason Gunthorpe Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann Reviewed-by: Liam R. Howlett Cc: Luigi Rizzo Cc: Jason Gunthorpe Cc: linux-mm@kvack.org Link: https://lore.kernel.org/bpf/20210909155000.1610299-1-yhs@fb.com commit d6498af58f5c7fb7b252f4791620fe4dd7213ca3 Merge: e99f23c5bf592 be2d24336f887 Author: Linus Torvalds Date: Fri Sep 10 13:20:47 2021 -0700 Merge tag 'pm-5.15-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These improve hybrid processors support in intel_pstate, fix an issue in the core devices PM code, clean up the handling of dedicated wake IRQs, update the Energy Model documentation and update MAINTAINERS. Specifics: - Make the HWP performance levels calibration on hybrid processors in intel_pstate more straightforward (Rafael Wysocki). - Prevent the PM core from leaving devices in suspend after a failing system-wide suspend transition in some cases when driver PM flags are used (Prasad Sodagudi). - Drop unused function argument from the dedicated wake IRQs handling code (Sergey Shtylyov). - Fix up Energy Model kerneldoc comments and include them in the Energy Model documentation (Lukasz Luba). - Use my kernel.org address in MAINTAINERS insead of the personal one (Rafael Wysocki)" * tag 'pm-5.15-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: MAINTAINERS: Change Rafael's e-mail address PM: sleep: core: Avoid setting power.must_resume to false Documentation: power: include kernel-doc in Energy Model doc PM: EM: fix kernel-doc comments cpufreq: intel_pstate: hybrid: Rework HWP calibration ACPI: CPPC: Introduce cppc_get_nominal_perf() PM: sleep: wakeirq: drop useless parameter from dev_pm_attach_wake_irq() commit 094b147c766289baa0f370d124609c3ac2b5a420 Author: Rob Herring Date: Fri Sep 10 11:59:45 2021 -0500 spi: dt-bindings: xilinx: Drop type reference on *-bits properties Properties with standard unit suffixes such as '-bits' don't need a type. Cc: Mark Brown Cc: Michal Simek Cc: linux-spi@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Rob Herring Acked-by: Mark Brown Link: https://lore.kernel.org/r/20210910165945.2852999-1-robh@kernel.org commit 975671241808ffacbe418a1f29965bd9985cc251 Author: Rob Herring Date: Fri Sep 10 11:51:53 2021 -0500 dt-bindings: More use 'enum' instead of 'oneOf' plus 'const' entries 'enum' is equivalent to 'oneOf' with a list of 'const' entries, but 'enum' is more concise and yields better error messages. Fix a couple more cases which have appeared. Cc: Rob Clark Cc: Sean Paul Cc: Mark Brown Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Marek Cc: Aswath Govindraju Cc: Marc Zyngier Cc: Linus Walleij Cc: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org Cc: linux-spi@vger.kernel.org Cc: linux-watchdog@vger.kernel.org Signed-off-by: Rob Herring Acked-by: Guenter Roeck Acked-by: Mark Brown Link: https://lore.kernel.org/r/20210910165153.2843871-1-robh@kernel.org commit e99f23c5bf59219d0cd9b6e0d7d4c1b641a98704 Merge: 23ef827c1bacc 85f58eb188982 Author: Linus Torvalds Date: Fri Sep 10 11:58:20 2021 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Limit the linear region to 51-bit when KVM is running in nVHE mode. Otherwise, depending on the placement of the ID map, kernel-VA to hyp-VA translations may produce addresses that either conflict with other HYP mappings or generate addresses outside of the 52-bit addressable range. - Instruct kmemleak not to scan the memory reserved for kdump as this range is removed from the kernel linear map and therefore not accessible. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kdump: Skip kmemleak scan reserved memory for kdump arm64: mm: limit linear region to 51 bits for KVM in nVHE mode commit 23ef827c1bacc6c2b8314ff5bf571d4db57059b0 Merge: 589e5cab17084 671028728083e Author: Linus Torvalds Date: Fri Sep 10 11:52:01 2021 -0700 Merge tag 'for-5.15/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - Build warning fixes in Makefile and Dino PCI driver - Fix when sched_clock is marked unstable - Drop strnlen_user() in favour of generic version - Prevent kernel to write outside userspace signal stack - Remove CONFIG_SET_FS including KERNEL_DS and USER_DS from parisc and switch to __get/put_kernel_nofault() * tag 'for-5.15/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Implement __get/put_kernel_nofault() parisc: Mark sched_clock unstable only if clocks are not syncronized parisc: Move pci_dev_is_behind_card_dino to where it is used parisc: Reduce sigreturn trampoline to 3 instructions parisc: Check user signal stack trampoline is inside TASK_SIZE parisc: Drop useless debug info and comments from signal.c parisc: Drop strnlen_user() in favour of generic version parisc: Add missing FORCE prerequisite in Makefile commit 589e5cab170843b2f7f8260168ab2d77163d4384 Merge: 5ffc06ebeaab6 8cc633190b524 Author: Linus Torvalds Date: Fri Sep 10 11:42:03 2021 -0700 Merge tag 'iommu-fixes-v5.15-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Intel VT-d: - PASID leakage in intel_svm_unbind_mm() - Deadlock in intel_svm_drain_prq() - AMD IOMMU: Fixes for an unhandled page-fault bug when AVIC is used for a KVM guest. - Make CONFIG_IOMMU_DEFAULT_DMA_LAZY architecture instead of IOMMU driver dependent * tag 'iommu-fixes-v5.15-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu: Clarify default domain Kconfig iommu/vt-d: Fix a deadlock in intel_svm_drain_prq() iommu/vt-d: Fix PASID leak in intel_svm_unbind_mm() iommu/amd: Remove iommu_init_ga() iommu/amd: Relocate GAMSup check to early_enable_iommus commit 5ffc06ebeaab65d8e08df6953caf8155df2c45f8 Merge: a668acb8f01fc 4cd67adc44a3c Author: Linus Torvalds Date: Fri Sep 10 11:31:47 2021 -0700 Merge tag 'char-misc-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull habanalabs updates from Greg KH: "Here is another round of misc driver patches for 5.15-rc1. In here is only updates for the Habanalabs driver. This request is late because the previously-objected-to dma-buf patches are all removed and some fixes that you and others found are now included in here as well. All of these have been in linux-next for well over a week with no reports of problems, and they are all self-contained to only this one driver. Full details are in the shortlog" * tag 'char-misc-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (61 commits) habanalabs/gaudi: hwmon default card name habanalabs: add support for f/w reset habanalabs/gaudi: block ICACHE_BASE_ADDERESS_HIGH in TPC habanalabs: cannot sleep while holding spinlock habanalabs: never copy_from_user inside spinlock habanalabs: remove unnecessary device status check habanalabs: disable IRQ in user interrupts spinlock habanalabs: add "in device creation" status habanalabs/gaudi: invalidate PMMU mem cache on init habanalabs/gaudi: size should be printed in decimal habanalabs/gaudi: define DC POWER for secured PMC habanalabs/gaudi: unmask out of bounds SLM access interrupt habanalabs: add userptr_lookup node in debugfs habanalabs/gaudi: fetch TPC/MME ECC errors from F/W habanalabs: modify multi-CS to wait on stream masters habanalabs/gaudi: add monitored SOBs to state dump habanalabs/gaudi: restore user registers when context opens habanalabs/gaudi: increase boot fit timeout habanalabs: update to latest firmware headers habanalabs/gaudi: minimize number of register reads ... commit 8fbc1c5b91133f7ae5254061d2cb3326992635c4 Merge: 22d692baba0a8 66e0aeaa8bae6 3265cc3ec52e7 Author: Rafael J. Wysocki Date: Fri Sep 10 20:27:07 2021 +0200 Merge branches 'acpi-scan' and 'acpi-prm' * acpi-scan: ACPI: scan: Remove unneeded header linux/nls.h * acpi-prm: ACPI: PRM: Find PRMT table before parsing it commit be2d24336f8876d60d8a4634f1a1e4753c4be124 Merge: 3d53afea525f5 46573fd6369f0 4a9344cd0aa44 d62aab8ff711d Author: Rafael J. Wysocki Date: Fri Sep 10 20:26:08 2021 +0200 Merge branches 'pm-cpufreq', 'pm-sleep' and 'pm-em' * pm-cpufreq: cpufreq: intel_pstate: hybrid: Rework HWP calibration ACPI: CPPC: Introduce cppc_get_nominal_perf() * pm-sleep: PM: sleep: core: Avoid setting power.must_resume to false PM: sleep: wakeirq: drop useless parameter from dev_pm_attach_wake_irq() * pm-em: Documentation: power: include kernel-doc in Energy Model doc PM: EM: fix kernel-doc comments commit a668acb8f01fc0d1e3877cddecbe319ef2ef651c Merge: 4396a73115fc8 70982eef4d7ee Author: Linus Torvalds Date: Fri Sep 10 11:22:23 2021 -0700 Merge tag 'drm-next-2021-09-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Just an initial bunch of fixes for the merge window, amdgpu is most of them with a few ttm fixes and an fbdev avoid multiply overflow fix. core: - Make some dma-buf config options depend on DMA_SHARED_BUFFER - Handle multiplication overflow of fbdev xres/yres in the core ttm: - Fix ttm_bo_move_memcpy() when ttm_resource is subclassed - Fix ttm deadlock if target BO isn't idle - ttm build fix - ttm docs fix dma-buf: - config option fixes fbdev: - limit resolutions to avoid int overflow i915: - stddef change. amdgpu: - Misc cleanups, typo fixes - EEPROM fix - Add some new PCI IDs - Scatter/Gather display support for Yellow Carp - PCIe DPM fix for RKL platforms - RAS fix amdkfd: - SVM fix vc4: - static function fix mgag200: - fix uninit var panfrost: - lock_region fixes" * tag 'drm-next-2021-09-10' of git://anongit.freedesktop.org/drm/drm: (36 commits) drm/ttm: Fix a deadlock if the target BO is not idle during swap fbmem: don't allow too huge resolutions dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER dma-buf: DMABUF_DEBUG should depend on DMA_SHARED_BUFFER drm/i915: use linux/stddef.h due to "isystem: trim/fixup stdarg.h and other headers" dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER drm/amdkfd: drop process ref count when xnack disable drm/amdgpu: enable more pm sysfs under SRIOV 1-VF mode drm/amdgpu: fix fdinfo race with process exit drm/amdgpu: Fix a deadlock if previous GEM object allocation fails drm/amdgpu: stop scheduler when calling hw_fini (v2) drm/amdgpu: Clear RAS interrupt status on aldebaran drm/amd/display: Initialize lt_settings on instantiation drm/amd/display: cleanup idents after a revert drm/amd/display: Fix memory leak reported by coverity drm/ttm: Fix ttm_bo_move_memcpy() for subclassed struct ttm_resource drm/amdgpu/swsmu: fix spelling mistake "minimun" -> "minimum" drm/amdgpu: Disable PCIE_DPM on Intel RKL Platform drm/amdgpu: show both cmd id and name when psp cmd failed drm/amd/display: setup system context for APUs ... commit 4396a73115fc8739083536162e2228c0c0c3ed1a Author: Amir Goldstein Date: Thu Sep 9 14:56:34 2021 +0300 fsnotify: fix sb_connectors leak Fix a leak in s_fsnotify_connectors counter in case of a race between concurrent add of new fsnotify mark to an object. The task that lost the race fails to drop the counter before freeing the unused connector. Following umount() hangs in fsnotify_sb_delete()/wait_var_event(), because s_fsnotify_connectors never drops to zero. Fixes: ec44610fe2b8 ("fsnotify: count all objects with attached connectors") Reported-by: Murphy Zhou Link: https://lore.kernel.org/linux-fsdevel/20210907063338.ycaw6wvhzrfsfdlp@xzhoux.usersys.redhat.com/ Signed-off-by: Amir Goldstein Signed-off-by: Linus Torvalds commit 4a48b66b3f52aa1a8aaa8a8863891eed35769731 Author: Saravana Kannan Date: Thu Sep 9 18:14:45 2021 -0700 of: property: Disable fw_devlink DT support for X86 Andre reported fw_devlink=on breaking OLPC XO-1.5 [1]. OLPC XO-1.5 is an X86 system that uses a mix of ACPI and OF to populate devices. The root cause seems to be ISA devices not setting their fwnode field. But trying to figure out how to fix that doesn't seem worth the trouble because the OLPC devicetree is very sparse/limited and fw_devlink only adds the links causing this issue. Considering that there aren't many users of OF in an X86 system, simply fw_devlink DT support for X86. [1] - https://lore.kernel.org/lkml/3c1f2473-92ad-bfc4-258e-a5a08ad73dd0@web.de/ Fixes: ea718c699055 ("Revert "Revert "driver core: Set fw_devlink=on by default""") Signed-off-by: Saravana Kannan Cc: Andre Muller Acked-by: Greg Kroah-Hartman Tested-by: Andre Müller Link: https://lore.kernel.org/r/20210910011446.3208894-1-saravanak@google.com Signed-off-by: Rob Herring commit 3a3a11e6e5a2bc0595c7e36ae33c861c9e8c75b1 Author: Kees Cook Date: Wed Sep 1 16:34:06 2021 -0700 lkdtm: Use init_uts_ns.name instead of macros Using generated/compile.h triggered a full LKDTM rebuild with every build. Avoid this by using the exported strings instead. Fixes: b8661450bc7f ("lkdtm: Add kernel version to failure hints") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210901233406.2571643-1-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman commit 7bd5d979dfdb6c047499a5ac91339bf42f7bdee3 Merge: 1dd038522615b c590fa80b3928 Author: Mark Brown Date: Fri Sep 10 15:46:13 2021 +0100 Merge series "ASoC: fsl: register platform component before registering cpu dai" from Shengjiu Wang : There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. This patch set is to fix this issue for SAI, ESAI, MICFIL, SPDIF, XCVR drivers. Shengjiu Wang (5): ASoC: fsl_sai: register platform component before registering cpu dai ASoC: fsl_esai: register platform component before registering cpu dai ASoC: fsl_micfil: register platform component before registering cpu dai ASoC: fsl_spdif: register platform component before registering cpu dai ASoC: fsl_xcvr: register platform component before registering cpu dai sound/soc/fsl/fsl_esai.c | 16 ++++++++++------ sound/soc/fsl/fsl_micfil.c | 15 ++++++++++----- sound/soc/fsl/fsl_sai.c | 14 +++++++++----- sound/soc/fsl/fsl_spdif.c | 14 +++++++++----- sound/soc/fsl/fsl_xcvr.c | 15 ++++++++++----- 5 files changed, 48 insertions(+), 26 deletions(-) -- 2.17.1 commit 9fe8895a27a840095281864803b128ddc26dcd30 Author: Kim Phillips Date: Tue Aug 17 17:15:07 2021 -0500 perf env: Add perf_env__cpuid, perf_env__{nr_}pmu_mappings To be used by IBS raw data display: It needs the recorder's cpuid in order to determine which errata workarounds to apply to the data, and the pmu_mappings are needed in order to figure out which PMU sample type is IBS Fetch vs. IBS Op. When not available from perf.data, we assume local operation, and retrieve cpuid and pmu mappings directly from the running system. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Boris Ostrovsky Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Joao Martins Cc: Konrad Rzeszutek Wilk Cc: Mark Rutland Cc: Michael Petlan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Robert Richter Cc: Stephane Eranian Link: https //lore.kernel.org/r/20210817221509.88391-2-kim.phillips@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit d2930ede5218be28413a00130a6895d14393c325 Author: Remi Bernon Date: Thu Sep 9 21:26:36 2021 +0200 perf symbol: Look for ImageBase in PE file to compute .text offset Instead of using the file offset in the debug file. This fixes a regression from 00a3423492bc90be ("perf symbols: Make dso__load_bfd_symbols() load PE files from debug cache only"), causing incorrect symbol resolution when debug file have been stripped from non-debug sections (in which case its .text section is empty and doesn't have any file position). The debug files could also be created with a different file alignment, and have different file positions from the mmap-ed binary, or have the section reordered. This instead looks for the file image base, using the corresponding bfd *ABS* symbols. As PE symbols only have 4 bytes, it also needs to keep .text section vma high bits. Signed-off-by: Remi Bernon Fixes: 00a3423492bc90be ("perf symbols: Make dso__load_bfd_symbols() load PE files from debug cache only") Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Nicholas Fraser Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210909192637.4139125-1-rbernon@codeweavers.com Signed-off-by: Arnaldo Carvalho de Melo commit 51ae7fa62dcb0ab96ea5f83aec254a1fb6d4d371 Author: Michael Petlan Date: Mon Apr 27 16:23:27 2020 +0200 perf scripts python: Fix passing arguments to stackcollapse report The '--' prevented arguments from being passed to the script, such as: $ perf script report stackcollapse -i my_perf.data Signed-off-by: Michael Petlan Cc: Jiri Olsa Cc: Paolo Bonzini LPU-Reference: 20200427142327.21172-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc Author: Michael Petlan Date: Thu Aug 5 18:06:11 2021 +0200 perf test: Fix bpf test sample mismatch reporting When the expected sample count in the condition changed, the message needs to be changed too, otherwise we'll get: 0x1001f2091d8: mmap mask[0]: BPF filter result incorrect, expected 56, got 56 samples Fixes: 4b04e0decd2518e5 ("perf test: Fix basic bpf filtering test") Signed-off-by: Michael Petlan Cc: Jiri Olsa Cc: Sumanth Korikkar Link: https //lore.kernel.org/r/20210805160611.5542-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit 64f4535166aa11d5bad53a058af036f2e216ad17 Author: Arnaldo Carvalho de Melo Date: Wed Sep 8 16:09:08 2021 -0300 tools headers UAPI: Sync files changed by new process_mrelease syscall and the removal of some compat entry points To pick the changes in these csets: 59ab844eed9c6b01 ("compat: remove some compat entry points") dce49103962840dd ("mm: wire up syscall process_mrelease") b48c7236b13cb5ef ("exit/bdflush: Remove the deprecated bdflush system call") That add support for this new syscall in tools such as 'perf trace'. For instance, this is now possible: # perf trace -v -e process_mrelease event qualifier tracepoint filter: (common_pid != 19351 && common_pid != 9112) && (id == 448) ^C# That is the filter expression attached to the raw_syscalls:sys_{enter,exit} tracepoints. $ grep process_mrelease tools/perf/arch/x86/entry/syscalls/syscall_64.tbl 448 common process_mrelease sys_process_mrelease $ This addresses these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/unistd.h' differs from latest version at 'include/uapi/asm-generic/unistd.h' diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h Warning: Kernel ABI header at 'tools/perf/arch/x86/entry/syscalls/syscall_64.tbl' differs from latest version at 'arch/x86/entry/syscalls/syscall_64.tbl' diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl Warning: Kernel ABI header at 'tools/perf/arch/powerpc/entry/syscalls/syscall.tbl' differs from latest version at 'arch/powerpc/kernel/syscalls/syscall.tbl' diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl Warning: Kernel ABI header at 'tools/perf/arch/s390/entry/syscalls/syscall.tbl' differs from latest version at 'arch/s390/kernel/syscalls/syscall.tbl' diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl Warning: Kernel ABI header at 'tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl' differs from latest version at 'arch/mips/kernel/syscalls/syscall_n64.tbl' diff -u tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl arch/mips/kernel/syscalls/syscall_n64.tbl Cc: Arnd Bergmann Cc: Eric W. Biederman Cc: Linus Torvalds Cc: Suren Baghdasaryan Signed-off-by: Arnaldo Carvalho de Melo commit 1dd038522615b70f5f8945c5631e9e2fa5bd58b1 Author: Trevor Wu Date: Fri Sep 10 17:26:13 2021 +0800 ASoC: mediatek: common: handle NULL case in suspend/resume function When memory allocation for afe->reg_back_up fails, reg_back_up can't be used. Keep the suspend/resume flow but skip register backup when afe->reg_back_up is NULL, in case illegal memory access happens. Fixes: 283b612429a2 ("ASoC: mediatek: implement mediatek common structure") Signed-off-by: Trevor Wu Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/20210910092613.30188-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit c590fa80b39287a91abeb487829f3190e7ae775f Author: Shengjiu Wang Date: Fri Sep 3 18:30:06 2021 +0800 ASoC: fsl_xcvr: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630665006-31437-6-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit ee8ccc2eb5840e34fce088bdb174fd5329153ef0 Author: Shengjiu Wang Date: Fri Sep 3 18:30:05 2021 +0800 ASoC: fsl_spdif: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630665006-31437-5-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 0adf292069dcca8bab76a603251fcaabf77468ca Author: Shengjiu Wang Date: Fri Sep 3 18:30:04 2021 +0800 ASoC: fsl_micfil: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630665006-31437-4-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit f12ce92e98b21c1fc669cd74e12c54a0fe3bc2eb Author: Shengjiu Wang Date: Fri Sep 3 18:30:03 2021 +0800 ASoC: fsl_esai: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. Fixes: 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630665006-31437-3-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 9c3ad33b5a412d8bc0a377e7cd9baa53ed52f22d Author: Shengjiu Wang Date: Fri Sep 3 18:30:02 2021 +0800 ASoC: fsl_sai: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. Fixes: 435508214942 ("ASoC: Add SAI SoC Digital Audio Interface driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630665006-31437-2-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit bb91de44693b1c10fe2f9e668506b01e88efed0e Author: Arnaldo Carvalho de Melo Date: Mon Sep 6 11:57:46 2021 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: Fixes: d32f89da7fa8ccc8 ("net: add accept helper not installing fd") Fixes: bc49d8169aa72295 ("mctp: Add MCTP base") This automagically adds support for the AF_MCTP protocol domain: $ tools/perf/trace/beauty/socket.sh > before $ cp include/linux/socket.h tools/perf/trace/beauty/include/linux/socket.h $ tools/perf/trace/beauty/socket.sh > after $ diff -u before after --- before 2021-09-06 11:57:14.972747200 -0300 +++ after 2021-09-06 11:57:30.541920222 -0300 @@ -44,4 +44,5 @@ [42] = "QIPCRTR", [43] = "SMC", [44] = "XDP", + [45] = "MCTP", }; $ This will allow 'perf trace' to translate 45 into "MCTP" as is done with the other domains: # perf trace -e socket* 0.000 chronyd/1029 socket(family: INET, type: DGRAM|CLOEXEC|NONBLOCK, protocol: IP) = 4 ^C# This addresses this perf build warning: Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h' diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Cc: David S. Miller Cc: Jens Axboe Cc: Jeremy Kerr Cc: Pavel Begunkov Signed-off-by: Arnaldo Carvalho de Melo commit 666eb96d85dcbc93aacc186a037db2e05b92b9f5 Author: Colin Ian King Date: Fri Sep 10 12:15:11 2021 +0100 qlcnic: Remove redundant initialization of variable ret The variable ret is being initialized with a value that is never read, it is being updated later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 3d53afea525f5812da782624014e7910ba731b34 Author: Rafael J. Wysocki Date: Fri Sep 10 14:45:57 2021 +0200 MAINTAINERS: Change Rafael's e-mail address I have been slow to respond to messages going to rjw@rjwysocki.net recently, so change it to rafael@kernel.org (which works better for me) in MAINTAINERS. Signed-off-by: Rafael J. Wysocki commit 22d692baba0a899bc448d2f90ad006a5b04d99a8 Author: Rafael J. Wysocki Date: Fri Sep 10 14:42:51 2021 +0200 ACPICA: Update the list of maintainers Erik Kaneda will not be maintaining ACPICA any more, so drop his address (which doesn't work any more anyway) from the maintainer list. Signed-off-by: Rafael J. Wysocki commit 32c2d33e0b7c4ea53284d5d9435dd022b582c8cf Author: Hao Xu Date: Tue Sep 7 11:22:43 2021 +0800 io_uring: fix off-by-one in BUILD_BUG_ON check of __REQ_F_LAST_BIT Build check of __REQ_F_LAST_BIT should be larger than, not equal or larger than. It's perfectly valid to have __REQ_F_LAST_BIT be 32, as that means that the last valid bit is 31 which does fit in the type. Signed-off-by: Hao Xu Link: https://lore.kernel.org/r/20210907032243.114190-1-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 85f58eb1889826b9745737718723a80b639e0fbd Author: Chen Wandun Date: Fri Sep 10 14:48:44 2021 +0800 arm64: kdump: Skip kmemleak scan reserved memory for kdump Trying to boot with kdump + kmemleak, command will result in a crash: "echo scan > /sys/kernel/debug/kmemleak" crashkernel reserved: 0x0000000007c00000 - 0x0000000027c00000 (512 MB) Kernel command line: BOOT_IMAGE=(hd1,gpt2)/vmlinuz-5.14.0-rc5-next-20210809+ root=/dev/mapper/ao-root ro rd.lvm.lv=ao/root rd.lvm.lv=ao/swap crashkernel=512M Unable to handle kernel paging request at virtual address ffff000007c00000 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 64k pages, 48-bit VAs, pgdp=00002024f0d80000 [ffff000007c00000] pgd=1800205ffffd0003, p4d=1800205ffffd0003, pud=1800205ffffd0003, pmd=1800205ffffc0003, pte=0068000007c00f06 Internal error: Oops: 96000007 [#1] SMP pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : scan_block+0x98/0x230 lr : scan_block+0x94/0x230 sp : ffff80008d6cfb70 x29: ffff80008d6cfb70 x28: 0000000000000000 x27: 0000000000000000 x26: 00000000000000c0 x25: 0000000000000001 x24: 0000000000000000 x23: ffffa88a6b18b398 x22: ffff000007c00ff9 x21: ffffa88a6ac7fc40 x20: ffffa88a6af6a830 x19: ffff000007c00000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffffffff00000000 x13: ffffffffffffffff x12: 0000000000000020 x11: 0000000000000000 x10: 0000000001080000 x9 : ffffa88a6951c77c x8 : ffffa88a6a893988 x7 : ffff203ff6cfb3c0 x6 : ffffa88a6a52b3c0 x5 : ffff203ff6cfb3c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffff20226cb56a40 x0 : 0000000000000000 Call trace: scan_block+0x98/0x230 scan_gray_list+0x120/0x270 kmemleak_scan+0x3a0/0x648 kmemleak_write+0x3ac/0x4c8 full_proxy_write+0x6c/0xa0 vfs_write+0xc8/0x2b8 ksys_write+0x70/0xf8 __arm64_sys_write+0x24/0x30 invoke_syscall+0x4c/0x110 el0_svc_common+0x9c/0x190 do_el0_svc+0x30/0x98 el0_svc+0x28/0xd8 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 The reserved memory for kdump will be looked up by kmemleak, this area will be set invalid when kdump service is bring up. That will result in crash when kmemleak scan this area. Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Chen Wandun Reviewed-by: Kefeng Wang Reviewed-by: Mike Rapoport Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20210910064844.3827813-1-chenwandun@huawei.com Signed-off-by: Catalin Marinas commit 20e100f52730cd0db609e559799c1712b5f27582 Author: Shai Malin Date: Fri Sep 10 11:33:56 2021 +0300 qed: Handle management FW error Handle MFW (management FW) error response in order to avoid a crash during recovery flows. Changes from v1: - Add "Fixes tag". Fixes: tag 5e7ba042fd05 ("qed: Fix reading stale configuration information") Signed-off-by: Ariel Elior Signed-off-by: Shai Malin Signed-off-by: David S. Miller commit dc41c4a98a76640e7085815f937eadd1f336ba85 Author: Baruch Siach Date: Thu Sep 9 20:49:47 2021 +0300 net/packet: clarify source of pr_*() messages Add pr_fmt macro to spell out the source of messages in prefix. Before this patch: packet size is too long (1543 > 1518) With this patch: af_packet: packet size is too long (1543 > 1518) Signed-off-by: Baruch Siach Signed-off-by: David S. Miller commit e3f0cc1a945fcefec0c7c9d9dfd028a51daa1846 Author: Florian Fainelli Date: Thu Sep 9 10:33:28 2021 -0700 r6040: Restore MDIO clock frequency after MAC reset A number of users have reported that they were not able to get the PHY to successfully link up, especially after commit c36757eb9dee ("net: phy: consider AN_RESTART status when reading link status") where we stopped reading just BMSR, but we also read BMCR to determine the link status. Andrius at NetBSD did a wonderful job at debugging the problem and found out that the MDIO bus clock frequency would be incorrectly set back to its default value which would prevent the MDIO bus controller from reading PHY registers properly. Back when we only read BMSR, if we read all 1s, we could falsely indicate a link status, though in general there is a cable plugged in, so this went unnoticed. After a second read of BMCR was added, a wrong read will lead to the inability to determine a link UP condition which is when it started to be visibly broken, even if it was long before that. The fix consists in restoring the value of the MD_CSR register that was set prior to the MAC reset. Link: http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=53494 Fixes: 90f750a81a29 ("r6040: consolidate MAC reset to its own function") Reported-by: Andrius V Reported-by: Darek Strugacz Tested-by: Darek Strugacz Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit bfe84435090a6c85271b02a42b1d83fef9ff7cc7 Author: Dave Ertman Date: Thu Sep 9 08:12:23 2021 -0700 ice: Correctly deal with PFs that do not support RDMA There are two cases where the current PF does not support RDMA functionality. The first is if the NVM loaded on the device is set to not support RDMA (common_caps.rdma is false). The second is if the kernel bonding driver has included the current PF in an active link aggregate. When the driver has determined that this PF does not support RDMA, then auxiliary devices should not be created on the auxiliary bus. Without a device on the auxiliary bus, even if the irdma driver is present, there will be no RDMA activity attempted on this PF. Currently, in the reset flow, an attempt to create auxiliary devices is performed without regard to the ability of the PF. There needs to be a check in ice_aux_plug_dev (as the central point that creates auxiliary devices) to see if the PF is in a state to support the functionality. When disabling and re-enabling RDMA due to the inclusion/removal of the PF in a link aggregate, we also need to set/clear the bit which controls auxiliary device creation so that a reset recovery in a link aggregate situation doesn't try to create auxiliary devices when it shouldn't. Fixes: f9f5301e7e2d ("ice: Register auxiliary device to provide RDMA") Reported-by: Yongxin Liu Signed-off-by: Dave Ertman Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 70982eef4d7eebb47a3b1ef25ec1bc742f3a21cf Author: xinhui pan Date: Tue Sep 7 12:08:32 2021 +0800 drm/ttm: Fix a deadlock if the target BO is not idle during swap The ret value might be -EBUSY, caller will think lru lock is still locked but actually NOT. So return -ENOSPC instead. Otherwise we hit list corruption. ttm_bo_cleanup_refs might fail too if BO is not idle. If we return 0, caller(ttm_tt_populate -> ttm_global_swapout ->ttm_device_swapout) will be stuck as we actually did not free any BO memory. This usually happens when the fence is not signaled for a long time. Signed-off-by: xinhui pan Reviewed-by: Christian König Fixes: ebd59851c796 ("drm/ttm: move swapout logic around v3") Link: https://patchwork.freedesktop.org/patch/msgid/20210907040832.1107747-1-xinhui.pan@amd.com Signed-off-by: Christian König Signed-off-by: Dave Airlie commit b011522c8a6ff2b5f11a9ba0ba537352919d6abb Merge: de04744d658bb 8c28051cdcbe9 Author: Dave Airlie Date: Fri Sep 10 14:18:33 2021 +1000 Merge tag 'drm-misc-next-fixes-2021-09-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next-fixes for v5.15: - Make some dma-buf config options depend on DMA_SHARED_BUFFER. - Handle multiplication overflow of fbdev xres/yres in the core. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/37c5fe2e-5be8-45c3-286b-d8d536a5cef2@linux.intel.com commit bf9f243f23e6623f310ba03fbb14e10ec3a61290 Merge: 8dde20867c443 4cf0ccd033d9c Author: Linus Torvalds Date: Thu Sep 9 16:17:14 2021 -0700 Merge tag '5.15-rc-ksmbd-part2' of git://git.samba.org/ksmbd Pull ksmbd fixes from Steve French: - various fixes pointed out by coverity, and a minor cleanup patch - id mapping and ownership fixes - an smbdirect fix * tag '5.15-rc-ksmbd-part2' of git://git.samba.org/ksmbd: ksmbd: fix control flow issues in sid_to_id() ksmbd: fix read of uninitialized variable ret in set_file_basic_info ksmbd: add missing assignments to ret on ndr_read_int64 read calls ksmbd: add validation for ndr read/write functions ksmbd: remove unused ksmbd_file_table_flush function ksmbd: smbd: fix dma mapping error in smb_direct_post_send_data ksmbd: Reduce error log 'speed is unknown' to debug ksmbd: defer notify_change() call ksmbd: remove setattr preparations in set_file_basic_info() ksmbd: ensure error is surfaced in set_file_basic_info() ndr: fix translation in ndr_encode_posix_acl() ksmbd: fix translation in sid_to_id() ksmbd: fix subauth 0 handling in sid_to_id() ksmbd: fix translation in acl entries ksmbd: fix translation in ksmbd_acls_fattr() ksmbd: fix translation in create_posix_rsp_buf() ksmbd: fix translation in smb2_populate_readdir_entry() ksmbd: fix lookup on idmapped mounts commit 5dfe50b05588010f347cb2f436434bf22b7a84ed Author: Masami Hiramatsu Date: Thu Sep 9 22:36:38 2021 +0900 bootconfig: Rename xbc_node_find_child() to xbc_node_find_subkey() Rename xbc_node_find_child() to xbc_node_find_subkey() for clarifying that function returns a key node (no value node). Since there are xbc_node_for_each_child() (loop on all child nodes) and xbc_node_for_each_subkey() (loop on only subkey nodes), this name distinction is necessary to avoid confusing users. Link: https://lkml.kernel.org/r/163119459826.161018.11200274779483115300.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 5f8895b27da2656e5e2be029acfb68c016f03326 Author: Masami Hiramatsu Date: Thu Sep 9 22:36:30 2021 +0900 tracing/boot: Fix to check the histogram control param is a leaf node Since xbc_node_find_child() doesn't ensure the returned node is a leaf node (key-value pair or do not have subkeys), use xbc_node_find_value to ensure the histogram control parameter is a leaf node in trace_boot_compose_hist_cmd(). Link: https://lkml.kernel.org/r/163119459059.161018.18341288218424528962.stgit@devnote2 Fixes: e66ed86ca6c5 ("tracing/boot: Add per-event histogram action options") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit a3928f877e7b153dbc243d6329b3777ac75b6004 Author: Masami Hiramatsu Date: Thu Sep 9 22:36:23 2021 +0900 tracing/boot: Fix trace_boot_hist_add_array() to check array is value trace_boot_hist_add_array() uses the combination of xbc_node_find_child() and xbc_node_get_child() to get the child node of the key node. But since it missed to check the child node is data node or not, user can pass the subkey node for the array node (anode). To avoid this issue, check the array node is a data node. Actually, there is xbc_node_find_value(node, key, vnode), which ensures the @vnode is a value node, so use it in trace_boot_hist_add_array() to fix this issue. Link: https://lkml.kernel.org/r/163119458308.161018.1516455973625940212.stgit@devnote2 Fixes: e66ed86ca6c5 ("tracing/boot: Add per-event histogram action options") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 8dde20867c443aedf6d64d8a494e8703d7ba53cb Merge: ae79394a62853 f79645df80656 Author: Linus Torvalds Date: Thu Sep 9 16:09:56 2021 -0700 Merge tag 'for-5.15-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix max_inline mount option limit on 64k page system - lockdep fixes: - update bdev time in a safer way - move bdev put outside of sb write section when removing device - fix possible deadlock when mounting seed/sprout filesystem - zoned mode: fix split extent accounting - minor include fixup * tag 'for-5.15-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: fix double counting of split ordered extent btrfs: fix lockdep warning while mounting sprout fs btrfs: delay blkdev_put until after the device remove btrfs: update the bdev time directly when closing btrfs: use correct header for div_u64 in misc.h btrfs: fix upper limit for max_inline for page size 64K commit ae79394a628530372e3b0aae4cb9e6495186558c Merge: d6c338a741295 25fca8c9e0d79 Author: Linus Torvalds Date: Thu Sep 9 16:05:10 2021 -0700 Merge tag 'sound-fix-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes that have been gathered before rc1, including a few regression fixes for the problem in the previous pull request" * tag 'sound-fix-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: gus: Fix repeated probe for ISA interwave card ALSA: gus: Fix repeated probes of snd_gus_create() ALSA: vx222: fix null-ptr-deref ASoC: rockchip: i2s: Fix concurrency between tx/rx ASoC: mt8195: correct the dts parsing logic about DPTX and HDMITX ASoC: Intel: boards: Fix CONFIG_SND_SOC_SDW_MOCKUP select ASoC: dt-bindings: fsl_rpmsg: Add compatible string for i.MX8ULP ALSA: usb-audio: Add registration quirk for JBL Quantum 800 ASoC: rt5682: fix headset background noise when S3 state ASoC: dt-bindings: mt8195: remove dependent headers in the example ASoC: mediatek: SND_SOC_MT8195 should depend on ARCH_MEDIATEK ASoC: samsung: s3c24xx_simtec: fix spelling mistake "devicec" -> "device" ASoC: audio-graph: respawn Platform Support ASoC: mediatek: mt8195: add MTK_PMIC_WRAP dependency commit 9351590f51cdda49d0265932a37f099950998504 Author: Enzo Matsumiya Date: Thu Sep 9 18:46:45 2021 -0300 cifs: properly invalidate cached root handle when closing it Cached root file was not being completely invalidated sometimes. Reproducing: - With a DFS share with 2 targets, one disabled and one enabled - start some I/O on the mount # while true; do ls /mnt/dfs; done - at the same time, disable the enabled target and enable the disabled one - wait for DFS cache to expire - on reconnect, the previous cached root handle should be invalid, but open_cached_dir_by_dentry() will still try to use it, but throws a use-after-free warning (kref_get()) Make smb2_close_cached_fid() invalidate all fields every time, but only send an SMB2_close() when the entry is still valid. Signed-off-by: Enzo Matsumiya Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 671028728083e856e9919221b109e3b2cd2ccc49 Author: Helge Deller Date: Thu Sep 9 12:47:00 2021 +0200 parisc: Implement __get/put_kernel_nofault() Remove CONFIG_SET_FS from parisc, so we need to add __get_kernel_nofault() and __put_kernel_nofault(), define HAVE_GET_KERNEL_NOFAULT and remove set_fs(), get_fs(), load_sr2(), thread_info->addr_limit, KERNEL_DS and USER_DS. The nice side-effect of this patch is that we now can directly access userspace via sr3 without the need to use a temporary sr2 which is either copied from sr3 or set to zero (for kernel space). Signed-off-by: Helge Deller Suggested-by: Arnd Bergmann commit d6c338a741295c04ed84679153448b2fffd2c9cf Merge: 35776f10513c0 adf9ae0d159d3 Author: Linus Torvalds Date: Thu Sep 9 13:45:26 2021 -0700 Merge tag 'for-linus-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - Support for VMAP_STACK - Support for splice_write in hostfs - Fixes for virt-pci - Fixes for virtio_uml - Various fixes * tag 'for-linus-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: fix stub location calculation um: virt-pci: fix uapi documentation um: enable VMAP_STACK um: virt-pci: don't do DMA from stack hostfs: support splice_write um: virtio_uml: fix memory leak on init failures um: virtio_uml: include linux/virtio-uml.h lib/logic_iomem: fix sparse warnings um: make PCI emulation driver init/exit static commit 35776f10513c0d523c5dd2f1b415f642497779e2 Merge: 43175623dd0df 6c974e79d3760 Author: Linus Torvalds Date: Thu Sep 9 13:25:49 2021 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM development updates from Russell King: - Rename "mod_init" and "mod_exit" so that initcall debug output is actually useful (Randy Dunlap) - Update maintainers entries for linux-arm-kernel to indicate it is moderated for non-subscribers (Randy Dunlap) - Move install rules to arch/arm/Makefile (Masahiro Yamada) - Drop unnecessary ARCH_NR_GPIOS definition (Linus Walleij) - Don't warn about atags_to_fdt() stack size (David Heidelberg) - Speed up unaligned copy_{from,to}_kernel_nofault (Arnd Bergmann) - Get rid of set_fs() usage (Arnd Bergmann) - Remove checks for GCC prior to v4.6 (Geert Uytterhoeven) * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9118/1: div64: Remove always-true __div64_const32_is_OK() duplicate ARM: 9117/1: asm-generic: div64: Remove always-true __div64_const32_is_OK() ARM: 9116/1: unified: Remove check for gcc < 4 ARM: 9110/1: oabi-compat: fix oabi epoll sparse warning ARM: 9113/1: uaccess: remove set_fs() implementation ARM: 9112/1: uaccess: add __{get,put}_kernel_nofault ARM: 9111/1: oabi-compat: rework fcntl64() emulation ARM: 9114/1: oabi-compat: rework sys_semtimedop emulation ARM: 9108/1: oabi-compat: rework epoll_wait/epoll_pwait emulation ARM: 9107/1: syscall: always store thread_info->abi_syscall ARM: 9109/1: oabi-compat: add epoll_pwait handler ARM: 9106/1: traps: use get_kernel_nofault instead of set_fs() ARM: 9115/1: mm/maccess: fix unaligned copy_{from,to}_kernel_nofault ARM: 9105/1: atags_to_fdt: don't warn about stack size ARM: 9103/1: Drop ARCH_NR_GPIOS definition ARM: 9102/1: move theinstall rules to arch/arm/Makefile ARM: 9100/1: MAINTAINERS: mark all linux-arm-kernel@infradead list as moderated ARM: 9099/1: crypto: rename 'mod_init' & 'mod_exit' functions to be module-specific commit 221e8360834c59f0c9952630fa5904a94ebd2bb8 Author: Yang Yingliang Date: Thu Sep 9 17:06:08 2021 +0800 n64cart: fix return value check in n64cart_probe() In case of error, the function devm_platform_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: d9b2a2bbbb4d ("block: Add n64 cart driver") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20210909090608.2989716-1-yangyingliang@huawei.com Signed-off-by: Jens Axboe commit 43175623dd0dffccacbf014e368ee77f77c73898 Merge: f154c806676ad cfd799837dbc4 Author: Linus Torvalds Date: Thu Sep 9 13:11:15 2021 -0700 Merge tag 'trace-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull more tracing updates from Steven Rostedt: - Add migrate-disable counter to tracing header - Fix error handling in event probes - Fix missed unlock in osnoise in error path - Fix merge issue with tools/bootconfig - Clean up bootconfig data when init memory is removed - Fix bootconfig to loop only on subkeys - Have kernel command lines override bootconfig options - Increase field counts for synthetic events - Have histograms dynamic allocate event elements to save space - Fixes in testing and documentation * tag 'trace-v5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/boot: Fix to loop on only subkeys selftests/ftrace: Exclude "(fault)" in testing add/remove eprobe events tracing: Dynamically allocate the per-elt hist_elt_data array tracing: synth events: increase max fields count tools/bootconfig: Show whole test command for each test case bootconfig: Fix missing return check of xbc_node_compose_key function tools/bootconfig: Fix tracing_on option checking in ftrace2bconf.sh docs: bootconfig: Add how to use bootconfig for kernel parameters init/bootconfig: Reorder init parameter from bootconfig and cmdline init: bootconfig: Remove all bootconfig data when the init memory is removed tracing/osnoise: Fix missed cpus_read_unlock() in start_per_cpu_kthreads() tracing: Fix some alloc_event_probe() error handling bugs tracing: Add migrate-disabled counter to tracing output. commit f154c806676ad7153c6e161f30c53a44855329d6 Merge: 7b871c7713d1e bb9c14ad267d2 Author: Linus Torvalds Date: Thu Sep 9 12:55:12 2021 -0700 Merge tag 's390-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Heiko Carstens: "Except for the xpram device driver removal it is all about fixes and cleanups. - Fix topology update on cpu hotplug, so notifiers see expected masks. This bug was uncovered with SCHED_CORE support. - Fix stack unwinding so that the correct number of entries are omitted like expected by common code. This fixes KCSAN selftests. - Add kmemleak annotation to stack_alloc to avoid false positive kmemleak warnings. - Avoid layering violation in common I/O code and don't unregister subchannel from child-drivers. - Remove xpram device driver for which no real use case exists since the kernel is 64 bit only. Also all hypervisors got required support removed in the meantime, which means the xpram device driver is dead code. - Fix -ENODEV handling of clp_get_state in our PCI code. - Enable KFENCE in debug defconfig. - Cleanup hugetlbfs s390 specific Kconfig dependency. - Quite a lot of trivial fixes to get rid of "W=1" warnings, and and other simple cleanups" * tag 's390-5.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: hugetlbfs: s390 is always 64bit s390/ftrace: remove incorrect __va usage s390/zcrypt: remove incorrect kernel doc indicators scsi: zfcp: fix kernel doc comments s390/sclp: add __nonstring annotation s390/hmcdrv_ftp: fix kernel doc comment s390: remove xpram device driver s390/pci: read clp_list_pci_req only once s390/pci: fix clp_get_state() handling of -ENODEV s390/cio: fix kernel doc comment s390/ctrlchar: fix kernel doc comment s390/con3270: use proper type for tasklet function s390/cpum_cf: move array from header to C file s390/mm: fix kernel doc comments s390/topology: fix topology information when calling cpu hotplug notifiers s390/unwind: use current_frame_address() to unwind current task s390/configs: enable CONFIG_KFENCE in debug_defconfig s390/entry: make oklabel within CHKSTG macro local s390: add kmemleak annotation in stack_alloc() s390/cio: dont unregister subchannel from child-drivers commit 7b871c7713d1eafc3a614883bbdf68ab1dffa883 Merge: e2e694b9e6f3e d75b9fa053e4c Author: Linus Torvalds Date: Thu Sep 9 12:45:26 2021 -0700 Merge branch 'work.gfs2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull gfs2 setattr updates from Al Viro: "Make it possible for filesystems to use a generic 'may_setattr()' and switch gfs2 to using it" * 'work.gfs2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: gfs2: Switch to may_setattr in gfs2_setattr fs: Move notify_change permission checks into may_setattr commit e2e694b9e6f3ec7deeb233b6b0fe20b6a47b304b Merge: 7b7699c09f66f 6e7c1770a2122 Author: Linus Torvalds Date: Thu Sep 9 12:38:18 2021 -0700 Merge branch 'work.init' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull root filesystem type handling updates from Al Viro: "Teach init/do_mounts.c to handle non-block filesystems, hopefully preventing even more special-cased kludges (such as root=/dev/nfs, etc)" * 'work.init' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: simplify get_filesystem_list / get_all_fs_names init: allow mounting arbitrary non-blockdevice filesystems as root init: split get_fs_names commit 7b7699c09f66f180b9a8a5010df352acb8683bfa Merge: 70868a180501d 89c2b3b749182 Author: Linus Torvalds Date: Thu Sep 9 12:13:46 2021 -0700 Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull iov_iter fixes from Al Viro: "Fixes for io-uring handling of iov_iter reexpands" * 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: io_uring: reexpand under-reexpanded iters iov_iter: track truncated size commit 70868a180501d17fea58153c649d56bc18435315 Merge: 2e5fd489a4e5f 2b922a9d064f8 Author: Linus Torvalds Date: Thu Sep 9 11:48:27 2021 -0700 Merge tag 'cxl-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL (Compute Express Link) updates from Dan Williams: - Fix detection of CXL host bridges to filter out disabled ACPI0016 devices in the ACPI DSDT. - Fix kernel lockdown integration to disable raw commands when raw PCI access is disabled. - Fix a broken debug message. - Add support for "Get Partition Info". I.e. enumerate the split between volatile and persistent capacity on bi-modal CXL memory expanders. - Re-factor the core by subject area. This is a work in progress. - Prepare libnvdimm to understand CXL labels in addition to EFI labels. This is a work in progress. * tag 'cxl-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (25 commits) cxl/registers: Fix Documentation warning cxl/pmem: Fix Documentation warning cxl/uapi: Fix defined but not used warnings cxl/pci: Fix debug message in cxl_probe_regs() cxl/pci: Fix lockdown level cxl/acpi: Do not add DSDT disabled ACPI0016 host bridge ports libnvdimm/labels: Add claim class helpers libnvdimm/labels: Add type-guid helpers libnvdimm/labels: Add blk special cases for nlabel and position helpers libnvdimm/labels: Add blk isetcookie set / validation helpers libnvdimm/labels: Add a checksum calculation helper libnvdimm/labels: Introduce label setter helpers libnvdimm/labels: Add isetcookie validation helper libnvdimm/labels: Introduce getters for namespace label fields cxl/mem: Adjust ram/pmem range to represent DPA ranges cxl/mem: Account for partitionable space in ram/pmem ranges cxl/pci: Store memory capacity values cxl/pci: Simplify register setup cxl/pci: Ignore unknown register block types cxl/core: Move memdev management to core ... commit 2e5fd489a4e5fcc97b035c03ace724c1d481a4c1 Merge: 4b105f4a256ae 3fc3725357414 Author: Linus Torvalds Date: Thu Sep 9 11:39:57 2021 -0700 Merge tag 'libnvdimm-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: - Fix a race condition in the teardown path of raw mode pmem namespaces. - Cleanup the code that filesystems use to detect filesystem-dax capabilities of their underlying block device. * tag 'libnvdimm-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: remove bdev_dax_supported xfs: factor out a xfs_buftarg_is_dax helper dax: stub out dax_supported for !CONFIG_FS_DAX dax: remove __generic_fsdax_supported dax: move the dax_read_lock() locking into dax_supported dax: mark dax_get_by_host static dm: use fs_dax_get_by_bdev instead of dax_get_by_host dax: stop using bdevname fsdax: improve the FS_DAX Kconfig description and help text libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind commit 4b105f4a256ae629522a7ed1611aba28fd282bd5 Merge: 0aa2516017123 2169b908894df Author: Linus Torvalds Date: Thu Sep 9 11:14:14 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "I don't usually send a second PR in the merge window, but the fix to mlx5 is significant enough that it should start going through the process ASAP. Along with it comes some of the usual -rc stuff that would normally wait for a -rc2 or so. Summary: Important error case regression fixes in mlx5: - Wrong size used when computing the error path smaller allocation request leads to corruption - Confusing but ultimately harmless alignment mis-calculation Static checker warning fixes: - NULL pointer subtraction in qib - kcalloc in bnxt_re - Missing static on global variable in hfi1" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/hfi1: make hist static RDMA/bnxt_re: Prefer kcalloc over open coded arithmetic IB/qib: Fix null pointer subtraction compiler warning RDMA/mlx5: Fix xlt_chunk_align calculation RDMA/mlx5: Fix number of allocated XLT entries commit 0aa2516017123a7c35a2c0c35c4dc7727579b8a3 Merge: a3fa7a101dcff 11a427be2c474 Author: Linus Torvalds Date: Thu Sep 9 11:07:47 2021 -0700 Merge tag 'dmaengine-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New drivers/devices - Support for Renesas RZ/G2L dma controller - New driver for AMD PTDMA controller Updates: - Big pile of idxd updates - Updates for Altera driver, stm32-dma, dw etc" * tag 'dmaengine-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (83 commits) dmaengine: sh: fix some NULL dereferences dmaengine: sh: Fix unused initialization of pointer lmdesc MAINTAINERS: Fix AMD PTDMA DRIVER entry dmaengine: ptdma: remove PT_OFFSET to avoid redefnition dmaengine: ptdma: Add debugfs entries for PTDMA dmaengine: ptdma: register PTDMA controller as a DMA resource dmaengine: ptdma: Initial driver for the AMD PTDMA dmaengine: fsl-dpaa2-qdma: Fix spelling mistake "faile" -> "failed" dmaengine: idxd: remove interrupt disable for dev_lock dmaengine: idxd: remove interrupt disable for cmd_lock dmaengine: idxd: fix setting up priv mode for dwq dmaengine: xilinx_dma: Set DMA mask for coherent APIs dmaengine: ti: k3-psil-j721e: Add entry for CSI2RX dmaengine: sh: Add DMAC driver for RZ/G2L SoC dmaengine: Extend the dma_slave_width for 128 bytes dt-bindings: dma: Document RZ/G2L bindings dmaengine: ioat: depends on !UML dmaengine: idxd: set descriptor allocation size to threshold for swq dmaengine: idxd: make submit failure path consistent on desc freeing dmaengine: idxd: remove interrupt flag for completion list spinlock ... commit 88053ec8cb1b91df566353cd3116470193797e00 Author: Ard Biesheuvel Date: Thu Aug 26 18:56:13 2021 +0200 arm64: mm: limit linear region to 51 bits for KVM in nVHE mode KVM in nVHE mode divides up its VA space into two equal halves, and picks the half that does not conflict with the HYP ID map to map its linear region. This worked fine when the kernel's linear map itself was guaranteed to cover precisely as many bits of VA space, but this was changed by commit f4693c2716b35d08 ("arm64: mm: extend linear region for 52-bit VA configurations"). The result is that, depending on the placement of the ID map, kernel-VA to hyp-VA translations may produce addresses that either conflict with other HYP mappings (including the ID map itself) or generate addresses outside of the 52-bit addressable range, neither of which is likely to lead to anything useful. Given that 52-bit capable cores are guaranteed to implement VHE, this only affects configurations such as pKVM where we opt into non-VHE mode even if the hardware is VHE capable. So just for these configurations, let's limit the kernel linear map to 51 bits and work around the problem. Fixes: f4693c2716b3 ("arm64: mm: extend linear region for 52-bit VA configurations") Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20210826165613.60774-1-ardb@kernel.org Signed-off-by: Catalin Marinas commit 15b2ae776044ac52cddda8a3e6c9fecd15226b8c Author: Kari Argillander Date: Tue Sep 7 18:35:57 2021 +0300 fs/ntfs3: Show uid/gid always in show_options() Show options should show option according documentation when some value is not default or when ever coder wants. Uid/gid are problematic because it is hard to know which are defaults. In file system there is many different implementation for this problem. Some file systems show uid/gid when they are different than root, some when user has set them and some show them always. There is also problem that what if root uid/gid change. This code just choose to show them always. This way we do not need to think this any more. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 28a941ffc1404b66d67228cbe8392bbadb94af0d Author: Kari Argillander Date: Tue Sep 7 18:35:56 2021 +0300 fs/ntfs3: Rename mount option no_acs_rules > (no)acsrules Rename mount option no_acs_rules to (no)acsrules. This allow us to use possibility to mount with options noaclrules or aclrules. Acked-by: Christian Brauner Reviewed-by: Christoph Hellwig Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit e274cde8c7550cac46eb7aba3a77aff44ae0b301 Author: Kari Argillander Date: Tue Sep 7 18:35:55 2021 +0300 fs/ntfs3: Add iocharset= mount option as alias for nls= Other fs drivers are using iocharset= mount option for specifying charset. So add it also for ntfs3 and mark old nls= mount option as deprecated. Reviewed-by: Pali Rohár Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 9d1939f4575f3fda70dd94542dbd4d775e104132 Author: Kari Argillander Date: Tue Sep 7 18:35:54 2021 +0300 fs/ntfs3: Make mount option nohidden more universal If we call Opt_nohidden with just keyword hidden, then we can use hidden/nohidden when mounting. We already use this method for almoust all other parameters so it is just logical that this will use same method. Acked-by: Christian Brauner Reviewed-by: Christoph Hellwig Reviewed-by: Pali Rohár Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 27fac77707a1d99deef33fd5f3f5f2ed96bfbf6a Author: Kari Argillander Date: Tue Sep 7 18:35:53 2021 +0300 fs/ntfs3: Init spi more in init_fs_context than fill_super init_fs_context() is meant to initialize s_fs_info (spi). Move spi initializing code there which we can initialize before fill_super(). Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 610f8f5a7baf998e70a61c63e53869b676d9b04c Author: Kari Argillander Date: Tue Sep 7 18:35:52 2021 +0300 fs/ntfs3: Use new api for mounting We have now new mount api as described in Documentation/filesystems. We should use it as it gives us some benefits which are desribed here lore.kernel.org/linux-fsdevel/159646178122.1784947.11705396571718464082.stgit@warthog.procyon.org.uk/ Nls loading is changed a to load with string. This did make code also little cleaner. Also try to use fsparam_flag_no as much as possible. This is just nice little touch and is not mandatory but it should not make any harm. It is just convenient that we can use example acl/noacl mount options. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 564c97bdfa39c7d1f331841fb24da6e714693037 Author: Kari Argillander Date: Tue Sep 7 18:35:51 2021 +0300 fs/ntfs3: Convert mount options to pointer in sbi Use pointer to mount options. We want to do this because we will use new mount api which will benefit that we have spi and mount options in different allocations. When we remount we do not have to make whole new spi it is enough that we will allocate just mount options. Please note that we can do example remount lot cleaner but things will change in next patch so this should be just functional. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit c2c389fd6c6b0393549578997744b03822dd2b24 Author: Kari Argillander Date: Tue Sep 7 18:35:50 2021 +0300 fs/ntfs3: Remove unnecesarry remount flag handling Remove unnecesarry remount flag handling. This does not do anything for this driver. We have already set SB_NODIRATIME when we fill super. Also noatime should be set from mount option. Now for some reson we try to set it when remounting. Lazytime part looks like it is copied from f2fs and there is own mount parameter for it. That is why they use it. We do not set lazytime anywhere in our code. So basically this just blocks lazytime when remounting. Acked-by: Christian Brauner Reviewed-by: Christoph Hellwig Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit b8a30b4171b9a3c22ef0605ed74a21544d00c680 Author: Kari Argillander Date: Tue Sep 7 18:35:49 2021 +0300 fs/ntfs3: Remove unnecesarry mount option noatime Remove unnecesarry mount option noatime because this will be handled by VFS. Our option parser will never get opt like this. Acked-by: Christian Brauner Reviewed-by: Christoph Hellwig Reviewed-by: Pali Rohár Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 2ae2eb9dde18979b40629dd413b9adbd6c894cdf Author: Pavel Begunkov Date: Thu Sep 9 13:56:27 2021 +0100 io_uring: fail links of cancelled timeouts When we cancel a timeout we should mark it with REQ_F_FAIL, so linked requests are cancelled as well, but not queued for further execution. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/fff625b44eeced3a5cae79f60e6acf3fbdf8f990.1631192135.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 26be23af1866eead5a29f8501f9d774ac277d0bd Author: Arnaud Pouliquen Date: Thu Sep 9 16:54:49 2021 +0200 MAINTAINERS: fix update references to stm32 audio bindings The 00d38fd8d2524 ("MAINTAINERS: update references to stm32 audio bindings") commit update the bindings reference, by removing bindings/sound/st,stm32-adfsdm.txt, to set the new reference to bindings/iio/adc/st,stm32-*.yaml. This leads to "get_maintainer finds" the match for the Documentation/devicetree/bindings/iio/adc/st,stm32-dfsdm-adc.yaml, but also to the IIO bindings Documentation/devicetree/bindings/iio/adc/st,stm32-adc.yaml And The commit fixes only a part of the problem: Documentation/devicetree/bindings/sound/st,stm32-*.txt file have been also moved to yaml. Update references to include all stm32 audio bindings file and exclude the st,stm32-adc.yaml bindings file. cc: Mauro Carvalho Chehab Fixes: 0d38fd8d2524 ("MAINTAINERS: update references to stm32 audio bindings") Signed-off-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20210909145449.24388-1-arnaud.pouliquen@foss.st.com Signed-off-by: Mark Brown commit 948ca5f30e1df0c11eb5b0f410b9ceb97fa77ad9 Author: Eric Whitney Date: Thu Aug 19 10:49:27 2021 -0400 ext4: enforce buffer head state assertion in ext4_da_map_blocks Remove the code that re-initializes a buffer head with an invalid block number and BH_New and BH_Delay bits when a matching delayed and unwritten block has been found in the extent status cache. Replace it with assertions that verify the buffer head already has this state correctly set. The current code masked an inline data truncation bug that left stale entries in the extent status cache. With this change, generic/130 can be used to reproduce and detect that bug. Signed-off-by: Eric Whitney Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210819144927.25163-3-enwlinux@gmail.com Signed-off-by: Theodore Ts'o commit 0add491df4e5e2c8cc6eeeaa6dbcca50f932090c Author: Eric Whitney Date: Thu Aug 19 10:49:26 2021 -0400 ext4: remove extent cache entries when truncating inline data Conditionally remove all cached extents belonging to an inode when truncating its inline data. It's only necessary to attempt to remove cached extents when a conversion from inline to extent storage has been initiated (!EXT4_STATE_MAY_INLINE_DATA). This avoids unnecessary es lock overhead in the more common inline case. Signed-off-by: Eric Whitney Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210819144927.25163-2-enwlinux@gmail.com Signed-off-by: Theodore Ts'o commit 11ef08c9eb52a808b8903004cba0733df6902a43 Merge: 1fd95c05d8f74 cc883236b7929 Author: Theodore Ts'o Date: Sat Sep 4 23:46:32 2021 -0400 Merge branch 'delalloc-buffer-write' into dev Fix a bug in how we update i_disksize, and the error path in inline_data_end. Finally, drop an unnecessary creation of a journal handle which was only needed for inline data, which can give us a large performance gain in delayed allocation writes. Signed-off-by: Theodore Ts'o commit 70ee251ded6ba24c15537f4abb8a318e233d0d1a Author: Matthias Kaehlcke Date: Mon Aug 23 13:47:30 2021 -0700 thermal/drivers/qcom/spmi-adc-tm5: Don't abort probing if a sensor is not used adc_tm5_register_tzd() registers the thermal zone sensors for all channels of the thermal monitor. If the registration of one channel fails the function skips the processing of the remaining channels and returns an error, which results in _probe() being aborted. One of the reasons the registration could fail is that none of the thermal zones is using the channel/sensor, which hardly is a critical error (if it is an error at all). If this case is detected emit a warning and continue with processing the remaining channels. Fixes: ca66dca5eda6 ("thermal: qcom: add support for adc-tm5 PMIC thermal monitor") Signed-off-by: Matthias Kaehlcke Reported-by: Stephen Boyd Reviewed-by: Stephen Boyd Reviewed-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20210823134726.1.I1dd23ddf77e5b3568625d80d6827653af071ce19@changeid commit 5950fc44a57ace59f21dccfd792250019348a182 Author: Srinivas Pandruvada Date: Thu Aug 19 19:40:05 2021 -0700 thermal/drivers/intel: Allow processing of HWP interrupt Add a weak function to process HWP (Hardware P-states) notifications and move updating HWP_STATUS MSR to this function. This allows HWP interrupts to be processed by the intel_pstate driver in HWP mode by overriding the implementation. Signed-off-by: Srinivas Pandruvada Acked-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20210820024006.2347720-1-srinivas.pandruvada@linux.intel.com commit 2bab94090b01bc593d8bc25f68df41f198721173 Author: Guenter Roeck Date: Mon Sep 6 21:53:58 2021 -0700 spi: tegra20-slink: Declare runtime suspend and resume functions conditionally The following build error is seen with CONFIG_PM=n. drivers/spi/spi-tegra20-slink.c:1188:12: error: 'tegra_slink_runtime_suspend' defined but not used drivers/spi/spi-tegra20-slink.c:1200:12: error: 'tegra_slink_runtime_resume' defined but not used Declare the functions only if PM is enabled. While at it, remove the unnecessary forward declarations. Signed-off-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20210907045358.2138282-1-linux@roeck-us.net Signed-off-by: Mark Brown commit 5a80dea93191d55840f42252ed3e4565a125a514 Author: Trevor Wu Date: Thu Sep 9 14:55:33 2021 +0800 ASoC: mediatek: add required config dependency Because SND_SOC_MT8195 depends on COMPILE_TEST, it's possible to build MT8195 driver in many different config combinations. Add all dependent config for SND_SOC_MT8195 in case some errors happen when COMPILE_TEST is enabled. Signed-off-by: Trevor Wu Reported-by: Randy Dunlap Link: https://lore.kernel.org/r/20210909065533.2114-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 58eafe1ff52ee1ce255759fc15729519af180cbb Author: Pierre-Louis Bossart Date: Tue Sep 7 13:44:36 2021 -0500 ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic The SoundWire BEs make use of 'stream' functions for .prepare and .trigger. These functions will in turn force a Bank Switch, which implies a wait operation. Mark SoundWire BEs as nonatomic for consistency, but keep all other types of BEs as is. The initialization of .nonatomic is done outside of the create_sdw_dailink helper to avoid adding more parameters to deal with a single exception to the rule that BEs are atomic. Suggested-by: Takashi Iwai Signed-off-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20210907184436.33152-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 66e70be722886e4f134350212baa13f217e39e42 Author: Qiang.zhang Date: Thu Sep 9 19:58:22 2021 +0800 io-wq: fix memory leak in create_io_worker() BUG: memory leak unreferenced object 0xffff888126fcd6c0 (size 192): comm "syz-executor.1", pid 11934, jiffies 4294983026 (age 15.690s) backtrace: [] kmalloc_node include/linux/slab.h:609 [inline] [] kzalloc_node include/linux/slab.h:732 [inline] [] create_io_worker+0x41/0x1e0 fs/io-wq.c:739 [] io_wqe_create_worker fs/io-wq.c:267 [inline] [] io_wqe_enqueue+0x1fe/0x330 fs/io-wq.c:866 [] io_queue_async_work+0xc4/0x200 fs/io_uring.c:1473 [] __io_queue_sqe+0x34c/0x510 fs/io_uring.c:6933 [] io_req_task_submit+0x4b/0xa0 fs/io_uring.c:2233 [] io_async_task_func+0x108/0x1c0 fs/io_uring.c:5462 [] tctx_task_work+0x1b3/0x3a0 fs/io_uring.c:2158 [] task_work_run+0x73/0xb0 kernel/task_work.c:164 [] tracehook_notify_signal include/linux/tracehook.h:212 [inline] [] handle_signal_work kernel/entry/common.c:146 [inline] [] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] [] exit_to_user_mode_prepare+0x151/0x180 kernel/entry/common.c:209 [] __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] [] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:302 [] do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 [] entry_SYSCALL_64_after_hwframe+0x44/0xae when create_io_thread() return error, and not retry, the worker object need to be freed. Reported-by: syzbot+65454c239241d3d647da@syzkaller.appspotmail.com Signed-off-by: Qiang.zhang Link: https://lore.kernel.org/r/20210909115822.181188-1-qiang.zhang@windriver.com Signed-off-by: Jens Axboe commit 8cc633190b524c678b740c87fa1fc37447151a6b Author: Robin Murphy Date: Wed Sep 8 13:55:37 2021 +0100 iommu: Clarify default domain Kconfig Although strictly it is the AMD and Intel drivers which have an existing expectation of lazy behaviour by default, it ends up being rather unintuitive to describe this literally in Kconfig. Express it instead as an architecture dependency, to clarify that it is a valid config-time decision. The end result is the same since virtio-iommu doesn't support lazy mode and thus falls back to strict at runtime regardless. The per-architecture disparity is a matter of historical expectations: the AMD and Intel drivers have been lazy by default since 2008, and changing that gets noticed by people asking where their I/O throughput has gone. Conversely, Arm-based systems with their wider assortment of IOMMU drivers mostly only support strict mode anyway; only the Arm SMMU drivers have later grown support for passthrough and lazy mode, for users who wanted to explicitly trade off isolation for performance. These days, reducing the default level of isolation in a way which may go unnoticed by users who expect otherwise hardly seems worth risking for the sake of one line of Kconfig, so here's where we are. Reported-by: Linus Torvalds Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/69a0c6f17b000b54b8333ee42b3124c1d5a869e2.1631105737.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel commit 6ef0505158f7ca1b32763a3b038b5d11296b642b Author: Fenghua Yu Date: Sat Aug 28 15:06:22 2021 +0800 iommu/vt-d: Fix a deadlock in intel_svm_drain_prq() pasid_mutex and dev->iommu->param->lock are held while unbinding mm is flushing IO page fault workqueue and waiting for all page fault works to finish. But an in-flight page fault work also need to hold the two locks while unbinding mm are holding them and waiting for the work to finish. This may cause an ABBA deadlock issue as shown below: idxd 0000:00:0a.0: unbind PASID 2 ====================================================== WARNING: possible circular locking dependency detected 5.14.0-rc7+ #549 Not tainted [ 186.615245] ---------- dsa_test/898 is trying to acquire lock: ffff888100d854e8 (¶m->lock){+.+.}-{3:3}, at: iopf_queue_flush_dev+0x29/0x60 but task is already holding lock: ffffffff82b2f7c8 (pasid_mutex){+.+.}-{3:3}, at: intel_svm_unbind+0x34/0x1e0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (pasid_mutex){+.+.}-{3:3}: __mutex_lock+0x75/0x730 mutex_lock_nested+0x1b/0x20 intel_svm_page_response+0x8e/0x260 iommu_page_response+0x122/0x200 iopf_handle_group+0x1c2/0x240 process_one_work+0x2a5/0x5a0 worker_thread+0x55/0x400 kthread+0x13b/0x160 ret_from_fork+0x22/0x30 -> #1 (¶m->fault_param->lock){+.+.}-{3:3}: __mutex_lock+0x75/0x730 mutex_lock_nested+0x1b/0x20 iommu_report_device_fault+0xc2/0x170 prq_event_thread+0x28a/0x580 irq_thread_fn+0x28/0x60 irq_thread+0xcf/0x180 kthread+0x13b/0x160 ret_from_fork+0x22/0x30 -> #0 (¶m->lock){+.+.}-{3:3}: __lock_acquire+0x1134/0x1d60 lock_acquire+0xc6/0x2e0 __mutex_lock+0x75/0x730 mutex_lock_nested+0x1b/0x20 iopf_queue_flush_dev+0x29/0x60 intel_svm_drain_prq+0x127/0x210 intel_svm_unbind+0xc5/0x1e0 iommu_sva_unbind_device+0x62/0x80 idxd_cdev_release+0x15a/0x200 [idxd] __fput+0x9c/0x250 ____fput+0xe/0x10 task_work_run+0x64/0xa0 exit_to_user_mode_prepare+0x227/0x230 syscall_exit_to_user_mode+0x2c/0x60 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: ¶m->lock --> ¶m->fault_param->lock --> pasid_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(pasid_mutex); lock(¶m->fault_param->lock); lock(pasid_mutex); lock(¶m->lock); *** DEADLOCK *** 2 locks held by dsa_test/898: #0: ffff888100cc1cc0 (&group->mutex){+.+.}-{3:3}, at: iommu_sva_unbind_device+0x53/0x80 #1: ffffffff82b2f7c8 (pasid_mutex){+.+.}-{3:3}, at: intel_svm_unbind+0x34/0x1e0 stack backtrace: CPU: 2 PID: 898 Comm: dsa_test Not tainted 5.14.0-rc7+ #549 Hardware name: Intel Corporation Kabylake Client platform/KBL S DDR4 UD IMM CRB, BIOS KBLSE2R1.R00.X050.P01.1608011715 08/01/2016 Call Trace: dump_stack_lvl+0x5b/0x74 dump_stack+0x10/0x12 print_circular_bug.cold+0x13d/0x142 check_noncircular+0xf1/0x110 __lock_acquire+0x1134/0x1d60 lock_acquire+0xc6/0x2e0 ? iopf_queue_flush_dev+0x29/0x60 ? pci_mmcfg_read+0xde/0x240 __mutex_lock+0x75/0x730 ? iopf_queue_flush_dev+0x29/0x60 ? pci_mmcfg_read+0xfd/0x240 ? iopf_queue_flush_dev+0x29/0x60 mutex_lock_nested+0x1b/0x20 iopf_queue_flush_dev+0x29/0x60 intel_svm_drain_prq+0x127/0x210 ? intel_pasid_tear_down_entry+0x22e/0x240 intel_svm_unbind+0xc5/0x1e0 iommu_sva_unbind_device+0x62/0x80 idxd_cdev_release+0x15a/0x200 pasid_mutex protects pasid and svm data mapping data. It's unnecessary to hold pasid_mutex while flushing the workqueue. To fix the deadlock issue, unlock pasid_pasid during flushing the workqueue to allow the works to be handled. Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework") Reported-and-tested-by: Dave Jiang Signed-off-by: Fenghua Yu Link: https://lore.kernel.org/r/20210826215918.4073446-1-fenghua.yu@intel.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20210828070622.2437559-3-baolu.lu@linux.intel.com [joro: Removed timing information from kernel log messages] Signed-off-by: Joerg Roedel commit a21518cb23a3c7d49bafcb59862fd389fd829d4b Author: Fenghua Yu Date: Sat Aug 28 15:06:21 2021 +0800 iommu/vt-d: Fix PASID leak in intel_svm_unbind_mm() The mm->pasid will be used in intel_svm_free_pasid() after load_pasid() during unbinding mm. Clearing it in load_pasid() will cause PASID cannot be freed in intel_svm_free_pasid(). Additionally mm->pasid was updated already before load_pasid() during pasid allocation. No need to update it again in load_pasid() during binding mm. Don't update mm->pasid to avoid the issues in both binding mm and unbinding mm. Fixes: 4048377414162 ("iommu/vt-d: Use iommu_sva_alloc(free)_pasid() helpers") Reported-and-tested-by: Dave Jiang Co-developed-by: Jacob Pan Signed-off-by: Jacob Pan Signed-off-by: Fenghua Yu Link: https://lore.kernel.org/r/20210826215918.4073446-1-fenghua.yu@intel.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20210828070622.2437559-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit eb03f2d2f6a4da25d286613717d10add9ce9f175 Author: Suravee Suthikulpanit Date: Fri Aug 20 15:29:57 2021 -0500 iommu/amd: Remove iommu_init_ga() Since the function has been simplified and only call iommu_init_ga_log(), remove the function and replace with iommu_init_ga_log() instead. Signed-off-by: Suravee Suthikulpanit Link: https://lore.kernel.org/r/20210820202957.187572-4-suravee.suthikulpanit@amd.com Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log") Signed-off-by: Joerg Roedel commit c3811a50addd23b9bb5a36278609ee1638debcf6 Author: Wei Huang Date: Fri Aug 20 15:29:55 2021 -0500 iommu/amd: Relocate GAMSup check to early_enable_iommus Currently, iommu_init_ga() checks and disables IOMMU VAPIC support (i.e. AMD AVIC support in IOMMU) when GAMSup feature bit is not set. However it forgets to clear IRQ_POSTING_CAP from the previously set amd_iommu_irq_ops.capability. This triggers an invalid page fault bug during guest VM warm reboot if AVIC is enabled since the irq_remapping_cap(IRQ_POSTING_CAP) is incorrectly set, and crash the system with the following kernel trace. BUG: unable to handle page fault for address: 0000000000400dd8 RIP: 0010:amd_iommu_deactivate_guest_mode+0x19/0xbc Call Trace: svm_set_pi_irte_mode+0x8a/0xc0 [kvm_amd] ? kvm_make_all_cpus_request_except+0x50/0x70 [kvm] kvm_request_apicv_update+0x10c/0x150 [kvm] svm_toggle_avic_for_irq_window+0x52/0x90 [kvm_amd] svm_enable_irq_window+0x26/0xa0 [kvm_amd] vcpu_enter_guest+0xbbe/0x1560 [kvm] ? avic_vcpu_load+0xd5/0x120 [kvm_amd] ? kvm_arch_vcpu_load+0x76/0x240 [kvm] ? svm_get_segment_base+0xa/0x10 [kvm_amd] kvm_arch_vcpu_ioctl_run+0x103/0x590 [kvm] kvm_vcpu_ioctl+0x22a/0x5d0 [kvm] __x64_sys_ioctl+0x84/0xc0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes by moving the initializing of AMD IOMMU interrupt remapping mode (amd_iommu_guest_ir) earlier before setting up the amd_iommu_irq_ops.capability with appropriate IRQ_POSTING_CAP flag. [joro: Squashed the two patches and limited check_features_on_all_iommus() to CONFIG_IRQ_REMAP to fix a compile warning.] Signed-off-by: Wei Huang Co-developed-by: Suravee Suthikulpanit Signed-off-by: Suravee Suthikulpanit Link: https://lore.kernel.org/r/20210820202957.187572-2-suravee.suthikulpanit@amd.com Link: https://lore.kernel.org/r/20210820202957.187572-3-suravee.suthikulpanit@amd.com Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log") Signed-off-by: Joerg Roedel commit d97180ad68bdb7ee10f327205a649bc2f558741d Author: Helge Deller Date: Wed Sep 8 23:27:00 2021 +0200 parisc: Mark sched_clock unstable only if clocks are not syncronized We check at runtime if the cr16 clocks are stable across CPUs. Only mark the sched_clock unstable by calling clear_sched_clock_stable() if we know that we run on a system which isn't syncronized across CPUs. Signed-off-by: Helge Deller commit 907872baa9f1538eed02ec737b8e89eba6c6e4b9 Author: Guenter Roeck Date: Wed Sep 8 08:30:41 2021 -0700 parisc: Move pci_dev_is_behind_card_dino to where it is used parisc build test images fail to compile with the following error. drivers/parisc/dino.c:160:12: error: 'pci_dev_is_behind_card_dino' defined but not used Move the function just ahead of its only caller to avoid the error. Fixes: 5fa1659105fa ("parisc: Disable HP HSC-PCI Cards to prevent kernel crash") Cc: Helge Deller Signed-off-by: Guenter Roeck Signed-off-by: Helge Deller commit e4f2006f1287e7ea17660490569cff323772dac4 Author: Helge Deller Date: Tue Sep 7 05:03:29 2021 +0200 parisc: Reduce sigreturn trampoline to 3 instructions We can move the INSN_LDI_R20 instruction into the branch delay slot. Signed-off-by: Helge Deller commit 3e4a1aff2a97cb4fd7f0268e4b69e8c9d3641277 Author: Helge Deller Date: Sun Sep 5 11:53:32 2021 +0200 parisc: Check user signal stack trampoline is inside TASK_SIZE Add some additional checks to ensure the signal stack is inside userspace bounds. Signed-off-by: Helge Deller commit ea4b3fca18adc81e6a965b2ad0668f38d5d3485b Author: Helge Deller Date: Mon Sep 6 22:45:16 2021 +0200 parisc: Drop useless debug info and comments from signal.c Signed-off-by: Helge Deller commit 1260dea6d2eb75706c978da828a36f0def590d3a Author: Helge Deller Date: Sat Sep 4 23:49:26 2021 +0200 parisc: Drop strnlen_user() in favour of generic version As suggested by Arnd Bergmann, drop the parisc version of strnlen_user() and switch to the generic version. Suggested-by: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Helge Deller commit 3da6379a6d865ef4faa369eebe2019dac75cda4b Author: Helge Deller Date: Sun Sep 5 11:50:56 2021 +0200 parisc: Add missing FORCE prerequisite in Makefile Signed-off-by: Helge Deller commit e011912651bdf72840d88e8a8de3716bbcc4be99 Author: Guenter Roeck Date: Wed Sep 8 21:49:53 2021 -0700 net: ni65: Avoid typecast of pointer to u32 Building alpha:allmodconfig results in the following error. drivers/net/ethernet/amd/ni65.c: In function 'ni65_stop_start': drivers/net/ethernet/amd/ni65.c:751:37: error: cast from pointer to integer of different size buffer[i] = (u32) isa_bus_to_virt(tmdp->u.buffer); 'buffer[]' is declared as unsigned long, so replace the typecast to u32 with a typecast to unsigned long to fix the problem. Cc: Arnd Bergmann Signed-off-by: Guenter Roeck Acked-by: Arnd Bergmann Signed-off-by: David S. Miller commit e3a843f98c8fad4d02849fdb14919885024bf51f Merge: 2a48d96fd58a6 6215b608a8c4d Author: David S. Miller Date: Thu Sep 9 11:17:37 2021 +0100 Merge branch 'sfx-xdp-fallback-tx-queues' Íñigo Huguet says: ==================== sfc: fallback for lack of xdp tx queues If there are not enough hardware resources to allocate one tx queue per CPU for XDP, XDP_TX and XDP_REDIRECT actions were unavailable, and using them resulted each time with the packet being drop and this message in the logs: XDP TX failed (-22) These patches implement 2 fallback solutions for 2 different situations that might happen: 1. There are not enough free resources for all the tx queues, but there are some free resources available 2. There are not enough free resources at all for tx queues. Both solutions are based in sharing tx queues, using __netif_tx_lock for synchronization. In the second case, as there are not XDP TX queues to share, network stack queues are used instead, but since we're taking __netif_tx_lock, concurrent access to the queues is correctly protected. The solution for this second case might affect performance both of XDP traffic and normal traffice due to lock contention if both are used intensively. That's why I call it a "last resort" fallback: it's not a desirable situation, but at least we have XDP TX working. Some tests has shown good results and indicate that the non-fallback case is not being damaged by this changes. They are also promising for the fallback cases. This is the test: 1. From another machine, send high amount of packets with pktgen, script samples/pktgen/pktgen_sample04_many_flows.sh 2. In the tested machine, run samples/bpf/xdp_rxq_info with arguments "-a XDP_TX --swapmac" and see the results 3. In the tested machine, run also pktgen_sample04 to create high TX normal traffic, and see how xdp_rxq_info results vary Note that this test doesn't check the worst situations for the fallback solutions because XDP_TX will only be executed from the same CPUs that are processed by sfc, and not from every CPU in the system, so the performance drop due to the highest locking contention doesn't happen. I'd like to test that, as well, but I don't have access right now to a proper environment. Test results: Without doing TX: Before changes: ~2,900,000 pps After changes, 1 queues/core: ~2,900,000 pps After changes, 2 queues/core: ~2,900,000 pps After changes, 8 queues/core: ~2,900,000 pps After changes, borrowing from network stack: ~2,900,000 pps With multiflow TX at the same time: Before changes: ~1,700,000 - 2,900,000 pps After changes, 1 queues/core: ~1,700,000 - 2,900,000 pps After changes, 2 queues/core: ~1,700,000 pps After changes, 8 queues/core: ~1,700,000 pps After changes, borrowing from network stack: 1,150,000 pps Sporadic "XDP TX failed (-5)" warnings are shown when running xdp program and pktgen simultaneously. This was expected because XDP doesn't have any buffering system if the NIC is under very high pressure. Thousands of these warnings are shown in the case of borrowing net stack queues. As I said before, this was also expected. ==================== Signed-off-by: David S. Miller commit 6215b608a8c4d4a478721e14a6faa0dc56e4a693 Author: Íñigo Huguet Date: Thu Sep 9 11:28:46 2021 +0200 sfc: last resort fallback for lack of xdp tx queues Previous patch addressed the situation of having some free resources for xdp tx but not enough for one tx queue per CPU. This patch address the worst case of not having resources at all for xdp tx. Instead of using queues dedicated to xdp, normal queues used by network stack are shared for both cases, using __netif_tx_lock for synchronization. Also queue stop/restart must be considered in the xdp path to avoid freezing the queue. This is not the ideal situation we might want to be, and a performance penalty is expected both for normal and xdp traffic, but at least XDP will work in all possible situations (with a warning in the logs), improving a bit the pain of not knowing in what situations we can use it and in what situations we cannot. Signed-off-by: Íñigo Huguet Signed-off-by: David S. Miller commit 415446185b939dcdcd6a483e705c805ab961e54c Author: Íñigo Huguet Date: Thu Sep 9 11:28:45 2021 +0200 sfc: fallback for lack of xdp tx queues If there are not enough resources to allocate one TX queue per core for XDP TX it was completely disabled. This patch implements a fallback solution for sharing the available queues using __netif_tx_lock for synchronization. In the normal case that there is one TX queue per CPU, no locking is done, as it was before. With this fallback solution, XDP TX will work in much more cases that were failing, specially in machines with many CPUs. It's hard for XDP users to know what features are supported across different NICs and configurations, so they will benefit on having wider support. Signed-off-by: Íñigo Huguet Signed-off-by: David S. Miller commit 2a48d96fd58a666ae231c3dd6fe4a458798ac645 Author: Joakim Zhang Date: Thu Sep 9 17:23:22 2021 +0800 net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP Use __maybe_unused for noirq_suspend()/noirq_resume() hooks to avoid build warning with !CONFIG_PM_SLEEP: >> drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:796:12: error: 'stmmac_pltfr_noirq_resume' defined but not used [-Werror=unused-function] 796 | static int stmmac_pltfr_noirq_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:775:12: error: 'stmmac_pltfr_noirq_suspend' defined but not used [-Werror=unused-function] 775 | static int stmmac_pltfr_noirq_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Fixes: 276aae377206 ("net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume") Reported-by: kernel test robot Signed-off-by: Joakim Zhang Signed-off-by: David S. Miller commit 3c10ffddc61f8a1a59e29a110ba70b47e679206a Author: Pavel Skripkin Date: Thu Sep 2 22:04:00 2021 +0300 net: xfrm: fix shift-out-of-bounds in xfrm_get_default Syzbot hit shift-out-of-bounds in xfrm_get_default. The problem was in missing validation check for user data. up->dirmask comes from user-space, so we need to check if this value is less than XFRM_USERPOLICY_DIRMASK_MAX to avoid shift-out-of-bounds bugs. Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Reported-and-tested-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: Steffen Klassert commit 9b6ff7eb666415e1558f1ba8a742f5db6a9954de Author: Xiyu Yang Date: Thu Sep 9 12:32:00 2021 +0800 net/l2tp: Fix reference count leak in l2tp_udp_recv_core The reference count leak issue may take place in an error handling path. If both conditions of tunnel->version == L2TP_HDR_VER_3 and the return value of l2tp_v3_ensure_opt_in_linear is nonzero, the function would directly jump to label invalid, without decrementing the reference count of the l2tp_session object session increased earlier by l2tp_tunnel_get_session(). This may result in refcount leaks. Fix this issue by decrease the reference count before jumping to the label invalid. Fixes: 4522a70db7aa ("l2tp: fix reading optional fields of L2TPv3") Signed-off-by: Xiyu Yang Signed-off-by: Xin Xiong Signed-off-by: Xin Tan Signed-off-by: David S. Miller commit 04f08eb44b5011493d77b602fdec29ff0f5c6cd5 Author: Eric Dumazet Date: Wed Sep 8 17:00:29 2021 -0700 net/af_unix: fix a data-race in unix_dgram_poll syzbot reported another data-race in af_unix [1] Lets change __skb_insert() to use WRITE_ONCE() when changing skb head qlen. Also, change unix_dgram_poll() to use lockless version of unix_recvq_full() It is verry possible we can switch all/most unix_recvq_full() to the lockless version, this will be done in a future kernel version. [1] HEAD commit: 8596e589b787732c8346f0482919e83cc9362db1 BUG: KCSAN: data-race in skb_queue_tail / unix_dgram_poll write to 0xffff88814eeb24e0 of 4 bytes by task 25815 on cpu 0: __skb_insert include/linux/skbuff.h:1938 [inline] __skb_queue_before include/linux/skbuff.h:2043 [inline] __skb_queue_tail include/linux/skbuff.h:2076 [inline] skb_queue_tail+0x80/0xa0 net/core/skbuff.c:3264 unix_dgram_sendmsg+0xff2/0x1600 net/unix/af_unix.c:1850 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 ___sys_sendmsg net/socket.c:2446 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2532 __do_sys_sendmmsg net/socket.c:2561 [inline] __se_sys_sendmmsg net/socket.c:2558 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2558 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88814eeb24e0 of 4 bytes by task 25834 on cpu 1: skb_queue_len include/linux/skbuff.h:1869 [inline] unix_recvq_full net/unix/af_unix.c:194 [inline] unix_dgram_poll+0x2bc/0x3e0 net/unix/af_unix.c:2777 sock_poll+0x23e/0x260 net/socket.c:1288 vfs_poll include/linux/poll.h:90 [inline] ep_item_poll fs/eventpoll.c:846 [inline] ep_send_events fs/eventpoll.c:1683 [inline] ep_poll fs/eventpoll.c:1798 [inline] do_epoll_wait+0x6ad/0xf00 fs/eventpoll.c:2226 __do_sys_epoll_wait fs/eventpoll.c:2238 [inline] __se_sys_epoll_wait fs/eventpoll.c:2233 [inline] __x64_sys_epoll_wait+0xf6/0x120 fs/eventpoll.c:2233 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000001b -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 25834 Comm: syz-executor.1 Tainted: G W 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 86b18aaa2b5b ("skbuff: fix a data race in skb_queue_len()") Cc: Qian Cai Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Author: Tong Zhang Date: Wed Sep 8 12:02:32 2021 -0700 net: macb: fix use after free on rmmod plat_dev->dev->platform_data is released by platform_device_unregister(), use of pclk and hclk is a use-after-free. Since device unregister won't need a clk device we adjust the function call sequence to fix this issue. [ 31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci] [ 31.275563] Freed by task 306: [ 30.276782] platform_device_release+0x25/0x80 Suggested-by: Nicolas Ferre Signed-off-by: Tong Zhang Acked-by: Nicolas Ferre Signed-off-by: David S. Miller commit 273c29e944bda9a20a30c26cfc34c9a3f363280b Author: Sukadev Bhattiprolu Date: Wed Sep 8 09:58:20 2021 -0700 ibmvnic: check failover_pending in login response If a failover occurs before a login response is received, the login response buffer maybe undefined. Check that there was no failover before accessing the login response buffer. Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol") Signed-off-by: Sukadev Bhattiprolu Signed-off-by: David S. Miller commit 3c4cea8fa7f71f00c5279547043a84bc2a4d8b8c Author: Paolo Abeni Date: Wed Sep 8 13:42:09 2021 +0200 vhost_net: fix OoB on sendmsg() failure. If the sendmsg() call in vhost_tx_batch() fails, both the 'batched_xdp' and 'done_idx' indexes are left unchanged. If such failure happens when batched_xdp == VHOST_NET_BATCH, the next call to vhost_net_build_xdp() will access and write memory outside the xdp buffers area. Since sendmsg() can only error with EBADFD, this change addresses the issue explicitly freeing the XDP buffers batch on error. Fixes: 0a0be13b8fe2 ("vhost_net: batch submitting XDP buffers to underlayer sockets") Suggested-by: Jason Wang Signed-off-by: Paolo Abeni Acked-by: Jason Wang Signed-off-by: David S. Miller commit 868ad33bfa3bf39960982682ad3a0f8ebda1656e Author: Thomas Gleixner Date: Sat Aug 28 15:55:52 2021 +0200 sched: Prevent balance_push() on remote runqueues sched_setscheduler() and rt_mutex_setprio() invoke the run-queue balance callback after changing priorities or the scheduling class of a task. The run-queue for which the callback is invoked can be local or remote. That's not a problem for the regular rq::push_work which is serialized with a busy flag in the run-queue struct, but for the balance_push() work which is only valid to be invoked on the outgoing CPU that's wrong. It not only triggers the debug warning, but also leaves the per CPU variable push_work unprotected, which can result in double enqueues on the stop machine list. Remove the warning and validate that the function is invoked on the outgoing CPU. Fixes: ae7927023243 ("sched: Optimize finish_lock_switch()") Reported-by: Sebastian Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/87zgt1hdw7.ffs@tglx commit 9848417926353daa59d2b05eb26e185063dbac6e Author: Sebastian Andrzej Siewior Date: Mon Sep 6 13:30:34 2021 +0200 sched/idle: Make the idle timer expire in hard interrupt context The intel powerclamp driver will setup a per-CPU worker with RT priority. The worker will then invoke play_idle() in which it remains in the idle poll loop until it is stopped by the timer it started earlier. That timer needs to expire in hard interrupt context on PREEMPT_RT. Otherwise the timer will expire in ksoftirqd as a SOFT timer but that task won't be scheduled on the CPU because its priority is lower than the priority of the worker which is in the idle loop. Always expire the idle timer in hard interrupt context. Reported-by: Thomas Gleixner Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210906113034.jgfxrjdvxnjqgtmc@linutronix.de commit e5480572706da1b2c2dc2c6484eab64f92b9263b Author: Peter Zijlstra Date: Wed Sep 1 11:44:11 2021 +0200 locking/rtmutex: Fix ww_mutex deadlock check Dan reported that rt_mutex_adjust_prio_chain() can be called with .orig_waiter == NULL however commit a055fcc132d4 ("locking/rtmutex: Return success on deadlock for ww_mutex waiters") unconditionally dereferences it. Since both call-sites that have .orig_waiter == NULL don't care for the return value, simply disable the deadlock squash by adding the NULL check. Notably, both callers use the deadlock condition as a termination condition for the iteration; once detected, it is sure that (de)boosting is done. Arguably step [3] would be a more natural termination point, but it's dubious whether adding a third deadlock detection state would improve the code. Fixes: a055fcc132d4 ("locking/rtmutex: Return success on deadlock for ww_mutex waiters") Reported-by: Dan Carpenter Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Acked-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/YS9La56fHMiCCo75@hirez.programming.kicks-ass.net commit 0c45d3e24ef3d3d87c5e0077b8f38d1372af7176 Author: Yu-Tung Chang Date: Mon Aug 30 13:25:32 2021 +0800 rtc: rx8010: select REGMAP_I2C The rtc-rx8010 uses the I2C regmap but doesn't select it in Kconfig so depending on the configuration the build may fail. Fix it. Signed-off-by: Yu-Tung Chang Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20210830052532.40356-1-mtwget@gmail.com commit 0c5483a5778fa9910538453b5a9f1a6ed49e95ad Author: Guenter Roeck Date: Tue Sep 7 18:37:08 2021 -0700 Input: analog - always use ktime functions m68k, mips, s390, and sparc allmodconfig images fail to build with the following error. drivers/input/joystick/analog.c:160:2: error: #warning Precise timer not defined for this architecture. Remove architecture specific time handling code and always use ktime functions to determine time deltas. Also remove the now useless use_ktime kernel parameter. Signed-off-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20210907123734.21520-1-linux@roeck-us.net Signed-off-by: Dmitry Torokhov commit 8d014f5fe98142b79dfa3bcd0d9483a5165f3570 Author: Steve French Date: Thu Sep 9 00:09:20 2021 -0500 cifs: move SMB FSCTL definitions to common code The FSCTL definitions are in smbfsctl.h which should be shared by client and server. Move the updated version of smbfsctl.h into smbfs_common and have the client code use it (subsequent patch will change the server to use this common version of the header). Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 23e91d8b7c5ae2bbd3a4582ec12c6a0cfcb19e85 Author: Steve French Date: Wed Sep 8 23:59:26 2021 -0500 cifs: rename cifs_common to smbfs_common As we move to common code between client and server, we have been asked to make the names less confusing, and refer less to "cifs" and more to words which include "smb" instead to e.g. "smbfs" for the client (we already have "ksmbd" for the kernel server, and "smbd" for the user space Samba daemon). So to be more consistent in the naming of common code between client and server and reduce the risk of merge conflicts as more common code is added - rename "cifs_common" to "smbfs_common" (in future releases we also will rename the fs/cifs directory to fs/smbfs) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit fc111fb9a6da6baddf23930811210650824b8a88 Author: Steve French Date: Wed Sep 8 23:06:24 2021 -0500 cifs: update FSCTL definitions Add some missing defines used by ksmbd to the client version of smbfsctl.h, and add a missing newer define mentioned in the protocol definitions (MS-FSCC). This will also make it easier to move to common code. Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit de04744d658bb36d62d94bf8fe040c51c2954d4e Merge: 06b224d5162bc efcefc7127290 Author: Dave Airlie Date: Thu Sep 9 13:34:15 2021 +1000 Merge tag 'drm-misc-next-fixes-2021-09-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next-fixes for v5.15: - Fix ttm_bo_move_memcpy() when ttm_resource is subclassed. - Small fixes to panfrost, mgag200, vc4. - Small ttm compilation fixes. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/41ff5e54-0837-2226-a182-97ffd11ef01e@linux.intel.com commit 06b224d5162bc4e353ade4815dc8ed831f10b9b8 Merge: 1645cca9da91a d6043581e1d9d Author: Dave Airlie Date: Thu Sep 9 13:33:48 2021 +1000 Merge tag 'amd-drm-next-5.15-2021-09-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.15-2021-09-01: amdgpu: - Misc cleanups, typo fixes - EEPROM fix - Add some new PCI IDs - Scatter/Gather display support for Yellow Carp - PCIe DPM fix for RKL platforms - RAS fix amdkfd: - SVM fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210901214015.4488-1-alexander.deucher@amd.com commit 3b33e3f4a6c0296812a7ee757bdae83290e64aed Author: Jens Axboe Date: Wed Sep 8 19:57:26 2021 -0600 io-wq: fix silly logic error in io_task_work_match() We check for the func with an OR condition, which means it always ends up being false and we never match the task_work we want to cancel. In the unexpected case that we do exit with that pending, we can trigger a hang waiting for a worker to exit, but it was never created. syzbot reports that as such: INFO: task syz-executor687:8514 blocked for more than 143 seconds. Not tainted 5.14.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor687 state:D stack:27296 pid: 8514 ppid: 8479 flags:0x00024004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x176/0x280 kernel/sched/completion.c:138 io_wq_exit_workers fs/io-wq.c:1162 [inline] io_wq_put_and_exit+0x40c/0xc70 fs/io-wq.c:1197 io_uring_clean_tctx fs/io_uring.c:9607 [inline] io_uring_cancel_generic+0x5fe/0x740 fs/io_uring.c:9687 io_uring_files_cancel include/linux/io_uring.h:16 [inline] do_exit+0x265/0x2a30 kernel/exit.c:780 do_group_exit+0x125/0x310 kernel/exit.c:922 get_signal+0x47f/0x2160 kernel/signal.c:2868 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x445cd9 RSP: 002b:00007fc657f4b308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00000000004cb448 RCX: 0000000000445cd9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00000000004cb44c RBP: 00000000004cb440 R08: 000000000000000e R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049b154 R13: 0000000000000003 R14: 00007fc657f4b400 R15: 0000000000022000 While in there, also decrement accr->nr_workers. This isn't strictly needed as we're exiting, but let's make sure the accounting matches up. Fixes: 3146cba99aa2 ("io-wq: make worker creation resilient against signals") Reported-by: syzbot+f62d3e0a4ea4f38f5326@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit a3fa7a101dcff93791d1b1bdb3affcad1410c8c1 Merge: 730bf31b8fc8e a7a08b275a8bb ddb13122aa7e9 Author: Linus Torvalds Date: Wed Sep 8 18:52:05 2021 -0700 Merge branches 'akpm' and 'akpm-hotfixes' (patches from Andrew) Merge yet more updates and hotfixes from Andrew Morton: "Post-linux-next material, based upon latest upstream to catch the now-merged dependencies: - 10 patches. Subsystems affected by this patch series: mm (vmstat and migration) and compat. And bunch of hotfixes, mostly cc:stable: - 8 patches. Subsystems affected by this patch series: mm (hmm, hugetlb, vmscan, pagealloc, pagemap, kmemleak, mempolicy, and memblock)" * emailed patches from Andrew Morton : arch: remove compat_alloc_user_space compat: remove some compat entry points mm: simplify compat numa syscalls mm: simplify compat_sys_move_pages kexec: avoid compat_alloc_user_space kexec: move locking into do_kexec_load mm: migrate: change to use bool type for 'page_was_mapped' mm: migrate: fix the incorrect function name in comments mm: migrate: introduce a local variable to get the number of pages mm/vmstat: protect per cpu variables with preempt disable on RT * emailed hotfixes from Andrew Morton : nds32/setup: remove unused memblock_region variable in setup_memory() mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task mm/kmemleak: allow __GFP_NOLOCKDEP passed to kmemleak's gfp mmap_lock: change trace and locking order mm/page_alloc.c: avoid accessing uninitialized pcp page migratetype mm,vmscan: fix divide by zero in get_scan_count mm/hugetlb: initialize hugetlb_usage in mm_init mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled commit ddb13122aa7e988e15283701afb086e0950c405f Author: Mike Rapoport Date: Wed Sep 8 18:10:23 2021 -0700 nds32/setup: remove unused memblock_region variable in setup_memory() kernel test robot reports unused variable warning: arch/nds32/kernel/setup.c:247:26: warning: Unused variable: region [unusedVariable] struct memblock_region *region; ^ Remove the unused variable. Link: https://lkml.kernel.org/r/20210712125218.28951-1-rppt@kernel.org Signed-off-by: Mike Rapoport Reported-by: kernel test robot Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Cc: Greentime Hu Cc: Nick Hu Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 276aeee1c5fc00df700f0782060beae126600472 Author: yanghui Date: Wed Sep 8 18:10:20 2021 -0700 mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task Servers happened below panic: Kernel version:5.4.56 BUG: unable to handle page fault for address: 0000000000002c48 RIP: 0010:__next_zones_zonelist+0x1d/0x40 Call Trace: __alloc_pages_nodemask+0x277/0x310 alloc_page_interleave+0x13/0x70 handle_mm_fault+0xf99/0x1390 __do_page_fault+0x288/0x500 do_page_fault+0x30/0x110 page_fault+0x3e/0x50 The reason for the panic is that MAX_NUMNODES is passed in the third parameter in __alloc_pages_nodemask(preferred_nid). So access to zonelist->zoneref->zone_idx in __next_zones_zonelist will cause a panic. In offset_il_node(), first_node() returns nid from pol->v.nodes, after this other threads may chang pol->v.nodes before next_node(). This race condition will let next_node return MAX_NUMNODES. So put pol->nodes in a local variable. The race condition is between offset_il_node and cpuset_change_task_nodemask: CPU0: CPU1: alloc_pages_vma() interleave_nid(pol,) offset_il_node(pol,) first_node(pol->v.nodes) cpuset_change_task_nodemask //nodes==0xc mpol_rebind_task mpol_rebind_policy mpol_rebind_nodemask(pol,nodes) //nodes==0x3 next_node(nid, pol->v.nodes)//return MAX_NUMNODES Link: https://lkml.kernel.org/r/20210906034658.48721-1-yanghui.def@bytedance.com Signed-off-by: yanghui Reviewed-by: Muchun Song Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79d3705040c3b41075f894fdeeebdcbb46550c63 Author: Naohiro Aota Date: Wed Sep 8 18:10:17 2021 -0700 mm/kmemleak: allow __GFP_NOLOCKDEP passed to kmemleak's gfp In a memory pressure situation, I'm seeing the lockdep WARNING below. Actually, this is similar to a known false positive which is already addressed by commit 6dcde60efd94 ("xfs: more lockdep whackamole with kmem_alloc*"). This warning still persists because it's not from kmalloc() itself but from an allocation for kmemleak object. While kmalloc() itself suppress the warning with __GFP_NOLOCKDEP, gfp_kmemleak_mask() is dropping the flag for the kmemleak's allocation. Allow __GFP_NOLOCKDEP to be passed to kmemleak's allocation, so that the warning for it is also suppressed. ====================================================== WARNING: possible circular locking dependency detected 5.14.0-rc7-BTRFS-ZNS+ #37 Not tainted ------------------------------------------------------ kswapd0/288 is trying to acquire lock: ffff88825ab45df0 (&xfs_nondir_ilock_class){++++}-{3:3}, at: xfs_ilock+0x8a/0x250 but task is already holding lock: ffffffff848cc1e0 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire+0x112/0x160 kmem_cache_alloc+0x48/0x400 create_object.isra.0+0x42/0xb10 kmemleak_alloc+0x48/0x80 __kmalloc+0x228/0x440 kmem_alloc+0xd3/0x2b0 kmem_alloc_large+0x5a/0x1c0 xfs_attr_copy_value+0x112/0x190 xfs_attr_shortform_getvalue+0x1fc/0x300 xfs_attr_get_ilocked+0x125/0x170 xfs_attr_get+0x329/0x450 xfs_get_acl+0x18d/0x430 get_acl.part.0+0xb6/0x1e0 posix_acl_xattr_get+0x13a/0x230 vfs_getxattr+0x21d/0x270 getxattr+0x126/0x310 __x64_sys_fgetxattr+0x1a6/0x2a0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #0 (&xfs_nondir_ilock_class){++++}-{3:3}: __lock_acquire+0x2c0f/0x5a00 lock_acquire+0x1a1/0x4b0 down_read_nested+0x50/0x90 xfs_ilock+0x8a/0x250 xfs_can_free_eofblocks+0x34f/0x570 xfs_inactive+0x411/0x520 xfs_fs_destroy_inode+0x2c8/0x710 destroy_inode+0xc5/0x1a0 evict+0x444/0x620 dispose_list+0xfe/0x1c0 prune_icache_sb+0xdc/0x160 super_cache_scan+0x31e/0x510 do_shrink_slab+0x337/0x8e0 shrink_slab+0x362/0x5c0 shrink_node+0x7a7/0x1a40 balance_pgdat+0x64e/0xfe0 kswapd+0x590/0xa80 kthread+0x38c/0x460 ret_from_fork+0x22/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&xfs_nondir_ilock_class); lock(fs_reclaim); lock(&xfs_nondir_ilock_class); *** DEADLOCK *** 3 locks held by kswapd0/288: #0: ffffffff848cc1e0 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30 #1: ffffffff848a08d8 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x269/0x5c0 #2: ffff8881a7a820e8 (&type->s_umount_key#60){++++}-{3:3}, at: super_cache_scan+0x5a/0x510 Link: https://lkml.kernel.org/r/20210907055659.3182992-1-naohiro.aota@wdc.com Signed-off-by: Naohiro Aota Acked-by: Catalin Marinas Cc: "Darrick J . Wong" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10994316089c9682f2fbe0be0b1e82bcaf5f4e8c Author: Liam Howlett Date: Wed Sep 8 18:10:14 2021 -0700 mmap_lock: change trace and locking order Print to the trace log before releasing the lock to avoid racing with other trace log printers of the same lock type. Link: https://lkml.kernel.org/r/20210903022041.1843024-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Suggested-by: Steven Rostedt (VMware) Reviewed-by: Matthew Wilcox (Oracle) Cc: Michel Lespinasse Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 053cfda102306a3394012f9fe2594811c34925e4 Author: Miaohe Lin Date: Wed Sep 8 18:10:11 2021 -0700 mm/page_alloc.c: avoid accessing uninitialized pcp page migratetype If it's not prepared to free unref page, the pcp page migratetype is unset. Thus we will get rubbish from get_pcppage_migratetype() and might list_del(&page->lru) again after it's already deleted from the list leading to grumble about data corruption. Link: https://lkml.kernel.org/r/20210902115447.57050-1-linmiaohe@huawei.com Fixes: df1acc856923 ("mm/page_alloc: avoid conflating IRQs disabled with zone->lock") Signed-off-by: Miaohe Lin Acked-by: Mel Gorman Acked-by: Vlastimil Babka Reviewed-by: David Hildenbrand Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 32d4f4b782bb8f0ceb78c6b5dc46eb577ae25bf7 Author: Rik van Riel Date: Wed Sep 8 18:10:08 2021 -0700 mm,vmscan: fix divide by zero in get_scan_count Commit f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim") introduced a divide by zero corner case when oomd is being used in combination with cgroup memory.low protection. When oomd decides to kill a cgroup, it will force the cgroup memory to be reclaimed after killing the tasks, by writing to the memory.max file for that cgroup, forcing the remaining page cache and reclaimable slab to be reclaimed down to zero. Previously, on cgroups with some memory.low protection that would result in the memory being reclaimed down to the memory.low limit, or likely not at all, having the page cache reclaimed asynchronously later. With f56ce412a59d the oomd write to memory.max tries to reclaim all the way down to zero, which may race with another reclaimer, to the point of ending up with the divide by zero below. This patch implements the obvious fix. Link: https://lkml.kernel.org/r/20210826220149.058089c6@imladris.surriel.com Fixes: f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim") Signed-off-by: Rik van Riel Acked-by: Roman Gushchin Acked-by: Michal Hocko Acked-by: Johannes Weiner Acked-by: Chris Down Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 13db8c50477d83ad3e3b9b0ae247e5cd833a7ae4 Author: Liu Zixian Date: Wed Sep 8 18:10:05 2021 -0700 mm/hugetlb: initialize hugetlb_usage in mm_init After fork, the child process will get incorrect (2x) hugetlb_usage. If a process uses 5 2MB hugetlb pages in an anonymous mapping, HugetlbPages: 10240 kB and then forks, the child will show, HugetlbPages: 20480 kB The reason for double the amount is because hugetlb_usage will be copied from the parent and then increased when we copy page tables from parent to child. Child will have 2x actual usage. Fix this by adding hugetlb_count_init in mm_init. Link: https://lkml.kernel.org/r/20210826071742.877-1-liuzixian4@huawei.com Fixes: 5d317b2b6536 ("mm: hugetlb: proc: add HugetlbPages field to /proc/PID/status") Signed-off-by: Liu Zixian Reviewed-by: Naoya Horiguchi Reviewed-by: Mike Kravetz Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b42fb213678d2b6a9eeea92a9be200f23e49583 Author: Li Zhijian Date: Wed Sep 8 18:10:02 2021 -0700 mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled Previously, we noticed the one rpma example was failed[1] since commit 36f30e486dce ("IB/core: Improve ODP to use hmm_range_fault()"), where it will use ODP feature to do RDMA WRITE between fsdax files. After digging into the code, we found hmm_vma_handle_pte() will still return EFAULT even though all the its requesting flags has been fulfilled. That's because a DAX page will be marked as (_PAGE_SPECIAL | PAGE_DEVMAP) by pte_mkdevmap(). Link: https://github.com/pmem/rpma/issues/1142 [1] Link: https://lkml.kernel.org/r/20210830094232.203029-1-lizhijian@cn.fujitsu.com Fixes: 405506274922 ("mm/hmm: add missing call to hmm_pte_need_fault in HMM_PFN_SPECIAL handling") Signed-off-by: Li Zhijian Reviewed-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 009ad9f0c6eed0caa7943bc46aa1ae2cb8c382fb Author: Jens Axboe Date: Wed Sep 8 19:07:26 2021 -0600 io_uring: drop ctx->uring_lock before acquiring sqd->lock The SQPOLL thread dictates the lock order, and we hold the ctx->uring_lock for all the registration opcodes. We also hold a ref to the ctx, and we do drop the lock for other reasons to quiesce, so it's fine to drop the ctx lock temporarily to grab the sqd->lock. This fixes the following lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 5.14.0-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.5/25433 is trying to acquire lock: ffff888023426870 (&sqd->lock){+.+.}-{3:3}, at: io_register_iowq_max_workers fs/io_uring.c:10551 [inline] ffff888023426870 (&sqd->lock){+.+.}-{3:3}, at: __io_uring_register fs/io_uring.c:10757 [inline] ffff888023426870 (&sqd->lock){+.+.}-{3:3}, at: __do_sys_io_uring_register+0x10aa/0x2e70 fs/io_uring.c:10792 but task is already holding lock: ffff8880885b40a8 (&ctx->uring_lock){+.+.}-{3:3}, at: __do_sys_io_uring_register+0x2e1/0x2e70 fs/io_uring.c:10791 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&ctx->uring_lock){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:596 [inline] __mutex_lock+0x131/0x12f0 kernel/locking/mutex.c:729 __io_sq_thread fs/io_uring.c:7291 [inline] io_sq_thread+0x65a/0x1370 fs/io_uring.c:7368 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 -> #0 (&sqd->lock){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3051 [inline] check_prevs_add kernel/locking/lockdep.c:3174 [inline] validate_chain kernel/locking/lockdep.c:3789 [inline] __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __mutex_lock_common kernel/locking/mutex.c:596 [inline] __mutex_lock+0x131/0x12f0 kernel/locking/mutex.c:729 io_register_iowq_max_workers fs/io_uring.c:10551 [inline] __io_uring_register fs/io_uring.c:10757 [inline] __do_sys_io_uring_register+0x10aa/0x2e70 fs/io_uring.c:10792 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ctx->uring_lock); lock(&sqd->lock); lock(&ctx->uring_lock); lock(&sqd->lock); *** DEADLOCK *** Fixes: 2e480058ddc2 ("io-wq: provide a way to limit max number of workers") Reported-by: syzbot+97fa56483f69d677969f@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 730bf31b8fc8e94f3d2d58aaee5f07e5f1f8146f Merge: 30f349097897c 4665584888ad2 Author: Linus Torvalds Date: Wed Sep 8 16:43:46 2021 -0700 Merge tag 'tag-chrome-platform-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Benson Leung: "cros_ec_typec: - make the cros_ec_typec driver to use the pre-existing cros_ec_check_features() function sensorhub: - add trace events for sample misc: - cros_ec_proto - re-send commands in the event of a timeout (for the FPMCU) - fix warnings in cros_ec_trace related to format output" * tag 'tag-chrome-platform-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_trace: Fix format warnings platform/chrome: cros_ec_typec: Use existing feature check platform/chrome: cros_ec_proto: Send command again when timeout occurs platform/chrome: sensorhub: Add trace events for sample commit 30f349097897c115345beabeecc5e710b479ff1e Merge: 9c566611ac5cc f76c87e8c3376 Author: Linus Torvalds Date: Wed Sep 8 16:38:25 2021 -0700 Merge tag 'pm-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are mostly ARM cpufreq driver updates, including one new MediaTek driver that has just passed all of the reviews, with the addition of a revert of a recent intel_pstate commit, some core cpufreq changes and a DT-related update of the operating performance points (OPP) support code. Specifics: - Add new cpufreq driver for the MediaTek MT6779 platform called mediatek-hw along with corresponding DT bindings (Hector.Yuan). - Add DCVS interrupt support to the qcom-cpufreq-hw driver (Thara Gopinath). - Make the qcom-cpufreq-hw driver set the dvfs_possible_from_any_cpu policy flag (Taniya Das). - Blocklist more Qualcomm platforms in cpufreq-dt-platdev (Bjorn Andersson). - Make the vexpress cpufreq driver set the CPUFREQ_IS_COOLING_DEV flag (Viresh Kumar). - Add new cpufreq driver callback to allow drivers to register with the Energy Model in a consistent way and make several drivers use it (Viresh Kumar). - Change the remaining users of the .ready() cpufreq driver callback to move the code from it elsewhere and drop it from the cpufreq core (Viresh Kumar). - Revert recent intel_pstate change adding HWP guaranteed performance change notification support to it that led to problems, because the notification in question is triggered prematurely on some systems (Rafael Wysocki). - Convert the OPP DT bindings to DT schema and clean them up while at it (Rob Herring)" * tag 'pm-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (23 commits) Revert "cpufreq: intel_pstate: Process HWP Guaranteed change notification" cpufreq: mediatek-hw: Add support for CPUFREQ HW cpufreq: Add of_perf_domain_get_sharing_cpumask dt-bindings: cpufreq: add bindings for MediaTek cpufreq HW cpufreq: Remove ready() callback cpufreq: sh: Remove sh_cpufreq_cpu_ready() cpufreq: acpi: Remove acpi_cpufreq_cpu_ready() cpufreq: qcom-hw: Set dvfs_possible_from_any_cpu cpufreq driver flag cpufreq: blocklist more Qualcomm platforms in cpufreq-dt-platdev cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support cpufreq: scmi: Use .register_em() to register with energy model cpufreq: vexpress: Use .register_em() to register with energy model cpufreq: scpi: Use .register_em() to register with energy model dt-bindings: opp: Convert to DT schema dt-bindings: Clean-up OPP binding node names in examples ARM: dts: omap: Drop references to opp.txt cpufreq: qcom-cpufreq-hw: Use .register_em() to register with energy model cpufreq: omap: Use .register_em() to register with energy model cpufreq: mediatek: Use .register_em() to register with energy model cpufreq: imx6q: Use .register_em() to register with energy model ... commit 9c566611ac5cc7b45af943632f7a9b1b6a642991 Merge: 0f4b9289bad35 e543b10cd9d75 Author: Linus Torvalds Date: Wed Sep 8 16:33:21 2021 -0700 Merge tag 'acpi-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These add ACPI support to the PCI VMD driver, improve suspend-to-idle support for AMD platforms and update documentation. Specifics: - Add ACPI support to the PCI VMD driver (Rafael Wysocki) - Rearrange suspend-to-idle support code to reflect the platform firmware expectations on some AMD platforms (Mario Limonciello) - Make SSDT overlays documentation follow the code documented by it more closely (Andy Shevchenko)" * tag 'acpi-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Run both AMD and Microsoft methods if both are supported Documentation: ACPI: Align the SSDT overlays file with the code PCI: VMD: ACPI: Make ACPI companion lookup work for VMD bus commit 0f4b9289bad354b606190a4cd54d5222b4e41d98 Merge: 6dcaf9fb623fb 7c5c18bdb6560 Author: Linus Torvalds Date: Wed Sep 8 16:28:14 2021 -0700 Merge tag 'docs-5.15-2' of git://git.lwn.net/linux Pull more documentation updates from Jonathan Corbet: "Another collection of documentation patches, mostly fixes but also includes another set of traditional Chinese translations" * tag 'docs-5.15-2' of git://git.lwn.net/linux: docs: pdfdocs: Fix typo in CJK-language specific font settings docs: kernel-hacking: Remove inappropriate text docs/zh_TW: add translations for zh_TW/filesystems docs/zh_TW: add translations for zh_TW/cpu-freq docs/zh_TW: add translations for zh_TW/arm64 docs/zh_CN: Modify the translator tag and fix the wrong word Documentation/features/vm: correct huge-vmap APIs Documentation: block: blk-mq: Fix small typo in multi-queue docs Documentation: in_irq() cleanup Documentation: arm: marvell: Add 88F6825 model into list Documentation/process/maintainer-pgp-guide: Replace broken link to PGP path finder Documentation: locking: fix references Documentation: Update details of The Linux Kernel Module Programming Guide docs: x86: Remove obsolete information about x86_64 vmalloc() faulting Documentation/process/applying-patches: Activate linux-next man hyperlink commit b83a908498d68fafca931e1276e145b339cac5fb Author: Nick Desaulniers Date: Mon Aug 2 13:23:20 2021 -0700 compiler_attributes.h: move __compiletime_{error|warning} Clang 14 will add support for __attribute__((__error__(""))) and __attribute__((__warning__(""))). To make use of these in __compiletime_error and __compiletime_warning (as used by BUILD_BUG and friends) for newer clang and detect/fallback for older versions of clang, move these to compiler_attributes.h and guard them with __has_attribute preprocessor guards. Link: https://reviews.llvm.org/D106030 Link: https://bugs.llvm.org/show_bug.cgi?id=16428 Link: https://github.com/ClangBuiltLinux/linux/issues/1173 Signed-off-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Reviewed-by: Kees Cook [Reworded, landed in Clang 14] Signed-off-by: Miguel Ojeda commit 6dcaf9fb623fb87b08e3896cdf6116744bf00668 Merge: 1511e5d64a512 ced75a2f5da71 Author: Linus Torvalds Date: Wed Sep 8 16:06:48 2021 -0700 Merge tag 'modules-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull module updates from Jessica Yu: "The only main change I have for this round of updates is the modules MAINTAINERS update. As I find myself with less time to devote to upstream these days, Luis has kindly agreed to help maintain the module loader, to eventually transition to being the primary maintainer. Since Luis is already very involved upstream with experience maintaining various areas of the kernel including the kmod usermode helper, I think he is a great fit for this area of the kernel. Summary: - Add Luis Chamberlain as modules maintainer - Fix for .ctors sections in module linker script" * tag 'modules-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: MAINTAINERS: Add Luis Chamberlain as modules maintainer module: combine constructors in module linker script commit 1511e5d64a51292a84d38e4146304393ebe4d080 Merge: 14e2bc4e8c40a 315511166469a Author: Linus Torvalds Date: Wed Sep 8 16:02:13 2021 -0700 Merge tag 'microblaze-v5.15' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze update from Michal Simek: - Kbuild clean up * tag 'microblaze-v5.15' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: move core-y in arch/microblaze/Makefile to arch/microblaze/Kbuild commit 3fc3725357414636d91be1558ce8b14f228b4bda Merge: 32b2397c1e56f bdd3c50d83bf7 Author: Dan Williams Date: Wed Sep 8 15:58:13 2021 -0700 Merge branch 'for-5.15/fsdax-cleanups' into for-5.15/libnvdimm Include Christoph's rework of the dax_supported() helpers in the v5.15 libnvdimm update. This supports the ongoing dax-reflink enabling effort. commit 14e2bc4e8c40a876c1ab5597320d523c12a97f39 Merge: 8a05abd0c9384 0c217d5066c84 Author: Linus Torvalds Date: Wed Sep 8 15:55:42 2021 -0700 Merge tag 'nfsd-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Restore performance on memory-starved servers * tag 'nfsd-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: improve error response to over-size gss credential SUNRPC: don't pause on incomplete allocation commit 8a05abd0c93841a7bbcf777ec1677a1ad9155793 Merge: 34c59da47329a 05a444d3f90a3 Author: Linus Torvalds Date: Wed Sep 8 15:50:32 2021 -0700 Merge tag 'ceph-for-5.15-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: - a set of patches to address fsync stalls caused by depending on periodic rather than triggered MDS journal flushes in some cases (Xiubo Li) - a fix for mtime effectively not getting updated in case of competing writers (Jeff Layton) - a couple of fixes for inode reference leaks and various WARNs after "umount -f" (Xiubo Li) - a new ceph.auth_mds extended attribute (Jeff Layton) - a smattering of fixups and cleanups from Jeff, Xiubo and Colin. * tag 'ceph-for-5.15-rc1' of git://github.com/ceph/ceph-client: ceph: fix dereference of null pointer cf ceph: drop the mdsc_get_session/put_session dout messages ceph: lockdep annotations for try_nonblocking_invalidate ceph: don't WARN if we're forcibly removing the session caps ceph: don't WARN if we're force umounting ceph: remove the capsnaps when removing caps ceph: request Fw caps before updating the mtime in ceph_write_iter ceph: reconnect to the export targets on new mdsmaps ceph: print more information when we can't find snaprealm ceph: add ceph_change_snap_realm() helper ceph: remove redundant initializations from mdsc and session ceph: cancel delayed work instead of flushing on mdsc teardown ceph: add a new vxattr to return auth mds for an inode ceph: remove some defunct forward declarations ceph: flush the mdlog before waiting on unsafe reqs ceph: flush mdlog before umounting ceph: make iterate_sessions a global symbol ceph: make ceph_create_session_msg a global symbol ceph: fix comment about short copies in ceph_write_end ceph: fix memory leak on decode error in ceph_handle_caps commit 34c59da47329ac50b9700035e0c3a829e6c3c183 Merge: 2d338201d5311 9c4d94dc9a644 Author: Linus Torvalds Date: Wed Sep 8 15:40:39 2021 -0700 Merge tag '9p-for-5.15-rc1' of git://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "A couple of harmless fixes, increase max tcp msize (64KB -> 1MB), and increase default msize (8KB -> 128KB) The default increase has been discussed with Christian for the qemu side of things but makes sense for all supported transports" * tag '9p-for-5.15-rc1' of git://github.com/martinetd/linux: net/9p: increase default msize to 128k net/9p: use macro to define default msize net/9p: increase tcp max msize to 1MB 9p/xen: Fix end of loop tests for list_for_each_entry 9p/trans_virtio: Remove sysfs file on probe failure commit a7a08b275a8bbade798c4bdaad07ade68fe7003c Author: Arnd Bergmann Date: Wed Sep 8 15:18:29 2021 -0700 arch: remove compat_alloc_user_space All users of compat_alloc_user_space() and copy_in_user() have been removed from the kernel, only a few functions in sparc remain that can be changed to calling arch_copy_in_user() instead. Link: https://lkml.kernel.org/r/20210727144859.4150043-7-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Cc: Al Viro Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Eric Biederman Cc: Feng Tang Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Michael Ellerman Cc: Paul Mackerras Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 59ab844eed9c6b01d32dcb27b57accc23771b324 Author: Arnd Bergmann Date: Wed Sep 8 15:18:25 2021 -0700 compat: remove some compat entry points These are all handled correctly when calling the native system call entry point, so remove the special cases. Link: https://lkml.kernel.org/r/20210727144859.4150043-6-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Cc: Al Viro Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Eric Biederman Cc: Feng Tang Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Michael Ellerman Cc: Paul Mackerras Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e130242dc351f1cfa2bbeb6766a1486ce936ef88 Author: Arnd Bergmann Date: Wed Sep 8 15:18:21 2021 -0700 mm: simplify compat numa syscalls The compat implementations for mbind, get_mempolicy, set_mempolicy and migrate_pages are just there to handle the subtly different layout of bitmaps on 32-bit hosts. The compat implementation however lacks some of the checks that are present in the native one, in particular for checking that the extra bits are all zero when user space has a larger mask size than the kernel. Worse, those extra bits do not get cleared when copying in or out of the kernel, which can lead to incorrect data as well. Unify the implementation to handle the compat bitmap layout directly in the get_nodes() and copy_nodes_to_user() helpers. Splitting out the get_bitmap() helper from get_nodes() also helps readability of the native case. On x86, two additional problems are addressed by this: compat tasks can pass a bitmap at the end of a mapping, causing a fault when reading across the page boundary for a 64-bit word. x32 tasks might also run into problems with get_mempolicy corrupting data when an odd number of 32-bit words gets passed. On parisc the migrate_pages() system call apparently had the wrong calling convention, as big-endian architectures expect the words inside of a bitmap to be swapped. This is not a problem though since parisc has no NUMA support. [arnd@arndb.de: fix mempolicy crash] Link: https://lkml.kernel.org/r/20210730143417.3700653-1-arnd@kernel.org Link: https://lore.kernel.org/lkml/YQPLG20V3dmOfq3a@osiris/ Link: https://lkml.kernel.org/r/20210727144859.4150043-5-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Cc: Al Viro Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Eric Biederman Cc: Feng Tang Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Michael Ellerman Cc: Paul Mackerras Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b1b561ba73c8ab9c98e5dfd14dc7ee47efb6530 Author: Arnd Bergmann Date: Wed Sep 8 15:18:17 2021 -0700 mm: simplify compat_sys_move_pages The compat move_pages() implementation uses compat_alloc_user_space() for converting the pointer array. Moving the compat handling into the function itself is a bit simpler and lets us avoid the compat_alloc_user_space() call. Link: https://lkml.kernel.org/r/20210727144859.4150043-4-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Cc: Al Viro Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Eric Biederman Cc: Feng Tang Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Michael Ellerman Cc: Paul Mackerras Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5d700a0fd71ded7096b97f01d276efc1a6579613 Author: Arnd Bergmann Date: Wed Sep 8 15:18:13 2021 -0700 kexec: avoid compat_alloc_user_space kimage_alloc_init() expects a __user pointer, so compat_sys_kexec_load() uses compat_alloc_user_space() to convert the layout and put it back onto the user space caller stack. Moving the user space access into the syscall handler directly actually makes the code simpler, as the conversion for compat mode can now be done on kernel memory. Link: https://lkml.kernel.org/r/20210727144859.4150043-3-arnd@kernel.org Link: https://lore.kernel.org/lkml/YPbtsU4GX6PL7%2F42@infradead.org/ Link: https://lore.kernel.org/lkml/m1y2cbzmnw.fsf@fess.ebiederm.org/ Signed-off-by: Arnd Bergmann Co-developed-by: Eric Biederman Co-developed-by: Christoph Hellwig Acked-by: "Eric W. Biederman" Cc: Al Viro Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christoph Hellwig Cc: "David S. Miller" Cc: Feng Tang Cc: Heiko Carstens Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Michael Ellerman Cc: Paul Mackerras Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b692e861619353ce069e547a67c8d0e32d9ef3d Author: Arnd Bergmann Date: Wed Sep 8 15:18:10 2021 -0700 kexec: move locking into do_kexec_load Patch series "compat: remove compat_alloc_user_space", v5. Going through compat_alloc_user_space() to convert indirect system call arguments tends to add complexity compared to handling the native and compat logic in the same code. This patch (of 6): The locking is the same between the native and compat version of sys_kexec_load(), so it can be done in the common implementation to reduce duplication. Link: https://lkml.kernel.org/r/20210727144859.4150043-1-arnd@kernel.org Link: https://lkml.kernel.org/r/20210727144859.4150043-2-arnd@kernel.org Signed-off-by: Arnd Bergmann Co-developed-by: Eric Biederman Co-developed-by: Christoph Hellwig Acked-by: "Eric W. Biederman" Cc: Catalin Marinas Cc: Will Deacon Cc: Thomas Bogendoerfer Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Al Viro Cc: Feng Tang Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 213ecb3157514486a9ae6848a298b91a79cc2e2a Author: Baolin Wang Date: Wed Sep 8 15:18:06 2021 -0700 mm: migrate: change to use bool type for 'page_was_mapped' Change to use bool type for 'page_was_mapped' variable making it more readable. Link: https://lkml.kernel.org/r/ce1279df18d2c163998c403e0b5ec6d3f6f90f7a.1629447552.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Yang Shi Cc: Alistair Popple Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68a9843f14b6b0d1ce023721814403253d8e9153 Author: Baolin Wang Date: Wed Sep 8 15:18:03 2021 -0700 mm: migrate: fix the incorrect function name in comments since commit a98a2f0c8ce1 ("mm/rmap: split migration into its own function"), the migration ptes establishment has been split into a separate try_to_migrate() function, thus update the related comments. Link: https://lkml.kernel.org/r/5b824bad6183259c916ae6cf42f81d14c6118b06.1629447552.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Yang Shi Reviewed-by: Alistair Popple Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2b9b624f5aef6af608edf541fed973948e27004c Author: Baolin Wang Date: Wed Sep 8 15:18:01 2021 -0700 mm: migrate: introduce a local variable to get the number of pages Use thp_nr_pages() instead of compound_nr() to get the number of pages for THP page, meanwhile introducing a local variable 'nr_pages' to avoid getting the number of pages repeatedly. Link: https://lkml.kernel.org/r/a8e331ac04392ee230c79186330fb05e86a2aa77.1629447552.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Yang Shi Cc: Alistair Popple Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c68ed7945701a38f2121ed74e23ff19c2052b4c2 Author: Ingo Molnar Date: Wed Sep 8 15:17:57 2021 -0700 mm/vmstat: protect per cpu variables with preempt disable on RT Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption. This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts. Link: https://lkml.kernel.org/r/20210805160019.1137-2-mgorman@techsingularity.net Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4cf0ccd033d9cedef870eb8598a55851e680a173 Author: Namjae Jeon Date: Tue Sep 7 08:16:26 2021 +0900 ksmbd: fix control flow issues in sid_to_id() Addresses-Coverity reported Control flow issues in sid_to_id() /fs/ksmbd/smbacl.c: 277 in sid_to_id() 271 272 if (sidtype == SIDOWNER) { 273 kuid_t uid; 274 uid_t id; 275 276 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]); >>> CID 1506810: Control flow issues (NO_EFFECT) >>> This greater-than-or-equal-to-zero comparison of an unsigned value >>> is always true. "id >= 0U". 277 if (id >= 0) { 278 /* 279 * Translate raw sid into kuid in the server's user 280 * namespace. 281 */ 282 uid = make_kuid(&init_user_ns, id); Addresses-Coverity: ("Control flow issues") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 4ffd5264e8ecb20e1826b9474c19738fdecd67e6 Author: Namjae Jeon Date: Tue Sep 7 08:15:21 2021 +0900 ksmbd: fix read of uninitialized variable ret in set_file_basic_info Addresses-Coverity reported Uninitialized variables warninig : /fs/ksmbd/smb2pdu.c: 5525 in set_file_basic_info() 5519 if (!rc) { 5520 inode->i_ctime = ctime; 5521 mark_inode_dirty(inode); 5522 } 5523 inode_unlock(inode); 5524 } >>> CID 1506805: Uninitialized variables (UNINIT) >>> Using uninitialized value "rc". 5525 return rc; 5526 } 5527 5528 static int set_file_allocation_info(struct ksmbd_work *work, 5529 struct ksmbd_file *fp, char *buf) 5530 { Addresses-Coverity: ("Uninitialized variable") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 36bbeb336584c3551bac72592bcaeeebb430fef1 Author: Colin Ian King Date: Mon Sep 6 14:44:38 2021 +0100 ksmbd: add missing assignments to ret on ndr_read_int64 read calls Currently there are two ndr_read_int64 calls where ret is being checked for failure but ret is not being assigned a return value from the call. Static analyis is reporting the checks on ret as dead code. Fix this. Addresses-Coverity: ("Logical dead code") Reviewed-by: Sergey Senozhatsky Signed-off-by: Colin Ian King Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit c57a91fb1ccfa203ba3e31e5a389cb04de5b0561 Author: Pavel Begunkov Date: Wed Sep 8 20:49:17 2021 +0100 io_uring: fix missing mb() before waitqueue_active In case of !SQPOLL, io_cqring_ev_posted_iopoll() doesn't provide a memory barrier required by waitqueue_active(&ctx->poll_wait). There is a wq_has_sleeper(), which does smb_mb() inside, but it's called only for SQPOLL. Fixes: 5fd4617840596 ("io_uring: be smarter about waking multiple CQ ring waiters") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2982e53bcea2274006ed435ee2a77197107d8a29.1631130542.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2d338201d5311bcd79d42f66df4cecbcbc5f4f2c Merge: cc09ee80c3b18 b285437d1d929 Author: Linus Torvalds Date: Wed Sep 8 12:55:35 2021 -0700 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: "147 patches, based on 7d2a07b769330c34b4deabeed939325c77a7ec2f. Subsystems affected by this patch series: mm (memory-hotplug, rmap, ioremap, highmem, cleanups, secretmem, kfence, damon, and vmscan), alpha, percpu, procfs, misc, core-kernel, MAINTAINERS, lib, checkpatch, epoll, init, nilfs2, coredump, fork, pids, criu, kconfig, selftests, ipc, and scripts" * emailed patches from Andrew Morton : (94 commits) scripts: check_extable: fix typo in user error message mm/workingset: correct kernel-doc notations ipc: replace costly bailout check in sysvipc_find_ipc() selftests/memfd: remove unused variable Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH configs: remove the obsolete CONFIG_INPUT_POLLDEV prctl: allow to setup brk for et_dyn executables pid: cleanup the stale comment mentioning pidmap_init(). kernel/fork.c: unexport get_{mm,task}_exe_file coredump: fix memleak in dump_vma_snapshot() fs/coredump.c: log if a core dump is aborted due to changed file permissions nilfs2: use refcount_dec_and_lock() to fix potential UAF nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group nilfs2: fix NULL pointer in nilfs_##name##_attr_release nilfs2: fix memory leak in nilfs_sysfs_create_device_group trap: cleanup trap_init() init: move usermodehelper_enable() to populate_rootfs() ... commit cfd799837dbc48499abb05d1891b3d9992354d3a Author: Masami Hiramatsu Date: Thu Sep 9 04:38:03 2021 +0900 tracing/boot: Fix to loop on only subkeys Since the commit e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key") allows to co-exist a value node and key nodes under a node, xbc_node_for_each_child() is not only returning key node but also a value node. In the boot-time tracing using xbc_node_for_each_child() to iterate the events, groups and instances, but those must be key nodes. Thus it must use xbc_node_for_each_subkey(). Link: https://lkml.kernel.org/r/163112988361.74896.2267026262061819145.stgit@devnote2 Fixes: e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit cc09ee80c3b18ae1a897a30a17fe710b2b2f620a Merge: 49832c819ab85 bd0e7491a931f Author: Linus Torvalds Date: Wed Sep 8 12:36:00 2021 -0700 Merge tag 'mm-slub-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/linux Pull SLUB updates from Vlastimil Babka: "SLUB: reduce irq disabled scope and make it RT compatible This series was initially inspired by Mel's pcplist local_lock rewrite, and also interest to better understand SLUB's locking and the new primitives and RT variants and implications. It makes SLUB compatible with PREEMPT_RT and generally more preemption-friendly, apparently without significant regressions, as the fast paths are not affected. The main changes to SLUB by this series: - irq disabling is now only done for minimum amount of time needed to protect the strict kmem_cache_cpu fields, and as part of spin lock, local lock and bit lock operations to make them irq-safe - SLUB is fully PREEMPT_RT compatible The series should now be sufficiently tested in both RT and !RT configs, mainly thanks to Mike. The RFC/v1 version also got basic performance screening by Mel that didn't show major regressions. Mike's testing with hackbench of v2 on !RT reported negligible differences [6]: virgin(ish) tip 5.13.0.g60ab3ed-tip 7,320.67 msec task-clock # 7.792 CPUs utilized ( +- 0.31% ) 221,215 context-switches # 0.030 M/sec ( +- 3.97% ) 16,234 cpu-migrations # 0.002 M/sec ( +- 4.07% ) 13,233 page-faults # 0.002 M/sec ( +- 0.91% ) 27,592,205,252 cycles # 3.769 GHz ( +- 0.32% ) 8,309,495,040 instructions # 0.30 insn per cycle ( +- 0.37% ) 1,555,210,607 branches # 212.441 M/sec ( +- 0.42% ) 5,484,209 branch-misses # 0.35% of all branches ( +- 2.13% ) 0.93949 +- 0.00423 seconds time elapsed ( +- 0.45% ) 0.94608 +- 0.00384 seconds time elapsed ( +- 0.41% ) (repeat) 0.94422 +- 0.00410 seconds time elapsed ( +- 0.43% ) 5.13.0.g60ab3ed-tip +slub-local-lock-v2r3 7,343.57 msec task-clock # 7.776 CPUs utilized ( +- 0.44% ) 223,044 context-switches # 0.030 M/sec ( +- 3.02% ) 16,057 cpu-migrations # 0.002 M/sec ( +- 4.03% ) 13,164 page-faults # 0.002 M/sec ( +- 0.97% ) 27,684,906,017 cycles # 3.770 GHz ( +- 0.45% ) 8,323,273,871 instructions # 0.30 insn per cycle ( +- 0.28% ) 1,556,106,680 branches # 211.901 M/sec ( +- 0.31% ) 5,463,468 branch-misses # 0.35% of all branches ( +- 1.33% ) 0.94440 +- 0.00352 seconds time elapsed ( +- 0.37% ) 0.94830 +- 0.00228 seconds time elapsed ( +- 0.24% ) (repeat) 0.93813 +- 0.00440 seconds time elapsed ( +- 0.47% ) (repeat) RT configs showed some throughput regressions, but that's expected tradeoff for the preemption improvements through the RT mutex. It didn't prevent the v2 to be incorporated to the 5.13 RT tree [7], leading to testing exposure and bugfixes. Before the series, SLUB is lockless in both allocation and free fast paths, but elsewhere, it's disabling irqs for considerable periods of time - especially in allocation slowpath and the bulk allocation, where IRQs are re-enabled only when a new page from the page allocator is needed, and the context allows blocking. The irq disabled sections can then include deactivate_slab() which walks a full freelist and frees the slab back to page allocator or unfreeze_partials() going through a list of percpu partial slabs. The RT tree currently has some patches mitigating these, but we can do much better in mainline too. Patches 1-6 are straightforward improvements or cleanups that could exist outside of this series too, but are prerequsities. Patches 7-9 are also preparatory code changes without functional changes, but not so useful without the rest of the series. Patch 10 simplifies the fast paths on systems with preemption, based on (hopefully correct) observation that the current loops to verify tid are unnecessary. Patches 11-20 focus on reducing irq disabled scope in the allocation slowpath: - patch 11 moves disabling of irqs into ___slab_alloc() from its callers, which are the allocation slowpath, and bulk allocation. Instead these callers only disable preemption to stabilize the cpu. - The following patches then gradually reduce the scope of disabled irqs in ___slab_alloc() and the functions called from there. As of patch 14, the re-enabling of irqs based on gfp flags before calling the page allocator is removed from allocate_slab(). As of patch 17, it's possible to reach the page allocator (in case of existing slabs depleted) without disabling and re-enabling irqs a single time. Pathces 21-26 reduce the scope of disabled irqs in functions related to unfreezing percpu partial slab. Patch 27 is preparatory. Patch 28 is adopted from the RT tree and converts the flushing of percpu slabs on all cpus from using IPI to workqueue, so that the processing isn't happening with irqs disabled in the IPI handler. The flushing is not performance critical so it should be acceptable. Patch 29 also comes from RT tree and makes object_map_lock RT compatible. Patch 30 make slab_lock irq-safe on RT where we cannot rely on having irq disabled from the list_lock spin lock usage. Patch 31 changes kmem_cache_cpu->partial handling in put_cpu_partial() from cmpxchg loop to a short irq disabled section, which is used by all other code modifying the field. This addresses a theoretical race scenario pointed out by Jann, and makes the critical section safe wrt with RT local_lock semantics after the conversion in patch 35. Patch 32 changes preempt disable to migrate disable, so that the nested list_lock spinlock is safe to take on RT. Because migrate_disable() is a function call even on !RT, a small set of private wrappers is introduced to keep using the cheaper preempt_disable() on !PREEMPT_RT configurations. As of this patch, SLUB should be already compatible with RT's lock semantics. Finally, patch 33 changes irq disabled sections that protect kmem_cache_cpu fields in the slow paths, with a local lock. However on PREEMPT_RT it means the lockless fast paths can now preempt slow paths which don't expect that, so the local lock has to be taken also in the fast paths and they are no longer lockless. RT folks seem to not mind this tradeoff. The patch also updates the locking documentation in the file's comment" Mike Galbraith and Mel Gorman verified that their earlier testing observations still hold for the final series: Link: https://lore.kernel.org/lkml/89ba4f783114520c167cc915ba949ad2c04d6790.camel@gmx.de/ Link: https://lore.kernel.org/lkml/20210907082010.GB3959@techsingularity.net/ * tag 'mm-slub-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/linux: (33 commits) mm, slub: convert kmem_cpu_slab protection to local_lock mm, slub: use migrate_disable() on PREEMPT_RT mm, slub: protect put_cpu_partial() with disabled irqs instead of cmpxchg mm, slub: make slab_lock() disable irqs with PREEMPT_RT mm: slub: make object_map_lock a raw_spinlock_t mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context mm, slab: split out the cpu offline variant of flush_slab() mm, slub: don't disable irqs in slub_cpu_dead() mm, slub: only disable irq with spin_lock in __unfreeze_partials() mm, slub: separate detaching of partial list in unfreeze_partials() from unfreezing mm, slub: detach whole partial list at once in unfreeze_partials() mm, slub: discard slabs in unfreeze_partials() without irqs disabled mm, slub: move irq control into unfreeze_partials() mm, slub: call deactivate_slab() without disabling irqs mm, slub: make locking in deactivate_slab() irq-safe mm, slub: move reset of c->page and freelist out of deactivate_slab() mm, slub: stop disabling irqs around get_partial() mm, slub: check new pages with restored irqs mm, slub: validate slab from partial list or page allocator before making it cpu slab mm, slub: restore irqs around calling new_slab() ... commit 04178ea130a64a50826f17c7cc92774ada7ea9d0 Author: Steven Rostedt (VMware) Date: Tue Sep 7 23:04:29 2021 -0400 selftests/ftrace: Exclude "(fault)" in testing add/remove eprobe events The original test for adding and removing eprobes used synthetic events and retrieved the filename from the open system call at the end of the system call. This would allow it to always be loaded into the page tables when accessed. Masami suggested that the test was too complex for just testing add and remove, so it was changed to test just adding and removing an event probe on top of the start of the open system call event. Now it is possible that the filename will not be loaded into memory at the time the eprobe is triggered, and will result in "(fault)" being displayed in the event. This causes the test to fail. Account for "(fault)" also being one of the values of the filename field of the event probe. Link: https://lkml.kernel.org/r/20210907230429.5783d519@rorschach.local.home Fixes: 079db70794ec5 ("selftests/ftrace: Add test case to test adding and removing of event probe") Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit c910db943d35d4ac4b77570ece76e0799af24233 Author: Tom Zanussi Date: Thu Sep 2 15:57:12 2021 -0500 tracing: Dynamically allocate the per-elt hist_elt_data array Setting the hist_elt_data.field_var_str[] array unconditionally to a size of SYNTH_FIELD_MAX elements wastes space unnecessarily. The actual number of elements needed can be calculated at run-time instead. In most cases, this will save a lot of space since it's a per-elt array which isn't normally close to being full. It also allows us to increase SYNTH_FIELD_MAX without worrying about even more wastage when we do that. Link: https://lkml.kernel.org/r/d52ae0ad5e1b59af7c4f54faf3fc098461fd82b3.camel@kernel.org Signed-off-by: Tom Zanussi Tested-by: Artem Bityutskiy Signed-off-by: Steven Rostedt (VMware) commit 0be083cee42ec78ba6f9148f5b12a00aa2fb8bd3 Author: Artem Bityutskiy Date: Wed Sep 1 16:55:13 2021 +0300 tracing: synth events: increase max fields count Sometimes it is useful to construct larger synthetic trace events. Increase 'SYNTH_FIELDS_MAX' (maximum number of fields in a synthetic event) from 32 to 64. Link: https://lkml.kernel.org/r/20210901135513.3087062-1-dedekind1@gmail.com Signed-off-by: Artem Bityutskiy Acked-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit 47914d4e591cbbf7ce5103d86257a5d0d8532110 Author: Masami Hiramatsu Date: Sun Sep 5 00:54:46 2021 +0900 tools/bootconfig: Show whole test command for each test case Show whole test command instead of only the 3rd argument. This will clear to show what will be actually tested by each test case. Link: https://lkml.kernel.org/r/163077088607.222577.14786016266462495017.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 903bd067faa837fddb6e5c8b740c3374dc582f04 Author: Julio Faracco Date: Sun Sep 5 00:54:38 2021 +0900 bootconfig: Fix missing return check of xbc_node_compose_key function The function `xbc_show_list should` handle the keys during the composition. Even the errors returned by the compose function. Instead of removing the `ret` variable, it should save the value and show the exact error. This missing variable is causing a compilation issue also. Link: https://lkml.kernel.org/r/163077087861.222577.12884543474750968146.stgit@devnote2 Fixes: e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key") Signed-off-by: Julio Faracco Acked-by: Masami Hiramatsu Cc: stable@vger.kernel.org Signed-off-by: Steven Rostedt (VMware) commit 32ba9f0fb027cc43074e3ea26fcf831adeee8e03 Author: Masami Hiramatsu Date: Sun Sep 5 00:54:31 2021 +0900 tools/bootconfig: Fix tracing_on option checking in ftrace2bconf.sh Since tracing_on indicates only "1" (default) or "0", ftrace2bconf.sh only need to check the value is "0". Link: https://lkml.kernel.org/r/163077087144.222577.6888011847727968737.stgit@devnote2 Fixes: 55ed4560774d ("tools/bootconfig: Add tracing_on support to helper scripts") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 26c9c72fd0b960906b6a31a614fb30d2434b166b Author: Masami Hiramatsu Date: Sun Sep 5 00:54:24 2021 +0900 docs: bootconfig: Add how to use bootconfig for kernel parameters Add a section to describe how to use the bootconfig for specifying kernel and init parameters. This is an important section because it is the reason why this document is under the admin-guide. Link: https://lkml.kernel.org/r/163077086399.222577.5881779375643977991.stgit@devnote2 Signed-off-by: Masami Hiramatsu Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Signed-off-by: Steven Rostedt (VMware) commit b66fbbe8d48228e1e81b583ae39abb86d7d09053 Author: Masami Hiramatsu Date: Sun Sep 5 00:54:16 2021 +0900 init/bootconfig: Reorder init parameter from bootconfig and cmdline Reorder the init parameters from bootconfig and kernel cmdline so that the kernel cmdline always be the last part of the parameters as below. " -- "[bootconfig init params][cmdline init params] This change will help us to prevent that bootconfig init params overwrite the init params which user gives in the command line. Link: https://lkml.kernel.org/r/163077085675.222577.5665176468023636160.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 40caa127f3c7279c75cb0c9684559fa314ee3a66 Author: Masami Hiramatsu Date: Sun Sep 5 00:54:09 2021 +0900 init: bootconfig: Remove all bootconfig data when the init memory is removed Since the bootconfig is used only in the init functions, it doesn't need to keep the data after boot. Free it when the init memory is removed. Link: https://lkml.kernel.org/r/163077084958.222577.5924961258513004428.stgit@devnote2 Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 4b6b08f2e45edda4c067ac40833e3c1f84383c0b Author: Qiang.Zhang Date: Tue Aug 31 10:29:19 2021 +0800 tracing/osnoise: Fix missed cpus_read_unlock() in start_per_cpu_kthreads() When start_kthread() return error, the cpus_read_unlock() need to be called. Link: https://lkml.kernel.org/r/20210831022919.27630-1-qiang.zhang@windriver.com Cc: Fixes: c8895e271f79 ("trace/osnoise: Support hotplug operations") Acked-by: Daniel Bristot de Oliveira Signed-off-by: Qiang.Zhang Signed-off-by: Steven Rostedt (VMware) commit 3265cc3ec52e75fc8daf189954cebda27ad26b2e Author: Aubrey Li Date: Wed Sep 8 18:55:45 2021 +0800 ACPI: PRM: Find PRMT table before parsing it Find and verify PRMT before parsing it, which eliminates a warning on machines without PRMT: [ 7.197173] ACPI: PRMT not present Fixes: cefc7ca46235 ("ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype") Signed-off-by: Aubrey Li Tested-by: Paul Menzel Cc: 5.14+ # 5.14+ [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 34b1999da935a33be6239226bfa6cd4f704c5c88 Author: Mike Rapoport Date: Thu Aug 19 16:27:17 2021 +0300 x86/mm: Fix kern_addr_valid() to cope with existing but not present entries Jiri Olsa reported a fault when running: # cat /proc/kallsyms | grep ksys_read ffffffff8136d580 T ksys_read # objdump -d --start-address=0xffffffff8136d580 --stop-address=0xffffffff8136d590 /proc/kcore /proc/kcore: file format elf64-x86-64 Segmentation fault general protection fault, probably for non-canonical address 0xf887ffcbff000: 0000 [#1] SMP PTI CPU: 12 PID: 1079 Comm: objdump Not tainted 5.14.0-rc5qemu+ #508 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:kern_addr_valid Call Trace: read_kcore ? rcu_read_lock_sched_held ? rcu_read_lock_sched_held ? rcu_read_lock_sched_held ? trace_hardirqs_on ? rcu_read_lock_sched_held ? lock_acquire ? lock_acquire ? rcu_read_lock_sched_held ? lock_acquire ? rcu_read_lock_sched_held ? rcu_read_lock_sched_held ? rcu_read_lock_sched_held ? lock_release ? _raw_spin_unlock ? __handle_mm_fault ? rcu_read_lock_sched_held ? lock_acquire ? rcu_read_lock_sched_held ? lock_release proc_reg_read ? vfs_read vfs_read ksys_read do_syscall_64 entry_SYSCALL_64_after_hwframe The fault happens because kern_addr_valid() dereferences existent but not present PMD in the high kernel mappings. Such PMDs are created when free_kernel_image_pages() frees regions larger than 2Mb. In this case, a part of the freed memory is mapped with PMDs and the set_memory_np_noalias() -> ... -> __change_page_attr() sequence will mark the PMD as not present rather than wipe it completely. Have kern_addr_valid() check whether higher level page table entries are present before trying to dereference them to fix this issue and to avoid similar issues in the future. Stable backporting note: ------------------------ Note that the stable marking is for all active stable branches because there could be cases where pagetable entries exist but are not valid - see 9a14aefc1d28 ("x86: cpa, fix lookup_address"), for example. So make sure to be on the safe side here and use pXY_present() accessors rather than pXY_none() which could #GP when accessing pages in the direct map. Also see: c40a56a7818c ("x86/mm/init: Remove freed kernel image areas from alias mapping") for more info. Reported-by: Jiri Olsa Signed-off-by: Mike Rapoport Signed-off-by: Borislav Petkov Reviewed-by: David Hildenbrand Acked-by: Dave Hansen Tested-by: Jiri Olsa Cc: # 4.4+ Link: https://lkml.kernel.org/r/20210819132717.19358-1-rppt@kernel.org commit b285437d1d929785a5bef3603da78d2cd5341893 Author: Randy Dunlap Date: Tue Sep 7 20:00:59 2021 -0700 scripts: check_extable: fix typo in user error message Fix typo ("and" should be "an") in an error message. Link: https://lkml.kernel.org/r/20210727002943.29774-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Quentin Casasnovas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 560a870570287aeb0e77825ae0fa1aba47031cf9 Author: Randy Dunlap Date: Tue Sep 7 20:00:56 2021 -0700 mm/workingset: correct kernel-doc notations Use the documented kernel-doc format to prevent kernel-doc warnings. mm/workingset.c:256: warning: No description found for return value of 'workingset_eviction' mm/workingset.c:285: warning: Function parameter or member 'folio' not described in 'workingset_refault' mm/workingset.c:285: warning: Excess function parameter 'page' description in 'workingset_refault' Link: https://lkml.kernel.org/r/20210808203153.10678-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 20401d1058f3f841f35a594ac2fc1293710e55b9 Author: Rafael Aquini Date: Tue Sep 7 20:00:53 2021 -0700 ipc: replace costly bailout check in sysvipc_find_ipc() sysvipc_find_ipc() was left with a costly way to check if the offset position fed to it is bigger than the total number of IPC IDs in use. So much so that the time it takes to iterate over /proc/sysvipc/* files grows exponentially for a custom benchmark that creates "N" SYSV shm segments and then times the read of /proc/sysvipc/shm (milliseconds): 12 msecs to read 1024 segs from /proc/sysvipc/shm 18 msecs to read 2048 segs from /proc/sysvipc/shm 65 msecs to read 4096 segs from /proc/sysvipc/shm 325 msecs to read 8192 segs from /proc/sysvipc/shm 1303 msecs to read 16384 segs from /proc/sysvipc/shm 5182 msecs to read 32768 segs from /proc/sysvipc/shm The root problem lies with the loop that computes the total amount of ids in use to check if the "pos" feeded to sysvipc_find_ipc() grew bigger than "ids->in_use". That is a quite inneficient way to get to the maximum index in the id lookup table, specially when that value is already provided by struct ipc_ids.max_idx. This patch follows up on the optimization introduced via commit 15df03c879836 ("sysvipc: make get_maxid O(1) again") and gets rid of the aforementioned costly loop replacing it by a simpler checkpoint based on ipc_get_maxidx() returned value, which allows for a smooth linear increase in time complexity for the same custom benchmark: 2 msecs to read 1024 segs from /proc/sysvipc/shm 2 msecs to read 2048 segs from /proc/sysvipc/shm 4 msecs to read 4096 segs from /proc/sysvipc/shm 9 msecs to read 8192 segs from /proc/sysvipc/shm 19 msecs to read 16384 segs from /proc/sysvipc/shm 39 msecs to read 32768 segs from /proc/sysvipc/shm Link: https://lkml.kernel.org/r/20210809203554.1562989-1-aquini@redhat.com Signed-off-by: Rafael Aquini Acked-by: Davidlohr Bueso Acked-by: Manfred Spraul Cc: Waiman Long Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d42990f486b56ce4381edd42a47119c073b131d5 Author: Greg Thelen Date: Tue Sep 7 20:00:50 2021 -0700 selftests/memfd: remove unused variable Commit 544029862cbb ("selftests/memfd: add tests for F_SEAL_FUTURE_WRITE seal") added an unused variable to mfd_assert_reopen_fd(). Delete the unused variable. Link: https://lkml.kernel.org/r/20210702045509.1517643-1-gthelen@google.com Fixes: 544029862cbb ("selftests/memfd: add tests for F_SEAL_FUTURE_WRITE seal") Signed-off-by: Greg Thelen Cc: Shuah Khan Cc: Michael Ellerman Cc: "Joel Fernandes (Google)" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6fe26259b4884b657cbc233fb9cdade9d704976e Author: Lukas Bulwahn Date: Tue Sep 7 20:00:47 2021 -0700 Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH Commit 05a4a9527931 ("kernel/watchdog: split up config options") adds a new config HARDLOCKUP_DETECTOR, which selects the non-existing config HARDLOCKUP_DETECTOR_ARCH. Hence, ./scripts/checkkconfigsymbols.py warns: HARDLOCKUP_DETECTOR_ARCH Referencing files: lib/Kconfig.debug Simply drop selecting the non-existing HARDLOCKUP_DETECTOR_ARCH. Link: https://lkml.kernel.org/r/20210806115618.22088-1-lukas.bulwahn@gmail.com Fixes: 05a4a9527931 ("kernel/watchdog: split up config options") Signed-off-by: Lukas Bulwahn Cc: Nicholas Piggin Cc: Masahiro Yamada Cc: Babu Moger Cc: Don Zickus Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4cb398fe1bf127c1e9eff40969454b289f219c43 Author: Zenghui Yu Date: Tue Sep 7 20:00:44 2021 -0700 configs: remove the obsolete CONFIG_INPUT_POLLDEV This CONFIG option was removed in commit 278b13ce3a89 ("Input: remove input_polled_dev implementation") so there's no point to keep it in defconfigs any longer. Get rid of the leftover for all arches. Link: https://lkml.kernel.org/r/20210726074741.1062-1-yuzenghui@huawei.com Signed-off-by: Zenghui Yu Cc: Dmitry Torokhov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e1fbbd073137a9d63279f6bf363151a938347640 Author: Cyrill Gorcunov Date: Tue Sep 7 20:00:41 2021 -0700 prctl: allow to setup brk for et_dyn executables Keno Fischer reported that when a binray loaded via ld-linux-x the prctl(PR_SET_MM_MAP) doesn't allow to setup brk value because it lays before mm:end_data. For example a test program shows | # ~/t | | start_code 401000 | end_code 401a15 | start_stack 7ffce4577dd0 | start_data 403e10 | end_data 40408c | start_brk b5b000 | sbrk(0) b5b000 and when executed via ld-linux | # /lib64/ld-linux-x86-64.so.2 ~/t | | start_code 7fc25b0a4000 | end_code 7fc25b0c4524 | start_stack 7fffcc6b2400 | start_data 7fc25b0ce4c0 | end_data 7fc25b0cff98 | start_brk 55555710c000 | sbrk(0) 55555710c000 This of course prevent criu from restoring such programs. Looking into how kernel operates with brk/start_brk inside brk() syscall I don't see any problem if we allow to setup brk/start_brk without checking for end_data. Even if someone pass some weird address here on a purpose then the worst possible result will be an unexpected unmapping of existing vma (own vma, since prctl works with the callers memory) but test for RLIMIT_DATA is still valid and a user won't be able to gain more memory in case of expanding VMAs via new values shipped with prctl call. Link: https://lkml.kernel.org/r/20210121221207.GB2174@grain Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec") Signed-off-by: Cyrill Gorcunov Reported-by: Keno Fischer Acked-by: Andrey Vagin Tested-by: Andrey Vagin Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Kirill Tkhai Cc: Eric W. Biederman Cc: Pavel Tikhomirov Cc: Alexander Mikhalitsyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b91a75b3312c03798f555e10569fd85211a490c Author: Takahiro Itazuri Date: Tue Sep 7 20:00:38 2021 -0700 pid: cleanup the stale comment mentioning pidmap_init(). pidmap_init() has already been replaced with pid_idr_init() in the commit 95846ecf9dac ("pid: replace pid bitmap implementation with IDR API"). Cleanup the stale comment which still mentions it. Link: https://lkml.kernel.org/r/20210714120713.19825-1-itazur@amazon.com Signed-off-by: Takahiro Itazuri Cc: Kuniyuki Iwashima Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 05da8113c9ba63a8913e6c73dc06ed01cae55f68 Author: Christoph Hellwig Date: Tue Sep 7 20:00:35 2021 -0700 kernel/fork.c: unexport get_{mm,task}_exe_file Only used by core code and the tomoyo which can't be a module either. Link: https://lkml.kernel.org/r/20210820095430.445242-1-hch@lst.de Signed-off-by: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6fcac87e1f9e5b27805a2a404f4849194bb51de8 Author: QiuXi Date: Tue Sep 7 20:00:32 2021 -0700 coredump: fix memleak in dump_vma_snapshot() dump_vma_snapshot() allocs memory for *vma_meta, when dump_vma_snapshot() returns -EFAULT, the memory will be leaked, so we free it correctly. Link: https://lkml.kernel.org/r/20210810020441.62806-1-qiuxi1@huawei.com Fixes: a07279c9a8cd7 ("binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot") Signed-off-by: QiuXi Cc: Al Viro Cc: Jann Horn Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dbd9d6f8fa9c3e676e491ac65c7fa10a1af8321f Author: David Oberhollenzer Date: Tue Sep 7 20:00:29 2021 -0700 fs/coredump.c: log if a core dump is aborted due to changed file permissions For obvious security reasons, a core dump is aborted if the filesystem cannot preserve ownership or permissions of the dump file. This affects filesystems like e.g. vfat, but also something like a 9pfs share in a Qemu test setup, running as a regular user, depending on the security model used. In those cases, the result is an empty core file and a confused user. To hopefully save other people a lot of time figuring out the cause, this patch adds a simple log message for those specific cases. [akpm@linux-foundation.org: s/|%s/%s/ in printk text] Link: https://lkml.kernel.org/r/20210701233151.102720-1-david.oberhollenzer@sigma-star.at Signed-off-by: David Oberhollenzer Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 98e2e409e76ef7781d8511f997359e9c504a95c1 Author: Zhen Lei Date: Tue Sep 7 20:00:26 2021 -0700 nilfs2: use refcount_dec_and_lock() to fix potential UAF When the refcount is decreased to 0, the resource reclamation branch is entered. Before CPU0 reaches the race point (1), CPU1 may obtain the spinlock and traverse the rbtree to find 'root', see nilfs_lookup_root(). Although CPU1 will call refcount_inc() to increase the refcount, it is obviously too late. CPU0 will release 'root' directly, CPU1 then accesses 'root' and triggers UAF. Use refcount_dec_and_lock() to ensure that both the operations of decrease refcount to 0 and link deletion are lock protected eliminates this risk. CPU0 CPU1 nilfs_put_root(): <-------- (1) spin_lock(&nilfs->ns_cptree_lock); rb_erase(&root->rb_node, &nilfs->ns_cptree); spin_unlock(&nilfs->ns_cptree_lock); kfree(root); <-------- use-after-free refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 9476 at lib/refcount.c:28 \ refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28 Modules linked in: CPU: 2 PID: 9476 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... RIP: 0010:refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28 ... ... Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] nilfs_put_root+0xc1/0xd0 fs/nilfs2/the_nilfs.c:795 nilfs_segctor_destroy fs/nilfs2/segment.c:2749 [inline] nilfs_detach_log_writer+0x3fa/0x570 fs/nilfs2/segment.c:2812 nilfs_put_super+0x2f/0xf0 fs/nilfs2/super.c:467 generic_shutdown_super+0xcd/0x1f0 fs/super.c:464 kill_block_super+0x4a/0x90 fs/super.c:1446 deactivate_locked_super+0x6a/0xb0 fs/super.c:335 deactivate_super+0x85/0x90 fs/super.c:366 cleanup_mnt+0x277/0x2e0 fs/namespace.c:1118 __cleanup_mnt+0x15/0x20 fs/namespace.c:1125 task_work_run+0x8e/0x110 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x13c/0x170 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x16/0x30 kernel/entry/common.c:266 do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 There is no reproduction program, and the above is only theoretical analysis. Link: https://lkml.kernel.org/r/1629859428-5906-1-git-send-email-konishi.ryusuke@gmail.com Fixes: ba65ae4729bf ("nilfs2: add checkpoint tree to nilfs object") Link: https://lkml.kernel.org/r/20210723012317.4146-1-thunder.leizhen@huawei.com Signed-off-by: Zhen Lei Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 17243e1c3072b8417a5ebfc53065d0a87af7ca77 Author: Nanyong Sun Date: Tue Sep 7 20:00:23 2021 -0700 nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group kobject_put() should be used to cleanup the memory associated with the kobject instead of kobject_del(). See the section "Kobject removal" of "Documentation/core-api/kobject.rst". Link: https://lkml.kernel.org/r/20210629022556.3985106-7-sunnanyong@huawei.com Link: https://lkml.kernel.org/r/1625651306-10829-7-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b2fe39c248f3fa4bbb2a20759b4fdd83504190f7 Author: Nanyong Sun Date: Tue Sep 7 20:00:21 2021 -0700 nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group If kobject_init_and_add returns with error, kobject_put() is needed here to avoid memory leak, because kobject_init_and_add may return error without freeing the memory associated with the kobject it allocated. Link: https://lkml.kernel.org/r/20210629022556.3985106-6-sunnanyong@huawei.com Link: https://lkml.kernel.org/r/1625651306-10829-6-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a3e181259ddd61fd378390977a1e4e2316853afa Author: Nanyong Sun Date: Tue Sep 7 20:00:18 2021 -0700 nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group The kobject_put() should be used to cleanup the memory associated with the kobject instead of kobject_del. See the section "Kobject removal" of "Documentation/core-api/kobject.rst". Link: https://lkml.kernel.org/r/20210629022556.3985106-5-sunnanyong@huawei.com Link: https://lkml.kernel.org/r/1625651306-10829-5-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 24f8cb1ed057c840728167dab33b32e44147c86f Author: Nanyong Sun Date: Tue Sep 7 20:00:15 2021 -0700 nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group If kobject_init_and_add return with error, kobject_put() is needed here to avoid memory leak, because kobject_init_and_add may return error without freeing the memory associated with the kobject it allocated. Link: https://lkml.kernel.org/r/20210629022556.3985106-4-sunnanyong@huawei.com Link: https://lkml.kernel.org/r/1625651306-10829-4-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dbc6e7d44a514f231a64d9d5676e001b660b6448 Author: Nanyong Sun Date: Tue Sep 7 20:00:12 2021 -0700 nilfs2: fix NULL pointer in nilfs_##name##_attr_release In nilfs_##name##_attr_release, kobj->parent should not be referenced because it is a NULL pointer. The release() method of kobject is always called in kobject_put(kobj), in the implementation of kobject_put(), the kobj->parent will be assigned as NULL before call the release() method. So just use kobj to get the subgroups, which is more efficient and can fix a NULL pointer reference problem. Link: https://lkml.kernel.org/r/20210629022556.3985106-3-sunnanyong@huawei.com Link: https://lkml.kernel.org/r/1625651306-10829-3-git-send-email-konishi.ryusuke@gmail.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5f5dec07aca7067216ed4c1342e464e7307a9197 Author: Nanyong Sun Date: Tue Sep 7 20:00:09 2021 -0700 nilfs2: fix memory leak in nilfs_sysfs_create_device_group Patch series "nilfs2: fix incorrect usage of kobject". This patchset from Nanyong Sun fixes memory leak issues and a NULL pointer dereference issue caused by incorrect usage of kboject in nilfs2 sysfs implementation. This patch (of 6): Reported by syzkaller: BUG: memory leak unreferenced object 0xffff888100ca8988 (size 8): comm "syz-executor.1", pid 1930, jiffies 4294745569 (age 18.052s) hex dump (first 8 bytes): 6c 6f 6f 70 31 00 ff ff loop1... backtrace: kstrdup+0x36/0x70 mm/util.c:60 kstrdup_const+0x35/0x60 mm/util.c:83 kvasprintf_const+0xf1/0x180 lib/kasprintf.c:48 kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289 kobject_add_varg lib/kobject.c:384 [inline] kobject_init_and_add+0xc9/0x150 lib/kobject.c:473 nilfs_sysfs_create_device_group+0x150/0x7d0 fs/nilfs2/sysfs.c:986 init_nilfs+0xa21/0xea0 fs/nilfs2/the_nilfs.c:637 nilfs_fill_super fs/nilfs2/super.c:1046 [inline] nilfs_mount+0x7b4/0xe80 fs/nilfs2/super.c:1316 legacy_get_tree+0x105/0x210 fs/fs_context.c:592 vfs_get_tree+0x8e/0x2d0 fs/super.c:1498 do_new_mount fs/namespace.c:2905 [inline] path_mount+0xf9b/0x1990 fs/namespace.c:3235 do_mount+0xea/0x100 fs/namespace.c:3248 __do_sys_mount fs/namespace.c:3456 [inline] __se_sys_mount fs/namespace.c:3433 [inline] __x64_sys_mount+0x14b/0x1f0 fs/namespace.c:3433 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae If kobject_init_and_add return with error, then the cleanup of kobject is needed because memory may be allocated in kobject_init_and_add without freeing. And the place of cleanup_dev_kobject should use kobject_put to free the memory associated with the kobject. As the section "Kobject removal" of "Documentation/core-api/kobject.rst" says, kobject_del() just makes the kobject "invisible", but it is not cleaned up. And no more cleanup will do after cleanup_dev_kobject, so kobject_put is needed here. Link: https://lkml.kernel.org/r/1625651306-10829-1-git-send-email-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/1625651306-10829-2-git-send-email-konishi.ryusuke@gmail.com Reported-by: Hulk Robot Link: https://lkml.kernel.org/r/20210629022556.3985106-2-sunnanyong@huawei.com Signed-off-by: Nanyong Sun Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8b097881b54cbc23dd78262ed88c9924d00ea457 Author: Kefeng Wang Date: Tue Sep 7 20:16:06 2021 -0700 trap: cleanup trap_init() There are some empty trap_init() definitions in different ARCHs, Introduce a new weak trap_init() function to clean them up. Link: https://lkml.kernel.org/r/20210812123602.76356-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Russell King (Oracle) [arm32] Acked-by: Vineet Gupta [arc] Acked-by: Michael Ellerman [powerpc] Cc: Yoshinori Sato Cc: Ley Foon Tan Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Stafford Horne Cc: James E.J. Bottomley Cc: Helge Deller Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Paul Walmsley Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b234ed6d629420827e2839c8c8935be85a0867fd Author: Rasmus Villemoes Date: Tue Sep 7 20:00:03 2021 -0700 init: move usermodehelper_enable() to populate_rootfs() Currently, usermodehelper is enabled right before PID1 starts going through the initcalls. However, any call of a usermodehelper from a pure_, core_, postcore_, arch_, subsys_ or fs_ initcall is futile, as there is no filesystem contents yet. Up until commit e7cb072eb988 ("init/initramfs.c: do unpacking asynchronously"), such calls, whether via some request_module(), a legacy uevent "/sbin/hotplug" notification or something else, would just fail silently with (presumably) -ENOENT from kernel_execve(). However, that commit introduced the wait_for_initramfs() synchronization hook which must be called from the usermodehelper exec path right before the kernel_execve, in order that request_module() et al done from *after* rootfs_initcall() time (i.e. device_ and late_ initcalls) would continue to find a populated initramfs as they used to. Any call of wait_for_initramfs() done before the unpacking has been scheduled (i.e. before rootfs_initcall time) must just return immediately [and let the caller find an empty file system] in order not to deadlock the machine. I mistakenly thought, and my limited testing confirmed, that there were no such calls, so I added a pr_warn_once() in wait_for_initramfs(). It turns out that one can indeed hit request_module() as well as kobject_uevent_env() during those early init calls, leading to a user-visible warning in the kernel log emitted consistently for certain configurations. We could just remove the pr_warn_once(), but I think it's better to postpone enabling the usermodehelper framework until there is at least some chance of finding the executable. That is also a little more efficient in that a lot of work done in umh.c will be elided. However, it does change the error seen by those early callers from -ENOENT to -EBUSY, so there is a risk of a regression if any caller care about the exact error value. Link: https://lkml.kernel.org/r/20210728134638.329060-1-linux@rasmusvillemoes.dk Fixes: e7cb072eb988 ("init/initramfs.c: do unpacking asynchronously") Signed-off-by: Rasmus Villemoes Reported-by: Alexander Egorenkov Reported-by: Bruno Goncalves Reported-by: Heiner Kallweit Cc: Luis Chamberlain Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1e1c15839df084f4011825fee922aa976c9159dc Author: Nicholas Piggin Date: Tue Sep 7 20:00:00 2021 -0700 fs/epoll: use a per-cpu counter for user's watches count This counter tracks the number of watches a user has, to compare against the 'max_user_watches' limit. This causes a scalability bottleneck on SPECjbb2015 on large systems as there is only one user. Changing to a per-cpu counter increases throughput of the benchmark by about 30% on a 16-socket, > 1000 thread system. [rdunlap@infradead.org: fix build errors in kernel/user.c when CONFIG_EPOLL=n] [npiggin@gmail.com: move ifdefs into wrapper functions, slightly improve panic message] Link: https://lkml.kernel.org/r/1628051945.fens3r99ox.astroid@bobo.none [akpm@linux-foundation.org: tweak user_epoll_alloc(), per Guenter] Link: https://lkml.kernel.org/r/20210804191421.GA1900577@roeck-us.net Link: https://lkml.kernel.org/r/20210802032013.2751916-1-npiggin@gmail.com Signed-off-by: Nicholas Piggin Reported-by: Anton Blanchard Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4ce9f970457899defdf68e26e0502c7245002eb3 Author: Joe Perches Date: Tue Sep 7 19:59:57 2021 -0700 checkpatch: improve GIT_COMMIT_ID test The preferred git commit id reference has the form commit ("Title line") where SHA-1 is the commit hex hash with a minimum lenth of 12 and ("Title line") is the complete title line of the commit with a (" prefix and ") suffix. The current tests fail when the "Title line" has one or more embedded double quotes. Improve the test that finds the commit SHA-1 hex hash then ("Title line") by using $balanced_parens for a maximum of 3 consecutive lines. [akpm@linux-foundation.org: add missing &&] Link: https://lkml.kernel.org/r/976c6cdd680db4b55ae31b5fc2d1779da5c0dc66.camel@perches.com Signed-off-by: Joe Perches Cc: Dwaipayan Ray Cc: Lukas Bulwahn Cc: Denis Efremov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 046fc741e35e9dee7c7f7c4173ba3d79f938286f Author: Mimi Zohar Date: Tue Sep 7 19:59:54 2021 -0700 checkpatch: make email address check case insensitive Instead of checkpatch requiring the patch author to exactly match the signed-off-by tag, commit 48ca2d8ac8a1 ("checkpatch: add new warnings to author signoff checks.") safely relaxed this requirement. Although the local-part of an email address (local-part@domain), may be case sensitive, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. Mailbox domains follow normal DNS rules and are hence not case sensitive. (Refer to https://datatracker.ietf.org/doc/html/rfc5321#section-2.4.) Further relax the patch author and signed-off-by tag comparison by making the email address check case insensitive. Link: https://lkml.kernel.org/r/20210816112725.173206-1-zohar@linux.ibm.com Signed-off-by: Mimi Zohar Acked-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2af5aa6c036d3fd2c1ff3379ffe3e6805929952 Author: Joe Perches Date: Tue Sep 7 19:59:51 2021 -0700 checkpatch: support wide strings Allow prefixing typical strings with L for wide strings and u for unicode strings. Link: https://lkml.kernel.org/r/20210801170733.1.I3f9784fd3c1007d08ec2e70b151d137687575495@changeid Signed-off-by: Joe Perches Signed-off-by: Simon Glass Cc: Dwaipayan Ray Cc: Lukas Bulwahn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7fc5b571325f1bcbe1ce384409b2d05546431b04 Author: Andy Shevchenko Date: Tue Sep 7 19:59:35 2021 -0700 tools: rename bitmap_alloc() to bitmap_zalloc() Rename bitmap_alloc() to bitmap_zalloc() in tools to follow the bitmap API in the kernel. No functional changes intended. Link: https://lkml.kernel.org/r/20210814211713.180533-14-yury.norov@gmail.com Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov Suggested-by: Yury Norov Acked-by: Yury Norov Tested-by: Wolfram Sang Acked-by: Jiri Olsa Cc: Alexander Lobakin Cc: Alexey Klimov Cc: Dennis Zhou Cc: Ulf Hansson Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 44e5599775541eb5e25d6dfb01d9abbd5ad79823 Author: Randy Dunlap Date: Tue Sep 7 19:58:54 2021 -0700 lib/iov_iter.c: fix kernel-doc warnings Fix all kernel-doc warnings in lib/iov_iter.c: lib/iov_iter.c:695: warning: Function parameter or member 'i' not described in '_copy_mc_to_iter' lib/iov_iter.c:695: warning: Excess function parameter 'iter' description in '_copy_mc_to_iter' lib/iov_iter.c:695: warning: No description found for return value of '_copy_mc_to_iter' lib/iov_iter.c:758: warning: Function parameter or member 'i' not described in '_copy_from_iter_flushcache' lib/iov_iter.c:758: warning: Excess function parameter 'iter' description in '_copy_from_iter_flushcache' lib/iov_iter.c:758: warning: No description found for return value of '_copy_from_iter_flushcache' Link: https://lkml.kernel.org/r/20210809051053.6531-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 83a29beb23bcc770a3838fc33970efbaaad26bf7 Author: Randy Dunlap Date: Tue Sep 7 19:58:51 2021 -0700 lib/dump_stack: correct kernel-doc notation Fix kernel-doc warnings in dump_stack.c: lib/dump_stack.c:97: warning: Function parameter or member 'log_lvl' not described in 'dump_stack_lvl' lib/dump_stack.c:97: warning: expecting prototype for dump_stack(). Prototype was for dump_stack_lvl() instead Link: https://lkml.kernel.org/r/20210809051643.17567-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 36f33b562936295a0fb365ea0b1b2afcd8974242 Author: Daniel Latypov Date: Tue Sep 7 19:58:48 2021 -0700 lib/test: convert test_sort.c to use KUnit This follows up commit ebd09577be6c ("lib/test: convert lib/test_list_sort.c to use KUnit"). Converting this test to KUnit makes the test a bit shorter, standardizes how it reports pass/fail, and adds an easier way to run the test [1]. Like ebd09577be6c, this leaves the file and Kconfig option name the same, but slightly changes their dependencies (needs CONFIG_KUNIT). [1] Can be run via $ ./tools/testing/kunit/kunit.py run --kunitconfig /dev/stdin < Cc: Pravin Shedge Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8ba739ede49dec361ddcb70afe24986b4b8cfe17 Author: Geert Uytterhoeven Date: Tue Sep 7 19:58:36 2021 -0700 math: RATIONAL_KUNIT_TEST should depend on RATIONAL instead of selecting it RATIONAL_KUNIT_TEST selects RATIONAL, thus enabling an optional feature the user may not want to have enabled. Fix this by making the test depend on RATIONAL instead. Link: https://lkml.kernel.org/r/20210706100945.3803694-3-geert@linux-m68k.org Fixes: b6c75c4afceb8bc0 ("lib/math/rational: add Kunit test cases") Signed-off-by: Geert Uytterhoeven Cc: Andy Shevchenko Cc: Brendan Higgins Cc: Colin Ian King Cc: Trent Piepho Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bcda5fd34417c89f653cc0912cc0608b36ea032c Author: Geert Uytterhoeven Date: Tue Sep 7 19:58:33 2021 -0700 math: make RATIONAL tristate Patch series "math: RATIONAL and RATIONAL_KUNIT_TEST improvements". This series makes the RATIONAL symbol tristate, so it is not forced builtin if all users are modular, and makes the RATIONAL_KUNIT_TEST depend on RATIONAL, to avoid enabling RATIONAL if there are no real users. This patch (of 2): All but one symbols that select RATIONAL are tristate, but RATIONAL itself is bool. Change it to tristate, so the rational fractions support code can be modular if no builtin code relies on it. Link: https://lkml.kernel.org/r/20210706100945.3803694-1-geert@linux-m68k.org Link: https://lkml.kernel.org/r/20210706100945.3803694-2-geert@linux-m68k.org Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Cc: Trent Piepho Cc: Colin Ian King Cc: Brendan Higgins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c3493bb290bc654d13063a88660c070ad4eabcd Author: Nathan Chancellor Date: Tue Sep 7 19:58:30 2021 -0700 Documentation/llvm: update IRC location This should have been done with commit 91ed3ed0f798 ("MAINTAINERS: update ClangBuiltLinux IRC chat") but I did not realize it was in two separate spots. Link: https://lkml.kernel.org/r/20210825211823.6406-3-nathan@kernel.org Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Cc: Kees Cook Cc: Masahiro Yamada Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28f8fc19b24924a9770bd2e93123005547c3f3f5 Author: Nathan Chancellor Date: Tue Sep 7 19:58:27 2021 -0700 Documentation/llvm: update mailing list We are now at llvm@lists.linux.dev. Link: https://lkml.kernel.org/r/20210825211823.6406-2-nathan@kernel.org Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Cc: Kees Cook Cc: Masahiro Yamada Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 726248b62fbed796c14ab866f0aa7a6ff3c0f201 Author: Nathan Chancellor Date: Tue Sep 7 19:58:24 2021 -0700 MAINTAINERS: update ClangBuiltLinux mailing list We are now at llvm@lists.linux.dev. Link: https://lkml.kernel.org/r/20210825211823.6406-1-nathan@kernel.org Signed-off-by: Nathan Chancellor Acked-by: Nick Desaulniers Cc: Masahiro Yamada Cc: Kees Cook Cc: Sami Tolvanen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d Author: Pavel Skripkin Date: Tue Sep 7 19:58:21 2021 -0700 profiling: fix shift-out-of-bounds bugs Syzbot reported shift-out-of-bounds bug in profile_init(). The problem was in incorrect prof_shift. Since prof_shift value comes from userspace we need to clamp this value into [0, BITS_PER_LONG -1] boundaries. Second possible shiht-out-of-bounds was found by Tetsuo: sample_step local variable in read_profile() had "unsigned int" type, but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent possible shiht-out-of-bounds sample_step type was changed to "unsigned long". Also, "unsigned short int" will be sufficient for storing [0, BITS_PER_LONG] value, that's why there is no need for "unsigned long" prof_shift. Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com Suggested-by: Tetsuo Handa Signed-off-by: Pavel Skripkin Cc: Thomas Gleixner Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c91dda97eea704ac257ddb138d1154adab8db62 Author: Yang Yang Date: Tue Sep 7 19:58:18 2021 -0700 kernel/acct.c: use dedicated helper to access rlimit values Use rlimit() helper instead of manually writing whole chain from task to rlimit value. See patch "posix-cpu-timers: Use dedicated helper to access rlimit values". Link: https://lkml.kernel.org/r/20210728030822.524789-1-yang.yang29@zte.com.cn Signed-off-by: Yang Yang Reported-by: Zeal Robot Cc: Randy Dunlap Cc: sh_def@163.com Cc: Yang Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18821693b97bd5601d796a41ecc7da9cc2766769 Author: Daniel Lezcano Date: Tue Sep 7 19:58:15 2021 -0700 phy/drivers/stm32: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. Link: https://lkml.kernel.org/r/20210816114732.1834145-11-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Andy Shevchenko Cc: Chanwoo Choi Cc: Christian Eggers Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9ef347c3df98ac69d04ff2d959cb5a3c7d4367d0 Author: Daniel Lezcano Date: Tue Sep 7 19:58:11 2021 -0700 mtd/drivers/nand: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. Link: https://lkml.kernel.org/r/20210816114732.1834145-10-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Acked-by: Miquel Raynal Reviewed-by: Andy Shevchenko Cc: Chanwoo Choi Cc: Christian Eggers Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09704a941c42296c34955651d7bcc860635f8a59 Author: Daniel Lezcano Date: Tue Sep 7 19:58:08 2021 -0700 i2c/drivers/ov02q10: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. Link: https://lkml.kernel.org/r/20210816114732.1834145-9-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Andy Shevchenko Cc: Chanwoo Choi Cc: Christian Eggers Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 87000e7fe0a201572fd8756e3497c0b5ee4f4231 Author: Daniel Lezcano Date: Tue Sep 7 19:58:05 2021 -0700 iio/drivers/hid-sensor: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. Link: https://lkml.kernel.org/r/20210816114732.1834145-8-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Andy Shevchenko Acked-by: Jonathan Cameron Cc: Chanwoo Choi Cc: Christian Eggers Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d59eacaac953242853c2e53db0ee7cc25613ae03 Author: Daniel Lezcano Date: Tue Sep 7 19:58:01 2021 -0700 hwmon/drivers/mr75203: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. The new macro is an unsigned long. The code dealing with it is considering as an unsigned long also. Link: https://lkml.kernel.org/r/20210816114732.1834145-7-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Christian Eggers Reviewed-by: Andy Shevchenko Acked-by: Guenter Roeck Cc: Chanwoo Choi Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 55c653e0be71acb70f0dd2235b8c7aabebe3ed98 Author: Daniel Lezcano Date: Tue Sep 7 19:57:58 2021 -0700 iio/drivers/as73211: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. Link: https://lkml.kernel.org/r/20210816114732.1834145-6-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Christian Eggers Reviewed-by: Andy Shevchenko Acked-by: Jonathan Cameron Cc: Chanwoo Choi Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 04c8984ae3fa4373948483e367561c79fda7f571 Author: Daniel Lezcano Date: Tue Sep 7 19:57:54 2021 -0700 devfreq: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. The new macro has an unsigned long type. All the code is dealing with unsigned long and the code using the macro is doing a coercitive cast to unsigned long. Link: https://lkml.kernel.org/r/20210816114732.1834145-5-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Christian Eggers Reviewed-by: Andy Shevchenko Acked-by: Chanwoo Choi Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 73b718c617caae17f6e2964fba823e2c18a9b67c Author: Daniel Lezcano Date: Tue Sep 7 19:57:51 2021 -0700 thermal/drivers/devfreq_cooling: use HZ macros HZ unit conversion macros are available in units.h, use them and remove the duplicate definition. The new macro uses a unsigned long type which is already the type in the current code via the 'freq' variable. Link: https://lkml.kernel.org/r/20210816114732.1834145-4-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Andy Shevchenko Reviewed-by: Christian Eggers Cc: Chanwoo Choi Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e2c77032fcbe515194107994d12cd72ddb77b022 Author: Daniel Lezcano Date: Tue Sep 7 19:57:48 2021 -0700 units: add the HZ macros The macros for the unit conversion for frequency are duplicated in different places. Provide these macros in the 'units' header, so they can be reused. Link: https://lkml.kernel.org/r/20210816114732.1834145-3-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Reviewed-by: Christian Eggers Reviewed-by: Andy Shevchenko Cc: Chanwoo Choi Cc: Guenter Roeck Cc: Jonathan Cameron Cc: Jonathan Cameron Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Lukasz Luba Cc: Maxime Coquelin Cc: Miquel Raynal Cc: MyungJoo Ham Cc: Peter Meerwald Cc: "Rafael J. Wysocki" Cc: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c9221919a2d2df5741ab074dfec5bdfc6f1e043b Author: Daniel Lezcano Date: Tue Sep 7 19:57:44 2021 -0700 units: change from 'L' to 'UL' Patch series "Add Hz macros", v3. There are multiple definitions of the HZ_PER_MHZ or HZ_PER_KHZ in the different drivers. Instead of duplicating this definition again and again, add one in the units.h header to be reused in all the place the redefiniton occurs. At the same time, change the type of the Watts, as they can not be negative. This patch (of 10): The users of the macros are safe to be assigned with an unsigned instead of signed as the variables using them are themselves unsigned. Link: https://lkml.kernel.org/r/20210816114732.1834145-1-daniel.lezcano@linaro.org Link: https://lkml.kernel.org/r/20210816114732.1834145-2-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano Cc: Andy Shevchenko Cc: Jonathan Cameron Cc: Christian Eggers Cc: Lukasz Luba Cc: MyungJoo Ham Cc: Kyungmin Park Cc: Lars-Peter Clausen Cc: Peter Meerwald Cc: Zhang Rui Cc: Guenter Roeck Cc: Miquel Raynal Cc: Maxime Coquelin Cc: "Rafael J. Wysocki" Cc: Daniel Lezcano Cc: Chanwoo Choi Cc: Jonathan Cameron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8a47cf5ce4bbc70a54fa4eca71d35f43dc8218a Author: Andy Shevchenko Date: Tue Sep 7 19:57:41 2021 -0700 include/linux/once.h: fix trivia typo Not -> Note Fix trivia typo Not -> Note in the comment to DO_ONCE(). Link: https://lkml.kernel.org/r/20210722184349.76290-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c226bc3cd99bd3535f6a7264c7c7fb0bce16db12 Author: Colin Ian King Date: Tue Sep 7 19:57:38 2021 -0700 arch: Kconfig: fix spelling mistake "seperate" -> "separate" Threre is a spelling mistake in the Kconfig text. Fix it. Link: https://lkml.kernel.org/r/20210704095207.37342-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c2f273ebd89a79ed87ef1025753343e327b99ac9 Author: Ohhoon Kwon Date: Tue Sep 7 19:57:35 2021 -0700 connector: send event on write to /proc/[pid]/comm While comm change event via prctl has been reported to proc connector by 'commit f786ecba4158 ("connector: add comm change event report to proc connector")', connector listeners were missing comm changes by explicit writes on /proc/[pid]/comm. Let explicit writes on /proc/[pid]/comm report to proc connector. Link: https://lkml.kernel.org/r/20210701133458epcms1p68e9eb9bd0eee8903ba26679a37d9d960@epcms1p6 Signed-off-by: Ohhoon Kwon Cc: Ingo Molnar Cc: David S. Miller Cc: Christian Brauner Cc: Eric W. Biederman Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8d23b2080b4ffe530edc324f233c2a5bb192b152 Author: Christoph Hellwig Date: Tue Sep 7 19:57:33 2021 -0700 proc: stop using seq_get_buf in proc_task_name Use seq_escape_str and seq_printf instead of poking holes into the seq_file abstraction. Link: https://lkml.kernel.org/r/20210810151945.1795567-1-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Christian Brauner Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3843c50a782c397422765cf0839a95e75e523229 Author: Greg Kroah-Hartman Date: Tue Sep 7 19:57:27 2021 -0700 percpu: remove export of pcpu_base_addr This is not needed by any modules, so remove the export. Link: https://lkml.kernel.org/r/20210722185814.504541-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman Reviewed-by: Christoph Hellwig Cc: Dennis Zhou Cc: Tejun Heo Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0a9d991c424b4cda5db574b6355f0c627ae59109 Author: Randy Dunlap Date: Tue Sep 7 19:57:24 2021 -0700 alpha: pci-sysfs: fix all kernel-doc warnings Fix all kernel-doc warnings in arch/alpha/kernel/pci-sysfs.c: arch/alpha/kernel/pci-sysfs.c:67: warning: No description found for return value of 'pci_mmap_resource' arch/alpha/kernel/pci-sysfs.c:115: warning: Function parameter or member 'pdev' not described in 'pci_remove_resource_files' arch/alpha/kernel/pci-sysfs.c:115: warning: Excess function parameter 'dev' description in 'pci_remove_resource_files' arch/alpha/kernel/pci-sysfs.c:230: warning: Function parameter or member 'pdev' not described in 'pci_create_resource_files' arch/alpha/kernel/pci-sysfs.c:230: warning: Excess function parameter 'dev' description in 'pci_create_resource_files' arch/alpha/kernel/pci-sysfs.c:232: warning: No description found for return value of 'pci_create_resource_files' arch/alpha/kernel/pci-sysfs.c:305: warning: Function parameter or member 'bus' not described in 'pci_adjust_legacy_attr' arch/alpha/kernel/pci-sysfs.c:305: warning: Excess function parameter 'b' description in 'pci_adjust_legacy_attr' Link: https://lkml.kernel.org/r/20210808185249.31442-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5ecae8f6aafe6ae7c8fb10c3c175f85baf779814 Author: Randy Dunlap Date: Tue Sep 7 19:57:21 2021 -0700 alpha: agp: make empty macros use do-while-0 style Copy these macros from ia64/include/asm/agp.h to avoid the "empty-body" in 'if' statment warning. drivers/char/agp/generic.c: In function 'agp_generic_destroy_page': ../drivers/char/agp/generic.c:1265:42: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 1265 | unmap_page_from_agp(page); Link: https://lkml.kernel.org/r/20210809030822.20658-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: David Airlie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75e39b1a3668c008c32c7ffbebe93386e67c7352 Author: SeongJae Park Date: Tue Sep 7 19:57:17 2021 -0700 MAINTAINERS: update for DAMON This commit updates MAINTAINERS file for DAMON related files. Link: https://lkml.kernel.org/r/20210716081449.22187-14-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Markus Boehme Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Fernand Sieber Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b348eb7abd0987b849420113ced27ad7a1bc6cf3 Author: SeongJae Park Date: Tue Sep 7 19:57:13 2021 -0700 mm/damon: add user space selftests This commit adds a simple user space tests for DAMON. The tests are using kselftest framework. Link: https://lkml.kernel.org/r/20210716081449.22187-13-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Markus Boehme Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Fernand Sieber Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 17ccae8bb5c928946f6f3af14626ec458f74e6ad Author: SeongJae Park Date: Tue Sep 7 19:57:09 2021 -0700 mm/damon: add kunit tests This commit adds kunit based unit tests for the core and the virtual address spaces monitoring primitives of DAMON. Link: https://lkml.kernel.org/r/20210716081449.22187-12-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Brendan Higgins Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Fernand Sieber Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c4ba6014aec39e74ad3c10229dcfd187c42ee4f3 Author: SeongJae Park Date: Tue Sep 7 19:57:05 2021 -0700 Documentation: add documents for DAMON This commit adds documents for DAMON under `Documentation/admin-guide/mm/damon/` and `Documentation/vm/damon/`. Link: https://lkml.kernel.org/r/20210716081449.22187-11-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Fernand Sieber Reviewed-by: Markus Boehme Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75c1c2b53c78bf3b3188ebb7b3508dadbf98bba1 Author: SeongJae Park Date: Tue Sep 7 19:57:01 2021 -0700 mm/damon/dbgfs: support multiple contexts In some use cases, users would want to run multiple monitoring context. For example, if a user wants a high precision monitoring and dedicating multiple CPUs for the job is ok, because DAMON creates one monitoring thread per one context, the user can split the monitoring target regions into multiple small regions and create one context for each region. Or, someone might want to simultaneously monitor different address spaces, e.g., both virtual address space and physical address space. The DAMON's API allows such usage, but 'damon-dbgfs' does not. Therefore, only kernel space DAMON users can do multiple contexts monitoring. This commit allows the user space DAMON users to use multiple contexts monitoring by introducing two new 'damon-dbgfs' debugfs files, 'mk_context' and 'rm_context'. Users can create a new monitoring context by writing the desired name of the new context to 'mk_context'. Then, a new directory with the name and having the files for setting of the context ('attrs', 'target_ids' and 'record') will be created under the debugfs directory. Writing the name of the context to remove to 'rm_context' will remove the related context and directory. Link: https://lkml.kernel.org/r/20210716081449.22187-10-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Fernand Sieber Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 429538e85410c3ae12719ec42b89ab873ed6d47b Author: SeongJae Park Date: Tue Sep 7 19:56:57 2021 -0700 mm/damon/dbgfs: export kdamond pid to the user space For CPU usage accounting, knowing pid of the monitoring thread could be helpful. For example, users could use cpuaccount cgroups with the pid. This commit therefore exports the pid of currently running monitoring thread to the user space via 'kdamond_pid' file in the debugfs directory. Link: https://lkml.kernel.org/r/20210716081449.22187-9-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Fernand Sieber Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4bc05954d0076655cfaf6f0135585bdc20cd6b11 Author: SeongJae Park Date: Tue Sep 7 19:56:53 2021 -0700 mm/damon: implement a debugfs-based user space interface DAMON is designed to be used by kernel space code such as the memory management subsystems, and therefore it provides only kernel space API. That said, letting the user space control DAMON could provide some benefits to them. For example, it will allow user space to analyze their specific workloads and make their own special optimizations. For such cases, this commit implements a simple DAMON application kernel module, namely 'damon-dbgfs', which merely wraps the DAMON api and exports those to the user space via the debugfs. 'damon-dbgfs' exports three files, ``attrs``, ``target_ids``, and ``monitor_on`` under its debugfs directory, ``/damon/``. Attributes ---------- Users can read and write the ``sampling interval``, ``aggregation interval``, ``regions update interval``, and min/max number of monitoring target regions by reading from and writing to the ``attrs`` file. For example, below commands set those values to 5 ms, 100 ms, 1,000 ms, 10, 1000 and check it again:: # cd /damon # echo 5000 100000 1000000 10 1000 > attrs # cat attrs 5000 100000 1000000 10 1000 Target IDs ---------- Some types of address spaces supports multiple monitoring target. For example, the virtual memory address spaces monitoring can have multiple processes as the monitoring targets. Users can set the targets by writing relevant id values of the targets to, and get the ids of the current targets by reading from the ``target_ids`` file. In case of the virtual address spaces monitoring, the values should be pids of the monitoring target processes. For example, below commands set processes having pids 42 and 4242 as the monitoring targets and check it again:: # cd /damon # echo 42 4242 > target_ids # cat target_ids 42 4242 Note that setting the target ids doesn't start the monitoring. Turning On/Off -------------- Setting the files as described above doesn't incur effect unless you explicitly start the monitoring. You can start, stop, and check the current status of the monitoring by writing to and reading from the ``monitor_on`` file. Writing ``on`` to the file starts the monitoring of the targets with the attributes. Writing ``off`` to the file stops those. DAMON also stops if every targets are invalidated (in case of the virtual memory monitoring, target processes are invalidated when terminated). Below example commands turn on, off, and check the status of DAMON:: # cd /damon # echo on > monitor_on # echo off > monitor_on # cat monitor_on off Please note that you cannot write to the above-mentioned debugfs files while the monitoring is turned on. If you write to the files while DAMON is running, an error code such as ``-EBUSY`` will be returned. [akpm@linux-foundation.org: remove unneeded "alloc failed" printks] [akpm@linux-foundation.org: replace macro with static inline] Link: https://lkml.kernel.org/r/20210716081449.22187-8-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Fernand Sieber Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shakeel Butt Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2fcb93629ad8911c846cdc44521c746e53cc4e6d Author: SeongJae Park Date: Tue Sep 7 19:56:48 2021 -0700 mm/damon: add a tracepoint This commit adds a tracepoint for DAMON. It traces the monitoring results of each region for each aggregation interval. Using this, DAMON can easily integrated with tracepoints supporting tools such as perf. Link: https://lkml.kernel.org/r/20210716081449.22187-7-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Steven Rostedt (VMware) Reviewed-by: Fernand Sieber Acked-by: Shakeel Butt Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shuah Khan Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f49584b262cf8f42b25f4c1ad9f5bfd3bdc1bca Author: SeongJae Park Date: Tue Sep 7 19:56:44 2021 -0700 mm/damon: implement primitives for the virtual memory address spaces This commit introduces a reference implementation of the address space specific low level primitives for the virtual address space, so that users of DAMON can easily monitor the data accesses on virtual address spaces of specific processes by simply configuring the implementation to be used by DAMON. The low level primitives for the fundamental access monitoring are defined in two parts: 1. Identification of the monitoring target address range for the address space. 2. Access check of specific address range in the target space. The reference implementation for the virtual address space does the works as below. PTE Accessed-bit Based Access Check ----------------------------------- The implementation uses PTE Accessed-bit for basic access checks. That is, it clears the bit for the next sampling target page and checks whether it is set again after one sampling period. This could disturb the reclaim logic. DAMON uses ``PG_idle`` and ``PG_young`` page flags to solve the conflict, as Idle page tracking does. VMA-based Target Address Range Construction ------------------------------------------- Only small parts in the super-huge virtual address space of the processes are mapped to physical memory and accessed. Thus, tracking the unmapped address regions is just wasteful. However, because DAMON can deal with some level of noise using the adaptive regions adjustment mechanism, tracking every mapping is not strictly required but could even incur a high overhead in some cases. That said, too huge unmapped areas inside the monitoring target should be removed to not take the time for the adaptive mechanism. For the reason, this implementation converts the complex mappings to three distinct regions that cover every mapped area of the address space. Also, the two gaps between the three regions are the two biggest unmapped areas in the given address space. The two biggest unmapped areas would be the gap between the heap and the uppermost mmap()-ed region, and the gap between the lowermost mmap()-ed region and the stack in most of the cases. Because these gaps are exceptionally huge in usual address spaces, excluding these will be sufficient to make a reasonable trade-off. Below shows this in detail:: (small mmap()-ed regions and munmap()-ed regions) [akpm@linux-foundation.org: mm/damon/vaddr.c needs highmem.h for kunmap_atomic()] [sjpark@amazon.de: remove unnecessary PAGE_EXTENSION setup] Link: https://lkml.kernel.org/r/20210806095153.6444-2-sj38.park@gmail.com [sjpark@amazon.de: safely walk page table] Link: https://lkml.kernel.org/r/20210831161800.29419-1-sj38.park@gmail.com Link: https://lkml.kernel.org/r/20210716081449.22187-6-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Fernand Sieber Acked-by: Shakeel Butt Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c676e0d9b1a59b98885b24a0e16a81fe4cc8301 Author: SeongJae Park Date: Tue Sep 7 19:56:40 2021 -0700 mm/idle_page_tracking: make PG_idle reusable PG_idle and PG_young allow the two PTE Accessed bit users, Idle Page Tracking and the reclaim logic concurrently work while not interfering with each other. That is, when they need to clear the Accessed bit, they set PG_young to represent the previous state of the bit, respectively. And when they need to read the bit, if the bit is cleared, they further read the PG_young to know whether the other has cleared the bit meanwhile or not. For yet another user of the PTE Accessed bit, we could add another page flag, or extend the mechanism to use the flags. For the DAMON usecase, however, we don't need to do that just yet. IDLE_PAGE_TRACKING and DAMON are mutually exclusive, so there's only ever going to be one user of the current set of flags. In this commit, we split out the CONFIG options to allow for the use of PG_young and PG_idle outside of idle page tracking. In the next commit, DAMON's reference implementation of the virtual memory address space monitoring primitives will use it. [sjpark@amazon.de: set PAGE_EXTENSION for non-64BIT] Link: https://lkml.kernel.org/r/20210806095153.6444-1-sj38.park@gmail.com [akpm@linux-foundation.org: tweak Kconfig text] [sjpark@amazon.de: hide PAGE_IDLE_FLAG from users] Link: https://lkml.kernel.org/r/20210813081238.34705-1-sj38.park@gmail.com Link: https://lkml.kernel.org/r/20210716081449.22187-5-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Shakeel Butt Reviewed-by: Fernand Sieber Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Leonard Foerster Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b9a6ac4e4ede4172d165c133398b93e3233b0ba7 Author: SeongJae Park Date: Tue Sep 7 19:56:36 2021 -0700 mm/damon: adaptively adjust regions Even somehow the initial monitoring target regions are well constructed to fulfill the assumption (pages in same region have similar access frequencies), the data access pattern can be dynamically changed. This will result in low monitoring quality. To keep the assumption as much as possible, DAMON adaptively merges and splits each region based on their access frequency. For each ``aggregation interval``, it compares the access frequencies of adjacent regions and merges those if the frequency difference is small. Then, after it reports and clears the aggregated access frequency of each region, it splits each region into two or three regions if the total number of regions will not exceed the user-specified maximum number of regions after the split. In this way, DAMON provides its best-effort quality and minimal overhead while keeping the upper-bound overhead that users set. Link: https://lkml.kernel.org/r/20210716081449.22187-4-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Fernand Sieber Acked-by: Shakeel Butt Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f23b8eee1871a6db5c37f90831147de5426c40b7 Author: SeongJae Park Date: Tue Sep 7 19:56:32 2021 -0700 mm/damon/core: implement region-based sampling To avoid the unbounded increase of the overhead, DAMON groups adjacent pages that are assumed to have the same access frequencies into a region. As long as the assumption (pages in a region have the same access frequencies) is kept, only one page in the region is required to be checked. Thus, for each ``sampling interval``, 1. the 'prepare_access_checks' primitive picks one page in each region, 2. waits for one ``sampling interval``, 3. checks whether the page is accessed meanwhile, and 4. increases the access count of the region if so. Therefore, the monitoring overhead is controllable by adjusting the number of regions. DAMON allows both the underlying primitives and user callbacks to adjust regions for the trade-off. In other words, this commit makes DAMON to use not only time-based sampling but also space-based sampling. This scheme, however, cannot preserve the quality of the output if the assumption is not guaranteed. Next commit will address this problem. Link: https://lkml.kernel.org/r/20210716081449.22187-3-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Fernand Sieber Acked-by: Shakeel Butt Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Brendan Higgins Cc: David Hildenbrand Cc: David Rientjes Cc: David Woodhouse Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Ingo Molnar Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Marco Elver Cc: Markus Boehme Cc: Maximilian Heyne Cc: Mel Gorman Cc: Minchan Kim Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: Shuah Khan Cc: Steven Rostedt (VMware) Cc: Vladimir Davydov Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2224d8485492e499ca2e5d25407f8502cc06f149 Author: SeongJae Park Date: Tue Sep 7 19:56:28 2021 -0700 mm: introduce Data Access MONitor (DAMON) Patch series "Introduce Data Access MONitor (DAMON)", v34. Introduction ============ DAMON is a data access monitoring framework for the Linux kernel. The core mechanisms of DAMON called 'region based sampling' and 'adaptive regions adjustment' (refer to 'mechanisms.rst' in the 11th patch of this patchset for the detail) make it - accurate (The monitored information is useful for DRAM level memory management. It might not appropriate for Cache-level accuracy, though.), - light-weight (The monitoring overhead is low enough to be applied online while making no impact on the performance of the target workloads.), and - scalable (the upper-bound of the instrumentation overhead is controllable regardless of the size of target workloads.). Using this framework, therefore, several memory management mechanisms such as reclamation and THP can be optimized to aware real data access patterns. Experimental access pattern aware memory management optimization works that incurring high instrumentation overhead will be able to have another try. Though DAMON is for kernel subsystems, it can be easily exposed to the user space by writing a DAMON-wrapper kernel subsystem. Then, user space users who have some special workloads will be able to write personalized tools or applications for deeper understanding and specialized optimizations of their systems. DAMON is also merged in two public Amazon Linux kernel trees that based on v5.4.y[1] and v5.10.y[2]. [1] https://github.com/amazonlinux/linux/tree/amazon-5.4.y/master/mm/damon [2] https://github.com/amazonlinux/linux/tree/amazon-5.10.y/master/mm/damon The userspace tool[1] is available, released under GPLv2, and actively being maintained. I am also planning to implement another basic user interface in perf[2]. Also, the basic test suite for DAMON is available under GPLv2[3]. [1] https://github.com/awslabs/damo [2] https://lore.kernel.org/linux-mm/20210107120729.22328-1-sjpark@amazon.com/ [3] https://github.com/awslabs/damon-tests Long-term Plan -------------- DAMON is a part of a project called Data Access-aware Operating System (DAOS). As the name implies, I want to improve the performance and efficiency of systems using fine-grained data access patterns. The optimizations are for both kernel and user spaces. I will therefore modify or create kernel subsystems, export some of those to user space and implement user space library / tools. Below shows the layers and components for the project. --------------------------------------------------------------------------- Primitives: PTE Accessed bit, PG_idle, rmap, (Intel CMT), ... Framework: DAMON Features: DAMOS, virtual addr, physical addr, ... Applications: DAMON-debugfs, (DARC), ... ^^^^^^^^^^^^^^^^^^^^^^^ KERNEL SPACE ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Raw Interface: debugfs, (sysfs), (damonfs), tracepoints, (sys_damon), ... vvvvvvvvvvvvvvvvvvvvvvv USER SPACE vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv Library: (libdamon), ... Tools: DAMO, (perf), ... --------------------------------------------------------------------------- The components in parentheses or marked as '...' are not implemented yet but in the future plan. IOW, those are the TODO tasks of DAOS project. For more detail, please refer to the plans: https://lore.kernel.org/linux-mm/20201202082731.24828-1-sjpark@amazon.com/ Evaluations =========== We evaluated DAMON's overhead, monitoring quality and usefulness using 24 realistic workloads on my QEMU/KVM based virtual machine running a kernel that v24 DAMON patchset is applied. DAMON is lightweight. It increases system memory usage by 0.39% and slows target workloads down by 1.16%. DAMON is accurate and useful for memory management optimizations. An experimental DAMON-based operation scheme for THP, namely 'ethp', removes 76.15% of THP memory overheads while preserving 51.25% of THP speedup. Another experimental DAMON-based 'proactive reclamation' implementation, 'prcl', reduces 93.38% of residential sets and 23.63% of system memory footprint while incurring only 1.22% runtime overhead in the best case (parsec3/freqmine). NOTE that the experimental THP optimization and proactive reclamation are not for production but only for proof of concepts. Please refer to the official document[1] or "Documentation/admin-guide/mm: Add a document for DAMON" patch in this patchset for detailed evaluation setup and results. [1] https://damonitor.github.io/doc/html/latest-damon/admin-guide/mm/damon/eval.html Real-world User Story ===================== In summary, DAMON has used on production systems and proved its usefulness. DAMON as a profiler ------------------- We analyzed characteristics of a large scale production systems of our customers using DAMON. The systems utilize 70GB DRAM and 36 CPUs. From this, we were able to find interesting things below. There were obviously different access pattern under idle workload and active workload. Under the idle workload, it accessed large memory regions with low frequency, while the active workload accessed small memory regions with high freuqnecy. DAMON found a 7GB memory region that showing obviously high access frequency under the active workload. We believe this is the performance-effective working set and need to be protected. There was a 4KB memory region that showing highest access frequency under not only active but also idle workloads. We think this must be a hottest code section like thing that should never be paged out. For this analysis, DAMON used only 0.3-1% of single CPU time. Because we used recording-based analysis, it consumed about 3-12 MB of disk space per 20 minutes. This is only small amount of disk space, but we can further reduce the disk usage by using non-recording-based DAMON features. I'd like to argue that only DAMON can do such detailed analysis (finding 4KB highest region in 70GB memory) with the light overhead. DAMON as a system optimization tool ----------------------------------- We also found below potential performance problems on the systems and made DAMON-based solutions. The system doesn't want to make the workload suffer from the page reclamation and thus it utilizes enough DRAM but no swap device. However, we found the system is actively reclaiming file-backed pages, because the system has intensive file IO. The file IO turned out to be not performance critical for the workload, but the customer wanted to ensure performance critical file-backed pages like code section to not mistakenly be evicted. Using direct IO should or `mlock()` would be a straightforward solution, but modifying the user space code is not easy for the customer. Alternatively, we could use DAMON-based operation scheme[1]. By using it, we can ask DAMON to track access frequency of each region and make 'process_madvise(MADV_WILLNEED)[2]' call for regions having specific size and access frequency for a time interval. We also found the system is having high number of TLB misses. We tried 'always' THP enabled policy and it greatly reduced TLB misses, but the page reclamation also been more frequent due to the THP internal fragmentation caused memory bloat. We could try another DAMON-based operation scheme that applies 'MADV_HUGEPAGE' to memory regions having >=2MB size and high access frequency, while applying 'MADV_NOHUGEPAGE' to regions having <2MB size and low access frequency. We do not own the systems so we only reported the analysis results and possible optimization solutions to the customers. The customers satisfied about the analysis results and promised to try the optimization guides. [1] https://lore.kernel.org/linux-mm/20201006123931.5847-1-sjpark@amazon.com/ [2] https://lore.kernel.org/linux-api/20200622192900.22757-4-minchan@kernel.org/ Comparison with Idle Page Tracking ================================== Idle Page Tracking allows users to set and read idleness of pages using a bitmap file which represents each page with each bit of the file. One recommended usage of it is working set size detection. Users can do that by 1. find PFN of each page for workloads in interest, 2. set all the pages as idle by doing writes to the bitmap file, 3. wait until the workload accesses its working set, and 4. read the idleness of the pages again and count pages became not idle. NOTE: While Idle Page Tracking is for user space users, DAMON is primarily designed for kernel subsystems though it can easily exposed to the user space. Hence, this section only assumes such user space use of DAMON. For what use cases Idle Page Tracking would be better? ------------------------------------------------------ 1. Flexible usecases other than hotness monitoring. Because Idle Page Tracking allows users to control the primitive (Page idleness) by themselves, Idle Page Tracking users can do anything they want. Meanwhile, DAMON is primarily designed to monitor the hotness of each memory region. For this, DAMON asks users to provide sampling interval and aggregation interval. For the reason, there could be some use case that using Idle Page Tracking is simpler. 2. Physical memory monitoring. Idle Page Tracking receives PFN range as input, so natively supports physical memory monitoring. DAMON is designed to be extensible for multiple address spaces and use cases by implementing and using primitives for the given use case. Therefore, by theory, DAMON has no limitation in the type of target address space as long as primitives for the given address space exists. However, the default primitives introduced by this patchset supports only virtual address spaces. Therefore, for physical memory monitoring, you should implement your own primitives and use it, or simply use Idle Page Tracking. Nonetheless, RFC patchsets[1] for the physical memory address space primitives is already available. It also supports user memory same to Idle Page Tracking. [1] https://lore.kernel.org/linux-mm/20200831104730.28970-1-sjpark@amazon.com/ For what use cases DAMON is better? ----------------------------------- 1. Hotness Monitoring. Idle Page Tracking let users know only if a page frame is accessed or not. For hotness check, the user should write more code and use more memory. DAMON do that by itself. 2. Low Monitoring Overhead DAMON receives user's monitoring request with one step and then provide the results. So, roughly speaking, DAMON require only O(1) user/kernel context switches. In case of Idle Page Tracking, however, because the interface receives contiguous page frames, the number of user/kernel context switches increases as the monitoring target becomes complex and huge. As a result, the context switch overhead could be not negligible. Moreover, DAMON is born to handle with the monitoring overhead. Because the core mechanism is pure logical, Idle Page Tracking users might be able to implement the mechanism on their own, but it would be time consuming and the user/kernel context switching will still more frequent than that of DAMON. Also, the kernel subsystems cannot use the logic in this case. 3. Page granularity working set size detection. Until v22 of this patchset, this was categorized as the thing Idle Page Tracking could do better, because DAMON basically maintains additional metadata for each of the monitoring target regions. So, in the page granularity working set size detection use case, DAMON would incur (number of monitoring target pages * size of metadata) memory overhead. Size of the single metadata item is about 54 bytes, so assuming 4KB pages, about 1.3% of monitoring target pages will be additionally used. All essential metadata for Idle Page Tracking are embedded in 'struct page' and page table entries. Therefore, in this use case, only one counter variable for working set size accounting is required if Idle Page Tracking is used. There are more details to consider, but roughly speaking, this is true in most cases. However, the situation changed from v23. Now DAMON supports arbitrary types of monitoring targets, which don't use the metadata. Using that, DAMON can do the working set size detection with no additional space overhead but less user-kernel context switch. A first draft for the implementation of monitoring primitives for this usage is available in a DAMON development tree[1]. An RFC patchset for it based on this patchset will also be available soon. Since v24, the arbitrary type support is dropped from this patchset because this patchset doesn't introduce real use of the type. You can still get it from the DAMON development tree[2], though. [1] https://github.com/sjp38/linux/tree/damon/pgidle_hack [2] https://github.com/sjp38/linux/tree/damon/master 4. More future usecases While Idle Page Tracking has tight coupling with base primitives (PG_Idle and page table Accessed bits), DAMON is designed to be extensible for many use cases and address spaces. If you need some special address type or want to use special h/w access check primitives, you can write your own primitives for that and configure DAMON to use those. Therefore, if your use case could be changed a lot in future, using DAMON could be better. Can I use both Idle Page Tracking and DAMON? -------------------------------------------- Yes, though using them concurrently for overlapping memory regions could result in interference to each other. Nevertheless, such use case would be rare or makes no sense at all. Even in the case, the noise would bot be really significant. So, you can choose whatever you want depending on the characteristics of your use cases. More Information ================ We prepared a showcase web site[1] that you can get more information. There are - the official documentations[2], - the heatmap format dynamic access pattern of various realistic workloads for heap area[3], mmap()-ed area[4], and stack[5] area, - the dynamic working set size distribution[6] and chronological working set size changes[7], and - the latest performance test results[8]. [1] https://damonitor.github.io/_index [2] https://damonitor.github.io/doc/html/latest-damon [3] https://damonitor.github.io/test/result/visual/latest/rec.heatmap.0.png.html [4] https://damonitor.github.io/test/result/visual/latest/rec.heatmap.1.png.html [5] https://damonitor.github.io/test/result/visual/latest/rec.heatmap.2.png.html [6] https://damonitor.github.io/test/result/visual/latest/rec.wss_sz.png.html [7] https://damonitor.github.io/test/result/visual/latest/rec.wss_time.png.html [8] https://damonitor.github.io/test/result/perf/latest/html/index.html Baseline and Complete Git Trees =============================== The patches are based on the latest -mm tree, specifically v5.14-rc1-mmots-2021-07-15-18-47 of https://github.com/hnaz/linux-mm. You can also clone the complete git tree: $ git clone git://github.com/sjp38/linux -b damon/patches/v34 The web is also available: https://github.com/sjp38/linux/releases/tag/damon/patches/v34 Development Trees ----------------- There are a couple of trees for entire DAMON patchset series and features for future release. - For latest release: https://github.com/sjp38/linux/tree/damon/master - For next release: https://github.com/sjp38/linux/tree/damon/next Long-term Support Trees ----------------------- For people who want to test DAMON but using LTS kernels, there are another couple of trees based on two latest LTS kernels respectively and containing the 'damon/master' backports. - For v5.4.y: https://github.com/sjp38/linux/tree/damon/for-v5.4.y - For v5.10.y: https://github.com/sjp38/linux/tree/damon/for-v5.10.y Amazon Linux Kernel Trees ------------------------- DAMON is also merged in two public Amazon Linux kernel trees that based on v5.4.y[1] and v5.10.y[2]. [1] https://github.com/amazonlinux/linux/tree/amazon-5.4.y/master/mm/damon [2] https://github.com/amazonlinux/linux/tree/amazon-5.10.y/master/mm/damon Git Tree for Diff of Patches ============================ For easy review of diff between different versions of each patch, I prepared a git tree containing all versions of the DAMON patchset series: https://github.com/sjp38/damon-patches You can clone it and use 'diff' for easy review of changes between different versions of the patchset. For example: $ git clone https://github.com/sjp38/damon-patches && cd damon-patches $ diff -u damon/v33 damon/v34 Sequence Of Patches =================== First three patches implement the core logics of DAMON. The 1st patch introduces basic sampling based hotness monitoring for arbitrary types of targets. Following two patches implement the core mechanisms for control of overhead and accuracy, namely regions based sampling (patch 2) and adaptive regions adjustment (patch 3). Now the essential parts of DAMON is complete, but it cannot work unless someone provides monitoring primitives for a specific use case. The following two patches make it just work for virtual address spaces monitoring. The 4th patch makes 'PG_idle' can be used by DAMON and the 5th patch implements the virtual memory address space specific monitoring primitives using page table Accessed bits and the 'PG_idle' page flag. Now DAMON just works for virtual address space monitoring via the kernel space api. To let the user space users can use DAMON, following four patches add interfaces for them. The 6th patch adds a tracepoint for monitoring results. The 7th patch implements a DAMON application kernel module, namely damon-dbgfs, that simply wraps DAMON and exposes DAMON interface to the user space via the debugfs interface. The 8th patch further exports pid of monitoring thread (kdamond) to user space for easier cpu usage accounting, and the 9th patch makes the debugfs interface to support multiple contexts. Three patches for maintainability follows. The 10th patch adds documentations for both the user space and the kernel space. The 11th patch provides unit tests (based on the kunit) while the 12th patch adds user space tests (based on the kselftest). Finally, the last patch (13th) updates the MAINTAINERS file. This patch (of 13): DAMON is a data access monitoring framework for the Linux kernel. The core mechanisms of DAMON make it - accurate (the monitoring output is useful enough for DRAM level performance-centric memory management; It might be inappropriate for CPU cache levels, though), - light-weight (the monitoring overhead is normally low enough to be applied online), and - scalable (the upper-bound of the overhead is in constant range regardless of the size of target workloads). Using this framework, hence, we can easily write efficient kernel space data access monitoring applications. For example, the kernel's memory management mechanisms can make advanced decisions using this. Experimental data access aware optimization works that incurring high access monitoring overhead could again be implemented on top of this. Due to its simple and flexible interface, providing user space interface would be also easy. Then, user space users who have some special workloads can write personalized applications for better understanding and optimizations of their workloads and systems. === Nevertheless, this commit is defining and implementing only basic access check part without the overhead-accuracy handling core logic. The basic access check is as below. The output of DAMON says what memory regions are how frequently accessed for a given duration. The resolution of the access frequency is controlled by setting ``sampling interval`` and ``aggregation interval``. In detail, DAMON checks access to each page per ``sampling interval`` and aggregates the results. In other words, counts the number of the accesses to each region. After each ``aggregation interval`` passes, DAMON calls callback functions that previously registered by users so that users can read the aggregated results and then clears the results. This can be described in below simple pseudo-code:: init() while monitoring_on: for page in monitoring_target: if accessed(page): nr_accesses[page] += 1 if time() % aggregation_interval == 0: for callback in user_registered_callbacks: callback(monitoring_target, nr_accesses) for page in monitoring_target: nr_accesses[page] = 0 if time() % update_interval == 0: update() sleep(sampling interval) The target regions constructed at the beginning of the monitoring and updated after each ``regions_update_interval``, because the target regions could be dynamically changed (e.g., mmap() or memory hotplug). The monitoring overhead of this mechanism will arbitrarily increase as the size of the target workload grows. The basic monitoring primitives for actual access check and dynamic target regions construction aren't in the core part of DAMON. Instead, it allows users to implement their own primitives that are optimized for their use case and configure DAMON to use those. In other words, users cannot use current version of DAMON without some additional works. Following commits will implement the core mechanisms for the overhead-accuracy control and default primitives implementations. Link: https://lkml.kernel.org/r/20210716081449.22187-1-sj38.park@gmail.com Link: https://lkml.kernel.org/r/20210716081449.22187-2-sj38.park@gmail.com Signed-off-by: SeongJae Park Reviewed-by: Leonard Foerster Reviewed-by: Fernand Sieber Acked-by: Shakeel Butt Cc: Jonathan Cameron Cc: Alexander Shishkin Cc: Amit Shah Cc: Benjamin Herrenschmidt Cc: Jonathan Corbet Cc: David Hildenbrand Cc: David Woodhouse Cc: Marco Elver Cc: Fan Du Cc: Greg Kroah-Hartman Cc: Greg Thelen Cc: Joe Perches Cc: Mel Gorman Cc: Maximilian Heyne Cc: Minchan Kim Cc: Ingo Molnar Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rik van Riel Cc: David Rientjes Cc: Steven Rostedt (VMware) Cc: Shuah Khan Cc: Vlastimil Babka Cc: Vladimir Davydov Cc: Brendan Higgins Cc: Markus Boehme Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c40c6e593bf978e232bae1fab81f4111f2e2c956 Author: Marco Elver Date: Tue Sep 7 19:56:24 2021 -0700 kfence: test: fail fast if disabled at boot Fail kfence_test fast if KFENCE was disabled at boot, instead of each test case trying several seconds to allocate from KFENCE and failing. KUnit will fail all test cases if kunit_suite::init returns an error. Even if KFENCE was disabled, we still want the test to fail, so that CI systems that parse KUnit output will alert on KFENCE being disabled (accidentally or otherwise). Link: https://lkml.kernel.org/r/20210825105533.1247922-1-elver@google.com Signed-off-by: Marco Elver Reported-by: Kefeng Wang Tested-by: Kefeng Wang Acked-by: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4bbf04aa9aa88ae41205e387d35743a9bf5e933d Author: Marco Elver Date: Tue Sep 7 19:56:21 2021 -0700 kfence: show cpu and timestamp in alloc/free info Record cpu and timestamp on allocations and frees, and show them in reports. Upon an error, this can help correlate earlier messages in the kernel log via allocation and free timestamps. Link: https://lkml.kernel.org/r/20210714175312.2947941-1-elver@google.com Suggested-by: Joern Engel Signed-off-by: Marco Elver Acked-by: Alexander Potapenko Acked-by: Joern Engel Cc: Yuanyuan Zhong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 110860541f443f950c1274f217a1a3e298670a33 Author: Jordy Zomer Date: Tue Sep 7 19:56:18 2021 -0700 mm/secretmem: use refcount_t instead of atomic_t When a secret memory region is active, memfd_secret disables hibernation. One of the goals is to keep the secret data from being written to persistent-storage. It accomplishes this by maintaining a reference count to `secretmem_users`. Once this reference is held your system can not be hibernated due to the check in `hibernation_available()`. However, because `secretmem_users` is of type `atomic_t`, reference counter overflows are possible. As you can see there's an `atomic_inc` for each `memfd` that is opened in the `memfd_secret` syscall. If a local attacker succeeds to open 2^32 memfd's, the counter will wrap around to 0. This implies that you may hibernate again, even though there are still regions of this secret memory, thereby bypassing the security check. In an attempt to fix this I have used `refcount_t` instead of `atomic_t` which prevents reference counter overflows. Link: https://lkml.kernel.org/r/20210820043339.2151352-1-jordy@pwning.systems Signed-off-by: Jordy Zomer Cc: Kees Cook , Cc: Jordy Zomer Cc: James Bottomley Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 41c961b9013ee9b6d0491f6926df546e37964b1f Author: Muchun Song Date: Tue Sep 7 19:56:15 2021 -0700 mm: introduce PAGEFLAGS_MASK to replace ((1UL << NR_PAGEFLAGS) - 1) Instead of hard-coding ((1UL << NR_PAGEFLAGS) - 1) everywhere, introducing PAGEFLAGS_MASK to make the code clear to get the page flags. Link: https://lkml.kernel.org/r/20210819150712.59948-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Roman Gushchin Acked-by: Johannes Weiner Reviewed-by: Shakeel Butt Cc: Michal Hocko Cc: Vladimir Davydov Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ea0eafead4b66543b8218ebfbe14173315feb7d1 Author: Changbin Du Date: Tue Sep 7 19:56:12 2021 -0700 mm: in_irq() cleanup Replace the obsolete and ambiguos macro in_irq() with new macro in_hardirq(). Link: https://lkml.kernel.org/r/20210813145245.86070-1-changbin.du@gmail.com Signed-off-by: Changbin Du Acked-by: Catalin Marinas [kmemleak] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 513861202d1259e35934e206b79cd54f523d79b5 Author: Sebastian Andrzej Siewior Date: Tue Sep 7 19:56:09 2021 -0700 highmem: don't disable preemption on RT in kmap_atomic() kmap_atomic() disables preemption and pagefaults for historical reasons. The conversion to kmap_local(), which only disables migration, cannot be done wholesale because quite some call sites need to be updated to accommodate with the changed semantics. On PREEMPT_RT enabled kernels the kmap_atomic() semantics are problematic due to the implicit disabling of preemption which makes it impossible to acquire 'sleeping' spinlocks within the kmap atomic sections. PREEMPT_RT replaces the preempt_disable() with a migrate_disable() for more than a decade. It could be argued that this is a justification to do this unconditionally, but PREEMPT_RT covers only a limited number of architectures and it disables some functionality which limits the coverage further. Limit the replacement to PREEMPT_RT for now. Link: https://lkml.kernel.org/r/20210810091116.pocdmaatdcogvdso@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Acked-by: Vlastimil Babka Cc: Thomas Gleixner Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 395519b4b6e82741f29aaf6defa66cbdf3466584 Author: Weizhao Ouyang Date: Tue Sep 7 19:56:06 2021 -0700 mm/early_ioremap.c: remove redundant early_ioremap_shutdown() early_ioremap_reset() reserved a weak function so that architectures can provide a specific cleanup. Now no architectures use it, remove this redundant function. Link: https://lkml.kernel.org/r/20210901082917.399953-1-o451686892@gmail.com Signed-off-by: Weizhao Ouyang Reviewed-by: David Hildenbrand Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8491502f787c4a902bd4f223b578ef47d3490264 Author: Christoph Hellwig Date: Tue Sep 7 19:56:04 2021 -0700 mm: don't allow executable ioremap mappings There is no need to execute from iomem (and most platforms it is impossible anyway), so add the pgprot_nx() call similar to vmap. Link: https://lkml.kernel.org/r/20210824091259.1324527-3-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Nicholas Piggin Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 82a70ce0426dd7c4099516175019dccbd18cebf9 Author: Christoph Hellwig Date: Tue Sep 7 19:56:01 2021 -0700 mm: move ioremap_page_range to vmalloc.c Patch series "small ioremap cleanups". The first patch moves a little code around the vmalloc/ioremap boundary following a bigger move by Nick earlier. The second enforces non-executable mapping on ioremap just like we do for vmap. No driver currently uses executable mappings anyway, as they should. This patch (of 2): This keeps it together with the implementation, and to remove the vmap_range wrapper. Link: https://lkml.kernel.org/r/20210824091259.1324527-1-hch@lst.de Link: https://lkml.kernel.org/r/20210824091259.1324527-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Nicholas Piggin Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8350229ffceb372621e277d4d36f1ffca6212135 Author: Christoph Hellwig Date: Tue Sep 7 19:55:58 2021 -0700 riscv: only select GENERIC_IOREMAP if MMU support is enabled nommu ioremap is an inline stub in asm-generic/io.h. Link: https://lkml.kernel.org/r/20210825072036.GA29161@lst.de Signed-off-by: Christoph Hellwig Cc: Nicholas Piggin Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe3df441ef885a75a3eff5e151ead1a92266d222 Author: Muchun Song Date: Tue Sep 7 19:55:55 2021 -0700 mm: remove redundant compound_head() calling There is a READ_ONCE() in the macro of compound_head(), which will prevent compiler from optimizing the code when there are more than once calling of it in a function. Remove the redundant calling of compound_head() from page_to_index() and page_add_file_rmap() for better code generation. Link: https://lkml.kernel.org/r/20210811101431.83940-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: David Howells Cc: Matthew Wilcox (Oracle) Cc: William Kucharski Cc: Kirill A. Shutemov Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5ef5f810199f421cb6455aa018fb8f21151b4a16 Author: Miaohe Lin Date: Tue Sep 7 19:55:52 2021 -0700 mm/memory_hotplug: use helper zone_is_zone_device() to simplify the code Patch series "Cleanup and fixups for memory hotplug". This series contains cleanup to use helper function to simplify the code. Also we fix some potential bugs. More details can be found in the respective changelogs. This patch (of 3): Use helper zone_is_zone_device() to simplify the code and remove some explicit CONFIG_ZONE_DEVICE codes. Link: https://lkml.kernel.org/r/20210821094246.10149-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210821094246.10149-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Naoya Horiguchi Cc: Michal Hocko Cc: Minchan Kim Cc: Chris Goldsworthy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3fcebf90209a7f52d384ad7701425aa91be309ab Author: David Hildenbrand Date: Tue Sep 7 19:55:48 2021 -0700 mm/memory_hotplug: improved dynamic memory group aware "auto-movable" online policy Currently, the "auto-movable" online policy does not allow for hotplugged KERNEL (ZONE_NORMAL) memory to increase the amount of MOVABLE memory we can have, primarily, because there is no coordiantion across memory devices and we don't want to create zone-imbalances accidentially when unplugging memory. However, within a single memory device it's different. Let's allow for KERNEL memory within a dynamic memory group to allow for more MOVABLE within the same memory group. The only thing we have to take care of is that the managing driver avoids zone imbalances by unplugging MOVABLE memory first, otherwise there can be corner cases where unplug of memory could result in (accidential) zone imbalances. virtio-mem is the only user of dynamic memory groups and recently added support for prioritizing unplug of ZONE_MOVABLE over ZONE_NORMAL, so we don't need a new toggle to enable it for dynamic memory groups. We limit this handling to dynamic memory groups, because: * We want to keep the runtime overhead for collecting stats when onlining a single memory block small. We tend to have only a handful of dynamic memory groups, but we can have quite some static memory groups (e.g., 256 DIMMs). * It doesn't make too much sense for static memory groups, as we try onlining all applicable memory blocks either completely to ZONE_MOVABLE or not. In ordinary operation, we won't have a mixture of zones within a static memory group. When adding memory to a dynamic memory group, we'll first online memory to ZONE_MOVABLE as long as early KERNEL memory allows for it. Then, we'll online the next unit(s) to ZONE_NORMAL, until we can online the next unit(s) to ZONE_MOVABLE. For a simple virtio-mem device with a MOVABLE:KERNEL ratio of 3:1, it will result in a layout like: [M][M][M][M][M][M][M][M][N][M][M][M][N][M][M][M]... ^ movable memory due to early kernel memory ^ allows for more movable memory ... ^-----^ ... here ^ allows for more movable memory ... ^-----^ ... here While the created layout is sub-optimal when it comes to contiguous zones, it gives us the maximum flexibility when dynamically growing/shrinking a device; we can grow small VMs really big in small steps, and still shrink reliably to e.g., 1/4 of the maximum VM size in this example, removing full memory blocks along with meta data more reliably. Mark dynamic memory groups in the xarray such that we can efficiently iterate over them when collecting stats. In usual setups, we have one virtio-mem device per NUMA node, and usually only a small number of NUMA nodes. Note: for now, there seems to be no compelling reason to make this behavior configurable. Link: https://lkml.kernel.org/r/20210806124715.17090-10-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 445fcf7c721450dd1d4ec6c217b3c6a932602a44 Author: David Hildenbrand Date: Tue Sep 7 19:55:45 2021 -0700 mm/memory_hotplug: memory group aware "auto-movable" online policy Use memory groups to improve our "auto-movable" onlining policy: 1. For static memory groups (e.g., a DIMM), online a memory block MOVABLE only if all other memory blocks in the group are either MOVABLE or could be onlined MOVABLE. A DIMM will either be MOVABLE or not, not a mixture. 2. For dynamic memory groups (e.g., a virtio-mem device), online a memory block MOVABLE only if all other memory blocks inside the current unit are either MOVABLE or could be onlined MOVABLE. For a virtio-mem device with a device block size with 512 MiB, all 128 MiB memory blocks wihin a 512 MiB unit will either be MOVABLE or not, not a mixture. We have to pass the memory group to zone_for_pfn_range() to take the memory group into account. Note: for now, there seems to be no compelling reason to make this behavior configurable. Link: https://lkml.kernel.org/r/20210806124715.17090-9-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ffaa6ce835eaf0fe3eb05ff931de3c1134b07f35 Author: David Hildenbrand Date: Tue Sep 7 19:55:41 2021 -0700 virtio-mem: use a single dynamic memory group for a single virtio-mem device Let's use a single dynamic memory group. Link: https://lkml.kernel.org/r/20210806124715.17090-8-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eedf634aac3b85b70e7b139c32fc68f565ecf815 Author: David Hildenbrand Date: Tue Sep 7 19:55:37 2021 -0700 dax/kmem: use a single static memory group for a single probed unit Although dax/kmem users often disable auto-onlining and instead online memory manually (usually to ZONE_MOVABLE), there is still value in having auto-onlining be aware of the relationship of memory blocks. Let's treat one probed unit as a single static memory device, similar to a single ACPI memory device. Link: https://lkml.kernel.org/r/20210806124715.17090-7-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2a1578397a16fc18677c0c434db792182ba551ed Author: David Hildenbrand Date: Tue Sep 7 19:55:34 2021 -0700 ACPI: memhotplug: use a single static memory group for a single memory device Let's group all memory we add for a single memory device - we want a single node for that (which also seems to be the sane thing to do). We won't care for now about memory that was already added to the system (e.g., via e820) -- usually *all* memory of a memory device was already added and we'll fail acpi_memory_enable_device(). Link: https://lkml.kernel.org/r/20210806124715.17090-6-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Rafael J. Wysocki Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 836809ec75cc07c6d07c43036e3844affbe0d46f Author: David Hildenbrand Date: Tue Sep 7 19:55:30 2021 -0700 mm/memory_hotplug: track present pages in memory groups Let's track all present pages in each memory group. Especially, track memory present in ZONE_MOVABLE and memory present in one of the kernel zones (which really only is ZONE_NORMAL right now as memory groups only apply to hotplugged memory) separately within a memory group, to prepare for making smart auto-online decision for individual memory blocks within a memory group based on group statistics. Link: https://lkml.kernel.org/r/20210806124715.17090-5-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 028fc57a1c361116e3bcebfeba4ca87878baaf4f Author: David Hildenbrand Date: Tue Sep 7 19:55:26 2021 -0700 drivers/base/memory: introduce "memory groups" to logically group memory blocks In our "auto-movable" memory onlining policy, we want to make decisions across memory blocks of a single memory device. Examples of memory devices include ACPI memory devices (in the simplest case a single DIMM) and virtio-mem. For now, we don't have a connection between a single memory block device and the real memory device. Each memory device consists of 1..X memory block devices. Let's logically group memory blocks belonging to the same memory device in "memory groups". Memory groups can span multiple physical ranges and a memory group itself does not contain any information regarding physical ranges, only properties (e.g., "max_pages") necessary for improved memory onlining. Introduce two memory group types: 1) Static memory group: E.g., a single ACPI memory device, consisting of 1..X memory resources. A memory group consists of 1..Y memory blocks. The whole group is added/removed in one go. If any part cannot get offlined, the whole group cannot be removed. 2) Dynamic memory group: E.g., a single virtio-mem device. Memory is dynamically added/removed in a fixed granularity, called a "unit", consisting of 1..X memory blocks. A unit is added/removed in one go. If any part of a unit cannot get offlined, the whole unit cannot be removed. In case of 1) we usually want either all memory managed by ZONE_MOVABLE or none. In case of 2) we usually want to have as many units as possible managed by ZONE_MOVABLE. We want a single unit to be of the same type. For now, memory groups are an internal concept that is not exposed to user space; we might want to change that in the future, though. add_memory() users can specify a mgid instead of a nid when passing the MHP_NID_IS_MGID flag. Link: https://lkml.kernel.org/r/20210806124715.17090-4-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e83a437faa625efb2e70924fd3c32ba95610c502 Author: David Hildenbrand Date: Tue Sep 7 19:55:23 2021 -0700 mm/memory_hotplug: introduce "auto-movable" online policy When onlining without specifying a zone (using "online" instead of "online_kernel" or "online_movable"), we currently select a zone such that existing zones are kept contiguous. This online policy made sense in the past, where contiguous zones where required. We'd like to implement smarter policies, however: * User space has little insight. As one example, it has no idea which memory blocks logically belong together (e.g., to a DIMM or to a virtio-mem device). * Drivers that add memory in separate memory blocks, especially virtio-mem, want memory to get onlined right from the kernel when adding. So we really want to have onlining to differing zones managed in the kernel, configured by user space. We see more and more cases where we might eventually hotplug a lot of memory in the future (e.g., eventually grow a 2 GiB VM to 64 GiB), however: * Resizing happens dynamically, in smaller steps in both directions (e.g., 2 GiB -> 8 GiB -> 4 GiB -> 16 GiB ...) * We still want as much flexibility as possible, especially, hotunplugging as much memory as possible later. We can really only use "online_movable" if we know that the amount of memory we are going to hotplug upfront, and we know that it won't result in a zone imbalance. So in our example, a 2 GiB VM that could grow to 64 GiB could currently not use "online_movable", and instead, "online_kernel" would have to be used, resulting in worse (no) memory hotunplug reliability. Let's add a new "auto-movable" online policy that considers the current zone ratios (global, per-node) to determine, whether we a memory block can be onlined to ZONE_MOVABLE: MOVABLE : KERNEL However, internally we'll only consider the following ratio for now: MOVABLE : KERNEL_EARLY For now, we don't allow for hotplugged KERNEL memory to allow for more MOVABLE memory, because there is no coordination across memory devices. In follow-up patches, we will allow for more KERNEL memory within a memory device to allow for more MOVABLE memory within the same memory device -- which only makes sense for special memory device types. We base our calculation on "present pages", see the code comments for details. Hotplugged memory will get online to ZONE_MOVABLE if the configured ratio allows for it. Depending on the setup, this can result in fragmented zones, which can make compaction slower and dynamic allocation of gigantic pages when not using CMA less reliable (... which is already pretty unreliable). The old policy will be the default and called "contig-zones". In follow-up patches, our new policy will use additional information, such as memory groups, to make even smarter decisions across memory blocks. Configuration: * memory_hotplug.online_policy is used to switch between both polices and defaults to "contig-zones". * memory_hotplug.auto_movable_ratio defines the maximum ratio is in percent and defaults to "301" -- allowing e.g., most 8 GiB machines to grow to 32 GiB and have all hotplugged memory in ZONE_MOVABLE. The additional percent accounts for a handful of lost present pages (e.g., firmware allocations). User space is expected to adjust this ratio when enabling the new "auto-movable" policy, though. * memory_hotplug.auto_movable_numa_aware considers numa node stats in addition to global stats, and defaults to "true". Note: just like the old policy, the new policy won't take things like unmovable huge pages or memory ballooning that doesn't support balloon compaction into account. User space has to configure onlining accordingly. Link: https://lkml.kernel.org/r/20210806124715.17090-3-david@redhat.com Signed-off-by: David Hildenbrand Cc: Anshuman Khandual Cc: Dan Williams Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Hui Zhu Cc: Jason Wang Cc: Len Brown Cc: Marek Kedzierski Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b0970024408afb17886e0c76e9761c4264db2a8 Author: David Hildenbrand Date: Tue Sep 7 19:55:19 2021 -0700 mm: track present early pages per zone Patch series "mm/memory_hotplug: "auto-movable" online policy and memory groups", v3. I. Goal The goal of this series is improving in-kernel auto-online support. It tackles the fundamental problems that: 1) We can create zone imbalances when onlining all memory blindly to ZONE_MOVABLE, in the worst case crashing the system. We have to know upfront how much memory we are going to hotplug such that we can safely enable auto-onlining of all hotplugged memory to ZONE_MOVABLE via "online_movable". This is far from practical and only applicable in limited setups -- like inside VMs under the RHV/oVirt hypervisor which will never hotplug more than 3 times the boot memory (and the limitation is only in place due to the Linux limitation). 2) We see more setups that implement dynamic VM resizing, hot(un)plugging memory to resize VM memory. In these setups, we might hotplug a lot of memory, but it might happen in various small steps in both directions (e.g., 2 GiB -> 8 GiB -> 4 GiB -> 16 GiB ...). virtio-mem is the primary driver of this upstream right now, performing such dynamic resizing NUMA-aware via multiple virtio-mem devices. Onlining all hotplugged memory to ZONE_NORMAL means we basically have no hotunplug guarantees. Onlining all to ZONE_MOVABLE means we can easily run into zone imbalances when growing a VM. We want a mixture, and we want as much memory as reasonable/configured in ZONE_MOVABLE. Details regarding zone imbalances can be found at [1]. 3) Memory devices consist of 1..X memory block devices, however, the kernel doesn't really track the relationship. Consequently, also user space has no idea. We want to make per-device decisions. As one example, for memory hotunplug it doesn't make sense to use a mixture of zones within a single DIMM: we want all MOVABLE if possible, otherwise all !MOVABLE, because any !MOVABLE part will easily block the whole DIMM from getting hotunplugged. As another example, virtio-mem operates on individual units that span 1..X memory blocks. Similar to a DIMM, we want a unit to either be all MOVABLE or !MOVABLE. A "unit" can be thought of like a DIMM, however, all units of a virtio-mem device logically belong together and are managed (added/removed) by a single driver. We want as much memory of a virtio-mem device to be MOVABLE as possible. 4) We want memory onlining to be done right from the kernel while adding memory, not triggered by user space via udev rules; for example, this is reqired for fast memory hotplug for drivers that add individual memory blocks, like virito-mem. We want a way to configure a policy in the kernel and avoid implementing advanced policies in user space. The auto-onlining support we have in the kernel is not sufficient. All we have is a) online everything MOVABLE (online_movable) b) online everything !MOVABLE (online_kernel) c) keep zones contiguous (online). This series allows configuring c) to mean instead "online movable if possible according to the coniguration, driven by a maximum MOVABLE:KERNEL ratio" -- a new onlining policy. II. Approach This series does 3 things: 1) Introduces the "auto-movable" online policy that initially operates on individual memory blocks only. It uses a maximum MOVABLE:KERNEL ratio to make a decision whether a memory block will be onlined to ZONE_MOVABLE or not. However, in the basic form, hotplugged KERNEL memory does not allow for more MOVABLE memory (details in the patches). CMA memory is treated like MOVABLE memory. 2) Introduces static (e.g., DIMM) and dynamic (e.g., virtio-mem) memory groups and uses group information to make decisions in the "auto-movable" online policy across memory blocks of a single memory device (modeled as memory group). More details can be found in patch #3 or in the DIMM example below. 3) Maximizes ZONE_MOVABLE memory within dynamic memory groups, by allowing ZONE_NORMAL memory within a dynamic memory group to allow for more ZONE_MOVABLE memory within the same memory group. The target use case is dynamic VM resizing using virtio-mem. See the virtio-mem example below. I remember that the basic idea of using a ratio to implement a policy in the kernel was once mentioned by Vitaly Kuznetsov, but I might be wrong (I lost the pointer to that discussion). For me, the main use case is using it along with virtio-mem (and DIMMs / ppc64 dlpar where necessary) for dynamic resizing of VMs, increasing the amount of memory we can hotunplug reliably again if we might eventually hotplug a lot of memory to a VM. III. Target Usage The target usage will be: 1) Linux boots with "mhp_default_online_type=offline" 2) User space (e.g., systemd unit) configures memory onlining (according to a config file and system properties), for example: * Setting memory_hotplug.online_policy=auto-movable * Setting memory_hotplug.auto_movable_ratio=301 * Setting memory_hotplug.auto_movable_numa_aware=true 3) User space enabled auto onlining via "echo online > /sys/devices/system/memory/auto_online_blocks" 4) User space triggers manual onlining of all already-offline memory blocks (go over offline memory blocks and set them to "online") IV. Example For DIMMs, hotplugging 4 GiB DIMMs to a 4 GiB VM with a configured ratio of 301% results in the following layout: Memory block 0-15: DMA32 (early) Memory block 32-47: Normal (early) Memory block 48-79: Movable (DIMM 0) Memory block 80-111: Movable (DIMM 1) Memory block 112-143: Movable (DIMM 2) Memory block 144-275: Normal (DIMM 3) Memory block 176-207: Normal (DIMM 4) ... all Normal (-> hotplugged Normal memory does not allow for more Movable memory) For virtio-mem, using a simple, single virtio-mem device with a 4 GiB VM will result in the following layout: Memory block 0-15: DMA32 (early) Memory block 32-47: Normal (early) Memory block 48-143: Movable (virtio-mem, first 12 GiB) Memory block 144: Normal (virtio-mem, next 128 MiB) Memory block 145-147: Movable (virtio-mem, next 384 MiB) Memory block 148: Normal (virtio-mem, next 128 MiB) Memory block 149-151: Movable (virtio-mem, next 384 MiB) ... Normal/Movable mixture as above (-> hotplugged Normal memory allows for more Movable memory within the same device) Which gives us maximum flexibility when dynamically growing/shrinking a VM in smaller steps. V. Doc Update I'll update the memory-hotplug.rst documentation, once the overhaul [1] is usptream. Until then, details can be found in patch #2. VI. Future Work 1) Use memory groups for ppc64 dlpar 2) Being able to specify a portion of (early) kernel memory that will be excluded from the ratio. Like "128 MiB globally/per node" are excluded. This might be helpful when starting VMs with extremely small memory footprint (e.g., 128 MiB) and hotplugging memory later -- not wanting the first hotplugged units getting onlined to ZONE_MOVABLE. One alternative would be a trigger to not consider ZONE_DMA memory in the ratio. We'll have to see if this is really rrequired. 3) Indicate to user space that MOVABLE might be a bad idea -- especially relevant when memory ballooning without support for balloon compaction is active. This patch (of 9): For implementing a new memory onlining policy, which determines when to online memory blocks to ZONE_MOVABLE semi-automatically, we need the number of present early (boot) pages -- present pages excluding hotplugged pages. Let's track these pages per zone. Pass a page instead of the zone to adjust_present_page_count(), similar as adjust_managed_page_count() and derive the zone from the page. It's worth noting that a memory block to be offlined/onlined is either completely "early" or "not early". add_memory() and friends can only add complete memory blocks and we only online/offline complete (individual) memory blocks. Link: https://lkml.kernel.org/r/20210806124715.17090-1-david@redhat.com Link: https://lkml.kernel.org/r/20210806124715.17090-2-david@redhat.com Signed-off-by: David Hildenbrand Cc: Vitaly Kuznetsov Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Marek Kedzierski Cc: Hui Zhu Cc: Pankaj Gupta Cc: Wei Yang Cc: Oscar Salvador Cc: Michal Hocko Cc: Dan Williams Cc: Anshuman Khandual Cc: Dave Hansen Cc: Vlastimil Babka Cc: Mike Rapoport Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Pavel Tatashin Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 35ba0cd5290b2f1f92e1f0eb6de7ce7979f79728 Author: David Hildenbrand Date: Tue Sep 7 19:55:14 2021 -0700 ACPI: memhotplug: memory resources cannot be enabled yet We allocate + initialize everything from scratch. In case enabling the device fails, we free all memory resourcs. Link: https://lkml.kernel.org/r/20210712124052.26491-5-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Rafael J. Wysocki Reviewed-by: Oscar Salvador Reviewed-by: Pankaj Gupta Cc: Andy Lutomirski Cc: "Aneesh Kumar K.V" Cc: Anshuman Khandual Cc: Anton Blanchard Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christophe Leroy Cc: Dan Williams Cc: Dave Hansen Cc: Dave Jiang Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jason Wang Cc: Jia He Cc: Joe Perches Cc: Kefeng Wang Cc: Laurent Dufour Cc: Len Brown Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Michel Lespinasse Cc: Mike Rapoport Cc: Nathan Lynch Cc: Nicholas Piggin Cc: Pankaj Gupta Cc: Paul Mackerras Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Pierre Morel Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Scott Cheloha Cc: Sergei Trofimovich Cc: Thiago Jung Bauermann Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e1c158e4956612e7bada4c03dfb99210af4d6cde Author: David Hildenbrand Date: Tue Sep 7 19:55:09 2021 -0700 mm/memory_hotplug: remove nid parameter from remove_memory() and friends There is only a single user remaining. We can simply lookup the nid only used for node offlining purposes when walking our memory blocks. We don't expect to remove multi-nid ranges; and if we'd ever do, we most probably don't care about removing multi-nid ranges that actually result in empty nodes. If ever required, we can detect the "multi-nid" scenario and simply try offlining all online nodes. Link: https://lkml.kernel.org/r/20210712124052.26491-4-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michael Ellerman (powerpc) Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Dan Williams Cc: Vishal Verma Cc: Dave Jiang Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Nathan Lynch Cc: Laurent Dufour Cc: "Aneesh Kumar K.V" Cc: Scott Cheloha Cc: Anton Blanchard Cc: Andy Lutomirski Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Baoquan He Cc: Borislav Petkov Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Christophe Leroy Cc: Dave Hansen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jia He Cc: Joe Perches Cc: Kefeng Wang Cc: Michal Hocko Cc: Michel Lespinasse Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Pankaj Gupta Cc: Pankaj Gupta Cc: Pavel Tatashin Cc: Peter Zijlstra Cc: Pierre Morel Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Sergei Trofimovich Cc: Thiago Jung Bauermann Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65a2aa5f482ed0c1b5afb9e6b0b9e0b16bb8b616 Author: David Hildenbrand Date: Tue Sep 7 19:55:04 2021 -0700 mm/memory_hotplug: remove nid parameter from arch_remove_memory() The parameter is unused, let's remove it. Link: https://lkml.kernel.org/r/20210712124052.26491-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Catalin Marinas Acked-by: Michael Ellerman [powerpc] Acked-by: Heiko Carstens [s390] Reviewed-by: Pankaj Gupta Reviewed-by: Oscar Salvador Cc: Catalin Marinas Cc: Will Deacon Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Yoshinori Sato Cc: Rich Felker Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Pavel Tatashin Cc: Baoquan He Cc: Laurent Dufour Cc: Sergei Trofimovich Cc: Kefeng Wang Cc: Michel Lespinasse Cc: Christophe Leroy Cc: "Aneesh Kumar K.V" Cc: Thiago Jung Bauermann Cc: Joe Perches Cc: Pierre Morel Cc: Jia He Cc: Anton Blanchard Cc: Dan Williams Cc: Dave Jiang Cc: Jason Wang Cc: Len Brown Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Nathan Lynch Cc: Pankaj Gupta Cc: "Rafael J. Wysocki" Cc: "Rafael J. Wysocki" Cc: Scott Cheloha Cc: Vishal Verma Cc: Vitaly Kuznetsov Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7cf209ba8a86410939a24cb1aeb279479a7e0ca6 Author: David Hildenbrand Date: Tue Sep 7 19:54:59 2021 -0700 mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() Patch series "mm/memory_hotplug: preparatory patches for new online policy and memory" These are all cleanups and one fix previously sent as part of [1]: [PATCH v1 00/12] mm/memory_hotplug: "auto-movable" online policy and memory groups. These patches make sense even without the other series, therefore I pulled them out to make the other series easier to digest. [1] https://lkml.kernel.org/r/20210607195430.48228-1-david@redhat.com This patch (of 4): Checkpatch complained on a follow-up patch that we are using "unsigned" here, which defaults to "unsigned int" and checkpatch is correct. As we will search for a fitting zone using the wrong pfn, we might end up onlining memory to one of the special kernel zones, such as ZONE_DMA, which can end badly as the onlined memory does not satisfy properties of these zones. Use "unsigned long" instead, just as we do in other places when handling PFNs. This can bite us once we have physical addresses in the range of multiple TB. Link: https://lkml.kernel.org/r/20210712124052.26491-2-david@redhat.com Fixes: e5e689302633 ("mm, memory_hotplug: display allowed zones in the preferred ordering") Signed-off-by: David Hildenbrand Reviewed-by: Pankaj Gupta Reviewed-by: Muchun Song Reviewed-by: Oscar Salvador Cc: David Hildenbrand Cc: Vitaly Kuznetsov Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Pankaj Gupta Cc: Wei Yang Cc: Michal Hocko Cc: Dan Williams Cc: Anshuman Khandual Cc: Dave Hansen Cc: Vlastimil Babka Cc: Mike Rapoport Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Pavel Tatashin Cc: Heiko Carstens Cc: Michael Ellerman Cc: Catalin Marinas Cc: virtualization@lists.linux-foundation.org Cc: Andy Lutomirski Cc: "Aneesh Kumar K.V" Cc: Anton Blanchard Cc: Ard Biesheuvel Cc: Baoquan He Cc: Benjamin Herrenschmidt Cc: Borislav Petkov Cc: Christian Borntraeger Cc: Christophe Leroy Cc: Dave Jiang Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jia He Cc: Joe Perches Cc: Kefeng Wang Cc: Laurent Dufour Cc: Michel Lespinasse Cc: Nathan Lynch Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Pierre Morel Cc: "Rafael J. Wysocki" Cc: Rich Felker Cc: Scott Cheloha Cc: Sergei Trofimovich Cc: Thiago Jung Bauermann Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vishal Verma Cc: Will Deacon Cc: Yoshinori Sato Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 673d40c82eb2200da32ae9cc9cac8c584b66b5a9 Author: Mike Rapoport Date: Tue Sep 7 19:54:55 2021 -0700 mm: memory_hotplug: cleanup after removal of pfn_valid_within() When test_pages_in_a_zone() used pfn_valid_within() is has some logic surrounding pfn_valid_within() checks. Since pfn_valid_within() is gone, this logic can be removed. Link: https://lkml.kernel.org/r/20210713080035.7464-3-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 859a85ddf90e714092dea71a0e54c7b9896621be Author: Mike Rapoport Date: Tue Sep 7 19:54:52 2021 -0700 mm: remove pfn_valid_within() and CONFIG_HOLES_IN_ZONE Patch series "mm: remove pfn_valid_within() and CONFIG_HOLES_IN_ZONE". After recent updates to freeing unused parts of the memory map, no architecture can have holes in the memory map within a pageblock. This makes pfn_valid_within() check and CONFIG_HOLES_IN_ZONE configuration option redundant. The first patch removes them both in a mechanical way and the second patch simplifies memory_hotplug::test_pages_in_a_zone() that had pfn_valid_within() surrounded by more logic than simple if. This patch (of 2): After recent changes in freeing of the unused parts of the memory map and rework of pfn_valid() in arm and arm64 there are no architectures that can have holes in the memory map within a pageblock and so nothing can enable CONFIG_HOLES_IN_ZONE which guards non trivial implementation of pfn_valid_within(). With that, pfn_valid_within() is always hardwired to 1 and can be completely removed. Remove calls to pfn_valid_within() and CONFIG_HOLES_IN_ZONE. Link: https://lkml.kernel.org/r/20210713080035.7464-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20210713080035.7464-2-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: David Hildenbrand Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac3332c44767b17b761b703523ac4ae9b2bcd227 Author: David Hildenbrand Date: Tue Sep 7 19:54:49 2021 -0700 memory-hotplug.rst: complete admin-guide overhaul The memory hot(un)plug documentation is outdated and incomplete. Most of the content dates back to 2007, so it's time for a major overhaul. Let's rewrite, reorganize and update most parts of the documentation. In addition to memory hot(un)plug, also add some details regarding ZONE_MOVABLE, with memory hotunplug being one of its main consumers. Drop the file history, that information can more reliably be had from the git log. The style of the document is also properly fixed that e.g., "restview" renders it cleanly now. In the future, we might add some more details about virt users like virtio-mem, the XEN balloon, the Hyper-V balloon and ppc64 dlpar. Link: https://lkml.kernel.org/r/20210707073205.3835-3-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Reviewed-by: Mike Rapoport Reviewed-by: Oscar Salvador Cc: Mike Kravetz Cc: Dave Hansen Cc: Matthew Wilcox Cc: Anshuman Khandual Cc: Muchun Song Cc: Pavel Tatashin Cc: Jonathan Corbet Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df82bf5a9fad7004bc0c35a075ed7402b2eb7374 Author: David Hildenbrand Date: Tue Sep 7 19:54:46 2021 -0700 memory-hotplug.rst: remove locking details from admin-guide Patch series "memory-hotplug.rst: complete admin-guide overhaul", v3. This patch (of 2): We have the same content at Documentation/core-api/memory-hotplug.rst and it doesn't fit into the admin-guide. The documentation was accidentially duplicated when merging. Link: https://lkml.kernel.org/r/20210707073205.3835-1-david@redhat.com Link: https://lkml.kernel.org/r/20210707073205.3835-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Mike Rapoport Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Cc: Mike Kravetz Cc: Dave Hansen Cc: Matthew Wilcox Cc: Anshuman Khandual Cc: Muchun Song Cc: Pavel Tatashin Cc: Jonathan Corbet Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb9c14ad267d25dd77ceccbcfd69804bdb7240f5 Author: David Hildenbrand Date: Wed Sep 8 17:45:06 2021 +0200 hugetlbfs: s390 is always 64bit No need to check for 64BIT. While at it, let's just select ARCH_SUPPORTS_HUGETLBFS from arch/s390/Kconfig. Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20210908154506.20764-1-david@redhat.com Signed-off-by: Heiko Carstens commit 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae Author: Tetsuo Handa Date: Wed Sep 8 19:27:49 2021 +0900 fbmem: don't allow too huge resolutions syzbot is reporting page fault at vga16fb_fillrect() [1], for vga16fb_check_var() is failing to detect multiplication overflow. if (vxres * vyres > maxmem) { vyres = maxmem / vxres; if (vyres < yres) return -ENOMEM; } Since no module would accept too huge resolutions where multiplication overflow happens, let's reject in the common path. Link: https://syzkaller.appspot.com/bug?extid=04168c8063cfdde1db5e [1] Reported-by: syzbot Debugged-by: Randy Dunlap Signed-off-by: Tetsuo Handa Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/185175d6-227a-7b55-433d-b070929b262c@i-love.sakura.ne.jp commit 49832c819ab85b33b7a2a1429c8d067e82be2977 Author: Randy Dunlap Date: Tue Sep 7 15:42:02 2021 -0700 Makefile: use -Wno-main in the full kernel tree When using gcc (SUSE Linux) 7.5.0 (on openSUSE 15.3), I see a build warning: kernel/trace/trace_osnoise.c: In function 'start_kthread': kernel/trace/trace_osnoise.c:1461:8: warning: 'main' is usually a function [-Wmain] void *main = osnoise_main; ^~~~ Quieten that warning by using "-Wno-main". It's OK to use "main" as a declaration name in the kernel. Build-tested on most ARCHes. [ v2: only do it for gcc, since clang doesn't have that particular warning ] Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/lkml/20210813224131.25803-1-rdunlap@infradead.org/ Suggested-by: Steven Rostedt Suggested-by: Linus Torvalds Cc: Daniel Bristot de Oliveira Cc: Masahiro Yamada Cc: Michal Marek Cc: linux-kbuild@vger.kernel.org Signed-off-by: Linus Torvalds commit 25fca8c9e0d79ca4c5bb0199dcc52ab0ea4cbd7d Merge: c5433f026b27c fcb958ee8e832 Author: Takashi Iwai Date: Wed Sep 8 17:52:23 2021 +0200 Merge tag 'asoc-fix-v5.15-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.15 A collection of fixes that came in during the merge window, nothing too remarkable but a reasonably large number of fixes. commit 39ff83f2f6cc5cc1458dfcea9697f96338210beb Author: Lukas Hannen Date: Wed Aug 25 10:12:43 2021 +0000 time: Handle negative seconds correctly in timespec64_to_ns() timespec64_ns() prevents multiplication overflows by comparing the seconds value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it returns KTIME_MAX. But that check casts the signed seconds value to unsigned which makes the comparision true for all negative values and therefore return wrongly KTIME_MAX. Negative second values are perfectly valid and required in some places, e.g. ptp_clock_adjtime(). Remove the cast and add a check for the negative boundary which is required to prevent undefined behaviour due to multiplication underflow. Fixes: cb47755725da ("time: Prevent undefined behaviour in timespec64_to_ns()")' Signed-off-by: Lukas Hannen Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5416.eurprd01.prod.exchangelabs.com commit e543b10cd9d75309c820d2175200d09b2a62f249 Merge: 59dc33252ee77 fa209644a7124 17b121ad0c433 Author: Rafael J. Wysocki Date: Wed Sep 8 16:44:15 2021 +0200 Merge branches 'acpi-pm' and 'acpi-docs' * acpi-pm: ACPI: PM: s2idle: Run both AMD and Microsoft methods if both are supported * acpi-docs: Documentation: ACPI: Align the SSDT overlays file with the code commit f76c87e8c33766cc6a7bf7461dfac9cebb05b5df Merge: eabf9e616ec6e 2a3441f59464c Author: Rafael J. Wysocki Date: Wed Sep 8 16:42:13 2021 +0200 Merge branch 'pm-opp' * pm-opp: dt-bindings: opp: Convert to DT schema dt-bindings: Clean-up OPP binding node names in examples ARM: dts: omap: Drop references to opp.txt commit eabf9e616ec6e7864458371390ef7771dfb3ad0a Merge: 5cbba60596b1f 27de8d5970207 Author: Rafael J. Wysocki Date: Wed Sep 8 16:42:02 2021 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: Revert "cpufreq: intel_pstate: Process HWP Guaranteed change notification" cpufreq: mediatek-hw: Add support for CPUFREQ HW cpufreq: Add of_perf_domain_get_sharing_cpumask dt-bindings: cpufreq: add bindings for MediaTek cpufreq HW cpufreq: Remove ready() callback cpufreq: sh: Remove sh_cpufreq_cpu_ready() cpufreq: acpi: Remove acpi_cpufreq_cpu_ready() cpufreq: qcom-hw: Set dvfs_possible_from_any_cpu cpufreq driver flag cpufreq: blocklist more Qualcomm platforms in cpufreq-dt-platdev cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support cpufreq: scmi: Use .register_em() to register with energy model cpufreq: vexpress: Use .register_em() to register with energy model cpufreq: scpi: Use .register_em() to register with energy model cpufreq: qcom-cpufreq-hw: Use .register_em() to register with energy model cpufreq: omap: Use .register_em() to register with energy model cpufreq: mediatek: Use .register_em() to register with energy model cpufreq: imx6q: Use .register_em() to register with energy model cpufreq: dt: Use .register_em() to register with energy model cpufreq: Add callback to register with energy model cpufreq: vexpress: Set CPUFREQ_IS_COOLING_DEV flag commit 713b9825a4c47897f66ad69409581e7734a8728e Author: Pavel Begunkov Date: Wed Sep 8 10:09:29 2021 +0100 io-wq: fix cancellation on create-worker failure WARNING: CPU: 0 PID: 10392 at fs/io_uring.c:1151 req_ref_put_and_test fs/io_uring.c:1151 [inline] WARNING: CPU: 0 PID: 10392 at fs/io_uring.c:1151 req_ref_put_and_test fs/io_uring.c:1146 [inline] WARNING: CPU: 0 PID: 10392 at fs/io_uring.c:1151 io_req_complete_post+0xf5b/0x1190 fs/io_uring.c:1794 Modules linked in: Call Trace: tctx_task_work+0x1e5/0x570 fs/io_uring.c:2158 task_work_run+0xe0/0x1a0 kernel/task_work.c:164 tracehook_notify_signal include/linux/tracehook.h:212 [inline] handle_signal_work kernel/entry/common.c:146 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x232/0x2a0 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae When io_wqe_enqueue() -> io_wqe_create_worker() fails, we can't just call io_run_cancel() to clean up the request, it's already enqueued via io_wqe_insert_work() and will be executed either by some other worker during cancellation (e.g. in io_wq_put_and_exit()). Reported-by: Hao Sun Fixes: 3146cba99aa28 ("io-wq: make worker creation resilient against signals") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/93b9de0fcf657affab0acfd675d4abcd273ee863.1631092071.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 9652cb805c44b74ba935c84bfd59745cb1962de8 Author: Heiko Carstens Date: Tue Sep 7 20:37:59 2021 +0200 s390/ftrace: remove incorrect __va usage The address of ftrace_graph_caller is already virtual. Using __va() to translate the address is wrong. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 2c57ad602493a6674d5c8e35b427ab27012437b2 Author: Heiko Carstens Date: Tue Sep 7 07:28:20 2021 +0200 s390/zcrypt: remove incorrect kernel doc indicators Many comments above functions start with a kernel doc indicator, but the comments are not using kernel doc style. Get rid of the warnings by simply removing the indicator. E.g.: drivers/s390/crypto/zcrypt_msgtype6.c:111: warning: This comment starts with '/**', but isn't a kernel-doc comment. Reviewed-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit f6beebb15eeede0c39bb2d25aefa61f9ddcf2395 Author: Heiko Carstens Date: Mon Sep 6 22:28:16 2021 +0200 scsi: zfcp: fix kernel doc comments A couple of function names don't match what the kernel doc comments indicate. Acked-by: Benjamin Block Signed-off-by: Heiko Carstens commit ff8a58b0ae735f32fe87d0d07e98751ff9dcaed0 Author: Heiko Carstens Date: Mon Sep 6 22:20:05 2021 +0200 s390/sclp: add __nonstring annotation Add __nonstring annotation, since the missing string termination for id member of sclp_trace_entry is intended. This way we get rid of this warning: drivers/s390/char/sclp.c:84:9: warning: ‘strncpy’ output truncated before terminating nul copying 4 bytes from a string of the same length [-Wstringop-truncation] 84 | strncpy(e.id, id, sizeof(e.id)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: kernel test robot Reviewed-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 2169b908894df2ce83e7eb4a399d3224b2635126 Author: chongjiapeng Date: Mon Sep 6 17:48:43 2021 +0800 IB/hfi1: make hist static This symbol is not used outside of trace.c, so marks it static. Fix the following sparse warning: drivers/infiniband/hw/hfi1/trace.c:491:23: warning: symbol 'hist' was not declared. Should it be static? Link: https://lore.kernel.org/r/1630921723-21545-1-git-send-email-jiapeng.chong@linux.alibaba.com Reported-by: Abaci Robot Signed-off-by: chongjiapeng Signed-off-by: Jason Gunthorpe commit f1b195ce81ad31618e9f28894a343fd62debb9ab Author: Len Baker Date: Sun Sep 5 10:18:12 2021 +0200 RDMA/bnxt_re: Prefer kcalloc over open coded arithmetic As noted in the "Deprecated Interfaces, Language Features, Attributes, and Conventions" documentation [1], size calculations (especially multiplication) should not be performed in memory allocator (or similar) function arguments due to the risk of them overflowing. This could lead to values wrapping around and a smaller allocation being made than the caller was expecting. Using those allocations could lead to linear overflows of heap memory and other misbehaviors. In this case this is not actually dynamic sizes: both sides of the multiplication are constant values. However it is best to refactor this anyway, just to keep the open-coded math idiom out of code. So, use the purpose specific kcalloc() function instead of the argument size * count in the kzalloc() function. Also, remove the unnecessary initialization of the sqp_tbl variable since it is set a few lines later. [1] https://www.kernel.org/doc/html/v5.14/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Link: https://lore.kernel.org/r/20210905081812.17113-1-len.baker@gmx.com Signed-off-by: Len Baker Reviewed-by: Leon Romanovsky Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 84f969e1c48ed3825986e91a0786e363d57f69d1 Author: Jason Gunthorpe Date: Fri Sep 3 10:07:28 2021 -0300 IB/qib: Fix null pointer subtraction compiler warning >> drivers/infiniband/hw/qib/qib_sysfs.c:411:1: warning: performing pointer subtraction with a null pointer has undefined behavior +[-Wnull-pointer-subtraction] QIB_DIAGC_ATTR(rc_resends); ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/qib/qib_sysfs.c:408:51: note: expanded from macro 'QIB_DIAGC_ATTR' .counter = &((struct qib_ibport *)0)->rvp.n_##N - (u64 *)0, \ Use offsetof and accomplish the type check using static_assert. Fixes: 4a7aaf88c89f ("RDMA/qib: Use attributes for the port sysfs") Link: https://lore.kernel.org/r/0-v1-43ae3c759177+65-qib_type_jgg@nvidia.com Reported-by: kernel test robot Acked-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit f4c6f31011eafe027abddf6cee1288a1b5a05b73 Author: Niklas Schnelle Date: Wed Sep 8 10:18:49 2021 +0200 RDMA/mlx5: Fix xlt_chunk_align calculation The XLT chunk alignment depends on ent_size not sizeof(ent_size) aka sizeof(size_t). The incoming ent_size is either 8 or 16, so the miscalculation when 16 is required is only an over-alignment and functional harmless. Fixes: 8010d74b9965 ("RDMA/mlx5: Split the WR setup out of mlx5_ib_update_xlt()") Link: https://lore.kernel.org/r/20210908081849.7948-2-schnelle@linux.ibm.com Signed-off-by: Niklas Schnelle Signed-off-by: Jason Gunthorpe commit 9660dcbe0d9186976917c94bce4e69dbd8d7a974 Author: Niklas Schnelle Date: Wed Sep 8 10:18:48 2021 +0200 RDMA/mlx5: Fix number of allocated XLT entries In commit 8010d74b9965b ("RDMA/mlx5: Split the WR setup out of mlx5_ib_update_xlt()") the allocation logic was split out of mlx5_ib_update_xlt() and the logic was changed to enable better OOM handling. Sadly this change introduced a miscalculation of the number of entries that were actually allocated when under memory pressure where it can actually become 0 which on s390 lets dma_map_single() fail. It can also lead to corruption of the free pages list when the wrong number of entries is used in the calculation of sg->length which is used as argument for free_pages(). Fix this by using the allocation size instead of misusing get_order(size). Cc: stable@vger.kernel.org Fixes: 8010d74b9965 ("RDMA/mlx5: Split the WR setup out of mlx5_ib_update_xlt()") Link: https://lore.kernel.org/r/20210908081849.7948-1-schnelle@linux.ibm.com Signed-off-by: Niklas Schnelle Signed-off-by: Jason Gunthorpe commit 276aae377206d60b9b7b7df4586cd9f2a813f5d0 Author: Joakim Zhang Date: Wed Sep 8 15:43:35 2021 +0800 net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume commit 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after napi disabled"), this patch tries to fix system hang caused by eee_ctrl_timer, unfortunately, it only can resolve it for system reboot stress test. System hang also can be reproduced easily during system suspend/resume stess test when mount NFS on i.MX8MP EVK board. In stmmac driver, eee feature is combined to phylink framework. When do system suspend, phylink_stop() would queue delayed work, it invokes stmmac_mac_link_down(), where to deactivate eee_ctrl_timer synchronizly. In above commit, try to fix issue by deactivating eee_ctrl_timer obviously, but it is not enough. Looking into eee_ctrl_timer expire callback stmmac_eee_ctrl_timer(), it could enable hareware eee mode again. What is unexpected is that LPI interrupt (MAC_Interrupt_Enable.LPIEN bit) is always asserted. This interrupt has chance to be issued when LPI state entry/exit from the MAC, and at that time, clock could have been already disabled. The result is that system hang when driver try to touch register from interrupt handler. The reason why above commit can fix system hang issue in stmmac_release() is that, deactivate eee_ctrl_timer not just after napi disabled, further after irq freed. In conclusion, hardware would generate LPI interrupt when clock has been disabled during suspend or resume, since hardware is in eee mode and LPI interrupt enabled. Interrupts from MAC, MTL and DMA level are enabled and never been disabled when system suspend, so postpone clocks management from suspend stage to noirq suspend stage should be more safe. Fixes: 5f58591323bf ("net: stmmac: delete the eee_ctrl_timer after napi disabled") Signed-off-by: Joakim Zhang Signed-off-by: David S. Miller commit b5c102238cea985d8126b173d06b9e1de88037ee Author: Alex Elder Date: Tue Sep 7 12:05:54 2021 -0500 net: ipa: initialize all filter table slots There is an off-by-one problem in ipa_table_init_add(), when initializing filter tables. In that function, the number of filter table entries is determined based on the number of set bits in the filter map. However that count does *not* include the extra "slot" in the filter table that holds the filter map itself. Meanwhile, ipa_table_addr() *does* include the filter map in the memory it returns, but because the count it's provided doesn't include it, it includes one too few table entries. Fix this by including the extra slot for the filter map in the count computed in ipa_table_init_add(). Note: ipa_filter_reset_table() does not have this problem; it resets filter table entries one by one, but does not overwrite the filter bitmap. Fixes: 2b9feef2b6c2 ("soc: qcom: ipa: filter and routing tables") Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit ea269a6f720782ed94171fb962b14ce07c372138 Author: Nathan Rossi Date: Thu Sep 2 05:14:49 2021 +0000 net: phylink: Update SFP selected interface on advertising changes Currently changes to the advertising state via ethtool do not cause any reselection of the configured interface mode after the SFP is already inserted and initially configured. While it is not typical to change the advertised link modes for an interface using an SFP in certain use cases it is desirable. In the case of a SFP port that is capable of handling both SFP and SFP+ modules it will automatically select between 1G and 10G modes depending on the supported mode of the SFP. However if the SFP module is capable of working in multiple modes (e.g. a SFP+ DAC that can operate at 1G or 10G), one end of the cable may be attached to a SFP 1000base-x port thus the SFP+ end must be manually configured to the 1000base-x mode in order for the link to be established. This change causes the ethtool setting of advertised mode changes to reselect the interface mode so that the link can be established. Additionally when a module is inserted the advertising mode is reset to match the supported modes of the module. Signed-off-by: Nathan Rossi Signed-off-by: David S. Miller commit d7e203ffd3ba5965e88952e7364a42ab32064408 Author: Arnd Bergmann Date: Tue Sep 7 15:46:10 2021 +0200 ne2000: fix unused function warning Geert noticed a warning on MIPS TX49xx, Atari and presuambly other platforms when the driver is built-in but NETDEV_LEGACY_INIT is disabled: drivers/net/ethernet/8390/ne.c:909:20: warning: ‘ne_add_devices’ defined but not used [-Wunused-function] Merge the two module init functions into a single one with an IS_ENABLED() check to replace the incorrect #ifdef. Fixes: 4228c3942821 ("make legacy ISA probe optional") Reported-by: Geert Uytterhoeven Signed-off-by: Arnd Bergmann Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit c324f023dbb2bcceccb7ecad5a268e58b80e638d Merge: d437f5aa23aa2 8db6a54f3cae6 Author: David S. Miller Date: Wed Sep 8 11:40:03 2021 +0100 Merge tag 'mlx5-fixes-2021-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2021-09-07 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. Included here, a patch which solves a build warning reported on linux-kernel mailing list [1]: Fix commit ("net/mlx5: Bridge, fix uninitialized variable usage") I hope this series can make it to rc1. [1] https://www.spinics.net/lists/netdev/msg765481.html ==================== Signed-off-by: David S. Miller commit d437f5aa23aa2b7bd07cd44b839d7546cc17166f Author: Sukadev Bhattiprolu Date: Tue Sep 7 22:07:03 2021 -0700 ibmvnic: check failover_pending in login response If a failover occurs before a login response is received, the login response buffer maybe undefined. Check that there was no failover before accessing the login response buffer. Signed-off-by: Sukadev Bhattiprolu Signed-off-by: David S. Miller commit 581edcd0c8a076eba2ec9e20db50921ee80f5cbc Author: Jeremy Kerr Date: Wed Sep 8 12:13:10 2021 +0800 mctp: perform route destruction under RCU read lock The kernel test robot reports: [ 843.509974][ T345] ============================= [ 843.524220][ T345] WARNING: suspicious RCU usage [ 843.538791][ T345] 5.14.0-rc2-00606-g889b7da23abf #1 Not tainted [ 843.553617][ T345] ----------------------------- [ 843.567412][ T345] net/mctp/route.c:310 RCU-list traversed in non-reader section!! - we're missing the rcu read lock acquire around the destruction path. This change adds the acquire/release - the path is already atomic, and we're using the _rcu list iterators. Reported-by: kernel test robot Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller commit d9ea761fdd197351890418acd462c51f241014a7 Author: Lin, Zhenpeng Date: Wed Sep 8 03:40:59 2021 +0000 dccp: don't duplicate ccid when cloning dccp sock Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed a UAF but reintroduced CVE-2017-6074. When the sock is cloned, two dccps_hc_tx_ccid will reference to the same ccid. So one can free the ccid object twice from two socks after cloning. This issue was found by "Hadar Manor" as well and assigned with CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port the patch from Ubuntu to fix it. The patch prevents cloned socks from referencing the same ccid. Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...") Signed-off-by: Zhenpeng Lin Signed-off-by: David S. Miller commit 0f31ab217dc52a3044044d416be0248b1778c4da Author: Samuel Holland Date: Tue Sep 7 22:02:40 2021 -0500 dt-bindings: net: sun8i-emac: Add compatible for D1 The D1 SoC contains EMAC hardware which is compatible with the A64 EMAC. Add the new compatible string, with the A64 as a fallback. Signed-off-by: Samuel Holland Acked-by: Maxime Ripard Signed-off-by: David S. Miller commit ac08b1c68d1b1ed3cebb218fc3ea2c07484eb07d Merge: b339ec9c229aa 742a4c49a82a8 Author: Linus Torvalds Date: Tue Sep 7 19:13:42 2021 -0700 Merge tag 'pci-v5.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Convert controller drivers to generic_handle_domain_irq() (Marc Zyngier) - Simplify VPD (Vital Product Data) access and search (Heiner Kallweit) - Update bnx2, bnx2x, bnxt, cxgb4, cxlflash, sfc, tg3 drivers to use simplified VPD interfaces (Heiner Kallweit) - Run Max Payload Size quirks before configuring MPS; work around ASMedia ASM1062 SATA MPS issue (Marek Behún) Resource management: - Refactor pci_ioremap_bar() and pci_ioremap_wc_bar() (Krzysztof Wilczyński) - Optimize pci_resource_len() to reduce kernel size (Zhen Lei) PCI device hotplug: - Fix a double unmap in ibmphp (Vishal Aslot) PCIe port driver: - Enable Bandwidth Notification only if port supports it (Stuart Hayes) Sysfs/proc/syscalls: - Add schedule point in proc_bus_pci_read() (Krzysztof Wilczyński) - Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure (Krzysztof Wilczyński) - Return "int" from pciconfig_read() syscall (Krzysztof Wilczyński) Virtualization: - Extend "pci=noats" to also turn on Translation Blocking to protect against some DMA attacks (Alex Williamson) - Add sysfs mechanism to control the type of reset used between device assignments to VMs (Amey Narkhede) - Add support for ACPI _RST reset method (Shanker Donthineni) - Add ACS quirks for Cavium multi-function devices (George Cherian) - Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms (Wasim Khan) - Allow HiSilicon AMBA devices that appear as fake PCI devices to use PASID and SVA (Zhangfei Gao) Endpoint framework: - Add support for SR-IOV Endpoint devices (Kishon Vijay Abraham I) - Zero-initialize endpoint test tool parameters so we don't use random parameters (Shunyong Yang) APM X-Gene PCIe controller driver: - Remove redundant dev_err() call in xgene_msi_probe() (ErKun Yang) Broadcom iProc PCIe controller driver: - Don't fail devm_pci_alloc_host_bridge() on missing 'ranges' because it's optional on BCMA devices (Rob Herring) - Fix BCMA probe resource handling (Rob Herring) Cadence PCIe driver: - Work around J7200 Link training electrical issue by increasing delays in LTSSM (Nadeem Athani) Intel IXP4xx PCI controller driver: - Depend on ARCH_IXP4XX to avoid useless config questions (Geert Uytterhoeven) Intel Keembay PCIe controller driver: - Add Intel Keem Bay PCIe controller (Srikanth Thokala) Marvell Aardvark PCIe controller driver: - Work around config space completion handling issues (Evan Wang) - Increase timeout for config access completions (Pali Rohár) - Emulate CRS Software Visibility bit (Pali Rohár) - Configure resources from DT 'ranges' property to fix I/O space access (Pali Rohár) - Serialize INTx mask/unmask (Pali Rohár) MediaTek PCIe controller driver: - Add MT7629 support in DT (Chuanjia Liu) - Fix an MSI issue (Chuanjia Liu) - Get syscon regmap ("mediatek,generic-pciecfg"), IRQ number ("pci_irq"), PCI domain ("linux,pci-domain") from DT properties if present (Chuanjia Liu) Microsoft Hyper-V host bridge driver: - Add ARM64 support (Boqun Feng) - Support "Create Interrupt v3" message (Sunil Muthuswamy) NVIDIA Tegra PCIe controller driver: - Use seq_puts(), move err_msg from stack to static, fix OF node leak (Christophe JAILLET) NVIDIA Tegra194 PCIe driver: - Disable suspend when in Endpoint mode (Om Prakash Singh) - Fix MSI-X address programming error (Om Prakash Singh) - Disable interrupts during suspend to avoid spurious AER link down (Om Prakash Singh) Renesas R-Car PCIe controller driver: - Work around hardware issue that prevents Link L1->L0 transition (Marek Vasut) - Fix runtime PM refcount leak (Dinghao Liu) Rockchip DesignWare PCIe controller driver: - Add Rockchip RK356X host controller driver (Simon Xue) TI J721E PCIe driver: - Add support for J7200 and AM64 (Kishon Vijay Abraham I) Toshiba Visconti PCIe controller driver: - Add Toshiba Visconti PCIe host controller driver (Nobuhiro Iwamatsu) Xilinx NWL PCIe controller driver: - Enable PCIe reference clock via CCF (Hyun Kwon) Miscellaneous: - Convert sta2x11 from 'pci_' to 'dma_' API (Christophe JAILLET) - Fix pci_dev_str_match_path() alloc while atomic bug (used for kernel parameters that specify devices) (Dan Carpenter) - Remove pointless Precision Time Management warning when PTM is present but not enabled (Jakub Kicinski) - Remove surplus "break" statements (Krzysztof Wilczyński)" * tag 'pci-v5.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (132 commits) PCI: ibmphp: Fix double unmap of io_mem x86/PCI: sta2x11: switch from 'pci_' to 'dma_' API PCI/VPD: Use unaligned access helpers PCI/VPD: Clean up public VPD defines and inline functions cxgb4: Use pci_vpd_find_id_string() to find VPD ID string PCI/VPD: Add pci_vpd_find_id_string() PCI/VPD: Include post-processing in pci_vpd_find_tag() PCI/VPD: Stop exporting pci_vpd_find_info_keyword() PCI/VPD: Stop exporting pci_vpd_find_tag() PCI: Set dma-can-stall for HiSilicon chips PCI: rockchip-dwc: Add Rockchip RK356X host controller driver PCI: dwc: Remove surplus break statement after return PCI: artpec6: Remove local code block from switch statement PCI: artpec6: Remove surplus break statement after return MAINTAINERS: Add entries for Toshiba Visconti PCIe controller PCI: visconti: Add Toshiba Visconti PCIe host controller driver PCI/portdrv: Enable Bandwidth Notification only if port supports it PCI: Allow PASID on fake PCIe devices without TLP prefixes PCI: mediatek: Use PCI domain to handle ports detection PCI: mediatek: Add new method to get irq number ... commit b339ec9c229aaf399296a120d7be0e34fbc355ca Author: Marco Elver Date: Tue Sep 7 23:12:08 2021 +0200 kbuild: Only default to -Werror if COMPILE_TEST The cross-product of the kernel's supported toolchains, architectures, and configuration options is large. So large, that it's generally accepted to be infeasible to enumerate and build+test them all (many compile-testers rely on randomly generated configs). Without the possibility to enumerate all possible combinations of toolchains, architectures, and configuration options, it is inevitable that compiler warnings in this space exist. With -Werror, this means that an innumerable set of kernels are now broken, yet had been perfectly usable before (confused compilers, code with warnings unused, or luck). Distributors will necessarily pick a point in the toolchain X arch X config space, and if unlucky, will have a broken build. Granted, those will likely disable CONFIG_WERROR and move on. The kernel's default configuration is unlikely to be suitable for all users, but it's inappropriate to force many users to set CONFIG_WERROR=n. This also holds for CI systems which are focused on runtime testing, where the odd warning in some subsystem will disrupt testing of the rest of the kernel. Many of those runtime-focused CI systems run tests or fuzz the kernel using runtime debugging tools. Runtime testing of different subsystems can proceed in parallel, and potentially uncover serious bugs; halting runtime testing of the entire kernel because of the odd warning (now error) in a subsystem or driver is simply inappropriate. Therefore, runtime-focused CI systems will likely choose CONFIG_WERROR=n as well. The appropriate usecase for -Werror is therefore compile-test focused builds (often done by developers or CI systems). Reflect this in the Kconfig option by making the default value of WERROR match COMPILE_TEST. Signed-off-by: Marco Elver Acked-by: Guenter Roeck Acked-by: Randy Dunlap Reviwed-by: Mark Brown Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 5615e088b43d564aec08ccfaecb21ba484a1b4d6 Author: Dan Carpenter Date: Tue Aug 24 14:51:50 2021 +0300 tracing: Fix some alloc_event_probe() error handling bugs There are two bugs in this code. First, if the kzalloc() fails it leads to a NULL dereference of "ep" on the next line. Second, if the alloc_event_probe() function returns an error then it leads to an error pointer dereference in the caller. Link: https://lkml.kernel.org/r/20210824115150.GI31143@kili Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Dan Carpenter Signed-off-by: Steven Rostedt (VMware) commit 7f2a6a69f7ced6db8220298e0497cf60482a9d4b Author: Song Liu Date: Tue Sep 7 16:03:38 2021 -0700 blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug for multiple_queues Limiting number of request to BLK_MAX_REQUEST_COUNT at blk_plug hurts performance for large md arrays. [1] shows resync speed of md array drops for md array with more than 16 HDDs. Fix this by allowing more request at plug queue. The multiple_queue flag is used to only apply higher limit to multiple queue cases. [1] https://lore.kernel.org/linux-raid/CAFDAVznS71BXW8Jxv6k9dXc2iR3ysX3iZRBww_rzA8WifBFxGg@mail.gmail.com/ Tested-by: Marcin Wanat Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 8db6a54f3cae6a803b2cbf5390662bca641f7da8 Author: Aya Levin Date: Sun Aug 29 13:41:08 2021 +0300 net/mlx5e: Fix condition when retrieving PTP-rqn When activating the PTP-RQ, redirect the RQT from drop-RQ to PTP-RQ. Use mlx5e_channels_get_ptp_rqn to retrieve the rqn. This helper returns a boolean (not status), hence caller should consider return value 0 as a fail. Change the caller interpretation of the return value. Fixes: 43ec0f41fa73 ("net/mlx5e: Hide all implementation details of mlx5e_rx_res") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit c91c1da72b47fc4c5e353cdd9099ba94ae07d2fa Author: Aya Levin Date: Thu Jul 15 10:53:28 2021 +0300 net/mlx5e: Fix mutual exclusion between CQE compression and HW TS Some profiles of the driver don't support a dedicated PTP-RQ, hence can't support HW TS and CQE compression simultaneously. When HW TS is enabled the COE compression is disabled, and should be restored when the HW TS is turned off. Add rx_filter as an input to modifying CQE compression to enforce this restriction. Fixes: 256f79d13c1d ("net/mlx5e: Fix HW TS with CQE compression according to profile") Signed-off-by: Aya Levin Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit ee27e330a953595903979ffdb84926843595a9fe Author: Maor Gottlieb Date: Wed Sep 1 11:48:13 2021 +0300 net/mlx5: Fix potential sleeping in atomic context Fixes the below flow of sleeping in atomic context by releasing the RCU lock before calling to free_match_list. build_match_list() <- disables preempt -> free_match_list() -> tree_put_node() -> down_write_ref_node() <- take write lock Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table") Reported-by: Dan Carpenter Signed-off-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit dfe6fd72b5f1878b16aa2c8603e031bbcd66b96d Author: Saeed Mahameed Date: Wed Aug 18 13:09:26 2021 -0700 net/mlx5: FWTrace, cancel work on alloc pd error flow Handle error flow on mlx5_core_alloc_pd() failure, read_fw_strings_work must be canceled. Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling") Reported-by: Pavel Machek (CIP) Suggested-by: Pavel Machek (CIP) Signed-off-by: Saeed Mahameed Reviewed-by: Aya Levin commit da8252d5805d4a80120a0c2151277e5fb9e8aa9e Author: Mark Bloch Date: Wed Aug 11 16:40:16 2021 +0300 net/mlx5: Lag, don't update lag if lag isn't supported In NICs that don't support LAG, the LAG control structure won't be allocated. If it wasn't allocated it means LAG doesn't exists and can be skipped. Fixes: cac1eb2cf2e3 ("net/mlx5: Lag, properly lock eswitch if needed") Signed-off-by: Mark Bloch Reviewed-by: Maor Gottlieb Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 897ae4b40e80be7dcbf2b3079d85fa6339a6b751 Author: Parav Pandit Date: Tue Aug 17 15:59:17 2021 +0300 net/mlx5: Fix rdma aux device on devlink reload RDMA auxdev parameter registration was skipped for eswitch manager PCI PF. Due to this when devlink parameter is read, it reads as false in below code flow. $ devlink dev reload pci/0000:06:00.0 devlink_reload() mlx5_load_one() mlx5_attach_device() is_ib_enabled() devlink_param_driverinit_value_get() Due to this, is_ib_enabled() returns false for the RDMA auxiliary device. This results into a skipping RDMA auxiliary device creation on reload. There is no need to check for eswitch manager capability to support RDMA auxiliary device. Hence, fix it by skipping eswitch manager capability. Fixes: 87158cedf00e ("net/mlx5: Support enable_rdma devlink dev param") Signed-off-by: Parav Pandit Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 8343268ec3cf4e097aa8b2071f0cd6779e2c4953 Author: Vlad Buslov Date: Wed Aug 18 14:19:13 2021 +0300 net/mlx5: Bridge, fix uninitialized variable usage In some conditions variable 'err' is not assigned with value in mlx5_esw_bridge_port_obj_attr_set() and mlx5_esw_bridge_port_changeupper() functions after recent changes to support LAG. Initialize the variable with zero value in both cases. Reported-by: Colin King Reported-by: Tim Gardner Reported-by: Naresh Kamboju CC: linux-kernel@vger.kernel.org Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG") Signed-off-by: Vlad Buslov commit 626bf91a292e2035af5b9d9cce35c5c138dfe06d Merge: 4c00e1e2e58ee 0f77f2defaf68 Author: Linus Torvalds Date: Tue Sep 7 14:02:58 2021 -0700 Merge tag 'net-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes and stragglers from Jakub Kicinski: "Networking stragglers and fixes, including changes from netfilter, wireless and can. Current release - regressions: - qrtr: revert check in qrtr_endpoint_post(), fixes audio and wifi - ip_gre: validate csum_start only on pull - bnxt_en: fix 64-bit doorbell operation on 32-bit kernels - ionic: fix double use of queue-lock, fix a sleeping in atomic - can: c_can: fix null-ptr-deref on ioctl() - cs89x0: disable compile testing on powerpc Current release - new code bugs: - bridge: mcast: fix vlan port router deadlock, consistently disable BH Previous releases - regressions: - dsa: tag_rtl4_a: fix egress tags, only port 0 was working - mptcp: fix possible divide by zero - netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex - netfilter: socket: icmp6: fix use-after-scope - stmmac: fix MAC not working when system resume back with WoL active Previous releases - always broken: - ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address - seg6: set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 - mptcp: only send extra TCP acks in eligible socket states - dsa: lantiq_gswip: fix maximum frame length - stmmac: fix overall budget calculation for rxtx_napi - bnxt_en: fix firmware version reporting via devlink - renesas: sh_eth: add missing barrier to fix freeing wrong tx descriptor Stragglers: - netfilter: conntrack: switch to siphash - netfilter: refuse insertion if chain has grown too large - ncsi: add get MAC address command to get Intel i210 MAC address" * tag 'net-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (76 commits) ieee802154: Remove redundant initialization of variable ret net: stmmac: fix MAC not working when system resume back with WoL active net: phylink: add suspend/resume support net: renesas: sh_eth: Fix freeing wrong tx descriptor bonding: 3ad: pass parameter bond_params by reference cxgb3: fix oops on module removal can: c_can: fix null-ptr-deref on ioctl() can: rcar_canfd: add __maybe_unused annotation to silence warning net: wwan: iosm: Unify IO accessors used in the driver net: wwan: iosm: Replace io.*64_lo_hi() with regular accessors net: qcom/emac: Replace strlcpy with strscpy ip6_gre: Revert "ip6_gre: add validation for csum_start" net: hns3: make hclgevf_cmd_caps_bit_map0 and hclge_cmd_caps_bit_map0 static selftests/bpf: Test XDP bonding nest and unwind bonding: Fix negative jump label count on nested bonding MAINTAINERS: add VM SOCKETS (AF_VSOCK) entry stmmac: dwmac-loongson:Fix missing return value iwlwifi: fix printk format warnings in uefi.c net: create netdev->dev_addr assignment helpers bnxt_en: Fix possible unintended driver initiated error recovery ... commit 4c00e1e2e58eefb288ba9ef585b6f19e1f33bf1e Merge: 192ad3c27a489 41e73feb10249 Author: Linus Torvalds Date: Tue Sep 7 13:52:46 2021 -0700 Merge tag 'linux-watchdog-5.15-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add Mediatek MT7986 & MT8195 wdt support - add Maxim MAX63xx - drop bd70528 support - rewrite ixp4xx to watchdog framework - constify static struct watchdog_ops for sl28cpld_wdt, mpc8xxx_wdt and tqmx86 - introduce watchdog_dev_suspend/resume - several fixes and improvements * tag 'linux-watchdog-5.15-rc1' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: Add compatible for Mediatek MT7986 watchdog: ixp4xx: Rewrite driver to use core watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if appropriate watchdog: max63xx_wdt: Add device tree probing dt-bindings: watchdog: Add Maxim MAX63xx bindings watchdog: mediatek: mt8195: add wdt support dt-bindings: reset: mt8195: add toprgu reset-controller header file watchdog: tqmx86: Constify static struct watchdog_ops watchdog: mpc8xxx_wdt: Constify static struct watchdog_ops watchdog: sl28cpld_wdt: Constify static struct watchdog_ops watchdog: iTCO_wdt: Fix detection of SMI-off case watchdog: bcm2835_wdt: consider system-power-controller property watchdog: imx2_wdg: notify wdog core to stop ping worker on suspend watchdog: introduce watchdog_dev_suspend/resume watchdog: Fix NULL pointer dereference when releasing cdev watchdog: only run driver set_pretimeout op if device supports it watchdog: bd70528 drop bd70528 support commit 192ad3c27a4895ee4b2fa31c5b54a932f5bb08c1 Merge: a2b28235335fe 109bbba5066b4 Author: Linus Torvalds Date: Tue Sep 7 13:40:51 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - Page ownership tracking between host EL1 and EL2 - Rely on userspace page tables to create large stage-2 mappings - Fix incompatibility between pKVM and kmemleak - Fix the PMU reset state, and improve the performance of the virtual PMU - Move over to the generic KVM entry code - Address PSCI reset issues w.r.t. save/restore - Preliminary rework for the upcoming pKVM fixed feature - A bunch of MM cleanups - a vGIC fix for timer spurious interrupts - Various cleanups s390: - enable interpretation of specification exceptions - fix a vcpu_idx vs vcpu_id mixup x86: - fast (lockless) page fault support for the new MMU - new MMU now the default - increased maximum allowed VCPU count - allow inhibit IRQs on KVM_RUN while debugging guests - let Hyper-V-enabled guests run with virtualized LAPIC as long as they do not enable the Hyper-V "AutoEOI" feature - fixes and optimizations for the toggling of AMD AVIC (virtualized LAPIC) - tuning for the case when two-dimensional paging (EPT/NPT) is disabled - bugfixes and cleanups, especially with respect to vCPU reset and choosing a paging mode based on CR0/CR4/EFER - support for 5-level page table on AMD processors Generic: - MMU notifier invalidation callbacks do not take mmu_lock unless necessary - improved caching of LRU kvm_memory_slot - support for histogram statistics - add statistics for halt polling and remote TLB flush requests" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (210 commits) KVM: Drop unused kvm_dirty_gfn_invalid() KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted KVM: MMU: mark role_regs and role accessors as maybe unused KVM: MIPS: Remove a "set but not used" variable x86/kvm: Don't enable IRQ when IRQ enabled in kvm_wait KVM: stats: Add VM stat for remote tlb flush requests KVM: Remove unnecessary export of kvm_{inc,dec}_notifier_count() KVM: x86/mmu: Move lpage_disallowed_link further "down" in kvm_mmu_page KVM: x86/mmu: Relocate kvm_mmu_page.tdp_mmu_page for better cache locality Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" KVM: x86/mmu: Remove unused field mmio_cached in struct kvm_mmu_page kvm: x86: Increase KVM_SOFT_MAX_VCPUS to 710 kvm: x86: Increase MAX_VCPUS to 1024 kvm: x86: Set KVM_MAX_VCPU_ID to 4*KVM_MAX_VCPUS KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation KVM: x86/mmu: Don't freak out if pml5_root is NULL on 4-level host KVM: s390: index kvm->arch.idle_mask by vcpu_idx KVM: s390: Enable specification exception interpretation KVM: arm64: Trim guest debug exception handling KVM: SVM: Add 5-level page table support for SVM ... commit ea47ab111669b187808b3080602788dec26cb9bc Author: Al Viro Date: Tue Sep 7 16:14:05 2021 -0400 putname(): IS_ERR_OR_NULL() is wrong here Mixing NULL and ERR_PTR() just in case is a Bad Idea(tm). For struct filename the former is wrong - failures are reported as ERR_PTR(...), not as NULL. Signed-off-by: Al Viro commit b4a4f213a39d5e55baf38c96042acaeaf927ec74 Author: Stephen Brennan Date: Wed Sep 1 10:51:43 2021 -0700 namei: Standardize callers of filename_create() filename_create() has two variants, one which drops the caller's reference to filename (filename_create) and one which does not (__filename_create). This can be confusing as it's unusual to drop a caller's reference. Remove filename_create, rename __filename_create to filename_create, and convert all callers. Link: https://lore.kernel.org/linux-fsdevel/f6238254-35bd-7e97-5b27-21050c745874@oracle.com/ Cc: Christoph Hellwig Cc: Al Viro Signed-off-by: Stephen Brennan Signed-off-by: Al Viro commit a2b28235335fee2586b4bd16448fb59ed6c80eef Merge: 1735715e0fd7a f97a2103f1a75 Author: Linus Torvalds Date: Tue Sep 7 13:08:08 2021 -0700 Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull dmi fix from Jean Delvare. Unbreak some existing udev/hwdb modalias matches due to misplaced product_sku field. * 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware: dmi: Move product_sku info to the end of the modalias commit 794ebcea865bff47231de89269e9d542121ab7be Author: Stephen Brennan Date: Wed Sep 1 10:51:42 2021 -0700 namei: Standardize callers of filename_lookup() filename_lookup() has two variants, one which drops the caller's reference to filename (filename_lookup), and one which does not (__filename_lookup). This can be confusing as it's unusual to drop a caller's reference. Remove filename_lookup, rename __filename_lookup to filename_lookup, and convert all callers. The cost is a few slightly longer functions, but the clarity is greater. [AV: consuming a reference is not at all unusual, actually; look at e.g. do_mkdirat(), for example. It's more that we want non-consuming variant for close relative of that function...] Link: https://lore.kernel.org/linux-fsdevel/YS+dstZ3xfcLxhoB@zeniv-ca.linux.org.uk/ Cc: Christoph Hellwig Cc: Al Viro Signed-off-by: Stephen Brennan Signed-off-by: Al Viro commit 1735715e0fd7a16972402ac98197e6cf30988a45 Merge: 21f577b0f48fd 38de3afffb725 Author: Linus Torvalds Date: Tue Sep 7 13:05:02 2021 -0700 Merge tag 'ntb-5.15' of git://github.com/jonmason/ntb Pull NTB updates from Jon Mason: "Bug fixes and clean-ups for Linux v5.15" * tag 'ntb-5.15' of git://github.com/jonmason/ntb: NTB: switch from 'pci_' to 'dma_' API ntb: ntb_pingpong: remove redundant initialization of variables msg_data and spad_data NTB: perf: Fix an error code in perf_setup_inbuf() NTB: Fix an error code in ntb_msit_probe() ntb: intel: remove invalid email address in header comment commit c5f563f9e9e66c0ad0b23abe25165c124579b70e Author: Al Viro Date: Tue Sep 7 15:57:42 2021 -0400 rename __filename_parentat() to filename_parentat() ... in separate commit, to avoid noise in previous one Signed-off-by: Al Viro commit 21f577b0f48fd3a8871ca4116dad0e9c41ec42b2 Merge: 2d7b4cdbb523c a0a77028c85ad Author: Linus Torvalds Date: Tue Sep 7 12:56:40 2021 -0700 Merge tag 'rproc-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc Pull remoteproc updates from Bjorn Andersson: - move the crash recovery worker to the freezable work queue to avoid interaction with other drivers during suspend & resume - fix a couple of typos in comments - add support for handling the audio DSP on SDM660 - fix a race between the Qualcomm wireless subsystem driver and the associated driver for the RF chip * tag 'rproc-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc: remoteproc: q6v5_pas: Add sdm660 ADSP PIL compatible dt-bindings: remoteproc: qcom: adsp: Add SDM660 ADSP remoteproc: use freezable workqueue for crash notifications remoteproc: fix kernel doc for struct rproc_ops remoteproc: fix an typo in fw_elf_get_class code comments remoteproc: qcom: wcnss: Fix race with iris probe commit 0766ec82e5fb26fc5dc6d592bc61865608bdc651 Author: Stephen Brennan Date: Wed Sep 1 10:51:41 2021 -0700 namei: Fix use after free in kern_path_locked In 0ee50b47532a ("namei: change filename_parentat() calling conventions"), filename_parentat() was made to always call putname() on the filename before returning, and kern_path_locked() was migrated to this calling convention. However, kern_path_locked() uses the "last" parameter to lookup and potentially create a new dentry. The last parameter contains the last component of the path and points within the filename, which was recently freed at the end of filename_parentat(). Thus, when kern_path_locked() calls __lookup_hash(), it is using the filename after it has already been freed. In other words, these calling conventions had been wrong for the only remaining caller of filename_parentat(). Everything else is using __filename_parentat(), which does not drop the reference; so should kern_path_locked(). Switch kern_path_locked() to use of __filename_parentat() and move getting/dropping struct filename into wrapper. Remove filename_parentat(), now that we have no remaining callers. Fixes: 0ee50b47532a ("namei: change filename_parentat() calling conventions") Link: https://lore.kernel.org/linux-fsdevel/YS9D4AlEsaCxLFV0@infradead.org/ Link: https://lore.kernel.org/linux-fsdevel/YS+csMTV2tTXKg3s@zeniv-ca.linux.org.uk/ Cc: Christoph Hellwig Cc: Al Viro Reported-by: syzbot+fb0d60a179096e8c2731@syzkaller.appspotmail.com Signed-off-by: Stephen Brennan Co-authored-by: Dmitry Kadashev Signed-off-by: Al Viro commit 2d7b4cdbb523cd11a978519f8e11895c27f05258 Merge: 86406a9e73334 79fad92f2e596 Author: Linus Torvalds Date: Tue Sep 7 12:50:01 2021 -0700 Merge tag 'backlight-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Fix-ups: - Improve bootloader/kernel device handover Bug Fixes: - Stabilise backlight in ktd253 driver" * tag 'backlight-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: pwm_bl: Improve bootloader/kernel device handover backlight: ktd253: Stabilize backlight commit 86406a9e733347f877a2bd5269ce7429d3748c6a Merge: 5e6a5845dd651 cdff1eda69326 Author: Linus Torvalds Date: Tue Sep 7 12:38:59 2021 -0700 Merge tag 'mfd-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Frameworks: - Add support for registering devices via MFD cells to Simple MFD (I2C) New Drivers: - Add support for Renesas Synchronization Management Unit (SMU) New Device Support: - Add support for N5010 to Intel M10 BMC - Add support for Cannon Lake to Intel LPSS ACPI - Add support for Samsung SSG{1,2} to ST-Ericsson's U8500 family - Add support for TQMx110EB and TQMxE40x to TQ-Systems PLD TQMx86 New Functionality: - Add support for GPIO to Intel LPC ICH - Add support for Reset to Texas Instruments TPS65086 Fix-ups: - Trivial, sorting, whitespace, renaming, etc; mt6360-core, db8500-prcmu-regs, tqmx86 - Device Tree fiddling; syscon, axp20x, qcom,pm8008, ti,tps65086, brcm,cru - Use proper APIs for IRQ map resolution; ab8500-core, stmpe, tc3589x, wm8994-irq - Pass 'supplied-from' property through axp288_fuel_gauge via swnode - Remove unused file entry; MAINTAINERS - Make interrupt line optional; tps65086 - Rename db8500-cpuidle driver symbol; db8500-prcmu - Remove support for unused hardware; tqmx86 - Provide a standard LPC clock frequency for unknown boards; tqmx86 - Remove unused code; ti_am335x_tscadc - Use of_iomap() instead of ioremap(); syscon Bug Fixes: - Clear GPIO IRQ resource flags when no IRQ is set; tqmx86 - Fix incorrect/misleading frequencies; db8500-prcmu - Mitigate namespace clash with other GPIOBASE users" * tag 'mfd-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (31 commits) mfd: lpc_sch: Rename GPIOBASE to prevent build error mfd: syscon: Use of_iomap() instead of ioremap() dt-bindings: mfd: Add Broadcom CRU mfd: ti_am335x_tscadc: Delete superfluous error message mfd: tqmx86: Assume 24MHz LPC clock for unknown boards mfd: tqmx86: Add support for TQ-Systems DMI IDs mfd: tqmx86: Add support for TQMx110EB and TQMxE40x mfd: tqmx86: Fix typo in "platform" mfd: tqmx86: Remove incorrect TQMx90UC board ID mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set mfd: simple-mfd-i2c: Add support for registering devices via MFD cells mfd/cpuidle: ux500: Rename driver symbol mfd: tps65086: Add cell entry for reset driver mfd: tps65086: Make interrupt line optional dt-bindings: mfd: Convert tps65086.txt to YAML MAINTAINERS: Adjust ARM/NOMADIK/Ux500 ARCHITECTURES to file renaming mfd: db8500-prcmu: Handle missing FW variant mfd: db8500-prcmu: Rename register header mfd: axp20x: Add supplied-from property to axp288_fuel_gauge cell mfd: Don't use irq_create_mapping() to resolve a mapping ... commit 5e6a5845dd651b00754a62edec2f0a439182024d Merge: 75b96f0ec5faf 889a1b3f35db6 Author: Linus Torvalds Date: Tue Sep 7 12:27:27 2021 -0700 Merge tag 'gpio-updates-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We mostly have various improvements and refactoring all over the place but also some interesting new features - like the virtio GPIO driver that allows guest VMs to use host's GPIOs. We also have a new/old GPIO driver for rockchip - this one has been split out of the pinctrl driver. Summary: - new driver: gpio-virtio allowing a guest VM running linux to access GPIO lines provided by the host - split the GPIO driver out of the rockchip pin control driver - add support for a new model to gpio-aspeed-sgpio, refactor the driver and use generic device property interfaces, improve property sanitization - add ACPI support to gpio-tegra186 - improve the code setting the line names to support multiple GPIO banks per device - constify a bunch of OF functions in the core GPIO code and make the declaration for one of the core OF functions we use consistent within its header - use software nodes in intel_quark_i2c_gpio - add support for the gpio-line-names property in gpio-mt7621 - use the standard GPIO function for setting the GPIO names in gpio-brcmstb - fix a bunch of leaks and other bugs in gpio-mpc8xxx - use generic pm callbacks in gpio-ml-ioh - improve resource management and PM handling in gpio-mlxbf2 - modernize and improve the gpio-dwapb driver - coding style improvements in gpio-rcar - documentation fixes and improvements - update the MAINTAINERS entry for gpio-zynq - minor tweaks in several drivers" * tag 'gpio-updates-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (35 commits) gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code and avoid a leak gpio: mpc8xxx: Fix a potential double iounmap call in 'mpc8xxx_probe()' gpio: mpc8xxx: Fix a resources leak in the error handling path of 'mpc8xxx_probe()' gpio: viperboard: remove platform_set_drvdata() call in probe gpio: virtio: Add missing mailings lists in MAINTAINERS entry gpio: virtio: Fix sparse warnings gpio: remove the obsolete MX35 3DS BOARD MC9S08DZ60 GPIO functions gpio: max730x: Use the right include gpio: Add virtio-gpio driver gpio: mlxbf2: Use DEFINE_RES_MEM_NAMED() helper macro gpio: mlxbf2: Use devm_platform_ioremap_resource() gpio: mlxbf2: Drop wrong use of ACPI_PTR() gpio: mlxbf2: Convert to device PM ops gpio: dwapb: Get rid of legacy platform data mfd: intel_quark_i2c_gpio: Convert GPIO to use software nodes gpio: dwapb: Read GPIO base from gpio-base property gpio: dwapb: Unify ACPI enumeration checks in get_irq() and configure_irqs() gpiolib: Deduplicate forward declaration in the consumer.h header MAINTAINERS: update gpio-zynq.yaml reference gpio: tegra186: Add ACPI support ... commit 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 Author: Prasad Sodagudi Date: Tue Sep 7 04:24:23 2021 -0700 PM: sleep: core: Avoid setting power.must_resume to false There are variables(power.may_skip_resume and dev->power.must_resume) and DPM_FLAG_MAY_SKIP_RESUME flags to control the resume of devices after a system wide suspend transition. Setting the DPM_FLAG_MAY_SKIP_RESUME flag means that the driver allows its "noirq" and "early" resume callbacks to be skipped if the device can be left in suspend after a system-wide transition into the working state. PM core determines that the driver's "noirq" and "early" resume callbacks should be skipped or not with dev_pm_skip_resume() function by checking power.may_skip_resume variable. power.must_resume variable is getting set to false in __device_suspend() function without checking device's DPM_FLAG_MAY_SKIP_RESUME settings. In problematic scenario, where all the devices in the suspend_late stage are successful and some device can fail to suspend in suspend_noirq phase. So some devices successfully suspended in suspend_late stage are not getting chance to execute __device_suspend_noirq() to set dev->power.must_resume variable to true and not getting resumed in early_resume phase. Add a check for device's DPM_FLAG_MAY_SKIP_RESUME flag before setting power.must_resume variable in __device_suspend function. Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase") Signed-off-by: Prasad Sodagudi Signed-off-by: Rafael J. Wysocki commit 75b96f0ec5faf730128c32187e3e28441c27a094 Merge: 996fe06160998 a9667ac88e2b2 Author: Linus Torvalds Date: Tue Sep 7 12:18:29 2021 -0700 Merge tag 'fuse-update-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Allow mounting an active fuse device. Previously the fuse device would always be mounted during initialization, and sharing a fuse superblock was only possible through mount or namespace cloning - Fix data flushing in syncfs (virtiofs only) - Fix data flushing in copy_file_range() - Fix a possible deadlock in atomic O_TRUNC - Misc fixes and cleanups * tag 'fuse-update-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: remove unused arg in fuse_write_file_get() fuse: wait for writepages in syncfs fuse: flush extending writes fuse: truncate pagecache on atomic_o_trunc fuse: allow sharing existing sb fuse: move fget() to fuse_get_tree() fuse: move option checking into fuse_fill_super() fuse: name fs_context consistently fuse: fix use after free in fuse_read_interrupt() commit d62aab8ff711dc3a4c07684ea33042347f79b630 Author: Lukasz Luba Date: Mon Sep 6 09:44:53 2021 +0100 Documentation: power: include kernel-doc in Energy Model doc Improve the existing documentation of the Energy Model and add kernel-doc comments. This extends an API description and helps better understanding the usage. Signed-off-by: Lukasz Luba Signed-off-by: Rafael J. Wysocki commit ca67408ad57a5a67ad6801d792c40c010451bdef Author: Lukasz Luba Date: Mon Sep 6 09:44:52 2021 +0100 PM: EM: fix kernel-doc comments Fix the kernel-doc comments for the improved Energy Model documentation. Signed-off-by: Lukasz Luba Signed-off-by: Rafael J. Wysocki commit 46573fd6369f098f15e11768850b6430f374905f Author: Rafael J. Wysocki Date: Sat Sep 4 15:53:39 2021 +0200 cpufreq: intel_pstate: hybrid: Rework HWP calibration The current HWP calibration for hybrid processors in intel_pstate is fragile, because it depends too much on the information provided by the platform firmware via CPPC which may not be reliable enough. It also need not be so complicated. In order to improve that mechanism and make it more resistant to platform firmware issues, make it only use the CPPC nominal_perf values to compute the HWP-to-frequency scaling factors for all CPUs and possibly use the HWP_CAP highest_perf values to recompute them if the ones derived from the CPPC nominal_perf values alone appear to be too high. Namely, fetch CPC.nominal_perf for all CPUs present in the system, find the minimum one and use it as a reference for computing all of the CPUs' scaling factors (using the observation that for the CPUs having the minimum CPC.nominal_perf the HWP range of available performance levels should be the same as the range of available "legacy" P-states and so the HWP-to-frequency scaling factor for them should be the same as the corresponding scaling factor used for representing the P-state values in kHz). Signed-off-by: Rafael J. Wysocki Tested-by: Zhang Rui commit 0654cf05d17bc4d296a53a8bc7d107bc8a795f2e Author: Rafael J. Wysocki Date: Sat Sep 4 15:51:45 2021 +0200 ACPI: CPPC: Introduce cppc_get_nominal_perf() On some systems the nominal_perf value retrieved via CPPC is just a constant and fetching it doesn't require accessing any registers, so if it is the only CPPC capability that's needed, it is wasteful to run cppc_get_perf_caps() in order to get just that value alone, especially when this is done for CPUs other than the one running the code. For this reason, introduce cppc_get_nominal_perf() allowing nominal_perf to be obtained individually, by generalizing the existing cppc_get_desired_perf() (and renaming it) so it can be used to retrieve any specific CPPC capability value. While at it, clean up the cppc_get_desired_perf() kerneldoc comment a bit. Signed-off-by: Rafael J. Wysocki commit 66e0aeaa8bae6d464f7bcd2767c10c8c84658362 Author: Kari Argillander Date: Sat Sep 4 00:06:33 2021 +0300 ACPI: scan: Remove unneeded header linux/nls.h Code that use linux/nls.h was moved to device_sysfs.c by commit c2efefb33abf ("ACPI / scan: Move sysfs-related device code to a separate file") Remove this include so that complier has easier times and it would be easier to grep where nls code is used. Signed-off-by: Kari Argillander Signed-off-by: Rafael J. Wysocki commit d216bfb4d7984a510e984d2c94ae6d2251d76aee Author: Sergey Shtylyov Date: Thu Sep 2 23:57:29 2021 +0300 PM: sleep: wakeirq: drop useless parameter from dev_pm_attach_wake_irq() This function has the 'irq' parameter which isn't ever used, so drop it. Signed-off-by: Sergey Shtylyov [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 996fe06160998a38ff07189feb3ec8ab8f68fd4e Merge: 0bcfe68b87674 f8416aa291854 Author: Linus Torvalds Date: Tue Sep 7 12:08:04 2021 -0700 Merge tag 'kgdb-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Changes for kgdb/kdb this cycle are dominated by a change from Sumit that removes as small (256K) private heap from kdb. This is change I've hoped for ever since I discovered how few users of this heap remained in the kernel, so many thanks to Sumit for hunting these down. The other change is an incremental step towards SPDX headers" * tag 'kgdb-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kernel: debug: Convert to SPDX identifier kdb: Rename members of struct kdbtab_t kdb: Simplify kdb_defcmd macro logic kdb: Get rid of redundant kdb_register_flags() kdb: Rename struct defcmd_set to struct kdb_macro kdb: Get rid of custom debug heap allocator commit 2b922a9d064f8e86b53b04f5819917b7a04142ed Author: Dan Williams Date: Fri Sep 3 19:21:06 2021 -0700 cxl/registers: Fix Documentation warning Commit 0f06157e0135 ("cxl/core: Move register mapping infrastructure") neglected to add a DOC header for the new drivers/core/regs.c file. Reported-by: Ben Widawsky Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/163072206675.2250120.3527179192933919995.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit a01da6ca7d0ad66b6fa2dc4af0fc97ca8ba28b45 Author: Dan Williams Date: Fri Sep 3 19:21:01 2021 -0700 cxl/pmem: Fix Documentation warning Commit 06737cd0d216 ("cxl/core: Move pmem functionality") neglected to add a DOC header for the new drivers/cxl/core/pmem.c file. Reported-by: Ben Widawsky Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/163072206163.2250120.11486436976516079516.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 9d1b3afd73047d4dd30e3636412c9f9b5def2b14 Author: Ben Widawsky Date: Fri Sep 3 19:20:56 2021 -0700 cxl/uapi: Fix defined but not used warnings Fix unused-const-variable warnings emitted by gcc when cxlmem.h is used by pretty much all files except pci.c Signed-off-by: Ben Widawsky Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/163072205652.2250120.16833548560832424468.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit da582aa5ad5787c46e3f475ab3f4602ec84c1617 Author: Li Qiang (Johnny Li) Date: Fri Sep 3 19:20:50 2021 -0700 cxl/pci: Fix debug message in cxl_probe_regs() Indicator string for mbox and memdev register set to status incorrectly in error message. Cc: Fixes: 30af97296f48 ("cxl/pci: Map registers based on capabilities") Signed-off-by: Li Qiang (Johnny Li) Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/163072205089.2250120.8103605864156687395.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b Author: Dan Williams Date: Fri Sep 3 19:20:45 2021 -0700 cxl/pci: Fix lockdown level A proposed rework of security_locked_down() users identified that the cxl_pci driver was passing the wrong lockdown_reason. Update cxl_mem_raw_command_allowed() to fail raw command access when raw pci access is also disabled. Fixes: 13237183c735 ("cxl/mem: Add a "RAW" send command") Cc: Ben Widawsky Cc: Jonathan Cameron Cc: Cc: Ondrej Mosnacek Cc: Paul Moore Link: https://lore.kernel.org/r/163072204525.2250120.16615792476976546735.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit a7bfaad54b8b9cf06041528988d6b75b4b921546 Author: Alison Schofield Date: Fri Sep 3 19:20:39 2021 -0700 cxl/acpi: Do not add DSDT disabled ACPI0016 host bridge ports During CXL ACPI probe, host bridge ports are discovered by scanning the ACPI0017 root port for ACPI0016 host bridge devices. The scan matches on the hardware id of "ACPI0016". An issue occurs when an ACPI0016 device is defined in the DSDT yet disabled on the platform. Attempts by the cxl_acpi driver to add host bridge ports using a disabled device fails, and the entire cxl_acpi probe fails. The DSDT table includes an _STA method that sets the status and the ACPI subsystem has checks available to examine it. One such check is in the acpi_pci_find_root() path. Move the call to acpi_pci_find_root() to the matching function to prevent this issue when adding either upstream or downstream ports. Suggested-by: Dan Williams Signed-off-by: Alison Schofield Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances") Cc: Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/163072203957.2250120.2178685721061002124.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 0bcfe68b876748762557797a940d0a82de700629 Author: Linus Torvalds Date: Tue Sep 7 11:26:23 2021 -0700 Revert "memcg: enable accounting for pollfd and select bits arrays" This reverts commit b655843444152c0a14b749308e4cb35d91cbcf0b. Just like with the memcg lock accounting, the kernel test robot reports a sizeable performance regression for this commit, and while it clearly does the rigth thing in theory, we'll need to look at just how to avoid or minimize the performance overhead of the memcg accounting. People already have suggestions on how to do that, but it's "future work". So revert it for now. [ Note: the first link below is for this same commit but a different commit ID, because it's the kernel test robot ended up noticing it in Andrew Morton's patch queue ] Link: https://lore.kernel.org/lkml/20210905132732.GC15026@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/lkml/20210907150757.GE17617@xsang-OptiPlex-9020/ Acked-by: Jens Axboe Acked-by: Shakeel Butt Acked-by: Roman Gushchin Cc: Tejun Heo Signed-off-by: Linus Torvalds commit 3754707bcc3e190e5dadc978d172b61e809cb3bd Author: Linus Torvalds Date: Tue Sep 7 11:21:48 2021 -0700 Revert "memcg: enable accounting for file lock caches" This reverts commit 0f12156dff2862ac54235fc72703f18770769042. The kernel test robot reports a sizeable performance regression for this commit, and while it clearly does the rigth thing in theory, we'll need to look at just how to avoid or minimize the performance overhead of the memcg accounting. People already have suggestions on how to do that, but it's "future work". So revert it for now. Link: https://lore.kernel.org/lkml/20210907150757.GE17617@xsang-OptiPlex-9020/ Acked-by: Jens Axboe Acked-by: Shakeel Butt Acked-by: Roman Gushchin Cc: Tejun Heo Signed-off-by: Linus Torvalds commit cd1adf1b63a112d762832e9c64b0a886fbb840d6 Author: Linus Torvalds Date: Tue Sep 7 11:03:45 2021 -0700 Revert "mm/gup: remove try_get_page(), call try_get_compound_head() directly" This reverts commit 9857a17f206ff374aea78bccfb687f145368be2e. That commit was completely broken, and I should have caught on to it earlier. But happily, the kernel test robot noticed the breakage fairly quickly. The breakage is because "try_get_page()" is about avoiding the page reference count overflow case, but is otherwise the exact same as a plain "get_page()". In contrast, "try_get_compound_head()" is an entirely different beast, and uses __page_cache_add_speculative() because it's not just about the page reference count, but also about possibly racing with the underlying page going away. So all the commentary about how "try_get_page() has fallen a little behind in terms of maintenance, try_get_compound_head() handles speculative page references more thoroughly" was just completely wrong: yes, try_get_compound_head() handles speculative page references, but the point is that try_get_page() does not, and must not. So there's no lack of maintainance - there are fundamentally different semantics. A speculative page reference would be entirely wrong in "get_page()", and it's entirely wrong in "try_get_page()". It's not about speculation, it's purely about "uhhuh, you can't get this page because you've tried to increment the reference count too much already". The reason the kernel test robot noticed this bug was that it hit the VM_BUG_ON() in __page_cache_add_speculative(), which is all about verifying that the context of any speculative page access is correct. But since that isn't what try_get_page() is all about, the VM_BUG_ON() tests things that are not correct to test for try_get_page(). Reported-by: kernel test robot Cc: John Hubbard Cc: Christoph Hellwig Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 3a029e1f3d6e2ee809e85abecce619a48016bd4b Author: Jean-Philippe Brucker Date: Mon Sep 6 17:36:38 2021 +0100 selftests/bpf: Fix build of task_pt_regs test for arm64 struct pt_regs is not exported to userspace on all archs. arm64 and s390 export "user_pt_regs" instead, which causes build failure at the moment: progs/test_task_pt_regs.c:8:16: error: variable has incomplete type 'struct pt_regs' struct pt_regs current_regs = {}; Instead of using pt_regs from ptrace.h, use the larger kernel struct from vmlinux.h directly. Since the test runner task_pt_regs.c does not have access to the kernel struct definition, copy it into a char array. Fixes: 576d47bb1a92 ("bpf: selftests: Add bpf_task_pt_regs() selftest") Suggested-by: Andrii Nakryiko Signed-off-by: Jean-Philippe Brucker Signed-off-by: Daniel Borkmann Tested-by: Ilya Leoshkevich Acked-by: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20210906163635.302307-1-jean-philippe@linaro.org commit 0dca4462ed0681649fdcd5700a6ddfbaa65fa178 Author: Christoph Hellwig Date: Tue Sep 7 16:13:03 2021 +0200 block: move fs/block_dev.c to block/bdev.c Move it together with the rest of the block layer. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210907141303.1371844-3-hch@lst.de Signed-off-by: Jens Axboe commit cd82cca7ebfe9c6c74a8e5b28382ba88177ba5f1 Author: Christoph Hellwig Date: Tue Sep 7 16:13:02 2021 +0200 block: split out operations on block special files Add a new block/fops.c for all the file and address_space operations that provide the block special file support. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210907141303.1371844-2-hch@lst.de [axboe: correct trailing whitespace while at it] Signed-off-by: Jens Axboe commit 49d82b1445f13b2754aacc38d73d0cf1b515456c Merge: 884f0e84f1e31 aff959c284085 Author: Jens Axboe Date: Tue Sep 7 08:37:19 2021 -0600 Merge tag 'nvme-5.15-2021-09-07' of git://git.infradead.org/nvme into block-5.15 Pull NVMe fixes from Christoph: "nvme fixes for Linux 5.15 - fix nvmet command set reporting for passthrough controllers (Adam Manzanares) - updated - update a MAINTAINERS email address (Chaitanya Kulkarni) - set QUEUE_FLAG_NOWAIT for nvme-multipth (me) - handle errors from add_disk() (Luis Chamberlain) - update the keep alive interval when kato is modified (Tatsuya Sasaki) - fix a buffer overrun in nvmet_subsys_attr_serial (Hannes Reinecke) - do not reset transport on data digest errors in nvme-tcp (Daniel Wagner) - only call synchronize_srcu when clearing current path (Daniel Wagner) - revalidate paths during rescan (Hannes Reinecke)" * tag 'nvme-5.15-2021-09-07' of git://git.infradead.org/nvme: nvme: update MAINTAINERS email address nvme: add error handling support for add_disk() nvme: only call synchronize_srcu when clearing current path nvme: update keep alive interval when kato is modified nvme-tcp: Do not reset transport on data digest errors nvmet: fixup buffer overrun in nvmet_subsys_attr_serial() nvmet: return bool from nvmet_passthru_ctrl and nvmet_is_passthru_req nvmet: looks at the passthrough controller when initializing CAP nvme: move nvme_multi_css into nvme.h nvme-multipath: revalidate paths during rescan nvme-multipath: set QUEUE_FLAG_NOWAIT commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 Author: Li Jinlin Date: Tue Sep 7 20:12:42 2021 +0800 blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() The pending timer has been set up in blk_throtl_init(). However, the timer is not deleted in blk_throtl_exit(). This means that the timer handler may still be running after freeing the timer, which would result in a use-after-free. Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit(). Signed-off-by: Li Jinlin Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com Signed-off-by: Jens Axboe commit dfbb3409b27fa42b96f5727a80d3ceb6a8663991 Author: Tetsuo Handa Date: Tue Sep 7 20:52:13 2021 +0900 block: genhd: don't call blkdev_show() with major_names_lock held If CONFIG_BLK_DEV_LOOP && CONFIG_MTD (at least; there might be other combinations), lockdep complains circular locking dependency at __loop_clr_fd(), for major_names_lock serves as a locking dependency aggregating hub across multiple block modules. ====================================================== WARNING: possible circular locking dependency detected 5.14.0+ #757 Tainted: G E ------------------------------------------------------ systemd-udevd/7568 is trying to acquire lock: ffff88800f334d48 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x70/0x560 but task is already holding lock: ffff888014a7d4a0 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x4d/0x400 [loop] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #6 (&lo->lo_mutex){+.+.}-{3:3}: lock_acquire+0xbe/0x1f0 __mutex_lock_common+0xb6/0xe10 mutex_lock_killable_nested+0x17/0x20 lo_open+0x23/0x50 [loop] blkdev_get_by_dev+0x199/0x540 blkdev_open+0x58/0x90 do_dentry_open+0x144/0x3a0 path_openat+0xa57/0xda0 do_filp_open+0x9f/0x140 do_sys_openat2+0x71/0x150 __x64_sys_openat+0x78/0xa0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #5 (&disk->open_mutex){+.+.}-{3:3}: lock_acquire+0xbe/0x1f0 __mutex_lock_common+0xb6/0xe10 mutex_lock_nested+0x17/0x20 bd_register_pending_holders+0x20/0x100 device_add_disk+0x1ae/0x390 loop_add+0x29c/0x2d0 [loop] blk_request_module+0x5a/0xb0 blkdev_get_no_open+0x27/0xa0 blkdev_get_by_dev+0x5f/0x540 blkdev_open+0x58/0x90 do_dentry_open+0x144/0x3a0 path_openat+0xa57/0xda0 do_filp_open+0x9f/0x140 do_sys_openat2+0x71/0x150 __x64_sys_openat+0x78/0xa0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #4 (major_names_lock){+.+.}-{3:3}: lock_acquire+0xbe/0x1f0 __mutex_lock_common+0xb6/0xe10 mutex_lock_nested+0x17/0x20 blkdev_show+0x19/0x80 devinfo_show+0x52/0x60 seq_read_iter+0x2d5/0x3e0 proc_reg_read_iter+0x41/0x80 vfs_read+0x2ac/0x330 ksys_read+0x6b/0xd0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #3 (&p->lock){+.+.}-{3:3}: lock_acquire+0xbe/0x1f0 __mutex_lock_common+0xb6/0xe10 mutex_lock_nested+0x17/0x20 seq_read_iter+0x37/0x3e0 generic_file_splice_read+0xf3/0x170 splice_direct_to_actor+0x14e/0x350 do_splice_direct+0x84/0xd0 do_sendfile+0x263/0x430 __se_sys_sendfile64+0x96/0xc0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #2 (sb_writers#3){.+.+}-{0:0}: lock_acquire+0xbe/0x1f0 lo_write_bvec+0x96/0x280 [loop] loop_process_work+0xa68/0xc10 [loop] process_one_work+0x293/0x480 worker_thread+0x23d/0x4b0 kthread+0x163/0x180 ret_from_fork+0x1f/0x30 -> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}: lock_acquire+0xbe/0x1f0 process_one_work+0x280/0x480 worker_thread+0x23d/0x4b0 kthread+0x163/0x180 ret_from_fork+0x1f/0x30 -> #0 ((wq_completion)loop0){+.+.}-{0:0}: validate_chain+0x1f0d/0x33e0 __lock_acquire+0x92d/0x1030 lock_acquire+0xbe/0x1f0 flush_workqueue+0x8c/0x560 drain_workqueue+0x80/0x140 destroy_workqueue+0x47/0x4f0 __loop_clr_fd+0xb4/0x400 [loop] blkdev_put+0x14a/0x1d0 blkdev_close+0x1c/0x20 __fput+0xfd/0x220 task_work_run+0x69/0xc0 exit_to_user_mode_prepare+0x1ce/0x1f0 syscall_exit_to_user_mode+0x26/0x60 do_syscall_64+0x4c/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: (wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&lo->lo_mutex); lock(&disk->open_mutex); lock(&lo->lo_mutex); lock((wq_completion)loop0); *** DEADLOCK *** 2 locks held by systemd-udevd/7568: #0: ffff888012554128 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0x4c/0x1d0 #1: ffff888014a7d4a0 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x4d/0x400 [loop] stack backtrace: CPU: 0 PID: 7568 Comm: systemd-udevd Tainted: G E 5.14.0+ #757 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack_lvl+0x79/0xbf print_circular_bug+0x5d6/0x5e0 ? stack_trace_save+0x42/0x60 ? save_trace+0x3d/0x2d0 check_noncircular+0x10b/0x120 validate_chain+0x1f0d/0x33e0 ? __lock_acquire+0x953/0x1030 ? __lock_acquire+0x953/0x1030 __lock_acquire+0x92d/0x1030 ? flush_workqueue+0x70/0x560 lock_acquire+0xbe/0x1f0 ? flush_workqueue+0x70/0x560 flush_workqueue+0x8c/0x560 ? flush_workqueue+0x70/0x560 ? sched_clock_cpu+0xe/0x1a0 ? drain_workqueue+0x41/0x140 drain_workqueue+0x80/0x140 destroy_workqueue+0x47/0x4f0 ? blk_mq_freeze_queue_wait+0xac/0xd0 __loop_clr_fd+0xb4/0x400 [loop] ? __mutex_unlock_slowpath+0x35/0x230 blkdev_put+0x14a/0x1d0 blkdev_close+0x1c/0x20 __fput+0xfd/0x220 task_work_run+0x69/0xc0 exit_to_user_mode_prepare+0x1ce/0x1f0 syscall_exit_to_user_mode+0x26/0x60 do_syscall_64+0x4c/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0fd4c661f7 Code: 00 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 13 fc ff ff RSP: 002b:00007ffd1c9e9fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 00007f0fd46be6c8 RCX: 00007f0fd4c661f7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 RBP: 0000000000000006 R08: 000055fff1eaf400 R09: 0000000000000000 R10: 00007f0fd46be6c8 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000002f08 R15: 00007ffd1c9ea050 Commit 1c500ad706383f1a ("loop: reduce the loop_ctl_mutex scope") is for breaking "loop_ctl_mutex => &lo->lo_mutex" dependency chain. But enabling a different block module results in forming circular locking dependency due to shared major_names_lock mutex. The simplest fix is to call probe function without holding major_names_lock [1], but Christoph Hellwig does not like such idea. Therefore, instead of holding major_names_lock in blkdev_show(), introduce a different lock for blkdev_show() in order to break "sb_writers#$N => &p->lock => major_names_lock" dependency chain. Link: https://lkml.kernel.org/r/b2af8a5b-3c1b-204e-7f56-bea0b15848d6@i-love.sakura.ne.jp [1] Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/18a02da2-0bf3-550e-b071-2b4ab13c49f0@i-love.sakura.ne.jp Signed-off-by: Jens Axboe commit 27de8d597020755b6bdeca7036463ca6d0b4c295 Merge: dd7c46d6e58e8 4855e26bcf4d2 Author: Rafael J. Wysocki Date: Tue Sep 7 15:42:10 2021 +0200 Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull more ARM cpufreq changes for v5.15-rc1 from Viresh Kumar: "This adds a new cpufreq driver for Mediatek, which had been going through reviews since last one year." * 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: mediatek-hw: Add support for CPUFREQ HW cpufreq: Add of_perf_domain_get_sharing_cpumask dt-bindings: cpufreq: add bindings for MediaTek cpufreq HW commit dd7c46d6e58e8737b0ac3ba21e8584c2632dba65 Author: Rafael J. Wysocki Date: Tue Sep 7 15:32:48 2021 +0200 Revert "cpufreq: intel_pstate: Process HWP Guaranteed change notification" Revert commit d0e936adbd22 ("cpufreq: intel_pstate: Process HWP Guaranteed change notification"), because it causes a NULL pointer dereference to occur on Lenovo X1 gen9 laptops due to an HWP guaranteed performance change interrupt arriving prematurely. This feature will be revisited in the next cycle. Reported-by: Jens Axboe Signed-off-by: Rafael J. Wysocki commit 0f77f2defaf682eb7e7ef623168e49c74ae529e3 Author: Colin Ian King Date: Tue Sep 7 11:28:14 2021 +0100 ieee802154: Remove redundant initialization of variable ret The variable ret is being initialized with a value that is never read, it is being updated later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit d1bf73387b5adbc12c6a59c1fbaa69e05ee265ed Merge: 0341d5e3d1ee2 90702dcd19c09 Author: David S. Miller Date: Tue Sep 7 14:04:59 2021 +0100 Merge branch 'stmmac-wol-fix' Joakim Zhang says: ==================== net: stmmac: fix WoL issue This patch set fixes stmmac not working after system resume back with WoL active. Thanks a lot for Russell King keeps looking into this issue. ==================== Signed-off-by: David S. Miller commit 90702dcd19c093621b422ba16fcfd870afe2552f Author: Joakim Zhang Date: Tue Sep 7 18:56:47 2021 +0800 net: stmmac: fix MAC not working when system resume back with WoL active We can reproduce this issue with below steps: 1) enable WoL on the host 2) host system suspended 3) remote client send out wakeup packets We can see that host system resume back, but can't work, such as ping failed. After a bit digging, this issue is introduced by the commit 46f69ded988d ("net: stmmac: Use resolved link config in mac_link_up()"), which use the finalised link parameters in mac_link_up() rather than the parameters in mac_config(). There are two scenarios for MAC suspend/resume in STMMAC driver: 1) MAC suspend with WoL inactive, stmmac_suspend() call phylink_mac_change() to notify phylink machine that a change in MAC state, then .mac_link_down callback would be invoked. Further, it will call phylink_stop() to stop the phylink instance. When MAC resume back, firstly phylink_start() is called to start the phylink instance, then call phylink_mac_change() which will finally trigger phylink machine to invoke .mac_config and .mac_link_up callback. All is fine since configuration in these two callbacks will be initialized, that means MAC can restore the state. 2) MAC suspend with WoL active, phylink_mac_change() will put link down, but there is no phylink_stop() to stop the phylink instance, so it will link up again, that means .mac_config and .mac_link_up would be invoked before system suspended. After system resume back, it will do DMA initialization and SW reset which let MAC lost the hardware setting (i.e MAC_Configuration register(offset 0x0) is reset). Since link is up before system suspended, so .mac_link_up would not be invoked after system resume back, lead to there is no chance to initialize the configuration in .mac_link_up callback, as a result, MAC can't work any longer. After discussed with Russell King [1], we confirm that phylink framework have not take WoL into consideration yet. This patch calls phylink_suspend()/phylink_resume() functions which is newly introduced by Russell King to fix this issue. [1] https://lore.kernel.org/netdev/20210901090228.11308-1-qiangqing.zhang@nxp.com/ Fixes: 46f69ded988d ("net: stmmac: Use resolved link config in mac_link_up()") Signed-off-by: Joakim Zhang Signed-off-by: David S. Miller commit f97493657c6372eeefe70faadd214bf31488c44e Author: Russell King (Oracle) Date: Tue Sep 7 18:56:46 2021 +0800 net: phylink: add suspend/resume support Joakim Zhang reports that Wake-on-Lan with the stmmac ethernet driver broke when moving the incorrect handling of mac link state out of mac_config(). This reason this breaks is because the stmmac's WoL is handled by the MAC rather than the PHY, and phylink doesn't cater for that scenario. This patch adds the necessary phylink code to handle suspend/resume events according to whether the MAC still needs a valid link or not. This is the barest minimum for this support. Reported-by: Joakim Zhang Tested-by: Joakim Zhang Signed-off-by: Russell King (Oracle) Signed-off-by: Joakim Zhang Signed-off-by: David S. Miller commit 0341d5e3d1ee2a36dd5a49b5bef2ce4ad1cfa6b4 Author: Yoshihiro Shimoda Date: Tue Sep 7 20:29:40 2021 +0900 net: renesas: sh_eth: Fix freeing wrong tx descriptor The cur_tx counter must be incremented after TACT bit of txdesc->status was set. However, a CPU is possible to reorder instructions and/or memory accesses between cur_tx and txdesc->status. And then, if TX interrupt happened at such a timing, the sh_eth_tx_free() may free the descriptor wrongly. So, add wmb() before cur_tx++. Otherwise NETDEV WATCHDOG timeout is possible to happen. Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit f79645df806565a03abb2847a1d20e6930b25e7e Author: Naohiro Aota Date: Tue Sep 7 00:04:28 2021 +0900 btrfs: zoned: fix double counting of split ordered extent btrfs_add_ordered_extent_*() add num_bytes to fs_info->ordered_bytes. Then, splitting an ordered extent will call btrfs_add_ordered_extent_*() again for split extents, leading to double counting of the region of a split extent. These leaked bytes are finally reported at unmount time as follow: BTRFS info (device dm-1): at unmount dio bytes count 364544 Fix the double counting by subtracting split extent's size from fs_info->ordered_bytes. Fixes: d22002fd37bd ("btrfs: zoned: split ordered extent when bio is sent") CC: stable@vger.kernel.org # 5.12+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit c124706900c20dee70f921bb3a90492431561a0a Author: Anand Jain Date: Tue Aug 31 09:21:28 2021 +0800 btrfs: fix lockdep warning while mounting sprout fs Following test case reproduces lockdep warning. Test case: $ mkfs.btrfs -f $ btrfstune -S 1 $ mount $ btrfs device add -f $ umount $ mount $ umount The warning claims a possible ABBA deadlock between the threads initiated by [#1] btrfs device add and [#0] the mount. [ 540.743122] WARNING: possible circular locking dependency detected [ 540.743129] 5.11.0-rc7+ #5 Not tainted [ 540.743135] ------------------------------------------------------ [ 540.743142] mount/2515 is trying to acquire lock: [ 540.743149] ffffa0c5544c2ce0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: clone_fs_devices+0x6d/0x210 [btrfs] [ 540.743458] but task is already holding lock: [ 540.743461] ffffa0c54a7932b8 (btrfs-chunk-00){++++}-{4:4}, at: __btrfs_tree_read_lock+0x32/0x200 [btrfs] [ 540.743541] which lock already depends on the new lock. [ 540.743543] the existing dependency chain (in reverse order) is: [ 540.743546] -> #1 (btrfs-chunk-00){++++}-{4:4}: [ 540.743566] down_read_nested+0x48/0x2b0 [ 540.743585] __btrfs_tree_read_lock+0x32/0x200 [btrfs] [ 540.743650] btrfs_read_lock_root_node+0x70/0x200 [btrfs] [ 540.743733] btrfs_search_slot+0x6c6/0xe00 [btrfs] [ 540.743785] btrfs_update_device+0x83/0x260 [btrfs] [ 540.743849] btrfs_finish_chunk_alloc+0x13f/0x660 [btrfs] <--- device_list_mutex [ 540.743911] btrfs_create_pending_block_groups+0x18d/0x3f0 [btrfs] [ 540.743982] btrfs_commit_transaction+0x86/0x1260 [btrfs] [ 540.744037] btrfs_init_new_device+0x1600/0x1dd0 [btrfs] [ 540.744101] btrfs_ioctl+0x1c77/0x24c0 [btrfs] [ 540.744166] __x64_sys_ioctl+0xe4/0x140 [ 540.744170] do_syscall_64+0x4b/0x80 [ 540.744174] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 540.744180] -> #0 (&fs_devs->device_list_mutex){+.+.}-{4:4}: [ 540.744184] __lock_acquire+0x155f/0x2360 [ 540.744188] lock_acquire+0x10b/0x5c0 [ 540.744190] __mutex_lock+0xb1/0xf80 [ 540.744193] mutex_lock_nested+0x27/0x30 [ 540.744196] clone_fs_devices+0x6d/0x210 [btrfs] [ 540.744270] btrfs_read_chunk_tree+0x3c7/0xbb0 [btrfs] [ 540.744336] open_ctree+0xf6e/0x2074 [btrfs] [ 540.744406] btrfs_mount_root.cold.72+0x16/0x127 [btrfs] [ 540.744472] legacy_get_tree+0x38/0x90 [ 540.744475] vfs_get_tree+0x30/0x140 [ 540.744478] fc_mount+0x16/0x60 [ 540.744482] vfs_kern_mount+0x91/0x100 [ 540.744484] btrfs_mount+0x1e6/0x670 [btrfs] [ 540.744536] legacy_get_tree+0x38/0x90 [ 540.744537] vfs_get_tree+0x30/0x140 [ 540.744539] path_mount+0x8d8/0x1070 [ 540.744541] do_mount+0x8d/0xc0 [ 540.744543] __x64_sys_mount+0x125/0x160 [ 540.744545] do_syscall_64+0x4b/0x80 [ 540.744547] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 540.744551] other info that might help us debug this: [ 540.744552] Possible unsafe locking scenario: [ 540.744553] CPU0 CPU1 [ 540.744554] ---- ---- [ 540.744555] lock(btrfs-chunk-00); [ 540.744557] lock(&fs_devs->device_list_mutex); [ 540.744560] lock(btrfs-chunk-00); [ 540.744562] lock(&fs_devs->device_list_mutex); [ 540.744564] *** DEADLOCK *** [ 540.744565] 3 locks held by mount/2515: [ 540.744567] #0: ffffa0c56bf7a0e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.isra.16+0xdf/0x450 [ 540.744574] #1: ffffffffc05a9628 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0x63/0xbb0 [btrfs] [ 540.744640] #2: ffffa0c54a7932b8 (btrfs-chunk-00){++++}-{4:4}, at: __btrfs_tree_read_lock+0x32/0x200 [btrfs] [ 540.744708] stack backtrace: [ 540.744712] CPU: 2 PID: 2515 Comm: mount Not tainted 5.11.0-rc7+ #5 But the device_list_mutex in clone_fs_devices() is redundant, as explained below. Two threads [1] and [2] (below) could lead to clone_fs_device(). [1] open_ctree <== mount sprout fs btrfs_read_chunk_tree() mutex_lock(&uuid_mutex) <== global lock read_one_dev() open_seed_devices() clone_fs_devices() <== seed fs_devices mutex_lock(&orig->device_list_mutex) <== seed fs_devices [2] btrfs_init_new_device() <== sprouting mutex_lock(&uuid_mutex); <== global lock btrfs_prepare_sprout() lockdep_assert_held(&uuid_mutex) clone_fs_devices(seed_fs_device) <== seed fs_devices Both of these threads hold uuid_mutex which is sufficient to protect getting the seed device(s) freed while we are trying to clone it for sprouting [2] or mounting a sprout [1] (as above). A mounted seed device can not free/write/replace because it is read-only. An unmounted seed device can be freed by btrfs_free_stale_devices(), but it needs uuid_mutex. So this patch removes the unnecessary device_list_mutex in clone_fs_devices(). And adds a lockdep_assert_held(&uuid_mutex) in clone_fs_devices(). Reported-by: Su Yue Tested-by: Su Yue Signed-off-by: Anand Jain Signed-off-by: David Sterba commit 3fa421dedbc82f985f030c5a6480ea2d784334c3 Author: Josef Bacik Date: Tue Jul 27 17:01:17 2021 -0400 btrfs: delay blkdev_put until after the device remove When removing the device we call blkdev_put() on the device once we've removed it, and because we have an EXCL open we need to take the ->open_mutex on the block device to clean it up. Unfortunately during device remove we are holding the sb writers lock, which results in the following lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 5.14.0-rc2+ #407 Not tainted ------------------------------------------------------ losetup/11595 is trying to acquire lock: ffff973ac35dd138 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x67/0x5e0 but task is already holding lock: ffff973ac9812c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&lo->lo_mutex){+.+.}-{3:3}: __mutex_lock+0x7d/0x750 lo_open+0x28/0x60 [loop] blkdev_get_whole+0x25/0xf0 blkdev_get_by_dev.part.0+0x168/0x3c0 blkdev_open+0xd2/0xe0 do_dentry_open+0x161/0x390 path_openat+0x3cc/0xa20 do_filp_open+0x96/0x120 do_sys_openat2+0x7b/0x130 __x64_sys_openat+0x46/0x70 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #3 (&disk->open_mutex){+.+.}-{3:3}: __mutex_lock+0x7d/0x750 blkdev_put+0x3a/0x220 btrfs_rm_device.cold+0x62/0xe5 btrfs_ioctl+0x2a31/0x2e70 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #2 (sb_writers#12){.+.+}-{0:0}: lo_write_bvec+0xc2/0x240 [loop] loop_process_work+0x238/0xd00 [loop] process_one_work+0x26b/0x560 worker_thread+0x55/0x3c0 kthread+0x140/0x160 ret_from_fork+0x1f/0x30 -> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}: process_one_work+0x245/0x560 worker_thread+0x55/0x3c0 kthread+0x140/0x160 ret_from_fork+0x1f/0x30 -> #0 ((wq_completion)loop0){+.+.}-{0:0}: __lock_acquire+0x10ea/0x1d90 lock_acquire+0xb5/0x2b0 flush_workqueue+0x91/0x5e0 drain_workqueue+0xa0/0x110 destroy_workqueue+0x36/0x250 __loop_clr_fd+0x9a/0x660 [loop] block_ioctl+0x3f/0x50 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: (wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&lo->lo_mutex); lock(&disk->open_mutex); lock(&lo->lo_mutex); lock((wq_completion)loop0); *** DEADLOCK *** 1 lock held by losetup/11595: #0: ffff973ac9812c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop] stack backtrace: CPU: 0 PID: 11595 Comm: losetup Not tainted 5.14.0-rc2+ #407 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Call Trace: dump_stack_lvl+0x57/0x72 check_noncircular+0xcf/0xf0 ? stack_trace_save+0x3b/0x50 __lock_acquire+0x10ea/0x1d90 lock_acquire+0xb5/0x2b0 ? flush_workqueue+0x67/0x5e0 ? lockdep_init_map_type+0x47/0x220 flush_workqueue+0x91/0x5e0 ? flush_workqueue+0x67/0x5e0 ? verify_cpu+0xf0/0x100 drain_workqueue+0xa0/0x110 destroy_workqueue+0x36/0x250 __loop_clr_fd+0x9a/0x660 [loop] ? blkdev_ioctl+0x8d/0x2a0 block_ioctl+0x3f/0x50 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc21255d4cb So instead save the bdev and do the put once we've dropped the sb writers lock in order to avoid the lockdep recursion. Reviewed-by: Anand Jain Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8f96a5bfa1503e0a5f3c78d51e993a1794d4aff1 Author: Josef Bacik Date: Tue Jul 27 17:01:16 2021 -0400 btrfs: update the bdev time directly when closing We update the ctime/mtime of a block device when we remove it so that blkid knows the device changed. However we do this by re-opening the block device and calling filp_update_time. This is more correct because it'll call the inode->i_op->update_time if it exists, but the block dev inodes do not do this. Instead call generic_update_time() on the bd_inode in order to avoid the blkdev_open path and get rid of the following lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 5.14.0-rc2+ #406 Not tainted ------------------------------------------------------ losetup/11596 is trying to acquire lock: ffff939640d2f538 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x67/0x5e0 but task is already holding lock: ffff939655510c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&lo->lo_mutex){+.+.}-{3:3}: __mutex_lock+0x7d/0x750 lo_open+0x28/0x60 [loop] blkdev_get_whole+0x25/0xf0 blkdev_get_by_dev.part.0+0x168/0x3c0 blkdev_open+0xd2/0xe0 do_dentry_open+0x161/0x390 path_openat+0x3cc/0xa20 do_filp_open+0x96/0x120 do_sys_openat2+0x7b/0x130 __x64_sys_openat+0x46/0x70 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #3 (&disk->open_mutex){+.+.}-{3:3}: __mutex_lock+0x7d/0x750 blkdev_get_by_dev.part.0+0x56/0x3c0 blkdev_open+0xd2/0xe0 do_dentry_open+0x161/0x390 path_openat+0x3cc/0xa20 do_filp_open+0x96/0x120 file_open_name+0xc7/0x170 filp_open+0x2c/0x50 btrfs_scratch_superblocks.part.0+0x10f/0x170 btrfs_rm_device.cold+0xe8/0xed btrfs_ioctl+0x2a31/0x2e70 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #2 (sb_writers#12){.+.+}-{0:0}: lo_write_bvec+0xc2/0x240 [loop] loop_process_work+0x238/0xd00 [loop] process_one_work+0x26b/0x560 worker_thread+0x55/0x3c0 kthread+0x140/0x160 ret_from_fork+0x1f/0x30 -> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}: process_one_work+0x245/0x560 worker_thread+0x55/0x3c0 kthread+0x140/0x160 ret_from_fork+0x1f/0x30 -> #0 ((wq_completion)loop0){+.+.}-{0:0}: __lock_acquire+0x10ea/0x1d90 lock_acquire+0xb5/0x2b0 flush_workqueue+0x91/0x5e0 drain_workqueue+0xa0/0x110 destroy_workqueue+0x36/0x250 __loop_clr_fd+0x9a/0x660 [loop] block_ioctl+0x3f/0x50 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Chain exists of: (wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&lo->lo_mutex); lock(&disk->open_mutex); lock(&lo->lo_mutex); lock((wq_completion)loop0); *** DEADLOCK *** 1 lock held by losetup/11596: #0: ffff939655510c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop] stack backtrace: CPU: 1 PID: 11596 Comm: losetup Not tainted 5.14.0-rc2+ #406 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Call Trace: dump_stack_lvl+0x57/0x72 check_noncircular+0xcf/0xf0 ? stack_trace_save+0x3b/0x50 __lock_acquire+0x10ea/0x1d90 lock_acquire+0xb5/0x2b0 ? flush_workqueue+0x67/0x5e0 ? lockdep_init_map_type+0x47/0x220 flush_workqueue+0x91/0x5e0 ? flush_workqueue+0x67/0x5e0 ? verify_cpu+0xf0/0x100 drain_workqueue+0xa0/0x110 destroy_workqueue+0x36/0x250 __loop_clr_fd+0x9a/0x660 [loop] ? blkdev_ioctl+0x8d/0x2a0 block_ioctl+0x3f/0x50 __x64_sys_ioctl+0x80/0xb0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Reviewed-by: Anand Jain Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit cde7417ce487988322d0bdaa02b4165082fbe388 Author: Kari Argillander Date: Tue Aug 31 00:51:52 2021 +0300 btrfs: use correct header for div_u64 in misc.h asm/do_div.h is for div_u64, but it is found in math64.h. This change will make compiler job easier and prevent compiler errors in situation where compiler will not find math64.h from another paths. Signed-off-by: Kari Argillander Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f93e834fa7c5faa0372e46828b4b2a966ac61d7 Author: Anand Jain Date: Tue Aug 10 23:23:44 2021 +0800 btrfs: fix upper limit for max_inline for page size 64K The mount option max_inline ranges from 0 to the sectorsize (which is now equal to page size). But we parse the mount options too early and before the actual sectorsize is read from the superblock. So the upper limit of max_inline is unaware of the actual sectorsize and is limited by the temporary sectorsize 4096, even on a system where the default sectorsize is 64K. Fix this by reading the superblock sectorsize before the mount option parse. Reported-by: Alexander Tsvetkov CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7d665612dd5ae0fe982a34447f84cb5121c3455a Author: Heiko Carstens Date: Mon Sep 6 22:23:36 2021 +0200 s390/hmcdrv_ftp: fix kernel doc comment Signed-off-by: Heiko Carstens commit 68c32eb2707aed0a3be1a60b0f206943a25e8f34 Author: Heiko Carstens Date: Mon Sep 6 13:59:26 2021 +0200 s390: remove xpram device driver Support for expanded storage was only available until z13 and z/VM 6.3 respectively. However there haven't been any use cases a long time before for this device driver. Therefore remove it. Acked-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit 85ad27215ca57d02bb7c43d76f65a865dc863b59 Author: Pierre Morel Date: Mon Sep 6 08:49:44 2021 +0200 s390/pci: read clp_list_pci_req only once We do not have to reset the fh_list in the loop. Signed-off-by: Pierre Morel Reviewed-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit ebd9cc6593691e6bc8526e368cedbdfc8034f403 Author: Niklas Schnelle Date: Fri Sep 3 18:27:01 2021 +0200 s390/pci: fix clp_get_state() handling of -ENODEV With commit cc049eecfb7a ("s390/pci: simplify CLP List PCI handling") clp_get_state() was changed to make use of the new clp_find_pci() helper function to query a specific function. This however returns -ENODEV when the device is not found at all and this error was passed to the caller. It was missed however that the callers actually expect a success return from clp_get_state() if the device is gone. Fix this by handling the -ENODEV return of clp_find_pci() explicitly in clp_get_state() returning success and setting the state parameter to ZPCI_FN_STATE_RESERVED matching the design concept that a PCI function that disappeared must have been resverved elsewhere. For all other error returns continue to just pass them on to the caller. Reviewed-by: Matthew Rosato Fixes: cc049eecfb7a ("s390/pci: simplify CLP List PCI handling") Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 19379d456f7b6d46e478cc1587a20d23f9d092ef Author: Heiko Carstens Date: Fri Sep 3 18:13:10 2021 +0200 s390/cio: fix kernel doc comment Signed-off-by: Heiko Carstens commit 7a928af413c367bfed513e0a44220b4a5d21ef9a Author: Heiko Carstens Date: Fri Sep 3 18:03:59 2021 +0200 s390/ctrlchar: fix kernel doc comment Signed-off-by: Heiko Carstens commit 44bead2545f11d543c3cc38b1342713c7f825dc2 Author: Heiko Carstens Date: Thu Sep 2 20:38:53 2021 +0200 s390/con3270: use proper type for tasklet function Get rid of this warning: drivers/s390/char/con3270.c:629:22: warning: cast between incompatible function types from ‘void (*)(struct raw3270_request *)’ to ‘void (*)(long unsigned int)’ [-Wcast-function-type] 629 | (void (*)(unsigned long)) con3270_read_tasklet, | ^ Signed-off-by: Heiko Carstens commit 5dddfaac4c258f5eda7b3dba7f9d851262fcbbab Author: Heiko Carstens Date: Thu Sep 2 19:51:59 2021 +0200 s390/cpum_cf: move array from header to C file Move array from header to C file to avoid that it gets defined in every C file where the header is included: In file included from arch/s390/kernel/perf_cpum_cf_common.c:19: ./arch/s390/include/asm/cpu_mcf.h:27:18: warning: ‘cpumf_ctr_ctl’ defined but not used [-Wunused-const-variable=] 27 | static const u64 cpumf_ctr_ctl[CPUMF_CTR_SET_MAX] = { | ^~~~~~~~~~~~~ Signed-off-by: Heiko Carstens commit 2e8275285a60868231eaf63abd9552cc27e512a2 Author: Heiko Carstens Date: Thu Sep 2 19:47:37 2021 +0200 s390/mm: fix kernel doc comments Signed-off-by: Heiko Carstens commit a052096bdd6809eeab809202726634d1ac975aa1 Author: Sven Schnelle Date: Fri Aug 27 20:21:05 2021 +0200 s390/topology: fix topology information when calling cpu hotplug notifiers The cpu hotplug notifiers are called without updating the core/thread masks when a new CPU is added. This causes problems with code setting up data structures in a cpu hotplug notifier, and relying on that later in normal code. This caused a crash in the new core scheduling code (SCHED_CORE), where rq->core was set up in a notifier depending on cpu masks. To fix this, add a cpu_setup_mask which is used in update_cpu_masks() instead of the cpu_online_mask to determine whether the cpu masks should be set for a certain cpu. Also move update_cpu_masks() to update the masks before calling notify_cpu_starting() so that the notifiers are seeing the updated masks. Signed-off-by: Sven Schnelle Cc: [hca@linux.ibm.com: get rid of cpu_online_mask handling] Signed-off-by: Heiko Carstens commit 88b604263f3d6eedae0b1c2c3bbd602d1e2e8775 Author: Vasily Gorbik Date: Wed Sep 1 16:05:59 2021 +0200 s390/unwind: use current_frame_address() to unwind current task current_stack_pointer() simply returns current value of %r15. If current_stack_pointer() caller allocates stack (which is the case in unwind code) %r15 points to a stack frame allocated for callees, meaning current_stack_pointer() caller (e.g. stack_trace_save) will end up in the stacktrace. This is not expected by stack_trace_save*() callers and causes problems. current_frame_address() on the other hand returns function stack frame address, which matches %r15 upon function invocation. Using it in get_stack_pointer() makes it more aligned with x86 implementation (according to BACKTRACE_SELF_TEST output) and meets stack_trace_save*() caller's expectations, notably KCSAN. Also make sure unwind_start is always inlined. Reported-by: Nathan Chancellor Suggested-by: Marco Elver Signed-off-by: Vasily Gorbik Tested-by: Marco Elver Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/patch.git-04dd26be3043.your-ad-here.call-01630504868-ext-6188@work.hours Signed-off-by: Heiko Carstens commit c5433f026b27cc100985189fac04969dfbf56dba Author: Takashi Iwai Date: Tue Sep 7 11:39:30 2021 +0200 ALSA: gus: Fix repeated probe for ISA interwave card The legacy ISA probe tries to probe the card repeatedly, and this would conflict with the refactoring using devres. Put the card creation out of the loop and only probe GUS object repeatedly. Fixes: 5b88da3c800f ("ALSA: gus: Allocate resources with device-managed APIs") Link: https://lore.kernel.org/r/20210907093930.29009-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9d2e19e349627e79bcd474bc64e71a312029b3be Author: Takashi Iwai Date: Tue Sep 7 11:39:29 2021 +0200 ALSA: gus: Fix repeated probes of snd_gus_create() GUS card object may be repeatedly probed for the legacy ISA devices, and the behavior doesn't fit with the devres resource management. Revert partially back to the classical way for the snd_gus_card object, so that the repeated calls of snd_gus_create() are allowed. Fixes: 5b88da3c800f ("ALSA: gus: Allocate resources with device-managed APIs") Reported-by: kernel test robot Link: https://lore.kernel.org/r/20210907093930.29009-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit bbef56d861f103058e387ad5354b4083b9892a7c Author: Colin Ian King Date: Tue Sep 7 09:45:34 2021 +0100 bonding: 3ad: pass parameter bond_params by reference The parameter bond_params is a relatively large 192 byte sized struct so pass it by reference rather than by value to reduce copying. Addresses-Coverity: ("Big parameter passed by value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 1c990729e19891bd586f9f28a290db2867bdcb0a Merge: 8f110f35f9629 644d0a5bcc336 Author: David S. Miller Date: Tue Sep 7 10:06:50 2021 +0100 Merge tag 'linux-can-fixes-for-5.15-20210907' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can linux-can-fixes-for-5.15-20210907 Signed-off-by: David S. Miller commit 8f110f35f9629397ad40cf4c2a66c2c350fbd8ea Merge: be27a47a760e3 e4457a45b41c1 Author: David S. Miller Date: Tue Sep 7 10:04:47 2021 +0100 Merge tag 'wireless-drivers-2021-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for v5.15 First set of fixes for v5.15 and only iwlwifi patches this time. Most important being support for new hardware and new firmware API. I had already earlier applied a fix which also Linus applied to this tree as commit 1476ff21abb4 ("iwl: fix debug printf format strings"), but this doesn't seem to cause any conflicts so I left it there. iwlwifi * add support for firmware API 66 * add support for Samsung Galaxy Book Flex2 Alpha * fix a leak happening every time module is loaded * fix a printk compiler warning ==================== Signed-off-by: David S. Miller commit be27a47a760e3ad8ce979a680558776f672efffd Author: Heiner Kallweit Date: Mon Sep 6 22:51:33 2021 +0200 cxgb3: fix oops on module removal When removing the driver module w/o bringing an interface up before the error below occurs. Reason seems to be that cancel_work_sync() is called in t3_sge_stop() for a queue that hasn't been initialized yet. [10085.941785] ------------[ cut here ]------------ [10085.941799] WARNING: CPU: 1 PID: 5850 at kernel/workqueue.c:3074 __flush_work+0x3ff/0x480 [10085.941819] Modules linked in: vfat snd_hda_codec_hdmi fat snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio led_class ee1004 iTCO_ wdt intel_tcc_cooling x86_pkg_temp_thermal coretemp aesni_intel crypto_simd cryptd snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core r 8169 snd_pcm realtek mdio_devres snd_timer snd i2c_i801 i2c_smbus libphy i915 i2c_algo_bit cxgb3(-) intel_gtt ttm mdio drm_kms_helper mei_me s yscopyarea sysfillrect sysimgblt mei fb_sys_fops acpi_pad sch_fq_codel crypto_user drm efivarfs ext4 mbcache jbd2 crc32c_intel [10085.941944] CPU: 1 PID: 5850 Comm: rmmod Not tainted 5.14.0-rc7-next-20210826+ #6 [10085.941974] Hardware name: System manufacturer System Product Name/PRIME H310I-PLUS, BIOS 2603 10/21/2019 [10085.941992] RIP: 0010:__flush_work+0x3ff/0x480 [10085.942003] Code: c0 74 6b 65 ff 0d d1 bd 78 75 e8 bc 2f 06 00 48 c7 c6 68 b1 88 8a 48 c7 c7 e0 5f b4 8b 45 31 ff e8 e6 66 04 00 e9 4b fe ff ff <0f> 0b 45 31 ff e9 41 fe ff ff e8 72 c1 79 00 85 c0 74 87 80 3d 22 [10085.942036] RSP: 0018:ffffa1744383fc08 EFLAGS: 00010246 [10085.942048] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000923 [10085.942062] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff91c901710a88 [10085.942076] RBP: ffffa1744383fce8 R08: 0000000000000001 R09: 0000000000000001 [10085.942090] R10: 00000000000000c2 R11: 0000000000000000 R12: ffff91c901710a88 [10085.942104] R13: 0000000000000000 R14: ffff91c909a96100 R15: 0000000000000001 [10085.942118] FS: 00007fe417837740(0000) GS:ffff91c969d00000(0000) knlGS:0000000000000000 [10085.942134] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [10085.942146] CR2: 000055a8d567ecd8 CR3: 0000000121690003 CR4: 00000000003706e0 [10085.942160] Call Trace: [10085.942166] ? __lock_acquire+0x3af/0x22e0 [10085.942177] ? cancel_work_sync+0xb/0x10 [10085.942187] __cancel_work_timer+0x128/0x1b0 [10085.942197] ? __pm_runtime_resume+0x5b/0x90 [10085.942208] cancel_work_sync+0xb/0x10 [10085.942217] t3_sge_stop+0x2f/0x50 [cxgb3] [10085.942234] remove_one+0x26/0x190 [cxgb3] [10085.942248] pci_device_remove+0x39/0xa0 [10085.942258] __device_release_driver+0x15e/0x240 [10085.942269] driver_detach+0xd9/0x120 [10085.942278] bus_remove_driver+0x53/0xd0 [10085.942288] driver_unregister+0x2c/0x50 [10085.942298] pci_unregister_driver+0x31/0x90 [10085.942307] cxgb3_cleanup_module+0x10/0x18c [cxgb3] [10085.942324] __do_sys_delete_module+0x191/0x250 [10085.942336] ? syscall_enter_from_user_mode+0x21/0x60 [10085.942347] ? trace_hardirqs_on+0x2a/0xe0 [10085.942357] __x64_sys_delete_module+0x13/0x20 [10085.942368] do_syscall_64+0x40/0x90 [10085.942377] entry_SYSCALL_64_after_hwframe+0x44/0xae [10085.942389] RIP: 0033:0x7fe41796323b Fixes: 5e0b8928927f ("net:cxgb3: replace tasklets with works") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit cdff1eda69326fb46de10c5454212b3efcf4bb41 Author: Randy Dunlap Date: Mon Sep 6 17:19:49 2021 -0700 mfd: lpc_sch: Rename GPIOBASE to prevent build error One MIPS platform (mach-rc32434) defines GPIOBASE. This macro conflicts with one of the same name in lpc_sch.c. Rename the latter one to prevent the build error. ../drivers/mfd/lpc_sch.c:25: error: "GPIOBASE" redefined [-Werror] 25 | #define GPIOBASE 0x44 ../arch/mips/include/asm/mach-rc32434/rb.h:32: note: this is the location of the previous definition 32 | #define GPIOBASE 0x050000 Cc: Denis Turischev Fixes: e82c60ae7d3a ("mfd: Introduce lpc_sch for Intel SCH LPC bridge") Signed-off-by: Randy Dunlap Signed-off-by: Lee Jones commit 452d07413954ef38951cfd41507b310c3afccd93 Author: Hector Martin Date: Mon Aug 23 23:31:22 2021 +0900 mfd: syscon: Use of_iomap() instead of ioremap() This automatically selects between ioremap() and ioremap_np() on platforms that require it, such as Apple SoCs. Signed-off-by: Hector Martin Acked-by: Arnd Bergmann Signed-off-by: Lee Jones commit 87fd9ef47597b2fcee3264eb5f288410b9f376d5 Author: Geert Uytterhoeven Date: Thu Sep 2 14:49:13 2021 +0200 dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER DMA-BUF sysfs statistics are an option of DMA-BUF. It does not make much sense to bother the user with a question about DMA-BUF sysfs statistics if DMA-BUF itself is not enabled. Worse, enabling the statistics enables the feature. Fixes: bdb8d06dfefd666d ("dmabuf: Add the capability to expose DMA-BUF stats in sysfs") Signed-off-by: Geert Uytterhoeven Signed-off-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/msgid/20210902124913.2698760-4-geert@linux-m68k.org commit cca62758ebdd71fcfb6d589d6487a7f26398d50d Author: Geert Uytterhoeven Date: Thu Sep 2 14:49:12 2021 +0200 dma-buf: DMABUF_DEBUG should depend on DMA_SHARED_BUFFER DMA-BUF debug checks are an option of DMA-BUF. Enabling DMABUF_DEBUG without DMA_SHARED_BUFFER does not have any impact, as drivers/dma-buf/ is not entered during the build when DMA_SHARED_BUFFER is disabled. Fixes: 84335675f2223cbd ("dma-buf: Add debug option") Signed-off-by: Geert Uytterhoeven Signed-off-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/msgid/20210902124913.2698760-3-geert@linux-m68k.org commit 644d0a5bcc3361170d84fb8d0b13943c354119db Author: Tong Zhang Date: Mon Sep 6 16:37:02 2021 -0700 can: c_can: fix null-ptr-deref on ioctl() The pdev maybe not a platform device, e.g. c_can_pci device, in this case, calling to_platform_device() would not make sense. Also, per the comment in drivers/net/can/c_can/c_can_ethtool.c, @bus_info should match dev_name() string, so I am replacing this with dev_name() to fix this issue. [ 1.458583] BUG: unable to handle page fault for address: 0000000100000000 [ 1.460921] RIP: 0010:strnlen+0x1a/0x30 [ 1.466336] ? c_can_get_drvinfo+0x65/0xb0 [c_can] [ 1.466597] ethtool_get_drvinfo+0xae/0x360 [ 1.466826] dev_ethtool+0x10f8/0x2970 [ 1.467880] sock_ioctl+0xef/0x300 Fixes: 2722ac986e93 ("can: c_can: add ethtool support") Link: https://lore.kernel.org/r/20210906233704.1162666-1-ztong0001@gmail.com Cc: stable@vger.kernel.org # 5.14+ Signed-off-by: Tong Zhang Signed-off-by: Marc Kleine-Budde commit 54d7a47a008b89fce5a669528274194ca092634d Author: Marc Kleine-Budde Date: Sat Sep 4 14:35:26 2021 +0200 can: rcar_canfd: add __maybe_unused annotation to silence warning Since commit | dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") the rcar_canfd driver can be compile tested on all architectures. On non OF enabled archs, or archs where OF is optional (and disabled in the .config) the compilation throws the following warning: | drivers/net/can/rcar/rcar_canfd.c:2020:34: warning: unused variable 'rcar_canfd_of_table' [-Wunused-const-variable] | static const struct of_device_id rcar_canfd_of_table[] = { | ^ This patch fixes the warning by marking the variable rcar_canfd_of_table as __maybe_unused. Fixes: ac4224087312 ("can: rcar: Kconfig: Add helper dependency on COMPILE_TEST") Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") Link: https://lore.kernel.org/all/20210907064537.1054268-1-mkl@pengutronix.de Cc: linux-renesas-soc@vger.kernel.org Cc: Cai Huoqing Reported-by: kernel test robot Signed-off-by: Marc Kleine-Budde commit ab108678195ff70edf50025379a5de94b0bb26be Author: Linus Walleij Date: Mon Sep 6 23:31:42 2021 -0700 Input: mms114 - support MMS134S The MMS134S like the MMS136 has an event size of 6 bytes. After this patch, the touchscreen on the Samsung SGH-I407 works fine with PostmarketOS. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20210706235951.189289-1-linus.walleij@linaro.org Signed-off-by: Dmitry Torokhov commit 3ad02c27d89d72b3b49ac51899144b7d0942f05f Author: Randy Dunlap Date: Tue Sep 7 06:40:22 2021 +0200 media: s5p-jpeg: rename JPEG marker constants to prevent build warnings The use of a macro named 'RST' conflicts with one of the same name in arch/mips/include/asm/mach-rc32434/rb.h. This causes build warnings on some MIPS builds. Change the names of the JPEG marker constants to be in their own namespace to fix these build warnings and to prevent other similar problems in the future. Fixes these build warnings: In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c:14: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 | ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-s5p.c:13: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos4.c:12: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-core.c:31: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) Also update the kernel-doc so that the word "marker" is not repeated. Link: https://lore.kernel.org/linux-media/20210907044022.30602-1-rdunlap@infradead.org Fixes: bb677f3ac434 ("[media] Exynos4 JPEG codec v4l2 driver") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Andrzej Pietrasiewicz Cc: Jacek Anaszewski Cc: Sylwester Nawrocki Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Mauro Carvalho Chehab commit d198b8273e3006818ea287a93eb4d8fd2543e512 Author: jingle.wu Date: Mon Sep 6 21:52:05 2021 -0700 Input: elan_i2c - reduce the resume time for controller in Whitebox Similar to controllers found Voxel, Delbin, Magpie and Bobba, the one found in Whitebox does not need to be reset after issuing power-on command, and skipping reset saves resume time. Signed-off-by: Jingle Wu Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210907012924.11391-1-jingle.wu@emc.com.tw Signed-off-by: Dmitry Torokhov commit 8491f59e3b130ea8b5116e363d400c42f91544fc Author: Tong Zhang Date: Mon Sep 6 18:47:45 2021 -0700 ALSA: vx222: fix null-ptr-deref a recent refactor created a null pointer vx in snd_vx222_probe(). The vx pointer should have been populated in snd_vx222_create() as suggested in earlier version, otherwise vx->core.ibl.size will throw an error. [ 1.298398] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [ 1.316799] RIP: 0010:snd_vx222_probe+0x155/0x290 [snd_vx222] Fixes: 3bde3359aa16 ("ALSA: vx222: Allocate resources with device-managed APIs") Signed-off-by: Tong Zhang Link: https://lore.kernel.org/r/20210907014746.1445278-1-ztong0001@gmail.com Signed-off-by: Takashi Iwai commit 5ac749a57e0ebb334b1b2c3d28d4d5b1ef85f8ed Author: Jens Axboe Date: Mon Sep 6 18:43:55 2021 -0600 libata: pass over maintainership to Damien Le Moal Damien has agreed to take over maintainership of libata, update the MAINTAINERS file to reflect that. Acked-by: Damien Le Moal Signed-off-by: Jens Axboe commit 7c5c18bdb656057cb76fabfa1a74b793ac49da35 Author: Akira Yokosawa Date: Sun Aug 29 11:06:16 2021 +0900 docs: pdfdocs: Fix typo in CJK-language specific font settings There were typos in the fallback definitions of dummy LaTeX macros for systems without CJK fonts. They cause build errors in "make pdfdocs" on such systems. Fix them. Fixes: e291ff6f5a03 ("docs: pdfdocs: Add CJK-language-specific font settings") Signed-off-by: Akira Yokosawa Link: https://lore.kernel.org/r/ad7615a5-f8fa-2bc3-de6b-7ed49d458964@gmail.com Signed-off-by: Jonathan Corbet commit 4b93c544e90e2b28326182d31ee008eb80e02074 Author: Linus Torvalds Date: Mon Sep 6 12:27:03 2021 -0700 thunderbolt: test: split up test cases in tb_test_credit_alloc_all The tb_test_credit_alloc_all() function had a huge number of KUNIT_ASSERT() statements, all of which (though the magic of many many layers of inscrutable macros) ended up allocating and initializing various test assertion structures on the stack. Don't do that. The kernel stack isn't infinite, and we have compiler warnings (now errors) for the case where a stack frame grows too large. Like it did here, by not an inconsiderable margin: drivers/thunderbolt/test.c: In function ‘tb_test_credit_alloc_all’: drivers/thunderbolt/test.c:2367:1: error: the frame size of 4500 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] 2367 | } | ^ Solve this similarly to the lib/test_scanf case: split out the tests into several smaller functions, each just testing one particular tunnel credit allocation. This makes the i386 allyesconfig build work for me again. Signed-off-by: Linus Torvalds commit ba7b1f861086d760ef1032915fe7c809a191434e Author: Linus Torvalds Date: Mon Sep 6 11:04:03 2021 -0700 lib/test_scanf: split up number parsing test routines It turns out that gcc has real trouble merging all the temporary on-stack buffer allocation. So despite the fact that their lifetimes do not overlap, gcc will allocate stack for all of them when they have different types. Which they do in the number scanning test routines. This is unfortunate in general, but with lots of test-cases in one function, it becomes a real problem. gcc will allocate a huge stack frame for no actual good reason. We have tried to counteract this tendency of gcc not merging stack slots (see "-fconserve-stack"), but that has limited effect (and should be on by default these days, iirc). So with all the debug options enabled on an i386 allmodconfig build, we end up with overly big stack frames, and the resulting stack frame size warnings (now errors): lib/test_scanf.c: In function ‘numbers_list_field_width_val_width’: lib/test_scanf.c:530:1: error: the frame size of 2088 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] 530 | } | ^ lib/test_scanf.c: In function ‘numbers_list_field_width_typemax’: lib/test_scanf.c:488:1: error: the frame size of 2568 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] 488 | } | ^ lib/test_scanf.c: In function ‘numbers_list’: lib/test_scanf.c:437:1: error: the frame size of 2088 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] 437 | } | ^ In this particular case, the reasonably straightforward solution is to just split out the test routines into multiple more targeted versions. That way we don't have one huge stack, but several smaller ones, and they aren't active all at the same time. Signed-off-by: Linus Torvalds commit 1476ff21abb435cd4c453e61df5b125fac8cc50b Author: Linus Torvalds Date: Mon Sep 6 10:24:58 2021 -0700 iwl: fix debug printf format strings The variable 'package_size' is an unsigned long, and should be printed out using '%lu', not '%zd' (that would be for a size_t). Yes, on many architectures (including x86-64), 'size_t' is in fact the same type as 'long', but that's a fairly random architecture definition, and on some platforms 'size_t' is in fact 'int' rather than 'long'. That is the case on traditional 32-bit x86. Yes, both types are the exact same 32-bit size, and it would all print out perfectly correctly, but '%zd' ends up still being wrong. And we can't make 'package_size' be a 'size_t', because we get the actual value using efivar_entry_get() that takes a pointer to an 'unsigned long'. So '%lu' it is. This fixes two of the i386 allmodconfig build warnings (that is now an error due to -Werror). Signed-off-by: Linus Torvalds commit 1dbe7e386f505bdae30f7436c41769149c7dcf32 Merge: 03085b3d5a45a 1c500ad706383 Author: Linus Torvalds Date: Mon Sep 6 10:06:26 2021 -0700 Merge tag 'block-5.15-2021-09-05' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Was going to send this one in later this week, but given that -Werror is now enabled (or at least available), the mq-deadline fix really should go in for the folks hitting that. - Ensure dd_queued() is only there if needed (Geert) - Fix a kerneldoc warning for bio_alloc_kiocb() - BFQ fix for queue merging - loop locking fix (Tetsuo)" * tag 'block-5.15-2021-09-05' of git://git.kernel.dk/linux-block: loop: reduce the loop_ctl_mutex scope bio: fix kerneldoc documentation for bio_alloc_kiocb() block, bfq: honor already-setup queue merges block/mq-deadline: Move dd_queued() to fix defined but not used warning commit 03085b3d5a45a60061423ac4857f339c7cb260ff Merge: eebb4159a2bf6 55d1308bdff73 Author: Linus Torvalds Date: Mon Sep 6 10:00:25 2021 -0700 Merge tag 'misc-5.15-2021-09-05' of git://git.kernel.dk/linux-block Pull CDROM maintainer update from Jens Axboe: "It's been about 22 years since I originally started maintaining the CDROM code, and I just haven't been able to even get reviews done in a timely fashion the last handful of years. Time to pass it on, and Phillip has volunteered take over these duties. I'll be helping as needed for the foreseeable future" * tag 'misc-5.15-2021-09-05' of git://git.kernel.dk/linux-block: cdrom: update uniform CD-ROM maintainership in MAINTAINERS file commit eebb4159a2bf660b545ecb6ee318179971d610a2 Merge: 60f8fbaa95445 7a8526a5cd51c Author: Linus Torvalds Date: Mon Sep 6 09:51:42 2021 -0700 Merge tag 'libata-5.15-2021-09-05' of git://git.kernel.dk/linux-block Pull libata fixes from Jens Axboe: "Fixes for queued trim on certain Samsung SSDs, in conjunction with certain ATI controllers" * tag 'libata-5.15-2021-09-05' of git://git.kernel.dk/linux-block: libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs commit 60f8fbaa954452104a1914e21c5cc109f7bf276a Merge: 20fbb11fe4ea9 2fc2a7a62eb58 Author: Linus Torvalds Date: Mon Sep 6 09:26:07 2021 -0700 Merge tag 'for-5.15/io_uring-2021-09-04' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "As sometimes happens, two reports came in around the merge window open that led to some fixes. Hence this one is a bit bigger than usual followup fixes, but most of it will be going towards stable, outside of the fixes that are addressing regressions from this merge window. In detail: - postgres is a heavy user of signals between tasks, and if we're unlucky this can interfere with io-wq worker creation. Make sure we're resilient against unrelated signal handling. This set of changes also includes hardening against allocation failures, which could previously had led to stalls. - Some use cases that end up having a mix of bounded and unbounded work would have starvation issues related to that. Split the pending work lists to handle that better. - Completion trace int -> unsigned -> long fix - Fix issue with REGISTER_IOWQ_MAX_WORKERS and SQPOLL - Fix regression with hash wait lock in this merge window - Fix retry issued on block devices (Ming) - Fix regression with links in this merge window (Pavel) - Fix race with multi-shot poll and completions (Xiaoguang) - Ensure regular file IO doesn't inadvertently skip completion batching (Pavel) - Ensure submissions are flushed after running task_work (Pavel)" * tag 'for-5.15/io_uring-2021-09-04' of git://git.kernel.dk/linux-block: io_uring: io_uring_complete() trace should take an integer io_uring: fix possible poll event lost in multi shot mode io_uring: prolong tctx_task_work() with flushing io_uring: don't disable kiocb_done() CQE batching io_uring: ensure IORING_REGISTER_IOWQ_MAX_WORKERS works with SQPOLL io-wq: make worker creation resilient against signals io-wq: get rid of FIXED worker flag io-wq: only exit on fatal signals io-wq: split bounded and unbounded work into separate lists io-wq: fix queue stalling race io_uring: don't submit half-prepared drain request io_uring: fix queueing half-created requests io-wq: ensure that hash wait lock is IRQ disabling io_uring: retry in case of short read on block device io_uring: IORING_OP_WRITE needs hash_reg_file set io-wq: fix race between adding work and activating a free worker commit 20fbb11fe4ea99e02d77824613f1438bea456683 Author: Stephen Rothwell Date: Mon Sep 6 15:47:02 2021 +1000 don't make the syscall checking produce errors from warnings Signed-off-by: Stephen Rothwell Signed-off-by: Linus Torvalds commit b81bede4d138ce62f7342e27bf55ac93c8071818 Author: Wolfram Sang Date: Thu Aug 26 10:21:07 2021 +0200 mmc: renesas_sdhi: fix regression with hard reset on old SDHIs Old SDHI instances have a default value for the reset register which keeps it in reset state by default. So, when applying a hard reset we need to manually leave the soft reset state as well. Later SDHI instances have a different default value, the one we write manually now. Fixes: b4d86f37eacb ("mmc: renesas_sdhi: do hard reset if possible") Signed-off-by: Wolfram Sang Tested-by: Geert Uytterhoeven Reported-by: Geert Uytterhoeven Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210826082107.47299-1-wsa+renesas@sang-engineering.com Signed-off-by: Ulf Hansson commit 26391e49d5b0f0c33eb4b28a312d2ecc094d7489 Author: Vincent Whitchurch Date: Wed Aug 25 13:42:13 2021 +0200 mmc: dw_mmc: Only inject fault before done/error The fault injection function can set EVENT_DATA_ERROR but skip the setting of ->data_status to an error status if it hits just after a data over interrupt. This confuses the tasklet which can later end up triggering the WARN_ON(host->cmd || ..) in dw_mci_request_end() since dw_mci_data_complete() would return success. Prevent the fault injection function from doing this since this is not a real case, and ensure that the fault injection doesn't race with a real error either. Signed-off-by: Vincent Whitchurch Reviewed-by: Jaehoon Chung Fixes: 2b8ac062f337 ("mmc: dw_mmc: Add data CRC error injection") Link: https://lore.kernel.org/r/20210825114213.7429-1-vincent.whitchurch@axis.com Signed-off-by: Ulf Hansson commit b539c44df067ac116ec1b58b956efda51b6a7fc1 Author: Andy Shevchenko Date: Mon Sep 6 15:44:49 2021 +0300 net: wwan: iosm: Unify IO accessors used in the driver Currently we have readl()/writel()/ioread*()/iowrite*() APIs in use. Let's unify to use only ioread*()/iowrite*() variants. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit 1d99411fe70194f39d74a8db2ad082daa12e6aad Author: Andy Shevchenko Date: Mon Sep 6 15:44:48 2021 +0300 net: wwan: iosm: Replace io.*64_lo_hi() with regular accessors The io.*_lo_hi() variants are not strictly needed on the x86 hardware and especially the PCI bus. Replace them with regular accessors, but leave headers in place in case of 32-bit build. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller commit 0a83299935f047f4a051e2a1d32391d34f4e4fcc Author: Jason Wang Date: Mon Sep 6 21:56:53 2021 +0800 net: qcom/emac: Replace strlcpy with strscpy The strlcpy should not be used because it doesn't limit the source length. As linus says, it's a completely useless function if you can't implicitly trust the source string - but that is almost always why people think they should use it! All in all the BSD function will lead some potential bugs. But the strscpy doesn't require reading memory from the src string beyond the specified "count" bytes, and since the return value is easier to error-check than strlcpy()'s. In addition, the implementation is robust to the string changing out from underneath it, unlike the current strlcpy() implementation. Thus, We prefer using strscpy instead of strlcpy. Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit fe63339ef36bfb1cc12962015a9b254170eea057 Author: Willem de Bruijn Date: Mon Sep 6 10:27:38 2021 -0400 ip6_gre: Revert "ip6_gre: add validation for csum_start" This reverts commit 9cf448c200ba9935baa94e7a0964598ce947db9d. This commit was added for equivalence with a similar fix to ip_gre. That fix proved to have a bug. Upon closer inspection, ip6_gre is not susceptible to the original bug. So revert the unnecessary extra check. In short, ipgre_xmit calls skb_pull to remove ipv4 headers previously inserted by dev_hard_header. ip6gre_tunnel_xmit does not. Link: https://lore.kernel.org/netdev/CA+FuTSe+vJgTVLc9SojGuN-f9YQ+xWLPKE_S4f=f+w+_P2hgUg@mail.gmail.com/#t Fixes: 9cf448c200ba ("ip6_gre: add validation for csum_start") Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit f8416aa29185468e0d914ba4b2a330fd53ee263f Author: Cai Huoqing Date: Mon Sep 6 19:23:02 2021 +0800 kernel: debug: Convert to SPDX identifier use SPDX-License-Identifier instead of a verbose license text Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210906112302.937-1-caihuoqing@baidu.com Signed-off-by: Daniel Thompson commit a61cb6017df0a9be072a35259e6e9ae7aa0ef6b3 Author: Christoph Hellwig Date: Mon Sep 6 14:40:00 2021 +0200 dma-mapping: fix the kerneldoc for dma_map_sg_attrs Add the missing description for the nents parameter, and fix a trivial misalignment. Fixes: fffe3cc8c219 ("dma-mapping: allow map_sg() ops to return negative error codes") Reported-by: Stephen Rothwell Signed-off-by: Christoph Hellwig commit 109bbba5066b42431399b40e947243f049d8dc8d Author: Peter Xu Date: Wed Sep 1 19:09:04 2021 -0400 KVM: Drop unused kvm_dirty_gfn_invalid() Drop the unused function as reported by test bot. Reported-by: kernel test robot Signed-off-by: Peter Xu Message-Id: <20210901230904.15164-1-peterx@redhat.com> Signed-off-by: Paolo Bonzini commit 0c0383918a3ec4250e318cdbdd32e1caef12c14c Author: chongjiapeng Date: Mon Sep 6 17:51:59 2021 +0800 net: hns3: make hclgevf_cmd_caps_bit_map0 and hclge_cmd_caps_bit_map0 static This symbols is not used outside of hclge_cmd.c and hclgevf_cmd.c, so marks it static. Fix the following sparse warning: drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c:345:35: warning: symbol 'hclgevf_cmd_caps_bit_map0' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c:365:33: warning: symbol 'hclge_cmd_caps_bit_map0' was not declared. Should it be static? Reported-by: Abaci Robot Signed-off-by: chongjiapeng Signed-off-by: David S. Miller commit b109398a2206bf4bd3f6cb4fe678735387574d79 Merge: e0b6417be0885 4a9c93dc47de3 Author: David S. Miller Date: Mon Sep 6 13:12:09 2021 +0100 Merge branch 'bonding-fix' Jussi Maki says: ==================== bonding: Fix negative jump count reported by syzbot This patch set fixes a negative jump count warning encountered by syzbot [1] and extends the tests to cover nested bonding devices. [1]: https://lore.kernel.org/lkml/0000000000000a9f3605cb1d2455@google.com/ ==================== Signed-off-by: David S. Miller commit 4a9c93dc47de335880ce7347e6aa006d8f33265a Author: Jussi Maki Date: Mon Sep 6 10:56:38 2021 +0200 selftests/bpf: Test XDP bonding nest and unwind Modify the test to check that enslaving a bond slave with a XDP program is now allowed. Extend attach test to exercise the program unwinding in bond_xdp_set and add a new test for loading XDP program on doubly nested bond device to verify that static key incr/decr is correct. Signed-off-by: Jussi Maki Signed-off-by: David S. Miller commit 6d5f1ef838683efba01bacb7854f6516fbcbae17 Author: Jussi Maki Date: Mon Sep 6 10:56:37 2021 +0200 bonding: Fix negative jump label count on nested bonding With nested bonding devices the nested bond device's ndo_bpf was called without a program causing it to decrement the static key without a prior increment leading to negative count. Fix the issue by 1) only calling slave's ndo_bpf when there's a program to be loaded and 2) only decrement the count when a program is unloaded. Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Reported-by: syzbot+30622fb04ddd72a4d167@syzkaller.appspotmail.com Signed-off-by: Jussi Maki Signed-off-by: David S. Miller commit e0b6417be08850646d4e44ef1123772ec786baea Author: Stefano Garzarella Date: Mon Sep 6 11:11:59 2021 +0200 MAINTAINERS: add VM SOCKETS (AF_VSOCK) entry Add a new entry for VM Sockets (AF_VSOCK) that covers vsock core, tests, and headers. Move some general vsock stuff from virtio-vsock entry into this new more general vsock entry. I've been reviewing and contributing for the last few years, so I'm available to help maintain this code. Cc: Dexuan Cui Cc: Jorgen Hansen Cc: Stefan Hajnoczi Suggested-by: Michael S. Tsirkin Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller commit 5289de5929d1758a95477a4d160195397ccffa7b Author: zhaoxiao Date: Mon Sep 6 15:21:07 2021 +0800 stmmac: dwmac-loongson:Fix missing return value Add the return value when phy_mode < 0. Signed-off-by: zhaoxiao Signed-off-by: David S. Miller commit a9667ac88e2b20f6426e09945e9dbf555fb86ff0 Author: Miklos Szeredi Date: Wed Sep 1 12:39:02 2021 +0200 fuse: remove unused arg in fuse_write_file_get() The struct fuse_conn argument is not used and can be removed. Signed-off-by: Miklos Szeredi commit 660585b56e63ca034ad506ea53c807c5cdca3196 Author: Miklos Szeredi Date: Wed Sep 1 12:39:02 2021 +0200 fuse: wait for writepages in syncfs In case of fuse the MM subsystem doesn't guarantee that page writeback completes by the time ->sync_fs() is called. This is because fuse completes page writeback immediately to prevent DoS of memory reclaim by the userspace file server. This means that fuse itself must ensure that writes are synced before sending the SYNCFS request to the server. Introduce sync buckets, that hold a counter for the number of outstanding write requests. On syncfs replace the current bucket with a new one and wait until the old bucket's counter goes down to zero. It is possible to have multiple syncfs calls in parallel, in which case there could be more than one waited-on buckets. Descendant buckets must not complete until the parent completes. Add a count to the child (new) bucket until the (parent) old bucket completes. Use RCU protection to dereference the current bucket and to wake up an emptied bucket. Use fc->lock to protect against parallel assignments to the current bucket. This leaves just the counter to be a possible scalability issue. The fc->num_waiting counter has a similar issue, so both should be addressed at the same time. Reported-by: Amir Goldstein Fixes: 2d82ab251ef0 ("virtiofs: propagate sync() to file server") Cc: # v5.14 Signed-off-by: Miklos Szeredi commit 7bc7f61897b66bef78bb5952e3d1e9f3aaf9ccca Author: Xie Yongji Date: Tue Aug 31 18:36:34 2021 +0800 Documentation: Add documentation for VDUSE VDUSE (vDPA Device in Userspace) is a framework to support implementing software-emulated vDPA devices in userspace. This document is intended to clarify the VDUSE design and usage. Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-14-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit c8a6153b6c59d95c0e091f053f6f180952ade91e Author: Xie Yongji Date: Tue Aug 31 18:36:33 2021 +0800 vduse: Introduce VDUSE - vDPA Device in Userspace This VDUSE driver enables implementing software-emulated vDPA devices in userspace. The vDPA device is created by ioctl(VDUSE_CREATE_DEV) on /dev/vduse/control. Then a char device interface (/dev/vduse/$NAME) is exported to userspace for device emulation. In order to make the device emulation more secure, the device's control path is handled in kernel. A message mechnism is introduced to forward some dataplane related control messages to userspace. And in the data path, the DMA buffer will be mapped into userspace address space through different ways depending on the vDPA bus to which the vDPA device is attached. In virtio-vdpa case, the MMU-based software IOTLB is used to achieve that. And in vhost-vdpa case, the DMA buffer is reside in a userspace memory region which can be shared to the VDUSE userspace processs via transferring the shmfd. For more details on VDUSE design and usage, please see the follow-on Documentation commit. NB(mst): when merging this with b542e383d8c0 ("eventfd: Make signal recursion protection a task bit") replace eventfd_signal_count with eventfd_signal_allowed, and drop the previous ("eventfd: Export eventfd_wake_count to modules"). Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-13-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 8c773d53fb7b64267b0f55c1d3517cb8c5e29b3c Author: Xie Yongji Date: Tue Aug 31 18:36:32 2021 +0800 vduse: Implement an MMU-based software IOTLB This implements an MMU-based software IOTLB to support mapping kernel dma buffer into userspace dynamically. The basic idea behind it is treating MMU (VA->PA) as IOMMU (IOVA->PA). The software IOTLB will set up MMU mapping instead of IOMMU mapping for the DMA transfer so that the userspace process is able to use its virtual address to access the dma buffer in kernel. To avoid security issue, a bounce-buffering mechanism is introduced to prevent userspace accessing the original buffer directly which may contain other kernel data. During the mapping, unmapping, the software IOTLB will copy the data from the original buffer to the bounce buffer and back, depending on the direction of the transfer. And the bounce-buffer addresses will be mapped into the user address space instead of the original one. Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-12-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit d8945ec411209272bcd4ae9e75ea1b078257e492 Author: Xie Yongji Date: Tue Aug 31 18:36:31 2021 +0800 vdpa: Support transferring virtual addressing during DMA mapping This patch introduces an attribute for vDPA device to indicate whether virtual address can be used. If vDPA device driver set it, vhost-vdpa bus driver will not pin user page and transfer userspace virtual address instead of physical address during DMA mapping. And corresponding vma->vm_file and offset will be also passed as an opaque pointer. Suggested-by: Jason Wang Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-11-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 22af48cf91aae5f2fd32fe811d9be1c52d7a801b Author: Xie Yongji Date: Tue Aug 31 18:36:30 2021 +0800 vdpa: factor out vhost_vdpa_pa_map() and vhost_vdpa_pa_unmap() The upcoming patch is going to support VA mapping/unmapping. So let's factor out the logic of PA mapping/unmapping firstly to make the code more readable. Suggested-by: Jason Wang Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-10-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit c10fb9454adc80c062151c6a436047e1fa59e99f Author: Xie Yongji Date: Tue Aug 31 18:36:29 2021 +0800 vdpa: Add an opaque pointer for vdpa_config_ops.dma_map() Add an opaque pointer for DMA mapping. Suggested-by: Jason Wang Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-9-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 59dfe4f1e810b5820443c84f9863b04b033143e8 Author: Xie Yongji Date: Tue Aug 31 18:36:28 2021 +0800 vhost-iotlb: Add an opaque pointer for vhost IOTLB Add an opaque pointer for vhost IOTLB. And introduce vhost_iotlb_add_range_ctx() to accept it. Suggested-by: Jason Wang Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-8-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 7f05630dc65d62df5d55ad3e1038ffbe5e2ce9c3 Author: Xie Yongji Date: Tue Aug 31 18:36:27 2021 +0800 vhost-vdpa: Handle the failure of vdpa_reset() The vdpa_reset() may fail now. This adds check to its return value and fail the vhost_vdpa_open(). Signed-off-by: Xie Yongji Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210831103634.33-7-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 0686082dbf7a204ca0fab326a820779e31666639 Author: Xie Yongji Date: Tue Aug 31 18:36:26 2021 +0800 vdpa: Add reset callback in vdpa_config_ops This adds a new callback to support device specific reset behavior. The vdpa bus driver will call the reset function instead of setting status to zero during resetting. Signed-off-by: Xie Yongji Link: https://lore.kernel.org/r/20210831103634.33-6-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 86e17a51c1a5a299009f8b1645e3e9da0d59faae Author: Xie Yongji Date: Tue Aug 31 18:36:25 2021 +0800 vdpa: Fix some coding style issues Fix some code indent issues and following checkpatch warning: WARNING: Prefer 'unsigned int' to bare use of 'unsigned' 371: FILE: include/linux/vdpa.h:371: +static inline void vdpa_get_config(struct vdpa_device *vdev, unsigned offset, Signed-off-by: Xie Yongji Acked-by: Jason Wang Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210831103634.33-5-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 9c930054f2f5326d59ee4bf8d7d1cf6c82f5643b Author: Xie Yongji Date: Tue Aug 31 18:36:24 2021 +0800 file: Export receive_fd() to modules Export receive_fd() so that some modules can use it to pass file descriptor between processes without missing any security stuffs. Signed-off-by: Xie Yongji Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210831103634.33-4-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 7a6b92d33ab166c6ea6e5764033ca99dcb6ec361 Author: Xie Yongji Date: Tue Aug 31 18:36:23 2021 +0800 eventfd: Export eventfd_wake_count to modules Export eventfd_wake_count so that some modules can use the eventfd_signal_count() to check whether the eventfd_signal() call should be deferred to a safe context. NB(mst): this patch is not needed in Linus tree since there eventfd_signal_count() has been superseded by an already exported eventfd_signal_allowed(). Signed-off-by: Xie Yongji Link: https://lore.kernel.org/r/20210831103634.33-3-xieyongji@bytedance.com Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit a93a962669cdbe56bb0bcd88156f0f1598f31c88 Author: Xie Yongji Date: Tue Aug 31 18:36:22 2021 +0800 iova: Export alloc_iova_fast() and free_iova_fast() Export alloc_iova_fast() and free_iova_fast() so that some modules can make use of the per-CPU cache to get rid of rbtree spinlock in alloc_iova() and free_iova() during IOVA allocation. Signed-off-by: Xie Yongji Acked-by: Jason Wang Acked-by: Will Deacon Link: https://lore.kernel.org/r/20210831103634.33-2-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin commit 6105d1fe6f4c24ce8c13e2e6568b16b76e04983d Author: Max Gurtovoy Date: Sun Sep 5 11:57:17 2021 +0300 virtio-blk: remove unneeded "likely" statements Usually we use "likely/unlikely" to optimize the fast path. Remove redundant "likely/unlikely" statements in the control path to simplify the code and make it easier to read. Reviewed-by: Stefan Hajnoczi Signed-off-by: Max Gurtovoy Link: https://lore.kernel.org/r/20210905085717.7427-1-mgurtovoy@nvidia.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Stefan Hajnoczi commit 81a83d7f4cfcb255c040df09ce83249fabf8733a Author: Xianting Tian Date: Fri Jul 23 13:42:59 2021 +0800 virtio-balloon: Use virtio_find_vqs() helper Use the helper virtio_find_vqs(). Signed-off-by: Xianting Tian Reviewed-by: David Hildenbrand Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210723054259.2779-1-xianting.tian@linux.alibaba.com Signed-off-by: Michael S. Tsirkin commit d9130a2dfdd4b21736c91b818f87dbc0ccd1e757 Author: Zelin Deng Date: Wed Apr 28 10:22:01 2021 +0800 KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted When MSR_IA32_TSC_ADJUST is written by guest due to TSC ADJUST feature especially there's a big tsc warp (like a new vCPU is hot-added into VM which has been up for a long time), tsc_offset is added by a large value then go back to guest. This causes system time jump as tsc_timestamp is not adjusted in the meantime and pvclock monotonic character. To fix this, just notify kvm to update vCPU's guest time before back to guest. Cc: stable@vger.kernel.org Signed-off-by: Zelin Deng Signed-off-by: Paolo Bonzini Message-Id: <1619576521-81399-2-git-send-email-zelin.deng@linux.alibaba.com> Signed-off-by: Paolo Bonzini commit 4ac214574d2d83b7ef20c603d75f1937c912bfd6 Author: Paolo Bonzini Date: Mon Sep 6 05:52:23 2021 -0400 KVM: MMU: mark role_regs and role accessors as maybe unused It is reasonable for these functions to be used only in some configurations, for example only if the host is 64-bits (and therefore supports 64-bit guests). It is also reasonable to keep the role_regs and role accessors in sync even though some of the accessors may be used only for one of the two sets (as is the case currently for CR4.LA57).. Because clang reports warnings for unused inlines declared in a .c file, mark both sets of accessors as __maybe_unused. Reported-by: kernel test robot Signed-off-by: Paolo Bonzini commit a3cf527e70bd1553500746ef2f38db41e2af1d9e Author: Huacai Chen Date: Tue Apr 6 10:49:11 2021 +0800 KVM: MIPS: Remove a "set but not used" variable This fix a build warning: arch/mips/kvm/vz.c: In function '_kvm_vz_restore_htimer': >> arch/mips/kvm/vz.c:392:10: warning: variable 'freeze_time' set but not used [-Wunused-but-set-variable] 392 | ktime_t freeze_time; | ^~~~~~~~~~~ Reported-by: kernel test robot Signed-off-by: Huacai Chen Message-Id: <20210406024911.2008046-1-chenhuacai@loongson.cn> Signed-off-by: Paolo Bonzini commit e99314a340d27efafab3b7ea226beb239162cd46 Merge: 0d0a19395baa3 419025b3b4190 Author: Paolo Bonzini Date: Mon Sep 6 06:34:11 2021 -0400 Merge tag 'kvmarm-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 5.15 - Page ownership tracking between host EL1 and EL2 - Rely on userspace page tables to create large stage-2 mappings - Fix incompatibility between pKVM and kmemleak - Fix the PMU reset state, and improve the performance of the virtual PMU - Move over to the generic KVM entry code - Address PSCI reset issues w.r.t. save/restore - Preliminary rework for the upcoming pKVM fixed feature - A bunch of MM cleanups - a vGIC fix for timer spurious interrupts - Various cleanups commit 0d0a19395baa36ab186df8081ab7f7b57c3fade1 Merge: a40b2fd064bb7 a3e03bc1368c1 Author: Paolo Bonzini Date: Mon Sep 6 06:33:40 2021 -0400 Merge tag 'kvm-s390-next-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fix and feature for 5.15 - enable interpretion of specification exceptions - fix a vcpu_idx vs vcpu_id mixup commit a40b2fd064bb7c0425c7cbdca2120cf0609a90a2 Author: Lai Jiangshan Date: Sat Aug 14 11:51:29 2021 +0800 x86/kvm: Don't enable IRQ when IRQ enabled in kvm_wait Commit f4e61f0c9add3 ("x86/kvm: Fix broken irq restoration in kvm_wait") replaced "local_irq_restore() when IRQ enabled" with "local_irq_enable() when IRQ enabled" to suppress a warnning. Although there is no similar debugging warnning for doing local_irq_enable() when IRQ enabled as doing local_irq_restore() in the same IRQ situation. But doing local_irq_enable() when IRQ enabled is no less broken as doing local_irq_restore() and we'd better avoid it. Cc: Mark Rutland Cc: Peter Zijlstra (Intel) Signed-off-by: Lai Jiangshan Message-Id: <20210814035129.154242-1-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini commit 3cc4e148b96263313e3dce926eae569c942bb74e Author: Jing Zhang Date: Tue Aug 17 00:26:39 2021 +0000 KVM: stats: Add VM stat for remote tlb flush requests Add a new stat that counts the number of times a remote TLB flush is requested, regardless of whether it kicks vCPUs out of guest mode. This allows us to look at how often flushes are initiated. Unlike remote_tlb_flush, this one applies to ARM's instruction-set-based TLB flush implementation, so apply it there too. Original-by: David Matlack Signed-off-by: Jing Zhang Message-Id: <20210817002639.3856694-1-jingzhangos@google.com> Signed-off-by: Paolo Bonzini commit fdde13c13f9012b22e1b3a1df8a108d147842f6f Author: Sean Christopherson Date: Thu Sep 2 10:59:51 2021 -0700 KVM: Remove unnecessary export of kvm_{inc,dec}_notifier_count() Don't export KVM's MMU notifier count helpers, under no circumstance should any downstream module, including x86's vendor code, have a legitimate reason to piggyback KVM's MMU notifier logic. E.g in the x86 case, only KVM's MMU should be elevating the notifier count, and that code is always built into the core kvm.ko module. Fixes: edb298c663fc ("KVM: x86/mmu: bump mmu notifier count in kvm_zap_gfn_range") Cc: Maxim Levitsky Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Message-Id: <20210902175951.1387989-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1148bfc47be3f885a10945ecbc1e3789a0313603 Author: Sean Christopherson Date: Wed Sep 1 15:10:23 2021 -0700 KVM: x86/mmu: Move lpage_disallowed_link further "down" in kvm_mmu_page Move "lpage_disallowed_link" out of the first 64 bytes, i.e. out of the first cache line, of kvm_mmu_page so that "spt" and to a lesser extent "gfns" land in the first cache line. "lpage_disallowed_link" is accessed relatively infrequently compared to "spt", which is accessed any time KVM is walking and/or manipulating the shadow page tables. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20210901221023.1303578-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit ca41c34cab1f50f13ab5ac95739483871637a684 Author: Sean Christopherson Date: Wed Sep 1 15:10:22 2021 -0700 KVM: x86/mmu: Relocate kvm_mmu_page.tdp_mmu_page for better cache locality Move "tdp_mmu_page" into the 1-byte void left by the recently removed "mmio_cached" so that it resides in the first 64 bytes of kvm_mmu_page, i.e. in the same cache line as the most commonly accessed fields. Don't bother wrapping tdp_mmu_page in CONFIG_X86_64, including the field in 32-bit builds doesn't affect the size of kvm_mmu_page, and a future patch can always wrap the field in the unlikely event KVM gains a 1-byte flag that is 32-bit specific. Note, the size of kvm_mmu_page is also unchanged on CONFIG_X86_64=y due to it previously sharing an 8-byte chunk with write_flooding_count. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20210901221023.1303578-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit e7177339d7b5f9594b316842122b5fda9513d5e2 Author: Sean Christopherson Date: Tue Aug 31 09:42:22 2021 -0700 Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" Revert a misguided illegal GPA check when "translating" a non-nested GPA. The check is woefully incomplete as it does not fill in @exception as expected by all callers, which leads to KVM attempting to inject a bogus exception, potentially exposing kernel stack information in the process. WARNING: CPU: 0 PID: 8469 at arch/x86/kvm/x86.c:525 exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 CPU: 1 PID: 8469 Comm: syz-executor531 Not tainted 5.14.0-rc7-syzkaller #0 RIP: 0010:exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 Call Trace: x86_emulate_instruction+0xef6/0x1460 arch/x86/kvm/x86.c:7853 kvm_mmu_page_fault+0x2f0/0x1810 arch/x86/kvm/mmu/mmu.c:5199 handle_ept_misconfig+0xdf/0x3e0 arch/x86/kvm/vmx/vmx.c:5336 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6021 [inline] vmx_handle_exit+0x336/0x1800 arch/x86/kvm/vmx/vmx.c:6038 vcpu_enter_guest+0x2a1c/0x4430 arch/x86/kvm/x86.c:9712 vcpu_run arch/x86/kvm/x86.c:9779 [inline] kvm_arch_vcpu_ioctl_run+0x47d/0x1b20 arch/x86/kvm/x86.c:10010 kvm_vcpu_ioctl+0x49e/0xe50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3652 The bug has escaped notice because practically speaking the GPA check is useless. The GPA check in question only comes into play when KVM is walking guest page tables (or "translating" CR3), and KVM already handles illegal GPA checks by setting reserved bits in rsvd_bits_mask for each PxE, or in the case of CR3 for loading PTDPTRs, manually checks for an illegal CR3. This particular failure doesn't hit the existing reserved bits checks because syzbot sets guest.MAXPHYADDR=1, and IA32 architecture simply doesn't allow for such an absurd MAXPHYADDR, e.g. 32-bit paging doesn't define any reserved PA bits checks, which KVM emulates by only incorporating the reserved PA bits into the "high" bits, i.e. bits 63:32. Simply remove the bogus check. There is zero meaningful value and no architectural justification for supporting guest.MAXPHYADDR < 32, and properly filling the exception would introduce non-trivial complexity. This reverts commit ec7771ab471ba6a945350353617e2e3385d0e013. Fixes: ec7771ab471b ("KVM: x86: mmu: Add guest physical address check in translate_gpa()") Cc: stable@vger.kernel.org Reported-by: syzbot+200c08e88ae818f849ce@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson Message-Id: <20210831164224.1119728-2-seanjc@google.com> Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 678a305b85d95f288c12e3d69a32d3351b34f2bb Author: Jia He Date: Mon Aug 30 22:53:36 2021 +0800 KVM: x86/mmu: Remove unused field mmio_cached in struct kvm_mmu_page After reverting and restoring the fast tlb invalidation patch series, the mmio_cached is not removed. Hence a unused field is left in kvm_mmu_page. Cc: Sean Christopherson Signed-off-by: Jia He Message-Id: <20210830145336.27183-1-justin.he@arm.com> Signed-off-by: Paolo Bonzini commit 1dbaf04cb91b2b680d10f9a8f9f823d94c7087bf Author: Eduardo Habkost Date: Fri Sep 3 17:16:00 2021 -0400 kvm: x86: Increase KVM_SOFT_MAX_VCPUS to 710 Support for 710 VCPUs was tested by Red Hat since RHEL-8.4, so increase KVM_SOFT_MAX_VCPUS to 710. Signed-off-by: Eduardo Habkost Message-Id: <20210903211600.2002377-4-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini commit 074c82c8f7cf8a46c3b81965f122599e3a133450 Author: Eduardo Habkost Date: Fri Sep 3 17:15:59 2021 -0400 kvm: x86: Increase MAX_VCPUS to 1024 Increase KVM_MAX_VCPUS to 1024, so we can test larger VMs. I'm not changing KVM_SOFT_MAX_VCPUS yet because I'm afraid it might involve complicated questions around the meaning of "supported" and "recommended" in the upstream tree. KVM_SOFT_MAX_VCPUS will be changed in a separate patch. For reference, visible effects of this change are: - KVM_CAP_MAX_VCPUS will now return 1024 (of course) - Default value for CPUID[HYPERV_CPUID_IMPLEMENT_LIMITS (00x40000005)].EAX will now be 1024 - KVM_MAX_VCPU_ID will change from 1151 to 4096 - Size of struct kvm will increase from 19328 to 22272 bytes (in x86_64) - Size of struct kvm_ioapic will increase from 1780 to 5084 bytes (in x86_64) - Bitmap stack variables that will grow: - At kvm_hv_flush_tlb() kvm_hv_send_ipi(), vp_bitmap[] and vcpu_bitmap[] will now be 128 bytes long - vcpu_bitmap at bioapic_write_indirect() will be 128 bytes long once patch "KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()" is applied Signed-off-by: Eduardo Habkost Message-Id: <20210903211600.2002377-3-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini commit 4ddacd525a2f16cebec8ba409fbce6b6fb45e987 Author: Eduardo Habkost Date: Fri Sep 3 17:15:58 2021 -0400 kvm: x86: Set KVM_MAX_VCPU_ID to 4*KVM_MAX_VCPUS Instead of requiring KVM_MAX_VCPU_ID to be manually increased every time we increase KVM_MAX_VCPUS, set it to 4*KVM_MAX_VCPUS. This should be enough for CPU topologies where Cores-per-Package and Packages-per-Socket are not powers of 2. In practice, this increases KVM_MAX_VCPU_ID from 1023 to 1152. The only side effect of this change is making some fields in struct kvm_ioapic larger, increasing the struct size from 1628 to 1780 bytes (in x86_64). Signed-off-by: Eduardo Habkost Message-Id: <20210903211600.2002377-2-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini commit e4457a45b41c1c2ec7fb392dc60f4e2386b48a90 Author: Randy Dunlap Date: Fri Aug 20 19:09:01 2021 -0700 iwlwifi: fix printk format warnings in uefi.c The kernel test robot reports printk format warnings in uefi.c, so correct them. ../drivers/net/wireless/intel/iwlwifi/fw/uefi.c: In function 'iwl_uefi_get_pnvm': ../drivers/net/wireless/intel/iwlwifi/fw/uefi.c:52:30: warning: format '%zd' expects argument of type 'signed size_t', but argument 7 has type 'long unsigned int' [-Wformat=] 52 | "PNVM UEFI variable not found %d (len %zd)\n", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 53 | err, package_size); | ~~~~~~~~~~~~ | | | long unsigned int ../drivers/net/wireless/intel/iwlwifi/fw/uefi.c:59:29: warning: format '%zd' expects argument of type 'signed size_t', but argument 6 has type 'long unsigned int' [-Wformat=] 59 | IWL_DEBUG_FW(trans, "Read PNVM from UEFI with size %zd\n", package_size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~ | | | long unsigned int Fixes: 84c3c9952afb ("iwlwifi: move UEFI code to a separate file") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Kalle Valo Cc: Luca Coelho Cc: linux-wireless@vger.kernel.org Cc: "David S. Miller" Cc: Jakub Kicinski Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210821020901.25901-1-rdunlap@infradead.org commit 81b4b56d4f8130bbb99cf4e2b48082e5b4cfccb9 Author: Maxim Levitsky Date: Thu Aug 26 12:57:49 2021 +0300 KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation If we are emulating an invalid guest state, we don't have a correct exit reason, and thus we shouldn't do anything in this function. Signed-off-by: Maxim Levitsky Message-Id: <20210826095750.1650467-2-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Fixes: 95b5a48c4f2b ("KVM: VMX: Handle NMIs, #MCs and async #PFs in common irqs-disabled fn", 2019-06-18) Signed-off-by: Paolo Bonzini commit a717a780fc4e1dddd3fbf9ad08f180eec2a78194 Author: Sean Christopherson Date: Mon Aug 23 17:58:24 2021 -0700 KVM: x86/mmu: Don't freak out if pml5_root is NULL on 4-level host Include pml5_root in the set of special roots if and only if the host, and thus NPT, is using 5-level paging. mmu_alloc_special_roots() expects special roots to be allocated as a bundle, i.e. they're either all valid or all NULL. But for pml5_root, that expectation only holds true if the host uses 5-level paging, which causes KVM to WARN about pml5_root being NULL when the other special roots are valid. The silver lining of 4-level vs. 5-level NPT being tied to the host kernel's paging level is that KVM's shadow root level is constant; unlike VMX's EPT, KVM can't choose 4-level NPT based on guest.MAXPHYADDR. That means KVM can still expect pml5_root to be bundled with the other special roots, it just needs to be conditioned on the shadow root level. Fixes: cb0f722aff6e ("KVM: x86/mmu: Support shadowing NPT when 5-level paging is enabled in host") Reported-by: Maxim Levitsky Reviewed-by: Maxim Levitsky Signed-off-by: Sean Christopherson Message-Id: <20210824005824.205536-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4855e26bcf4d28956f3e33231b961610a0d4a72d Author: Hector.Yuan Date: Fri Sep 3 16:39:24 2021 +0800 cpufreq: mediatek-hw: Add support for CPUFREQ HW Introduce cpufreq HW driver which can support CPU frequency adjust in MT6779 platform. Signed-off-by: Hector.Yuan [ Viresh: Massaged the patch and cleaned some stuff. ] Signed-off-by: Viresh Kumar commit 8486a32dd484a7d7ec25295c7439094608f54915 Author: Hector.Yuan Date: Fri Sep 3 16:39:23 2021 +0800 cpufreq: Add of_perf_domain_get_sharing_cpumask Add of_perf_domain_get_sharing_cpumask function to group cpu to specific performance domain. Signed-off-by: Hector.Yuan [ Viresh: create separate routine parse_perf_domain() and always set the cpumask. ] Signed-off-by: Viresh Kumar commit a8bbe0c9440561cb407cefc0b1def808c2c38431 Author: Hector.Yuan Date: Fri Sep 3 16:39:22 2021 +0800 dt-bindings: cpufreq: add bindings for MediaTek cpufreq HW Add devicetree bindings for MediaTek HW driver. Signed-off-by: Hector.Yuan Reviewed-by: Rob Herring Signed-off-by: Viresh Kumar commit c2f24933a18ac9098a758cb3edfff6503ed5c55d Author: Rafał Miłecki Date: Tue Jul 13 11:47:45 2021 +0200 dt-bindings: mfd: Add Broadcom CRU CRU is a block used in e.g. Northstar devices. It can be seen in the bcm5301x.dtsi and this binding documents its proper usage. Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring Signed-off-by: Lee Jones commit aff959c2840858d55d9ee155d555b3aa7e068b32 Author: Chaitanya Kulkarni Date: Sun Sep 5 19:26:01 2021 -0700 nvme: update MAINTAINERS email address Update the MAINTAINERS file email address. Signed-off-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit ab3994f6efba95e0832dc9e68c088b2d7ae764b8 Author: Luis Chamberlain Date: Mon Aug 30 14:25:33 2021 -0700 nvme: add error handling support for add_disk() We never checked for errors on add_disk() as this function returned void. Now that this is fixed, use the shiny new error handling. Signed-off-by: Luis Chamberlain Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 041bd1a1fc737cd73b0b8a9f74909191a8acc9fe Author: Daniel Wagner Date: Wed Sep 1 11:25:24 2021 +0200 nvme: only call synchronize_srcu when clearing current path The function nmve_mpath_clear_current_path returns true if the current path has changed. In this case we have to wait for all concurrent submissions to finish. But if we didn't change the current path, there is no point in waiting for another RCU period to finish. Signed-off-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit b58da2d270dbcc67db73f15028774d27c85e16d7 Author: Tatsuya Sasaki Date: Wed Sep 1 08:23:42 2021 +0000 nvme: update keep alive interval when kato is modified Currently the connection between host and NVMe-oF target gets disconnected by keep-alive timeout when a user connects to a target with a relatively large kato value and then sets the smaller kato with a set features command (e.g. connects with 60 seconds kato value and then sets 10 seconds kato value). The cause is that keep alive command interval on the host, which is defined as unsigned int kato in nvme_ctrl structure, does not follow the kato value changes. This patch updates the keep alive interval in the following steps when the kato is modified by a set features command: stops the keep alive work queue, then sets the kato as new timer value and re-start the queue. Signed-off-by: Tatsuya Sasaki Signed-off-by: Christoph Hellwig commit 1ba2e507f55c5b0cbde8c0fbfe0d9e39612a3e52 Author: Daniel Wagner Date: Mon Aug 30 15:36:26 2021 +0200 nvme-tcp: Do not reset transport on data digest errors The spec says 7.4.6.1 Digest Error handling When a host detects a data digest error in a C2HData PDU, that host shall continue processing C2HData PDUs associated with the command and when the command processing has completed, if a successful status was returned by the controller, the host shall fail the command with a non-fatal transport error. Currently the transport is reseted when a data digest error is detected. Instead, when a digest error is detected, mark the final status as NVME_SC_DATA_XFER_ERROR and let the upper layer handle the error. In order to keep track of the final result maintain a status field in nvme_tcp_request object and use it to overwrite the completion queue status (which might be successful even though a digest error has been detected) when completing the request. Signed-off-by: Daniel Wagner Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit f04064814c2a15c22ed9c803f9b634ef34f91092 Author: Hannes Reinecke Date: Mon Sep 6 09:04:03 2021 +0200 nvmet: fixup buffer overrun in nvmet_subsys_attr_serial() The serial number is copied into the buffer via memcpy_and_pad() with the length NVMET_SN_MAX_SIZE. So when printing out we also need to take just that length as anything beyond that will be uninitialized. Signed-off-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit ab7a2737ac5acd7d485ca45d8772497717fbc781 Author: Christoph Hellwig Date: Fri Aug 27 08:11:12 2021 +0200 nvmet: return bool from nvmet_passthru_ctrl and nvmet_is_passthru_req The target core code never needs the host-side nvme_ctrl structure. Open code two uses of nvmet_is_passthru_req in passthru.c, and then switch the helpers used by the core to return bool. Also rename the fuctions to better match their usage: nvmet_passthru_ctrl -> nvmet_is_passthru_subsys nvmet_req_passthru_ctrl -> nvmet_is_passthru_req Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit 77d651a65569a5e60f314b768500e94fcb936311 Author: Adam Manzanares Date: Thu Aug 26 21:15:45 2021 +0000 nvmet: looks at the passthrough controller when initializing CAP For a passthru controller make cap initialization dependent on the cap of the passthru controller, given that multiple Command Set support needs to be supported by the underlying controller. For that move the initialization of CAP later so that it can use the fully initialized nvmet_ctrl structure. Fixes: ab5d0b38c047 (nvmet: add Command Set Identifier support) Signed-off-by: Adam Manzanares Reviewed-by: Keith Busch [hch: refactored the code a bit to keep it more contained in passthru.c] Signed-off-by: Christoph Hellwig commit 43dc987828eabf915858b1ac37a8e67fa8004349 Author: Adam Manzanares Date: Thu Aug 26 21:15:45 2021 +0000 nvme: move nvme_multi_css into nvme.h Preparatory patch in order to reuse nvme_multi_css in the nvme target code. Signed-off-by: Adam Manzanares Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit e7d65803e2bb5bc739548b67a5fc72c626cf7e3b Author: Hannes Reinecke Date: Tue Aug 24 16:57:42 2021 +0200 nvme-multipath: revalidate paths during rescan When triggering a rescan due to a namespace resize we will be receiving AENs on every controller, triggering a rescan of all attached namespaces. If multipath is active only the current path and the ns_head disk will be updated, the other paths will still refer to the old size until AENs for the remaining controllers are received. If I/O comes in before that it might be routed to one of the old paths, triggering an I/O failure with 'access beyond end of device'. With this patch the old paths are skipped from multipath path selection until the controller serving these paths has been rescanned. Signed-off-by: Hannes Reinecke [dwagner: - introduce NVME_NS_READY flag instead of NVME_NS_INVALIDATE - use 'revalidate' instead of 'invalidate' which follows the zoned device code path. - clear NVME_NS_READY before clearing current_path] Signed-off-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit d32d3d0b47f7e34560ae3c55ddfcf68694813501 Author: Christoph Hellwig Date: Mon Jun 14 13:17:34 2021 +0200 nvme-multipath: set QUEUE_FLAG_NOWAIT The nvme multipathing code just dispatches bios to one of the blk-mq based paths and never blocks on its own, so set QUEUE_FLAG_NOWAIT to support REQ_NOWAIT bios. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit 132c88614f2b3548cd3c8979a434609019db4151 Author: Nicolas Dufresne Date: Thu Aug 19 16:00:09 2021 +0200 media: cedrus: Fix SUNXI tile size calculation Tiled formats requires full rows being allocated (even for Chroma planes). When the number of Luma tiles is odd, we need to round up to twice the tile width in order to roundup the number of Chroma tiles. This was notice with a crash running BA1_FT_C compliance test using sunxi tiles using GStreamer. Cedrus driver would allocate 9 rows for Luma, but only 4.5 rows for Chroma, causing userspace to crash. Signed-off-by: Nicolas Dufresne Fixes: 50e761516f2b8 ("media: platform: Add Cedrus VPU decoder driver") Reviewed-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 31692ab9a9ef0119959f66838de74eeb37490c8d Author: Jernej Skrabec Date: Thu Aug 5 21:04:16 2021 +0200 media: hantro: Fix check for single irq Some cores use only one interrupt and in such case interrupt name in DT is not needed. Driver supposedly accounted that, but due to the wrong field check it never worked. Fix that. Fixes: 18d6c8b7b4c9 ("media: hantro: add fallback handling for single irq/clk") Signed-off-by: Jernej Skrabec Reviewed-by: Ezequiel Garcia Reviewed-by: Emil Velikov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1645cca9da91a85167394a34fcfe1cb5dd336d7f Author: Stephen Rothwell Date: Fri Aug 20 12:33:48 2021 +1000 drm/i915: use linux/stddef.h due to "isystem: trim/fixup stdarg.h and other headers" After merging the drm tree, today's linux-next build (x86_64 allmodconfig) failed like this: In file included from drivers/gpu/drm/i915/i915_debugfs.c:39: drivers/gpu/drm/i915/gt/intel_gt_requests.h:9:10: fatal error: stddef.h: No such file or directory 9 | #include | ^~~~~~~~~~ Caused by commit 564f963eabd1 ("isystem: delete global -isystem compile option") from the kbuild tree interacting with commit b97060a99b01 ("drm/i915/guc: Update intel_gt_wait_for_idle to work with GuC") Fixes: b97060a99b01 ("drm/i915/guc: Update intel_gt_wait_for_idle to work with GuC") Signed-off-by: Stephen Rothwell Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210820123348.6535a87e@canb.auug.org.au commit 729ce5a5bd6fda5eb2322a39db2287f1f26f92f3 Author: Cai Huoqing Date: Mon Aug 2 09:37:17 2021 +0800 vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro it's a nice refactor to make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210802013717.851-1-caihuoqing@baidu.com Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 0e115c45ee0b86172d910588dd41632f1a2c0199 Author: Arseny Krasnov Date: Fri Sep 3 15:33:18 2021 +0300 vsock_test: update message bounds test for MSG_EOR Set 'MSG_EOR' in one of message sent, check that 'MSG_EOR' is visible in corresponding message at receiver. Signed-off-by: Arseny Krasnov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210903123321.3273866-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin commit 8fc92b7c15f04fb50ce414cbeba7b326e07fcf86 Author: Arseny Krasnov Date: Fri Sep 3 15:33:03 2021 +0300 af_vsock: rename variables in receive loop Record is supported via MSG_EOR flag, while current logic operates with message, so rename variables from 'record' to 'message'. Signed-off-by: Arseny Krasnov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210903123306.3273757-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin commit 146ea9b679c9f3e235f20456be477ccd109ac9bd Author: Oliver Graute Date: Sun Sep 5 19:09:25 2021 -0700 Input: edt-ft5x06 - added case for EDT EP0110M09 Add Support for EP011M09 Firmware Signed-off-by: Oliver Graute Reviewed-by: Marco Felsch Link: https://lore.kernel.org/r/20210813062110.13950-1-oliver.graute@kococonnector.com Signed-off-by: Dmitry Torokhov commit 8be98d2f2a0a262f8bf8a0bc1fdf522b3c7aab17 Merge: 818b26588994d 3e204d6b76b29 Author: Dmitry Torokhov Date: Sun Sep 5 18:58:05 2021 -0700 Merge branch 'next' into for-linus Prepare input updates for 5.15 merge window. commit 38de3afffb7257176978dfa9b3ab67d0c29af95c Author: Christophe JAILLET Date: Sun Aug 22 16:04:12 2021 +0200 NTB: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET Acked-by: Serge Semin Signed-off-by: Jon Mason commit e631548027cae026486300fe93542949df73a87d Author: Colin Ian King Date: Wed Jun 9 12:21:28 2021 +0100 ntb: ntb_pingpong: remove redundant initialization of variables msg_data and spad_data The variables msg_data and spad_data are being initialized with values that are never read, they are being updated later on. The initializations are redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Acked-by: Serge Semin Signed-off-by: Jon Mason commit 8d5ac871b556c73b042438dc1c811c554dadca52 Author: Arseny Krasnov Date: Fri Sep 3 15:32:48 2021 +0300 virtio/vsock: support MSG_EOR bit processing If packet has 'EOR' bit - set MSG_EOR in 'recvmsg()' flags. Signed-off-by: Arseny Krasnov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210903123251.3273639-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin commit 1af7e55511fe194a07f3fa4e77b5b9d10bdd9208 Author: Arseny Krasnov Date: Fri Sep 3 15:32:35 2021 +0300 vhost/vsock: support MSG_EOR bit processing 'MSG_EOR' handling has similar logic as 'MSG_EOM' - if bit present in packet's header, reset it to 0. Then restore it back if packet processing wasn't completed. Instead of bool variable for each flag, bit mask variable was added: it has logical OR of 'MSG_EOR' and 'MSG_EOM' if needed, to restore flags, this variable is ORed with flags field of packet. Signed-off-by: Arseny Krasnov Link: https://lore.kernel.org/r/20210903123238.3273526-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 41116599a0731f4cd451e9d191d879ab45e31945 Author: Arseny Krasnov Date: Fri Sep 3 15:32:23 2021 +0300 virtio/vsock: add 'VIRTIO_VSOCK_SEQ_EOR' bit. This bit is used to handle POSIX MSG_EOR flag passed from userspace in 'send*()' system calls. It marks end of each record and is visible to receiver using 'recvmsg()' system call. Signed-off-by: Arseny Krasnov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210903123225.3273425-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin commit 9af8f1061646e8e22b66413bedf7b3e2ab3d69e5 Author: Arseny Krasnov Date: Fri Sep 3 15:31:06 2021 +0300 virtio/vsock: rename 'EOR' to 'EOM' bit. This current implemented bit is used to mark end of messages ('EOM' - end of message), not records('EOR' - end of record). Also rename 'record' to 'message' in implementation as it is different things. Signed-off-by: Arseny Krasnov Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210903123109.3273053-1-arseny.krasnov@kaspersky.com Signed-off-by: Michael S. Tsirkin commit 694a1116b405d887c893525a6766b390989c8606 Author: Viresh Kumar Date: Tue Jul 27 10:53:52 2021 +0530 virtio: Bind virtio device to device-tree node Bind the virtio devices with their of_node. This will help users of the virtio devices to mention their dependencies on the device in the DT itself. Like GPIO pin users can use the phandle of the device node, or the node may contain more subnodes to add i2c or spi eeproms and other users. Reviewed-by: Arnd Bergmann Signed-off-by: Viresh Kumar Link: https://lore.kernel.org/r/94c12705602929968477aaf27e02439eb7a7f253.1627362340.git.viresh.kumar@linaro.org Signed-off-by: Michael S. Tsirkin commit d5a8680dfab0547a4ecd708b1fe9de48598a6757 Author: Viresh Kumar Date: Tue Jul 27 10:53:51 2021 +0530 uapi: virtio_ids: Sync ids with specification This synchronizes the virtio ids with the latest list from virtio specification. Signed-off-by: Viresh Kumar Link: https://lore.kernel.org/r/61b27e3bc61fb0c9f067001e95cfafc5d37d414a.1627362340.git.viresh.kumar@linaro.org Signed-off-by: Michael S. Tsirkin commit f3a66dcdf2390f8434622a4e20a1af7413502623 Author: Viresh Kumar Date: Tue Jul 27 10:53:50 2021 +0530 dt-bindings: gpio: Add bindings for gpio-virtio This patch adds binding for virtio GPIO controller, it is based on virtio-device bindings. Reviewed-by: Arnd Bergmann Signed-off-by: Viresh Kumar Link: https://lore.kernel.org/r/acf7402ef4aabc0ad6295c32846f2bef1cd9b56a.1627362340.git.viresh.kumar@linaro.org Signed-off-by: Michael S. Tsirkin Reviewed-by: Rob Herring commit 7f815fce08d563006e43d1b7d2f9a0a4f3b832f3 Author: Viresh Kumar Date: Tue Jul 27 10:53:49 2021 +0530 dt-bindings: i2c: Add bindings for i2c-virtio This patch adds binding for virtio I2C device, it is based on virtio-device bindings. Acked-by: Wolfram Sang Reviewed-by: Arnd Bergmann Signed-off-by: Viresh Kumar Link: https://lore.kernel.org/r/33c317b95097ce491845c697db1e8285e3ec1d41.1627362340.git.viresh.kumar@linaro.org Signed-off-by: Michael S. Tsirkin Reviewed-by: Rob Herring commit ad93f7b3715449704225feb33d5fbe6507472245 Author: Viresh Kumar Date: Tue Jul 27 10:53:48 2021 +0530 dt-bindings: virtio: Add binding for virtio devices Allow virtio device sub-nodes to be added to the virtio mmio or pci nodes. The compatible property for virtio device must be of the format "virtio,device", where ID is virtio device ID in hexadecimal format. Signed-off-by: Viresh Kumar Link: https://lore.kernel.org/r/d8319fd18df7086b12cdcc23193c313893aa071a.1627362340.git.viresh.kumar@linaro.org Signed-off-by: Michael S. Tsirkin Reviewed-by: Arnd Bergmann Reviewed-by: Rob Herring commit 0d8c9e7d4b403f10f5c277efefd787244198a00c Author: Xie Yongji Date: Mon Aug 9 18:09:23 2021 +0800 vdpa_sim: Use iova_shift() for the size passed to alloc_iova() The size passed to alloc_iova() should be the size of page frames. Now we use byte granularity for the iova domain, so it's safe to pass the size in bytes to alloc_iova(). But it would be better to use iova_shift() for the size to avoid future bugs if we change granularity. Signed-off-by: Xie Yongji Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20210809100923.38-1-xieyongji@bytedance.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 23b228cb89fdad2140b6b73254ecaf5fb05de5fe Author: Cai Huoqing Date: Sat Aug 21 20:33:20 2021 +0800 vhost scsi: Convert to SPDX identifier use SPDX-License-Identifier instead of a verbose license text Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210821123320.734-1-caihuoqing@baidu.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit 52893733f2c5886fc74be6c386d12b59a3f581df Author: Eli Cohen Date: Mon Aug 23 08:21:23 2021 +0300 vdpa/mlx5: Add multiqueue support Multiqueue support requires additional virtio_net_q objects to be added or removed per the configured number of queue pairs. In addition the RQ tables needs to be modified to match the number of configured receive queues so the packets are dispatched to the right virtqueue according to the hash result. Note: qemu v6.0.0 is broken when the device requests more than two data queues; no net device will be created for the vdpa device. To avoid this, one should specify mq=off to qemu. In this case it will end up with a single queue. Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-7-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit 5262912ef3cfc5e518892c3d67fb36412cb813e2 Author: Eli Cohen Date: Mon Aug 23 08:21:22 2021 +0300 vdpa/mlx5: Add support for control VQ and MAC setting Add support to handle control virtqueue configurations per virtio specification. The control virtqueue is implemented in software and no hardware offloading is involved. Control VQ configuration need task context, therefore all configurations are handled in a workqueue created for the purpose. Modifications are made to the memory registration code to allow for saving a copy of itolb to be used by the control VQ to access the vring. The max number of data virtqueus supported by the driver has been updated to 2 since multiqueue is not supported at this stage and we need to ensure consistency of VQ indices mapping to either data or control VQ. Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-6-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit e4fc66508c884b87422a98259cdfe135edae130f Author: Eli Cohen Date: Mon Aug 23 08:21:21 2021 +0300 vdpa/mlx5: Ensure valid indices are provided Following patches add control virtuqeue and multiqueue support. We want to verify that the index value to callbacks referencing a virtqueue is valid. The logic defining valid indices is as follows: CVQ clear: 0 and 1. CVQ set, MQ clear: 0, 1 and 2 CVQ set, MQ set: 0..nvq where nvq is whatever provided to _vdpa_register_device() Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-5-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit db296d252dfb977885391e47d3fb6ac5a1f9601c Author: Eli Cohen Date: Mon Aug 23 08:21:20 2021 +0300 vdpa/mlx5: Decouple virtqueue callback from struct mlx5_vdpa_virtqueue Instead, define an array of struct vdpa_callback on struct mlx5_vdpa_net and use it to store callbacks for any virtqueue provided. This is required due to the fact that callback configurations arrive before feature negotiation. With control VQ and multiqueue introduced next we want to save the information until after feature negotiation where we know the CVQ index. Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-4-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit ae0428debf7cddf0863a95e415a1957d53384e7e Author: Eli Cohen Date: Mon Aug 23 08:21:19 2021 +0300 vdpa/mlx5: function prototype modifications in preparation to control VQ Use struct mlx5_vdpa_dev as an argument to setup_driver() and a few others in preparation to control virtqueue support in a subsequent patch. The control virtqueue is part of struct mlx5_vdpa_dev so this is required. Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-3-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit 4e57a9f622ccacacceadcead7bb65fb807383ab3 Author: Eli Cohen Date: Mon Aug 23 08:21:18 2021 +0300 vdpa/mlx5: Remove redundant header file inclusion linux/if_vlan.h is not required. Remove it. Signed-off-by: Eli Cohen Link: https://lore.kernel.org/r/20210823052123.14909-2-elic@nvidia.com Signed-off-by: Michael S. Tsirkin commit 90d1936681bc469824c6dfeda701efc884d3b448 Author: Zhu Lingshan Date: Wed Aug 18 17:57:14 2021 +0800 vDPA/ifcvf: enable multiqueue and control vq This commit enbales multi-queue and control vq features for ifcvf Signed-off-by: Zhu Lingshan Link: https://lore.kernel.org/r/20210818095714.3220-3-lingshan.zhu@intel.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 2ddae773c93bbcb0678ae819551f1750a505edec Author: Zhu Lingshan Date: Wed Aug 18 17:57:13 2021 +0800 vDPA/ifcvf: detect and use the onboard number of queues directly To enable this multi-queue feature for ifcvf, this commit intends to detect and use the onboard number of queues directly than IFCVF_MAX_QUEUE_PAIRS = 1 (removed) Signed-off-by: Zhu Lingshan Link: https://lore.kernel.org/r/20210818095714.3220-2-lingshan.zhu@intel.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6b5df347c6482f57b0d8f0569b86fb8fcd90d168 Author: Zhu Lingshan Date: Thu Aug 12 11:24:54 2021 +0800 vDPA/ifcvf: implement management netlink framework for ifcvf This commit implements the management netlink framework for ifcvf, including register and add / remove a device It works with iproute2: [root@localhost lszhu]# vdpa mgmtdev show -jp { "mgmtdev": { "pci/0000:01:00.5": { "supported_classes": [ "net" ] }, "pci/0000:01:00.6": { "supported_classes": [ "net" ] } } } [root@localhost lszhu]# vdpa dev add mgmtdev pci/0000:01:00.5 name vdpa0 [root@localhost lszhu]# vdpa dev add mgmtdev pci/0000:01:00.6 name vdpa1 Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210812032454.24486-3-lingshan.zhu@intel.com Signed-off-by: Michael S. Tsirkin commit 30326f9577342aac257ed9c036608de666b06389 Author: Zhu Lingshan Date: Thu Aug 12 11:24:53 2021 +0800 vDPA/ifcvf: introduce get_dev_type() which returns virtio dev id This commit introduces a new function get_dev_type() which returns the virtio device id of a device, to avoid duplicated code. Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Link: https://lore.kernel.org/r/20210812032454.24486-2-lingshan.zhu@intel.com Signed-off-by: Michael S. Tsirkin commit 48eab831ae8b9f7002a533fa4235eed63ea1f1a3 Author: Jakub Kicinski Date: Thu Sep 2 11:10:37 2021 -0700 net: create netdev->dev_addr assignment helpers Recent work on converting address list to a tree made it obvious we need an abstraction around writing netdev->dev_addr. Without such abstraction updating the main device address is invisible to the core. Introduce a number of helpers which for now just wrap memcpy() but in the future can make necessary changes to the address tree. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 8c9bc823efd93394061c9b18270405cf21168d51 Merge: 63f8428b4077d 1b2b91831983a Author: David S. Miller Date: Sun Sep 5 20:43:04 2021 +0100 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes This series includes 3 fixes related to devlink firmware and chip versions. The other 2 patches fix a UDP tunneling issue and an error recovery issue. ==================== Signed-off-by: David S. Miller commit 1b2b91831983aeac3adcbb469aa8b0dc71453f89 Author: Michael Chan Date: Sun Sep 5 14:10:59 2021 -0400 bnxt_en: Fix possible unintended driver initiated error recovery If error recovery is already enabled, bnxt_timer() will periodically check the heartbeat register and the reset counter. If we get an error recovery async. notification from the firmware (e.g. change in primary/secondary role), we will immediately read and update the heartbeat register and the reset counter. If the timer for the next health check expires soon after this, we may read the heartbeat register again in quick succession and find that it hasn't changed. This will trigger error recovery unintentionally. The likelihood is small because we also reset fw_health->tmr_counter which will reset the interval for the next health check. But the update is not protected and bnxt_timer() can miss the update and perform the health check without waiting for the full interval. Fix it by only reading the heartbeat register and reset counter in bnxt_async_event_process() if error recovery is trasitioning to the enabled state. Also add proper memory barriers so that when enabling for the first time, bnxt_timer() will see the tmr_counter interval and perform the health check after the full interval has elapsed. Fixes: 7e914027f757 ("bnxt_en: Enable health monitoring.") Reviewed-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 7ae9dc356f247ad9f9634b3da61a45eb72968b2e Author: Michael Chan Date: Sun Sep 5 14:10:58 2021 -0400 bnxt_en: Fix UDP tunnel logic The current logic assumes that when the driver sends the message to the firmware to add the VXLAN or Geneve port, the firmware will never fail the operation. The UDP ports are always stored and are used to check the tunnel packets in .ndo_features_check(). These tunnnel packets will fail to offload on the transmit side if firmware fails the call to add the UDP ports. To fix the problem, bp->vxlan_port and bp->nge_port will only be set to the offloaded ports when the HWRM_TUNNEL_DST_PORT_ALLOC firmware call succeeds. When deleting a UDP port, we check that the port was previously added successfuly first by checking the FW ID. Fixes: 1698d600b361 ("bnxt_en: Implement .ndo_features_check().") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6fdab8a3ade2adc123bbf5c4fdec3394560b1fb1 Author: Michael Chan Date: Sun Sep 5 14:10:57 2021 -0400 bnxt_en: Fix asic.rev in devlink dev info command The current asic.rev is incomplete and does not include the metal revision. Add the metal revision and decode the complete asic revision into the more common and readable form (A0, B0, etc). Fixes: 7154917a12b2 ("bnxt_en: Refactor bnxt_dl_info_get().") Reviewed-by: Edwin Peer Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit beb55fcf950f5454715df05234bb2b2914bc97ac Author: Edwin Peer Date: Sun Sep 5 14:10:56 2021 -0400 bnxt_en: fix read of stored FW_PSID version on P5 devices P5 devices store NVM arrays using a different internal representation. This implementation detail permeates into the HWRM API, requiring the caller to explicitly index the array elements in HWRM_NVM_GET_VARIABLE on these devices. Conversely, older devices do not support the indexed mode of operation and require reading the raw NVM content. Fixes: db28b6c77f40 ("bnxt_en: Fix devlink info's stored fw.psid version format.") Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1656db67233e4259281d2ac35b25f712edbbc20b Author: Edwin Peer Date: Sun Sep 5 14:10:55 2021 -0400 bnxt_en: fix stored FW_PSID version masks The FW_PSID version components are 8 bits wide, not 4. Fixes: db28b6c77f40 ("bnxt_en: Fix devlink info's stored fw.psid version format.") Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 27151f177827d478508e756c7657273261aaf8a9 Merge: 58ca24158758f c7a3828d98db2 Author: Linus Torvalds Date: Sun Sep 5 11:56:18 2021 -0700 Merge tag 'perf-tools-for-v5.15-2021-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tool updates from Arnaldo Carvalho de Melo: "New features: - Improvements for the flamegraph python script, including: - Display perf.data header - Display PIDs of user stacks - Added option to change color scheme - Default to blue/green color scheme to improve accessibility - Correctly identify kernel stacks when debuginfo is available - Improvements for 'perf bench futex': - Add --mlockall parameter - Add --broadcast and --pi to the 'requeue' sub benchmark - Add support for PMU aliases. - Introduce an ARM Coresight ETE decoder. - Add a 'perf bench' entry for evlist open/close operations, to help quantify improvements with multithreading 'perf record'. - Allow reporting the [un]throttle PERF_RECORD_ meta event in 'perf script's python scripting. - Add a 'perf test' entry for PMU aliases. - Add a 'perf test' entry for 'perf record/perf report/perf script' pipe mode. Fixes: - perf script dlfilter (API for filtering via dynamically loaded shared object introduced in v5.14) fixes and a 'perf test' entry for it. - Fix get_current_dir_name() compilation on Android. - Fix issues with asciidoc and double dashes uses. - Fix memory leaks in the BTF handling code. - Fix leftover problems in the Documentation from the infrastructure originally lifted from the git codebase. - Fix *probe_vfs_getname.sh 'perf test' failures. - Handle fd gaps in 'perf test's test__dso_data_reopen(). - Make sure to show disasembly warnings for 'perf annotate --stdio'. - Fix output from pipe to file and vice-versa in 'perf record/report/script'. - Correct 'perf data -h' output. - Fix wrong comm in system-wide mode with 'perf record --delay'. - Do not allow --for-each-cgroup without cpu in 'perf stat' - Make 'perf test --skip' work on shell tests. - Fix libperf's verbose printing. Misc improvements: - Preparatory patches for multithreading various 'perf record' phases (synthesizing, opening, recording, etc). - Add sparse context/locking annotations in compiler-types.h, also to help with the multithreading effort. - Optimize the generation of the arch specific erno tables used in 'perf trace'. - Optimize libperf's perf_cpu_map__max(). - Improve ARM's CoreSight warnings. - Report collisions in AUX records. - Improve warnings for the LLVM 'perf test' entry. - Improve the PMU events 'perf test' codebase. - perf test: Do not compare overheads in the zstd comp test - Better support annotation on ARM. - Update 'perf trace's cmd string table to decode sys_bpf() first arg. Vendor events: - Add JSON events and metrics for Intel's Ice Lake, Tiger Lake and Elhart Lake. - Update JSON eventsand metrics for Intel's Cascade Lake and Sky Lake servers. Hardware tracing: - Improvements for the ARM hardware tracing auxtrace support" * tag 'perf-tools-for-v5.15-2021-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (130 commits) perf tests: Add test for PMU aliases perf pmu: Add PMU alias support perf session: Report collisions in AUX records perf script python: Allow reporting the [un]throttle PERF_RECORD_ meta event perf build: Report failure for testing feature libopencsd perf cs-etm: Show a warning for an unknown magic number perf cs-etm: Print the decoder name perf cs-etm: Create ETE decoder perf cs-etm: Update OpenCSD decoder for ETE perf cs-etm: Fix typo perf cs-etm: Save TRCDEVARCH register perf cs-etm: Refactor out ETMv4 header saving perf cs-etm: Initialise architecture based on TRCIDR1 perf cs-etm: Refactor initialisation of decoder params. tools build: Fix feature detect clean for out of source builds perf evlist: Add evlist__for_each_entry_from() macro perf evsel: Handle precise_ip fallback in evsel__open_cpu() perf evsel: Move bpf_counter__install_pe() to success path in evsel__open_cpu() perf evsel: Move test_attr__open() to success path in evsel__open_cpu() perf evsel: Move ignore_missing_thread() to fallback code ... commit 58ca24158758f1784400d32743373d7d6227d018 Merge: e07af26266432 4420f5b1be7b1 Author: Linus Torvalds Date: Sun Sep 5 11:50:41 2021 -0700 Merge tag 'trace-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: - simplify the Kconfig use of FTRACE and TRACE_IRQFLAGS_SUPPORT - bootconfig can now start histograms - bootconfig supports group/all enabling - histograms now can put values in linear size buckets - execnames can be passed to synthetic events - introduce "event probes" that attach to other events and can retrieve data from pointers of fields, or record fields as different types (a pointer to a string as a string instead of just a hex number) - various fixes and clean ups * tag 'trace-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (35 commits) tracing/doc: Fix table format in histogram code selftests/ftrace: Add selftest for testing duplicate eprobes and kprobes selftests/ftrace: Add selftest for testing eprobe events on synthetic events selftests/ftrace: Add test case to test adding and removing of event probe selftests/ftrace: Fix requirement check of README file selftests/ftrace: Add clear_dynamic_events() to test cases tracing: Add a probe that attaches to trace events tracing/probes: Reject events which have the same name of existing one tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs tracing/probe: Change traceprobe_set_print_fmt() to take a type tracing/probes: Use struct_size() instead of defining custom macros tracing/probes: Allow for dot delimiter as well as slash for system names tracing/probe: Have traceprobe_parse_probe_arg() take a const arg tracing: Have dynamic events have a ref counter tracing: Add DYNAMIC flag for dynamic events tracing: Replace deprecated CPU-hotplug functions. MAINTAINERS: Add an entry for os noise/latency tracepoint: Fix kerneldoc comments bootconfig/tracing/ktest: Update ktest example for boot-time tracing tools/bootconfig: Use per-group/all enable option in ftrace2bconf script ... commit e07af2626643293fa16df655979e7963250abc63 Merge: 063df71a574b8 56809a28d45fc Author: Linus Torvalds Date: Sun Sep 5 11:43:03 2021 -0700 Merge tag 'arc-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: "Finally a big pile of changes for ARC (atomics/mm). These are from our internal arc64 tree, preparing mainline for eventual arc64 support. I'm spreading them out to avoid tsunami of patches in one release. - MM rework: - Implement up to 4 paging levels - Enable STRICT_MM_TYPECHECK - switch pgtable_t back to 'struct page *' - Atomics rework / implement relaxed accessors - Retire legacy MMUv1,v2; ARC750 cores - A few other build errors, typos" * tag 'arc-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: (33 commits) ARC: mm: vmalloc sync from kernel to user table to update PMD ... ARC: mm: support 4 levels of page tables ARC: mm: support 3 levels of page tables ARC: mm: switch to asm-generic/pgalloc.h ARC: mm: switch pgtable_t back to struct page * ARC: mm: hack to allow 2 level build with 4 level code ARC: mm: disintegrate pgtable.h into levels and flags ARC: mm: disintegrate mmu.h (arcv2 bits out) ARC: mm: move MMU specific bits out of entry code ... ARC: mm: move MMU specific bits out of ASID allocator ARC: mm: non-functional code movement/cleanup ARC: mm: pmd_populate* to use the canonical set_pmd (and drop pmd_set) ARC: ioremap: use more commonly used PAGE_KERNEL based uncached flag ARC: mm: Enable STRICT_MM_TYPECHECKS ARC: mm: Fixes to allow STRICT_MM_TYPECHECKS ARC: mm: move mmu/cache externs out to setup.h ARC: mm: remove tlb paranoid code ARC: mm: use SCRATCH_DATA0 register for caching pgdir in ARCv2 only ARC: retire MMUv1 and MMUv2 support ARC: retire ARC750 support ... commit 063df71a574b88e94391a3a719cf66d1b46df884 Merge: 3fe617ccafd6f c24a19674258d Author: Linus Torvalds Date: Sun Sep 5 11:31:23 2021 -0700 Merge tag 'riscv-for-linus-5.15-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - support PC-relative instructions (auipc and branches) in kprobes - support for forced IRQ threading - support for the hlt/nohlt kernel command line options, via the generic idle loop - show the edge/level triggered behavior of interrupts in /proc/interrupts - a handful of cleanups to our address mapping mechanisms - support for allocating gigantic hugepages via CMA - support for the undefined behavior sanitizer (UBSAN) - a handful of cleanups to the VDSO that allow the kernel to build with LLD. - support for hugepage migration * tag 'riscv-for-linus-5.15-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (21 commits) riscv: add support for hugepage migration RISC-V: Fix VDSO build for !MMU riscv: use strscpy to replace strlcpy riscv: explicitly use symbol offsets for VDSO riscv: Enable Undefined Behavior Sanitizer UBSAN riscv: Keep the riscv Kconfig selects sorted riscv: Support allocating gigantic hugepages using CMA riscv: fix the global name pfn_base confliction error riscv: Move early fdt mapping creation in its own function riscv: Simplify BUILTIN_DTB device tree mapping handling riscv: Use __maybe_unused instead of #ifdefs around variable declarations riscv: Get rid of map_size parameter to create_kernel_page_table riscv: Introduce va_kernel_pa_offset for 32-bit kernel riscv: Optimize kernel virtual address conversion macro dt-bindings: riscv: add starfive jh7100 bindings riscv: Enable GENERIC_IRQ_SHOW_LEVEL riscv: Enable idle generic idle loop riscv: Allow forced irq threading riscv: Implement thread_struct whitelist for hardened usercopy riscv: kprobes: implement the branch instructions ... commit 3fe617ccafd6f5bb33c2391d6f4eeb41c1fd0151 Author: Linus Torvalds Date: Sun Sep 5 11:24:05 2021 -0700 Enable '-Werror' by default for all kernel builds ... but make it a config option so that broken environments can disable it when required. We really should always have a clean build, and will disable specific over-eager warnings as required, if we can't fix them. But while I fairly religiously enforce that in my own tree, it doesn't get enforced by various build robots that don't necessarily report warnings. So this just makes '-Werror' a default compiler flag, but allows people to disable it for their configuration if they have some particular issues. Occasionally, new compiler versions end up enabling new warnings, and it can take a while before we have them fixed (or the warnings disabled if that is what it takes), so the config option allows for that situation. Hopefully this will mean that I get fewer pull requests that have new warnings that were not noticed by various automation we have in place. Knock wood. Signed-off-by: Linus Torvalds commit fd47ff55c9c31101fcc06d20cb381da3d4089bd5 Merge: 6b6dc4f40c526 1b4f3dfb4792f Author: Linus Torvalds Date: Sun Sep 5 11:19:15 2021 -0700 Merge tag 'usb-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull more USB updates from Greg KH: "Here are some straggler USB-serial changes for 5.15-rc1. These were not included in the first pull request as they came in "late" from Johan and I had missed them in my pull request earlier this week. Nothing big in here, just some USB to serial driver updates and fixes. All of these were in linux-next before I pulled them into my tree, and have been in linux-next all this week from my tree with no reported problems" * tag 'usb-5.15-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: pl2303: fix GL type detection USB: serial: replace symbolic permissions by octal permissions USB: serial: cp210x: determine fw version for CP2105 and CP2108 USB: serial: cp210x: clean up type detection USB: serial: cp210x: clean up set-chars request USB: serial: cp210x: clean up control-request timeout USB: serial: cp210x: fix flow-control error handling USB: serial: cp210x: fix control-characters error handling USB: serial: io_edgeport: drop unused descriptor helper commit 63f8428b4077de3664eb0b252393c839b0b293ec Author: Rafał Miłecki Date: Sun Sep 5 19:23:28 2021 +0200 net: dsa: b53: Fix IMP port setup on BCM5301x Broadcom's b53 switches have one IMP (Inband Management Port) that needs to be programmed using its own designed register. IMP port may be different than CPU port - especially on devices with multiple CPU ports. For that reason it's required to explicitly note IMP port index and check for it when choosing a register to use. This commit fixes BCM5301x support. Those switches use CPU port 5 while their IMP port is 8. Before this patch b53 was trying to program port 5 with B53_PORT_OVERRIDE_CTRL instead of B53_GMII_PORT_OVERRIDE_CTRL(5). It may be possible to also replace "cpu_port" usages with dsa_is_cpu_port() but that is out of the scope of thix BCM5301x fix. Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Rafał Miłecki Signed-off-by: David S. Miller commit 8a0ed250f911da31a2aef52101bc707846a800ff Author: Willem de Bruijn Date: Sun Sep 5 11:21:09 2021 -0400 ip_gre: validate csum_start only on pull The GRE tunnel device can pull existing outer headers in ipge_xmit. This is a rare path, apparently unique to this device. The below commit ensured that pulling does not move skb->data beyond csum_start. But it has a false positive if ip_summed is not CHECKSUM_PARTIAL and thus csum_start is irrelevant. Refine to exclude this. At the same time simplify and strengthen the test. Simplify, by moving the check next to the offending pull, making it more self documenting and removing an unnecessary branch from other code paths. Strengthen, by also ensuring that the transport header is correct and therefore the inner headers will be after skb_reset_inner_headers. The transport header is set to csum_start in skb_partial_csum_set. Link: https://lore.kernel.org/netdev/YS+h%2FtqCJJiQei+W@shredder/ Fixes: 1d011c4803c7 ("ip_gre: add validation for csum_start") Reported-by: Ido Schimmel Suggested-by: Alexander Duyck Signed-off-by: Willem de Bruijn Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller commit 6b6dc4f40c5264556223ba94693f20d83796ab1f Merge: 0319b848b1551 c1fe77e42440d Author: Linus Torvalds Date: Sun Sep 5 10:50:12 2021 -0700 Merge tag 'mtd/for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD changes: - blkdevs: - Simplify the refcounting in blktrans_{open, release} - Simplify blktrans_getgeo - Remove blktrans_ref_mutex - Simplify blktrans_dev_get - Use lockdep_assert_held - Don't hold del_mtd_blktrans_dev in blktrans_{open, release} - ftl: - Don't cast away the type when calling add_mtd_blktrans_dev - Don't cast away the type when calling add_mtd_blktrans_dev - Use container_of() rather than cast - Fix use-after-free - Add discard support - Allow use of MTD_RAM for testing purposes - concat: - Check _read, _write callbacks existence before assignment - Judge callback existence based on the master - maps: - Maps: remove dead MTD map driver for PMC-Sierra MSP boards - mtdblock: - Warn if added for a NAND device - Add comment about UBI block devices - Update old JFFS2 mention in Kconfig - partitions: - Redboot: convert to YAML NAND core changes: - Repair Miquel Raynal's email address in MAINTAINERS - Fix a couple of spelling mistakes in Kconfig - bbt: Skip bad blocks when searching for the BBT in NAND - Remove never changed ret variable Raw NAND changes: - cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' - intel: Fix error handling in probe - omap: Fix kernel doc warning on 'calcuate' typo - gpmc: Fix the ECC bytes vs. OOB bytes equation SPI-NAND core changes: - Properly fill the OOB area. - Fix comment SPI-NAND drivers changes: - macronix: Add Quad support for serial NAND flash" * tag 'mtd/for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits) mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' mtd_blkdevs: simplify the refcounting in blktrans_{open, release} mtd_blkdevs: simplify blktrans_getgeo mtd_blkdevs: remove blktrans_ref_mutex mtd_blkdevs: simplify blktrans_dev_get mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev mtd/ftl: don't cast away the type when calling add_mtd_blktrans_dev mtd_blkdevs: use lockdep_assert_held mtd_blkdevs: don't hold del_mtd_blktrans_dev in blktrans_{open, release} mtd: rawnand: intel: Fix error handling in probe mtd: mtdconcat: Check _read, _write callbacks existence before assignment mtd: mtdconcat: Judge callback existence based on the master mtd: maps: remove dead MTD map driver for PMC-Sierra MSP boards mtd: rfd_ftl: use container_of() rather than cast mtd: rfd_ftl: fix use-after-free mtd: rfd_ftl: add discard support mtd: rfd_ftl: allow use of MTD_RAM for testing purposes mtdblock: Warn if added for a NAND device mtd: spinand: macronix: Add Quad support for serial NAND flash mtdblock: Add comment about UBI block devices ... commit 0319b848b155185815724e1b46103c550627a845 Author: Geert Uytterhoeven Date: Sun Sep 5 11:30:34 2021 +0200 binfmt: a.out: Fix bogus semicolon fs/binfmt_aout.c: In function ‘load_aout_library’: fs/binfmt_aout.c:311:27: error: expected ‘)’ before ‘;’ token 311 | MAP_FIXED | MAP_PRIVATE; | ^ fs/binfmt_aout.c:309:10: error: too few arguments to function ‘vm_mmap’ 309 | error = vm_mmap(file, start_addr, ex.a_text + ex.a_data, | ^~~~~~~ In file included from fs/binfmt_aout.c:12: include/linux/mm.h:2626:35: note: declared here 2626 | extern unsigned long __must_check vm_mmap(struct file *, unsigned long, | ^~~~~~~ Fix this by reverting the accidental replacement of a comma by a semicolon. Fixes: 42be8b42535183f8 ("binfmt: don't use MAP_DENYWRITE when loading shared libraries via uselib()") Reported-by: noreply@ellerman.id.au Reported-by: Guenter Roeck Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 0a4fd8df07ddc3d12fad3b2e81ea5832bde2f806 Author: David Decotigny Date: Fri Sep 3 23:31:29 2021 -0700 bonding: complain about missing route only once for A/B ARP probes On configs where there is no confirgured direct route to the target of the ARP probes, these probes are still sent and may be replied to properly, so no need to repeatedly complain about the missing route. Signed-off-by: David Decotigny Signed-off-by: David S. Miller commit e5dd729460ca8d2da02028dbf264b65be8cd4b5f Author: Antonio Quartulli Date: Fri Sep 3 18:58:42 2021 +0200 ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address GRE interfaces are not Ether-like and therefore it is not possible to generate the v6LL address the same way as (for example) GRETAP devices. With default settings, a GRE interface will attempt generating its v6LL address using the EUI64 approach, but this will fail when the local endpoint of the GRE tunnel is set to "any". In this case the GRE interface will end up with no v6LL address, thus violating RFC4291. SIT interfaces already implement a different logic to ensure that a v6LL address is always computed. Change the GRE v6LL generation logic to follow the same approach as SIT. This way GRE interfaces will always have a v6LL address as well. Behaviour of GRETAP interfaces has not been changed as they behave like classic Ether-like interfaces. To avoid code duplication sit_add_v4_addrs() has been renamed to add_v4_addrs() and adapted to handle also the IP6GRE/GRE cases. Signed-off-by: Antonio Quartulli Signed-off-by: David S. Miller commit 81d0885d68ec427e62044cf46a400c9958ea0092 Author: Song Yoong Siang Date: Fri Sep 3 10:00:26 2021 +0800 net: stmmac: Fix overall budget calculation for rxtx_napi tx_done is not used for napi_complete_done(). Thus, NAPI busy polling mechanism by gro_flush_timeout and napi_defer_hard_irqs will not able be triggered after a packet is transmitted when there is no receive packet. Fix this by taking the maximum value between tx_done and rx_done as overall budget completed by the rxtx NAPI poll to ensure XDP Tx ZC operation is continuously polling for next Tx frame. This gives benefit of lower packet submission processing latency and jitter under XDP Tx ZC mode. Performance of tx-only using xdp-sock on Intel ADL-S platform is the same with and without this patch. root@intel-corei7-64:~# ./xdpsock -i enp0s30f4 -t -z -q 1 -n 10 sock0@enp0s30f4:1 txonly xdp-drv pps pkts 10.00 rx 0 0 tx 511630 8659520 sock0@enp0s30f4:1 txonly xdp-drv pps pkts 10.00 rx 0 0 tx 511625 13775808 sock0@enp0s30f4:1 txonly xdp-drv pps pkts 10.00 rx 0 0 tx 511619 18892032 Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket") Cc: # 5.13.x Co-developed-by: Ong Boon Leong Signed-off-by: Ong Boon Leong Signed-off-by: Song Yoong Siang Signed-off-by: David S. Miller commit 45010c080e6e7434fcae73212b0087a03590049f Author: Christophe JAILLET Date: Thu Sep 2 22:38:11 2021 +0200 iwlwifi: pnvm: Fix a memory leak in 'iwl_pnvm_get_from_fs()' A firmware is requested but never released in this function. This leads to a memory leak in the normal execution path. Add the missing 'release_firmware()' call. Also introduce a temp variable (new_len) in order to keep the value of 'pnvm->size' after the firmware has been released. Fixes: cdda18fbbefa ("iwlwifi: pnvm: move file loading code to a separate function") Signed-off-by: Christophe JAILLET Reviewed-by: Dan Carpenter Acked-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1b5d80f54c1dbf85710fd285243932943b498fe7.1630614969.git.christophe.jaillet@wanadoo.fr commit cc883236b79297f6266ca6f4e7f24f3fd3c736c1 Author: Zhang Yi Date: Fri Jul 16 20:20:24 2021 +0800 ext4: drop unnecessary journal handle in delalloc write After we factor out the inline data write procedure from ext4_da_write_end(), we don't need to start journal handle for the cases of both buffer overwrite and append-write. If we need to update i_disksize, mark_inode_dirty() do start handle and update inode buffer. So we could just remove all the journal handle codes in the delalloc write procedure. After this patch, we could get a lot of performance improvement. Below is the Unixbench comparison data test on my machine with 'Intel Xeon Gold 5120' CPU and nvme SSD backend. Test cmd: ./Run -c 56 -i 3 fstime fsbuffer fsdisk Before this patch: System Benchmarks Partial Index BASELINE RESULT INDEX File Copy 1024 bufsize 2000 maxblocks 3960.0 422965.0 1068.1 File Copy 256 bufsize 500 maxblocks 1655.0 105077.0 634.9 File Copy 4096 bufsize 8000 maxblocks 5800.0 1429092.0 2464.0 ====== System Benchmarks Index Score (Partial Only) 1186.6 After this patch: System Benchmarks Partial Index BASELINE RESULT INDEX File Copy 1024 bufsize 2000 maxblocks 3960.0 732716.0 1850.3 File Copy 256 bufsize 500 maxblocks 1655.0 184940.0 1117.5 File Copy 4096 bufsize 8000 maxblocks 5800.0 2427152.0 4184.7 ====== System Benchmarks Index Score (Partial Only) 2053.0 Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210716122024.1105856-5-yi.zhang@huawei.com commit 6984aef59814fb5c47b0e30c56e101186b5ebf8c Author: Zhang Yi Date: Fri Jul 16 20:20:23 2021 +0800 ext4: factor out write end code of inline file Now that the inline_data file write end procedure are falled into the common write end functions, it is not clear. Factor them out and do some cleanup. This patch also drop ext4_da_write_inline_data_end() and switch to use ext4_write_inline_data_end() instead because we also need to do the same error processing if we failed to write data into inline entry. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210716122024.1105856-4-yi.zhang@huawei.com commit 55ce2f649b9e88111270333a8127e23f4f8f42d7 Author: Zhang Yi Date: Fri Jul 16 20:20:22 2021 +0800 ext4: correct the error path of ext4_write_inline_data_end() Current error path of ext4_write_inline_data_end() is not correct. Firstly, it should pass out the error value if ext4_get_inode_loc() return fail, or else it could trigger infinite loop if we inject error here. And then it's better to add inode to orphan list if it return fail in ext4_journal_stop(), otherwise we could not restore inline xattr entry after power failure. Finally, we need to reset the 'ret' value if ext4_write_inline_data_end() return success in ext4_write_end() and ext4_journalled_write_end(), otherwise we could not get the error return value of ext4_journal_stop(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210716122024.1105856-3-yi.zhang@huawei.com commit 4df031ff5876d94b48dd9ee486ba5522382a06b2 Author: Zhang Yi Date: Fri Jul 16 20:20:21 2021 +0800 ext4: check and update i_disksize properly After commit 3da40c7b0898 ("ext4: only call ext4_truncate when size <= isize"), i_disksize could always be updated to i_size in ext4_setattr(), and we could sure that i_disksize <= i_size since holding inode lock and if i_disksize < i_size there are delalloc writes pending in the range upto i_size. If the end of the current write is <= i_size, there's no need to touch i_disksize since writeback will push i_disksize upto i_size eventually. So we can switch to check i_size instead of i_disksize in ext4_da_write_end() when write to the end of the file. we also could remove ext4_mark_inode_dirty() together because we defer inode dirtying to generic_write_end() or ext4_da_write_inline_data_end(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210716122024.1105856-2-yi.zhang@huawei.com commit 9c4d94dc9a64426d2fa0255097a3a84f6ff2eebe Author: Christian Schoenebeck Date: Sat Sep 4 17:12:51 2021 +0200 net/9p: increase default msize to 128k Let's raise the default msize value to 128k. The 'msize' option defines the maximum message size allowed for any message being transmitted (in both directions) between 9p server and 9p client during a 9p session. Currently the default 'msize' is just 8k, which is way too conservative. Such a small 'msize' value has quite a negative performance impact, because individual 9p messages have to be split up far too often into numerous smaller messages to fit into this message size limitation. A default value of just 8k also has a much higher probablity of hitting short-read issues like: https://gitlab.com/qemu-project/qemu/-/issues/409 Unfortunately user feedback showed that many 9p users are not aware that this option even exists, nor the negative impact it might have if it is too low. Link: http://lkml.kernel.org/r/61ea0f0faaaaf26dd3c762eabe4420306ced21b9.1630770829.git.linux_oss@crudebyte.com Link: https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg01003.html Signed-off-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit 9210fc0a3b61c396ba9b32467b88c89d41bc9fe7 Author: Christian Schoenebeck Date: Sat Sep 4 17:07:12 2021 +0200 net/9p: use macro to define default msize Use a macro to define the default value for the 'msize' option at one place instead of using two separate integer literals. Link: http://lkml.kernel.org/r/28bb651ae0349a7d57e8ddc92c1bd5e62924a912.1630770829.git.linux_oss@crudebyte.com Signed-off-by: Christian Schoenebeck Signed-off-by: Dominique Martinet commit 22bb3b79290ec5970b74fa6e9eb313802d075c82 Author: Dominique Martinet Date: Sun Sep 5 08:29:22 2021 +0900 net/9p: increase tcp max msize to 1MB Historically TCP has been limited to 64K buffers, but increasing msize provides huge performance benefits especially as latency increase so allow for bigger buffers. Ideally further improvements could change the allocation from the current contiguous chunk in slab (kmem_cache) to some scatter-gather compatible API... Note this only increases the max possible setting, not the default value. Link: http://lkml.kernel.org/r/YTQB5jCbvhmCWzNd@codewreck.org Signed-off-by: Dominique Martinet commit 0097ae5f7af5684f961a5f803ff7ad3e6f933668 Author: Yang Li Date: Mon Jun 7 16:40:36 2021 +0800 NTB: perf: Fix an error code in perf_setup_inbuf() When the function IS_ALIGNED() returns false, the value of ret is 0. So, we set ret to -EINVAL to indicate this error. Clean up smatch warning: drivers/ntb/test/ntb_perf.c:602 perf_setup_inbuf() warn: missing error code 'ret'. Reported-by: Abaci Robot Signed-off-by: Yang Li Reviewed-by: Serge Semin Signed-off-by: Jon Mason commit 319f83ac98d7afaabab84ce5281a819a358b9895 Author: Yang Li Date: Mon Jun 7 13:56:20 2021 +0800 NTB: Fix an error code in ntb_msit_probe() When the value of nm->isr_ctx is false, the value of ret is 0. So, we set ret to -ENOMEM to indicate this error. Clean up smatch warning: drivers/ntb/test/ntb_msi_test.c:373 ntb_msit_probe() warn: missing error code 'ret'. Reported-by: Abaci Robot Signed-off-by: Yang Li Reviewed-by: Logan Gunthorpe Signed-off-by: Jon Mason commit f3b6b10fccc44ce0343878a1ed7cd8ef8fd687d8 Author: Dave Jiang Date: Mon Feb 1 09:12:39 2021 -0700 ntb: intel: remove invalid email address in header comment Remove Jon's old email address. Signed-off-by: Dave Jiang Signed-off-by: Jon Mason commit 49624efa65ac9889f4e7c7b2452b2e6ce42ba37d Merge: f7464060f7ab9 592ca09be8333 Author: Linus Torvalds Date: Sat Sep 4 11:35:47 2021 -0700 Merge tag 'denywrite-for-5.15' of git://github.com/davidhildenbrand/linux Pull MAP_DENYWRITE removal from David Hildenbrand: "Remove all in-tree usage of MAP_DENYWRITE from the kernel and remove VM_DENYWRITE. There are some (minor) user-visible changes: - We no longer deny write access to shared libaries loaded via legacy uselib(); this behavior matches modern user space e.g. dlopen(). - We no longer deny write access to the elf interpreter after exec completed, treating it just like shared libraries (which it often is). - We always deny write access to the file linked via /proc/pid/exe: sys_prctl(PR_SET_MM_MAP/EXE_FILE) will fail if write access to the file cannot be denied, and write access to the file will remain denied until the link is effectivel gone (exec, termination, sys_prctl(PR_SET_MM_MAP/EXE_FILE)) -- just as if exec'ing the file. Cross-compiled for a bunch of architectures (alpha, microblaze, i386, s390x, ...) and verified via ltp that especially the relevant tests (i.e., creat07 and execve04) continue working as expected" * tag 'denywrite-for-5.15' of git://github.com/davidhildenbrand/linux: fs: update documentation of get_write_access() and friends mm: ignore MAP_DENYWRITE in ksys_mmap_pgoff() mm: remove VM_DENYWRITE binfmt: remove in-tree usage of MAP_DENYWRITE kernel/fork: always deny write access to current MM exe_file kernel/fork: factor out replacing the current MM exe_file binfmt: don't use MAP_DENYWRITE when loading shared libraries via uselib() commit f7464060f7ab9a2424428008f0ee9f1e267e410f Merge: 6abaa83c7352b 2e3a51b59ea26 Author: Linus Torvalds Date: Sat Sep 4 11:15:50 2021 -0700 Merge git://github.com/Paragon-Software-Group/linux-ntfs3 Merge NTFSv3 filesystem from Konstantin Komarov: "This patch adds NTFS Read-Write driver to fs/ntfs3. Having decades of expertise in commercial file systems development and huge test coverage, we at Paragon Software GmbH want to make our contribution to the Open Source Community by providing implementation of NTFS Read-Write driver for the Linux Kernel. This is fully functional NTFS Read-Write driver. Current version works with NTFS (including v3.1) and normal/compressed/sparse files and supports journal replaying. We plan to support this version after the codebase once merged, and add new features and fix bugs. For example, full journaling support over JBD will be added in later updates" Link: https://lore.kernel.org/lkml/20210729134943.778917-1-almaz.alexandrovich@paragon-software.com/ Link: https://lore.kernel.org/lkml/aa4aa155-b9b2-9099-b7a2-349d8d9d8fbd@paragon-software.com/ * git://github.com/Paragon-Software-Group/linux-ntfs3: (35 commits) fs/ntfs3: Change how module init/info messages are displayed fs/ntfs3: Remove GPL boilerplates from decompress lib files fs/ntfs3: Remove unnecessary condition checking from ntfs_file_read_iter fs/ntfs3: Fix integer overflow in ni_fiemap with fiemap_prep() fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Rework file operations fs/ntfs3: Remove fat ioctl's from ntfs3 driver for now fs/ntfs3: Restyle comments to better align with kernel-doc fs/ntfs3: Fix error handling in indx_insert_into_root() fs/ntfs3: Potential NULL dereference in hdr_find_split() fs/ntfs3: Fix error code in indx_add_allocate() fs/ntfs3: fix an error code in ntfs_get_acl_ex() fs/ntfs3: add checks for allocation failure fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc fs/ntfs3: Do not use driver own alloc wrappers fs/ntfs3: Use kernel ALIGN macros over driver specific fs/ntfs3: Restyle comment block in ni_parse_reparse() fs/ntfs3: Remove unused including fs/ntfs3: Fix fall-through warnings for Clang fs/ntfs3: Fix one none utf8 char in source file ... commit 6abaa83c7352b31450d7e8c173f674324c16b02b Merge: 0961f0c00e696 9605f75cf36e0 Author: Linus Torvalds Date: Sat Sep 4 10:48:47 2021 -0700 Merge tag 'f2fs-for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this cycle, we've addressed some performance issues such as lock contention, misbehaving compress_cache, allowing extent_cache for compressed files, and new sysfs to adjust ra_size for fadvise. In order to diagnose the performance issues quickly, we also added an iostat which shows the IO latencies periodically. On the stability side, we've found two memory leakage cases in the error path in compression flow. And, we've also fixed various corner cases in fiemap, quota, checkpoint=disable, zstd, and so on. Enhancements: - avoid long checkpoint latency by releasing nat_tree_lock - collect and show iostats periodically - support extent_cache for compressed files - add a sysfs entry to manage ra_size given fadvise(POSIX_FADV_SEQUENTIAL) - report f2fs GC status via sysfs - add discard_unit=%s in mount option to handle zoned device Bug fixes: - fix two memory leakages when an error happens in the compressed IO flow - fix commpress_cache to get the right LBA - fix fiemap to deal with compressed case correctly - fix wrong EIO returns due to SBI_NEED_FSCK - fix missing writes when enabling checkpoint back - fix quota deadlock - fix zstd level mount option In addition to the above major updates, we've cleaned up several code paths such as dio, unnecessary operations, debugfs/f2fs/status, sanity check, and typos" * tag 'f2fs-for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (46 commits) f2fs: should put a page beyond EOF when preparing a write f2fs: deallocate compressed pages when error happens f2fs: enable realtime discard iff device supports discard f2fs: guarantee to write dirty data when enabling checkpoint back f2fs: fix to unmap pages from userspace process in punch_hole() f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() f2fs: fix to account missing .skipped_gc_rwsem f2fs: adjust unlock order for cleanup f2fs: Don't create discard thread when device doesn't support realtime discard f2fs: rebuild nat_bits during umount f2fs: introduce periodic iostat io latency traces f2fs: separate out iostat feature f2fs: compress: do sanity check on cluster f2fs: fix description about main_blkaddr node f2fs: convert S_IRUGO to 0444 f2fs: fix to keep compatibility of fault injection interface f2fs: support fault injection for f2fs_kmem_cache_alloc() f2fs: compress: allow write compress released file after truncate to zero f2fs: correct comment in segment.h f2fs: improve sbi status info in debugfs/f2fs/status ... commit 55d1308bdff7341b778e5cf36220616a0dd6ab8f Author: Phillip Potter Date: Sat Sep 4 18:40:30 2021 +0100 cdrom: update uniform CD-ROM maintainership in MAINTAINERS file Update maintainership for the uniform CD-ROM driver from Jens Axboe to Phillip Potter in MAINTAINERS file, to reflect the attempt to pass on maintainership of this driver to a different individual. Also remove URL to site which is no longer active. Suggested-by: Jens Axboe Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20210904174030.1103-1-phil@philpotter.co.uk Signed-off-by: Jens Axboe commit 0961f0c00e69672a8e4a2e591355567dbda44389 Merge: f1583cb1be35c 8cfb9015280d4 Author: Linus Torvalds Date: Sat Sep 4 10:25:26 2021 -0700 Merge tag 'nfs-for-5.15-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Better client responsiveness when server isn't replying - Use refcount_t in sunrpc rpc_client refcount tracking - Add srcaddr and dst_port to the sunrpc sysfs info files - Add basic support for connection sharing between servers with multiple NICs` Bugfixes and Cleanups: - Sunrpc tracepoint cleanups - Disconnect after ib_post_send() errors to avoid deadlocks - Fix for tearing down rpcrdma_reps - Fix a potential pNFS layoutget livelock loop - pNFS layout barrier fixes - Fix a potential memory corruption in rpc_wake_up_queued_task_set_status() - Fix reconnection locking - Fix return value of get_srcport() - Remove rpcrdma_post_sends() - Remove pNFS dead code - Remove copy size restriction for inter-server copies - Overhaul the NFS callback service - Clean up sunrpc TCP socket shutdowns - Always provide aligned buffers to RPC read layers" * tag 'nfs-for-5.15-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (39 commits) NFS: Always provide aligned buffers to the RPC read layers NFSv4.1 add network transport when session trunking is detected SUNRPC enforce creation of no more than max_connect xprts NFSv4 introduce max_connect mount options SUNRPC add xps_nunique_destaddr_xprts to xprt_switch_info in sysfs SUNRPC keep track of number of transports to unique addresses NFSv3: Delete duplicate judgement in nfs3_async_handle_jukebox SUNRPC: Tweak TCP socket shutdown in the RPC client SUNRPC: Simplify socket shutdown when not reusing TCP ports NFSv4.2: remove restriction of copy size for inter-server copy. NFS: Clean up the synopsis of callback process_op() NFS: Extract the xdr_init_encode/decode() calls from decode_compound NFS: Remove unused callback void decoder NFS: Add a private local dispatcher for NFSv4 callback operations SUNRPC: Eliminate the RQ_AUTHERR flag SUNRPC: Set rq_auth_stat in the pg_authenticate() callout SUNRPC: Add svc_rqst::rq_auth_stat SUNRPC: Add dst_port to the sysfs xprt info file SUNRPC: Add srcaddr as a file in sysfs sunrpc: Fix return value of get_srcport() ... commit ecbd690b52dc11e3ef96139d4cfce53b1191b8a7 Author: Christophe JAILLET Date: Sat Sep 4 09:34:51 2021 +0200 octeontx2-af: Fix some memory leaks in the error handling path of 'cgx_lmac_init()' Memory allocated before 'lmac' is stored in 'cgx->lmac_idmap[]' must be freed explicitly. Otherwise, in case of error, it will leak. Rename the 'err_irq' label to better describe what is done at this place in the error handling path. Fixes: 6f14078e3ee5 ("octeontx2-af: DMAC filter support in MAC block") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit d863ca67bb6e40b7653e25f3787994281b8c2e58 Author: Christophe JAILLET Date: Sat Sep 4 09:34:41 2021 +0200 octeontx2-af: Add a 'rvu_free_bitmap()' function In order to match 'rvu_alloc_bitmap()', add a 'rvu_free_bitmap()' function Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 7db8263a12155c7ae4ad97e850f1e499c73765fc Author: Yang Li Date: Fri Sep 3 14:42:33 2021 +0800 ethtool: Fix an error code in cxgb2.c When adapter->registered_device_map is NULL, the value of err is uncertain, we set err to -EINVAL to avoid ambiguity. Clean up smatch warning: drivers/net/ethernet/chelsio/cxgb/cxgb2.c:1114 init_one() warn: missing error code 'err' Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: David S. Miller commit 9ddbc2a00d7f63fa9748f4278643193dac985f2d Author: Dinghao Liu Date: Fri Sep 3 15:35:43 2021 +0800 qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom Previous commit 68233c583ab4 removes the qlcnic_rom_lock() in qlcnic_pinit_from_rom(), but remains its corresponding unlock function, which is odd. I'm not very sure whether the lock is missing, or the unlock is redundant. This bug is suggested by a static analysis tool, please advise. Fixes: 68233c583ab4 ("qlcnic: updated reset sequence") Signed-off-by: Dinghao Liu Signed-off-by: David S. Miller commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 Author: Eric Dumazet Date: Fri Sep 3 15:03:43 2021 -0700 fq_codel: reject silly quantum parameters syzbot found that forcing a big quantum attribute would crash hosts fast, essentially using this: tc qd replace dev eth0 root fq_codel quantum 4294967295 This is because fq_codel_dequeue() would have to loop ~2^31 times in : if (flow->deficit <= 0) { flow->deficit += q->quantum; list_move_tail(&flow->flowchain, &q->old_flows); goto begin; } SFQ max quantum is 2^19 (half a megabyte) Lets adopt a max quantum of one megabyte for FQ_CODEL. Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit bd0e7491a931f5a2960555b10b9551464ff8cc8e Author: Vlastimil Babka Date: Sat May 22 01:59:38 2021 +0200 mm, slub: convert kmem_cpu_slab protection to local_lock Embed local_lock into struct kmem_cpu_slab and use the irq-safe versions of local_lock instead of plain local_irq_save/restore. On !PREEMPT_RT that's equivalent, with better lockdep visibility. On PREEMPT_RT that means better preemption. However, the cost on PREEMPT_RT is the loss of lockless fast paths which only work with cpu freelist. Those are designed to detect and recover from being preempted by other conflicting operations (both fast or slow path), but the slow path operations assume they cannot be preempted by a fast path operation, which is guaranteed naturally with disabled irqs. With local locks on PREEMPT_RT, the fast paths now also need to take the local lock to avoid races. In the allocation fastpath slab_alloc_node() we can just defer to the slowpath __slab_alloc() which also works with cpu freelist, but under the local lock. In the free fastpath do_slab_free() we have to add a new local lock protected version of freeing to the cpu freelist, as the existing slowpath only works with the page freelist. Also update the comment about locking scheme in SLUB to reflect changes done by this series. [ Mike Galbraith : use local_lock() without irq in PREEMPT_RT scope; debugging of RT crashes resulting in put_cpu_partial() locking changes ] Signed-off-by: Vlastimil Babka commit 25c00c506e8176d03f9ad821cc349230dfb5dc1a Author: Vlastimil Babka Date: Fri May 21 14:03:23 2021 +0200 mm, slub: use migrate_disable() on PREEMPT_RT We currently use preempt_disable() (directly or via get_cpu_ptr()) to stabilize the pointer to kmem_cache_cpu. On PREEMPT_RT this would be incompatible with the list_lock spinlock. We can use migrate_disable() instead, but that increases overhead on !PREEMPT_RT as it's an unconditional function call. In order to get the best available mechanism on both PREEMPT_RT and !PREEMPT_RT, introduce private slub_get_cpu_ptr() and slub_put_cpu_ptr() wrappers and use them. Signed-off-by: Vlastimil Babka commit e0a043aa4145a14d6a8864847811491699a81310 Author: Vlastimil Babka Date: Wed Jul 28 12:26:27 2021 +0200 mm, slub: protect put_cpu_partial() with disabled irqs instead of cmpxchg Jann Horn reported [1] the following theoretically possible race: task A: put_cpu_partial() calls preempt_disable() task A: oldpage = this_cpu_read(s->cpu_slab->partial) interrupt: kfree() reaches unfreeze_partials() and discards the page task B (on another CPU): reallocates page as page cache task A: reads page->pages and page->pobjects, which are actually halves of the pointer page->lru.prev task B (on another CPU): frees page interrupt: allocates page as SLUB page and places it on the percpu partial list task A: this_cpu_cmpxchg() succeeds which would cause page->pages and page->pobjects to end up containing halves of pointers that would then influence when put_cpu_partial() happens and show up in root-only sysfs files. Maybe that's acceptable, I don't know. But there should probably at least be a comment for now to point out that we're reading union fields of a page that might be in a completely different state. Additionally, the this_cpu_cmpxchg() approach in put_cpu_partial() is only safe against s->cpu_slab->partial manipulation in ___slab_alloc() if the latter disables irqs, otherwise a __slab_free() in an irq handler could call put_cpu_partial() in the middle of ___slab_alloc() manipulating ->partial and corrupt it. This becomes an issue on RT after a local_lock is introduced in later patch. The fix means taking the local_lock also in put_cpu_partial() on RT. After debugging this issue, Mike Galbraith suggested [2] that to avoid different locking schemes on RT and !RT, we can just protect put_cpu_partial() with disabled irqs (to be converted to local_lock_irqsave() later) everywhere. This should be acceptable as it's not a fast path, and moving the actual partial unfreezing outside of the irq disabled section makes it short, and with the retry loop gone the code can be also simplified. In addition, the race reported by Jann should no longer be possible. [1] https://lore.kernel.org/lkml/CAG48ez1mvUuXwg0YPH5ANzhQLpbphqk-ZS+jbRz+H66fvm4FcA@mail.gmail.com/ [2] https://lore.kernel.org/linux-rt-users/e3470ab357b48bccfbd1f5133b982178a7d2befb.camel@gmx.de/ Reported-by: Jann Horn Suggested-by: Mike Galbraith Signed-off-by: Vlastimil Babka commit a2b4ae8bfd9c10e3c1c1966bd3c8d8b7c9026aaf Author: Vlastimil Babka Date: Fri Jun 4 12:55:55 2021 +0200 mm, slub: make slab_lock() disable irqs with PREEMPT_RT We need to disable irqs around slab_lock() (a bit spinlock) to make it irq-safe. Most calls to slab_lock() are nested under spin_lock_irqsave() which doesn't disable irqs on PREEMPT_RT, so add explicit disabling with PREEMPT_RT. The exception is cmpxchg_double_slab() which already disables irqs, so use a __slab_[un]lock() variant without irq disable there. slab_[un]lock() thus needs a flags pointer parameter, which is unused on !RT. free_debug_processing() now has two flags variables, which looks odd, but only one is actually used - the one used in spin_lock_irqsave() on !RT and the one used in slab_lock() on RT. As a result, __cmpxchg_double_slab() and cmpxchg_double_slab() become effectively identical on RT, as both will disable irqs, which is necessary on RT as most callers of this function also rely on irqsaving lock operations. Thus, assert that irqs are already disabled in __cmpxchg_double_slab() only on !RT and also change the VM_BUG_ON assertion to the more standard lockdep_assert one. Signed-off-by: Vlastimil Babka commit 94ef0304e2b8dc942f46c74a13841d6b61f61d2f Author: Sebastian Andrzej Siewior Date: Thu Jul 16 18:47:50 2020 +0200 mm: slub: make object_map_lock a raw_spinlock_t The variable object_map is protected by object_map_lock. The lock is always acquired in debug code and within already atomic context Make object_map_lock a raw_spinlock_t. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Vlastimil Babka commit 3e204d6b76b29274cc8e57f8bd8d9873f04a7f48 Author: Geert Uytterhoeven Date: Fri Sep 3 23:28:17 2021 -0700 Input: adc-keys - drop bogus __refdata annotation As the ADC ladder input driver does not have any code or data located in initmem, there is no need to annotate the adc_keys_driver structure with __refdata. Drop the annotation, to avoid suppressing future section warnings. Signed-off-by: Geert Uytterhoeven Acked-by: Alexandre Belloni Link: https://lore.kernel.org/r/7091e8213602be64826fd689a7337246d218f3b1.1626255421.git.geert+renesas@glider.be Signed-off-by: Dmitry Torokhov commit 7ec7c72fbf9db4c6479fbdae7162d047a9012788 Author: Colin Ian King Date: Fri Sep 3 23:22:22 2021 -0700 Input: Fix spelling mistake in Kconfig "useable" -> "usable" There is a spelling mistake in the Kconfig text. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210705100230.7583-1-colin.king@canonical.com Signed-off-by: Dmitry Torokhov commit ca595ac271688cc168da722e6f70fcf6ae4266f6 Author: Colin Ian King Date: Fri Sep 3 23:21:37 2021 -0700 Input: Fix spelling mistake in Kconfig "Modul" -> "Module" There is a spelling mistake in the Kconfig text. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210704095702.37567-1-colin.king@canonical.com Signed-off-by: Dmitry Torokhov commit 303fff2b8c77a85c62dbde3b27c24b084144c04c Author: Namjae Jeon Date: Fri Sep 3 07:09:44 2021 +0900 ksmbd: add validation for ndr read/write functions If ndr->length is smaller than expected size, ksmbd can access invalid access in ndr->data. This patch add validation to check ndr->offset is over ndr->length. and added exception handling to check return value of ndr read/write function. Cc: Dan Carpenter Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 687c59e702f48e0eca91455d3ef3197b7b8a8314 Author: Namjae Jeon Date: Tue Aug 31 22:47:02 2021 +0900 ksmbd: remove unused ksmbd_file_table_flush function ksmbd_file_table_flush is a leftover from SMB1. This function is no longer needed as SMB1 has been removed from ksmbd. Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 72d6cbb533d4309734606027fe083c4edb0aa7aa Author: Hyunchul Lee Date: Mon Aug 30 13:27:43 2021 +0900 ksmbd: smbd: fix dma mapping error in smb_direct_post_send_data Becase smb direct header is mapped and msg->num_sge already is incremented, the decrement should be removed from the condition. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d475866eeed89cc44ed54e0cd296537a68667b1b Author: Per Forlin Date: Mon Aug 30 13:23:04 2021 +0900 ksmbd: Reduce error log 'speed is unknown' to debug This log happens on servers with a network bridge since the bridge does not have a specified link speed. This is not a real error so change the error log to debug instead. Signed-off-by: Per Forlin Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 28a5d3de9d65058f7edf8e5aaaf6b0a8d8f4a29f Author: Christian Brauner Date: Thu Aug 26 17:05:17 2021 +0900 ksmbd: defer notify_change() call When ownership is changed we might in certain scenarios loose the ability to alter the inode after we changed ownership. This can e.g. happen when we are on an idmapped mount where uid 0 is mapped to uid 1000 and uid 1000 is mapped to uid 0. A caller with fs*id 1000 will be able to create files as *id 1000 on disk. They will also be able to change ownership of files owned by *id 0 to *id 1000 but they won't be able to change ownership in the other direction. This means acl operations following notify_change() would fail. Move the notify_change() call after the acls have been updated. This guarantees that we don't end up with spurious "hash value diff" warnings later on because we managed to change ownership but didn't manage to alter acls. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit db7fb6fe3d7a8eb05f2b74c6252771c9362f3b74 Author: Christian Brauner Date: Thu Aug 26 10:07:05 2021 +0900 ksmbd: remove setattr preparations in set_file_basic_info() Permission checking and copying over ownership information is the task of the underlying filesystem not ksmbd. The order is also wrong here. This modifies the inode before notify_change(). If notify_change() fails this will have changed ownership nonetheless. All of this is unnecessary though since the underlying filesystem's ->setattr handler will do all this (if required) by itself. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit eb5784f0c6efbe0db720ad7e34e097cea51c1afc Author: Christian Brauner Date: Mon Aug 23 17:13:55 2021 +0200 ksmbd: ensure error is surfaced in set_file_basic_info() It seems the error was accidently ignored until now. Make sure it is surfaced. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9467a0ce486c87a8f06ad492afa8b95686bff61f Author: Christian Brauner Date: Mon Aug 23 17:13:54 2021 +0200 ndr: fix translation in ndr_encode_posix_acl() The sid_to_id() helper encodes raw ownership information suitable for s*id handling. This is conceptually equivalent to reporting ownership information via stat to userspace. In this case the consumer is ksmbd instead of a regular user. So when encoding raw ownership information suitable for s*id handling later we need to map the id up according to the user namespace of ksmbd itself taking any idmapped mounts into account. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 55cd04d75e635ac915bf54586ec64057249508ec Author: Christian Brauner Date: Tue Aug 24 20:10:20 2021 +0900 ksmbd: fix translation in sid_to_id() The sid_to_id() functions is relevant when changing ownership of filesystem objects based on acl information. In this case we need to first translate the relevant s*ids into k*ids in ksmbd's user namespace and account for any idmapped mounts. Requesting a change in ownership requires the inverse translation to be applied when we would report ownership to userspace. So k*id_from_mnt() must be used here. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit f0bb29d5c65b492ab82cce7b1e1dd00cbca28601 Author: Christian Brauner Date: Tue Aug 24 20:07:18 2021 +0900 ksmbd: fix subauth 0 handling in sid_to_id() It's not obvious why subauth 0 would be excluded from translation. This would lead to wrong results whenever a non-identity idmapping is used. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0e844efebdf9c03aed9ae1894f22762a8aee1a3b Author: Christian Brauner Date: Mon Aug 23 17:13:51 2021 +0200 ksmbd: fix translation in acl entries The ksmbd server performs translation of posix acls to smb acls. Currently the translation is wrong since the idmapping of the mount is used to map the ids into raw userspace ids but what is relevant is the user namespace of ksmbd itself. The user namespace of ksmbd itself which is the initial user namespace. The operation is similar to asking "What *ids would a userspace process see given that k*id in the relevant user namespace?". Before the final translation we need to apply the idmapping of the mount in case any is used. Add two simple helpers for ksmbd. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 43205ca7192aa5de46775fbf7a043222e76abac5 Author: Christian Brauner Date: Mon Aug 23 17:13:50 2021 +0200 ksmbd: fix translation in ksmbd_acls_fattr() When creating new filesystem objects ksmbd translates between k*ids and s*ids. For this it often uses struct smb_fattr and stashes the k*ids in cf_uid and cf_gid. Let cf_uid and cf_gid always contain the final information taking any potential idmapped mounts into account. When finally translation cf_*id into s*ids translate them into the user namespace of ksmbd since that is the relevant user namespace here. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3cdc20e72c3dacf22382fd15d3154e48d0efdec9 Author: Christian Brauner Date: Mon Aug 23 17:13:49 2021 +0200 ksmbd: fix translation in create_posix_rsp_buf() When transferring ownership information to the client the k*ids are translated into raw *ids before they are sent over the wire. The function currently erroneously translates the k*ids according to the mount's idmapping. Instead, reporting the owning *ids to userspace the underlying k*ids need to be mapped up in the caller's user namespace. This is how stat() works. The caller in this instance is ksmbd itself and ksmbd always runs in the initial user namespace. Translate according to that taking any potential idmapped mounts into account. Switch to from_k*id_munged() which ensures that the overflow*id is returned instead of the (*id_t)-1 when the k*id can't be translated. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 475d6f98804c09a48b5c815f7bd466fb4c1e743e Author: Christian Brauner Date: Mon Aug 23 17:13:48 2021 +0200 ksmbd: fix translation in smb2_populate_readdir_entry() When transferring ownership information to the client the k*ids are translated into raw *ids before they are sent over the wire. The function currently erroneously translates the k*ids according to the mount's idmapping. Instead, reporting the owning *ids to userspace the underlying k*ids need to be mapped up in the caller's user namespace. This is how stat() works. The caller in this instance is ksmbd itself and ksmbd always runs in the initial user namespace. Translate according to that. The idmapping of the mount is already taken into account by the lower filesystem and so kstat->*id will contain the mapped k*ids. Switch to from_k*id_munged() which ensures that the overflow*id is returned instead of the (*id_t)-1 when the k*id can't be translated. Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit da1e7ada5b62859b3a9d236a44035ae9d8f3f7e1 Author: Christian Brauner Date: Mon Aug 23 17:13:47 2021 +0200 ksmbd: fix lookup on idmapped mounts It's great that the new in-kernel ksmbd server will support idmapped mounts out of the box! However, lookup is currently broken. Lookup helpers such as lookup_one_len() call inode_permission() internally to ensure that the caller is privileged over the inode of the base dentry they are trying to lookup under. So the permission checking here is currently wrong. Linux v5.15 will gain a new lookup helper lookup_one() that does take idmappings into account. I've added it as part of my patch series to make btrfs support idmapped mounts. The new helper is in linux-next as part of David's (Sterba) btrfs for-next branch as commit c972214c133b ("namei: add mapping aware lookup helper"). I've said it before during one of my first reviews: I would very much recommend adding fstests to [1]. It already seems to have very rudimentary cifs support. There is a completely generic idmapped mount testsuite that supports idmapped mounts. [1]: https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/ Cc: Colin Ian King Cc: Steve French Cc: Christoph Hellwig Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Sergey Senozhatsky Cc: David Sterba Cc: linux-cifs@vger.kernel.org Signed-off-by: Christian Brauner Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 1c500ad706383f1a6609e63d0b5d1723fd84dab9 Author: Tetsuo Handa Date: Thu Sep 2 09:07:35 2021 +0900 loop: reduce the loop_ctl_mutex scope syzbot is reporting circular locking problem at __loop_clr_fd() [1], for commit a160c6159d4a0cf8 ("block: add an optional probe callback to major_names") is calling the module's probe function with major_names_lock held. Fortunately, since commit 990e78116d38059c ("block: loop: fix deadlock between open and remove") stopped holding loop_ctl_mutex in lo_open(), current role of loop_ctl_mutex is to serialize access to loop_index_idr and loop_add()/loop_remove(); in other words, management of id for IDR. To avoid holding loop_ctl_mutex during whole add/remove operation, use a bool flag to indicate whether the loop device is ready for use. loop_unregister_transfer() which is called from cleanup_cryptoloop() currently has possibility of use-after-free problem due to lack of serialization between kfree() from loop_remove() from loop_control_remove() and mutex_lock() from unregister_transfer_cb(). But since lo->lo_encryption should be already NULL when this function is called due to module unload, and commit 222013f9ac30b9ce ("cryptoloop: add a deprecation warning") indicates that we will remove this function shortly, this patch updates this function to emit warning instead of checking lo->lo_encryption. Holding loop_ctl_mutex in loop_exit() is pointless, for all users must close /dev/loop-control and /dev/loop$num (in order to drop module's refcount to 0) before loop_exit() starts, and nobody can open /dev/loop-control or /dev/loop$num afterwards. Link: https://syzkaller.appspot.com/bug?id=7bb10e8b62f83e4d445cdf4c13d69e407e629558 [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/adb1e792-fc0e-ee81-7ea0-0906fc36419d@i-love.sakura.ne.jp Signed-off-by: Jens Axboe commit 54357f0c9149c871e5e4b83ad385a6f2ad3a749f Author: Thomas Gleixner Date: Tue Aug 10 15:26:25 2021 +0200 tracing: Add migrate-disabled counter to tracing output. migrate_disable() forbids task migration to another CPU. It is available since v5.11 and has already users such as highmem or BPF. It is useful to observe this task state in tracing which already has other states like the preemption counter. Instead of adding the migrate disable counter as a new entry to struct trace_entry, which would extend the whole struct by four bytes, it is squashed into the preempt-disable counter. The lower four bits represent the preemption counter, the upper four bits represent the migrate disable counter. Both counter shouldn't exceed 15 but if they do, there is a safety net which caps the value at 15. Add the migrate-disable counter to the trace entry so it shows up in the trace. Due to the users mentioned above, it is already possible to observe it: | bash-1108 [000] ...21 73.950578: rss_stat: mm_id=2213312838 curr=0 type=MM_ANONPAGES size=8192B | bash-1108 [000] d..31 73.951222: irq_disable: caller=flush_tlb_mm_range+0x115/0x130 parent=ptep_clear_flush+0x42/0x50 | bash-1108 [000] d..31 73.951222: tlb_flush: pages:1 reason:local mm shootdown (3) The last value is the migrate-disable counter. Things that popped up: - trace_print_lat_context() does not print the migrate counter. Not sure if it should. It is used in "verbose" mode and uses 8 digits and I'm not sure ther is something processing the value. - trace_define_common_fields() now defines a different variable. This probably breaks things. No ide what to do in order to preserve the old behaviour. Since this is used as a filter it should be split somehow to be able to match both nibbles here. Link: https://lkml.kernel.org/r/20210810132625.ylssabmsrkygokuv@linutronix.de Signed-off-by: Thomas Gleixner [bigeasy: patch description.] Signed-off-by: Sebastian Andrzej Siewior [ SDR: Removed change to common_preempt_count field name ] Signed-off-by: Steven Rostedt (VMware) commit 89c2b3b74918200e46699338d7bcc19b1ea12110 Author: Pavel Begunkov Date: Mon Aug 23 11:18:45 2021 +0100 io_uring: reexpand under-reexpanded iters [ 74.211232] BUG: KASAN: stack-out-of-bounds in iov_iter_revert+0x809/0x900 [ 74.212778] Read of size 8 at addr ffff888025dc78b8 by task syz-executor.0/828 [ 74.214756] CPU: 0 PID: 828 Comm: syz-executor.0 Not tainted 5.14.0-rc3-next-20210730 #1 [ 74.216525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 74.219033] Call Trace: [ 74.219683] dump_stack_lvl+0x8b/0xb3 [ 74.220706] print_address_description.constprop.0+0x1f/0x140 [ 74.224226] kasan_report.cold+0x7f/0x11b [ 74.226085] iov_iter_revert+0x809/0x900 [ 74.227960] io_write+0x57d/0xe40 [ 74.232647] io_issue_sqe+0x4da/0x6a80 [ 74.242578] __io_queue_sqe+0x1ac/0xe60 [ 74.245358] io_submit_sqes+0x3f6e/0x76a0 [ 74.248207] __do_sys_io_uring_enter+0x90c/0x1a20 [ 74.257167] do_syscall_64+0x3b/0x90 [ 74.257984] entry_SYSCALL_64_after_hwframe+0x44/0xae old_size = iov_iter_count(); ... iov_iter_revert(old_size - iov_iter_count()); If iov_iter_revert() is done base on the initial size as above, and the iter is truncated and not reexpanded in the middle, it miscalculates borders causing problems. This trace is due to no one reexpanding after generic_write_checks(). Now iters store how many bytes has been truncated, so reexpand them to the initial state right before reverting. Cc: stable@vger.kernel.org Reported-by: Palash Oswal Reported-by: Sudip Mukherjee Reported-and-tested-by: syzbot+9671693590ef5aad8953@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov Signed-off-by: Al Viro commit 2112ff5ce0c1128fe7b4d19cfe7f2b8ce5b595fa Author: Pavel Begunkov Date: Mon Aug 23 11:18:44 2021 +0100 iov_iter: track truncated size Remember how many bytes were truncated and reverted back. Because not reexpanded iterators don't always work well with reverting, we may need to know that to reexpand ourselves when needed. Signed-off-by: Pavel Begunkov Signed-off-by: Al Viro commit 10905b4a68cc58863e04d5ea5864323cb9341f9b Merge: 52a67fbf0cffc 730affed24bff Author: Jakub Kicinski Date: Fri Sep 3 16:20:36 2021 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Protect nft_ct template with global mutex, from Pavel Skripkin. 2) Two recent commits switched inet rt and nexthop exception hashes from jhash to siphash. If those two spots are problematic then conntrack is affected as well, so switch voer to siphash too. While at it, add a hard upper limit on chain lengths and reject insertion if this is hit. Patches from Florian Westphal. 3) Fix use-after-scope in nf_socket_ipv6 reported by KASAN, from Benjamin Hesmans. * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf: netfilter: socket: icmp6: fix use-after-scope netfilter: refuse insertion if chain has grown too large netfilter: conntrack: switch to siphash netfilter: conntrack: sanitize table size default settings netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex ==================== Link: https://lore.kernel.org/r/20210903163020.13741-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 52a67fbf0cffcc1a0d1272cf0522cb193a0d0bd6 Author: Dan Carpenter Date: Fri Sep 3 16:18:56 2021 +0300 ionic: fix a sleeping in atomic bug This code is holding spin_lock_bh(&lif->rx_filters.lock); so the allocation needs to be atomic. Fixes: 969f84394604 ("ionic: sync the filters in the work task") Signed-off-by: Dan Carpenter Signed-off-by: Shannon Nelson Link: https://lore.kernel.org/r/20210903131856.GA25934@kili Signed-off-by: Jakub Kicinski commit 5a836bf6b09f99ead1b69457ff39ab3011ece57b Author: Sebastian Andrzej Siewior Date: Fri Feb 26 17:11:55 2021 +0100 mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context flush_all() flushes a specific SLAB cache on each CPU (where the cache is present). The deactivate_slab()/__free_slab() invocation happens within IPI handler and is problematic for PREEMPT_RT. The flush operation is not a frequent operation or a hot path. The per-CPU flush operation can be moved to within a workqueue. Because a workqueue handler, unlike IPI handler, does not disable irqs, flush_slab() now has to disable them for working with the kmem_cache_cpu fields. deactivate_slab() is safe to call with irqs enabled. [vbabka@suse.cz: adapt to new SLUB changes] Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Vlastimil Babka commit 08beb547a1f7b66fbeaf40f2d3675a3ea0060c0b Author: Vlastimil Babka Date: Thu Jun 3 19:17:42 2021 +0200 mm, slab: split out the cpu offline variant of flush_slab() flush_slab() is called either as part IPI handler on given live cpu, or as a cleanup on behalf of another cpu that went offline. The first case needs to protect updating the kmem_cache_cpu fields with disabled irqs. Currently the whole call happens with irqs disabled by the IPI handler, but the following patch will change from IPI to workqueue, and flush_slab() will have to disable irqs (to be replaced with a local lock later) in the critical part. To prepare for this change, replace the call to flush_slab() for the dead cpu handling with an opencoded variant that will not disable irqs nor take a local lock. Suggested-by: Mike Galbraith Signed-off-by: Vlastimil Babka commit 0e7ac738f785e695acfa1203a87f6a505305542a Author: Vlastimil Babka Date: Fri May 21 01:48:56 2021 +0200 mm, slub: don't disable irqs in slub_cpu_dead() slub_cpu_dead() cleans up for an offlined cpu from another cpu and calls only functions that are now irq safe, so we don't need to disable irqs anymore. Signed-off-by: Vlastimil Babka commit 7cf9f3ba2f02216b2303e648c0c5439f00191008 Author: Vlastimil Babka Date: Fri May 21 01:16:54 2021 +0200 mm, slub: only disable irq with spin_lock in __unfreeze_partials() __unfreeze_partials() no longer needs to have irqs disabled, except for making the spin_lock operations irq-safe, so convert the spin_locks operations and remove the separate irq handling. Signed-off-by: Vlastimil Babka commit fc1455f4e023b278ca73cb729bc50037dc48c45c Author: Vlastimil Babka Date: Thu May 20 16:39:51 2021 +0200 mm, slub: separate detaching of partial list in unfreeze_partials() from unfreezing Unfreezing partial list can be split to two phases - detaching the list from struct kmem_cache_cpu, and processing the list. The whole operation does not need to be protected by disabled irqs. Restructure the code to separate the detaching (with disabled irqs) and unfreezing (with irq disabling to be reduced in the next patch). Also, unfreeze_partials() can be called from another cpu on behalf of a cpu that is being offlined, where disabling irqs on the local cpu has no sense, so restructure the code as follows: - __unfreeze_partials() is the bulk of unfreeze_partials() that processes the detached percpu partial list - unfreeze_partials() detaches list from current cpu with irqs disabled and calls __unfreeze_partials() - unfreeze_partials_cpu() is to be called for the offlined cpu so it needs no irq disabling, and is called from __flush_cpu_slab() - flush_cpu_slab() is for the local cpu thus it needs to call unfreeze_partials(). So it can't simply call __flush_cpu_slab(smp_processor_id()) anymore and we have to open-code the proper calls. Signed-off-by: Vlastimil Babka commit c2f973ba42ed1fe7b2ca71e93767afeacc88caa0 Author: Vlastimil Babka Date: Thu May 20 14:18:12 2021 +0200 mm, slub: detach whole partial list at once in unfreeze_partials() Instead of iterating through the live percpu partial list, detach it from the kmem_cache_cpu at once. This is simpler and will allow further optimization. Signed-off-by: Vlastimil Babka commit 8de06a6f48f2062444a8872eb7f5abbfe65b5ecd Author: Vlastimil Babka Date: Thu May 20 14:01:57 2021 +0200 mm, slub: discard slabs in unfreeze_partials() without irqs disabled No need for disabled irqs when discarding slabs, so restore them before discarding. Signed-off-by: Vlastimil Babka commit f3ab8b6b9228176920e1c73fa24d2db62268aa48 Author: Vlastimil Babka Date: Thu May 20 14:00:03 2021 +0200 mm, slub: move irq control into unfreeze_partials() unfreeze_partials() can be optimized so that it doesn't need irqs disabled for the whole time. As the first step, move irq control into the function and remove it from the put_cpu_partial() caller. Signed-off-by: Vlastimil Babka commit cfdf836e1f93df56ddd9a1d48b2deadf02f441fe Author: Vlastimil Babka Date: Wed May 12 14:04:43 2021 +0200 mm, slub: call deactivate_slab() without disabling irqs The function is now safe to be called with irqs enabled, so move the calls outside of irq disabled sections. When called from ___slab_alloc() -> flush_slab() we have irqs disabled, so to reenable them before deactivate_slab() we need to open-code flush_slab() in ___slab_alloc() and reenable irqs after modifying the kmem_cache_cpu fields. But that means a IRQ handler meanwhile might have assigned a new page to kmem_cache_cpu.page so we have to retry the whole check. The remaining callers of flush_slab() are the IPI handler which has disabled irqs anyway, and slub_cpu_dead() which will be dealt with in the following patch. Signed-off-by: Vlastimil Babka commit 3406e91bce47383f03fe839f02f7f4bef78c832c Author: Vlastimil Babka Date: Wed May 12 13:59:58 2021 +0200 mm, slub: make locking in deactivate_slab() irq-safe dectivate_slab() now no longer touches the kmem_cache_cpu structure, so it will be possible to call it with irqs enabled. Just convert the spin_lock calls to their irq saving/restoring variants to make it irq-safe. Note we now have to use cmpxchg_double_slab() for irq-safe slab_lock(), because in some situations we don't take the list_lock, which would disable irqs. Signed-off-by: Vlastimil Babka commit a019d20162586ae5b14bf26c94f1943b1d24a832 Author: Vlastimil Babka Date: Wed May 12 13:53:34 2021 +0200 mm, slub: move reset of c->page and freelist out of deactivate_slab() deactivate_slab() removes the cpu slab by merging the cpu freelist with slab's freelist and putting the slab on the proper node's list. It also sets the respective kmem_cache_cpu pointers to NULL. By extracting the kmem_cache_cpu operations from the function, we can make it not dependent on disabled irqs. Also if we return a single free pointer from ___slab_alloc, we no longer have to assign kmem_cache_cpu.page before deactivation or care if somebody preempted us and assigned a different page to our kmem_cache_cpu in the process. Signed-off-by: Vlastimil Babka commit 4b1f449dedd2ff1eede4ced08a503e13c8d668ce Author: Vlastimil Babka Date: Tue May 11 17:45:26 2021 +0200 mm, slub: stop disabling irqs around get_partial() The function get_partial() does not need to have irqs disabled as a whole. It's sufficient to convert spin_lock operations to their irq saving/restoring versions. As a result, it's now possible to reach the page allocator from the slab allocator without disabling and re-enabling interrupts on the way. Signed-off-by: Vlastimil Babka commit 9f101ee89465e0b2c11b477f5b55e03039b2c308 Author: Vlastimil Babka Date: Tue May 11 16:56:09 2021 +0200 mm, slub: check new pages with restored irqs Building on top of the previous patch, re-enable irqs before checking new pages. alloc_debug_processing() is now called with enabled irqs so we need to remove VM_BUG_ON(!irqs_disabled()); in check_slab() - there doesn't seem to be a need for it anyway. Signed-off-by: Vlastimil Babka commit 3f2b77e35a4fc3c83132a1a1a2fc7a2c803a2514 Author: Vlastimil Babka Date: Tue May 11 16:37:51 2021 +0200 mm, slub: validate slab from partial list or page allocator before making it cpu slab When we obtain a new slab page from node partial list or page allocator, we assign it to kmem_cache_cpu, perform some checks, and if they fail, we undo the assignment. In order to allow doing the checks without irq disabled, restructure the code so that the checks are done first, and kmem_cache_cpu.page assignment only after they pass. Signed-off-by: Vlastimil Babka commit 6c1dbb674c5cf76d23381160577d34bead60b76b Author: Vlastimil Babka Date: Mon May 10 16:30:01 2021 +0200 mm, slub: restore irqs around calling new_slab() allocate_slab() currently re-enables irqs before calling to the page allocator. It depends on gfpflags_allow_blocking() to determine if it's safe to do so. Now we can instead simply restore irq before calling it through new_slab(). The other caller early_kmem_cache_node_alloc() is unaffected by this. Signed-off-by: Vlastimil Babka commit fa417ab7506f9234100e249938d13e94a8c404e8 Author: Vlastimil Babka Date: Mon May 10 13:56:17 2021 +0200 mm, slub: move disabling irqs closer to get_partial() in ___slab_alloc() Continue reducing the irq disabled scope. Check for per-cpu partial slabs with first with irqs enabled and then recheck with irqs disabled before grabbing the slab page. Mostly preparatory for the following patches. Signed-off-by: Vlastimil Babka commit 0b303fb402862dcb7948eeeed2439bd8c99948b5 Author: Vlastimil Babka Date: Sat May 8 02:28:02 2021 +0200 mm, slub: do initial checks in ___slab_alloc() with irqs enabled As another step of shortening irq disabled sections in ___slab_alloc(), delay disabling irqs until we pass the initial checks if there is a cached percpu slab and it's suitable for our allocation. Now we have to recheck c->page after actually disabling irqs as an allocation in irq handler might have replaced it. Because we call pfmemalloc_match() as one of the checks, we might hit VM_BUG_ON_PAGE(!PageSlab(page)) in PageSlabPfmemalloc in case we get interrupted and the page is freed. Thus introduce a pfmemalloc_match_unsafe() variant that lacks the PageSlab check. Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman commit e500059ba55268e1c5212632e4f21e45f54dc6d9 Author: Vlastimil Babka Date: Fri May 7 19:32:31 2021 +0200 mm, slub: move disabling/enabling irqs to ___slab_alloc() Currently __slab_alloc() disables irqs around the whole ___slab_alloc(). This includes cases where this is not needed, such as when the allocation ends up in the page allocator and has to awkwardly enable irqs back based on gfp flags. Also the whole kmem_cache_alloc_bulk() is executed with irqs disabled even when it hits the __slab_alloc() slow path, and long periods with disabled interrupts are undesirable. As a first step towards reducing irq disabled periods, move irq handling into ___slab_alloc(). Callers will instead prevent the s->cpu_slab percpu pointer from becoming invalid via get_cpu_ptr(), thus preempt_disable(). This does not protect against modification by an irq handler, which is still done by disabled irq for most of ___slab_alloc(). As a small immediate benefit, slab_out_of_memory() from ___slab_alloc() is now called with irqs enabled. kmem_cache_alloc_bulk() disables irqs for its fastpath and then re-enables them before calling ___slab_alloc(), which then disables them at its discretion. The whole kmem_cache_alloc_bulk() operation also disables preemption. When ___slab_alloc() calls new_slab() to allocate a new page, re-enable preemption, because new_slab() will re-enable interrupts in contexts that allow blocking (this will be improved by later patches). The patch itself will thus increase overhead a bit due to disabled preemption (on configs where it matters) and increased disabling/enabling irqs in kmem_cache_alloc_bulk(), but that will be gradually improved in the following patches. Note in __slab_alloc() we need to change the #ifdef CONFIG_PREEMPT guard to CONFIG_PREEMPT_COUNT to make sure preempt disable/enable is properly paired in all configurations. On configs without involuntary preemption and debugging the re-read of kmem_cache_cpu pointer is still compiled out as it was before. [ Mike Galbraith : Fix kmem_cache_alloc_bulk() error path ] Signed-off-by: Vlastimil Babka commit 9b4bc85a69f57fea93c1f359b393d2c24857d2f5 Author: Vlastimil Babka Date: Tue May 18 02:01:39 2021 +0200 mm, slub: simplify kmem_cache_cpu and tid setup In slab_alloc_node() and do_slab_free() fastpaths we need to guarantee that our kmem_cache_cpu pointer is from the same cpu as the tid value. Currently that's done by reading the tid first using this_cpu_read(), then the kmem_cache_cpu pointer and verifying we read the same tid using the pointer and plain READ_ONCE(). This can be simplified to just fetching kmem_cache_cpu pointer and then reading tid using the pointer. That guarantees they are from the same cpu. We don't need to read the tid using this_cpu_read() because the value will be validated by this_cpu_cmpxchg_double(), making sure we are on the correct cpu and the freelist didn't change by anyone preempting us since reading the tid. Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman commit 1572df7cbcb48936c880f2d2de524f8e47ab65d4 Author: Vlastimil Babka Date: Tue May 11 18:25:09 2021 +0200 mm, slub: restructure new page checks in ___slab_alloc() When we allocate slab object from a newly acquired page (from node's partial list or page allocator), we usually also retain the page as a new percpu slab. There are two exceptions - when pfmemalloc status of the page doesn't match our gfp flags, or when the cache has debugging enabled. The current code for these decisions is not easy to follow, so restructure it and add comments. The new structure will also help with the following changes. No functional change. Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman commit 75c8ff281d7a6faa650bb9b32052f3ee1b5f8e83 Author: Vlastimil Babka Date: Tue May 11 14:05:22 2021 +0200 mm, slub: return slab page from get_partial() and set c->page afterwards The function get_partial() finds a suitable page on a partial list, acquires and returns its freelist and assigns the page pointer to kmem_cache_cpu. In later patch we will need more control over the kmem_cache_cpu.page assignment, so instead of passing a kmem_cache_cpu pointer, pass a pointer to a pointer to a page that get_partial() can fill and the caller can assign the kmem_cache_cpu.page pointer. No functional change as all of this still happens with disabled IRQs. Signed-off-by: Vlastimil Babka commit 53a0de06e50acb372c75d87fcc72ddfdf4a060ee Author: Vlastimil Babka Date: Tue May 11 13:01:34 2021 +0200 mm, slub: dissolve new_slab_objects() into ___slab_alloc() The later patches will need more fine grained control over individual actions in ___slab_alloc(), the only caller of new_slab_objects(), so dissolve it there. This is a preparatory step with no functional change. The only minor change is moving WARN_ON_ONCE() for using a constructor together with __GFP_ZERO to new_slab(), which makes it somewhat less frequent, but still able to catch a development change introducing a systematic misuse. Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter Acked-by: Mel Gorman commit 2a904905ae041504aefaf8fc7144d31b940443e0 Author: Vlastimil Babka Date: Tue May 11 12:45:48 2021 +0200 mm, slub: extract get_partial() from new_slab_objects() The later patches will need more fine grained control over individual actions in ___slab_alloc(), the only caller of new_slab_objects(), so this is a first preparatory step with no functional change. This adds a goto label that appears unnecessary at this point, but will be useful for later changes. Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter commit 2fc2a7a62eb58650e71b4550cf6fa6cc0a75b2d2 Author: Jens Axboe Date: Fri Sep 3 16:55:26 2021 -0600 io_uring: io_uring_complete() trace should take an integer It currently takes a long, and while that's normally OK, the io_uring limit is an int. Internally in io_uring it's an int, but sometimes it's passed as a long. That can yield confusing results where a completions seems to generate a huge result: ou-sqp-1297-1298 [001] ...1 788.056371: io_uring_complete: ring 000000000e98e046, user_data 0x0, result 4294967171, cflags 0 which is due to -ECANCELED being stored in an unsigned, and then passed in as a long. Using the right int type, the trace looks correct: iou-sqp-338-339 [002] ...1 15.633098: io_uring_complete: ring 00000000e0ac60cf, user_data 0x0, result -125, cflags 0 Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe commit f1583cb1be35c23df60b1c39e3e7e6704d749d0b Merge: b250e6d141ce4 67d6d80d90fb2 Author: Linus Torvalds Date: Fri Sep 3 15:55:41 2021 -0700 Merge tag 'linux-kselftest-next-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: "Fixes to build and test failures: - openat2 test failure for O_LARGEFILE flag on ARM64 - x86 test build failures related to glibc 2.34 adding support for variable sized MINSIGSTKSZ and SIGSTKSZ - removing obsolete configs in sync and cpufreq config files - minor spelling and duplicate header include cleanups" * tag 'linux-kselftest-next-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/cpufreq: Rename DEBUG_PI_LIST to DEBUG_PLIST selftests/sync: Remove the deprecated config SYNC selftests: safesetid: Fix spelling mistake "cant" -> "can't" selftests/x86: Fix error: variably modified 'altstack_data' at file scope kselftest:sched: remove duplicate include in cs_prctl_test.c selftests: openat2: Fix testing failure for O_LARGEFILE flag commit b250e6d141ce4f0d0ada60e4b5db577050e5feb0 Merge: 4e71add02821b bc7cd2dd1f8e5 Author: Linus Torvalds Date: Fri Sep 3 15:33:47 2021 -0700 Merge tag 'kbuild-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Add -s option (strict mode) to merge_config.sh to make it fail when any symbol is redefined. - Show a warning if a different compiler is used for building external modules. - Infer --target from ARCH for CC=clang to let you cross-compile the kernel without CROSS_COMPILE. - Make the integrated assembler default (LLVM_IAS=1) for CC=clang. - Add to the kernel source instead of borrowing from the compiler. - Add Nick Desaulniers as a Kbuild reviewer. - Drop stale cc-option tests. - Fix the combination of CONFIG_TRIM_UNUSED_KSYMS and CONFIG_LTO_CLANG to handle symbols in inline assembly. - Show a warning if 'FORCE' is missing for if_changed rules. - Various cleanups * tag 'kbuild-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (39 commits) kbuild: redo fake deps at include/ksym/*.h kbuild: clean up objtool_args slightly modpost: get the *.mod file path more simply checkkconfigsymbols.py: Fix the '--ignore' option kbuild: merge vmlinux_link() between ARCH=um and other architectures kbuild: do not remove 'linux' link in scripts/link-vmlinux.sh kbuild: merge vmlinux_link() between the ordinary link and Clang LTO kbuild: remove stale *.symversions kbuild: remove unused quiet_cmd_update_lto_symversions gen_compile_commands: extract compiler command from a series of commands x86: remove cc-option-yn test for -mtune= arc: replace cc-option-yn uses with cc-option s390: replace cc-option-yn uses with cc-option ia64: move core-y in arch/ia64/Makefile to arch/ia64/Kbuild sparc: move the install rule to arch/sparc/Makefile security: remove unneeded subdir-$(CONFIG_...) kbuild: sh: remove unused install script kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y kbuild: Switch to 'f' variants of integrated assembler flag kbuild: Shuffle blank line to improve comment meaning ... commit 4e71add02821bdd204dd29c35e66baecc9b6a235 Merge: 7cca308cfdc07 8b7084b848cd9 Author: Linus Torvalds Date: Fri Sep 3 15:21:54 2021 -0700 Merge branch 'stable/for-linus-5.15-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft Pull ibft fix from Konrad Rzeszutek Wilk: "An arm64 compile fix for the new code that fixed the iBFT KASLR handling. I missed the original 0-day build email report" * 'stable/for-linus-5.15-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: Fix isa_bus_to_virt not working under ARM commit 976b805c782a57256e08aeaab45a64536b8887cf Author: Vlastimil Babka Date: Tue Jun 8 01:19:03 2021 +0200 mm, slub: remove redundant unfreeze_partials() from put_cpu_partial() Commit d6e0b7fa1186 ("slub: make dead caches discard free slabs immediately") introduced cpu partial flushing for kmemcg caches, based on setting the target cpu_partial to 0 and adding a flushing check in put_cpu_partial(). This code that sets cpu_partial to 0 was later moved by c9fc586403e7 ("slab: introduce __kmemcg_cache_deactivate()") and ultimately removed by 9855609bde03 ("mm: memcg/slab: use a single set of kmem_caches for all accounted allocations"). However the check and flush in put_cpu_partial() was never removed, although it's effectively a dead code. So this patch removes it. Note that d6e0b7fa1186 also added preempt_disable()/enable() to unfreeze_partials() which could be thus also considered unnecessary. But further patches will rely on it, so keep it. Signed-off-by: Vlastimil Babka commit 84048039d7774c363951ee6fc41c5d26f50f72fd Author: Vlastimil Babka Date: Fri May 21 01:25:06 2021 +0200 mm, slub: don't disable irq for debug_check_no_locks_freed() In slab_free_hook() we disable irqs around the debug_check_no_locks_freed() call, which is unnecessary, as irqs are already being disabled inside the call. This seems to be leftover from the past where there were more calls inside the irq disabled sections. Remove the irq disable/enable operations. Mel noted: > Looks like it was needed for kmemcheck which went away back in 4.15 Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman commit 0a19e7dd928800da66efe429c25b0adc3a07c534 Author: Vlastimil Babka Date: Sun May 23 01:37:07 2021 +0200 mm, slub: allocate private object map for validate_slab_cache() validate_slab_cache() is called either to handle a sysfs write, or from a self-test context. In both situations it's straightforward to preallocate a private object bitmap instead of grabbing the shared static one meant for critical sections, so let's do that. Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter Acked-by: Mel Gorman commit b3fd64e1451b5efd94aa0ebc755e02558e6f3ca1 Author: Vlastimil Babka Date: Sun May 23 01:28:37 2021 +0200 mm, slub: allocate private object map for debugfs listings Slub has a static spinlock protected bitmap for marking which objects are on freelist when it wants to list them, for situations where dynamically allocating such map can lead to recursion or locking issues, and on-stack bitmap would be too large. The handlers of debugfs files alloc_traces and free_traces also currently use this shared bitmap, but their syscall context makes it straightforward to allocate a private map before entering locked sections, so switch these processing paths to use a private bitmap. Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter Acked-by: Mel Gorman commit eafb1d64030abf5f885026c2074d120c13e0ca9d Author: Vlastimil Babka Date: Fri May 28 14:32:10 2021 +0200 mm, slub: don't call flush_all() from slab_debug_trace_open() slab_debug_trace_open() can only be called on caches with SLAB_STORE_USER flag and as with all slub debugging flags, such caches avoid cpu or percpu partial slabs altogether, so there's nothing to flush. Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter commit abf36fe0be7d754f2a1c733d684d11474e85b7ea Author: Alyssa Rosenzweig Date: Fri Sep 3 11:18:26 2021 -0400 docs: kernel-hacking: Remove inappropriate text Remove inappropriate sexual (and ableist) text from the locking documentation, aligning it with the kernel code-of-conduct. As the text was unrelated to locking, this change streamlines the document and improves readability. Signed-off-by: Alyssa Rosenzweig Link: https://lore.kernel.org/r/20210903151826.6300-1-alyssa@rosenzweig.io Signed-off-by: Jonathan Corbet commit d66e3edee7af87fe212df611ab9846b987a5070f Author: Thomas Gleixner Date: Fri Sep 3 22:47:06 2021 +0200 futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic() The recent bug fix left the variable 'vpid' and an assignment to it around, but the variable is otherwise unused. clang dose not complain even with W=1, but gcc exposed this. Fixes: 4f07ec0d76f2 ("futex: Prevent inconsistent state and exit race") Signed-off-by: Thomas Gleixner commit 7cca308cfdc0725363ac5943dca9dcd49cc1d2d5 Merge: 11d5576880aed a3314262eede9 Author: Linus Torvalds Date: Fri Sep 3 11:22:50 2021 -0700 Merge tag 'powerpc-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Convert pseries & powernv to use MSI IRQ domains. - Rework the pseries CPU numbering so that CPUs that are removed, and later re-added, are given a CPU number on the same node as previously, when possible. - Add support for a new more flexible device-tree format for specifying NUMA distances. - Convert powerpc to GENERIC_PTDUMP. - Retire sbc8548 and sbc8641d board support. - Various other small features and fixes. Thanks to Alexey Kardashevskiy, Aneesh Kumar K.V, Anton Blanchard, Cédric Le Goater, Christophe Leroy, Emmanuel Gil Peyrot, Fabiano Rosas, Fangrui Song, Finn Thain, Gautham R. Shenoy, Hari Bathini, Joel Stanley, Jordan Niethe, Kajol Jain, Laurent Dufour, Leonardo Bras, Lukas Bulwahn, Marc Zyngier, Masahiro Yamada, Michal Suchanek, Nathan Chancellor, Nicholas Piggin, Parth Shah, Paul Gortmaker, Pratik R. Sampat, Randy Dunlap, Sebastian Andrzej Siewior, Srikar Dronamraju, Wan Jiabing, Xiongwei Song, and Zheng Yongjun. * tag 'powerpc-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (154 commits) powerpc/bug: Cast to unsigned long before passing to inline asm powerpc/ptdump: Fix generic ptdump for 64-bit KVM: PPC: Fix clearing never mapped TCEs in realmode powerpc/pseries/iommu: Rename "direct window" to "dma window" powerpc/pseries/iommu: Make use of DDW for indirect mapping powerpc/pseries/iommu: Find existing DDW with given property name powerpc/pseries/iommu: Update remove_dma_window() to accept property name powerpc/pseries/iommu: Reorganize iommu_table_setparms*() with new helper powerpc/pseries/iommu: Add ddw_property_create() and refactor enable_ddw() powerpc/pseries/iommu: Allow DDW windows starting at 0x00 powerpc/pseries/iommu: Add ddw_list_new_entry() helper powerpc/pseries/iommu: Add iommu_pseries_alloc_table() helper powerpc/kernel/iommu: Add new iommu_table_in_use() helper powerpc/pseries/iommu: Replace hard-coded page shift powerpc/numa: Update cpu_cpu_map on CPU online/offline powerpc/numa: Print debug statements only when required powerpc/numa: convert printk to pr_xxx powerpc/numa: Drop dbg in favour of pr_debug powerpc/smp: Enable CACHE domain for shared processor powerpc/smp: Update cpu_core_map on all PowerPc systems ... commit 11d5576880aed34b8aa4e8049afdab92793b071f Merge: d6742212c0c6c c42813b71a06a Author: Linus Torvalds Date: Fri Sep 3 11:15:49 2021 -0700 Merge tag 'for-5.15/parisc-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "Fix an unaligned-access crash in the bootloader and drop asm/swab.h" * tag 'for-5.15/parisc-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix unaligned-access crash in bootloader parisc: Drop __arch_swab16(), arch_swab24(), _arch_swab32() and __arch_swab64() functions commit 2cfa946be843834d937e0914552d4967ffd421fc Author: Konrad Dybcio Date: Fri Sep 3 12:17:59 2021 +0200 clk: qcom: gcc-sm6350: Remove unused variable In the commit "clk: qcom: Add SM6350 GCC driver" (no hash yet) an unused variable has been overlooked. Remove it. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/5b7edab0-4756-94d0-d601-050120cbf4cb@somainline.org Reported-by: kernel test robot Signed-off-by: Stephen Boyd commit d6742212c0c6ccee2351499db80acba71fa36052 Merge: 603eefda5fcf8 bea6a94a279bc Author: Linus Torvalds Date: Fri Sep 3 11:11:54 2021 -0700 Merge tag 'mips_5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - converted Pistachio platform to use MIPS generic kernel - fixes and cleanups * tag 'mips_5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (29 commits) MIPS: Malta: fix alignment of the devicetree buffer MIPS: ingenic: Unconditionally enable clock of CPU #0 MIPS: mscc: ocelot: mark the phy-mode for internal PHY ports MIPS: mscc: ocelot: disable all switch ports by default MAINTAINERS: adjust PISTACHIO SOC SUPPORT after its retirement MIPS: Return true/false (not 1/0) from bool functions MIPS: generic: Return true/false (not 1/0) from bool functions MIPS: Make a alias for pistachio_defconfig MIPS: Retire MACH_PISTACHIO MIPS: config: generic: Add config for Marduk board pinctrl: pistachio: Make it as an option phy: pistachio-usb: Depend on MIPS || COMPILE_TEST clocksource/drivers/pistachio: Make it selectable for MIPS clk: pistachio: Make it selectable for generic MIPS kernel MIPS: DTS: Pistachio add missing cpc and cdmm MIPS: generic: Allow generating FIT image for Marduk board MIPS: locking/atomic: Fix atomic{_64,}_sub_if_positive MIPS: loongson2ef: don't build serial.o unconditionally MIPS: Replace deprecated CPU-hotplug functions. MIPS: Alchemy: Fix spelling contraction "cant" -> "can't" ... commit 603eefda5fcf8f9dab3ae253e677abb285f6f3bc Merge: 50ddcdb2635c8 1955d843efc3b Author: Linus Torvalds Date: Fri Sep 3 11:03:00 2021 -0700 Merge tag 'for-linus' of git://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "A few cleanups and compiler warning fixes for OpenRISC. Also, this includes dts and defconfig updates to enable Ethernet on OpenRISC/Litex FPGA SoC's now that the LiteEth driver has gone upstream" * tag 'for-linus' of git://github.com/openrisc/linux: openrisc/litex: Update defconfig openrisc/litex: Add ethernet device openrisc/litex: Update uart address openrisc: Fix compiler warnings in setup openrisc: rename or32 code & comments to or1k openrisc: don't printk() unconditionally commit 50ddcdb2635c82e195a2557341d759c5b9419bf1 Merge: 69a5c49a9147e 1daf08a066cfe Author: Linus Torvalds Date: Fri Sep 3 10:57:25 2021 -0700 Merge tag 'livepatching-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek. * tag 'livepatching-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Replace deprecated CPU-hotplug functions. commit 69a5c49a9147e9daca76201e3d6edfea5ed8403a Merge: 3de18c865f504 d8768d7eb9c21 Author: Linus Torvalds Date: Fri Sep 3 10:44:35 2021 -0700 Merge tag 'iommu-updates-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - New DART IOMMU driver for Apple Silicon M1 chips - Optimizations for iommu_[map/unmap] performance - Selective TLB flush support for the AMD IOMMU driver to make it more efficient on emulated IOMMUs - Rework IOVA setup and default domain type setting to move more code out of IOMMU drivers and to support runtime switching between certain types of default domains - VT-d Updates from Lu Baolu: - Update the virtual command related registers - Enable Intel IOMMU scalable mode by default - Preset A/D bits for user space DMA usage - Allow devices to have more than 32 outstanding PRs - Various cleanups - ARM SMMU Updates from Will Deacon: SMMUv3: - Minor optimisation to avoid zeroing struct members on CMD submission - Increased use of batched commands to reduce submission latency - Refactoring in preparation for ECMDQ support SMMUv2: - Fix races when probing devices with identical StreamIDs - Optimise walk cache flushing for Qualcomm implementations - Allow deep sleep states for some Qualcomm SoCs with shared clocks - Various smaller optimizations, cleanups, and fixes * tag 'iommu-updates-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (85 commits) iommu/io-pgtable: Abstract iommu_iotlb_gather access iommu/arm-smmu: Fix missing unlock on error in arm_smmu_device_group() iommu/vt-d: Add present bit check in pasid entry setup helpers iommu/vt-d: Use pasid_pte_is_present() helper function iommu/vt-d: Drop the kernel doc annotation iommu/vt-d: Allow devices to have more than 32 outstanding PRs iommu/vt-d: Preset A/D bits for user space DMA usage iommu/vt-d: Enable Intel IOMMU scalable mode by default iommu/vt-d: Refactor Kconfig a bit iommu/vt-d: Remove unnecessary oom message iommu/vt-d: Update the virtual command related registers iommu: Allow enabling non-strict mode dynamically iommu: Merge strictness and domain type configs iommu: Only log strictness for DMA domains iommu: Expose DMA domain strictness via sysfs iommu: Express DMA strictness via the domain type iommu/vt-d: Prepare for multiple DMA domain types iommu/arm-smmu: Prepare for multiple DMA domain types iommu/amd: Prepare for multiple DMA domain types iommu: Introduce explicit type for non-strict DMA domains ... commit 0c217d5066c84f67cd672cf03ec8f682e5d013c2 Author: NeilBrown Date: Thu Sep 2 09:30:37 2021 +1000 SUNRPC: improve error response to over-size gss credential When the NFS server receives a large gss (kerberos) credential and tries to pass it up to rpc.svcgssd (which is deprecated), it triggers an infinite loop in cache_read(). cache_request() always returns -EAGAIN, and this causes a "goto again". This patch: - changes the error to -E2BIG to avoid the infinite loop, and - generates a WARN_ONCE when rsi_request first sees an over-sized credential. The warning suggests switching to gssproxy. Link: https://bugzilla.kernel.org/show_bug.cgi?id=196583 Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 3de18c865f504ab59ed2588b1e11acd4bcb9ea09 Merge: 14726903c8351 f3c4b1341e832 Author: Linus Torvalds Date: Fri Sep 3 10:34:44 2021 -0700 Merge branch 'stable/for-linus-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb Pull swiotlb updates from Konrad Rzeszutek Wilk: "A new feature called restricted DMA pools. It allows SWIOTLB to utilize per-device (or per-platform) allocated memory pools instead of using the global one. The first big user of this is ARM Confidential Computing where the memory for DMA operations can be set per platform" * 'stable/for-linus-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb: (23 commits) swiotlb: use depends on for DMA_RESTRICTED_POOL of: restricted dma: Don't fail device probe on rmem init failure of: Move of_dma_set_restricted_buffer() into device.c powerpc/svm: Don't issue ultracalls if !mem_encrypt_active() s390/pv: fix the forcing of the swiotlb swiotlb: Free tbl memory in swiotlb_exit() swiotlb: Emit diagnostic in swiotlb_exit() swiotlb: Convert io_default_tlb_mem to static allocation of: Return success from of_dma_set_restricted_buffer() when !OF_ADDRESS swiotlb: add overflow checks to swiotlb_bounce swiotlb: fix implicit debugfs declarations of: Add plumbing for restricted DMA pool dt-bindings: of: Add restricted DMA pool swiotlb: Add restricted DMA pool initialization swiotlb: Add restricted DMA alloc/free support swiotlb: Refactor swiotlb_tbl_unmap_single swiotlb: Move alloc_size to swiotlb_find_slots swiotlb: Use is_swiotlb_force_bounce for swiotlb data bouncing swiotlb: Update is_swiotlb_active to add a struct device argument swiotlb: Update is_swiotlb_buffer to add a struct device argument ... commit 14726903c835101cd8d0a703b609305094350d61 Merge: a9c9a6f741cda d5fffc5aff269 Author: Linus Torvalds Date: Fri Sep 3 10:08:28 2021 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc updates from Andrew Morton: "173 patches. Subsystems affected by this series: ia64, ocfs2, block, and mm (debug, pagecache, gup, swap, shmem, memcg, selftests, pagemap, mremap, bootmem, sparsemem, vmalloc, kasan, pagealloc, memory-failure, hugetlb, userfaultfd, vmscan, compaction, mempolicy, memblock, oom-kill, migration, ksm, percpu, vmstat, and madvise)" * emailed patches from Andrew Morton : (173 commits) mm/madvise: add MADV_WILLNEED to process_madvise() mm/vmstat: remove unneeded return value mm/vmstat: simplify the array size calculation mm/vmstat: correct some wrong comments mm/percpu,c: remove obsolete comments of pcpu_chunk_populated() selftests: vm: add COW time test for KSM pages selftests: vm: add KSM merging time test mm: KSM: fix data type selftests: vm: add KSM merging across nodes test selftests: vm: add KSM zero page merging test selftests: vm: add KSM unmerge test selftests: vm: add KSM merge test mm/migrate: correct kernel-doc notation mm: wire up syscall process_mrelease mm: introduce process_mrelease system call memblock: make memblock_find_in_range method private mm/mempolicy.c: use in_task() in mempolicy_slab_node() mm/mempolicy: unify the create() func for bind/interleave/prefer-many policies mm/mempolicy: advertise new MPOL_PREFERRED_MANY mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY ... commit d5fffc5aff269717a035baa087630adca612a6c4 Author: zhangkui Date: Thu Sep 2 15:01:11 2021 -0700 mm/madvise: add MADV_WILLNEED to process_madvise() There is a usecase in Android that an app process's memory is swapped out by process_madvise() with MADV_PAGEOUT, such as the memory is swapped to zram or a backing device. When the process is scheduled to running, like switch to foreground, multiple page faults may cause the app dropped frames. To reduce the problem, System Management Software can read-ahead memory of the process immediately when the app switches to forground. Calling process_madvise() with MADV_WILLNEED can meet this need. Link: https://lkml.kernel.org/r/20210804082010.12482-1-zhangkui@oppo.com Signed-off-by: zhangkui Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33090af97350cee9ea0e347301cef704bd5b0d8e Author: Miaohe Lin Date: Thu Sep 2 15:01:08 2021 -0700 mm/vmstat: remove unneeded return value The return value of pagetypeinfo_showfree and pagetypeinfo_showblockcount are unused now. Remove them. Link: https://lkml.kernel.org/r/20210715122911.15700-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 64632fd3eb4611780a1190362f2119d8f2bb5465 Author: Miaohe Lin Date: Thu Sep 2 15:01:05 2021 -0700 mm/vmstat: simplify the array size calculation We can replace the array_num * sizeof(array[0]) with sizeof(array) to simplify the code. Link: https://lkml.kernel.org/r/20210715122911.15700-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ea15ba17b434b7dd7f92bb85b7e5cf53707733ad Author: Miaohe Lin Date: Thu Sep 2 15:01:03 2021 -0700 mm/vmstat: correct some wrong comments Patch series "Cleanup for vmstat". This series contains cleanups to remove unneeded return value, correct wrong comment and simplify the array size calculation. More details can be found in the respective changelogs. This patch (of 3): Correct wrong fls(mem+1) to fls(mem)+1 and remove the duplicated comment with quiet_vmstat(). Link: https://lkml.kernel.org/r/20210715122911.15700-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210715122911.15700-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 319814504992f51ed17af60edb1a237ada1892e8 Author: Jing Xiangfeng Date: Thu Sep 2 15:01:00 2021 -0700 mm/percpu,c: remove obsolete comments of pcpu_chunk_populated() Commit b239f7daf553 ("percpu: set PCPU_BITMAP_BLOCK_SIZE to PAGE_SIZE") removed the parameter 'for_alloc', so remove this comment. Link: https://lkml.kernel.org/r/1630576043-21367-1-git-send-email-jingxiangfeng@huawei.com Signed-off-by: Jing Xiangfeng Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 924a11bd1623787c6604590202e0920eb572fa42 Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:57 2021 -0700 selftests: vm: add COW time test for KSM pages Since merged pages are copied every time they need to be modified, the write access time is different between shared and non-shared pages. Add ksm_cow_time() function which evaluates latency of these COW breaks. First, 4000 pages are allocated and the time, required to modify 1 byte in every other page, is measured. After this, the pages are merged into 2000 pairs and in each pair, 1 page is modified (i.e. they are decoupled) to detect COW breaks. The time needed to break COW of merged pages is then compared with performance of non-shared pages. The test is run as follows: ./ksm_tests -C The output: Total size: 15 MiB Not merged pages: Total time: 0.002185489 s Average speed: 3202.945 MiB/s Merged pages: Total time: 0.004386872 s Average speed: 1595.670 MiB/s Link: https://lkml.kernel.org/r/1d03ee0d1b341959d4b61672c6401d498bff5652.1629386192.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Tyler Hicks Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9e7cb94ca218816bfd51e07b50bcfeadd3166d42 Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:54 2021 -0700 selftests: vm: add KSM merging time test Patch series "add KSM performance tests", v3. Extend KSM self tests with a performance benchmark. These tests are not part of regular regression testing, as they are mainly intended to be used by developers making changes to the memory management subsystem. This patch (of 2): Add ksm_merge_time() function to determine speed and time needed for merging. The total spent time is shown in seconds while speed is in MiB/s. User must specify the size of duplicated memory area (in MiB) before running the test. The test is run as follows: ./ksm_tests -P -s 100 The output: Total size: 100 MiB Total time: 0.201106786 s Average speed: 497.248 MiB/s Link: https://lkml.kernel.org/r/cover.1629386192.git.zhansayabagdaulet@gmail.com Link: https://lkml.kernel.org/r/318b946ac80cc9205c89d0962048378f7ce0705b.1629386192.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Tyler Hicks Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 584ff0dfb09a81e1addf02543f7c1fa8e71ce6d2 Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:51 2021 -0700 mm: KSM: fix data type ksm_stable_node_chains_prune_millisecs is declared as int, but in stable__node_chains_prune_millisecs_store(), it can store values up to UINT_MAX. Change its type to unsigned int. Link: https://lkml.kernel.org/r/20210806111351.GA71845@asus Signed-off-by: Zhansaya Bagdauletkyzy Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 82e717ad35018ce59ba1b66297dfd898b2a1a03f Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:48 2021 -0700 selftests: vm: add KSM merging across nodes test Add check_ksm_numa_merge() function to test that pages in different NUMA nodes are being handled properly. First, two duplicate pages are allocated in two separate NUMA nodes using the libnuma library. Since there is one unique page in each node, with merge_across_nodes = 0, there won't be any shared pages. If merge_across_nodes is set to 1, the pages will be treated as usual duplicate pages and will be merged. If NUMA config is not enabled or the number of NUMA nodes is less than two, then the test is skipped. The test is run as follows: ./ksm_tests -N Link: https://lkml.kernel.org/r/071c17b5b04ebb0dfeba137acc495e5dd9d2a719.1626252248.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Pavel Tatashin Reviewed-by: Tyler Hicks Cc: Hugh Dickins Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39619982c5be6ed57390f17aabee6bc11e4af37e Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:45 2021 -0700 selftests: vm: add KSM zero page merging test Add check_ksm_zero_page_merge() function to test that empty pages are being handled properly. For this, several zero pages are allocated and merged using madvise. If use_zero_pages is enabled, the pages must be shared with the special kernel zero pages; otherwise, they are merged as usual duplicate pages. The test is run as follows: ./ksm_tests -Z Link: https://lkml.kernel.org/r/6d0caab00d4bdccf5e3791cb95cf6dfd5eb85e45.1626252248.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Pavel Tatashin Reviewed-by: Tyler Hicks Cc: Hugh Dickins Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a40c80e348fac4ecff8abcc3fae31e2e84c055d6 Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:42 2021 -0700 selftests: vm: add KSM unmerge test Add check_ksm_unmerge() function to verify that KSM is properly unmerging shared pages. For this, two duplicate pages are merged first and then their contents are modified. Since they are not identical anymore, the pages must be unmerged and the number of merged pages has to be 0. The test is run as follows: ./ksm_tests -U Link: https://lkml.kernel.org/r/c0f55420440d704d5b094275b4365aa1b2ad46b5.1626252248.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Pavel Tatashin Reviewed-by: Tyler Hicks Cc: Hugh Dickins Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68d6289baa35c5e59b5359577d3dc01c00c437d2 Author: Zhansaya Bagdauletkyzy Date: Thu Sep 2 15:00:39 2021 -0700 selftests: vm: add KSM merge test Patch series "add KSM selftests". Introduce selftests to validate the functionality of KSM. The tests are run on private anonymous pages. Since some KSM tunables are modified, their starting values are saved and restored after testing. At the start, run is set to 2 to ensure that only test pages will be merged (we assume that no applications make madvise syscalls in the background). If KSM config not enabled, all tests will be skipped. This patch (of 4): Add check_ksm_merge() function to check the basic merging feature of KSM. First, some number of identical pages are allocated and the MADV_MERGEABLE advice is given to merge these pages. Then, pages_shared and pages_sharing values are compared with the expected numbers using assert_ksm_pages_count() function. The number of pages can be changed using -p option. Link: https://lkml.kernel.org/r/cover.1626252248.git.zhansayabagdaulet@gmail.com Link: https://lkml.kernel.org/r/90287685c13300972ea84de93d1f3f900373f9fe.1626252248.git.zhansayabagdaulet@gmail.com Signed-off-by: Zhansaya Bagdauletkyzy Reviewed-by: Pavel Tatashin Reviewed-by: Tyler Hicks Cc: Shuah Khan Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c9bd7d183673b5136e56210003e1d94338d47c45 Author: Randy Dunlap Date: Thu Sep 2 15:00:36 2021 -0700 mm/migrate: correct kernel-doc notation Use the expected "Return:" format to prevent a kernel-doc warning. mm/migrate.c:1157: warning: Excess function parameter 'returns' description in 'next_demotion_node' Link: https://lkml.kernel.org/r/20210808203151.10632-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dce49103962840dd61423d7627748d6c558d58c5 Author: Suren Baghdasaryan Date: Thu Sep 2 15:00:33 2021 -0700 mm: wire up syscall process_mrelease Split off from prev patch in the series that implements the syscall. Link: https://lkml.kernel.org/r/20210809185259.405936-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Acked-by: Geert Uytterhoeven Cc: Andy Lutomirski Cc: Christian Brauner Cc: Christoph Hellwig Cc: David Hildenbrand Cc: David Rientjes Cc: Florian Weimer Cc: Jan Engelhardt Cc: Jann Horn Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Minchan Kim Cc: Oleg Nesterov Cc: Rik van Riel Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tim Murray Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 884a7e5964e06ed93c7771c0d7cf19c09a8946f1 Author: Suren Baghdasaryan Date: Thu Sep 2 15:00:29 2021 -0700 mm: introduce process_mrelease system call In modern systems it's not unusual to have a system component monitoring memory conditions of the system and tasked with keeping system memory pressure under control. One way to accomplish that is to kill non-essential processes to free up memory for more important ones. Examples of this are Facebook's OOM killer daemon called oomd and Android's low memory killer daemon called lmkd. For such system component it's important to be able to free memory quickly and efficiently. Unfortunately the time process takes to free up its memory after receiving a SIGKILL might vary based on the state of the process (uninterruptible sleep), size and OPP level of the core the process is running. A mechanism to free resources of the target process in a more predictable way would improve system's ability to control its memory pressure. Introduce process_mrelease system call that releases memory of a dying process from the context of the caller. This way the memory is freed in a more controllable way with CPU affinity and priority of the caller. The workload of freeing the memory will also be charged to the caller. The operation is allowed only on a dying process. After previous discussions [1, 2, 3] the decision was made [4] to introduce a dedicated system call to cover this use case. The API is as follows, int process_mrelease(int pidfd, unsigned int flags); DESCRIPTION The process_mrelease() system call is used to free the memory of an exiting process. The pidfd selects the process referred to by the PID file descriptor. (See pidfd_open(2) for further information) The flags argument is reserved for future use; currently, this argument must be specified as 0. RETURN VALUE On success, process_mrelease() returns 0. On error, -1 is returned and errno is set to indicate the error. ERRORS EBADF pidfd is not a valid PID file descriptor. EAGAIN Failed to release part of the address space. EINTR The call was interrupted by a signal; see signal(7). EINVAL flags is not 0. EINVAL The memory of the task cannot be released because the process is not exiting, the address space is shared with another live process or there is a core dump in progress. ENOSYS This system call is not supported, for example, without MMU support built into Linux. ESRCH The target process does not exist (i.e., it has terminated and been waited on). [1] https://lore.kernel.org/lkml/20190411014353.113252-3-surenb@google.com/ [2] https://lore.kernel.org/linux-api/20201113173448.1863419-1-surenb@google.com/ [3] https://lore.kernel.org/linux-api/20201124053943.1684874-3-surenb@google.com/ [4] https://lore.kernel.org/linux-api/20201223075712.GA4719@lst.de/ Link: https://lkml.kernel.org/r/20210809185259.405936-1-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Acked-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Christian Brauner Cc: David Rientjes Cc: Matthew Wilcox (Oracle) Cc: Johannes Weiner Cc: Roman Gushchin Cc: Rik van Riel Cc: Minchan Kim Cc: Christoph Hellwig Cc: Oleg Nesterov Cc: Jann Horn Cc: Geert Uytterhoeven Cc: Andy Lutomirski Cc: Christian Brauner Cc: Florian Weimer Cc: Jan Engelhardt Cc: Tim Murray Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a7259df7670240ee03b0cfce8a3e5d3773911e24 Author: Mike Rapoport Date: Thu Sep 2 15:00:26 2021 -0700 memblock: make memblock_find_in_range method private There are a lot of uses of memblock_find_in_range() along with memblock_reserve() from the times memblock allocation APIs did not exist. memblock_find_in_range() is the very core of memblock allocations, so any future changes to its internal behaviour would mandate updates of all the users outside memblock. Replace the calls to memblock_find_in_range() with an equivalent calls to memblock_phys_alloc() and memblock_phys_alloc_range() and make memblock_find_in_range() private method of memblock. This simplifies the callers, ensures that (unlikely) errors in memblock_reserve() are handled and improves maintainability of memblock_find_in_range(). Link: https://lkml.kernel.org/r/20210816122622.30279-1-rppt@kernel.org Signed-off-by: Mike Rapoport Reviewed-by: Catalin Marinas [arm64] Acked-by: Kirill A. Shutemov Acked-by: Rafael J. Wysocki [ACPI] Acked-by: Russell King (Oracle) Acked-by: Nick Kossifidis [riscv] Tested-by: Guenter Roeck Acked-by: Rob Herring Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38b031dd4d03542d963eebe600d67ea34f47eb65 Author: Vasily Averin Date: Thu Sep 2 15:00:23 2021 -0700 mm/mempolicy.c: use in_task() in mempolicy_slab_node() Obsoleted in_intrrupt() include task context with disabled BH, it's better to use in_task() instead. Link: https://lkml.kernel.org/r/984ee771-4834-21da-801f-c15c18ddf4d1@virtuozzo.com Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be897d48a971e36daadbd9289967e7e4f3749528 Author: Feng Tang Date: Thu Sep 2 15:00:19 2021 -0700 mm/mempolicy: unify the create() func for bind/interleave/prefer-many policies As they all do the same thing: sanity check and save nodemask info, create one mpol_new_nodemask() to reduce redundancy. Link: https://lkml.kernel.org/r/1627970362-61305-6-git-send-email-feng.tang@intel.com Signed-off-by: Feng Tang Acked-by: Michal Hocko Cc: Andi Kleen Cc: Andrea Arcangeli Cc: Ben Widawsky Cc: Dan Williams Cc: Dave Hansen Cc: David Rientjes Cc: Huang Ying Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Randy Dunlap Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a38a59fdfa10be55d08e4530923d950e739ac6a2 Author: Ben Widawsky Date: Thu Sep 2 15:00:16 2021 -0700 mm/mempolicy: advertise new MPOL_PREFERRED_MANY Adds a new mode to the existing mempolicy modes, MPOL_PREFERRED_MANY. MPOL_PREFERRED_MANY will be adequately documented in the internal admin-guide with this patch. Eventually, the man pages for mbind(2), get_mempolicy(2), set_mempolicy(2) and numactl(8) will also have text about this mode. Those shall contain the canonical reference. NUMA systems continue to become more prevalent. New technologies like PMEM make finer grain control over memory access patterns increasingly desirable. MPOL_PREFERRED_MANY allows userspace to specify a set of nodes that will be tried first when performing allocations. If those allocations fail, all remaining nodes will be tried. It's a straight forward API which solves many of the presumptive needs of system administrators wanting to optimize workloads on such machines. The mode will work either per VMA, or per thread. [Michal Hocko: refine kernel doc for MPOL_PREFERRED_MANY] Link: https://lore.kernel.org/r/20200630212517.308045-13-ben.widawsky@intel.com Link: https://lkml.kernel.org/r/1627970362-61305-5-git-send-email-feng.tang@intel.com Signed-off-by: Ben Widawsky Signed-off-by: Feng Tang Acked-by: Michal Hocko Cc: Andi Kleen Cc: Andrea Arcangeli Cc: Dan Williams Cc: Dave Hansen Cc: David Rientjes Cc: Huang Ying Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Randy Dunlap Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cfcaa66f803233c50e17239469f6c96136a673a1 Author: Ben Widawsky Date: Thu Sep 2 15:00:13 2021 -0700 mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY Implement the missing huge page allocation functionality while obeying the preferred node semantics. This is similar to the implementation for general page allocation, as it uses a fallback mechanism to try multiple preferred nodes first, and then all other nodes. To avoid adding too many "#ifdef CONFIG_NUMA" check, add a helper function in mempolicy.h to check whether a mempolicy is MPOL_PREFERRED_MANY. [akpm@linux-foundation.org: fix compiling issue when merging with other hugetlb patch] [Thanks to 0day bot for catching the !CONFIG_NUMA compiling issue] [mhocko@suse.com: suggest to remove the #ifdef CONFIG_NUMA check] [ben.widawsky@intel.com: add helpers to avoid ifdefs] Link: https://lore.kernel.org/r/20200630212517.308045-12-ben.widawsky@intel.com Link: https://lkml.kernel.org/r/1627970362-61305-4-git-send-email-feng.tang@intel.com Link: https://lkml.kernel.org/r/20210809024430.GA46432@shbuild999.sh.intel.com [nathan@kernel.org: initialize page to NULL in alloc_buddy_huge_page_with_mpol()] Link: https://lkml.kernel.org/r/20210810200632.3812797-1-nathan@kernel.org Link: https://lore.kernel.org/r/20200630212517.308045-12-ben.widawsky@intel.com Link: https://lkml.kernel.org/r/1627970362-61305-4-git-send-email-feng.tang@intel.com Link: https://lkml.kernel.org/r/20210809024430.GA46432@shbuild999.sh.intel.com Signed-off-by: Ben Widawsky Signed-off-by: Feng Tang Signed-off-by: Nathan Chancellor Co-developed-by: Feng Tang Suggested-by: Michal Hocko Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c54d94908e089e9741513797eac30a8b8217034 Author: Feng Tang Date: Thu Sep 2 15:00:10 2021 -0700 mm/memplicy: add page allocation function for MPOL_PREFERRED_MANY policy The semantics of MPOL_PREFERRED_MANY is similar to MPOL_PREFERRED, that it will first try to allocate memory from the preferred node(s), and fallback to all nodes in system when first try fails. Add a dedicated function alloc_pages_preferred_many() for it just like for 'interleave' policy, which will be used by 2 general memoory allocation APIs: alloc_pages() and alloc_pages_vma() Link: https://lore.kernel.org/r/20200630212517.308045-9-ben.widawsky@intel.com Link: https://lkml.kernel.org/r/1627970362-61305-3-git-send-email-feng.tang@intel.com Suggested-by: Michal Hocko Originally-by: Ben Widawsky Co-developed-by: Ben Widawsky Signed-off-by: Ben Widawsky Signed-off-by: Feng Tang Acked-by: Michal Hocko Cc: Andi Kleen Cc: Andrea Arcangeli Cc: Dan Williams Cc: Dave Hansen Cc: David Rientjes Cc: Huang Ying Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Kravetz Cc: Randy Dunlap Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b27abaccf8e8b012f126da0c2a1ab32723ec8b9f Author: Dave Hansen Date: Thu Sep 2 15:00:06 2021 -0700 mm/mempolicy: add MPOL_PREFERRED_MANY for multiple preferred nodes Patch series "Introduce multi-preference mempolicy", v7. This patch series introduces the concept of the MPOL_PREFERRED_MANY mempolicy. This mempolicy mode can be used with either the set_mempolicy(2) or mbind(2) interfaces. Like the MPOL_PREFERRED interface, it allows an application to set a preference for nodes which will fulfil memory allocation requests. Unlike the MPOL_PREFERRED mode, it takes a set of nodes. Like the MPOL_BIND interface, it works over a set of nodes. Unlike MPOL_BIND, it will not cause a SIGSEGV or invoke the OOM killer if those preferred nodes are not available. Along with these patches are patches for libnuma, numactl, numademo, and memhog. They still need some polish, but can be found here: https://gitlab.com/bwidawsk/numactl/-/tree/prefer-many It allows new usage: `numactl -P 0,3,4` The goal of the new mode is to enable some use-cases when using tiered memory usage models which I've lovingly named. 1a. The Hare - The interconnect is fast enough to meet bandwidth and latency requirements allowing preference to be given to all nodes with "fast" memory. 1b. The Indiscriminate Hare - An application knows it wants fast memory (or perhaps slow memory), but doesn't care which node it runs on. The application can prefer a set of nodes and then xpu bind to the local node (cpu, accelerator, etc). This reverses the nodes are chosen today where the kernel attempts to use local memory to the CPU whenever possible. This will attempt to use the local accelerator to the memory. 2. The Tortoise - The administrator (or the application itself) is aware it only needs slow memory, and so can prefer that. Much of this is almost achievable with the bind interface, but the bind interface suffers from an inability to fallback to another set of nodes if binding fails to all nodes in the nodemask. Like MPOL_BIND a nodemask is given. Inherently this removes ordering from the preference. > /* Set first two nodes as preferred in an 8 node system. */ > const unsigned long nodes = 0x3 > set_mempolicy(MPOL_PREFER_MANY, &nodes, 8); > /* Mimic interleave policy, but have fallback *. > const unsigned long nodes = 0xaa > set_mempolicy(MPOL_PREFER_MANY, &nodes, 8); Some internal discussion took place around the interface. There are two alternatives which we have discussed, plus one I stuck in: 1. Ordered list of nodes. Currently it's believed that the added complexity is nod needed for expected usecases. 2. A flag for bind to allow falling back to other nodes. This confuses the notion of binding and is less flexible than the current solution. 3. Create flags or new modes that helps with some ordering. This offers both a friendlier API as well as a solution for more customized usage. It's unknown if it's worth the complexity to support this. Here is sample code for how this might work: > // Prefer specific nodes for some something wacky > set_mempolicy(MPOL_PREFER_MANY, 0x17c, 1024); > > // Default > set_mempolicy(MPOL_PREFER_MANY | MPOL_F_PREFER_ORDER_SOCKET, NULL, 0); > // which is the same as > set_mempolicy(MPOL_DEFAULT, NULL, 0); > > // The Hare > set_mempolicy(MPOL_PREFER_MANY | MPOL_F_PREFER_ORDER_TYPE, NULL, 0); > > // The Tortoise > set_mempolicy(MPOL_PREFER_MANY | MPOL_F_PREFER_ORDER_TYPE_REV, NULL, 0); > > // Prefer the fast memory of the first two sockets > set_mempolicy(MPOL_PREFER_MANY | MPOL_F_PREFER_ORDER_TYPE, -1, 2); > This patch (of 5): The NUMA APIs currently allow passing in a "preferred node" as a single bit set in a nodemask. If more than one bit it set, bits after the first are ignored. This single node is generally OK for location-based NUMA where memory being allocated will eventually be operated on by a single CPU. However, in systems with multiple memory types, folks want to target a *type* of memory instead of a location. For instance, someone might want some high-bandwidth memory but do not care about the CPU next to which it is allocated. Or, they want a cheap, high capacity allocation and want to target all NUMA nodes which have persistent memory in volatile mode. In both of these cases, the application wants to target a *set* of nodes, but does not want strict MPOL_BIND behavior as that could lead to OOM killer or SIGSEGV. So add MPOL_PREFERRED_MANY policy to support the multiple preferred nodes requirement. This is not a pie-in-the-sky dream for an API. This was a response to a specific ask of more than one group at Intel. Specifically: 1. There are existing libraries that target memory types such as https://github.com/memkind/memkind. These are known to suffer from SIGSEGV's when memory is low on targeted memory "kinds" that span more than one node. The MCDRAM on a Xeon Phi in "Cluster on Die" mode is an example of this. 2. Volatile-use persistent memory users want to have a memory policy which is targeted at either "cheap and slow" (PMEM) or "expensive and fast" (DRAM). However, they do not want to experience allocation failures when the targeted type is unavailable. 3. Allocate-then-run. Generally, we let the process scheduler decide on which physical CPU to run a task. That location provides a default allocation policy, and memory availability is not generally considered when placing tasks. For situations where memory is valuable and constrained, some users want to allocate memory first, *then* allocate close compute resources to the allocation. This is the reverse of the normal (CPU) model. Accelerators such as GPUs that operate on core-mm-managed memory are interested in this model. A check is added in sanitize_mpol_flags() to not permit 'prefer_many' policy to be used for now, and will be removed in later patch after all implementations for 'prefer_many' are ready, as suggested by Michal Hocko. [mhocko@kernel.org: suggest to refine policy_node/policy_nodemask handling] Link: https://lkml.kernel.org/r/1627970362-61305-1-git-send-email-feng.tang@intel.com Link: https://lore.kernel.org/r/20200630212517.308045-4-ben.widawsky@intel.com Link: https://lkml.kernel.org/r/1627970362-61305-2-git-send-email-feng.tang@intel.com Co-developed-by: Ben Widawsky Signed-off-by: Ben Widawsky Signed-off-by: Dave Hansen Signed-off-by: Feng Tang Cc: Michal Hocko Acked-by: Michal Hocko Cc: Andrea Arcangeli Cc: Mel Gorman Cc: Mike Kravetz Cc: Randy Dunlap Cc: Vlastimil Babka Cc: Andi Kleen Cc: Dan Williams Cc: Huang Ying b Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 062db29358c9bd40d8aa9e96ce7b492b03d669d5 Author: Baolin Wang Date: Thu Sep 2 15:00:03 2021 -0700 mm/mempolicy: use readable NUMA_NO_NODE macro instead of magic number The caller of mpol_misplaced() already use NUMA_NO_NODE to check whether current page node is misplaced, thus using NUMA_NO_NODE in mpol_misplaced() instead of magic number is more readable. Link: https://lkml.kernel.org/r/1b77c0ce21183fa86f4db250b115cf5e27396528.1627558356.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65d759c8f9f57b96c199f3fe5cfb93ac7da095e9 Author: Charan Teja Reddy Date: Thu Sep 2 14:59:59 2021 -0700 mm: compaction: support triggering of proactive compaction by user The proactive compaction[1] gets triggered for every 500msec and run compaction on the node for COMPACTION_HPAGE_ORDER (usually order-9) pages based on the value set to sysctl.compaction_proactiveness. Triggering the compaction for every 500msec in search of COMPACTION_HPAGE_ORDER pages is not needed for all applications, especially on the embedded system usecases which may have few MB's of RAM. Enabling the proactive compaction in its state will endup in running almost always on such systems. Other side, proactive compaction can still be very much useful for getting a set of higher order pages in some controllable manner(controlled by using the sysctl.compaction_proactiveness). So, on systems where enabling the proactive compaction always may proove not required, can trigger the same from user space on write to its sysctl interface. As an example, say app launcher decide to launch the memory heavy application which can be launched fast if it gets more higher order pages thus launcher can prepare the system in advance by triggering the proactive compaction from userspace. This triggering of proactive compaction is done on a write to sysctl.compaction_proactiveness by user. [1]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=facdaa917c4d5a376d09d25865f5a863f906234a [akpm@linux-foundation.org: tweak vm.rst, per Mike] Link: https://lkml.kernel.org/r/1627653207-12317-1-git-send-email-charante@codeaurora.org Signed-off-by: Charan Teja Reddy Acked-by: Vlastimil Babka Acked-by: Rafael Aquini Cc: Mike Rapoport Cc: Luis Chamberlain Cc: Kees Cook Cc: Iurii Zaikin Cc: Dave Hansen Cc: Mel Gorman Cc: Nitin Gupta Cc: Jonathan Corbet Cc: Khalid Aziz Cc: David Rientjes Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e1e92bfa3825b72be4957f9fef267b3106d20aa6 Author: Charan Teja Reddy Date: Thu Sep 2 14:59:56 2021 -0700 mm: compaction: optimize proactive compaction deferrals Vlastimil Babka figured out that when fragmentation score didn't go down across the proactive compaction i.e. when no progress is made, next wake up for proactive compaction is deferred for 1 << COMPACT_MAX_DEFER_SHIFT, i.e. 64 times, with each wakeup interval of HPAGE_FRAG_CHECK_INTERVAL_MSEC(=500). In each of this wakeup, it just decrement 'proactive_defer' counter and goes sleep i.e. it is getting woken to just decrement a counter. The same deferral time can also achieved by simply doing the HPAGE_FRAG_CHECK_INTERVAL_MSEC << COMPACT_MAX_DEFER_SHIFT thus unnecessary wakeup of kcompact thread is avoided thus also removes the need of 'proactive_defer' thread counter. [akpm@linux-foundation.org: tweak comment] Link: https://lore.kernel.org/linux-fsdevel/88abfdb6-2c13-b5a6-5b46-742d12d1c910@suse.cz/ Link: https://lkml.kernel.org/r/1626869599-25412-1-git-send-email-charante@codeaurora.org Signed-off-by: Charan Teja Reddy Acked-by: Vlastimil Babka Reviewed-by: Khalid Aziz Acked-by: David Rientjes Cc: Nitin Gupta Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1399af7e54896c774d67f1c1acc491b07149421d Author: Vlastimil Babka Date: Thu Sep 2 14:59:53 2021 -0700 mm, vmscan: guarantee drop_slab_node() termination drop_slab_node() is called as part of echo 2>/proc/sys/vm/drop_caches operation. It iterates over all memcgs and calls shrink_slab() which in turn iterates over all slab shrinkers. Freed objects are counted and as long as the total number of freed objects from all memcgs and shrinkers is higher than 10, drop_slab_node() loops for another full memcgs*shrinkers iteration. This arbitrary constant threshold of 10 can result in effectively an infinite loop on a system with large number of memcgs and/or parallel activity that allocates new objects. This has been reported previously by Chunxin Zang [1] and recently by our customer. The previous report [1] has resulted in commit 069c411de40a ("mm/vmscan: fix infinite loop in drop_slab_node") which added a check for signals allowing the user to terminate the command writing to drop_caches. At the time it was also considered to make the threshold grow with each iteration to guarantee termination, but such patch hasn't been formally proposed yet. This patch implements the dynamically growing threshold. At first iteration it's enough to free one object to continue, and this threshold effectively doubles with each iteration. Our customer's feedback was positive. There is always a risk that this change will result on some system in a previously terminating drop_caches operation to terminate sooner and free fewer objects. Ideally the semantics would guarantee freeing all freeable objects that existed at the moment of starting the operation, while not looping forever for newly allocated objects, but that's not feasible to track. In the less ideal solution based on thresholds, arguably the termination guarantee is more important than the exhaustiveness guarantee. If there are reports of large regression wrt being exhaustive, we can tune how fast the threshold grows. [1] https://lore.kernel.org/lkml/20200909152047.27905-1-zangchunxin@bytedance.com/T/#u [vbabka@suse.cz: avoid undefined shift behaviour] Link: https://lkml.kernel.org/r/2f034e6f-a753-550a-f374-e4e23899d3d5@suse.cz Link: https://lkml.kernel.org/r/20210818152239.25502-1-vbabka@suse.cz Signed-off-by: Vlastimil Babka Reported-by: Chunxin Zang Cc: Muchun Song Cc: Chris Down Cc: Michal Hocko Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: Kefeng Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e786d9e5a2014c327d9b2eec83fa60b16af26f9 Author: Miaohe Lin Date: Thu Sep 2 14:59:50 2021 -0700 mm/vmscan: add 'else' to remove check_pending label We could add 'else' to remove the somewhat odd check_pending label to make code core succinct. Link: https://lkml.kernel.org/r/20210717065911.61497-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Michal Hocko Cc: Alex Shi Cc: Alistair Popple Cc: David Hildenbrand Cc: Hillf Danton Cc: Jens Axboe Cc: Johannes Weiner Cc: John Hubbard Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Minchan Kim Cc: Shaohua Li Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b87c517ac5de168aec6e8318ca0707b11b2ccfaf Author: Miaohe Lin Date: Thu Sep 2 14:59:46 2021 -0700 mm/vmscan: remove unneeded return value of kswapd_run() The return value of kswapd_run() is unused now. Clean it up. Link: https://lkml.kernel.org/r/20210717065911.61497-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Michal Hocko Cc: Alex Shi Cc: Alistair Popple Cc: David Hildenbrand Cc: Hillf Danton Cc: Jens Axboe Cc: Johannes Weiner Cc: John Hubbard Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Minchan Kim Cc: Shaohua Li Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eaad1ae7819fa2b8616a31c66d48982b1bb85d62 Author: Miaohe Lin Date: Thu Sep 2 14:59:43 2021 -0700 mm/vmscan: remove misleading setting to sc->priority The priority field of sc is used to control how many pages we should scan at once while we always traverse the list to shrink the pages in these functions. So these settings are unneeded and misleading. Link: https://lkml.kernel.org/r/20210717065911.61497-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Alex Shi Cc: Alistair Popple Cc: David Hildenbrand Cc: Hillf Danton Cc: Jens Axboe Cc: Johannes Weiner Cc: John Hubbard Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Michal Hocko Cc: Minchan Kim Cc: Shaohua Li Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d17be2d9ff6c689fd70d2d451153d613508a56ae Author: Miaohe Lin Date: Thu Sep 2 14:59:39 2021 -0700 mm/vmscan: remove the PageDirty check after MADV_FREE pages are page_ref_freezed Patch series "Cleanups for vmscan", v2. This series contains cleanups to remove unneeded return value, misleading setting and so on. Also this remove the PageDirty check after MADV_FREE pages are page_ref_freezed. More details can be found in the respective changelogs. This patch (of 4): If the MADV_FREE pages are redirtied before they could be reclaimed, put the pages back to anonymous LRU list by setting SwapBacked flag and the pages will be reclaimed in normal swapout way. But as Yu Zhao pointed out, "The page has only one reference left, which is from the isolation. After the caller puts the page back on lru and drops the reference, the page will be freed anyway. It doesn't matter which lru it goes." So we don't bother checking PageDirty here. [Yu Zhao's comment is also quoted in the code.] Link: https://lkml.kernel.org/r/20210717065911.61497-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210717065911.61497-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Yu Zhao Cc: Johannes Weiner Cc: Vlastimil Babka Cc: Michal Hocko Cc: Jens Axboe Cc: Joonsoo Kim Cc: Alex Shi Cc: Alistair Popple Cc: Matthew Wilcox Cc: Minchan Kim Cc: David Hildenbrand Cc: Shaohua Li Cc: Hillf Danton Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9647875be52b33fe22cb034ec3074896c581543f Author: Hui Su Date: Thu Sep 2 14:59:36 2021 -0700 mm/vmpressure: replace vmpressure_to_css() with vmpressure_to_memcg() We can get memcg directly form vmpr instead of vmpr->memcg->css->memcg, so add a new func helper vmpressure_to_memcg(). And no code will use vmpressure_to_css(), so delete it. Link: https://lkml.kernel.org/r/20210630112146.455103-1-suhui@zeku.com Signed-off-by: Hui Su Acked-by: Michal Hocko Acked-by: Chris Down Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 20b51af15e014cac63b58a4f8b8b323ac35bccce Author: Huang Ying Date: Thu Sep 2 14:59:33 2021 -0700 mm/migrate: add sysfs interface to enable reclaim migration Some method is obviously needed to enable reclaim-based migration. Just like traditional autonuma, there will be some workloads that will benefit like workloads with more "static" configurations where hot pages stay hot and cold pages stay cold. If pages come and go from the hot and cold sets, the benefits of this approach will be more limited. The benefits are truly workload-based and *not* hardware-based. We do not believe that there is a viable threshold where certain hardware configurations should have this mechanism enabled while others do not. To be conservative, earlier work defaulted to disable reclaim- based migration and did not include a mechanism to enable it. This proposes add a new sysfs file /sys/kernel/mm/numa/demotion_enabled as a method to enable it. We are open to any alternative that allows end users to enable this mechanism or disable it if workload harm is detected (just like traditional autonuma). Once this is enabled page demotion may move data to a NUMA node that does not fall into the cpuset of the allocating process. This could be construed to violate the guarantees of cpusets. However, since this is an opt-in mechanism, the assumption is that anyone enabling it is content to relax the guarantees. Link: https://lkml.kernel.org/r/20210721063926.3024591-9-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-10-ying.huang@intel.com Signed-off-by: Huang Ying Originally-by: Dave Hansen Cc: Michal Hocko Cc: Wei Xu Cc: Yang Shi Cc: Zi Yan Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3a235693d3930e1276c8d9cc0ca5807ef292cf0a Author: Dave Hansen Date: Thu Sep 2 14:59:30 2021 -0700 mm/vmscan: never demote for memcg reclaim Global reclaim aims to reduce the amount of memory used on a given node or set of nodes. Migrating pages to another node serves this purpose. memcg reclaim is different. Its goal is to reduce the total memory consumption of the entire memcg, across all nodes. Migration does not assist memcg reclaim because it just moves page contents between nodes rather than actually reducing memory consumption. Link: https://lkml.kernel.org/r/20210715055145.195411-9-ying.huang@intel.com Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Suggested-by: Yang Shi Reviewed-by: Yang Shi Reviewed-by: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a2a36488a61cefe3129295c6e75b3987b9d7fd13 Author: Keith Busch Date: Thu Sep 2 14:59:26 2021 -0700 mm/vmscan: Consider anonymous pages without swap Reclaim anonymous pages if a migration path is available now that demotion provides a non-swap recourse for reclaiming anon pages. Note that this check is subtly different from the can_age_anon_pages() checks. This mechanism checks whether a specific page in a specific context can actually be reclaimed, given current swap space and cgroup limits. can_age_anon_pages() is a much simpler and more preliminary check which just says whether there is a possibility of future reclaim. [kbusch@kernel.org: v11] Link: https://lkml.kernel.org/r/20210715055145.195411-8-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210721063926.3024591-7-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-8-ying.huang@intel.com Cc: Keith Busch Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f368a9fb7f408ba7d4e6d588e1958fe8b780d08 Author: Dave Hansen Date: Thu Sep 2 14:59:23 2021 -0700 mm/vmscan: add helper for querying ability to age anonymous pages Anonymous pages are kept on their own LRU(s). These lists could theoretically always be scanned and maintained. But, without swap, there is currently nothing the kernel can *do* with the results of a scanned, sorted LRU for anonymous pages. A check for '!total_swap_pages' currently serves as a valid check as to whether anonymous LRUs should be maintained. However, another method will be added shortly: page demotion. Abstract out the 'total_swap_pages' checks into a helper, give it a logically significant name, and check for the possibility of page demotion. [dave.hansen@linux.intel.com: v11] Link: https://lkml.kernel.org/r/20210715055145.195411-7-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210721063926.3024591-6-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-7-ying.huang@intel.com Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Greg Thelen Reviewed-by: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Keith Busch Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 668e4147d8850df32ca41e28f52c146025ca45c6 Author: Yang Shi Date: Thu Sep 2 14:59:19 2021 -0700 mm/vmscan: add page demotion counter Account the number of demoted pages. Add pgdemote_kswapd and pgdemote_direct VM counters showed in /proc/vmstat. [ daveh: - __count_vm_events() a bit, and made them look at the THP size directly rather than getting data from migrate_pages() ] Link: https://lkml.kernel.org/r/20210721063926.3024591-5-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-6-ying.huang@intel.com Signed-off-by: Yang Shi Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Wei Xu Reviewed-by: Zi Yan Cc: Michal Hocko Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Oscar Salvador Cc: Greg Thelen Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26aa2d199d6f2cfa6f2ef2a5dfe891f2250e71a0 Author: Dave Hansen Date: Thu Sep 2 14:59:16 2021 -0700 mm/migrate: demote pages during reclaim This is mostly derived from a patch from Yang Shi: https://lore.kernel.org/linux-mm/1560468577-101178-10-git-send-email-yang.shi@linux.alibaba.com/ Add code to the reclaim path (shrink_page_list()) to "demote" data to another NUMA node instead of discarding the data. This always avoids the cost of I/O needed to read the page back in and sometimes avoids the writeout cost when the page is dirty. A second pass through shrink_page_list() will be made if any demotions fail. This essentially falls back to normal reclaim behavior in the case that demotions fail. Previous versions of this patch may have simply failed to reclaim pages which were eligible for demotion but were unable to be demoted in practice. For some cases, for example, MADV_PAGEOUT, the pages are always discarded instead of demoted to follow the kernel API definition. Because MADV_PAGEOUT is defined as freeing specified pages regardless in which tier they are. Note: This just adds the start of infrastructure for migration. It is actually disabled next to the FIXME in migrate_demote_page_ok(). [dave.hansen@linux.intel.com: v11] Link: https://lkml.kernel.org/r/20210715055145.195411-5-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210721063926.3024591-4-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-5-ying.huang@intel.com Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Wei Xu Reviewed-by: Oscar Salvador Reviewed-by: Zi Yan Cc: Michal Hocko Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5ac95884a784e822b8cbe3d4bd6e9f96b3b71e3f Author: Yang Shi Date: Thu Sep 2 14:59:13 2021 -0700 mm/migrate: enable returning precise migrate_pages() success count Under normal circumstances, migrate_pages() returns the number of pages migrated. In error conditions, it returns an error code. When returning an error code, there is no way to know how many pages were migrated or not migrated. Make migrate_pages() return how many pages are demoted successfully for all cases, including when encountering errors. Page reclaim behavior will depend on this in subsequent patches. Link: https://lkml.kernel.org/r/20210721063926.3024591-3-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-4-ying.huang@intel.com Signed-off-by: Yang Shi Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Suggested-by: Oscar Salvador [optional parameter] Reviewed-by: Yang Shi Reviewed-by: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: Dan Williams Cc: David Hildenbrand Cc: David Rientjes Cc: Greg Thelen Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 884a6e5d1f93b5032e5d6dd2a183f8b3f008416b Author: Dave Hansen Date: Thu Sep 2 14:59:09 2021 -0700 mm/migrate: update node demotion order on hotplug events Reclaim-based migration is attempting to optimize data placement in memory based on the system topology. If the system changes, so must the migration ordering. The implementation is conceptually simple and entirely unoptimized. On any memory or CPU hotplug events, assume that a node was added or removed and recalculate all migration targets. This ensures that the node_demotion[] array is always ready to be used in case the new reclaim mode is enabled. This recalculation is far from optimal, most glaringly that it does not even attempt to figure out the hotplug event would have some *actual* effect on the demotion order. But, given the expected paucity of hotplug events, this should be fine. Link: https://lkml.kernel.org/r/20210721063926.3024591-2-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-3-ying.huang@intel.com Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Zi Yan Cc: Michal Hocko Cc: Wei Xu Cc: Oscar Salvador Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79c28a41672278283fa72e03d0bf80e6644d4ac4 Author: Dave Hansen Date: Thu Sep 2 14:59:06 2021 -0700 mm/numa: automatically generate node migration order Patch series "Migrate Pages in lieu of discard", v11. We're starting to see systems with more and more kinds of memory such as Intel's implementation of persistent memory. Let's say you have a system with some DRAM and some persistent memory. Today, once DRAM fills up, reclaim will start and some of the DRAM contents will be thrown out. Allocations will, at some point, start falling over to the slower persistent memory. That has two nasty properties. First, the newer allocations can end up in the slower persistent memory. Second, reclaimed data in DRAM are just discarded even if there are gobs of space in persistent memory that could be used. This patchset implements a solution to these problems. At the end of the reclaim process in shrink_page_list() just before the last page refcount is dropped, the page is migrated to persistent memory instead of being dropped. While I've talked about a DRAM/PMEM pairing, this approach would function in any environment where memory tiers exist. This is not perfect. It "strands" pages in slower memory and never brings them back to fast DRAM. Huang Ying has follow-on work which repurposes NUMA balancing to promote hot pages back to DRAM. This is also all based on an upstream mechanism that allows persistent memory to be onlined and used as if it were volatile: http://lkml.kernel.org/r/20190124231441.37A4A305@viggo.jf.intel.com With that, the DRAM and PMEM in each socket will be represented as 2 separate NUMA nodes, with the CPUs sit in the DRAM node. So the general inter-NUMA demotion mechanism introduced in the patchset can migrate the cold DRAM pages to the PMEM node. We have tested the patchset with the postgresql and pgbench. On a 2-socket server machine with DRAM and PMEM, the kernel with the patchset can improve the score of pgbench up to 22.1% compared with that of the DRAM only + disk case. This comes from the reduced disk read throughput (which reduces up to 70.8%). == Open Issues == * Memory policies and cpusets that, for instance, restrict allocations to DRAM can be demoted to PMEM whenever they opt in to this new mechanism. A cgroup-level API to opt-in or opt-out of these migrations will likely be required as a follow-on. * Could be more aggressive about where anon LRU scanning occurs since it no longer necessarily involves I/O. get_scan_count() for instance says: "If we have no swap space, do not bother scanning anon pages" This patch (of 9): Prepare for the kernel to auto-migrate pages to other memory nodes with a node migration table. This allows creating single migration target for each NUMA node to enable the kernel to do NUMA page migrations instead of simply discarding colder pages. A node with no target is a "terminal node", so reclaim acts normally there. The migration target does not fundamentally _need_ to be a single node, but this implementation starts there to limit complexity. When memory fills up on a node, memory contents can be automatically migrated to another node. The biggest problems are knowing when to migrate and to where the migration should be targeted. The most straightforward way to generate the "to where" list would be to follow the page allocator fallback lists. Those lists already tell us if memory is full where to look next. It would also be logical to move memory in that order. But, the allocator fallback lists have a fatal flaw: most nodes appear in all the lists. This would potentially lead to migration cycles (A->B, B->A, A->B, ...). Instead of using the allocator fallback lists directly, keep a separate node migration ordering. But, reuse the same data used to generate page allocator fallback in the first place: find_next_best_node(). This means that the firmware data used to populate node distances essentially dictates the ordering for now. It should also be architecture-neutral since all NUMA architectures have a working find_next_best_node(). RCU is used to allow lock-less read of node_demotion[] and prevent demotion cycles been observed. If multiple reads of node_demotion[] are performed, a single rcu_read_lock() must be held over all reads to ensure no cycles are observed. Details are as follows. === What does RCU provide? === Imagine a simple loop which walks down the demotion path looking for the last node: terminal_node = start_node; while (node_demotion[terminal_node] != NUMA_NO_NODE) { terminal_node = node_demotion[terminal_node]; } The initial values are: node_demotion[0] = 1; node_demotion[1] = NUMA_NO_NODE; and are updated to: node_demotion[0] = NUMA_NO_NODE; node_demotion[1] = 0; What guarantees that the cycle is not observed: node_demotion[0] = 1; node_demotion[1] = 0; and would loop forever? With RCU, a rcu_read_lock/unlock() can be placed around the loop. Since the write side does a synchronize_rcu(), the loop that observed the old contents is known to be complete before the synchronize_rcu() has completed. RCU, combined with disable_all_migrate_targets(), ensures that the old migration state is not visible by the time __set_migration_target_nodes() is called. === What does READ_ONCE() provide? === READ_ONCE() forbids the compiler from merging or reordering successive reads of node_demotion[]. This ensures that any updates are *eventually* observed. Consider the above loop again. The compiler could theoretically read the entirety of node_demotion[] into local storage (registers) and never go back to memory, and *permanently* observe bad values for node_demotion[]. Note: RCU does not provide any universal compiler-ordering guarantees: https://lore.kernel.org/lkml/20150921204327.GH4029@linux.vnet.ibm.com/ This code is unused for now. It will be called later in the series. Link: https://lkml.kernel.org/r/20210721063926.3024591-1-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-1-ying.huang@intel.com Link: https://lkml.kernel.org/r/20210715055145.195411-2-ying.huang@intel.com Signed-off-by: Dave Hansen Signed-off-by: "Huang, Ying" Reviewed-by: Yang Shi Reviewed-by: Zi Yan Reviewed-by: Oscar Salvador Cc: Michal Hocko Cc: Wei Xu Cc: David Rientjes Cc: Dan Williams Cc: David Hildenbrand Cc: Greg Thelen Cc: Keith Busch Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4410cbb5c9f9371556c4e928b5dd00226b073082 Author: Nadav Amit Date: Thu Sep 2 14:59:02 2021 -0700 selftests/vm/userfaultfd: wake after copy failure When userfaultfd copy-ioctl fails since the PTE already exists, an -EEXIST error is returned and the faulting thread is not woken. The current userfaultfd test does not wake the faulting thread in such case. The assumption is presumably that another thread set the PTE through copy/wp ioctl and would wake the faulting thread or that alternatively the fault handler would realize there is no need to "must_wait" and continue. This is not necessarily true. There is an assumption that the "must_wait" tests in handle_userfault() are sufficient to provide definitive answer whether the offending PTE is populated or not. However, userfaultfd_must_wait() test is lockless. Consequently, concurrent calls to ptep_modify_prot_start(), for instance, can clear the PTE and can cause userfaultfd_must_wait() to wrongly assume it is not populated and a wait is needed. There are therefore 3 options: (1) Change the tests to wake on copy failure. (2) Wake faulting thread unconditionally on zero/copy ioctls before returning -EEXIST. (3) Change the userfaultfd_must_wait() to hold locks. This patch took the first approach, but the others are valid solutions with different tradeoffs. Link: https://lkml.kernel.org/r/20210808020724.1022515-4-namit@vmware.com Signed-off-by: Nadav Amit Cc: Jens Axboe Cc: Andrea Arcangeli Cc: Peter Xu Cc: Alexander Viro Cc: Axel Rasmussen Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 Author: Nadav Amit Date: Thu Sep 2 14:58:59 2021 -0700 userfaultfd: prevent concurrent API initialization userfaultfd assumes that the enabled features are set once and never changed after UFFDIO_API ioctl succeeded. However, currently, UFFDIO_API can be called concurrently from two different threads, succeed on both threads and leave userfaultfd's features in non-deterministic state. Theoretically, other uffd operations (ioctl's and page-faults) can be dispatched while adversely affected by such changes of features. Moreover, the writes to ctx->state and ctx->features are not ordered, which can - theoretically, again - let userfaultfd_ioctl() think that userfaultfd API completed, while the features are still not initialized. To avoid races, it is arguably best to get rid of ctx->state. Since there are only 2 states, record the API initialization in ctx->features as the uppermost bit and remove ctx->state. Link: https://lkml.kernel.org/r/20210808020724.1022515-3-namit@vmware.com Fixes: 9cd75c3cd4c3d ("userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor") Signed-off-by: Nadav Amit Cc: Alexander Viro Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Jens Axboe Cc: Mike Rapoport Cc: Peter Xu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a759a909d42d727e918bd5248d6cff7562fa8109 Author: Nadav Amit Date: Thu Sep 2 14:58:56 2021 -0700 userfaultfd: change mmap_changing to atomic Patch series "userfaultfd: minor bug fixes". Three unrelated bug fixes. The first two addresses possible issues (not too theoretical ones), but I did not encounter them in practice. The third patch addresses a test bug that causes the test to fail on my system. It has been sent before as part of a bigger RFC. This patch (of 3): mmap_changing is currently a boolean variable, which is set and cleared without any lock that protects against concurrent modifications. mmap_changing is supposed to mark whether userfaultfd page-faults handling should be retried since mappings are undergoing a change. However, concurrent calls, for instance to madvise(MADV_DONTNEED), might cause mmap_changing to be false, although the remove event was still not read (hence acknowledged) by the user. Change mmap_changing to atomic_t and increase/decrease appropriately. Add a debug assertion to see whether mmap_changing is negative. Link: https://lkml.kernel.org/r/20210808020724.1022515-1-namit@vmware.com Link: https://lkml.kernel.org/r/20210808020724.1022515-2-namit@vmware.com Fixes: df2cc96e77011 ("userfaultfd: prevent non-cooperative events vs mcopy_atomic races") Signed-off-by: Nadav Amit Cc: Mike Rapoport Cc: Peter Xu Cc: Axel Rasmussen Cc: Alexander Viro Cc: Andrea Arcangeli Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09a26e832705fdb7a9484495b71a05e0bbc65207 Author: Mike Kravetz Date: Thu Sep 2 14:58:53 2021 -0700 hugetlb: fix hugetlb cgroup refcounting during vma split Guillaume Morin reported hitting the following WARNING followed by GPF or NULL pointer deference either in cgroups_destroy or in the kill_css path.: percpu ref (css_release) <= 0 (-1) after switching to atomic WARNING: CPU: 23 PID: 130 at lib/percpu-refcount.c:196 percpu_ref_switch_to_atomic_rcu+0x127/0x130 CPU: 23 PID: 130 Comm: ksoftirqd/23 Kdump: loaded Tainted: G O 5.10.60 #1 RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x127/0x130 Call Trace: rcu_core+0x30f/0x530 rcu_core_si+0xe/0x10 __do_softirq+0x103/0x2a2 run_ksoftirqd+0x2b/0x40 smpboot_thread_fn+0x11a/0x170 kthread+0x10a/0x140 ret_from_fork+0x22/0x30 Upon further examination, it was discovered that the css structure was associated with hugetlb reservations. For private hugetlb mappings the vma points to a reserve map that contains a pointer to the css. At mmap time, reservations are set up and a reference to the css is taken. This reference is dropped in the vma close operation; hugetlb_vm_op_close. However, if a vma is split no additional reference to the css is taken yet hugetlb_vm_op_close will be called twice for the split vma resulting in an underflow. Fix by taking another reference in hugetlb_vm_op_open. Note that the reference is only taken for the owner of the reserve map. In the more common fork case, the pointer to the reserve map is cleared for non-owning vmas. Link: https://lkml.kernel.org/r/20210830215015.155224-1-mike.kravetz@oracle.com Fixes: e9fe92ae0cd2 ("hugetlb_cgroup: add reservation accounting for private mappings") Signed-off-by: Mike Kravetz Reported-by: Guillaume Morin Suggested-by: Guillaume Morin Tested-by: Guillaume Morin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e32d20c0c88b1cd0a44f882c4f0eb2f536363d1b Author: Mike Kravetz Date: Thu Sep 2 14:58:50 2021 -0700 hugetlb: before freeing hugetlb page set dtor to appropriate value When removing a hugetlb page from the pool the ref count is set to one (as the free page has no ref count) and compound page destructor is set to NULL_COMPOUND_DTOR. Since a subsequent call to free the hugetlb page will call __free_pages for non-gigantic pages and free_gigantic_page for gigantic pages the destructor is not used. However, consider the following race with code taking a speculative reference on the page: Thread 0 Thread 1 -------- -------- remove_hugetlb_page set_page_refcounted(page); set_compound_page_dtor(page, NULL_COMPOUND_DTOR); get_page_unless_zero(page) __update_and_free_page __free_pages(page, huge_page_order(h)); /* Note that __free_pages() will simply drop the reference to the page. */ put_page(page) __put_compound_page() destroy_compound_page NULL_COMPOUND_DTOR BUG: kernel NULL pointer dereference, address: 0000000000000000 To address this race, set the dtor to the normal compound page dtor for non-gigantic pages. The dtor for gigantic pages does not matter as gigantic pages are changed from a compound page to 'just a group of pages' before freeing. Hence, the destructor is not used. Link: https://lkml.kernel.org/r/20210809184832.18342-4-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Cc: Michal Hocko Cc: Oscar Salvador Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Naoya Horiguchi Cc: Mina Almasry Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b65a4edae11ecd209a0f7c39e856de24678612d9 Author: Mike Kravetz Date: Thu Sep 2 14:58:47 2021 -0700 hugetlb: drop ref count earlier after page allocation When discussing the possibility of inflated page ref counts, Muuchun Song pointed out this potential issue [1]. It is true that any code could potentially take a reference on a compound page after allocation and before it is converted to and put into use as a hugetlb page. Specifically, this could be done by any users of get_page_unless_zero. There are three areas of concern within hugetlb code. 1) When adding pages to the pool. In this case, new pages are allocated added to the pool by calling put_page to invoke the hugetlb destructor (free_huge_page). If there is an inflated ref count on the page, it will not be immediately added to the free list. It will only be added to the free list when the temporary ref count is dropped. This is deemed acceptable and will not be addressed. 2) A page is allocated for immediate use normally as a surplus page or migration target. In this case, the user of the page will also hold a reference. There is no issue as this is just like normal page ref counting. 3) A page is allocated and MUST be added to the free list to satisfy a reservation. One such example is gather_surplus_pages as pointed out by Muchun in [1]. More specifically, this case covers callers of enqueue_huge_page where the page reference count must be zero. This patch covers this third case. Three routines call enqueue_huge_page when the page reference count could potentially be inflated. They are: gather_surplus_pages, alloc_and_dissolve_huge_page and add_hugetlb_page. add_hugetlb_page is called on error paths when a huge page can not be freed due to the inability to allocate vmemmap pages. In this case, the temporairly inflated ref count is not an issue. When the ref is dropped the appropriate action will be taken. Instead of VM_BUG_ON if the ref count does not drop to zero, simply return. In gather_surplus_pages and alloc_and_dissolve_huge_page the caller expects a page (or pages) to be put on the free lists. In this case we must ensure there are no temporary ref counts. We do this by calling put_page_testzero() earlier and not using pages without a zero ref count. The temporary page flag (HPageTemporary) is used in such cases so that as soon as the inflated ref count is dropped the page will be freed. [1] https://lore.kernel.org/linux-mm/CAMZfGtVMn3daKrJwZMaVOGOaJU+B4dS--x_oPmGQMD=c=QNGEg@mail.gmail.com/ Link: https://lkml.kernel.org/r/20210809184832.18342-3-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Michal Hocko Cc: Mina Almasry Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 416d85ed3e08c1164c1405249a94343166837802 Author: Mike Kravetz Date: Thu Sep 2 14:58:43 2021 -0700 hugetlb: simplify prep_compound_gigantic_page ref count racing code Code in prep_compound_gigantic_page waits for a rcu grace period if it notices a temporarily inflated ref count on a tail page. This was due to the identified potential race with speculative page cache references which could only last for a rcu grace period. This is overly complicated as this situation is VERY unlikely to ever happen. Instead, just quickly return an error. Also, only print a warning in prep_compound_gigantic_page instead of multiple callers. Link: https://lkml.kernel.org/r/20210809184832.18342-2-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Michal Hocko Cc: Mina Almasry Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f87060d345232c7d855167a43faf006e24afa999 Author: Michael Wang Date: Thu Sep 2 14:58:40 2021 -0700 mm: fix panic caused by __page_handle_poison() In commit 510d25c92ec4 ("mm/hwpoison: disable pcp for page_handle_poison()"), __page_handle_poison() was introduced, and if we mark: RET_A = dissolve_free_huge_page(); RET_B = take_page_off_buddy(); then __page_handle_poison was supposed to return TRUE When RET_A == 0 && RET_B == TRUE But since it failed to take care the case when RET_A is -EBUSY or -ENOMEM, and just return the ret as a bool which actually become TRUE, it break the original logic. The following result is a huge page in freelist but was referenced as poisoned, and lead into the final panic: kernel BUG at mm/internal.h:95! invalid opcode: 0000 [#1] SMP PTI skip... RIP: 0010:set_page_refcounted mm/internal.h:95 [inline] RIP: 0010:remove_hugetlb_page+0x23c/0x240 mm/hugetlb.c:1371 skip... Call Trace: remove_pool_huge_page+0xe4/0x110 mm/hugetlb.c:1892 return_unused_surplus_pages+0x8d/0x150 mm/hugetlb.c:2272 hugetlb_acct_memory.part.91+0x524/0x690 mm/hugetlb.c:4017 This patch replaces 'bool' with 'int' to handle RET_A correctly. Link: https://lkml.kernel.org/r/61782ac6-1e8a-4f6f-35e6-e94fce3b37f5@linux.alibaba.com Fixes: 510d25c92ec4 ("mm/hwpoison: disable pcp for page_handle_poison()") Signed-off-by: Michael Wang Acked-by: Naoya Horiguchi Reported-by: Abaci Cc: [5.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 941ca063eb8ed01e66336b1f493e95b107024bc8 Author: Yang Shi Date: Thu Sep 2 14:58:37 2021 -0700 mm: hwpoison: dump page for unhandlable page Currently just very simple message is shown for unhandlable page, e.g. non-LRU page, like: soft_offline: 0x1469f2: unknown non LRU page type 5ffff0000000000 () It is not very helpful for further debug, calling dump_page() could show more useful information. Calling dump_page() in get_any_page() in order to not duplicate the call in a couple of different places. It may be called with pcp disabled and holding memory hotplug lock, it should be not a big deal since hwpoison handler is not called very often. [shy828301@gmail.com: remove redundant pr_info per Noaya Horiguchi] Link: https://lkml.kernel.org/r/20210824020946.195257-3-shy828301@gmail.com Link: https://lkml.kernel.org/r/20210819054116.266126-3-shy828301@gmail.com Signed-off-by: Yang Shi Suggested-by: Matthew Wilcox Acked-by: Naoya Horiguchi Reviewed-by: David Hildenbrand Cc: Oscar Salvador Cc: David Mackey Cc: Jonathan Corbet Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f6533121696b2126a33b436f433a048b4427944f Author: Yang Shi Date: Thu Sep 2 14:58:34 2021 -0700 doc: hwpoison: correct the support for hugepage The hwpoison support for huge page, both hugetlb and THP, has been in kernel for a while, the statement in document is obsolete, correct it. Link: https://lkml.kernel.org/r/20210819054116.266126-2-shy828301@gmail.com Signed-off-by: Yang Shi Acked-by: Naoya Horiguchi Reviewed-by: David Hildenbrand Cc: Oscar Salvador Cc: David Mackey Cc: Jonathan Corbet Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d0505e9f7dcec85da6634ec66da2b17656ee177b Author: Yang Shi Date: Thu Sep 2 14:58:31 2021 -0700 mm: hwpoison: don't drop slab caches for offlining non-LRU page In the current implementation of soft offline, if non-LRU page is met, all the slab caches will be dropped to free the page then offline. But if the page is not slab page all the effort is wasted in vain. Even though it is a slab page, it is not guaranteed the page could be freed at all. However the side effect and cost is quite high. It does not only drop the slab caches, but also may drop a significant amount of page caches which are associated with inode caches. It could make the most workingset gone in order to just offline a page. And the offline is not guaranteed to succeed at all, actually I really doubt the success rate for real life workload. Furthermore the worse consequence is the system may be locked up and unusable since the page cache release may incur huge amount of works queued for memcg release. Actually we ran into such unpleasant case in our production environment. Firstly, the workqueue of memory_failure_work_func is locked up as below: BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 53s! Showing busy workqueues and worker pools: workqueue events: flags=0x0 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=14/256 refcnt=15 in-flight: 409271:memory_failure_work_func pending: kfree_rcu_work, kfree_rcu_monitor, kfree_rcu_work, rht_deferred_worker, rht_deferred_worker, rht_deferred_worker, rht_deferred_worker, kfree_rcu_work, kfree_rcu_work, kfree_rcu_work, kfree_rcu_work, drain_local_stock, kfree_rcu_work workqueue mm_percpu_wq: flags=0x8 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: vmstat_update workqueue cgroup_destroy: flags=0x0 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=12072 pending: css_release_work_fn There were over 12K css_release_work_fn queued, and this caused a few lockups due to the contention of worker pool lock with IRQ disabled, for example: NMI watchdog: Watchdog detected hard LOCKUP on cpu 1 Modules linked in: amd64_edac_mod edac_mce_amd crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xt_DSCP iptable_mangle kvm_amd bpfilter vfat fat acpi_ipmi i2c_piix4 usb_storage ipmi_si k10temp i2c_core ipmi_devintf ipmi_msghandler acpi_cpufreq sch_fq_codel xfs libcrc32c crc32c_intel mlx5_core mlxfw nvme xhci_pci ptp nvme_core pps_core xhci_hcd CPU: 1 PID: 205500 Comm: kworker/1:0 Tainted: G L 5.10.32-t1.el7.twitter.x86_64 #1 Hardware name: TYAN F5AMT /z /S8026GM2NRE-CGN, BIOS V8.030 03/30/2021 Workqueue: events memory_failure_work_func RIP: 0010:queued_spin_lock_slowpath+0x41/0x1a0 Code: 41 f0 0f ba 2f 08 0f 92 c0 0f b6 c0 c1 e0 08 89 c2 8b 07 30 e4 09 d0 a9 00 01 ff ff 75 1b 85 c0 74 0e 8b 07 84 c0 74 08 f3 90 <8b> 07 84 c0 75 f8 b8 01 00 00 00 66 89 07 c3 f6 c4 01 75 04 c6 47 RSP: 0018:ffff9b2ac278f900 EFLAGS: 00000002 RAX: 0000000000480101 RBX: ffff8ce98ce71800 RCX: 0000000000000084 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8ce98ce6a140 RBP: 00000000000284c8 R08: ffffd7248dcb6808 R09: 0000000000000000 R10: 0000000000000003 R11: ffff9b2ac278f9b0 R12: 0000000000000001 R13: ffff8cb44dab9c00 R14: ffffffffbd1ce6a0 R15: ffff8cacaa37f068 FS: 0000000000000000(0000) GS:ffff8ce98ce40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcf6e8cb000 CR3: 0000000a0c60a000 CR4: 0000000000350ee0 Call Trace: __queue_work+0xd6/0x3c0 queue_work_on+0x1c/0x30 uncharge_batch+0x10e/0x110 mem_cgroup_uncharge_list+0x6d/0x80 release_pages+0x37f/0x3f0 __pagevec_release+0x1c/0x50 __invalidate_mapping_pages+0x348/0x380 inode_lru_isolate+0x10a/0x160 __list_lru_walk_one+0x7b/0x170 list_lru_walk_one+0x4a/0x60 prune_icache_sb+0x37/0x50 super_cache_scan+0x123/0x1a0 do_shrink_slab+0x10c/0x2c0 shrink_slab+0x1f1/0x290 drop_slab_node+0x4d/0x70 soft_offline_page+0x1ac/0x5b0 memory_failure_work_func+0x6a/0x90 process_one_work+0x19e/0x340 worker_thread+0x30/0x360 kthread+0x116/0x130 The lockup made the machine is quite unusable. And it also made the most workingset gone, the reclaimabled slab caches were reduced from 12G to 300MB, the page caches were decreased from 17G to 4G. But the most disappointing thing is all the effort doesn't make the page offline, it just returns: soft_offline: 0x1469f2: unknown non LRU page type 5ffff0000000000 () It seems the aggressive behavior for non-LRU page didn't pay back, so it doesn't make too much sense to keep it considering the terrible side effect. Link: https://lkml.kernel.org/r/20210819054116.266126-1-shy828301@gmail.com Signed-off-by: Yang Shi Reported-by: David Mackey Acked-by: David Hildenbrand Acked-by: Naoya Horiguchi Cc: Oscar Salvador Cc: Matthew Wilcox (Oracle) Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a21c184fe25eab36fb6efabae55333452171d53b Author: Miaohe Lin Date: Thu Sep 2 14:58:28 2021 -0700 mm/hwpoison: fix some obsolete comments Since commit cb731d6c62bb ("vmscan: per memory cgroup slab shrinkers"), shrink_node_slabs is renamed to drop_slab_node. And doit argument is changed to forcekill since commit 6751ed65dc66 ("x86/mce: Fix siginfo_t->si_addr value for non-recoverable memory faults"). Link: https://lkml.kernel.org/r/20210814105131.48814-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ed8c2f492d4e7248a9c0493c444c47bed84d345d Author: Miaohe Lin Date: Thu Sep 2 14:58:25 2021 -0700 mm/hwpoison: change argument struct page **hpagep to *hpage It's unnecessary to pass in a struct page **hpagep because it's never modified. Changing to use *hpage to simplify the code. Link: https://lkml.kernel.org/r/20210814105131.48814-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ea3732f7a1cf636284388988d1a1e56d5cba6044 Author: Miaohe Lin Date: Thu Sep 2 14:58:22 2021 -0700 mm/hwpoison: fix potential pte_unmap_unlock pte error If the first pte is equal to poisoned_pfn, i.e. check_hwpoisoned_entry() return 1, the wrong ptep - 1 would be passed to pte_unmap_unlock(). Link: https://lkml.kernel.org/r/20210814105131.48814-3-linmiaohe@huawei.com Fixes: ad9c59c24095 ("mm,hwpoison: send SIGBUS with error virutal address") Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae611d072c5c2968e2cc29431cf58094d8971b94 Author: Miaohe Lin Date: Thu Sep 2 14:58:19 2021 -0700 mm/hwpoison: remove unneeded variable unmap_success Patch series "Cleanups and fixup for hwpoison" This series contains cleanups to remove unneeded variable, fix some obsolete comments and so on. Also we fix potential pte_unmap_unlock on wrong pte. More details can be found in the respective changelogs. This patch (of 4): unmap_success is used to indicate whether page is successfully unmapped but it's irrelated with ZONE_DEVICE page and unmap_success is always true here. Remove this unneeded one. Link: https://lkml.kernel.org/r/20210814105131.48814-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210814105131.48814-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d09510bcc6bc00ed406f0d65e39ab3b734f124b Author: George G. Davis Date: Thu Sep 2 14:58:16 2021 -0700 mm/page_isolation: tracing: trace all test_pages_isolated failures Some test_pages_isolated failure conditions don't include trace points. For debugging issues caused by "pinned" pages, make sure to trace all calls whether they succeed or fail. In this case, a failure case did not result in a trace point. So add the missing failure case in test_pages_isolated traces. Link: https://lkml.kernel.org/r/20210823202823.13765-1-george_davis@mentor.com Signed-off-by: George G. Davis Cc: Eugeniu Rosca Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 88dc6f208829cfdbc0b96495c5c73a6af0559300 Author: Vasily Averin Date: Thu Sep 2 14:58:13 2021 -0700 mm/page_alloc.c: use in_task() Obsoleted in_intrrupt() include task context with disabled BH, it's better to use in_task() instead. Link: https://lkml.kernel.org/r/877caa99-1994-5545-92d2-d0bb2e394182@virtuozzo.com Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3b446da6be7a722d769e23f68dbaf4ebb2eda542 Author: Mike Rapoport Date: Thu Sep 2 14:58:10 2021 -0700 mm/page_alloc: make alloc_node_mem_map() __init rather than __ref alloc_node_mem_map() is never only called from free_area_init_node() that is an __init function. Make the actual alloc_node_mem_map() also __init and its stub version static inline. Link: https://lkml.kernel.org/r/20210716064124.31865-1-rppt@kernel.org Signed-off-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b346075fcf5dda7f9e9ae671703aae60e8a94564 Author: Nico Pache Date: Thu Sep 2 14:58:08 2021 -0700 mm/page_alloc.c: fix 'zone_id' may be used uninitialized in this function warning When compiling with -Werror, cc1 will warn that 'zone_id' may be used uninitialized in this function warning. Initialize the zone_id as 0. Its safe to assume that if the code reaches this point it has at least one numa node with memory, so no need for an assertion before init_unavilable_range. Link: https://lkml.kernel.org/r/20210716210336.1114114-1-npache@redhat.com Fixes: 122e093c1734 ("mm/page_alloc: fix memory map initialization for descending nodes") Signed-off-by: Nico Pache Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 08678804e0b305bbbf5b756ad365373e5fe885a2 Author: Mike Rapoport Date: Thu Sep 2 14:58:05 2021 -0700 memblock: stop poisoning raw allocations Functions memblock_alloc_exact_nid_raw() and memblock_alloc_try_nid_raw() are intended for early memory allocation without overhead of zeroing the allocated memory. Since these functions were used to allocate the memory map, they have ended up with addition of a call to page_init_poison() that poisoned the allocated memory when CONFIG_PAGE_POISON was set. Since the memory map is allocated using a dedicated memmep_alloc() function that takes care of the poisoning, remove page poisoning from the memblock_alloc_*_raw() functions. Link: https://lkml.kernel.org/r/20210714123739.16493-5-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Michal Simek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c803b3c8b3b70f306ee6300bf8acdd70ffd1441a Author: Mike Rapoport Date: Thu Sep 2 14:58:02 2021 -0700 mm: introduce memmap_alloc() to unify memory map allocation There are several places that allocate memory for the memory map: alloc_node_mem_map() for FLATMEM, sparse_buffer_init() and __populate_section_memmap() for SPARSEMEM. The memory allocated in the FLATMEM case is zeroed and it is never poisoned, regardless of CONFIG_PAGE_POISON setting. The memory allocated in the SPARSEMEM cases is not zeroed and it is implicitly poisoned inside memblock if CONFIG_PAGE_POISON is set. Introduce memmap_alloc() wrapper for memblock allocators that will be used for both FLATMEM and SPARSEMEM cases and will makei memory map zeroing and poisoning consistent for different memory models. Link: https://lkml.kernel.org/r/20210714123739.16493-4-rppt@kernel.org Signed-off-by: Mike Rapoport Cc: Michal Simek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22e7878102f94a50e9a4c2c19f909a9a0898c4ce Author: Mike Rapoport Date: Thu Sep 2 14:57:59 2021 -0700 microblaze: simplify pte_alloc_one_kernel() The microblaze's implementation of pte_alloc_one_kernel() used memblock_alloc_try_nid_raw() along with clear_page() to allocated a zeroed page during early setup. Replace calls of these functions with a call to memblock_alloc_try_nid() that already returns zeroed page and respects the same allocation limits as memblock_alloc_try_nid_raw(). While on it drop early_get_page() wrapper that was only used in pte_alloc_one_kernel(). Link: https://lkml.kernel.org/r/20210714123739.16493-3-rppt@kernel.org Signed-off-by: Mike Rapoport Reviewed-by: David Hildenbrand Cc: Michal Simek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c3ab6baf6a004eab7344a1d8880a971f2414e1b6 Author: Mike Rapoport Date: Thu Sep 2 14:57:56 2021 -0700 mm/page_alloc: always initialize memory map for the holes Patch series "mm: ensure consistency of memory map poisoning". Currently memory map allocation for FLATMEM case does not poison the struct pages regardless of CONFIG_PAGE_POISON setting. This happens because allocation of the memory map for FLATMEM and SPARSMEM use different memblock functions and those that are used for SPARSMEM case (namely memblock_alloc_try_nid_raw() and memblock_alloc_exact_nid_raw()) implicitly poison the allocated memory. Another side effect of this implicit poisoning is that early setup code that uses the same functions to allocate memory burns cycles for the memory poisoning even if it was not intended. These patches introduce memmap_alloc() wrapper that ensure that the memory map allocation is consistent for different memory models. This patch (of 4): Currently memory map for the holes is initialized only when SPARSEMEM memory model is used. Yet, even with FLATMEM there could be holes in the physical memory layout that have memory map entries. For instance, the memory reserved using e820 API on i386 or "reserved-memory" nodes in device tree would not appear in memblock.memory and hence the struct pages for such holes will be skipped during memory map initialization. These struct pages will be zeroed because the memory map for FLATMEM systems is allocated with memblock_alloc_node() that clears the allocated memory. While zeroed struct pages do not cause immediate problems, the correct behaviour is to initialize every page using __init_single_page(). Besides, enabling page poison for FLATMEM case will trigger PF_POISONED_CHECK() unless the memory map is properly initialized. Make sure init_unavailable_range() is called for both SPARSEMEM and FLATMEM so that struct pages representing memory holes would appear as PG_Reserved with any memory layout. [rppt@kernel.org: fix microblaze] Link: https://lkml.kernel.org/r/YQWW3RCE4eWBuMu/@kernel.org Link: https://lkml.kernel.org/r/20210714123739.16493-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20210714123739.16493-2-rppt@kernel.org Signed-off-by: Mike Rapoport Acked-by: David Hildenbrand Tested-by: Guenter Roeck Cc: Michal Simek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f16de0bcdb55bf18e2533ca625f3e4b4952f254c Author: Andrey Konovalov Date: Thu Sep 2 14:57:53 2021 -0700 kasan: test: avoid corrupting memory in kasan_rcu_uaf kasan_rcu_uaf() writes to freed memory via kasan_rcu_reclaim(), which is only safe with the GENERIC mode (as it uses quarantine). For other modes, this test corrupts kernel memory, which might result in a crash. Turn the write into a read. Link: https://lkml.kernel.org/r/b6f2c3bf712d2457c783fa59498225b66a634f62.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 756e5a47a5ddf0caa3708f922385a92af9d330b5 Author: Andrey Konovalov Date: Thu Sep 2 14:57:50 2021 -0700 kasan: test: avoid corrupting memory in copy_user_test copy_user_test() does writes past the allocated object. As the result, it corrupts kernel memory, which might lead to crashes with the HW_TAGS mode, as it neither uses quarantine nor redzones. (Technically, this test can't yet be enabled with the HW_TAGS mode, but this will be implemented in the future.) Adjust the test to only write memory within the aligned kmalloc object. Link: https://lkml.kernel.org/r/19bf3a5112ee65b7db88dc731643b657b816c5e8.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b38fcca339dbcf680c9e43054502608fabc81508 Author: Andrey Konovalov Date: Thu Sep 2 14:57:47 2021 -0700 kasan: test: clean up ksize_uaf Some KASAN tests use global variables to store function returns values so that the compiler doesn't optimize away these functions. ksize_uaf() doesn't call any functions, so it doesn't need to use kasan_int_result. Use volatile accesses instead, to be consistent with other similar tests. Link: https://lkml.kernel.org/r/a1fc34faca4650f4a6e4dfb3f8d8d82c82eb953a.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 25b12a58e848459ae2dbf2e7d318ef168bd1c5e2 Author: Andrey Konovalov Date: Thu Sep 2 14:57:44 2021 -0700 kasan: test: only do kmalloc_uaf_memset for generic mode kmalloc_uaf_memset() writes to freed memory, which is only safe with the GENERIC mode (as it uses quarantine). For other modes, this test corrupts kernel memory, which might result in a crash. Only enable kmalloc_uaf_memset() for the GENERIC mode. Link: https://lkml.kernel.org/r/2e1c87b607b1292556cde3cab2764f108542b60c.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b0668be62cfa394903bb368641c80533bf42d5a Author: Andrey Konovalov Date: Thu Sep 2 14:57:41 2021 -0700 kasan: test: disable kmalloc_memmove_invalid_size for HW_TAGS The HW_TAGS mode doesn't check memmove for negative size. As a result, the kmalloc_memmove_invalid_size test corrupts memory, which can result in a crash. Disable this test with HW_TAGS KASAN. Link: https://lkml.kernel.org/r/088733a06ac21eba29aa85b6f769d2abd74f9638.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 555999a009aacd90ea51a6690e8eb2a5d0427edc Author: Andrey Konovalov Date: Thu Sep 2 14:57:38 2021 -0700 kasan: test: avoid corrupting memory via memset kmalloc_oob_memset_*() tests do writes past the allocated objects. As the result, they corrupt memory, which might lead to crashes with the HW_TAGS mode, as it neither uses quarantine nor redzones. Adjust the tests to only write memory within the aligned kmalloc objects. Also add a comment mentioning that memset tests are designed to touch both valid and invalid memory. Link: https://lkml.kernel.org/r/64fd457668a16e7b58d094f14a165f9d5170c5a9.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8fbad19bdcb4b9be8131536e5bb9616ab2e4eeb3 Author: Andrey Konovalov Date: Thu Sep 2 14:57:35 2021 -0700 kasan: test: avoid writing invalid memory Multiple KASAN tests do writes past the allocated objects or writes to freed memory. Turn these writes into reads to avoid corrupting memory. Otherwise, these tests might lead to crashes with the HW_TAGS mode, as it neither uses quarantine nor redzones. Link: https://lkml.kernel.org/r/c3cd2a383e757e27dd9131635fc7d09a48a49cf9.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ab512805710fa0e4ec6b61fee8a52d044a060009 Author: Andrey Konovalov Date: Thu Sep 2 14:57:32 2021 -0700 kasan: test: rework kmalloc_oob_right Patch series "kasan: test: avoid crashing the kernel with HW_TAGS", v2. KASAN tests do out-of-bounds and use-after-free accesses. Running the tests works fine for the GENERIC mode, as it uses qurantine and redzones. But the HW_TAGS mode uses neither, and running the tests might crash the kernel. Rework the tests to avoid corrupting kernel memory. This patch (of 8): Rework kmalloc_oob_right() to do these bad access checks: 1. An unaligned access one byte past the requested kmalloc size (can only be detected by KASAN_GENERIC). 2. An aligned access into the first out-of-bounds granule that falls within the aligned kmalloc object. 3. Out-of-bounds access past the aligned kmalloc object. Test #3 deliberately uses a read access to avoid corrupting memory. Otherwise, this test might lead to crashes with the HW_TAGS mode, as it neither uses quarantine nor redzones. Link: https://lkml.kernel.org/r/cover.1628779805.git.andreyknvl@gmail.com Link: https://lkml.kernel.org/r/474aa8b7b538c6737a4c6d0090350af2e1776bef.1628779805.git.andreyknvl@gmail.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c9d1af2b780a7077d253047ccc81c5253cf0974a Author: Woody Lin Date: Thu Sep 2 14:57:29 2021 -0700 mm/kasan: move kasan.fault to mm/kasan/report.c Move the boot parameter 'kasan.fault' from hw_tags.c to report.c, so it can support all KASAN modes - generic, and both tag-based. Link: https://lkml.kernel.org/r/20210713010536.3161822-1-woodylin@google.com Signed-off-by: Woody Lin Reviewed-by: Marco Elver Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f181234a5a21fd0a86b793330016b92c7b3ed8ee Author: Chen Wandun Date: Thu Sep 2 14:57:26 2021 -0700 mm/vmalloc: fix wrong behavior in vread commit f608788cd2d6 ("mm/vmalloc: use rb_tree instead of list for vread() lookups") use rb_tree instread of list to speed up lookup, but function __find_vmap_area is try to find a vmap_area that include target address, if target address is smaller than the leftmost node in vmap_area_root, it will return NULL, then vread will read nothing. This behavior is different from the primitive semantics. The correct way is find the first vmap_are that bigger than target addr, that is what function find_vmap_area_exceed_addr does. Link: https://lkml.kernel.org/r/20210714015959.3204871-1-chenwandun@huawei.com Fixes: f608788cd2d6 ("mm/vmalloc: use rb_tree instead of list for vread() lookups") Signed-off-by: Chen Wandun Reported-by: Hulk Robot Cc: Serapheim Dimitropoulos Cc: Uladzislau Rezki (Sony) Cc: Kefeng Wang Cc: Wei Yongjun Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f8bcbecfb6b48c026e2205679c063d1f16f5a2c0 Author: Uladzislau Rezki (Sony) Date: Thu Sep 2 14:57:23 2021 -0700 lib/test_vmalloc.c: add a new 'nr_pages' parameter In order to simulate different fixed sizes for vmalloc allocation introduce a new parameter that sets number of pages to be allocated for the "fix_size_alloc_test" test. By default 1 page is used unless a different number is specified over the new parameter. Link: https://lkml.kernel.org/r/20210710194151.21370-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Mel Gorman Cc: Christoph Hellwig Cc: Matthew Wilcox Cc: Nicholas Piggin Cc: Hillf Danton Cc: Michal Hocko Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12e376a6f859a000308b6c7cf4a2493eda2bb026 Author: Uladzislau Rezki (Sony) Date: Thu Sep 2 14:57:19 2021 -0700 mm/vmalloc: remove gfpflags_allow_blocking() check Get rid of gfpflags_allow_blocking() check from the vmalloc() path as it is supposed to be sleepable anyway. Thus remove it from the alloc_vmap_area() as well as from the vm_area_alloc_pages(). Link: https://lkml.kernel.org/r/20210707182639.31282-2-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Cc: Mel Gorman Cc: Christoph Hellwig Cc: Matthew Wilcox Cc: Nicholas Piggin Cc: Hillf Danton Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 343ab8178f318b6006d54865972ff9c433b29e10 Author: Uladzislau Rezki (Sony) Date: Thu Sep 2 14:57:16 2021 -0700 mm/vmalloc: use batched page requests in bulk-allocator In case of simultaneous vmalloc allocations, for example it is 1GB and 12 CPUs my system is able to hit "BUG: soft lockup" for !CONFIG_PREEMPT kernel. RIP: 0010:__alloc_pages_bulk+0xa9f/0xbb0 Call Trace: __vmalloc_node_range+0x11c/0x2d0 __vmalloc_node+0x4b/0x70 fix_size_alloc_test+0x44/0x60 [test_vmalloc] test_func+0xe7/0x1f0 [test_vmalloc] kthread+0x11a/0x140 ret_from_fork+0x22/0x30 To address this issue invoke a bulk-allocator many times until all pages are obtained, i.e. do batched page requests adding cond_resched() meanwhile to reschedule. Batched value is hard-coded and is 100 pages per call. Link: https://lkml.kernel.org/r/20210707182639.31282-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Cc: Christoph Hellwig Cc: Hillf Danton Cc: Matthew Wilcox Cc: Mel Gorman Cc: Nicholas Piggin Cc: Oleksiy Avramchenko Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bdbda735508ca83341899a77f143e4d5c58007b3 Author: Miles Chen Date: Thu Sep 2 14:57:13 2021 -0700 mm/sparse: clarify pgdat_to_phys Clarify pgdat_to_phys() by testing if pgdat == &contig_page_data when CONFIG_NUMA=n. We only expect contig_page_data in such case, so we use &contig_page_data directly instead of pgdat. No functional change intended when CONFIG_BUG_VM=n. Comment from Mark [1]: " ... and I reckon it'd be clearer and more robust to define pgdat_to_phys() in the same ifdefs as contig_page_data so that these, stay in-sync. e.g. have: | #ifdef CONFIG_NUMA | #define pgdat_to_phys(x) virt_to_phys(x) | #else /* CONFIG_NUMA */ | | extern struct pglist_data contig_page_data; | ... | #define pgdat_to_phys(x) __pa_symbol(&contig_page_data) | | #endif /* CONIFIG_NUMA */ " [1] https://lore.kernel.org/linux-arm-kernel/20210615131902.GB47121@C02TD0UTHF1T.local/ Link: https://lkml.kernel.org/r/20210723123342.26406-1-miles.chen@mediatek.com Signed-off-by: Miles Chen Reviewed-by: David Hildenbrand Acked-by: Mike Rapoport Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0dbb2bccf19ce5e870afb420a3d0480c582bb7b Author: Matthew Wilcox Date: Thu Sep 2 14:57:10 2021 -0700 include/linux/mmzone.h: avoid a warning in sparse memory support cppcheck warns that we're possibly losing information by shifting an int. It's a false positive, because we don't allow for a NUMA node ID that large, but if we ever change SECTION_NID_SHIFT, it could become a problem, and in any case this is usually a legitimate warning. Fix it by adding the necessary cast, which makes the compiler generate the right code. Link: https://lkml.kernel.org/r/YOya+aBZFFmC476e@casper.infradead.org Link: https://lkml.kernel.org/r/202107130348.6LsVT9Nc-lkp@intel.com Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 01c8d337d195ed105cabab95bc4dcb9e145bf5ea Author: Naoya Horiguchi Date: Thu Sep 2 14:57:07 2021 -0700 mm/sparse: set SECTION_NID_SHIFT to 6 Currently SECTION_NID_SHIFT is set to 3, which is incorrect because bit 3 and 4 can be overlapped by sub-field for early NID, and can be unexpectedly set on NUMA systems. There are a few non-critical issues related to this: - Having SECTION_TAINT_ZONE_DEVICE set for wrong sections forces pfn_to_online_page() through the slow path, but doesn't actually break the kernel. - A kdump generation tool like makedumpfile uses this field to calculate the physical address to read. So wrong bits can make the tool access to wrong address and fail to create kdump. This can be avoided by the tool, so it's not critical. To fix it, set SECTION_NID_SHIFT to 6 which is the minimum number of available bits of section flag field. Link: https://lkml.kernel.org/r/20210707045548.810271-1-naoya.horiguchi@linux.dev Fixes: 1f90a3477df3 ("mm: teach pfn_to_online_page() about ZONE_DEVICE section collisions") Signed-off-by: Naoya Horiguchi Reported-by: Kazuhito Hagio Suggested-by: Dan Williams Acked-by: David Hildenbrand Cc: Oscar Salvador Cc: Wang Wensheng Cc: Rui Xiang Cc: Kazu Cc: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 11e02d3729da1a2d4a33db5ea61291770d411884 Author: Ohhoon Kwon Date: Thu Sep 2 14:57:04 2021 -0700 mm: sparse: remove __section_nr() function As the last users of __section_nr() are gone, let's remove unused function __section_nr(). Link: https://lkml.kernel.org/r/20210707150212.855-4-ohoono.kwon@samsung.com Signed-off-by: Ohhoon Kwon Acked-by: Michal Hocko Acked-by: Mike Rapoport Reviewed-by: David Hildenbrand Cc: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fc1f5e980a463325cf41d39ac6a69aa3cca73995 Author: Ohhoon Kwon Date: Thu Sep 2 14:57:01 2021 -0700 mm: sparse: pass section_nr to find_memory_block With CONFIG_SPARSEMEM_EXTREME enabled, __section_nr() which converts mem_section to section_nr could be costly since it iterates all section roots to check if the given mem_section is in its range. On the other hand, __nr_to_section() which converts section_nr to mem_section can be done in O(1). Let's pass section_nr instead of mem_section ptr to find_memory_block() in order to reduce needless iterations. Link: https://lkml.kernel.org/r/20210707150212.855-3-ohoono.kwon@samsung.com Signed-off-by: Ohhoon Kwon Acked-by: Michal Hocko Acked-by: Mike Rapoport Reviewed-by: David Hildenbrand Cc: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a1bc561bb2d3d9b944878955095f53aeba30a166 Author: Ohhoon Kwon Date: Thu Sep 2 14:56:58 2021 -0700 mm: sparse: pass section_nr to section_mark_present Patch series "mm: sparse: remove __section_nr() function", v4. This patch (of 3): With CONFIG_SPARSEMEM_EXTREME enabled, __section_nr() which converts mem_section to section_nr could be costly since it iterates all section roots to check if the given mem_section is in its range. Since both callers of section_mark_present already know section_nr, let's also pass section_nr as well as mem_section in order to reduce costly translation. Link: https://lkml.kernel.org/r/20210707150212.855-1-ohoono.kwon@samsung.com Link: https://lkml.kernel.org/r/20210707150212.855-2-ohoono.kwon@samsung.com Signed-off-by: Ohhoon Kwon Acked-by: Mike Rapoport Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cdcfc631c80e716d4b3bf534471273456bb99556 Author: Muchun Song Date: Thu Sep 2 14:56:55 2021 -0700 mm/bootmem_info.c: mark __init on register_page_bootmem_info_section register_page_bootmem_info_section() is only called from __init functions, so mark it __init as well. Link: https://lkml.kernel.org/r/20210817042221.77172-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: David Hildenbrand Cc: Oscar Salvador Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e22928abe671ea1541f19afb80523442938d342 Author: Chen Wandun Date: Thu Sep 2 14:56:52 2021 -0700 mm/mremap: fix memory account on do_munmap() failure mremap will account the delta between new_len and old_len in vma_to_resize, and then call move_vma when expanding an existing memory mapping. In function move_vma, there are two scenarios when calling do_munmap: 1. move_page_tables from old_addr to new_addr success 2. move_page_tables from old_addr to new_addr fail In first scenario, it should account old_len if do_munmap fail, because the delta has already been accounted. In second scenario, new_addr/new_len will assign to old_addr/old_len if move_page_table fail, so do_munmap is try to unmap new_addr actually, if do_munmap fail, it should account the new_len, because error code will be return from move_vma, and delta will be unaccounted. What'more, because of new_len == old_len, so account old_len also is OK. In summary, account old_len will be correct if do_munmap fail. Link: https://lkml.kernel.org/r/20210717101942.120607-1-chenwandun@huawei.com Fixes: 51df7bcb6151 ("mm/mremap: account memory on do_munmap() failure") Signed-off-by: Chen Wandun Acked-by: Dmitry Safonov Cc: Kefeng Wang Cc: Wei Yongjun Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b593cb20283e68e5e65b09ca10038935297f05b Author: Liam R. Howlett Date: Thu Sep 2 14:56:49 2021 -0700 remap_file_pages: Use vma_lookup() instead of find_vma() Using vma_lookup() verifies the start address is contained in the found vma. This results in easier to read code. Link: https://lkml.kernel.org/r/20210817135234.1550204-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b78ed24e8ec48602c1d6f5a188e58d000c81e2b Author: Luigi Rizzo Date: Thu Sep 2 14:56:46 2021 -0700 mm/pagemap: add mmap_assert_locked() annotations to find_vma*() find_vma() and variants need protection when used. This patch adds mmap_assert_lock() calls in the functions. To make sure the invariant is satisfied, we also need to add a mmap_read_lock() around the get_user_pages_remote() call in get_arg_page(). The lock is not strictly necessary because the mm has been newly created, but the extra cost is limited because the same mutex was also acquired shortly before in __bprm_mm_init(), so it is hot and uncontended. [penguin-kernel@i-love.sakura.ne.jp: TOMOYO needs the same protection which get_arg_page() needs] Link: https://lkml.kernel.org/r/58bb6bf7-a57e-8a40-e74b-39584b415152@i-love.sakura.ne.jp Link: https://lkml.kernel.org/r/20210731175341.3458608-1-lrizzo@google.com Signed-off-by: Luigi Rizzo Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e15710bf04063766f428048f4dad7b73b646203f Author: Greg Kroah-Hartman Date: Thu Sep 2 14:56:43 2021 -0700 mm: change fault_in_pages_* to have an unsigned size parameter fault_in_pages_writeable() and fault_in_pages_readable() treat the size parameter as unsigned, doing pointer math with the value, so make this explicit and set it to be a size_t type which all callers currently treat it as anyway. This solves the issue where static checkers get nervous seeing pointer arithmetic happening with a signed value. Link: https://lkml.kernel.org/r/20210727111136.457638-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman Reported-by: Jordy Zomer Cc: Matthew Wilcox Cc: David Howells Cc: William Kucharski Cc: "Darrick J. Wong" Cc: Hugh Dickins Cc: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f00230ff8411eaecbea1f2e528e205424f3725ba Author: Huang Ying Date: Thu Sep 2 14:56:40 2021 -0700 mm,do_huge_pmd_numa_page: remove unnecessary TLB flushing code Before commit c5b5a3dd2c1f ("mm: thp: refactor NUMA fault handling"), the TLB flushing is done in do_huge_pmd_numa_page() itself via flush_tlb_range(). But after commit c5b5a3dd2c1f ("mm: thp: refactor NUMA fault handling"), the TLB flushing is done in migrate_pages() as in the following code path anyway. do_huge_pmd_numa_page migrate_misplaced_page migrate_pages So now, the TLB flushing code in do_huge_pmd_numa_page() becomes unnecessary. So the code is deleted in this patch to simplify the code. This is only code cleanup, there's no visible performance difference. The mmu_notifier_invalidate_range() in do_huge_pmd_numa_page() is deleted too. Because migrate_pages() takes care of that too when CPU TLB is flushed. Link: https://lkml.kernel.org/r/20210720065529.716031-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Zi Yan Reviewed-by: Yang Shi Cc: Dan Carpenter Cc: Mel Gorman Cc: Christian Borntraeger Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Hugh Dickins Cc: Andrea Arcangeli Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Vasily Gorbik Cc: Paolo Bonzini Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f358afc52c3066f4e8cd7b3a2d75b31e822519e9 Author: Christoph Hellwig Date: Thu Sep 2 14:56:36 2021 -0700 mm: remove flush_kernel_dcache_page flush_kernel_dcache_page is a rather confusing interface that implements a subset of flush_dcache_page by not being able to properly handle page cache mapped pages. The only callers left are in the exec code as all other previous callers were incorrect as they could have dealt with page cache pages. Replace the calls to flush_kernel_dcache_page with calls to flush_dcache_page, which for all architectures does either exactly the same thing, can contains one or more of the following: 1) an optimization to defer the cache flush for page cache pages not mapped into userspace 2) additional flushing for mapped page cache pages if cache aliases are possible Link: https://lkml.kernel.org/r/20210712060928.4161649-7-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Linus Torvalds Reviewed-by: Ira Weiny Cc: Alex Shi Cc: Geoff Levand Cc: Greentime Hu Cc: Guo Ren Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Nick Hu Cc: Paul Cercueil Cc: Rich Felker Cc: Russell King Cc: Thomas Bogendoerfer Cc: Ulf Hansson Cc: Vincent Chen Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0e84f5dbf8d6c33d685c45300da55bafd5dd786e Author: Christoph Hellwig Date: Thu Sep 2 14:56:33 2021 -0700 scatterlist: replace flush_kernel_dcache_page with flush_dcache_page Pages used in scatterlist can be mapped page cache pages (and often are), so we must use flush_dcache_page here instead of the more limited flush_kernel_dcache_page that is intended for highmem pages only. Also remove the PageSlab check given that page_mapping_file as used by the flush_dcache_page implementations already contains that check. Link: https://lkml.kernel.org/r/20210712060928.4161649-5-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Linus Torvalds Cc: Alex Shi Cc: Geoff Levand Cc: Greentime Hu Cc: Guo Ren Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Nick Hu Cc: Paul Cercueil Cc: Rich Felker Cc: Russell King Cc: Thomas Bogendoerfer Cc: Ulf Hansson Cc: Vincent Chen Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 64a05fe645e27a318470a9f31c76c86f36725689 Author: Christoph Hellwig Date: Thu Sep 2 14:56:30 2021 -0700 mmc: mmc_spi: replace flush_kernel_dcache_page with flush_dcache_page Pages passed to block drivers can be mapped page cache pages, so we must use flush_dcache_page here instead of the more limited flush_kernel_dcache_page that is intended for highmem pages only. Link: https://lkml.kernel.org/r/20210712060928.4161649-3-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Linus Torvalds Cc: Alex Shi Cc: Geoff Levand Cc: Greentime Hu Cc: Guo Ren Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Nick Hu Cc: Paul Cercueil Cc: Rich Felker Cc: Russell King Cc: Thomas Bogendoerfer Cc: Ulf Hansson Cc: Vincent Chen Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79c62de859f7e854399efb84a2f04ceeb1c13cc9 Author: Christoph Hellwig Date: Thu Sep 2 14:56:26 2021 -0700 mmc: JZ4740: remove the flush_kernel_dcache_page call in jz4740_mmc_read_data Patch series "_kernel_dcache_page fixes and removal". While looking to convert the block layer away from kmap_atomic towards kmap_local_page and prefeably the helpers that abstract it away I noticed that a few block drivers directly or implicitly call flush_kernel_dcache_page before kunmapping a page that has been written to. flush_kernel_dcache_page is documented to to be used in such cases, but flush_dcache_page is actually required when the page could be in the page cache and mapped to userspace, which is pretty much always the case when kmapping an arbitrary page. Unfortunately the documentation doesn't exactly make that clear, which lead to this misused. And it turns out that only the copy_strings / copy_string_kernel in the exec code were actually correct users of flush_kernel_dcache_page, which is why I think we should just remove it and eat the very minor overhead in exec rather than confusing poor driver writers. This patch (of 6): MIPS now implements flush_kernel_dcache_page (as an alias to flush_dcache_page). Link: https://lkml.kernel.org/r/20210712060928.4161649-1-hch@lst.de Link: https://lkml.kernel.org/r/20210712060928.4161649-2-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Linus Torvalds Cc: "James E.J. Bottomley" Cc: Russell King Cc: Guo Ren Cc: Thomas Bogendoerfer Cc: Nick Hu Cc: Greentime Hu Cc: Vincent Chen Cc: Helge Deller Cc: Yoshinori Sato Cc: Rich Felker Cc: Geoff Levand Cc: Paul Cercueil Cc: Ulf Hansson Cc: Alex Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0c52ec9513b309b250046fdb2c4c6c3726fa5cfb Author: Colin Ian King Date: Thu Sep 2 14:56:11 2021 -0700 selftests: Fix spelling mistake "cann't" -> "cannot" There is a spelling mistake in an error message. Fix it. Link: https://lkml.kernel.org/r/20210826121217.12885-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6260618e09d375ee6aa19be16813dac40cc47513 Author: Po-Hsu Lin Date: Thu Sep 2 14:56:08 2021 -0700 selftests/vm: use kselftest skip code for skipped tests There are several test cases in the vm directory are still using exit 0 when they need to be skipped. Use the kselftest framework to skip code instead so it can help us to distinguish the return status. Criterion to filter out what should be fixed in vm directory: grep -r "exit 0" -B1 | grep -i skip This change might cause some false-positives if people are running these test scripts directly and only checking their return codes, which will change from 0 to 4. However I think the impact should be small as most of our scripts here are already using this skip code. And there will be no such issue if running them with the kselftest framework. Link: https://lkml.kernel.org/r/20210823073433.37653-1-po-hsu.lin@canonical.com Signed-off-by: Po-Hsu Lin Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4ba9515d32bac1c54c2357796e32d68eeab784ce Author: Shakeel Butt Date: Thu Sep 2 14:56:05 2021 -0700 memcg: make memcg->event_list_lock irqsafe The memcg->event_list_lock is usually taken in the normal context but when the userspace closes the corresponding eventfd, eventfd_release through memcg_event_wake takes memcg->event_list_lock with interrupts disabled. This is not an issue on its own but it creates a nested dependency from eventfd_ctx->wqh.lock to memcg->event_list_lock. Independently, for unrelated eventfd, eventfd_signal() can be called in the irq context, thus making eventfd_ctx->wqh.lock an irq lock. For example, FPGA DFL driver, VHOST VPDA driver and couple of VFIO drivers. This will force memcg->event_list_lock to be an irqsafe lock as well. One way to break the nested dependency between eventfd_ctx->wqh.lock and memcg->event_list_lock is to add an indirection. However the simplest solution would be to make memcg->event_list_lock irqsafe. This is cgroup v1 feature, is in maintenance and may get deprecated in near future. So, no need to add more code. BTW this has been discussed previously [1] but there weren't irq users of eventfd_signal() at the time. [1] https://www.spinics.net/lists/cgroups/msg06248.html Link: https://lkml.kernel.org/r/20210830172953.207257-1-shakeelb@google.com Signed-off-by: Shakeel Butt Cc: Tejun Heo Cc: Johannes Weiner Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5c49cf9ad600f705f595ecbbbac2a5da9a3bb3bd Author: Michal Hocko Date: Thu Sep 2 14:56:02 2021 -0700 memcg: fix up drain_local_stock comment Thomas and Vlastimil have noticed that the comment in drain_local_stock doesn't quite make sense. It talks about a synchronization with the memory hotplug but there is no actual memory hotplug involvement here. I meant to talk about cpu hotplug here. Fix that up and hopefuly make the comment more helpful by referencing the cpu hotplug callback as well. Link: https://lkml.kernel.org/r/YRDwOhVglJmY7ES5@dhcp22.suse.cz Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 27fb0956ed08780e480a14c5cca2fd4818e99fa7 Author: Miaohe Lin Date: Thu Sep 2 14:55:59 2021 -0700 mm, memcg: save some atomic ops when flush is already true Add 'else' to save some atomic ops in obj_stock_flush_required() when flush is already true. No functional change intended here. Link: https://lkml.kernel.org/r/20210807082835.61281-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Shakeel Butt Reviewed-by: Muchun Song Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Vladimir Davydov Cc: Muchun Song Cc: Matthew Wilcox (Oracle) Cc: Alex Shi Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bec49c067c679e9b7ca7c1aac50b56618c12d879 Author: Miaohe Lin Date: Thu Sep 2 14:55:56 2021 -0700 mm, memcg: remove unused functions Since commit 2d146aa3aa84 ("mm: memcontrol: switch to rstat"), last user of memcg_stat_item_in_bytes() is gone. And since commit fa40d1ee9f15 ("mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node()"), only the declaration of mem_cgroup_select_victim_node() is remained here. Remove them. Link: https://lkml.kernel.org/r/20210807082835.61281-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Shakeel Butt Reviewed-by: Muchun Song Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Alex Shi Cc: Matthew Wilcox (Oracle) Cc: Vladimir Davydov Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 37bc3cb9bbef86d1ddbbc789e55b588c8a2cac26 Author: Baolin Wang Date: Thu Sep 2 14:55:53 2021 -0700 mm: memcontrol: set the correct memcg swappiness restriction Since commit c843966c556d ("mm: allow swappiness that prefers reclaiming anon over the file workingset") has expended the swappiness value to make swap to be preferred in some systems. We should also change the memcg swappiness restriction to allow memcg swap-preferred. Link: https://lkml.kernel.org/r/d77469b90c45c49953ccbc51e54a1d465bc18f70.1627626255.git.baolin.wang@linux.alibaba.com Fixes: c843966c556d ("mm: allow swappiness that prefers reclaiming anon over the file workingset") Signed-off-by: Baolin Wang Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 55a68c823951855f3ec313fdb85100db84284505 Author: Vasily Averin Date: Thu Sep 2 14:55:49 2021 -0700 memcg: replace in_interrupt() by !in_task() in active_memcg() set_active_memcg() uses in_interrupt() check to select proper storage for cgroup: pointer on task struct or per-cpu pointer. It isn't fully correct: obsoleted in_interrupt() includes tasks with disabled BH. It's better to use '!in_task()' instead. Link: https://lkml.org/lkml/2021/7/26/487 Link: https://lkml.kernel.org/r/ed4448b0-4970-616f-7368-ef9dd3cb628d@virtuozzo.com Fixes: 37d5985c003d ("mm: kmem: prepare remote memcg charging infra for interrupt contexts") Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96e51ccf1af33e82f429a0d6baebba29c6448d0f Author: Shakeel Butt Date: Thu Sep 2 14:55:46 2021 -0700 memcg: cleanup racy sum avoidance code We used to have per-cpu memcg and lruvec stats and the readers have to traverse and sum the stats from each cpu. This summing was racy and may expose transient negative values. So, an explicit check was added to avoid such scenarios. Now these stats are moved to rstat infrastructure and are no more per-cpu, so we can remove the fixup for transient negative values. Link: https://lkml.kernel.org/r/20210728012243.3369123-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec403e2ae0dfc85996aad6e944a98a16e6dfcc6d Author: Vasily Averin Date: Thu Sep 2 14:55:43 2021 -0700 memcg: enable accounting for ldt_struct objects Each task can request own LDT and force the kernel to allocate up to 64Kb memory per-mm. There are legitimate workloads with hundreds of processes and there can be hundreds of workloads running on large machines. The unaccounted memory can cause isolation issues between the workloads particularly on highly utilized machines. It makes sense to account for this objects to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/38010594-50fe-c06d-7cb0-d1f77ca422f3@virtuozzo.com Signed-off-by: Vasily Averin Acked-by: Borislav Petkov Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c509723ec27e925bb91a20682c448e95d4bc8c9f Author: Vasily Averin Date: Thu Sep 2 14:55:39 2021 -0700 memcg: enable accounting for posix_timers_cache slab A program may create multiple interval timers using timer_create(). For each timer the kernel preallocates a "queued real-time signal", Consequently, the number of timers is limited by the RLIMIT_SIGPENDING resource limit. The allocated object is quite small, ~250 bytes, but even the default signal limits allow to consume up to 100 megabytes per user. It makes sense to account for them to limit the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/57795560-025c-267c-6b1a-dea852d95530@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Thomas Gleixner Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5f58c39819ff78ca5ddbba2b3cd8ff4779b19bb5 Author: Vasily Averin Date: Thu Sep 2 14:55:35 2021 -0700 memcg: enable accounting for signals When a user send a signal to any another processes it forces the kernel to allocate memory for 'struct sigqueue' objects. The number of signals is limited by RLIMIT_SIGPENDING resource limit, but even the default settings allow each user to consume up to several megabytes of memory. It makes sense to account for these allocations to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/e34e958c-e785-712e-a62a-2c7b66c646c7@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 18319498fdd4cdf8c1c2c48cd432863b1f915d6f Author: Vasily Averin Date: Thu Sep 2 14:55:31 2021 -0700 memcg: enable accounting of ipc resources When user creates IPC objects it forces kernel to allocate memory for these long-living objects. It makes sense to account them to restrict the host's memory consumption from inside the memcg-limited container. This patch enables accounting for IPC shared memory segments, messages semaphores and semaphore's undo lists. Link: https://lkml.kernel.org/r/d6507b06-4df6-78f8-6c54-3ae86e3b5339@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30acd0bdfb86548172168a0cc71d455944de0683 Author: Vasily Averin Date: Thu Sep 2 14:55:27 2021 -0700 memcg: enable accounting for new namesapces and struct nsproxy Container admin can create new namespaces and force kernel to allocate up to several pages of memory for the namespaces and its associated structures. Net and uts namespaces have enabled accounting for such allocations. It makes sense to account for rest ones to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/5525bcbf-533e-da27-79b7-158686c64e13@virtuozzo.com Signed-off-by: Vasily Averin Acked-by: Serge Hallyn Acked-by: Christian Brauner Acked-by: Kirill Tkhai Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 839d68206de869b8cb4272c5ea10da2ef7ec34cb Author: Vasily Averin Date: Thu Sep 2 14:55:23 2021 -0700 memcg: enable accounting for fasync_cache fasync_struct is used by almost all character device drivers to set up the fasync queue, and for regular files by the file lease code. This structure is quite small but long-living and it can be assigned for any open file. It makes sense to account for its allocations to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/1b408625-d71c-0b26-b0b6-9baf00f93e69@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0f12156dff2862ac54235fc72703f18770769042 Author: Vasily Averin Date: Thu Sep 2 14:55:19 2021 -0700 memcg: enable accounting for file lock caches User can create file locks for each open file and force kernel to allocate small but long-living objects per each open file. It makes sense to account for these objects to limit the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/b009f4c7-f0ab-c0ec-8e83-918f47d677da@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b655843444152c0a14b749308e4cb35d91cbcf0b Author: Vasily Averin Date: Thu Sep 2 14:55:14 2021 -0700 memcg: enable accounting for pollfd and select bits arrays User can call select/poll system calls with a large number of assigned file descriptors and force kernel to allocate up to several pages of memory till end of these sleeping system calls. We have here long-living unaccounted per-task allocations. It makes sense to account for these allocations to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/56e31cb5-6e1e-bdba-d7ca-be64b9842363@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Borislav Petkov Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Johannes Weiner Cc: Kirill Tkhai Cc: Michal Hocko Cc: Oleg Nesterov Cc: Roman Gushchin Cc: Serge Hallyn Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vladimir Davydov Cc: Yutian Yang Cc: Zefan Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79f6540ba88dfb383ecf057a3425e668105ca774 Author: Vasily Averin Date: Thu Sep 2 14:55:10 2021 -0700 memcg: enable accounting for mnt_cache entries Patch series "memcg accounting from OpenVZ", v7. OpenVZ uses memory accounting 20+ years since v2.2.x linux kernels. Initially we used our own accounting subsystem, then partially committed it to upstream, and a few years ago switched to cgroups v1. Now we're rebasing again, revising our old patches and trying to push them upstream. We try to protect the host system from any misuse of kernel memory allocation triggered by untrusted users inside the containers. Patch-set is addressed mostly to cgroups maintainers and cgroups@ mailing list, though I would be very grateful for any comments from maintainersi of affected subsystems or other people added in cc: Compared to the upstream, we additionally account the following kernel objects: - network devices and its Tx/Rx queues - ipv4/v6 addresses and routing-related objects - inet_bind_bucket cache objects - VLAN group arrays - ipv6/sit: ip_tunnel_prl - scm_fp_list objects used by SCM_RIGHTS messages of Unix sockets - nsproxy and namespace objects itself - IPC objects: semaphores, message queues and share memory segments - mounts - pollfd and select bits arrays - signals and posix timers - file lock - fasync_struct used by the file lease code and driver's fasync queues - tty objects - per-mm LDT We have an incorrect/incomplete/obsoleted accounting for few other kernel objects: sk_filter, af_packets, netlink and xt_counters for iptables. They require rework and probably will be dropped at all. Also we're going to add an accounting for nft, however it is not ready yet. We have not tested performance on upstream, however, our performance team compares our current RHEL7-based production kernel and reports that they are at least not worse as the according original RHEL7 kernel. This patch (of 10): The kernel allocates ~400 bytes of 'struct mount' for any new mount. Creating a new mount namespace clones most of the parent mounts, and this can be repeated many times. Additionally, each mount allocates up to PATH_MAX=4096 bytes for mnt->mnt_devname. It makes sense to account for these allocations to restrict the host's memory consumption from inside the memcg-limited container. Link: https://lkml.kernel.org/r/045db11f-4a45-7c9b-2664-5b32c2b44943@virtuozzo.com Signed-off-by: Vasily Averin Reviewed-by: Shakeel Butt Acked-by: Christian Brauner Cc: Tejun Heo Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Roman Gushchin Cc: Yutian Yang Cc: Alexander Viro Cc: Alexey Dobriyan Cc: Andrei Vagin Cc: Borislav Petkov Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Jens Axboe Cc: Jiri Slaby Cc: Kirill Tkhai Cc: Oleg Nesterov Cc: Serge Hallyn Cc: Thomas Gleixner Cc: Zefan Li Cc: Borislav Petkov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb902cb47cf93b33cd92b3b7a4019330a03ef57f Author: Yutian Yang Date: Thu Sep 2 14:55:07 2021 -0700 memcg: charge fs_context and legacy_fs_context This patch adds accounting flags to fs_context and legacy_fs_context allocation sites so that kernel could correctly charge these objects. We have written a PoC to demonstrate the effect of the missing-charging bugs. The PoC takes around 1,200MB unaccounted memory, while it is charged for only 362MB memory usage. We evaluate the PoC on QEMU x86_64 v5.2.90 + Linux kernel v5.10.19 + Debian buster. All the limitations including ulimits and sysctl variables are set as default. Specifically, the hard NOFILE limit and nr_open in sysctl are both 1,048,576. /*------------------------- POC code ----------------------------*/ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); \ } while (0) #define STACK_SIZE (8 * 1024) #ifndef __NR_fsopen #define __NR_fsopen 430 #endif static inline int fsopen(const char *fs_name, unsigned int flags) { return syscall(__NR_fsopen, fs_name, flags); } static char thread_stack[512][STACK_SIZE]; int thread_fn(void* arg) { for (int i = 0; i< 800000; ++i) { int fsfd = fsopen("nfs", FSOPEN_CLOEXEC); if (fsfd == -1) { errExit("fsopen"); } } while(1); return 0; } int main(int argc, char *argv[]) { int thread_pid; for (int i = 0; i < 1; ++i) { thread_pid = clone(thread_fn, thread_stack[i] + STACK_SIZE, \ SIGCHLD, NULL); } while(1); return 0; } /*-------------------------- end --------------------------------*/ Link: https://lkml.kernel.org/r/1626517201-24086-1-git-send-email-nglaive@gmail.com Signed-off-by: Yutian Yang Reviewed-by: Shakeel Butt Cc: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa48e47e3906c332eaf1e5d7b58be11d3509ad9f Author: Shakeel Butt Date: Thu Sep 2 14:55:04 2021 -0700 memcg: infrastructure to flush memcg stats At the moment memcg stats are read in four contexts: 1. memcg stat user interfaces 2. dirty throttling 3. page fault 4. memory reclaim Currently the kernel flushes the stats for first two cases. Flushing the stats for remaining two casese may have performance impact. Always flushing the memcg stats on the page fault code path may negatively impacts the performance of the applications. In addition flushing in the memory reclaim code path, though treated as slowpath, can become the source of contention for the global lock taken for stat flushing because when system or memcg is under memory pressure, many tasks may enter the reclaim path. This patch uses following mechanisms to solve these challenges: 1. Periodically flush the stats from root memcg every 2 seconds. This will time limit the out of sync stats. 2. Asynchronously flush the stats after fixed number of stat updates. In the worst case the stat can be out of sync by O(nr_cpus * BATCH) for 2 seconds. 3. For avoiding thundering herd to flush the stats particularly from the memory reclaim context, introduce memcg local spinlock and let only one flusher active at a time. This could have been done through cgroup_rstat_lock lock but that lock is used by other subsystem and for userspace reading memcg stats. So, it is better to keep flushers introduced by this patch decoupled from cgroup_rstat_lock. However we would have to use irqsafe version of rstat flush but that is fine as this code path will be flushing for whole tree and do the work for everyone. No one will be waiting for that worker. [shakeelb@google.com: fix sleep-in-wrong context bug] Link: https://lkml.kernel.org/r/20210716212137.1391164-2-shakeelb@google.com Link: https://lkml.kernel.org/r/20210714013948.270662-2-shakeelb@google.com Signed-off-by: Shakeel Butt Tested-by: Marek Szyprowski Cc: Hillf Danton Cc: Huang Ying Cc: Johannes Weiner Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e1c0d6f58207e7e60674647d3935f446f05613c Author: Shakeel Butt Date: Thu Sep 2 14:55:00 2021 -0700 memcg: switch lruvec stats to rstat The commit 2d146aa3aa84 ("mm: memcontrol: switch to rstat") switched memcg stats to rstat infrastructure but skipped the conversion of the lruvec stats as such stats are read in the performance critical code paths and flushing stats may have impacted the performances of the applications. This patch converts the lruvec stats to rstat and later patches add mechanisms to keep the performance impact to minimum. The rstat conversion comes with the price i.e. memory cost. Effectively this patch reverts the savings done by the commit f3344adf38bd ("mm: memcontrol: optimize per-lruvec stats counter memory usage"). However this cost is justified due to negative impact of the inaccurate lruvec stats on many heuristics. One such case is reported in [1]. The memory reclaim code is filled with plethora of heuristics and many of those heuristics reads the lruvec stats. So, inaccurate stats can make such heuristics ineffective. [1] reports the impact of inaccurate lruvec stats on the "cache trim mode" heuristic. Inaccurate lruvec stats can impact the deactivation and aging anon heuristics as well. [1] https://lore.kernel.org/linux-mm/20210311004449.1170308-1-ying.huang@intel.com/ Link: https://lkml.kernel.org/r/20210716212137.1391164-1-shakeelb@google.com Link: https://lkml.kernel.org/r/20210714013948.270662-1-shakeelb@google.com Signed-off-by: Shakeel Butt Cc: Tejun Heo Cc: Johannes Weiner Cc: Muchun Song Cc: Michal Hocko Cc: Roman Gushchin Cc: Huang Ying Cc: Hillf Danton Cc: Michal Koutný Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fab827dbee8c2e06ca4ba000fa6c48bcf9054aba Author: Vasily Averin Date: Thu Sep 2 14:54:57 2021 -0700 memcg: enable accounting for pids in nested pid namespaces Commit 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") enabled memcg accounting for pids allocated from init_pid_ns.pid_cachep, but forgot to adjust the setting for nested pid namespaces. As a result, pid memory is not accounted exactly where it is really needed, inside memcg-limited containers with their own pid namespaces. Pid was one the first kernel objects enabled for memcg accounting. init_pid_ns.pid_cachep marked by SLAB_ACCOUNT and we can expect that any new pids in the system are memcg-accounted. Though recently I've noticed that it is wrong. nested pid namespaces creates own slab caches for pid objects, nested pids have increased size because contain id both for all parent and for own pid namespaces. The problem is that these slab caches are _NOT_ marked by SLAB_ACCOUNT, as a result any pids allocated in nested pid namespaces are not memcg-accounted. Pid struct in nested pid namespace consumes up to 500 bytes memory, 100000 such objects gives us up to ~50Mb unaccounted memory, this allow container to exceed assigned memcg limits. Link: https://lkml.kernel.org/r/8b6de616-fd1a-02c6-cbdb-976ecdcfa604@virtuozzo.com Fixes: 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") Cc: stable@vger.kernel.org Signed-off-by: Vasily Averin Reviewed-by: Michal Koutný Reviewed-by: Shakeel Butt Acked-by: Christian Brauner Acked-by: Roman Gushchin Cc: Michal Hocko Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 01c4b28cd2e600160566a7d83b4703800381dae1 Author: Suren Baghdasaryan Date: Thu Sep 2 14:54:54 2021 -0700 mm, memcg: inline swap-related functions to improve disabled memcg config Inline mem_cgroup_try_charge_swap, mem_cgroup_uncharge_swap and cgroup_throttle_swaprate functions to perform mem_cgroup_disabled static key check inline before calling the main body of the function. This minimizes the memcg overhead in the pagefault and exit_mmap paths when memcgs are disabled using cgroup_disable=memory command-line option. This change results in ~1% overhead reduction when running PFT test [1] comparing {CONFIG_MEMCG=n} against {CONFIG_MEMCG=y, cgroup_disable=memory} configuration on an 8-core ARM64 Android device. [1] https://lkml.org/lkml/2006/8/29/294 also used in mmtests suite Link: https://lkml.kernel.org/r/20210713010934.299876-3-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Reviewed-by: Muchun Song Acked-by: Johannes Weiner Acked-by: Michal Hocko Cc: Tejun Heo Cc: Roman Gushchin Cc: Yang Shi Cc: Alex Shi Cc: Wei Yang Cc: Jens Axboe Cc: Joonsoo Kim Cc: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Alistair Popple Cc: Minchan Kim Cc: Miaohe Lin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c8d8f97ae2272f1455ee31a5af62b326772eb31 Author: Suren Baghdasaryan Date: Thu Sep 2 14:54:50 2021 -0700 mm, memcg: inline mem_cgroup_{charge/uncharge} to improve disabled memcg config Inline mem_cgroup_{charge/uncharge} and mem_cgroup_uncharge_list functions functions to perform mem_cgroup_disabled static key check inline before calling the main body of the function. This minimizes the memcg overhead in the pagefault and exit_mmap paths when memcgs are disabled using cgroup_disable=memory command-line option. This change results in ~0.4% overhead reduction when running PFT test [1] comparing {CONFIG_MEMCG=n} against {CONFIG_MEMCG=y, cgroup_disable=memory} configuration on an 8-core ARM64 Android device. [1] https://lkml.org/lkml/2006/8/29/294 also used in mmtests suite Link: https://lkml.kernel.org/r/20210713010934.299876-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Reviewed-by: Muchun Song Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Alex Shi Cc: Alistair Popple Cc: David Hildenbrand Cc: Jens Axboe Cc: Joonsoo Kim Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Minchan Kim Cc: Roman Gushchin Cc: Tejun Heo Cc: Wei Yang Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 56cab2859fbe08e1f2a5ac3f4655dcc398bc013d Author: Suren Baghdasaryan Date: Thu Sep 2 14:54:47 2021 -0700 mm, memcg: add mem_cgroup_disabled checks in vmpressure and swap-related functions Add mem_cgroup_disabled check in vmpressure, mem_cgroup_uncharge_swap and cgroup_throttle_swaprate functions. This minimizes the memcg overhead in the pagefault and exit_mmap paths when memcgs are disabled using cgroup_disable=memory command-line option. This change results in ~2.1% overhead reduction when running PFT test [1] comparing {CONFIG_MEMCG=n, CONFIG_MEMCG_SWAP=n} against {CONFIG_MEMCG=y, CONFIG_MEMCG_SWAP=y, cgroup_disable=memory} configuration on an 8-core ARM64 Android device. [1] https://lkml.org/lkml/2006/8/29/294 also used in mmtests suite Link: https://lkml.kernel.org/r/20210713010934.299876-1-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Reviewed-by: Muchun Song Acked-by: Johannes Weiner Acked-by: Michal Hocko Cc: Alex Shi Cc: Alistair Popple Cc: David Hildenbrand Cc: Jens Axboe Cc: Joonsoo Kim Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Minchan Kim Cc: Roman Gushchin Cc: Tejun Heo Cc: Wei Yang Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1e6decf30af5c5c75445ed6ad4e65a26de578a03 Author: Hugh Dickins Date: Thu Sep 2 14:54:43 2021 -0700 shmem: shmem_writepage() split unlikely i915 THP drivers/gpu/drm/i915/gem/i915_gem_shmem.c contains a shmem_writeback() which calls shmem_writepage() from a shrinker: that usually works well enough; but if /sys/kernel/mm/transparent_hugepage/shmem_enabled has been set to "always" (intended to be usable) or "force" (forces huge everywhere for easy testing), shmem_writepage() is surprised to be called with a huge page, and crashes on the VM_BUG_ON_PAGE(PageCompound) (I did not find out where the crash happens when CONFIG_DEBUG_VM is off). LRU page reclaim always splits the shmem huge page first: I'd prefer not to demand that of i915, so check and split compound in shmem_writepage(). Patch history: when first sent last year http://lkml.kernel.org/r/alpine.LSU.2.11.2008301401390.5954@eggly.anvils https://lore.kernel.org/linux-mm/20200919042009.bomzxmrg7%25akpm@linux-foundation.org/ Matthew Wilcox noticed that tail pages were wrongly left clean. This version brackets the split with Set and Clear PageDirty as he suggested: which works very well, even if it falls short of our aspirations. And recently I realized that the crash is not limited to the testing option "force", but affects "always" too: which is more important to fix. Link: https://lkml.kernel.org/r/bac6158c-8b3d-4dca-cffc-4982f58d9794@google.com Fixes: 2d6692e642e7 ("drm/i915: Start writeback from the shrinker") Signed-off-by: Hugh Dickins Reviewed-by: Shakeel Butt Acked-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a7fddc36299a8a99073e9e6e922b6cd451508385 Author: Hugh Dickins Date: Thu Sep 2 14:54:40 2021 -0700 huge tmpfs: decide stat.st_blksize by shmem_is_huge() 4.18 commit 89fdcd262fd4 ("mm: shmem: make stat.st_blksize return huge page size if THP is on") added is_huge_enabled() to decide st_blksize: if hugeness is to be defined per file, that will need to be replaced by shmem_is_huge(). This does give a different answer (No) for small files on a "huge=within_size" mount: but that can be considered a minor bugfix. And a different answer (No) for default files on a "huge=advise" mount: I'm reluctant to complicate it, just to reproduce the same debatable answer as before. Link: https://lkml.kernel.org/r/af7fb3f9-4415-9e8e-fdac-b1a5253ad21@google.com Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e6e5a12a44ca5ff2b130d8d39aaf9b8c026de94 Author: Hugh Dickins Date: Thu Sep 2 14:54:37 2021 -0700 huge tmpfs: shmem_is_huge(vma, inode, index) Extend shmem_huge_enabled(vma) to shmem_is_huge(vma, inode, index), so that a consistent set of checks can be applied, even when the inode is accessed through read/write syscalls (with NULL vma) instead of mmaps (the index argument is seldom of interest, but required by mount option "huge=within_size"). Clean up and rearrange the checks a little. This then replaces the checks which shmem_fault() and shmem_getpage_gfp() were making, and eliminates the SGP_HUGE and SGP_NOHUGE modes. Replace a couple of 0s by explicit SHMEM_HUGE_NEVERs; and replace the obscure !shmem_mapping() symlink check by explicit S_ISLNK() - nothing else needs that symlink check, so leave it there in shmem_getpage_gfp(). Link: https://lkml.kernel.org/r/23a77889-2ddc-b030-75cd-44ca27fd4d1@google.com Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit acdd9f8e0fed9f1bd7e83a8ff934694bb4c9a72b Author: Hugh Dickins Date: Thu Sep 2 14:54:34 2021 -0700 huge tmpfs: SGP_NOALLOC to stop collapse_file() on race khugepaged's collapse_file() currently uses SGP_NOHUGE to tell shmem_getpage() not to try allocating a huge page, in the very unlikely event that a racing hole-punch removes the swapped or fallocated page as soon as i_pages lock is dropped. We want to consolidate shmem's huge decisions, removing SGP_HUGE and SGP_NOHUGE; but cannot quite persuade ourselves that it's okay to regress the protection in this case - Yang Shi points out that the huge page would remain indefinitely, charged to root instead of the intended memcg. collapse_file() should not even allocate a small page in this case: why proceed if someone is punching a hole? SGP_READ is almost the right flag here, except that it optimizes away from a fallocated page, with NULL to tell caller to fill with zeroes (like a hole); whereas collapse_file()'s sequence relies on using a cache page. Add SGP_NOALLOC just for this. There are too many consecutive "if (page"s there in shmem_getpage_gfp(): group it better; and fix the outdated "bring it back from swap" comment. Link: https://lkml.kernel.org/r/1355343b-acf-4653-ef79-6aee40214ac5@google.com Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c852023e6fd4fa5f75175729e0b55abb062ca799 Author: Hugh Dickins Date: Thu Sep 2 14:54:31 2021 -0700 huge tmpfs: move shmem_huge_enabled() upwards shmem_huge_enabled() is about to be enhanced into shmem_is_huge(), so that it can be used more widely throughout: before making functional changes, shift it to its final position (to avoid forward declaration). Link: https://lkml.kernel.org/r/16fec7b7-5c84-415a-8586-69d8bf6a6685@google.com Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b9e2faaf6fa0df984d4ecca775f3629a4d5e599b Author: Hugh Dickins Date: Thu Sep 2 14:54:27 2021 -0700 huge tmpfs: revert shmem's use of transhuge_vma_enabled() 5.14 commit e6be37b2e7bd ("mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled()") added transhuge_vma_enabled() as a wrapper for two very different checks (one check is whether the app has marked its address range not to use THPs, the other check is whether the app is running in a hierarchy that has been marked never to use THPs). shmem_huge_enabled() prefers to show those two checks explicitly, as before. Link: https://lkml.kernel.org/r/45e5338-18d-c6f9-c17e-34f510bc1728@google.com Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2b5bbcb1c9c2cd05a06dcf54df77255a8c406a7b Author: Hugh Dickins Date: Thu Sep 2 14:54:24 2021 -0700 huge tmpfs: remove shrinklist addition from shmem_setattr() There's a block of code in shmem_setattr() to add the inode to shmem_unused_huge_shrink()'s shrinklist when lowering i_size: it dates from before 5.7 changed truncation to do split_huge_page() for itself, and should have been removed at that time. I am over-stating that: split_huge_page() can fail (notably if there's an extra reference to the page at that time), so there might be value in retrying. But there were already retries as truncation worked through the tails, and this addition risks repeating unsuccessful retries indefinitely: I'd rather remove it now, and work on reducing the chance of split_huge_page() failures separately, if we need to. Link: https://lkml.kernel.org/r/b73b3492-8822-18f9-83e2-938528cdde94@google.com Fixes: 71725ed10c40 ("mm: huge tmpfs: try to split_huge_page() when punching hole") Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d144bf6205342a4b5fed5d204ae18849a4de741b Author: Hugh Dickins Date: Thu Sep 2 14:54:21 2021 -0700 huge tmpfs: fix split_huge_page() after FALLOC_FL_KEEP_SIZE A successful shmem_fallocate() guarantees that the extent has been reserved, even beyond i_size when the FALLOC_FL_KEEP_SIZE flag was used. But that guarantee is broken by shmem_unused_huge_shrink()'s attempts to split huge pages and free their excess beyond i_size; and by other uses of split_huge_page() near i_size. It's sad to add a shmem inode field just for this, but I did not find a better way to keep the guarantee. A flag to say KEEP_SIZE has been used would be cheaper, but I'm averse to unclearable flags. The fallocend field is not perfect either (many disjoint ranges might be fallocated), but good enough; and gains another use later on. Link: https://lkml.kernel.org/r/ca9a146-3a59-6cd3-7f28-e9a044bb1052@google.com Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure") Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: "Kirill A. Shutemov" Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Rik van Riel Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 050dcb5c85bb47f8151175ca5833aa882cc7fe0c Author: Hugh Dickins Date: Thu Sep 2 14:54:18 2021 -0700 huge tmpfs: fix fallocate(vanilla) advance over huge pages Patch series "huge tmpfs: shmem_is_huge() fixes and cleanups". A series of huge tmpfs fixes and cleanups. This patch (of 9): shmem_fallocate() goes to a lot of trouble to leave its newly allocated pages !Uptodate, partly to identify and undo them on failure, partly to leave the overhead of clearing them until later. But the huge page case did not skip to the end of the extent, walked through the tail pages one by one, and appeared to work just fine: but in doing so, cleared and Uptodated the huge page, so there was no way to undo it on failure. And by setting Uptodate too soon, it messed up both its nr_falloced and nr_unswapped counts, so that the intended "time to give up" heuristic did not work at all. Now advance immediately to the end of the huge extent, with a comment on why this is more than just an optimization. But although this speeds up huge tmpfs fallocation, it does leave the clearing until first use, and some users may have come to appreciate slow fallocate but fast first use: if they complain, then we can consider adding a pass to clear at the end. Link: https://lkml.kernel.org/r/da632211-8e3e-6b1-aee-ab24734429a0@google.com Link: https://lkml.kernel.org/r/16201bd2-70e-37e2-e89b-5f929430da@google.com Fixes: 800d8c63b2e9 ("shmem: add huge pages support") Signed-off-by: Hugh Dickins Reviewed-by: Yang Shi Cc: Shakeel Butt Cc: "Kirill A. Shutemov" Cc: Miaohe Lin Cc: Mike Kravetz Cc: Michal Hocko Cc: Rik van Riel Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 86a2f3f2d99e9765d13a55ee2e4364deb6cdf794 Author: Miaohe Lin Date: Thu Sep 2 14:54:15 2021 -0700 shmem: include header file to declare swap_info It's bad to extern swap_info[] in .c. Include corresponding header file instead. Link: https://lkml.kernel.org/r/20210812120350.49801-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cdd89d4cb6507f123f6ecbfe51050e9a9844c2ab Author: Miaohe Lin Date: Thu Sep 2 14:54:12 2021 -0700 shmem: remove unneeded function forward declaration The forward declaration for shmem_should_replace_page() and shmem_replace_page() is unnecessary. Remove them. Link: https://lkml.kernel.org/r/20210812120350.49801-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b6378fc8b477921e62fd5763efeec676ff8e7a16 Author: Miaohe Lin Date: Thu Sep 2 14:54:09 2021 -0700 shmem: remove unneeded header file mfill_atomic_install_pte() is introduced to install pte and update mmu cache since commit bf6ebd97aba0 ("userfaultfd/shmem: modify shmem_mfill_atomic_pte to use install_pte()"). So we should remove tlbflush.h as update_mmu_cache() is not called here now. Link: https://lkml.kernel.org/r/20210812120350.49801-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2b346e4522c2849a3dc59b7077b8952918ef486 Author: Miaohe Lin Date: Thu Sep 2 14:54:06 2021 -0700 shmem: remove unneeded variable ret Patch series "Cleanups for shmem". This series contains cleanups to remove unneeded variable, header file, function forward declaration and so on. More details can be found in the respective changelogs. This patch (of 4): The local variable ret is always equal to -ENOMEM and never touched. So remove it and return -ENOMEM directly to simplify the code. Link: https://lkml.kernel.org/r/20210812120350.49801-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210812120350.49801-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf11b9a8e9a93c1fc0ebfc2929622d5cf7d43888 Author: Sebastian Andrzej Siewior Date: Thu Sep 2 14:54:03 2021 -0700 shmem: use raw_spinlock_t for ->stat_lock Each CPU has SHMEM_INO_BATCH inodes available in `->ino_batch' which is per-CPU. Access here is serialized by disabling preemption. If the pool is empty, it gets reloaded from `->next_ino'. Access here is serialized by ->stat_lock which is a spinlock_t and can not be acquired with disabled preemption. One way around it would make per-CPU ino_batch struct containing the inode number a local_lock_t. Another solution is to promote ->stat_lock to a raw_spinlock_t. The critical sections are short. The mpol_put() must be moved outside of the critical section to avoid invoking the destructor with disabled preemption. Link: https://lkml.kernel.org/r/20210806142916.jdwkb5bx62q5fwfo@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3969b1a654fb09b7915efc1aa4ad45daf932e12f Author: John Hubbard Date: Thu Sep 2 14:54:00 2021 -0700 mm: delete unused get_kernel_page() get_kernel_page() was added in 2012 by [1]. It was used for a while for NFS, but then in 2014, a refactoring [2] removed all callers, and it has apparently not been used since. Remove get_kernel_page() because it has no callers. [1] commit 18022c5d8627 ("mm: add get_kernel_page[s] for pinning of kernel addresses for I/O") [2] commit 91f79c43d1b5 ("new helper: iov_iter_get_pages_alloc()") Link: https://lkml.kernel.org/r/20210729221847.1165665-1-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Reviewed-by: David Hildenbrand Cc: Mel Gorman Cc: Rik van Riel Cc: David S. Miller Cc: Eric B Munson Cc: Eric Paris Cc: James Morris Cc: Mike Christie Cc: Neil Brown Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Cc: Trond Myklebust Cc: Xiaotian Feng Cc: Mark Salter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 51cc3a6620a6ca934d468bda345678768493f5d8 Author: Hugh Dickins Date: Thu Sep 2 14:53:57 2021 -0700 fs, mm: fix race in unlinking swapfile We had a recurring situation in which admin procedures setting up swapfiles would race with test preparation clearing away swapfiles; and just occasionally that got stuck on a swapfile "(deleted)" which could never be swapped off. That is not supposed to be possible. 2.6.28 commit f9454548e17c ("don't unlink an active swapfile") admitted that it was leaving a race window open: now close it. may_delete() makes the IS_SWAPFILE check (amongst many others) before inode_lock has been taken on target: now repeat just that simple check in vfs_unlink() and vfs_rename(), after taking inode_lock. Which goes most of the way to fixing the race, but swapon() must also check after it acquires inode_lock, that the file just opened has not already been unlinked. Link: https://lkml.kernel.org/r/e17b91ad-a578-9a15-5e3-4989e0f999b5@google.com Fixes: f9454548e17c ("don't unlink an active swapfile") Signed-off-by: Hugh Dickins Reviewed-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9857a17f206ff374aea78bccfb687f145368be2e Author: John Hubbard Date: Thu Sep 2 14:53:54 2021 -0700 mm/gup: remove try_get_page(), call try_get_compound_head() directly try_get_page() is very similar to try_get_compound_head(), and in fact try_get_page() has fallen a little behind in terms of maintenance: try_get_compound_head() handles speculative page references more thoroughly. There are only two try_get_page() callsites, so just call try_get_compound_head() directly from those, and remove try_get_page() entirely. Also, seeing as how this changes try_get_compound_head() into a non-static function, provide some kerneldoc documentation for it. Link: https://lkml.kernel.org/r/20210813044133.1536842-4-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54d516b1d62ff8f17cee2da06e5e4706a0d00b8a Author: John Hubbard Date: Thu Sep 2 14:53:51 2021 -0700 mm/gup: small refactoring: simplify try_grab_page() try_grab_page() does the same thing as try_grab_compound_head(..., refs=1, ...), just with a different API. So there is a lot of code duplication there. Change try_grab_page() to call try_grab_compound_head(), while keeping the API contract identical for callers. Also, now that try_grab_compound_head() always has a caller, remove the __maybe_unused annotation. Link: https://lkml.kernel.org/r/20210813044133.1536842-3-jhubbard@nvidia.com Signed-off-by: John Hubbard Reviewed-by: Christoph Hellwig Cc: Matthew Wilcox Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Vasily Gorbik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3967db22ba324939762f618f0d654b13317ca7a4 Author: John Hubbard Date: Thu Sep 2 14:53:48 2021 -0700 mm/gup: documentation corrections for gup/pup Patch series "A few gup refactorings and documentation updates", v3. While reviewing some of the other things going on around gup.c, I noticed that the documentation was wrong for a few of the routines that I wrote. And then I noticed that there was some significant code duplication too. So this fixes those issues. This is not entirely risk-free, but after looking closely at this, I think it's actually a useful improvement, getting rid of the code duplication here. This patch (of 3): The documentation for try_grab_compound_head() and try_grab_page() has fallen a little out of date. Update and clarify a few points. Also make it kerneldoc-correct, by adding @args documentation. Link: https://lkml.kernel.org/r/20210813044133.1536842-1-jhubbard@nvidia.com Link: https://lkml.kernel.org/r/20210813044133.1536842-2-jhubbard@nvidia.com Signed-off-by: John Hubbard Cc: Matthew Wilcox Cc: Christoph Hellwig Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be51eb18b81b2f0a0a562bac0f6fe0f4b05c439e Author: Miaohe Lin Date: Thu Sep 2 14:53:45 2021 -0700 mm: gup: use helper PAGE_ALIGNED in populate_vma_page_range() Use helper PAGE_ALIGNED to check if address is aligned to PAGE_SIZE. Minor readability improvement. Link: https://lkml.kernel.org/r/20210807093620.21347-6-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: John Hubbard Reviewed-by: David Hildenbrand Reviewed-by: Claudio Imbrenda Cc: Jan Kara Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6401c4eb57f947a49eb144b5b0787cde3318e82e Author: Miaohe Lin Date: Thu Sep 2 14:53:42 2021 -0700 mm: gup: fix potential pgmap refcnt leak in __gup_device_huge() When failed to try_grab_page, put_dev_pagemap() is missed. So pgmap refcnt will leak in this case. Also we remove the check for pgmap against NULL as it's also checked inside the put_dev_pagemap(). [akpm@linux-foundation.org: simplify, cleanup] [akpm@linux-foundation.org: fix return value] Link: https://lkml.kernel.org/r/20210807093620.21347-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Fixes: 3faa52c03f44 ("mm/gup: track FOLL_PIN pages") Reviewed-by: John Hubbard Reviewed-by: Claudio Imbrenda Cc: Jan Kara Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 06a9e696639c5e0f457ae117c39ec4cbe5096dc9 Author: Miaohe Lin Date: Thu Sep 2 14:53:39 2021 -0700 mm: gup: remove useless BUG_ON in __get_user_pages() Indeed, this BUG_ON couldn't catch anything useful. We are sure ret == 0 here because we would already bail out if ret != 0 and ret is untouched till here. Link: https://lkml.kernel.org/r/20210807093620.21347-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: John Hubbard Reviewed-by: David Hildenbrand Reviewed-by: Claudio Imbrenda Cc: Jan Kara Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0fef147ba7329d54a08b3b8c7e152b6dd5391199 Author: Miaohe Lin Date: Thu Sep 2 14:53:36 2021 -0700 mm: gup: remove unneed local variable orig_refs Remove unneed local variable orig_refs since refs is unchanged now. Link: https://lkml.kernel.org/r/20210807093620.21347-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: John Hubbard Reviewed-by: Claudio Imbrenda Reviewed-by: David Hildenbrand Cc: Jan Kara Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8fed2f3cd6da9fba1045c557f88fc3c46dc7d2d2 Author: Miaohe Lin Date: Thu Sep 2 14:53:33 2021 -0700 mm: gup: remove set but unused local variable major Patch series "Cleanups and fixup for gup". This series contains cleanups to remove unneeded variable, useless BUG_ON and use helper to improve readability. Also we fix a potential pgmap refcnt leak. More details can be found in the respective changelogs. This patch (of 5): Since commit a2beb5f1efed ("mm: clean up the last pieces of page fault accountings"), the local variable major is unused. Remove it. Link: https://lkml.kernel.org/r/20210807093620.21347-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20210807093620.21347-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: John Hubbard Reviewed-by: David Hildenbrand Reviewed-by: Claudio Imbrenda Cc: Jan Kara Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6de522d1667f628376517e4b177af10c739d745b Author: Jing Yangyang Date: Thu Sep 2 14:53:30 2021 -0700 include/linux/buffer_head.h: fix boolreturn.cocci warnings ./include/linux/buffer_head.h:412:64-65:WARNING:return of 0/1 in function 'has_bh_in_lru' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Link: https://lkml.kernel.org/r/20210824055828.58783-1-deng.changcheng@zte.com.cn Signed-off-by: Jing Yangyang Reported-by: Zeal Robot Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7490a2d248145d8694e1e9828801b496250fd697 Author: Shakeel Butt Date: Thu Sep 2 14:53:27 2021 -0700 writeback: memcg: simplify cgroup_writeback_by_id Currently cgroup_writeback_by_id calls mem_cgroup_wb_stats() to get dirty pages for a memcg. However mem_cgroup_wb_stats() does a lot more than just get the number of dirty pages. Just directly get the number of dirty pages instead of calling mem_cgroup_wb_stats(). Also cgroup_writeback_by_id() is only called for best-effort dirty flushing, so remove the unused 'nr' parameter and no need to explicitly flush memcg stats. Link: https://lkml.kernel.org/r/20210722182627.2267368-1-shakeelb@google.com Signed-off-by: Shakeel Butt Reviewed-by: Jan Kara Cc: Tejun Heo Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7ae12c809f6a31d3da7b96339dbefa141884c711 Author: Johannes Weiner Date: Thu Sep 2 14:53:24 2021 -0700 fs: inode: count invalidated shadow pages in pginodesteal pginodesteal is supposed to capture the impact that inode reclaim has on the page cache state. Currently, it doesn't consider shadow pages that get dropped this way, even though this can have a significant impact on paging behavior, memory pressure calculations etc. To improve visibility into these effects, make sure shadow pages get counted when they get dropped through inode reclaim. This changes the return value semantics of invalidate_mapping_pages() semantics slightly, but the only two users are the inode shrinker itsel and a usb driver that logs it for debugging purposes. Link: https://lkml.kernel.org/r/20210614211904.14420-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 16e2df2a05d46c983bf310b19432c5ca4684b2bc Author: Johannes Weiner Date: Thu Sep 2 14:53:21 2021 -0700 fs: drop_caches: fix skipping over shadow cache inodes When drop_caches truncates the page cache in an inode it also includes any shadow entries for evicted pages. However, there is a preliminary check on whether the inode has pages: if it has *only* shadow entries, it will skip running truncation on the inode and leave it behind. Fix the check to mapping_empty(), such that it runs truncation on any inode that has cache entries at all. Link: https://lkml.kernel.org/r/20210614211904.14420-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reported-by: Roman Gushchin Acked-by: Roman Gushchin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3047250972ff935b1d7a0629fa3acb04c12dcc07 Author: Johannes Weiner Date: Thu Sep 2 14:53:18 2021 -0700 mm: remove irqsave/restore locking from contexts with irqs enabled The page cache deletion paths all have interrupts enabled, so no need to use irqsafe/irqrestore locking variants. They used to have irqs disabled by the memcg lock added in commit c4843a7593a9 ("memcg: add per cgroup dirty page accounting"), but that has since been replaced by memcg taking the page lock instead, commit 0a31bc97c80c ("mm: memcontrol: rewrite uncharge AP"). Link: https://lkml.kernel.org/r/20210614211904.14420-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 20792ebf3eeb828a692b29f3000673cb9ca83c3a Author: Jan Kara Date: Thu Sep 2 14:53:15 2021 -0700 writeback: use READ_ONCE for unlocked reads of writeback stats We do some unlocked reads of writeback statistics like avg_write_bandwidth, dirty_ratelimit, or bw_time_stamp. Generally we are fine with getting somewhat out-of-date values but actually getting different values in various parts of the functions because the compiler decided to reload value from original memory location could confuse calculations. Use READ_ONCE for these unlocked accesses and WRITE_ONCE for the updates to be on the safe side. Link: https://lkml.kernel.org/r/20210713104716.22868-5-jack@suse.cz Signed-off-by: Jan Kara Cc: Michael Stapelberg Cc: Wu Fengguang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 42dd235cb15c06c8446f9aed695648a3c2eb8d11 Author: Jan Kara Date: Thu Sep 2 14:53:12 2021 -0700 writeback: rename domain_update_bandwidth() Rename domain_update_bandwidth() to domain_update_dirty_limit(). The original name is a misnomer. The function has nothing to do with a bandwidth, it updates dirty limits. Link: https://lkml.kernel.org/r/20210713104716.22868-4-jack@suse.cz Signed-off-by: Jan Kara Cc: Michael Stapelberg Cc: Wu Fengguang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 45a2966fd64147518dc5bca25f447bd0fb5359ac Author: Jan Kara Date: Thu Sep 2 14:53:09 2021 -0700 writeback: fix bandwidth estimate for spiky workload Michael Stapelberg has reported that for workload with short big spikes of writes (GCC linker seem to trigger this frequently) the write throughput is heavily underestimated and tends to steadily sink until it reaches zero. This has rather bad impact on writeback throttling (causing stalls). The problem is that writeback throughput estimate gets updated at most once per 200 ms. One update happens early after we submit pages for writeback (at that point writeout of only small fraction of pages is completed and thus observed throughput is tiny). Next update happens only during the next write spike (updates happen only from inode writeback and dirty throttling code) and if that is more than 1s after previous spike, we decide system was idle and just ignore whatever was written until this moment. Fix the problem by making sure writeback throughput estimate is also updated shortly after writeback completes to get reasonable estimate of throughput for spiky workloads. [jack@suse.cz: avoid division by 0 in wb_update_dirty_ratelimit()] Link: https://lore.kernel.org/lkml/20210617095309.3542373-1-stapelberg+linux@google.com Link: https://lkml.kernel.org/r/20210713104716.22868-3-jack@suse.cz Signed-off-by: Jan Kara Reported-by: Michael Stapelberg Tested-by: Michael Stapelberg Cc: Wu Fengguang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fee468fdf41cdf36ba6b5a780e2474d0a3e066ac Author: Jan Kara Date: Thu Sep 2 14:53:06 2021 -0700 writeback: reliably update bandwidth estimation Currently we trigger writeback bandwidth estimation from balance_dirty_pages() and from wb_writeback(). However neither of these need to trigger when the system is relatively idle and writeback is triggered e.g. from fsync(2). Make sure writeback estimates happen reliably by triggering them from do_writepages(). Link: https://lkml.kernel.org/r/20210713104716.22868-2-jack@suse.cz Signed-off-by: Jan Kara Cc: Michael Stapelberg Cc: Wu Fengguang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 633a2abb9e1cd5c95f3b600f4b2c12cce22ae4a0 Author: Jan Kara Date: Thu Sep 2 14:53:04 2021 -0700 writeback: track number of inodes under writeback Patch series "writeback: Fix bandwidth estimates", v4. Fix estimate of writeback throughput when device is not fully busy doing writeback. Michael Stapelberg has reported that such workload (e.g. generated by linking) tends to push estimated throughput down to 0 and as a result writeback on the device is practically stalled. The first three patches fix the reported issue, the remaining two patches are unrelated cleanups of problems I've noticed when reading the code. This patch (of 4): Track number of inodes under writeback for each bdi_writeback structure. We will use this to decide whether wb does any IO and so we can estimate its writeback throughput. In principle we could use number of pages under writeback (WB_WRITEBACK counter) for this however normal percpu counter reads are too inaccurate for our purposes and summing the counter is too expensive. Link: https://lkml.kernel.org/r/20210713104519.16394-1-jack@suse.cz Link: https://lkml.kernel.org/r/20210713104716.22868-1-jack@suse.cz Signed-off-by: Jan Kara Cc: Wu Fengguang Cc: Michael Stapelberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eb2169cee36fc492407a2d483c286b977a46288a Author: liuhailong Date: Thu Sep 2 14:53:01 2021 -0700 mm: add kernel_misc_reclaimable in show_free_areas Print NR_KERNEL_MISC_RECLAIMABLE stat from show_free_areas() so users can check whether the shrinker is working correctly and to show the current memory usage. Link: https://lkml.kernel.org/r/20210813104725.4562-1-liuhailong@oppo.com Signed-off-by: liuhailong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4f3eaf452a14ff3982f71c1ca8bdf757254231fa Author: Matthew Wilcox (Oracle) Date: Thu Sep 2 14:52:58 2021 -0700 mm: report a more useful address for reclaim acquisition A recent lockdep report included these lines: [ 96.177910] 3 locks held by containerd/770: [ 96.177934] #0: ffff88810815ea28 (&mm->mmap_lock#2){++++}-{3:3}, at: do_user_addr_fault+0x115/0x770 [ 96.177999] #1: ffffffff82915020 (rcu_read_lock){....}-{1:2}, at: get_swap_device+0x33/0x140 [ 96.178057] #2: ffffffff82955ba0 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30 While it was not useful to that bug report to know where the reclaim lock had been acquired, it might be useful under other circumstances. Allow the caller of __fs_reclaim_acquire to specify the instruction pointer to use. Link: https://lkml.kernel.org/r/20210719185709.1755149-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Omar Sandoval Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Boqun Feng Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c5b3a8adad2152d162fc0230c822f907c816be9 Author: Gavin Shan Date: Thu Sep 2 14:52:54 2021 -0700 mm/debug_vm_pgtable: fix corrupted page flag In page table entry modifying tests, set_xxx_at() are used to populate the page table entries. On ARM64, PG_arch_1 (PG_dcache_clean) flag is set to the target page flag if execution permission is given. The logic exits since commit 4f04d8f00545 ("arm64: MMU definitions"). The page flag is kept when the page is free'd to buddy's free area list. However, it will trigger page checking failure when it's pulled from the buddy's free area list, as the following warning messages indicate. BUG: Bad page state in process memhog pfn:08000 page:0000000015c0a628 refcount:0 mapcount:0 \ mapping:0000000000000000 index:0x1 pfn:0x8000 flags: 0x7ffff8000000800(arch_1|node=0|zone=0|lastcpupid=0xfffff) raw: 07ffff8000000800 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag(s) set This fixes the issue by clearing PG_arch_1 through flush_dcache_page() after set_xxx_at() is called. For architectures other than ARM64, the unexpected overhead of cache flushing is acceptable. Link: https://lkml.kernel.org/r/20210809092631.1888748-13-gshan@redhat.com Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fda88cfda1ab666ee6c136eeb401b4ead7ecd066 Author: Gavin Shan Date: Thu Sep 2 14:52:51 2021 -0700 mm/debug_vm_pgtable: remove unused code The variables used by old implementation isn't needed as we switched to "struct pgtable_debug_args". Lets remove them and related code in debug_vm_pgtable(). Link: https://lkml.kernel.org/r/20210809092631.1888748-12-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f87f8c39a91effbbfd88a4642bd245b9c2b7ad3 Author: Gavin Shan Date: Thu Sep 2 14:52:48 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in PGD and P4D modifying tests This uses struct pgtable_debug_args in PGD/P4D modifying tests. No allocated huge page is used in these tests. Besides, the unused variable @saved_p4dp and @saved_pudp are dropped. Link: https://lkml.kernel.org/r/20210809092631.1888748-11-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4cbde03bdb0b832503999387f5e86b006fa54674 Author: Gavin Shan Date: Thu Sep 2 14:52:45 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in PUD modifying tests This uses struct pgtable_debug_args in PUD modifying tests. The allocated huge page is used when set_pud_at() is used. The corresponding tests are skipped if the huge page doesn't exist. Besides, the following unused variables in debug_vm_pgtable() are dropped: @prot, @paddr, @pud_aligned. Link: https://lkml.kernel.org/r/20210809092631.1888748-10-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c0fe07b0aa72b530d5da63a24eb10d503cae5a95 Author: Gavin Shan Date: Thu Sep 2 14:52:41 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in PMD modifying tests This uses struct pgtable_debug_args in PMD modifying tests. The allocated huge page is used when set_pmd_at() is used. The corresponding tests are skipped if the huge page doesn't exist. Besides, the unused variable @pmd_aligned in debug_vm_pgtable() is dropped. Link: https://lkml.kernel.org/r/20210809092631.1888748-9-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 44966c4480f8024776c9ecc68f5589f023f19884 Author: Gavin Shan Date: Thu Sep 2 14:52:38 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in PTE modifying tests This uses struct pgtable_debug_args in PTE modifying tests. The allocated page is used as set_pte_at() is used there. The tests are skipped if the allocated page doesn't exist. It's notable that args->ptep need to be mapped before the tests. The reason why we don't map args->ptep at the beginning is PTE entry is only mapped and accessible in atomic context when CONFIG_HIGHPTE is enabled. So we avoid to do that so that atomic context is only enabled if needed. Besides, the unused variable @pte_aligned and @ptep in debug_vm_pgtable() are dropped. Link: https://lkml.kernel.org/r/20210809092631.1888748-8-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4878a888824bd69ad4fff18efa93901ba2ba24f3 Author: Gavin Shan Date: Thu Sep 2 14:52:35 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in migration and thp tests This uses struct pgtable_debug_args in the migration and thp test functions. It's notable that the pre-allocated page is used in swap_migration_tests() as set_pte_at() is used there. Link: https://lkml.kernel.org/r/20210809092631.1888748-7-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5f447e8067fd9f472bc418de219f3cb9a8c3fbe8 Author: Gavin Shan Date: Thu Sep 2 14:52:32 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in soft_dirty and swap tests This uses struct pgtable_debug_args in the soft_dirty and swap test functions. Link: https://lkml.kernel.org/r/20210809092631.1888748-6-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8cb183f2f2a014e818cf60de3afd5a06410fd5b9 Author: Gavin Shan Date: Thu Sep 2 14:52:28 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in protnone and devmap tests This uses struct pgtable_debug_args in protnone and devmap test functions. After that, the unused variable @protnone in debug_vm_pgtable() is dropped. Link: https://lkml.kernel.org/r/20210809092631.1888748-5-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8983d231c7cc1adaebed89153552da1e3fd55f61 Author: Gavin Shan Date: Thu Sep 2 14:52:25 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in leaf and savewrite tests This uses struct pgtable_debug_args in the leaf and savewrite test functions. Link: https://lkml.kernel.org/r/20210809092631.1888748-4-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 36b77d1e159283da3c9414cbe6d9cb8e79a59c19 Author: Gavin Shan Date: Thu Sep 2 14:52:22 2021 -0700 mm/debug_vm_pgtable: use struct pgtable_debug_args in basic tests This uses struct pgtable_debug_args in the basic test functions. The unused variables @pgd_aligned and @p4d_aligned in debug_vm_pgtable() are dropped. Link: https://lkml.kernel.org/r/20210809092631.1888748-3-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Aneesh Kumar K.V Cc: Catalin Marinas Cc: Chunyu Hu Cc: Qian Cai Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Author: Gavin Shan Date: Thu Sep 2 14:52:19 2021 -0700 mm/debug_vm_pgtable: introduce struct pgtable_debug_args Patch series "mm/debug_vm_pgtable: Enhancements", v6. There are a couple of issues with current implementations and this series tries to resolve the issues: (a) All needed information are scattered in variables, passed to various test functions. The code is organized in pretty much relaxed fashion. (b) The page isn't allocated from buddy during page table entry modifying tests. The page can be invalid, conflicting to the implementations of set_xxx_at() on ARM64. The target page is accessed so that the iCache can be flushed when execution permission is given on ARM64. Besides, the target page can be unmapped and accessing to it causes kernel crash. "struct pgtable_debug_args" is introduced to address issue (a). For issue (b), the used page is allocated from buddy in page table entry modifying tests. The corresponding tets will be skipped if we fail to allocate the (huge) page. For other test cases, the original page around to kernel symbol (@start_kernel) is still used. The patches are organized as below. PATCH[2-10] could be combined to one patch, but it will make the review harder: PATCH[1] introduces "struct pgtable_debug_args" as place holder of all needed information. With it, the old and new implementation can coexist. PATCH[2-10] uses "struct pgtable_debug_args" in various test functions. PATCH[11] removes the unused code for old implementation. PATCH[12] fixes the issue of corrupted page flag for ARM64 This patch (of 6): In debug_vm_pgtable(), there are many local variables introduced to track the needed information and they are passed to the functions for various test cases. It'd better to introduce a struct as place holder for these information. With it, what the tests functions need is the struct. In this way, the code is simplified and easier to be maintained. Besides, set_xxx_at() could access the data on the corresponding pages in the page table modifying tests. So the accessed pages in the tests should have been allocated from buddy. Otherwise, we're accessing pages that aren't owned by us. This causes issues like page flag corruption or kernel crash on accessing unmapped page when CONFIG_DEBUG_PAGEALLOC is enabled. This introduces "struct pgtable_debug_args". The struct is initialized and destroyed, but the information in the struct isn't used yet. It will be used in subsequent patches. Link: https://lkml.kernel.org/r/20210809092631.1888748-1-gshan@redhat.com Link: https://lkml.kernel.org/r/20210809092631.1888748-2-gshan@redhat.com Signed-off-by: Gavin Shan Reviewed-by: Anshuman Khandual Tested-by: Christophe Leroy [powerpc 8xx] Tested-by: Gerald Schaefer [s390] Cc: Anshuman Khandual Cc: Aneesh Kumar K.V Cc: Qian Cai Cc: Catalin Marinas Cc: Will Deacon Cc: Vineet Gupta Cc: Chunyu Hu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4bdffd2708d65e68ff254d90793bb167d828219f Author: kernel test robot Date: Thu Sep 2 14:50:20 2021 -0700 arch/csky/kernel/probes/kprobes.c: fix bugon.cocci warnings Use BUG_ON instead of a if condition followed by BUG. Generated by: scripts/coccinelle/misc/bugon.cocci Link: https://lkml.kernel.org/r/alpine.DEB.2.22.394.2107061049150.7197@hadrien Fixes: 7d37cb2c912d ("lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS") Signed-off-by: kernel test robot Signed-off-by: Julia Lawall Reported-by: kernel test robot Cc: Julian Braha Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9673e0050c39b0534d0e2ca431223f52089f4959 Author: Gang He Date: Thu Sep 2 14:50:17 2021 -0700 ocfs2: ocfs2_downconvert_lock failure results in deadlock Usually, ocfs2_downconvert_lock() function always downconverts dlm lock to the expected level for satisfy dlm bast requests from the other nodes. But there is a rare situation. When dlm lock conversion is being canceled, ocfs2_downconvert_lock() function will return -EBUSY. You need to be aware that ocfs2_cancel_convert() function is asynchronous in fsdlm implementation. If we does not requeue this lockres entry, ocfs2 downconvert thread no longer handles this dlm lock bast request. Then, the other nodes will not get the dlm lock again, the current node's process will be blocked when acquire this dlm lock again. Link: https://lkml.kernel.org/r/20210830044621.12544-1-ghe@suse.com Signed-off-by: Gang He Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c85c2c728193d19d6a908ae9fb312d0325e65ca Author: Tuo Li Date: Thu Sep 2 14:50:14 2021 -0700 ocfs2: quota_local: fix possible uninitialized-variable access in ocfs2_local_read_info() A memory block is allocated through kmalloc(), and its return value is assigned to the pointer oinfo. However, oinfo->dqi_gqinode is not initialized but it is accessed in: iput(oinfo->dqi_gqinode); To fix this possible uninitialized-variable access, assign NULL to oinfo->dqi_gqinode, and add ocfs2_qinfo_lock_res_init() behind the assignment in ocfs2_local_read_info(). Remove ocfs2_qinfo_lock_res_init() in ocfs2_global_read_info(). Link: https://lkml.kernel.org/r/20210804031832.57154-1-islituo@gmail.com Signed-off-by: Tuo Li Reported-by: TOTE Robot Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f566394467c86c3c89022013a99aa2d9d4a0208 Author: Dan Carpenter Date: Thu Sep 2 14:50:11 2021 -0700 ocfs2: remove an unnecessary condition The case where "tmp_oh" is NULL is handled at the start of the function. At this point we know it's non-NULL so this will always return 1. Link: https://lkml.kernel.org/r/YOcItgIXtisi3MaO@mwanda Signed-off-by: Dan Carpenter Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Larry Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e4265c88968d4e53b164944c05e12e79d8ff9c6 Author: Geert Uytterhoeven Date: Thu Sep 2 14:50:08 2021 -0700 ia64: make num_rsvd_regions static Commit f62800992e5917f2 ("ia64: switch to NO_BOOTMEM") removed the last user of num_rsvd_regions outside arch/ia64/kernel/setup.c. Link: https://lkml.kernel.org/r/a377b5437e3e9da93d02f996fe06a2b956cb0990.1629884459.git.geert+renesas@glider.be Signed-off-by: Geert Uytterhoeven Cc: Frank Rowand Cc: Jay Lan Cc: Magnus Damm Cc: Mike Rapoport Cc: Rob Herring Cc: Simon Horman Cc: Tony Luck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 70b2e9912a018e9fddb3a1e0cbb397d4d3c0e98f Author: Geert Uytterhoeven Date: Thu Sep 2 14:50:04 2021 -0700 ia64: make reserve_elfcorehdr() static There never was a reason for reserve_elfcorehdr() to be global. Make the function static, and move it before its sole caller. Link: https://lkml.kernel.org/r/fe236cd73b64abc4abd03dd808cb015c907f4c8c.1629884459.git.geert+renesas@glider.be Fixes: cee87af2a5f75713 ("[IA64] kexec: Use EFI_LOADER_DATA for ELF core header") Signed-off-by: Geert Uytterhoeven Cc: Frank Rowand Cc: Jay Lan Cc: Magnus Damm Cc: Mike Rapoport Cc: Rob Herring Cc: Simon Horman Cc: Tony Luck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d1f4bf845d36d73b27ed37790cae0da3112ca77 Author: Geert Uytterhoeven Date: Thu Sep 2 14:50:01 2021 -0700 ia64: fix #endif comment for reserve_elfcorehdr() Patch series "ia64: Miscellaneous fixes and cleanups". This patch series contains some miscellaneous fixes and cleanups for ia64. The second patch fixes a naming conflict triggered by a patch for the FDT code. This patch (of 3): The definition of reserve_elfcorehdr() depends on CONFIG_CRASH_DUMP, not CONFIG_PROC_VMCORE. Link: https://lkml.kernel.org/r/cover.1629884459.git.geert+renesas@glider.be Link: https://lkml.kernel.org/r/77b4c0648f200cab7e1c2c5171c06763e09362aa.1629884459.git.geert+renesas@glider.be Fixes: d9a9855d0b06ca6d ("always reserve elfcore header memory in crash kernel") Fixes: 17c1f07ed70afa4f ("[IA64] Reserve elfcorehdr memory in CONFIG_CRASH_DUMP") Signed-off-by: Geert Uytterhoeven Cc: Simon Horman Cc: Tony Luck Cc: Jay Lan Cc: Magnus Damm Cc: Mike Rapoport Cc: Rob Herring Cc: Frank Rowand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 577706de69c1e53bc23893953770d829a2242c38 Author: Jason Wang Date: Thu Sep 2 14:49:58 2021 -0700 ia64: fix typo in a comment s/when when/when/ Link: https://lkml.kernel.org/r/20210817112500.12848-1-wangborong@cdjrlc.com Signed-off-by: Jason Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 592ca09be8333bd226f50100328a905bfc377133 Author: David Hildenbrand Date: Fri Apr 23 09:45:45 2021 +0200 fs: update documentation of get_write_access() and friends As VM_DENYWRITE does no longer exists, let's spring-clean the documentation of get_write_access() and friends. Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 6128b3af2a5e42386aa7faf37609b57f39fb7d00 Author: David Hildenbrand Date: Fri Apr 23 09:38:14 2021 +0200 mm: ignore MAP_DENYWRITE in ksys_mmap_pgoff() Let's also remove masking off MAP_DENYWRITE from ksys_mmap_pgoff(): the last in-tree occurrence of MAP_DENYWRITE is now in LEGACY_MAP_MASK, which accepts the flag e.g., for MAP_SHARED_VALIDATE; however, the flag is ignored throughout the kernel now. Add a comment to LEGACY_MAP_MASK stating that MAP_DENYWRITE is ignored. Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 8d0920bde5eb8ec7e567939b85e65a0596c8580d Author: David Hildenbrand Date: Thu Apr 22 12:08:20 2021 +0200 mm: remove VM_DENYWRITE All in-tree users of MAP_DENYWRITE are gone. MAP_DENYWRITE cannot be set from user space, so all users are gone; let's remove it. Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 4589ff7ca81516381393649dec8dd4948884b2b2 Author: David Hildenbrand Date: Fri Apr 23 09:42:41 2021 +0200 binfmt: remove in-tree usage of MAP_DENYWRITE At exec time when we mmap the new executable via MAP_DENYWRITE we have it opened via do_open_execat() and already deny_write_access()'ed the file successfully. Once exec completes, we allow_write_acces(); however, we set mm->exe_file in begin_new_exec() via set_mm_exe_file() and also deny_write_access() as long as mm->exe_file remains set. We'll effectively deny write access to our executable via mm->exe_file until mm->exe_file is changed -- when the process is removed, on new exec, or via sys_prctl(PR_SET_MM_MAP/EXE_FILE). Let's remove all usage of MAP_DENYWRITE, it's no longer necessary for mm->exe_file. In case of an elf interpreter, we'll now only deny write access to the file during exec. This is somewhat okay, because the interpreter behaves (and sometime is) a shared library; all shared libraries, especially the ones loaded directly in user space like via dlopen() won't ever be mapped via MAP_DENYWRITE, because we ignore that from user space completely; these shared libraries can always be modified while mapped and executed. Let's only special-case the main executable, denying write access while being executed by a process. This can be considered a minor user space visible change. While this is a cleanup, it also fixes part of a problem reported with VM_DENYWRITE on overlayfs, as VM_DENYWRITE is effectively unused with this patch and will be removed next: "Overlayfs did not honor positive i_writecount on realfile for VM_DENYWRITE mappings." [1] [1] https://lore.kernel.org/r/YNHXzBgzRrZu1MrD@miu.piliscsaba.redhat.com/ Reported-by: Chengguang Xu Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit fe69d560b5bd9ec77b5d5749bd7027344daef47e Author: David Hildenbrand Date: Fri Apr 23 10:29:59 2021 +0200 kernel/fork: always deny write access to current MM exe_file We want to remove VM_DENYWRITE only currently only used when mapping the executable during exec. During exec, we already deny_write_access() the executable, however, after exec completes the VMAs mapped with VM_DENYWRITE effectively keeps write access denied via deny_write_access(). Let's deny write access when setting or replacing the MM exe_file. With this change, we can remove VM_DENYWRITE for mapping executables. Make set_mm_exe_file() return an error in case deny_write_access() fails; note that this should never happen, because exec code does a deny_write_access() early and keeps write access denied when calling set_mm_exe_file. However, it makes the code easier to read and makes set_mm_exe_file() and replace_mm_exe_file() look more similar. This represents a minor user space visible change: sys_prctl(PR_SET_MM_MAP/EXE_FILE) can now fail if the file is already opened writable. Also, after sys_prctl(PR_SET_MM_MAP/EXE_FILE) the file cannot be opened writable. Note that we can already fail with -EACCES if the file doesn't have execute permissions. Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 35d7bdc86031a2c1ae05ac27dfa93b2acdcbaecc Author: David Hildenbrand Date: Fri Apr 23 10:20:25 2021 +0200 kernel/fork: factor out replacing the current MM exe_file Let's factor the main logic out into replace_mm_exe_file(), such that all mm->exe_file logic is contained in kernel/fork.c. While at it, perform some simple cleanups that are possible now that we're simplifying the individual functions. Acked-by: Christian Brauner Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 42be8b42535183f84df99acbaf799e38724348f3 Author: David Hildenbrand Date: Thu Apr 22 12:53:00 2021 +0200 binfmt: don't use MAP_DENYWRITE when loading shared libraries via uselib() uselib() is the legacy systemcall for loading shared libraries. Nowadays, applications use dlopen() to load shared libraries, completely implemented in user space via mmap(). For example, glibc uses MAP_COPY to mmap shared libraries. While this maps to MAP_PRIVATE | MAP_DENYWRITE on Linux, Linux ignores any MAP_DENYWRITE specification from user space in mmap. With this change, all remaining in-tree users of MAP_DENYWRITE use it to map an executable. We will be able to open shared libraries loaded via uselib() writable, just as we already can via dlopen() from user space. This is one step into the direction of removing MAP_DENYWRITE from the kernel. This can be considered a minor user space visible change. Acked-by: "Eric W. Biederman" Acked-by: Christian König Signed-off-by: David Hildenbrand commit 730affed24bffcd1eebd5903171960f5ff9f1f22 Author: Benjamin Hesmans Date: Fri Sep 3 15:23:35 2021 +0200 netfilter: socket: icmp6: fix use-after-scope Bug reported by KASAN: BUG: KASAN: use-after-scope in inet6_ehashfn (net/ipv6/inet6_hashtables.c:40) Call Trace: (...) inet6_ehashfn (net/ipv6/inet6_hashtables.c:40) (...) nf_sk_lookup_slow_v6 (net/ipv6/netfilter/nf_socket_ipv6.c:91 net/ipv6/netfilter/nf_socket_ipv6.c:146) It seems that this bug has already been fixed by Eric Dumazet in the past in: commit 78296c97ca1f ("netfilter: xt_socket: fix a stack corruption bug") But a variant of the same issue has been introduced in commit d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match") `daddr` and `saddr` potentially hold a reference to ipv6_var that is no longer in scope when the call to `nf_socket_get_sock_v6` is made. Fixes: d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match") Acked-by: Matthieu Baerts Signed-off-by: Benjamin Hesmans Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8b7084b848cd9d7071ed9e253e1c600a25f72ddd Merge: a9c9a6f741cda 799206c1302e8 Author: Konrad Rzeszutek Wilk Date: Fri Sep 3 11:57:31 2021 -0400 Merge branch 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft into HEAD * 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: Fix isa_bus_to_virt not working under ARM commit fcb958ee8e832e9cdf43408535207e15f14af755 Author: Sugar Zhang Date: Fri Sep 3 21:07:14 2021 +0800 ASoC: rockchip: i2s: Fix concurrency between tx/rx This patch adds lock to fix comcurrency between tx/rx to fix 'rockchip-i2s ff070000.i2s; fail to clear' Considering the situation; tx stream rx stream | | | disable enable | | reset After this patch: lock | tx stream | enable | unlock -------- --------- lock | rx stream | disable | reset | unlock Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1630674434-650-1-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 31efe48eb5dc4de3e31e84b54f287e9665410ab3 Author: Xiaoguang Wang Date: Fri Sep 3 22:24:36 2021 +0800 io_uring: fix possible poll event lost in multi shot mode IIUC, IORING_POLL_ADD_MULTI is similar to epoll's edge-triggered mode, that means once one pure poll request returns one event(cqe), we'll need to read or write continually until EAGAIN is returned, then I think there is a possible poll event lost race in multi shot mode: t1 poll request add | | t2 | | t3 event happens | | t4 task work add | | t5 | task work run | t6 | commit one cqe | t7 | | user app handles cqe t8 | new event happen | t9 | add back to waitqueue | t10 | After t6 but before t9, if new event happens, there'll be no wakeup operation, and if user app has picked up this cqe in t7, read or write until EAGAIN is returned. In t8, new event happens and will be lost, though this race window maybe small. To fix this possible race, add poll request back to waitqueue before committing cqe. Fixes: 88e41cf928a6 ("io_uring: add multishot mode for IORING_OP_POLL_ADD") Signed-off-by: Xiaoguang Wang Link: https://lore.kernel.org/r/20210903142436.5767-1-xiaoguang.wang@linux.alibaba.com Signed-off-by: Jens Axboe commit 7a8526a5cd51cf5f070310c6c37dd7293334ac49 Author: Kate Hsuan Date: Fri Sep 3 17:44:11 2021 +0800 libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. Many users are reporting that the Samsung 860 and 870 SSD are having various issues when combined with AMD/ATI (vendor ID 0x1002) SATA controllers and only completely disabling NCQ helps to avoid these issues. Always disabling NCQ for Samsung 860/870 SSDs regardless of the host SATA adapter vendor will cause I/O performance degradation with well behaved adapters. To limit the performance impact to ATI adapters, introduce the ATA_HORKAGE_NO_NCQ_ON_ATI flag to force disable NCQ only for these adapters. Also, two libata.force parameters (noncqati and ncqati) are introduced to disable and enable the NCQ for the system which equipped with ATI SATA adapter and Samsung 860 and 870 SSDs. The user can determine NCQ function to be enabled or disabled according to the demand. After verifying the chipset from the user reports, the issue appears on AMD/ATI SB7x0/SB8x0/SB9x0 SATA Controllers and does not appear on recent AMD SATA adapters. The vendor ID of ATI should be 0x1002. Therefore, ATA_HORKAGE_NO_NCQ_ON_AMD was modified to ATA_HORKAGE_NO_NCQ_ON_ATI. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201693 Signed-off-by: Kate Hsuan Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20210903094411.58749-1-hpa@redhat.com Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b Author: Hans de Goede Date: Mon Aug 23 11:52:20 2021 +0200 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*", covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*" and "Samsung SSD 850*" series based on information from Samsung. But there is a large number of users which is still reporting issues with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or Marvell SATA controllers and all reporters also report these problems going away when disabling queued trims. Note that with AMD SATA controllers users are reporting even worse issues and only completely disabling NCQ helps there, this will be addressed in a separate patch. Fixes: ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203475 Cc: stable@vger.kernel.org Cc: Kate Hsuan Signed-off-by: Hans de Goede Reviewed-by: Damien Le Moal Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20210823095220.30157-1-hdegoede@redhat.com Signed-off-by: Jens Axboe commit 0ef47db1cb64a9a226e8983e8b2691f8e1c02a37 Author: Jens Axboe Date: Fri Sep 3 07:42:13 2021 -0600 bio: fix kerneldoc documentation for bio_alloc_kiocb() Apparently the last fixup got butter fingered a bit, the correct variable name is 'nr_vecs', not 'nr_iovecs'. Link: https://lore.kernel.org/lkml/20210903164939.02f6e8c5@canb.auug.org.au/ Reported-by: Stephen Rothwell Signed-off-by: Jens Axboe commit a3314262eede9c909a0c797f16f25f941d12c78d Merge: e432fe97f3e5d 787c70f2f9990 Author: Michael Ellerman Date: Fri Sep 3 22:54:12 2021 +1000 Merge branch 'fixes' into next Merge our fixes branch into next. That lets us resolve a conflict in arch/powerpc/sysdev/xive/common.c. Between cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs"), which moved request_irq() out of xive_init_ipis(), and 17df41fec5b8 ("powerpc: use IRQF_NO_DEBUG for IPIs") which added IRQF_NO_DEBUG to that request_irq() call, which has now moved. commit 9756e44fd4d283ebcc94df353642f322428b73de Author: 王贇 Date: Fri Sep 3 10:27:18 2021 +0800 net: remove the unnecessary check in cipso_v4_doi_free The commit 733c99ee8be9 ("net: fix NULL pointer reference in cipso_v4_doi_free") was merged by a mistake, this patch try to cleanup the mess. And we already have the commit e842cb60e8ac ("net: fix NULL pointer reference in cipso_v4_doi_free") which fixed the root cause of the issue mentioned in it's description. Suggested-by: Paul Moore Signed-off-by: Michael Wang Signed-off-by: David S. Miller commit ddd0d5293810c1882e2a96f8cce1678823b1dd38 Author: Nikolay Aleksandrov Date: Fri Sep 3 12:34:15 2021 +0300 net: bridge: mcast: fix vlan port router deadlock Before vlan/port mcast router support was added br_multicast_set_port_router was used only with bh already disabled due to the bridge port lock, but that is no longer the case and when it is called to configure a vlan/port mcast router we can deadlock with the timer, so always disable bh to make sure it can be called from contexts with both enabled and disabled bh. Fixes: 2796d846d74a ("net: bridge: vlan: convert mcast router global option to per-vlan entry") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit f1181e39d6ac13c0879b3766138aaa384fe62a55 Author: Arnd Bergmann Date: Fri Sep 3 12:29:07 2021 +0000 net: cs89x0: disable compile testing on powerpc The ISA DMA API is inconsistent between architectures, and while powerpc implements most of what the others have, it does not provide isa_virt_to_bus(): ../drivers/net/ethernet/cirrus/cs89x0.c: In function ‘net_open’: ../drivers/net/ethernet/cirrus/cs89x0.c:897:20: error: implicit declaration of function ‘isa_virt_to_bus’ [-Werror=implicit-function-declaration] (unsigned long)isa_virt_to_bus(lp->dma_buff)); ../drivers/net/ethernet/cirrus/cs89x0.c:894:3: note: in expansion of macro ‘cs89_dbg’ cs89_dbg(1, debug, "%s: dma %lx %lx\n", I tried a couple of approaches to handle this consistently across all architectures, but as this driver is really only used on ARM, I ended up taking the easy way out and just disable compile testing on powerpc. Reported-by: Guenter Roeck Reported-by: Stephen Rothwell Reported-by: Reported-by: kernel test robot Fixes: 47fd22f2b847 ("cs89x0: rework driver configuration") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 8d17a33b076d24aa4861f336a125c888fb918605 Author: Carlo Lobrano Date: Fri Sep 3 14:09:53 2021 +0200 net: usb: qmi_wwan: add Telit 0x1060 composition This patch adds support for Telit LN920 0x1060 composition 0x1060: tty, adb, rmnet, tty, tty, tty, tty Signed-off-by: Carlo Lobrano Signed-off-by: David S. Miller commit 5457773ef99f25fcc4b238ac76b68e28273250f4 Author: Tobias Schramm Date: Fri Aug 27 07:03:57 2021 +0200 spi: rockchip: handle zero length transfers without timing out Previously zero length transfers submitted to the Rokchip SPI driver would time out in the SPI layer. This happens because the SPI peripheral does not trigger a transfer completion interrupt for zero length transfers. Fix that by completing zero length transfers immediately at start of transfer. Signed-off-by: Tobias Schramm Link: https://lore.kernel.org/r/20210827050357.165409-1-t.schramm@manjaro.org Signed-off-by: Mark Brown commit 7eac1e24fbf6c56c9e3be302748ae73104bb40bd Author: Trevor Wu Date: Fri Sep 3 14:00:49 2021 +0800 ASoC: mt8195: correct the dts parsing logic about DPTX and HDMITX According to the description in dt-bindings, phandle assignment of HDMI TX and DP TX are not required properties, but driver regards them as required properties. In real use case, it's expected that DP TX and HDMI TX are optional features, so correct the behavior in driver. Fixes: 40d605df0a7b ("ASoC: mediatek: mt8195: add machine driver with mt6359, rt1019 and rt5682") Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210903060049.20764-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit b3dded7e2f98e2672deb9606514c0e13e3094640 Author: Nathan Chancellor Date: Thu Sep 2 11:12:18 2021 -0700 ASoC: Intel: boards: Fix CONFIG_SND_SOC_SDW_MOCKUP select When CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH is enabled without CONFIG_EXPERT, there is a Kconfig warning about unmet dependencies: WARNING: unmet direct dependencies detected for SND_SOC_SDW_MOCKUP Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && EXPERT [=n] && SOUNDWIRE [=y] Selected by [y]: - SND_SOC_INTEL_SOUNDWIRE_SOF_MACH [=y] && ... Selecting a symbol does not account for dependencies. There are three ways to resolve this: 1. Make CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH select CONFIG_SND_SOC_SDW_MOCKUP only if CONFIG_EXPERT is set. 2. Make CONFIG_SND_SOC_SDW_MOCKUP's prompt depend on CONFIG_EXPERT so that it can be selected by options that only depend on CONFIG_SOUNDWIRE but still appear as a prompt to the user when CONFIG_EXPERT is set. 3. Make CONFIG_SND_SOC_INTEL_SOUNDWIRE_SOF_MACH imply CONFIG_SND_SOC_SDW_MOCKUP, which will select CONFIG_SND_SOC_SDW_MOCKUP when its dependencies are enabled but still allow the user to disable it. Go with the third option as it gives the most flexibility while retaining the original intent of the select. Fixes: 0ccac3bcf356 ("ASoC: Intel: boards: sof_sdw: add SoundWire mockup codecs for tests") Suggested-by: Pierre-Louis Bossart Acked-by: Pierre-Louis Bossart Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20210902181217.2958966-1-nathan@kernel.org Signed-off-by: Mark Brown commit 8d4ad41e3e8e4b907f088f25aee4a92f3f864027 Author: Pavel Begunkov Date: Thu Sep 2 00:38:23 2021 +0100 io_uring: prolong tctx_task_work() with flushing io_submit_flush_completions() may enqueue linked requests for task_work execution, so don't leave tctx_task_work() right after the tw list is exhausted, but try to flush and then retry. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/0755d4c2c36301447c63bdd4146c10477cea4249.1630539342.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 636378535afb837f165beb7de3907896480cf3b2 Author: Pavel Begunkov Date: Thu Sep 2 00:38:22 2021 +0100 io_uring: don't disable kiocb_done() CQE batching Not passing issue_flags from kiocb_done() into __io_complete_rw() means that completion batching for this case is disabled, e.g. for most of buffered reads. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b2689462835c3ee28a5999ef4f9a581e24be04a2.1630539342.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit fa84693b3c896460831fe0750554121121a23da8 Author: Jens Axboe Date: Wed Sep 1 14:15:59 2021 -0600 io_uring: ensure IORING_REGISTER_IOWQ_MAX_WORKERS works with SQPOLL SQPOLL has a different thread doing submissions, we need to check for that and use the right task context when updating the worker values. Just hold the sqd->lock across the operation, this ensures that the thread cannot go away while we poke at ->io_uring. Link: https://github.com/axboe/liburing/issues/420 Fixes: 2e480058ddc2 ("io-wq: provide a way to limit max number of workers") Reported-by: Johannes Lundberg Tested-by: Johannes Lundberg Signed-off-by: Jens Axboe commit c7a3828d98db2730079265b5f51933dfcef8bb5f Author: Jin Yao Date: Thu Sep 2 14:59:55 2021 +0800 perf tests: Add test for PMU aliases A perf uncore PMU may have two PMU names, a real name and an alias. Add one test case to verify that the real and alias names have the same effect. Iterate sysfs to get one event which has an alias and create an evlist by adding two evsels. Evsel1 is created by event and evsel2 is created by alias. Test asserts: evsel1->core.attr.type == evsel2->core.attr.type evsel1->core.attr.config == evsel2->core.attr.config Signed-off-by: Jin Yao Reviewed-by: Andi Kleen Cc: Alexander Shishkin Cc: Jin Yao Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Peter Zijlstra Cc: Riccardo Mancini Link: http://lore.kernel.org/lkml/20210902065955.1299-3-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 13d60ba0738b0532edab3e1492b2005d36ba0802 Author: Kan Liang Date: Thu Sep 2 14:59:54 2021 +0800 perf pmu: Add PMU alias support A perf uncore PMU may have two PMU names, a real name and an alias. The alias is exported at /sys/bus/event_source/devices/uncore_*/alias. The perf tool should support the alias as well. Add alias_name in the struct perf_pmu to store the alias. For the PMU which doesn't have an alias. It's NULL. Introduce two X86 specific functions to retrieve the real name and the alias separately. Only go through the sysfs to retrieve the mapping between the real name and the alias once. The result is cached in a list, uncore_pmu_list. Nothing changed for the other ARCHs. With the patch, the perf tool can monitor the PMU with either the real name or the alias. Use the real name, $ perf stat -e uncore_cha_2/event=1/ -x, 4044879584,,uncore_cha_2/event=1/,2528059205,100.00,, Use the alias, $ perf stat -e uncore_type_0_2/event=1/ -x, 3659675336,,uncore_type_0_2/event=1/,2287306455,100.00,, Committer notes: Rename 'struct perf_pmu_alias_name' to 'pmu_alias', the 'perf_' prefix should be used for libperf, things inside just tools/perf/ are being moved away from that prefix. Also 'pmu_alias' is shorter and reflects the abstraction. Also don't use 'pmu' as the name for variables for that type, we should use that for the 'struct perf_pmu' variables, avoiding confusion. Use 'pmu_alias' for 'struct pmu_alias' variables. Co-developed-by: Jin Yao Co-developed-by: Arnaldo Carvalho de Melo Signed-off-by: Kan Liang Reviewed-by: Andi Kleen Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Peter Zijlstra Cc: Riccardo Mancini Link: http://lore.kernel.org/lkml/20210902065955.1299-2-yao.jin@linux.intel.com Signed-off-by: Jin Yao Signed-off-by: Arnaldo Carvalho de Melo commit bf0df73a2f0d1674bcc930ddff0de0544e512b6e Author: Colin Ian King Date: Thu Sep 2 15:35:05 2021 +0100 seg6_iptunnel: Remove redundant initialization of variable err The variable err is being initialized with a value that is never read, it is being updated later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit c68b421d8ebe15b509144a6ec5a08ff7089a7dd5 Author: Suzuki K Poulose Date: Wed Jul 28 10:12:19 2021 +0100 perf session: Report collisions in AUX records Just like the other flags in the AUX records, report a summary of the Collisions if there were any. Signed-off-by: Suzuki Poulouse Reviewed-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Mike Leach Cc: Suzuki Poulouse Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org LPU-Reference: 20210728091219.527886-1-suzuki.poulose@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 538d9c1829eddf375436c52604f82ff3f53c6690 Author: Stephen Brennan Date: Wed Sep 1 14:08:15 2021 -0700 perf script python: Allow reporting the [un]throttle PERF_RECORD_ meta event perf_events may sometimes throttle an event due to creating too many samples during a given timer tick. As of now, the perf tool will not report on throttling, which means this is a silent error. Implement a callback for the throttle and unthrottle events within the Python scripting engine, which can allow scripts to detect and report when events may have been lost due to throttling. The simplest script to report throttle events is: def throttle(*args): print("throttle" + repr(args)) def unthrottle(*args): print("unthrottle" + repr(args)) Signed-off-by: Stephen Brennan Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210901210815.133251-1-stephen.s.brennan@oracle.com Signed-off-by: Arnaldo Carvalho de Melo commit 71f7f897c309bcddc9c07505cd1a6442176f72cb Author: Leo Yan Date: Thu Sep 2 16:18:00 2021 +0800 perf build: Report failure for testing feature libopencsd When build perf tool with passing option 'CORESIGHT=1' explicitly, if the feature test fails for library libopencsd, the build doesn't complain the feature failure and continue to build the tool with disabling the CoreSight feature insteadly. This patch changes the building behaviour, when build perf tool with the option 'CORESIGHT=1' and detect the failure for testing feature libopencsd, the build process will be aborted and it shows the complaint info. Committer testing: First make sure there is no opencsd library installed: $ rpm -qa | grep -i csd $ sudo rm -rf `find /usr/local -name "*csd*"` $ find /usr/local -name "*csd*" $ Then cleanup the perf build output directory: $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf ; $ And try to build explicitely asking for coresight: $ make O=/tmp/build/perf CORESIGHT=1 O=/tmp/build/perf -C tools/perf install-bin make: Entering directory '/var/home/acme/git/perf/tools/perf' BUILD: Doing 'make -j24' parallel build HOSTCC /tmp/build/perf/fixdep.o HOSTLD /tmp/build/perf/fixdep-in.o LINK /tmp/build/perf/fixdep Makefile.config:493: *** Error: No libopencsd library found or the version is not up-to-date. Please install recent libopencsd to build with CORESIGHT=1. Stop. make[1]: *** [Makefile.perf:238: sub-make] Error 2 make: *** [Makefile:113: install-bin] Error 2 make: Leaving directory '/var/home/acme/git/perf/tools/perf' $ Now install the opencsd library present in Fedora 34: $ sudo dnf install opencsd-devel Installed: opencsd-1.0.0-1.fc34.x86_64 opencsd-devel-1.0.0-1.fc34.x86_64 Complete! $ Try again building with coresight: $ make O=/tmp/build/perf CORESIGHT=1 O=/tmp/build/perf -C tools/perf install-bin make: Entering directory '/var/home/acme/git/perf/tools/perf' BUILD: Doing 'make -j24' parallel build Makefile.config:493: *** Error: No libopencsd library found or the version is not up-to-date. Please install recent libopencsd to build with CORESIGHT=1. Stop. make[1]: *** [Makefile.perf:238: sub-make] Error 2 make: *** [Makefile:113: install-bin] Error 2 make: Leaving directory '/var/home/acme/git/perf/tools/perf' $ Since Fedora 34 is pretty recent, one assumes we need to get it from its upstream git repository, use rpm to find where that is: $ rpm -q --qf "%{URL}\n" opencsd https://github.com/Linaro/OpenCSD $ Go there, clone the repo, build it and install into /usr/local, then try again: $ cd ~acme/git/perf $ make O=/tmp/build/perf VF=1 CORESIGHT=1 O=/tmp/build/perf -C tools/perf install-bin | grep -i opencsd ... libopencsd: [ on ] PERF_VERSION = 5.14.g454719f67a3d $ export LD_LIBRARY_PATH=/usr/local/lib $ ldd ~/bin/perf | grep opencsd libopencsd_c_api.so.1 => /usr/local/lib/libopencsd_c_api.so.1 (0x00007f28f78a4000) libopencsd.so.1 => /usr/local/lib/libopencsd.so.1 (0x00007f28f6a2e000) $ Now it works. Requested-by: Arnaldo Carvalho de Melo Signed-off-by: Leo Yan Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: coresight@lists.linaro.org Link: http://lore.kernel.org/lkml/20210902081800.550016-1-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit a80aea64aa07361a57f2245a0695878f2ae67ee7 Author: James Clark Date: Fri Aug 6 14:41:09 2021 +0100 perf cs-etm: Show a warning for an unknown magic number Currently perf reports "Cannot allocate memory" which isn't very helpful for a potentially user facing issue. If we add a new magic number in the future, perf will be able to report unrecognised magic numbers. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-10-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 56c62f52b6f25802a2154243b6dacdc6ff4f75bd Author: James Clark Date: Fri Aug 6 14:41:08 2021 +0100 perf cs-etm: Print the decoder name Use the real name of the decoder instead of hard-coding "ETM" to avoid confusion when the trace is ETE. This also now distinguishes between ETMv3 and ETMv4. Reviewed-by: Leo Yan Reviewed-by: Suzuki Poulouse Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-9-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 779f414a4849fb3e650cad8525c84e76fdd3c0ea Author: James Clark Date: Fri Aug 6 14:41:07 2021 +0100 perf cs-etm: Create ETE decoder If the magic number indicates ETE instantiate a OCSD_BUILTIN_DCD_ETE decoder instead of OCSD_BUILTIN_DCD_ETMV4I. ETE is the new trace feature for Armv9. Testing performed ================= * Old files with v0 and v1 headers for ETMv4 still open correctly * New files with new magic number open on new versions of perf * New files with new magic number fail to open on old versions of perf * Decoding with the ETE decoder results in the same output as the ETMv4 decoder as long as there are no new ETE packet types Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-8-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 212095f7ca4a5182487ae12b62a8616ed87d617e Author: James Clark Date: Fri Aug 6 14:41:06 2021 +0100 perf cs-etm: Update OpenCSD decoder for ETE OpenCSD v1.1.1 has a bug fix for the installation of the ETE decoder headers. This also means that including headers separately for each decoder is unnecessary so remove these. Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-7-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 050a0fc4edc75a97b4dba7b834fd6bf243bf06ed Author: James Clark Date: Fri Aug 6 14:41:05 2021 +0100 perf cs-etm: Fix typo TRCIRD2 should be TRCIDR2 Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-6-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 51ba8811318ac9a8f800c1d446af3f1ce81ec911 Author: James Clark Date: Fri Aug 6 14:41:04 2021 +0100 perf cs-etm: Save TRCDEVARCH register When ETE is present save the TRCDEVARCH register and set a new magic number. It will be used to configure the decoder in a later commit. Old versions of perf will not be able to open files with this new magic number, but old files will still work with newer versions of perf. Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-5-james.clark@arm.com [ Addressed some cosmetic suggestions by Suzuki Poulouse ] Signed-off-by: Arnaldo Carvalho de Melo commit c9ccc96bf6f28d83ef497ee985b8f6ffd493de2a Author: James Clark Date: Fri Aug 6 14:41:03 2021 +0100 perf cs-etm: Refactor out ETMv4 header saving Extract a function for saving the ETMv4 header because this will be used for ETE in a later commit. Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit f4aef1ea2663ac7efddd796970678911e56ea1f7 Author: James Clark Date: Fri Aug 6 14:41:02 2021 +0100 perf cs-etm: Initialise architecture based on TRCIDR1 Currently the architecture is hard coded as ARCH_V8, but from ETMv4.4 onwards this should be ARCH_AA64. Reviewed-by: Leo Yan Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-3-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 991f69e9e0bb33e4917485bead62b51f0afefac0 Author: James Clark Date: Fri Aug 6 14:41:01 2021 +0100 perf cs-etm: Refactor initialisation of decoder params. The initialisation of the decoder params is duplicated between creation of the packet printer and packet decoder. Put them both into one function so that future changes only need to be made in one place. Reviewed-by: Leo Yan Signed-off-by: James Clark Acked-by: Suzuki Poulouse Cc: Alexander Shishkin Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https //lore.kernel.org/r/20210806134109.1182235-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit f1940d4e9cbe6208e7e77e433c587af108152a17 Author: Vitaly Kuznetsov Date: Tue Aug 31 16:39:16 2021 +0200 Drivers: hv: vmbus: Fix kernel crash upon unbinding a device from uio_hv_generic driver The following crash happens when a never-used device is unbound from uio_hv_generic driver: kernel BUG at mm/slub.c:321! invalid opcode: 0000 [#1] SMP PTI CPU: 0 PID: 4001 Comm: bash Kdump: loaded Tainted: G X --------- --- 5.14.0-0.rc2.23.el9.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 12/07/2018 RIP: 0010:__slab_free+0x1d5/0x3d0 ... Call Trace: ? pick_next_task_fair+0x18e/0x3b0 ? __cond_resched+0x16/0x40 ? vunmap_pmd_range.isra.0+0x154/0x1c0 ? __vunmap+0x22d/0x290 ? hv_ringbuffer_cleanup+0x36/0x40 [hv_vmbus] kfree+0x331/0x380 ? hv_uio_remove+0x43/0x60 [uio_hv_generic] hv_ringbuffer_cleanup+0x36/0x40 [hv_vmbus] vmbus_free_ring+0x21/0x60 [hv_vmbus] hv_uio_remove+0x4f/0x60 [uio_hv_generic] vmbus_remove+0x23/0x30 [hv_vmbus] __device_release_driver+0x17a/0x230 device_driver_detach+0x3c/0xa0 unbind_store+0x113/0x130 ... The problem appears to be that we free 'ring_info->pkt_buffer' twice: first, when the device is unbound from in-kernel driver (netvsc in this case) and second from hv_uio_remove(). Normally, ring buffer is supposed to be re-initialized from hv_uio_open() but this happens when UIO device is being opened and this is not guaranteed to happen. Generally, it is OK to call hv_ringbuffer_cleanup() twice for the same channel (which is being handed over between in-kernel drivers and UIO) even if we didn't call hv_ringbuffer_init() in between. We, however, need to avoid kfree() call for an already freed pointer. Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Andrea Parri Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20210831143916.144983-1-vkuznets@redhat.com Signed-off-by: Wei Liu commit 743902c5446190d9293672e717a6933dffabcb24 Author: Colin Ian King Date: Fri Sep 3 00:00:11 2021 +0100 tipc: clean up inconsistent indenting There is a statement that is indented one character too deeply, clean this up. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit c645fe9bf6ae589ff9163d6c515d3517ec2e32d5 Author: Colin Ian King Date: Thu Sep 2 23:56:23 2021 +0100 skbuff: clean up inconsistent indenting There is a statement that is indented one character too deeply, clean this up. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 73fc98154e9cb40c608a2af16cab12c09886c751 Author: Colin Ian King Date: Thu Sep 2 23:25:57 2021 +0100 drivers: net: smc911x: clean up inconsistent indenting There are various function arguments that are not indented correctly, clean these up with correct indentation. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 743238892156eb3e1825543744bbc8d2da45a019 Author: Colin Ian King Date: Thu Sep 2 23:17:45 2021 +0100 net: 3com: 3c59x: clean up inconsistent indenting There is a statement that is not indented correctly, add in the missing tab. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 340fa6667a696338e707cd5531a9631093d1be29 Author: Mat Martineau Date: Thu Sep 2 11:51:19 2021 -0700 mptcp: Only send extra TCP acks in eligible socket states Recent changes exposed a bug where specifically-timed requests to the path manager netlink API could trigger a divide-by-zero in __tcp_select_window(), as syzkaller does: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 PID: 9667 Comm: syz-executor.0 Not tainted 5.14.0-rc6+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:__tcp_select_window+0x509/0xa60 net/ipv4/tcp_output.c:3016 Code: 44 89 ff e8 c9 29 e9 fd 45 39 e7 0f 8d 20 ff ff ff e8 db 28 e9 fd 44 89 e3 e9 13 ff ff ff e8 ce 28 e9 fd 44 89 e0 44 89 e3 99 7c 24 04 29 d3 e9 fc fe ff ff e8 b7 28 e9 fd 44 89 f1 48 89 ea RSP: 0018:ffff888031ccf020 EFLAGS: 00010216 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000040000 RDX: 0000000000000000 RSI: ffff88811532c080 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffffffff835807c2 R09: 0000000000000000 R10: 0000000000000004 R11: ffffed1020b92441 R12: 0000000000000000 R13: 1ffff11006399e08 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fa4c8344700(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f424000 CR3: 000000003e4e2003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: tcp_select_window net/ipv4/tcp_output.c:264 [inline] __tcp_transmit_skb+0xc00/0x37a0 net/ipv4/tcp_output.c:1351 __tcp_send_ack.part.0+0x3ec/0x760 net/ipv4/tcp_output.c:3972 __tcp_send_ack net/ipv4/tcp_output.c:3978 [inline] tcp_send_ack+0x7d/0xa0 net/ipv4/tcp_output.c:3978 mptcp_pm_nl_addr_send_ack+0x1ab/0x380 net/mptcp/pm_netlink.c:654 mptcp_pm_remove_addr+0x161/0x200 net/mptcp/pm.c:58 mptcp_nl_remove_id_zero_address+0x197/0x460 net/mptcp/pm_netlink.c:1328 mptcp_nl_cmd_del_addr+0x98b/0xd40 net/mptcp/pm_netlink.c:1359 genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792 netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0x14e/0x190 net/socket.c:724 ____sys_sendmsg+0x709/0x870 net/socket.c:2403 ___sys_sendmsg+0xff/0x170 net/socket.c:2457 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae mptcp_pm_nl_addr_send_ack() was attempting to send a TCP ACK on the first subflow in the MPTCP socket's connection list without validating that the subflow was in a suitable connection state. To address this, always validate subflow state when sending extra ACKs on subflows for address advertisement or subflow priority change. Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/229 Co-developed-by: Paolo Abeni Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Acked-by: Geliang Tang Signed-off-by: David S. Miller commit 20e7b9f82b6e7efc487e2c1a1dededbc4231fe81 Author: Eric Dumazet Date: Thu Sep 2 10:17:09 2021 -0700 pktgen: remove unused variable pktgen_thread_worker() no longer needs wait variable, delete it. Fixes: ef87979c273a ("pktgen: better scheduler friendliness") Signed-off-by: Eric Dumazet Cc: Stephen Hemminger Signed-off-by: David S. Miller commit 79a58c06c2d1b93a9d3ec29df08e5b726a8c63e1 Author: Shannon Nelson Date: Thu Sep 2 09:34:07 2021 -0700 ionic: fix double use of queue-lock Deadlock seen in an instance where the hwstamp configuration is changed while the driver is running: [ 3988.736671] schedule_preempt_disabled+0xe/0x10 [ 3988.736676] __mutex_lock.isra.5+0x276/0x4e0 [ 3988.736683] __mutex_lock_slowpath+0x13/0x20 [ 3988.736687] ? __mutex_lock_slowpath+0x13/0x20 [ 3988.736692] mutex_lock+0x2f/0x40 [ 3988.736711] ionic_stop_queues_reconfig+0x16/0x40 [ionic] [ 3988.736726] ionic_reconfigure_queues+0x43e/0xc90 [ionic] [ 3988.736738] ionic_lif_config_hwstamp_rxq_all+0x85/0x90 [ionic] [ 3988.736751] ionic_lif_hwstamp_set_ts_config+0x29c/0x360 [ionic] [ 3988.736763] ionic_lif_hwstamp_set+0x76/0xf0 [ionic] [ 3988.736776] ionic_eth_ioctl+0x33/0x40 [ionic] [ 3988.736781] dev_ifsioc+0x12c/0x420 [ 3988.736785] dev_ioctl+0x316/0x720 This can be demonstrated with "ptp4l -m -i " To fix this, we pull the use of the queue_lock further up above the callers of ionic_reconfigure_queues() and ionic_stop_queues_reconfig(). Fixes: 7ee99fc5ed2e ("ionic: pull hwstamp queue_lock up a level") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 05a444d3f90a3c3e6362e88a1bf13e1a60f8cace Author: Colin Ian King Date: Sun Aug 29 19:18:24 2021 +0100 ceph: fix dereference of null pointer cf Currently in the case where kmem_cache_alloc fails the null pointer cf is dereferenced when assigning cf->is_capsnap = false. Fix this by adding a null pointer check and return path. Cc: stable@vger.kernel.org Addresses-Coverity: ("Dereference null return") Fixes: b2f9fa1f3bd8 ("ceph: correctly handle releasing an embedded cap flush") Signed-off-by: Colin Ian King Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 0ddc5e55e6f1da1286fb2646f4248bf7da31a601 Author: Marc Zyngier Date: Fri Sep 3 09:29:07 2021 +0100 Documentation: Fix irq-domain.rst build warning Correctly escape the * not to be used as emphasis. Also take this opportunity to clarify the fate of the rest of the legacy APIs. Reported-by: Stephen Rothwell Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210903085343.923036-1-maz@kernel.org commit c42813b71a06a2ff4a155aa87ac609feeab76cf3 Author: Helge Deller Date: Thu Sep 2 23:24:42 2021 +0200 parisc: Fix unaligned-access crash in bootloader Kernel v5.14 has various changes to optimize unaligned memory accesses, e.g. commit 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers"). Those changes triggered an unalignment-exception and thus crashed the bootloader on parisc because the unaligned "output_len" variable now suddenly was read word-wise while it was read byte-wise in the past. Fix this issue by declaring the external output_len variable as char which then forces the compiler to generate byte-accesses. Signed-off-by: Helge Deller Cc: Arnd Bergmann Cc: John David Anglin Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102162 Fixes: 8c031ba63f8f ("parisc: Unbreak bootloader due to gcc-7 optimizations") Fixes: 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers") Cc: # v5.14+ commit bc7cd2dd1f8e5889cc68b69984033ac5bef6ba61 Author: Masahiro Yamada Date: Mon Aug 30 17:20:33 2021 +0900 kbuild: redo fake deps at include/ksym/*.h Commit 0e0345b77ac4 ("kbuild: redo fake deps at include/config/*.h") simplified the Kconfig/fixdep interaction a lot. For CONFIG_FOO_BAR_BAZ, Kconfig now touches include/config/FOO_BAR_BAZ instead of the previous include/config/foo/bar/baz.h . This commit simplifies the TRIM_UNUSED_KSYMS feature in a similar way: - delete .h suffix - delete tolower() - put everything in 1 directory For EXPORT_SYMBOL(FOO_BAR_BAZ), scripts/adjust_autoksyms.sh now touches include/ksym/FOO_BAR_BAZ instead of include/ksym/foo/bar/baz.h . This is more precise, avoiding possibly unnecessary rebuilds. EXPORT_SYMBOL(FOO_BAR_BAZ) EXPORT_SYMBOL(_FOO_BAR_BAZ) EXPORT_SYMBOL(__FOO_BAR_BAZ) were previously mapped to the same header, include/ksym/foo/bar/baz.h but now are handled separately. Signed-off-by: Masahiro Yamada commit 44815c90210cd858c4a116c3eb35270160cecf81 Author: Masahiro Yamada Date: Sat Aug 28 18:51:01 2021 +0900 kbuild: clean up objtool_args slightly The code: $(if $(or $(CONFIG_GCOV_KERNEL),$(CONFIG_LTO_CLANG)), ...) ... can be simpled to: $(if $(CONFIG_GCOV_KERNEL)$(CONFIG_LTO_CLANG), ...) Also, remove meaningless commas at the end of $(if ...). Signed-off-by: Masahiro Yamada commit e54dd93a08228b9942d708b133ad3715d92712b0 Author: Masahiro Yamada Date: Sat Aug 28 18:50:59 2021 +0900 modpost: get the *.mod file path more simply get_src_version() strips 'o' or 'lto.o' from the end of the object file path (so, postfixlen is 1 or 5), then adds 'mod'. If you look at the code closely, mod->name already holds the base path with the extension stripped. Most of the code changes made by commit 7ac204b545f2 ("modpost: lto: strip .lto from module names") was actually unneeded. sumversion.c does not need strends(), so it can get back local in modpost.c again. Signed-off-by: Masahiro Yamada commit 1439ebd2ce77242400518d4e6a1e85bebcd8084f Author: Ariel Marcovitch Date: Sun Aug 22 22:22:01 2021 +0300 checkkconfigsymbols.py: Fix the '--ignore' option It seems like the implementation of the --ignore option is broken. In check_symbols_helper, when going through the list of files, a file is added to the list of source files to check if it matches the ignore pattern. Instead, as stated in the comment below this condition, the file should be added if it doesn't match the pattern. This means that when providing an ignore pattern, the only files that will be checked will be the ones we want the ignore, in addition to the Kconfig files that don't match the pattern (the check in parse_kconfig_files is done right) Signed-off-by: Ariel Marcovitch Signed-off-by: Masahiro Yamada commit 5df77ad61fd71b1b342ba40d913ad5595480691c Author: Masahiro Yamada Date: Thu Aug 19 09:57:39 2021 +0900 kbuild: merge vmlinux_link() between ARCH=um and other architectures For ARCH=um, ${CC} is used as the linker driver. Hence, the linker options are prefixed with -Wl, . Merge the similar code. I replaced the -T option with the long option --script= so that it works well with/without ${wl}. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit d40aecd108d2a6413d53f6f8339e787a23150595 Author: Masahiro Yamada Date: Thu Aug 19 09:57:38 2021 +0900 kbuild: do not remove 'linux' link in scripts/link-vmlinux.sh arch/um/Makefile passes the -f option to the ln command: linux: vmlinux @echo ' LINK $@' $(Q)ln -f $< $@ So, the hard link is always re-created, and the old one is removed anyway. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit 8f1305124ea48943d1dd07683ed4f82c69b232ee Author: Masahiro Yamada Date: Thu Aug 19 09:57:37 2021 +0900 kbuild: merge vmlinux_link() between the ordinary link and Clang LTO When Clang LTO is enabled, vmlinux_link() reuses vmlinux.o instead of re-linking ${KBUILD_VMLINUX_OBJS} and ${KBUILD_VMLINUX_LIBS}. That is the only difference here, so merge the similar code. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit a8390ba9ddce15242a41ca04d097b75fd54fd63f Author: Masahiro Yamada Date: Thu Aug 19 09:57:36 2021 +0900 kbuild: remove stale *.symversions cmd_update_lto_symversions merges all the existing *.symversions, but some of them might be stale. If the last EXPORT_SYMBOL is removed from a C file, the *.symversions file is not deleted or updated. It contains stale CRCs, but still they will be used for linking the vmlinux or modules. It is not a big deal when the EXPORT_SYMBOL is really removed. However, when the EXPORT_SYMBOL is moved to another file, the same __crc_ will appear twice in the merged *.symversions, possibly with different CRCs if the function argument is changed at the same time. It would confuse module versioning. If no EXPORT_SYMBOL is found, let's remove *.symversions explicitly. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit f01ac2a15218f3282b0b09b7ef7f314cbd7dd2b3 Author: Masahiro Yamada Date: Thu Aug 19 09:57:35 2021 +0900 kbuild: remove unused quiet_cmd_update_lto_symversions This is not used anywhere because the short log is displayed when it is used through a $(call cmd,...) invocation. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit 265264b814c2121513eab2e1cffe196502af0961 Author: Masahiro Yamada Date: Thu Aug 19 09:57:33 2021 +0900 gen_compile_commands: extract compiler command from a series of commands The current gen_compile_commands.py assumes that objects are always built by a single command. It makes sense to support cases where objects are built by a series of commands: cmd_ := ; One use-case is that is a compiler command, and an objtool command. It allows *.cmd files to contain an objtool command so that any change in it triggers object rebuilds. If ; appears after the C source file, take the first command. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook commit 7ab44e9ee5f241c0ed19e350d17e80bd90bde93d Author: Nick Desaulniers Date: Mon Aug 16 17:21:07 2021 -0700 x86: remove cc-option-yn test for -mtune= As noted in the comment, -mtune= has been supported since GCC 3.4. The minimum required version of GCC to build the kernel (as specified in Documentation/process/changes.rst) is GCC 4.9. tune is not immediately expanded. Instead it defines a macro that will test via cc-option later values for -mtune=. But we can skip the test whether to use -mtune= vs. -mcpu=. Signed-off-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Reviewed-by: Miguel Ojeda Signed-off-by: Masahiro Yamada commit 43e6b58f793c47b0a6772a112e6586cd1e24b239 Author: Nick Desaulniers Date: Mon Aug 16 17:21:06 2021 -0700 arc: replace cc-option-yn uses with cc-option cc-option-yn can be replaced with cc-option. ie. Checking for support: ifeq ($(call cc-option-yn,$(FLAG)),y) becomes: ifneq ($(call cc-option,$(FLAG)),) Checking for lack of support: ifeq ($(call cc-option-yn,$(FLAG)),n) becomes: ifeq ($(call cc-option,$(FLAG)),) This allows us to pursue removing cc-option-yn. Signed-off-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit ff00f64bceb164267dccc3648eb299aeafd3a342 Author: Nick Desaulniers Date: Mon Aug 16 17:21:04 2021 -0700 s390: replace cc-option-yn uses with cc-option cc-option-yn can be replaced with cc-option. ie. Checking for support: ifeq ($(call cc-option-yn,$(FLAG)),y) becomes: ifneq ($(call cc-option,$(FLAG)),) Checking for lack of support: ifeq ($(call cc-option-yn,$(FLAG)),n) becomes: ifeq ($(call cc-option,$(FLAG)),) This allows us to pursue removing cc-option-yn. Signed-off-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Acked-by: Heiko Carstens Signed-off-by: Masahiro Yamada commit ba3e87cfa2a0f2db889297b6fc8a9e91a35c2d21 Author: Masahiro Yamada Date: Thu Aug 12 01:43:12 2021 +0900 ia64: move core-y in arch/ia64/Makefile to arch/ia64/Kbuild Use obj-y to clean up Makefile. Signed-off-by: Masahiro Yamada commit 87c3cb564f3e34626f1afc0286b864045559b403 Author: Masahiro Yamada Date: Thu Jul 29 23:24:40 2021 +0900 sparc: move the install rule to arch/sparc/Makefile Currently, the install target in arch/sparc/Makefile descends into arch/sparc/boot/Makefile to invoke the shell script, but there is no good reason to do so. arch/sparc/Makefile can run the shell script directly. Signed-off-by: Masahiro Yamada commit e052826ff1a685a5c3a7033e907213de8433253e Author: Masahiro Yamada Date: Sat May 29 03:01:40 2021 +0900 security: remove unneeded subdir-$(CONFIG_...) All of these are unneeded. The directories to descend are specified by obj-$(CONFIG_...). Signed-off-by: Masahiro Yamada commit 25c648a066c1cc5ed763f2354531fdff41ac83a1 Author: Greg Kroah-Hartman Date: Wed Apr 7 07:34:17 2021 +0200 kbuild: sh: remove unused install script The sh arch has a install.sh script, but no Makefile actually calls it. Remove it to keep anyone from accidentally calling it in the future. Signed-off-by: Greg Kroah-Hartman Reviewed-by: Kees Cook Signed-off-by: Masahiro Yamada commit 52d83df682c82055961531853c066f4f16e234ea Author: Masahiro Yamada Date: Thu Aug 19 09:01:14 2021 +0900 kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y When CONFIG_TRIM_UNUSED_KSYMS is enabled, I see some warnings like this: nm: arch/x86/entry/vdso/vdso32/note.o: no symbols $NM (both GNU nm and llvm-nm) warns when no symbol is found in the object. Suppress the stderr. Fangrui Song mentioned binutils>=2.37 `nm -q` can be used to suppress "no symbols" [1], and llvm-nm>=13.0.0 supports -q as well. We cannot use it for now, but note it as a TODO. [1]: https://sourceware.org/bugzilla/show_bug.cgi?id=27408 Fixes: bbda5ec671d3 ("kbuild: simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS") Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit 2185a7e4b0ade86c2c57fc63d4a7535c40254bd0 Author: Nathan Chancellor Date: Mon Aug 16 13:52:47 2021 -0700 kbuild: Switch to 'f' variants of integrated assembler flag It has been brought up a few times in various code reviews that clang 3.5 introduced -f{,no-}integrated-as as the preferred way to enable and disable the integrated assembler, mentioning that -{no-,}integrated-as are now considered legacy flags. Switch the kernel over to using those variants in case there is ever a time where clang decides to remove the non-'f' variants of the flag. Also, fix a typo in a comment ("intergrated" -> "integrated"). Link: https://releases.llvm.org/3.5.0/tools/clang/docs/ReleaseNotes.html#new-compiler-flags Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 6272cc389fec78d1c0685599b8cad974476d89bb Author: Nathan Chancellor Date: Mon Aug 16 13:20:56 2021 -0700 kbuild: Shuffle blank line to improve comment meaning -Wunused-but-set-variable and -Wunused-const-variable are both disabled for the same reason but there is a blank line between them and no blank line between -Wno-unused-const-variable and the block. Shuffle the new line so that it is clear that the comment applied to both flags and the next block is separate from them. Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 5c6ae0efca8d7aeac02f8734825067cd9475a264 Author: Nathan Chancellor Date: Mon Aug 16 13:20:55 2021 -0700 kbuild: Add a comment above -Wno-gnu Whenever a warning is disabled, it is helpful for future travelers to understand why the warning is disabled and why it is acceptable to do so. Add a comment for -Wno-gnu so that people understand why it is disabled. Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit a312b60d6c4f09cebb727ffab68754fbf39dc1f1 Author: Nathan Chancellor Date: Mon Aug 16 13:20:54 2021 -0700 kbuild: Remove -Wno-format-invalid-specifier from clang block Turning on -Wformat does not reveal any instances of this warning across several different builds so remove this line to keep the number of disabled warnings as slim as possible. This has been disabled since commit 61163efae020 ("kbuild: LLVMLinux: Add Kbuild support for building kernel with Clang"), which does not explain exactly why it was turned off but since it was so long ago in terms of both the kernel and LLVM so it is possible that some bug got fixed along the way. Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit e1f86d7b4b2a5213b012c2b4fe3e5b6ad537686e Author: Masahiro Yamada Date: Fri Aug 13 15:30:05 2021 +0900 kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and filechk if_changed, if_changed_dep, and if_changed_rule must have FORCE as a prerequisite so the command line change is detected. Documentation/kbuild/makefiles.rst clearly explains it: Note: It is a typical mistake to forget the FORCE prerequisite. However, not all people follow the document. This mistake occurred again and again, so a compelling force is needed. Show a warning if FORCE is missing in the prerequisite of if_changed and friends. Same for filechk. Signed-off-by: Masahiro Yamada Tested-by: Nicolas Schier commit 6796e80409b9031458e33dc39a3ac8aa3b93855b Author: Masahiro Yamada Date: Fri Aug 13 15:30:04 2021 +0900 kbuild: macrofy the condition of if_changed and friends Add a new macro that expands into $(newer-prereqs)$(cmd-check). It makes it easier to add common code for if_changed, if_changed_dep, and if_changed_rule. Signed-off-by: Masahiro Yamada commit 55a6d00ed0c1b4d20d7966d00fda6848d776658d Author: Masahiro Yamada Date: Thu Aug 19 10:22:51 2021 +0900 x86/build/vdso: fix missing FORCE for *.so build rule Add FORCE so that if_changed can detect the command line change. Signed-off-by: Masahiro Yamada commit 850ded46c64299f04d15e39caaba21963fb966f8 Author: Sami Tolvanen Date: Mon Aug 16 11:05:19 2021 -0700 kbuild: Fix TRIM_UNUSED_KSYMS with LTO_CLANG With CONFIG_LTO_CLANG, we currently link modules into native code just before modpost, which means with TRIM_UNUSED_KSYMS enabled, we still look at the LLVM bitcode in the .o files when generating the list of used symbols. As the bitcode doesn't yet have calls to compiler intrinsics and llvm-nm doesn't see function references that only exist in function-level inline assembly, we currently need a whitelist for TRIM_UNUSED_KSYMS to work with LTO. This change moves module LTO linking to happen earlier, and thus avoids the issue with LLVM bitcode and TRIM_UNUSED_KSYMS entirely, allowing us to also drop the whitelist from gen_autoksyms.sh. Link: https://github.com/ClangBuiltLinux/linux/issues/1369 Signed-off-by: Sami Tolvanen Reviewed-by: Alexander Lobakin Tested-by: Alexander Lobakin Signed-off-by: Masahiro Yamada commit 7d73c3e9c51400d3e0e755488050804e4d44737a Author: Nick Desaulniers Date: Mon Aug 16 13:25:01 2021 -0700 Makefile: remove stale cc-option checks cc-option, cc-option-yn, and cc-disable-warning all invoke the compiler during build time, and can slow down the build when these checks become stale for our supported compilers, whose minimally supported versions increases over time. See Documentation/process/changes.rst for the current supported minimal versions (GCC 4.9+, clang 10.0.1+). Compiler version support for these flags may be verified on godbolt.org. The following flags are GCC only and supported since at least GCC 4.9. Remove cc-option and cc-disable-warning tests. * -fno-tree-loop-im * -Wno-maybe-uninitialized * -fno-reorder-blocks * -fno-ipa-cp-clone * -fno-partial-inlining * -femit-struct-debug-baseonly * -fno-inline-functions-called-once * -fconserve-stack The following flags are supported by all supported versions of GCC and Clang. Remove their cc-option, cc-option-yn, and cc-disable-warning tests. * -fno-delete-null-pointer-checks * -fno-var-tracking * -Wno-array-bounds The following configs are made dependent on GCC, since they use GCC specific flags. * READABLE_ASM * DEBUG_SECTION_MISMATCH -mfentry was not supported by s390-linux-gnu-gcc until gcc-9+, add a comment. --param=allow-store-data-races=0 was renamed to -fno-allow-store-data-races in the GCC 10 release; add a comment. -Wmaybe-uninitialized (GCC specific) was being added for CONFIG_GCOV, then again unconditionally; add it only once. Also, base RETPOLINE_CFLAGS and RETPOLINE_VDSO_CFLAGS on CONFIC_CC_IS_* then remove cc-option tests for Clang. Link: https://github.com/ClangBuiltLinux/linux/issues/1436 Acked-by: Miguel Ojeda Reviewed-by: Nathan Chancellor Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 36f1386d341209bf5ec792938fbc0786b914f8dd Author: Nick Desaulniers Date: Tue Aug 10 13:56:10 2021 -0700 MAINTAINERS: add Nick to Kbuild reviewers Kees' post inspired me to get more involved. I still have a long way to go in terms of mastery of GNU make, but at the least I can help with more code review. It's also helpful for me to pick up on what's missing from the LLVM ecosystem. Link: https://security.googleblog.com/2021/08/linux-kernel-security-done-right.html Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit a9c9a6f741cdaa2fa9ba24a790db8d07295761e3 Merge: 23852bec534a1 9b5ac8ab4e8bf Author: Linus Torvalds Date: Thu Sep 2 15:09:46 2021 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This series consists of the usual driver updates (ufs, qla2xxx, target, smartpqi, lpfc, mpt3sas). The core change causing the most churn was replacing the command request field request with a macro, allowing us to offset map to it and remove the redundant field; the same was also done for the tag field. The most impactful change is the final removal of scsi_ioctl, which has been deprecated for over a decade" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (293 commits) scsi: ufs: Fix ufshcd_request_sense_async() for Samsung KLUFG8RHDA-B2D1 scsi: ufs: ufs-exynos: Fix static checker warning scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Copyright updates for 14.0.0.1 patches scsi: lpfc: Update lpfc version to 14.0.0.1 scsi: lpfc: Add bsg support for retrieving adapter cmf data scsi: lpfc: Add cmf_info sysfs entry scsi: lpfc: Add debugfs support for cm framework buffers scsi: lpfc: Add support for maintaining the cm statistics buffer scsi: lpfc: Add rx monitoring statistics scsi: lpfc: Add support for the CM framework scsi: lpfc: Add cmfsync WQE support scsi: lpfc: Add support for cm enablement buffer scsi: lpfc: Add cm statistics buffer support scsi: lpfc: Add EDC ELS support scsi: lpfc: Expand FPIN and RDF receive logging scsi: lpfc: Add MIB feature enablement support scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware scsi: fc: Add EDC ELS definition ... commit c1fe77e42440d2cad76055df6fb58caabf622d51 Merge: ee28b42006c37 6b430c7595e4e Author: Miquel Raynal Date: Fri Sep 3 00:04:16 2021 +0200 Merge tag 'nand/for-5.15' into mtd/next NAND core changes: * Repair Miquel Raynal's email address in MAINTAINERS * Fix a couple of spelling mistakes in Kconfig * bbt: Skip bad blocks when searching for the BBT in NAND * Remove never changed ret variable Raw NAND changes: * cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' * intel: Fix error handling in probe * omap: Fix kernel doc warning on 'calcuate' typo * gpmc: Fix the ECC bytes vs. OOB bytes equation SPI-NAND core changes: * Properly fill the OOB area. * Fix comment SPI-NAND drivers changes: * macronix: Add Quad support for serial NAND flash commit e5a2cac908df691f1637f9272d4c6dec83239611 Author: Helge Deller Date: Thu Sep 2 23:54:03 2021 +0200 parisc: Drop __arch_swab16(), arch_swab24(), _arch_swab32() and __arch_swab64() functions No need to keep those as inline assembly functions, the compiler now generates the same or even better optimized code. Signed-off-by: Helge Deller commit 23852bec534a1633dc08f4df88b8493ae99953a9 Merge: 83ec91697412a 6a217437f9f54 Author: Linus Torvalds Date: Thu Sep 2 14:47:21 2021 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This is quite a small cycle, no major series stands out. The HNS and rxe drivers saw the most activity this cycle, with rxe being broken for a good chunk of time. The significant deleted line count is due to a SPDX cleanup series. Summary: - Various cleanup and small features for rtrs - kmap_local_page() conversions - Driver updates and fixes for: efa, rxe, mlx5, hfi1, qed, hns - Cache the IB subnet prefix - Rework how CRC is calcuated in rxe - Clean reference counting in iwpm's netlink - Pull object allocation and lifecycle for user QPs to the uverbs core code - Several small hns features and continued general code cleanups - Fix the scatterlist confusion of orig_nents/nents introduced in an earlier patch creating the append operation" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (90 commits) RDMA/mlx5: Relax DCS QP creation checks RDMA/hns: Delete unnecessary blank lines. RDMA/hns: Encapsulate the qp db as a function RDMA/hns: Adjust the order in which irq are requested and enabled RDMA/hns: Remove RST2RST error prints for hw v1 RDMA/hns: Remove dqpn filling when modify qp from Init to Init RDMA/hns: Fix QP's resp incomplete assignment RDMA/hns: Fix query destination qpn RDMA/hfi1: Convert to SPDX identifier IB/rdmavt: Convert to SPDX identifier RDMA/hns: Bugfix for incorrect association between dip_idx and dgid RDMA/hns: Bugfix for the missing assignment for dip_idx RDMA/hns: Bugfix for data type of dip_idx RDMA/hns: Fix incorrect lsn field RDMA/irdma: Remove the repeated declaration RDMA/core/sa_query: Retry SA queries RDMA: Use the sg_table directly and remove the opencoded version from umem lib/scatterlist: Fix wrong update of orig_nents lib/scatterlist: Provide a dedicated function to support table append RDMA/hns: Delete unused hns bitmap interface ... commit 83ec91697412ae64d25dcca74597ed03029aa00d Merge: c793011242d18 46a226b50ec3d Author: Linus Torvalds Date: Thu Sep 2 14:30:46 2021 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Fix in i2c-hid driver for Elan touchpad quirk regression (Jim Broadus) - Quirk preventing ASUS Claymore from accidentally suspending whole system (Luke D. Jones) - Updates to the existing FW reporting mechanism, MP2 FW status checks, adding proper power management support for amd-sfh (Basavaraj Natikar) - Regression fix for an issue in HID core that got uncovered by recent USB core cleanup leading to issues when transfer_buffer_length is not in line with wLength (Alan Stern) - Memory leak fix in USB HID core (Anirudh Rayabharam) - Improvement of stylus battery reporting (Dmitry Torokhov) - Power management improvement for Goodix driver (Douglas Anderson) - High-resolution scroll support for Magicmouse devices (José Expósito) - Support for GHLive PS4 dongles (Daniel Nguyen) - Support proper EV_MSC emissions to hid-apple (Vincent Lefevre) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (31 commits) HID: usbhid: Simplify code in hid_submit_ctrl() HID: usbhid: Fix warning caused by 0-length input reports HID: usbhid: Fix flood of "control queue full" messages HID: sony: Fix more ShanWan clone gamepads to not rumble when plugged in. HID: sony: support for the ghlive ps4 dongles HID: thrustmaster: clean up Makefile and adapt quirks HID: i2c-hid: Fix Elan touchpad regression HID: asus: Prevent Claymore sending suspend event HID: amd_sfh: Add dyndbg prints for debugging HID: amd_sfh: Add support for PM suspend and resume HID: amd_sfh: Move hid probe after sensor is enabled HID: amd_sfh: Add command response to check command status HID: amd_sfh: Fix period data field to enable sensor HID: logitech-hidpp: battery: provide CAPACITY property for newer devices HID: thrustmaster: Fix memory leak in thrustmaster_interrupts() HID: thrustmaster: Fix memory leak in remove HID: thrustmaster: Fix memory leaks in probe HID: elo: update the reference count of the usb device structure HID: logitech-hidpp: Use 'atomic_inc_return' instead of hand-writing it HID: apple: Add missing scan code event for keys handled by hid-apple ... commit c793011242d182e5f12800c12dbaf37af80be735 Merge: 75d6e7d9ced83 04853352952b7 Author: Linus Torvalds Date: Thu Sep 2 14:22:56 2021 -0700 Merge tag 'pinctrl-v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes for the v5.15 kernel cycle, no core changes at all this time, just driver work! New drivers: - New subdriver for Intel Keem Bay (an ARM-based SoC) - New subdriver for Qualcomm MDM9607 and SM6115 - New subdriver for ST Microelectronics STM32MP135 - New subdriver for Freescale i.MX8ULP ("Ultra Low Power") - New subdriver for Ingenic X2100 - Support for Qualcomm PMC8180, PMC8180C, SA8155p-adp PMIC GPIO - Support Samsung Exynos850 - Support Renesas RZ/G2L Enhancements: - A major refactoring of the Rockchip driver, breaking part of it out to a separate GPIO driver in drivers/gpio - Pin bias support on Renesas r8a77995 - Add SCI pins support to Ingenic JZ4755 and JZ4760 - Mediatek device tree bindings converted to YAML" * tag 'pinctrl-v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (53 commits) pinctrl: renesas: Add RZ/G2L pin and gpio controller driver pinctrl: samsung: Add Exynos850 SoC specific data dt-bindings: pinctrl: samsung: Add Exynos850 doc MAINTAINERS: Add maintainers for amd-pinctrl driver pinctrl: Add Intel Keem Bay pinctrl driver dt-bindings: pinctrl: Add bindings for Intel Keembay pinctrl driver pinctrl: zynqmp: Drop pinctrl_unregister for devm_ registered device dt-bindings: pinctrl: qcom-pmic-gpio: Remove the interrupts property dt-bindings: pinctrl: qcom-pmic-gpio: Convert qcom pmic gpio bindings to YAML dt-bindings: pinctrl: mt8195: Use real world values for drive-strength arguments dt-bindings: mediatek: convert pinctrl to yaml arm: dts: mt8183: Move pinfunc to include/dt-bindings/pinctrl arm: dts: mt8135: Move pinfunc to include/dt-bindings/pinctrl pinctrl: ingenic: Add .max_register in regmap_config pinctrl: ingenic: Fix bias config for X2000(E) pinctrl: ingenic: Fix incorrect pull up/down info pinctrl: Ingenic: Add pinctrl driver for X2100. dt-bindings: pinctrl: Add bindings for Ingenic X2100. pinctrl: Ingenic: Add SSI pins support for JZ4755 and JZ4760. pinctrl: Ingenic: Improve the code. ... commit 75d6e7d9ced83e937757e278c3ce1ccd6606a96a Merge: a180eab0b564a 47505bf3a8216 Author: Linus Torvalds Date: Thu Sep 2 14:17:24 2021 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Nothing changed in the clk framework core this time around. We did get some updates to the basic clk types to use determine_rate for the divider type and add a power of two fractional divider flag though. Otherwise, this is a collection of clk driver updates. More than half the diffstat is in the Qualcomm clk driver where we add a bunch of data to describe clks on various SoCs and fix bugs. The other big new thing in here is the Mediatek MT8192 clk driver. That's been under review for a while and it's nice to see that it's finally upstream. Beyond that it's the usual set of minor fixes and tweaks to clk drivers. There are some non-clk driver bits in here which have all been acked by the respective maintainers. New Drivers: - Support video, gpu, display clks on qcom sc7280 SoCs - GCC clks on qcom MSM8953, SM4250/6115, and SM6350 SoCs - Multimedia clks (MMCC) on qcom MSM8994/MSM8992 - RPMh clks on qcom SM6350 SoCs - Support for Mediatek MT8192 SoCs - Add display (DU and DSI) clocks on Renesas R-Car V3U - Add I2C, DMAC, USB, sound (SSIF-2), GPIO, CANFD, and ADC clocks and resets on Renesas RZ/G2L Updates: - Support the SD/OE pin on IDT VersaClock 5 and 6 clock generators - Add power of two flag to fractional divider clk type - Migrate some clk drivers to clk_divider_ops.determine_rate - Migrate to clk_parent_data in gcc-sdm660 - Fix CLKOUT clocks on i.MX8MM and i.MX8MN by using imx_clk_hw_mux2 - Switch from .round_rate to .determine_rate in clk-divider-gate - Fix clock tree update for TF-A controlled clocks for all i.MX8M - Add missing M7 core clock for i.MX8MN - YAML conversion of rk3399 clock controller binding - Removal of GRF dependency for the rk3328/rk3036 pll types - Drop CLK_IS_CRITICAL flag from Tegra fuse clk - Make CLK_R9A06G032 Kconfig symbol invisible - Convert various DT bindings to YAML" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (128 commits) dt-bindings: clock: samsung: fix header path in example clk: tegra: fix old-style declaration clk: qcom: Add SM6350 GCC driver MAINTAINERS: clock: include S3C and S5P in Samsung SoC clock entry dt-bindings: clock: samsung: convert S5Pv210 AudSS to dtschema dt-bindings: clock: samsung: convert Exynos AudSS to dtschema dt-bindings: clock: samsung: convert Exynos4 to dtschema dt-bindings: clock: samsung: convert Exynos3250 to dtschema dt-bindings: clock: samsung: convert Exynos542x to dtschema dt-bindings: clock: samsung: add bindings for Exynos external clock dt-bindings: clock: samsung: convert Exynos5250 to dtschema clk: vc5: Add properties for configuring SD/OE behavior clk: vc5: Use dev_err_probe dt-bindings: clk: vc5: Add properties for configuring the SD/OE pin dt-bindings: clock: brcm,iproc-clocks: fix armpll properties clk: zynqmp: Fix kernel-doc format clk: at91: clk-generated: Limit the requested rate to our range clk: ralink: avoid to set 'CLK_IS_CRITICAL' flag for gates clk: zynqmp: Fix a memory leak clk: zynqmp: Check the return type ... commit a180eab0b564a9dc149beb0517136ef7129f1260 Merge: 7ba88a2a09f47 85dfdbfc13ea9 Author: Linus Torvalds Date: Thu Sep 2 14:12:24 2021 -0700 Merge tag 'mailbox-v5.15' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - mtk: - added support for mt8192 and mt8195 - minor fix regarding address shift - qcom: - added compatibles for MSM8953, SM6350 and SM6115 - enable loading IPCC as a module - misc: - change Altera maintainer - fix sti kernel-doc warnings * tag 'mailbox-v5.15' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: cmdq: add multi-gce clocks support for mt8195 mailbox: cmdq: add mediatek mailbox support for mt8195 dt-bindings: gce: add gce header file for mt8195 dt-bindings: mailbox: add definition for mt8195 mailbox: qcom-apcs-ipc: Add compatible for MSM8953 SoC dt-bindings: mailbox: Add compatible for the MSM8953 dt-bindings: mailbox: qcom-ipcc: Add compatible for SM6350 mailbox: qcom: Add support for SM6115 APCS IPC dt-bindings: mailbox: qcom: Add SM6115 APCS compatible soc: mediatek: cmdq: add address shift in jump mailbox: cmdq: add mt8192 support dt-binding: gce: add gce header file for mt8192 MAINTAINERS: Replace Ley Foon Tan as Altera Mailbox maintainer mailbox: qcom-ipcc: Enable loading QCOM_IPCC as a module mailbox: sti: quieten kernel-doc warnings commit 7ba88a2a09f47e2e4f3e34215677a1d78a9e6a73 Merge: 89b6b8cd92c06 0487d4fc42d7f Author: Linus Torvalds Date: Thu Sep 2 13:49:39 2021 -0700 Merge tag 'platform-drivers-x86-v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: "Highlights: - Move all the Intel drivers into their own subdir(s) (mostly Kate's work) - New meraki-mx100 platform driver - Asus WMI driver enhancements, including support for /sys/firmware/acpi/platform_profile - New BIOS SAR driver for Intel M.2 WWAM modems - Alder Lake support for the Intel PMC driver - A whole bunch of cleanups + fixes all over the place" * tag 'platform-drivers-x86-v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (65 commits) platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call platform/x86: dell-smbios-wmi: Avoid false-positive memcpy() warning platform/x86: ISST: use semi-colons instead of commas platform/x86: asus-wmi: Fix "unsigned 'retval' is never less than zero" smatch warning platform/x86: asus-wmi: Delete impossible condition platform/x86: hp_accel: Convert to be a platform driver platform/x86: hp_accel: Remove _INI method call platform/mellanox: mlxbf-pmc: fix kernel-doc notation platform/x86/intel: pmc/core: Add GBE Package C10 fix for Alder Lake PCH platform/x86/intel: pmc/core: Add Alder Lake low power mode support for pmc core platform/x86/intel: pmc/core: Add Latency Tolerance Reporting (LTR) support to Alder Lake platform/x86/intel: pmc/core: Add Alderlake support to pmc core driver platform/x86: intel-wmi-thunderbolt: Move to intel sub-directory platform/x86: intel-wmi-sbl-fw-update: Move to intel sub-directory platform/x86: intel-vbtn: Move to intel sub-directory platform/x86: intel_oaktrail: Move to intel sub-directory platform/x86: intel_int0002_vgpio: Move to intel sub-directory platform/x86: intel-hid: Move to intel sub-directory platform/x86: intel_atomisp2: Move to intel sub-directory platform/x86: intel_speed_select_if: Move to intel sub-directory ... commit 9f3589993c0c69ab9f2401a6b65b21c419b482d6 Author: Jeff Layton Date: Tue Jan 26 13:22:31 2021 -0500 ceph: drop the mdsc_get_session/put_session dout messages These are very chatty, racy, and not terribly useful. Just remove them. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 3eaf5aa1cfa8c97c72f5824e2e9263d6cc977b03 Author: Jeff Layton Date: Thu Sep 2 08:31:03 2021 -0400 ceph: lockdep annotations for try_nonblocking_invalidate Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit a76d0a9c288ea7f5fc01bf05485573ce6b36b839 Author: Xiubo Li Date: Wed Aug 25 21:45:45 2021 +0800 ceph: don't WARN if we're forcibly removing the session caps For example in the case of a forced umount, we'll remove all the session caps even if they are dirty. Move the warning to a wrapper function and make most of the callers use it. Call the core function when removing caps due to a forced umount. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 42ad631b4d0e0d6da0bfe375af99887251fbf970 Author: Xiubo Li Date: Wed Aug 25 21:45:44 2021 +0800 ceph: don't WARN if we're force umounting Force umount will try to close the sessions by setting the session state to _CLOSING. We don't want to WARN in this situation, since it's expected. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit a6d37ccdd240e80f26aaea0e62cda310e0e184d7 Author: Xiubo Li Date: Wed Aug 25 21:45:43 2021 +0800 ceph: remove the capsnaps when removing caps capsnaps will take inode references via ihold when queueing to flush. When force unmounting, the client will just close the sessions and may never get a flush reply, causing a leak and inode ref leak. Fix this by removing the capsnaps for an inode when removing the caps. URL: https://tracker.ceph.com/issues/52295 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit b11ed50346683a749632ea664959b28d524d7395 Author: Jeff Layton Date: Wed Aug 11 06:40:42 2021 -0400 ceph: request Fw caps before updating the mtime in ceph_write_iter The current code will update the mtime and then try to get caps to handle the write. If we end up having to request caps from the MDS, then the mtime in the cap grant will clobber the updated mtime and it'll be lost. This is most noticable when two clients are alternately writing to the same file. Fw caps are continually being granted and revoked, and the mtime ends up stuck because the updated mtimes are always being overwritten with the old one. Fix this by changing the order of operations in ceph_write_iter to get the caps before updating the times. Also, make sure we check the pool full conditions before even getting any caps or uninlining. URL: https://tracker.ceph.com/issues/46574 Reported-by: Jozef Kováč Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Reviewed-by: Luis Henriques Signed-off-by: Ilya Dryomov commit d517b3983dd3106ca92d6c5d0d09415a4a09481c Author: Xiubo Li Date: Wed Aug 18 09:31:19 2021 +0800 ceph: reconnect to the export targets on new mdsmaps In the case where the export MDS has crashed just after the EImportStart journal is flushed, a standby MDS takes over for it and when replaying the EImportStart journal the MDS will wait the client to reconnect. That may never happen because the client may not have registered or opened the sessions yet. When receiving a new map, ensure we reconnect to valid export targets as well if their sessions don't exist yet. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 692e17159792a13e8c5031bdc0ae9b0f3158593d Author: Jeff Layton Date: Mon Aug 2 15:32:47 2021 -0400 ceph: print more information when we can't find snaprealm Print a bit more information when we can't find the realm during ceph_add_cap. Show both the inode number and the old realm inode number. Suggested-by: Sage Weil Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 0ba92e1c5f7ce7e9c1c828a84e873d7be51c1b9f Author: Jeff Layton Date: Mon Aug 2 11:01:26 2021 -0400 ceph: add ceph_change_snap_realm() helper Consolidate some fiddly code for changing an inode's snap_realm into a new helper function, and change the callers to use it. While we're in here, nothing uses the i_snap_realm_counter field, so remove that from the inode. Signed-off-by: Jeff Layton Reviewed-by: Luis Henriques Signed-off-by: Ilya Dryomov commit c80dc3aee984c647d747bb07c108862effc917d8 Author: Jeff Layton Date: Tue Jul 27 10:50:02 2021 -0400 ceph: remove redundant initializations from mdsc and session The ceph_mds_client and ceph_mds_session structures are kzalloc'ed so there's no need to explicitly initialize either of their fields to 0. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit b4002173b7989588b6feaefc42edaf011b596782 Author: Jeff Layton Date: Tue Jul 27 15:47:12 2021 -0400 ceph: cancel delayed work instead of flushing on mdsc teardown The first thing metric_delayed_work does is check mdsc->stopping, and then return immediately if it's set. That's good since we would have already torn down the metric structures at this point, otherwise, but there is no locking around mdsc->stopping. It's possible that the ceph_metric_destroy call could race with the delayed_work, in which case we could end up with the delayed_work accessing destroyed percpu variables. At this point in the mdsc teardown, the "stopping" flag has already been set, so there's no benefit to flushing the work. Move the work cancellation in ceph_metric_destroy ahead of the percpu variable destruction, and eliminate the flush_delayed_work call in ceph_mdsc_destroy. Fixes: 18f473b384a6 ("ceph: periodically send perf metrics to MDSes") Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 40e309de4dd84ba91b9e0549a5173ce13ef02c5e Author: Jeff Layton Date: Mon Jul 26 07:07:50 2021 -0400 ceph: add a new vxattr to return auth mds for an inode Add a new vxattr that shows what MDS is authoritative for an inode (if we happen to have auth caps). If we don't have an auth cap for the inode then just return -1. URL: https://tracker.ceph.com/issues/1276 Signed-off-by: Jeff Layton Reviewed-by: Luis Henriques Signed-off-by: Ilya Dryomov commit 49f8899e5edfc4b8a97d3959e1ded5a95f2e46b3 Author: Jeff Layton Date: Wed Jul 7 12:26:47 2021 -0400 ceph: remove some defunct forward declarations We missed these in the recent fscache rework. Reported-by: Steve French Signed-off-by: Jeff Layton Signed-off-by: Ilya Dryomov commit e1a4541ec0b951685a49d1f72d183681e6433a45 Author: Xiubo Li Date: Mon Jul 5 09:22:57 2021 +0800 ceph: flush the mdlog before waiting on unsafe reqs For the client requests who will have unsafe and safe replies from MDS daemons, in the MDS side the MDS daemons won't flush the mdlog (journal log) immediatelly, because they think it's unnecessary. That's true for most cases but not all, likes the fsync request. The fsync will wait until all the unsafe replied requests to be safely replied. Normally if there have multiple threads or clients are running, the whole mdlog in MDS daemons could be flushed in time if any request will trigger the mdlog submit thread. So usually we won't experience the normal operations will stuck for a long time. But in case there has only one client with only thread is running, the stuck phenomenon maybe obvious and the worst case it must wait at most 5 seconds to wait the mdlog to be flushed by the MDS's tick thread periodically. This patch will trigger to flush the mdlog in the relevant and auth MDSes to which the in-flight requests are sent just before waiting the unsafe requests to finish. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit d095559ce4100f0c02aea229705230deac329c97 Author: Xiubo Li Date: Mon Jul 5 09:22:56 2021 +0800 ceph: flush mdlog before umounting Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 59b312f36230ea91ebb6ce1b11f2781604495d30 Author: Xiubo Li Date: Mon Jul 5 09:22:55 2021 +0800 ceph: make iterate_sessions a global symbol Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit fba97e8025015b63b1bdb73cd868c8ea832a1620 Author: Xiubo Li Date: Mon Jul 5 09:22:54 2021 +0800 ceph: make ceph_create_session_msg a global symbol Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit ce3a8732ae0d43a6d14aa24624c0f12b3e6281b9 Author: Jeff Layton Date: Mon Jun 14 07:15:38 2021 -0400 ceph: fix comment about short copies in ceph_write_end Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 2ad32cf09bd28a21e6ad1595355a023ed631b529 Author: Jeff Layton Date: Thu Jul 1 10:41:46 2021 -0400 ceph: fix memory leak on decode error in ceph_handle_caps If we hit a decoding error late in the frame, then we might exit the function without putting the pool_ns string. Ensure that we always put that reference on the way out of the function. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 89b6b8cd92c068cd1bdf877ec7fb1392568ef35d Merge: 9ae5fceb9a201 ea870730d83fc Author: Linus Torvalds Date: Thu Sep 2 13:41:33 2021 -0700 Merge tag 'vfio-v5.15-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Fix dma-valid return WAITED implementation (Anthony Yznaga) - SPDX license cleanups (Cai Huoqing) - Split vfio-pci-core from vfio-pci and enhance PCI driver matching to support future vendor provided vfio-pci variants (Yishai Hadas, Max Gurtovoy, Jason Gunthorpe) - Replace duplicated reflck with core support for managing first open, last close, and device sets (Jason Gunthorpe, Max Gurtovoy, Yishai Hadas) - Fix non-modular mdev support and don't nag about request callback support (Christoph Hellwig) - Add semaphore to protect instruction intercept handler and replace open-coded locks in vfio-ap driver (Tony Krowiak) - Convert vfio-ap to vfio_register_group_dev() API (Jason Gunthorpe) * tag 'vfio-v5.15-rc1' of git://github.com/awilliam/linux-vfio: (37 commits) vfio/pci: Introduce vfio_pci_core.ko vfio: Use kconfig if XX/endif blocks instead of repeating 'depends on' vfio: Use select for eventfd PCI / VFIO: Add 'override_only' support for VFIO PCI sub system PCI: Add 'override_only' field to struct pci_device_id vfio/pci: Move module parameters to vfio_pci.c vfio/pci: Move igd initialization to vfio_pci.c vfio/pci: Split the pci_driver code out of vfio_pci_core.c vfio/pci: Include vfio header in vfio_pci_core.h vfio/pci: Rename ops functions to fit core namings vfio/pci: Rename vfio_pci_device to vfio_pci_core_device vfio/pci: Rename vfio_pci_private.h to vfio_pci_core.h vfio/pci: Rename vfio_pci.c to vfio_pci_core.c vfio/ap_ops: Convert to use vfio_register_group_dev() s390/vfio-ap: replace open coded locks for VFIO_GROUP_NOTIFY_SET_KVM notification s390/vfio-ap: r/w lock for PQAP interception handler function pointer vfio/type1: Fix vfio_find_dma_valid return vfio-pci/zdev: Remove repeated verbose license text vfio: platform: reset: Convert to SPDX identifier vfio: Remove struct vfio_device_ops open/release ... commit 3f2b16734914fa7c53ef7f8a10a63828890dbd37 Author: Jitao Shi Date: Sun Aug 8 21:24:33 2021 +0800 pwm: mtk-disp: Implement atomic API .get_state() Switch the driver to support the .get_state() method. Signed-off-by: Jitao Shi [thierry.reding@gmail.com: add missing linux/bitfield.h include] Signed-off-by: Thierry Reding commit 331e049dec64c2d269648a3ea4ea6aae8a54b4ac Author: Jitao Shi Date: Sun Aug 8 21:24:32 2021 +0800 pwm: mtk-disp: Fix overflow in period and duty calculation Current calculation for period and high_width may have 64-bit overflow. state->period and rate are u64. rate * state->period will overflow. clk_div = div_u64(rate * state->period, NSEC_PER_SEC) period = div64_u64(rate * state->period, div); high_width = div64_u64(rate * state->duty_cycle, div); This patch is to resolve it by using mul_u64_u64_div_u64(). Signed-off-by: Jitao Shi Signed-off-by: Thierry Reding commit 888a623db5d025cc72cd2887bacc3cf3fad10b6f Author: Jitao Shi Date: Sun Aug 8 21:24:31 2021 +0800 pwm: mtk-disp: Implement atomic API .apply() Switch the driver to support the .apply() method. Signed-off-by: Jitao Shi Signed-off-by: Thierry Reding commit 799206c1302e8fabfab5a4151e74a2fe90090590 Author: Konrad Rzeszutek Wilk Date: Wed Sep 1 20:22:11 2021 -0400 iscsi_ibft: Fix isa_bus_to_virt not working under ARM The isa_bus_to_virt is only needed under X86 and in fact the code that sets the ibft_phys_addr is only compiled under X86. As such lets just ifdef the code. Reported-by: kernel test robot Reported-by: Vijayendra Suman CC: Maurizio Lombardi CC: Mike Rapoport Signed-off-by: Konrad Rzeszutek Wilk --- v2: Remove the ibft_phys_addr as it is defined in iscsi_ibft.h commit 9ae5fceb9a20154d74586fe17d1096b981b23e34 Merge: a2d616b935a0d 58e636039b512 Author: Linus Torvalds Date: Thu Sep 2 13:20:11 2021 -0700 Merge tag 'for-linus-5.15-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - some small cleanups - a fix for a bug when running as Xen PV guest which could result in not all memory being transferred in case of a migration of the guest - a small series for getting rid of code for supporting very old Xen hypervisor versions nobody should be using since many years now - a series for hardening the Xen block frontend driver - a fix for Xen PV boot code issuing warning messages due to a stray preempt_disable() on the non-boot processors * tag 'for-linus-5.15-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: remove stray preempt_disable() from PV AP startup code xen/pcifront: Removed unnecessary __ref annotation x86: xen: platform-pci-unplug: use pr_err() and pr_warn() instead of raw printk() drivers/xen/xenbus/xenbus_client.c: fix bugon.cocci warnings xen/blkfront: don't trust the backend response data blindly xen/blkfront: don't take local copy of a request from the ring page xen/blkfront: read response from backend only once xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests xen: assume XENFEAT_mmu_pt_update_preserve_ad being set for pv guests xen: check required Xen features xen: fix setting of max_pfn in shared_info commit a2d616b935a0df24bc9375785b19bf30d7fc9c6a Merge: b5d6d2633c1b6 6f1fce595b78b Author: Linus Torvalds Date: Thu Sep 2 13:16:00 2021 -0700 Merge tag 'for-5.15/parisc' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture updates from Helge Deller: - Fix a kernel crash when a signal is delivered to bad userspace stack - Fix fall-through warnings in math-emu code - Increase size of gcc stack frame check - Switch coding from 'pci_' to 'dma_' API - Make struct parisc_driver::remove() return void - Some parisc related Makefile changes - Minor cleanups, e.g. change to octal permissions, fix macro collisions, fix PMD_ORDER collision, replace spaces with tabs * tag 'for-5.15/parisc' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: math-emu: Fix fall-through warnings parisc: fix crash with signals and alloca parisc: Fix compile failure when building 64-bit kernel natively parisc: ccio-dma.c: Added tab instead of spaces parisc/parport_gsc: switch from 'pci_' to 'dma_' API parisc: move core-y in arch/parisc/Makefile to arch/parisc/Kbuild parisc: switch from 'pci_' to 'dma_' API parisc: Make struct parisc_driver::remove() return void parisc: remove unused arch/parisc/boot/install.sh and its phony target parisc: Rename PMD_ORDER to PMD_TABLE_ORDER parisc: math-emu: Avoid "fmt" macro collision parisc: Increase size of gcc stack frame check parisc: Replace symbolic permissions with octal permissions commit b5d6d2633c1b6b2b4599f658f8abe7eb1358cc77 Merge: aa829778b16f1 7b7cec477fc3c Author: Linus Torvalds Date: Thu Sep 2 13:12:44 2021 -0700 Merge tag 'xtensa-20210902' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG - add fairness to handling IRQs of the same priority - fix pointer usage before NULL check in ISS console driver - build system cleanups * tag 'xtensa-20210902' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: move core-y in arch/xtensa/Makefile to arch/xtensa/Kbuild xtensa: build platform directories unconditionally xtensa: do not build variants directory xtensa: remove unneeded exports xtensa: ISS: don't use string pointer before NULL check xtensa: add fairness to IRQ handling xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG commit 340576590dac4bb58d532a8ad5bfa806d8ab473c Author: Thomas Gleixner Date: Thu Sep 2 11:48:51 2021 +0200 futex: Avoid redundant task lookup No need to do the full VPID based task lookup and validation of the top waiter when the user space futex was acquired on it's behalf during the requeue_pi operation. The task is known already and it cannot go away before requeue_pi_wake_futex() has been invoked. Split out the actual attach code from attach_pi_state_owner() and use that instead of the full blown variant. Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20210902094414.676104881@linutronix.de commit 249955e51c8136189b3c66f54e212981a1350a0f Author: Thomas Gleixner Date: Thu Sep 2 11:48:50 2021 +0200 futex: Clarify comment for requeue_pi_wake_futex() It's slightly confusing. Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20210902094414.618613025@linutronix.de commit 4f07ec0d76f242d4ca0f0c0c6f7293c28254a554 Author: Thomas Gleixner Date: Thu Sep 2 11:48:48 2021 +0200 futex: Prevent inconsistent state and exit race The recent rework of the requeue PI code introduced a possibility for going back to user space in inconsistent state: CPU 0 CPU 1 requeue_futex() if (lock_pifutex_user()) { dequeue_waiter(); wake_waiter(task); sched_in(task); return_from_futex_syscall(); ---> Inconsistent state because PI state is not established It becomes worse if the woken up task immediately exits: sys_exit(); attach_pistate(vpid); <--- FAIL Attach the pi state before dequeuing and waking the waiter. If the waiter gets a spurious wakeup before the dequeue operation it will wait in futex_requeue_pi_wakeup_sync() and therefore cannot return and exit. Fixes: 07d91ef510fb ("futex: Prevent requeue_pi() lock nesting issue on RT") Reported-by: syzbot+4d1bd0725ef09168e1a0@syzkaller.appspotmail.com Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20210902094414.558914045@linutronix.de commit a974b54036f79dd5e395e9f6c80c3decb4661a14 Author: Colin Ian King Date: Wed Aug 18 14:18:40 2021 +0100 futex: Return error code instead of assigning it without effect The check on the rt_waiter and top_waiter->pi_state is assigning an error return code to ret but this later gets re-assigned, hence the check is ineffective. Return -EINVAL rather than assigning it to ret which was the original intent. Fixes: dc7109aaa233 ("futex: Validate waiter correctly in futex_proxy_trylock_atomic()") Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner Reviewed-by: André Almeida Link: https://lore.kernel.org/r/20210818131840.34262-1-colin.king@canonical.com commit 15eb7c888e749fbd1cc0370f3d38de08ad903700 Author: Mike Galbraith Date: Tue Aug 31 08:38:19 2021 +0200 locking/rwsem: Add missing __init_rwsem() for PREEMPT_RT 730633f0b7f95 became the first direct caller of __init_rwsem() vs the usual init_rwsem(), exposing PREEMPT_RT's lack thereof. Add it. [ tglx: Move it out of line ] Signed-off-by: Mike Galbraith Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/50a936b7d8f12277d6ec7ed2ef0421a381056909.camel@gmx.de commit d7a4e582587d97a586b1f7709e3bddcf35928e96 Author: Jitao Shi Date: Sun Aug 8 21:24:29 2021 +0800 pwm: mtk-disp: Adjust the clocks to avoid them mismatch The clks "main" and "mm" are prepared in .probe() (and unprepared in .remove()). This results in the clocks being on during suspend which results in unnecessarily increased power consumption. Remove the clock operations from .probe() and .remove(). Add the clk_prepare_enable() in .enable() and the clk_disable_unprepare() in .disable(). Signed-off-by: Jitao Shi [thierry.reding@gmail.com: squashed in fixup patch] Signed-off-by: Thierry Reding commit aa829778b16f15266fefe2640f04931b16ce39c0 Merge: aef4892a63c24 4812c9111220b Author: Linus Torvalds Date: Thu Sep 2 13:00:15 2021 -0700 Merge tag 'locking-debug-2021-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull memory model updates from Ingo Molnar: "LKMM updates: - Update documentation and code example KCSAN updates: - Introduce CONFIG_KCSAN_STRICT (which RCU uses) - Optimize use of get_ctx() by kcsan_found_watchpoint() - Rework atomic.h into permissive.h - Add the ability to ignore writes that change only one bit of a given data-racy variable. - Improve comments" * tag 'locking-debug-2021-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools/memory-model: Document data_race(READ_ONCE()) tools/memory-model: Heuristics using data_race() must handle all values tools/memory-model: Add example for heuristic lockless reads tools/memory-model: Make read_foo_diagnostic() more clearly diagnostic kcsan: Make strict mode imply interruptible watchers kcsan: permissive: Ignore data-racy 1-bit value changes kcsan: Print if strict or non-strict during init kcsan: Rework atomic.h into permissive.h kcsan: Reduce get_ctx() uses in kcsan_found_watchpoint() kcsan: Introduce CONFIG_KCSAN_STRICT kcsan: Remove CONFIG_KCSAN_DEBUG kcsan: Improve some Kconfig comments commit d7109fe3a0991a0f7b4ac099b78c908e3b619787 Author: Andy Shevchenko Date: Thu Aug 26 18:03:17 2021 +0300 x86/platform: Increase maximum GPIO number for X86_64 By default the 512 GPIOs is the maximum on any x86 platform. With, for example, Intel Tiger Lake-H the SoC based controller occupies up to 480 pins. This leaves only 32 available for GPIO expanders or other drivers, like PMIC. Hence, bump the maximum GPIO number to 1024 for X86_64 and leave 512 for X86_32. Signed-off-by: Andy Shevchenko Signed-off-by: Thomas Gleixner Reviewed-by: Linus Walleij Reviewed-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20210826150317.29435-1-andriy.shevchenko@linux.intel.com commit 742a4c49a82a8fe1369e4ec2af4a9bf69123cb88 Merge: e3c825c93e623 224d8031e482b Author: Bjorn Helgaas Date: Thu Sep 2 14:56:52 2021 -0500 Merge branch 'remotes/lorenzo/pci/tools' - Zero-initialize pcitest param to avoid random "-d" setting (Shunyong Yang) * remotes/lorenzo/pci/tools: tools: PCI: Zero-initialize param commit e3c825c93e623198ad08e73f49377489ff6fb03b Merge: 6e129176c3afd 9f1168cf263aa Author: Bjorn Helgaas Date: Thu Sep 2 14:56:52 2021 -0500 Merge branch 'remotes/lorenzo/pci/misc' - Make ixp4xx driver depend on ARCH_IXP4XX (Geert Uytterhoeven) * remotes/lorenzo/pci/misc: PCI: controller: PCI_IXP4XX should depend on ARCH_IXP4XX commit 6e129176c3afd337966562fc3de236cc48447582 Merge: eccefc748e0ed 0c84f5bf3eb32 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:51 2021 -0500 Merge branch 'remotes/lorenzo/pci/endpoint' - Add max-virtual-functions to endpoint binding (Kishon Vijay Abraham I) - Add pci_epf_add_vepf() API to add virtual function to endpoint (Kishon Vijay Abraham I) - Add pci_epf_vepf_link() to link virtual function to endpoint physical function (Kishon Vijay Abraham I) - Add virtual function number to pci_epc_ops endpoint ops interfaces (Kishon Vijay Abraham I) - Simplify register base address computation for endpoint BAR configuration (Kishon Vijay Abraham I) - Add support to configure virtual functions in cadence endpoint driver (Kishon Vijay Abraham I) - Add SR-IOV configuration to endpoint test driver (Kishon Vijay Abraham I) - Document configfs usage to create virtual functions for endpoints (Kishon Vijay Abraham I) * remotes/lorenzo/pci/endpoint: Documentation: PCI: endpoint/pci-endpoint-cfs: Guide to use SR-IOV misc: pci_endpoint_test: Populate sriov_configure ops to configure SR-IOV device PCI: cadence: Add support to configure virtual functions PCI: cadence: Simplify code to get register base address for configuring BAR PCI: endpoint: Add virtual function number in pci_epc ops PCI: endpoint: Add support to link a physical function to a virtual function PCI: endpoint: Add support to add virtual function in endpoint core dt-bindings: PCI: pci-ep: Add binding to specify virtual function commit eccefc748e0edbb3ae8be846c4cd17bc20397898 Merge: 09cfc9db2db1a de0a01f529665 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:51 2021 -0500 Merge branch 'remotes/lorenzo/pci/xilinx-nwl' - Document optional clock DT property (Michal Simek) - Enable PCIe ref clock (Hyun Kwon) * remotes/lorenzo/pci/xilinx-nwl: PCI: xilinx-nwl: Enable the clock through CCF dt-bindings: pci: xilinx-nwl: Document optional clock property commit 09cfc9db2db1a0c7a38033b16e2471c7c6becaf8 Merge: 4a4547db5612d 9e4ae52cabd8a Author: Bjorn Helgaas Date: Thu Sep 2 14:56:51 2021 -0500 Merge branch 'remotes/lorenzo/pci/xgene' - Remove redundant dev_err() after devm_ioremap_resource() (ErKun Yang) * remotes/lorenzo/pci/xgene: PCI: xgene-msi: Remove redundant dev_err() call in xgene_msi_probe() commit 4a4547db5612da9ac2404c014b258add369b5b16 Merge: db2d64f83703a f62750e6918d2 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:50 2021 -0500 Merge branch 'remotes/lorenzo/pci/tegra194' - Fix handling BME_CHGED event (Om Prakash Singh) - Fix MSI-X programming (Om Prakash Singh) - Disable interrupts before entering L2 (Om Prakash Singh) - Don't allow suspend when Tegra PCIe is in EP mode (Om Prakash Singh) * remotes/lorenzo/pci/tegra194: PCI: tegra194: Cleanup unused code PCI: tegra194: Don't allow suspend when Tegra PCIe is in EP mode PCI: tegra194: Disable interrupts before entering L2 PCI: tegra194: Fix MSI-X programming PCI: tegra194: Fix handling BME_CHGED event commit db2d64f83703aca8d560abcf83166fac3d111d94 Merge: c2863b217edc1 fd44e8efccd4d Author: Bjorn Helgaas Date: Thu Sep 2 14:56:50 2021 -0500 Merge branch 'remotes/lorenzo/pci/tegra' - Remove unused struct tegra_pcie_bus (Krzysztof Wilczyński) * remotes/lorenzo/pci/tegra: PCI: tegra: make const array err_msg static PCI: tegra: Use 'seq_puts' instead of 'seq_printf' PCI: tegra: Fix OF node reference leak PCI: tegra: Remove unused struct tegra_pcie_bus commit c2863b217edc1438b275bfebc4815952964a3a61 Merge: c501cf9cbeacc a115b1bd3af0c Author: Bjorn Helgaas Date: Thu Sep 2 14:56:49 2021 -0500 Merge branch 'remotes/lorenzo/pci/rcar' - Fix runtime PM imbalance in rcar_pcie_ep_probe() (Dinghao Liu) * remotes/lorenzo/pci/rcar: PCI: rcar: Add L1 link state fix into data abort hook PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe() commit c501cf9cbeacc4cf2dfb03a20d27c3661ddd9643 Merge: af42a0d4a88b6 77216702c8f62 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:49 2021 -0500 Merge branch 'remotes/lorenzo/pci/mediatek' - Split DT bindings for PCIe controllers with independent MSI domains into separate nodes for MT2712/MT7622 (Chuanjia Liu) - Locate shared registers from "mediatek,generic-pciecfg" property (Chuanjia Liu) - Get IRQ from "pcie_irq" if "interrupt-names" property is present to fix an MSI issue (Chuanjia Liu) - Get PCI domain from "linux,pci-domain" property if present (Chuanjia Liu) * remotes/lorenzo/pci/mediatek: PCI: mediatek: Use PCI domain to handle ports detection PCI: mediatek: Add new method to get irq number PCI: mediatek: Add new method to get shared pcie-cfg base address dt-bindings: PCI: mediatek: Update the Device tree bindings commit af42a0d4a88b658e848d4c27732203a364788b2d Merge: c1bb1449fa8e3 0c87f90b4c135 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:48 2021 -0500 Merge branch 'remotes/lorenzo/pci/keembay' - Add Intel Keem Bay PCIe controller driver and DT binding (Srikanth Thokala) * remotes/lorenzo/pci/keembay: PCI: keembay: Add support for Intel Keem Bay dt-bindings: PCI: Add Intel Keem Bay PCIe controller commit c1bb1449fa8e3e769c0e7a5861bb49974fe63fb0 Merge: a1e4ca8eb963f aeaea8969b402 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:48 2021 -0500 Merge branch 'remotes/lorenzo/pci/iproc' - Don't fail devm_pci_alloc_host_bridge() on missing 'ranges' (Rob Herring) - Fix BCMA probe resource handling (Rob Herring) * remotes/lorenzo/pci/iproc: PCI: iproc: Fix BCMA probe resource handling PCI: of: Don't fail devm_pci_alloc_host_bridge() on missing 'ranges' commit a1e4ca8eb963f58fc9c2c26a971d86456ea717f5 Merge: 53cb14d256620 88f94c7f8f40d Author: Bjorn Helgaas Date: Thu Sep 2 14:56:47 2021 -0500 Merge branch 'remotes/lorenzo/pci/hyper-v' - Add domain_nr in struct pci_host_bridge (Boqun Feng) - Use host bridge MSI domain for root buses if present (Boqun Feng) - Allow ARM64 virtual host bridge with no ACPI companion (e.g., Hyper-V) (Boqun Feng) - Make Hyper-V enumeration more generic (Arnd Bergmann) - Set Hyper-V domain_nr at probe-time (Boqun Feng) - Set up Hyper-V MSI domain at bridge probe-time (Boqun Feng) - Enable Hyper-V bridge probing on ARM64 (Boqun Feng) * remotes/lorenzo/pci/hyper-v: PCI: hv: Turn on the host bridge probing on ARM64 PCI: hv: Set up MSI domain at bridge probing time PCI: hv: Set ->domain_nr of pci_host_bridge at probing time PCI: hv: Generify PCI probing arm64: PCI: Support root bridge preparation for Hyper-V arm64: PCI: Restructure pcibios_root_bridge_prepare() PCI: Support populating MSI domains of root buses via bridges PCI: Introduce domain_nr in pci_host_bridge commit 53cb14d2566205ed9a08649fdc59e9446adf0727 Merge: 2b5a949eea282 8f6a6b3c50ce1 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:47 2021 -0500 Merge branch 'remotes/lorenzo/pci/hv' - Support Hyper-V Create Interrupt v3 message (Sunil Muthuswamy) * remotes/lorenzo/pci/hv: PCI: hv: Support for create interrupt v3 commit 2b5a949eea282d03d1ace935936b1f73c5dd6cd7 Merge: 540267e236dd6 7c52009d94ab5 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:47 2021 -0500 Merge branch 'remotes/lorenzo/pci/cadence' - Convert bool in structs to bitfield (Kishon Vijay Abraham I) - Work around J7200 non-PCIe SERDES lane electrical issue that prevents PCIe link training (Nadeem Athani) - Add J7200 PCIe support to j721e (Kishon Vijay Abraham I) - Add AM64 PCIe support to j721e (Kishon Vijay Abraham I) - Add J7200 and AM64 device IDs to endpoint test (Kishon Vijay Abraham I) * remotes/lorenzo/pci/cadence: misc: pci_endpoint_test: Add deviceID for AM64 and J7200 PCI: j721e: Add PCIe support for AM64 PCI: j721e: Add PCIe support for J7200 PCI: cadence: Add quirk flag to set minimum delay in LTSSM Detect.Quiet state PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool commit 540267e236dd66fc3cb7429c8e88e3077f9a735b Merge: a549a33c37ef0 d212dcee27c1f Author: Bjorn Helgaas Date: Thu Sep 2 14:56:46 2021 -0500 Merge branch 'remotes/lorenzo/pci/aardvark' - Fix PIO config access status checking (Evan Wang) - Increase config access polling delay to 1.5s (Pali Rohár) - Add PCIe Root Capabilities to bridge emulation (Pali Rohár) - Report Config Request Retry Status when Software Visibility enabled (Pali Rohár) - Add back configuration of PCIe resources from 'ranges' DT property and pay attention to DT size and CPU/PCI offset to fix issues with I/O port space (Pali Rohár) - Serialize masking and unmasking legacy INTx interrupts (Pali Rohár) * remotes/lorenzo/pci/aardvark: PCI: aardvark: Fix masking and unmasking legacy INTx interrupts PCI: aardvark: Configure PCIe resources from 'ranges' DT property PCI: aardvark: Fix reporting CRS value PCI: pci-bridge-emul: Add PCIe Root Capabilities Register PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response PCI: aardvark: Fix checking for PIO status commit a549a33c37ef081593dff266f0c3a9e78a28bdf0 Merge: 0e52059a82567 89761eefc7ad5 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:46 2021 -0500 Merge branch 'pci/visconti' - Add Toshiba Visconti PCIe host controller driver (Nobuhiro Iwamatsu) * pci/visconti: MAINTAINERS: Add entries for Toshiba Visconti PCIe controller PCI: visconti: Add Toshiba Visconti PCIe host controller driver commit 0e52059a8256730f5c9555943b52fc115cdb3680 Merge: bd8bb4d097e4c 0e898eb8df4e3 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:45 2021 -0500 Merge branch 'pci/rockchip-dwc' - Add Rockchip RK356X host controller driver (Simon Xue) * pci/rockchip-dwc: PCI: rockchip-dwc: Add Rockchip RK356X host controller driver commit bd8bb4d097e4ca31c234b4dfce8b2efaf11d9889 Merge: dbf0b9bad0400 71121fdd79f56 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:45 2021 -0500 Merge branch 'pci/dwc' - Remove surplus break statement (Krzysztof Wilczyński) * pci/dwc: PCI: dwc: Remove surplus break statement after return commit dbf0b9bad040049cab56d39cc2a4d16f26135586 Merge: 739c4747a25af 30492c12d2324 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:45 2021 -0500 Merge branch 'pci/artpec6' - Remove surplus break statement and local code block (Krzysztof Wilczyński) * pci/artpec6: PCI: artpec6: Remove local code block from switch statement PCI: artpec6: Remove surplus break statement after return commit 739c4747a25af3a2571f69e4709f2b476a17d5d4 Merge: 74797618e2022 0da14a19493da Author: Bjorn Helgaas Date: Thu Sep 2 14:56:44 2021 -0500 Merge branch 'pci/misc' - Add pci_numachip_init() declaration (Krzysztof Wilczyński) - Allocate pci_dev_str_match_path() string atomically (Dan Carpenter) - Drop error message when Precision Time Measurement supported but not enabled (Jakub Kicinski) - Correct the pci_iomap.h header guard #endif comment (Jonathan Cameron) - Add schedule point in proc_bus_pci_read() (Krzysztof Wilczyński) - Make saved capability state private to core (Bjorn Helgaas) - Sync __pci_register_driver() stub for CONFIG_PCI=n (Andy Shevchenko) - Convert sta2x11 from PCI-DMA-API to generic DMA-API (Christophe JAILLET) * pci/misc: x86/PCI: sta2x11: switch from 'pci_' to 'dma_' API PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n PCI: Make saved capability state private to core PCI: Add schedule point in proc_bus_pci_read() PCI: Correct the pci_iomap.h header guard #endif comment PCI/PTM: Remove error message at boot PCI: Fix pci_dev_str_match_path() alloc while atomic bug x86/PCI: Add pci_numachip_init() declaration # Conflicts: # include/linux/pci.h commit 74797618e2022dfcd923f1ea8903ba4959f746a4 Merge: 1295d187abfb8 2c208abd4f9ef Author: Bjorn Helgaas Date: Thu Sep 2 14:56:44 2021 -0500 Merge branch 'pci/vpd' - Check Resource Item Names against those defined for type (Bjorn Helgaas) - Treat initial 0xff as missing EEPROM (Heiner Kallweit) - Reject resource tags with invalid size (Bjorn Helgaas) - Don't check Large Resource Item Names for validity (Bjorn Helgaas) - Allow access to valid parts of VPD if some is invalid (Bjorn Helgaas) - Remove pci_vpd_size() old_size argument (Heiner Kallweit) - Make pci_vpd_wait() uninterruptible (Heiner Kallweit) - Remove struct pci_vpd.flag (Heiner Kallweit) - Remove struct pci_vpd_ops (Heiner Kallweit) - Remove struct pci_vpd.valid member (Heiner Kallweit) - Embed struct pci_vpd in struct pci_dev (Heiner Kallweit) - Determine VPD size in pci_vpd_init() (Heiner Kallweit) - Treat invalid VPD like missing VPD capability (Heiner Kallweit) - Add pci_vpd_alloc() to allocate buffer and read VPD into it (Heiner Kallweit) - Add pci_vpd_find_ro_info_keyword() (Heiner Kallweit) - Add pci_vpd_check_csum() (Heiner Kallweit) - Add pci_vpd_find_id_string() (Heiner Kallweit) - Read VPD with pci_vpd_alloc() (bnx2x, bnxt, sfc, sfc falcon, tg3 drivers) (Heiner Kallweit) - Search VPD with pci_vpd_find_ro_info_keyword() (bnx2, bnx2x, bnxt, cxgb4, cxlflash SCSI, sfc, sfc falcon, tg3 drivers) (Heiner Kallweit) - Search VPD with pci_vpd_find_id_string() (cxgb4 driver) (Heiner Kallweit) - Validate VPD checksum with pci_vpd_check_csum() (cxgb4, tg3 drivers) (Heiner Kallweit) - Replace open-coded byte swapping with swab32s() in bnx2 (Heiner Kallweit) - Remove unused vpd_param member ec (Heiner Kallweit) - Stop exporting pci_vpd_find_tag(), pci_vpd_find_info_keyword() (Heiner Kallweit) - Move several VPD defines and inlines to internal PCI core (Heiner Kallweit) * pci/vpd: PCI/VPD: Use unaligned access helpers PCI/VPD: Clean up public VPD defines and inline functions cxgb4: Use pci_vpd_find_id_string() to find VPD ID string PCI/VPD: Add pci_vpd_find_id_string() PCI/VPD: Include post-processing in pci_vpd_find_tag() PCI/VPD: Stop exporting pci_vpd_find_info_keyword() PCI/VPD: Stop exporting pci_vpd_find_tag() scsi: cxlflash: Search VPD with pci_vpd_find_ro_info_keyword() cxgb4: Search VPD with pci_vpd_find_ro_info_keyword() cxgb4: Remove unused vpd_param member ec cxgb4: Validate VPD checksum with pci_vpd_check_csum() bnxt: Search VPD with pci_vpd_find_ro_info_keyword() bnxt: Read VPD with pci_vpd_alloc() bnx2x: Search VPD with pci_vpd_find_ro_info_keyword() bnx2x: Read VPD with pci_vpd_alloc() bnx2: Replace open-coded byte swapping with swab32s() bnx2: Search VPD with pci_vpd_find_ro_info_keyword() sfc: falcon: Search VPD with pci_vpd_find_ro_info_keyword() sfc: falcon: Read VPD with pci_vpd_alloc() tg3: Search VPD with pci_vpd_find_ro_info_keyword() tg3: Validate VPD checksum with pci_vpd_check_csum() tg3: Read VPD with pci_vpd_alloc() sfc: Search VPD with pci_vpd_find_ro_info_keyword() sfc: Read VPD with pci_vpd_alloc() PCI/VPD: Add pci_vpd_check_csum() PCI/VPD: Add pci_vpd_find_ro_info_keyword() PCI/VPD: Add pci_vpd_alloc() PCI/VPD: Treat invalid VPD like missing VPD capability PCI/VPD: Determine VPD size in pci_vpd_init() PCI/VPD: Embed struct pci_vpd in struct pci_dev PCI/VPD: Remove struct pci_vpd.valid member PCI/VPD: Remove struct pci_vpd_ops PCI/VPD: Reorder pci_read_vpd(), pci_write_vpd() PCI/VPD: Remove struct pci_vpd.flag PCI/VPD: Make pci_vpd_wait() uninterruptible PCI/VPD: Remove pci_vpd_size() old_size argument PCI/VPD: Allow access to valid parts of VPD if some is invalid PCI/VPD: Don't check Large Resource Item Names for validity PCI/VPD: Reject resource tags with invalid size PCI/VPD: Treat initial 0xff as missing EEPROM PCI/VPD: Check Resource Item Names against those valid for type PCI/VPD: Correct diagnostic for VPD read failure commit 1295d187abfb80514240ea3179b722a2d8f7871d Merge: 9045f63e67bc9 7cae7849fccee Author: Bjorn Helgaas Date: Thu Sep 2 14:56:43 2021 -0500 Merge branch 'pci/virtualization' - Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms (Wasim Khan) - Add ACS quirks for Cavium multi-function devices (George Cherian) - Enforce pci=noats with Transaction Blocking (Alex Williamson) * pci/virtualization: PCI/ACS: Enforce pci=noats with Transaction Blocking PCI: Add ACS quirks for Cavium multi-function devices PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms commit 9045f63e67bc91f02be245346fff9fb9703e7a3c Merge: e210d9fc0903e ca32b5310a1a3 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:43 2021 -0500 Merge branch 'pci/resource' - Refactor pci_ioremap_bar() and pci_ioremap_wc_bar() (Krzysztof Wilczyński) - Optimize pci_resource_len() to reduce kernel size (Zhen Lei) * pci/resource: PCI: Optimize pci_resource_len() to reduce kernel size PCI: Refactor pci_ioremap_bar() and pci_ioremap_wc_bar() commit e210d9fc0903e83aa018a32227f7ff529e593004 Merge: 34627f4dcd0f4 9bdc81ce440ec Author: Bjorn Helgaas Date: Thu Sep 2 14:56:42 2021 -0500 Merge branch 'pci/reset' - Cache PCIe Device Capabilities register (Amey Narkhede) - Add pcie_reset_flr() with 'probe' argument (Amey Narkhede) - Add pdev->reset_methods[] array to track reset method ordering (Amey Narkhede) - Remove reset_fn field from pci_dev (Amey Narkhede) - Add sysfs interface to query and set device reset mechanism (Amey Narkhede) - Add pci_set_acpi_fwnode() to set ACPI_COMPANION (Shanker Donthineni) - Use acpi_pci_power_manageable() instead of duplicating logic (Shanker Donthineni) - Set ACPI fwnode early and at the same time with OF (Shanker Donthineni) - Add support for ACPI _RST reset method (Shanker Donthineni) - Change reset function 'probe' argument to bool (Amey Narkhede) * pci/reset: PCI: Change the type of probe argument in reset functions PCI: Add support for ACPI _RST reset method PCI: Setup ACPI fwnode early and at the same time with OF PCI: Use acpi_pci_power_manageable() PCI: Add pci_set_acpi_fwnode() to set ACPI_COMPANION PCI: Allow userspace to query and set device reset mechanism PCI: Remove reset_fn field from pci_dev PCI: Add array to track reset method ordering PCI: Add pcie_reset_flr() with 'probe' argument PCI: Cache PCIe Device Capabilities register commit 34627f4dcd0f4fefab9e0eb88a45aad4178064f7 Merge: 03816e7f78877 00823dcbdd415 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:42 2021 -0500 Merge branch 'pci/portdrv' - Enable Bandwidth Notification only if port supports it (Stuart Hayes) * pci/portdrv: PCI/portdrv: Enable Bandwidth Notification only if port supports it commit 03816e7f7887747548fc2ced59933cd421bf0cf8 Merge: 9d102c7437247 d21faba11693c Author: Bjorn Helgaas Date: Thu Sep 2 14:56:42 2021 -0500 Merge branch 'pci/irq' - Convert irq_find_mapping() + generic_handle_irq() to generic_handle_domain_irq() (Marc Zyngier) * pci/irq: PCI: Bulk conversion to generic_handle_domain_irq() commit 9d102c7437247a909dd6f46cbda11cde5526f7b6 Merge: 4f6f0b86d3605 8304a3a199eeb Author: Bjorn Helgaas Date: Thu Sep 2 14:56:41 2021 -0500 Merge branch 'pci/iommu' - Allow PASID on fake PCIe devices, e.g., HiSilicon KunPeng920 and KunPeng930 AMBA devices, without TLP prefixes (Zhangfei Gao) - Allow SVA / dma-can-stall on fake PCIe devices (Zhangfei Gao) * pci/iommu: PCI: Set dma-can-stall for HiSilicon chips PCI: Allow PASID on fake PCIe devices without TLP prefixes commit 4f6f0b86d3605464865e9a9d60b5e88f88f03783 Merge: 52d44f3c61975 faa2e05ad0dcc Author: Bjorn Helgaas Date: Thu Sep 2 14:56:41 2021 -0500 Merge branch 'pci/hotplug' - Fix ibmphp double unmap of io_mem (Vishal Aslot) * pci/hotplug: PCI: ibmphp: Fix double unmap of io_mem commit 52d44f3c61975cacfa2379a94e470b33a7639e73 Merge: e73f0f0ee7541 d6b1715999fc2 Author: Bjorn Helgaas Date: Thu Sep 2 14:56:40 2021 -0500 Merge branch 'pci/enumeration' - Call Max Payload Size-related fixup quirks early, so they're considered by pci_configure_mps() (Marek Behún) - Restrict Max Payload Size Supported to work around ASMedia ASM1062 SATA erratum (Marek Behún) - Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure (Krzysztof Wilczyński) * pci/enumeration: PCI: Return int from pciconfig_read() syscall PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Call Max Payload Size-related fixup quirks early commit aeef8b5089b76852bd84889f2809e69a7cfb414e Author: Jeff Moyer Date: Wed Aug 11 17:07:37 2021 -0400 x86/pat: Pass valid address to sanitize_phys() The end address passed to memtype_reserve() is handed directly to sanitize_phys(). However, end is exclusive and sanitize_phys() expects an inclusive address. If end falls at the end of the physical address space, sanitize_phys() will return 0. This can result in drivers failing to load, and the following warning: WARNING: CPU: 26 PID: 749 at arch/x86/mm/pat.c:354 reserve_memtype+0x262/0x450 reserve_memtype failed: [mem 0x3ffffff00000-0xffffffffffffffff], req uncached-minus Call Trace: [] reserve_memtype+0x262/0x450 [] ioremap_nocache+0x1a/0x20 [] mpt3sas_base_map_resources+0x151/0xa60 [mpt3sas] [] mpt3sas_base_attach+0xf5/0xa50 [mpt3sas] ---[ end trace 6d6eea4438db89ef ]--- ioremap reserve_memtype failed -22 mpt3sas_cm0: unable to map adapter memory! or resource not found mpt3sas_cm0: failure at drivers/scsi/mpt3sas/mpt3sas_scsih.c:10597/_scsih_probe()! Fix this by passing the inclusive end address to sanitize_phys(). Fixes: 510ee090abc3 ("x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses") Signed-off-by: Jeff Moyer Signed-off-by: Thomas Gleixner Reviewed-by: David Hildenbrand Reviewed-by: Dan Williams Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/x49o8a3pu5i.fsf@segfault.boston.devel.redhat.com commit aef4892a63c248c31718d23941536b86829a49f0 Merge: b55060d796c53 cb181da161963 Author: Linus Torvalds Date: Thu Sep 2 12:51:41 2021 -0700 Merge tag 'integrity-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity subsystem updates from Mimi Zohar: - Limit the allowed hash algorithms when writing security.ima xattrs or verifying them, based on the IMA policy and the configured hash algorithms. - Return the calculated "critical data" measurement hash and size to avoid code duplication. (Preparatory change for a proposed LSM.) - and a single patch to address a compiler warning. * tag 'integrity-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: IMA: reject unknown hash algorithms in ima_get_hash_algo IMA: prevent SETXATTR_CHECK policy rules with unavailable algorithms IMA: introduce a new policy option func=SETXATTR_CHECK IMA: add a policy option to restrict xattr hash algorithms on appraisal IMA: add support to restrict the hash algorithms used for file appraisal IMA: block writes of the security.ima xattr with unsupported algorithms IMA: remove the dependency on CRYPTO_MD5 ima: Add digest and digest_len params to the functions to measure a buffer ima: Return int in the functions to measure a buffer ima: Introduce ima_get_current_hash_algo() IMA: remove -Wmissing-prototypes warning commit dd8f6b299a2b86c4839de4a60a28ce2399453bc0 Author: Liang Chen Date: Mon Jul 26 11:03:54 2021 +0200 dt-bindings: pwm: rockchip: Add description for rk3568 Add "rockchip,rk3568-pwm", "rockchip,rk3328-pwm" compatible strings for PWM nodes found on a rk3568 platform. Signed-off-by: Liang Chen Signed-off-by: Heiko Stuebner Acked-by: Uwe Kleine-König Acked-by: Rob Herring Signed-off-by: Thierry Reding commit 8083f58d08fd52f547c0a62c0f4e448e15e6726b Author: Uwe Kleine-König Date: Wed Jul 7 18:28:35 2021 +0200 pwm: Make pwmchip_remove() return void Since some time pwmchip_remove() always returns 0 so the return value isn't usefull. Now that all callers are converted to ignore its value the function can be changed to return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 7587f8a863ce4a5514802eeaed48f60663d69179 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:34 2021 +0200 pwm: sun4i: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of sun4i_pwm_remove() and considers the device removed anyhow. So returning early results in a resource leak. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit ceb2c2842f3664dcc4e6d8cb317e1e83bb81b1e5 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:33 2021 +0200 pwm: sifive: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pwm_sifive_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 4e334973541de4d31c20be22d6198c646f58eb81 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:32 2021 +0200 pwm: samsung: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pwm_samsung_remove() and considers the device removed anyhow. So returning early results in a resource leak. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 81d4b5c449ced26685c736eaaa6a7093d87e3891 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:31 2021 +0200 pwm: renesas-tpu: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of tpu_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 15d217614fcfde5386f4ebf7c74c6e98df2777c0 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:30 2021 +0200 pwm: rcar: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of rcar_pwm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit f0e96e2e2cb292594483b0ff3cd00b45e386c45f Author: Uwe Kleine-König Date: Wed Jul 7 18:28:29 2021 +0200 pwm: pca9685: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pca9685_pwm_remove() and considers the device removed anyhow. So returning early results in a resource leak. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit faaa2222213b0c44e4f477c93d6f980e0156cda8 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:28 2021 +0200 pwm: omap-dmtimer: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pwm_omap_dmtimer_remove() and considers the device removed anyhow. So returning early results in a resource leak. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae Author: Uwe Kleine-König Date: Wed Jul 7 18:28:27 2021 +0200 pwm: mtk-disp: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of mtk_disp_pwm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit bfecbc9490dcbe7a32d554dfd3d0f34bf17f10d8 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:26 2021 +0200 pwm: imx-tpm: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pwm_imx_tpm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit fc3f3f565eacf6d2d9aab9f065612a9a5152d879 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:25 2021 +0200 pwm: img: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of pwm_imx_tpm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit a08be12771c0c212790953b65b897e8f551eaa0e Author: Uwe Kleine-König Date: Wed Jul 7 18:28:24 2021 +0200 pwm: cros-ec: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of cros_ec_pwm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b4334246cc3d7b6163f6bc2f96f56676967e93b4 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:23 2021 +0200 pwm: brcmstb: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of brcmstb_pwm_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 319333b0c48e98fe84e81c1f68384353dc37dd61 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:22 2021 +0200 pwm: atmel-tcb: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of atmel_tcb_pwm_remove() and considers the device removed anyhow. So returning early results in a resource leak. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 632927511c3a362989625b38d7f70080cab8d8b0 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:21 2021 +0200 pwm: atmel-hlcdc: Don't check the return code of pwmchip_remove() pwmchip_remove() returns always 0. Don't use the value to make it possible to eventually change the function to return void. Also the driver core ignores the return value of atmel_hlcdc_pwm_remove() and considers the device removed anyhow. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit a75bc6b783ab5844d70cc54314c593de34782844 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:20 2021 +0200 pwm: twl: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit c9bb1c9e5460f6e84e95b65fe4c5bb09d5dff10a Author: Uwe Kleine-König Date: Wed Jul 7 18:28:19 2021 +0200 pwm: twl-led: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit a64a5853a827147b36abecd5aabab11d07d67177 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:18 2021 +0200 pwm: tiecap: Simplify using devm_pwmchip_add() With devm_pwmchip_add() there is no need to explicitly call pwmchip_remove(), so this call can be dropped from the remove callback. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 8614e210083e7ef135719e00bbc81e10f3f53286 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:17 2021 +0200 pwm: stm32-lp: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 02dd2e417e7dfe63c810d356175b560e12c8fb8c Author: Uwe Kleine-König Date: Wed Jul 7 18:28:16 2021 +0200 pwm: sl28cpld: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b7783c62581523fbb66e4624d5f90f190b1f8036 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:15 2021 +0200 pwm: raspberrypi-poe: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 97f290357df22c0564a8addb782875e6275b7479 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:14 2021 +0200 pwm: pxa: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 9c3fac7aaf27f7f026a22087605a67683adfd551 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:13 2021 +0200 pwm: ntxec: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 43f5f48d095c31e67777c41ad3ee65186f384b03 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:12 2021 +0200 pwm: mxs: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit e0150252a6437d12de3db84bb3af12bd5aa5cc70 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:11 2021 +0200 pwm: mediatek: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit da68a9f4b03cb090bf725595815782a5c6b38937 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:10 2021 +0200 pwm: lpc32xx: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 071beb7c5ee37e778f8a85c95e271d93f0e6ffef Author: Uwe Kleine-König Date: Wed Jul 7 18:28:09 2021 +0200 pwm: lp3943: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 0aa2bec5a8ed0f5f3c01f218f7bd37981f043de9 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:08 2021 +0200 pwm: keembay: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit f0d6d7f26007907b108ed3624c641dc7614da505 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:07 2021 +0200 pwm: jz4740: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 2e27afd0557f76a036183e0db3507aa94aab61bd Author: Uwe Kleine-König Date: Wed Jul 7 18:28:06 2021 +0200 pwm: iqs620a: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit d8c11a6505d277025e3b5a0ed29d65ed990f65cc Author: Uwe Kleine-König Date: Wed Jul 7 18:28:05 2021 +0200 pwm: intel-lgm: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit acfdc2030a773a7ca9c94bdeb32e943159fc1f9a Author: Uwe Kleine-König Date: Wed Jul 7 18:28:04 2021 +0200 pwm: imx27: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 5ba3eb4bb3b5d3742805b799b965a4bc9e0ab7a6 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:03 2021 +0200 pwm: fsl-ftm: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit a0b336a35216b0f45c221824097757e12231e33e Author: Uwe Kleine-König Date: Wed Jul 7 18:28:02 2021 +0200 pwm: ep93xx: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit ccc2df6f802b527d684c0fe171f3f4c9f883b833 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:01 2021 +0200 pwm: bcm-kona: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 14ac9e17f9bd4bd0dfe18e384a3c2ca8dfbffcc8 Author: Uwe Kleine-König Date: Wed Jul 7 18:28:00 2021 +0200 pwm: ab8500: Simplify using devm_pwmchip_add() This allows to drop the platform_driver's remove function. This is the only user of driver data so this can go away, too. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit cf83f7b7ae765e3d5eed65f8186c8d6ff320722d Author: Uwe Kleine-König Date: Wed Jul 7 18:27:59 2021 +0200 pwm: keembay: Improve compile coverage by allowing to enable on !ARM64 There are no arm64 specific constructs in this driver and it compiles just fine with ARCH=arm. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 2ee4bc91b62e8ff2d8ffd4f1a4a02a36ad7a4f3b Author: Uwe Kleine-König Date: Wed Jul 7 18:27:58 2021 +0200 pwm: jz4740: Improve compile coverage by allowing to enable on !MIPS There are no mips specific constructs in this driver and it compiles just fine with ARCH=arm. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 97966ade662e912cbbbf4ff101baccf8b0bac9ae Author: Uwe Kleine-König Date: Wed Jul 7 18:27:57 2021 +0200 pwm: ntxec: Drop useless assignment to struct pwmchip::base Since commit f9a8ee8c8bcd ("pwm: Always allocate PWM chip base ID dynamically") there is no effect any more for assigning this variable. When the patch resulting in f9a8ee8c8bcd was created, this driver didn't exist yet, so this was missed. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 1a0c97b6460f30d8b164eaef07d77369e466dda3 Author: Uwe Kleine-König Date: Wed Jul 7 18:27:56 2021 +0200 pwm: tiehrpwm: Unprepare clock only after the PWM was unregistered The driver is supposed to stay functional until pwmchip_remove() returns. So disable clocks only after that. pwmchip_remove() always returns 0, so the return code can be ignored which keeps ehrpwm_pwm_remove() a bit simpler and eventually allows to make pwmchip_remove() return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 84ea61f65d7016dd9a087ef40c4da09f0deaa648 Author: Uwe Kleine-König Date: Wed Jul 7 18:27:55 2021 +0200 pwm: rockchip: Unprepare clocks only after the PWM was unregistered The driver is supposed to stay functional until pwmchip_remove() returns. So disable clocks only after that. pwmchip_remove() always returns 0, so the return code can be ignored which keeps rockchip_pwm_remove() a bit simpler and allows to eventually make pwmchip_remove() return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 04d775210fb99609b1725ca33313da908a40d767 Author: Uwe Kleine-König Date: Wed Jul 7 18:27:54 2021 +0200 pwm: hibvt: Disable the clock only after the PWM was unregistered The driver is supposed to stay functional until pwmchip_remove() returns. So disable clocks and reset the hardware only after that. The return value of pwmchip_remove doesn't need to be checked because it returns zero anyhow and should be changed to return void eventually. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit d44084c93427bb0a9261432db1a8ca76a42d805e Author: Uwe Kleine-König Date: Wed Jul 7 18:27:53 2021 +0200 pwm: stm32-lp: Don't modify HW state in .remove() callback A consumer is expected to disable a PWM before calling pwm_put(). And if they didn't there is hopefully a good reason (or the consumer needs fixing). Also if disabling an enabled PWM was the right thing to do, this should better be done in the framework instead of in each low level driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 9d768cd7fd42bb0be16f36aec48548fca5260759 Author: Uwe Kleine-König Date: Wed Jul 7 18:27:52 2021 +0200 pwm: rockchip: Don't modify HW state in .remove() callback A consumer is expected to disable a PWM before calling pwm_put(). And if they didn't there is hopefully a good reason (or the consumer needs fixing). Also if disabling an enabled PWM was the right thing to do, this should better be done in the framework instead of in each low level driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit c68eb29c8e9067c08175dd0414f6984f236f719d Author: Uwe Kleine-König Date: Wed Jul 7 18:27:51 2021 +0200 pwm: img: Don't modify HW state in .remove() callback A consumer is expected to disable a PWM before calling pwm_put(). And if they didn't there is hopefully a good reason (or the consumer needs fixing). Also if disabling an enabled PWM was the right thing to do, this should better be done in the framework instead of in each low level driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 020162d6f49f2963062229814a56a89c86cbeaa8 Author: Uwe Kleine-König Date: Wed Jul 7 18:27:50 2021 +0200 pwm: mxs: Don't modify HW state in .probe() after the PWM chip was registered This fixes a race condition: After pwmchip_add() is called there might already be a consumer and then modifying the hardware behind the consumer's back is bad. So reset before calling pwmchip_add(). Note that reseting the hardware isn't the right thing to do if the PWM is already running as it might e.g. disable (or even enable) a backlight that is supposed to be on (or off). Fixes: 4dce82c1e840 ("pwm: add pwm-mxs support") Cc: Sascha Hauer Cc: Shawn Guo Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e Author: Uwe Kleine-König Date: Wed Jul 7 18:27:49 2021 +0200 pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered This fixes a race condition: After pwmchip_add() is called there might already be a consumer and then modifying the hardware behind the consumer's back is bad. So set the default before. (Side-note: I don't know what this register setting actually does, if this modifies the polarity there is an inconsistency because the inversed polarity isn't considered if the PWM is already running during .probe().) Fixes: acfd92fdfb93 ("pwm: lpc32xx: Set PWM_PIN_LEVEL bit to default value") Cc: Sylvain Lemieux Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b55060d796c5300ad7a410cb5faec36582925570 Merge: c815f04ba9494 a8fc576d4af2f Author: Linus Torvalds Date: Thu Sep 2 12:35:34 2021 -0700 Merge tag 'hardening-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Expand lib/test_stackinit to include more initialization styles - Improve Kconfig for CLang's auto-var-init feature - Introduce support for GCC's zero-call-used-regs feature * tag 'hardening-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lib/test_stackinit: Add assigned initializers lib/test_stackinit: Allow building stand-alone lib/test_stackinit: Fix static initializer test hardening: Clarify Kconfig text for auto-var-init hardening: Introduce CONFIG_ZERO_CALL_USED_REGS commit eb41f334589d66b9da6f2b1acf7963ef8ca8d94e Author: Uwe Kleine-König Date: Mon Jul 5 18:55:10 2021 +0200 pwm: ab8500: Fix register offset calculation to not depend on probe order The assumption that lead to commit 5e5da1e9fbee ("pwm: ab8500: Explicitly allocate pwm chip base dynamically") was wrong: The pwm-ab8500 devices are not directly instantiated from device tree, but from the ab8500 mfd driver. So the pdev->id isn't -1, but a number between 1 and 3. Now that pwmchip ids are always allocated dynamically, this cannot easily be reverted. Introduce a new member in the driver data struct that tracks the hardware id and use this to calculate the register offset. Side-note: Using chip->base to calculate the offset was never robust because if there was already a PWM with id 1 at the time ab8500-pwm.1 was probed, the associated pwmchip would get assigned chip->base = 2 (or something bigger). Fixes: 5e5da1e9fbee ("pwm: ab8500: Explicitly allocate pwm chip base dynamically") Fixes: 6173f8f4ed9c ("pwm: Move AB8500 PWM driver to PWM framework") Signed-off-by: Uwe Kleine-König Acked-by: Linus Walleij Signed-off-by: Thierry Reding commit 52eaba4cedbda728f78d7083a05725e537b3df91 Author: Uwe Kleine-König Date: Wed Apr 21 11:26:08 2021 +0200 pwm: atmel: Rework tracking updates pending in hardware This improves the driver's behavior in several ways: - The lock is held for shorter periods and so a channel that is currently waited for doesn't block disabling another channel. - It's easier to understand because the procedure is split into more semantic units and documentation is improved - A channel is only set to pending when such an event is actually scheduled in hardware (by writing the CUPD register). - Also wait in .get_state() to report the last configured state instead of (maybe) the previous one. This fixes the read back duty cycle and so prevents a warning being emitted when PWM_DEBUG is on. Tested on an AriettaG25. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit c815f04ba94940fbc303a6ea9669e7da87f8e77d Merge: 612b23f27793e acd8e8407b8fc Author: Linus Torvalds Date: Thu Sep 2 12:32:12 2021 -0700 Merge tag 'linux-kselftest-kunit-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: "This KUnit update for Linux 5.15-rc1 adds new features and tests: Tool: - support for '--kernel_args' to allow setting module params - support for '--raw_output' option to show just the kunit output during make Tests: - new KUnit tests for checksums and timestamps - Print test statistics on failure - Integrates UBSAN into the KUnit testing framework. It fails KUnit tests whenever it reports undefined behavior" * tag 'linux-kselftest-kunit-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Print test statistics on failure kunit: tool: make --raw_output support only showing kunit output kunit: tool: add --kernel_args to allow setting module params kunit: ubsan integration fat: Add KUnit tests for checksums and timestamps commit 612b23f27793ea1cf41621ca6dc552eb4699f41c Merge: 4a3bb4200a595 e888fa7bb882a Author: Linus Torvalds Date: Thu Sep 2 12:26:31 2021 -0700 Merge tag 'memblock-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: "Robustness and debug improvements: - add check for memory add/cap ordering - add missing debug code to memblock_add_node()" * tag 'memblock-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: Check memory add/cap ordering memblock: Add missing debug code to memblock_add_node() commit 4a3bb4200a5958d76cc26ebe4db4257efa56812b Merge: eceae1e7acaef c1dec343d7abd Author: Linus Torvalds Date: Thu Sep 2 10:32:06 2021 -0700 Merge tag 'dma-mapping-5.15' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - fix debugfs initialization order (Anthony Iliopoulos) - use memory_intersects() directly (Kefeng Wang) - allow to return specific errors from ->map_sg (Logan Gunthorpe, Martin Oliveira) - turn the dma_map_sg return value into an unsigned int (me) - provide a common global coherent pool іmplementation (me) * tag 'dma-mapping-5.15' of git://git.infradead.org/users/hch/dma-mapping: (31 commits) hexagon: use the generic global coherent pool dma-mapping: make the global coherent pool conditional dma-mapping: add a dma_init_global_coherent helper dma-mapping: simplify dma_init_coherent_memory dma-mapping: allow using the global coherent pool for !ARM ARM/nommu: use the generic dma-direct code for non-coherent devices dma-direct: add support for dma_coherent_default_memory dma-mapping: return an unsigned int from dma_map_sg{,_attrs} dma-mapping: disallow .map_sg operations from returning zero on error dma-mapping: return error code from dma_dummy_map_sg() x86/amd_gart: don't set failed sg dma_address to DMA_MAPPING_ERROR x86/amd_gart: return error code from gart_map_sg() xen: swiotlb: return error code from xen_swiotlb_map_sg() parisc: return error code from .map_sg() ops sparc/iommu: don't set failed sg dma_address to DMA_MAPPING_ERROR sparc/iommu: return error codes from .map_sg() ops s390/pci: don't set failed sg dma_address to DMA_MAPPING_ERROR s390/pci: return error code from s390_dma_map_sg() powerpc/iommu: don't set failed sg dma_address to DMA_MAPPING_ERROR powerpc/iommu: return error code from .map_sg() ops ... commit eceae1e7acaefc0a71e4dd4b8cd49270172b4731 Merge: 265113f70f3d6 c42dd069be8df Author: Linus Torvalds Date: Thu Sep 2 10:27:17 2021 -0700 Merge tag 'configfs-5.15' of git://git.infradead.org/users/hch/configfs Pull configfs updates from Christoph Hellwig: - fix a race in configfs_lookup (Sishuai Gong) - minor cleanups (me) * tag 'configfs-5.15' of git://git.infradead.org/users/hch/configfs: configfs: fix a race in configfs_lookup() configfs: fold configfs_attach_attr into configfs_lookup configfs: simplify the configfs_dirent_is_ready configfs: return -ENAMETOOLONG earlier in configfs_lookup commit 265113f70f3d63ae8b6eb1ce4303d14dbbd71b2d Merge: b0cfcdd9b9672 ecd95673142ef Author: Linus Torvalds Date: Thu Sep 2 10:19:45 2021 -0700 Merge tag 'dlm-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This set includes a number of minor fixes and cleanups related to the networking changes in the last release. A patch to delay ack messages reduces network traffic significantly" * tag 'dlm-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: fs: dlm: avoid comms shutdown delay in release_lockspace fs: dlm: fix return -EINTR on recovery stopped fs: dlm: implement delayed ack handling fs: dlm: move receive loop into receive handler fs: dlm: fix multiple empty writequeue alloc fs: dlm: generic connect func fs: dlm: auto load sctp module fs: dlm: introduce generic listen fs: dlm: move to static proto ops fs: dlm: introduce con_next_wq helper fs: dlm: cleanup and remove _send_rcom fs: dlm: clear CF_APP_LIMITED on close fs: dlm: fix typo in tlv prefix fs: dlm: use READ_ONCE for config var fs: dlm: use sk->sk_socket instead of con->sock commit 3146cba99aa284b1d4a10fbd923df953f1d18035 Author: Jens Axboe Date: Wed Sep 1 11:20:10 2021 -0600 io-wq: make worker creation resilient against signals If a task is queueing async work and also handling signals, then we can run into the case where create_io_thread() is interrupted and returns failure because of that. If this happens for creating the first worker in a group, then that worker will never get created and we can hang the ring. If we do get a fork failure, retry from task_work. With signals we have to be a bit careful as we cannot simply queue as task_work, as we'll still have signals pending at that point. Punt over a normal workqueue first and then create from task_work after that. Lastly, ensure that we handle fatal worker creations. Worker creation failures are normally not fatal, only if we fail to create one in an empty worker group can we not make progress. Right now that is ignored, ensure that we handle that and run cancel on the work item. There are two paths that create new workers - one is the "existing worker going to sleep", and the other is "no workers found for this work, create one". The former is never fatal, as workers do exist in the group. Only the latter needs to be carefully handled. Signed-off-by: Jens Axboe commit 05c5f4ee4da7086cceacc78bf3a080e314c241fa Author: Jens Axboe Date: Wed Sep 1 13:01:17 2021 -0600 io-wq: get rid of FIXED worker flag It makes the logic easier to follow if we just get rid of the fixed worker flag, and simply ensure that we never exit the last worker in the group. This also means that no particular worker is special. Just track the last timeout state, and if we have hit it and no work is pending, check if there are other workers. If yes, then we can exit this one safely. Signed-off-by: Jens Axboe commit b0cfcdd9b9672ea90642f33d6c0dd8516553adf2 Author: Linus Torvalds Date: Fri Jul 16 14:01:12 2021 -0700 d_path: make 'prepend()' fill up the buffer exactly on overflow Instead of just marking the buffer as having overflowed, fill it up as much as we can. That will allow the overflow case to then return whatever truncated result if it wants to. Cc: Al Viro Signed-off-by: Linus Torvalds commit faa2e05ad0dccf37f995bcfbb8d1980d66c02c11 Author: Vishal Aslot Date: Wed Aug 18 11:57:51 2021 -0500 PCI: ibmphp: Fix double unmap of io_mem ebda_rsrc_controller() calls iounmap(io_mem) on the error path. Its caller, ibmphp_access_ebda(), also calls iounmap(io_mem) on good and error paths. Remove the iounmap(io_mem) invocation from ebda_rsrc_controller(). [bhelgaas: remove item from TODO] Link: https://lore.kernel.org/r/20210818165751.591185-1-os.vaslot@gmail.com Signed-off-by: Vishal Aslot Signed-off-by: Bjorn Helgaas commit 7661809d493b426e979f39ab512e3adf41fbcc69 Author: Linus Torvalds Date: Wed Jul 14 09:45:49 2021 -0700 mm: don't allow oversized kvmalloc() calls 'kvmalloc()' is a convenience function for people who want to do a kmalloc() but fall back on vmalloc() if there aren't enough physically contiguous pages, or if the allocation is larger than what kmalloc() supports. However, let's make sure it doesn't get _too_ easy to do crazy things with it. In particular, don't allow big allocations that could be due to integer overflow or underflow. So make sure the allocation size fits in an 'int', to protect against trivial integer conversion issues. Acked-by: Willy Tarreau Cc: Kees Cook Signed-off-by: Linus Torvalds commit 851c8e761c393a63d6346b472ae40b4ef74eba1f Author: Luca Coelho Date: Wed Sep 1 13:14:12 2021 +0300 iwlwifi: bump FW API to 66 for AX devices Start supporting API version 66 for AX devices. Th iwlwifi FW API is frozen every 6 weeks, so we need to bump the newest version number that the driver supports accordingly. In this specific case, support for new HW will only be possible with the new FW version. This change still keeps backwards compatibility with older FW API versions for existing devices. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210901101412.300012-1-luca@coelho.fi commit 2f32c147a3816d789722c0bd242a9431332ec3ed Author: Justin M. Forbes Date: Fri Jul 2 17:31:53 2021 -0500 iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha The Samsung Galaxy Book Flex2 Alpha uses an ax201 with the ID a0f0/6074. This works fine with the existing driver once it knows to claim it. Simple patch to add the device. Signed-off-by: Justin M. Forbes Reviewed-by: Jaehoon Chung Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210702223155.1981510-1-jforbes@fedoraproject.org commit 111c1aa8cad4a0069dfe98fc093507b5b2cdfda7 Merge: 815409a12c0a9 baaae979b1126 Author: Linus Torvalds Date: Thu Sep 2 09:37:09 2021 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "In addition to some ext4 bug fixes and cleanups, this cycle we add the orphan_file feature, which eliminates bottlenecks when doing a large number of parallel truncates and file deletions, and move the discard operation out of the jbd2 commit thread when using the discard mount option, to better support devices with slow discard operations" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (23 commits) ext4: make the updating inode data procedure atomic ext4: remove an unnecessary if statement in __ext4_get_inode_loc() ext4: move inode eio simulation behind io completeion ext4: Improve scalability of ext4 orphan file handling ext4: Orphan file documentation ext4: Speedup ext4 orphan inode handling ext4: Move orphan inode handling into a separate file ext4: Support for checksumming from journal triggers ext4: fix race writing to an inline_data file while its xattrs are changing jbd2: add sparse annotations for add_transaction_credits() ext4: fix sparse warnings ext4: Make sure quota files are not grabbed accidentally ext4: fix e2fsprogs checksum failure for mounted filesystem ext4: if zeroout fails fall back to splitting the extent node ext4: reduce arguments of ext4_fc_add_dentry_tlv ext4: flush background discard kwork when retry allocation ext4: get discard out of jbd2 commit kthread contex ext4: remove the repeated comment of ext4_trim_all_free ext4: add new helper interface ext4_try_to_trim_range() ext4: remove the 'group' parameter of ext4_trim_extent ... commit 0da14a19493da0f9b4c5ee5930ab05a4c61f5883 Author: Christophe JAILLET Date: Sun Aug 22 20:49:20 2021 +0200 x86/PCI: sta2x11: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been hand modified to use 'dma_set_mask_and_coherent()' instead of 'pci_set_dma_mask()/pci_set_consistent_dma_mask()' when applicable. This is less verbose. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Link: https://lore.kernel.org/r/99656452963ba3c63a6cb12e151279d81da365eb.1629658069.git.christophe.jaillet@wanadoo.fr Link: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ Signed-off-by: Christophe JAILLET Signed-off-by: Bjorn Helgaas commit 815409a12c0a9c0de17a910fd95fe11e1eb97f32 Merge: 412106c203b75 332f606b32b62 Author: Linus Torvalds Date: Thu Sep 2 09:21:27 2021 -0700 Merge tag 'ovl-update-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs update from Miklos Szeredi: - Copy up immutable/append/sync/noatime attributes (Amir Goldstein) - Improve performance by enabling RCU lookup. - Misc fixes and improvements The reason this touches so many files is that the ->get_acl() method now gets a "bool rcu" argument. The ->get_acl() API was updated based on comments from Al and Linus: Link: https://lore.kernel.org/linux-fsdevel/CAJfpeguQxpd6Wgc0Jd3ks77zcsAv_bn0q17L3VNnnmPKu11t8A@mail.gmail.com/ * tag 'ovl-update-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: enable RCU'd ->get_acl() vfs: add rcu argument to ->get_acl() callback ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() ovl: use kvalloc in xattr copy-up ovl: update ctime when changing fileattr ovl: skip checking lower file's i_writecount on truncate ovl: relax lookup error on mismatch origin ftype ovl: do not set overlay.opaque for new directories ovl: add ovl_allow_offline_changes() helper ovl: disable decoding null uuid with redirect_dir ovl: consistent behavior for immutable/append-only inodes ovl: copy up sync/noatime fileattr flags ovl: pass ovl_fs to ovl_check_setxattr() fs: add generic helper for filling statx attribute flags commit fa209644a7124b3f4cf811ced55daef49ae39ac6 Author: Mario Limonciello Date: Wed Sep 1 09:21:11 2021 -0500 ACPI: PM: s2idle: Run both AMD and Microsoft methods if both are supported It was reported that on "HP ENVY x360" that power LED does not come back, certain keys like brightness controls do not work, and the fan never spins up, even under load on 5.14 final. In analysis of the SSDT it's clear that the Microsoft UUID doesn't provide functional support, but rather the AMD UUID should be supporting this system. Because this is a gap in the expected logic, we checked back with internal team. The conclusion was that on Windows AMD uPEP *does* run even when Microsoft UUID present, but most OEM systems have adopted value of "0x3" for supported functions and hence nothing runs. Henceforth add support for running both Microsoft and AMD methods. This approach will also allow the same logic on Intel systems if desired at a future time as well by pulling the evaluation of `lps0_dsm_func_mask_microsoft` out of the `if` block for `acpi_s2idle_vendor_amd`. Link: https://gitlab.freedesktop.org/drm/amd/uploads/9fbcd7ec3a385cc6949c9bacf45dc41b/acpi-f.20.bin BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1691 Reported-by: Maxwell Beck Signed-off-by: Mario Limonciello [ rjw: Edits of the new comments ] Signed-off-by: Rafael J. Wysocki commit 412106c203b759fa7fbcc4f855a90ab18e681ccb Merge: 89594c746b00d 1266b4a7ecb67 Author: Linus Torvalds Date: Thu Sep 2 09:12:05 2021 -0700 Merge tag 'erofs-for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "In this cycle, direct I/O and fsdax support for uncompressed files are now added in order to avoid double-caching for loop device and VM container use cases. All uncompressed cases are now turned into iomap infrastructure, which looks much simpler and cleaner. In addition, fiemap support is added for both (un)compressed files by using iomap infrastructure as well so end users can easily get file distribution. We've also added chunk-based uncompressed files support for data deduplication as the next step of VM container use cases. Summary: - support direct I/O for all uncompressed files - support fsdax for non-tailpacking regular files - use iomap infrastructure for all uncompressed cases - support fiemap for both (un)compressed files - introduce chunk-based files for chunk deduplication - some cleanups" * tag 'erofs-for-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix double free of 'copied' erofs: support reading chunk-based uncompressed files erofs: introduce chunk-based file on-disk format erofs: add fiemap support with iomap erofs: add support for the full decompressed length erofs: remove the mapping parameter from erofs_try_to_free_cached_page() erofs: directly use wrapper erofs_page_is_managed() when shrinking erofs: convert all uncompressed cases to iomap erofs: dax support for non-tailpacking regular file erofs: iomap support for non-tailpacking DIO commit 17b121ad0c43342bc894632f6710b894849ca372 Author: Andy Shevchenko Date: Sun Aug 29 16:22:43 2021 +0300 Documentation: ACPI: Align the SSDT overlays file with the code This updates the following: 1) The ASL code to follow latest ACPI requirements, i.e. - static buffer to be defined outside of the method - The _ADR and _HID shouldn't be together for the same device 2) EFI section relies on the additional kernel configuration option, i.e. CONFIG_EFI_CUSTOM_SSDT_OVERLAYS 3) Refer to ACPI machine language as AML (capitalized) 4) Miscellaneous amendments Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 89594c746b00d3755e0792a2407f0b557a30ef37 Merge: 75ae663d053bd 20ec197bfa13c Author: Linus Torvalds Date: Thu Sep 2 09:06:28 2021 -0700 Merge tag 'fscache-next-20210829' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache updates from David Howells: "Preparatory work for the fscache rewrite that's being worked on and fix some bugs. These include: - Always select netfs stats when enabling fscache stats since they're displayed through the same procfile. - Add a cookie debug ID that can be used in tracepoints instead of a pointer and cache it in the netfs_cache_resources struct rather than in the netfs_read_request struct to make it more available. - Use file_inode() in cachefiles rather than dereferencing file->f_inode directly. - Provide a procfile to display fscache cookies. - Remove the fscache and cachefiles histogram procfiles. - Remove the fscache object list procfile. - Avoid using %p in fscache and cachefiles as the value is hashed and not comparable to the register dump in an oops trace. - Fix the cookie hash function to actually achieve useful dispersion. - Fix fscache_cookie_put() so that it doesn't dereference the cookie pointer in the tracepoint after the refcount has been decremented (we're only allowed to do that if we decremented it to zero). - Use refcount_t rather than atomic_t for the fscache_cookie refcount" * tag 'fscache-next-20210829' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: Use refcount_t for the cookie refcount instead of atomic_t fscache: Fix fscache_cookie_put() to not deref after dec fscache: Fix cookie key hashing cachefiles: Change %p in format strings to something else fscache: Change %p in format strings to something else fscache: Remove the object list procfile fscache, cachefiles: Remove the histogram stuff fscache: Procfile to display cookies fscache: Add a cookie debug ID and use that in traces cachefiles: Use file_inode() rather than accessing ->f_inode netfs: Move cookie debug ID to struct netfs_cache_resources fscache: Select netfs stats if fscache stats are enabled commit 4bf8e582119ed9767f907abb6dc62ef9dddf10df Author: Viresh Kumar Date: Wed Sep 1 14:41:57 2021 +0530 cpufreq: Remove ready() callback This isn't used anymore, get rid of it. Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 9ab0a6cb76b998f5f2231e1c428bee3771893002 Author: Viresh Kumar Date: Wed Sep 1 14:41:56 2021 +0530 cpufreq: sh: Remove sh_cpufreq_cpu_ready() The ->ready() callback is going away and since we don't do any important stuff in sh_cpufreq_cpu_ready(), remove it. Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 692a3b9a89947b27fc76d40b2613b33286a1690b Author: Viresh Kumar Date: Wed Sep 1 14:41:55 2021 +0530 cpufreq: acpi: Remove acpi_cpufreq_cpu_ready() The ready() callback was implemented earlier for acpi-cpufreq driver as we wanted to use policy->cpuinfo.max_freq for which the policy was required to be verified. That is no longer the case and we can do the pr_warn() right from ->init() callback now. Remove acpi_cpufreq_cpu_ready(). Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 59dc33252ee777e02332774fbdf3381b1d5d5f5d Author: Rafael J. Wysocki Date: Tue Aug 24 16:43:55 2021 +0200 PCI: VMD: ACPI: Make ACPI companion lookup work for VMD bus On some systems, in order to get to the deepest low-power state of the platform (which may be necessary to save significant enough amounts of energy while suspended to idle. for example), devices on the PCI bus exposed by the VMD driver need to be power-managed via ACPI. However, the layout of the ACPI namespace below the VMD controller device object does not reflect the layout of the PCI bus under the VMD host bridge, so in order to identify the ACPI companion objects for the devices on that bus, it is necessary to use a special _ADR encoding on the ACPI side. In other words, acpi_pci_find_companion() does not work for these devices, so it needs to be amended with a special lookup logic specific to the VMD bus. Address this issue by allowing the VMD driver to temporarily install an ACPI companion lookup hook containing the code matching the devices on the VMD PCI bus with the corresponding objects in the ACPI namespace. Signed-off-by: Rafael J. Wysocki Acked-by: Jon Derrick commit 75ae663d053bddf7c70a24cccf53c83ae03deff8 Author: Luca Coelho Date: Thu Sep 2 13:11:01 2021 +0300 iwlwifi: mvm: add rtnl_lock() in iwl_mvm_start_get_nvm() Due to a rebase damage, we lost the rtnl_lock() when the patch was sent out. This causes an RTNL imbalance and failed assertions, due to missing RTNL protection, for instance: RTNL: assertion failed at net/wireless/reg.c (4025) WARNING: CPU: 60 PID: 1720 at net/wireless/reg.c:4025 regulatory_set_wiphy_regd_sync+0x7f/0x90 [cfg80211] Call Trace: iwl_mvm_init_mcc+0x170/0x190 [iwlmvm] iwl_op_mode_mvm_start+0x824/0xa60 [iwlmvm] iwl_opmode_register+0xd0/0x130 [iwlwifi] init_module+0x23/0x1000 [iwlmvm] Fix this by adding the missing rtnl_lock() back to the code. Fixes: eb09ae93dabf ("iwlwifi: mvm: load regdomain at INIT stage") Link: https://lore.kernel.org/lkml/CAHk-=wjB_zBwZ+WR9LOpvgjvaQn=cqryoKigod8QnZs=iYGEhA@mail.gmail.com/ Reported-by: Linus Torvalds Signed-off-by: Luca Coelho Acked-by: David S. Miller Signed-off-by: Linus Torvalds commit 2e3a51b59ea26544303e168de8a0479915f09aa3 Author: Kari Argillander Date: Sun Aug 29 17:42:39 2021 +0300 fs/ntfs3: Change how module init/info messages are displayed Usually in file system init() messages are only displayed in info level. Change level from notice to info, but keep CONFIG_NTFS3_64BIT_CLUSTER in notice level. Also this need even more attention so let's put big warning here so that nobody will not try accidentally use it. There is also no good reason to display internal stuff like binary tree search. This is always on option which can only disabled for debugging purposes by developer. Also this message does not even check if developer has disabled it or not so it is useless info. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 989e795bfe360cca0affb0a4224f37bd8494b46d Author: Kari Argillander Date: Fri Aug 27 00:44:41 2021 +0300 fs/ntfs3: Remove GPL boilerplates from decompress lib files Files already have SDPX identifier so no reason to keep boilerplates in these files anymore. Signed-off-by: Kari Argillander Acked-by: Eric Biggers Signed-off-by: Konstantin Komarov commit dd854e4b5b12016d27bfa2694226a1c15acbd640 Author: Kari Argillander Date: Wed Aug 25 21:25:22 2021 +0300 fs/ntfs3: Remove unnecessary condition checking from ntfs_file_read_iter This check will be also performed in generic_file_read_iter() so we do not want to check this two times in a row. This was founded with Smatch fs/ntfs3/file.c:803 ntfs_file_read_iter() warn: unused return: count = iov_iter_count() Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit d4e8e135a9af7d8d939bba1874ab314322fc2dc2 Author: Kari Argillander Date: Wed Aug 25 21:24:35 2021 +0300 fs/ntfs3: Fix integer overflow in ni_fiemap with fiemap_prep() Use fiemap_prep() to check valid flags. It also shrink request scope (@len) to what the fs can actually handle. This address following Smatch static checker warning: fs/ntfs3/frecord.c:1894 ni_fiemap() warn: potential integer overflow from user 'vbo + len' Because fiemap_prep() shrinks @len this cannot happened anymore. Reported-by: Dan Carpenter Link: lore.kernel.org/ntfs3/20210825080440.GA17407@kili/ Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 1fd95c05d8f742abfe906620780aee4dbe1a2db0 Author: Theodore Ts'o Date: Thu Sep 2 11:36:01 2021 -0400 ext4: add error checking to ext4_ext_replay_set_iblocks() If the call to ext4_map_blocks() fails due to an corrupted file system, ext4_ext_replay_set_iblocks() can get stuck in an infinite loop. This could be reproduced by running generic/526 with a file system that has inline_data and fast_commit enabled. The system will repeatedly log to the console: EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076 and the stack that it gets stuck in is: ext4_block_to_path+0xe3/0x130 ext4_ind_map_blocks+0x93/0x690 ext4_map_blocks+0x100/0x660 skip_hole+0x47/0x70 ext4_ext_replay_set_iblocks+0x223/0x440 ext4_fc_replay_inode+0x29e/0x3b0 ext4_fc_replay+0x278/0x550 do_one_pass+0x646/0xc10 jbd2_journal_recover+0x14a/0x270 jbd2_journal_load+0xc4/0x150 ext4_load_journal+0x1f3/0x490 ext4_fill_super+0x22d4/0x2c00 With this patch, generic/526 still fails, but system is no longer locking up in a tight loop. It's likely the root casue is that fast_commit replay is corrupting file systems with inline_data, and we probably need to add better error handling in the fast commit replay code path beyond what is done here, which essentially just breaks the infinite loop without reporting the to the higher levels of the code. Fixes: 8016E29F4362 ("ext4: fast commit recovery path") Cc: stable@kernel.org Cc: Harshad Shirwadkar Signed-off-by: Theodore Ts'o commit f97a2103f1a75ca70f23deadb4d96a16c4d85e7d Author: Hans de Goede Date: Thu Sep 2 17:28:53 2021 +0200 firmware: dmi: Move product_sku info to the end of the modalias Commit e26f023e01ef ("firmware/dmi: Include product_sku info to modalias") added a new field to the modalias in the middle of the modalias, breaking some existing udev/hwdb matches on the whole modalias without a wildcard ('*') in between the pvr and rvn fields. All modalias matches in e.g. : https://github.com/systemd/systemd/blob/main/hwdb.d/60-sensor.hwdb deliberately end in ':*' so that new fields can be added at *the end* of the modalias, but adding a new field in the middle like this breaks things. Move the new sku field to the end of the modalias to fix some hwdb entries no longer matching. The new sku field has already been put to use in 2 new hwdb entries: sensor:modalias:platform:HID-SENSOR-200073:dmi:*svnDell*:sku0A3E:* ACCEL_LOCATION=base sensor:modalias:platform:HID-SENSOR-200073:dmi:*svnDell*:sku0B0B:* ACCEL_LOCATION=base The wildcard use before and after the sku in these matches means that they should keep working with the sku moved to the end. Note that there is a second instance of in essence the same problem, commit f5152f4ded3c ("firmware/dmi: Report DMI Bios & EC firmware release") Added 2 new br and efr fields in the middle of the modalias. This too breaks some hwdb modalias matches, but this has gone unnoticed for over a year. So some newer hwdb modalias matches actually depend on these fields being in the middle of the string. Moving these to the end now would break 3 hwdb entries, while fixing 8 entries. Since there is no good answer for the new br and efr fields I have chosen to leave these as is. Instead I'll submit a hwdb update to put a wildcard at the place where these fields may or may not be present depending on the kernel version. BugLink: https://github.com/systemd/systemd/issues/20550 Link: https://github.com/systemd/systemd/pull/20562 Fixes: e26f023e01ef ("firmware/dmi: Include product_sku info to modalias") Cc: stable@vger.kernel.org Cc: Kai-Chuan Hsieh Cc: Erwan Velu Signed-off-by: Hans de Goede Signed-off-by: Jean Delvare commit 90c90cda05aecf0f7c45f9f35384b31bba38455f Merge: 4ac6d90867a4d f38a032b165d8 Author: Linus Torvalds Date: Thu Sep 2 08:26:03 2021 -0700 Merge tag 'xfs-5.15-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "There's a lot in this cycle. Starting with bug fixes: To avoid livelocks between the logging code and the quota code, we've disabled the ability of quotaoff to turn off quota accounting. (Admins can still disable quota enforcement, but truly turning off accounting requires a remount.) We've tried to do this in a careful enough way that there shouldn't be any user visible effects aside from quotaoff no longer randomly hanging the system. We've also fixed some bugs in runtime log behavior that could trip up log recovery if (otherwise unrelated) transactions manage to start and commit concurrently; some bugs in the GETFSMAP ioctl where we would incorrectly restrict the range of records output if the two xfs devices are of different sizes; a bug that resulted in fallocate funshare failing unnecessarily; and broken behavior in the xfs inode cache when DONTCACHE is in play. As for new features: we now batch inode inactivations in percpu background threads, which sharply decreases frontend thread wait time when performing file deletions and should improve overall directory tree deletion times. This eliminates both the problem where closing an unlinked file (especially on a frozen fs) can stall for a long time, and should also ease complaints about direct reclaim bogging down on unlinked file cleanup. Starting with this release, we've enabled pipelining of the XFS log. On workloads with high rates of metadata updates to different shards of the filesystem, multiple threads can be used to format committed log updates into log checkpoints. Lastly, with this release, two new features have graduated to supported status: inode btree counters (for faster mounts), and support for dates beyond Y2038. Expect these to be enabled by default in a future release of xfsprogs. Summary: - Fix a potential log livelock on busy filesystems when there's so much work going on that we can't finish a quotaoff before filling up the log by removing the ability to disable quota accounting. - Introduce the ability to use per-CPU data structures in XFS so that we can do a better job of maintaining CPU locality for certain operations. - Defer inode inactivation work to per-CPU lists, which will help us batch that processing. Deletions of large sparse files will *appear* to run faster, but all that means is that we've moved the work to the backend. - Drop the EXPERIMENTAL warnings from the y2038+ support and the inode btree counters, since it's been nearly a year and no complaints have come in. - Remove more of our bespoke kmem* variants in favor of using the standard Linux calls. - Prepare for the addition of log incompat features in upcoming cycles by actually adding code to support this. - Small cleanups of the xattr code in preparation for landing support for full logging of extended attribute updates in a future cycle. - Replace the various log shutdown state and flag code all over xfs with a single atomic bit flag. - Fix a serious log recovery bug where log item replay can be skipped based on the start lsn of a transaction even though the transaction commit lsn is the key data point for that by enforcing start lsns to appear in the log in the same order as commit lsns. - Enable pipelining in the code that pushes log items to disk. - Drop ->writepage. - Fix some bugs in GETFSMAP where the last fsmap record reported for a device could extend beyond the end of the device, and a separate bug where query keys for one device could be applied to another. - Don't let GETFSMAP query functions edit their input parameters. - Small cleanups to the scrub code's handling of perag structures. - Small cleanups to the incore inode tree walk code. - Constify btree function parameters that aren't changed, so that there will never again be confusion about range query functions changing their input parameters. - Standardize the format and names of tracepoint data attributes. - Clean up all the mount state and feature flags to use wrapped bitset functions instead of inconsistently open-coded flag checks. - Fix some confusion between xfs_buf hash table key variable vs. block number. - Fix a mis-interaction with iomap where we reported shared delalloc cow fork extents to iomap, which would cause the iomap unshare operation to return IO errors unnecessarily. - Fix DONTCACHE behavior" * tag 'xfs-5.15-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (103 commits) xfs: fix I_DONTCACHE xfs: only set IOMAP_F_SHARED when providing a srcmap to a write xfs: fix perag structure refcounting error when scrub fails xfs: rename buffer cache index variable b_bn xfs: convert bp->b_bn references to xfs_buf_daddr() xfs: introduce xfs_buf_daddr() xfs: kill xfs_sb_version_has_v3inode() xfs: introduce xfs_sb_is_v5 helper xfs: remove unused xfs_sb_version_has wrappers xfs: convert xfs_sb_version_has checks to use mount features xfs: convert scrub to use mount-based feature checks xfs: open code sb verifier feature checks xfs: convert xfs_fs_geometry to use mount feature checks xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown xfs: convert remaining mount flags to state flags xfs: convert mount flags to features xfs: consolidate mount option features in m_features xfs: replace xfs_sb_version checks with feature flag checks xfs: reflect sb features in xfs_mount xfs: rework attr2 feature and mount options ... commit 4f89ff026ddbaab49dba993ad2dc757920d0ad49 Author: Shengjiu Wang Date: Thu Sep 2 11:32:05 2021 +0800 ASoC: dt-bindings: fsl_rpmsg: Add compatible string for i.MX8ULP Add compatible string for i.MX8ULP platform which support audio function through rpmsg audio channel on M core. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1630553525-25655-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit c4f3a3460a5daebc772d9263500e4099b11e7300 Author: Geert Uytterhoeven Date: Thu Sep 2 14:49:11 2021 +0200 dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER Move notify between drivers is an option of DMA-BUF. Enabling DMABUF_MOVE_NOTIFY without DMA_SHARED_BUFFER does not have any impact, as drivers/dma-buf/ is not entered during the build when DMA_SHARED_BUFFER is disabled. Fixes: bb42df4662a44765 ("dma-buf: add dynamic DMA-buf handling v15") Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210902124913.2698760-2-geert@linux-m68k.org commit 49ca6153208f6efc409c1deb82dd5bcbb519d7e1 Author: Daniel Borkmann Date: Tue Aug 24 09:39:31 2021 +0200 bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause Some time ago we dual-licensed both libbpf and bpftool through commits 1bc38b8ff6cc ("libbpf: relicense libbpf as LGPL-2.1 OR BSD-2-Clause") and 907b22365115 ("tools: bpftool: dual license all files"). The latter missed the disasm.{c,h} which we pull in via kernel/bpf/ such that we have a single source for verifier as well as bpftool asm dumping, see also f4ac7e0b5cc8 ("bpf: move instruction printing into a separate file"). It is currently GPL-2.0-only and missed the conversion in 907b22365115, therefore relicense the two as GPL-2.0-only OR BSD-2-Clause as well. Spotted-by: Quentin Monnet Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Acked-by: Thomas Graf Acked-by: Brendan Jackman Acked-by: Jakub Kicinski Acked-by: Jiri Olsa Acked-by: Simon Horman Acked-by: Martin KaFai Lau Acked-by: Xu Kuohai Acked-by: Edward Cree commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b Author: Paolo Valente Date: Mon Aug 2 16:13:52 2021 +0200 block, bfq: honor already-setup queue merges The function bfq_setup_merge prepares the merging between two bfq_queues, say bfqq and new_bfqq. To this goal, it assigns bfqq->new_bfqq = new_bfqq. Then, each time some I/O for bfqq arrives, the process that generated that I/O is disassociated from bfqq and associated with new_bfqq (merging is actually a redirection). In this respect, bfq_setup_merge increases new_bfqq->ref in advance, adding the number of processes that are expected to be associated with new_bfqq. Unfortunately, the stable-merging mechanism interferes with this setup. After bfqq->new_bfqq has been set by bfq_setup_merge, and before all the expected processes have been associated with bfqq->new_bfqq, bfqq may happen to be stably merged with a different queue than the current bfqq->new_bfqq. In this case, bfqq->new_bfqq gets changed. So, some of the processes that have been already accounted for in the ref counter of the previous new_bfqq will not be associated with that queue. This creates an unbalance, because those references will never be decremented. This commit fixes this issue by reestablishing the previous, natural behaviour: once bfqq->new_bfqq has been set, it will not be changed until all expected redirections have occurred. Signed-off-by: Davide Zini Signed-off-by: Paolo Valente Link: https://lore.kernel.org/r/20210802141352.74353-2-paolo.valente@linaro.org Signed-off-by: Jens Axboe commit 55a51ea14094a1e7dd0d7f33237d246033dd39ab Author: Geert Uytterhoeven Date: Mon Aug 30 11:11:28 2021 +0200 block/mq-deadline: Move dd_queued() to fix defined but not used warning If CONFIG_BLK_DEBUG_FS=n: block/mq-deadline.c:274:12: warning: ‘dd_queued’ defined but not used [-Wunused-function] 274 | static u32 dd_queued(struct deadline_data *dd, enum dd_prio prio) | ^~~~~~~~~ Fix this by moving dd_queued() just before the sole function that calls it. Fixes: 7b05bf771084ff78 ("Revert "block/mq-deadline: Prioritize high-priority requests"") Signed-off-by: Geert Uytterhoeven Fixes: 38ba64d12d4c ("block/mq-deadline: Track I/O statistics") Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20210830091128.1854266-1-geert@linux-m68k.org Signed-off-by: Jens Axboe commit d12e1c4649883e8ca5e8ff341e1948b3b6313259 Author: Rafał Miłecki Date: Thu Sep 2 10:30:51 2021 +0200 net: dsa: b53: Set correct number of ports in the DSA struct Setting DSA_MAX_PORTS caused DSA to call b53 callbacks (e.g. b53_disable_port() during dsa_register_switch()) for invalid (non-existent) ports. That made b53 modify unrelated registers and is one of reasons for a broken BCM5301x support. This problem exists for years but DSA_MAX_PORTS usage has changed few times. It seems the most accurate to reference commit dropping dsa_switch_alloc() in the Fixes tag. Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper") Signed-off-by: Rafał Miłecki Signed-off-by: David S. Miller commit cdb067d31c0fe4cce98b9d15f1f2ef525acaa094 Author: Rafał Miłecki Date: Thu Sep 2 10:30:50 2021 +0200 net: dsa: b53: Fix calculating number of switch ports It isn't true that CPU port is always the last one. Switches BCM5301x have 9 ports (port 6 being inactive) and they use port 5 as CPU by default (depending on design some other may be CPU ports too). A more reliable way of determining number of ports is to check for the last set bit in the "enabled_ports" bitfield. This fixes b53 internal state, it will allow providing accurate info to the DSA and is required to fix BCM5301x support. Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Rafał Miłecki Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit aabbdc67f3485b5db27ab4eba01e5fbf1ffea62c Author: Daniele Palmas Date: Thu Sep 2 12:51:22 2021 +0200 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit LN920 0x1061 composition in order to avoid bind error. Signed-off-by: Daniele Palmas Signed-off-by: David S. Miller commit ecdc28defc46af476566fffd9e5cb4495a2f176e Author: Ziyang Xuan Date: Thu Sep 2 16:36:09 2021 +0800 net: hso: add failure handler for add_net_device If the network devices connected to the system beyond HSO_MAX_NET_DEVICES. add_net_device() in hso_create_net_device() will be failed for the network_table is full. It will lead to business failure which rely on network_table, for example, hso_suspend() and hso_resume(). It will also lead to memory leak because resource release process can not search the hso_device object from network_table in hso_free_interface(). Add failure handler for add_net_device() in hso_create_net_device() to solve the above problems. Fixes: 72dc1c096c70 ("HSO: add option hso driver") Signed-off-by: Ziyang Xuan Signed-off-by: David S. Miller commit b9edbfe1adecfc48fd11061dce68afb03d6adbdc Author: Tetsuo Handa Date: Thu Sep 2 14:36:17 2021 +0900 flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common() Commit 3df98d79215ace13 ("lsm,selinux: pass flowi_common instead of flowi to the LSM hooks") introduced flowi{4,6}_to_flowi_common() functions which cause UBSAN warning when building with LLVM 11.0.1 on Ubuntu 21.04. ================================================================================ UBSAN: object-size-mismatch in ./include/net/flow.h:197:33 member access within address ffffc9000109fbd8 with insufficient space for an object of type 'struct flowi' CPU: 2 PID: 7410 Comm: systemd-resolve Not tainted 5.14.0 #51 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack_lvl+0x103/0x171 ubsan_type_mismatch_common+0x1de/0x390 __ubsan_handle_type_mismatch_v1+0x41/0x50 udp_sendmsg+0xda2/0x1300 ? ip_skb_dst_mtu+0x1f0/0x1f0 ? sock_rps_record_flow+0xe/0x200 ? inet_send_prepare+0x2d/0x90 sock_sendmsg+0x49/0x80 ____sys_sendmsg+0x269/0x370 __sys_sendmsg+0x15e/0x1d0 ? syscall_enter_from_user_mode+0xf0/0x1b0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f7081a50497 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007ffc153870f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f7081a50497 RDX: 0000000000000000 RSI: 00007ffc15387140 RDI: 000000000000000c RBP: 00007ffc15387140 R08: 0000563f29a5e4fc R09: 000000000000cd28 R10: 0000563f29a68a30 R11: 0000000000000246 R12: 000000000000000c R13: 0000000000000001 R14: 0000563f29a68a30 R15: 0000563f29a5e50c ================================================================================ I don't think we need to call flowi{4,6}_to_flowi() from these functions because the first member of "struct flowi4" and "struct flowi6" is struct flowi_common __fl_common; while the first member of "struct flowi" is union { struct flowi_common __fl_common; struct flowi4 ip4; struct flowi6 ip6; struct flowidn dn; } u; which should point to the same address without access to "struct flowi". Signed-off-by: Tetsuo Handa Signed-off-by: David S. Miller commit 9aca491e0dccf8a9d84a5b478e5eee3c6ea7803b Author: Ryoga Saito Date: Thu Sep 2 05:20:14 2021 +0000 Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 This patch fixes kernel NULL pointer dereference when creating nexthop which is bound with SRv6 decapsulation. In the creation of nexthop, __seg6_end_dt_vrf_build is called. __seg6_end_dt_vrf_build expects fc_lninfo in fib6_config is set correctly, but it isn't set in nh_create_ipv6, which causes kernel crash. Here is steps to reproduce kernel crash: 1. modprobe vrf 2. ip -6 nexthop add encap seg6local action End.DT4 vrftable 1 dev eth0 We got the following message: [ 901.370336] BUG: kernel NULL pointer dereference, address: 0000000000000ba0 [ 901.371658] #PF: supervisor read access in kernel mode [ 901.372672] #PF: error_code(0x0000) - not-present page [ 901.373672] PGD 0 P4D 0 [ 901.374248] Oops: 0000 [#1] SMP PTI [ 901.374944] CPU: 0 PID: 8593 Comm: ip Not tainted 5.14-051400-generic #202108310811-Ubuntu [ 901.376404] Hardware name: Red Hat KVM, BIOS 1.11.1-4.module_el8.2.0+320+13f867d7 04/01/2014 [ 901.377907] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf] [ 901.379182] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00 [ 901.382652] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282 [ 901.383746] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8 [ 901.385436] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 [ 901.386924] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40 [ 901.388537] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000 [ 901.389937] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b [ 901.391226] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000 [ 901.392737] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 901.393803] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0 [ 901.395122] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 901.396496] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 901.397833] PKRU: 55555554 [ 901.398578] Call Trace: [ 901.399144] l3mdev_ifindex_lookup_by_table_id+0x3b/0x70 [ 901.400179] __seg6_end_dt_vrf_build+0x34/0xd0 [ 901.401067] seg6_end_dt4_build+0x16/0x20 [ 901.401904] seg6_local_build_state+0x271/0x430 [ 901.402797] lwtunnel_build_state+0x81/0x130 [ 901.403645] fib_nh_common_init+0x82/0x100 [ 901.404465] ? sock_def_readable+0x4b/0x80 [ 901.405285] fib6_nh_init+0x115/0x7c0 [ 901.406033] nh_create_ipv6.isra.0+0xe1/0x140 [ 901.406932] rtm_new_nexthop+0x3b7/0xeb0 [ 901.407828] rtnetlink_rcv_msg+0x152/0x3a0 [ 901.408663] ? rtnl_calcit.isra.0+0x130/0x130 [ 901.409535] netlink_rcv_skb+0x55/0x100 [ 901.410319] rtnetlink_rcv+0x15/0x20 [ 901.411026] netlink_unicast+0x1a8/0x250 [ 901.411813] netlink_sendmsg+0x238/0x470 [ 901.412602] ? _copy_from_user+0x2b/0x60 [ 901.413394] sock_sendmsg+0x65/0x70 [ 901.414112] ____sys_sendmsg+0x218/0x290 [ 901.414929] ? copy_msghdr_from_user+0x5c/0x90 [ 901.415814] ___sys_sendmsg+0x81/0xc0 [ 901.416559] ? fsnotify_destroy_marks+0x27/0xf0 [ 901.417447] ? call_rcu+0xa4/0x230 [ 901.418153] ? kmem_cache_free+0x23f/0x410 [ 901.418972] ? dentry_free+0x37/0x70 [ 901.419705] ? mntput_no_expire+0x4c/0x260 [ 901.420574] __sys_sendmsg+0x62/0xb0 [ 901.421297] __x64_sys_sendmsg+0x1f/0x30 [ 901.422057] do_syscall_64+0x5c/0xc0 [ 901.422756] ? syscall_exit_to_user_mode+0x27/0x50 [ 901.423675] ? __x64_sys_close+0x12/0x40 [ 901.424462] ? do_syscall_64+0x69/0xc0 [ 901.425219] ? irqentry_exit_to_user_mode+0x9/0x20 [ 901.426149] ? irqentry_exit+0x19/0x30 [ 901.426901] ? exc_page_fault+0x89/0x160 [ 901.427709] ? asm_exc_page_fault+0x8/0x30 [ 901.428536] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 901.429514] RIP: 0033:0x7fe493945747 [ 901.430248] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 901.433549] RSP: 002b:00007ffe9932cf68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 901.434981] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe493945747 [ 901.436303] RDX: 0000000000000000 RSI: 00007ffe9932cfe0 RDI: 0000000000000003 [ 901.437607] RBP: 00000000613053f7 R08: 0000000000000001 R09: 00007ffe9932d07c [ 901.438990] R10: 000055f4a903a010 R11: 0000000000000246 R12: 0000000000000001 [ 901.440340] R13: 0000000000000001 R14: 000055f4a802b163 R15: 000055f4a8042020 [ 901.441630] Modules linked in: vrf nls_utf8 isofs nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common isst_if_mbox_msr isst_if_common nfit rapl input_leds joydev serio_raw qemu_fw_cfg mac_hid sch_fq_codel drm virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd virtio_net net_failover cryptd psmouse virtio_blk failover i2c_piix4 pata_acpi floppy [ 901.450808] CR2: 0000000000000ba0 [ 901.451514] ---[ end trace c27b934b99ade304 ]--- [ 901.452403] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf] [ 901.453626] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00 [ 901.456910] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282 [ 901.457912] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8 [ 901.459238] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000 [ 901.460552] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40 [ 901.461882] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000 [ 901.463208] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b [ 901.464529] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000 [ 901.466058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 901.467189] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0 [ 901.468515] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 901.469858] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 901.471139] PKRU: 55555554 Signed-off-by: Ryoga Saito Signed-off-by: David S. Miller commit d2cabd2dc8da78faf9b690ea521d03776686c9fe Author: Dan Carpenter Date: Thu Sep 2 13:08:51 2021 +0300 net: qrtr: revert check in qrtr_endpoint_post() I tried to make this check stricter as a hardenning measure but it broke audo and wifi on these devices so revert it. Fixes: aaa8e4922c88 ("net: qrtr: make checks in qrtr_endpoint_post() stricter") Reported-by: John Stultz Signed-off-by: Dan Carpenter Tested-by: Srinivas Kandagatla Signed-off-by: David S. Miller commit 552799f8b3b0074d2617f53a63a088f9514a66e3 Author: Jan Hoffmann Date: Wed Sep 1 20:49:33 2021 +0200 net: dsa: lantiq_gswip: fix maximum frame length Currently, outgoing packets larger than 1496 bytes are dropped when tagged VLAN is used on a switch port. Add the frame check sequence length to the value of the register GSWIP_MAC_FLEN to fix this. This matches the lantiq_ppa vendor driver, which uses a value consisting of 1518 bytes for the MAC frame, plus the lengths of special tag and VLAN tags. Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Cc: stable@vger.kernel.org Signed-off-by: Jan Hoffmann Acked-by: Hauke Mehrtens Signed-off-by: David S. Miller commit 025efa0a82dfa79ac2b126f622ba9244f795e707 Author: Jakub Kicinski Date: Wed Sep 1 08:55:01 2021 -0700 selftests: add simple GSO GRE test Test case for commit a6e3f2985a80 ("ip6_tunnel: fix GRE6 segmentation"). Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 3f22bb137eb03ab27eaaa8b40d3e072eb541444e Author: Jiwon Kim Date: Thu Sep 2 00:34:49 2021 +0900 ipv6: change return type from int to void for mld_process_v2 The mld_process_v2 only returned 0. So, the return type is changed to void. Signed-off-by: Jiwon Kim Signed-off-by: David S. Miller commit 66abf5fb4cf713c6fdfccfbbabdcdf834f8bb9e2 Author: Geert Uytterhoeven Date: Wed Sep 1 14:17:35 2021 +0200 net/sun3_82586: Fix return value of sun3_82586_probe() drivers/net/ethernet/i825xx/sun3_82586.c: In function ‘sun3_82586_probe’: drivers/net/ethernet/i825xx/sun3_82586.c:317:9: warning: returning ‘struct net_device *’ from a function with return type ‘int’ makes integer from pointer without a cast [-Wint-conversion] 317 | return dev; | ^~~ The return type of sun3_82586_probe() was changed, but one return value was forgotten to be updated. Fixes: e179d78ee11a70e2 ("m68k: remove legacy probing") Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit bea6a94a279bcbe6b2cde348782b28baf12255a5 Author: Oleksij Rempel Date: Thu Sep 2 09:19:51 2021 +0200 MIPS: Malta: fix alignment of the devicetree buffer Starting with following patch MIPS Malta is not able to boot: | commit 79edff12060fe7772af08607eff50c0e2486c5ba | Author: Rob Herring | scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9 The reason is the alignment test added to the fdt_ro_probe_(). To fix this issue, we need to make sure that fdt_buf is aligned. Since the dtc patch was designed to uncover potential issue, I handle initial MIPS Malta patch as initial bug. Fixes: e81a8c7dabac ("MIPS: Malta: Setup RAM regions via DT") Signed-off-by: Oleksij Rempel Signed-off-by: Thomas Bogendoerfer commit 4ac6d90867a4de2e12117e755dbd76e08d88697f Merge: df43d903828c5 37397b092e7f4 Author: Linus Torvalds Date: Wed Sep 1 18:49:47 2021 -0700 Merge tag 'docs-5.15' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "Yet another set of documentation changes: - A reworking of PDF generation to yield better results for documents using CJK fonts in particular. - A new set of translations into traditional Chinese, a dialect for which I am assured there is a community of interested readers. - A lot more regular Chinese translation work as well. ... plus the usual assortment of updates, fixes, typo tweaks, etc" * tag 'docs-5.15' of git://git.lwn.net/linux: (55 commits) docs: sphinx-requirements: Move sphinx_rtd_theme to top docs: pdfdocs: Enable language-specific font choice of zh_TW translations docs: pdfdocs: Teach xeCJK about character classes of quotation marks docs: pdfdocs: Permit AutoFakeSlant for CJK fonts docs: pdfdocs: One-half spacing for CJK translations docs: pdfdocs: Add conf.py local to translations for ascii-art alignment docs: pdfdocs: Preserve inter-phrase space in Korean translations docs: pdfdocs: Choose Serif font as CJK mainfont if possible docs: pdfdocs: Add CJK-language-specific font settings docs: pdfdocs: Refactor config for CJK document scripts/kernel-doc: Override -Werror from KCFLAGS with KDOC_WERROR docs/zh_CN: Add zh_CN/accounting/psi.rst doc: align Italian translation Documentation/features/vm: riscv supports THP now docs/zh_CN: add infiniband user_verbs translation docs/zh_CN: add infiniband user_mad translation docs/zh_CN: add infiniband tag_matching translation docs/zh_CN: add infiniband sysfs translation docs/zh_CN: add infiniband opa_vnic translation docs/zh_CN: add infiniband ipoib translation ... commit df43d903828c59afb9e93b59835127a02e1f8144 Merge: 9e5f3ffcf1cb3 c985aafb60e97 Author: Linus Torvalds Date: Wed Sep 1 18:41:13 2021 -0700 Merge tag 'printk-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Optionally, provide an index of possible printk messages via /printk/index/. It can be used when monitoring important kernel messages on a farm of various hosts. The monitor has to be updated when some messages has changed or are not longer available by a newly deployed kernel. - Add printk.console_no_auto_verbose boot parameter. It allows to generate crash dump even with slow consoles in a reasonable time frame. - Remove printk_safe buffers. The messages are always stored directly to the main logbuffer, even in NMI or recursive context. Also it allows to serialize syslog operations by a mutex instead of a spin lock. - Misc clean up and build fixes. * tag 'printk-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/index: Fix -Wunused-function warning lib/nmi_backtrace: Serialize even messages about idle CPUs printk: Add printk.console_no_auto_verbose boot parameter printk: Remove console_silent() lib/test_scanf: Handle n_bits == 0 in random tests printk: syslog: close window between wait and read printk: convert @syslog_lock to mutex printk: remove NMI tracking printk: remove safe buffers printk: track/limit recursion lib/nmi_backtrace: explicitly serialize banner and regs printk: Move the printk() kerneldoc comment to its new home printk/index: Fix warning about missing prototypes MIPS/asm/printk: Fix build failure caused by printk printk: index: Add indexing support to dev_printk printk: Userspace format indexing support printk: Rework parse_prefix into printk_parse_prefix printk: Straighten out log_flags into printk_info_flags string_helpers: Escape double quotes in escape_special printk/console: Check consistent sequence number when handling race in console_unlock() commit 9e5f3ffcf1cb34e7c7beb3f79a96f58536730924 Merge: 6104dde096eba b1e202503508d Author: Linus Torvalds Date: Wed Sep 1 18:34:51 2021 -0700 Merge tag 'devicetree-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: - Refactor arch kdump DT related code to a common implementation - Add fw_devlink tracking for 'phy-handle', 'leds', 'backlight', 'resets', and 'pwm' properties - Various clean-ups to DT FDT code - Fix a runtime error for !CONFIG_SYSFS - Convert Synopsys DW PCI and derivative binding docs to schemas. Add Toshiba Visconti PCIe binding. - Convert a bunch of memory controller bindings to schemas - Covert eeprom-93xx46, Samsung Exynos TRNG, Samsung Exynos IRQ combiner, arm-charlcd, img-ascii-lcd, UniPhier eFuse, Xilinx Zynq MPSoC FPGA, Xilinx Zynq MPSoC reset, Mediatek mmsys, Gemini boards, brcm,iproc-i2c, faraday,ftpci100, and ks8851 net to DT schema. - Extend nvmem bindings to handle bit offsets in unit-addresses - Add DT schemas for HiKey 970 PCIe PHY - Remove unused ZTE, energymicro,efm32-timer, and Exynos SATA bindings - Enable dtc pci_device_reg warning by default - Fixes for handling 'unevaluatedProperties' in preparation to enable pending support in the tooling for jsonschema 2020-12 draft * tag 'devicetree-for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (78 commits) dt-bindings: display: remove zte,vou.txt binding doc dt-bindings: hwmon: merge max1619 into trivial devices dt-bindings: mtd-physmap: Add 'arm,vexpress-flash' compatible dt-bindings: PCI: imx6: convert the imx pcie controller to dtschema dt-bindings: Use 'enum' instead of 'oneOf' plus 'const' entries dt-bindings: Add vendor prefix for Topic Embedded Systems of: fdt: Rename reserve_elfcorehdr() to fdt_reserve_elfcorehdr() arm64: kdump: Remove custom linux,usable-memory-range handling arm64: kdump: Remove custom linux,elfcorehdr handling riscv: Remove non-standard linux,elfcorehdr handling of: fdt: Use IS_ENABLED(CONFIG_BLK_DEV_INITRD) instead of #ifdef of: fdt: Add generic support for handling usable memory range property of: fdt: Add generic support for handling elf core headers property crash_dump: Make elfcorehdr address/size symbols always visible dt-bindings: memory: convert Samsung Exynos DMC to dtschema dt-bindings: devfreq: event: convert Samsung Exynos PPMU to dtschema dt-bindings: devfreq: event: convert Samsung Exynos NoCP to dtschema kbuild: Enable dtc 'pci_device_reg' warning by default dt-bindings: soc: remove obsolete zte zx header dt-bindings: clock: remove obsolete zte zx header ... commit 6104dde096eba9f443845686a2c4b3fa31129eb4 Merge: c07f191907e7d db87db65c1059 Author: Linus Torvalds Date: Wed Sep 1 18:31:45 2021 -0700 Merge tag 'm68knommu-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A collection of fixes: - flexcan platform support (for m5441x) - fix CONFIG_ROMKERNEL linking - fix compilation when CONFIG_ISA_DMA_API is set - fix local ColdFire clk_enable() for NULL clk" * tag 'm68knommu-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch m68k: coldfire: return success for clk_enable(NULL) m68k: m5441x: add flexcan support m68k: stmark2: update board setup m68k/nommu: prevent setting ROMKERNEL when ROM is not set commit c07f191907e7d7e04034a2b9657a6bbf1355c60a Merge: 7c636d4d20f8c 9d68cd9120e4e Author: Linus Torvalds Date: Wed Sep 1 18:25:20 2021 -0700 Merge tag 'hyperv-next-signed-20210831' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - make Hyper-V code arch-agnostic (Michael Kelley) - fix sched_clock behaviour on Hyper-V (Ani Sinha) - fix a fault when Linux runs as the root partition on MSHV (Praveen Kumar) - fix VSS driver (Vitaly Kuznetsov) - cleanup (Sonia Sharma) * tag 'hyperv-next-signed-20210831' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer Drivers: hv: Enable Hyper-V code to be built on ARM64 arm64: efi: Export screen_info arm64: hyperv: Initialize hypervisor on boot arm64: hyperv: Add panic handler arm64: hyperv: Add Hyper-V hypercall and register access utilities x86/hyperv: fix root partition faults when writing to VP assist page MSR hv: hyperv.h: Remove unused inline functions drivers: hv: Decouple Hyper-V clock/timer code from VMbus drivers x86/hyperv: add comment describing TSC_INVARIANT_CONTROL MSR setting bit 0 Drivers: hv: Move Hyper-V misc functionality to arch-neutral code Drivers: hv: Add arch independent default functions for some Hyper-V handlers Drivers: hv: Make portions of Hyper-V init code be arch neutral x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable asm-generic/hyperv: Add missing #include of nmi.h commit 205b95fe658ddba25236c60da777f67b4eec3fd3 Author: Ivan Mikhaylov Date: Mon Aug 30 20:18:06 2021 +0300 net/ncsi: add get MAC address command to get Intel i210 MAC address This patch adds OEM Intel GMA command and response handler for it. Signed-off-by: Brad Ho Signed-off-by: Paul Fertser Signed-off-by: Ivan Mikhaylov Link: https://lore.kernel.org/r/20210830171806.119857-2-i.mikhaylov@yadro.com Signed-off-by: Jakub Kicinski commit 5240118f08a07669537677be19edbf008682f8bd Author: Edwin Peer Date: Wed Sep 1 11:53:15 2021 -0700 bnxt_en: fix kernel doc warnings in bnxt_hwrm.c Parameter names in the comments did not match the function arguments. Fixes: 213808170840 ("bnxt_en: add support for HWRM request slices") Signed-off-by: Edwin Peer Reported-by: Jakub Kicinski Reviewed-by: Michael Chan Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20210901185315.57137-1-edwin.peer@broadcom.com Signed-off-by: Jakub Kicinski commit 7c636d4d20f8c5acfbfbc60f326fddb0e1cf5daa Merge: 32b47072f319b 9e62ec0e661ca Author: Linus Torvalds Date: Wed Sep 1 15:39:09 2021 -0700 Merge tag 'dt-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC DT updates from Arnd Bergmann: "As usual, the bulk of work in the SoC tree goes into DT files, this time with a roughly even split between 32-bit and 64-bit SoCs rather than the usual mostly 64-bit changes. New SoCs: - Microchip SAMA7 SoC family based on Cortex-A7, a new 32-bit platform based on the older SAMA5 series. - Qualcomm Snapdragon SDM636 and SM8150, variations of the existing phone SoCs. - Renesas R-Car H3e-2G and M3e-2G SoCs, variations of older Renesas SoCs. New boards: - Marvell CN913x reference boards - ASpeed AST2600 BMC implementations for Facebook Cloudripper, Elbert and Fuji server boards. - Snapdragon 665 based Sony Xperia 10II - Snapdragon MSM8916 based Xiaomi Redmi 2 - Snapdragon MSM8226 based Samsung Galaxy S3 Neo - NXP i.MX based 32-bit boards: - DHCOM based PicoITX - DHSOM based DRC0ỉ - SolidRun SolidSense - SKOV i.MX6 boards. - NXP i.MX based 64-bit boards: - Nitrogen8 SoM and MNT Reform2 - LS1088A based Traverse Ten64 - i.MX8M based GW7902. - NVIDIA Jetson TX2 NX Developer Kit - 4KOpen STiH418-b2264 development board - ux500 based Samsung phones: Gavini, Codina and Kyle - TI AM335x based Sancloud BBE Lite - ixp4xx dts files to replace all old board files Other changes: - Treewide fixes for dtc warnings - Rockchips i/o domain support - TI OMAP/AM3 CPSW switch driver support - Improved device support for allwinner, aspeed, qualcomm, NXP, nvidia, Renesas, Samsung, Amlogic, Mediatek, ixp4xx, stm32, sti, OMAP and actions" * tag 'dt-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (412 commits) arm/arm64: dts: Fix remaining dtc 'unit_address_format' warnings ARM: dts: rockchip: Add SFC to RV1108 arm64: dts: marvell: armada-37xx: Extend PCIe MEM space ARM: dts: aspeed: p10bmc: Add power control pins ARM: dts: aspeed: cloudripper: Add comments for "mdio1" ARM: dts: aspeed: minipack: Update flash partition table dt-bindings: arm: fsl: Add Traverse Ten64 (LS1088A) board dt-bindings: vendor-prefixes: add Traverse Technologies arm64: dts: add device tree for Traverse Ten64 (LS1088A) arm64: dts: ls1088a: add missing PMU node arm64: dts: ls1088a: add internal PCS for DPMAC1 node ARM: dts: imx6qp-prtwd3: configure ENET_REF clock to 125MHz ARM: dts: vf610-zii-dev-rev-b: Remove #address-cells and #size-cells property from at93c46d dt node ARM: dts: add SKOV imx6q and imx6dl based boards dt-bindings: arm: fsl: add SKOV imx6q and imx6dl based boards dt-bindings: vendor-prefixes: Add an entry for SKOV A/S arm64: dts: imx8mq-reform2: add sound support arm64: dts: imx8m: drop interrupt-affinity for pmu arm64: dts: imx8qxp: update pmu compatible arm64: dts: imx8mm: update pmu compatible ... commit 32b47072f319bb65e9afad59e78153d83496f1f5 Merge: 866147b8fa595 79cd0bb66e359 Author: Linus Torvalds Date: Wed Sep 1 15:28:28 2021 -0700 Merge tag 'defconfig-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM defconfig updates from Arnd Bergmann: "The usual set of defconfig updates, including one new defconfig file for the new sama7 family of SoCs" * tag 'defconfig-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: config: aspeed: Regenerate defconfigs ARM: config: aspeed_g4: Enable EDAC and SPGIO ARM: config: aspeed: Enable KCS adapter for raw SerIO ARM: config: aspeed: Enable hardened allocator feature ARM: imx_v6_v7_defconfig: enable driver of the LTC3676 PMIC ARM: multi_v7_defconfig: Enable CONFIG_TEGRA30_TSENSOR ARM: multi_v7_defconfig: Enable Acer A500 drivers ARM: tegra: Rebuild default configuration ARM: tegra: Enable CONFIG_CROS_EC ARM: tegra: Enable Acer A500 drivers ARM: tegra: Enable CONFIG_FB ARM: tegra: Enable CONFIG_TEGRA30_TSENSOR ARM: configs: multi_v7: enable PL35x NAND controller arm64: defconfig: Enable Qualcomm MSM8996 CPU clock driver ARM: imx_v6_v7_defconfig: Let CONFIG_SCSI_LOWLEVEL be selected ARM: imx_v6_v7_defconfig: Select CONFIG_KPROBES ARM: multi_v7_defconfig: Enable CONFIG_MMC_MESON_MX_SDHC ARM: multi_v7_defconfig: add sama7g5 SoC ARM: configs: at91: add defconfig for sama7 family of SoCs commit 47505bf3a82166c3576155c229e941af922bf147 Merge: 8fb59ce15c43d aaedb9e00e540 3e061910b2a2e 46d4ee48aaef1 e7296d16ef7be c16edf5ff8ece Author: Stephen Boyd Date: Wed Sep 1 15:27:07 2021 -0700 Merge branches 'clk-kirkwood', 'clk-imx', 'clk-doc', 'clk-zynq' and 'clk-ralink' into clk-next * clk-kirkwood: clk: kirkwood: Fix a clocking boot regression * clk-imx: clk: imx8mn: Add M7 core clock clk: imx8m: fix clock tree update of TF-A managed clocks clk: imx: clk-divider-gate: Switch to clk_divider.determine_rate clk: imx8mn: use correct mux type for clkout path clk: imx8mm: use correct mux type for clkout path * clk-doc: dt-bindings: clock: samsung: fix header path in example MAINTAINERS: clock: include S3C and S5P in Samsung SoC clock entry dt-bindings: clock: samsung: convert S5Pv210 AudSS to dtschema dt-bindings: clock: samsung: convert Exynos AudSS to dtschema dt-bindings: clock: samsung: convert Exynos4 to dtschema dt-bindings: clock: samsung: convert Exynos3250 to dtschema dt-bindings: clock: samsung: convert Exynos542x to dtschema dt-bindings: clock: samsung: add bindings for Exynos external clock dt-bindings: clock: samsung: convert Exynos5250 to dtschema dt-bindings: clock: brcm,iproc-clocks: fix armpll properties clk: zynqmp: Fix kernel-doc format clk: at91: sama7g5: remove all kernel-doc & kernel-doc warnings clk: zynqmp: fix kernel doc * clk-zynq: clk: zynqmp: Fix a memory leak clk: zynqmp: Check the return type * clk-ralink: clk: ralink: avoid to set 'CLK_IS_CRITICAL' flag for gates commit 8fb59ce15c43d025dadc2df3d21590bd1e91eff0 Merge: 1faa7cb2b066a 27115441b938b 1d070108354b6 af7651e67b9d5 d83e561d43bc7 Author: Stephen Boyd Date: Wed Sep 1 15:26:58 2021 -0700 Merge branches 'clk-nvidia', 'clk-rockchip', 'clk-at91' and 'clk-vc5' into clk-next - Support the SD/OE pin on IDT VersaClock 5 and 6 clock generators * clk-nvidia: clk: tegra: fix old-style declaration clk: tegra: Remove CLK_IS_CRITICAL flag from fuse clock soc/tegra: fuse: Enable fuse clock on suspend for Tegra124 soc/tegra: fuse: Add runtime PM support soc/tegra: fuse: Clear fuse->clk on driver probe failure soc/tegra: pmc: Prevent racing with cpuilde driver soc/tegra: bpmp: Remove unused including * clk-rockchip: clk: rockchip: make rk3308 ddrphy4x clock critical clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types dt-bindings: clk: Convert rockchip,rk3399-cru to DT schema clk: rockchip: Add support for hclk_sfc on rk3036 clk: rockchip: rk3036: fix up the sclk_sfc parent error clk: rockchip: add dt-binding clkid for hclk_sfc on rk3036 * clk-at91: clk: at91: clk-generated: Limit the requested rate to our range * clk-vc5: clk: vc5: Add properties for configuring SD/OE behavior clk: vc5: Use dev_err_probe dt-bindings: clk: vc5: Add properties for configuring the SD/OE pin commit 1faa7cb2b066a3f8966a1311d574832ccb93a72c Merge: 7110569a096d8 e81b917a78c7e Author: Stephen Boyd Date: Wed Sep 1 15:26:42 2021 -0700 Merge branch 'clk-frac-divider' into clk-next - Add power of two flag to fractional divider clk type * clk-frac-divider: clk: fractional-divider: Document the arithmetics used behind the code clk: fractional-divider: Introduce POWER_OF_TWO_PS flag clk: fractional-divider: Hide clk_fractional_divider_ops from wide audience clk: fractional-divider: Export approximation algorithm to the CCF users commit 866147b8fa59530812fc769027a94468d89401e7 Merge: 634135a07b887 06779631d18ff Author: Linus Torvalds Date: Wed Sep 1 15:25:28 2021 -0700 Merge tag 'drivers-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Arnd Bergmann: "These are updates for drivers that are tied to a particular SoC, including the correspondig device tree bindings: - A couple of reset controller changes for unisoc, uniphier, renesas and zte platforms - memory controller driver fixes for omap and tegra - Rockchip io domain driver updates - Lots of updates for qualcomm platforms, mostly touching their firmware and power management drivers - Tegra FUSE and firmware driver updateѕ - Support for virtio transports in the SCMI firmware framework - cleanup of ixp4xx drivers, towards enabling multiplatform support and bringing it up to date with modern platforms - Minor updates for keystone, mediatek, omap, renesas" * tag 'drivers-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (96 commits) reset: simple: remove ZTE details in Kconfig help soc: rockchip: io-domain: Remove unneeded semicolon soc: rockchip: io-domain: add rk3568 support dt-bindings: power: add rk3568-pmu-io-domain support bus: ixp4xx: return on error in ixp4xx_exp_probe() soc: renesas: Prefer memcpy() over strcpy() firmware: tegra: Stop using seq_get_buf() soc/tegra: fuse: Enable fuse clock on suspend for Tegra124 soc/tegra: fuse: Add runtime PM support soc/tegra: fuse: Clear fuse->clk on driver probe failure soc/tegra: pmc: Prevent racing with cpuilde driver soc/tegra: bpmp: Remove unused including dt-bindings: soc: ti: pruss: Add dma-coherent property soc: ti: Remove pm_runtime_irq_safe() usage for smartreflex soc: ti: pruss: Enable support for ICSSG subsystems on K3 AM64x SoCs dt-bindings: soc: ti: pruss: Update bindings for K3 AM64x SoCs firmware: arm_scmi: Use WARN_ON() to check configured transports firmware: arm_scmi: Fix boolconv.cocci warnings soc: mediatek: mmsys: Fix missing UFOE component in mt8173 table routing soc: mediatek: mmsys: add MT8365 support ... commit 7110569a096d820876f99543660741bd8a96af7c Merge: 4990d8c1333dc a1cde1f0172ee 28fc39f7abeca 23a57ee7af01a Author: Stephen Boyd Date: Wed Sep 1 15:25:15 2021 -0700 Merge branches 'clk-renesas', 'clk-cleanup' and 'clk-determine-divider' into clk-next - Migrate some clk drivers to clk_divider_ops.determine_rate * clk-renesas: clk: renesas: Make CLK_R9A06G032 invisible clk: renesas: r9a07g044: Add entry for fixed clock P0_DIV2 dt-bindings: clock: r9a07g044-cpg: Add entry for P0_DIV2 core clock clk: renesas: r9a07g044: Add clock and reset entries for ADC clk: renesas: r9a07g044: Add clock and reset entries for CANFD clk: renesas: Rename renesas-rzg2l-cpg.[ch] to rzg2l-cpg.[ch] clk: renesas: r9a07g044: Add GPIO clock and reset entries clk: renesas: r9a07g044: Add SSIF-2 clock and reset entries clk: renesas: r9a07g044: Add USB clocks/resets clk: renesas: r9a07g044: Add DMAC clocks/resets clk: renesas: r9a07g044: Add I2C clocks/resets clk: renesas: r8a779a0: Add the DSI clocks clk: renesas: r8a779a0: Add the DU clock clk: renesas: rzg2: Rename i2c-dvfs to iic-pmic clk: renesas: rzg2l: Fix off-by-one check in rzg2l_cpg_clk_src_twocell_get() clk: renesas: rzg2l: Avoid mixing error pointers and NULL clk: renesas: rzg2l: Fix a double free on error clk: renesas: rzg2l: Fix return value and unused assignment clk: renesas: rzg2l: Remove unneeded semicolon * clk-cleanup: clk: palmas: Add a missing SPDX license header clk: Align provider-specific CLK_* bit definitions * clk-determine-divider: clk: stm32mp1: Switch to clk_divider.determine_rate clk: stm32h7: Switch to clk_divider.determine_rate clk: stm32f4: Switch to clk_divider.determine_rate clk: bcm2835: Switch to clk_divider.determine_rate clk: divider: Implement and wire up .determine_rate by default commit 4990d8c1333dc827aff8f18ff616bec4e9a32e2d Merge: 2734d6c1b1a08 131abae905df9 d17929eb1066d d17e4e62df328 284c537a8aceb cf0a95659e659 Author: Stephen Boyd Date: Wed Sep 1 15:24:59 2021 -0700 Merge branches 'clk-qcom', 'clk-socfpga', 'clk-mediatek', 'clk-lmk' and 'clk-x86' into clk-next - Support video, gpu, display clks on qcom sc7280 SoCs - GCC clks on qcom MSM8953, SM4250/6115, and SM6350 SoCs - Multimedia clks (MMCC) on qcom MSM8994/MSM8992 - Migrate to clk_parent_data in gcc-sdm660 - RPMh clks on qcom SM6350 SoCs - Support for Mediatek MT8192 SoCs * clk-qcom: (38 commits) clk: qcom: Add SM6350 GCC driver dt-bindings: clock: Add SM6350 GCC clock bindings clk: qcom: rpmh: Add support for RPMH clocks on SM6350 dt-bindings: clock: Add RPMHCC bindings for SM6350 clk: qcom: adjust selects for SM_VIDEOCC_8150 and SM_VIDEOCC_8250 clk: qcom: Add Global Clock controller (GCC) driver for SM6115 dt-bindings: clk: qcom: gcc-sm6115: Document SM6115 GCC clk: qcom: mmcc-msm8994: Add MSM8992 support clk: qcom: Add msm8994 MMCC driver dt-bindings: clock: Add support for MSM8992/4 MMCC clk: qcom: Add Global Clock Controller driver for MSM8953 dt-bindings: clock: add Qualcomm MSM8953 GCC driver bindings clk: qcom: gcc-sdm660: Replace usage of parent_names clk: qcom: gcc-sdm660: Move parent tables after PLLs clk: qcom: use devm_pm_runtime_enable and devm_pm_clk_create PM: runtime: add devm_pm_clk_create helper PM: runtime: add devm_pm_runtime_enable helper clk: qcom: a53-pll: Add MSM8939 a53pll support dt-bindings: clock: Update qcom,a53pll bindings for MSM8939 support clk: qcom: a53pll/mux: Use unique clock name ... * clk-socfpga: clk: socfpga: agilex: add the bypass register for s2f_usr0 clock clk: socfpga: agilex: fix up s2f_user0_clk representation clk: socfpga: agilex: fix the parents of the psi_ref_clk * clk-mediatek: (22 commits) clk: mediatek: make COMMON_CLK_MT8167* depend on COMMON_CLK_MT8167 clk: mediatek: Add MT8192 vencsys clock support clk: mediatek: Add MT8192 vdecsys clock support clk: mediatek: Add MT8192 scp adsp clock support clk: mediatek: Add MT8192 msdc clock support clk: mediatek: Add MT8192 mmsys clock support clk: mediatek: Add MT8192 mfgcfg clock support clk: mediatek: Add MT8192 mdpsys clock support clk: mediatek: Add MT8192 ipesys clock support clk: mediatek: Add MT8192 imp i2c wrapper clock support clk: mediatek: Add MT8192 imgsys clock support clk: mediatek: Add MT8192 camsys clock support clk: mediatek: Add MT8192 audio clock support clk: mediatek: Add MT8192 basic clocks support clk: mediatek: Add mtk_clk_simple_probe() to simplify clock providers clk: mediatek: Add configurable enable control to mtk_pll_data clk: mediatek: Fix asymmetrical PLL enable and disable control clk: mediatek: Get regmap without syscon compatible check clk: mediatek: Add dt-bindings of MT8192 clocks dt-bindings: ARM: Mediatek: Add audsys document binding for MT8192 ... * clk-lmk: clk: lmk04832: drop redundant fallthrough statements * clk-x86: clk: x86: Rename clk-lpt to more specific clk-lpss-atom commit 634135a07b887a8ad8904da8c147407650747a38 Merge: 4cdc4cc2ad35f 51e321fed0ff8 Author: Linus Torvalds Date: Wed Sep 1 15:19:43 2021 -0700 Merge tag 'soc-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "There are three noteworthy updates for 32-bit arm platforms this time: - The Microchip SAMA7 family based on Cortex-A7 gets introduced, a new cousin to the older SAM9 (ARM9xx based) and SAMA5 (Cortex-A5 based) SoCs. - The ixp4xx platform (based on Intel XScale) is finally converted to device tree, and all the old board files are getting removed now. - The Cirrus Logic EP93xx platform loses support for the old MaverickCrunch FPU. Support for compiling user space applications was already removed in gcc-4.9, and the kernel support for old applications could not be built with clang ias. After confirming that there are no remaining users, removing this from the kernel seemed better than adding support for unused features to clang. There are minor updates to the aspeed, omap and samsung platforms" * tag 'soc-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits) soc: aspeed-lpc-ctrl: Fix clock cleanup in error path ARM: s3c: delete unneed local variable "delay" soc: aspeed: Re-enable FWH2AHB on AST2600 soc: aspeed: socinfo: Add AST2625 variant soc: aspeed: p2a-ctrl: Fix boundary check for mmap soc: aspeed: lpc-ctrl: Fix boundary check for mmap ARM: ixp4xx: Delete the Freecom FSG-3 boardfiles ARM: ixp4xx: Delete GTWX5715 board files ARM: ixp4xx: Delete Coyote and IXDPG425 boardfiles ARM: ixp4xx: Delete Intel reference design boardfiles ARM: ixp4xx: Delete Avila boardfiles ARM: ixp4xx: Delete the Arcom Vulcan boardfiles ARM: ixp4xx: Delete Gateway WG302v2 boardfiles ARM: ixp4xx: Delete Omicron boardfiles ARM: ixp4xx: Delete the D-Link DSM-G600 boardfiles ARM: ixp4xx: Delete NAS100D boardfiles ARM: ixp4xx: Delete NSLU2 boardfiles arm: omap2: Drop the unused OMAP_PACKAGE_* KConfig entries arm: omap2: Drop obsolete MACH_OMAP3_PANDORA entry ARM: ep93xx: remove MaverickCrunch support ... commit 4cdc4cc2ad35f92338497d53d3e8b7876cf2a51d Merge: 57c78a234e809 8f76f9c469526 Author: Linus Torvalds Date: Wed Sep 1 15:13:02 2021 -0700 Merge tag 'asm-generic-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "The main content for 5.15 is a series that cleans up the handling of strncpy_from_user() and strnlen_user(), removing a lot of slightly incorrect versions of these in favor of the lib/strn*.c helpers that implement these correctly and more efficiently. The only architectures that retain a private version now are mips, ia64, um and parisc. I had offered to convert those at all, but Thomas Bogendoerfer wanted to keep the mips version for the moment until he had a chance to do regression testing. The branch also contains two patches for bitops and for ffs()" * tag 'asm-generic-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: bitops/non-atomic: make @nr unsigned to avoid any DIV asm-generic: ffs: Drop bogus reference to ffz location asm-generic: reverse GENERIC_{STRNCPY_FROM,STRNLEN}_USER symbols asm-generic: remove extra strn{cpy_from,len}_user declarations asm-generic: uaccess: remove inline strncpy_from_user/strnlen_user s390: use generic strncpy/strnlen from_user microblaze: use generic strncpy/strnlen from_user csky: use generic strncpy/strnlen from_user arc: use generic strncpy/strnlen from_user hexagon: use generic strncpy/strnlen from_user h8300: remove stale strncpy_from_user asm-generic/uaccess.h: remove __strncpy_from_user/__strnlen_user commit 57c78a234e809e3a0516491e37ae5ccc6eeb21e8 Merge: bcfeebbff3627 65266a7c6abfa Author: Linus Torvalds Date: Wed Sep 1 15:04:29 2021 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: - Support for 32-bit tasks on asymmetric AArch32 systems (on top of the scheduler changes merged via the tip tree). - More entry.S clean-ups and conversion to C. - MTE updates: allow a preferred tag checking mode to be set per CPU (the overhead of synchronous mode is smaller for some CPUs than others); optimisations for kernel entry/exit path; optionally disable MTE on the kernel command line. - Kselftest improvements for SVE and signal handling, PtrAuth. - Fix unlikely race where a TLBI could use stale ASID on an ASID roll-over (found by inspection). - Miscellaneous fixes: disable trapping of PMSNEVFR_EL1 to higher exception levels; drop unnecessary sigdelsetmask() call in the signal32 handling; remove BUG_ON when failing to allocate SVE state (just signal the process); SYM_CODE annotations. - Other trivial clean-ups: use macros instead of magic numbers, remove redundant returns, typos. * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (56 commits) arm64: Do not trap PMSNEVFR_EL1 arm64: mm: fix comment typo of pud_offset_phys() arm64: signal32: Drop pointless call to sigdelsetmask() arm64/sve: Better handle failure to allocate SVE register storage arm64: Document the requirement for SCR_EL3.HCE arm64: head: avoid over-mapping in map_memory arm64/sve: Add a comment documenting the binutils needed for SVE asm arm64/sve: Add some comments for sve_save/load_state() kselftest/arm64: signal: Add a TODO list for signal handling tests kselftest/arm64: signal: Add test case for SVE register state in signals kselftest/arm64: signal: Verify that signals can't change the SVE vector length kselftest/arm64: signal: Check SVE signal frame shows expected vector length kselftest/arm64: signal: Support signal frames with SVE register data kselftest/arm64: signal: Add SVE to the set of features we can check for arm64: replace in_irq() with in_hardirq() kselftest/arm64: pac: Fix skipping of tests on systems without PAC Documentation: arm64: describe asymmetric 32-bit support arm64: Remove logic to kill 32-bit tasks on 64-bit-only cores arm64: Hook up cmdline parameter to allow mismatched 32-bit EL0 arm64: Advertise CPUs capable of running 32-bit applications in sysfs ... commit bcfeebbff3627093014c7948aec9cc4730e50c3d Merge: 48983701a1e0e d21918e5a94a8 Author: Linus Torvalds Date: Wed Sep 1 14:52:05 2021 -0700 Merge branch 'exit-cleanups-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull exit cleanups from Eric Biederman: "In preparation of doing something about PTRACE_EVENT_EXIT I have started cleaning up various pieces of code related to do_exit. Most of that code I did not manage to get tested and reviewed before the merge window opened but a handful of very useful cleanups are ready to be merged. The first change is simply the removal of the bdflush system call. The code has now been disabled long enough that even the oldest userspace working userspace setups anyone can find to test are fine with the bdflush system call being removed. Changing m68k fsp040_die to use force_sigsegv(SIGSEGV) instead of calling do_exit directly is interesting only in that it is nearly the most difficult of the incorrect uses of do_exit to remove. The change to the seccomp code to simply send a signal instead of calling do_coredump directly is a very nice little cleanup made possible by realizing the existing signal sending helpers were missing a little bit of functionality that is easy to provide" * 'exit-cleanups-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal/seccomp: Dump core when there is only one live thread signal/seccomp: Refactor seccomp signal and coredump generation signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die exit/bdflush: Remove the deprecated bdflush system call commit 48983701a1e0e252faa4aab274ba14419cb286fa Merge: 477f70cd2a679 ee53488cc7414 Author: Linus Torvalds Date: Wed Sep 1 14:42:36 2021 -0700 Merge branch 'siginfo-si_trapno-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull siginfo si_trapno updates from Eric Biederman: "The full set of si_trapno changes was not appropriate as a fix for the newly added SIGTRAP TRAP_PERF, and so I postponed the rest of the related cleanups. This is the rest of the cleanups for si_trapno that reduces it from being a really weird arch special case that is expect to be always present (but isn't) on the architectures that support it to being yet another field in the _sigfault union of struct siginfo. The changes have been reviewed and marinated in linux-next. With the removal of this awkward special case new code (like SIGTRAP TRAP_PERF) that works across architectures should be easier to write and maintain" * 'siginfo-si_trapno-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal: Rename SIL_PERF_EVENT SIL_FAULT_PERF_EVENT for consistency signal: Verify the alignment and size of siginfo_t signal: Remove the generic __ARCH_SI_TRAPNO support signal/alpha: si_trapno is only used with SIGFPE and SIGTRAP TRAP_UNK signal/sparc: si_trapno is only used with SIGILL ILL_ILLTRP arm64: Add compile-time asserts for siginfo_t offsets arm: Add compile-time asserts for siginfo_t offsets sparc64: Add compile-time asserts for siginfo_t offsets commit d6043581e1d9d0507a8413a302db0e35c8506e0e Author: Alex Sierra Date: Tue Aug 31 21:05:02 2021 -0500 drm/amdkfd: drop process ref count when xnack disable During svm restore pages interrupt handler, kfd_process ref count was never dropped when xnack was disabled. Therefore, the object was never released. Fixes: 2383f56bbe4a ("drm/amdkfd: page table restore through svm API") Signed-off-by: Alex Sierra Reviewed-by: Philip Yang Reviewed-by: Jonathan Kim Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c8b177b6e3a005bd8fb0395a4bc5db3470301c28 Author: Alexander Tsoy Date: Tue Aug 31 03:25:31 2021 +0300 ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Add another device ID for JBL Quantum 800. It requires the same quirk as other JBL Quantum devices. Signed-off-by: Alexander Tsoy Cc: Link: https://lore.kernel.org/r/20210831002531.116957-1-alexander@tsoy.me Signed-off-by: Takashi Iwai commit 6f1fce595b78b775d7fb585c15c2dc3a6994f96e Author: Helge Deller Date: Wed Sep 1 22:18:18 2021 +0200 parisc: math-emu: Fix fall-through warnings Fix lots of fallthrough warnings, e.g.: arch/parisc/math-emu/fpudispatch.c:323:33: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Helge Deller commit 46a226b50ec3d5d9ff2f4399702ff6c1b427f824 Merge: 2501ce96ecd00 3b41fb4094914 Author: Jiri Kosina Date: Wed Sep 1 22:11:24 2021 +0200 Merge branch 'for-5.15/apple' into for-linus - Support proper EV_MSC emissions to hid-apple (Vincent Lefevre) commit 2501ce96ecd00f817323c1014a870dc9710ddb82 Merge: fcbc26eb92545 9d339fe4cbd5d Author: Jiri Kosina Date: Wed Sep 1 22:04:50 2021 +0200 Merge branch 'for-5.15/wacom' into for-linus commit fcbc26eb92545ba5e2828f2dcffd1c4bdd82b373 Merge: 854a95877f4d9 c3800eed22d21 Author: Jiri Kosina Date: Wed Sep 1 22:04:05 2021 +0200 Merge branch 'for-5.15/thrustmaster' into for-linus - Fixes for memory leaks commit 854a95877f4d95b65918cb126fdc0c84ea564676 Merge: 163a312466790 a4bfe13f96bf8 Author: Jiri Kosina Date: Wed Sep 1 22:03:18 2021 +0200 Merge branch 'for-5.15/sony' into for-linus - Support for GHLive PS4 dongles commit 163a3124667901c29978bf67c0ffdcc9650515ac Merge: 1138b33192426 9d60648c607a2 Author: Jiri Kosina Date: Wed Sep 1 22:02:37 2021 +0200 Merge branch 'for-5.15/magicmouse' into for-linus - High-resolution scroll support for Magicmouse devices commit 1138b3319242695dce82896e710c2290cf53770c Merge: 6ef9233f4a42c b23cdfbddb73b Author: Jiri Kosina Date: Wed Sep 1 22:02:15 2021 +0200 Merge branch 'for-5.15/logitech' into for-linus commit 6ef9233f4a42c290ef745a8a5242673707894856 Merge: dab6e4f452c2f 25ddd7cfc582d Author: Jiri Kosina Date: Wed Sep 1 22:01:27 2021 +0200 Merge branch 'for-5.15/goodix' into for-linus - power management improvement for Goodix driver commit dab6e4f452c2fd45c15c701e6f7be665a72c7add Merge: e4ee5090e3e5e d2f311ec91984 Author: Jiri Kosina Date: Wed Sep 1 22:00:06 2021 +0200 Merge branch 'for-5.15/core' into for-linus - Regression fix for an issue in HID core that got uncovered by recent USB core cleanup leading to issues when transfer_buffer_length is not in line with wLength - Memory leak fix in USB HID core - Improvement of stylus battery reporting commit e4ee5090e3e5e9c2f38aa761436fc494e3a80937 Merge: 56e527b0f790d bebf8820b355e Author: Jiri Kosina Date: Wed Sep 1 21:56:46 2021 +0200 Merge branch 'for-5.15/cmedia' into for-linus commit 56e527b0f790dd8e7f077b9197eba11f2117a527 Merge: bab94e97323ba e665775591865 Author: Jiri Kosina Date: Wed Sep 1 21:54:57 2021 +0200 Merge branch 'for-5.15/amd-sfh' into for-linus - Updates to the existing FW reporting mechanism, MP2 FW status checks, adding proper power management support for amd-sfh commit 030f653078316a9cc9ca6bd1b0234dcf858be35d Author: Mikulas Patocka Date: Mon Aug 30 05:42:27 2021 -0400 parisc: fix crash with signals and alloca I was debugging some crashes on parisc and I found out that there is a crash possibility if a function using alloca is interrupted by a signal. The reason for the crash is that the gcc alloca implementation leaves garbage in the upper 32 bits of the sp register. This normally doesn't matter (the upper bits are ignored because the PSW W-bit is clear), however the signal delivery routine in the kernel uses full 64 bits of sp and it fails with -EFAULT if the upper 32 bits are not zero. I created this program that demonstrates the problem: #include #include #include #include static __attribute__((noinline,noclone)) void aa(int *size) { void * volatile p = alloca(-*size); while (1) ; } static void handler(int sig) { write(1, "signal delivered\n", 17); _exit(0); } int main(void) { int size = -0x100; signal(SIGALRM, handler); alarm(1); aa(&size); } If you compile it with optimizations, it will crash. The "aa" function has this disassembly: 000106a0 : 106a0: 08 03 02 41 copy r3,r1 106a4: 08 1e 02 43 copy sp,r3 106a8: 6f c1 00 80 stw,ma r1,40(sp) 106ac: 37 dc 3f c1 ldo -20(sp),ret0 106b0: 0c 7c 12 90 stw ret0,8(r3) 106b4: 0f 40 10 9c ldw 0(r26),ret0 ; ret0 = 0x00000000FFFFFF00 106b8: 97 9c 00 7e subi 3f,ret0,ret0 ; ret0 = 0xFFFFFFFF0000013F 106bc: d7 80 1c 1a depwi 0,31,6,ret0 ; ret0 = 0xFFFFFFFF00000100 106c0: 0b 9e 0a 1e add,l sp,ret0,sp ; sp = 0xFFFFFFFFxxxxxxxx 106c4: e8 1f 1f f7 b,l,n 106c4 ,r0 This patch fixes the bug by truncating the "usp" variable to 32 bits. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit 5f6e0fe01b6b33894cf6f61b359ab5a6d2b7674e Author: Masahiro Yamada Date: Thu Jun 10 11:03:31 2021 +0900 parisc: Fix compile failure when building 64-bit kernel natively Commit 23243c1ace9f ("arch: use cross_compiling to check whether it is a cross build or not") broke 64-bit parisc builds on 32-bit parisc systems. Helge mentioned: - 64-bit parisc userspace is not supported yet [1] - hppa gcc does not support "-m64" flag [2] That means, parisc developers working on a 32-bit parisc machine need to use hppa64-linux-gnu-gcc (cross compiler) for building the 64-bit parisc kernel. After the offending commit, gcc is used in such a case because both $(SRCARCH) and $(SUBARCH) are 'parisc', hence cross_compiling is unset. A correct way is to introduce ARCH=parisc64 because building the 64-bit parisc kernel on a 32-bit parisc system is not exactly a native build, but rather a semi-cross build. [1]: https://lore.kernel.org/linux-parisc/5dfd81eb-c8ca-b7f5-e80e-8632767c022d@gmx.de/#t [2]: https://lore.kernel.org/linux-parisc/89515325-fc21-31da-d238-6f7a9abbf9a0@gmx.de/ Fixes: 23243c1ace9f ("arch: use cross_compiling to check whether it is a cross build or not") Signed-off-by: Masahiro Yamada Reported-by: Meelis Roos Tested-by: Meelis Roos Cc: # v5.13+ Signed-off-by: Helge Deller commit 8ef5b28d670b76601e14476b00a505854abc838b Author: Shubhankar Kuranagatti Date: Wed Apr 28 21:09:42 2021 +0530 parisc: ccio-dma.c: Added tab instead of spaces Single spaces has been removed and replaced with tabs. This is done to maintain code uniformity. Signed-off-by: Shubhankar Kuranagatti Reported-by: kernel test robot Signed-off-by: Helge Deller commit d2f311ec91984adb219ac6985d4dd72c37ae734d Author: Alan Stern Date: Wed Sep 1 12:36:06 2021 -0400 HID: usbhid: Simplify code in hid_submit_ctrl() This patch makes a small simplification to the code in hid_submit_ctrl(). The test for maxpacket being > 0 is unnecessary, because endpoint 0 always has a maxpacket value which is >= 8. Furthermore, endpoint 0's maxpacket value is always a power of 2, so instead of open-coding the round-to-next-multiple computation we can call the optimized round_up() routine. Signed-off-by: Alan Stern Tested-by: Benjamin Tissoires Acked-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 0a824efdb724e07574bafcd2c2486b2a3de35ff6 Author: Alan Stern Date: Wed Sep 1 12:36:00 2021 -0400 HID: usbhid: Fix warning caused by 0-length input reports Syzbot found a warning caused by hid_submit_ctrl() submitting a control request to transfer a 0-length input report: usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType a1 (The warning message is a little difficult to understand. It means that the control request claims to be for an IN transfer but this contradicts the USB spec, which requires 0-length control transfers always to be in the OUT direction.) Now, a zero-length report isn't good for anything and there's no reason for a device to have one, but the fuzzer likes to pick out these weird edge cases. In the future, perhaps we will decide to reject 0-length reports at probe time. For now, the simplest approach for avoiding these warnings is to pretend that the report actually has length 1. Signed-off-by: Alan Stern Reported-and-tested-by: syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com Tested-by: Oleksandr Natalenko Tested-by: Benjamin Tissoires Acked-by: Benjamin Tissoires Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 5049307d37a760e304ad191c5dc7c6851266d2f8 Author: Michal Kubecek Date: Wed Sep 1 12:35:49 2021 -0400 HID: usbhid: Fix flood of "control queue full" messages [patch description by Alan Stern] Commit 7652dd2c5cb7 ("USB: core: Check buffer length matches wLength for control transfers") causes control URB submissions to fail if the transfer_buffer_length value disagrees with the setup packet's wLength valuel. Unfortunately, it turns out that the usbhid can trigger this failure mode when it submits a control request for an input report: It pads the transfer buffer size to a multiple of the maxpacket value but does not increase wLength correspondingly. These failures have caused problems for people using an APS UPC, in the form of a flood of log messages resembling: hid-generic 0003:051D:0002.0002: control queue full This patch fixes the problem by setting the wLength value equal to the padded transfer_buffer_length value in hid_submit_ctrl(). As a nice bonus, the code which stores the transfer_buffer_length value is now shared between the two branches of an "if" statement, so it can be de-duplicated. Signed-off-by: Michal Kubecek Signed-off-by: Alan Stern Fixes: 7652dd2c5cb7 ("USB: core: Check buffer length matches wLength for control transfers") Tested-by: Oleksandr Natalenko Tested-by: Benjamin Tissoires Acked-by: Benjamin Tissoires Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 15e20db2e0cecce0bfc6a67b69e55020fe9cda00 Author: Jens Axboe Date: Wed Sep 1 11:18:41 2021 -0600 io-wq: only exit on fatal signals If the application uses io_uring and also relies heavily on signals for communication, that can cause io-wq workers to spuriously exit just because the parent has a signal pending. Just ignore signals unless they are fatal. Signed-off-by: Jens Axboe commit f95dc207b93da9c88ddbb7741ec3730c6657b88e Author: Jens Axboe Date: Tue Aug 31 13:57:32 2021 -0600 io-wq: split bounded and unbounded work into separate lists We've got a few issues that all boil down to the fact that we have one list of pending work items, yet two different types of workers to serve them. This causes some oddities around workers switching type and even hashed work vs regular work on the same bounded list. Just separate them out cleanly, similarly to how we already do accounting of what is running. That provides a clean separation and removes some corner cases that can cause stalls when handling IO that is punted to io-wq. Fixes: ecc53c48c13d ("io-wq: check max_worker limits if a worker transitions bound state") Signed-off-by: Jens Axboe commit 477f70cd2a67904e04c2c2b9bd0fa2e95222f2f6 Merge: 835d31d319d9c 8f0284f190e6a Author: Linus Torvalds Date: Wed Sep 1 11:26:46 2021 -0700 Merge tag 'drm-next-2021-08-31-1' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Highlights: - i915 has seen a lot of refactoring and uAPI cleanups due to a change in the upstream direction going forward This has all been audited with known userspace, but there may be some pitfalls that were missed. - i915 now uses common TTM to enable discrete memory on DG1/2 GPUs - i915 enables Jasper and Elkhart Lake by default and has preliminary XeHP/DG2 support - amdgpu adds support for Cyan Skillfish - lots of implicit fencing rules documented and fixed up in drivers - msm now uses the core scheduler - the irq midlayer has been removed for non-legacy drivers - the sysfb code now works on more than x86. Otherwise the usual smattering of stuff everywhere, panels, bridges, refactorings. Detailed summary: core: - extract i915 eDP backlight into core - DP aux bus support - drm_device.irq_enabled removed - port drivers to native irq interfaces - export gem shadow plane handling for vgem - print proper driver name in framebuffer registration - driver fixes for implicit fencing rules - ARM fixed rate compression modifier added - updated fb damage handling - rmfb ioctl logging/docs - drop drm_gem_object_put_locked - define DRM_FORMAT_MAX_PLANES - add gem fb vmap/vunmap helpers - add lockdep_assert(once) helpers - mark drm irq midlayer as legacy - use offset adjusted bo mapping conversion vgaarb: - cleanups fbdev: - extend efifb handling to all arches - div by 0 fixes for multiple drivers udmabuf: - add hugepage mapping support dma-buf: - non-dynamic exporter fixups - document implicit fencing rules amdgpu: - Initial Cyan Skillfish support - switch virtual DCE over to vkms based atomic - VCN/JPEG power down fixes - NAVI PCIE link handling fixes - AMD HDMI freesync fixes - Yellow Carp + Beige Goby fixes - Clockgating/S0ix/SMU/EEPROM fixes - embed hw fence in job - rework dma-resv handling - ensure eviction to system ram amdkfd: - uapi: SVM address range query added - sysfs leak fix - GPUVM TLB optimizations - vmfault/migration counters i915: - Enable JSL and EHL by default - preliminary XeHP/DG2 support - remove all CNL support (never shipped) - move to TTM for discrete memory support - allow mixed object mmap handling - GEM uAPI spring cleaning - add I915_MMAP_OBJECT_FIXED - reinstate ADL-P mmap ioctls - drop a bunch of unused by userspace features - disable and remove GPU relocations - revert some i915 misfeatures - major refactoring of GuC for Gen11+ - execbuffer object locking separate step - reject caching/set-domain on discrete - Enable pipe DMC loading on XE-LPD and ADL-P - add PSF GV point support - Refactor and fix DDI buffer translations - Clean up FBC CFB allocation code - Finish INTEL_GEN() and friends macro conversions nouveau: - add eDP backlight support - implicit fence fix msm: - a680/7c3 support - drm/scheduler conversion panfrost: - rework GPU reset virtio: - fix fencing for planes ast: - add detect support bochs: - move to tiny GPU driver vc4: - use hotplug irqs - HDMI codec support vmwgfx: - use internal vmware device headers ingenic: - demidlayering irq rcar-du: - shutdown fixes - convert to bridge connector helpers zynqmp-dsub: - misc fixes mgag200: - convert PLL handling to atomic mediatek: - MT8133 AAL support - gem mmap object support - MT8167 support etnaviv: - NXP Layerscape LS1028A SoC support - GEM mmap cleanups tegra: - new user API exynos: - missing unlock fix - build warning fix - use refcount_t" * tag 'drm-next-2021-08-31-1' of git://anongit.freedesktop.org/drm/drm: (1318 commits) drm/amd/display: Move AllowDRAMSelfRefreshOrDRAMClockChangeInVblank to bounding box drm/amd/display: Remove duplicate dml init drm/amd/display: Update bounding box states (v2) drm/amd/display: Update number of DCN3 clock states drm/amdgpu: disable GFX CGCG in aldebaran drm/amdgpu: Clear RAS interrupt status on aldebaran drm/amdgpu: Add support for RAS XGMI err query drm/amdkfd: Account for SH/SE count when setting up cu masks. drm/amdgpu: rename amdgpu_bo_get_preferred_pin_domain drm/amdgpu: drop redundant cancel_delayed_work_sync call drm/amdgpu: add missing cleanups for more ASICs on UVD/VCE suspend drm/amdgpu: add missing cleanups for Polaris12 UVD/VCE on suspend drm/amdkfd: map SVM range with correct access permission drm/amdkfd: check access permisson to restore retry fault drm/amdgpu: Update RAS XGMI Error Query drm/amdgpu: Add driver infrastructure for MCA RAS drm/amd/display: Add Logging for HDMI color depth information drm/amd/amdgpu: consolidate PSP TA init shared buf functions drm/amd/amdgpu: add name field back to ras_common_if drm/amdgpu: Fix build with missing pm_suspend_target_state module export ... commit 4cd67adc44a3ccdb3b8526c9f932f905284e028f Merge: ba1dc7f273c73 8ea32183072a8 Author: Greg Kroah-Hartman Date: Wed Sep 1 20:13:05 2021 +0200 Merge tag 'misc-habanalabs-next-2021-09-01' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux into char-misc-next Oded writes: This tag contains habanalabs driver changes for v5.15: - Add a new uAPI (under the cs ioctl) to enable to user to reserve signals and signal them from within its workloads, while the driver performs the waiting. This allows finer granularity of pipelining between the different engines and resource utilization. - Add a new uAPI (under the wait_for_cs ioctl) to allow waiting on multiple command submissions (workloads) at the same time. This is an optimization for the user process so it won't need to call multiple times to the wait_for_cs ioctl. - Add new feature of "state dump", which can be triggered through new debugfs node. This is a similar concept to the kernel panic dump. This new mechanism retrieves information from the device in case one of the workloads that was sent by the user got stuck. This is very helpful for debugging the hang. - Add a new debugfs node to perform lookup of user pointers that are mapped to habana device's pmmu. - Fix to the tracking of user process when running inside a container. - Allow user to map more than 4GB of memory to the device MMU in single IOCTL call. - Minimize number of register reads done in GAUDI during user operation. - Allow user to retrieve the device's server type that the device is connected to. - Several fixes to the code of waiting on interrupts on behalf of the user. - Fixes and improvements to the hint mechanism in our VA allocation. - Update the firmware header files to the latest version while maintaining backward compatibility with older firmware versions. - Multiple fixes to various bugs. * tag 'misc-habanalabs-next-2021-09-01' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux: (61 commits) habanalabs/gaudi: hwmon default card name habanalabs: add support for f/w reset habanalabs/gaudi: block ICACHE_BASE_ADDERESS_HIGH in TPC habanalabs: cannot sleep while holding spinlock habanalabs: never copy_from_user inside spinlock habanalabs: remove unnecessary device status check habanalabs: disable IRQ in user interrupts spinlock habanalabs: add "in device creation" status habanalabs/gaudi: invalidate PMMU mem cache on init habanalabs/gaudi: size should be printed in decimal habanalabs/gaudi: define DC POWER for secured PMC habanalabs/gaudi: unmask out of bounds SLM access interrupt habanalabs: add userptr_lookup node in debugfs habanalabs/gaudi: fetch TPC/MME ECC errors from F/W habanalabs: modify multi-CS to wait on stream masters habanalabs/gaudi: add monitored SOBs to state dump habanalabs/gaudi: restore user registers when context opens habanalabs/gaudi: increase boot fit timeout habanalabs: update to latest firmware headers habanalabs/gaudi: minimize number of register reads ... commit 1b4f3dfb4792f03b139edf10124fcbeb44e608e6 Merge: 2037e5d6fbbce dcf097e7d21fb Author: Greg Kroah-Hartman Date: Wed Sep 1 20:11:41 2021 +0200 Merge tag 'usb-serial-5.15-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial fix for 5.15-rc1 Here's a single fix for a pl2303 type detection regression, and which has been in linux-next over night. * tag 'usb-serial-5.15-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: pl2303: fix GL type detection commit 2037e5d6fbbcee276a10737a0ed40694dcd2d071 Merge: 835d31d319d9c a65ab973c1669 Author: Greg Kroah-Hartman Date: Wed Sep 1 20:10:40 2021 +0200 Merge tag 'usb-serial-5.15-rc1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 5.15-rc1 Here are the USB serial updates for 5.15-rc1, including: - a couple of fixes for cp210x termios error handling - retrieval of fw revisions for more cp210x types - a switch to octal permissions for all module-parameter definitions Included are also various clean ups. All have been in linux-next with no reported issues. * tag 'usb-serial-5.15-rc1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: replace symbolic permissions by octal permissions USB: serial: cp210x: determine fw version for CP2105 and CP2108 USB: serial: cp210x: clean up type detection USB: serial: cp210x: clean up set-chars request USB: serial: cp210x: clean up control-request timeout USB: serial: cp210x: fix flow-control error handling USB: serial: cp210x: fix control-characters error handling USB: serial: io_edgeport: drop unused descriptor helper commit 36e784a60b85eb41a34b3232e95bf111931b9b09 Merge: 780aa1209f88f bfd862a7e9318 Author: Jakub Kicinski Date: Wed Sep 1 10:55:51 2021 -0700 Merge branch 'mptcp-prevent-tcp_push-crash-and-selftest-temp-file-buildup' Mat Martineau says: ==================== mptcp: Prevent tcp_push() crash and selftest temp file buildup These are two fixes for the net tree, addressing separate issues. Patch 1 addresses a divide-by-zero crash seen in syzkaller and also reported by a user on the netdev list. This changes MPTCP code so tcp_push() cannot be called with an invalid (0) mss_now value. Patch 2 fixes a selftest temp file cleanup issue that consumes excessive disk space when running repeated tests. ==================== Link: https://lore.kernel.org/r/20210901171537.121255-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit bfd862a7e9318dd906844807a713d27cdd1a72b1 Author: Matthieu Baerts Date: Wed Sep 1 10:15:37 2021 -0700 selftests: mptcp: clean tmp files in simult_flows '$cin' and '$sin' variables are local to a function: they are then not available from the cleanup trap. Instead, we need to use '$large' and '$small' that are not local and defined just before setting the trap. Without this patch, running this script in a loop might cause a: write: No space left on device issue. Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests") Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 1094c6fe7280e17e0e87934add5ad2585e990def Author: Paolo Abeni Date: Wed Sep 1 10:15:36 2021 -0700 mptcp: fix possible divide by zero Florian noted that if mptcp_alloc_tx_skb() allocation fails in __mptcp_push_pending(), we can end-up invoking mptcp_push_release()/tcp_push() with a zero mss, causing a divide by 0 error. This change addresses the issue refactoring the skb allocation code checking if skb collapsing will happen for sure and doing the skb allocation only after such check. Skb allocation will now happen only after the call to tcp_send_mss() which correctly initializes mss_now. As side bonuses we now fill the skb tx cache only when needed, and this also clean-up a bit the output path. v1 -> v2: - use lockdep_assert_held_once() - Jakub - fix indentation - Jakub Reported-by: Florian Westphal Fixes: 724cfd2ee8aa ("mptcp: allocate TX skbs in msk context") Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 835d31d319d9c8c4eb6cac074643360ba0ecab10 Merge: 0d290223a6c77 9c3a0f2852488 Author: Linus Torvalds Date: Wed Sep 1 10:34:52 2021 -0700 Merge tag 'media/v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new sensor drivers: imx335, imx412, ov9282 - new IR transmitter driver: meson-ir-tx - handro driver gained support for H.264 for Rockchip VDPU2 - imx gained support for i.MX8MQ - ti-vpe has gained support for other SoC variants - lots of cleanups, fixes, board additions and doc improvements * tag 'media/v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (195 commits) media: venus: venc: add support for V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM control media: venus: venc: Add support for intra-refresh period media: v4l2-ctrls: Add intra-refresh period control media: docs: ext-ctrls-codec: Document cyclic intra-refresh zero control value media: venus: helper: do not set constrained parameters for UBWC media: venus: venc: Fix potential null pointer dereference on pointer fmt media: venus: hfi: fix return value check in sys_get_prop_image_version() media: tegra-cec: Handle errors of clk_prepare_enable() media: cec-pin: rename timer overrun variables media: TDA1997x: report -ENOLINK after disconnecting HDMI source media: TDA1997x: fix tda1997x_query_dv_timings() return value media: Fix cosmetic error in TDA1997x driver media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: imx: add a driver for i.MX8MQ mipi csi rx phy and controller media: dt-bindings: media: document the nxp,imx8mq-mipi-csi2 receiver phy and controller media: imx: imx7_mipi_csis: convert some switch cases to the default media: imx: imx7-media-csi: Fix buffer return upon stream start failure media: imx: imx7-media-csi: Don't set PIXEL_BIT in CSICR1 media: imx: imx7-media-csi: Set TWO_8BIT_SENSOR for >= 10-bit formats media: dt-bindings: media: nxp,imx7-csi: Add i.MX8MM support ... commit 0d290223a6c77107b1c3988959e49279a8dafaba Merge: ea7b4244b3656 a8729efbbb847 Author: Linus Torvalds Date: Wed Sep 1 10:29:29 2021 -0700 Merge tag 'sound-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "There are a few intensive changes in ALSA core side at this time that helped with significant code reduction. Meanwhile we keep getting new stuff, so the total size still grows... Anyway, the below are some highlights in this development cycle. ALSA core: - New helpers to manage page allocations and card object with devres - Refactoring for memory allocation with wc-pages - A new PCM hardware flag SNDRV_PCM_INFO_EXPLICIT_SYNC for controlling the explicit sync of the stream control; it'll be used for ASoC SOF and non-coherent memory in future ASoC: - Lots of cleanups and improvements to the Intel drivers, including some new systems support - New support for AMD Vangoh, CUI CMM-4030D-261, Mediatek Mt8195, Renesas RZ/G2L Mediatek Mt8195, RealTek RT101P, Renesas RZ/G2L, Rockchip RK3568 S/PDIF USB-audio: - Re-organized the quirk handling and a new option quirk_flags - Fix for a regression in 5.14 code change for JACK - Quirks for Sony WALKMAN, Digidesign mbox HD-audio: - Enhanced support for CS8409 codec - More consistent shutdown behavior with the runtime PM - The model option can accept the PCI or codec SSID as an alias - Quirks for ASUS ROG, HP Spectre x360 Others: - Lots of code reduction in legacy drivers with devres helpers - FireWire MOTU 896HD support" * tag 'sound-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (421 commits) ASoC: Revert PCM trigger changes ALSA: usb-audio: Add lowlatency module option ALSA: hda/cs8409: Initialize Codec only in init fixup. ALSA: hda/cs8409: Ensure Type Detection is only run on startup when necessary ALSA: usb-audio: Work around for XRUN with low latency playback ALSA: pcm: fix divide error in snd_pcm_lib_ioctl ASoC: soc-pcm: test refcount before triggering ASoC: soc-pcm: protect BE dailink state changes in trigger ASoC: wcd9335: Disable irq on slave ports in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Fix a double irq free in the remove function ALSA: hda: Disable runtime resume at shutdown ASoC: rockchip: i2s: Add support for frame inversion ASoC: dt-bindings: rockchip: Add compatible strings for more SoCs ASoC: rockchip: i2s: Add compatible for more SoCs ASoC: rockchip: i2s: Make playback/capture optional ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B ASoC: dt-bindings: rockchip: Document reset property for i2s ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Improve dma data transfer efficiency ... commit ea7b4244b3656ca33b19a950f092b5bbc718b40c Author: Nathan Chancellor Date: Wed Sep 1 09:07:01 2021 -0700 x86/setup: Explicitly include acpi.h After commit 342f43af70db ("iscsi_ibft: fix crash due to KASLR physical memory remapping") x86_64_defconfig shows the following errors: arch/x86/kernel/setup.c: In function ‘setup_arch’: arch/x86/kernel/setup.c:916:13: error: implicit declaration of function ‘acpi_mps_check’ [-Werror=implicit-function-declaration] 916 | if (acpi_mps_check()) { | ^~~~~~~~~~~~~~ arch/x86/kernel/setup.c:1110:9: error: implicit declaration of function ‘acpi_table_upgrade’ [-Werror=implicit-function-declaration] 1110 | acpi_table_upgrade(); | ^~~~~~~~~~~~~~~~~~ [... more acpi noise ...] acpi.h was being implicitly included from iscsi_ibft.h in this configuration so the removal of that header means these functions have no definition or declaration. In most other configurations, continued to be included through at least if CONFIG_INTEL_TXT was enabled, and there were probably other implicit include paths too. Add acpi.h explicitly so there is no more error, and so that we don't continue to depend on these unreliable implicit include paths. Tested-by: Matthieu Baerts Signed-off-by: Nathan Chancellor Cc: Maurizio Lombardi Cc: Mike Rapoport Cc: Konrad Rzeszutek Wilk Signed-off-by: Linus Torvalds commit 07281a257a6868b900da5de1eda808c9e20253f1 Merge: 7c314bdfb64e4 9c1587d99f930 Author: Linus Torvalds Date: Wed Sep 1 09:59:34 2021 -0700 Merge tag 'usb-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt patches for 5.15-rc1. Nothing huge in here, just lots of constant forward progress on a number of different drivers and hardware support: - more USB 4/Thunderbolt support added - dwc3 driver updates and additions - usb gadget fixes and addtions for new types - udc gadget driver updates - host controller updates - removal of obsolete drivers - other minor driver updates All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (148 commits) usb: isp1760: otg control register access usb: isp1760: use the right irq status bit usb: isp1760: write to status and address register usb: isp1760: fix qtd fill length usb: isp1760: fix memory pool initialization usb: typec: tcpm: Fix spelling mistake "atleast" -> "at least" usb: dwc2: Fix spelling mistake "was't" -> "wasn't" usb: renesas_usbhs: Fix spelling mistake "faile" -> "failed" usb: host: xhci-rcar: Don't reload firmware after the completion usb: xhci-mtk: allow bandwidth table rollover usb: mtu3: fix random remote wakeup usb: mtu3: return successful suspend status usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint usb: xhci-mtk: modify the SOF/ITP interval for mt8195 usb: xhci-mtk: add a member of num_esit usb: xhci-mtk: check boundary before check tt usb: xhci-mtk: update fs bus bandwidth by bw_budget_table usb: xhci-mtk: fix issue of out-of-bounds array access usb: xhci-mtk: support option to disable usb2 ports usb: xhci-mtk: fix use-after-free of mtk->hcd ... commit 7c314bdfb64e4bb8d2f829376ed56ce663483752 Merge: ebf435d3b51b2 2e5f3a69b6fcd Author: Linus Torvalds Date: Wed Sep 1 09:51:16 2021 -0700 Merge tag 'tty-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial updates from Greg KH: "Here is the "big" set of tty/serial driver patches for 5.15-rc1 Nothing major in here at all, just some driver updates and more cleanups on old tty apis and code that needed it that includes: - tty.h cleanup of things that didn't belong in it - other tty cleanups by Jiri - driver cleanups - rs485 support added to amba-pl011 driver - dts updates - stm32 serial driver updates - other minor fixes and driver updates All have been in linux-next for a while with no reported problems" * tag 'tty-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (83 commits) tty: serial: uartlite: Use read_poll_timeout for a polling loop tty: serial: uartlite: Use constants in early_uartlite_putc tty: Fix data race between tiocsti() and flush_to_ldisc() serial: vt8500: Use of_device_get_match_data serial: tegra: Use of_device_get_match_data serial: 8250_ingenic: Use of_device_get_match_data tty: serial: linflexuart: Remove redundant check to simplify the code tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp tty: serial: fsl_lpuart: enable two stop bits for lpuart32 tty: serial: fsl_lpuart: fix the wrong mapbase value mxser: use semi-colons instead of commas tty: moxa: use semi-colons instead of commas tty: serial: fsl_lpuart: check dma_tx_in_progress in tx dma callback tty: replace in_irq() with in_hardirq() serial: sh-sci: fix break handling for sysrq serial: stm32: use devm_platform_get_and_ioremap_resource() serial: stm32: use the defined variable to simplify code Revert "arm pl011 serial: support multi-irq request" tty: serial: samsung: Add Exynos850 SoC data tty: serial: samsung: Fix driver data macros style ... commit ebf435d3b51b22340ef047aad0c2936ec4833ab2 Merge: c6c3c5704ba70 4adb389e08c95 Author: Linus Torvalds Date: Wed Sep 1 09:45:57 2021 -0700 Merge tag 'staging-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull IIO and staging driver updates from Greg KH: "Here is the big set of staging and IIO driver updates for 5.15-rc1. Also included in here are the counter driver subsystem updates as the IIO drivers needed them. Lots of churn in some staging drivers, we dropped the "old" rtl8188eu driver and replaced it with a newer version of the driver that had been maintained out-of-tree by Larry with the end goal of actually being able to get this driver out of staging eventually. Despite that driver being "newer" the line count of this pull request is going up. Some drivers moved out of staging as well, which is always nice to see, that is why there are additions to the mfc and misc driver subsystems. All of these were acked by the various subsystem maintainers involved. But by far, as normal, it's coding style cleanups all over the drivers/staging/ tree in here. Full details of these changes are in the shortlog. All of these have been in linux-next for a while with no reported problems" [ Note: the r8188eu merge clashed with commit 89939e890605 ("staging: rtlwifi: use siocdevprivate") from the networking tree. When resolving the issue, I noted that the whole r8188eu rtw_android code is dead since commit ae7471cae00a ("staging: r8188eu: remove rtw_ioctl function"). End result: the merge resolution was to throw all of that away, rather than do the mindless fixup to code that isn't actually reachable - Linus ] * tag 'staging-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (551 commits) staging: vt6655: Remove filenames in files staging: r8188eu: add extra TODO entries staging: vt6656: Remove filenames in files staging: wlan-ng: fix invalid assignment warning staging: r8188eu: rename fields of struct rtl_ps staging: r8188eu: remove ODM_DynamicPrimaryCCA_DupRTS() staging: r8188eu: rename fields of struct dyn_primary_cca staging: r8188eu: rename struct field Wifi_Error_Status staging: r8188eu: Provide a TODO file for this driver staging: r8188eu: remove unneeded variable staging: r8188eu: remove unneeded conversions to bool staging: r8188eu: remove {read,write}_macreg staging: r8188eu: core: remove condition with no effect staging: r8188eu: remove ethernet.h header file staging: r8188eu: remove ip.h header file staging: r8188eu: remove if_ether.h header file staging: r8188eu: make rtw_deinit_intf_priv return void staging: r8188eu: use is_multicast_ether_addr in os_dep/recv_linux.c staging: r8188eu: use is_multicast_ether_addr in hal/rtl8188eu_xmit.c staging: r8188eu: use is_multicast_ether_addr in core/rtw_xmit.c ... commit 863580418bc82062083be854355f2213d3d804f5 Author: Dmitry Baryshkov Date: Wed Sep 1 14:43:50 2021 +0300 regulator: qcom-rpmh-regulator: fix pm8009-1 ldo7 resource name Fix a typo in the pm8009 LDO7 declaration, it uses resource name ldo%s6 instead of ldo%s7. Fixes: 951384cabc5d ("regulator: qcom-rpmh-regulator: add pm8009-1 chip revision") Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210901114350.1106073-1-dmitry.baryshkov@linaro.org Signed-off-by: Mark Brown commit 0866d645b76d062b7d55091fd6fb80f058d0c384 Author: Shuming Fan Date: Wed Sep 1 18:07:54 2021 +0800 ASoC: rt5682: fix headset background noise when S3 state Remove CBJ power off setting to avoid floating state. Signed-off-by: Jack Yu Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20210901100754.21045-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 0f2ef911de0bdf3a0ea1d9b28e9126d3e018bbd5 Merge: 222039a2503e0 38b7673000949 Author: Mark Brown Date: Wed Sep 1 17:30:37 2021 +0100 Merge tag 'asoc-v5.15' into asoc-5.15 ASoC: Updates for v5.15 Quite a quiet release this time, mostly a combination of cleanups and a good set of new drivers. - Lots of cleanups and improvements to the Intel drivers, including some new systems support. - New support for AMD Vangoh, CUI CMM-4030D-261, Mediatek Mt8195, Renesas RZ/G2L Mediatek Mt8195, RealTek RT101P, Renesas RZ/G2L,, Rockchip RK3568 S/PDIF. commit ecd95673142ef80169a6c003b569b8a86d1e6329 Author: Alexander Aring Date: Thu Aug 26 10:06:31 2021 -0400 fs: dlm: avoid comms shutdown delay in release_lockspace When dlm_release_lockspace does active shutdown on connections to other nodes, the active shutdown will wait for any exisitng passive shutdowns to be resolved. But, the sequence of operations during dlm_release_lockspace can prevent the normal resolution of passive shutdowns (processed normally by way of lockspace recovery.) This disruption of passive shutdown handling can cause the active shutdown to wait for a full timeout period, delaying the completion of dlm_release_lockspace. To fix this, make dlm_release_lockspace resolve existing passive shutdowns (by calling dlm_clear_members earlier), before it does active shutdowns. The active shutdowns will not find any passive shutdowns to wait for, and will not be delayed. Reported-by: Chris Mackowski Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 222039a2503e0839f859e18e6f09acb9997480d1 Author: Trevor Wu Date: Tue Aug 31 16:39:56 2021 +0800 ASoC: dt-bindings: mt8195: remove dependent headers in the example Drop the use of the defines including clock and power id, so that we can remove the headers which are not applied in the example. Fixes: b5bac34fcfb4 ("dt-bindings: mediatek: mt8195: add audio afe document") Signed-off-by: Trevor Wu Acked-by: Rob Herring Link: https://lore.kernel.org/r/20210831083956.9804-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 940ffa19454704ca2ecd23b0d8dd604c93421bfa Author: Geert Uytterhoeven Date: Tue Aug 31 15:18:54 2021 +0200 ASoC: mediatek: SND_SOC_MT8195 should depend on ARCH_MEDIATEK The Mediatek MT8195 sound hardware is only present on Mediatek MT8195 SoCs. Hence add a dependency on ARCH_MEDIATEK, to prevent asking the user about this driver when configuring a kernel without Mediatek SoC support. Fixes: 6746cc858259985a ("ASoC: mediatek: mt8195: add platform driver") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/7e628e359bde04ceb9ddd74a45931059b4a4623c.1630415860.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 2a6a0a03117ee349308ab77ac0925fdca8ef32f5 Author: Colin Ian King Date: Fri Aug 27 19:50:03 2021 +0100 ASoC: samsung: s3c24xx_simtec: fix spelling mistake "devicec" -> "device" There is a spelling mistake in a dev_err error message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210827185003.507006-1-colin.king@canonical.com Signed-off-by: Mark Brown commit c6c3c5704ba70820f6b632982abde06661b7222a Merge: ba1dc7f273c73 049d1693db781 Author: Linus Torvalds Date: Wed Sep 1 08:44:42 2021 -0700 Merge tag 'driver-core-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the big set of driver core patches for 5.15-rc1. These do change a number of different things across different subsystems, and because of that, there were 2 stable tags created that might have already come into your tree from different pulls that did the following - changed the bus remove callback to return void - sysfs iomem_get_mapping rework Other than those two things, there's only a few small things in here: - kernfs performance improvements for huge numbers of sysfs users at once - tiny api cleanups - other minor changes All of these have been in linux-next for a while with no reported problems, other than the before-mentioned merge issue" * tag 'driver-core-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (33 commits) MAINTAINERS: Add dri-devel for component.[hc] driver core: platform: Remove platform_device_add_properties() ARM: tegra: paz00: Handle device properties with software node API bitmap: extend comment to bitmap_print_bitmask/list_to_buf drivers/base/node.c: use bin_attribute to break the size limitation of cpumap ABI topology: use bin_attribute to break the size limitation of cpumap ABI lib: test_bitmap: add bitmap_print_bitmask/list_to_buf test cases cpumask: introduce cpumap_print_list/bitmask_to_buf to support large bitmask and list sysfs: Rename struct bin_attribute member to f_mapping sysfs: Invoke iomem_get_mapping() from the sysfs open callback debugfs: Return error during {full/open}_proxy_open() on rmmod zorro: Drop useless (and hardly used) .driver member in struct zorro_dev zorro: Simplify remove callback sh: superhyway: Simplify check in remove callback nubus: Simplify check in remove callback nubus: Make struct nubus_driver::remove return void kernfs: dont call d_splice_alias() under kernfs node lock kernfs: use i_lock to protect concurrent inode updates kernfs: switch kernfs to use an rwsem kernfs: use VFS negative dentry caching ... commit 8ea32183072a83fc26df481168eecab46f9aba1d Author: Rajaravi Krishna Katta Date: Tue Aug 17 12:34:10 2021 +0300 habanalabs/gaudi: hwmon default card name This commit corrects CARD NAME for Gaudi as "HL205" Signed-off-by: Rajaravi Krishna Katta Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 8d9aa980beb8664457011e57e84fea4143b214a9 Author: Oded Gabbay Date: Mon Aug 9 22:43:37 2021 +0300 habanalabs: add support for f/w reset When the f/w runs in secured mode, it can reset the ASIC when certain events occur. In unsecured mode, the driver asks the f/w to reset the ASIC for those events. We need to perform the entire reset procedure but without accessing the ASIC. i.e. without halting the engines and without sending messages to the f/w. Signed-off-by: Oded Gabbay commit 56e753d5956647f942f76611cd179bc27c739bd8 Author: Oded Gabbay Date: Wed Aug 11 12:20:39 2021 +0300 habanalabs/gaudi: block ICACHE_BASE_ADDERESS_HIGH in TPC This register shouldn't be modified by user. Prefetch is disabled in Gaudi. Signed-off-by: Oded Gabbay commit 607b1468c2263e082d74c1a3e71399a9026b41ce Author: farah kassabri Date: Sun Aug 15 11:16:16 2021 +0300 habanalabs: cannot sleep while holding spinlock Fix 2 areas in the code where it's possible the code will go to sleep while holding a spinlock. Reported-by: Dan Carpenter Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 698f744aa858e4a5bfcef3f5e0cfc57a15d5b64a Author: Oded Gabbay Date: Fri Aug 20 14:24:48 2021 +0300 habanalabs: never copy_from_user inside spinlock copy_from_user might sleep so we can never call it when we have a spinlock. Moreover, it is not necessary in waiting for user interrupt, because if multiple threads will call this function on the same interrupt, each one will have it's own fence object inside the driver. The user address might be the same, but it doesn't really matter to us, as we only read from it. Signed-off-by: Oded Gabbay commit 053caa267fd1a46f6cea37bb6ee39b4a8779840f Author: Oded Gabbay Date: Fri Aug 20 14:10:40 2021 +0300 habanalabs: remove unnecessary device status check Checking if the device is operational when entering the function to wait for user interrupt is not something that is useful or necessary. It is not done in any other wait_for_cs ioctl path. If the device becomes non-operational during the wait, the reset function will make sure the process wait is interrupted. Instead, move the check to the beginning of hl_wait_ioctl(). It will block any attempt to wait on CS or user interrupt once the device is already marked as non-operational. Signed-off-by: Oded Gabbay commit 176d23a77edb7f10611bf61f1196abde119c7694 Author: Oded Gabbay Date: Fri Aug 20 13:49:39 2021 +0300 habanalabs: disable IRQ in user interrupts spinlock Because this spinlock is taken in an interrupt handler, we must use the spin_lock_irqsave/irqrestore version to disable the interrupts on the local CPU. Otherwise, we can have a potential deadlock (if the interrupt handler is scheduled to run on the same cpu that the code who took the lock was running on). Signed-off-by: Oded Gabbay commit 71731090ab17a208a58020e4b342fdfee280458a Author: Omer Shpigelman Date: Mon Aug 16 13:27:12 2021 +0300 habanalabs: add "in device creation" status On init, the disabled state is cleared right before hw_init and that causes the device to report on "Operational" state before the device initialization is finished. Although the char device is not yet exposed to the user at this stage, the sysfs entries are exposed. This can cause errors in monitoring applications that use the sysfs entries. In order to avoid this, a new state "in device creation" is introduced to ne reported when the device is not disabled but is still in init flow. Signed-off-by: Omer Shpigelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit e1b61f8e975ae3de555b9fa1f2939f47c70afeba Author: Oded Gabbay Date: Tue Aug 17 13:36:06 2021 +0300 habanalabs/gaudi: invalidate PMMU mem cache on init This must be done to clear the internal mem cache so we won't get ecc errors on the first invalidation. Signed-off-by: Oded Gabbay commit 6be42f0a1c3a0745f0d42572654a443e09b2470b Author: Oded Gabbay Date: Wed Aug 11 15:39:00 2021 +0300 habanalabs/gaudi: size should be printed in decimal It's more readable for the size to be in decimal. Signed-off-by: Oded Gabbay commit da105e6108a2ea0d1aa2034299fb67c4361f207d Author: Oded Gabbay Date: Tue Aug 10 21:02:33 2021 +0300 habanalabs/gaudi: define DC POWER for secured PMC In secured mode, the CGM is disabled. Therefore, the DC power is higher. Without taking it into consideration, the utilization is 12-15% at idle. Signed-off-by: Oded Gabbay commit 83d93e2bed14bafb30f9dca1babf4bf5de4e7a5a Author: Tomer Tayar Date: Sun Aug 8 20:36:48 2021 +0300 habanalabs/gaudi: unmask out of bounds SLM access interrupt The out of bounds SLM access TPC interrupt indicates a severe compiler bug and needs to be informed to user. This interrupt is currently masked so unmask it. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 89b213657c71aa292921f72a81d405679b1ea8df Author: Yuri Nudelman Date: Thu Jul 29 11:44:28 2021 +0300 habanalabs: add userptr_lookup node in debugfs It is useful to have the ability to see which user address was pinned to which physical address during the initial mapping. We already have all that info stored, but no means to search this data (which may be quite large). Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 816a6c6d99a3758baed317263efe7efd91770004 Author: Ofir Bitton Date: Thu Aug 5 17:36:24 2021 +0300 habanalabs/gaudi: fetch TPC/MME ECC errors from F/W In case F/W security is enabled driver cannot access ECC registers, hence driver must fetch the ECC info from F/W. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 72d6625570c16b9c097d4b9f16c2016974f83366 Author: Ohad Sharabi Date: Sun Aug 1 23:02:07 2021 +0300 habanalabs: modify multi-CS to wait on stream masters During the integration, the multi-CS requirements were refined: - The multi CS call shall wait on "per-ASIC" predefined stream masters instead of set of streams. - Stream masters are set of QIDs used by the upper SW layers (synapse) for completion (must be an external/HW queue). Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 1f6bdee76553b484a218eeffafd16a7232e5a00e Author: Alon Mizrahi Date: Thu Jul 22 18:12:18 2021 +0300 habanalabs/gaudi: add monitored SOBs to state dump Current "state dump" is lacking of monitored SOB IDs. Add for convenience. Signed-off-by: Alon Mizrahi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 929cbab5b3c8be3038b95e7443adbe23c223d8dc Author: Oded Gabbay Date: Tue Aug 3 08:13:39 2021 +0300 habanalabs/gaudi: restore user registers when context opens Because we don't have multiple contexts in GAUDI, and to minimize calls to is_idle function (which uses many register reads), move the call to clear the user registers to the opening of the single user context. Signed-off-by: Oded Gabbay commit 60d86e74df306795e97f7404ccaf89ec1019448c Author: Oded Gabbay Date: Tue Aug 3 13:22:06 2021 +0300 habanalabs/gaudi: increase boot fit timeout Various f/w versions have different timeouts, so increase the default timeout to accommodate all the options. Signed-off-by: Oded Gabbay commit c2aa71361806c8e04d33a4f516d2ca6c125f8a7a Author: Oded Gabbay Date: Tue Aug 3 15:53:46 2021 +0300 habanalabs: update to latest firmware headers Add several new packets between driver and firmware. Add matching compatibility bits for backward compatibility. Add support for 4K event types. Add information about pcie errors. Signed-off-by: Oded Gabbay commit 1fd984f5fe62c864b8ec66b637f73c0f46be45d4 Author: Oded Gabbay Date: Sun Aug 1 22:24:18 2021 +0300 habanalabs/gaudi: minimize number of register reads Because the register reads might be trapped by the hypervisor in certain deployments, minimize the number of reads during runtime by moving static initializations to functions that occur during device initialization instead of context open. Signed-off-by: Oded Gabbay commit 09ae43043c748423a5dcdc7bb1e63e4dcabe9bd6 Author: Yuri Nudelman Date: Thu Jul 29 11:54:50 2021 +0300 habanalabs: fix mmu node address resolution in debugfs The address resolution via debugfs was not taking into consideration the page offset, resulting in a wrong address. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 714fccbf48245482b9d5ed356a9ef23f2eb68612 Author: Yuri Nudelman Date: Tue Jul 27 17:39:42 2021 +0300 habanalabs: save pid per userptr Currently userptr endpoint in debugfs prints out virtual addresses in the user process memory space, without specifying their owner process ID. User space virtual address is meaningless without knowing the owner process. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 83f14f2f9b632da439e8e1e51826db5eab5c242b Author: Oded Gabbay Date: Wed Jul 28 00:16:31 2021 +0300 habanalabs/gaudi: move scrubbing to late init HW init is mostly about configuring registers. Therefore, it is better to activate DMAs only in late init and afterwards. Signed-off-by: Oded Gabbay commit f5137aff6dcc3a85d0143ee91e6061c2c3611bf7 Author: Ofir Bitton Date: Tue Jul 27 10:54:22 2021 +0300 habanalabs/gaudi: scrub HBM to a specific value In order to enhance debuggability, we will scrub the whole HBM to a specific value, in case HBM scrubbing is enabled. Scrubbing will be performed after reset and after user closes the FD. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 Author: Ofir Bitton Date: Tue Jul 20 09:16:05 2021 +0300 habanalabs: add validity check for event ID received from F/W Currently there is no validity check for event ID received from F/W, Thus exposing driver to memory overrun. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit cc5b4c4c75c43184c1d8684299efef2a68b87720 Author: Koby Elbaz Date: Mon Jul 19 08:28:34 2021 +0300 habanalabs: clear msg_to_cpu_reg to avoid misread after reset For some ASICs, the f/w reads the msg_to_cpu_reg value after reset, and for some it doesn't. Therefore, to be sure f/w doesn't read a wrong value after reset, we need to clear this register before the reset occurs. Signed-off-by: Koby Elbaz Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit b9317d513098d0da45ea96deff19058d1d37ae4d Author: Ohad Sharabi Date: Thu Jul 15 15:20:44 2021 +0300 habanalabs: make set_pci_regions asic function In order to better support variants of the same ASIC the set_pci_regions function is now an ASIC function which allows each ASIC to implement it internally, thus keeping all definitions static to the file. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 932adf1645cd3917dfc5678b2c3ffc84e5fa65a1 Author: Ohad Sharabi Date: Sun Jul 18 12:06:41 2021 +0300 habanalabs: convert PCI BAR offset to u64 Done as the bar size can exceed 4GB. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 5dc9ffaff1420676827c4054bc789a7710f2a272 Author: Oded Gabbay Date: Thu Jul 15 10:48:43 2021 +0300 habanalabs: expose server type in INFO IOCTL Add the server type property to the hl_info_hw_ip_info structure that is exposed to the user via the INFO IOCTL. This is needed by the userspace s/w stack to know the connections map of the internal links that connect the ASIC among themselves inside the server. The F/W will tell us, as part of the NIC information, the server type that the GAUDI is located in. Signed-off-by: Oded Gabbay commit ba1dc7f273c73b93e0e1dd9707b239ed69eebd70 Merge: 9e9fb7655ed58 0dc3ad3f859d3 Author: Linus Torvalds Date: Wed Sep 1 08:35:06 2021 -0700 Merge tag 'char-misc-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver updates from Greg KH: "Here is the big set of char/misc driver changes for 5.15-rc1. Lots of different driver subsystems are being updated in here, notably: - mhi subsystem update - fpga subsystem update - coresight/hwtracing subsystem update - interconnect subsystem update - nvmem subsystem update - parport drivers update - phy subsystem update - soundwire subsystem update and there are some other char/misc drivers being updated as well: - binder driver additions - new misc drivers - lkdtm driver updates - mei driver updates - sram driver updates - other minor driver updates. Note, there are no habanalabs driver updates in this pull request, that will probably come later before -rc1 is out in a different request. All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (169 commits) Revert "bus: mhi: Add inbound buffers allocation flag" misc/pvpanic: fix set driver data VMCI: fix NULL pointer dereference when unmapping queue pair char: mware: fix returnvar.cocci warnings parport: remove non-zero check on count soundwire: cadence: do not extend reset delay soundwire: intel: conditionally exit clock stop mode on system suspend soundwire: intel: skip suspend/resume/wake when link was not started soundwire: intel: fix potential race condition during power down phy: qcom-qmp: Add support for SM6115 UFS phy dt-bindings: phy: qcom,qmp: Add SM6115 UFS PHY bindings phy: qmp: Provide unique clock names for DP clocks lkdtm: remove IDE_CORE_CP crashpoint lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ coresight: Replace deprecated CPU-hotplug functions. Documentation: coresight: Add documentation for CoreSight config coresight: syscfg: Add initial configfs support coresight: config: Add preloaded configurations coresight: etm4x: Add complex configuration handlers to etmv4 coresight: etm-perf: Update to activate selected configuration ... commit 5f939f49771002f347039edf984aca42f30fc31a Author: Kuninori Morimoto Date: Mon Aug 30 09:44:44 2021 +0900 ASoC: audio-graph: respawn Platform Support commit 63f2f9cceb09f8 ("ASoC: audio-graph: remove Platform support") removed Platform support from audio-graph, because it doesn't have "plat" support on DT (simple-card has). But, Platform support is needed if user is using snd_dmaengine_pcm_register() which adds generic DMA as Platform. And this Platform dev is using CPU dev. Without this patch, at least STM32MP15 audio sound card is no more functional (v5.13 or later). This patch respawn Platform Support on audio-graph again. Reported-by: Olivier MOYSAN Signed-off-by: Kuninori Morimoto Tested-by: Olivier MOYSAN Link: https://lore.kernel.org/r/878s0jzrpf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cd5e4efde23ad8050921672ed777ec3f7aa310ec Author: Trevor Wu Date: Tue Aug 31 10:13:03 2021 +0800 ASoC: mediatek: mt8195: add MTK_PMIC_WRAP dependency randconfig builds show the warning below, WARNING: unmet direct dependencies detected for SND_SOC_MT6359 Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && MTK_PMIC_WRAP [=n] Selected by [y]: - SND_SOC_MT8195_MT6359_RT1019_RT5682 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && I2C [=y] && SND_SOC_MT8195 [=y] Add a dependency to avoid it. Signed-off-by: Trevor Wu Reported-by: Randy Dunlap Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20210831021303.5230-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit e38b3f20059426a0adbde014ff71071739ab5226 Author: NeilBrown Date: Mon Aug 30 08:36:34 2021 +1000 SUNRPC: don't pause on incomplete allocation alloc_pages_bulk_array() attempts to allocate at least one page based on the provided pages, and then opportunistically allocates more if that can be done without dropping the spinlock. So if it returns fewer than requested, that could just mean that it needed to drop the lock. In that case, try again immediately. Only pause for a time if no progress could be made. Reported-and-tested-by: Mike Javorski Reported-and-tested-by: Lothar Paltins Fixes: f6e70aab9dfe ("SUNRPC: refresh rq_pages using a bulk page allocator") Signed-off-by: NeilBrown Acked-by: Mel Gorman Signed-off-by: Chuck Lever commit 8af52e69772d053bc7caab12ad1c59f18ef2e3e2 Author: James Clark Date: Mon Aug 16 14:07:05 2021 +0100 tools build: Fix feature detect clean for out of source builds Currently the clean target when using O= isn't cleaning the feature detect output. This is because O= and OUTPUT= are set to canonical paths. For example in tools/perf/Makefile: FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O)) This means that OUTPUT ends in a / and most usages prepend it to a file without adding an extra /. This line that was changed adds an extra / before the 'feature' folder but not to the end, resulting in a clean command like this: rm -f /tmp/build//featuretest-all.bin ... After the change the clean command looks like this: rm -f /tmp/build/feature/test-all.bin ... Fixes: 762323eb39a257c3 ("perf build: Move feature cleanup under tools/build") Signed-off-by: James Clark Acked-by: Jiri Olsa Link: http://lore.kernel.org/lkml/20210816130705.1331868-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 79e7ed56d7e8899827d977d9dbd381b0ddb7a52a Author: Riccardo Mancini Date: Sat Aug 21 11:19:33 2021 +0200 perf evlist: Add evlist__for_each_entry_from() macro This patch adds a new iteration macro for evlist that resumes iteration from a given evsel in the evlist. This macro will be used in the workqueue series. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/2386505f8b598adf0dbcd04ec21804c6bcf00826.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 780aa1209f88fd96d40572b62df922662f2b896d Author: Wan Jiabing Date: Wed Sep 1 11:19:32 2021 +0800 mptcp: Fix duplicated argument in protocol.h Fix the following coccicheck warning: ./net/mptcp/protocol.h:36:50-73: duplicated argument to & or | The OPTION_MPTCP_MPJ_SYNACK here is duplicate. Here should be OPTION_MPTCP_MPJ_ACK. Fixes: 74c7dfbee3e18 ("mptcp: consolidate in_opt sub-options fields in a bitmask") Signed-off-by: Wan Jiabing Acked-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: David S. Miller commit e432fe97f3e5de325b40021e505cce53877586c5 Author: Michael Ellerman Date: Fri Aug 27 22:51:06 2021 +1000 powerpc/bug: Cast to unsigned long before passing to inline asm In commit 1e688dd2a3d6 ("powerpc/bug: Provide better flexibility to WARN_ON/__WARN_FLAGS() with asm goto") we changed WARN_ON(). Previously it would take the warning condition, x, and double negate it before converting the result to int, and passing that int to the underlying inline asm. ie: #define WARN_ON(x) ({ int __ret_warn_on = !!(x); if (__builtin_constant_p(__ret_warn_on)) { ... } else { BUG_ENTRY(PPC_TLNEI " %4, 0", BUGFLAG_WARNING | BUGFLAG_TAINT(TAINT_WARN), "r" (__ret_warn_on)); The asm then does a full register width comparison with zero and traps if it is non-zero (PPC_TLNEI). The new code instead passes the full expression, x, with some arbitrary type, to the inline asm: #define WARN_ON(x) ({ ... do { if (__builtin_constant_p((x))) { ... } else { ... WARN_ENTRY(PPC_TLNEI " %4, 0", BUGFLAG_WARNING | BUGFLAG_TAINT(TAINT_WARN), __label_warn_on, "r" (x)); As reported[1] by Nathan, when building with clang this can cause spurious warnings to fire repeatedly at boot: WARNING: CPU: 0 PID: 1 at lib/klist.c:62 .klist_add_tail+0x3c/0x110 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.14.0-rc7-next-20210825 #1 NIP: c0000000007ff81c LR: c00000000090a038 CTR: 0000000000000000 REGS: c0000000073c32a0 TRAP: 0700 Tainted: G W (5.14.0-rc7-next-20210825) MSR: 8000000002029032 CR: 22000a40 XER: 00000000 CFAR: c00000000090a034 IRQMASK: 0 GPR00: c00000000090a038 c0000000073c3540 c000000001be3200 0000000000000001 GPR04: c0000000072d65c0 0000000000000000 c0000000091ba798 c0000000091bb0a0 GPR08: 0000000000000001 0000000000000000 c000000008581918 fffffffffffffc00 GPR12: 0000000044000240 c000000001dd0000 c000000000012300 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR24: 0000000000000000 c0000000017e3200 0000000000000000 c000000001a0e778 GPR28: c0000000072d65b0 c0000000072d65a8 c000000007de72c8 c0000000073c35d0 NIP .klist_add_tail+0x3c/0x110 LR .bus_add_driver+0x148/0x290 Call Trace: 0xc0000000073c35d0 (unreliable) .bus_add_driver+0x148/0x290 .driver_register+0xb8/0x190 .__hid_register_driver+0x70/0xd0 .redragon_driver_init+0x34/0x58 .do_one_initcall+0x130/0x3b0 .do_initcall_level+0xd8/0x188 .do_initcalls+0x7c/0xdc .kernel_init_freeable+0x178/0x21c .kernel_init+0x34/0x220 .ret_from_kernel_thread+0x58/0x60 Instruction dump: fba10078 7c7d1b78 38600001 fb810070 3b9d0008 fbc10080 7c9e2378 389d0018 fb9d0008 fb9d0010 90640000 fbdd0000 <0b1e0000> e87e0018 28230000 41820024 The instruction dump shows that we are trapping because r30 is not zero: tdnei r30,0 Where r30 = c000000007de72c8 The WARN_ON() comes from: static void knode_set_klist(struct klist_node *knode, struct klist *klist) { knode->n_klist = klist; /* no knode deserves to start its life dead */ WARN_ON(knode_dead(knode)); ^^^^^^^^^^^^^^^^^ Where: #define KNODE_DEAD 1LU static bool knode_dead(struct klist_node *knode) { return (unsigned long)knode->n_klist & KNODE_DEAD; } The full disassembly shows that clang has not generated any code to apply the "& KNODE_DEAD" to the n_klist pointer, which is surprising. Nathan filed an LLVM bug [2], in which Eli Friedman explained that clang believes it is only passing a single bit to the asm (ie. a bool) and so the mask of bit 0 with 1 can be omitted, and suggested that if we want the full 64-bit value passed to the inline asm we should cast to a 64-bit type (or 32-bit on 32-bits). In fact we already do that for BUG_ENTRY(), which was added to fix a possibly similar bug in 2005 in commit 32818c2eb6b8 ("[PATCH] ppc64: Fix issue with gcc 4.0 compiled kernels"). So cast the value we pass to the inline asm to long. For GCC this appears to have no effect on code generation, other than causing sign extension in some cases. [1]: http://lore.kernel.org/r/YSa1O4fcX1nNKqN/@Ryzen-9-3900X.localdomain [2]: https://bugs.llvm.org/show_bug.cgi?id=51634 Fixes: 1e688dd2a3d6 ("powerpc/bug: Provide better flexibility to WARN_ON/__WARN_FLAGS() with asm goto") Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210901112522.1085134-1-mpe@ellerman.id.au commit 0e90dfa7a8d817db755c7b5d89d77b9c485e4180 Author: Linus Walleij Date: Tue Aug 31 20:50:50 2021 +0200 net: dsa: tag_rtl4_a: Fix egress tags I noticed that only port 0 worked on the RTL8366RB since we started to use custom tags. It turns out that the format of egress custom tags is actually different from ingress custom tags. While the lower bits just contain the port number in ingress tags, egress tags need to indicate destination port by setting the bit for the corresponding port. It was working on port 0 because port 0 added 0x00 as port number in the lower bits, and if you do this the packet appears at all ports, including the intended port. Ooops. Fix this and all ports work again. Use the define for shifting the "type A" into place while we're at it. Tested on the D-Link DIR-685 by sending traffic to each of the ports in turn. It works. Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") Cc: DENG Qingfang Cc: Mauri Sandberg Signed-off-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ef6c8da71eaffe4e251b0ff2a1d0da96f89fe6b0 Author: Geetha sowjanya Date: Wed Sep 1 15:25:50 2021 +0530 octeontx2-pf: cn10K: Reserve LMTST lines per core This patch reserves the LMTST lines per cpu instead of separate LMTST lines for NPA(buffer free) and NIX(sqe flush). LMTST line of the core on which SQ or RQ is processed is used for LMTST operation. This patch also replace STEOR with STEORL release semantics and updates driver name in ethtool file. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 21274aa1781941884599a97ab59be7f8f36af98c Author: Smadar Fuks Date: Wed Sep 1 11:08:59 2021 +0530 octeontx2-af: Add additional register check to rvu_poll_reg() Check one more time before exiting the API with an error. Fix API to poll at least twice, in case there are other high priority tasks and this API doesn't get CPU cycles for multiple jiffies update. In addition, increase timeout from usecs_to_jiffies(10000) to usecs_to_jiffies(20000), to prevent the case that for CONFIG_100HZ timeout will be a single jiffies. A single jiffies results actual timeout that can be any time between 1usec and 10msec. To solve this, a value of usecs_to_jiffies(20000) ensures that timeout is 2 jiffies. Signed-off-by: Smadar Fuks Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 8eebaf4a11fc78aa5662112cfaaff9fe3834a02c Author: Wan Jiabing Date: Wed Sep 1 10:20:57 2021 +0800 net: ixp46x: Remove duplicate include of module.h Remove repeated include of linux/module.h as it has been included at line 8. Signed-off-by: Wan Jiabing Signed-off-by: David S. Miller commit c6132f6f2e682c958f7022ecfd8bec35723a1a9d Author: Michael Chan Date: Tue Aug 31 21:15:23 2021 -0400 bnxt_en: Fix 64-bit doorbell operation on 32-bit kernels The driver requires 64-bit doorbell writes to be atomic on 32-bit architectures. So we redefined writeq as a new macro with spinlock protection on 32-bit architectures. This created a new warning when we added a new file in a recent patchset. writeq is defined on many 32-bit architectures to do the memory write non-atomically and it generated a new macro redefined warning. This warning was fixed incorrectly in the recent patch. Fix this properly by adding a new bnxt_writeq() function that will do the non-atomic write under spinlock on 32-bit systems. All callers in the driver will now call bnxt_writeq() instead. v2: Need to pass in bp to bnxt_writeq() Use lo_hi_writeq() [suggested by Florian] Reported-by: kernel test robot Fixes: f9ff578251dc ("bnxt_en: introduce new firmware message API based on DMA pools") Reviewed-by: Edwin Peer Signed-off-by: Michael Chan Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 58e636039b512697554b579c2bb23774061877f5 Author: Juergen Gross Date: Wed Aug 25 13:31:58 2021 +0200 xen: remove stray preempt_disable() from PV AP startup code In cpu_bringup() there is a call of preempt_disable() without a paired preempt_enable(). This is not needed as interrupts are off initially. Additionally this will result in early boot messages like: BUG: scheduling while atomic: swapper/1/0/0x00000002 Signed-off-by: Juergen Gross Link: https://lore.kernel.org/r/20210825113158.11716-1-jgross@suse.com Signed-off-by: Juergen Gross commit f956c1b0d58a50dd92ec82ae4923f7cc97e2ea52 Author: Sergio Miguéns Iglesias Date: Mon Aug 30 19:53:05 2021 +0200 xen/pcifront: Removed unnecessary __ref annotation An unnecessary "__ref" annotation was removed from the "drivers/pci/xen_pcifront.c" file. The function where the annotation was used was "pcifront_backend_changed()", which does not call any functions annotated as "__*init" nor "__*exit". This makes "__ref" unnecessary since this annotation is used to make the compiler ignore section miss-matches when they are not happening here in the first place. In addition to the aforementioned change, some code style issues were fixed in the same file. Signed-off-by: Sergio Miguéns Iglesias Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20210830175305.13370-1-sergio@lony.xyz Signed-off-by: Juergen Gross commit 4b92d4add5f6dcf21275185c997d6ecb800054cd Author: Thomas Gleixner Date: Tue Aug 31 13:48:34 2021 +0200 drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() DEFINE_SMP_CALL_CACHE_FUNCTION() was usefel before the CPU hotplug rework to ensure that the cache related functions are called on the upcoming CPU because the notifier itself could run on any online CPU. The hotplug state machine guarantees that the callbacks are invoked on the upcoming CPU. So there is no need to have this SMP function call obfuscation. That indirection was missed when the hotplug notifiers were converted. This also solves the problem of ARM64 init_cache_level() invoking ACPI functions which take a semaphore in that context. That's invalid as SMP function calls run with interrupts disabled. Running it just from the callback in context of the CPU hotplug thread solves this. Fixes: 8571890e1513 ("arm64: Add support for ACPI based firmware tables") Reported-by: Guenter Roeck Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Acked-by: Will Deacon Acked-by: Peter Zijlstra Link: https://lore.kernel.org/r/871r69ersb.ffs@tglx commit b14b8b1ed0e15b8f43fba9c25654278a31ee3c2f Author: Michael Ellerman Date: Tue Aug 31 23:51:51 2021 +1000 powerpc/ptdump: Fix generic ptdump for 64-bit Since the conversion to generic ptdump we see crashes on 64-bit: BUG: Unable to handle kernel data access on read at 0xc0eeff7f00000000 Faulting instruction address: 0xc00000000045e5fc Oops: Kernel access of bad area, sig: 11 [#1] ... NIP __walk_page_range+0x2bc/0xce0 LR __walk_page_range+0x240/0xce0 Call Trace: __walk_page_range+0x240/0xce0 (unreliable) walk_page_range_novma+0x74/0xb0 ptdump_walk_pgd+0x98/0x170 ptdump_check_wx+0x88/0xd0 mark_rodata_ro+0x48/0x80 kernel_init+0x74/0x1a0 ret_from_kernel_thread+0x5c/0x64 What's happening is that have walked off the end of the kernel page tables, and started dereferencing junk values. That happens because we initialised the ptdump_range to span all the way up to 0xffffffffffffffff: static struct ptdump_range ptdump_range[] __ro_after_init = { {TASK_SIZE_MAX, ~0UL}, But the kernel page tables don't span that far. So on 64-bit set the end of the range to be the address immediately past the end of the kernel page tables, to limit the page table walk to valid addresses. Fixes: e084728393a5 ("powerpc/ptdump: Convert powerpc to GENERIC_PTDUMP") Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210831135151.886620-1-mpe@ellerman.id.au commit 46d4ee48aaef1671adfddbbde588af2259573ba7 Author: Krzysztof Kozlowski Date: Tue Aug 31 15:06:43 2021 +0200 dt-bindings: clock: samsung: fix header path in example The proper header is exynos4.h: samsung,exynos4412-isp-clock.example.dts:19:18: fatal error: dt-bindings/clock/exynos4412.h: No such file or directory Fixes: 7ac615780926 ("dt-bindings: clock: samsung: convert Exynos4 to dtschema") Reported-by: Stephen Boyd Reported-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210831130643.83249-1-krzysztof.kozlowski@canonical.com Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 85dfdbfc13ea9614a2168ce4a7d2cd089d84cb64 Author: jason-jh.lin Date: Tue Aug 31 15:09:03 2021 +0800 mailbox: cmdq: add multi-gce clocks support for mt8195 For the design of GCE hardware event signal transportation, evnet rx will send the event signal to all GCE event merges after receiving the event signal from the other hardware. Because GCE event merges need to response to event rx, their clocks must be enabled at that time. To make sure all the gce clock is enabled while receiving the hardware event, each cmdq mailbox should enable or disable the others gce clk at the same time. Signed-off-by: jason-jh.lin Signed-off-by: Jassi Brar commit 8d4f5a9e012abb7919f7b63656ea571f22789918 Author: jason-jh.lin Date: Tue Aug 31 15:09:02 2021 +0800 mailbox: cmdq: add mediatek mailbox support for mt8195 Add mt8195 compatible name in the driver data of cmdq mailbox driver. Signed-off-by: jason-jh.lin Signed-off-by: Jassi Brar commit 704446b935bd7061b8799b16922265f88b2a4445 Author: jason-jh.lin Date: Tue Aug 31 15:09:00 2021 +0800 dt-bindings: gce: add gce header file for mt8195 Add gce header file to define the gce subsys id, hardware event id and constant for mt8195. Signed-off-by: jason-jh.lin Signed-off-by: Jassi Brar commit 0553fb51686ee53c25386ded56848862cb66ae19 Author: jason-jh.lin Date: Tue Aug 31 15:08:59 2021 +0800 dt-bindings: mailbox: add definition for mt8195 Add definition of compatible and dt-binding header for mt8195. Signed-off-by: jason-jh.lin Signed-off-by: Jassi Brar commit 9e9fb7655ed585da8f468e29221f0ba194a5f613 Merge: 86ac54e79fe09 29ce8f9701072 Author: Linus Torvalds Date: Tue Aug 31 16:43:06 2021 -0700 Merge tag 'net-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core: - Enable memcg accounting for various networking objects. BPF: - Introduce bpf timers. - Add perf link and opaque bpf_cookie which the program can read out again, to be used in libbpf-based USDT library. - Add bpf_task_pt_regs() helper to access user space pt_regs in kprobes, to help user space stack unwinding. - Add support for UNIX sockets for BPF sockmap. - Extend BPF iterator support for UNIX domain sockets. - Allow BPF TCP congestion control progs and bpf iterators to call bpf_setsockopt(), e.g. to switch to another congestion control algorithm. Protocols: - Support IOAM Pre-allocated Trace with IPv6. - Support Management Component Transport Protocol. - bridge: multicast: add vlan support. - netfilter: add hooks for the SRv6 lightweight tunnel driver. - tcp: - enable mid-stream window clamping (by user space or BPF) - allow data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD - more accurate DSACK processing for RACK-TLP - mptcp: - add full mesh path manager option - add partial support for MP_FAIL - improve use of backup subflows - optimize option processing - af_unix: add OOB notification support. - ipv6: add IFLA_INET6_RA_MTU to expose MTU value advertised by the router. - mac80211: Target Wake Time support in AP mode. - can: j1939: extend UAPI to notify about RX status. Driver APIs: - Add page frag support in page pool API. - Many improvements to the DSA (distributed switch) APIs. - ethtool: extend IRQ coalesce uAPI with timer reset modes. - devlink: control which auxiliary devices are created. - Support CAN PHYs via the generic PHY subsystem. - Proper cross-chip support for tag_8021q. - Allow TX forwarding for the software bridge data path to be offloaded to capable devices. Drivers: - veth: more flexible channels number configuration. - openvswitch: introduce per-cpu upcall dispatch. - Add internet mix (IMIX) mode to pktgen. - Transparently handle XDP operations in the bonding driver. - Add LiteETH network driver. - Renesas (ravb): - support Gigabit Ethernet IP - NXP Ethernet switch (sja1105): - fast aging support - support for "H" switch topologies - traffic termination for ports under VLAN-aware bridge - Intel 1G Ethernet - support getcrosststamp() with PCIe PTM (Precision Time Measurement) for better time sync - support Credit-Based Shaper (CBS) offload, enabling HW traffic prioritization and bandwidth reservation - Broadcom Ethernet (bnxt) - support pulse-per-second output - support larger Rx rings - Mellanox Ethernet (mlx5) - support ethtool RSS contexts and MQPRIO channel mode - support LAG offload with bridging - support devlink rate limit API - support packet sampling on tunnels - Huawei Ethernet (hns3): - basic devlink support - add extended IRQ coalescing support - report extended link state - Netronome Ethernet (nfp): - add conntrack offload support - Broadcom WiFi (brcmfmac): - add WPA3 Personal with FT to supported cipher suites - support 43752 SDIO device - Intel WiFi (iwlwifi): - support scanning hidden 6GHz networks - support for a new hardware family (Bz) - Xen pv driver: - harden netfront against malicious backends - Qualcomm mobile - ipa: refactor power management and enable automatic suspend - mhi: move MBIM to WWAN subsystem interfaces Refactor: - Ambient BPF run context and cgroup storage cleanup. - Compat rework for ndo_ioctl. Old code removal: - prism54 remove the obsoleted driver, deprecated by the p54 driver. - wan: remove sbni/granch driver" * tag 'net-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1715 commits) net: Add depends on OF_NET for LiteX's LiteETH ipv6: seg6: remove duplicated include net: hns3: remove unnecessary spaces net: hns3: add some required spaces net: hns3: clean up a type mismatch warning net: hns3: refine function hns3_set_default_feature() ipv6: remove duplicated 'net/lwtunnel.h' include net: w5100: check return value after calling platform_get_resource() net/mlxbf_gige: Make use of devm_platform_ioremap_resourcexxx() net: mdio: mscc-miim: Make use of the helper function devm_platform_ioremap_resource() net: mdio-ipq4019: Make use of devm_platform_ioremap_resource() fou: remove sparse errors ipv4: fix endianness issue in inet_rtm_getroute_build_skb() octeontx2-af: Set proper errorcode for IPv4 checksum errors octeontx2-af: Fix static code analyzer reported issues octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg octeontx2-af: Fix loop in free and unmap counter af_unix: fix potential NULL deref in unix_dgram_connect() dpaa2-eth: Replace strlcpy with strscpy octeontx2-af: Use NDC TX for transmit packet data ... commit 86ac54e79fe09b34c52691a780a6e31d12fa57f4 Merge: 69dc8010b8fca bdb0a6548d223 Author: Linus Torvalds Date: Tue Aug 31 15:53:20 2021 -0700 Merge branch 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: "There is a long-standing subtle destroy_workqueue() bug where a workqueue can be destroyed while internal work items used for flushing are still in flight. Lai fixed it by assigning a flush color to the internal work items so that they are correctly waited for during destruction. Other than that, all are minor cleanups" * 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Remove unused WORK_NO_COLOR workqueue: Assign a color to barrier work items workqueue: Mark barrier work with WORK_STRUCT_INACTIVE workqueue: Change the code of calculating work_flags in insert_wq_barrier() workqueue: Change arguement of pwq_dec_nr_in_flight() workqueue: Rename "delayed" (delayed by active management) to "inactive" workqueue: Replace deprecated CPU-hotplug functions. workqueue: Replace deprecated ida_simple_*() with ida_alloc()/ida_free() workqueue: Fix typo in comments workqueue: Fix possible memory leaks in wq_numa_init() commit 69dc8010b8fca475170650a4ebbc0074541df859 Merge: 81b0b29bf70bb d20d30ebb1993 Author: Linus Torvalds Date: Tue Aug 31 15:49:04 2021 -0700 Merge branch 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Two cpuset behavior changes: - cpuset on cgroup2 is changed to enable memory migration based on nodemask by default. - A notification is generated when cpuset partition state changes. All other patches are minor fixes and cleanups" * 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Avoid compiler warnings with no subsystems cgroup/cpuset: Avoid memory migration when nodemasks match cgroup/cpuset: Enable memory migration for cpuset v2 cgroup/cpuset: Enable event notification when partition state changes cgroup: cgroup-v1: clean up kernel-doc notation cgroup: Replace deprecated CPU-hotplug functions. cgroup/cpuset: Fix violation of cpuset locking rule cgroup/cpuset: Fix a partition bug with hotplug cgroup/cpuset: Miscellaneous code cleanup cgroup: remove cgroup_mount from comments commit 81b0b29bf70bb8b459cf1f0b4a6a4898be457850 Merge: efa916af13206 7fd1d00bf8181 Author: Linus Torvalds Date: Tue Aug 31 15:28:21 2021 -0700 Merge branch 'stable/for-linus-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft Pull ibft updates from Konrad Rzeszutek Wilk: "A fix for iBFT parsing code badly interfacing when KASLR is enabled" * 'stable/for-linus-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft: iscsi_ibft: fix warning in reserve_ibft_region() iscsi_ibft: fix crash due to KASLR physical memory remapping commit efa916af13206eb15916e102c45c99a13ea78f33 Merge: a998a62be9cdb d3703ef331297 Author: Linus Torvalds Date: Tue Aug 31 14:55:09 2021 -0700 Merge tag 'for-5.15/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Add DM infrastructure for IMA-based remote attestion. These changes are the basis for deploying DM-based storage in a "cloud" that must validate configurations end-users run to maintain trust. These DM changes allow supported DM targets' configurations to be measured via IMA. But the policy and enforcement (of which configurations are valid) is managed by something outside the kernel (e.g. Keylime). - Fix DM crypt scalability regression on systems with many cpus due to percpu_counter spinlock contention in crypt_page_alloc(). - Use in_hardirq() instead of deprecated in_irq() in DM crypt. - Add event counters to DM writecache to allow users to further assess how the writecache is performing. - Various code cleanup in DM writecache's main IO mapping function. * tag 'for-5.15/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm crypt: use in_hardirq() instead of deprecated in_irq() dm ima: update dm documentation for ima measurement support dm ima: update dm target attributes for ima measurements dm ima: add a warning in dm_init if duplicate ima events are not measured dm ima: prefix ima event name related to device mapper with dm_ dm ima: add version info to dm related events in ima log dm ima: prefix dm table hashes in ima log with hash algorithm dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() dm: add documentation for IMA measurement support dm: update target status functions to support IMA measurement dm ima: measure data on device rename dm ima: measure data on table clear dm ima: measure data on device remove dm ima: measure data on device resume dm ima: measure data on table load dm writecache: add event counters dm writecache: report invalid return from writecache_map helpers dm writecache: further writecache_map() cleanup dm writecache: factor out writecache_map_remap_origin() dm writecache: split up writecache_map() to improve code readability commit a998a62be9cdb509491731ffe81575aa09943a32 Merge: e7c1bbcf0c315 239f32b4f161c Author: Linus Torvalds Date: Tue Aug 31 14:41:41 2021 -0700 Merge tag 'leds-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: "Usual driver changes, some documentation that should hopefully get LED names standartized, and many fixes" * tag 'leds-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: (32 commits) leds: pca955x: Switch to i2c probe_new leds: pca955x: Let the core process the fwnode leds: pca955x: Implement the default-state property leds: pca955x: Add brightness_get function leds: pca955x: Clean up code formatting leds: leds-core: Implement the retain-state-shutdown property dt-bindings: leds: Add retain-state-shutdown boolean Documentation: leds: standartizing LED names leds: trigger: remove reference to obsolete CONFIG_IDE_GD_ATA leds: lp50xx: Fix chip name in KConfig leds: pwm: add support for default-state device property leds: move default_state read from fwnode to core leds: flash: Remove redundant initialization of variable ret leds: lgm-sso: Propagate error codes from callee to caller leds: trigger: audio: Add an activate callback to ensure the initial brightness is set leds: rt8515: Put fwnode in any case during ->probe() leds: lt3593: Put fwnode in any case during ->probe() leds: lm3697: Make error handling more robust leds: lm3697: Update header block to reflect reality leds: lm3692x: Correct headers (of*.h -> mod_devicetable.h) ... commit 9605f75cf36e0bcc0f4ada07b5be712d30107607 Author: Jaegeuk Kim Date: Mon Aug 30 13:30:45 2021 -0700 f2fs: should put a page beyond EOF when preparing a write The prepare_compress_overwrite() gets/locks a page to prepare a read, and calls f2fs_read_multi_pages() which checks EOF first. If there's any page beyond EOF, we unlock the page and set cc->rpages[i] = NULL, which we can't put the page anymore. This makes page leak, so let's fix by putting that page. Fixes: a949dc5f2c5c ("f2fs: compress: fix race condition of overwrite vs truncate") Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 827f02842e40ea2e00f401e8f4cb1bccf3b8cd86 Author: Jaegeuk Kim Date: Mon Aug 30 11:37:32 2021 -0700 f2fs: deallocate compressed pages when error happens In f2fs_write_multi_pages(), f2fs_compress_pages() allocates pages for compression work in cc->cpages[]. Then, f2fs_write_compressed_pages() initiates bio submission. But, if there's any error before submitting the IOs like early f2fs_cp_error(), previously it didn't free cpages by f2fs_compress_free_page(). Let's fix memory leak by putting that just before deallocating cc->cpages. Fixes: 4c8ff7095bef ("f2fs: support data compression") Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e7c1bbcf0c315c56cd970642214aa1df3d8cf61d Merge: 871dda463c6f2 0e35f63f7f4ee Author: Linus Torvalds Date: Tue Aug 31 14:37:41 2021 -0700 Merge tag 'hwmon-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers for: - Aquacomputer D5 Next - SB-RMI power module Added chip support to existing drivers: - Support for various Zen2 and Zen3 APUs and for Yellow Carp (SMU v13) added to k10temp driver - Support for Silicom n5010 PAC added to intel-m10-bmc driver - Support for BPD-RS600 added to pmbus/bpa-rs600 driver Other notable changes: - In k10temp, do not display Tdie on Zen CPUs if there is no difference between Tdie and Tctl - Converted adt7470 and dell-smm drivers to use devm_hwmon_device_register_with_info API - Support for temperature/pwm tables added to axi-fan-control driver - Enabled fan control for Dell Precision 7510 in dell-smm driver Various other minor improvements and fixes in several drivers" * tag 'hwmon-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (41 commits) hwmon: add driver for Aquacomputer D5 Next hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API hwmon: (adt7470) Convert to use regmap hwmon: (adt7470) Fix some style issues hwmon: (k10temp) Add support for yellow carp hwmon: (k10temp) Rework the temperature offset calculation hwmon: (k10temp) Don't show Tdie for all Zen/Zen2/Zen3 CPU/APU hwmon: (k10temp) Add additional missing Zen2 and Zen3 APUs hwmon: remove amd_energy driver in Makefile hwmon: (dell-smm) Rework SMM function debugging hwmon: (dell-smm) Mark i8k_get_fan_nominal_speed as __init hwmon: (dell-smm) Mark tables as __initconst hwmon: (pmbus/bpa-rs600) Add workaround for incorrect Pin max hwmon: (pmbus/bpa-rs600) Don't use rated limits as warn limits hwmon: (axi-fan-control) Support temperature vs pwm points hwmon: (axi-fan-control) Handle irqs in natural order hwmon: (axi-fan-control) Make sure the clock is enabled hwmon: (pmbus/ibm-cffps) Fix write bits for LED control hwmon: (w83781d) Match on device tree compatibles dt-bindings: hwmon: Add bindings for Winbond W83781D ... commit 871dda463c6f2c2a4a660937e2f57616146f42de Merge: 359f3d743f3a7 8b51a8e64443b Author: Linus Torvalds Date: Tue Aug 31 14:34:01 2021 -0700 Merge branch 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has a smaller pull reuest this time: - new driver for I2C virtio - removal of PMC SMP driver because platform is already gone - IRQ probing and DMAENGINE API cleanups - add SI metric prefix definitions to units.h - beginning of i801 refactorization - a few driver improvements" * 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (28 commits) i2c: cadence: Implement save restore i2c: xlp9xx: fix main IRQ check i2c: mt65xx: fix IRQ check i2c: virtio: add a virtio i2c frontend driver i2c: hix5hd2: fix IRQ check i2c: s3c2410: fix IRQ check i2c: iop3xx: fix deferred probing i2c: synquacer: fix deferred probing i2c: sun6i-pw2i: Prefer strscpy over strlcpy i2c: remove dead PMC MSP TWI/SMBus/I2C driver i2c: dev: Use sysfs_emit() in "show" functions i2c: dev: Define pr_fmt() and drop duplication substrings i2c: designware: Fix indentation in the header i2c: designware: Use DIV_ROUND_CLOSEST() macro units: Add SI metric prefix definitions i2c: at91: mark PM ops as __maybe unused i2c: sh_mobile: : use proper DMAENGINE API for termination i2c: qup: : use proper DMAENGINE API for termination i2c: mxs: : use proper DMAENGINE API for termination i2c: imx: : use proper DMAENGINE API for termination ... commit 359f3d743f3a762cc2cc7ddb7c6fb4c57b9a06cc Merge: 8e235ff9a1e3d a75c956162978 Author: Linus Torvalds Date: Tue Aug 31 14:31:10 2021 -0700 Merge tag 'mmc-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC and MEMSTICK updates from Ulf Hansson: "MMC core: - Return a proper response in case of an ioctl error - Issue HPI to interrupt BKOPS for eMMC if it timed out - Avoid hogging the CPU while polling for busy - Extend sd8787 pwrseq to support the wilc1000 SDIO - Remove a couple of confusing warning messages - Clarify comment for ->card_busy() host ops MMC host: - dw_mmc: Add data CRC error injection - mmci: De-assert reset during ->probe() - rtsx_pci: Fix long reads when clock is pre-scaled - sdhci: Correct the tuning command handle for PIO mode - sdhci-esdhc-imx: Improve support for auto tuning - sdhci-msm: Add support for the sc7280 - sdhci-of-arasan: Don't auto tune for DDR50 mode for ZynqMP - sdhci-of-arasan: Enable support for auto cmd12 - sdhci-of-arasan: Use 19MHz for SD default speed for ZynqMP for level shifter - usdhi6rol0: Implement the ->card_busy() host ops MEMSTICK: - A couple of minor cleanups" * tag 'mmc-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (52 commits) mmc: queue: Remove unused parameters(request_queue) mmc: pwrseq: sd8787: fix compilation warning mmc: core: Return correct emmc response in case of ioctl error mmc: sdhci-esdhc-imx: Select the correct mode for auto tuning mmc: sdhci-esdhc-imx: Remove redundant code for manual tuning mmc: core: Issue HPI in case the BKOPS timed out mmc: queue: Match the data type of max_segments mmc: switch from 'pci_' to 'dma_' API memstick: switch from 'pci_' to 'dma_' API memstick: r592: Change the name of the 'pci_driver' structure to be consistent mmc: pwrseq: add wilc1000_sdio dependency for pwrseq_sd8787 mmc: pwrseq: sd8787: add support for wilc1000 dt-bindings: mmc: Extend pwrseq-sd8787 binding for wilc1000 dt-bindings: mmc: fsl-imx-esdhc: change the pinctrl-names rule dt-bindings: mmc: fsl-imx-esdhc: add a new compatible string dt-bindings: mmc: renesas,sdhi: Document RZ/G2L bindings dt-bindings: mmc: renesas,sdhi: Fix dtbs-check warning mmc: core: Update ->card_busy() callback comment mmc: usdhi6rol0: Implement card_busy function mmc: sdhci: Correct the tuning command handle for PIO mode ... commit 2c208abd4f9efac02622d8f3c9989f4b7b1ad973 Author: Heiner Kallweit Date: Thu Aug 26 20:58:07 2021 +0200 PCI/VPD: Use unaligned access helpers Use unaligned access helpers to simplify the code. Link: https://lore.kernel.org/r/0f1c7e21-5330-72ab-139d-f5ce3c65f04a@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 06e1913d457121a98ee276179734c34dab30f388 Author: Heiner Kallweit Date: Thu Aug 26 20:57:01 2021 +0200 PCI/VPD: Clean up public VPD defines and inline functions After recent introduction of new VPD API functions and user migration these defines and inline functions aren't used outside VPD core any longer. Link: https://lore.kernel.org/r/d33e06bf-bc5e-ece7-bf35-7245ae224d1b@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 24c521f81c305191a7c3938932ed7de1f157ff64 Author: Heiner Kallweit Date: Thu Aug 26 20:56:22 2021 +0200 cxgb4: Use pci_vpd_find_id_string() to find VPD ID string Use pci_vpd_find_id_string() to find the VPD ID string. This simplifies the code and avoids the need for pci_vpd_lrdt_size(). Link: https://lore.kernel.org/r/19ea2e9b-6e94-288a-6612-88db01b1b417@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit acfbb1b8a494d7bfd316dfb363a820e6df637e8d Author: Heiner Kallweit Date: Thu Aug 26 20:55:43 2021 +0200 PCI/VPD: Add pci_vpd_find_id_string() Add a pci_vpd_find_id_string() API function to retrieve the ID string from VPD. This way callers don't need pci_vpd_lrdt_size() any longer, and it can be made private to the VPD core. Link: https://lore.kernel.org/r/c5225bf6-8d29-970d-e271-0d7b52252630@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 46a347835cc50b04da0996a070939ed8927d69bd Author: Heiner Kallweit Date: Thu Aug 26 20:55:07 2021 +0200 PCI/VPD: Include post-processing in pci_vpd_find_tag() Move pci_vpd_find_tag() post-processing from pci_vpd_find_ro_info_keyword() to pci_vpd_find_tag(). This simplifies function pci_vpd_find_id_string() that will be added in a subsequent patch. Link: https://lore.kernel.org/r/fb15393f-d3b2-e140-2643-570d3abd7382@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 59b83b29bb5532bbff54a271e0b4f321e28b954f Author: Heiner Kallweit Date: Thu Aug 26 20:54:23 2021 +0200 PCI/VPD: Stop exporting pci_vpd_find_info_keyword() Now that the last users have been migrated to pci_vpd_find_ro_keyword() we can stop exporting this function. It's still used in VPD core code. Link: https://lore.kernel.org/r/96ca2a56-383e-9b61-9cba-4f1e5611dc15@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit a61590892ef097c180144fa469abe2256b9ae715 Author: Heiner Kallweit Date: Thu Aug 26 20:53:42 2021 +0200 PCI/VPD: Stop exporting pci_vpd_find_tag() Now that the last users have been migrated to pci_vpd_find_ro_keyword() we can stop exporting this function. It's still used in VPD core code. Link: https://lore.kernel.org/r/71131eca-0502-7878-365f-30b6614161cf@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 8e235ff9a1e3dc3d800224ab97bcd2418d3b19c3 Merge: 6f1e8b12eec44 a90887705668f Author: Linus Torvalds Date: Tue Aug 31 13:36:01 2021 -0700 Merge tag 'devprop-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "These improve the handling of secondary firmware nodes in fwnode_graph_get_next_endpoint() (Daniel Scally)" * tag 'devprop-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "media: device property: Call fwnode_graph_get_endpoint_by_id() for fwnode->secondary" device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() commit 6f1e8b12eec44ee047dc9e0a9544b2cfed739503 Merge: 5cbba60596b1f 2cbd40709a9d4 Author: Linus Torvalds Date: Tue Aug 31 13:29:22 2021 -0700 Merge tag 'acpi-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA kernel code to upstream revision 20210730, clean up the ACPI companion binding code, optimize the I2C handling in the XPower PMIC driver, add 16550-compatible Serial Port Subtype support to the SPCR parsing code, add a few LoongArch support bits, add a ne quirk to the button driver, add new PCH FIVR methods to the DPTF code, replace deprecated CPU-hotplug functions in the processor driver, improve the acpi_os_map_memory() handling on non-x86 and do some assorted cleanups. Specifics: - Update ACPICA code in the kernel to upstream revision 20210730 including the following changes: - Add support for the AEST table (data compiler) to iASL (Bob Moore) - Fix an if statement (add parens) (Bob Moore) - Drop trailing semicolon from some macros (Bob Moore) - Fix compilation of WPBT table with no command-line arguments in iASL (Bob Moore) - Add method name "_DIS" for use with aslmethod.c (Bob Moore) - Add new DBG2 Serial Port Subtypes (Marcin Wojtas) - Add new PCH FIVR methods to the DPTF code (Srinivas Pandruvada) - Add support for the new 16550-compatible Serial Port Subtype to the SPCR table parsing code (Marcin Wojtas) - Add DMI quirk for Lenovo Yoga 9 (14INTL5) to the ACPI button driver (Ulrich Huber) - Add LoongArch support for ACPI_PROCESSOR/ACPI_NUMA (Huacai Chen) - Add memory semantics to acpi_os_map_memory() (Lorenzo Pieralisi) - Replace deprecated CPU-hotplug functions in the ACPI processor driver (Sebastian Andrzej Siewior) - Optimize I2C-bus handling in the XPower PMIC driver (Hans de Goede) - Make platform-profile catch profile changes initiated by user space and notify user processes of them (Hans de Goede) - Clean up the ACPI companion binding and unbinding code and update debug messaging in the ACPI power resources code (Rafael Wysocki) - Clean up a couple of code pieces related to configfs (Andy Shevchenko) - Rearrange the FPDT table parsing code to avoid printing warning messages for reserved record types (Adrian Huang)" * tag 'acpi-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (27 commits) ACPI: power: Drop name from struct acpi_power_resource ACPI: power: Use acpi_handle_debug() to print debug messages ACPI: tables: FPDT: Do not print FW_BUG message if record types are reserved ACPI: button: Add DMI quirk for Lenovo Yoga 9 (14INTL5) ACPI: Add memory semantics to acpi_os_map_memory() ACPI: SPCR: Add support for the new 16550-compatible Serial Port Subtype ACPI: platform-profile: call sysfs_notify() from platform_profile_store() ACPICA: Update version to 20210730 ACPICA: Add method name "_DIS" For use with aslmethod.c ACPICA: iASL: Fix for WPBT table with no command-line arguments ACPICA: Headers: Add new DBG2 Serial Port Subtypes ACPICA: Macros should not use a trailing semicolon ACPICA: Fix an if statement (add parens) ACPICA: iASL: Add support for the AEST table (data compiler) ACPI: processor: Replace deprecated CPU-hotplug functions ACPI: DPTF: Add new PCH FIVR methods ACPI: configfs: Make get_header() to return error pointer ACPI: configfs: Use sysfs_emit() in "show" functions driver core: Split device_platform_notify() software nodes: Split software_node_notify() ... commit 5cbba60596b1f32f637190ca9ed5b1acdadb852c Merge: 9b2eacd8f0462 fe583359ddf0d Author: Linus Torvalds Date: Tue Aug 31 13:21:58 2021 -0700 Merge tag 'pm-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These address some PCI device power management issues, add new hardware support to the RAPL power capping driver, add HWP guaranteed performance change notification support to the intel_pstate driver, replace deprecated CPU-hotplug functions in a few places, update CPU PM notifiers to use raw spinlocks, update the PM domains framework (new DT property support, Kconfig fix), do a couple of cleanups in code related to system sleep, and improve the energy model and the schedutil cpufreq governor. Specifics: - Address 3 PCI device power management issues (Rafael Wysocki). - Add Power Limit4 support for Alder Lake to the Intel RAPL power capping driver (Sumeet Pawnikar). - Add HWP guaranteed performance change notification support to the intel_pstate driver (Srinivas Pandruvada). - Replace deprecated CPU-hotplug functions in code related to power management (Sebastian Andrzej Siewior). - Update CPU PM notifiers to use raw spinlocks (Valentin Schneider). - Add support for 'required-opps' DT property to the generic power domains (genpd) framework and use this property for I2C on ARM64 sc7180 (Rajendra Nayak). - Fix Kconfig issue related to genpd (Geert Uytterhoeven). - Increase energy calculation precision in the Energy Model (Lukasz Luba). - Fix kobject deletion in the exit code of the schedutil cpufreq governor (Kevin Hao). - Unmark some functions as kernel-doc in the PM core to avoid false-positive documentation build warnings (Randy Dunlap). - Check RTC features instead of ops in suspend_test Alexandre Belloni)" * tag 'pm-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: domains: Fix domain attach for CONFIG_PM_OPP=n powercap: Add Power Limit4 support for Alder Lake SoC cpufreq: intel_pstate: Process HWP Guaranteed change notification thermal: intel: Allow processing of HWP interrupt notifier: Remove atomic_notifier_call_chain_robust() PM: cpu: Make notifier chain use a raw_spinlock_t PM: sleep: unmark 'state' functions as kernel-doc arm64: dts: sc7180: Add required-opps for i2c PM: domains: Add support for 'required-opps' to set default perf state opp: Don't print an error if required-opps is missing cpufreq: schedutil: Use kobject release() method to free sugov_tunables PM: EM: Increase energy calculation precision PM: sleep: check RTC features instead of ops in suspend_test PM: sleep: s2idle: Replace deprecated CPU-hotplug functions cpufreq: Replace deprecated CPU-hotplug functions powercap: intel_rapl: Replace deprecated CPU-hotplug functions PCI: PM: Enable PME if it can be signaled from D3cold PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: Use pci_update_current_state() in pci_enable_device_flags() commit 8304a3a199eeb3e6434fc855ac072e7374d0c490 Author: Zhangfei Gao Date: Tue Jul 13 10:54:36 2021 +0800 PCI: Set dma-can-stall for HiSilicon chips HiSilicon KunPeng920 and KunPeng930 have devices that appear as PCI but are actually on the AMBA bus. These fake PCI devices can support SVA via the SMMU stall feature. DT systems can indicate this in the device tree, but ACPI systems don't have that mechanism, so add a "dma-can-stall" property manually for them. [bhelgaas: add text from Robin as comment near quirk] Link: https://lore.kernel.org/r/1626144876-11352-4-git-send-email-zhangfei.gao@linaro.org Signed-off-by: Zhangfei Gao Signed-off-by: Jean-Philippe Brucker Signed-off-by: Zhou Wang Signed-off-by: Bjorn Helgaas Acked-by: Robin Murphy commit 9b2eacd8f04625c6cb2dd82469972a3bba3a783a Merge: 8e0cd9525ca7a bfc3cac0c7612 Author: Linus Torvalds Date: Tue Aug 31 13:01:40 2021 -0700 Merge tag 'Smack-for-5.15' of git://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: "There is a variable used only during start-up that's now marked __initdata and a change where the code was working by sheer luck that is now done properly. Both have been in next for several weeks and pass the Smack testsuite" * tag 'Smack-for-5.15' of git://github.com/cschaufler/smack-next: smack: mark 'smack_enabled' global variable as __initdata Smack: Fix wrong semantics in smk_access_entry() commit 0e898eb8df4e34c7b129452444eb7cef68a11f43 Author: Simon Xue Date: Fri Jun 25 14:55:11 2021 +0800 PCI: rockchip-dwc: Add Rockchip RK356X host controller driver Add a driver for the DesignWare-based PCIe controller found on RK356X. The existing pcie-rockchip-host driver is only used for the Rockchip-designed IP found on RK3399. Link: https://lore.kernel.org/r/20210625065511.1096935-1-xxm@rock-chips.com Tested-by: Peter Geis Signed-off-by: Simon Xue Signed-off-by: Shawn Lin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kever Yang Reviewed-by: Rob Herring commit 71121fdd79f562c891900ff21c27316ddeac73af Author: Krzysztof Wilczyński Date: Thu Jul 1 21:02:52 2021 +0000 PCI: dwc: Remove surplus break statement after return As part of code refactoring completed in a0fd361db8e5 ("PCI: dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common code"), dw_plat_add_pcie_ep() was removed and the call to the dw_pcie_ep_init() was moved into dw_plat_pcie_probe(). This left a break statement behind that is not needed any more as as dw_plat_pcie_probe() returns immediately after calling dw_pcie_ep_init(). Remove this surplus break statement that became dead code. Suggested-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20210701210252.1638709-1-kw@linux.com Signed-off-by: Krzysztof Wilczyński Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas commit 8e0cd9525ca7ab8ba87135d85b10596e61b10e63 Merge: befa491ce6954 67d69e9d1a6c8 Author: Linus Torvalds Date: Tue Aug 31 12:55:50 2021 -0700 Merge tag 'audit-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "Two patches in the audit pull request for v5.15; one is trivial ("header protection") but the second is a real patch that fixes a refcounting problem. The refcount fix normally would have been sent up during the -rcX cycle, but since we merged it less than a week before v5.14 proper I felt it was better to wait for the merge window to open; the patch is marked with the usual -stable markings" * tag 'audit-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: move put_tree() to avoid trim_trees refcount underflow and UAF audit: add header protection to kernel/audit.h commit 30492c12d2324e8bc9a35ef3f3c1d92a5bd7753d Author: Krzysztof Wilczyński Date: Thu Jul 1 20:44:01 2021 +0000 PCI: artpec6: Remove local code block from switch statement The switch statement in the artpec6_pcie_probe() has a local code block where "val" is defined and immediately used by the artpec6_pcie_readl(). This extra code block adds brackets at the same indentation level as the switch statement itself which can hinder readability of the code. Move the "val" declaration to the top of the function and remove the extra code block from the switch statement. Suggested-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20210701204401.1636562-2-kw@linux.com Signed-off-by: Krzysztof Wilczyński Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Jesper Nilsson commit befa491ce6954adadb181c464d0318925f18e499 Merge: e55f0c439a268 893c47d1964f5 Author: Linus Torvalds Date: Tue Aug 31 12:53:34 2021 -0700 Merge tag 'selinux-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux update from Paul Moore: "We've got an unusually small SELinux pull request for v5.15 that consists of only one (?!) patch that is really pretty minor when you look at it. Unsurprisingly it passes all of our tests and merges cleanly on top of your tree right now, please merge this for v5.15" * tag 'selinux-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: return early for possible NULL audit buffers commit ee6f85683e859728eba6cbca6ed338fb608286b3 Author: Krzysztof Wilczyński Date: Thu Jul 1 20:44:00 2021 +0000 PCI: artpec6: Remove surplus break statement after return As part of code refactoring completed in a0fd361db8e5 ("PCI: dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common code"), artpec6_add_pcie_ep() was removed and the call to the dw_pcie_ep_init() was moved into artpec6_pcie_probe(). This left a break statement behind that is not needed any more as artpec6_pcie_probe() returns immediately after calling dw_pcie_ep_init(). Remove this surplus break statement that became dead code. Link: https://lore.kernel.org/r/20210701204401.1636562-1-kw@linux.com Signed-off-by: Krzysztof Wilczyński Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Jesper Nilsson commit 0242f6426ea78fbe3933b44f8c55ae93ec37f6cc Author: Jens Axboe Date: Tue Aug 31 13:53:00 2021 -0600 io-wq: fix queue stalling race We need to set the stalled bit early, before we drop the lock for adding us to the stall hash queue. If not, then we can race with new work being queued between adding us to the stall hash and io_worker_handle_work() marking us stalled. Signed-off-by: Jens Axboe commit 28667a526980bd713ccd55e955e9a9a9c9bc7724 Author: Riccardo Mancini Date: Sat Aug 21 11:19:30 2021 +0200 perf evsel: Handle precise_ip fallback in evsel__open_cpu() This is another patch in the effort to separate the fallback mechanisms from the open itself. In case of precise_ip fallback, the original precise_ip will be stored in the evsel (it was stored in a local variable) and the open will be retried. Since the precise_ip fallback will be the first in the chain of fallbacks, there should be no functional change with this patch. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/74208c433d2024a6c4af9c0b140b54ed6b5ea810.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 89761eefc7ad59ebe7d8436a4fe9a1830be9c3b0 Author: Nobuhiro Iwamatsu Date: Wed Aug 11 17:38:30 2021 +0900 MAINTAINERS: Add entries for Toshiba Visconti PCIe controller Add entries for Toshiba Visconti PCIe controller binding and driver. Link: https://lore.kernel.org/r/20210811083830.784065-4-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas commit da36024a4e838b52408cf3d04999ae934728092a Author: Nobuhiro Iwamatsu Date: Wed Aug 11 17:38:29 2021 +0900 PCI: visconti: Add Toshiba Visconti PCIe host controller driver Add support for the PCIe RC controller on Toshiba Visconti ARM SoCs. This PCIe controller is based on the Synopsys DesignWare PCIe core. Link: https://lore.kernel.org/r/20210811083830.784065-3-nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Yuji Ishikawa Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring commit 91233d003b0906f146765fbef3572509c99d9386 Author: Riccardo Mancini Date: Sat Aug 21 11:19:29 2021 +0200 perf evsel: Move bpf_counter__install_pe() to success path in evsel__open_cpu() I don't see why bpf_counter__install_pe() should get called even if fd = -1, so I'm moving it to the success path. This will be useful in following patches to separate the actual open and the related operations from the fallback mechanisms. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: http://lore.kernel.org/lkml/64f8a1b0a838a6e6049cd43c1beafd432999ae57.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit ebfb045a417415d8ac3f588e443f001b1278c01c Author: Riccardo Mancini Date: Sat Aug 21 11:19:28 2021 +0200 perf evsel: Move test_attr__open() to success path in evsel__open_cpu() test_attr__open() ignores the fd if -1, therefore it is safe to move it to the success path (fd >= 0). Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/b3baf11360ca96541c9631730614fd7d217496fc.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit da7c3b462293431ea2558765a977a55007a26379 Author: Riccardo Mancini Date: Sat Aug 21 11:19:27 2021 +0200 perf evsel: Move ignore_missing_thread() to fallback code This patch moves ignore_missing_thread outside the perf_event_open loop. Doing so, we need to move the retry_open flag a few places higher, with minimal impact. Furthermore, thread need not be decreased since it won't get increased by the for loop (since we're jumping back inside), but we need to check that the nthreads decrease didn't put thread out of range. The goal is to have fallbacks handled in one place only, since in the future parallel code, these would be handled separately. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/4eca51443c786baaf6811b7cd8e73aafd97f7606.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 71efc48a4cbd208707b4ee4464b9eabd3b6438aa Author: Riccardo Mancini Date: Sat Aug 21 11:19:26 2021 +0200 perf evsel: Separate rlimit increase from evsel__open_cpu() This is a preparatory patch for the workqueue patches with the goal to separate from evlist__open_cpu() the actual opening (which could be performed in parallel), from the existing fallback mechanisms, which should be handled sequentially. This patch separates the rlimit increase from evsel__open_cpu(). Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/2f256de8ec37b9809a5cef73c2fa7bce416af5d3.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit d21fc5f077f7760bbae5742e185691718518f255 Author: Riccardo Mancini Date: Sat Aug 21 11:19:25 2021 +0200 perf evsel: Separate missing feature detection from evsel__open_cpu() This is a preparatory patch for the workqueue patches with the goal to separate in evlist__open_cpu() the actual opening, which could be performed in parallel, from the existing fallback mechanisms, which should be handled sequentially. This patch separates the missing feature detection in evsel__open_cpu() into a new evsel__detect_missing_features() function. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/cba0b7d939862473662adeedb0f9c9b69566ee9a.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 6efd06e3741944e528bc8243c88d9e3320c1c80c Author: Riccardo Mancini Date: Sat Aug 21 11:19:24 2021 +0200 perf evsel: Add evsel__prepare_open() This function will prepare the evsel and disable the missing features. It will be used in one of the following patches. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/fa5e78bbb92c848226f044278fdcf777b3ce4583.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 588f4ac7639941d12fa669c30e64e0d68fb96b08 Author: Riccardo Mancini Date: Sat Aug 21 11:19:23 2021 +0200 perf evsel: Separate missing feature disabling from evsel__open_cpu This is a preparatory patch for the patches in the workqueue series with the goal to separate in evlist__open_cpu() the actual opening, which could be performed in parallel, from the existing fallback mechanisms, which should be handled sequentially. This patch separates the disabling of missing features from evlist__open_cpu() into a new function evsel__disable_missing_features((). Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/48138bd2932646dde315505da733c2ca635ad2ee.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 46def08f5db0d84275bd0a3ba4a279a2197aa3a6 Author: Riccardo Mancini Date: Sat Aug 21 11:19:22 2021 +0200 perf evsel: Save open flags in evsel in prepare_open() This patch caches the flags used in perf_event_open() inside evsel, so that they can be set in __evsel__prepare_open() (this will be useful in patches in the workqueue series, when the fallback mechanisms will be handled outside the open itself). This also optimizes the code, by not having to recompute them everytime. Since flags are now saved in evsel, the flags argument in perf_event_open() is removed. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/d9f63159098e56fa518eecf25171d72e6f74df37.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit d45ce03434fd0f9177a0d3a7237fce4263eed24b Author: Riccardo Mancini Date: Sat Aug 21 11:19:21 2021 +0200 perf evsel: Separate open preparation from open itself This is a preparatory patch for the following patches with the goal to separate in evlist__open_cpu the actual perf_event_open, which could be performed in parallel, from the existing fallback mechanisms, which should be handled sequentially. This patch separates the first lines of evsel__open_cpu into a new __evsel__prepare_open function. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/e14118b934c338dbbf68b8677f20d0d7dbf9359a.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit bc0496043edf9c78e443bcf74ed2fa04566fdc18 Author: Riccardo Mancini Date: Sat Aug 21 11:19:20 2021 +0200 perf evsel: Remove retry_sample_id goto label As far as I can tell, there is no good reason, apart from optimization to have the retry_sample_id separate from fallback_missing_features. Probably, this label was added to avoid reapplying patches for missing features that had already been applied. However, missing features that have been added later have not used this optimization, always jumping to fallback_missing_features and reapplying all missing features. This patch removes that label, replacing it with fallback_missing_features. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/340af0d03408d6621fd9c742e311db18b3585b3b.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 5d4da30f76b96682dfefbe34717b7c0bf69ffc74 Author: Riccardo Mancini Date: Sat Aug 21 11:19:11 2021 +0200 perf mmap: Add missing bitops.h header MMAP_CPU_MASK_BYTES uses the BITS_TO_LONGS macro, which is defined in linux/bitops.h. However, this header is not included directly, but gets imported indirectly in files using the macro. This patch adds the missing include. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/c5b91ee432a2e28e7f16337c740b43b4d0b0e86c.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 6e93bc534f1408e0e1f890e760596099b12f0d8c Author: Riccardo Mancini Date: Sat Aug 21 11:19:08 2021 +0200 libperf cpumap: Take into advantage it is sorted to optimize perf_cpu_map__max() From commit 7074674e7338863e ("perf cpumap: Maintain cpumaps ordered and without dups"), perf_cpu_map elements are sorted in ascending order. This patch improves the perf_cpu_map__max function by returning the last element. Committer notes: Do it as a ternary to keep it in just one return line, add a comment explaining it is sorted and what functions does it. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/fb79f02e7b86ea8044d563adb1e9890c906f982f.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit e55f0c439a2681a3c299bedd99ebe998049fa508 Merge: 67b03f93a30fa 2863643fb8b92 Author: Linus Torvalds Date: Tue Aug 31 12:16:05 2021 -0700 Merge tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull set_user() update from Christian Brauner: "This contains a single fix to set_user() which aligns permission checks with the corresponding fork() codepath. No one involved in this could come up with a reason for the difference. A capable caller can already circumvent the check when they fork where the permission checks are already for the relevant capabilities in addition to also allowing to exceed nproc when it is the init user. So apply the same logic to set_user()" * tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: set_user: add capability check when rlimit(RLIMIT_NPROC) exceeds commit 00823dcbdd415c868390feaca16f0265101efab4 Author: Stuart Hayes Date: Thu May 13 03:03:14 2021 +0530 PCI/portdrv: Enable Bandwidth Notification only if port supports it Previously we assumed that all Root Ports and Switch Downstream Ports supported Link Bandwidth Notification. Per spec, this is only required for Ports supporting Links wider than x1 and/or multiple Link speeds (PCIe r5.0, sec 7.5.3.6). Because we assumed all Ports supported it, we tried to set up a Bandwidth Notification IRQ, which failed for devices that don't support IRQs at all, which meant pcieport didn't attach to the Port at all. Check the Link Bandwidth Notification Capability bit and enable the service only when the Port supports it. [bhelgaas: commit log] Fixes: e8303bb7a75c ("PCI/LINK: Report degraded links via link bandwidth notification") Link: https://lore.kernel.org/r/20210512213314.7778-1-stuart.w.hayes@gmail.com Signed-off-by: Stuart Hayes Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org commit 67b03f93a30facabf105b8b8632e3b9b6ef9200a Merge: 927bc120a248b ad19607a90b29 Author: Linus Torvalds Date: Tue Aug 31 12:06:17 2021 -0700 Merge tag 'fs.idmapped.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull idmapping documentation updates from Christian Brauner: "The bulk of the idmapped work this cycle was adding support for idmapped mounts to btrfs. While this required the addition of a (simple) new vfs helper all the work is going through David Sterba's btrfs tree. It was way simpler to do it this way rather then forcing David to coordinate between his btrfs and my tree. Plus I don't care who merges it as long as I feel I can trust the maintainer and the btrfs folks were really fast and helpful in reviewing this work. As always, associated with the btrfs port for idmapped mounts is a new fstests extension specifically concerned with btrfs ioctls (e.g. subvolume creation, deletion etc.) on idmapped mounts which can be found in the fstests repo as 5f8179ce8b00 ("btrfs: introduce btrfs specific idmapped mounts tests"). Consequently, this cycle the idmapping pull is boring. It only contains documentation updates, specifically about how idmappings and idmapped mounts work" * tag 'fs.idmapped.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: doc: give a more thorough id handling explanation commit 927bc120a248b658acc2f5206ec4e81a794d8a57 Merge: 1dd5915a5cbda 03ba0fe4d09f2 Author: Linus Torvalds Date: Tue Aug 31 12:00:07 2021 -0700 Merge tag 'fs.close_range.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull close_range() cleanup from Christian Brauner: "This is a cleanup for close_range() which was sent as part of a bugfix we did some time ago in commit 9b5b872215fe ("file: fix close_range() for unshare+cloexec"). We used to share more code between some helpers for close_range() which made retrieving the maximum number of open fds before calling into the helpers sensible. But with the introduction of CLOSE_RANGE_CLOEXEC and the need to retrieve the number of maximum fds once more for CLOSE_RANGE_CLOEXEC that stopped making sense. So the code was in a dumb in-limbo state. Fix this by simplifying the code a bit. The original idea was to only fix the bug itself and make backporting easy. And since the cleanup wasn't very pressing I left it in linux-next for a very long time. I didn't pull the patches from the list again back then which is why they don't have lore-links. So I'm listing them below explicitly" Commit 03ba0fe4d09f ("file: simplify logic in __close_range()") Link: https://lore.kernel.org/linux-fsdevel/20210402123548.108372-3-brauner@kernel.org Commit f49fd6d3c070 ("file: let pick_file() tell caller it's done") Link: https://lore.kernel.org/linux-fsdevel/20210402123548.108372-4-brauner@kernel.org * tag 'fs.close_range.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: file: simplify logic in __close_range() file: let pick_file() tell caller it's done commit 1dd5915a5cbda100e67823e7a4ca7af919185ea6 Merge: 0ee7c3e25d8c2 8374f43123a59 Author: Linus Torvalds Date: Tue Aug 31 11:54:02 2021 -0700 Merge tag 'fs.move_mount.move_mount_set_group.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull move_mount updates from Christian Brauner: "This contains an extension to the move_mount() syscall making it possible to add a single private mount into an existing propagation tree. The use-case comes from the criu folks which have been struggling with restoring complex mount trees for a long time. Variations of this work have been discussed at Plumbers before, e.g. https://www.linuxplumbersconf.org/event/7/contributions/640/ The extension to move_mount() enables criu to restore any set of mount namespaces, mount trees and sharing group trees without introducing yet more complexity into mount propagation itself. The changes required to criu to make use of this and restore complex propagation trees are available at https://github.com/Snorch/criu/commits/mount-v2-poc A cleaned-up version of this will go up for merging into the main criu repo after this lands" * tag 'fs.move_mount.move_mount_set_group.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: tests: add move_mount(MOVE_MOUNT_SET_GROUP) selftest move_mount: allow to add a mount into an existing group commit f3c4b1341e8320e63f197a554fc5a25686a11d22 Author: Claire Chang Date: Fri Aug 27 11:48:02 2021 +0800 swiotlb: use depends on for DMA_RESTRICTED_POOL Use depends on instead of select for DMA_RESTRICTED_POOL; otherwise it will make SWIOTLB user configurable and cause compile errors for some arch (e.g. mips). Fixes: 0b84e4f8b793 ("swiotlb: Add restricted DMA pool initialization") Acked-by: Will Deacon Reported-by: Guenter Roeck Signed-off-by: Claire Chang Signed-off-by: Konrad Rzeszutek Wilk commit b75f299d6960e773a28fcd38bad901998035e69e Author: Riccardo Mancini Date: Sat Aug 21 11:19:37 2021 +0200 libsubcmd: add OPT_UINTEGER_OPTARG option type This patch adds OPT_UINTEGER_OPTARG, which is the same as OPT_UINTEGER, but also makes it possible to use the option without any value, setting the variable to a default value, d. Signed-off-by: Riccardo Mancini Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/c46749b3dff796729078352ff164d363457a3587.1629490974.git.rickyman7@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 7884d0e9e30e0ba41a2d0d36de3d605fc314b532 Author: Jiawei Gu Date: Wed Aug 4 15:19:16 2021 +0800 drm/amdgpu: enable more pm sysfs under SRIOV 1-VF mode Enable pp_num_states, pp_cur_state, pp_force_state, pp_table sysfs under SRIOV 1-VF scenario. Signed-off-by: Jiawei Gu Signed-off-by: Alex Deucher commit d7eff46c214c036606dd3cd305bd5a128aecfe8c Author: Philip Yang Date: Thu Jul 29 17:19:54 2021 -0400 drm/amdgpu: fix fdinfo race with process exit Get process vm root BO ref in case process is exiting and root BO is freed, to avoid NULL pointer dereference backtrace: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 Call Trace: amdgpu_show_fdinfo+0xfe/0x2a0 [amdgpu] seq_show+0x12c/0x180 seq_read+0x153/0x410 vfs_read+0x91/0x140[ 3427.206183] ksys_read+0x4f/0xb0 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 703677d9345d87d7288ed8a2483ca424af7d4b3b Author: xinhui pan Date: Tue Aug 31 13:49:59 2021 +0800 drm/amdgpu: Fix a deadlock if previous GEM object allocation fails Fall through to handle the error instead of return. Fixes: f8aab60422c37 ("drm/amdgpu: Initialise drm_gem_object_funcs for imported BOs") Cc: stable@vger.kernel.org Signed-off-by: xinhui pan Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f7d6779df642720e22bffd449e683bb8690bd3bf Author: Guchun Chen Date: Fri Aug 27 18:31:41 2021 +0800 drm/amdgpu: stop scheduler when calling hw_fini (v2) This gurantees no more work on the ring can be submitted to hardware in suspend/resume case, otherwise a potential race will occur and the ring will get no chance to stay empty before suspend. v2: Call drm_sched_resubmit_job before drm_sched_start to restart jobs from the pending list. Suggested-by: Andrey Grodzovsky Suggested-by: Christian König Signed-off-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 156872b07e893d01454ce9a4cf33f1b025aea516 Author: John Clements Date: Tue Aug 31 14:43:53 2021 +0800 drm/amdgpu: Clear RAS interrupt status on aldebaran Resolve incorrect register address Reviewed-by: Candice Li Signed-off-by: John Clements Signed-off-by: Alex Deucher commit e5b310f900ccf2380b2432ad33e5b4c0cd699b78 Author: Michael Strauss Date: Mon Aug 16 16:15:36 2021 -0400 drm/amd/display: Initialize lt_settings on instantiation [WHY] lt_settings' pointers remain uninitialized but nonzero if display fails to light up with no DPCD/EDID info populated, leading to a hang on access Reviewed-by: Nicholas Kazlauskas Acked-by: Mikita Lipski Signed-off-by: Michael Strauss Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0e62b094a82d5266283b6acb862e5dcc15b7422f Author: Angus Wang Date: Thu Aug 12 16:33:43 2021 -0400 drm/amd/display: cleanup idents after a revert [WHY] The change has caused high idle memory clock speed and power consumption at some resolutions and frame rates for Navi10 [HOW] Reverted change "drm/amd/display: Fixed Intermittent blue screen on OLED panel" Reviewed-by: Aric Cyr Acked-by: Mikita Lipski Signed-off-by: Angus Wang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 03388a347fe7cf7c3bdf68b0823ba316d177d470 Author: Anson Jacob Date: Fri Aug 13 17:11:51 2021 -0400 drm/amd/display: Fix memory leak reported by coverity Free memory allocated if any of the previous allocations failed. >>> CID 1487129: Resource leaks (RESOURCE_LEAK) >>> Variable "vpg" going out of scope leaks the storage it points to. Addresses-Coverity-ID: 1487129: ("Resource leaks") Reviewed-by: Aric Cyr Acked-by: Mikita Lipski Signed-off-by: Anson Jacob Signed-off-by: Alex Deucher commit 40a72c6472c52ce765d5c57ab053083c8cbcc3c9 Author: James Clark Date: Tue Aug 31 15:55:01 2021 +0100 perf tools: Fix LLVM download hint link http://llvm.org/apt returns 404, it has moved to https://apt.llvm.org/ Signed-off-by: James Clark Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20210831145501.2135754-3-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 792adb1aa97251c48da7035bf927920b611925c8 Author: James Clark Date: Tue Aug 31 15:55:00 2021 +0100 perf tools: Fix LLVM test failure when running in verbose mode A CI system might want to run all tests in verbose mode so that there is enough information to diagnose issues. This LLVM test is the only test that uses "-v" to signify to not skip the test if the preconditions aren't met (LLVM isn't installed). This means that running the test in verbose mode without LLVM installed causes a test failure. For consistency with the other tests, remove this verbose/skip check. An alternate solution would be to make _all_ tests not skip when run in verbose mode, but I don't think that would be intuitive. Also change the search_program() call to search_program_and_warn(). Previously the hint about installing LLVM was only printed by the actual test because this check was skipped in verbose mode. To maintain the old behaviour, the precondition check must also print the full warning. Previous output: $ ./perf test llvm 40: LLVM search and compile : 40.1: Basic BPF llvm compile : Skip $ ./perf test -v llvm 40: LLVM search and compile : 40.1: Basic BPF llvm compile : --- start --- test child forked, pid 2085835 ERROR: unable to find clang. Hint: Try to install latest clang/llvm to support BPF. Check your $PATH ... test child finished with -1 ---- end ---- LLVM search and compile subtest 1: FAILED! New output (non verbose mode is identical, verbose changes from fail to skip): $ ./perf test llvm 40: LLVM search and compile : 40.1: Basic BPF llvm compile : Skip $ ./perf test -v llvm 40: LLVM search and compile : 40.1: Basic BPF llvm compile : --- start --- test child forked, pid 2087680 ERROR: unable to find clang. Hint: Try to install latest clang/llvm to support BPF. Check your $PATH ... No clang, skip this test test child finished with -2 ---- end ---- LLVM search and compile subtest 1: Skip Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20210831145501.2135754-2-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit a8a2d5c0b33ed32e6056f197e065cd1800b21948 Author: James Clark Date: Tue Aug 31 15:54:59 2021 +0100 perf tools: Refactor LLVM test warning for missing binary The same warning is duplicated in two places so refactor it into a single function "search_program_and_warn". This will be used a third time in a later commit. Signed-off-by: James Clark Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: clang-built-linux@googlegroups.com Link: http://lore.kernel.org/lkml/20210831145501.2135754-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 0ee7c3e25d8c28845fceb4dd1c3cb5f50b9c45a9 Merge: 916d636e0a2df 03b8df8d43ecc Author: Linus Torvalds Date: Tue Aug 31 11:13:35 2021 -0700 Merge tag 'iomap-5.15-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "The most notable externally visible change for this cycle is the addition of support for reads to inline tail fragments of files, which was requested by the erofs developers; and a correction for a kernel memory corruption bug if the sysadmin tries to activate a swapfile with more pages than the swapfile header suggests. We also now report writeback completion errors to the file mapping correctly, instead of munging all errors into EIO. Internally, the bulk of the changes are Christoph's patchset to reduce the indirect function call count by a third to a half by converting iomap iteration from a loop pattern to a generator/consumer pattern. As an added bonus, fsdax no longer open-codes iomap apply loops. Summary: - Simplify the bio_end_page usage in the buffered IO code. - Support reading inline data at nonzero offsets for erofs. - Fix some typos and bad grammar. - Convert kmap_atomic usage in the inline data read path. - Add some extra inline data input checking. - Fix a memory corruption bug stemming from iomap_swapfile_activate trying to activate more pages than mm was expecting. - Pass errnos through the page writeback code so that writeback errors are reported correctly instead of being munged to EIO. - Replace iomap_apply with a open-coded iterator loops to reduce the number of indirect calls by a third to a half. - Refactor the fsdax code to use iomap iterators instead of the open-coded iomap_apply code that it had before. - Format file range iomap tracepoint data in hexadecimal and standardize the names used in the pretty-print string" * tag 'iomap-5.15-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (41 commits) iomap: standardize tracepoint formatting and storage mm/swap: consider max pages in iomap_swapfile_add_extent iomap: move loop control code to iter.c iomap: constify iomap_iter_srcmap fsdax: switch the fault handlers to use iomap_iter fsdax: factor out a dax_fault_actor() helper fsdax: factor out helpers to simplify the dax fault code iomap: rework unshare flag iomap: pass an iomap_iter to various buffered I/O helpers iomap: remove iomap_apply fsdax: switch dax_iomap_rw to use iomap_iter iomap: switch iomap_swapfile_activate to use iomap_iter iomap: switch iomap_seek_data to use iomap_iter iomap: switch iomap_seek_hole to use iomap_iter iomap: switch iomap_bmap to use iomap_iter iomap: switch iomap_fiemap to use iomap_iter iomap: switch __iomap_dio_rw to use iomap_iter iomap: switch iomap_page_mkwrite to use iomap_iter iomap: switch iomap_zero_range to use iomap_iter iomap: switch iomap_file_unshare to use iomap_iter ... commit 474b3f2882b21180a23672a1f80b0591b2bed039 Author: Leo Yan Date: Sun Aug 29 18:22:38 2021 +0800 perf auxtrace arm: Support compat_auxtrace_mmap__{read_head|write_tail} When the tool runs with compat mode on Arm platform, the kernel is in 64-bit mode and user space is in 32-bit mode; the user space can use instructions "ldrd" and "strd" for 64-bit value atomicity. This patch adds compat_auxtrace_mmap__{read_head|write_tail} for arm building, it uses "ldrd" and "strd" instructions to ensure accessing atomicity for aux head and tail. The file arch/arm/util/auxtrace.c is built for arm and arm64 building, these two functions are not needed for arm64, so check the compiler macro "__arm__" to only include them for arm building. Signed-off-by: Leo Yan Reviewed-by: James Clark Tested-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: "Russell King (oracle)" Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20210829102238.19693-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit bbc49f1202030d8563140f307af3ab541d649bd3 Author: Leo Yan Date: Sun Aug 29 18:22:37 2021 +0800 perf auxtrace: Add compat_auxtrace_mmap__{read_head|write_tail} When perf runs in compat mode (kernel in 64-bit mode and the perf is in 32-bit mode), the 64-bit value atomicity in the user space cannot be assured, E.g. on some architectures, the 64-bit value accessing is split into two instructions, one is for the low 32-bit word accessing and another is for the high 32-bit word. This patch introduces weak functions compat_auxtrace_mmap__read_head() and compat_auxtrace_mmap__write_tail(), as their naming indicates, when perf tool works in compat mode, it uses these two functions to access the AUX head and tail. These two functions can allow the perf tool to work properly in certain conditions, e.g. when perf tool works in snapshot mode with only using AUX head pointer, or perf tool uses the AUX buffer and the incremented tail is not bigger than 4GB. When perf tool cannot handle the case when the AUX tail is bigger than 4GB, the function compat_auxtrace_mmap__write_tail() returns -1 and tells the caller to bail out for the error. These two functions are declared as weak attribute, this allows to implement arch specific functions if any arch can support the 64-bit value atomicity in compat mode. Suggested-by: Adrian Hunter Signed-off-by: Leo Yan Acked-by: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: "Russell King (oracle)" Cc: Suzuki Poulouse Cc: Will Deacon Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20210829102238.19693-2-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 298105b78b0ede160c2b94293b86d4ba4e936ad5 Author: Ian Rogers Date: Thu Aug 26 11:48:33 2021 -0700 perf bpf: Fix memory leaks relating to BTF. BTF needs to be freed with btf__free(). Signed-off-by: Ian Rogers Reviewed-by: Kajol Jain Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210826184833.408563-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 760f5e77e662e0141bd46ade28d72fc884ca64d9 Author: Joshua Martinez Date: Tue Aug 24 13:58:29 2021 -0700 perf data: Correct -h output There is currently only 1 'perf data' command, but supporting extra commands was breaking the help output. Simplify for now so that the help output is correct. Before: $ perf data -h Usage: perf data [] [] $ perf data Usage: perf data [] [] Available commands: convert - converts data file between formats After: $ perf data Usage: perf data convert [] -f, --force don't complain, do it -i, --input input file name -v, --verbose be more verbose --all Convert all events --to-ctf ... Convert to CTF format --to-json ... Convert to JSON format --tod Convert time to wall clock time $ perf data -h Usage: perf data convert [] -f, --force don't complain, do it -i, --input input file name -v, --verbose be more verbose --all Convert all events --to-ctf ... Convert to CTF format --to-json ... Convert to JSON format --tod Convert time to wall clock time Signed-off-by: Joshua Martinez Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20210824205829.52822-1-irogers@google.com Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit cb5a2ebbf15b87728bf1b47a12a44bdcc9a80313 Author: Colin Ian King Date: Thu Aug 26 13:18:01 2021 +0100 perf header: Fix spelling mistake "cant'" -> "can't" There is a spelling mistake in a warning message. Fix it. Signed-off-by: Colin King Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: kernel-janitors@vger.kernel.org Link: http://lore.kernel.org/lkml/20210826121801.13281-1-colin.king@canonical.com Signed-off-by: Arnaldo Carvalho de Melo commit e807ffe6692bd545a2529a5c0ff6b0078b79a491 Author: Arnaldo Carvalho de Melo Date: Mon Aug 30 18:20:11 2021 -0300 perf dlfilters: Fix build on environments with a --sysroot gcc arg Such as cross building on Android, so just add EXTRA_CFLAGS to the dlfilters rules as it is where --sysroot= has been specified. Acked-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lore.kernel.org/lkml/YS1JwIMTNNWcbGdT@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 916d636e0a2df48be48b573d8ec9070408d7681f Merge: 8bda95577627d d03ef4daf33a3 Author: Linus Torvalds Date: Tue Aug 31 11:06:32 2021 -0700 Merge tag 'vfs-5.15-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull project quota update from Darrick Wong: "A single VFS patch that prevents userspace from setting project quota ids on files that the VFS considers invalid" * tag 'vfs-5.15-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: fs: forbid invalid project ID commit 8bda95577627dc0633c48d581ea3605c27efe829 Merge: 4529fb1546b9c 0bcc7ca40bd82 Author: Linus Torvalds Date: Tue Aug 31 10:57:06 2021 -0700 Merge tag 'nfsd-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "New features: - Support for server-side disconnect injection via debugfs - Protocol definitions for new RPC_AUTH_TLS authentication flavor Performance improvements: - Reduce page allocator traffic in the NFSD splice read actor - Reduce CPU utilization in svcrdma's Send completion handler Notable bug fixes: - Stabilize lockd operation when re-exporting NFS mounts - Fix the use of %.*s in NFSD tracepoints - Fix /proc/sys/fs/nfs/nsm_use_hostnames" * tag 'nfsd-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (31 commits) nfsd: fix crash on LOCKT on reexported NFSv3 nfs: don't allow reexport reclaims lockd: don't attempt blocking locks on nfs reexports nfs: don't atempt blocking locks on nfs reexports Keep read and write fds with each nlm_file lockd: update nlm_lookup_file reexport comment nlm: minor refactoring nlm: minor nlm_lookup_file argument change lockd: lockd server-side shouldn't set fl_ops SUNRPC: Add documentation for the fail_sunrpc/ directory SUNRPC: Server-side disconnect injection SUNRPC: Move client-side disconnect injection SUNRPC: Add a /sys/kernel/debug/fail_sunrpc/ directory svcrdma: xpt_bc_xprt is already clear in __svc_rdma_free() nfsd4: Fix forced-expiry locking rpc: fix gss_svc_init cleanup on failure SUNRPC: Add RPC_AUTH_TLS protocol numbers lockd: change the proc_handler for nsm_use_hostnames sysctl: introduce new proc handler proc_dobool SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() ... commit b8ce1b9d25ccf81e1bbabd45b963ed98b2222df8 Author: Pavel Begunkov Date: Tue Aug 31 14:13:11 2021 +0100 io_uring: don't submit half-prepared drain request [ 3784.910888] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 3784.910904] RIP: 0010:__io_file_supports_nowait+0x5/0xc0 [ 3784.910926] Call Trace: [ 3784.910928] ? io_read+0x17c/0x480 [ 3784.910945] io_issue_sqe+0xcb/0x1840 [ 3784.910953] __io_queue_sqe+0x44/0x300 [ 3784.910959] io_req_task_submit+0x27/0x70 [ 3784.910962] tctx_task_work+0xeb/0x1d0 [ 3784.910966] task_work_run+0x61/0xa0 [ 3784.910968] io_run_task_work_sig+0x53/0xa0 [ 3784.910975] __x64_sys_io_uring_enter+0x22/0x30 [ 3784.910977] do_syscall_64+0x3d/0x90 [ 3784.910981] entry_SYSCALL_64_after_hwframe+0x44/0xae io_drain_req() goes before checks for REQ_F_FAIL, which protect us from submitting under-prepared request (e.g. failed in io_init_req(). Fail such drained requests as well. Fixes: a8295b982c46d ("io_uring: fix failed linkchain code logic") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e411eb9924d47a131b1e200b26b675df0c2b7627.1630415423.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit c6d3d9cbd659de8f2176b4e4721149c88ac096d4 Author: Pavel Begunkov Date: Tue Aug 31 14:13:10 2021 +0100 io_uring: fix queueing half-created requests [ 27.259845] general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI [ 27.261043] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 27.263730] RIP: 0010:sock_from_file+0x20/0x90 [ 27.272444] Call Trace: [ 27.272736] io_sendmsg+0x98/0x600 [ 27.279216] io_issue_sqe+0x498/0x68d0 [ 27.281142] __io_queue_sqe+0xab/0xb50 [ 27.285830] io_req_task_submit+0xbf/0x1b0 [ 27.286306] tctx_task_work+0x178/0xad0 [ 27.288211] task_work_run+0xe2/0x190 [ 27.288571] exit_to_user_mode_prepare+0x1a1/0x1b0 [ 27.289041] syscall_exit_to_user_mode+0x19/0x50 [ 27.289521] do_syscall_64+0x48/0x90 [ 27.289871] entry_SYSCALL_64_after_hwframe+0x44/0xae io_req_complete_failed() -> io_req_complete_post() -> io_req_task_queue() still would try to enqueue hard linked request, which can be half prepared (e.g. failed init), so we can't allow that to happen. Fixes: a8295b982c46d ("io_uring: fix failed linkchain code logic") Reported-by: syzbot+f9704d1878e290eddf73@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/70b513848c1000f88bd75965504649c6bb1415c0.1630415423.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 08bdbd39b58474d762242e1fadb7f2eb9ffcca71 Author: Jens Axboe Date: Tue Aug 31 06:57:25 2021 -0600 io-wq: ensure that hash wait lock is IRQ disabling A previous commit removed the IRQ safety of the worker and wqe locks, but that left one spot of the hash wait lock now being done without already having IRQs disabled. Ensure that we use the right locking variant for the hashed waitqueue lock. Fixes: a9a4aa9fbfc5 ("io-wq: wqe and worker locks no longer need to be IRQ safe") Signed-off-by: Jens Axboe commit 7db304375e11741e5940f9bc549155035bfb4dc1 Author: Ming Lei Date: Sat Aug 21 23:07:51 2021 +0800 io_uring: retry in case of short read on block device In case of buffered reading from block device, when short read happens, we should retry to read more, otherwise the IO will be completed partially, for example, the following fio expects to read 2MB, but it can only read 1M or less bytes: fio --name=onessd --filename=/dev/nvme0n1 --filesize=2M \ --rw=randread --bs=2M --direct=0 --overwrite=0 --numjobs=1 \ --iodepth=1 --time_based=0 --runtime=2 --ioengine=io_uring \ --registerfiles --fixedbufs --gtod_reduce=1 --group_reporting Fix the issue by allowing short read retry for block device, which sets FMODE_BUF_RASYNC really. Fixes: 9a173346bd9e ("io_uring: fix short read retries for non-reg files") Cc: Pavel Begunkov Signed-off-by: Ming Lei Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20210821150751.1290434-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 7b3188e7ed54102a5dcc73d07727f41fb528f7c8 Author: Jens Axboe Date: Mon Aug 30 19:37:41 2021 -0600 io_uring: IORING_OP_WRITE needs hash_reg_file set During some testing, it became evident that using IORING_OP_WRITE doesn't hash buffered writes like the other writes commands do. That's simply an oversight, and can cause performance regressions when doing buffered writes with this command. Correct that and add the flag, so that buffered writes are correctly hashed when using the non-iovec based write command. Cc: stable@vger.kernel.org Fixes: 3a6820f2bb8a ("io_uring: add non-vectored read/write commands") Signed-off-by: Jens Axboe commit 94ffb0a282872c2f4b14f757fa1aef2302aeaabb Author: Jens Axboe Date: Mon Aug 30 11:55:22 2021 -0600 io-wq: fix race between adding work and activating a free worker The attempt to find and activate a free worker for new work is currently combined with creating a new one if we don't find one, but that opens io-wq up to a race where the worker that is found and activated can put itself to sleep without knowing that it has been selected to perform this new work. Fix this by moving the activation into where we add the new work item, then we can retain it within the wqe->lock scope and elimiate the race with the worker itself checking inside the lock, but sleeping outside of it. Cc: stable@vger.kernel.org Reported-by: Andres Freund Signed-off-by: Jens Axboe commit 4529fb1546b9cd3f5dbd8a36595aa4159331c963 Merge: cd358208d703f 08d736667185d Author: Linus Torvalds Date: Tue Aug 31 10:20:14 2021 -0700 Merge tag 'gfs2-v5.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Various withdraw related fixes (freeze glock recursion, thread initialization / destruction order, journal recovery, glock cleanup, withdraw under journal lock). - Some error message improvements. - Various minor cleanups. * tag 'gfs2-v5.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Remove redundant check from gfs2_glock_dq gfs2: Delay withdraw from atomic context gfs2: Don't call dlm after protocol is unmounted gfs2: don't stop reads while withdraw in progress gfs2: Mark journal inodes as "don't cache" gfs2: nit: gfs2_drop_inode shouldn't return bool gfs2: Eliminate vestigial HIF_FIRST gfs2: Make recovery error more readable gfs2: Don't release and reacquire local statfs bh gfs2: init system threads before freeze lock gfs2: tiny cleanup in gfs2_log_reserve gfs2: trivial clean up of gfs2_ail_error gfs2: be more verbose replaying invalid rgrp blocks gfs2: Fix glock recursion in freeze_go_xmote_bh gfs2: Fix memory leak of object lsi on error return path commit cd358208d703fca446b52f3cf8f23c18f9e7705e Merge: 87045e6546078 38ef66b05cfa3 Author: Linus Torvalds Date: Tue Aug 31 10:01:14 2021 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fscrypt updates from Eric Biggers: "Some small fixes and cleanups for fs/crypto/: - Fix ->getattr() for ext4, f2fs, and ubifs to report the correct st_size for encrypted symlinks - Use base64url instead of a custom Base64 variant - Document struct fscrypt_operations" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fscrypt: document struct fscrypt_operations fscrypt: align Base64 encoding with RFC 4648 base64url fscrypt: remove mention of symlink st_size quirk from documentation ubifs: report correct st_size for encrypted symlinks f2fs: report correct st_size for encrypted symlinks ext4: report correct st_size for encrypted symlinks fscrypt: add fscrypt_symlink_getattr() for computing st_size commit 67d6d80d90fb27b3cc7659f464fa3b87fd67bc14 Author: Li Zhijian Date: Tue Aug 31 18:23:16 2021 +0800 selftests/cpufreq: Rename DEBUG_PI_LIST to DEBUG_PLIST DEBUG_PI_LIST was renamed to DEBUG_PLIST since 8e18faeac3 ("lib/plist: rename DEBUG_PI_LIST to DEBUG_PLIST") - It's not reasonable to keep the deprecated configs. - configs under kselftests are recommended by corresponding tests. So if some configs are missing, it will impact the testing results CC: "Rafael J. Wysocki" CC: Viresh Kumar CC: linux-pm@vger.kernel.org Signed-off-by: Li Zhijian Acked-by: Viresh Kumar Signed-off-by: Shuah Khan commit 00712d01820fcc34052090eff41516c1e7f57382 Author: Li Zhijian Date: Tue Aug 31 18:23:15 2021 +0800 selftests/sync: Remove the deprecated config SYNC SYNC was removed since aff9da10e21 ("staging/android: make sync_timeline internal to sw_sync") LKP/0Day will check if all configs listing under selftests are able to be enabled properly. For the missing configs, it will report something like: LKP WARN miss config CONFIG_SYNC= of sync/config - it's not reasonable to keep the deprecated configs. - configs under kselftests are recommended by corresponding tests. So if some configs are missing, it will impact the testing results CC: Philip Li Reported-by: kernel test robot Signed-off-by: Li Zhijian Signed-off-by: Shuah Khan commit 87045e6546078dae215d1bd3b2bc82b3ada3ca77 Merge: 9c849ce86e0fa 0d977e0eba234 Author: Linus Torvalds Date: Tue Aug 31 09:41:22 2021 -0700 Merge tag 'for-5.15-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "The highlights of this round are integrations with fs-verity and idmapped mounts, the rest is usual mix of minor improvements, speedups and cleanups. There are some patches outside of btrfs, namely updating some VFS interfaces, all straightforward and acked. Features: - fs-verity support, using standard ioctls, backward compatible with read-only limitation on inodes with previously enabled fs-verity - idmapped mount support - make mount with rescue=ibadroots more tolerant to partially damaged trees - allow raid0 on a single device and raid10 on two devices, degenerate cases but might be useful as an intermediate step during conversion to other profiles - zoned mode block group auto reclaim can be disabled via sysfs knob Performance improvements: - continue readahead of node siblings even if target node is in memory, could speed up full send (on sample test +11%) - batching of delayed items can speed up creating many files - fsync/tree-log speedups - avoid unnecessary work (gains +2% throughput, -2% run time on sample load) - reduced lock contention on renames (on dbench +4% throughput, up to -30% latency) Fixes: - various zoned mode fixes - preemptive flushing threshold tuning, avoid excessive work on almost full filesystems Core: - continued subpage support, preparation for implementing remaining features like compression and defragmentation; with some limitations, write is now enabled on 64K page systems with 4K sectors, still considered experimental - no readahead on compressed reads - inline extents disabled - disabled raid56 profile conversion and mount - improved flushing logic, fixing early ENOSPC on some workloads - inode flags have been internally split to read-only and read-write incompat bit parts, used by fs-verity - new tree items for fs-verity - descriptor item - Merkle tree item - inode operations extended to be namespace-aware - cleanups and refactoring Generic code changes: - fs: new export filemap_fdatawrite_wbc - fs: removed sync_inode - block: bio_trim argument type fixups - vfs: add namespace-aware lookup" * tag 'for-5.15-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (114 commits) btrfs: reset replace target device to allocation state on close btrfs: zoned: fix ordered extent boundary calculation btrfs: do not do preemptive flushing if the majority is global rsv btrfs: reduce the preemptive flushing threshold to 90% btrfs: tree-log: check btrfs_lookup_data_extent return value btrfs: avoid unnecessarily logging directories that had no changes btrfs: allow idmapped mount btrfs: handle ACLs on idmapped mounts btrfs: allow idmapped INO_LOOKUP_USER ioctl btrfs: allow idmapped SUBVOL_SETFLAGS ioctl btrfs: allow idmapped SET_RECEIVED_SUBVOL ioctls btrfs: relax restrictions for SNAP_DESTROY_V2 with subvolids btrfs: allow idmapped SNAP_DESTROY ioctls btrfs: allow idmapped SNAP_CREATE/SUBVOL_CREATE ioctls btrfs: check whether fsgid/fsuid are mapped during subvolume creation btrfs: allow idmapped permission inode op btrfs: allow idmapped setattr inode op btrfs: allow idmapped tmpfile inode op btrfs: allow idmapped symlink inode op btrfs: allow idmapped mkdir inode op ... commit 9c849ce86e0fa93a218614eac562ace44053d7ce Merge: e24c567b7ecff 3998f0b8bc49e Author: Linus Torvalds Date: Tue Aug 31 09:22:37 2021 -0700 Merge tag '5.15-rc-smb3-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client updates from Steve French: "Eleven cifs/smb3 client fixes: - mostly restructuring to allow disabling less secure algorithms (this will allow eventual removing rc4 and md4 from general use in the kernel) - four fixes, including two for stable - enable r/w support with fscache and cifs.ko I am working on a larger set of changes (the usual ... multichannel, auth and signing improvements), but wanted to get these in earlier to reduce chance of merge conflicts later in the merge window" * tag '5.15-rc-smb3-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED cifs: add cifs_common directory to MAINTAINERS file cifs: cifs_md4 convert to SPDX identifier cifs: create a MD4 module and switch cifs.ko to use it cifs: fork arc4 and create a separate module for it for cifs and other users cifs: remove support for NTLM and weaker authentication algorithms cifs: enable fscache usage even for files opened as rw oid_registry: Add OIDs for missing Spnego auth mechanisms to Macs smb3: fix posix extensions mount option cifs: fix wrong release in sess_alloc_buffer() failed path CIFS: Fix a potencially linear read overflow commit 11a427be2c4749954e8b868ef5301dc65ca5a14b Author: Dan Carpenter Date: Fri Aug 27 11:54:10 2021 +0300 dmaengine: sh: fix some NULL dereferences The dma_free_coherent() function needs a valid device pointer or it will crash. Fixes: 550c591a89a1 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210827085410.GA9183@kili Signed-off-by: Vinod Koul commit 1e008336b9f590eb749ac96ccef4ea0301f79619 Author: Colin Ian King Date: Sun Aug 29 16:28:11 2021 +0100 dmaengine: sh: Fix unused initialization of pointer lmdesc Pointer lmdesc is being inintialized with a value that is never read, it is later being re-assigned a new value. Fix this by initializing it with the latter value. Addresses-Coverity: ("Unused value") Fixes: 550c591a89a1 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210829152811.529766-1-colin.king@canonical.com Signed-off-by: Vinod Koul commit 8f031494df0e5bed90f262c138f592535946910d Author: Geert Uytterhoeven Date: Tue Aug 31 14:42:21 2021 +0200 MAINTAINERS: Fix AMD PTDMA DRIVER entry Remove the bogus leading plus signs from the entry for the AMD PTDMA driver. Fixes: fa5d823b16a9442d ("dmaengine: ptdma: Initial driver for the AMD PTDMA") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/28b7663ebcaf9363324a615129417b24625a7038.1630413650.git.geert+renesas@glider.be Signed-off-by: Vinod Koul commit e24c567b7ecff1c8b6023a10d7f78256cef742c4 Merge: b91db6a0b52e0 7d5d8d7156892 Author: Linus Torvalds Date: Tue Aug 31 09:11:55 2021 -0700 Merge tag '5.15-rc-first-ksmbd-merge' of git://git.samba.org/ksmbd Pull initial ksmbd implementation from Steve French: "Initial merge of kernel smb3 file server, ksmbd. The SMB family of protocols is the most widely deployed network filesystem protocol, the default on Windows and Macs (and even on many phones and tablets), with clients and servers on all major operating systems, but lacked a kernel server for Linux. For many cases the current userspace server choices were suboptimal either due to memory footprint, performance or difficulty integrating well with advanced Linux features. ksmbd is a new kernel module which implements the server-side of the SMB3 protocol. The target is to provide optimized performance, GPLv2 SMB server, and better lease handling (distributed caching). The bigger goal is to add new features more rapidly (e.g. RDMA aka "smbdirect", and recent encryption and signing improvements to the protocol) which are easier to develop on a smaller, more tightly optimized kernel server than for example in Samba. The Samba project is much broader in scope (tools, security services, LDAP, Active Directory Domain Controller, and a cross platform file server for a wider variety of purposes) but the user space file server portion of Samba has proved hard to optimize for some Linux workloads, including for smaller devices. This is not meant to replace Samba, but rather be an extension to allow better optimizing for Linux, and will continue to integrate well with Samba user space tools and libraries where appropriate. Working with the Samba team we have already made sure that the configuration files and xattrs are in a compatible format between the kernel and user space server. Various types of functional and regression tests are regularly run against it. One example is the automated 'buildbot' regression tests which use the Linux client to test against ksmbd, e.g. http://smb3-test-rhel-75.southcentralus.cloudapp.azure.com/#/builders/8/builds/56 but other test suites, including Samba's smbtorture functional test suite are also used regularly" * tag '5.15-rc-first-ksmbd-merge' of git://git.samba.org/ksmbd: (219 commits) ksmbd: fix __write_overflow warning in ndr_read_string MAINTAINERS: ksmbd: add cifs_common directory to ksmbd entry MAINTAINERS: ksmbd: update my email address ksmbd: fix permission check issue on chown and chmod ksmbd: don't set FILE DELETE and FILE_DELETE_CHILD in access mask by default MAINTAINERS: add git adddress of ksmbd ksmbd: update SMB3 multi-channel support in ksmbd.rst ksmbd: smbd: fix kernel oops during server shutdown ksmbd: remove select FS_POSIX_ACL in Kconfig ksmbd: use proper errno instead of -1 in smb2_get_ksmbd_tcon() ksmbd: update the comment for smb2_get_ksmbd_tcon() ksmbd: change int data type to boolean ksmbd: Fix multi-protocol negotiation ksmbd: fix an oops in error handling in smb2_open() ksmbd: add ipv6_addr_v4mapped check to know if connection from client is ipv4 ksmbd: fix missing error code in smb2_lock ksmbd: use channel signingkey for binding SMB2 session setup ksmbd: don't set RSS capable in FSCTL_QUERY_NETWORK_INTERFACE_INFO ksmbd: Return STATUS_OBJECT_PATH_NOT_FOUND if smb2_creat() returns ENOENT ksmbd: fix -Wstringop-truncation warnings ... commit d3624466b56dd5b1886c1dff500525b544c19c83 Author: Konstantin Komarov Date: Tue Aug 31 16:57:40 2021 +0300 fs/ntfs3: Restyle comments to better align with kernel-doc Signed-off-by: Konstantin Komarov commit 78ab59fee07f22464f32eafebab2bd97ba94ff2d Author: Konstantin Komarov Date: Tue Aug 31 18:52:39 2021 +0300 fs/ntfs3: Rework file operations Rename now works "Add new name and remove old name". "Remove old name and add new name" may result in bad inode if we can't add new name and then can't restore (add) old name. Signed-off-by: Konstantin Komarov commit a97131c29c997e81b6fa1d1adf8f3ca07b63a2e1 Author: Kari Argillander Date: Tue Aug 24 21:20:20 2021 +0300 fs/ntfs3: Remove fat ioctl's from ntfs3 driver for now For some reason we have FAT ioctl calls. Even old ntfs driver did not use these. We should not use these because it his hard to get things out of kernel when they are upstream. That's why we remove these for now. More discussion is needed what ioctl should be implemented and what is important. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 29ce8f9701072fc221d9c38ad952de1a9578f95c Merge: c3496da580b0f 57f780f1c4336 Author: Jakub Kicinski Date: Tue Aug 31 09:06:04 2021 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net include/linux/netdevice.h net/socket.c d0efb16294d1 ("net: don't unconditionally copy_from_user a struct ifreq for socket ioctls") 876f0bf9d0d5 ("net: socket: simplify dev_ifconf handling") 29c4964822aa ("net: socket: rework compat_ifreq_ioctl()") Signed-off-by: Jakub Kicinski commit c3496da580b0fc10fdeba8f6a5e6aef4c78b5598 Author: Slark Xiao Date: Tue Aug 31 10:40:25 2021 +0800 net: Add depends on OF_NET for LiteX's LiteETH Current settings may produce a build error when CONFIG_OF_NET is disabled. The CONFIG_OF_NET controls a headfile and some functions in . Signed-off-by: Slark Xiao Signed-off-by: Jakub Kicinski commit b1e202503508d5b66bf1532bea36b5776b00d869 Author: Zenghui Yu Date: Tue Aug 31 11:49:24 2021 +0800 dt-bindings: display: remove zte,vou.txt binding doc The zte zx platform was removed in commit 89d4f98ae90d ("ARM: remove zte zx platform") and the zxdrm driver is going to be removed in v5.15 via drm tree. Let's remove the now obsolete binding doc. Cc: Arnd Bergmann Cc: Jun Nie Cc: Shawn Guo Signed-off-by: Zenghui Yu Link: https://lore.kernel.org/r/20210831034924.86-1-yuzenghui@huawei.com Signed-off-by: Rob Herring commit 785b66427ee173609670876ea9c9d3eb35d8f3dc Author: Krzysztof Kozlowski Date: Thu Aug 19 20:25:43 2021 +0200 dt-bindings: hwmon: merge max1619 into trivial devices Ther Maxim max1619 bindings are trivial, so simply merge it into trivial-devices.yaml. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210819182544.224121-1-krzysztof.kozlowski@canonical.com Signed-off-by: Rob Herring commit c47cbd4f565983c4f9c415ffc41d0e45c845b4ef Author: Rob Herring Date: Thu Aug 19 13:24:27 2021 -0500 dt-bindings: mtd-physmap: Add 'arm,vexpress-flash' compatible The 'arm,vexpress-flash' compatible is in use, but has never been documented, so add it now. Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: linux-mtd@lists.infradead.org Signed-off-by: Rob Herring Acked-by: Miquel Raynal Link: https://lore.kernel.org/r/20210819182427.1175753-1-robh@kernel.org Signed-off-by: Rob Herring commit 1955d843efc3b5cf3ab4878986a87ad4972ff4e1 Author: Joel Stanley Date: Thu Aug 26 22:59:46 2021 +0930 openrisc/litex: Update defconfig Add the liteeth network device and basic network options, and update the options by doing a savedefconfig. Signed-off-by: Joel Stanley Signed-off-by: Stafford Horne commit 978c791491bce8cc1a27cb50392a2e8bbcea79d4 Author: Joel Stanley Date: Thu Aug 26 22:59:45 2021 +0930 openrisc/litex: Add ethernet device Add the liteeth ethernet device. Signed-off-by: Joel Stanley Signed-off-by: Stafford Horne commit 7851155a1a7c33f2270dcd979ab6532a89be5293 Author: Joel Stanley Date: Thu Aug 26 22:59:44 2021 +0930 openrisc/litex: Update uart address Recent litex socs will place the UART at 0xe0006800. Signed-off-by: Joel Stanley Signed-off-by: Stafford Horne commit 81912856e0fbc294deed595db568a7a00f962d95 Author: Sven Schnelle Date: Sat Aug 28 10:18:44 2021 +0200 s390/configs: enable CONFIG_KFENCE in debug_defconfig Signed-off-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 15256194eff64f9a774b33b7817ea663e352394a Author: Heiko Carstens Date: Fri Aug 27 13:45:14 2021 +0200 s390/entry: make oklabel within CHKSTG macro local Make the oklabel within the CHKSTG macro local. This makes sure that tools like objdump and the crash debugging tool still disassemble full functions where the macro has been used instead of stopping half way where such a global label is used and one has to guess how to disassemble the rest of such a function: E.g.: 0000000000cb0270 : cb0270: b2 05 03 20 stck 800 ... cb0354: a7 74 00 97 jne cb0482 0000000000cb0358 : cb0358: c0 e0 00 22 4e 8f larl %r14,10fa076 ... Fixes: d35925b34996 ("s390/mcck: move storage error checks to assembler") Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 436fc4feeabbf103d78d50a8e091b3aac28cc37f Author: Sven Schnelle Date: Fri Aug 27 08:36:06 2021 +0200 s390: add kmemleak annotation in stack_alloc() kmemleak with enabled auto scanning reports that our stack allocation is lost. This is because we're saving the pointer + STACK_INIT_OFFSET to lowcore. When kmemleak now scans the objects, it thinks that this one is lost because it can't find a corresponding pointer. Reported-by: Marc Hartmayer Signed-off-by: Sven Schnelle Tested-by: Marc Hartmayer Signed-off-by: Heiko Carstens commit 2297791c92d04a154ad29ba5a073f9f627982110 Author: Vineeth Vijayan Date: Sun Apr 25 10:41:59 2021 +0200 s390/cio: dont unregister subchannel from child-drivers The devices owned by the parent-driver (css) was getting unregistered from the io-subchannel driver is clearly a layering violation. Remove the subchannel unregistration from the child-drivers. This also means, if the device connected to the subchannel is not operational, or not accessible, the subchannel will not be unregistered. Instead the CIO layer will allow valid subchannels without any operational devices in sysfs. And the userspace tooling might need to be modified to optimally handle this new situation. Signed-off-by: Vineeth Vijayan Reviewed-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 59bda8ecee2ffc6a602b7bf2b9e43ca669cdbdcd Author: Miklos Szeredi Date: Tue Aug 31 14:18:08 2021 +0200 fuse: flush extending writes Callers of fuse_writeback_range() assume that the file is ready for modification by the server in the supplied byte range after the call returns. If there's a write that extends the file beyond the end of the supplied range, then the file needs to be extended to at least the end of the range, but currently that's not done. There are at least two cases where this can cause problems: - copy_file_range() will return short count if the file is not extended up to end of the source range. - FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE will not extend the file, hence the region may not be fully allocated. Fix by flushing writes from the start of the range up to the end of the file. This could be optimized if the writes are non-extending, etc, but it's probably not worth the trouble. Fixes: a2bc92362941 ("fuse: fix copy_file_range() in the writeback case") Fixes: 6b1bdb56b17c ("fuse: allow fallocate(FALLOC_FL_ZERO_RANGE)") Cc: # v5.2 Signed-off-by: Miklos Szeredi commit b2a6181e27c325f0e654b8d33e5fb621fc3db52b Merge: d0e936adbd225 f0712ace7fe07 Author: Rafael J. Wysocki Date: Tue Aug 31 14:02:16 2021 +0200 Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull ARM cpufreq driver changes for v5.15 from Viresh Kumar: "This contains: - Update cpufreq-dt blocklist with more platforms (Bjorn Andersson). - Allow freq changes from any CPU for qcom-hw driver (Taniya Das). - Add DSVS interrupt's support for qcom-hw driver (Thara Gopinath). - A new callback (->register_em()) to register EM at a more convenient point of time." * 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: qcom-hw: Set dvfs_possible_from_any_cpu cpufreq driver flag cpufreq: blocklist more Qualcomm platforms in cpufreq-dt-platdev cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support cpufreq: scmi: Use .register_em() to register with energy model cpufreq: vexpress: Use .register_em() to register with energy model cpufreq: scpi: Use .register_em() to register with energy model cpufreq: qcom-cpufreq-hw: Use .register_em() to register with energy model cpufreq: omap: Use .register_em() to register with energy model cpufreq: mediatek: Use .register_em() to register with energy model cpufreq: imx6q: Use .register_em() to register with energy model cpufreq: dt: Use .register_em() to register with energy model cpufreq: Add callback to register with energy model cpufreq: vexpress: Set CPUFREQ_IS_COOLING_DEV flag commit 2a3441f59464cfe5e7bdc99176142726f3a1e70e Merge: 1f8b66d9654b2 94274f20f6bf5 Author: Rafael J. Wysocki Date: Tue Aug 31 13:59:25 2021 +0200 Merge branch 'opp/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull operating performance points (OPP) framework changes for v5.15 from Viresh Kumar: "This moves the OPP bindings to DT schema (Rob Herring)." * 'opp/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: dt-bindings: opp: Convert to DT schema dt-bindings: Clean-up OPP binding node names in examples ARM: dts: omap: Drop references to opp.txt commit a9e7c3cedc2914f63cd135b75832b9bf850af782 Author: Lv Ruyi Date: Tue Aug 31 04:22:50 2021 -0700 ipv6: seg6: remove duplicated include Remove all but the first include of net/lwtunnel.h from 'seg6_local.c. Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Signed-off-by: David S. Miller commit 7f2d4b7ffa42565a41f0fd6aa147d84863bb088b Author: Hao Chen Date: Mon Aug 30 21:51:09 2021 +0800 net: hns3: remove unnecessary spaces This patch removes some unnecessary spaces for cleanup. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit c74e503572ea0dbfa6ef3449944a286354f9f9b4 Author: Hao Chen Date: Mon Aug 30 21:51:08 2021 +0800 net: hns3: add some required spaces Add some required spaces to improve readability. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e79c0e324b011b0288cd411a5b53870a7730f163 Author: Guojia Liao Date: Mon Aug 30 21:51:07 2021 +0800 net: hns3: clean up a type mismatch warning abs() returns signed long, which could not convert the type as unsigned, and it may cause a mismatch type warning from static tools. To fix it, this patch uses an variable to save the abs()'s result and does a explicit conversion. Signed-off-by: Guojia Liao Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit dc9b5ce03124cf86bac3bd714369a8387d6e2012 Author: Jian Shen Date: Mon Aug 30 21:51:06 2021 +0800 net: hns3: refine function hns3_set_default_feature() Currently, the driver sets default feature for netdev->features, netdev->hw_features, netdev->vlan_features and netdev->hw_enc_features separately. It's fussy, because most of the feature bits are same. So refine it by copy value from netdev->features. Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 53c622db99df0789ade7082d028bf4f3b6064c95 Author: Lv Ruyi Date: Tue Aug 31 02:09:06 2021 -0700 ipv6: remove duplicated 'net/lwtunnel.h' include Remove all but the first include of net/lwtunnel.h from seg6_iptunnel.c. Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Signed-off-by: David S. Miller commit a39ff4a47f3e1da3b036817ef436b1a9be10783a Author: Yang Yingliang Date: Tue Aug 31 16:40:18 2021 +0800 net: w5100: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit 464a57281f29afc202905b456b0cb8bc729b383a Author: Cai Huoqing Date: Tue Aug 31 16:02:31 2021 +0800 net/mlxbf_gige: Make use of devm_platform_ioremap_resourcexxx() Use the devm_platform_ioremap_resource_byname() helper instead of calling platform_get_resource_byname() and devm_ioremap_resource() separately Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately Signed-off-by: Cai Huoqing Signed-off-by: David S. Miller commit 672a1c39495023e7e4e03f946ec792c17704267d Author: Cai Huoqing Date: Tue Aug 31 15:58:18 2021 +0800 net: mdio: mscc-miim: Make use of the helper function devm_platform_ioremap_resource() Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately Signed-off-by: Cai Huoqing Signed-off-by: David S. Miller commit fa14d03e014a130839f9dc1b97ea61fe598d873d Author: Cai Huoqing Date: Tue Aug 31 15:56:58 2021 +0800 net: mdio-ipq4019: Make use of devm_platform_ioremap_resource() Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately Signed-off-by: Cai Huoqing Signed-off-by: David S. Miller commit 8d65cd8d25fa23951171094553901d69a88ccdff Author: Eric Dumazet Date: Mon Aug 30 20:26:08 2021 -0700 fou: remove sparse errors We need to add __rcu qualifier to avoid these errors: net/ipv4/fou.c:250:18: warning: incorrect type in assignment (different address spaces) net/ipv4/fou.c:250:18: expected struct net_offload const **offloads net/ipv4/fou.c:250:18: got struct net_offload const [noderef] __rcu ** net/ipv4/fou.c:251:15: error: incompatible types in comparison expression (different address spaces): net/ipv4/fou.c:251:15: struct net_offload const [noderef] __rcu * net/ipv4/fou.c:251:15: struct net_offload const * net/ipv4/fou.c:272:18: warning: incorrect type in assignment (different address spaces) net/ipv4/fou.c:272:18: expected struct net_offload const **offloads net/ipv4/fou.c:272:18: got struct net_offload const [noderef] __rcu ** net/ipv4/fou.c:273:15: error: incompatible types in comparison expression (different address spaces): net/ipv4/fou.c:273:15: struct net_offload const [noderef] __rcu * net/ipv4/fou.c:273:15: struct net_offload const * net/ipv4/fou.c:442:18: warning: incorrect type in assignment (different address spaces) net/ipv4/fou.c:442:18: expected struct net_offload const **offloads net/ipv4/fou.c:442:18: got struct net_offload const [noderef] __rcu ** net/ipv4/fou.c:443:15: error: incompatible types in comparison expression (different address spaces): net/ipv4/fou.c:443:15: struct net_offload const [noderef] __rcu * net/ipv4/fou.c:443:15: struct net_offload const * net/ipv4/fou.c:489:18: warning: incorrect type in assignment (different address spaces) net/ipv4/fou.c:489:18: expected struct net_offload const **offloads net/ipv4/fou.c:489:18: got struct net_offload const [noderef] __rcu ** net/ipv4/fou.c:490:15: error: incompatible types in comparison expression (different address spaces): net/ipv4/fou.c:490:15: struct net_offload const [noderef] __rcu * net/ipv4/fou.c:490:15: struct net_offload const * net/ipv4/udp_offload.c:170:26: warning: incorrect type in assignment (different address spaces) net/ipv4/udp_offload.c:170:26: expected struct net_offload const **offloads net/ipv4/udp_offload.c:170:26: got struct net_offload const [noderef] __rcu ** net/ipv4/udp_offload.c:171:23: error: incompatible types in comparison expression (different address spaces): net/ipv4/udp_offload.c:171:23: struct net_offload const [noderef] __rcu * net/ipv4/udp_offload.c:171:23: struct net_offload const * Fixes: efc98d08e1ec ("fou: eliminate IPv4,v6 specific GRO functions") Fixes: 8bce6d7d0d1e ("udp: Generalize skb_udp_segment") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 92548b0ee220e000d81c27ac9a80e0ede895a881 Author: Eric Dumazet Date: Mon Aug 30 19:02:10 2021 -0700 ipv4: fix endianness issue in inet_rtm_getroute_build_skb() The UDP length field should be in network order. This removes the following sparse error: net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types) net/ipv4/route.c:3173:27: expected restricted __be16 [usertype] len net/ipv4/route.c:3173:27: got unsigned long Fixes: 404eb77ea766 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE") Signed-off-by: Eric Dumazet Cc: Roopa Prabhu Cc: David Ahern Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 616920a6a567e2fc5b9437b84703de717bb7295e Merge: dc56ad7028c5f 1e4428b6dba9b Author: David S. Miller Date: Tue Aug 31 11:35:26 2021 +0100 Merge branch 'octeon-npc-fixes' Subbaraya Sundeep says: ==================== octeontx2-af: Miscellaneous fixes in npc This patchset consists of consolidated fixes in rvu_npc file. Two of the patches prevent infinite loop which can happen in corner cases. One patch is for fixing static code analyzer reported issues. And the last patch is a minor change in npc protocol checker hardware block to report ipv4 checksum errors as a known error codes. ==================== Signed-off-by: David S. Miller commit 1e4428b6dba9b683dc2ec0a56ed7879de3200cce Author: Sunil Goutham Date: Mon Aug 30 23:30:46 2021 +0530 octeontx2-af: Set proper errorcode for IPv4 checksum errors With current config, for packets with IPv4 checksum errors, errorcode is being set to UNKNOWN. Hence added a separate errorcodes for outer and inner IPv4 checksum and changed NPC configuration accordingly. Also turn on L2 multicast address check in NPC protocol check block. Fixes: 6b3321bacc5a ("octeontx2-af: Enable packet length and csum validation") Signed-off-by: Sunil Goutham Signed-off-by: Subbaraya Sundeep Signed-off-by: David S. Miller commit 698a82ebfb4b2f2014baf31b7324b328a2a6366e Author: Subbaraya Sundeep Date: Mon Aug 30 23:30:45 2021 +0530 octeontx2-af: Fix static code analyzer reported issues This patch fixes the static code analyzer reported issues in rvu_npc.c. The reported errors are different sizes of operands in bitops and returning uninitialized values. Fixes: 651cd2652339 ("octeontx2-af: MCAM entry installation support") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit f2e4568ec95166605c77577953b2787c7f909978 Author: Subbaraya Sundeep Date: Mon Aug 30 23:30:44 2021 +0530 octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg In npc_update_vf_flow_entry function the loop cursor 'index' is being changed inside the loop causing the loop to spin forever. This in turn hogs the kworker thread forever and no other mbox message is processed by AF driver after that. Fix this by using another variable in the loop. Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 6537e96d743b89294b397b4865c6c061abae31b0 Author: Subbaraya Sundeep Date: Mon Aug 30 23:30:43 2021 +0530 octeontx2-af: Fix loop in free and unmap counter When the given counter does not belong to the entry then code ends up in infinite loop because the loop cursor, entry is not getting updated further. This patch fixes that by updating entry for every iteration. Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit dc56ad7028c5f559b3ce90d5cca2e6b7b839f1d5 Author: Eric Dumazet Date: Mon Aug 30 10:21:37 2021 -0700 af_unix: fix potential NULL deref in unix_dgram_connect() syzbot was able to trigger NULL deref in unix_dgram_connect() [1] This happens in if (unix_peer(sk)) sk->sk_state = other->sk_state = TCP_ESTABLISHED; // crash because @other is NULL Because locks have been dropped, unix_peer() might be non NULL, while @other is NULL (AF_UNSPEC case) We need to move code around, so that we no longer access unix_peer() and sk_state while locks have been released. [1] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 10341 Comm: syz-executor239 Not tainted 5.14.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:unix_dgram_connect+0x32a/0xc60 net/unix/af_unix.c:1226 Code: 00 00 45 31 ed 49 83 bc 24 f8 05 00 00 00 74 69 e8 eb 5b a6 f9 48 8d 7d 12 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 e0 07 00 00 RSP: 0018:ffffc9000a89fcd8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff87cf4ef5 RDI: 0000000000000012 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88802e1917c3 R10: ffffffff87cf4eba R11: 0000000000000001 R12: ffff88802e191740 R13: 0000000000000000 R14: ffff88802e191d38 R15: ffff88802e1917c0 FS: 00007f3eb0052700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004787d0 CR3: 0000000029c0a000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __sys_connect_file+0x155/0x1a0 net/socket.c:1890 __sys_connect+0x161/0x190 net/socket.c:1907 __do_sys_connect net/socket.c:1917 [inline] __se_sys_connect net/socket.c:1914 [inline] __x64_sys_connect+0x6f/0xb0 net/socket.c:1914 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x446a89 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3eb0052208 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00000000004cc4d8 RCX: 0000000000446a89 RDX: 000000000000006e RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00000000004cc4d0 R08: 00007f3eb0052700 R09: 0000000000000000 R10: 00007f3eb0052700 R11: 0000000000000246 R12: 00000000004cc4dc R13: 00007ffd791e79cf R14: 00007f3eb0052300 R15: 0000000000022000 Modules linked in: ---[ end trace 4eb809357514968c ]--- RIP: 0010:unix_dgram_connect+0x32a/0xc60 net/unix/af_unix.c:1226 Code: 00 00 45 31 ed 49 83 bc 24 f8 05 00 00 00 74 69 e8 eb 5b a6 f9 48 8d 7d 12 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 e0 07 00 00 RSP: 0018:ffffc9000a89fcd8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff87cf4ef5 RDI: 0000000000000012 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88802e1917c3 R10: ffffffff87cf4eba R11: 0000000000000001 R12: ffff88802e191740 R13: 0000000000000000 R14: ffff88802e191d38 R15: ffff88802e1917c0 FS: 00007f3eb0052700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd791fe960 CR3: 0000000029c0a000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 83301b5367a9 ("af_unix: Set TCP_ESTABLISHED for datagram sockets too") Signed-off-by: Eric Dumazet Cc: Cong Wang Cc: Alexei Starovoitov Reported-by: syzbot Signed-off-by: David S. Miller commit 995786ba0dab6c96780e411bf22347270e837c89 Author: Jason Wang Date: Mon Aug 30 21:05:31 2021 +0800 dpaa2-eth: Replace strlcpy with strscpy The strlcpy should not be used because it doesn't limit the source length. As linus says, it's a completely useless function if you can't implicitly trust the source string - but that is almost always why people think they should use it! All in all the BSD function will lead some potential bugs. But the strscpy doesn't require reading memory from the src string beyond the specified "count" bytes, and since the return value is easier to error-check than strlcpy()'s. In addition, the implementation is robust to the string changing out from underneath it, unlike the current strlcpy() implementation. Thus, We prefer using strscpy instead of strlcpy. Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit a7314371b3f3e682bad8d814434e65f8682aade1 Author: Geetha sowjanya Date: Mon Aug 30 18:25:18 2021 +0530 octeontx2-af: Use NDC TX for transmit packet data For better performance set hardware to use NDC TX for reading packet data specified NIX_SEND_SG_S. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 6baeb3951c271cff30828c4763fa1362da56454a Author: MichelleJin Date: Sun Aug 29 04:32:29 2021 +0000 net: bridge: use mld2r_ngrec instead of icmpv6_dataun br_ip6_multicast_mld2_report function uses icmp6h to parse mld2_report packet. mld2r_ngrec defines mld2r_hdr.icmp6_dataun.un_data16[1] in include/net/mld.h. So, it is more compact to use mld2r rather than icmp6h. By doing printk test, it is confirmed that icmp6h->icmp6_dataun.un_data16[1] and mld2r->mld2r_ngrec are indeed equivalent. Also, sizeof(*mld2r) and sizeof(*icmp6h) are equivalent, too. Signed-off-by: MichelleJin Signed-off-by: David S. Miller commit 429205da6c834447a57279af128bdd56ccd5225e Author: Stefan Wahren Date: Sat Aug 28 16:23:15 2021 +0200 net: qualcomm: fix QCA7000 checksum handling Based on tests the QCA7000 doesn't support checksum offloading. So assume ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum handling. This fixes data transfer issues in noisy environments. Reported-by: Michael Heimpold Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Signed-off-by: Stefan Wahren Signed-off-by: David S. Miller commit 889a1b3f35db6ba5ba6a0c23a3a55594570b6a17 Author: Christophe JAILLET Date: Fri Aug 20 17:38:13 2021 +0200 gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code and avoid a leak If an error occurs after a 'gpiochip_add_data()' call it must be undone by a corresponding 'gpiochip_remove()' as already done in the remove function. To simplify the code a fix a leak in the error handling path of the probe, use the managed version instead (i.e. 'devm_gpiochip_add_data()') Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") Signed-off-by: Christophe JAILLET Signed-off-by: Bartosz Golaszewski commit 7d6588931ccd4c09e70a08175cf2e0cf7fc3b869 Author: Christophe JAILLET Date: Fri Aug 20 17:38:03 2021 +0200 gpio: mpc8xxx: Fix a potential double iounmap call in 'mpc8xxx_probe()' Commit 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support") has switched to a managed version when dealing with 'mpc8xxx_gc->regs'. So the corresponding 'iounmap()' call in the error handling path and in the remove should be removed to avoid a double unmap. This also allows some simplification in the probe. All the error handling paths related to managed resources can be direct returns and a NULL check in what remains in the error handling path can be removed. Fixes: 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support") Signed-off-by: Christophe JAILLET Signed-off-by: Bartosz Golaszewski commit 555bda42b0c1a5ffb72d3227c043e8afde778f1f Author: Christophe JAILLET Date: Fri Aug 20 17:37:55 2021 +0200 gpio: mpc8xxx: Fix a resources leak in the error handling path of 'mpc8xxx_probe()' Commit 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") has introduced a new 'goto err;' at the very end of the function, but has not updated the error handling path accordingly. Add the now missing 'irq_domain_remove()' call which balances a previous 'irq_domain_create_linear() call. Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal") Signed-off-by: Christophe JAILLET Signed-off-by: Bartosz Golaszewski commit 6b4a2a427245fd357208ccf427891805354ef5b1 Author: Alexandru Ardelean Date: Wed Aug 25 10:01:25 2021 +0300 gpio: viperboard: remove platform_set_drvdata() call in probe The platform_set_drvdata() call is only useful if we need to retrieve back the private information. Since the driver doesn't do that, it's not useful to have it. This change removes it. Also removing with this change is some logging about the failure to init the gpio chip data. There are other logging methods to view that this failed. Signed-off-by: Alexandru Ardelean Signed-off-by: Bartosz Golaszewski commit dacd59b4b3586862b00d9894b6e65c294f4ec413 Author: Viresh Kumar Date: Tue Aug 31 12:09:17 2021 +0530 gpio: virtio: Add missing mailings lists in MAINTAINERS entry Add gpio and virtualization lists in the MAINTAINERS entry for Virtio gpio driver. Reported-by: "Michael S. Tsirkin" Signed-off-by: Viresh Kumar Signed-off-by: Bartosz Golaszewski commit 17395d7742baa4737e9d3b4672cc3d10e5970998 Author: Viresh Kumar Date: Tue Aug 31 10:59:25 2021 +0530 gpio: virtio: Fix sparse warnings Fix warnings reported by sparse, related to type mismatch between u16 and __le16. Reported-by: kernel test robot Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver") Signed-off-by: Viresh Kumar Acked-by: Michael S. Tsirkin Signed-off-by: Bartosz Golaszewski commit efcefc7127290e7e9fa98dea029163ad8eda8fb3 Author: Thomas Hellström Date: Tue Aug 31 09:15:36 2021 +0200 drm/ttm: Fix ttm_bo_move_memcpy() for subclassed struct ttm_resource The code was making a copy of a struct ttm_resource. However, recently the struct ttm_resources were allowed to be subclassed and also were allowed to be malloced, hence the driver could end up assuming the copy we handed it was subclassed and worse, the original could have been freed at this point. Fix this by using the original struct ttm_resource before it is potentially freed in ttm_bo_move_sync_cleanup() v2: Base on drm-misc-next-fixes rather than drm-tip. Reported-by: Ben Skeggs Reported-by: Dave Airlie Cc: Christian König Cc: Fixes: 3bf3710e3718 ("drm/ttm: Add a generic TTM memcpy move for page-based iomem") Signed-off-by: Thomas Hellström Reviewed-by: Christian König Reviewed-by: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/20210831071536.80636-1-thomas.hellstrom@linux.intel.com commit 65266a7c6abfa1ad915a362c41bf38576607f1f9 Merge: 1a7f67e618d42 702f43872665e Author: Catalin Marinas Date: Tue Aug 31 09:10:00 2021 +0100 Merge remote-tracking branch 'tip/sched/arm64' into for-next/core * tip/sched/arm64: (785 commits) Documentation: arm64: describe asymmetric 32-bit support arm64: Remove logic to kill 32-bit tasks on 64-bit-only cores arm64: Hook up cmdline parameter to allow mismatched 32-bit EL0 arm64: Advertise CPUs capable of running 32-bit applications in sysfs arm64: Prevent offlining first CPU with 32-bit EL0 on mismatched system arm64: exec: Adjust affinity for compat tasks with mismatched 32-bit EL0 arm64: Implement task_cpu_possible_mask() sched: Introduce dl_task_check_affinity() to check proposed affinity sched: Allow task CPU affinity to be restricted on asymmetric systems sched: Split the guts of sched_setaffinity() into a helper function sched: Introduce task_struct::user_cpus_ptr to track requested affinity sched: Reject CPU affinity changes based on task_cpu_possible_mask() cpuset: Cleanup cpuset_cpus_allowed_fallback() use in select_fallback_rq() cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus() cpuset: Don't use the cpu_possible_mask as a last resort for cgroup v1 sched: Introduce task_cpu_possible_mask() to limit fallback rq selection sched: Cgroup SCHED_IDLE support sched/topology: Skip updating masks for non-online nodes Linux 5.14-rc6 lib: use PFN_PHYS() in devmem_is_allowed() ... commit baaae979b112642a41b71c71c599d875c067d257 Author: Zhang Yi Date: Thu Aug 26 21:04:09 2021 +0800 ext4: make the updating inode data procedure atomic Now that ext4_do_update_inode() return error before filling the whole inode data if we fail to set inode blocks in ext4_inode_blocks_set(). This error should never happen in theory since sb->s_maxbytes should not have allowed this, we have already init sb->s_maxbytes according to this feature in ext4_fill_super(). So even through that could only happen due to the filesystem corruption, we'd better to return after we finish updating the inode because it may left an uninitialized buffer and we could read this buffer later in "errors=continue" mode. This patch make the updating inode data procedure atomic, call EXT4_ERROR_INODE() after we dropping i_raw_lock after something bad happened, make sure that the inode is integrated, and also drop a BUG_ON and do some small cleanups. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20210826130412.3921207-4-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 8e33fadf945a918c50d92fab6a769661df484156 Author: Zhang Yi Date: Thu Aug 26 21:04:08 2021 +0800 ext4: remove an unnecessary if statement in __ext4_get_inode_loc() The "if (!buffer_uptodate(bh))" hunk covered almost the whole code after getting buffer in __ext4_get_inode_loc() which seems unnecessary, remove it and switch to check ext4_buffer_uptodate(), it simplify code and make it more readable. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20210826130412.3921207-3-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 0904c9ae3465c7acc066a564a76b75c0af83e6c7 Author: Zhang Yi Date: Thu Aug 26 21:04:07 2021 +0800 ext4: move inode eio simulation behind io completeion No EIO simulation is required if the buffer is uptodate, so move the simulation behind read bio completeion just like inode/block bitmap simulation does. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20210826130412.3921207-2-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit 4a79a98c7b19dd3d4cfe9200fbc384ba9119e039 Author: Jan Kara Date: Mon Aug 16 11:57:08 2021 +0200 ext4: Improve scalability of ext4 orphan file handling Even though the length of the critical section when adding / removing orphaned inodes was significantly reduced by using orphan file, the contention of lock protecting orphan file still appears high in profiles for truncate / unlink intensive workloads with high number of threads. This patch makes handling of orphan file completely lockless. Also to reduce conflicts between CPUs different CPUs start searching for empty slot in orphan file in different blocks. Performance comparison of locked orphan file handling, lockless orphan file handling, and completely disabled orphan inode handling from 80 CPU Xeon Server with 526 GB of RAM, filesystem located on SAS SSD disk, average of 5 runs: stress-orphan (microbenchmark truncating files byte-by-byte from N processes in parallel) Threads Time Time Time Orphan locked Orphan lockless No orphan 1 0.945600 0.939400 0.891200 2 1.331800 1.246600 1.174400 4 1.995000 1.780600 1.713200 8 6.424200 4.900000 4.106000 16 14.937600 8.516400 8.138000 32 33.038200 24.565600 24.002200 64 60.823600 39.844600 38.440200 128 122.941400 70.950400 69.315000 So we can see that with lockless orphan file handling, addition / deletion of orphaned inodes got almost completely out of picture even for a microbenchmark stressing it. For reaim creat_clo workload on ramdisk there are also noticeable gains (average of 5 runs): Clients Vanilla (ops/s) Patched (ops/s) creat_clo-1 14705.88 ( 0.00%) 14354.07 * -2.39%* creat_clo-3 27108.43 ( 0.00%) 28301.89 ( 4.40%) creat_clo-5 37406.48 ( 0.00%) 45180.73 * 20.78%* creat_clo-7 41338.58 ( 0.00%) 54687.50 * 32.29%* creat_clo-9 45226.13 ( 0.00%) 62937.07 * 39.16%* creat_clo-11 44000.00 ( 0.00%) 65088.76 * 47.93%* creat_clo-13 36516.85 ( 0.00%) 68661.97 * 88.03%* creat_clo-15 30864.20 ( 0.00%) 69551.78 * 125.35%* creat_clo-17 27478.45 ( 0.00%) 67729.08 * 146.48%* creat_clo-19 25000.00 ( 0.00%) 61621.62 * 146.49%* creat_clo-21 18772.35 ( 0.00%) 63829.79 * 240.02%* creat_clo-23 16698.94 ( 0.00%) 61938.96 * 270.92%* creat_clo-25 14973.05 ( 0.00%) 56947.61 * 280.33%* creat_clo-27 16436.69 ( 0.00%) 65008.03 * 295.51%* creat_clo-29 13949.01 ( 0.00%) 69047.62 * 395.00%* creat_clo-31 14283.52 ( 0.00%) 67982.45 * 375.95%* Reviewed-by: Theodore Ts'o Reviewed-by: Lukas Czerner Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20210816095713.16537-5-jack@suse.cz Signed-off-by: Theodore Ts'o commit 3a6541e97c035dba90cdf37169d73b2d8057e55d Author: Jan Kara Date: Mon Aug 16 11:57:07 2021 +0200 ext4: Orphan file documentation Add documentation about the orphan file feature. Reviewed-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20210816095713.16537-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 02f310fcf47fa9311d6ba2946a8d19e7d7d11f37 Author: Jan Kara Date: Mon Aug 16 11:57:06 2021 +0200 ext4: Speedup ext4 orphan inode handling Ext4 orphan inode handling is a bottleneck for workloads which heavily truncate / unlink small files since it contends on the global s_orphan_mutex lock (and generally it's difficult to improve scalability of the ondisk linked list of orphaned inodes). This patch implements new way of handling orphan inodes. Instead of linking orphaned inode into a linked list, we store it's inode number in a new special file which we call "orphan file". Only if there's no more space in the orphan file (too many inodes are currently orphaned) we fall back to using old style linked list. Currently we protect operations in the orphan file with a spinlock for simplicity but even in this setting we can substantially reduce the length of the critical section and thus speedup some workloads. In the next patch we improve this by making orphan handling lockless. Note that the change is backwards compatible when the filesystem is clean - the existence of the orphan file is a compat feature, we set another ro-compat feature indicating orphan file needs scanning for orphaned inodes when mounting filesystem read-write. This ro-compat feature gets cleared on unmount / remount read-only. Some performance data from 80 CPU Xeon Server with 512 GB of RAM, filesystem located on SSD, average of 5 runs: stress-orphan (microbenchmark truncating files byte-by-byte from N processes in parallel) Threads Time Time Vanilla Patched 1 1.057200 0.945600 2 1.680400 1.331800 4 2.547000 1.995000 8 7.049400 6.424200 16 14.827800 14.937600 32 40.948200 33.038200 64 87.787400 60.823600 128 206.504000 122.941400 So we can see significant wins all over the board. Reviewed-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20210816095713.16537-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit 25c6d98fc4c245d164cf688815a7b259257ead2a Author: Jan Kara Date: Mon Aug 16 11:57:05 2021 +0200 ext4: Move orphan inode handling into a separate file Move functions for handling orphan inodes into a new file fs/ext4/orphan.c to have them in one place and somewhat reduce size of other files. No code changes. Reviewed-by: Andreas Dilger Reviewed-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20210816095713.16537-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit b33d9f5909c8d30f1429fb9aefbb32760901a023 Author: Theodore Ts'o Date: Sat Aug 14 10:54:09 2021 -0400 jbd2: add sparse annotations for add_transaction_credits() Signed-off-by: Theodore Ts'o commit 188c299e2a26cc33747187f87c9e044dfd85a782 Author: Jan Kara Date: Mon Aug 16 11:57:04 2021 +0200 ext4: Support for checksumming from journal triggers JBD2 layer support triggers which are called when journaling layer moves buffer to a certain state. We can use the frozen trigger, which gets called when buffer data is frozen and about to be written out to the journal, to compute block checksums for some buffer types (similarly as does ocfs2). This avoids unnecessary repeated recomputation of the checksum (at the cost of larger window where memory corruption won't be caught by checksumming) and is even necessary when there are unsynchronized updaters of the checksummed data. So add superblock and journal trigger type arguments to ext4_journal_get_write_access() and ext4_journal_get_create_access() so that frozen triggers can be set accordingly. Also add inode argument to ext4_walk_page_buffers() and all the callbacks used with that function for the same purpose. This patch is mostly only a change of prototype of the above mentioned functions and a few small helpers. Real checksumming will come later. Reviewed-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20210816095713.16537-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit a5fda11338180db13f3e9eec20c9deda1f7bad72 Author: Theodore Ts'o Date: Sat Aug 14 10:41:30 2021 -0400 ext4: fix sparse warnings Add sparse annotations to suppress false positive context imbalance warnings, and use NULL instead of 0 in EXT_MAX_{EXTENT,INDEX}. Signed-off-by: Theodore Ts'o commit a54c4613dac1500b40e4ab55199f7c51f028e848 Author: Theodore Ts'o Date: Fri Aug 20 23:44:17 2021 -0400 ext4: fix race writing to an inline_data file while its xattrs are changing The location of the system.data extended attribute can change whenever xattr_sem is not taken. So we need to recalculate the i_inline_off field since it mgiht have changed between ext4_write_begin() and ext4_write_end(). This means that caching i_inline_off is probably not helpful, so in the long run we should probably get rid of it and shrink the in-memory ext4 inode slightly, but let's fix the race the simple way for now. Cc: stable@kernel.org Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data") Reported-by: syzbot+13146364637c7363a7de@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o commit bd2c38cf1726ea913024393a0d11f2e2a3f4c180 Author: Jan Kara Date: Thu Aug 12 15:31:22 2021 +0200 ext4: Make sure quota files are not grabbed accidentally If ext4 filesystem is corrupted so that quota files are linked from directory hirerarchy, bad things can happen. E.g. quota files can get corrupted or deleted. Make sure we are not grabbing quota file inodes when we expect normal inodes. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210812133122.26360-1-jack@suse.cz commit b2bbb92f7042e8075fb036bf97043339576330c3 Author: Jan Kara Date: Thu Aug 12 14:47:37 2021 +0200 ext4: fix e2fsprogs checksum failure for mounted filesystem Commit 81414b4dd48 ("ext4: remove redundant sb checksum recomputation") removed checksum recalculation after updating superblock free space / inode counters in ext4_fill_super() based on the fact that we will recalculate the checksum on superblock writeout. That is correct assumption but until the writeout happens (which can take a long time) the checksum is incorrect in the buffer cache and if programs such as tune2fs or resize2fs is called shortly after a file system is mounted can fail. So return back the checksum recalculation and add a comment explaining why. Fixes: 81414b4dd48f ("ext4: remove redundant sb checksum recomputation") Cc: stable@kernel.org Reported-by: Boyang Xue Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210812124737.21981-1-jack@suse.cz commit 308c57ccf4318236be75dfa251c84713e694457b Author: Theodore Ts'o Date: Fri Aug 13 11:20:48 2021 -0400 ext4: if zeroout fails fall back to splitting the extent node If the underlying storage device is using thin-provisioning, it's possible for a zeroout operation to return ENOSPC. Commit df22291ff0fd ("ext4: Retry block allocation if we have free blocks left") added logic to retry block allocation since we might get free block after we commit a transaction. But the ENOSPC from thin-provisioning will confuse ext4, and lead to an infinite loop. Since using zeroout instead of splitting the extent node is an optimization, if it fails, we might as well fall back to splitting the extent node. Reported-by: yangerkun Signed-off-by: Theodore Ts'o commit facec450a8243cd3310ff8a8b9bb2f71d35df9e9 Author: Guoqing Jiang Date: Tue Jul 27 16:07:08 2021 +0800 ext4: reduce arguments of ext4_fc_add_dentry_tlv Let's pass fc_dentry directly since those arguments (tag, parent_ino and ino etc) can be deferenced from it. Signed-off-by: Guoqing Jiang Reviewed-by: Harshad Shirwadkar Signed-off-by: Theodore Ts'o Link: https://lore.kernel.org/r/20210727080708.3708814-1-guoqing.jiang@linux.dev commit 5036ab8df278f9879d8958679bd043e32515a3e4 Author: Wang Jianchao Date: Mon Aug 30 15:52:46 2021 +0800 ext4: flush background discard kwork when retry allocation The background discard kwork tries to mark blocks used and issue discard. This can make filesystem suffer from NOSPC error, xfstest generic/371 can fail due to it. Fix it by flushing discard kwork in ext4_should_retry_alloc. At the same time, give up discard at the moment. Signed-off-by: Wang Jianchao Link: https://lore.kernel.org/r/20210830075246.12516-6-jianchao.wan9@gmail.com Signed-off-by: Theodore Ts'o commit 55cdd0af2bc5ffc92a2deb745627755aecd5db33 Author: Wang Jianchao Date: Sat Jul 24 15:41:23 2021 +0800 ext4: get discard out of jbd2 commit kthread contex Right now, discard is issued and waited to be completed in jbd2 commit kthread context after the logs are committed. When large amount of files are deleted and discard is flooding, jbd2 commit kthread can be blocked for long time. Then all of the metadata operations can be blocked to wait the log space. One case is the page fault path with read mm->mmap_sem held, which wants to update the file time but has to wait for the log space. When other threads in the task wants to do mmap, then write mmap_sem is blocked. Finally all of the following read mmap_sem requirements are blocked, even the ps command which need to read the /proc/pid/ -cmdline. Our monitor service which needs to read /proc/pid/cmdline used to be blocked for 5 mins. This patch frees the blocks back to buddy after commit and then do discard in a async kworker context in fstrim fashion, namely, - mark blocks to be discarded as used if they have not been allocated - do discard - mark them free After this, jbd2 commit kthread won't be blocked any more by discard and we won't get NOSPC even if the discard is slow or throttled. Link: https://marc.info/?l=linux-kernel&m=162143690731901&w=2 Suggested-by: Theodore Ts'o Reviewed-by: Jan Kara Signed-off-by: Wang Jianchao Link: https://lore.kernel.org/r/20210830075246.12516-5-jianchao.wan9@gmail.com Signed-off-by: Theodore Ts'o commit a16ef91aa61ac2a42b1bb199fccb897d54ab3dcd Author: Christophe JAILLET Date: Sat Aug 28 13:28:48 2021 +0200 net: pasemi: Remove usage of the deprecated "pci-dma-compat.h" API In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant parts are given below. An 'unlikely()' has been removed when calling 'dma_mapping_error()' because this function, which is inlined, already has such an annotation. @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/bc6cd281eae024b26fd9c7ef6678d2d1dc9d74fd.1630150008.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit c66070125837900163b81a03063ddd657a7e9bfb Author: Xiyu Yang Date: Sun Aug 29 23:58:01 2021 +0800 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed The reference counting issue happens in one exception handling path of cbq_change_class(). When failing to get tcf_block, the function forgets to decrease the refcount of "rtab" increased by qdisc_put_rtab(), causing a refcount leak. Fix this issue by jumping to "failure" label when get tcf_block failed. Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") Signed-off-by: Xiyu Yang Reviewed-by: Cong Wang Link: https://lore.kernel.org/r/1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn Signed-off-by: Jakub Kicinski commit b91db6a0b52e019b6bdabea3f1dbe36d85c7e52c Merge: 3b629f8d6dc04 cf30da90bc3a2 Author: Linus Torvalds Date: Mon Aug 30 19:39:59 2021 -0700 Merge tag 'for-5.15/io_uring-vfs-2021-08-30' of git://git.kernel.dk/linux-block Pull io_uring mkdirat/symlinkat/linkat support from Jens Axboe: "This adds io_uring support for mkdirat, symlinkat, and linkat" * tag 'for-5.15/io_uring-vfs-2021-08-30' of git://git.kernel.dk/linux-block: io_uring: add support for IORING_OP_LINKAT io_uring: add support for IORING_OP_SYMLINKAT io_uring: add support for IORING_OP_MKDIRAT namei: update do_*() helpers to return ints namei: make do_linkat() take struct filename namei: add getname_uflags() namei: make do_symlinkat() take struct filename namei: make do_mknodat() take struct filename namei: make do_mkdirat() take struct filename namei: change filename_parentat() calling conventions namei: ignore ERR/NULL names in putname() commit 3b629f8d6dc04d3af94429c18fe17239d6fbe2c3 Merge: c547d89a9a445 3d5b3fbedad65 Author: Linus Torvalds Date: Mon Aug 30 19:30:30 2021 -0700 Merge tag 'io_uring-bio-cache.5-2021-08-30' of git://git.kernel.dk/linux-block Pull support for struct bio recycling from Jens Axboe: "This adds bio recycling support for polled IO, allowing quick reuse of a bio for high IOPS scenarios via a percpu bio_set list. It's good for almost a 10% improvement in performance, bumping our per-core IO limit from ~3.2M IOPS to ~3.5M IOPS" * tag 'io_uring-bio-cache.5-2021-08-30' of git://git.kernel.dk/linux-block: bio: improve kerneldoc documentation for bio_alloc_kiocb() block: provide bio_clear_hipri() helper block: use the percpu bio cache in __blkdev_direct_IO io_uring: enable use of bio alloc cache block: clear BIO_PERCPU_CACHE flag if polling isn't supported bio: add allocation cache abstraction fs: add kiocb alloc cache flag bio: optimize initialization of a bio commit c547d89a9a445f6bb757b93247de43d312e722da Merge: 44d7d3b0d1cdb 87df7fb922d18 Author: Linus Torvalds Date: Mon Aug 30 19:22:52 2021 -0700 Merge tag 'for-5.15/io_uring-2021-08-30' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: - cancellation cleanups (Hao, Pavel) - io-wq accounting cleanup (Hao) - io_uring submit locking fix (Hao) - io_uring link handling fixes (Hao) - fixed file improvements (wangyangbo, Pavel) - allow updates of linked timeouts like regular timeouts (Pavel) - IOPOLL fix (Pavel) - remove batched file get optimization (Pavel) - improve reference handling (Pavel) - IRQ task_work batching (Pavel) - allow pure fixed file, and add support for open/accept (Pavel) - GFP_ATOMIC RT kernel fix - multiple CQ ring waiter improvement - funnel IRQ completions through task_work - add support for limiting async workers explicitly - add different clocksource support for timeouts - io-wq wakeup race fix - lots of cleanups and improvement (Pavel et al) * tag 'for-5.15/io_uring-2021-08-30' of git://git.kernel.dk/linux-block: (87 commits) io-wq: fix wakeup race when adding new work io-wq: wqe and worker locks no longer need to be IRQ safe io-wq: check max_worker limits if a worker transitions bound state io_uring: allow updating linked timeouts io_uring: keep ltimeouts in a list io_uring: support CLOCK_BOOTTIME/REALTIME for timeouts io-wq: provide a way to limit max number of workers io_uring: add build check for buf_index overflows io_uring: clarify io_req_task_cancel() locking io_uring: add task-refs-get helper io_uring: fix failed linkchain code logic io_uring: remove redundant req_set_fail() io_uring: don't free request to slab io_uring: accept directly into fixed file table io_uring: hand code io_accept() fd installing io_uring: openat directly into fixed fd table net: add accept helper not installing fd io_uring: fix io_try_cancel_userdata race for iowq io_uring: IRQ rw completion batching io_uring: batch task work locking ... commit 44d7d3b0d1cdb2119dba33bbedd602ce30528d6c Merge: 9a1d6c9e3f537 62283c6c9d4c1 Author: Linus Torvalds Date: Mon Aug 30 19:09:45 2021 -0700 Merge tag 'for-5.15/libata-2021-08-30' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "libata changes for the 5.15 release: - NCQ priority improvements (Damien, Niklas) - coccinelle warning fix (Jing) - dwc_460ex phy fix (Andy)" * tag 'for-5.15/libata-2021-08-30' of git://git.kernel.dk/linux-block: include:libata: fix boolreturn.cocci warnings docs: sysfs-block-device: document ncq_prio_supported docs: sysfs-block-device: improve ncq_prio_enable documentation libata: Introduce ncq_prio_supported sysfs sttribute libata: print feature list on device scan libata: fix ata_read_log_page() warning libata: cleanup NCQ priority handling libata: cleanup ata_dev_configure() libata: cleanup device sleep capability detection libata: simplify ata_scsi_rbuf_fill() libata: fix ata_host_start() ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() commit 9a1d6c9e3f53732f2f48f4424e028642db616663 Merge: 679369114e55f b5b0eba590f08 Author: Linus Torvalds Date: Mon Aug 30 19:01:46 2021 -0700 Merge tag 'for-5.15/drivers-2021-08-30' of git://git.kernel.dk/linux-block Pull block driver updates from Jens Axboe: "Sitting on top of the core block changes, here are the driver changes for the 5.15 merge window: - NVMe updates via Christoph: - suspend improvements for devices with an HMB (Keith Busch) - handle double completions more gacefull (Sagi Grimberg) - cleanup the selects for the nvme core code a bit (Sagi Grimberg) - don't update queue count when failing to set io queues (Ruozhu Li) - various nvmet connect fixes (Amit Engel) - cleanup lightnvm leftovers (Keith Busch, me) - small cleanups (Colin Ian King, Hou Pu) - add tracing for the Set Features command (Hou Pu) - CMB sysfs cleanups (Keith Busch) - add a mutex_destroy call (Keith Busch) - remove lightnvm subsystem. It's served its purpose and ultimately led to zoned nvme support, we no longer need it (Christoph) - revert floppy O_NDELAY fix (Denis) - nbd fixes (Hou, Pavel, Baokun) - nbd locking fixes (Tetsuo) - nbd device removal fixes (Christoph) - raid10 rcu warning fix (Xiao) - raid1 write behind fix (Guoqing) - rnbd fixes (Gioh, Md Haris) - misc fixes (Colin)" * tag 'for-5.15/drivers-2021-08-30' of git://git.kernel.dk/linux-block: (42 commits) Revert "floppy: reintroduce O_NDELAY fix" raid1: ensure write behind bio has less than BIO_MAX_VECS sectors md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard nbd: remove nbd->destroy_complete nbd: only return usable devices from nbd_find_unused nbd: set nbd->index before releasing nbd_index_mutex nbd: prevent IDR lookups from finding partially initialized devices nbd: reset NBD to NULL when restarting in nbd_genl_connect nbd: add missing locking to the nbd_dev_add error path nvme: remove the unused NVME_NS_* enum nvme: remove nvm_ndev from ns nvme: Have NVME_FABRICS select NVME_CORE instead of transport drivers block: nbd: add sanity check for first_minor nvmet: check that host sqsize does not exceed ctrl MQES nvmet: avoid duplicate qid in connect cmd nvmet: pass back cntlid on successful completion nvme-rdma: don't update queue count when failing to set io queues nvme-tcp: don't update queue count when failing to set io queues nvme-tcp: pair send_mutex init with destroy nvme: allow user toggling hmb usage ... commit 679369114e55f422dc593d0628cfde1d04ae59b3 Merge: 8596e589b7877 1d1cf156dc176 Author: Linus Torvalds Date: Mon Aug 30 18:52:11 2021 -0700 Merge tag 'for-5.15/block-2021-08-30' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: "Nothing major in here - lots of good cleanups and tech debt handling, which is also evident in the diffstats. In particular: - Add disk sequence numbers (Matteo) - Discard merge fix (Ming) - Relax disk zoned reporting restrictions (Niklas) - Bio error handling zoned leak fix (Pavel) - Start of proper add_disk() error handling (Luis, Christoph) - blk crypto fix (Eric) - Non-standard GPT location support (Dmitry) - IO priority improvements and cleanups (Damien)o - blk-throtl improvements (Chunguang) - diskstats_show() stack reduction (Abd-Alrhman) - Loop scheduler selection (Bart) - Switch block layer to use kmap_local_page() (Christoph) - Remove obsolete disk_name helper (Christoph) - block_device refcounting improvements (Christoph) - Ensure gendisk always has a request queue reference (Christoph) - Misc fixes/cleanups (Shaokun, Oliver, Guoqing)" * tag 'for-5.15/block-2021-08-30' of git://git.kernel.dk/linux-block: (129 commits) sg: pass the device name to blk_trace_setup block, bfq: cleanup the repeated declaration blk-crypto: fix check for too-large dun_bytes blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN blk-zoned: allow zone management send operations without CAP_SYS_ADMIN block: mark blkdev_fsync static block: refine the disk_live check in del_gendisk mmc: sdhci-tegra: Enable MMC_CAP2_ALT_GPT_TEGRA mmc: block: Support alternative_gpt_sector() operation partitions/efi: Support non-standard GPT location block: Add alternative_gpt_sector() operation bio: fix page leak bio_add_hw_page failure block: remove CONFIG_DEBUG_BLOCK_EXT_DEVT block: remove a pointless call to MINOR() in device_add_disk null_blk: add error handling support for add_disk() virtio_blk: add error handling support for add_disk() block: add error handling for device_add_disk / add_disk block: return errors from disk_alloc_events block: return errors from blk_integrity_add block: call blk_register_queue earlier in device_add_disk ... commit 751ca492f131290155fd48e16601629ecf5ee058 Author: Richard Zhu Date: Fri Aug 27 14:42:58 2021 +0800 dt-bindings: PCI: imx6: convert the imx pcie controller to dtschema Convert the fsl,imx6q-pcie.txt into a schema. - ranges property should be grouped by region, with no functional changes. - only one propert is allowed in the compatible string, remove "snps,dw-pcie". Signed-off-by: Richard Zhu Link: https://lore.kernel.org/r/1630046580-19282-2-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Rob Herring commit 4665584888ad2175831c972c004115741ec799e9 Author: Gwendal Grignou Date: Mon Aug 30 11:00:50 2021 -0700 platform/chrome: cros_ec_trace: Fix format warnings Fix printf format issues in new tracing events. Fixes: 814318242687 ("platform/chrome: cros_ec_trace: Add fields to command traces") Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20210830180050.2077261-1-gwendal@chromium.org Signed-off-by: Benson Leung commit 19a31d79219cdd66484721f564ee68293dcc6c24 Merge: ca49bfd90a9dd fca35b11e18a9 Author: Jakub Kicinski Date: Mon Aug 30 16:42:46 2021 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== bpf-next 2021-08-31 We've added 116 non-merge commits during the last 17 day(s) which contain a total of 126 files changed, 6813 insertions(+), 4027 deletions(-). The main changes are: 1) Add opaque bpf_cookie to perf link which the program can read out again, to be used in libbpf-based USDT library, from Andrii Nakryiko. 2) Add bpf_task_pt_regs() helper to access userspace pt_regs, from Daniel Xu. 3) Add support for UNIX stream type sockets for BPF sockmap, from Jiang Wang. 4) Allow BPF TCP congestion control progs to call bpf_setsockopt() e.g. to switch to another congestion control algorithm during init, from Martin KaFai Lau. 5) Extend BPF iterator support for UNIX domain sockets, from Kuniyuki Iwashima. 6) Allow bpf_{set,get}sockopt() calls from setsockopt progs, from Prankur Gupta. 7) Add bpf_get_netns_cookie() helper for BPF_PROG_TYPE_{SOCK_OPS,CGROUP_SOCKOPT} progs, from Xu Liu and Stanislav Fomichev. 8) Support for __weak typed ksyms in libbpf, from Hao Luo. 9) Shrink struct cgroup_bpf by 504 bytes through refactoring, from Dave Marchevsky. 10) Fix a smatch complaint in verifier's narrow load handling, from Andrey Ignatov. 11) Fix BPF interpreter's tail call count limit, from Daniel Borkmann. 12) Big batch of improvements to BPF selftests, from Magnus Karlsson, Li Zhijian, Yucong Sun, Yonghong Song, Ilya Leoshkevich, Jussi Maki, Ilya Leoshkevich, others. 13) Another big batch to revamp XDP samples in order to give them consistent look and feel, from Kumar Kartikeya Dwivedi. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (116 commits) MAINTAINERS: Remove self from powerpc BPF JIT selftests/bpf: Fix potential unreleased lock samples: bpf: Fix uninitialized variable in xdp_redirect_cpu selftests/bpf: Reduce more flakyness in sockmap_listen bpf: Fix bpf-next builds without CONFIG_BPF_EVENTS bpf: selftests: Add dctcp fallback test bpf: selftests: Add connect_to_fd_opts to network_helpers bpf: selftests: Add sk_state to bpf_tcp_helpers.h bpf: tcp: Allow bpf-tcp-cc to call bpf_(get|set)sockopt selftests: xsk: Preface options with opt selftests: xsk: Make enums lower case selftests: xsk: Generate packets from specification selftests: xsk: Generate packet directly in umem selftests: xsk: Simplify cleanup of ifobjects selftests: xsk: Decrease sending speed selftests: xsk: Validate tx stats on tx thread selftests: xsk: Simplify packet validation in xsk tests selftests: xsk: Rename worker_* functions that are not thread entry points selftests: xsk: Disassociate umem size with packets sent selftests: xsk: Remove end-of-test packet ... ==================== Link: https://lore.kernel.org/r/20210830225618.11634-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit ca49bfd90a9dde175d2929dc1544b54841e33804 Author: Maxim Mikityanskiy Date: Thu Aug 26 14:54:25 2021 +0300 sch_htb: Fix inconsistency when leaf qdisc creation fails In HTB offload mode, qdiscs of leaf classes are grafted to netdev queues. sch_htb expects the dev_queue field of these qdiscs to point to the corresponding queues. However, qdisc creation may fail, and in that case noop_qdisc is used instead. Its dev_queue doesn't point to the right queue, so sch_htb can lose track of used netdev queues, which will cause internal inconsistencies. This commit fixes this bug by keeping track of the netdev queue inside struct htb_class. All reads of cl->leaf.q->dev_queue are replaced by the new field, the two values are synced on writes, and WARNs are added to assert equality of the two values. The driver API has changed: when TC_HTB_LEAF_DEL needs to move a queue, the driver used to pass the old and new queue IDs to sch_htb. Now that there is a new field (offload_queue) in struct htb_class that needs to be updated on this operation, the driver will pass the old class ID to sch_htb instead (it already knows the new class ID). Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Link: https://lore.kernel.org/r/20210826115425.1744053-1-maximmi@nvidia.com Signed-off-by: Jakub Kicinski commit 927c1e56cc5e0e22da975c72433da2458b3f4fd5 Author: Lukas Bulwahn Date: Mon Aug 30 14:22:20 2021 -0700 Input: remove dead CSR Prima2 PWRC driver Commit f3a732843acc ("ARM: remove sirf prima2/atlas platforms") removes the config ARCH_SIRF in ./arch/arm/mach-prima2/Kconfig. Hence, since then, the corresponding CSR Prima2 PWRC Driver is dead code. Remove this dead driver. Signed-off-by: Lukas Bulwahn Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210817072842.8640-1-lukas.bulwahn@gmail.com Signed-off-by: Dmitry Torokhov commit 1c6aacecea383b5982299c34b4b191f6f21eb14d Author: Linus Walleij Date: Mon Aug 30 14:23:10 2021 -0700 Input: adp5589-keys - use the right header This keyboard driver is implementing a GPIO driver, so it need to include and not the legacy header. Signed-off-by: Linus Walleij Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20210816232707.485031-1-linus.walleij@linaro.org Signed-off-by: Dmitry Torokhov commit 9d9bfd180c8e3748be1f1a8843b0b54ed0ef42c9 Author: Linus Walleij Date: Mon Aug 30 14:18:59 2021 -0700 Input: adp5588-keys - use the right header This keyboard driver is implementing a GPIO driver, so it need to include and not the legacy header. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20210820222958.57238-1-linus.walleij@linaro.org Signed-off-by: Dmitry Torokhov commit 8596e589b787732c8346f0482919e83cc9362db1 Merge: bed91667415be d25a025201ed9 Author: Linus Torvalds Date: Mon Aug 30 15:31:33 2021 -0700 Merge tag 'timers-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Updates for timekeeping, timers and related drivers: Core code: - Cure a couple of correctness issues in the posix CPU timer code to prevent that the tick dependency for NOHZ full is kept alive for no reason. - Avoid expensive double reprogramming of the clockevent device in hrtimer_start_range_ns(). - Avoid pointless SMP function calls when the clock was set to avoid disturbing CPUs which do not have any affected timers queued. - Make the clocksource watchdog test work correctly when CONFIG_HZ is less than 100. Drivers: - Prefer the ARM architected timer over the Exynos timer which is way more expensive to access. - Add device tree bindings for new Ingenic SoCs - The usual improvements and cleanups all over the place" * tag 'timers-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (29 commits) clocksource: Make clocksource watchdog test safe for slow-HZ systems dt-bindings: timer: Add ABIs for new Ingenic SoCs clocksource/drivers/fttmr010: Pass around less pointers clocksource/drivers/mediatek: Optimize systimer irq clear flow on shutdown clocksource/drivers/ingenic: Use bitfield macro helpers clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel dt-bindings: timer: convert rockchip,rk-timer.txt to YAML clocksource/drivers/exynos_mct: Mark MCT device as CLOCK_EVT_FEAT_PERCPU clocksource/drivers/exynos_mct: Prioritise Arm arch timer on arm64 hrtimer: Unbreak hrtimer_force_reprogram() hrtimer: Use raw_cpu_ptr() in clock_was_set() hrtimer: Avoid more SMP function calls in clock_was_set() hrtimer: Avoid unnecessary SMP function calls in clock_was_set() hrtimer: Add bases argument to clock_was_set() time/timekeeping: Avoid invoking clock_was_set() twice timekeeping: Distangle resume and clock-was-set events timerfd: Provide timerfd_resume() hrtimer: Force clock_was_set() handling for the HIGHRES=n, NOHZ=y case hrtimer: Ensure timerfd notification for HIGHRES=n hrtimer: Consolidate reprogramming code ... commit bed91667415be768be4e5d7691011f2b5e16d796 Merge: ccd8ec4a3f9a5 a729691b541f6 Author: Linus Torvalds Date: Mon Aug 30 15:27:15 2021 -0700 Merge tag 'x86-misc-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Thomas Gleixner: "A set of updates for the x86 reboot code: - Limit the Dell Optiplex 990 quirk to early BIOS versions to avoid the full 'power cycle' alike reboot which is required for the buggy BIOSes. - Update documentation for the reboot=pci command line option and document how DMI platform quirks can be overridden" * tag 'x86-misc-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions x86/reboot: Document how to override DMI platform quirks x86/reboot: Document the "reboot=pci" option commit ccd8ec4a3f9a5d3d97766231b04e7321dcc2df1e Merge: 0a096f240aa19 34739a2809e1e Author: Linus Torvalds Date: Mon Aug 30 15:20:05 2021 -0700 Merge tag 'x86-irq-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 PIRQ updates from Thomas Gleixner: "A set of updates to support port 0x22/0x23 based PCI configuration space which can be found on various ALi chipsets and is also available on older Intel systems which expose a PIRQ router. While the Intel support is more or less nostalgia, the ALi chips are still in use on popular embedded boards used for routers" * tag 'x86-irq-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Fix typo s/ECLR/ELCR/ for the PIC register x86: Avoid magic number with ELCR register accesses x86/PCI: Add support for the Intel 82426EX PIRQ router x86/PCI: Add support for the Intel 82374EB/82374SB (ESC) PIRQ router x86/PCI: Add support for the ALi M1487 (IBC) PIRQ router x86: Add support for 0x22/0x23 port I/O configuration space commit 0a096f240aa1992ddac65f8e704f7b0c0795fe1c Merge: 7d6e3fa87e732 b7fe54f6c2d43 Author: Linus Torvalds Date: Mon Aug 30 15:00:33 2021 -0700 Merge tag 'x86-cpu-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cache flush updates from Thomas Gleixner: "A reworked version of the opt-in L1D flush mechanism. This is a stop gap for potential future speculation related hardware vulnerabilities and a mechanism for truly security paranoid applications. It allows a task to request that the L1D cache is flushed when the kernel switches to a different mm. This can be requested via prctl(). Changes vs the previous versions: - Get rid of the software flush fallback - Make the handling consistent with other mitigations - Kill the task when it ends up on a SMT enabled core which defeats the purpose of L1D flushing obviously" * tag 'x86-cpu-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation: Add L1D flushing Documentation x86, prctl: Hook L1D flushing in via prctl x86/mm: Prepare for opt-in based L1D flush in switch_mm() x86/process: Make room for TIF_SPEC_L1D_FLUSH sched: Add task_work callback for paranoid L1D flush x86/mm: Refactor cond_ibpb() to support other use cases x86/smp: Add a per-cpu view of SMT state commit 7d6e3fa87e732ec1e7761bf325c0907685c8571b Merge: e5e726f7bb9f7 47fb0cfdb7a71 Author: Linus Torvalds Date: Mon Aug 30 14:38:37 2021 -0700 Merge tag 'irq-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Updates to the interrupt core and driver subsystems: Core changes: - The usual set of small fixes and improvements all over the place, but nothing stands out MSI changes: - Further consolidation of the PCI/MSI interrupt chip code - Make MSI sysfs code independent of PCI/MSI and expose the MSI interrupts of platform devices in the same way as PCI exposes them. Driver changes: - Support for ARM GICv3 EPPI partitions - Treewide conversion to generic_handle_domain_irq() for all chained interrupt controllers - Conversion to bitmap_zalloc() throughout the irq chip drivers - The usual set of small fixes and improvements" * tag 'irq-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (57 commits) platform-msi: Add ABI to show msi_irqs of platform devices genirq/msi: Move MSI sysfs handling from PCI to MSI core genirq/cpuhotplug: Demote debug printk to KERN_DEBUG irqchip/qcom-pdc: Trim unused levels of the interrupt hierarchy irqdomain: Export irq_domain_disconnect_hierarchy() irqchip/gic-v3: Fix priority comparison when non-secure priorities are used irqchip/apple-aic: Fix irq_disable from within irq handlers pinctrl/rockchip: drop the gpio related codes gpio/rockchip: drop irq_gc_lock/irq_gc_unlock for irq set type gpio/rockchip: support next version gpio controller gpio/rockchip: use struct rockchip_gpio_regs for gpio controller gpio/rockchip: add driver for rockchip gpio dt-bindings: gpio: change items restriction of clock for rockchip,gpio-bank pinctrl/rockchip: add pinctrl device to gpio bank struct pinctrl/rockchip: separate struct rockchip_pin_bank to a head file pinctrl/rockchip: always enable clock for gpio controller genirq: Fix kernel doc indentation EDAC/altera: Convert to generic_handle_domain_irq() powerpc: Bulk conversion to generic_handle_domain_irq() nios2: Bulk conversion to generic_handle_domain_irq() ... commit e5e726f7bb9f711102edea7e5bd511835640e3b4 Merge: 08403e2174c4a a055fcc132d4c Author: Linus Torvalds Date: Mon Aug 30 14:26:36 2021 -0700 Merge tag 'locking-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking and atomics updates from Thomas Gleixner: "The regular pile: - A few improvements to the mutex code - Documentation updates for atomics to clarify the difference between cmpxchg() and try_cmpxchg() and to explain the forward progress expectations. - Simplification of the atomics fallback generator - The addition of arch_atomic_long*() variants and generic arch_*() bitops based on them. - Add the missing might_sleep() invocations to the down*() operations of semaphores. The PREEMPT_RT locking core: - Scheduler updates to support the state preserving mechanism for 'sleeping' spin- and rwlocks on RT. This mechanism is carefully preserving the state of the task when blocking on a 'sleeping' spin- or rwlock and takes regular wake-ups targeted at the same task into account. The preserved or updated (via a regular wakeup) state is restored when the lock has been acquired. - Restructuring of the rtmutex code so it can be utilized and extended for the RT specific lock variants. - Restructuring of the ww_mutex code to allow sharing of the ww_mutex specific functionality for rtmutex based ww_mutexes. - Header file disentangling to allow substitution of the regular lock implementations with the PREEMPT_RT variants without creating an unmaintainable #ifdef mess. - Shared base code for the PREEMPT_RT specific rw_semaphore and rwlock implementations. Contrary to the regular rw_semaphores and rwlocks the PREEMPT_RT implementation is writer unfair because it is infeasible to do priority inheritance on multiple readers. Experience over the years has shown that real-time workloads are not the typical workloads which are sensitive to writer starvation. The alternative solution would be to allow only a single reader which has been tried and discarded as it is a major bottleneck especially for mmap_sem. Aside of that many of the writer starvation critical usage sites have been converted to a writer side mutex/spinlock and RCU read side protections in the past decade so that the issue is less prominent than it used to be. - The actual rtmutex based lock substitutions for PREEMPT_RT enabled kernels which affect mutex, ww_mutex, rw_semaphore, spinlock_t and rwlock_t. The spin/rw_lock*() functions disable migration across the critical section to preserve the existing semantics vs per-CPU variables. - Rework of the futex REQUEUE_PI mechanism to handle the case of early wake-ups which interleave with a re-queue operation to prevent the situation that a task would be blocked on both the rtmutex associated to the outer futex and the rtmutex based hash bucket spinlock. While this situation cannot happen on !RT enabled kernels the changes make the underlying concurrency problems easier to understand in general. As a result the difference between !RT and RT kernels is reduced to the handling of waiting for the critical section. !RT kernels simply spin-wait as before and RT kernels utilize rcu_wait(). - The substitution of local_lock for PREEMPT_RT with a spinlock which protects the critical section while staying preemptible. The CPU locality is established by disabling migration. The underlying concepts of this code have been in use in PREEMPT_RT for way more than a decade. The code has been refactored several times over the years and this final incarnation has been optimized once again to be as non-intrusive as possible, i.e. the RT specific parts are mostly isolated. It has been extensively tested in the 5.14-rt patch series and it has been verified that !RT kernels are not affected by these changes" * tag 'locking-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (92 commits) locking/rtmutex: Return success on deadlock for ww_mutex waiters locking/rtmutex: Prevent spurious EDEADLK return caused by ww_mutexes locking/rtmutex: Dequeue waiter on ww_mutex deadlock locking/rtmutex: Dont dereference waiter lockless locking/semaphore: Add might_sleep() to down_*() family locking/ww_mutex: Initialize waiter.ww_ctx properly static_call: Update API documentation locking/local_lock: Add PREEMPT_RT support locking/spinlock/rt: Prepare for RT local_lock locking/rtmutex: Add adaptive spinwait mechanism locking/rtmutex: Implement equal priority lock stealing preempt: Adjust PREEMPT_LOCK_OFFSET for RT locking/rtmutex: Prevent lockdep false positive with PI futexes futex: Prevent requeue_pi() lock nesting issue on RT futex: Simplify handle_early_requeue_pi_wakeup() futex: Reorder sanity checks in futex_requeue() futex: Clarify comment in futex_requeue() futex: Restructure futex_requeue() futex: Correct the number of requeued waiters for PI futex: Remove bogus condition for requeue PI ... commit c611e4f24c79841f5637e62a8014f42da3dae5ae Author: Andreas Gerstmayr Date: Mon Aug 30 18:47:27 2021 +0200 perf flamegraph: flamegraph.py script improvements * display perf.data header * display PIDs of user stacks * added option to change color scheme * default to blue/green color scheme to improve accessibility * correctly identify kernel stacks when kernel-debuginfo is installed Signed-off-by: Andreas Gerstmayr Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210830164729.116049-1-agerstmayr@redhat.com Signed-off-by: Arnaldo Carvalho de Melo commit bb07d62e039b592f8006c9faedab48cd627e20c4 Author: Namhyung Kim Date: Fri Aug 27 16:32:12 2021 -0700 perf record: Fix wrong comm in system-wide mode with delay Stephane found that the name of the forked process in a system-wide mode is wrong when --delay option is used. For example, # perf record -a --delay=1000 noploop 3 The noploop process will run a busy loop for 3 second. And on an idle machine it should show up at the top in the perf report. It works well without the --delay option. But if I add the option, it showed 'perf' not 'noploop'. # perf report -s comm -q | head -3 52.94% perf 16.65% swapper 12.04% chrome It turned out that the dummy event didn't work at all and it missed COMM and MMAP events for the noploop process (and others too). We should enable the dummy event immediately in system-wide mode, as the enable-on-exec would work only for task events. With this change, # perf report -s comm -q | head -3 52.75% noploop 17.03% swapper 12.83% chrome Reported-by: Stephane Eranian Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210827233212.3121037-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 1c02f6c9043e9a6f359278cc2f17b4283ac0bd67 Author: Namhyung Kim Date: Mon Aug 30 10:02:00 2021 -0700 perf stat: Do not allow --for-each-cgroup without cpu The cgroup mode should work with cpu events. Warn if --for-each-cgroup option is used with a task target like existing -G option. # perf stat --for-each-cgroup . sleep 1 both cgroup and no-aggregation modes only available in system-wide mode Usage: perf stat [] [] -G, --cgroup monitor event in cgroup name only -A, --no-aggr disable CPU count aggregation -a, --all-cpus system-wide collection from all CPUs --for-each-cgroup expand events for each cgroup Signed-off-by: Namhyung Kim Cc: Andi Kleen Cc: Ian Rogers Cc: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210830170200.55652-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a32762b864f889cff884249c1273819bb79a05bb Author: Arnaldo Carvalho de Melo Date: Mon Aug 30 15:42:57 2021 -0300 perf bench evlist-open-close: Use PRIu64 with u64 to fix build on 32-bit architectures 73 9.00 ubuntu:18.04-x-powerpc : FAIL gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) bench/evlist-open-close.c: In function 'bench_evlist_open_close__run': bench/evlist-open-close.c:173:12: error: format '%ld' expects argument of type 'long int', but argument 5 has type 'u64 {aka long long unsigned int}' [-Werror=format=] pr_debug("Iteration %d took:\t%ldus\n", i, runtime_us); ^ bench/../util/debug.h:18:21: note: in definition of macro 'pr_fmt' #define pr_fmt(fmt) fmt ^~~ bench/evlist-open-close.c:173:3: note: in expansion of macro 'pr_debug' pr_debug("Iteration %d took:\t%ldus\n", i, runtime_us); ^~~~~~~~ cc1: all warnings being treated as errors /git/perf-5.14.0/tools/build/Makefile.build:139: recipe for target 'bench' failed Cc: Riccardo Mancini Fixes: 4241eabf59d5b7e9 ("perf bench: Add benchmark for evlist open/close operations") Link: http://lore.kernel.org/lkml/YS0oTcA9Zuy8Wjm9@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 08403e2174c4ac8b23922b5b7abe670129f8acb5 Merge: e4c3562e1bc79 7625eccd1852a Author: Linus Torvalds Date: Mon Aug 30 14:10:07 2021 -0700 Merge tag 'smp-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP core updates from Thomas Gleixner: - Replace get/put_online_cpus() in various places. The final removal will happen shortly before v5.15-rc1 when the rest of the patches have been merged. - Add debug code to help the analysis of CPU hotplug failures - A set of kernel doc updates * tag 'smp-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: mm: Replace deprecated CPU-hotplug functions. md/raid5: Replace deprecated CPU-hotplug functions. Documentation: Replace deprecated CPU-hotplug functions. smp: Fix all kernel-doc warnings cpu/hotplug: Add debug printks for hotplug callback failures cpu/hotplug: Use DEVICE_ATTR_*() macro cpu/hotplug: Eliminate all kernel-doc warnings cpu/hotplug: Fix kernel doc warnings for __cpuhp_setup_state_cpuslocked() cpu/hotplug: Fix comment typo smpboot: Replace deprecated CPU-hotplug functions. commit e4c3562e1bc79f912457cb062cd0c147026d4a1e Merge: 46f4945e2b39d 4bedcc28469a2 Author: Linus Torvalds Date: Mon Aug 30 14:06:31 2021 -0700 Merge tag 'core-debugobjects-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A single commit for debugobjects to make them work on PREEMPT_RT by preventing object pool refill in atomic contexts" * tag 'core-debugobjects-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Make them PREEMPT_RT aware commit 46f4945e2b39dda4b832909434785483e028419d Merge: 4a2b88eb0265a 1be72c8e07867 Author: Linus Torvalds Date: Mon Aug 30 13:57:55 2021 -0700 Merge tag 'efi-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "A handful of EFI changes for this cycle: - EFI CPER parsing improvements - Don't take the address of efi_guid_t internal fields" * tag 'efi-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: cper: check section header more appropriately efi: Don't use knowledge about efi_guid_t internals efi: cper: fix scnprintf() use in cper_mem_err_location() commit 4a2b88eb0265a9d550982b188abf20618a0c1a84 Merge: 5d3c0db4598c5 6a371bafe613b Author: Linus Torvalds Date: Mon Aug 30 13:50:20 2021 -0700 Merge tag 'perf-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf event updates from Ingo Molnar: - Add support for Intel Sapphire Rapids server CPU uncore events - Allow the AMD uncore driver to be built as a module - Misc cleanups and fixes * tag 'perf-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) perf/x86/amd/ibs: Add bitfield definitions in new header perf/amd/uncore: Allow the driver to be built as a module x86/cpu: Add get_llc_id() helper function perf/amd/uncore: Clean up header use, use Date: Mon Aug 30 13:42:10 2021 -0700 Merge tag 'sched-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - The biggest change in this cycle is scheduler support for asymmetric scheduling affinity, to support the execution of legacy 32-bit tasks on AArch32 systems that also have 64-bit-only CPUs. Architectures can fill in this functionality by defining their own task_cpu_possible_mask(p). When this is done, the scheduler will make sure the task will only be scheduled on CPUs that support it. (The actual arm64 specific changes are not part of this tree.) For other architectures there will be no change in functionality. - Add cgroup SCHED_IDLE support - Increase node-distance flexibility & delay determining it until a CPU is brought online. (This enables platforms where node distance isn't final until the CPU is only.) - Deadline scheduler enhancements & fixes - Misc fixes & cleanups. * tag 'sched-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) eventfd: Make signal recursion protection a task bit sched/fair: Mark tg_is_idle() an inline in the !CONFIG_FAIR_GROUP_SCHED case sched: Introduce dl_task_check_affinity() to check proposed affinity sched: Allow task CPU affinity to be restricted on asymmetric systems sched: Split the guts of sched_setaffinity() into a helper function sched: Introduce task_struct::user_cpus_ptr to track requested affinity sched: Reject CPU affinity changes based on task_cpu_possible_mask() cpuset: Cleanup cpuset_cpus_allowed_fallback() use in select_fallback_rq() cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus() cpuset: Don't use the cpu_possible_mask as a last resort for cgroup v1 sched: Introduce task_cpu_possible_mask() to limit fallback rq selection sched: Cgroup SCHED_IDLE support sched/topology: Skip updating masks for non-online nodes sched: Replace deprecated CPU-hotplug functions. sched: Skip priority checks with SCHED_FLAG_KEEP_PARAMS sched: Fix UCLAMP_FLAG_IDLE setting sched/deadline: Fix missing clock update in migrate_task_rq_dl() sched/fair: Avoid a second scan of target in select_idle_cpu sched/fair: Use prev instead of new target as recent_used_cpu sched: Don't report SCHED_FLAG_SUGOV in sched_getattr() ... commit 230bda0873a6ce4d089afde22aa5e487888ddebb Merge: 42f6e869a028a 5b3fd8aa5df02 Author: Linus Torvalds Date: Mon Aug 30 13:35:36 2021 -0700 Merge tag 'x86_cleanups_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: "The usual round of minor cleanups and fixes" * tag 'x86_cleanups_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kaslr: Have process_mem_region() return a boolean x86/power: Fix kernel-doc warnings in cpu.c x86/mce/inject: Replace deprecated CPU-hotplug functions. x86/microcode: Replace deprecated CPU-hotplug functions. x86/mtrr: Replace deprecated CPU-hotplug functions. x86/mmiotrace: Replace deprecated CPU-hotplug functions. commit 42f6e869a028abcf61422bc0d5de59d823db17b1 Merge: ced119b6308df 111136e69c9df Author: Linus Torvalds Date: Mon Aug 30 13:31:36 2021 -0700 Merge tag 'x86_cache_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: "A first round of changes towards splitting the arch-specific bits from the filesystem bits of resctrl, the ultimate goal being to support ARM's equivalent technology MPAM, with the same fs interface (James Morse)" * tag 'x86_cache_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) x86/resctrl: Make resctrl_arch_get_config() return its value x86/resctrl: Merge the CDP resources x86/resctrl: Expand resctrl_arch_update_domains()'s msr_param range x86/resctrl: Remove rdt_cdp_peer_get() x86/resctrl: Merge the ctrl_val arrays x86/resctrl: Calculate the index from the configuration type x86/resctrl: Apply offset correction when config is staged x86/resctrl: Make ctrlval arrays the same size x86/resctrl: Pass configuration type to resctrl_arch_get_config() x86/resctrl: Add a helper to read a closid's configuration x86/resctrl: Rename update_domains() to resctrl_arch_update_domains() x86/resctrl: Allow different CODE/DATA configurations to be staged x86/resctrl: Group staged configuration into a separate struct x86/resctrl: Move the schemata names into struct resctrl_schema x86/resctrl: Add a helper to read/set the CDP configuration x86/resctrl: Swizzle rdt_resource and resctrl_schema in pseudo_lock_region x86/resctrl: Pass the schema to resctrl filesystem functions x86/resctrl: Add resctrl_arch_get_num_closid() x86/resctrl: Store the effective num_closid in the schema x86/resctrl: Walk the resctrl schema list instead of an arch list ... commit ced119b6308df8ad2e4345e88f94d2bdcd6d6d4e Merge: 8f645b420822f 081551266d2fb Author: Linus Torvalds Date: Mon Aug 30 13:27:16 2021 -0700 Merge tag 'x86_build_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Borislav Petkov: - Remove cc-option checks which are old and already supported by the minimal compiler version the kernel uses and thus avoid the need to invoke the compiler unnecessarily. - Cleanups * tag 'x86_build_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/build: Move the install rule to arch/x86/Makefile x86/build: Remove the left-over bzlilo target x86/tools/relocs: Mark die() with the printf function attr format x86/build: Remove stale cc-option checks commit 8f645b420822f2061a41d022e8bd9a02fae5ba28 Merge: 05b5fdb2a8f7f 3bff147b187d5 Author: Linus Torvalds Date: Mon Aug 30 13:23:17 2021 -0700 Merge tag 'ras_core_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS update from Borislav Petkov: "A single RAS change for 5.15: - Do not start processing MCEs logged early because the decoding chain is not up yet - delay that processing until everything is ready" * tag 'ras_core_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Defer processing of early errors commit fca35b11e18a9d854cda6b18ed39a78011f4b082 Author: Sandipan Das Date: Fri Aug 27 16:49:05 2021 +0530 MAINTAINERS: Remove self from powerpc BPF JIT Stepping down as I haven't had a chance to look into the powerpc BPF JIT compilers for a while. Signed-off-by: Sandipan Das Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20210827111905.396145-1-sandipan@linux.ibm.com commit 05b5fdb2a8f7f981b9b1aa77a6c4b810e19f01ab Merge: c7a5238ef68b9 cf4e6d52f5839 Author: Linus Torvalds Date: Mon Aug 30 13:17:29 2021 -0700 Merge tag 'edac_updates_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: "The usual EDAC stuff which managed to trickle in for 5.15: - Add new HBM2 (High Bandwidth Memory Gen 2) type and add support for it to the Intel SKx drivers - Print additional useful per-channel error information on i10nm, like on SKL - Don't load the AMD EDAC decoder in virtual images - The usual round of fixes and cleanups" * tag 'edac_updates_for_v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/i10nm: Retrieve and print retry_rd_err_log registers EDAC/i10nm: Fix NVDIMM detection EDAC/skx_common: Set the memory type correctly for HBM memory EDAC/altera: Skip defining unused structures for specific configs EDAC/mce_amd: Do not load edac_mce_amd module on guests EDAC/mc: Add new HBM2 memory type EDAC/amd64: Use DEVICE_ATTR helper macros commit c7a5238ef68b98130fe36716bb3fa44502f56001 Merge: adc5ea221089e 927932240aa17 Author: Linus Torvalds Date: Mon Aug 30 13:07:15 2021 -0700 Merge tag 's390-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Improve ftrace code patching so that stop_machine is not required anymore. This requires a small common code patch acked by Steven Rostedt: https://lore.kernel.org/linux-s390/20210730220741.4da6fdf6@oasis.local.home/ - Enable KCSAN for s390. This comes with a small common code change to fix a compile warning. Acked by Marco Elver: https://lore.kernel.org/r/20210729142811.1309391-1-hca@linux.ibm.com - Add KFENCE support for s390. This also comes with a minimal x86 patch from Marco Elver who said also this can be carried via the s390 tree: https://lore.kernel.org/linux-s390/YQJdarx6XSUQ1tFZ@elver.google.com/ - More changes to prepare the decompressor for relocation. - Enable DAT also for CPU restart path. - Final set of register asm removal patches; leaving only three locations where needed and sane. - Add NNPA, Vector-Packed-Decimal-Enhancement Facility 2, PCI MIO support to hwcaps flags. - Cleanup hwcaps implementation. - Add new instructions to in-kernel disassembler. - Various QDIO cleanups. - Add SCLP debug feature. - Various other cleanups and improvements all over the place. * tag 's390-5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (105 commits) s390: remove SCHED_CORE from defconfigs s390/smp: do not use nodat_stack for secondary CPU start s390/smp: enable DAT before CPU restart callback is called s390: update defconfigs s390/ap: fix state machine hang after failure to enable irq KVM: s390: generate kvm hypercall functions s390/sclp: add tracing of SCLP interactions s390/debug: add early tracing support s390/debug: fix debug area life cycle s390/debug: keep debug data on resize s390/diag: make restart_part2 a local label s390/mm,pageattr: fix walk_pte_level() early exit s390: fix typo in linker script s390: remove do_signal() prototype and do_notify_resume() function s390/crypto: fix all kernel-doc warnings in vfio_ap_ops.c s390/pci: improve DMA translation init and exit s390/pci: simplify CLP List PCI handling s390/pci: handle FH state mismatch only on disable s390/pci: fix misleading rc in clp_set_pci_fn() s390/boot: factor out offset_vmlinux_info() function ... commit adc5ea221089e8eff8207d6e9c98751e0347b0de Merge: 44a7d4441181d 87d93029fe83e Author: Linus Torvalds Date: Mon Aug 30 13:02:19 2021 -0700 Merge tag 'm68k-for-v5.15-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - miscellaneous fixes - defconfig updates * tag 'm68k-for-v5.15-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Fix asm register constraints for atomic ops m68k: Fix invalid RMW_INSNS on CPUs that lack CAS m68k: defconfig: Update defconfigs for v5.14-rc1 m68k: emu: Fix invalid free in nfeth_cleanup() commit 44a7d4441181d0f2d622dc9bb512d7f5ca13f768 Merge: 4ca4256453eff 6ae51ffe5e768 Author: Linus Torvalds Date: Mon Aug 30 12:57:10 2021 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "Algorithms: - Add AES-NI/AVX/x86_64 implementation of SM4. Drivers: - Add Arm SMCCC TRNG based driver" [ And obviously a lot of random fixes and updates - Linus] * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (84 commits) crypto: sha512 - remove imaginary and mystifying clearing of variables crypto: aesni - xts_crypt() return if walk.nbytes is 0 padata: Remove repeated verbose license text crypto: ccp - Add support for new CCP/PSP device ID crypto: x86/sm4 - add AES-NI/AVX2/x86_64 implementation crypto: x86/sm4 - export reusable AESNI/AVX functions crypto: rmd320 - remove rmd320 in Makefile crypto: skcipher - in_irq() cleanup crypto: hisilicon - check _PS0 and _PR0 method crypto: hisilicon - change parameter passing of debugfs function crypto: hisilicon - support runtime PM for accelerator device crypto: hisilicon - add runtime PM ops crypto: hisilicon - using 'debugfs_create_file' instead of 'debugfs_create_regset32' crypto: tcrypt - add GCM/CCM mode test for SM4 algorithm crypto: testmgr - Add GCM/CCM mode test of SM4 algorithm crypto: tcrypt - Fix missing return value check crypto: hisilicon/sec - modify the hardware endian configuration crypto: hisilicon/sec - fix the abnormal exiting process crypto: qat - store vf.compatible flag crypto: qat - do not export adf_iov_putmsg() ... commit 4ca4256453effb885c1688633676682529593f82 Merge: 6f01c935d96cd b770efc4608d2 Author: Linus Torvalds Date: Mon Aug 30 12:48:01 2021 -0700 Merge branch 'core-rcu.2021.08.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: "RCU changes for this cycle were: - Documentation updates - Miscellaneous fixes - Offloaded-callbacks updates - Updates to the nolibc library - Tasks-RCU updates - In-kernel torture-test updates - Torture-test scripting, perhaps most notably the pinning of torture-test guest OSes so as to force differences in memory latency. For example, in a two-socket system, a four-CPU guest OS will have one pair of its CPUs pinned to threads in a single core on one socket and the other pair pinned to threads in a single core on the other socket. This approach proved able to force race conditions that earlier testing missed. Some of these race conditions are still being tracked down" * 'core-rcu.2021.08.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (61 commits) torture: Replace deprecated CPU-hotplug functions. rcu: Replace deprecated CPU-hotplug functions rcu: Print human-readable message for schedule() in RCU reader rcu: Explain why rcu_all_qs() is a stub in preemptible TREE RCU rcu: Use per_cpu_ptr to get the pointer of per_cpu variable rcu: Remove useless "ret" update in rcu_gp_fqs_loop() rcu: Mark accesses in tree_stall.h rcu: Make rcu_gp_init() and rcu_gp_fqs_loop noinline to conserve stack rcu: Mark lockless ->qsmask read in rcu_check_boost_fail() srcutiny: Mark read-side data races rcu: Start timing stall repetitions after warning complete rcu: Do not disable GP stall detection in rcu_cpu_stall_reset() rcu/tree: Handle VM stoppage in stall detection rculist: Unify documentation about missing list_empty_rcu() rcu: Mark accesses to ->rcu_read_lock_nesting rcu: Weaken ->dynticks accesses and updates rcu: Remove special bit at the bottom of the ->dynticks counter rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock rcu: Fix to include first blocked task in stall warning torture: Make kvm-test-1-run-qemu.sh check for reboot loops ... commit 6f01c935d96cd4eb8bbbc5249bd9a754b6939e0a Merge: 451819aa5ad0a 2949e8427af3b Author: Linus Torvalds Date: Mon Aug 30 12:38:13 2021 -0700 Merge tag 'locks-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "This starts with a couple of fixes for potential deadlocks in the fowner/fasync handling. The next patch removes the old mandatory locking code from the kernel altogether. The last patch cleans up rw_verify_area a bit more after the mandatory locking removal" * tag 'locks-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: fs: clean up after mandatory file locking support removal fs: remove mandatory file locking support fcntl: fix potential deadlock for &fasync_struct.fa_lock fcntl: fix potential deadlocks for &fown_struct.lock commit f5d8e16488056d9ad48d2561ef4eaf7fdd11c162 Author: Colin Ian King Date: Fri Aug 27 19:59:14 2021 +0100 drm/amdgpu/swsmu: fix spelling mistake "minimun" -> "minimum" There are three identical spelling mistakes in dev_err messages. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit b3dc549986eb7b38eba4a144e979dc93f386751f Author: Koba Ko Date: Mon Aug 30 10:02:00 2021 +0800 drm/amdgpu: Disable PCIE_DPM on Intel RKL Platform Due to high latency in PCIE clock switching on RKL platforms, switching the PCIE clock dynamically at runtime can lead to HDMI/DP audio problems. On newer asics this is handled in the SMU firmware. For SMU7-based asics, disable PCIE clock switching to avoid the issue. AMD provide a parameter to disable PICE_DPM. modprobe amdgpu ppfeaturemask=0xfff7bffb It's better to contorl PCIE_DPM in amd gpu driver, switch PCI_DPM by determining intel RKL platform for SMU7-based asics. Fixes: 1a31474cdb48 ("drm/amd/pm: workaround for audio noise issue") Ref: https://lists.freedesktop.org/archives/amd-gfx/2021-August/067413.html Signed-off-by: Koba Ko Signed-off-by: Alex Deucher commit 50c6dedeb1aac21c445ee4193f7660503873f395 Author: Lang Yu Date: Fri Aug 27 11:38:55 2021 +0800 drm/amdgpu: show both cmd id and name when psp cmd failed To cover the corner case that people want to know the ID of an UNKNOWN CMD. Suggested-by: John Clements Signed-off-by: Lang Yu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 3ca001aff0878546494d7f403334c8d987924977 Author: Aaron Liu Date: Mon Aug 23 12:26:50 2021 +0800 drm/amd/display: setup system context for APUs Scatter/gather is APU feature starting from carrizo. adev->apu_flags is not used for all APUs. adev->flags & AMD_IS_APU can be used for all APUs. Signed-off-by: Aaron Liu Reviewed-by: Huang Rui Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c5d3c9a093d353e7f38183a70df425f92e3c329d Author: Nicholas Kazlauskas Date: Thu Jan 14 14:49:27 2021 -0500 drm/amdgpu: Enable S/G for Yellow Carp Missing code for Yellow Carp to enable scatter gather - follows how DCN21 support was added. Tested that 8k framebuffer allocation and display can now succeed after applying the patch. v2: Add hookup in DM Reviewed-by: Aaron Liu Acked-by: Huang Rui Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4a9bd6db19be735f5f9d883ed15fb2b70ba36187 Author: Kees Cook Date: Thu Aug 26 20:16:47 2021 -0700 drm/amd/pm: And destination bounds checking to struct copy In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. The "Board Parameters" members of the structs: struct atom_smc_dpm_info_v4_5 struct atom_smc_dpm_info_v4_6 struct atom_smc_dpm_info_v4_7 struct atom_smc_dpm_info_v4_10 are written to the corresponding members of the corresponding PPTable_t variables, but they lack destination size bounds checking, which means the compiler cannot verify at compile time that this is an intended and safe memcpy(). Since the header files are effectively immutable[1] and a struct_group() cannot be used, nor a common struct referenced by both sides of the memcpy() arguments, add a new helper, amdgpu_memcpy_trailing(), to perform the bounds checking at compile time. Replace the open-coded memcpy()s with amdgpu_memcpy_trailing() which includes enough context for the bounds checking. "objdump -d" shows no object code changes. [1] https://lore.kernel.org/lkml/e56aad3c-a06f-da07-f491-a894a570d78f@amd.com Cc: "Christian König" Cc: "Pan, Xinhui" Cc: David Airlie Cc: Daniel Vetter Cc: Hawking Zhang Cc: Feifei Xu Cc: Likun Gao Cc: Jiawei Gu Cc: Evan Quan Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Kees Cook Signed-off-by: Alex Deucher commit 602e338ffed31b1f15c706ea109366e3bae6e39b Author: Evan Quan Date: Tue Aug 24 11:32:44 2021 +0800 drm/amdgpu: reenable BACO support for 699F:C7 polaris12 SKU This reverts the commit below: "drm/amdgpu: disable BACO support for 699F:C7 polaris12 SKU temporarily". As the S3 hang issue has been fixed by another commit: "drm/amdgpu: add missing cleanups for Polaris12 UVD/VCE on suspend". Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 64261a0d0600ab335677073c54b1989565ceddad Author: YuBiao Wang Date: Fri Aug 27 14:48:51 2021 +0800 drm/amd/amdgpu: Add ready_to_reset resp for vega10 Send response to host after received the flr notification from host. Port NV change to vega10. Signed-off-by: YuBiao Wang Reviewed-by: Jingwen Chen Signed-off-by: Alex Deucher commit 8f0c93f454bd7ab04eaec1d3c436c4c7c2378f07 Author: Alex Deucher Date: Thu Aug 26 15:43:18 2021 -0400 drm/amdgpu: add some additional RDNA2 PCI IDs New PCI IDs. Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 6333a495f53347067cc25012043f4876b249f8e7 Author: Yifan Zhang Date: Thu Aug 26 17:58:21 2021 +0800 drm/amdgpu: correct comments in memory type managers The parameters were renamed. Signed-off-by: Yifan Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit cc947bf91bad65d4f0ef85a3cd7272a1cf26f53d Author: Luben Tuikov Date: Wed Aug 25 13:50:20 2021 -0400 drm/amdgpu: Process any VBIOS RAS EEPROM address We can now process any RAS EEPROM address from VBIOS. Generalize so as to compute the top three bits of the 19-bit EEPROM address, from any byte returned as the "i2c address" from VBIOS. Cc: John Clements Cc: Hawking Zhang Cc: Alex Deucher Signed-off-by: Luben Tuikov Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit a6a355a22f7a0efa6a11bc90b5161f394d51fe95 Author: Luben Tuikov Date: Tue Aug 24 11:01:32 2021 -0400 drm/amdgpu: Fixes to returning VBIOS RAS EEPROM address 1) Generalize the function--if the user didn't set i2c_address, still return true/false to indicate whether VBIOS contains the RAS EEPROM address. This function shouldn't evaluate whether the user set the i2c_address pointer or not. 2) Don't touch the caller's i2c_address, unless you have to--this function shouldn't have side effects. 3) Correctly set the function comment as a kernel-doc comment. Cc: John Clements Cc: Hawking Zhang Cc: Alex Deucher Signed-off-by: Luben Tuikov Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit fbd2a6003a259fe12750ceb5efc47432c3cc7ce4 Author: Jing Yangyang Date: Mon Aug 23 22:52:32 2021 -0700 drm:dcn31: fix boolreturn.cocci warnings ./drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c:112:9-10:WARNING: return of 0/1 in function 'dcn31_is_panel_backlight_on' with return type bool ./drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c:122:9-10:WARNING: return of 0/1 in function 'dcn31_is_panel_powered_on' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Reported-by: Zeal Robot Signed-off-by: Jing Yangyang Signed-off-by: Alex Deucher commit 451819aa5ad0a22b23f0eb178816dc72b73ab903 Merge: 4520dcbe0df41 f985911b7bc75 Author: Linus Torvalds Date: Mon Aug 30 11:53:24 2021 -0700 Merge tag 'tpmdd-next-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm driver updates from Jarkko Sakkinen: "The highlights are: - Support for signing LKM's with ECDSA keys - An integer overflow bug fix in pkey" * tag 'tpmdd-next-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: crypto: public_key: fix overflow during implicit conversion tpm: ibmvtpm: Avoid error message when process gets signal while waiting certs: Add support for using elliptic curve keys for signing modules certs: Trigger creation of RSA module signing key if it's not an RSA key char: tpm: cr50_i2c: convert to new probe interface char: tpm: Kconfig: remove bad i2c cr50 select commit 4520dcbe0df41385288f24e61f322ee97063fa03 Merge: 0da9bc6d2fc3f c9398455b046f Author: Linus Torvalds Date: Mon Aug 30 11:47:32 2021 -0700 Merge tag 'for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Battery/charger related: - cros-peripheral-charger: new driver - mt6360-charger: new driver - simple-battery: support reading chemistry info - max17042-battery: add max77849 support - sbs-battery: add time_to_empty_now support - smb347-charger: prepare USB OTG support - rn5t618: add voltage_now support - axp288: cleanup & optimizations - max17042_battery: cleanups - ab8500: cleanups - misc minor cleanups and DT binding fixes reset related: - tps65086-restart: new driver - linkstation-poweroff: support NETGEAR ReadyNAS Duo v2" * tag 'for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (51 commits) power: supply: core: Fix parsing of battery chemistry/technology power: supply: max17042_battery: log SOC threshold using debug log level power: supply: max17042_battery: more robust chip type checks power: supply: max17042_battery: fix typo in MAx17042_TOFF power: supply: max17042_battery: clean up MAX17055_V_empty power: supply: smb347-charger: Implement USB VBUS regulator power: supply: smb347-charger: Add missing pin control activation power: supply: smb347-charger: Utilize generic regmap caching power: supply: smb347-charger: Make smb347_set_writable() IRQ-safe dt-bindings: power: supply: smb347-charger: Document USB VBUS regulator power: reset: Add TPS65086 restart driver dt-bindings: power: supply: max17042: describe interrupt power: supply: max17042: remove duplicated STATUS bit defines power: supply: max17042: handle fails of reading status register power: supply: core: Parse battery chemistry/technology dt-bindings: power: Extend battery bindings with chemistry power: reset: linkstation-poweroff: add new device power: reset: linkstation-poweroff: prepare for new devices power: supply: bq24735: reorganize ChargeOption command macros power: supply: rn5t618: Add voltage_now property ... commit 0da9bc6d2fc3f98095d69f34c17f7d5730bbcc6c Merge: d46e0d335497d 6e9c846aa0c53 Author: Linus Torvalds Date: Mon Aug 30 11:41:46 2021 -0700 Merge tag 'spi-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "A quiet release for SPI, some fixes and a couple of new drivers plus one small refactoring: - Move the chip select timing configuration from the controller to the device to allow a bit more flexibility - New drivers for Rockchip SFC and Spreadtrum ADI" * tag 'spi-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (47 commits) spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible spi: add sprd ADI for sc9863 and ums512 spi: Convert sprd ADI bindings to yaml spi: sprd: Add ADI r3 support spi: sprd: Fix the wrong WDG_LOAD_VAL spi: davinci: invoke chipselect callback spi: sprd: fill offset only to RD_CMD register for reading from slave device spi: sprd: Make sure offset not equal to slave address size spi: sprd: Pass offset instead of physical address to adi_read/_write() spi: rockchip-sfc: Fix assigned but never used return error codes spi: rockchip-sfc: Remove redundant IO operations spi: stm32: fix excluded_middle.cocci warnings spi: coldfire-qspi: Use clk_disable_unprepare in the remove function spi: tegra20-slink: remove spi_master_put() in tegra_slink_remove() spi: rockchip-sfc: add rockchip serial flash controller spi: rockchip-sfc: Bindings for Rockchip serial flash controller spi: orion: Prevent incorrect chip select behaviour spi: mxic: add missing braces spi: spi-pic32: Fix issue with uninitialized dma_slave_config spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config ... commit d46e0d335497d89e36a8dab3ce5b605d7088c67a Merge: 4aed6ee53fcc0 7aa6d700b089d Author: Linus Torvalds Date: Mon Aug 30 11:37:15 2021 -0700 Merge tag 'regulator-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "A very quiet releases, some fixes and cleanups but not really that many of them. There were a couple of new driver specific pieces: - Support for controlling the over/under voltage protection on BD718xx devices - New drivers for Richtek RTQ2134, and RTQ6752" * tag 'regulator-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (37 commits) regulator: vctrl: Avoid lockdep warning in enable/disable ops regulator: vctrl: Use locked regulator_get_voltage in probe path regulator: Documentation fix for regulator error notification helper regulator: Minor regulator documentation fixes. regulator: sy7636a: Use the regmap directly regulator: sy7636a: Store the epd-pwr-good GPIO locally regulator: sy7636a: Use the parent driver data regulator: sy7636a: Remove the poll_enable_time regulator: sy8827n: Enable REGCACHE_FLAT regulator: sy8824x: Enable REGCACHE_FLAT regulator: rtq2134: Fix coding style regulator: hi6421v600: rename voltage range arrays regulator: hi6421v600: use lowercase for ldo regulator: fixed: use dev_err_probe for register regulator: rtq2134: Add support for Richtek RTQ2134 SubPMIC regulator: rtq2134: Add binding document for Richtek RTQ2134 SubPMIC regulator: Fix a couple of spelling mistakes in Kconfig regulator: rtq6752: fix reg reset behavior regulator: da9063: Add support for full-current mode. regulator: rt6245: make a const array func_base static, makes object smaller ... commit 4aed6ee53fcc012ea599f1be6b2c8d76cb7f7354 Merge: aa99f3c2b9c79 ca5537c9be13c Author: Linus Torvalds Date: Mon Aug 30 11:33:34 2021 -0700 Merge tag 'regmap-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "A few small fixes for regmaps this time, plus support for allowing drivers to select raw spinlocks for the locks in order to allow usage in interrutpt controllers" * tag 'regmap-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: teach regmap to use raw spinlocks if requested in the config regmap: allow const array for {devm_,}regmap_field_bulk_alloc reg_fields regmap: Prefer unsigned int to bare use of unsigned regmap: fix the offset of register error log commit 2cbd40709a9d44b8b0d418589de12efad6f71c15 Merge: 2fec5b82f9312 437b38c51162f 2bc4eb943b1b2 1a20d409c8742 Author: Rafael J. Wysocki Date: Mon Aug 30 20:03:28 2021 +0200 Merge branches 'acpi-osl', 'acpi-power' and 'acpi-misc' * acpi-osl: ACPI: Add memory semantics to acpi_os_map_memory() * acpi-power: ACPI: power: Drop name from struct acpi_power_resource ACPI: power: Use acpi_handle_debug() to print debug messages * acpi-misc: ACPI: button: Add DMI quirk for Lenovo Yoga 9 (14INTL5) commit 2fec5b82f93127629c67285ae7f6bd5d8e37a8e5 Merge: 7c85154643df0 7a6226db072be 95ac706744de7 97e03410bc5f6 b25d5a1cd1989 Author: Rafael J. Wysocki Date: Mon Aug 30 20:03:05 2021 +0200 Merge branches 'acpi-dptf', 'acpi-processor', 'acpi-tables' and 'acpi-platform' * acpi-dptf: ACPI: DPTF: Add new PCH FIVR methods * acpi-processor: ACPI: processor: Replace deprecated CPU-hotplug functions * acpi-tables: ACPI: tables: FPDT: Do not print FW_BUG message if record types are reserved ACPI: SPCR: Add support for the new 16550-compatible Serial Port Subtype * acpi-platform: ACPI: platform-profile: call sysfs_notify() from platform_profile_store() commit d20d30ebb199354729c64c86945ed25c66ff4991 Author: Kees Cook Date: Fri Aug 27 17:02:55 2021 -0700 cgroup: Avoid compiler warnings with no subsystems As done before in commit cb4a31675270 ("cgroup: use bitmask to filter for_each_subsys"), avoid compiler warnings for the pathological case of having no subsystems (i.e. CGROUP_SUBSYS_COUNT == 0). This condition is hit for the arm multi_v7_defconfig config under -Wzero-length-bounds: In file included from ./arch/arm/include/generated/asm/rwonce.h:1, from include/linux/compiler.h:264, from include/uapi/linux/swab.h:6, from include/linux/swab.h:5, from arch/arm/include/asm/opcodes.h:86, from arch/arm/include/asm/bug.h:7, from include/linux/bug.h:5, from include/linux/thread_info.h:13, from include/asm-generic/current.h:5, from ./arch/arm/include/generated/asm/current.h:1, from include/linux/sched.h:12, from include/linux/cgroup.h:12, from kernel/cgroup/cgroup-internal.h:5, from kernel/cgroup/cgroup.c:31: kernel/cgroup/cgroup.c: In function 'of_css': kernel/cgroup/cgroup.c:651:42: warning: array subscript '' is outside the bounds of an interior zero-length array 'struct cgroup_subsys_state *[0]' [-Wzero-length-bounds] 651 | return rcu_dereference_raw(cgrp->subsys[cft->ss->id]); Reported-by: Stephen Rothwell Cc: Tejun Heo Cc: Zefan Li Cc: Johannes Weiner Cc: cgroups@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Tejun Heo commit 7c85154643df00f19db43c49dfef23b8fa93f0c9 Merge: b46a8eda83b4d b1121e2a182dc b2ebd9dd52670 45c16fe1d1283 fd080a01ecfc9 Author: Rafael J. Wysocki Date: Mon Aug 30 19:30:37 2021 +0200 Merge branches 'acpi-numa', 'acpi-glue', 'acpi-config' and 'acpi-pmic' * acpi-numa: ACPI: Add LoongArch support for ACPI_PROCESSOR/ACPI_NUMA * acpi-glue: driver core: Split device_platform_notify() software nodes: Split software_node_notify() ACPI: glue: Eliminate acpi_platform_notify() ACPI: bus: Rename functions to avoid name collision ACPI: glue: Change return type of two functions to void ACPI: glue: Rearrange acpi_device_notify() * acpi-config: ACPI: configfs: Make get_header() to return error pointer ACPI: configfs: Use sysfs_emit() in "show" functions * acpi-pmic: ACPI / PMIC: XPower: optimize MIPI PMIQ sequence I2C-bus accesses ACPI / PMIC: XPower: optimize I2C-bus accesses commit b46a8eda83b4d8cf6fff0971bc17baba48535582 Merge: 294c34e704e78 696e0c937d07a Author: Rafael J. Wysocki Date: Mon Aug 30 19:27:13 2021 +0200 Merge branch 'acpica' * acpica: ACPICA: Update version to 20210730 ACPICA: Add method name "_DIS" For use with aslmethod.c ACPICA: iASL: Fix for WPBT table with no command-line arguments ACPICA: Headers: Add new DBG2 Serial Port Subtypes ACPICA: Macros should not use a trailing semicolon ACPICA: Fix an if statement (add parens) ACPICA: iASL: Add support for the AEST table (data compiler) commit fe583359ddf0d509275b87b635fa8b2e3794321e Merge: 88e9c0bf1ca38 0e00392a895c9 dbcfa7156f48e bc0d0b1dfe271 1cc5b9a411e43 Author: Rafael J. Wysocki Date: Mon Aug 30 19:25:42 2021 +0200 Merge branches 'pm-pci', 'pm-sleep', 'pm-domains' and 'powercap' * pm-pci: PCI: PM: Enable PME if it can be signaled from D3cold PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: Use pci_update_current_state() in pci_enable_device_flags() * pm-sleep: PM: sleep: unmark 'state' functions as kernel-doc PM: sleep: check RTC features instead of ops in suspend_test PM: sleep: s2idle: Replace deprecated CPU-hotplug functions * pm-domains: PM: domains: Fix domain attach for CONFIG_PM_OPP=n arm64: dts: sc7180: Add required-opps for i2c PM: domains: Add support for 'required-opps' to set default perf state opp: Don't print an error if required-opps is missing * powercap: powercap: Add Power Limit4 support for Alder Lake SoC powercap: intel_rapl: Replace deprecated CPU-hotplug functions commit 88e9c0bf1ca38b11b48b97b5821a7ac99d42e825 Merge: 7ee5fd12e8cac d0e936adbd225 15538a20579fa 7fcc17d0cb129 Author: Rafael J. Wysocki Date: Mon Aug 30 19:25:13 2021 +0200 Merge branches 'pm-cpufreq', 'pm-cpu' and 'pm-em' * pm-cpufreq: cpufreq: intel_pstate: Process HWP Guaranteed change notification thermal: intel: Allow processing of HWP interrupt cpufreq: schedutil: Use kobject release() method to free sugov_tunables cpufreq: Replace deprecated CPU-hotplug functions * pm-cpu: notifier: Remove atomic_notifier_call_chain_robust() PM: cpu: Make notifier chain use a raw_spinlock_t * pm-em: PM: EM: Increase energy calculation precision commit aa99f3c2b9c797d8fee28c674a2cbb5adb2ce2ef Merge: a1ca8e7147d07 7882c55ef64a8 Author: Linus Torvalds Date: Mon Aug 30 10:24:50 2021 -0700 Merge tag 'hole_punch_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fs hole punching vs cache filling race fixes from Jan Kara: "Fix races leading to possible data corruption or stale data exposure in multiple filesystems when hole punching races with operations such as readahead. This is the series I was sending for the last merge window but with your objection fixed - now filemap_fault() has been modified to take invalidate_lock only when we need to create new page in the page cache and / or bring it uptodate" * tag 'hole_punch_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: filesystems/locking: fix Malformed table warning cifs: Fix race between hole punch and page fault ceph: Fix race between hole punch and page fault fuse: Convert to using invalidate_lock f2fs: Convert to using invalidate_lock zonefs: Convert to using invalidate_lock xfs: Convert double locking of MMAPLOCK to use VFS helpers xfs: Convert to use invalidate_lock xfs: Refactor xfs_isilocked() ext2: Convert to using invalidate_lock ext4: Convert to use mapping->invalidate_lock mm: Add functions to lock invalidate_lock for two mappings mm: Protect operations adding pages to page cache with invalidate_lock documentation: Sync file_operations members with reality mm: Fix comments mentioning i_mutex commit 8cfb9015280d49f9d92d5b0f88cedf5f0856c0fd Author: Trond Myklebust Date: Fri Aug 27 14:00:56 2021 -0400 NFS: Always provide aligned buffers to the RPC read layers Instead of messing around with XDR padding in the RDMA layer, we should just give the RPC layer an aligned buffer. Try to avoid creating extra RPC calls by aligning to the smaller value of ALIGN(len, rsize) and PAGE_SIZE. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit bc0d0b1dfe27158c06c3a891953174d06b96a419 Merge: 3c5a272202c28 656164181eece Author: Rafael J. Wysocki Date: Mon Aug 30 19:20:32 2021 +0200 Merge back new PM domains material for v5.15. commit a1ca8e7147d07cb8649c618bc9902a9a7e6444e1 Merge: 63b0c403394d4 58bc6d1be2f3b Author: Linus Torvalds Date: Mon Aug 30 10:18:07 2021 -0700 Merge tag 'fs_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF and isofs updates from Jan Kara: "Several smaller fixes and cleanups in UDF and isofs" * tag 'fs_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf_get_extendedattr() had no boundary checks. isofs: joliet: Fix iocharset=utf8 mount option udf: Fix iocharset=utf8 mount option udf: Get rid of 0-length arrays in struct fileIdentDesc udf: Get rid of 0-length arrays udf: Remove unused declaration udf: Check LVID earlier commit 63b0c403394d4e2644751d090db8a5da80272e50 Merge: 3513431926f9b 9acb9c48b9408 Author: Linus Torvalds Date: Mon Aug 30 10:13:02 2021 -0700 Merge tag 'fiemap_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull FIEMAP cleanups from Jan Kara: "FIEMAP cleanups from Christoph transitioning all remaining filesystems supporting FIEMAP (ext2, hpfs) to iomap API and removing the old helper" * tag 'fiemap_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs: remove generic_block_fiemap hpfs: use iomap_fiemap to implement ->fiemap ext2: use iomap_fiemap to implement ->fiemap ext2: make ext2_iomap_ops available unconditionally commit f7db8dd6981e0d94e5e35b45c1d288c94357de52 Author: Chao Yu Date: Mon Aug 30 08:35:33 2021 +0800 f2fs: enable realtime discard iff device supports discard Let's only enable realtime discard if and only if device supports discard functionality. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit dddd3d65293a52c2c3850c19b1e5115712e534d8 Author: Jaegeuk Kim Date: Thu Aug 19 14:00:57 2021 -0700 f2fs: guarantee to write dirty data when enabling checkpoint back We must flush all the dirty data when enabling checkpoint back. Let's guarantee that first by adding a retry logic on sync_inodes_sb(). In addition to that, this patch adds to flush data in fsync when checkpoint is disabled, which can mitigate the sync_inodes_sb() failures in advance. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c8dc3047c48540183744f959412d44b08c5435e1 Author: Chao Yu Date: Wed Aug 25 19:34:19 2021 +0800 f2fs: fix to unmap pages from userspace process in punch_hole() We need to unmap pages from userspace process before removing pagecache in punch_hole() like we did in f2fs_setattr(). Similar change: commit 5e44f8c374dc ("ext4: hole-punch use truncate_pagecache_range") Fixes: fbfa2cc58d53 ("f2fs: add file operations") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit adf9ea89c719c1d23794e363f631e376b3ff8cbc Author: Chao Yu Date: Thu Aug 26 10:03:15 2021 +0800 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() In below path, it will return ENOENT if filesystem is shutdown: - f2fs_map_blocks - f2fs_get_dnode_of_data - f2fs_get_node_page - __get_node_page - read_node_page - is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) return -ENOENT - force return value from ENOENT to 0 It should be fine for read case, since it indicates a hole condition, and caller could use .m_next_pgofs to skip the hole and continue the lookup. However it may cause confusing for write case, since leaving a hole there, and said nothing was wrong doesn't help. There is at least one case from dax_iomap_actor() will complain that, so fix this in prior to supporting dax in f2fs. xfstest generic/388 reports below warning: ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 485833 at fs/dax.c:1127 dax_iomap_actor+0x339/0x370 Call Trace: iomap_apply+0x1c4/0x7b0 ? dax_iomap_rw+0x1c0/0x1c0 dax_iomap_rw+0xad/0x1c0 ? dax_iomap_rw+0x1c0/0x1c0 f2fs_file_write_iter+0x5ab/0x970 [f2fs] do_iter_readv_writev+0x273/0x2e0 do_iter_write+0xab/0x1f0 vfs_iter_write+0x21/0x40 iter_file_splice_write+0x287/0x540 do_splice+0x37c/0xa60 __x64_sys_splice+0x15f/0x3a0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs: ------------[ cut here ]------------ RIP: 0010:dax_iomap_pte_fault.isra.0+0x72e/0x14a0 Call Trace: dax_iomap_fault+0x44/0x70 f2fs_dax_huge_fault+0x155/0x400 [f2fs] f2fs_dax_fault+0x18/0x30 [f2fs] __do_fault+0x4e/0x120 do_fault+0x3cf/0x7a0 __handle_mm_fault+0xa8c/0xf20 ? find_held_lock+0x39/0xd0 handle_mm_fault+0x1b6/0x480 do_user_addr_fault+0x320/0xcd0 ? rcu_read_lock_sched_held+0x67/0xc0 exc_page_fault+0x77/0x3f0 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 Fixes: 83a3bfdb5a8a ("f2fs: indicate shutdown f2fs to allow unmount successfully") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ad126ebddecbf696e0cf214ff56c7b170fa9f0f7 Author: Chao Yu Date: Tue Aug 24 08:12:08 2021 +0800 f2fs: fix to account missing .skipped_gc_rwsem There is a missing place we forgot to account .skipped_gc_rwsem, fix it. Fixes: 6f8d4455060d ("f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d75da8c8a4c5c761936e4a51403f5f21e3aba935 Author: Chao Yu Date: Tue Aug 24 08:11:38 2021 +0800 f2fs: adjust unlock order for cleanup This patch adjusts unlock order of .i_mmap_sem and .i_gc_rwsem for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4d67490498acb4ffcef5ba7bc44990d46e66a44c Author: Fengnan Chang Date: Thu Aug 19 16:02:37 2021 +0800 f2fs: Don't create discard thread when device doesn't support realtime discard Don't create discard thread when device doesn't support realtime discard or user specifies nodiscard mount option. Signed-off-by: Fengnan Chang Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3513431926f9bfe3f4fcb06a39d9ec59b0470311 Merge: 2287a51ba8223 e43de7f0862b8 Author: Linus Torvalds Date: Mon Aug 30 10:04:31 2021 -0700 Merge tag 'fsnotify_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "fsnotify speedups when notification actually isn't used and support for identifying processes which caused fanotify events through pidfd instead of normal pid" * tag 'fsnotify_for_v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: optimize the case of no marks of any type fsnotify: count all objects with attached connectors fsnotify: count s_fsnotify_inode_refs for attached connectors fsnotify: replace igrab() with ihold() on attach connector fanotify: add pidfd support to the fanotify API fanotify: introduce a generic info record copying helper fanotify: minor cosmetic adjustments to fid labels kernel/pid.c: implement additional checks upon pidfd_create() parameters kernel/pid.c: remove static qualifier from pidfd_create() commit 2287a51ba822384834dafc1c798453375d1107c7 Author: Linus Torvalds Date: Mon Aug 30 08:55:18 2021 -0700 vt_kdsetmode: extend console locking As per the long-suffering comment. Reported-by: Minh Yuan Cc: Greg Kroah-Hartman Cc: Jiri Slaby Signed-off-by: Linus Torvalds commit e8b8e97f91b80f08a2f1b7ea4f81e7af61b2cc2f Author: Kari Argillander Date: Tue Aug 3 14:57:09 2021 +0300 fs/ntfs3: Restyle comments to better align with kernel-doc Capitalize comments and end with period for better reading. Also function comments are now little more kernel-doc style. This way we can easily convert them to kernel-doc style if we want. Note that these are not yet complete with this style. Example function comments start with /* and in kernel-doc style they start /**. Use imperative mood in function descriptions. Change words like ntfs -> NTFS, linux -> Linux. Use "we" not "I" when commenting code. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 3a2b2eb55681158d3e3ef464fbf47574cf0c517c Author: nick black Date: Mon Aug 30 04:56:15 2021 -0400 console: consume APC, DM, DCS The Linux console's VT102 implementation already consumes OSC ("Operating System Command") sequences, probably because that's how palette changes are transmitted. In addition to OSC, there are three other major clases of ANSI control strings: APC ("Application Program Command"), PM ("Privacy Message"), and DCS ("Device Control String"). They are handled similarly to OSC in terms of termination. Source: vt100.net Add three new enumerated states, one for each of these types. All three are handled the same way right now--they simply consume input until terminated. I hope to expand upon this firmament in the future. Add new predicate ansi_control_string(), returning true for any of these states. Replace explicit checks against ESosc with calls to this function. Transition to these states appropriately from the escape initiation (ESesc) state. This was motivated by the following Notcurses bugs: https://github.com/dankamongmen/notcurses/issues/2050 https://github.com/dankamongmen/notcurses/issues/1828 https://github.com/dankamongmen/notcurses/issues/2069 where standard VT sequences are not consumed by the Linux console. It's not necessary that the Linux console *support* these sequences, but it ought *consume* these well-specified classes of sequences. Tested by sending a variety of escape sequences to the console, and verifying that they still worked, or were now properly consumed. Verified that the escapes were properly terminated at a generic level. Verified that the Notcurses tools continued to show expected output on the Linux console, except now without escape bleedthrough. Link: https://lore.kernel.org/lkml/YSydL0q8iaUfkphg@schwarzgerat.orthanc/ Signed-off-by: nick black Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Tetsuo Handa Cc: Daniel Vetter Signed-off-by: Linus Torvalds commit 291d47ccad191322524d77e0769dadcc8a811630 Author: Linus Torvalds Date: Wed Jul 21 12:01:28 2021 -0700 string: improve default out-of-line memcmp() implementation This just does the "if the architecture does efficient unaligned handling, start the memcmp using 'unsigned long' accesses", since Nikolay Borisov found a load that cares. This is basically the minimal patch, and limited to architectures that are known to not have slow unaligned handling. We've had the stupid byte-at-a-time version forever, and nobody has ever even noticed before, so let's keep the fix minimal. A potential further improvement would be to align one of the sources in order to at least minimize unaligned cases, but the only real case of bigger memcmp() users seems to be the FIDEDUPERANGE ioctl(). As David Sterba says, the dedupe ioctl is typically called on ranges spanning many pages so the common case will all be page-aligned anyway. All the relevant architectures select HAVE_EFFICIENT_UNALIGNED_ACCESS, so I'm not going to worry about the combination of a very rare use-case and a rare architecture until somebody actually hits it. Particularly since Nikolay also tested the more complex patch with extra alignment handling code, and it only added overhead. Link: https://lore.kernel.org/lkml/20210721135926.602840-1-nborisov@suse.com/ Reported-by: Nikolay Borisov Cc: David Sterba Signed-off-by: Linus Torvalds commit c985aafb60e972c0a6b8d0bd65e03af5890b748a Merge: 715d3edb79c6c 26d1982fd17c2 Author: Petr Mladek Date: Mon Aug 30 16:36:10 2021 +0200 Merge branch 'rework/printk_safe-removal' into for-linus commit 715d3edb79c6c2b68dedf348b0aa96e61f360292 Merge: baa99c926718c 11e4b63abbe23 Author: Petr Mladek Date: Mon Aug 30 16:33:04 2021 +0200 Merge branch 'rework/fixup-for-5.15' into for-linus commit 87df7fb922d18e96992aa5e824aa34b2065fef59 Author: Jens Axboe Date: Mon Aug 30 07:45:47 2021 -0600 io-wq: fix wakeup race when adding new work When new work is added, io_wqe_enqueue() checks if we need to wake or create a new worker. But that check is done outside the lock that otherwise synchronizes us with a worker going to sleep, so we can end up in the following situation: CPU0 CPU1 lock insert work unlock atomic_read(nr_running) != 0 lock atomic_dec(nr_running) no wakeup needed Hold the wqe lock around the "need to wakeup" check. Then we can also get rid of the temporary work_flags variable, as we know the work will remain valid as long as we hold the lock. Cc: stable@vger.kernel.org Reported-by: Andres Freund Signed-off-by: Jens Axboe commit a9a4aa9fbfc5b87f315c63d9a317648774a46879 Author: Jens Axboe Date: Mon Aug 30 06:33:08 2021 -0600 io-wq: wqe and worker locks no longer need to be IRQ safe io_uring no longer queues async work off completion handlers that run in hard or soft interrupt context, and that use case was the only reason that io-wq had to use IRQ safe locks for wqe and worker locks. Signed-off-by: Jens Axboe commit ecc53c48c13d995e6fe5559e30ffee48d92784fd Author: Jens Axboe Date: Sun Aug 29 16:13:03 2021 -0600 io-wq: check max_worker limits if a worker transitions bound state For the two places where new workers are created, we diligently check if we are allowed to create a new worker. If we're currently at the limit of how many workers of a given type we can have, then we don't create any new ones. If you have a mixed workload with various types of bound and unbounded work, then it can happen that a worker finishes one type of work and is then transitioned to the other type. For this case, we don't check if we are actually allowed to do so. This can cause io-wq to temporarily exceed the allowed number of workers for a given type. When retrieving work, check that the types match. If they don't, check if we are allowed to transition to the other type. If not, then don't handle the new work. Cc: stable@vger.kernel.org Reported-by: Johannes Lundberg Signed-off-by: Jens Axboe commit a05b42702d69776db27aee81dca965c02c42e13f Author: James Clark Date: Wed Aug 25 17:42:59 2021 +0100 perf tests: Fix *probe_vfs_getname.sh test failures The commit 4d6101f5fd5d9960 ("perf probe: Clarify error message about not finding kernel modules debuginfo") changed the error message "Failed to find the path for kernel" to "Failed to find the path for the kernel". Update the regex so that the tests still skip rather than fail when kernel debug symbols aren't present. Signed-off-by: James Clark Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Link: http://lore.kernel.org/lkml/20210825164259.833222-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit edf7b4a2d85e37a1ee77156bddaed4aa6af9c5e1 Author: Arnaldo Carvalho de Melo Date: Wed Aug 25 11:50:37 2021 -0300 perf bench inject-buildid: Handle writen() errors The build on fedora:35 and fedora:rawhide with clang is failing with: 49 41.00 fedora:35 : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35) bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable] u64 len = 0; ^ 1 error generated. make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2 50 41.11 fedora:rawhide : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35) bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable] u64 len = 0; ^ 1 error generated. make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2 That 'len' variable is not used at all, so just make sure all the synthesize_RECORD() routines return ssize_t to propagate the writen() return, as it may fail, ditch the 'ret' var and bail out if those routines fail. Fixes: 0bf02a0d80427f26 ("perf bench: Add build-id injection benchmark") Acked-by: Namhyung Kim Link: http://lore.kernel.org/lkml/CAM9d7cgEZNSor+B+7Y2C+QYGme_v5aH0Zn0RLfxoQ+Fy83EHrg@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit cdf32b44678c382a31dc183d9a767306915cda7b Author: Li Huafei Date: Mon Aug 23 21:43:40 2021 +0800 perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} When setting LIBUNWIND_DIR, we first set FEATURE_CHECK_LDFLAGS-libunwind-{aarch64,x86} = -L$(LIBUNWIND_DIR)/lib. This happens a bit before, the overwritting, in: libunwind_arch_set_flags = $(eval $(libunwind_arch_set_flags_code)) define libunwind_arch_set_flags_code FEATURE_CHECK_CFLAGS-libunwind-$(1) = -I$(LIBUNWIND_DIR)/include FEATURE_CHECK_LDFLAGS-libunwind-$(1) = -L$(LIBUNWIND_DIR)/lib endef ifdef LIBUNWIND_DIR LIBUNWIND_CFLAGS = -I$(LIBUNWIND_DIR)/include LIBUNWIND_LDFLAGS = -L$(LIBUNWIND_DIR)/lib LIBUNWIND_ARCHS = x86 x86_64 arm aarch64 debug-frame-arm debug-frame-aarch64 $(foreach libunwind_arch,$(LIBUNWIND_ARCHS),$(call libunwind_arch_set_flags,$(libunwind_arch))) endif Look at that 'foreach' on all the LIBUNWIND_ARCHS. After commit 5c4d7c82c0dc ("perf unwind: Do not put libunwind-{x86,aarch64} in FEATURE_TESTS_BASIC"), FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} is overwritten. As a result, the remote libunwind libraries cannot be searched from $(LIBUNWIND_DIR)/lib directory during feature check tests. Fix it with variable appending. Before this patch: perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64 BUILD: Doing 'make -j16' parallel build ... ... libopencsd: [ OFF ] ... libunwind-x86: [ OFF ] ... libunwind-x86_64: [ OFF ] ... libunwind-arm: [ OFF ] ... libunwind-aarch64: [ OFF ] ... libunwind-debug-frame: [ OFF ] ... libunwind-debug-frame-arm: [ OFF ] ... libunwind-debug-frame-aarch64: [ OFF ] ... cxx: [ OFF ] perf$ cat ../build/feature/test-libunwind-aarch64.make.output /usr/bin/ld: cannot find -lunwind-aarch64 /usr/bin/ld: cannot find -lunwind-aarch64 collect2: error: ld returned 1 exit status After this patch: perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64 BUILD: Doing 'make -j16' parallel build ... libopencsd: [ OFF ] ... libunwind-x86: [ OFF ] ... libunwind-x86_64: [ OFF ] ... libunwind-arm: [ OFF ] ... libunwind-aarch64: [ on ] ... libunwind-debug-frame: [ OFF ] ... libunwind-debug-frame-arm: [ OFF ] ... libunwind-debug-frame-aarch64: [ OFF ] ... cxx: [ OFF ] perf$ cat ../build/feature/test-libunwind-aarch64.make.output perf$ ldd ./perf linux-vdso.so.1 (0x00007ffdf07da000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f30953dc000) librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f30951d4000) libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f3094e36000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3094c32000) libelf.so.1 => /usr/lib/x86_64-linux-gnu/libelf.so.1 (0x00007f3094a18000) libdw.so.1 => /usr/lib/x86_64-linux-gnu/libdw.so.1 (0x00007f30947cc000) libunwind-x86_64.so.8 => /usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8 (0x00007f30945ad000) libunwind.so.8 => /usr/lib/x86_64-linux-gnu/libunwind.so.8 (0x00007f3094392000) liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f309416c000) libunwind-aarch64.so.8 => not found libslang.so.2 => /lib/x86_64-linux-gnu/libslang.so.2 (0x00007f3093c8a000) libpython2.7.so.1.0 => /usr/local/lib/libpython2.7.so.1.0 (0x00007f309386b000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f309364e000) libnuma.so.1 => /usr/lib/x86_64-linux-gnu/libnuma.so.1 (0x00007f3093443000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3093052000) /lib64/ld-linux-x86-64.so.2 (0x00007f3096097000) libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f3092e42000) libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f3092c3f000) Fixes: 5c4d7c82c0dceccf ("perf unwind: Do not put libunwind-{x86,aarch64} in FEATURE_TESTS_BASIC") Signed-off-by: Li Huafei Cc: Alexander Shishkin Cc: He Kuang Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Zhang Jinhao Link: http://lore.kernel.org/lkml/20210823134340.60955-1-lihuafei1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 261f491133aecb943ccfdc3b3794e2d775607a87 Author: Arnaldo Carvalho de Melo Date: Fri Aug 20 11:13:36 2021 -0300 perf config: Fix caching and memory leak in perf_home_perfconfig() Acaict, perf_home_perfconfig() is supposed to cache the result of home_perfconfig, which returns the default location of perfconfig for the user, given the HOME environment variable. However, the current implementation calls home_perfconfig every time perf_home_perfconfig() is called (so no caching is actually performed), replacing the previous pointer, thus also causing a memory leak. This patch adds a check of whether either config or failed is set and, in that case, directly returns config without calling home_perfconfig at each invocation. Fixes: f5f03e19ce14fc31 ("perf config: Add perf_home_perfconfig function") Signed-off-by: Riccardo Mancini Cc: Alexander Shishkin Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: http://lore.kernel.org/lkml/20210820130817.740536-1-rickyman7@gmail.com [ Removed needless double check for the 'failed' variable ] Signed-off-by: Arnaldo Carvalho de Melo commit 128dbd78bd673f9edbc4413072b23efb6657feb0 Author: Alexey Dobriyan Date: Tue Aug 17 14:58:33 2021 +0300 perf tools: Fixup get_current_dir_name() compilation strdup() prototype doesn't live in stdlib.h . Add limits.h for PATH_MAX definition as well. This fixes the build on Android. Signed-off-by: Alexey Dobriyan (SK hynix) Acked-by: Namhyung Kim Link: http://lore.kernel.org/lkml/YRukaQbrgDWhiwGr@localhost.localdomain Signed-off-by: Arnaldo Carvalho de Melo commit c635813fef0b2327ffecbfbd642f0009e186b3a5 Merge: 37c3193fa4d7d 7d2a07b769330 Author: Arnaldo Carvalho de Melo Date: Mon Aug 30 10:05:46 2021 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To pick up fixes. Signed-off-by: Arnaldo Carvalho de Melo commit a8729efbbb847f6ea9b06e73491ec8ddb560465e Merge: f7b82b12626e1 38b7673000949 Author: Takashi Iwai Date: Mon Aug 30 14:57:03 2021 +0200 Merge tag 'asoc-v5.15' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.15 Quite a quiet release this time, mostly a combination of cleanups and a good set of new drivers. - Lots of cleanups and improvements to the Intel drivers, including some new systems support. - New support for AMD Vangoh, CUI CMM-4030D-261, Mediatek Mt8195, Renesas RZ/G2L Mediatek Mt8195, RealTek RT101P, Renesas RZ/G2L,, Rockchip RK3568 S/PDIF. commit baa99c926718c1a1549a7e08383f53a8e2944f04 Merge: 71af75b692945 10102a890b543 Author: Petr Mladek Date: Mon Aug 30 14:56:28 2021 +0200 Merge branch 'for-5.15-verbose-console' into for-linus commit 71af75b6929458d85f63c0649dc26d6f4c19729e Merge: fe8e3ee0d5885 bc17bed5fd73e Author: Petr Mladek Date: Mon Aug 30 14:56:06 2021 +0200 Merge branch 'for-5.15-printk-index' into for-linus commit 6a217437f9f5482a3f6f2dc5fcd27cf0f62409ac Merge: 65f90c8e38c99 79fbd3e1241ce Author: Jason Gunthorpe Date: Mon Aug 30 09:49:59 2021 -0300 Merge branch 'sg_nents' into rdma.git for-next From Maor Gottlieb ==================== Fix the use of nents and orig_nents in the sg table append helpers. The nents should be used by the DMA layer to store the number of DMA mapped sges, the orig_nents is the number of CPU sges. Since the sg append logic doesn't always create a SGL with exactly orig_nents entries store a total_nents as well to allow the table to be properly free'd and reorganize the freeing logic to share across all the use cases. ==================== Signed-off-by: Jason Gunthorpe * 'sg_nents': RDMA: Use the sg_table directly and remove the opencoded version from umem lib/scatterlist: Fix wrong update of orig_nents lib/scatterlist: Provide a dedicated function to support table append commit 65f90c8e38c9900692338864156e7824cf8a6501 Author: Lior Nahmanson Date: Mon Aug 30 13:48:49 2021 +0300 RDMA/mlx5: Relax DCS QP creation checks In order to create DCS QPs, we don't need to rely on both log_max_dci_stream_channels and log_max_dci_errored_streams capabilities. Fixes: 11656f593a86 ("RDMA/mlx5: Add DCS offload support") Link: https://lore.kernel.org/r/3e7b3363fd73686176cc584295e86832a7cf99b2.1630320354.git.leonro@nvidia.com Signed-off-by: Lior Nahmanson Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1c3ac086fd6956ae6124f45672bec227086e05db Author: Rob Herring Date: Tue Aug 24 14:51:54 2021 -0500 dt-bindings: Use 'enum' instead of 'oneOf' plus 'const' entries 'enum' is equivalent to 'oneOf' with a list of 'const' entries, but 'enum' is more concise and yields better error messages. Cc: Maxime Ripard Cc: Vignesh R Cc: Marc Zyngier Cc: Mauro Carvalho Chehab Cc: Lee Jones Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Bjorn Helgaas Cc: Kishon Vijay Abraham I Cc: Daniel Lezcano Cc: dmaengine@vger.kernel.org Cc: linux-i2c@vger.kernel.org Cc: linux-media@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-pci@vger.kernel.org Cc: linux-phy@lists.infradead.org Cc: linux-serial@vger.kernel.org Cc: alsa-devel@alsa-project.org Cc: linux-spi@vger.kernel.org Acked-by: Sakari Ailus (mipi-ccs) Acked-by: Mark Brown Reviewed-by: Vinod Koul Acked-By: Vinod Koul Acked-by: Wolfram Sang # for I2C Acked-by: Greg Kroah-Hartman Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20210824202014.978922-1-robh@kernel.org commit 1b9fbe813016b08e08b22ddba4ddbf9cb1b04b00 Author: Yajun Deng Date: Mon Aug 30 17:16:40 2021 +0800 net: ipv4: Fix the warning for dereference Add a if statements to avoid the warning. Dan Carpenter report: The patch faf482ca196a: "net: ipv4: Move ip_options_fragment() out of loop" from Aug 23, 2021, leads to the following Smatch complaint: net/ipv4/ip_output.c:833 ip_do_fragment() warn: variable dereferenced before check 'iter.frag' (see line 828) Reported-by: Dan Carpenter Fixes: faf482ca196a ("net: ipv4: Move ip_options_fragment() out of loop") Link: https://lore.kernel.org/netdev/20210830073802.GR7722@kadam/T/#t Signed-off-by: Yajun Deng Signed-off-by: David S. Miller commit 38b7673000949ca784fcb8a9feb70d2a802befa6 Merge: a617f7d45c499 3202e2f5fac00 Author: Mark Brown Date: Mon Aug 30 12:30:33 2021 +0100 Merge remote-tracking branch 'asoc/for-5.15' into asoc-linus commit a617f7d45c499b56689cdcef37dfa86fdeb99940 Merge: e22ce8eb631bd e6d0b92ac00b5 Author: Mark Brown Date: Mon Aug 30 12:30:31 2021 +0100 Merge remote-tracking branch 'asoc/for-5.14' into asoc-linus commit aaa8e4922c887ff47ad66ef918193682bccc1905 Author: Dan Carpenter Date: Mon Aug 30 11:37:17 2021 +0300 net: qrtr: make checks in qrtr_endpoint_post() stricter These checks are still not strict enough. The main problem is that if "cb->type == QRTR_TYPE_NEW_SERVER" is true then "len - hdrlen" is guaranteed to be 4 but we need to be at least 16 bytes. In fact, we can reject everything smaller than sizeof(*pkt) which is 20 bytes. Also I don't like the ALIGN(size, 4). It's better to just insist that data is needs to be aligned at the start. Fixes: 0baa99ee353c ("net: qrtr: Allow non-immediate node routing") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit efe487fce3061d94222c6501d7be3aa549b3dc78 Author: Haimin Zhang Date: Mon Aug 30 11:47:01 2021 +0800 fix array-index-out-of-bounds in taprio_change syzbot report an array-index-out-of-bounds in taprio_change index 16 is out of range for type '__u16 [16]' that's because mqprio->num_tc is lager than TC_MAX_QUEUE,so we check the return value of netdev_set_num_tc. Reported-by: syzbot+2b3e5fb6c7ef285a94f6@syzkaller.appspotmail.com Signed-off-by: Haimin Zhang Signed-off-by: David S. Miller commit e842cb60e8ac1d8a15b01e0dd4dad453807a597d Author: 王贇 Date: Mon Aug 30 18:28:01 2021 +0800 net: fix NULL pointer reference in cipso_v4_doi_free In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc failed, we sometime observe panic: BUG: kernel NULL pointer dereference, address: ... RIP: 0010:cipso_v4_doi_free+0x3a/0x80 ... Call Trace: netlbl_cipsov4_add_std+0xf4/0x8c0 netlbl_cipsov4_add+0x13f/0x1b0 genl_family_rcv_msg_doit.isra.15+0x132/0x170 genl_rcv_msg+0x125/0x240 This is because in cipso_v4_doi_free() there is no check on 'doi_def->map.std' when doi_def->type got value 1, which is possibe, since netlbl_cipsov4_add_std() haven't initialize it before alloc 'doi_def->map.std'. This patch just add the check to prevent panic happen in similar cases. Reported-by: Abaci Signed-off-by: Michael Wang Signed-off-by: David S. Miller commit 63cad4c7439c826be31e03af9edf7fa4e2e0cd46 Merge: 9dfa859da0f5f 67d6d681e15b5 Author: David S. Miller Date: Mon Aug 30 12:21:38 2021 +0100 Merge branch 'inet-exceptions-less-predictable' Eric Dumazet says: ==================== inet: make exception handling less predictible This second round of patches is addressing Keyu Man recommendations to make linux hosts more robust against a class of brute force attacks. ==================== Signed-off-by: David S. Miller commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e Author: Eric Dumazet Date: Sun Aug 29 15:16:15 2021 -0700 ipv4: make exception cache less predictible Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()"), an attacker can still use brute force to learn some secrets from a victim linux host. One way to defeat these attacks is to make the max depth of the hash table bucket a random value. Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack. After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets. This is slightly increasing memory size used by the hash table, by 50% in average, we do not expect this to be a problem. This patch is more complex than the prior one (IPv6 equivalent), because IPv4 was reusing the oldest entry. Since we need to be able to evict more than one entry per update_or_create_fnhe() call, I had to replace fnhe_oldest() with fnhe_remove_oldest(). Also note that we will queue extra kfree_rcu() calls under stress, which hopefully wont be a too big issue. Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.") Signed-off-by: Eric Dumazet Reported-by: Keyu Man Cc: Willy Tarreau Signed-off-by: David S. Miller Reviewed-by: David Ahern Tested-by: David Ahern Signed-off-by: David S. Miller commit a00df2caffed3883c341d5685f830434312e4a43 Author: Eric Dumazet Date: Sun Aug 29 15:16:14 2021 -0700 ipv6: make exception cache less predictible Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), an attacker can still use brute force to learn some secrets from a victim linux host. One way to defeat these attacks is to make the max depth of the hash table bucket a random value. Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack. After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets. This is slightly increasing memory size used by the hash table, we do not expect this to be a problem. Following patch is dealing with the same issue in IPv4. Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") Signed-off-by: Eric Dumazet Reported-by: Keyu Man Cc: Wei Wang Cc: Martin KaFai Lau Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 3202e2f5fac0032cb1128fb8d5b7f3368902c8d8 Author: Mark Brown Date: Mon Aug 30 12:13:46 2021 +0100 ASoC: Revert PCM trigger changes These have turned up some issues in further testing. Signed-off-by: Mark Brown commit 927932240aa1739ac8c92b142a5e2dcc490f36e0 Author: Heiko Carstens Date: Mon Aug 30 12:46:17 2021 +0200 s390: remove SCHED_CORE from defconfigs This causes too many problems. Enable it again when everything has been sorted out. Signed-off-by: Heiko Carstens commit 1a0df28c09831dc4bd336fe6e090bbe85a07e79f Author: zhaoxiao Date: Wed Aug 25 19:41:11 2021 +0800 x86: xen: platform-pci-unplug: use pr_err() and pr_warn() instead of raw printk() Since we have the nice helpers pr_err() and pr_warn(), use them instead of raw printk(). [jgross@suse.com] Move the "#define pr_fmt" above the #includes in order to avoid build warnings due to redefinition. Signed-off-by: zhaoxiao Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20210825114111.29009-1-zhaoxiao@uniontech.com Signed-off-by: Juergen Gross commit bb70913dceca050e8f4f60ba5361fcf62460df06 Author: Jing Yangyang Date: Tue Aug 24 23:24:51 2021 -0700 drivers/xen/xenbus/xenbus_client.c: fix bugon.cocci warnings Use BUG_ON instead of a if condition followed by BUG. Generated by: scripts/coccinelle/misc/bugon.cocci Reported-by: Zeal Robot Signed-off-by: Jing Yangyang Reviewed-by: SeongJae Park Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20210825062451.69998-1-deng.changcheng@zte.com.cn Signed-off-by: Juergen Gross commit b94e4b147fd1992ad450e1fea1fdaa3738753373 Author: Juergen Gross Date: Fri Jul 30 12:38:54 2021 +0200 xen/blkfront: don't trust the backend response data blindly Today blkfront will trust the backend to send only sane response data. In order to avoid privilege escalations or crashes in case of malicious backends verify the data to be within expected limits. Especially make sure that the response always references an outstanding request. Introduce a new state of the ring BLKIF_STATE_ERROR which will be switched to in case an inconsistency is being detected. Recovering from this state is possible only via removing and adding the virtual device again (e.g. via a suspend/resume cycle). Make all warning messages issued due to valid error responses rate limited in order to avoid message floods being triggered by a malicious backend. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Acked-by: Roger Pau Monné Link: https://lore.kernel.org/r/20210730103854.12681-4-jgross@suse.com Signed-off-by: Juergen Gross commit 8f5a695d99000fc3aa73934d7ced33cfc64dcdab Author: Juergen Gross Date: Fri Jul 30 12:38:53 2021 +0200 xen/blkfront: don't take local copy of a request from the ring page In order to avoid a malicious backend being able to influence the local copy of a request build the request locally first and then copy it to the ring page instead of doing it the other way round as today. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Acked-by: Roger Pau Monné Link: https://lore.kernel.org/r/20210730103854.12681-3-jgross@suse.com Signed-off-by: Juergen Gross commit 71b66243f9898d0e54296b4e7035fb33cdcb0707 Author: Juergen Gross Date: Fri Jul 30 12:38:52 2021 +0200 xen/blkfront: read response from backend only once In order to avoid problems in case the backend is modifying a response on the ring page while the frontend has already seen it, just read the response into a local buffer in one go and then operate on that buffer only. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Acked-by: Roger Pau Monné Link: https://lore.kernel.org/r/20210730103854.12681-2-jgross@suse.com Signed-off-by: Juergen Gross commit 9dfa859da0f5fe9dae4d2fca76c5c0272e43c702 Merge: 724812d8561c3 7a3f5b0de3647 Author: David S. Miller Date: Mon Aug 30 10:57:54 2021 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Clean up and consolidate ct ecache infrastructure by merging ct and expect notifiers, from Florian Westphal. 2) Missing counters and timestamp in nfnetlink_queue and _log conntrack information. 3) Missing error check for xt_register_template() in iptables mangle, as a incremental fix for the previous pull request, also from Florian Westphal. 4) Add netfilter hooks for the SRv6 lightweigh tunnel driver, from Ryoga Sato. The hooks are enabled via nf_hooks_lwtunnel sysctl to make sure existing netfilter rulesets do not break. There is a static key to disable the hooks by default. The pktgen_bench_xmit_mode_netif_receive.sh shows no noticeable impact in the seg6_input path for non-netfilter users: similar numbers with and without this patch. This is a sample of the perf report output: 11.67% kpktgend_0 [ipv6] [k] ipv6_get_saddr_eval 7.89% kpktgend_0 [ipv6] [k] __ipv6_addr_label 7.52% kpktgend_0 [ipv6] [k] __ipv6_dev_get_saddr 6.63% kpktgend_0 [kernel.vmlinux] [k] asm_exc_nmi 4.74% kpktgend_0 [ipv6] [k] fib6_node_lookup_1 3.48% kpktgend_0 [kernel.vmlinux] [k] pskb_expand_head 3.33% kpktgend_0 [ipv6] [k] ip6_rcv_core.isra.29 3.33% kpktgend_0 [ipv6] [k] seg6_do_srh_encap 2.53% kpktgend_0 [ipv6] [k] ipv6_dev_get_saddr 2.45% kpktgend_0 [ipv6] [k] fib6_table_lookup 2.24% kpktgend_0 [kernel.vmlinux] [k] ___cache_free 2.16% kpktgend_0 [ipv6] [k] ip6_pol_route 2.11% kpktgend_0 [kernel.vmlinux] [k] __ipv6_addr_type ==================== Signed-off-by: David S. Miller commit 30dcc56bba911db561c35d4131baf983a41023f8 Author: Juergen Gross Date: Fri Jul 30 09:18:04 2021 +0200 xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests XENFEAT_gnttab_map_avail_bits is always set in Xen 4.0 and newer. Remove coding assuming it might be zero. Signed-off-by: Juergen Gross Acked-by: Peter Zijlstra (Intel) Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210730071804.4302-4-jgross@suse.com Signed-off-by: Juergen Gross commit 2526cff7c4f944924f39043dc657189eccc4fe5c Author: Juergen Gross Date: Fri Jul 30 09:18:03 2021 +0200 xen: assume XENFEAT_mmu_pt_update_preserve_ad being set for pv guests XENFEAT_mmu_pt_update_preserve_ad is always set in Xen 4.0 and newer. Remove coding assuming it might be zero. Signed-off-by: Juergen Gross Acked-by: Peter Zijlstra (Intel) Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210730071804.4302-3-jgross@suse.com Signed-off-by: Juergen Gross commit ac4c403c9036793dfbf63e75acd1772cdac778de Author: Juergen Gross Date: Fri Jul 30 09:18:02 2021 +0200 xen: check required Xen features Linux kernel is not supported to run on Xen versions older than 4.0. Add tests for required Xen features always being present in Xen 4.0 and newer. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20210730071804.4302-2-jgross@suse.com Signed-off-by: Juergen Gross commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f Author: Juergen Gross Date: Fri Jul 30 11:26:21 2021 +0200 xen: fix setting of max_pfn in shared_info Xen PV guests are specifying the highest used PFN via the max_pfn field in shared_info. This value is used by the Xen tools when saving or migrating the guest. Unfortunately this field is misnamed, as in reality it is specifying the number of pages (including any memory holes) of the guest, so it is the highest used PFN + 1. Renaming isn't possible, as this is a public Xen hypervisor interface which needs to be kept stable. The kernel will set the value correctly initially at boot time, but when adding more pages (e.g. due to memory hotplug or ballooning) a real PFN number is stored in max_pfn. This is done when expanding the p2m array, and the PFN stored there is even possibly wrong, as it should be the last possible PFN of the just added P2M frame, and not one which led to the P2M expansion. Fix that by setting shared_info->max_pfn to the last possible PFN + 1. Fixes: 98dd166ea3a3c3 ("x86/xen/p2m: hint at the last populated P2M entry") Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Link: https://lore.kernel.org/r/20210730092622.9973-2-jgross@suse.com Signed-off-by: Juergen Gross commit d7e7747ac5c2496c98291944c6066adaa9f3b975 Author: Florian Westphal Date: Thu Aug 26 15:54:22 2021 +0200 netfilter: refuse insertion if chain has grown too large Also add a stat counter for this that gets exported both via old /proc interface and ctnetlink. Assuming the old default size of 16536 buckets and max hash occupancy of 64k, this results in 128k insertions (origin+reply), so ~8 entries per chain on average. The revised settings in this series will result in about two entries per bucket on average. This allows a hard-limit ceiling of 64. This is not tunable at the moment, but its possible to either increase nf_conntrack_buckets or decrease nf_conntrack_max to reduce average lengths. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit dd6d2910c5e071a8683827df1a89e527aa5145ab Author: Florian Westphal Date: Thu Aug 26 15:54:20 2021 +0200 netfilter: conntrack: switch to siphash Replace jhash in conntrack and nat core with siphash. While at it, use the netns mix value as part of the input key rather than abuse the seed value. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d532bcd0b2699d84d71a0c71d37157ac6eb3be25 Author: Florian Westphal Date: Thu Aug 26 15:54:19 2021 +0200 netfilter: conntrack: sanitize table size default settings conntrack has two distinct table size settings: nf_conntrack_max and nf_conntrack_buckets. The former limits how many conntrack objects are allowed to exist in each namespace. The second sets the size of the hashtable. As all entries are inserted twice (once for original direction, once for reply), there should be at least twice as many buckets in the table than the maximum number of conntrack objects that can exist at the same time. Change the default multiplier to 1 and increase the chosen bucket sizes. This results in the same nf_conntrack_max settings as before but reduces the average bucket list length. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 724812d8561c32d2564a90c2fdf94fd7431658b4 Merge: 27c779437cbc9 e9e506221b425 Author: David S. Miller Date: Mon Aug 30 09:59:11 2021 +0100 Merge branch 'IXP46x-PTP-Timer' Linus Walleij says: ==================== IXP46x PTP Timer clean-up and DT ChangeLog v2->v3: - Dropped the patch enabling compile tests: we are still dependent on some machine-specific headers. The plan is to get rid of this after device tree conversion. We include one of the compile testing fixes anyway, because it is nice to have fixed. - Rebased on the latest net-next ==================== Signed-off-by: David S. Miller commit e9e506221b425f3c48fbace164d9d7543643ff1f Author: Linus Walleij Date: Sat Aug 28 19:15:48 2021 +0200 ixp4xx_eth: Probe the PTP module from the device tree This adds device tree probing support for the PTP module adjacent to the ethernet module. It is pretty straight forward, all resources are in the device tree as they come to the platform device. Cc: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit 323fb75dae2808750a87250ffc502ba10c231dad Author: Linus Walleij Date: Sat Aug 28 19:15:47 2021 +0200 ixp4xx_eth: Add devicetree bindings This adds device tree bindings for the IXP46x PTP Timer, a companion to the IXP4xx ethernet in newer platforms. Cc: devicetree@vger.kernel.org Cc: Arnd Bergmann Reviewed-by: Rob Herring Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit 13dc931918ac7c1f5bc919f4a9049aa10f27ceee Author: Linus Walleij Date: Sat Aug 28 19:15:46 2021 +0200 ixp4xx_eth: Stop referring to GPIOs The driver is being passed interrupts, then looking up the same interrupts as GPIOs a second time to convert them into interrupts and set properties on them. This is pointless: the GPIO and irqchip APIs of a GPIO chip are orthogonal. Just request the interrupts and be done with it, drop reliance on any GPIO functions or definitions. Use devres-managed functions and add a small devress quirk to unregister the clock as well and we can rely on devres to handle all the resources and cut down a bunch of boilerplate in the process. Cc: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit f52749a285646d51a1b3f8fdc33881983e15ee5d Author: Arnd Bergmann Date: Sat Aug 28 19:15:45 2021 +0200 ixp4xx_eth: fix compile-testing Change the driver to use portable integer types to avoid warnings during compile testing, including: drivers/net/ethernet/xscale/ixp4xx_eth.c:721:21: error: cast to 'u32 *' (aka 'unsigned int *') from smaller integer type 'int' [-Werror,-Wint-to-pointer-cast] memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4); ^ drivers/net/ethernet/xscale/ixp4xx_eth.c:963:12: error: incompatible pointer types passing 'u32 *' (aka 'unsigned int *') to parameter of type 'dma_addr_t *' (aka 'unsigned long long *') [-Werror,-Wincompatible-pointer-types] &port->desc_tab_phys))) ^~~~~~~~~~~~~~~~~~~~ include/linux/dmapool.h:27:20: note: passing argument to parameter 'handle' here dma_addr_t *handle); ^ Signed-off-by: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit 9055a2f591629b952910503e72ddae1371c44bf1 Author: Arnd Bergmann Date: Sat Aug 28 19:15:44 2021 +0200 ixp4xx_eth: make ptp support a platform driver After the recent ixp4xx cleanups, the ptp driver has gained a build failure in some configurations: drivers/net/ethernet/xscale/ptp_ixp46x.c: In function 'ptp_ixp_init': drivers/net/ethernet/xscale/ptp_ixp46x.c:290:51: error: 'IXP4XX_TIMESYNC_BASE_VIRT' undeclared (first use in this function) Avoid the last bit of hardcoded constants from platform headers by turning the ptp driver bit into a platform driver and passing the IRQ and MMIO address as resources. This is a bit tricky: - The interface between the two drivers is now the new ixp46x_ptp_find() function, replacing the global ixp46x_phc_index variable. The call is done as late as possible, in hwtstamp_set(), to ensure that the ptp device is fully probed. - As the ptp driver is now called by the network driver, the link dependency is reversed, which in turn requires a small Makefile hack - The GPIO number is still left hardcoded. This is clearly not great, but it can be addressed later. Note that commit 98ac0cc270b7 ("ARM: ixp4xx: Convert to MULTI_IRQ_HANDLER") changed the IRQ number to something meaningless. Passing the correct IRQ in a resource fixes this. - When the PTP driver is disabled, ethtool .get_ts_info() now correctly lists only software timestamping regardless of the hardware. Signed-off-by: Arnd Bergmann [Fix a missing include] Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit 27c779437cbc903d318c12a5f54ea151aa3f307f Merge: 49f9df5ba298a 52d89333d2191 Author: David S. Miller Date: Mon Aug 30 09:43:19 2021 +0100 Merge branch 'hns3-cleanups' Guangbin Huang says: ==================== net: hns3: add some cleanups This series includes some cleanups for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 52d89333d21918ff0ac25d6f8307b7fe6cbfde11 Author: Hao Chen Date: Mon Aug 30 14:06:42 2021 +0800 net: hns3: uniform parameter name of hclge_ptp_clean_tx_hwts() The parameter name of hclge_ptp_clean_tx_hwts() in declaration is "dev", but the definition of this function is used the common name "hdev" as other functions, so modify it. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 38b99e1ede3280f0e286071956bd8632737be57b Author: Hao Chen Date: Mon Aug 30 14:06:41 2021 +0800 net: hnss3: use max() to simplify code Replace the "? :" statement wich max() to simplify code. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 5aea2da5930392055afc82e2fc02e706a022ba43 Author: Hao Chen Date: Mon Aug 30 14:06:40 2021 +0800 net: hns3: modify a print format of hns3_dbg_queue_map() The type of tqp_vector->vector_irq is int, so modify its print format to "%d". Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 04d96139ddb32dd15e5941c303f511a92759a5be Author: Guangbin Huang Date: Mon Aug 30 14:06:39 2021 +0800 net: hns3: refine function hclge_dbg_dump_tm_pri() To improve flexibility, simplicity and maintainability to dump info of every element of tm priority, add a struct hclge_dbg_item array of tm priority and fill string of every data according to this array. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 161ad669e6c23529415bffed5cb3bfa012e46cb4 Author: Guangbin Huang Date: Mon Aug 30 14:06:38 2021 +0800 net: hns3: reconstruct function hclge_ets_validate() This patch reconstructs function hclge_ets_validate() to reduce the code cycle complexity and make code more concise. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 4c8dab1c709c5a715bce14efdb8f4e889d86aa04 Author: Peng Li Date: Mon Aug 30 14:06:37 2021 +0800 net: hns3: reconstruct function hns3_self_test This patch reconstructs function hns3_self_test to reduce the code cycle complexity and make code more concise. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 60fe9ff9b7cbbf78a755cd849a3575d3b04b7394 Author: Jiaran Zhang Date: Mon Aug 30 14:06:36 2021 +0800 net: hns3: initialize each member of structure array on a separate line To make the format of each member initialization of structure array clearer, initialize each member on a separate line. Signed-off-by: Jiaran Zhang Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 49f9df5ba298a4b6754281e40ea80878a4d49c44 Merge: eaf2aaec0be46 68f684e257d7f Author: David S. Miller Date: Mon Aug 30 09:35:05 2021 +0100 Merge branch 'bnxt_en-fw-messages' Michael Chan says: ==================== bnxt_en: Implement new driver APIs to send FW messages The current driver APIs to send messages to the firmware allow only one outstanding message in flight. There is only one buffer for the firmware response for each firmware channel. To send a firmware message, all callers must take a mutex and it is released after the firmware response has been read. This scheme does not allow multiple firmware messages in flight. Firmware may take a long time to respond to some messages (e.g. NVRAM related ones) and this causes the mutex to be held for a long time, blocking other callers. This patchset intoduces the new driver APIs to address the above shortcomings. The new APIs are compatible with new and old firmware. But the new deferred firmware response mechanism will require newer firmware in order to allow multiple outstanding firmware commands. All callers are updated to use the new APIs. v2: Patch 4 and patch 9 updated to fix issues reported by test robot ==================== Signed-off-by: David S. Miller commit 68f684e257d7f3a6303b0e838bfa982c74f2c8da Author: Edwin Peer Date: Sun Aug 29 03:35:06 2021 -0400 bnxt_en: support multiple HWRM commands in flight Add infrastructure to maintain a pending list of HWRM commands awaiting completion and reduce the scope of the hwrm_cmd_lock mutex so that it protects only the request mailbox. The mailbox is free to use for one or more concurrent commands after receiving deferred response events. For uniformity and completeness, use the same pending list for collecting completions for commands that respond via a completion ring. These commands are only used for freeing rings and for IRQ test and we only support one such command in flight. Note deferred responses are also only supported on the main channel. The secondary channel (KONG) does not support deferred responses. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b34695a894b88e50e16dd3dcb1098fe919023f14 Author: Edwin Peer Date: Sun Aug 29 03:35:05 2021 -0400 bnxt_en: remove legacy HWRM interface There are no longer any callers relying on the old API. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit bbf33d1d9805fc3a59ded637ab6555fb20edb5d2 Author: Edwin Peer Date: Sun Aug 29 03:35:04 2021 -0400 bnxt_en: update all firmware calls to use the new APIs The conversion follows this general pattern for most of the calls: 1. The input message is changed from a stack variable initialized using bnxt_hwrm_cmd_hdr_init() to a pointer allocated and intialized using hwrm_req_init(). 2. If we don't need to read the firmware response, the hwrm_send_message() call is replaced with hwrm_req_send(). 3. If we need to read the firmware response, the mutex lock is replaced by hwrm_req_hold() to hold the response. When the response is read, the mutex unlock is replaced by hwrm_req_drop(). If additional DMA buffers are needed for firmware response data, the hwrm_req_dma_slice() is used instead of calling dma_alloc_coherent(). Some minor refactoring is also done while doing these conversions. v2: Fix unintialized variable warnings in __bnxt_hwrm_get_tx_rings() and bnxt_approve_mac() Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3c10ed497fa87780a9ee8c31092373e5f1e20f64 Author: Edwin Peer Date: Sun Aug 29 03:35:03 2021 -0400 bnxt_en: use link_lock instead of hwrm_cmd_lock to protect link_info We currently use the hwrm_cmd_lock to serialize the update of the firmware's link status response data and the copying of link status data to the VF. This won't work when we update the firmware message APIs, so we use the link_lock mutex instead. All link_info data should be updated under the link_lock mutex. Also add link_lock to functions that touch link_info in __bnxt_open_nic() and bnxt_probe_phy(). The locking is probably not strictly necessary during probe, but it's more consistent. Signed-off-by: Edwin Peer Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit 2138081708405fb9c16a76a9b6ef46c35d3f17a9 Author: Edwin Peer Date: Sun Aug 29 03:35:02 2021 -0400 bnxt_en: add support for HWRM request slices Slices are a mechanism for suballocating DMA mapped regions from the request buffer. Such regions can be used for indirect command data instead of creating new mappings with dma_alloc_coherent(). The advantage of using a slice is that the lifetime of the slice is bound to the request and will be automatically unmapped when the request is consumed. A single external region is also supported. This allows for regions that will not fit inside the spare request buffer space such that the same API can be used consistently even for larger mappings. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit ecddc29d928d0ecccbc8f339b59ed75e5c8e8ecf Author: Edwin Peer Date: Sun Aug 29 03:35:01 2021 -0400 bnxt_en: add HWRM request assignment API hwrm_req_replace() provides an assignment like operation to replace a managed HWRM request object with data from a pre-built source. This is useful for handling request data provided by higher layer HWRM clients. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 02b9aa1068682319508f9a1678e993ad958a8a4f Author: Edwin Peer Date: Sun Aug 29 03:35:00 2021 -0400 bnxt_en: discard out of sequence HWRM responses During firmware crash recovery, it is possible for firmware to respond to stale HWRM commands that have already timed out. Because response buffers may be reused, any out of sequence responses need to be ignored and only the matching seq_id should be accepted. Also, READ_ONCE should be used for the reads from the DMA buffer to ensure that the necessary loads are scheduled. Reviewed-by: Scott Branden Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f9ff578251dc2f1cf5b9b007e050033d8414829d Author: Edwin Peer Date: Sun Aug 29 03:34:59 2021 -0400 bnxt_en: introduce new firmware message API based on DMA pools This change constitutes a major step towards supporting multiple firmware commands in flight by maintaining a separate response buffer for the duration of each request. These firmware commands are also known as Hardware Resource Manager (HWRM) commands. Using separate response buffers requires an API change in order for callers to be able to free the buffer when done. It is impossible to keep the existing APIs unchanged. The existing usage for a simple HWRM message request such as the following: struct input req = {0}; bnxt_hwrm_cmd_hdr_init(bp, &req, REQ_TYPE, -1, -1); rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); if (rc) /* error */ changes to: struct input *req; rc = hwrm_req_init(bp, req, REQ_TYPE); if (rc) /* error */ rc = hwrm_req_send(bp, req); /* consumes req */ if (rc) /* error */ The key changes are: 1. The req is no longer allocated on the stack. 2. The caller must call hwrm_req_init() to allocate a req buffer and check for a valid buffer. 3. The req buffer is automatically released when hwrm_req_send() returns. 4. If the caller wants to check the firmware response, the caller must call hwrm_req_hold() to take ownership of the response buffer and release it afterwards using hwrm_req_drop(). The caller is no longer required to explicitly hold the hwrm_cmd_lock mutex to read the response. 5. Because the firmware commands and responses all have different sizes, some safeguards are added to the code. This patch maintains legacy API compatibiltiy, implementing the old API in terms of the new. The follow-on patches will convert all callers to use the new APIs. v2: Fix redefined writeq with parisc .config Fix "cast from pointer to integer of different size" warning in hwrm_calc_sentinel() Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3c8c20db769cd68e299b487035825e026b1a6ce9 Author: Edwin Peer Date: Sun Aug 29 03:34:58 2021 -0400 bnxt_en: move HWRM API implementation into separate file Move all firmware messaging functions and definitions to new bnxt_hwrm.[ch]. The follow-on patches will make major modifications to these APIs. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 7b370ad77392455dccd77c121b48bc9f76a14cbe Author: Edwin Peer Date: Sun Aug 29 03:34:57 2021 -0400 bnxt_en: Refactor the HWRM_VER_GET firmware calls Refactor the code so that __bnxt_hwrm_ver_get() does not call bnxt_hwrm_do_send_msg() directly. The new APIs will not expose this internal call. Add a new bnxt_hwrm_poll() to poll the HWRM_VER_GET firmware call silently. The other bnxt_hwrm_ver_get() function will send the HWRM_VER_GET message directly with error logs enabled. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6c172d59ad79d3973e393ba49d819ed6f0417202 Author: Edwin Peer Date: Sun Aug 29 03:34:56 2021 -0400 bnxt_en: remove DMA mapping for KONG response The additional response buffer serves no useful purpose. There can be only one firmware command in flight due to the hwrm_cmd_lock mutex, which is taken for the entire duration of any command completion, KONG or otherwise. It is thus safe to share a single DMA buffer. Removing the code associated with the additional mapping will simplify matters in the next patch, which allocates response buffers from DMA pools on a per request basis. Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit ab9c13a4b539709c7a080089b34de1bf4d1024d0 Author: Christophe JAILLET Date: Mon Aug 23 23:30:39 2021 +0200 parisc/parport_gsc: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit 6ef4661cad32b5098ffb31be3282c866befde85f Author: Masahiro Yamada Date: Thu Aug 12 01:41:16 2021 +0900 parisc: move core-y in arch/parisc/Makefile to arch/parisc/Kbuild Use obj-y to clean up Makefile. Signed-off-by: Masahiro Yamada Signed-off-by: Helge Deller commit 0c38502cee6f63a27c7af476948eac18e067d5ff Author: Christophe JAILLET Date: Sun Aug 22 22:29:01 2021 +0200 parisc: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller commit 87875c1084a28364dad8cd4f9ecbfdfe0b845ad5 Author: Uwe Kleine-König Date: Sat Aug 7 11:19:27 2021 +0200 parisc: Make struct parisc_driver::remove() return void The caller of this function (parisc_driver_remove() in arch/parisc/kernel/drivers.c) ignores the return value, so better don't return any value at all to not wake wrong expectations in driver authors. The only function that could return a non-zero value before was ipmi_parisc_remove() which returns the return value of ipmi_si_remove_by_dev(). Make this function return void, too, as for all other callers the value is ignored, too. Also fold in a small checkpatch fix for: WARNING: Unnecessary space before function pointer arguments + void (*remove) (struct parisc_device *dev); Acked-by: Dmitry Torokhov (for drivers/input) Signed-off-by: Uwe Kleine-König Acked-by: Sudip Mukherjee Acked-by: Jiri Slaby Signed-off-by: Helge Deller commit d220da0967dbda232350c5dc39317e04e0892743 Author: Masahiro Yamada Date: Wed Aug 25 00:48:20 2021 +0900 parisc: remove unused arch/parisc/boot/install.sh and its phony target Parisc has two similar installation scripts: arch/parisc/install.sh arch/parisc/boot/install.sh The latter is never used because 'make ARCH=parisc install' always invokes the 'install' target in arch/parisc/Makefile. The target in arch/parisc/boot/Makefile is not used either. Signed-off-by: Masahiro Yamada Signed-off-by: Helge Deller commit 7bf82eb3873fbbee8273f60ddef584194b99f6c1 Author: Matthew Wilcox (Oracle) Date: Thu Jul 15 14:46:12 2021 +0100 parisc: Rename PMD_ORDER to PMD_TABLE_ORDER This is the order of the page table allocation, not the order of a PMD. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Helge Deller commit 7f2dcc7371c1ab6e5d3678a7eff1cb0eb9725de9 Author: Kees Cook Date: Tue Aug 17 20:18:09 2021 -0700 parisc: math-emu: Avoid "fmt" macro collision The printk "fmt" macro was colliding. Rename like the others with a "bits" suffix. Fixes a build failure: arch/parisc/math-emu/decode_exc.c: In function 'decode_fpu': arch/parisc/math-emu/decode_exc.c:49:14: error: expected identifier before numeric constant 49 | #define fmt 11 /* bits 19 & 20 */ | ^~ ./include/linux/printk.h:379:6: note: in expansion of macro 'fmt' 379 | .fmt = __builtin_constant_p(_fmt) ? (_fmt) : NULL, \ | ^~~ ./include/linux/printk.h:417:3: note: in expansion of macro '__printk_index_emit' 417 | __printk_index_emit(_fmt, NULL, NULL); \ | ^~~~~~~~~~~~~~~~~~~ ./include/linux/printk.h:446:26: note: in expansion of macro 'printk_index_wrap' 446 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~~ arch/parisc/math-emu/decode_exc.c:339:3: note: in expansion of macro 'printk' 339 | printk("%s(%d) Unknown FPU exception 0x%x\n", __FILE__, | ^~~~~~ Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Helge Deller commit 55b70eed81cba1331773d4aaf5cba2bb07475cd8 Author: Helge Deller Date: Wed Jul 7 15:38:08 2021 +0200 parisc: Increase size of gcc stack frame check parisc uses much bigger frames than other architectures, so increase the stack frame check value to avoid compiler warnings. Cc: Arnd Bergmann Cc: Abd-Alrhman Masalkhi Cc: Christoph Hellwig Signed-off-by: Helge Deller commit 7e07b7475b5274b4739511a0d81e29dd8198743b Author: Jinchao Wang Date: Sat Jun 26 18:20:52 2021 +0800 parisc: Replace symbolic permissions with octal permissions Resolve following checkpatch issue, Replace symbolic permissions with octal permissions Signed-off-by: Jinchao Wang Signed-off-by: Helge Deller commit dcf097e7d21fbdfbf20e473ac155f4d154018374 Author: Robert Marko Date: Thu Aug 26 13:02:39 2021 +0200 USB: serial: pl2303: fix GL type detection At least some PL2303GL have a bcdDevice of 0x405 instead of 0x100 as the datasheet claims. Add it to the list of known release numbers for the HXN (G) type. Fixes: 894758d0571d ("USB: serial: pl2303: tighten type HXN (G) detection") Signed-off-by: Robert Marko Cc: stable@vger.kernel.org # 5.13 Link: https://lore.kernel.org/r/20210826110239.5269-1-robert.marko@sartura.hr Signed-off-by: Johan Hovold commit f7b82b12626e10a2f5332b699cc79819ac8decc7 Merge: ea41a498cc646 4801bee7d5a36 Author: Takashi Iwai Date: Mon Aug 30 08:04:04 2021 +0200 Merge branch 'for-linus' into for-next commit e5c11ee3106072ef4b949eca93db160f55e6b55b Author: Vladimir Lypak Date: Tue Aug 10 16:44:33 2021 +0000 mailbox: qcom-apcs-ipc: Add compatible for MSM8953 SoC MSM8953 has an APCS block similar to MSM8916 but with different clocks which are spread over 2MB IO region next to it. Signed-off-by: Vladimir Lypak Signed-off-by: Sireesh Kodali Signed-off-by: Jassi Brar commit 04d2c3b7832c04e1daa27aa29403dff3d819cac3 Author: Vladimir Lypak Date: Tue Aug 10 16:44:26 2021 +0000 dt-bindings: mailbox: Add compatible for the MSM8953 Add the mailbox compatible for the MSM8953 SoC. Signed-off-by: Vladimir Lypak Signed-off-by: Sireesh Kodali Signed-off-by: Jassi Brar commit fb339971bfc4266f8af35c7d966f31cf67fe83ce Author: Konrad Dybcio Date: Fri Aug 20 22:31:05 2021 +0200 dt-bindings: mailbox: qcom-ipcc: Add compatible for SM6350 Add IPCC compatible for SM6350 SoC. Signed-off-by: Konrad Dybcio Signed-off-by: Jassi Brar commit dc2b8edfa3b3e691fa43694c4bd1e16b682393e1 Author: Iskren Chernev Date: Sun Jun 27 21:58:28 2021 +0300 mailbox: qcom: Add support for SM6115 APCS IPC Qcom SM4250/6115, have APCS mailbox setup similar to msm8998 and msm8916. Signed-off-by: Iskren Chernev Signed-off-by: Jassi Brar commit affa8da916e87c63086f5f1fdda8fe7b7b366972 Author: Iskren Chernev Date: Sun Jun 27 21:58:27 2021 +0300 dt-bindings: mailbox: qcom: Add SM6115 APCS compatible Add compatible for the Qualcomm SM4250/6115 APCS block to the Qualcomm APCS binding. Signed-off-by: Iskren Chernev Acked-by: Rob Herring Signed-off-by: Jassi Brar commit 8b60ed2b1674b78ebc433a11efa7d48821229037 Author: Yongqiang Niu Date: Mon Aug 2 15:52:26 2021 +0800 soc: mediatek: cmdq: add address shift in jump Add address shift when compose jump instruction to compatible with 35bit format. Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform") Signed-off-by: Yongqiang Niu Reviewed-by: Nicolas Boichat Signed-off-by: Jassi Brar commit 84fd4201b78b96f8d31f6a2624be27ad6306a9bc Author: Yongqiang Niu Date: Mon Aug 2 15:46:05 2021 +0800 mailbox: cmdq: add mt8192 support add mt8192 support Signed-off-by: Yongqiang Niu Signed-off-by: Hsin-Yi Wang Signed-off-by: Jassi Brar commit 5f48ed2e812e6d084b106ed8fae6212f7dddb70b Author: Yongqiang Niu Date: Mon Aug 2 15:46:03 2021 +0800 dt-binding: gce: add gce header file for mt8192 Add documentation for the mt8192 gce. Add gce header file defined the gce hardware event, subsys number and constant for mt8192. Signed-off-by: Yongqiang Niu Reviewed-by: Rob Herring Signed-off-by: Hsin-Yi Wang Signed-off-by: Jassi Brar commit f0712ace7fe0723b40733c3b98591d34c1b0bfb9 Author: Taniya Das Date: Mon Aug 23 15:45:46 2021 +0530 cpufreq: qcom-hw: Set dvfs_possible_from_any_cpu cpufreq driver flag As remote cpufreq updates are supported on QCOM platforms, set dvfs_possible_from_any_cpu cpufreq driver flag. Signed-off-by: Taniya Das Signed-off-by: Viresh Kumar commit 5e79d6d9ea00c273f3efbced841212de85a384d1 Author: Bjorn Andersson Date: Fri Aug 20 14:57:00 2021 -0700 cpufreq: blocklist more Qualcomm platforms in cpufreq-dt-platdev The Qualcomm sa8155p, sm6350, sm8250 and sm8350 platforms also uses the qcom-cpufreq-hw driver, so add them to the cpufreq-dt-platdev driver's blocklist. Signed-off-by: Bjorn Andersson Signed-off-by: Viresh Kumar commit 275157b367f479334f3e2df7be93a3dd772f359c Author: Thara Gopinath Date: Mon Aug 9 15:16:01 2021 -0400 cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support Add interrupt support to notify the kernel of h/w initiated frequency throttling by LMh. Convey this to scheduler via thermal presssure interface. Signed-off-by: Thara Gopinath [Viresh: Added changes for arch_topology.c to fix build errors ] Signed-off-by: Viresh Kumar commit 37f188318ea3f1da75b32df3b1a19f45d9840652 Author: Viresh Kumar Date: Tue Aug 10 12:24:36 2021 +0530 cpufreq: scmi: Use .register_em() to register with energy model Set the newly added .register_em() callback to register with the EM after the cpufreq policy is properly initialized. Acked-by: Sudeep Holla Signed-off-by: Viresh Kumar commit 3fd23111185d2167696547d59235bda8d307425c Author: Viresh Kumar Date: Tue Aug 10 12:24:36 2021 +0530 cpufreq: vexpress: Use .register_em() to register with energy model Set the newly added .register_em() callback with cpufreq_register_em_with_opp() to register with the EM core. Acked-by: Sudeep Holla Signed-off-by: Viresh Kumar commit 4d584efae0b28928011dd5b3b9b3a3ac4324bcac Author: Viresh Kumar Date: Tue Aug 10 12:24:36 2021 +0530 cpufreq: scpi: Use .register_em() to register with energy model Set the newly added .register_em() callback with cpufreq_register_em_with_opp() to register with the EM core. Acked-by: Sudeep Holla Signed-off-by: Viresh Kumar commit d8037ae359a6fb0f347a842a860e778aae808cd0 Author: Joyce Ooi Date: Thu Jul 1 14:57:35 2021 +0800 MAINTAINERS: Replace Ley Foon Tan as Altera Mailbox maintainer This patch replaces Ley Foon Tan as Altera Mailbox maintainer as she has moved to a different role. Signed-off-by: Joyce Ooi Acked-by: Ley Foon Tan Signed-off-by: Jassi Brar commit 8d7e5908c0bcf8a0abc437385e58e49abab11a93 Author: Amit Pundir Date: Fri Jul 16 13:19:46 2021 +0530 mailbox: qcom-ipcc: Enable loading QCOM_IPCC as a module This patch enables the qcom_ipcc driver to be loaded as a module. IPCC is fairly core to system, so as such it should never be unloaded. It registers as a mailbox + irq controller and the irq controller drivers in kernel are not supposed to be unloaded as they don't have the visibility over the clients consuming the irqs. Hence adding supress_bind_attrs to disable bind/unbind via sysfs. Signed-off-by: Amit Pundir Reviewed-by: Manivannan Sadhasivam Signed-off-by: Jassi Brar commit 23e6a7ca464ed2b9d949520e07f7e0735bc025f4 Author: Randy Dunlap Date: Fri Jul 23 11:25:58 2021 -0700 mailbox: sti: quieten kernel-doc warnings Use kernel-doc struct notation for the mailbox structs to prevent these kernel-doc warnings: drivers/mailbox/mailbox-sti.c:39: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * STi Mailbox device data drivers/mailbox/mailbox-sti.c:63: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * STi Mailbox platform specific configuration drivers/mailbox/mailbox-sti.c:74: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * STi Mailbox allocated channel information Also move the field descriptions ahead of the function description as is expected in kernel-doc. This prevents another kernel-doc warning. Fixes: 9ef4546cbd7e ("mailbox: Add support for ST's Mailbox IP") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Aditya Srivastava Cc: Lee Jones Signed-off-by: Jassi Brar commit 1d78dfde33a02da1d816279c2e3452978b7abd39 Author: Alexey Kardashevskiy Date: Fri Aug 27 14:07:06 2021 +1000 KVM: PPC: Fix clearing never mapped TCEs in realmode Since commit e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too"), pages for TCE tables for KVM guests are allocated only when needed. This allows skipping any update when clearing TCEs. This works mostly fine as TCE updates are handled when the MMU is enabled. The realmode handlers fail with H_TOO_HARD when pages are not yet allocated, except when clearing a TCE in which case KVM prints a warning and proceeds to dereference a NULL pointer, which crashes the host OS. This has not been caught so far as the change in commit e1a1ef84cd07 is reasonably new, and POWER9 runs mostly radix which does not use realmode handlers. With hash, the default TCE table is memset() by QEMU when the machine is reset which triggers page faults and the KVM TCE device's kvm_spapr_tce_fault() handles those with MMU on. And the huge DMA windows are not cleared by VMs which instead successfully create a DMA window big enough to map the VM memory 1:1 and then VMs just map everything without clearing. This started crashing now as commit 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") added a mode when a dymanic DMA window not big enough to map the VM memory 1:1 but it is used anyway, and the VM now is the first (i.e. not QEMU) to clear a just created table. Note that upstream QEMU needs to be modified to trigger the VM to trigger the host OS crash. This replaces WARN_ON_ONCE_RM() with a check and return, and adds another warning if TCE is not being cleared. Fixes: e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210827040706.517652-1-aik@ozlabs.ru commit 247141f5286b6a915dd225de076c29d8591e9a94 Author: Marek Vasut Date: Fri Jul 23 17:47:41 2021 -0700 dt-bindings: input: tsc2005: Convert to YAML schema Convert the TI TSC2004/TSC2005 DT bindings to YAML schema. Signed-off-by: Marek Vasut Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210620210708.100147-1-marex@denx.de Signed-off-by: Dmitry Torokhov commit 62e4fe9f608f4eda65942f4e492fafdf4ff0381a Author: Alexander Sverdlin Date: Mon Jun 14 10:38:56 2021 -0700 Input: ep93xx_keypad - prepare clock before using it Use clk_prepare_enable()/clk_disable_unprepare() in preparation for switch to Common Clock Framework. Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20210613233041.128961-4-alexander.sverdlin@gmail.com Signed-off-by: Dmitry Torokhov commit 7a3f5b0de3647c854e34269c3332d7a1e902901a Author: Ryoga Saito Date: Tue Aug 17 08:39:37 2021 +0000 netfilter: add netfilter hooks to SRv6 data plane This patch introduces netfilter hooks for solving the problem that conntrack couldn't record both inner flows and outer flows. This patch also introduces a new sysctl toggle for enabling lightweight tunnel netfilter hooks. Signed-off-by: Ryoga Saito Signed-off-by: Pablo Neira Ayuso commit 8f0284f190e6a0aa09015090568c03f18288231a Merge: 5bea1c8ce673a 61d861cf47857 Author: Dave Airlie Date: Mon Aug 30 09:06:01 2021 +1000 Merge tag 'amd-drm-next-5.15-2021-08-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.15-2021-08-27: amdgpu: - PLL fix for SI - Misc code cleanups - RAS fixes - PSP cleanups - Polaris UVD/VCE suspend fixes - aldebaran fixes - DCN3.x mclk fixes amdkfd: - CWSR fixes for arcturus and aldebaran - SVM fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210827192336.4649-1-alexander.deucher@amd.com commit 5bea1c8ce673ad93253f4b327277c011049ba24d Merge: 7d8eb202719b9 fb43ebc83e069 Author: Dave Airlie Date: Mon Aug 30 09:04:47 2021 +1000 Merge tag 'drm-intel-next-fixes-2021-08-26' of git://anongit.freedesktop.org/drm/drm-intel into drm-next drm/i915 fixes for v5.15-rc1: - Disable underrun recovery with eDP MSO panels on ADL-P - Use designated initializers for init/exit table - Fix some error pointer usages Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87r1egd1cg.fsf@intel.com commit f1042b6ccb887f07301f6b096b3d0cfcf9189323 Author: Pavel Begunkov Date: Sat Aug 28 19:54:39 2021 -0600 io_uring: allow updating linked timeouts We allow updating normal timeouts, add support for adjusting timings of linked timeouts as well. Reported-by: Victor Stewart Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit ef9dd637084d437463f5e9efa153dfc94e7e5f08 Author: Pavel Begunkov Date: Sat Aug 28 19:54:38 2021 -0600 io_uring: keep ltimeouts in a list A preparation patch. Keep all queued linked timeout in a list, so they may be found and updated. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 47fb0cfdb7a71a8a0ff8fe1d117363dc81f6ca77 Merge: 00ed1401a0058 6e3b473ee0644 Author: Thomas Gleixner Date: Sun Aug 29 21:19:50 2021 +0200 Merge tag 'irqchip-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - API updates: - Treewide conversion to generic_handle_domain_irq() for anything that looks like a chained interrupt controller - Update the irqdomain documentation - Use of bitmap_zalloc() throughout the tree - New functionalities: - Support for GICv3 EPPI partitions - Fixes: - Qualcomm PDC hierarchy fixes - Yet another priority decoding fix for the GICv3 pseudo-NMIs - Fix the apple-aic driver irq_eoi() callback to always unmask the interrupt - Properly handle edge interrupts on loongson-pch-pic - Let the mtk-sysirq driver advertise IRQCHIP_SKIP_SET_WAKE Link: https://lore.kernel.org/r/20210828121013.2647964-1-maz@kernel.org commit 27115441b938b0287471ac351041dbac81095178 Author: Arnd Bergmann Date: Mon Mar 22 22:50:41 2021 +0100 clk: tegra: fix old-style declaration With extra warnings enabled, gcc complains about a slightly odd prototype: drivers/clk/tegra/clk-dfll.c:1380:1: error: 'inline' is not at beginning of declaration [-Werror=old-style-declaration] 1380 | static void inline dfll_debug_init(struct tegra_dfll *td) { } Move the 'inline' keyword to the start of the line. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20210322215047.1062540-1-arnd@kernel.org Acked-by: Thierry Reding Signed-off-by: Stephen Boyd commit eaf2aaec0be4623b1d19f5c6ef770a78a91cf460 Merge: 3dcc1edcbbc68 8d4be124062bd Author: David S. Miller Date: Sun Aug 29 15:11:16 2021 +0100 Merge tag 'wireless-drivers-next-2021-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== pull-request: wireless-drivers-next-2021-08-29 here's a pull request to net-next tree, more info below. Please let me know if there are any problems. wireless-drivers-next patches for v5.15 Second, and most likely last, set of patches for v5.15. Lots of iwlwifi patches this time, but smaller changes to other drivers as well. Nothing special standing out. Major changes: rtw88 * add quirk to disable pci caps on HP Pavilion 14-ce0xxx brcmfmac * Add WPA3 Personal with FT to supported cipher suites wcn36xx * allow firmware name to be overridden by DT iwlwifi * support scanning hidden 6GHz networks * support for a new hardware family (Bz) * support for new firmware API versions mwifiex * add reset_d3cold quirk for Surface gen4+ devices ==================== Signed-off-by: David S. Miller commit 50c1df2b56e0f581b1dbf334dbf807d6fb8f77b2 Author: Jens Axboe Date: Fri Aug 27 17:11:06 2021 -0600 io_uring: support CLOCK_BOOTTIME/REALTIME for timeouts Certain use cases want to use CLOCK_BOOTTIME or CLOCK_REALTIME rather than CLOCK_MONOTONIC, instead of the default CLOCK_MONOTONIC. Add an IORING_TIMEOUT_BOOTTIME and IORING_TIMEOUT_REALTIME flag that allows timeouts and linked timeouts to use the selected clock source. Only one clock source may be selected, and we -EINVAL the request if more than one is given. If neither BOOTIME nor REALTIME are selected, the previous default of MONOTONIC is used. Link: https://github.com/axboe/liburing/issues/369 Signed-off-by: Jens Axboe commit 2e480058ddc21ec53a10e8b41623e245e908bdbc Author: Jens Axboe Date: Fri Aug 27 11:33:19 2021 -0600 io-wq: provide a way to limit max number of workers io-wq divides work into two categories: 1) Work that completes in a bounded time, like reading from a regular file or a block device. This type of work is limited based on the size of the SQ ring. 2) Work that may never complete, we call this unbounded work. The amount of workers here is just limited by RLIMIT_NPROC. For various uses cases, it's handy to have the kernel limit the maximum amount of pending workers for both categories. Provide a way to do with with a new IORING_REGISTER_IOWQ_MAX_WORKERS operation. IORING_REGISTER_IOWQ_MAX_WORKERS takes an array of two integers and sets the max worker count to what is being passed in for each category. The old values are returned into that same array. If 0 is being passed in for either category, it simply returns the current value. The value is capped at RLIMIT_NPROC. This actually isn't that important as it's more of a hint, if we're exceeding the value then our attempt to fork a new worker will fail. This happens naturally already if more than one node is in the system, as these values are per-node internally for io-wq. Reported-by: Johannes Lundberg Link: https://github.com/axboe/liburing/issues/420 Signed-off-by: Jens Axboe commit e037e36c35c2587879ba6db90e626ffd9d3e2618 Author: Sanjay R Mehta Date: Sat Aug 28 14:28:28 2021 -0500 dmaengine: ptdma: remove PT_OFFSET to avoid redefnition Building on ARCH=um causes a "redefined" warning, so remove this PT_OFFSET macro to avoid the warning. drivers/dma/ptdma/ptdma.h:34: warning: "PT_OFFSET" redefined 34 | #define PT_OFFSET 0x0 | In file included from ./arch/um/include/asm/thread_info.h:17, from ./include/linux/thread_info.h:60, from ./include/asm-generic/preempt.h:5, from ./arch/um/include/generated/asm/preempt.h:1, from ./include/linux/preempt.h:78, from ./include/linux/spinlock.h:55, from ./include/linux/wait.h:9, from ./include/linux/wait_bit.h:8, from ./include/linux/fs.h:6, from ./include/linux/debugfs.h:15, from drivers/dma/ptdma/ptdma-debugfs.c:12: ./arch/x86/um/shared/sysdep/ptrace_user.h:4: note: this is the location of the previous definition 4 | #define PT_OFFSET(r) ((r) * sizeof(long)) Reported-by: kernel test robot Fixes: 2a99524459ce ("dmaengine: ptdma: Initial driver for the AMD PTDMA") Signed-off-by: Sanjay R Mehta Link: https://lore.kernel.org/r/1630178908-54973-1-git-send-email-Sanju.Mehta@amd.com Signed-off-by: Vinod Koul commit e2fb2e2a33fae6009bf68574a7eec8fcfdf9c78e Author: Sanjay R Mehta Date: Tue Aug 17 08:55:59 2021 -0500 dmaengine: ptdma: Add debugfs entries for PTDMA Expose data about the configuration and operation of the PTDMA through debugfs entries: device name, capabilities, configuration, statistics. Signed-off-by: Sanjay R Mehta Link: https://lore.kernel.org/r/1629208559-51964-4-git-send-email-Sanju.Mehta@amd.com Signed-off-by: Vinod Koul commit b0b4a6b10577a2e7eaf36f46781f4759b03321a7 Author: Sanjay R Mehta Date: Tue Aug 17 08:55:58 2021 -0500 dmaengine: ptdma: register PTDMA controller as a DMA resource Register ptdma queue to Linux dmaengine framework as general-purpose DMA channels. Signed-off-by: Sanjay R Mehta Link: https://lore.kernel.org/r/1629208559-51964-3-git-send-email-Sanju.Mehta@amd.com Signed-off-by: Vinod Koul commit fa5d823b16a9442d609617abeec31da8b6afa224 Author: Sanjay R Mehta Date: Tue Aug 17 08:55:57 2021 -0500 dmaengine: ptdma: Initial driver for the AMD PTDMA Add support for AMD PTDMA controller. It performs high-bandwidth memory to memory and IO copy operation. Device commands are managed via a circular queue of 'descriptors', each of which specifies source and destination addresses for copying a single buffer of data. Signed-off-by: Sanjay R Mehta Link: https://lore.kernel.org/r/1629208559-51964-2-git-send-email-Sanju.Mehta@amd.com Signed-off-by: Vinod Koul commit 64d57d2c64e56ceac85554cd0f653ca3a12aaa9a Author: Colin Ian King Date: Thu Aug 26 13:25:00 2021 +0100 dmaengine: fsl-dpaa2-qdma: Fix spelling mistake "faile" -> "failed" There is a spelling mistake in a dev_err error message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210826122500.13743-1-colin.king@canonical.com Signed-off-by: Vinod Koul commit cf84a4b968f38383534bcd0484385c9254828b2c Author: Dave Jiang Date: Tue Aug 24 14:24:27 2021 -0700 dmaengine: idxd: remove interrupt disable for dev_lock The spinlock is not being used in hard interrupt context. There is no need to disable irq when acquiring the lock. The interrupt thread handler also is not in bottom half context, therefore we can also remove disabling of the bh. Convert all dev_lock acquisition to plain spin_lock() calls. Reviewed-by: Dan Williams Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/162984026772.1939166.11504067782824765879.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit f9f4082dbc56c40093bcb5c1f62c04a916eca9a2 Author: Dave Jiang Date: Tue Aug 24 14:24:39 2021 -0700 dmaengine: idxd: remove interrupt disable for cmd_lock The cmd_lock spinlock is not being used in hard interrupt context. There is no need to disable irq when acquiring the lock. Convert all cmd_lock acquisition to plain spin_lock() calls. Reviewed-by: Dan Williams Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/162984027930.1939209.15758413737332339204.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit d8071323c5632bdf0a8ef9b9e5662fac43649f9d Author: Dave Jiang Date: Thu Aug 19 09:34:06 2021 -0700 dmaengine: idxd: fix setting up priv mode for dwq DSA spec says WQ priv bit is 0 if the Privileged Mode Enable field of the PCI Express PASID capability is 0 and pasid is enabled. Make sure that the WQCFG priv field is set correctly according to usage type. Reject config if setting up kernel WQ type and no support. Also add the correct priv setup for a descriptor. Fixes: 484f910e93b4 ("dmaengine: idxd: fix wq config registers offset programming") Cc: Ramesh Thomas Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/162939084657.903168.14160019185148244596.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit aac6c0f90799d66b8989be1e056408f33fd99fe6 Author: Radhey Shyam Pandey Date: Thu Aug 19 14:28:48 2021 +0530 dmaengine: xilinx_dma: Set DMA mask for coherent APIs The xilinx dma driver uses the consistent allocations, so for correct operation also set the DMA mask for coherent APIs. It fixes the below kernel crash with dmatest client when DMA IP is configured with 64-bit address width and linux is booted from high (>4GB) memory. Call trace: [ 489.531257] dma_alloc_from_pool+0x8c/0x1c0 [ 489.535431] dma_direct_alloc+0x284/0x330 [ 489.539432] dma_alloc_attrs+0x80/0xf0 [ 489.543174] dma_pool_alloc+0x160/0x2c0 [ 489.547003] xilinx_cdma_prep_memcpy+0xa4/0x180 [ 489.551524] dmatest_func+0x3cc/0x114c [ 489.555266] kthread+0x124/0x130 [ 489.558486] ret_from_fork+0x10/0x3c [ 489.562051] ---[ end trace 248625b2d596a90a ]--- Signed-off-by: Radhey Shyam Pandey Reviewed-by: Harini Katakam Link: https://lore.kernel.org/r/1629363528-30347-1-git-send-email-radhey.shyam.pandey@xilinx.com Signed-off-by: Vinod Koul commit 5e70a09c54c4d7ce8c8a573005889a5301cda4c4 Author: Pratyush Yadav Date: Thu Aug 19 16:31:05 2021 +0530 dmaengine: ti: k3-psil-j721e: Add entry for CSI2RX The CSI2RX subsystem on J721E is serviced by UDMA via PSI-L to transfer frames to memory. It can have up to 32 threads per instance. J721E has two instances of the subsystem, so there are 64 threads total. Add them to the endpoint map. Signed-off-by: Pratyush Yadav Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20210819110106.31409-1-p.yadav@ti.com Signed-off-by: Vinod Koul commit 5000d37042a61ca556fde2782ca40dbfa802ea16 Author: Biju Das Date: Fri Aug 6 10:53:22 2021 +0100 dmaengine: sh: Add DMAC driver for RZ/G2L SoC Add DMA Controller driver for RZ/G2L SoC. Based on the work done by Chris Brandt for RZ/A DMA driver. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20210806095322.2326-4-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit ab959c7d4ea086852f35c7ff20ecd79b7471cfad Author: Biju Das Date: Fri Aug 6 10:53:21 2021 +0100 dmaengine: Extend the dma_slave_width for 128 bytes Add DMA_SLAVE_BUSWIDTH_128_BYTES to dma_slave_width for DMA engines and users to select 128 bytes as bus width. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20210806095322.2326-3-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit 9b9b12537d3a7b5bea6b9e8f20bffc2338724269 Author: Biju Das Date: Fri Aug 6 10:53:20 2021 +0100 dt-bindings: dma: Document RZ/G2L bindings Document RZ/G2L DMAC bindings. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210806095322.2326-2-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit b5b0eba590f08e2b06c830b8343c1da7059c7a88 Merge: 461d971215dfb c7e9d0020361f Author: Jens Axboe Date: Sun Aug 29 06:50:58 2021 -0600 Merge tag 'floppy-for-5.15' of https://github.com/evdenis/linux-floppy into for-5.15/drivers Pull floppy fix from Denis: "Bring back O_NDELAY for floppy Only one commit this time with revert of O_NDELAY removal for the floppy. Users reported that the commit breaks userspace utils and known floppy workflow patterns. We already reverted the same commit back in 2016 presumably for the same reason. Completely drop O_NDELAY for floppy seems excessive to solve problems it introduces. I started to write basic selftests for the floppy to prevent this kind of userspace breaks in the future. Signed-off-by: Denis Efremov " * tag 'floppy-for-5.15' of https://github.com/evdenis/linux-floppy: Revert "floppy: reintroduce O_NDELAY fix" commit 8d4be124062bddbb2bcb887702a0601b790b9a83 Author: Jing Yangyang Date: Mon Aug 23 23:13:41 2021 -0700 ssb: fix boolreturn.cocci warning ./include/linux/ssb/ssb_driver_extif.h:200:8-9:WARNING: return of 0/1 in function 'ssb_extif_available' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Reported-by: Zeal Robot Signed-off-by: Jing Yangyang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210824061341.59255-1-deng.changcheng@zte.com.cn commit ebe9e6514b40f8aac7387466b898541b84c4ef1f Author: Christophe JAILLET Date: Sun Aug 22 10:03:50 2021 +0200 intel: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been hand modified to use 'dma_set_mask_and_coherent()' instead of 'pci_set_dma_mask()/pci_set_consistent_dma_mask()' when applicable. This is less verbose. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/f55043d0c847bfae60087707778563cf732a7bf9.1629619229.git.christophe.jaillet@wanadoo.fr commit a847666accf2c1d4f4ed6c50be43dbc30ebc3a11 Author: Tsuchiya Yuto Date: Fri Aug 20 16:20:50 2021 +0200 mwifiex: pcie: add reset_d3cold quirk for Surface gen4+ devices To reset mwifiex on Surface gen4+ (Pro 4 or later gen) devices, it seems that putting the wifi device into D3cold is required according to errata.inf file on Windows installation (Windows/INF/errata.inf). This patch adds a function that performs power-cycle (put into D3cold then D0) and call the function at the end of reset_prepare(). Note: Need to also reset the parent device (bridge) of wifi on SB1; it might be because the bridge of wifi always reports it's in D3hot. When I tried to reset only the wifi device (not touching parent), it gave the following error and the reset failed: acpi device:4b: Cannot transition to power state D0 for parent in D3hot mwifiex_pcie 0000:03:00.0: can't change power state from D3cold to D0 (config space inaccessible) Signed-off-by: Tsuchiya Yuto Signed-off-by: Jonas Dreßler Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210820142050.35741-3-verdre@v0yd.nl commit 5448bc2a426c2199db9b8bd87ae2b5c06b77ef92 Author: Jonas Dreßler Date: Fri Aug 20 16:20:49 2021 +0200 mwifiex: pcie: add DMI-based quirk implementation for Surface devices This commit adds the ability to apply device-specific quirks to the mwifiex driver. It uses DMI matching similar to the quirks brcmfmac uses with dmi.c. We'll add identifiers to match various MS Surface devices, which this is primarily meant for, later. This commit is a slightly modified version of a previous patch sent in by Tsuchiya Yuto. Co-developed-by: Tsuchiya Yuto Signed-off-by: Tsuchiya Yuto Signed-off-by: Jonas Dreßler Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210820142050.35741-2-verdre@v0yd.nl commit d745ca4f2c4ae9f1bd8cf7d8ac6e22d739bffd19 Author: Ahmad Fatoum Date: Tue Aug 17 08:35:22 2021 +0200 brcmfmac: pcie: fix oops on failure to resume and reprobe When resuming from suspend, brcmf_pcie_pm_leave_D3 will first attempt a hot resume and then fall back to removing the PCI device and then reprobing. If this probe fails, the kernel will oops, because brcmf_err, which is called to report the failure will dereference the stale bus pointer. Open code and use the default bus-less brcmf_err to avoid this. Fixes: 8602e62441ab ("brcmfmac: pass bus to the __brcmf_err() in pcie.c") Signed-off-by: Ahmad Fatoum Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210817063521.22450-1-a.fatoum@pengutronix.de commit 9fc8048c56f33e0e969844a2f1b1e89cf30ee5ba Author: Zenghui Yu Date: Tue Jul 27 10:52:32 2021 +0800 bcma: Drop the unused parameter of bcma_scan_read32() As it had never been used since the initial commit 8369ae33b705 ("bcma: add Broadcom specific AMBA bus driver"). Signed-off-by: Zenghui Yu Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210727025232.663-3-yuzenghui@huawei.com commit b63aed3ff195130fef12e0af590f4838cf0201d8 Author: Zenghui Yu Date: Tue Jul 27 10:52:31 2021 +0800 bcma: Fix memory leak for internally-handled cores kmemleak reported that dev_name() of internally-handled cores were leaked on driver unbinding. Let's use device_initialize() to take refcounts for them and put_device() to properly free the related stuff. While looking at it, there's another potential issue for those which should be *registered* into driver core. If device_register() failed, we put device once and freed bcma_device structures. In bcma_unregister_cores(), they're treated as unregistered and we hit both UAF and double-free. That smells not good and has also been fixed now. Fixes: ab54bc8460b5 ("bcma: fill core details for every device") Signed-off-by: Zenghui Yu Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com commit 71f8817c28e2e1e5549138e2aef68c2fd784e162 Author: Paul Cercueil Date: Mon Aug 23 18:34:05 2021 +0100 MIPS: ingenic: Unconditionally enable clock of CPU #0 Make sure that the PLL that feeds the CPU won't be stopped while the kernel is running. This fixes a problem on JZ4760 (and probably others) where under very specific conditions, the main PLL would be turned OFF when the kernel was shutting down, causing the shutdown process to fail. Signed-off-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit aee7c86a61c7b846ece6ee462a1145f2a209f24c Merge: a0929621eb498 e257d969f3650 Author: Kalle Valo Date: Sun Aug 29 13:20:48 2021 +0300 Merge commit 'e257d969f36503b8eb1240f32653a1afb3109f86' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next I think last commits in tag iwlwifi-next-for-kalle-2021-08-26 are not ready yet so I'm skipping those and pulling an earlier commit. I modified Luca's description below to not include the skipped commits. iwlwifi patches for v5.15 * Support scanning hidden 6GHz networks; * Some improvements in the FW error dumps; * Add some HE capability flags * A bunch of janitorial clean-ups; * Clean-ups in the TX code; * Small fix for SMPS; * Support for a new hardware family (Bz); * Small fix in the scan code; * A bunch of changes in the D3 code, including new FW API; * Finalize the refactoring of 6GHz scan; * Initial changes in the SAR profile code; * Fix reading one of our ACPI tables (WTAS); * Support some new ACPI table revisions; * Support new API of the WoWlan status FW notification; * Fixes in SAR ACPI tables handling; * Some debugging improvements; * Fix in ROC; * Support for new FW API versions; * Support new FW command versions; * Some other small fixes, clean-ups and improvements. commit 3dcc1edcbbc68991e7b3b1be6a6a7962a730fa35 Author: Li RongQing Date: Thu Aug 26 16:21:35 2021 +0800 virtio_net: reduce raw_smp_processor_id() calling in virtnet_xdp_get_sq smp_processor_id()/raw* will be called once each when not more queues in virtnet_xdp_get_sq() which is called in non-preemptible context, so it's safe to call the function smp_processor_id() once. Signed-off-by: Li RongQing Signed-off-by: David S. Miller commit 9b0df250a708ed9de9552fdf543f070fe930e7ea Author: Christophe JAILLET Date: Fri Aug 27 22:06:37 2021 +0200 niu: switch from 'pci_' to 'dma_' API In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant parts are given below. It has been hand modified to use 'dma_set_mask_and_coherent()' instead of 'pci_set_dma_mask()/pci_set_consistent_dma_mask()' when applicable. This is less verbose. Finally, the now useless 'dma_mask' variable has been removed. It has been compile tested. @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit a3ba7fd1d3bf6ce68a06632e755c18ae56cb1a7a Author: Christophe JAILLET Date: Fri Aug 27 22:00:57 2021 +0200 fddi: switch from 'pci_' to 'dma_' API In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant parts are given below. It has been compile tested. @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 27d57f85102b3746f19ccd7b79c3a7f8aa8b8714 Author: Christophe JAILLET Date: Fri Aug 27 21:56:28 2021 +0200 net: spider_net: switch from 'pci_' to 'dma_' API In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant parts are given below. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Acked-by: Geoff Levand Signed-off-by: David S. Miller commit dce677da57c0edac7a53f1fce58fca180b7ea89b Author: Subbaraya Sundeep Date: Fri Aug 27 19:00:55 2021 +0530 octeontx2-pf: Add vlan-etype to ntuple filters NPC extraction profile marks layer types NPC_LT_LB_CTAG for CTAG and NPC_LT_LB_STAG_QINQ for STAG after parsing input packet. Those layer types can be used to install ntuple filters using vlan-etype option. Below are the commands and corresponding behavior with this patch in place. > alias nt "ethtool -U eth0 flow-type ether" > nt vlan 5 m 0xf000 action 0 Input packets with outer VLAN id as 5 i.e, stag packets with VLAN id 5 and ctag packets with VLAN id as 5 are hit. > nt vlan-etype 0x8100 action 0 All input ctag packets with any VLAN id are hit. > nt vlan-etype 0x88A8 action 0 All input stag packets with any VLAN id are hit. > nt vlan-etype 0x8100 vlan 5 m 0xf000 action 0 All input ctag packets with VLAN id 5 are hit. > nt vlan-etype 0x88A8 vlan 5 m 0xf000 action 0 All input stag packets with VLAN id 5 are hit. Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 57f780f1c43362b86fd23d20bd940e2468237716 Author: Sudarsana Reddy Kalluru Date: Fri Aug 27 04:52:25 2021 -0700 atlantic: Fix driver resume flow. Driver crashes when restoring from the Hibernate. In the resume flow, driver need to clean up the older nic/vec objects and re-initialize them. Fixes: 8aaa112a57c1d ("net: atlantic: refactoring pm logic") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit c7cd6c5a460c92a58a0074936250462f539fa80d Author: Sunil Goutham Date: Fri Aug 27 17:16:44 2021 +0530 octeontx2-af: Fix inconsistent license text Fixed inconsistent license text across the RVU admin function driver. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit cb0e3ec4e67923e00699e5ed59e5718ed159a344 Author: Sunil Goutham Date: Fri Aug 27 17:15:07 2021 +0530 octeontx2-pf: Fix inconsistent license text Fixed inconsistent license text across the netdev drivers. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit d65a606b90ee2d4abd9961aadc9c3c69b9691e04 Merge: c77225119daa0 1ab011b0bf073 Author: David S. Miller Date: Sun Aug 29 10:44:31 2021 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next- queue Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2021-08-27 ravindhan Gunasekaran says: This adds support for Credit-based shaper qdisc offload from Traffic Control system. It enables traffic prioritization and bandwidth reservation via the Credit-Based Shaper which is implemented in hardware by i225 controller. Patch 1/3 adds a default cycle-time for TSN mode to be configured. Patch 2/3 helps to separate TSN mode programming on the fly and during reset sequence. It also simplifies handling features flags for various TSN modes supported by i225 in the driver. Patch 3/3 adds support for IEEE802.1Qav(CBS) standard implemented in i225 HW. Two sets of CBS HW shapers are present in i225 and driver enables them in the two high priority queues. ==================== Signed-off-by: David S. Miller commit a0929621eb49863645a0103109c466b01cb59ea2 Merge: 50cbbfd41e9f7 fd6729ec534cf Author: Kalle Valo Date: Sun Aug 29 11:56:22 2021 +0300 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v5.15. Major changes: wcn36xx * allow firmware name to be overridden by DT commit 50cbbfd41e9f7716baa976ae2d60309a088a246e Author: David Mosberger-Tang Date: Sat Aug 28 15:19:11 2021 +0000 wilc1000: Convert module-global "isinit" to device-specific variable Move static "isinit" variable to wilc_spi structure to allow multiple WILC1000 devices per machine. Signed-off-by: David Mosberger-Tang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210828151346.3012697-1-davidm@egauge.net commit 4b51de063d5310f1fb297388b7955926e63e45c9 Author: Paweł Drewniak Date: Tue Aug 24 23:13:30 2021 +0100 brcmfmac: Add WPA3 Personal with FT to supported cipher suites This allows the driver to connect to BSSIDs supporting SAE with 802.11r. Tested on Raspberry Pi 4 Model B (STA) and UniFi 6LR/OpenWRT 21.02.0-rc2. AP was set to 'sae-mixed' (WPA2/3 Personal). Signed-off-by: Paweł Drewniak Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210824221330.3847139-1-czajernia@gmail.com commit 81f9ebd43659320a88cae8ed5124c50b4d47ab66 Author: Linus Walleij Date: Sun Aug 22 01:58:00 2021 +0200 ssb: Drop legacy header include The SSB header only uses the legacy header to get struct gpio_chip so inluce which is the right include to deal with gpio_chip. Cc: Michael Buesch Cc: Kalle Valo Signed-off-by: Linus Walleij Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210821235800.138817-1-linus.walleij@linaro.org commit f4c813641897cfb43b3b99edd8c8851a1c98c70f Author: Colin Ian King Date: Thu Aug 19 13:50:18 2021 +0100 rsi: make array fsm_state static const, makes object smaller Don't populate the array fsm_state on the stack but instead it static const. Makes the object code smaller by 154 bytes: Before: text data bss dec hex filename 9213 3904 0 13117 333d .../wireless/rsi/rsi_91x_debugfs.o After: text data bss dec hex filename 8995 3968 0 12963 32a3 .../wireless/rsi/rsi_91x_debugfs.o (gcc version 10.3.0) Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210819125018.8577-1-colin.king@canonical.com commit 4801bee7d5a36c199b734a28cde5259183aff822 Author: Takashi Iwai Date: Sun Aug 29 09:38:30 2021 +0200 ALSA: usb-audio: Add lowlatency module option For making user to switch back to the old playback mode, this patch adds a new module option 'lowlatency' to snd-usb-audio driver. When user face a regression due to the recent low-latency playback support, they can test easily by passing lowlatency=0 option without rebuilding the kernel. Fixes: 307cc9baac5c ("ALSA: usb-audio: Reduce latency at playback start, take#2") Link: https://lore.kernel.org/r/20210829073830.22686-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 533ccdae76faa6fd8e0857ec494b264a5d87a191 Author: Nathan Chancellor Date: Mon Aug 23 15:20:14 2021 -0700 rtlwifi: rtl8192de: Fix initialization of place in _rtl92c_phy_get_rightchnlplace() Clang warns: drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:901:6: warning: variable 'place' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] if (chnl > 14) { ^~~~~~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:909:9: note: uninitialized use occurs here return place; ^~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:901:2: note: remove the 'if' if its condition is always true if (chnl > 14) { ^~~~~~~~~~~~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:899:10: note: initialize the variable 'place' to silence this warning u8 place; ^ = '\0' 1 warning generated. Commit 369956ae5720 ("rtlwifi: rtl8192de: Remove redundant variable initializations") removed the initialization of place but it appears that this removal was in the wrong function. _rtl92c_phy_get_rightchnlplace() returns place's value at the end of the function so now if the if statement is false, place never gets initialized. Add that initialization back to address the warning. place's initialization is not necessary in rtl92d_get_rightchnlplace_for_iqk() as place is only used within the if statement so it can be removed, which is likely what was intended in the first place. Fixes: 369956ae5720 ("rtlwifi: rtl8192de: Remove redundant variable initializations") Signed-off-by: Nathan Chancellor Acked-by: Ping-Ke Shih Reviewed-by: Kees Cook Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210823222014.764557-1-nathan@kernel.org commit 1d4dcaf3db9bd073cebf709d081957068de88bdc Author: Ugo Rémery Date: Sun Aug 22 14:49:32 2021 -0500 rtw88: add quirk to disable pci caps on HP Pavilion 14-ce0xxx 8821CE causes random freezes on HP Pavilion 14-ce0019nf. Add a quirk to disable pci ASPM capability. Signed-off-by: Ugo Rémery Signed-off-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210822194932.29630-1-Larry.Finger@lwfinger.net commit 131abae905df99f63d825e47b4df100d34f518ce Author: Konrad Dybcio Date: Fri Aug 20 22:36:24 2021 +0200 clk: qcom: Add SM6350 GCC driver This adds Global Clock controller (GCC) driver for SM6350 SoC Acked-by: AngeloGioacchino Del Regno Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210820203624.232268-3-konrad.dybcio@somainline.org Signed-off-by: Stephen Boyd commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe Author: Dan Carpenter Date: Fri Aug 13 14:34:38 2021 +0300 ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() This error path is unlikely because of it checked for NULL and returned -ENOMEM earlier in the function. But it should return an error code here as well if we ever do hit it because of a race condition or something. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210813113438.GB30697@kili commit 7c48662b9d56666219f526a71ace8c15e6e12f1f Author: Miaoqing Pan Date: Mon Aug 9 12:05:16 2021 +0800 ath9k: fix sleeping in atomic context The problem is that gpio_free() can sleep and the cfg_soc() can be called with spinlocks held. One problematic call tree is: --> ath_reset_internal() takes &sc->sc_pcu_lock spin lock --> ath9k_hw_reset() --> ath9k_hw_gpio_request_in() --> ath9k_hw_gpio_request() --> ath9k_hw_gpio_cfg_soc() Remove gpio_free(), use error message instead, so we should make sure there is no GPIO conflict. Also remove ath9k_hw_gpio_free() from ath9k_hw_apply_gpio_override(), as gpio_mask will never be set for SOC chips. Signed-off-by: Miaoqing Pan Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1628481916-15030-1-git-send-email-miaoqing@codeaurora.org commit 23151b9ae79e3bc4f6a0c4cd3a7f355f68dad128 Author: Zekun Shen Date: Sat Jun 19 09:29:14 2021 -0400 ath9k: fix OOB read ar9300_eeprom_restore_internal Bad header can have large length field which can cause OOB. cptr is the last bytes for read, and the eeprom is parsed from high to low address. The OOB, triggered by the condition length > cptr could cause memory error with a read on negative index. There are some sanity check around length, but it is not compared with cptr (the remaining bytes). Here, the corrupted/bad EEPROM can cause panic. I was able to reproduce the crash, but I cannot find the log and the reproducer now. After I applied the patch, the bug is no longer reproducible. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YM3xKsQJ0Hw2hjrc@Zekuns-MBP-16.fios-router.home commit 8678fd31f2d3eb14f2b8b39c9bc266f16fa24b22 Author: Loic Poulain Date: Thu Aug 26 17:46:08 2021 +0200 wcn36xx: Fix missing frame timestamp for beacon/probe-resp When receiving a beacon or probe response, we should update the boottime_ns field which is the timestamp the frame was received at. (cf mac80211.h) This fixes a scanning issue with Android since it relies on this timestamp to determine when the AP has been seen for the last time (via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter). Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1629992768-23785-1-git-send-email-loic.poulain@linaro.org commit b7f96d5c79cd9584bb1193a3c9008bd1e2683906 Author: Bjorn Andersson Date: Tue Aug 24 10:12:25 2021 -0700 wcn36xx: Allow firmware name to be overridden by DT The WLAN NV firmware blob differs between platforms, and possibly devices, so add support in the wcn36xx driver for reading the path of this file from DT in order to allow these files to live in a generic file system (or linux-firmware). For some reason the parent (wcnss_ctrl) also needs to upload this blob, so rather than specifying the same information in both nodes wcn36xx reads the string from the parent's of_node. Signed-off-by: Bjorn Andersson Tested-by: Bryan O'Donoghue Tested-by: Aníbal Limón Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210824171225.686683-1-bjorn.andersson@linaro.org commit d195d7aac09bddabc2c8326fb02fcec2b0a2de02 Author: Joseph Gates Date: Wed Aug 18 13:31:43 2021 +0200 wcn36xx: Ensure finish scan is not requested before start scan If the operating channel is the first in the scan list, it was seen that a finish scan request would be sent before a start scan request was sent, causing the firmware to fail all future scans. Track the current channel being scanned to avoid requesting the scan finish before it starts. Cc: Fixes: 5973a2947430 ("wcn36xx: Fix software-driven scan") Signed-off-by: Joseph Gates Signed-off-by: Loic Poulain Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1629286303-13179-1-git-send-email-loic.poulain@linaro.org commit faa6a1f9de51bc56a9384864ced067f5fa4f9bf7 Author: Krzysztof Kozlowski Date: Wed Aug 25 15:42:51 2021 +0200 MAINTAINERS: clock: include S3C and S5P in Samsung SoC clock entry Cover the S3C and S5Pv210 clock controller binding headers by Samsung SoC clock controller drivers maintainer entry. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20210825134251.220098-3-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 80204ac4bca95ff7f5f4e1022a98b0323a7f2e86 Author: Krzysztof Kozlowski Date: Wed Aug 25 15:42:50 2021 +0200 dt-bindings: clock: samsung: convert S5Pv210 AudSS to dtschema Convert Samsung S5Pv210 Audio SubSystem clock controller bindings to DT schema format using json-schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20210825134251.220098-2-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit e1ec390920888705e3a53b62dd594478a34ee610 Author: Krzysztof Kozlowski Date: Wed Aug 25 15:42:49 2021 +0200 dt-bindings: clock: samsung: convert Exynos AudSS to dtschema Convert Samsung Exynos Audio SubSystem clock controller bindings to DT schema format using json-schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20210825134251.220098-1-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 7ac615780926ae08bee9c13d940699d63155fa85 Author: Krzysztof Kozlowski Date: Wed Aug 25 15:40:53 2021 +0200 dt-bindings: clock: samsung: convert Exynos4 to dtschema Merge Exynos4210 and Exynos4412 clock controller bindings to existing DT schema. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210825134056.219884-6-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit e9385b93ffdd4c416c57fa460f3e824d9806bc8f Author: Krzysztof Kozlowski Date: Wed Aug 25 15:40:52 2021 +0200 dt-bindings: clock: samsung: convert Exynos3250 to dtschema Merge Exynos3250 clock controller bindings to existing DT schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210825134056.219884-5-krzysztof.kozlowski@canonical.com Signed-off-by: Stephen Boyd commit 41059b5d8b9ad833ce99d5964adbc0eef3f34ddb Author: Krzysztof Kozlowski Date: Wed Aug 25 15:40:51 2021 +0200 dt-bindings: clock: samsung: convert Exynos542x to dtschema Merge Exynos542x clock controller bindings to existing DT schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20210825134056.219884-4-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit ea7b028a00e4c24c5c51479ea540e0da8b79bb4a Author: Krzysztof Kozlowski Date: Wed Aug 25 15:40:50 2021 +0200 dt-bindings: clock: samsung: add bindings for Exynos external clock Document the bindings for Samsung Exynos external to SoC (oscclk/XXTI/XusbXTI) clock provided on boards. The bindings are already implemented in most of the Exynos clock drivers and DTS files. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210825134056.219884-3-krzysztof.kozlowski@canonical.com Signed-off-by: Stephen Boyd commit ae910bf9d8b22d9e590f4a2c76f0e62490ab5b41 Author: Krzysztof Kozlowski Date: Wed Aug 25 15:40:49 2021 +0200 dt-bindings: clock: samsung: convert Exynos5250 to dtschema Convert Samsung Exynos5250 clock controller bindings to DT schema format using json-schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20210825134056.219884-2-krzysztof.kozlowski@canonical.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit e62ada5e23d06dfeba2d3b098a9c70ac027c19b6 Author: Oded Gabbay Date: Wed Jul 14 11:01:21 2021 +0300 habanalabs: remove redundant warning message This warning is redundant as we will print a notice in case the device is still in use after the FD was closed. No need to print the same message per context. Signed-off-by: Oded Gabbay commit e4cdccd2ec0d178219dce0707aa2a63746119e3f Author: farah kassabri Date: Wed May 26 10:43:36 2021 +0300 habanalabs: add support for encapsulated signals submission This commit is the second part of the encapsulated signals feature. It contains the driver support for submission of cs with encapsulated signals and the wait for them. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit dadf17abb7245d9556591d8cc78bf57462e3b20a Author: farah kassabri Date: Mon May 24 18:09:22 2021 +0300 habanalabs: add support for encapsulated signals reservation The signaling from within encapsulated OP capability is merged into the existing stream architecture, such that one can trigger multiple signaling from an encapsulated op, according to the time the event was done in the graph execution and avoid the need to wait for the whole encapsulated OP execution to be complete before the stream can signal. This commit implements only the reserve/unreserve part. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 8ca2072ed8936076ae3ec7e508290a29be9024d8 Author: farah kassabri Date: Sun Jun 20 11:08:19 2021 +0300 habanalabs: signal/wait change sync object reset flow Currently the SOB reset was in fence release function which happens only at the CS wraparound during the CS allocation time. In order to support the new encapsulated signals reservation feature, we need to move the SOB reset to an earlier phase because this SOB could reach it's max value very fast using the signal reservation. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 215f0c1775d5506c8a833b5c85a77b5fb65bf26b Author: Ohad Sharabi Date: Mon Jun 14 22:18:41 2021 +0300 habanalabs: add wait-for-multi-CS uAPI When user sends multiple CSs, waiting for each CS is not efficient as it involves many user-kernel context switches. In order to address this issue we add support to "wait on multiple CSs" using a new uAPI which can wait on maximum of 32 CSs. The new uAPI is defined using a new flag - WAIT_FOR_MULTI_CS - in the wait_for_cs IOCTL. The input parameters for this uAPI will be: @seq: user pointer to an array of up to 32 CS's sequence numbers. @seq_array_len: length of sequence array. @timeout_us: timeout for waiting for any CS. The output paramateres for this API will be: @status: multi CS ioctl completion status (dedicated status was added as well). @flags: bitmap of output flags of the CS. @cs_completion_map: bitmap for multi CS, if CS sequence that was placed in index N in input seq array has completed- the N-th bit in cs_completion_map will be 1, otherwise it will be 0. @timestamp_nsec: timestamp of the first completed CS Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit c457d5abf8d370d710132b28aa17ce528e0866e3 Author: Ohad Sharabi Date: Sun Jun 20 11:00:26 2021 +0300 habanalabs: get multiple fences under same cs_lock To add proper support for wait-for-multi-CS, locking the CS lock for each CS fence in the list is not efficient. Instead, this patch add support to lock the CS lock once to get all required fences. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit a6cd2551d7874ce276ff64348471a9e22ce35020 Author: Oded Gabbay Date: Tue Jul 13 08:11:54 2021 +0300 habanalabs: revise prints on FD close The driver quietly handles memory mappings that were not freed so no need to print a warning about that when user closes the FD. Accordingly, revise the text that is printed in case the device is still in use after the user process closed the FD. Signed-off-by: Oded Gabbay commit 7886acb60b7d35fa265ea52b0c81f60229890055 Author: Oded Gabbay Date: Tue Jul 13 10:14:36 2021 +0300 habanalabs/goya: add missing initialization Need to initialize f/w Linux loaded indication to false to prevent wrong communication with the f/w. Signed-off-by: Oded Gabbay commit 2a2c4b74031423c181f330dcfde9fcf47d05dce8 Author: Oded Gabbay Date: Tue Jul 13 10:13:30 2021 +0300 habanalabs: update firmware header to latest version Add two new fields regarding interrupts communication between driver and f/w. Signed-off-by: Oded Gabbay commit 8bb8b505761238be0d6a83dc41188867d65e5d4c Author: Koby Elbaz Date: Tue Jul 6 20:50:33 2021 +0300 habanalabs: fix race between soft reset and heartbeat There is a scenario where an ongoing soft reset would race with an ongoing heartbeat routine, eventually causing heartbeat to fail and thus to escalate into a hard reset. With this fix, soft-reset procedure will disable heartbeat CPU messages and flush the (ongoing) current one before continuing with reset code. Signed-off-by: Koby Elbaz Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit ae2021d320e9b454ca4ea7b32fdf1d111d3902c4 Author: Oded Gabbay Date: Mon Jul 12 13:48:56 2021 +0300 habanalabs/gaudi: fix information printed on SM event Print the SM name instead of index because it is more informational for the user to know the SM name instead of id when a SM interrupt occurs. In addition, the index that is printed is of the SOB group, not a specific SOB. Signed-off-by: Oded Gabbay commit 7148e647a585075ee9996bc437c2ac95c5cea6bf Author: Ofir Bitton Date: Mon Jul 12 14:18:30 2021 +0300 habanalabs/gaudi: trigger state dump in case of SM errors State dump is relevant to the user in case of Sync Manager error, so we need to trigger it in that case as well. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit a6946151110e8ec8c675c6709e03c15b30a85def Author: Oded Gabbay Date: Sun Jul 11 08:55:42 2021 +0300 habanalabs: set dma max segment size This is required from any device that is capable to perform DMA. Signed-off-by: Oded Gabbay commit 2b5bbef5e88c6ffce59f935417e9b729afb44756 Author: Oded Gabbay Date: Sat Jul 10 21:12:45 2021 +0300 habanalabs: add asic property of host dma offset Each ASIC can have a different offset to add to a host dma address, to enable the ASIC to access that host memory. The usage for this can be common code so add this to the asic property structure. Signed-off-by: Oded Gabbay commit d18bf13e225258b6ee5325fc7cce48059c7b871f Author: Oded Gabbay Date: Sat Jul 10 20:00:35 2021 +0300 habanalabs: fix type of variable Recently, the size parameter in userptr structure was change to u64. As a result, we need to change the type of the local range_size in device_va_to_pa() to u64 to avoid overflow. Signed-off-by: Oded Gabbay commit a9623a8b3ae67d04187b7a4478d4e4155720eebc Author: Tomer Tayar Date: Fri Jul 9 17:34:45 2021 +0300 habanalabs: mark linux image as not loaded after hw_fini If hard reset fails after the call to hw_fini and before loading the linux image to the device, a subsequent call to hw_fini should communicate via COMMS (or MSG_TO_CPU regs for old FW versions). However, the driver still tries in this case to communicate via the GIC, and thus no hard reset is actually done. To avoid that, the patch clears the linux_loaded flag after every call to hw_fini. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 89aad770d692e4d2d9a604c1674e9dfa69421430 Author: Tomer Tayar Date: Fri Jul 9 00:06:47 2021 +0300 habanalabs: fix nullifying of destroyed mmu pgt pool In case of host-resident MMU, when the page tables pool is destroyed, its pointer is not nullified correctly. As a result, on a device fini which happens after a failing reset, the already destroyed pool is accessed, which leads to a kernel panic. The patch fixes the setting of the pool pointer to NULL. Signed-off-by: Tomer Tayar Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 1ee8e2bab509297bbc8320638c2a8a2d739c9b84 Author: Zvika Yehudai Date: Tue Jul 6 13:50:32 2021 +0300 habanalabs: rename cb_mmap to mmap This function will be used for more mmap operations than just mmaping CBs. Signed-off-by: Zvika Yehudai Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 40e35d195d8c18016011ae3e8ffbac765edc3e6f Author: Ofir Bitton Date: Tue Jul 6 12:06:15 2021 +0300 habanalabs: missing mutex_unlock in process kill procedure missing mutex unlock once driver is giving up killing user processes. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 77977ac875f2f1928aa24362f490eef37e063308 Author: Yuri Nudelman Date: Sun Jun 6 10:30:41 2021 +0300 habanalabs/gaudi: implement state dump At the first stage, only gaudi core dump shall be implemented, not including the status registers. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit fd2010b5cc5ebe564121be40ed44fb28209850fe Author: Yuri Nudelman Date: Wed Jun 9 14:04:26 2021 +0300 habanalabs: state dump monitors and fences infrastructure With the infrastructure in place, monitors and fences dump shall be implemented. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 938b793fdede518e10c67dc1dcfba1804faf98a6 Author: Yuri Nudelman Date: Sun Jun 6 10:28:51 2021 +0300 habanalabs: expose state dump To improve the user's ability to debug the case where a workload that is part of executing training/inference of a topology is getting stuck, we need to add a 'core dump' each time a CS times-out. The 'core dump' shall contain all relevant Sync Manager information and corresponding fence values. The most recent dumps shall be accessible via debugfs, under 'state_dump' node. Reading from the node will provide the oldest dump available. Writing an integer value X will discard X dumps, starting with the oldest one, i.e. subsequent read will now return newer dumps. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit e79e745b208b3c709cc5e689e587d04a4c0fe1bb Author: Oded Gabbay Date: Sat Jul 3 11:50:32 2021 +0300 habanalabs: use get_task_pid() to take PID The previous function we used, find_get_pid(), wasn't good in case the user process was run inside docker. As a result, we didn't had the PID and we couldn't kill the user process in case the device got stuck and we needed to reset the device. Signed-off-by: Oded Gabbay commit fbcd0efefc7e32f2acb9ca5d9196306dfa3da880 Author: Oded Gabbay Date: Tue Jun 29 18:23:41 2021 +0300 habanalabs: allow disabling huge page use Sometimes we may need to disable optimization of using huge pages in our memory management code. Add such a flag to the function that creates the list of physical pages that would be programmed into the device MMU. Signed-off-by: Oded Gabbay commit 00ce06539c068929f239dd1b338267b3403e8b93 Author: Oded Gabbay Date: Tue Jun 29 18:12:46 2021 +0300 habanalabs: user mappings can be 64-bit Increase the size variable in the userptr structure to 64-bit. That variable describes the size of the memory allocation of the user that is now being mapped into the device. The mapping can be larger than 4GB, so we need to support it. Signed-off-by: Oded Gabbay commit 429d77ca2760e0f42523fda72db59861c1b3aefc Author: Oded Gabbay Date: Thu Jul 1 10:36:16 2021 +0300 habanalabs: handle case of interruptable wait Same as we handle it in the regular wait for CS, we need to handle the case where the waiting for user interrupt was interrupted. In that case, we need to return correct error code to the user. Signed-off-by: Oded Gabbay commit b07e6c7ef5c7a094c20fa9962f9af2b42546ee94 Author: Oded Gabbay Date: Thu Jul 1 10:09:28 2021 +0300 habanalabs: release pending user interrupts on device fini In device fini there was missing a call to release all pending user interrupts. That can cause a process to be stuck inside the driver's IOCTL of wait for interrupts, in case the device is removed or simulator is killed at the same time. In addition, also call to remove inactive codec job was missing. Moreover, to prevent such errors in the future (where code is added to reset path but not to device fini), we moved some common parts to two dedicated functions: cleanup_resources take_release_locks Signed-off-by: Oded Gabbay commit d5546d78ad409b90dbcb62100458875e8eaf6a0d Author: Oded Gabbay Date: Thu Jul 1 11:42:53 2021 +0300 habanalabs: re-init completion object upon retry In case user interrupt arrived but the completion value is less than the target value, we want to retry the wait. However, before the retry we must reinitialize the completion object, under spin-lock, so the wait function won't exit immediately because the completion object is already completed (from the previous interrupt). Signed-off-by: Oded Gabbay commit 82629c71c26c1a67a26b0b25971da97003c3b287 Author: Oded Gabbay Date: Tue Jun 29 18:08:05 2021 +0300 habanalabs: rename enum vm_type_t to vm_type We don't use typedefs so the enum name shouldn't end with _t Signed-off-by: Oded Gabbay commit c67b0579b8eb97e8671341e889d5148f72f39f35 Author: Ofir Bitton Date: Mon Jun 28 11:21:56 2021 +0300 habanalabs: update firmware header files Update recent changes made in firmware header files, which contain a minor COMMS protocol change and new error status definitions. Signed-off-by: Ofir Bitton Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 486e19795f2ee11f0334e2e3fcf8951d4981ff88 Author: Yuri Nudelman Date: Thu Jun 3 17:51:58 2021 +0300 habanalabs: allow fail on inability to respect hint A new user flag is required to make memory map hint mandatory, in contrast to the current situation where it is best effort. This is due to the requirement to map certain data to specific pre-determined device virtual address ranges. Signed-off-by: Yuri Nudelman Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit 1ae32b9094984efa39ca6d22d4106963458dfd20 Author: farah kassabri Date: Sun Jan 31 18:56:03 2021 +0200 habanalabs: support hint addresses range reservation Add support for pre-determined driver-reserved device VA address ranges. This is needed for future ASIC support where some contents must be mapped into these pre-determined ranges because the H/W will be configured using these ranges. In case the user asks to map a VA without a hint address, avoid allocating the device VA from the reserved ranges. Make sure the validation checks of the hint address take into account situation where the DRAM page size is not pow of 2. Signed-off-by: farah kassabri Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay commit d83e561d43bc71e5404e277b0263774ecd1d1f40 Author: Sean Anderson Date: Mon Aug 9 18:38:13 2021 -0400 clk: vc5: Add properties for configuring SD/OE behavior The SD/OE pin may be configured to enable output when high or low, and to shutdown the device when high. This behavior is controller by the SH and SP bits of the Primary Source and Shutdown Register (and to a lesser extent the OS and OE bits). By default, both bits are 0 (unless set by OTP memory), but they may need to be configured differently, depending on the external circuitry controlling the SD/OE pin. Signed-off-by: Sean Anderson Link: https://lore.kernel.org/r/20210809223813.3766204-3-sean.anderson@seco.com Reviewed-by: Geert Uytterhoeven Signed-off-by: Stephen Boyd commit 2ef162548a53085499c08485228daa968d66dc5a Author: Sean Anderson Date: Mon Aug 9 18:38:12 2021 -0400 clk: vc5: Use dev_err_probe Convert uses of dev_err (+ return) to dev_err_probe. Signed-off-by: Sean Anderson Reviewed-by: Geert Uytterhoeven Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20210809223813.3766204-2-sean.anderson@seco.com Signed-off-by: Stephen Boyd commit 275e4e2dc0411508506acb591a45daf01d22f8eb Author: Sean Anderson Date: Mon Aug 9 18:38:11 2021 -0400 dt-bindings: clk: vc5: Add properties for configuring the SD/OE pin These properties allow configuring the SD/OE pin as described in the datasheet. Signed-off-by: Sean Anderson Reviewed-by: Rob Herring Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20210809223813.3766204-1-sean.anderson@seco.com Signed-off-by: Stephen Boyd commit 6880d94f84262e721f7da6eaa41cd8fd5d87164c Author: Rafał Miłecki Date: Thu Aug 19 07:29:18 2021 +0200 dt-bindings: clock: brcm,iproc-clocks: fix armpll properties armpll clocks (available on Cygnus and Northstar Plus) are simple clocks with no cells. Adjust binding props #clock-cells and clock-output-names to handle them. Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20210819052918.6753-1-zajec5@gmail.com Acked-by: Florian Fainelli Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 6e1cc688e4501c129ff4e0f001588e2859c5be33 Author: Michal Simek Date: Mon Aug 23 13:33:47 2021 +0200 clk: zynqmp: Fix kernel-doc format Align structure and function names with definitions. Issues are reported by kernel-doc script as: drivers/clk/zynqmp/clk-gate-zynqmp.c:24: warning: expecting prototype for struct clk_gate. Prototype was for struct zynqmp_clk_gate instead drivers/clk/zynqmp/clk-gate-zynqmp.c:75: warning: expecting prototype for zynqmp_clk_gate_is_enable(). Prototype was for zynqmp_clk_gate_is_enabled() instead Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/26526e144296373b2c75e75865dd023158f9bfc7.1629718424.git.michal.simek@xilinx.com Signed-off-by: Stephen Boyd commit af7651e67b9d5f7e63ea23b118e3672ac662244a Author: Codrin Ciubotariu Date: Wed Jul 7 16:12:13 2021 +0300 clk: at91: clk-generated: Limit the requested rate to our range On clk_generated_determine_rate(), the requested rate could be outside of clk's range. Limit the rate to the clock's range to not return an error. Fixes: df70aeef6083 ("clk: at91: add generated clock driver") Signed-off-by: Codrin Ciubotariu Link: https://lore.kernel.org/r/20210707131213.3283509-1-codrin.ciubotariu@microchip.com Acked-by: Nicolas Ferre Signed-off-by: Stephen Boyd commit c16edf5ff8ece9c4135175da4103cee1bec360be Author: Sergio Paracuellos Date: Tue Jul 27 07:55:37 2021 +0200 clk: ralink: avoid to set 'CLK_IS_CRITICAL' flag for gates 'clk_init_data' for gates is setting up 'CLK_IS_CRITICAL' flag for all of them. This was being doing because some drivers of this SoC might not be ready to use the clock and we don't wanted the kernel to disable them since default behaviour without clock driver was to set all gate bits to enabled state. After a bit more testing and checking driver code it is safe to remove this flag and just let the kernel to disable those gates that are not in use. No regressions seems to appear. Fixes: 48df7a26f470 ("clk: ralink: add clock driver for mt7621 SoC") Signed-off-by: Sergio Paracuellos Link: https://lore.kernel.org/r/20210727055537.11785-1-sergio.paracuellos@gmail.com Signed-off-by: Stephen Boyd commit e7296d16ef7be11a6001be9bd89906ef55ab2405 Author: Shubhrajyoti Datta Date: Wed Aug 18 12:29:28 2021 +0530 clk: zynqmp: Fix a memory leak Fix a memory leak of mux. Signed-off-by: Shubhrajyoti Datta Link: https://lore.kernel.org/r/20210818065929.12835-3-shubhrajyoti.datta@xilinx.com Signed-off-by: Stephen Boyd commit 47d0fbd1cd42d5458c05a7244f7fa3384557b6cc Author: Shubhrajyoti Datta Date: Wed Aug 18 12:29:27 2021 +0530 clk: zynqmp: Check the return type Currently the return value of of_clk_add_hw_provider is ignored. lets check and return value. Signed-off-by: Shubhrajyoti Datta Link: https://lore.kernel.org/r/20210818065929.12835-2-shubhrajyoti.datta@xilinx.com Signed-off-by: Stephen Boyd commit a3ef91f501b0a4bcae8627342f7a23401963490d Author: Randy Dunlap Date: Thu Aug 19 15:32:37 2021 -0700 clk: at91: sama7g5: remove all kernel-doc & kernel-doc warnings Remove all "/**" kernel-doc markers from sama7g5.c since they are all internal to this driver source file only. This eliminates 14 warnings that were reported by the kernel test robot. Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Claudiu Beznea Cc: Michael Turquette Cc: Stephen Boyd Cc: Eugen Hristev Cc: linux-clk@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20210819223237.20115-1-rdunlap@infradead.org Reviewed-by: Claudiu Beznea Signed-off-by: Stephen Boyd commit 0cbc0eb14e99eeac8b34625aa1a5ab83671af6a7 Author: Rajan Vaja Date: Mon Aug 23 05:07:13 2021 -0700 clk: zynqmp: fix kernel doc Add missing description of 'custom_type_flag' structure member. Fixes: e605fa9c4a0c ("clk: zynqmp: Add support for custom type flags") Signed-off-by: Rajan Vaja Link: https://lore.kernel.org/r/1629720433-19019-1-git-send-email-rajan.vaja@xilinx.com Signed-off-by: Stephen Boyd commit 3e061910b2a2ea2bc25861068a11df011fd3a0f8 Merge: e73f0f0ee7541 86842d255b45f Author: Stephen Boyd Date: Sat Aug 28 21:15:35 2021 -0700 Merge tag 'clk-imx-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clock driver updates from Abel Vesa - Fix CLKOUT clocks on i.MX8MM and i.MX8MN by using imx_clk_hw_mux2 - Switch from .round_rate to .determine_rate in clk-divider-gate - Fix clock tree update for TF-A controlled clocks for all i.MX8M - Add missing M7 core clock for i.MX8MN * tag 'clk-imx-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx8mn: Add M7 core clock clk: imx8m: fix clock tree update of TF-A managed clocks clk: imx: clk-divider-gate: Switch to clk_divider.determine_rate clk: imx8mn: use correct mux type for clkout path clk: imx8mm: use correct mux type for clkout path commit aaedb9e00e5400220a8871180d23a83e67f29f63 Author: Linus Walleij Date: Sun Aug 15 01:55:14 2021 +0200 clk: kirkwood: Fix a clocking boot regression Since a few kernel releases the Pogoplug 4 has crashed like this during boot: Unable to handle kernel NULL pointer dereference at virtual address 00000002 (...) [] (strlen) from [] (kstrdup+0x1c/0x4c) [] (kstrdup) from [] (__clk_register+0x44/0x37c) [] (__clk_register) from [] (clk_hw_register+0x20/0x44) [] (clk_hw_register) from [] (__clk_hw_register_mux+0x198/0x1e4) [] (__clk_hw_register_mux) from [] (clk_register_mux_table+0x5c/0x6c) [] (clk_register_mux_table) from [] (kirkwood_clk_muxing_setup.constprop.0+0x13c/0x1ac) [] (kirkwood_clk_muxing_setup.constprop.0) from [] (of_clk_init+0x12c/0x214) [] (of_clk_init) from [] (time_init+0x20/0x2c) [] (time_init) from [] (start_kernel+0x3dc/0x56c) [] (start_kernel) from [<00000000>] (0x0) Code: e3130020 1afffffb e12fff1e c08a1078 (e5d03000) This is because the "powersave" mux clock 0 was provided in an unterminated array, which is required by the loop in the driver: /* Count, allocate, and register clock muxes */ for (n = 0; desc[n].name;) n++; Here n will go out of bounds and then call clk_register_mux() on random memory contents after the mux clock. Fix this by terminating the array with a blank entry. Fixes: 105299381d87 ("cpufreq: kirkwood: use the powersave multiplexer") Cc: stable@vger.kernel.org Cc: Andrew Lunn Cc: Chris Packham Cc: Gregory CLEMENT Cc: Sebastian Hesselbarth Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20210814235514.403426-1-linus.walleij@linaro.org Reviewed-by: Andrew Lunn Signed-off-by: Stephen Boyd commit 920e9b9cd15413d87920b68acaee34850938fb01 Author: Konrad Dybcio Date: Fri Aug 20 22:36:23 2021 +0200 dt-bindings: clock: Add SM6350 GCC clock bindings Add device tree bindings for global clock controller on SM6350 SoC. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210820203624.232268-2-konrad.dybcio@somainline.org Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit be5b605d34cdf2ddd6bc8fb771f6351a39ba958c Author: Konrad Dybcio Date: Fri Aug 20 22:32:43 2021 +0200 clk: qcom: rpmh: Add support for RPMH clocks on SM6350 Add support for RPMH clocks on SM6350 SoCs. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210820203243.230157-3-konrad.dybcio@somainline.org Signed-off-by: Stephen Boyd commit 4966c52ad700040dc84f3335f149a66467f1a921 Author: Konrad Dybcio Date: Fri Aug 20 22:32:42 2021 +0200 dt-bindings: clock: Add RPMHCC bindings for SM6350 Add bindings and update documentation for clock rpmh driver on SM6350. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210820203243.230157-2-konrad.dybcio@somainline.org Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 386ea3bd8eae577cf463ef79bd354cf14e1f50d0 Author: Lukas Bulwahn Date: Mon Aug 16 15:59:30 2021 +0200 clk: qcom: adjust selects for SM_VIDEOCC_8150 and SM_VIDEOCC_8250 Commit 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150") and commit 0e94711a1f29 ("clk: qcom: add video clock controller driver for SM8250") add config SM_VIDEOCC_8150 and config SM_VIDEOCC_8250, which select the non-existing configs SDM_GCC_8150 and SDM_GCC_8250, respectively. Hence, ./scripts/checkkconfigsymbols.py warns: SDM_GCC_8150 Referencing files: drivers/clk/qcom/Kconfig SDM_GCC_8250 Referencing files: drivers/clk/qcom/Kconfig It is probably just a typo (or naming confusion of using SM_GCC_xxx and SDM_GCC_xxx for various Qualcomm clock drivers) in the config definitions for config SM_VIDEOCC_8150 and SM_VIDEOCC_8250, and intends to select the existing SM_GCC_8150 and SM_GCC_8250, respectively. Adjust the selects to the existing configs. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20210816135930.11810-1-lukas.bulwahn@gmail.com Signed-off-by: Stephen Boyd commit cbe63bfdc54fa289b8bfa943fbce97e70af04122 Author: Iskren Chernev Date: Thu Aug 5 19:11:07 2021 +0300 clk: qcom: Add Global Clock controller (GCC) driver for SM6115 Add support for the global clock controller found on SM6115 based devices. This should allow most non-multimedia device drivers to probe and control their clocks. Based on CAF implementation. GDSCs ported from downstream DT. Signed-off-by: Iskren Chernev Link: https://lore.kernel.org/r/20210805161107.1194521-3-iskren.chernev@gmail.com Signed-off-by: Stephen Boyd commit dce25b3e0bb26dc8929bb3b8eec18dd8a6777c9f Author: Iskren Chernev Date: Thu Aug 5 19:11:06 2021 +0300 dt-bindings: clk: qcom: gcc-sm6115: Document SM6115 GCC Add device tree bindings for global clock controller on SM6115 and SM4250 SoCs (pin and software compatible). Signed-off-by: Iskren Chernev Link: https://lore.kernel.org/r/20210805161107.1194521-2-iskren.chernev@gmail.com Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 0e35f63f7f4eebd268ec236fd1bbf4e561ce8de5 Author: Aleksa Savic Date: Sat Aug 28 07:26:28 2021 +0200 hwmon: add driver for Aquacomputer D5 Next This driver exposes hardware sensors of the Aquacomputer D5 Next watercooling pump, which communicates through a proprietary USB HID protocol. Available sensors are pump and fan speed, power, voltage and current, as well as coolant temperature. Also available through debugfs are the serial number, firmware version and power-on count. Attaching a fan is optional and allows it to be controlled using temperature curves directly from the pump. If it's not connected, the fan-related sensors will report zeroes. The pump can be configured either through software or via its physical interface. Configuring the pump through this driver is not implemented, as it seems to require sending it a complete configuration. That includes addressable RGB LEDs, for which there is no standard sysfs interface. Thus, that task is better suited for userspace tools. This driver has been tested on x86_64, both in-kernel and as a module. Signed-off-by: Aleksa Savic Signed-off-by: Guenter Roeck commit d25a025201ed98f4b93775e0999a3f2135702106 Author: Paul E. McKenney Date: Thu Aug 12 09:31:28 2021 -0700 clocksource: Make clocksource watchdog test safe for slow-HZ systems The clocksource watchdog test sets a local JIFFIES_SHIFT macro and assumes that HZ is >= 100. For smaller HZ values this shift value is too large and causes undefined behaviour. Move the HZ-based definitions of JIFFIES_SHIFT from kernel/time/jiffies.c to kernel/time/tick-internal.h so the clocksource watchdog test can utilize them, which makes it work correctly with all HZ values. [ tglx: Resolved conflicts and massaged changelog ] Signed-off-by: Paul E. McKenney Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/lkml/20210812000133.GA402890@paulmck-ThinkPad-P17-Gen-1/ commit 2619835e31cb0ed760e5cba546ac02af8917fc9a Merge: 0d55649d2ad72 b357d9717be7f Author: David S. Miller Date: Sat Aug 28 12:31:41 2021 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2021-08-27 This series contains updates to ice driver only. Jake corrects the iterator used for looping Tx timestamp and removes dead code related to pin configuration. He also adds locking around flushing of the Tx tracker and restarts the periodic clock following time changes. Brett corrects the locking around updating netdev dev_addr. ==================== Signed-off-by: David S. Miller commit c77225119daa0ca0a9c6c007945c0a87b3e4a2e8 Merge: 4af874f40ebb4 ccbbd002a419b Author: David S. Miller Date: Sat Aug 28 11:23:09 2021 +0100 Merge branch 'ionic-queue-mgmt' Shannon Nelson says: ==================== ionic: queue mgmt updates The first pair of patches help smooth the driver's response when the firmware has gone through a recovery/reboot cycle. The next four patches take care of a couple things seen when changing the interface status. ==================== Signed-off-by: David S. Miller commit ccbbd002a419b5b4df481be8d42c3c7a3ce86426 Author: Shannon Nelson Date: Fri Aug 27 11:55:12 2021 -0700 ionic: recreate hwstamp queues on ifup The queues can be freed in ionic_close(). They need to be recreated after ionic_open(). It doesn't need to replay the whole config. It only needs to create the timestamping queues again. Signed-off-by: Allen Hubbe Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 7ee99fc5ed2e5e299ef46a9ca9d24d93be08c461 Author: Shannon Nelson Date: Fri Aug 27 11:55:11 2021 -0700 ionic: pull hwstamp queue_lock up a level Move the hwstamp configuration use of queue_lock up a level to simplify use and error handling. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit af3d2ae1144327490f4eb96accbfa1d0f404eb8a Author: Shannon Nelson Date: Fri Aug 27 11:55:10 2021 -0700 ionic: add queue lock around open and stop Add the queue configuration lock to ionic_open() and ionic_stop() so that they don't collide with other in parallel queue configuration actions such as MTU changes as can be demonstrated with a tight loop of ifup/change-mtu/ifdown. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 92c90dff687f86ca02bcc1bf7d43626fcf06f4c9 Author: Shannon Nelson Date: Fri Aug 27 11:55:09 2021 -0700 ionic: fill mac addr earlier in add_addr Make sure the ctx struct has the new mac address before any save operations happen. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 970dfbf428c47b9d91960fc9e30f97c3ce59a22b Author: Shannon Nelson Date: Fri Aug 27 11:55:08 2021 -0700 ionic: squelch unnecessary fw halted message Since the heartbeat check will already have complained about the firmware status, don't bother complaining about the DEVCMD failing. We'll keep the print message but demote it to a debug messages so that we normally no longer see it. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit d3e2dcdb6853ee263283121360f5facb73627cfd Author: Shannon Nelson Date: Fri Aug 27 11:55:07 2021 -0700 ionic: fire watchdog again after fw_down In some cases of fw_down it was called because there was a fw_generation change, and the firmware is already back up. In order to keep the down time to a minimum, don't wait for the next watchdog polling cycle, fire another watchdog off as soon as we can - an out-of-cycle check won't hurt, and may well speed up the recovery. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 4af874f40ebb4c906eb632d8756673648c5724e6 Merge: 49b99da2c9ce1 0cb0704149f0d Author: David S. Miller Date: Sat Aug 28 11:20:05 2021 +0100 Merge branch 'hns3-next' Guangbin Huang says: ==================== net: hns3: updates for -next This series includes some updates for the HNS3 ethernet driver. This series includes some optimizations, cleanups and one ==================== Signed-off-by: David S. Miller commit 0cb0704149f0d9d3b7c68ebab932fc27222c740b Author: Hao Chen Date: Sat Aug 28 14:55:21 2021 +0800 net: hns3: add required space in comment Add some required spaces in comment for cleanup. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 1026b1534fa12a9dbdcebd34d417513fca4647f0 Author: Hao Chen Date: Sat Aug 28 14:55:20 2021 +0800 net: hns3: remove unnecessary "static" of local variables in function Some local variable declarations are no need to add "static", so remove it. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 7f2f8cf6ef668c1c745e229023f98663f47aa702 Author: Guangbin Huang Date: Sat Aug 28 14:55:19 2021 +0800 net: hns3: don't config TM DWRR twice when set ETS The function hclge_tm_dwrr_cfg() will be called twice in function hclge_ieee_setets() when map_changed is true, the calling flow is hclge_ieee_setets() hclge_map_update() | hclge_tm_schd_setup_hw() | hclge_tm_dwrr_cfg() hclge_notify_init_up() hclge_tm_dwrr_cfg() It is no need to call hclge_tm_dwrr_cfg() twice actually, so just return after calling hclge_notify_init_up(). Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit aec35aecc3ccc822b358e2594ff70ff54245261e Author: Guangbin Huang Date: Sat Aug 28 14:55:18 2021 +0800 net: hns3: add new function hclge_get_speed_bit() Currently, function hclge_check_port_speed() uses switch/case statement to get speed bit according to speed. To reuse this part of code and improve code readability and maintainability, add a new function hclge_get_speed_bit() to get speed bit according to map relationship of speed and speed bit defined in array speed_bit_map. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 81414ba71356b174d62370195a2bb99592e1b2a2 Author: Guangbin Huang Date: Sat Aug 28 14:55:17 2021 +0800 net: hns3: refactor function hclgevf_parse_capability() The function hclgevf_parse_capability() will add more if statement in the future, to improve code readability, maintainability and simplicity, refactor this function by using a bit mapping array of IMP capabilities and driver capabilities. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit e1d93bc6ef3bf497675f9ac2b35b79c48577b970 Author: Guangbin Huang Date: Sat Aug 28 14:55:16 2021 +0800 net: hns3: refactor function hclge_parse_capability() The function hclge_parse_capability() uses too many if statement, and it may add more in the future. To improve code readability, maintainability and simplicity, refactor this function by using a bit mapping array of IMP capabilities and driver capabilities. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 0fc36e37d5c0e940d6347e8c10a9fe2d8d5b0074 Author: Yufeng Mo Date: Sat Aug 28 14:55:15 2021 +0800 net: hns3: add trace event in hclge_gen_resp_to_vf() Add a trace to get the info of pf responds to the mailbox message of vf. Signed-off-by: Yufeng Mo Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit c7e9d0020361f4308a70cdfd6d5335e273eb8717 Author: Denis Efremov Date: Sat Aug 7 10:37:02 2021 +0300 Revert "floppy: reintroduce O_NDELAY fix" The patch breaks userspace implementations (e.g. fdutils) and introduces regressions in behaviour. Previously, it was possible to O_NDELAY open a floppy device with no media inserted or with write protected media without an error. Some userspace tools use this particular behavior for probing. It's not the first time when we revert this patch. Previous revert is in commit f2791e7eadf4 (Revert "floppy: refactor open() flags handling"). This reverts commit 8a0c014cd20516ade9654fc13b51345ec58e7be8. Link: https://lore.kernel.org/linux-block/de10cb47-34d1-5a88-7751-225ca380f735@compro.net/ Reported-by: Mark Hounschell Cc: Jiri Kosina Cc: Wim Osterholt Cc: Kurt Garloff Cc: Signed-off-by: Denis Efremov commit 4adb389e08c95fdf91995271932c59250ff0d561 Author: Aldas Taraškevičius Date: Sat Aug 28 10:21:19 2021 +0300 staging: vt6655: Remove filenames in files Fix checkpatch warnings about having filenames in the files. Signed-off-by: Aldas Taraškevičius Link: https://lore.kernel.org/r/20210828072119.1395-1-aldas60@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6506cd9f3ae9c9777a581b309f2ca1a215128fbf Author: Phillip Potter Date: Sat Aug 28 01:02:31 2021 +0100 staging: r8188eu: add extra TODO entries Add entry for CFG80211 to reflect that it is currently being worked on and is a desirable feature to have for this driver. Leave entries for LIB80211 and MAC80211 in case anyone else wishes to work on them - they can always be removed later, but MAC80211 in particular would certainly be good to aim for. Also, include an entry for improving error handling, as this is another goal of the cleanup effort. Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20210828000231.1458-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit e1e0ee8ed2b0e95df46785a98118465de880137e Author: Aldas Taraškevičius Date: Fri Aug 27 19:32:03 2021 +0300 staging: vt6656: Remove filenames in files checkpatch.pl warning: It's generally not useful to have the filename in the file Remove the filenames. Signed-off-by: Aldas Taraškevičius Link: https://lore.kernel.org/r/20210827163203.4100-1-aldas60@gmail.com Signed-off-by: Greg Kroah-Hartman commit 65bbdabe2a27a4f46387a3b6976d2355d67f9706 Author: Aakash Hemadri Date: Sat Aug 28 09:59:49 2021 +0530 staging: wlan-ng: fix invalid assignment warning p80211_hdr->frame_control is u16, change to __le16 to satisfy sparse warning: wlan-ng/prism2sta.c:253:43: warning: invalid assignment: |= wlan-ng/prism2sta.c:253:43: left side has type unsigned short wlan-ng/prism2sta.c:253:43: right side has type restricted __le16 Fixes: 6277fbfdd29c ("staging: wlan-ng: Remove pointless a3/a4 union") Reviewed-by: Kees Cook Signed-off-by: Aakash Hemadri Link: https://lore.kernel.org/r/20210828042949.2276341-1-aakashhemadri123@gmail.com Signed-off-by: Greg Kroah-Hartman commit 49b99da2c9ce13ffcd93fe3a0f5670791c1d76f7 Author: Rocco Yue Date: Fri Aug 27 23:04:12 2021 +0800 ipv6: add IFLA_INET6_RA_MTU to expose mtu value The kernel provides a "/proc/sys/net/ipv6/conf//mtu" file, which can temporarily record the mtu value of the last received RA message when the RA mtu value is lower than the interface mtu, but this proc has following limitations: (1) when the interface mtu (/sys/class/net//mtu) is updeated, mtu6 (/proc/sys/net/ipv6/conf//mtu) will be updated to the value of interface mtu; (2) mtu6 (/proc/sys/net/ipv6/conf//mtu) only affect ipv6 connection, and not affect ipv4. Therefore, when the mtu option is carried in the RA message, there will be a problem that the user sometimes cannot obtain RA mtu value correctly by reading mtu6. After this patch set, if a RA message carries the mtu option, you can send a netlink msg which nlmsg_type is RTM_GETLINK, and then by parsing the attribute of IFLA_INET6_RA_MTU to get the mtu value carried in the RA message received on the inet6 device. In addition, you can also get a link notification when ra_mtu is updated so it doesn't have to poll. In this way, if the MTU values that the device receives from the network in the PCO IPv4 and the RA IPv6 procedures are different, the user can obtain the correct ipv6 ra_mtu value and compare the value of ra_mtu and ipv4 mtu, then the device can use the lower MTU value for both IPv4 and IPv6. Signed-off-by: Rocco Yue Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20210827150412.9267-1-rocco.yue@mediatek.com Signed-off-by: Jakub Kicinski commit 0d55649d2ad7296acfda9127e1d05518d025734a Author: Vladimir Oltean Date: Fri Aug 27 15:25:41 2021 +0200 net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list Enabling interrupts via device tree for the internal PHYs on the mv88e6390 DSA switch does not work. The driver insists to use poll mode. Stage one debugging shows that the fwnode_mdiobus_phy_device_register function calls fwnode_irq_get properly, and phy->irq is set to a valid interrupt line initially. But it is then cleared. Stage two debugging shows that it is cleared here: phy_probe: /* Disable the interrupt if the PHY doesn't support it * but the interrupt is still a valid one */ if (!phy_drv_supports_irq(phydrv) && phy_interrupt_is_valid(phydev)) phydev->irq = PHY_POLL; Okay, so does the "Marvell 88E6390 Family" PHY driver not have the .config_intr and .handle_interrupt function pointers? Yes it does. Stage three debugging shows that the PHY device does not attempt a probe against the "Marvell 88E6390 Family" driver, but against the "mv88x3310" driver. Okay, so why does the "mv88x3310" driver match on a mv88x6390 internal PHY? The PHY IDs (MARVELL_PHY_ID_88E6390_FAMILY vs MARVELL_PHY_ID_88X3310) are way different. Stage four debugging has us looking through: phy_device_register -> device_add -> bus_probe_device -> device_initial_probe -> __device_attach -> bus_for_each_drv -> driver_match_device -> drv->bus->match -> phy_bus_match Okay, so as we said, the MII_PHYSID1 of mv88e6390 does not match the mv88x3310 driver's PHY mask & ID, so why would phy_bus_match return... Ahh, phy_bus_match calls a shortcircuit method, phydrv->match_phy_device, and does not even bother to compare the PHY ID if that is implemented. So of course, we go inside the marvell10g.c driver and sure enough, it implements .match_phy_device and does not bother to check the PHY ID. What's interesting though is that at the end of the device_add() from phy_device_register(), the driver for the internal PHYs _is_ the proper "Marvell 88E6390 Family". This is because "mv88x3310" ends up failing to probe after all, and __device_attach_driver(), to quote: /* * Ignore errors returned by ->probe so that the next driver can try * its luck. */ The next (and only other) driver that matches is the 6390 driver. For this one, phy_probe doesn't fail, and everything expects to work as normal, EXCEPT phydev->irq has already been cleared by the previous unsuccessful probe of a driver which did not implement PHY interrupts, and therefore cleared that IRQ. Okay, so it is not just Marvell 6390 that has PHY interrupts broken. Stuff like Atheros, Aquantia, Broadcom, Qualcomm work because they are lexicographically before Marvell, and stuff like NXP, Realtek, Vitesse are broken. This goes to show how fragile it is to reset phydev->irq = PHY_POLL from the actual beginning of phy_probe itself. That seems like an actual bug of its own too, since phy_probe has side effects which are not restored on probe failure, but the line of thought probably was, the same driver will attempt probe again, so it doesn't matter. Well, looks like it does. Maybe it would make more sense to move the phydev->irq clearing after the actual device_add() in phy_device_register() completes, and the bound driver is the actual final one. (also, a bit frightening that drivers are permitted to bypass the MDIO bus matching in such a trivial way and perform PHY reads and writes from the .match_phy_device method, on devices that do not even belong to them. In the general case it might not be guaranteed that the MDIO accesses one driver needs to make to figure out whether to match on a device is safe for all other PHY devices) Fixes: a5de4be0aaaa ("net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340") Signed-off-by: Vladimir Oltean Tested-by: Marek Behún Signed-off-by: Marek Behún Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20210827132541.28953-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit 0975d8b4bfa011b2943c53d3c169277f5e3cf799 Merge: 4baf0e0b32987 907fd4a294dbb Author: Jakub Kicinski Date: Fri Aug 27 17:14:33 2021 -0700 Merge branch 'bnxt-add-rx-discards-stats-for-oom-and-netpool' Jakub Kicinski says: ==================== bnxt: add rx discards stats for oom and netpoll Drivers should avoid silently dropping frames. This set adds two stats for previously unaccounted events to bnxt - packets dropped due to allocation failures and packets dropped during emergency ring polling. ==================== Link: https://lore.kernel.org/r/20210827152745.68812-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 907fd4a294dbb9ce12d9e47cb6fcf4dcc7b2a5f3 Author: Jakub Kicinski Date: Fri Aug 27 08:27:45 2021 -0700 bnxt: count discards due to memory allocation errors Count packets dropped due to buffer or skb allocation errors. Report as part of rx_dropped. v2: drop the ethtool -S entry [Vladimir] Reviewed-by: Michael Chan Reviewed-by: Edwin Peer Signed-off-by: Jakub Kicinski commit 40bedf7cb2ac949052bf9741ccb9d673d782ae2c Author: Jakub Kicinski Date: Fri Aug 27 08:27:44 2021 -0700 bnxt: count packets discarded because of netpoll bnxt may discard packets if Rx completions are consumed in an attempt to let netpoll make progress. It should be extremely rare in practice but nonetheless such events should be counted. Since completion ring memory is allocated dynamically use a similar scheme to what is done for HW stats to save them. Report the stats in rx_dropped and per-netdev ethtool counter. Chances that users care which ring dropped are very low. v3: only save the stat to rx_dropped on reset, rx_total_netpoll_discards will now only show drops since last reset, similar to other "total_discard" counters. Reviewed-by: Michael Chan Reviewed-by: Edwin Peer Signed-off-by: Jakub Kicinski commit 7625eccd1852ac84d3aa6a06ffc2f710e683b3fe Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:16:03 2021 +0200 mm: Replace deprecated CPU-hotplug functions. The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210803141621.780504-21-bigeasy@linutronix.de commit 252034e03f04e54acfb5f5924dd26ae638e3215e Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:15:58 2021 +0200 md/raid5: Replace deprecated CPU-hotplug functions. The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Song Liu Link: https://lore.kernel.org/r/20210803141621.780504-16-bigeasy@linutronix.de commit c7483d823ee0da31e42d32e51a752f667a059735 Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:15:44 2021 +0200 Documentation: Replace deprecated CPU-hotplug functions. The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Update the documentation accordingly. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210803141621.780504-2-bigeasy@linutronix.de commit b542e383d8c005f06a131e2b40d5889b812f19c6 Author: Thomas Gleixner Date: Thu Jul 29 13:01:59 2021 +0200 eventfd: Make signal recursion protection a task bit The recursion protection for eventfd_signal() is based on a per CPU variable and relies on the !RT semantics of spin_lock_irqsave() for protecting this per CPU variable. On RT kernels spin_lock_irqsave() neither disables preemption nor interrupts which allows the spin lock held section to be preempted. If the preempting task invokes eventfd_signal() as well, then the recursion warning triggers. Paolo suggested to protect the per CPU variable with a local lock, but that's heavyweight and actually not necessary. The goal of this protection is to prevent the task stack from overflowing, which can be achieved with a per task recursion protection as well. Replace the per CPU variable with a per task bit similar to other recursion protection bits like task_struct::in_page_owner. This works on both !RT and RT kernels and removes as a side effect the extra per CPU storage. No functional change for !RT kernels. Reported-by: Daniel Bristot de Oliveira Signed-off-by: Thomas Gleixner Tested-by: Daniel Bristot de Oliveira Acked-by: Jason Wang Cc: Al Viro Link: https://lore.kernel.org/r/87wnp9idso.ffs@tglx commit 461d971215dfb55bcd5f7d040b2b222592040f95 Merge: 7ee656c3ac3d0 6607cd319b6b9 Author: Jens Axboe Date: Fri Aug 27 16:32:01 2021 -0600 Merge branch 'md-next' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-5.15/drivers Pull MD changes from Song. * 'md-next' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: raid1: ensure write behind bio has less than BIO_MAX_VECS sectors md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard commit 6607cd319b6b91bff94e90f798a61c031650b514 Author: Guoqing Jiang Date: Tue Aug 24 09:16:54 2021 +0800 raid1: ensure write behind bio has less than BIO_MAX_VECS sectors We can't split write behind bio with more than BIO_MAX_VECS sectors, otherwise the below call trace was triggered because we could allocate oversized write behind bio later. [ 8.097936] bvec_alloc+0x90/0xc0 [ 8.098934] bio_alloc_bioset+0x1b3/0x260 [ 8.099959] raid1_make_request+0x9ce/0xc50 [raid1] [ 8.100988] ? __bio_clone_fast+0xa8/0xe0 [ 8.102008] md_handle_request+0x158/0x1d0 [md_mod] [ 8.103050] md_submit_bio+0xcd/0x110 [md_mod] [ 8.104084] submit_bio_noacct+0x139/0x530 [ 8.105127] submit_bio+0x78/0x1d0 [ 8.106163] ext4_io_submit+0x48/0x60 [ext4] [ 8.107242] ext4_writepages+0x652/0x1170 [ext4] [ 8.108300] ? do_writepages+0x41/0x100 [ 8.109338] ? __ext4_mark_inode_dirty+0x240/0x240 [ext4] [ 8.110406] do_writepages+0x41/0x100 [ 8.111450] __filemap_fdatawrite_range+0xc5/0x100 [ 8.112513] file_write_and_wait_range+0x61/0xb0 [ 8.113564] ext4_sync_file+0x73/0x370 [ext4] [ 8.114607] __x64_sys_fsync+0x33/0x60 [ 8.115635] do_syscall_64+0x33/0x40 [ 8.116670] entry_SYSCALL_64_after_hwframe+0x44/0xae Thanks for the comment from Christoph. [1]. https://bugs.archlinux.org/task/70992 Cc: stable@vger.kernel.org # v5.12+ Reported-by: Jens Stutte Tested-by: Jens Stutte Reviewed-by: Christoph Hellwig Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit fc958a61ff6d34a0ec42744d3ff524ee202b2e9f Author: Chris Packham Date: Thu Aug 26 14:41:20 2021 +1200 hwmon: (adt7470) Convert to devm_hwmon_device_register_with_info API Use the devm_hwmon_device_register_with_info API and remove code that deals with the standard sensor attributes. Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20210826024121.15665-4-chris.packham@alliedtelesis.co.nz [groeck: Fixed alignment issues] Signed-off-by: Guenter Roeck commit ef67959c42539bfece4d7c4335c07656703bb027 Author: Chris Packham Date: Thu Aug 26 14:41:19 2021 +1200 hwmon: (adt7470) Convert to use regmap Convert the adt7470 to using regmap which allows better error handling. Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20210826024121.15665-3-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 23bd022aa6182367e1add7b4d05777cdba283756 Author: Chris Packham Date: Thu Aug 26 14:41:18 2021 +1200 hwmon: (adt7470) Fix some style issues In preparation for the changes that follow fix up some existing style issues. Specifically: - add blank line between variable declaration and code - use strscpy instead of strlcpy - remove unnecessary braces Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20210826024121.15665-2-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 25572c818d2e40b5d7231a9dc49bd45a6b6c3dfa Author: Mario Limonciello Date: Fri Aug 27 15:15:26 2021 -0500 hwmon: (k10temp) Add support for yellow carp Yellow carp matches same behavior as green sardine and other Zen3 products, but have different CCD offsets. Signed-off-by: Mario Limonciello Acked-by: Borislav Petkov Link: https://lore.kernel.org/r/20210827201527.24454-3-mario.limonciello@amd.com Signed-off-by: Guenter Roeck commit 0e3f52bbd9ebaef5fba1b4c70e4132b9782c7c7e Author: Mario Limonciello Date: Fri Aug 27 15:15:25 2021 -0500 hwmon: (k10temp) Rework the temperature offset calculation Some of the existing assumptions made do not scale properly to new silicon in upcoming changes. This commit should cause no functional changes to existing silicon. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20210827201527.24454-2-mario.limonciello@amd.com Signed-off-by: Guenter Roeck commit 2a7a451a9084877a0b9d335c77d57e4cda1e5882 Author: Olga Kornievskaia Date: Fri Aug 27 14:37:19 2021 -0400 NFSv4.1 add network transport when session trunking is detected After trunking is discovered in nfs4_discover_server_trunking(), add the transport to the old client structure if the allowed limit of transports has not been reached. An example: there exists a multi-homed server and client mounts one server address and some volume and then doest another mount to a different address of the same server and perhaps a different volume. Previously, the client checks that this is a session trunkable servers (same server), and removes the newly created client structure along with its transport. Now, the client adds the connection from the 2nd mount into the xprt switch of the existing client (it leads to having 2 available connections). Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit dc48e0abee245e2f0361bd8d4e3b00f70450fab2 Author: Olga Kornievskaia Date: Fri Aug 27 14:37:18 2021 -0400 SUNRPC enforce creation of no more than max_connect xprts If we are adding new transports via rpc_clnt_test_and_add_xprt() then check if we've reached the limit. Currently only pnfs path adds transports via that function but this is done in preparation when the client would add new transports when session trunking is detected. A warning is logged if the limit is reached. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit 7e134205f62955369619021a695cd78fefd32451 Author: Olga Kornievskaia Date: Fri Aug 27 14:37:17 2021 -0400 NFSv4 introduce max_connect mount options This option will control up to how many xprts can the client establish to the server with a distinct address (that means nconnect connections are not counted towards this new limit). This patch is setting up nfs structures to keeep track of the max_connect limit (does not enforce it). The default value is kept at 1 so that no current mounts that don't want any additional connections would be effected. The maximum value is set at 16. Mounts to DS are not limited to default value of 1 but instead set to the maximum default value of 16 (NFS_MAX_TRANSPORTS). Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit df205d0a8ea1b873a29f1333f232f884e9728acc Author: Olga Kornievskaia Date: Fri Aug 27 14:37:16 2021 -0400 SUNRPC add xps_nunique_destaddr_xprts to xprt_switch_info in sysfs In sysfs's xprt_switch_info attribute also display the value of number of transports with unique destination addresses for this xprt_switch. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit 3a3f976639f267823e443fdd8bffa03848fa1c3f Author: Olga Kornievskaia Date: Fri Aug 27 14:37:14 2021 -0400 SUNRPC keep track of number of transports to unique addresses Currently, xprt_switch keeps a number of all xprts (xps_nxprts) that were added to the switch regardless of whethere it's an nconnect transport or a transport to a trunkable address. Introduce a new counter to keep track of transports to unique destination addresses per xprt_switch. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit 79d534f8cbf9714e2ba735f5b6c97678d266b2de Author: Ye Bin Date: Wed Aug 18 10:02:52 2021 +0800 NFSv3: Delete duplicate judgement in nfs3_async_handle_jukebox As eb96d5c97b08 ("SUNRPC handle EKEYEXPIRED in call_refreshresult") commit handle EKEYEXPIRED in call_refreshresult, so there is only handle when "task->tk_status" is equal "-EJUKEBOX" in nfs3_async_handle_jukebox. Signed-off-by: Ye Bin Signed-off-by: Anna Schumaker commit 7c81e6a9d75bd2c094005b64b442cec729dbdf66 Author: Trond Myklebust Date: Tue Aug 24 11:38:18 2021 -0400 SUNRPC: Tweak TCP socket shutdown in the RPC client We only really need to call shutdown() if we're in the ESTABLISHED TCP state, since that is the only case where the client is initiating a close of an established connection. If the socket is in FIN_WAIT1 or FIN_WAIT2, then we've already initiated socket shutdown and are waiting for the server's reply, so do nothing. In all other cases where we've already received a FIN from the server, we should be able to just close the socket. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 0a6ff58edbfb26469a095ab964095506352fc960 Author: Trond Myklebust Date: Tue Aug 24 11:38:17 2021 -0400 SUNRPC: Simplify socket shutdown when not reusing TCP ports If we're not required to reuse the TCP port, then we can just immediately close the socket, and leave the cleanup details to the TCP layer. Fixes: e6237b6feb37 ("NFSv4.1: Don't rebind to the same source port when reconnecting to the server") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit ea41a498cc646349d64eda7e8a4e23ae999bc259 Author: Stefan Binding Date: Fri Aug 27 12:02:52 2021 +0100 ALSA: hda/cs8409: Initialize Codec only in init fixup. It is not necessary to initialize the codec during both probe and inside the init fixup. Signed-off-by: Stefan Binding Signed-off-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20210827110252.5361-2-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 424e531b47f83da87490464c5bf633dfb624fe6a Author: Stefan Binding Date: Fri Aug 27 12:02:51 2021 +0100 ALSA: hda/cs8409: Ensure Type Detection is only run on startup when necessary Type Detection should only be run after init and when the controls have been built. There is no need to run it multiple times. Signed-off-by: Stefan Binding Signed-off-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20210827110252.5361-1-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 4267c5a8f3133db0572cd9abee059b42cafbbdad Author: Takashi Iwai Date: Fri Aug 27 22:33:11 2021 +0200 ALSA: usb-audio: Work around for XRUN with low latency playback The recent change for low latency playback works in most of test cases but it turned out still to hit errors on some use cases, most notably with JACK with small buffer sizes. This is because USB-audio driver fills up and submits full URBs at the beginning, while the URBs would return immediately and try to fill more -- that can easily trigger XRUN. It was more or less expected, but in the small buffer size, the problem became pretty obvious. Fixing this behavior properly would require the change of the fundamental driver design, so it's no trivial task, unfortunately. Instead, here we work around the problem just by switching back to the old method when the given configuration is too fragile with the low latency stream handling. As a threshold, we calculate the total buffer bytes in all plus one URBs, and check whether it's beyond the PCM buffer bytes. The one extra URB is needed because XRUN happens at the next submission after the first round. Fixes: 307cc9baac5c ("ALSA: usb-audio: Reduce latency at playback start, take#2") Cc: Link: https://lore.kernel.org/r/20210827203311.5987-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f3eef46f0518a2b32ca1244015820c35a22cfe4a Author: Zubin Mithra Date: Fri Aug 27 08:37:35 2021 -0700 ALSA: pcm: fix divide error in snd_pcm_lib_ioctl Syzkaller reported a divide error in snd_pcm_lib_ioctl. fifo_size is of type snd_pcm_uframes_t(unsigned long). If frame_size is 0x100000000, the error occurs. Fixes: a9960e6a293e ("ALSA: pcm: fix fifo_size frame calculation") Signed-off-by: Zubin Mithra Reviewed-by: Guenter Roeck Cc: Link: https://lore.kernel.org/r/20210827153735.789452-1-zsm@chromium.org Signed-off-by: Takashi Iwai commit b357d9717be7f95fde2c6c4650b186a995b71e59 Author: Brett Creeley Date: Tue Aug 24 12:27:53 2021 -0700 ice: Only lock to update netdev dev_addr commit 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list") introduced calls to netif_addr_lock_bh() and netif_addr_unlock_bh() in the driver's ndo_set_mac() callback. This is fine since the driver is updated the netdev's dev_addr, but since this is a spinlock, the driver cannot sleep when the lock is held. Unfortunately the functions to add/delete MAC filters depend on a mutex. This was causing a trace with the lock debug kernel config options enabled when changing the mac address via iproute. [ 203.273059] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 [ 203.273065] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6698, name: ip [ 203.273068] Preemption disabled at: [ 203.273068] [] ice_set_mac_address+0x8b/0x1c0 [ice] [ 203.273097] CPU: 31 PID: 6698 Comm: ip Tainted: G S W I 5.14.0-rc4 #2 [ 203.273100] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020 [ 203.273102] Call Trace: [ 203.273107] dump_stack_lvl+0x33/0x42 [ 203.273113] ? ice_set_mac_address+0x8b/0x1c0 [ice] [ 203.273124] ___might_sleep.cold.150+0xda/0xea [ 203.273131] mutex_lock+0x1c/0x40 [ 203.273136] ice_remove_mac+0xe3/0x180 [ice] [ 203.273155] ? ice_fltr_add_mac_list+0x20/0x20 [ice] [ 203.273175] ice_fltr_prepare_mac+0x43/0xa0 [ice] [ 203.273194] ice_set_mac_address+0xab/0x1c0 [ice] [ 203.273206] dev_set_mac_address+0xb8/0x120 [ 203.273210] dev_set_mac_address_user+0x2c/0x50 [ 203.273212] do_setlink+0x1dd/0x10e0 [ 203.273217] ? __nla_validate_parse+0x12d/0x1a0 [ 203.273221] __rtnl_newlink+0x530/0x910 [ 203.273224] ? __kmalloc_node_track_caller+0x17f/0x380 [ 203.273230] ? preempt_count_add+0x68/0xa0 [ 203.273236] ? _raw_spin_lock_irqsave+0x1f/0x30 [ 203.273241] ? kmem_cache_alloc_trace+0x4d/0x440 [ 203.273244] rtnl_newlink+0x43/0x60 [ 203.273245] rtnetlink_rcv_msg+0x13a/0x380 [ 203.273248] ? rtnl_calcit.isra.40+0x130/0x130 [ 203.273250] netlink_rcv_skb+0x4e/0x100 [ 203.273256] netlink_unicast+0x1a2/0x280 [ 203.273258] netlink_sendmsg+0x242/0x490 [ 203.273260] sock_sendmsg+0x58/0x60 [ 203.273263] ____sys_sendmsg+0x1ef/0x260 [ 203.273265] ? copy_msghdr_from_user+0x5c/0x90 [ 203.273268] ? ____sys_recvmsg+0xe6/0x170 [ 203.273270] ___sys_sendmsg+0x7c/0xc0 [ 203.273272] ? copy_msghdr_from_user+0x5c/0x90 [ 203.273274] ? ___sys_recvmsg+0x89/0xc0 [ 203.273276] ? __netlink_sendskb+0x50/0x50 [ 203.273278] ? mod_objcg_state+0xee/0x310 [ 203.273282] ? __dentry_kill+0x114/0x170 [ 203.273286] ? get_max_files+0x10/0x10 [ 203.273288] __sys_sendmsg+0x57/0xa0 [ 203.273290] do_syscall_64+0x37/0x80 [ 203.273295] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 203.273296] RIP: 0033:0x7f8edf96e278 [ 203.273298] Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 63 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55 [ 203.273300] RSP: 002b:00007ffcb8bdac08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 203.273303] RAX: ffffffffffffffda RBX: 000000006115e0ae RCX: 00007f8edf96e278 [ 203.273304] RDX: 0000000000000000 RSI: 00007ffcb8bdac70 RDI: 0000000000000003 [ 203.273305] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007ffcb8bda5b0 [ 203.273306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.273306] R13: 0000555e10092020 R14: 0000000000000000 R15: 0000000000000005 Fix this by only locking when changing the netdev->dev_addr. Also, make sure to restore the old netdev->dev_addr on any failures. Fixes: 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list") Signed-off-by: Brett Creeley Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 9ee313433c483e4a6ecd517c38c0f8aee1962c53 Author: Jacob Keller Date: Mon Aug 23 17:01:49 2021 -0700 ice: restart periodic outputs around time changes When we enabled auxiliary input/output support for the E810 device, we forgot to add logic to restart the output when we change time. This is important as the periodic output will be incorrect after a time change otherwise. This unfortunately includes the adjust time function, even though it uses an atomic hardware interface. The atomic adjustment can still cause the pin output to stall permanently, so we need to stop and restart it. Introduce wrapper functions to temporarily disable and then re-enable the clock outputs. Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins") Signed-off-by: Jacob Keller Tested-by: Sunitha D Mekala Signed-off-by: Tony Nguyen commit 0dc3ad3f859d3a65b335c861ec342d31d91e8bc8 Author: Greg Kroah-Hartman Date: Fri Aug 27 21:21:25 2021 +0200 Revert "bus: mhi: Add inbound buffers allocation flag" This reverts commit 0092a1e3f7636ff4e202a41b0320690699247e22 This should be reverted in the char-misc-next branch to make merging with Linus's branch possible due to issues with the mhi code that was found in the networking tree. Link: https://lore.kernel.org/r/20210827175852.GB15018@thinkpad Reported-by: Manivannan Sadhasivam Reported-by: Stephen Rothwell Cc: Arnd Bergmann Cc: Bhaumik Bhatt Cc: Hemant Kumar Cc: Jakub Kicinski Cc: Kalle Valo Cc: Loic Poulain Cc: Manivannan Sadhasivam Signed-off-by: Greg Kroah-Hartman commit 2bc4eb943b1b27606cd6d63be69f2197cad15173 Author: Rafael J. Wysocki Date: Wed Aug 25 20:31:10 2021 +0200 ACPI: power: Drop name from struct acpi_power_resource Drop the name field (that only is used in diagnostic messages) from struct acpi_power_resource and use the name of the power resource device object instead of it. Signed-off-by: Rafael J. Wysocki commit fad40a624854ad14a88ee0277b9e8207bfc6d95a Author: Rafael J. Wysocki Date: Fri Aug 27 21:07:58 2021 +0200 ACPI: power: Use acpi_handle_debug() to print debug messages Use acpi_handle_debug() to print diagnostic messages regarding ACPI power resources so as to make it easier to correlate the kernel messages with the power resource objects in the ACPI namespace that they are about. Signed-off-by: Rafael J. Wysocki commit 7d5d8d7156892f82cf40b63228ce788248cc57a3 Author: Namjae Jeon Date: Fri Aug 27 10:18:05 2021 +0900 ksmbd: fix __write_overflow warning in ndr_read_string Dan reported __write_overflow warning in ndr_read_string. CC [M] fs/ksmbd/ndr.o In file included from ./include/linux/string.h:253, from ./include/linux/bitmap.h:11, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/cpumask.h:5, from ./arch/x86/include/asm/msr.h:11, from ./arch/x86/include/asm/processor.h:22, from ./arch/x86/include/asm/cpufeature.h:5, from ./arch/x86/include/asm/thread_info.h:53, from ./include/linux/thread_info.h:60, from ./arch/x86/include/asm/preempt.h:7, from ./include/linux/preempt.h:78, from ./include/linux/spinlock.h:55, from ./include/linux/wait.h:9, from ./include/linux/wait_bit.h:8, from ./include/linux/fs.h:6, from fs/ksmbd/ndr.c:7: In function memcpy, inlined from ndr_read_string at fs/ksmbd/ndr.c:86:2, inlined from ndr_decode_dos_attr at fs/ksmbd/ndr.c:167:2: ./include/linux/fortify-string.h:219:4: error: call to __write_overflow declared with attribute error: detected write beyond size of object __write_overflow(); ^~~~~~~~~~~~~~~~~~ This seems to be a false alarm because hex_attr size is always smaller than n->length. This patch fix this warning by allocation hex_attr with n->length. Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 656164181eece68a2f99f0b8a1c5558184b67d7b Author: Geert Uytterhoeven Date: Tue Aug 24 17:23:38 2021 +0200 PM: domains: Fix domain attach for CONFIG_PM_OPP=n If CONFIG_PM_OPP=n, of_get_required_opp_performance_state() always returns -EOPNOTSUPP, and all drivers for devices that are part of a PM Domain fail to probe with: failed to set required performance state for power-domain foo: -95 probe of bar failed with error -95 Fix this by treating -EOPNOTSUPP the same as -ENODEV. Fixes: c016baf7dc58e77a ("PM: domains: Add support for 'required-opps' to set default perf state") Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Reviewed-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 47bb27a20d6ea22cd092c1fc2bb4fcecac374838 Author: Chengfeng Ye Date: Fri Aug 27 00:41:40 2021 -0700 selftests/bpf: Fix potential unreleased lock This lock is not released if the program return at the patched branch. Signed-off-by: Chengfeng Ye Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210827074140.118671-1-cyeaa@connect.ust.hk commit 02a2484cf8d17a2acf3b9b151147bafaa55ad38c Author: Mario Limonciello Date: Thu Aug 26 13:40:56 2021 -0500 hwmon: (k10temp) Don't show Tdie for all Zen/Zen2/Zen3 CPU/APU Tdie is an offset calculation that should only be shown when temp_offset is actually put into a table. This is useless to show for all CPU/APU. Show it only when necessary. Signed-off-by: Mario Limonciello Signed-off-by: Guenter Roeck commit 128066c88770c7b26352fa400cb67297775cc4e8 Author: Mario Limonciello Date: Thu Aug 26 13:40:52 2021 -0500 hwmon: (k10temp) Add additional missing Zen2 and Zen3 APUs These follow the rest of the existing codepaths for families 17h and 19h. Signed-off-by: Mario Limonciello Signed-off-by: Guenter Roeck commit a3e03bc1368c1bc16e19b001fc96dc7430573cc8 Author: Halil Pasic Date: Fri Aug 27 14:54:29 2021 +0200 KVM: s390: index kvm->arch.idle_mask by vcpu_idx While in practice vcpu->vcpu_idx == vcpu->vcp_id is often true, it may not always be, and we must not rely on this. Reason is that KVM decides the vcpu_idx, userspace decides the vcpu_id, thus the two might not match. Currently kvm->arch.idle_mask is indexed by vcpu_id, which implies that code like for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) { vcpu = kvm_get_vcpu(kvm, vcpu_id); do_stuff(vcpu); } is not legit. Reason is that kvm_get_vcpu expects an vcpu_idx, not an vcpu_id. The trouble is, we do actually use kvm->arch.idle_mask like this. To fix this problem we have two options. Either use kvm_get_vcpu_by_id(vcpu_id), which would loop to find the right vcpu_id, or switch to indexing via vcpu_idx. The latter is preferable for obvious reasons. Let us make switch from indexing kvm->arch.idle_mask by vcpu_id to indexing it by vcpu_idx. To keep gisa_int.kicked_mask indexed by the same index as idle_mask lets make the same change for it as well. Fixes: 1ee0bc559dc3 ("KVM: s390: get rid of local_int array") Signed-off-by: Halil Pasic Reviewed-by: Christian Bornträger Reviewed-by: Claudio Imbrenda Cc: # 3.15+ Link: https://lore.kernel.org/r/20210827125429.1912577-1-pasic@linux.ibm.com Signed-off-by: Christian Borntraeger commit 7119decf47d9867266459615be502e5d2cecedba Author: Janis Schoetterl-Glausch Date: Tue Jun 29 10:55:30 2021 +0200 KVM: s390: Enable specification exception interpretation When this feature is enabled the hardware is free to interpret specification exceptions generated by the guest, instead of causing program interruption interceptions. This benefits (test) programs that generate a lot of specification exceptions (roughly 4x increase in exceptions/sec). Interceptions will occur as before if ICTL_PINT is set, i.e. if guest debug is enabled. There is no indication if this feature is available or not and the hardware is free to interpret or not. So we can simply set this bit and if the hardware ignores it we fall back to intercept 8 handling. Signed-off-by: Janis Schoetterl-Glausch Link: https://lore.kernel.org/linux-s390/20210706114714.3936825-1-scgl@linux.ibm.com/ Reviewed-by: David Hildenbrand Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger commit 1ab011b0bf073ef02abf15344bb59e383aa15457 Author: Aravindhan Gunasekaran Date: Mon Aug 9 20:23:40 2021 +0530 igc: Add support for CBS offloading Implement support for Credit-based shaper(CBS) Qdisc hardware offload mode in the driver. There are two sets of IEEE802.1Qav (CBS) HW logic in i225 controller and this patch supports enabling them in the top two priority TX queues. Driver implemented as recommended by Foxville External Architecture Specification v0.993. Idleslope and Hi-credit are the CBS tunable parameters for i225 NIC, programmed in TQAVCC and TQAVHC registers respectively. In-order for IEEE802.1Qav (CBS) algorithm to work as intended and provide BW reservation CBS should be enabled in highest priority queue first. If we enable CBS on any of low priority queues, the traffic in high priority queue does not allow low priority queue to be selected for transmission and bandwidth reservation is not guaranteed. Signed-off-by: Aravindhan Gunasekaran Signed-off-by: Mallikarjuna Chilakala Tested-by: Dvora Fuxbrumer Signed-off-by: Tony Nguyen commit 61572d5f8f91d8603d8db028e1ec9e18fc0ca245 Author: Vinicius Costa Gomes Date: Mon Aug 9 20:23:39 2021 +0530 igc: Simplify TSN flags handling Separates the procedure done during reset from applying a configuration, knowing when the code is executing allow us to separate the better what changes the hardware state from what changes only the driver state. Introduces a flag for bookkeeping the driver state of TSN features. When Qav and frame-preemption is also implemented this flag makes it easier to keep track on whether a TSN feature driver state is enabled or not though controller state changes, say, during a reset. Signed-off-by: Vinicius Costa Gomes Signed-off-by: Aravindhan Gunasekaran Signed-off-by: Mallikarjuna Chilakala Tested-by: Dvora Fuxbrumer Signed-off-by: Tony Nguyen commit c814a2d2d48f04eb3c4480e8f7835a5f2b235f85 Author: Vinicius Costa Gomes Date: Mon Aug 9 20:23:38 2021 +0530 igc: Use default cycle 'start' and 'end' values for queues Sets default values for each queue cycle start and cycle end. This allows some simplification in the handling of these configurations as most TSN features in i225 require a cycle to be configured. In i225, cycle start and end time is required to be programmed for CBS to work properly. Signed-off-by: Vinicius Costa Gomes Signed-off-by: Aravindhan Gunasekaran Signed-off-by: Mallikarjuna Chilakala Tested-by: Dvora Fuxbrumer Signed-off-by: Tony Nguyen commit 4dd0d5c33c3ebf24a07cae6141648aeb7ba56072 Author: Jacob Keller Date: Mon Aug 23 17:01:48 2021 -0700 ice: add lock around Tx timestamp tracker flush The driver didn't take the lock while flushing the Tx tracker, which could cause a race where one thread is trying to read timestamps out while another thread is trying to read the tracker to check the timestamps. Avoid this by ensuring that flushing is locked against read accesses. Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") Signed-off-by: Jacob Keller Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 1f0cbb3e8916142382551c336065cbcbfb77a11e Author: Jacob Keller Date: Mon Aug 23 17:01:47 2021 -0700 ice: remove dead code for allocating pin_config We have code in the ice driver which allocates the pin_config structure if n_pins is > 0, but we never set n_pins to be greater than zero. There's no reason to keep this code until we actually have pin_config support. Remove this. We can re-add it properly when we implement support for pin_config for E810-T devices. Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins") Signed-off-by: Jacob Keller Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 84c5fb8c4264ec12ef9d21905c562d2297a0234e Author: Jacob Keller Date: Mon Aug 23 17:01:46 2021 -0700 ice: fix Tx queue iteration for Tx timestamp enablement The driver accidentally copied the ice_for_each_rxq iterator when implementing enablement of the ptp_tx bit for the Tx rings. We still load the Tx rings and set the ptp_tx field, but we iterate over the count of the num_rxq. If the number of Tx and Rx queues differ, this could either cause a buffer overrun when accessing the tx_rings list if num_txq is greater than num_rxq, or it could cause us to fail to enable Tx timestamps for some rings. This was not noticed originally as we generally have the same number of Tx and Rx queues. Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices") Signed-off-by: Jacob Keller Tested-by: Gurucharan G Signed-off-by: Tony Nguyen commit 90499ad00ca59320b5bb43392b7931e1bd84cad2 Author: Pavel Begunkov Date: Wed Aug 25 20:51:40 2021 +0100 io_uring: add build check for buf_index overflows req->buf_index is u16 and so we rely on registered buffers indexes fitting into it. Add a build check, so when the upper limit for the number of buffers is lifted we get a compliation fail but not lurking problems. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/787e8e1a17cea51ca6301426b1c4c4887b8bd676.1629920396.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b18a1a4574d2d15f1b0c84658d4549ccbf241fee Author: Pavel Begunkov Date: Wed Aug 25 20:51:39 2021 +0100 io_uring: clarify io_req_task_cancel() locking It's too easy to forget and misjudge about synchronisation in io_req_task_cancel(), add a comment clarifying it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/71099083835f983a1fd73d5a3da6391924da8300.1629920396.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit bc17bed5fd73ef1a9aed39f3b0ea26936dad60b8 Author: YueHaibing Date: Wed Aug 4 21:01:05 2021 +0800 printk/index: Fix -Wunused-function warning If CONFIG_MODULES is n, we got this: kernel/printk/index.c:146:13: warning: ‘pi_remove_file’ defined but not used [-Wunused-function] Move it inside #ifdef block to fix this warning. Reported-by: Hulk Robot Signed-off-by: YueHaibing Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20210804130105.18732-1-yuehaibing@huawei.com commit a75c956162978097c0a60d95971c97ae486a68d7 Merge: f80c8e6864eb1 885814a97f5a1 Author: Ulf Hansson Date: Fri Aug 27 16:35:55 2021 +0200 Merge branch 'fixes' into next commit 2e5f3a69b6fcd52a64ce3d746c6ee8390b6cabe8 Author: Sean Anderson Date: Thu Aug 26 15:25:49 2021 -0400 tty: serial: uartlite: Use read_poll_timeout for a polling loop read_poll_timeout was recently introduced, and can be used to simplify our console polling loop. This results in a slight reduction in code. early_uartlite_putc can't get the same treatment, because it can be called before udelay is set up. Signed-off-by: Sean Anderson Link: https://lore.kernel.org/r/20210826192549.3203071-1-sean.anderson@seco.com Signed-off-by: Greg Kroah-Hartman commit 3620a89b7d27138c716e5cf537a0bf6606a3a1b3 Author: Sean Anderson Date: Thu Aug 26 15:43:23 2021 -0400 tty: serial: uartlite: Use constants in early_uartlite_putc Use the constants defined at the beginning of this file instead of integer literals when accessing registers. This makes this code easier to read, and obviates the need for some explanatory comments. Signed-off-by: Sean Anderson Link: https://lore.kernel.org/r/20210826194323.3209227-1-sean.anderson@seco.com Signed-off-by: Greg Kroah-Hartman commit a99009bc4f2f0b46e6c553704fda0b67e04395f5 Author: Mihai Carabas Date: Thu Aug 19 18:12:26 2021 +0300 misc/pvpanic: fix set driver data Add again dev_set_drvdata(), but this time in devm_pvpanic_probe(), in order for dev_get_drvdata() to not return NULL. Fixes: 394febc9d0a6 ("misc/pvpanic: Make 'pvpanic_probe()' resource managed") Reviewed-by: Andy Shevchenko Signed-off-by: Mihai Carabas Link: https://lore.kernel.org/r/1629385946-4584-2-git-send-email-mihai.carabas@oracle.com Signed-off-by: Greg Kroah-Hartman commit a30dc6cf0dc51419021550152e435736aaef8799 Author: Wang Hai Date: Wed Aug 18 20:48:45 2021 +0800 VMCI: fix NULL pointer dereference when unmapping queue pair I got a NULL pointer dereference report when doing fuzz test: Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM. vmci_host_unlocked_ioctl vmci_host_do_alloc_queuepair vmci_qp_broker_alloc qp_broker_alloc qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM; When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation. Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker. Only when the qp broker has no mem, it can register the user memory when mapping the qp broker. Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") Cc: stable Reported-by: Hulk Robot Reviewed-by: Jorgen Hansen Signed-off-by: Wang Hai Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman commit f8cefead37ddc111786b14da73286204eb8509b5 Author: jing yangyang Date: Thu Aug 19 19:17:52 2021 -0700 char: mware: fix returnvar.cocci warnings Remove unneeded variables when "0" can be returned. Generated by: scripts/coccinelle/misc/returnvar.cocci Reported-by: Zeal Robot Signed-off-by: jing yangyang Link: https://lore.kernel.org/r/20210820021752.10927-1-jing.yangyang@zte.com.cn Signed-off-by: Greg Kroah-Hartman commit 0be883a0d795d9146f5325de582584147dd0dcdc Author: Colin Ian King Date: Fri Jul 30 11:07:10 2021 +0100 parport: remove non-zero check on count The check for count appears to be incorrect since a non-zero count check occurs a couple of statements earlier. Currently the check is always false and the dev->port->irq != PARPORT_IRQ_NONE part of the check is never tested and the if statement is dead-code. Fix this by removing the check on count. Note that this code is pre-git history, so I can't find a sha for it. Acked-by: Sudip Mukherjee Signed-off-by: Colin Ian King Addresses-Coverity: ("Logically dead code") Link: https://lore.kernel.org/r/20210730100710.27405-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit f6bc526accf861728d36b12fbc25ac94cd057fc9 Author: Michael Straube Date: Fri Aug 27 11:41:44 2021 +0200 staging: r8188eu: rename fields of struct rtl_ps Rename fields of struct rtl_ps to avoid camel case. PreCCAState -> pre_cca_state CurCCAState -> cur_cca_state PreRFState -> pre_rf_state CurRFState -> cur_rf_state Rssi_val_min -> rssi_val_min Reg874 -> reg_874 RegC70 -> reg_c70 Reg85C -> reg_85c RegA74 -> reg_a74 Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210827094144.13290-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9f801ac94d8b6613174a1bafdac684a1c05646ba Author: Michael Straube Date: Fri Aug 27 11:41:43 2021 +0200 staging: r8188eu: remove ODM_DynamicPrimaryCCA_DupRTS() Function ODM_DynamicPrimaryCCA_DupRTS() is unused, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210827094144.13290-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9f30a2312c0b6d19f444903491ff794ad40b6009 Author: Michael Straube Date: Fri Aug 27 11:41:42 2021 +0200 staging: r8188eu: rename fields of struct dyn_primary_cca Rename fields of struct dyn_primary_cca to avoid camel case. PriCCA_flag -> pri_cca_flag DupRTS_flag -> dup_rts_flag Monitor_flag -> monitor_flag Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210827094144.13290-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a01b0006de7632656b2711b67c1d59b76af4d6a2 Author: Michael Straube Date: Fri Aug 27 11:41:41 2021 +0200 staging: r8188eu: rename struct field Wifi_Error_Status Rename struct field Wifi_Error_Status to avoid camel case. Wifi_Error_Status -> wifi_error_status Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210827094144.13290-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 71419e03d85ff3e46b3c61238bd1e369f313c280 Author: Fabio M. De Francesco Date: Fri Aug 27 12:08:13 2021 +0200 staging: r8188eu: Provide a TODO file for this driver Provide a TODO file that lists the tasks that should be carried out in order to move this driver off drivers/staging. Acked-by: Phillip Potter Signed-off-by: Fabio M. De Francesco Link: https://lore.kernel.org/r/20210827100813.18610-1-fmdefrancesco@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9c1587d99f9305aa4f10b47fcf1981012aa5381f Author: Rui Miguel Silva Date: Fri Aug 27 14:11:54 2021 +0100 usb: isp1760: otg control register access The set/clear of the otg control values is done writing to two different 16bit registers, however we setup the regmap width for isp1760/61 to 32bit value bits. So, just access the clear register address (0x376)as the high part of the otg control register set (0x374), and write the values in one go to make sure they get clear/set. Reported-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210827131154.4151862-6-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 955d0fb590f18ec5c3a4085c7d0e39b6abde0dd6 Author: Rui Miguel Silva Date: Fri Aug 27 14:11:53 2021 +0100 usb: isp1760: use the right irq status bit Instead of using the fields enum values to check interrupts trigged, use the correct bit values. Reported-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210827131154.4151862-5-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 36815a4a0763bb405ebd776c45553005c1ef7a15 Author: Rui Miguel Silva Date: Fri Aug 27 14:11:52 2021 +0100 usb: isp1760: write to status and address register We were already writing directly the port status register to trigger changes in isp1763. The same is needed in other IP from the family, including also to setup the read address before reading from device. Reported-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210827131154.4151862-4-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit cbfa3effdf5c2d411c9ce9820f3d33d77bc4697d Author: Rui Miguel Silva Date: Fri Aug 27 14:11:51 2021 +0100 usb: isp1760: fix qtd fill length When trying to send bulks bigger than the biggest block size we need to split them over several qtd. Fix this limiting the maximum qtd size to largest block size. Reported-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210827131154.4151862-3-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit f757f9291f920e1da4c6cfd4064c6bf59639983e Author: Rui Miguel Silva Date: Fri Aug 27 14:11:50 2021 +0100 usb: isp1760: fix memory pool initialization The loops to setup the memory pool were skipping some blocks, that was not visible on the ISP1763 because it has fewer blocks than the ISP1761. But won testing on that IP from the family that would be an issue. Reported-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210827131154.4151862-2-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 4baf0e0b329874ec5e85480f53851b5f05a7ae58 Author: Johannes Berg Date: Fri Aug 27 09:48:04 2021 +0200 um: vector: adjust to coalesce API changes The API changes were propagated to most drivers, but clearly arch/um/drivers/ was missed, perhaps due to looking only at the drivers/ folder. Fix that. Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20210827094759.f3ab06684bd0.I985181cc00fe017cfe6413d9e1bb720cbe852e6d@changeid Signed-off-by: Jakub Kicinski commit b8155e95de38b25a69dfb03e4731fd6c5a28531e Author: Dan Carpenter Date: Tue Aug 24 10:51:04 2021 +0300 fs/ntfs3: Fix error handling in indx_insert_into_root() There are three bugs in this code: 1) If indx_get_root() fails, then return -EINVAL instead of success. 2) On the "/* make root external */" -EOPNOTSUPP; error path it should free "re" but it has a memory leak. 3) If indx_new() fails then it will lead to an error pointer dereference when we call put_indx_node(). I've re-written the error handling to be more clear. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 8c83a4851da1c7eda83098ade238665b15774da3 Author: Dan Carpenter Date: Tue Aug 24 10:50:15 2021 +0300 fs/ntfs3: Potential NULL dereference in hdr_find_split() The "e" pointer is dereferenced before it has been checked for NULL. Move the dereference after the NULL check to prevent an Oops. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 04810f000afdbdd37825ca7f563f036119422cb7 Author: Dan Carpenter Date: Tue Aug 24 10:49:32 2021 +0300 fs/ntfs3: Fix error code in indx_add_allocate() Return -EINVAL if ni_find_attr() fails. Don't return success. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 2926e4297053c735ab65450192dfba32a4f47fa9 Author: Dan Carpenter Date: Tue Aug 24 14:48:58 2021 +0300 fs/ntfs3: fix an error code in ntfs_get_acl_ex() The ntfs_get_ea() function returns negative error codes or on success it returns the length. In the original code a zero length return was treated as -ENODATA and results in a NULL return. But it should be treated as an invalid length and result in an PTR_ERR(-EINVAL) return. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Signed-off-by: Dan Carpenter Signed-off-by: Konstantin Komarov commit a1b04d380ab64790a7b4a8eb52e14679e47065ab Author: Dan Carpenter Date: Tue Aug 24 14:52:36 2021 +0300 fs/ntfs3: add checks for allocation failure Add a check for when the kzalloc() in init_rsttbl() fails. Some of the callers checked for NULL and some did not. I went down the call tree and added NULL checks where ever they were missing. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Dan Carpenter Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 345482bc431f6492beb464696341626057f67771 Author: Kari Argillander Date: Tue Aug 24 21:37:08 2021 +0300 fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc Use kcalloc/kmalloc_array over kzalloc/kmalloc when we allocate array. Checkpatch found these after we did not use our own defined allocation wrappers. Reviewed-by: Christoph Hellwig Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 195c52bdd5d5ecfdabf5a7c6159efe299e534f84 Author: Kari Argillander Date: Tue Aug 24 21:37:07 2021 +0300 fs/ntfs3: Do not use driver own alloc wrappers Problem with these wrapper is that we cannot take off example GFP_NOFS flag. It is not recomended use those in all places. Also if we change one driver specific wrapper to kernel wrapper then it would look really weird. People should be most familiar with kernel wrappers so let's just use those ones. Driver specific alloc wrapper also confuse some static analyzing tools, good example is example kernels checkpatch tool. After we converter these to kernel specific then warnings is showed. Following Coccinelle script was used to automate changing. virtual patch @alloc depends on patch@ expression x; expression y; @@ ( - ntfs_malloc(x) + kmalloc(x, GFP_NOFS) | - ntfs_zalloc(x) + kzalloc(x, GFP_NOFS) | - ntfs_vmalloc(x) + kvmalloc(x, GFP_NOFS) | - ntfs_free(x) + kfree(x) | - ntfs_vfree(x) + kvfree(x) | - ntfs_memdup(x, y) + kmemdup(x, y, GFP_NOFS) ) Reviewed-by: Christoph Hellwig Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit fa3cacf544636b2dc48cfb2f277a2071f14d66a2 Author: Kari Argillander Date: Thu Aug 26 11:56:29 2021 +0300 fs/ntfs3: Use kernel ALIGN macros over driver specific The static checkers (Smatch) were complaining because QuadAlign() was buggy. If you try to align something higher than UINT_MAX it got truncated to a u32. Smatch warning was: fs/ntfs3/attrib.c:383 attr_set_size_res() warn: was expecting a 64 bit value instead of '~7' So that this will not happen again we will change all these macros to kernel made ones. This can also help some other static analyzing tools to give us better warnings. Patch was generated with Coccinelle script and after that some style issue was hand fixed. Coccinelle script: virtual patch @alloc depends on patch@ expression x; @@ ( - #define QuadAlign(n) (((n) + 7u) & (~7u)) | - QuadAlign(x) + ALIGN(x, 8) | - #define IsQuadAligned(n) (!((size_t)(n)&7u)) | - IsQuadAligned(x) + IS_ALIGNED(x, 8) | - #define Quad2Align(n) (((n) + 15u) & (~15u)) | - Quad2Align(x) + ALIGN(x, 16) | - #define IsQuad2Aligned(n) (!((size_t)(n)&15u)) | - IsQuad2Aligned(x) + IS_ALIGNED(x, 16) | - #define Quad4Align(n) (((n) + 31u) & (~31u)) | - Quad4Align(x) + ALIGN(x, 32) | - #define IsSizeTAligned(n) (!((size_t)(n) & (sizeof(size_t) - 1))) | - IsSizeTAligned(x) + IS_ALIGNED(x, sizeof(size_t)) | - #define DwordAlign(n) (((n) + 3u) & (~3u)) | - DwordAlign(x) + ALIGN(x, 4) | - #define IsDwordAligned(n) (!((size_t)(n)&3u)) | - IsDwordAligned(x) + IS_ALIGNED(x, 4) | - #define WordAlign(n) (((n) + 1u) & (~1u)) | - WordAlign(x) + ALIGN(x, 2) | - #define IsWordAligned(n) (!((size_t)(n)&1u)) | - IsWordAligned(x) + IS_ALIGNED(x, 2) | ) Reported-by: Dan Carpenter Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 24516d481dfc6c7728ffe36280ca8cf4640d119a Author: Kari Argillander Date: Tue Aug 24 21:37:06 2021 +0300 fs/ntfs3: Restyle comment block in ni_parse_reparse() First of this fix one none utf8 char in this comment block. Maybe this happened because error in filesystem ;) Also this block was hard to read because long lines so make it max 80 long. And while we doing this stuff make little better grammer. Signed-off-by: Kari Argillander Reviewed-by: Christoph Hellwig Signed-off-by: Konstantin Komarov commit 1263eddfea9988125a4b9608efecc8aff2c721f9 Author: Jiapeng Chong Date: Thu Aug 19 16:23:37 2021 +0800 fs/ntfs3: Remove unused including Eliminate the follow versioncheck warning: ./fs/ntfs3/inode.c: 16 linux/version.h not needed. Reported-by: Abaci Robot Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Jiapeng Chong Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit abfeb2ee2103f07dd93b9d7b32317e26d1c8ef79 Author: Gustavo A. R. Silva Date: Wed Aug 18 17:21:46 2021 -0500 fs/ntfs3: Fix fall-through warnings for Clang Fix the following fallthrough warnings: fs/ntfs3/inode.c:1792:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] fs/ntfs3/index.c:178:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] This helps with the ongoing efforts to globally enable -Wimplicit-fallthrough for Clang. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Nathan Chancellor Signed-off-by: Konstantin Komarov commit be87e821fdb5ec8c6d404f29e118130c7879ce5b Author: Kari Argillander Date: Wed Aug 18 04:06:47 2021 +0300 fs/ntfs3: Fix one none utf8 char in source file In one source file there is for some reason non utf8 char. But hey this is fs development so this kind of thing might happen. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 8c01308b6d6b2bc8e9163c6a3400856fb782dee6 Author: Nathan Chancellor Date: Mon Aug 16 12:30:41 2021 -0700 fs/ntfs3: Remove unused variable cnt in ntfs_security_init() Clang warns: fs/ntfs3/fsntfs.c:1874:9: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] size_t cnt, off; ^ 1 warning generated. It is indeed unused so remove it. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 71eeb6ace80be7389d942b9647765417e5b039f7 Author: Colin Ian King Date: Mon Aug 16 17:30:25 2021 +0100 fs/ntfs3: Fix integer overflow in multiplication The multiplication of the u32 data_size with a int is being performed using 32 bit arithmetic however the results is being assigned to the variable nbits that is a size_t (64 bit) value. Fix a potential integer overflow by casting the u32 value to a size_t before the multiply to use a size_t sized bit multiply operation. Addresses-Coverity: ("Unintentional integer overflow") Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Colin Ian King Signed-off-by: Konstantin Komarov commit 87790b65343932411af43bc9b218f086ecebd6a5 Author: Kari Argillander Date: Mon Aug 16 15:01:56 2021 +0300 fs/ntfs3: Add ifndef + define to all header files Add guards so that compiler will only include header files once. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 528c9b3d1edf291685151afecd741d176f527ddf Author: Kari Argillander Date: Mon Aug 16 13:37:32 2021 +0300 fs/ntfs3: Use linux/log2 is_power_of_2 function We do not need our own implementation for this function in this driver. It is much better to use generic one. Signed-off-by: Kari Argillander Signed-off-by: Konstantin Komarov commit f8d87ed9f0d546ac5b05e8e7d2b148d4b77599fa Author: Colin Ian King Date: Mon Aug 16 11:13:08 2021 +0100 fs/ntfs3: Fix various spelling mistakes There is a spelling mistake in a ntfs_err error message. Also fix various spelling mistakes in comments. Signed-off-by: Colin Ian King Reviewed-by: Kari Argillander Signed-off-by: Konstantin Komarov commit 1be72c8e0786727df375f11c8178ce7e65eea20e Author: Shuai Xue Date: Mon Aug 23 19:56:54 2021 +0800 efi: cper: check section header more appropriately When checking a generic status block, we iterate over all the generic data blocks. The loop condition checks that the generic data block is valid. Because the size of data blocks (excluding error data) may vary depending on the revision and the revision is contained within the data block, we should ensure that enough of the current data block is valid appropriately for different revision. Signed-off-by: Shuai Xue Signed-off-by: Ard Biesheuvel commit b31eea2e04c1002e5cb864eefdc718b70d2cb08c Author: Andy Shevchenko Date: Tue Feb 9 18:45:06 2021 +0200 efi: Don't use knowledge about efi_guid_t internals When print GUIDs supply pointer to the efi_guid_t (guid_t) type rather its internal members. Signed-off-by: Andy Shevchenko Reviewed-by: Serge Hallyn Signed-off-by: Ard Biesheuvel commit 5eff88dd6b4badd664d7d3b648103d540b390248 Author: Rasmus Villemoes Date: Wed Apr 21 21:31:46 2021 +0200 efi: cper: fix scnprintf() use in cper_mem_err_location() The last two if-clauses fail to update n, so whatever they might have written at &msg[n] would be cut off by the final nul-termination. That nul-termination is redundant; scnprintf(), just like snprintf(), guarantees a nul-terminated output buffer, provided the buffer size is positive. And there's no need to discount one byte from the initial buffer; vsnprintf() expects to be given the full buffer size - it's not going to write the nul-terminator one beyond the given (buffer, size) pair. Signed-off-by: Rasmus Villemoes Signed-off-by: Ard Biesheuvel commit 9a10867ae54e02a0f204d2eebea5a446fb7a86f9 Author: Pavel Begunkov Date: Fri Aug 27 11:55:01 2021 +0100 io_uring: add task-refs-get helper As we have a more complicated task referencing, which apart from normal task references includes taking tctx->inflight and caching all that, it would be a good idea to have all that isolated in helpers. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d9114d037f1c195897aa13f38a496078eca2afdb.1630023531.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a8295b982c46d4a7c259a4cdd58a2681929068a9 Author: Hao Xu Date: Fri Aug 27 17:46:09 2021 +0800 io_uring: fix failed linkchain code logic Given a linkchain like this: req0(link_flag)-->req1(link_flag)-->...-->reqn(no link_flag) There is a problem: - if some intermediate linked req like req1 's submittion fails, reqs after it won't be cancelled. - sqpoll disabled: maybe it's ok since users can get the error info of req1 and stop submitting the following sqes. - sqpoll enabled: definitely a problem, the following sqes will be submitted in the next round. The solution is to refactor the code logic to: - if a linked req's submittion fails, just mark it and the head(if it exists) as REQ_F_FAIL. Leverage req->result to indicate whether it is failed or cancelled. - submit or fail the whole chain when we come to the end of it. Signed-off-by: Hao Xu Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20210827094609.36052-3-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 14afdd6ee3a0db7bcae887d1951ed21c4d1539cd Author: Hao Xu Date: Fri Aug 27 17:46:08 2021 +0800 io_uring: remove redundant req_set_fail() req_set_fail() in io_submit_sqe() is redundant, remove it. Signed-off-by: Hao Xu Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20210827094609.36052-2-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 20ec197bfa13c5b799fc9527790ea7b5374fc8f2 Author: David Howells Date: Mon Mar 29 13:53:50 2021 +0100 fscache: Use refcount_t for the cookie refcount instead of atomic_t Use refcount_t for the fscache_cookie refcount instead of atomic_t and rename the 'usage' member to 'ref' in such cases. The tracepoints that reference it change from showing "u=%d" to "r=%d". Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431204358.2908479.8006938388213098079.stgit@warthog.procyon.org.uk/ commit 33cba859220b0878b3b2931caa1629a3d2432379 Author: David Howells Date: Fri Jun 18 11:19:49 2021 +0100 fscache: Fix fscache_cookie_put() to not deref after dec fscache_cookie_put() accesses the cookie it has just put inside the tracepoint that monitors the change - but this is something it's not allowed to do if we didn't reduce the count to zero. Fix this by dropping most of those values from the tracepoint and grabbing the cookie debug ID before doing the dec. Also take the opportunity to switch over the usage and where arguments on the tracepoint to put the reason last. Fixes: a18feb55769b ("fscache: Add tracepoints") Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431203107.2908479.3259582550347000088.stgit@warthog.procyon.org.uk/ commit 35b72573e977ed6b18b094136a4fa3e0ffb13603 Author: David Howells Date: Thu Jun 17 14:21:00 2021 +0100 fscache: Fix cookie key hashing The current hash algorithm used for hashing cookie keys is really bad, producing almost no dispersion (after a test kernel build, ~30000 files were split over just 18 out of the 32768 hash buckets). Borrow the full_name_hash() hash function into fscache to do the hashing for cookie keys and, in the future, volume keys. I don't want to use full_name_hash() as-is because I want the hash value to be consistent across arches and over time as the hash value produced may get used on disk. I can also optimise parts of it away as the key will always be a padded array of aligned 32-bit words. Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies") Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431201844.2908479.8293647220901514696.stgit@warthog.procyon.org.uk/ commit 8beabdde18d31ac10c7d211347c361f07c7cd5b0 Author: David Howells Date: Mon Oct 19 21:40:32 2020 +0100 cachefiles: Change %p in format strings to something else Change plain %p in format strings in cachefiles code to something more useful, since %p is now hashed before printing and thus no longer matches the contents of an oops register dump. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/160588476042.3465195.6837847445880367183.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/162431200692.2908479.9253374494073633778.stgit@warthog.procyon.org.uk/ commit c97a72ded933a1ec88fa8f8d7aecef098d3e540b Author: David Howells Date: Mon Oct 19 21:32:55 2020 +0100 fscache: Change %p in format strings to something else Change plain %p in format strings in fscache code to something more useful, since %p is now hashed before printing and thus no longer matches the contents of an oops register dump. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/160588474843.3465195.5446072310069374803.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/162431199509.2908479.2950631488219944294.stgit@warthog.procyon.org.uk/ commit 58f386a73f16cea1f78e8466cc5c402eb7f6fcf8 Author: David Howells Date: Wed May 12 09:59:17 2021 +0100 fscache: Remove the object list procfile Remove the object list procfile from fscache as objects will become entirely internal to the cache. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431198332.2908479.5847286163455099669.stgit@warthog.procyon.org.uk/ commit 6ae9bd8bb037b7c422bafde746f2338a716f6058 Author: David Howells Date: Wed May 12 09:40:19 2021 +0100 fscache, cachefiles: Remove the histogram stuff Remove the histogram stuff as it's mostly going to be outdated. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431195953.2908479.16770977195634296638.stgit@warthog.procyon.org.uk/ commit 884a76881fc5f5c9c04de1b640bed2c340929842 Author: David Howells Date: Mon Feb 10 10:00:22 2020 +0000 fscache: Procfile to display cookies Add /proc/fs/fscache/cookies to display active cookies. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/158861211871.340223.7223853943667440807.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/159465771021.1376105.6933857529128238020.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/160588460994.3465195.16963417803501149328.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/162431194785.2908479.786917990782538164.stgit@warthog.procyon.org.uk/ commit a055fcc132d4c25b96d1115aea514258810dc6fc Author: Peter Zijlstra Date: Thu Aug 26 10:48:18 2021 +0200 locking/rtmutex: Return success on deadlock for ww_mutex waiters ww_mutexes can legitimately cause a deadlock situation in the lock graph which is resolved afterwards by the wait/wound mechanics. The rtmutex chain walk can detect such a deadlock and returns EDEADLK which in turn skips the wait/wound mechanism and returns EDEADLK to the caller. That's wrong because both lock chains might get EDEADLK or the wrong waiter would back out. Detect that situation and return 'success' in case that the waiter which initiated the chain walk is a ww_mutex with context. This allows the wait/wound mechanics to resolve the situation according to the rules. [ tglx: Split it apart and added changelog ] Reported-by: Sebastian Siewior Fixes: add461325ec5 ("locking/rtmutex: Extend the rtmutex core to support ww_mutex") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/YSeWjCHoK4v5OcOt@hirez.programming.kicks-ass.net commit 6467822b8cc96e5feda98c7bf5c6329c6a896c91 Author: Peter Zijlstra Date: Thu Aug 26 09:36:53 2021 +0200 locking/rtmutex: Prevent spurious EDEADLK return caused by ww_mutexes rtmutex based ww_mutexes can legitimately create a cycle in the lock graph which can be observed by a blocker which didn't cause the problem: P1: A, ww_A, ww_B P2: ww_B, ww_A P3: A P3 might therefore be trapped in the ww_mutex induced cycle and run into the lock depth limitation of rt_mutex_adjust_prio_chain() which returns -EDEADLK to the caller. Disable the deadlock detection walk when the chain walk observes a ww_mutex to prevent this looping. [ tglx: Split it apart and added changelog ] Reported-by: Sebastian Siewior Fixes: add461325ec5 ("locking/rtmutex: Extend the rtmutex core to support ww_mutex") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/YSeWjCHoK4v5OcOt@hirez.programming.kicks-ass.net commit 2908f5e101e3fb1d478cff1c556966e1af816641 Author: David Howells Date: Mon Feb 10 10:00:22 2020 +0000 fscache: Add a cookie debug ID and use that in traces Add a cookie debug ID and use that in traces and in procfiles rather than displaying the (hashed) pointer to the cookie. This is easier to correlate and we don't lose anything when interpreting oops output since that shows unhashed addresses and registers that aren't comparable to the hashed values. Changes: ver #2: - Fix the fscache_op tracepoint to handle a NULL cookie pointer. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/158861210988.340223.11688464116498247790.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/159465769844.1376105.14119502774019865432.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/160588459097.3465195.1273313637721852165.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/162431193544.2908479.17556704572948300790.stgit@warthog.procyon.org.uk/ commit 49d6baea798672ae42f73e4662ad792797339ad6 Author: Harman Kalra Date: Thu Aug 26 18:03:40 2021 +0530 octeontx2-af: cn10K: support for sched lmtst and other features Enhancing the mailbox scope to support important configurations like enabling scheduled LMTST, disable LMTLINE prefetch, disable early completion for ordered LMTST, as per request from the application. On FLR these configurations will be reset to default. This patch also adds the 95XXO silicon version to octeontx2 silicon list. Signed-off-by: Harman Kalra Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Signed-off-by: David S. Miller commit 0c1f5f2a5581827fadf493711c4e95528a5730aa Author: Pali Rohár Date: Fri Aug 27 11:27:53 2021 +0200 phy: marvell: phy-mvebu-a3700-comphy: Remove unsupported modes Armada 3700 does not support RXAUI, XFI and neither SFI. Remove unused macros for these unsupported modes. Signed-off-by: Pali Rohár Fixes: 9695375a3f4a ("phy: add A3700 COMPHY support") Signed-off-by: David S. Miller commit b756bbec9cdd83c4702552d30c9fb11d07487000 Author: Pali Rohár Date: Fri Aug 27 11:27:52 2021 +0200 phy: marvell: phy-mvebu-a3700-comphy: Rename HS-SGMMI to 2500Base-X Comphy phy mode 0x3 is incorrectly named. It is not SGMII but rather 2500Base-X mode which runs at 3.125 Gbps speed. Rename macro names and comments to 2500Base-X. Signed-off-by: Pali Rohár Fixes: 9695375a3f4a ("phy: add A3700 COMPHY support") Signed-off-by: David S. Miller commit 3f141ad617458a1dcbd8a473acb7d05fb35ac545 Author: Pali Rohár Date: Fri Aug 27 11:27:51 2021 +0200 phy: marvell: phy-mvebu-cp110-comphy: Rename HS-SGMMI to 2500Base-X Comphy phy mode 0x3 is incorrectly named. It is not SGMII but rather 2500Base-X mode which runs at 3.125 Gbps speed. Rename macro names and comments to 2500Base-X. Signed-off-by: Pali Rohár Fixes: eb6a1fcb53e2 ("phy: mvebu-cp110-comphy: Add SMC call support") Fixes: c2afb2fef595 ("phy: mvebu-cp110-comphy: Rename the macro handling only Ethernet modes") Signed-off-by: David S. Miller commit e31a8cf50292aad57fe2ab817d6ea391a1eefd00 Merge: fe50893aa86eb 0c5c135cdbdac Author: David S. Miller Date: Fri Aug 27 11:20:21 2021 +0100 Merge branch 'hns3-cleanups' Guangbin Huang says: ==================== net: hns3: add some cleanups This series includes some cleanups for the HNS3 ethernet driver. ==================== Signed-off-by: David S. Miller commit 0c5c135cdbdacdf82ca537c433db07e4a1664065 Author: Hao Chen Date: Fri Aug 27 17:28:24 2021 +0800 net: hns3: uniform type of function parameter cmd The parameter cmd in function definition of hns3_dbg_bd_file_init and hns3_dbg_common_file_init is used type u32, this patch uniforms them in function declaration to type u32 too. Signed-off-by: Hao Chen Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 5a24b1fd301e0cf0fc58a76f2716c54d378002cf Author: Peng Li Date: Fri Aug 27 17:28:23 2021 +0800 net: hns3: merge some repetitive macros There are some repetitive macros have same meaning and value, this patch merges them to make code clean. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit d7517f8f6b3b12c883ca0975659450ae009b1524 Author: Peng Li Date: Fri Aug 27 17:28:22 2021 +0800 net: hns3: package new functions to simplify hclgevf_mbx_handler code This patch packages two new function to simplify the function hclgevf_mbx_handler, and it can reduce the code cycle complexity and make code more concise. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 5f22a80f32deed391011f7ab3ce8951ea89282f8 Author: Peng Li Date: Fri Aug 27 17:28:21 2021 +0800 net: hns3: remove redundant param to simplify code The param msg_q is redundant, copy &req->msg to hdev->arq.msg_q[hdev->arq.tail] directly makes code clean. So removes the redundant param msg_q. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 304cd8e776ddca5021dd9c1d7603ea40afc48ec6 Author: Peng Li Date: Fri Aug 27 17:28:20 2021 +0800 net: hns3: use memcpy to simplify code Use memcpy to copy req->msg.resp_data to resp->additional_info, to simplify the code and improve a little efficiency. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 67821a0cf5c97690d7d00b5afe5137ebe29f60fd Author: Peng Li Date: Fri Aug 27 17:28:19 2021 +0800 net: hns3: remove redundant param mbx_event_pending This patch removes the redundant param mbx_event_pending. Signed-off-by: Peng Li Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit c511dfff4b655685d7341962a76d9a340150e0ac Author: Huazhong Tan Date: Fri Aug 27 17:28:18 2021 +0800 net: hns3: add hns3_state_init() to do state initialization To improve the readability and maintainability, add hns3_state_init() to initialize the state, and this new function will be used to add more state initialization in the future. Signed-off-by: Huazhong Tan Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit 4c116f85ecf8c147450602ed47ee25de60807f45 Author: Guangbin Huang Date: Fri Aug 27 17:28:17 2021 +0800 net: hns3: add macros for mac speeds of firmware command To improve code readability, replace digital numbers of mac speeds defined by firmware command with macros. Signed-off-by: Guangbin Huang Signed-off-by: David S. Miller commit fe50893aa86eb9f1c6ccf2ceef274193b6313aad Merge: a550409378d2a 5d8dbb7fb82b8 Author: David S. Miller Date: Fri Aug 27 11:16:29 2021 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2021-08-27 1) Remove an unneeded extra variable in esp4 esp_ssg_unref. From Corey Minyard. 2) Add a configuration option to change the default behaviour to block traffic if there is no matching policy. Joint work with Christian Langrock and Antony Antony. 3) Fix a shift-out-of-bounce bug reported from syzbot. From Pavel Skripkin. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit a550409378d2aea4d2104a551c192e7a65ddd6c0 Merge: 5ab54e5792a44 a2ebfbb7b1817 Author: David S. Miller Date: Fri Aug 27 09:53:31 2021 +0100 Merge tag 'mlx5-updates-2021-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== This patch series contains various fixes, additions and improvements to mlx5 software steering. Patch 1: adds support for REMOVE_HEADER packet reformat - a new reformat type that is supported starting with ConnectX-6 DX, and allows removing an arbitrary size packet segment at a selected position. Patches 2 and 3: add support for VLAN pop on TX and VLAN push on RX flows. Patch 4: enables retransmission mechanism for the SW Steering RC QP. Patch 5: does some improvements to error flow in building STE array and adds a more informative printout of an invalid actions sequence. Patch 6: improves error flow on SW Steering QP error. Patch 7: reduces the log level of a message that is printed when a table is connected to a lower/same level destination table, as this case proves to be not as rare as it was in the past. Patch 8: adds missing support for matching on IPv6 flow label for devices older than ConnectX-6 DX. Patch 9: replaces uintN_t types with kernel-style types. Patch 10: allows for using the right API for updating flow tables - if it is a FW-owned table, then FW API will be used. Patch 11: adds support for 'ignore_flow_level' on multi-destination flow tables that are created by SW Steering. Patch 12: optimizes FDB RX steering rule by skipping matching on source port, as the source port for all incoming packets equals to wire. Patch 13: is a small code refactoring - it merges several DR_STE_SIZE enums into a single enum. Patch 14: does some additional refactoring and removes HW-specific STE type from NIC domain. Patch 15: removes rehash ctrl struct from dr_htbl struct and saves some memory. Patch 16: does a more significant improvement in terms of memory consumption and was able to save about 1.6 Gb for 8M rules. Patch 17: adds support for update FTE, which is needed for cases where there are multiple rules with the same match. ==================== Signed-off-by: David S. Miller commit 5ab54e5792a44dc7431cef0d57755d3c0aa9740b Merge: 3aa7857fe1d7a 9758f40e90f77 Author: David S. Miller Date: Fri Aug 27 09:45:07 2021 +0100 Merge branch 'mptcp-Optimize-received-options-handling' Mat Martineau says: ==================== mptcp: Optimize received options handling These patches optimize received MPTCP option handling in terms of both storage and fewer conditionals to evaluate in common cases, and also add a couple of cleanup patches. Patches 1 and 5 do some cleanup in checksum option parsing and clarification of lock handling. Patches 2 and 3 rearrange struct mptcp_options_received to shrink it slightly and consolidate frequently used fields in the same cache line. Patch 4 optimizes incoming MPTCP option parsing to skip many extra comparisons in the common case where only a DSS option is present. ==================== Signed-off-by: David S. Miller commit 9758f40e90f77e457dd4edef1ca506006d7f471a Author: Paolo Abeni Date: Thu Aug 26 17:44:54 2021 -0700 mptcp: make the locking tx schema more readable Florian noted the locking schema used by __mptcp_push_pending() is hard to follow, let's add some more descriptive comments and drop an unneeded and confusing check. Suggested-by: Florian Westphal Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit f6c2ef59bcc7e1fbe4ea6f9de7f6e0df178d5882 Author: Paolo Abeni Date: Thu Aug 26 17:44:53 2021 -0700 mptcp: optimize the input options processing Most MPTCP packets carries a single MPTCP subption: the DSS containing the mapping for the current packet. Check explicitly for the above, so that is such scenario we replace most conditional statements with a single likely() one. Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 74c7dfbee3e185b3c3a03f194e25689ed037fa3c Author: Paolo Abeni Date: Thu Aug 26 17:44:52 2021 -0700 mptcp: consolidate in_opt sub-options fields in a bitmask This makes input options processing more consistent with output ones and will simplify the next patch. Also avoid clearing the suboption field after processing it, since it's not needed. Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit a086aebae0ebe37e93ed8f6e686ca0d5c4375b44 Author: Paolo Abeni Date: Thu Aug 26 17:44:51 2021 -0700 mptcp: better binary layout for mptcp_options_received This change reorder the mptcp_options_received fields to shrink the structure a bit and to ensure the most frequently used fields are all in the first cacheline. Sub-opt specific flags are moved out of the suboptions area, and we must now explicitly set them when the relevant suboption is parsed. There is a notable exception: 'csum_reqd' is used by both DSS and MPC suboptions, and keeping such field in the suboptions flag area will simplfy the next patch. Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 8d548ea1dd157a40ff5882224795a82a5b9abfe6 Author: Paolo Abeni Date: Thu Aug 26 17:44:50 2021 -0700 mptcp: do not set unconditionally csum_reqd on incoming opt Should be set only if the ingress packets present it, otherwise we can confuse csum validation. Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 5fe2a6b4344cbb2120d6d81e371b7ec8e75f03e2 Merge: d0efb16294d14 6cc64770fb386 Author: David S. Miller Date: Fri Aug 27 09:42:21 2021 +0100 Merge tag 'mlx5-fixes-2021-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2021-08-26 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. ==================== Signed-off-by: David S. Miller commit 049d1693db78144c979b34e2084287ada912cf7f Author: Daniel Vetter Date: Thu Aug 26 11:13:43 2021 +0200 MAINTAINERS: Add dri-devel for component.[hc] dri-devel is the main user, and somehow there's been the assumption that component stuff is unmaintained. Cc: Ezequiel Garcia Cc: "Rafael J. Wysocki" Signed-off-by: Daniel Vetter References: https://lore.kernel.org/dri-devel/CAAEAJfDWOzCJxZFNtxeT7Cvr2pWbYrfz-YnA81sVNs-rM=8n4Q@mail.gmail.com/ Link: https://lore.kernel.org/r/20210826091343.1039763-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman commit d0efb16294d145d157432feda83877ae9d7cdf37 Author: Peter Collingbourne Date: Thu Aug 26 12:46:01 2021 -0700 net: don't unconditionally copy_from_user a struct ifreq for socket ioctls A common implementation of isatty(3) involves calling a ioctl passing a dummy struct argument and checking whether the syscall failed -- bionic and glibc use TCGETS (passing a struct termios), and musl uses TIOCGWINSZ (passing a struct winsize). If the FD is a socket, we will copy sizeof(struct ifreq) bytes of data from the argument and return -EFAULT if that fails. The result is that the isatty implementations may return a non-POSIX-compliant value in errno in the case where part of the dummy struct argument is inaccessible, as both struct termios and struct winsize are smaller than struct ifreq (at least on arm64). Although there is usually enough stack space following the argument on the stack that this did not present a practical problem up to now, with MTE stack instrumentation it's more likely for the copy to fail, as the memory following the struct may have a different tag. Fix the problem by adding an early check for whether the ioctl is a valid socket ioctl, and return -ENOTTY if it isn't. Fixes: 44c02a2c3dc5 ("dev_ioctl(): move copyin/copyout to callers") Link: https://linux-review.googlesource.com/id/I869da6cf6daabc3e4b7b82ac979683ba05e27d4d Signed-off-by: Peter Collingbourne Cc: # 4.19 Signed-off-by: David S. Miller commit 7990b535d2987201187d750f809ed17b502eb608 Author: Jing Yangyang Date: Tue Aug 24 23:15:31 2021 -0700 staging: r8188eu: remove unneeded variable Eliminate the following coccicheck warning: ./drivers/staging/r8188eu/os_dep/os_intfs.c:505:6-12: Unneeded variable "status". Return "_SUCCESS" on line 577 ./drivers/staging/r8188eu/os_dep/os_intfs.c:772: 4-7: Unneeded variable "ret". Return "_SUCCESS" on line 818 ./drivers/staging/r8188eu/os_dep/os_intfs.c:823:4-8: Unneeded variable "ret8". Return "_SUCCESS" on line 849 Reported-by: Zeal Robot Signed-off-by: Jing Yangyang Link: https://lore.kernel.org/r/20210825061531.69678-1-deng.changcheng@zte.com.cn Signed-off-by: Greg Kroah-Hartman commit 62dbd849e03ce2cb2fb605ed7a6ca93b42cc99f4 Author: Jing Yangyang Date: Mon Aug 23 23:34:43 2021 -0700 staging: r8188eu: remove unneeded conversions to bool Found with scripts/coccinelle/misc/boolconv.cocci. Reported-by: Zeal Robot Reviewed-by: Pavel Skripkin Acked-by: Michael Straube Acked-by: Phillip Potter Signed-off-by: Jing Yangyang Link: https://lore.kernel.org/r/20210824063443.59724-1-deng.changcheng@zte.com.cn Signed-off-by: Greg Kroah-Hartman commit 6ae51ffe5e768d9e25a7f4298e2e7a058472bcc3 Author: Lukas Bulwahn Date: Sun Aug 22 12:31:07 2021 +0200 crypto: sha512 - remove imaginary and mystifying clearing of variables The function sha512_transform() assigns all local variables to 0 before returning to its caller with the intent to erase sensitive data. However, make clang-analyzer warns that all these assignments are dead stores, and as commit 7a4295f6c9d5 ("crypto: lib/sha256 - Don't clear temporary variables") already points out for sha256_transform(): The assignments to clear a through h and t1/t2 are optimized out by the compiler because they are unused after the assignments. Clearing individual scalar variables is unlikely to be useful, as they may have been assigned to registers, and even if stack spilling was required, there may be compiler-generated temporaries that are impossible to clear in any case. This applies here again as well. Drop meaningless clearing of local variables and avoid this way that the code suggests that data is erased, which simply does not happen. Signed-off-by: Lukas Bulwahn Reviewed-by: Nick Desaulniers Signed-off-by: Herbert Xu commit 72ff2bf04db2a48840df93a461b7115900f46c05 Author: Shreyansh Chouhan Date: Sun Aug 22 09:15:14 2021 +0530 crypto: aesni - xts_crypt() return if walk.nbytes is 0 xts_crypt() code doesn't call kernel_fpu_end() after calling kernel_fpu_begin() if walk.nbytes is 0. The correct behavior should be not calling kernel_fpu_begin() if walk.nbytes is 0. Reported-by: syzbot+20191dc583eff8602d2d@syzkaller.appspotmail.com Signed-off-by: Shreyansh Chouhan Signed-off-by: Herbert Xu commit cedcf527d59bcca5f87f52ea34a157bbc6e7a3a8 Author: Cai Huoqing Date: Sun Aug 22 10:27:34 2021 +0800 padata: Remove repeated verbose license text remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing Acked-by: Daniel Jordan Signed-off-by: Herbert Xu commit 3438de03e98ad305129bdd033cb63e46debd67f4 Author: John Allen Date: Fri Aug 20 14:56:21 2021 +0000 crypto: ccp - Add support for new CCP/PSP device ID Add a new CCP/PSP PCI device ID and corresponding entry in the dev_vdata struct. Signed-off-by: John Allen Signed-off-by: Herbert Xu commit 5b2efa2bb865eb784e06987c7ce98c3c835b495b Author: Tianjia Zhang Date: Wed Aug 18 11:31:17 2021 +0800 crypto: x86/sm4 - add AES-NI/AVX2/x86_64 implementation Like the implementation of AESNI/AVX, this patch adds an accelerated implementation of AESNI/AVX2. In terms of code implementation, by reusing AESNI/AVX mode-related codes, the amount of code is greatly reduced. From the benchmark data, it can be seen that when the block size is 1024, compared to AVX acceleration, the performance achieved by AVX2 has increased by about 70%, it is also 7.7 times of the pure software implementation of sm4-generic. The main algorithm implementation comes from SM4 AES-NI work by libgcrypt and Markku-Juhani O. Saarinen at: https://github.com/mjosaarinen/sm4ni This optimization supports the four modes of SM4, ECB, CBC, CFB, and CTR. Since CBC and CFB do not support multiple block parallel encryption, the optimization effect is not obvious. Benchmark on Intel i5-6200U 2.30GHz, performance data of three implementation methods, pure software sm4-generic, aesni/avx acceleration, and aesni/avx2 acceleration, the data comes from the 218 mode and 518 mode of tcrypt. The abscissas are blocks of different lengths. The data is tabulated and the unit is Mb/s: block-size | 16 64 128 256 1024 1420 4096 sm4-generic ECB enc | 60.94 70.41 72.27 73.02 73.87 73.58 73.59 ECB dec | 61.87 70.53 72.15 73.09 73.89 73.92 73.86 CBC enc | 56.71 66.31 68.05 69.84 70.02 70.12 70.24 CBC dec | 54.54 65.91 68.22 69.51 70.63 70.79 70.82 CFB enc | 57.21 67.24 69.10 70.25 70.73 70.52 71.42 CFB dec | 57.22 64.74 66.31 67.24 67.40 67.64 67.58 CTR enc | 59.47 68.64 69.91 71.02 71.86 71.61 71.95 CTR dec | 59.94 68.77 69.95 71.00 71.84 71.55 71.95 sm4-aesni-avx ECB enc | 44.95 177.35 292.06 316.98 339.48 322.27 330.59 ECB dec | 45.28 178.66 292.31 317.52 339.59 322.52 331.16 CBC enc | 57.75 67.68 69.72 70.60 71.48 71.63 71.74 CBC dec | 44.32 176.83 284.32 307.24 328.61 312.61 325.82 CFB enc | 57.81 67.64 69.63 70.55 71.40 71.35 71.70 CFB dec | 43.14 167.78 282.03 307.20 328.35 318.24 325.95 CTR enc | 42.35 163.32 279.11 302.93 320.86 310.56 317.93 CTR dec | 42.39 162.81 278.49 302.37 321.11 310.33 318.37 sm4-aesni-avx2 ECB enc | 45.19 177.41 292.42 316.12 339.90 322.53 330.54 ECB dec | 44.83 178.90 291.45 317.31 339.85 322.55 331.07 CBC enc | 57.66 67.62 69.73 70.55 71.58 71.66 71.77 CBC dec | 44.34 176.86 286.10 501.68 559.58 483.87 527.46 CFB enc | 57.43 67.60 69.61 70.52 71.43 71.28 71.65 CFB dec | 43.12 167.75 268.09 499.33 558.35 490.36 524.73 CTR enc | 42.42 163.39 256.17 493.95 552.45 481.58 517.19 CTR dec | 42.49 163.11 256.36 493.34 552.62 481.49 516.83 Signed-off-by: Tianjia Zhang Signed-off-by: Herbert Xu commit de79d9aae493a29d02926f396a4fd1a1309436fc Author: Tianjia Zhang Date: Wed Aug 18 11:31:16 2021 +0800 crypto: x86/sm4 - export reusable AESNI/AVX functions Export the reusable functions in the SM4 AESNI/AVX implementation, mainly public functions, which are used to develop the SM4 AESNI/AVX2 implementation, and eliminate unnecessary duplication of code. At the same time, in order to make the public function universal, minor fixes was added. Signed-off-by: Tianjia Zhang Signed-off-by: Herbert Xu commit ff1469a21df5a2e981dd2f78e96e412fecb3ba59 Author: Lukas Bulwahn Date: Mon Aug 16 14:44:33 2021 +0200 crypto: rmd320 - remove rmd320 in Makefile Commit 93f64202926f ("crypto: rmd320 - remove RIPE-MD 320 hash algorithm") removes the Kconfig and code, but misses to adjust the Makefile. Hence, ./scripts/checkkconfigsymbols.py warns: CRYPTO_RMD320 Referencing files: crypto/Makefile Remove the missing piece of this code removal. Fixes: 93f64202926f ("crypto: rmd320 - remove RIPE-MD 320 hash algorithm") Signed-off-by: Lukas Bulwahn Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit f73800a905a8a9c35b989e8de9ce5cdf328c2b63 Author: Colin Ian King Date: Thu Aug 26 13:39:59 2021 +0100 usb: typec: tcpm: Fix spelling mistake "atleast" -> "at least" There are spelling mistakes in a comment and a literal string. Fix them. Reviewed-by: Guenter Roeck Acked-by: Heikki Krogerus Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210826123959.14838-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit a76cb3d999b12219620d41a186ec2af2b247ac71 Author: Colin Ian King Date: Thu Aug 26 15:38:49 2021 +0100 usb: dwc2: Fix spelling mistake "was't" -> "wasn't" There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210826143849.55115-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit cc7f8825cdbb05fa10782a34732f5d8082daa5c3 Author: Colin Ian King Date: Thu Aug 26 13:26:58 2021 +0100 usb: renesas_usbhs: Fix spelling mistake "faile" -> "failed" There is a spelling mistake in a dev_err error message. Fix it. Reviewed-by: Yoshihiro Shimoda Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210826122658.13914-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman commit 57f3ffdc11143f56f1314972fe86fe17a0dcde85 Author: Yoshihiro Shimoda Date: Fri Aug 27 15:32:27 2021 +0900 usb: host: xhci-rcar: Don't reload firmware after the completion According to the datasheet, "Upon the completion of FW Download, there is no need to write or reload FW.". Otherwise, it's possible to cause unexpected behaviors. So, adds such a condition. Fixes: 4ac8918f3a73 ("usb: host: xhci-plat: add support for the R-Car H2 and M2 xHCI controllers") Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20210827063227.81990-1-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Greg Kroah-Hartman commit b7d509a92bb0216b01f428166be3770d04bbdd87 Author: Chunfeng Yun Date: Fri Aug 27 11:31:05 2021 +0800 usb: xhci-mtk: allow bandwidth table rollover xhci-mtk has 64 slots for periodic bandwidth calculations and each slot represents byte budgets on a microframe. When an endpoint's allocation sits on the boundary of the table, byte budgets' slot can be rolled over but the current implementation doesn't. This patch allows the microframe index rollover and prevent out-of-bounds array access. Signed-off-by: Ikjoon Jang Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210827033105.26595-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 452d1ea55c3e621dc94ac8b832c5e00feb59aad4 Merge: d98a30ccdc839 e5d6a7c6cfae9 Author: Greg Kroah-Hartman Date: Fri Aug 27 10:09:26 2021 +0200 Merge tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-next Peter writes: Only one patch for improving port index calculation for chipidea driver, no big changes. * tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: chipidea: host: fix port index underflow and UBSAN complains commit c24a19674258dcc968a198d8e0d4717c8f27700c Author: Chen Wandun Date: Tue Aug 10 21:51:05 2021 +0800 riscv: add support for hugepage migration Generic arch_hugetlb_migration_supported can provide appropriate support for hugepage migration when enable ARCH_ENABLE_HUGEPAGE_MIGRATION, so enable it for hugepage migration in riscv. Signed-off-by: Chen Wandun Signed-off-by: Palmer Dabbelt commit 3aa7857fe1d7ac7f600f5b7e1530396fb06822bf Author: Neil Spring Date: Wed Aug 25 14:01:17 2021 -0700 tcp: enable mid stream window clamp The TCP_WINDOW_CLAMP socket option is defined in tcp(7) to "Bound the size of the advertised window to this value." Window clamping is distributed across two variables, window_clamp ("Maximal window to advertise" in tcp.h) and rcv_ssthresh ("Current window clamp"). This patch updates the function where the window clamp is set to also reduce the current window clamp, rcv_sshthresh, if needed. With this, setting the TCP_WINDOW_CLAMP option has the documented effect of limiting the window. Signed-off-by: Neil Spring Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20210825210117.1668371-1-ntspring@fb.com Signed-off-by: Jakub Kicinski commit 97c78d0af55fff206947a5f2b85b690b5acf28ce Merge: deecae7d96843 73367f05b25db Author: Jakub Kicinski Date: Thu Aug 26 13:45:47 2021 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net drivers/net/wwan/mhi_wwan_mbim.c - drop the extra arg. Signed-off-by: Jakub Kicinski commit bdd3c50d83bf7f6acc869b48d02670d19030ae03 Author: Christoph Hellwig Date: Thu Aug 26 15:55:10 2021 +0200 dax: remove bdev_dax_supported All callers already have a dax_device obtained from fs_dax_get_by_bdev at hand, so just pass that to dax_supported() insted of doing another lookup. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-10-hch@lst.de Signed-off-by: Dan Williams commit a384f088e4a102b97a59bc0fdaf8b60bca177679 Author: Christoph Hellwig Date: Thu Aug 26 15:55:09 2021 +0200 xfs: factor out a xfs_buftarg_is_dax helper Refactor the DAX setup code in preparation of removing bdev_dax_supported. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20210826135510.6293-9-hch@lst.de Signed-off-by: Dan Williams commit 60b8340f0d6587d7b51990689fcdae567f309fbf Author: Christoph Hellwig Date: Thu Aug 26 15:55:08 2021 +0200 dax: stub out dax_supported for !CONFIG_FS_DAX dax_supported calls into ->dax_supported which checks for fsdax support. Don't bother building it for !CONFIG_FS_DAX as it will always return false. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-8-hch@lst.de Signed-off-by: Dan Williams commit cd93a2a4d1b076f5c73d70d836c202bbcbeea49e Author: Christoph Hellwig Date: Thu Aug 26 15:55:07 2021 +0200 dax: remove __generic_fsdax_supported Just implement generic_fsdax_supported directly out of line instead of adding a wrapper. Given that generic_fsdax_supported is only supplied for CONFIG_FS_DAX builds this also allows to not provide it at all for !CONFIG_FS_DAX builds. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-7-hch@lst.de Signed-off-by: Dan Williams commit 673a0658f6ac359131a881c0dcf1b91c2500ab9c Author: Christoph Hellwig Date: Thu Aug 26 15:55:06 2021 +0200 dax: move the dax_read_lock() locking into dax_supported Move the dax_read_lock/dax_read_unlock pair from the callers into dax_supported to make it a little easier to use. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-6-hch@lst.de Signed-off-by: Dan Williams commit 1b7646014e0d838b06be7288e2dec3262948cc56 Author: Christoph Hellwig Date: Thu Aug 26 15:55:05 2021 +0200 dax: mark dax_get_by_host static And move the code around a bit to avoid a forward declaration. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-5-hch@lst.de Signed-off-by: Dan Williams commit dfa584f6f91586dbf7bb9f35f8bbdc06590cde1f Author: Christoph Hellwig Date: Thu Aug 26 15:55:04 2021 +0200 dm: use fs_dax_get_by_bdev instead of dax_get_by_host There is no point in trying to finding the dax device if the DAX flag is not set on the queue as none of the users of the device mapper exported block devices could make use of the DAX capability. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Reviewed-by: Mike Snitzer Link: https://lore.kernel.org/r/20210826135510.6293-4-hch@lst.de Signed-off-by: Dan Williams commit 39b6389a7fdc0457d980a3ea1e77ca457402f477 Author: Christoph Hellwig Date: Thu Aug 26 15:55:03 2021 +0200 dax: stop using bdevname Just use the %pg format specifier instead. Signed-off-by: Christoph Hellwig Reviewed-by: Dan Williams Link: https://lore.kernel.org/r/20210826135510.6293-3-hch@lst.de Signed-off-by: Dan Williams commit 6c97ec172a1c058a66e7c79308a0d7f11753865d Author: Christoph Hellwig Date: Thu Aug 26 15:55:02 2021 +0200 fsdax: improve the FS_DAX Kconfig description and help text Rename the main option text to clarify it is for file system access, and add a bit of text that explains how to actually switch a nvdimm to a fsdax capable state. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210826135510.6293-2-hch@lst.de Signed-off-by: Dan Williams commit d21918e5a94a862ccb297b9f2be38574c865fda0 Author: Eric W. Biederman Date: Wed Jun 23 16:51:49 2021 -0500 signal/seccomp: Dump core when there is only one live thread Replace get_nr_threads with atomic_read(¤t->signal->live) as that is a more accurate number that is decremented sooner. Acked-by: Kees Cook Link: https://lkml.kernel.org/r/87lf6z6qbd.fsf_-_@disp2133 Signed-off-by: "Eric W. Biederman" commit a2ebfbb7b181774570224faee570f717ae11b6d8 Author: Yevgeny Kliteynik Date: Thu Jul 8 16:58:39 2021 +0300 net/mlx5: DR, Add support for update FTE Add the support for update FTE, which is needed for cases where there are multiple rules with the same match. In such case fs_core will merge the actions and call update FTE to update current FTE. Since we don't want to disrupt the traffic, we will add the new duplicate rule, and only then remove the old duplicate rule. Signed-off-by: Alex Vesker Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 8a015baef50a7b60c866a58ae2dc0406958061d9 Author: Yevgeny Kliteynik Date: Thu Jul 8 16:51:29 2021 +0300 net/mlx5: DR, Improve rule tracking memory consumption To track each STE of the rule a rule member was allocated, each member would point to one STE. This means that we would allocate 40B (rule member) * number of STEs per rule. To reduce this per rule allocation we use the STE tree pointers for next_htbl and pointing STE to navigate the tree, this allows us to keep only the pointer to the last STE of rule (always unique). From the last rule STE we are able to traverse and rebuild all of the STEs that construct the rule. In our testing with 8M rules, each consisting of 7 STES, we were able to reduce 1.6GB of memory. Signed-off-by: Alex Vesker Signed-off-by: Erez Shitrit Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 32c8e3b23020e4815480a169d4b144d2976fcb06 Author: Yevgeny Kliteynik Date: Sun Jul 4 20:54:26 2021 +0300 net/mlx5: DR, Remove rehash ctrl struct from dr_htbl The calculations to decide for the maximum allowed collision threshold are simple and there is no reason to save them on the htbl struct. Signed-off-by: Erez Shitrit Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 46f2a8ae8a7008f845b537ba800faf0f1f1f86e7 Author: Yevgeny Kliteynik Date: Sun Jul 4 20:43:10 2021 +0300 net/mlx5: DR, Remove HW specific STE type from nic domain Instead of using the HW specific STEv0 type, it is better to use an enum to indicate if this is an RX or TX nic domain. This means that now we will need to convert the nic domain type to the corresponding STE type. Signed-off-by: Alex Vesker Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit ab9d1f96120b4a6269befa80c446a51afdc32963 Author: Yevgeny Kliteynik Date: Sun Jul 4 18:01:54 2021 +0300 net/mlx5: DR, Merge DR_STE_SIZE enums Merge DR_STE_SIZE enums - no need for a separate enum for reduced STE size. Signed-off-by: Alex Vesker Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 990467f8afde8c85215f6f4ab439b9615fd151e7 Author: Yevgeny Kliteynik Date: Sun Jul 4 17:48:24 2021 +0300 net/mlx5: DR, Skip source port matching on FDB RX domain The FDB RX pipe is connected to the wire and the source port for all incoming packets equals to wire, single uplink port per PF, this means there is no point of matching on the source port in such case. Once we recognize such case, we will optimize the RX steering rule. Note that in such case we clean both source_eswitch_owner_vhca_id and source_port. Signed-off-by: Alex Vesker Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 63b85f49c05af3cc2dea6c4e0cfbac3786b3c638 Author: Yevgeny Kliteynik Date: Sun Jul 4 17:42:04 2021 +0300 net/mlx5: DR, Add ignore_flow_level support for multi-dest flow tables When creating an FTE, we might need to create multi-destination flow table, which is eventually created by FW. In such case, this FW table should include all the FTE properties as requested by the upper layer, including the ability to point to another flow table with level lower or equal to the current table - indicated by the "ignore_flow_level" property. Signed-off-by: Chris Mi Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit a01a43fa16e1d9e6810246e38aeb80c3dd645956 Author: Yevgeny Kliteynik Date: Sun Jul 4 17:29:01 2021 +0300 net/mlx5: DR, Use FW API when updating FW-owned flow table Need to call the DR API only when it is DR table. To update FW-owned table the driver should call the FW API. Signed-off-by: Erez Shitrit Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit ae3eddcff7aa6c162a425e1a772f4f6f2eeade01 Author: Yevgeny Kliteynik Date: Sun Jul 4 17:25:11 2021 +0300 net/mlx5: DR, replace uintN_t with kernel-style types Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 0733535d59e1541c69ad43c029b6efb89622f919 Author: Yevgeny Kliteynik Date: Sun Jul 4 17:17:33 2021 +0300 net/mlx5: DR, Support IPv6 matching on flow label for STEv0 Add missing support for matching on IPv6 flow label for STEv0. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit d7d0b2450e93acd8c05b9f7abae7d8b31663a0e5 Author: Bodong Wang Date: Wed Aug 26 10:59:54 2020 -0500 net/mlx5: DR, Reduce print level for FT chaining level check There are usecases with Connection Tracking that have such connection as default, printing this warning in dmesg confuses the user. Signed-off-by: Bodong Wang Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit d5a84e968f3dc6d9d95ed6bfd8a9be5228e13be9 Author: Yevgeny Kliteynik Date: Sun Jul 4 11:57:38 2021 +0300 net/mlx5: DR, Warn and ignore SW steering rule insertion on QP err In the event of SW steering QP entering error state, SW steering cannot insert more rules, and will silently ignore the insertion after issuing a warning. Signed-off-by: Yuval Avnery Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit f35715a6574707ecfeac795d451fccd751e614b5 Author: Yevgeny Kliteynik Date: Thu Sep 24 20:58:44 2020 +0300 net/mlx5: DR, Improve error flow in actions_build_ste_arr Improve error flow and print actions sequence when an invalid/unsupported sequence provided. Signed-off-by: Erez Shitrit Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit ec449ed8230cd30769de3cb70ee0fce293047372 Author: Yevgeny Kliteynik Date: Thu Sep 24 20:58:50 2020 +0300 net/mlx5: DR, Enable QP retransmission Under high stress, SW steering might get stuck on polling for completion that never comes. For such cases QP needs to have protocol retransmission mechanism enabled. Currently the retransmission timeout is defined as 0 (unlimited). Fix this by defining a real timeout. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 2de40f68cf76510c790663101b670868ba5ef9cf Author: Yevgeny Kliteynik Date: Sun Jun 27 23:05:28 2021 +0300 net/mlx5: DR, Enable VLAN pop on TX and VLAN push on RX Enable pop VLAN action in TX and push VLAN in RX. These actions are supported only on STEv1. On TX: when a host sends a packet, VLAN is popped at the beginning. On RX: just before passing the packet to the host the VLAN is pushed. Signed-off-by: Muhammad Sammar Signed-off-by: Alex Vesker Signed-off-by: Yishai Hadas Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit f5e22be534e094f0ea3a4e9fb1223b3de1ed8107 Author: Yevgeny Kliteynik Date: Sun Jun 27 15:01:12 2021 +0300 net/mlx5: DR, Split modify VLAN state to separate pop/push states Split modify vlan state in the actions state machine to pop vlan and push vlan states. This enables using of pop/push vlan without restrictions (e.g. pop vlan on TX in STEv1). Signed-off-by: Muhammad Sammar Signed-off-by: Alex Vesker Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 0139145fb8d8988f9c464b83cdd0c3f44038f7b3 Author: Yevgeny Kliteynik Date: Thu Apr 22 11:32:56 2021 +0300 net/mlx5: DR, Added support for REMOVE_HEADER packet reformat ConnectX supports offloading of various encapsulations and decapsulations (e.g. VXLAN), which are performed by 'Packet Reformat' action. Starting with ConnectX-6 DX, a new reformat type is supported - REMOVE_HEADER, which allows deleting an arbitrary size chunk at the selected position in the packet. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit 6cc64770fb386b10a64a1fe09328396de7bb5262 Author: Wentao_Liang Date: Thu Aug 19 22:30:05 2021 +0800 net/mlx5: DR, fix a potential use-after-free bug In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to cur_htbl and may cause cur_htbl to be freed. However, cur_htbl is subsequently used in the next line, which may result in an use-after-free bug. Fix this by calling mlx5dr_err() before the cur_htbl is put. Signed-off-by: Wentao_Liang Signed-off-by: Saeed Mahameed commit f9d196bd632b8b79261ec3366c30ec3923ea9a02 Author: Dmytro Linkin Date: Thu Jun 24 13:37:36 2021 +0300 net/mlx5e: Use correct eswitch for stack devices with lag If link aggregation is used within stack devices driver rejects encap rules if PF of the VF tunnel device is down. This happens because route resolved for other PF and its eswitch instance is used to determine correct vport. To fix that use devcom feature to retrieve other eswitch instance if failed to find vport for the 1st eswitch and LAG is active. Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") Signed-off-by: Dmytro Linkin Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit ca6891f9b27db7764bba0798202b0a21d0dc909c Author: Maor Dickman Date: Thu Aug 12 14:30:39 2021 +0300 net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group When indirect forward group is created, flow is added with vhca id but without setting vhca id valid flag which violates the PRM. Fix by setting the missing flag, vhca id valid. Fixes: 34ca65352ddf ("net/mlx5: E-Switch, Indirect table infrastructure") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 9a5f9cc794e17cf6ed2a5bb215d2e8b6832db444 Author: Roi Dayan Date: Sun Aug 22 10:14:58 2021 +0300 net/mlx5e: Fix possible use-after-free deleting fdb rule After neigh-update-add failure we are still with a slow path rule but the driver always assume the rule is an fdb rule. Fix neigh-update-del by checking slow path tc flag on the flow. Also fix neigh-update-add for when neigh-update-del fails the same. Fixes: 5dbe906ff1d5 ("net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available") Signed-off-by: Roi Dayan Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 8e7e2e8ed0e251138926838b7933f8eb6dd56b12 Author: Leon Romanovsky Date: Sat Aug 21 15:05:11 2021 +0300 net/mlx5: Remove all auxiliary devices at the unregister event The call to mlx5_unregister_device() means that mlx5_core driver is removed. In such scenario, we need to disregard all other flags like attach/detach and forcibly remove all auxiliary devices. Fixes: a5ae8fc9058e ("net/mlx5e: Don't create devices during unload flow") Tested-and-Reported-by: Yicong Yang Signed-off-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit 2f8b6161cca5fb34b0065e2eac8bb2b61b7bfe87 Author: Dima Chumak Date: Wed Jun 30 14:56:32 2021 +0300 net/mlx5: Lag, fix multipath lag activation When handling FIB_EVENT_ENTRY_REPLACE event for a new multipath route, lag activation can be missed if a stale (struct lag_mp)->mfi pointer exists, which was associated with an older multipath route that had been removed. Normally, when a route is removed, it triggers mlx5_lag_fib_event(), which handles FIB_EVENT_ENTRY_DEL and clears mfi pointer. But, if mlx5_lag_check_prereq() condition isn't met, for example when eswitch is in legacy mode, the fib event is skipped and mfi pointer becomes stale. Fix by resetting mfi pointer to NULL in mlx5_deactivate_lag(). Fixes: 8a66e4585979 ("net/mlx5: Change ownership model for lag") Signed-off-by: Dima Chumak Reviewed-by: Roi Dayan Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 7ce05074b93c7f130c48e04defa63d157adeb143 Author: Colin Ian King Date: Thu Aug 26 13:14:45 2021 +0100 selftests: safesetid: Fix spelling mistake "cant" -> "can't" There is a spelling mistake in an error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan commit 56809a28d45fcad94b28cfd614600568c0d46545 Author: Vineet Gupta Date: Tue Oct 13 19:44:07 2020 -0700 ARC: mm: vmalloc sync from kernel to user table to update PMD ... ... not PGD vmalloc() sets up the kernel page table (starting from @swapper_pg_dir). But when vmalloc area is accessed in context of a user task, say opening terminal in n_tty_open(), the user page tables need to be synced from kernel page tables so that TLB entry is created in "user context". The old code was doing this incorrectly, as it was updating the user pgd entry (first level itself) to point to kernel pud table (2nd level), effectively yanking away the entire user space translation with kernel one. The correct way to do this is to ONLY update a user space pgd/pud/pmd entry if it is not popluated already. This ensures that only the missing leaf pmd entry gets updated to point to relevant kernel pte table. From code change pov, we are chaging the pattern: p4d = p4d_offset(pgd, address); p4d_k = p4d_offset(pgd_k, address); if (!p4d_present(*p4d_k)) goto bad_area; set_p4d(p4d, *p4d_k); with p4d = p4d_offset(pgd, address); p4d_k = p4d_offset(pgd_k, address); if (p4d_none(*p4d_k)) goto bad_area; if (!p4d_present(*p4d)) set_p4d(p4d, *p4d_k); Signed-off-by: Vineet Gupta commit 8747ff704ac886f6ef992b1b7eadcf77d151fd3a Author: Vineet Gupta Date: Thu Oct 1 15:46:42 2020 -0700 ARC: mm: support 4 levels of page tables Acked-by: Mike Rapoport Signed-off-by: Vineet Gupta commit 2dde02ab6d1a725ddccc7144ff6bf5f55d37f916 Author: Vineet Gupta Date: Wed Sep 30 18:58:50 2020 -0700 ARC: mm: support 3 levels of page tables ARCv2 MMU is software walked and Linux implements 2 levels of paging: pgd/pte. Forthcoming hw will have multiple levels, so this change preps mm code for same. It is also fun to try multi levels even on soft-walked code to ensure generic mm code is robust to handle. overview ________ 2 levels {pgd, pte} : pmd is folded but pmd_* macros are valid and operate on pgd 3 levels {pgd, pmd, pte}: - pud is folded and pud_* macros point to pgd - pmd_* macros operate on actual pmd code changes ____________ 1. #include 2. Define CONFIG_PGTABLE_LEVELS 3 3a. Define PMD_SHIFT, PMD_SIZE, PMD_MASK, pmd_t 3b. Define pmd_val() which actually deals with pmd (pmd_offset(), pmd_index() are provided by generic code) 3c. pmd_alloc_one()/pmd_free() also provided by generic code (pmd_populate/pmd_free already exist) 4. Define pud_none(), pud_bad() macros based on generic pud_val() which internally pertains to pgd now. 4b. define pud_populate() to just setup pgd Acked-by: Mike Rapoport Signed-off-by: Vineet Gupta commit 9f3c76aedcbfee61dcdf299e708888141c7132fd Author: Vineet Gupta Date: Thu Aug 12 14:31:36 2021 -0700 ARC: mm: switch to asm-generic/pgalloc.h With previous patch ARC pgalloc functions are same as generic, hence switch to that. Suggested-by: Mike Rapoport Acked-by: Mike Rapoport Signed-off-by: Vineet Gupta commit d9820ff76f95fa26d33e412254a89cd65b23142d Author: Vineet Gupta Date: Thu Aug 12 12:54:43 2021 -0700 ARC: mm: switch pgtable_t back to struct page * So far ARC pgtable_t has not been struct page based to avoid extra page_address() calls involved. However the differences are down to noise and get in the way of using generic code, hence this patch. This also allows us to reuse generic THP depost/withdraw code. There's some additional consideration for PGDIR_SHIFT in 4K page config. Now due to page tables being PAGE_SIZE deep only, the address split can't be really arbitrary. Tested-by: kernel test robot Suggested-by: Mike Rapoport Acked-by: Mike Rapoport Signed-off-by: Vineet Gupta commit e257d969f36503b8eb1240f32653a1afb3109f86 Author: Johannes Berg Date: Thu Aug 26 22:47:43 2021 +0300 iwlwifi: mvm: don't use FW key ID in beacon protection To check beacon protection had a mismatch of the key ID we currently use the key ID from the firmware, but firmware side we want to clean up the API to stop reporting this. Instead, check the IWL_RX_MPDU_STATUS_KEY_VALID bit that indicates that the firmware used the correct key, and if that's set but we get invalid MIC/replay use the key ID from the frame to look up the key and notify mac80211 of MIC error or replay. Since both keys must have the same cipher and thus MIC length, we can use either of them to look up the MIC length. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.30e665d39b07.I78bf7d304ef5a80cecf5fa1c1fca0b51b956cceb@changeid Signed-off-by: Luca Coelho commit 090f1be3abf3069ef856b29761f181808bf55917 Author: Ilan Peer Date: Thu Aug 26 22:47:42 2021 +0300 iwlwifi: mvm: Fix scan channel flags settings The iwl_mvm_scan_ch_n_aps_flag() is called with a variable before the value of the variable is set. Fix it. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.f6f188980a5e.Ie7331a8b94004d308f6cbde44e519155a5be91dd@changeid Signed-off-by: Luca Coelho commit cde5dbaa35edbf4467cd6ac5b3588861257685a1 Author: Shaul Triebitz Date: Thu Aug 26 22:47:41 2021 +0300 iwlwifi: mvm: support broadcast TWT alone Tell the firmware about broadcast TWT support even if individual TWT is not supported. In that case the firmware will negotiate only a broadcast TWT session. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.556934ed023a.I843677252be64f4732e434ab9ef72f487625e49e@changeid Signed-off-by: Luca Coelho commit fb3fac5fafa8a6d45853b183c36cda4c13e1c279 Author: Gregory Greenman Date: Thu Aug 26 22:47:40 2021 +0300 iwlwifi: mvm: introduce iwl_stored_beacon_notif_v3 The new version sends station id in the notification. It's still not used, but need to adjust the code since the offset of the data was changed. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.87bc9e45c40b.I770493dc4a293ed8bdf059518e94dccf5dd1b3a7@changeid Signed-off-by: Luca Coelho commit b05c1d14a177eaffe3aa7fa18b39df3a3e1f3a47 Author: Dror Moshe Date: Thu Aug 26 22:47:39 2021 +0300 iwlwifi: move get pnvm file name to a separate function Move code that generates the pnvm file name to a separate function, so that it can be reused. Signed-off-by: Dror Moshe Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.7d2dd18c75a2.I3652584755b9ab44909ddcd09ff4d80c6690a1ad@changeid Signed-off-by: Luca Coelho commit bd34ff380e783d129bf3fc6b8762967ee8eab14f Author: Avraham Stern Date: Thu Aug 26 22:47:38 2021 +0300 iwlwifi: mvm: add support for responder config command version 9 This version adds the following configuration options: 1. Enable/disable setting the session id in the FTM frame 2. Set the BSS color for the responder 3. Set the minimum and maximum time between measurements for non trigger based NDP ranging. Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.0a10d43f3d7f.Ice4112c1910cf94babd1c2d492a3a3de9f7ee6cb@changeid Signed-off-by: Luca Coelho commit 830aa3e7d1ca1a7c8b6f414ac5bf8da561a45867 Author: Avraham Stern Date: Thu Aug 26 22:47:37 2021 +0300 iwlwifi: mvm: add support for range request command version 13 This version adds the following configuration options: 1. Set the BSS color for NDP ranging 2. Set the minimum and maximum time between measurements for non trigger based NDP ranging. 3. Terminate the session in case the responder requests LMR feedback. Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210826224715.9dcd5210b7e5.I76f6977cde852de0f251344e279ad85076eef8d6@changeid Signed-off-by: Luca Coelho commit 7e47f41648b215d458f2e0f35e26fe4157b9eb98 Author: Johannes Berg Date: Thu Aug 19 18:40:35 2021 +0300 iwlwifi: allow debug init in RF-kill We can send this even if initializing in RF-kill, thus suppressing a bunch of error messages about it. In fact, we _want_ to, since we might still want to debug the firmware even if in RF-kill. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.bcdb076609e2.I2d177c00772510b5338d8aa45af7558138b08448@changeid Signed-off-by: Luca Coelho commit a76b57311b1a247e31b055872d021c38707dc3a8 Author: Avraham Stern Date: Thu Aug 19 18:40:34 2021 +0300 iwlwifi: mvm: don't schedule the roc_done_wk if it is already running When P2P roc is removed, the IWL_MVM_STATUS_NEED_FLUSH_P2P bit is set to indicate to iwl_mvm_roc_done_wk() that the removed roc is a P2P one, so it will flush the broadcast station and not the aux station. However, since setting this bit and scheduling the worker is done in roc ended flow as well as in case the roc is removed, there is a race where the worker has already started running (but did not test this bit yet) and then it is scheduled again. In this case, the first run of the worker will clear this bit, and thus the second run will find it already cleared and will try to flush and remove the aux station by mistake. Fix it by scheduling the worker only if this bit is not yet set. In case this bit is already set, the worker is either running or scheduled, so there is no need to re-schedule it. Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.8c147659b331.If5924375e9bfd46214ab8ab81cb9d0f5c82fbcbc@changeid Signed-off-by: Luca Coelho commit 89639e06d0f35625db506f43971d08b0489cd2ce Author: Mukesh Sisodiya Date: Thu Aug 19 18:40:33 2021 +0300 iwlwifi: yoyo: support for new DBGI_SRAM region new region handling is added for dump collection. Signed-off-by: Mukesh Sisodiya Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.af9a24b82396.I53c5f82bd2d0f56fd699e3841c922082d99f1c90@changeid Signed-off-by: Luca Coelho commit 4e110e799cb50dcbf6b57254fd41b595479c91b9 Author: Shaul Triebitz Date: Thu Aug 19 18:40:32 2021 +0300 iwlwifi: add 'Rx control frame to MBSSID' HE capability 'Rx control frame to MBSSID' is supported by HW and FW. Add the capability to the HE mac capabilities. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.f3d6561dd8ee.I193d5331b43a1ecdae59eaedb37f0190a6d2311d@changeid Signed-off-by: Luca Coelho commit 8a433cb64ec5494571f313ba04f28ff58490c8c4 Author: Johannes Berg Date: Thu Aug 19 18:40:31 2021 +0300 iwlwifi: fw: fix debug dump data declarations The debug dump ranges aren't just an array of such ranges since each range has a variable size. Therefore, the use of a struct array is misleading at best. Change it to be a u8 data[] instead of the struct array, the code doesn't significantly change since it's actually doing things correctly now. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.693c9891097d.Idcaab1fd659e8be2f56be647b2534befd61a4460@changeid Signed-off-by: Luca Coelho commit 394f419296727cb614494c74b233d9bd3b24e271 Author: Johannes Berg Date: Thu Aug 19 18:40:30 2021 +0300 iwlwifi: api: remove datamember from struct We don't use this, but we embed this struct elsewhere and having structs with flexible arrays embedded isn't quite right, with sparse (for example) complaining. Remove the data[] member in this case. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.72ca1232b27c.I6ec766691b89670e1683f9fc0fbd12648309a574@changeid Signed-off-by: Luca Coelho commit 4246465edb16e493be2f2f1523866b589a234ec5 Author: Johannes Berg Date: Thu Aug 19 18:40:29 2021 +0300 iwlwifi: fix __percpu annotation Sparse warns about some type mismatches, which really is just because of the strangely placed __percpu annotation. Put it into the correct place. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.0a292b05fcf4.I7e89dfa6495143585021cb628ebb17d52e4588e5@changeid Signed-off-by: Luca Coelho commit 59a6ee97e0d4d8f9f3f47df1b82d850ce8e0f0b1 Author: Johannes Berg Date: Thu Aug 19 18:40:28 2021 +0300 iwlwifi: pcie: avoid dma unmap/remap in crash dump DMA-API debug code pointed out that in this code path we never check the return value of dma_map_page(), which could fail. However, we don't really even want to unmap/remap, we just want to ensure that we can actually access the last version of the data that the (now-dead) device may have written, so only need to dma_sync_single_for_cpu() instead. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.5987f35883a2.I2d9ea5ecc69a5e5947b546fb15f33363a0595651@changeid Signed-off-by: Luca Coelho commit 40063f602868aaeab5afe7f84237e3d95801680f Author: Luca Coelho Date: Thu Aug 19 18:40:27 2021 +0300 iwlwifi: acpi: fill in SAR tables with defaults If the tables we get in the iwl_sar_set_profile() is smaller than the revision we support, we need to fill the values with 0. Make sure that's the case. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.7fb9716db7ba.I75541846e0720f80695186ba39398133c8758280@changeid Signed-off-by: Luca Coelho commit c5b42c674ad88643c8a7d31611114bda62425fcf Author: Luca Coelho Date: Thu Aug 19 18:40:26 2021 +0300 iwlwifi: acpi: fill in WGDS table with defaults The tables we store are the larger of all the revisions, so we need to fill in the values that we don't get from ACPI when using older revisions. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.01b12461a30b.I08d1f9154f26eca25c44616efdb5223bcc1935f3@changeid Signed-off-by: Luca Coelho commit a6a39ab2645c696d5ed203a0d40300276da99f99 Author: Luca Coelho Date: Thu Aug 19 18:40:25 2021 +0300 iwlwifi: bump FW API to 65 for AX devices Start supporting API version 65 for AX devices. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210819183728.1cb15b015485.I2818924b772d7518f4d9fc38b4caab3494ab11f9@changeid Signed-off-by: Luca Coelho commit 664c011b763e437cbe2662432ec8e09128515700 Author: Luca Coelho Date: Thu Aug 5 14:21:58 2021 +0300 iwlwifi: acpi: support reading and storing WGDS revision 2 Revisions 0 and 1 are identical, so we were already supporting that. But revision 2 has a different size, so we have to try to read them separately. Add support for this new revision. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.78e441b16f9c.I2d79492f05624ddd02c533c673811a36eaf8a396@changeid Signed-off-by: Luca Coelho commit eb09ae93dabfd0980f5226dfd0bd531eb87902f5 Author: Miri Korenblit Date: Thu Aug 5 14:21:57 2021 +0300 iwlwifi: mvm: load regdomain at INIT stage We used to load the regdomain only in the load stage, this caused the 'iw phy phy0 reg get' command to fail if we booted a machine with wifi off. Therefor we should load it in INIT stage already. Signed-off-by: Miri Korenblit Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.a6077801d7d5.I7d8d5c895bc467efbf81ea055dde366ea01cced1@changeid Signed-off-by: Luca Coelho commit 78a19d5285d93e281b40c3b8d5a959fbbd2fe006 Author: Miri Korenblit Date: Thu Aug 5 14:21:56 2021 +0300 iwlwifi: mvm: Read the PPAG and SAR tables at INIT stage We used to read the PPAG, WRDS, EWRD, WGDS tables from ACPI in the load stage only. This prevented vendor commands from being executed before bringing the interface up. Move reading those tables to INIT stage. Signed-off-by: Miri Korenblit Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.ce3b60f0b426.I3643bf00e714aae930880cc7d6cf390b142eaccb@changeid Signed-off-by: Luca Coelho commit b537ffb6ea16b803b5ab5ef73c3bccc68a104af9 Author: Shaul Triebitz Date: Thu Aug 5 14:21:55 2021 +0300 iwlwifi: mvm: trigger WRT when no beacon heard If the session protection ends but no beacon was heard, the driver triggers a disconnection. Trigger WRT in that case so it can be debugged. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.7bf71939826b.Id73f1a466929670f5ec54301227d68883afd9207@changeid Signed-off-by: Luca Coelho commit e6344c060209ef4e970cac18adeac1676a2a73cd Author: Johannes Berg Date: Thu Aug 5 14:21:54 2021 +0300 iwlwifi: fw: correctly limit to monitor dump In commit 79f033f6f229 ("iwlwifi: dbg: don't limit dump decisions to all or monitor") we changed the code to pass around a bitmap, but in the monitor_only case, one place accidentally used the bit number, not the bit mask, resulting in CSR and FW_INFO getting dumped instead of monitor data. Fix that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.774fd8729a33.Ic985a787071d1c0b127ef0ba8367da896ee11f57@changeid Signed-off-by: Luca Coelho commit 19426d54302e199b3fd2d575f926a13af66be2b9 Author: Abhishek Naik Date: Thu Aug 5 14:21:53 2021 +0300 iwlwifi: skip first element in the WTAS ACPI table By mistake we were considering the first element of the WTAS wifi package as part of the data we want to rid, but that element is the wifi package signature (always 0x07), so it should be skipped. Change the code to read the data starting from element 1 instead. Signed-off-by: Abhishek Naik Fixes: 28dd7ccdc56f ("iwlwifi: acpi: read TAS table from ACPI and send it to the FW") Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.ff8148197b15.I70636c04e37b2b57a5df3ce611511f62203d27a7@changeid Signed-off-by: Luca Coelho commit 058b94dc9bf8310b93da864f9fe5bee5b50b0cf4 Author: Gregory Greenman Date: Thu Aug 5 14:21:52 2021 +0300 iwlwifi: mvm: support version 11 of wowlan statuses notification The new version of the command has same size and layout as version 10. It just sends corresponding station id in one of the reserved fields. It's not used in the driver, so just be ready to accept version 11. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.0a387598eef1.I3be0bbf603ef95c644218be8a12b329411f11646@changeid Signed-off-by: Luca Coelho commit 5bf7a9edddbb9d7c7deae58663aedd4dbc731a9e Author: Luca Coelho Date: Thu Aug 5 14:21:51 2021 +0300 iwlwifi: convert flat GEO profile table to a struct version The GEO profiles have been stored in single-dimension arrays and the access has been done via a single index. We will soon need to support different revisions of this table, which will make the flat array even harder to handle. To prepare for that, convert the single-dimension array to a struct with substructures. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.56f3506411a2.I600ed3708d19f2263a5a8d143f6711d08499bbb0@changeid Signed-off-by: Luca Coelho commit de95c9288ae15b53be63e52097fe0d5b374e6a13 Author: Luca Coelho Date: Thu Aug 5 14:21:50 2021 +0300 iwlwifi: remove unused ACPI_WGDS_TABLE_SIZE definition When we started supporting the new FW API for the geo profiles, we stopped using this definition, but left it there. Remove it now. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.91dec6fad3e8.Ica42d5538d83b1407efe0c441c61aa8830e7496d@changeid Signed-off-by: Luca Coelho commit 51266c11ceccbe95a5abe98e4c4b0f4932b5b023 Author: Luca Coelho Date: Thu Aug 5 14:21:49 2021 +0300 iwlwifi: support reading and storing EWRD revisions 1 and 2 As an extension to the WRDS support for revisions 1 and 2, do the same for the EWRD tables. These tables have a very similar format to the WRDS table, so most of the code is similar. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.2d5494de683c.Ia024b1368873d488906a639e29454cbbdc788d03@changeid Signed-off-by: Luca Coelho commit 2a8084147bff7a1fe9f567ed39c340a6a3fc27ef Author: Luca Coelho Date: Thu Aug 5 14:21:48 2021 +0300 iwlwifi: acpi: support reading and storing WRDS revision 1 and 2 Change the SAR profile tables storage to revision 2 regardless of the revision we read from ACPI. Revision 2 is a superset of revision 1, which is in turn a superset of revision 0, so they can all be stored inside revision 2. Add support for reading and storing also revisions 1 and 2, whose only difference is the number of chains and number of sub-bands. So most of the code revolves around passing different chain and sub-band sizes. With this patch we still pass only revision 0 to the firmware, but that will be changed in a separate patch. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.2edad09415c8.I36297aef90a9ec6a3ea1bf1a151a62f272826d59@changeid Signed-off-by: Luca Coelho commit 8ecf0477b990791949752578e7706908682db6e5 Author: Luca Coelho Date: Thu Aug 5 14:21:47 2021 +0300 iwlwifi: pass number of chains and sub-bands to iwl_sar_set_profile() The number of chains and sub-bands read from the ACPI tables varies depending on the revision. Pass these numbers to the iwl_sar_set_profile() function in order to make using different revisions easier. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805141826.905b54c398f8.I9bac8c3bc3b1b6bbe813de53746daee33e53fc86@changeid Signed-off-by: Luca Coelho commit dac7171c81323afa3a8c4fa1c08719ff9fd033cb Author: Luca Coelho Date: Thu Aug 5 13:19:34 2021 +0300 iwlwifi: remove ACPI_SAR_NUM_TABLES definition This definition was only used to pass the size of the tables in the FW API to the iwl_sar_select_profile() function, but we should actually pass the definition from the FW API file. We don't have the concept of tables in the ACPI definition, so we can remove it. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.00b5084be918.I18efb3c45bffacfa9a356c2c8d34e5ffbb3eb423@changeid Signed-off-by: Luca Coelho commit 81870d138dfe9450d99411113c57258449f250b3 Author: Luca Coelho Date: Thu Aug 5 13:19:33 2021 +0300 iwlwifi: convert flat SAR profile table to a struct version The SAR profiles have been stored in single-dimension arrays and the access has been done via a single index. We will soon need to support different revisions of this table, which will make the flat array even harder to handle. To prepare for that, convert the single-dimension array to a struct with substructures. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.01530088097f.I903c236a574c7e4c0fc4db101fc39c0f5415ca43@changeid Signed-off-by: Luca Coelho commit 248e7e2a1d8d1140f0d5cc507812987c33c7b020 Author: Luca Coelho Date: Thu Aug 5 13:19:32 2021 +0300 iwlwifi: rename ACPI_SAR_NUM_CHAIN_LIMITS to ACPI_SAR_NUM_CHAINS The "LIMITS" in the macro name don't have much meaning, so remove it to make the macro shorter and better reflect that this is the number of chains that we have limits for. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.65591c9fa2af.Ie7e4ba94c903ef444cb07df61891394c11c7c864@changeid Signed-off-by: Luca Coelho commit 6c608cd6962ebdf84fd3de6d42f88ed64d2f4e1b Author: Johannes Berg Date: Thu Aug 5 13:19:31 2021 +0300 iwlwifi: mvm: fix access to BSS elements BSS elements are protected using RCU, so we need to use RCU properly to access them, fix that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.fd8b5791ab44.Iba26800a6301078d3782fb249c476dd8ac2bf3c6@changeid Signed-off-by: Luca Coelho commit 967a39832ebe72e7b3826368e26ca1adda66814d Author: Ilan Peer Date: Thu Aug 5 13:19:30 2021 +0300 iwlwifi: mvm: Refactor setting of SSIDs for 6GHz scan - Short SSIDs should always be added for direct SSIDs included in the scan request. However, this was not done in case that information for collocated APs was included. Fix this. - With the above fix, if the FW also supports discovery of hidden APs over the 6GHz band, also set the corresponding full SSID information. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.02512b7a1443.Ibb023b09b86179ed049a195f4e32e887c2f4971d@changeid Signed-off-by: Luca Coelho commit 3df5c0ddcf81f2fe2d6a5e48efc3a37aa0feda5b Author: Avraham Stern Date: Thu Aug 5 13:19:29 2021 +0300 iwlwifi: mvm: silently drop encrypted frames for unknown station When a station is removed, the driver-mac80211 station mapping is removed before the station is actually deleted from the FW. As a result, it is reasonable that the FW will continue to pass frames although the driver doesn't have a station for them anymore. Thus change the message severity level from ERR to DEBUG_DROP. Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.a751177743c6.I5607504dade88ba461508643f58390dd661c05ba@changeid Signed-off-by: Luca Coelho commit 79e561f0f05afaa10b8d9bd18f89ec7d7168126d Author: Johannes Berg Date: Thu Aug 5 13:19:28 2021 +0300 iwlwifi: mvm: d3: implement RSC command version 5 In later firmware we haven't needed the TSC anyway since we have it already (and firmware image doesn't change), but the new version adds the ability to send down replay counters for more than one GTK. Implement that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.28cd065e8c4a.Ic8406a78ee46b07e0ca1b8199522ef08ec6eef53@changeid Signed-off-by: Luca Coelho commit af3aab9ce2989d7378e468c4d6a4eb39e0479c9b Author: Johannes Berg Date: Thu Aug 5 13:19:27 2021 +0300 iwlwifi: mvm: d3: make key reprogramming iteration optional Now that only reprogramming is left in the initial key iteration, skip it entirely on unified firmware images instead of skipping only the command sending inside of it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.c6f77325c430.I798ce9d757492a9e3d223c1de5d4e62ebbc00b2c@changeid Signed-off-by: Luca Coelho commit be05fae23d03a228b2b10b18e1a3e7dbaa363b0f Author: Johannes Berg Date: Thu Aug 5 13:19:26 2021 +0300 iwlwifi: mvm: d3: add separate key iteration for GTK type If we're sending the KEK/KCK data we also need the GTK and IGTK type, add a separate key iteration for that so we can make the configure_key iteration optional later. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.c99f86423702.Icf7d4e93be77ea05a80235d01851ad0155593de9@changeid Signed-off-by: Luca Coelho commit 631ee512028589835b48fdfa104654d0f563e27a Author: Johannes Berg Date: Thu Aug 5 13:19:25 2021 +0300 iwlwifi: mvm: d3: refactor TSC/RSC configuration Refactor the TSC/RSC configuration out from the normal wowlan key iteration so we can replace it later with a different one adapted to a different firmware API. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.78e431c9aaeb.I5b83b8b30e3e7c04706a1f99b3970e4e5f36af9e@changeid Signed-off-by: Luca Coelho commit 398760aa9679bbf985e00e1502f1d63d7fd25a67 Author: Johannes Berg Date: Thu Aug 5 13:19:24 2021 +0300 iwlwifi: mvm: d3: remove fixed cmd_flags argument We only ever pass cmd_flags == CMD_ASYNC, so might as well not have the argument. Remove it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.9130db608b77.I352cbc35fefd98cc00aa0c69ea43863942aa62f5@changeid Signed-off-by: Luca Coelho commit 0419e5e672d6d931fcaa83f7a715364ab4dc1ac9 Author: Johannes Berg Date: Thu Aug 5 13:19:23 2021 +0300 iwlwifi: mvm: d3: separate TKIP data from key iteration We do a key iteration to program the keys, and while at it we also collect the data necessary for TKIP. This code has all kinds of dependencies on the firmware API though, so take out the TKIP phase 1 key generation and do that in a separate key iteration only if necessary. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210805130823.80721fc0fd61.I5a8fbba4e3a9606f700ee41c7a4244dd5e2af935@changeid Signed-off-by: Luca Coelho commit 95a62c331f6ac38bd22b0353cab9d719d031c892 Author: Johannes Berg Date: Mon Aug 2 21:58:56 2021 +0300 iwlwifi: mvm: simplify __iwl_mvm_set_sta_key() There's no need to differentiate identical default and cipher type cases, nor do we really need to have a 'ret' variable. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.e89178b22fbf.I4d62baad9a9fdfd5c645a3cc5dbffb22feab5033@changeid Signed-off-by: Luca Coelho commit 199d895f47601fcd2c24d484e5ce1f5d283b5d4f Author: Johannes Berg Date: Mon Aug 2 21:58:55 2021 +0300 iwlwifi: mvm: support new station key API The new version 3 of the station key API has gotten rid of the strange hole in the sequence counter values, support that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.39a00ca1a1a6.Ifb4adeb4edd2b72232046dd2d59c0b3732f497c2@changeid Signed-off-by: Luca Coelho commit 35fc5feca7b24b97e828e6e6a4243b4b9b0131f8 Author: Ilan Peer Date: Mon Aug 2 21:58:54 2021 +0300 iwlwifi: mvm: Fix umac scan request probe parameters Both 'iwl_scan_probe_params_v3' and 'iwl_scan_probe_params_v4' wrongly addressed the 'bssid_array' field which should supposed to be any array of BSSIDs each of size ETH_ALEN and not the opposite. Fix it. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.04146f24794f.I90726440ddff75013e9fecbe9fa1a05c69e3f17b@changeid Signed-off-by: Luca Coelho commit 9de168a01279db655052a19b56662656bc94ea89 Author: Johannes Berg Date: Mon Aug 2 21:58:53 2021 +0300 iwlwifi: pcie: implement Bz reset flow Bz device reset flow changed, now the hardware (instead of firmware) will reset the PCI bus etc., this can take up to 100ms. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.df30875c6ff9.I962ed0f2c3358903dc6ba1abb65726ce5acbbd48@changeid Signed-off-by: Luca Coelho commit 6c0795f1a52410f2dccc63cd0993ae1a38856c77 Author: Johannes Berg Date: Mon Aug 2 21:58:52 2021 +0300 iwlwifi: implement Bz NMI behaviour The method to NMI the firmware also changed in Bz devices, implement the new logic. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.c9bd2034dc05.I983c25caa09c3776c7640fff73fe739362ecc5b6@changeid Signed-off-by: Luca Coelho commit 9ce041f5966fd07a4326b81add4ae472400351cd Author: Johannes Berg Date: Mon Aug 2 21:58:51 2021 +0300 iwlwifi: pcie: implement Bz device startup Device startup changed in Bz, some register bits moved around. Change the code accordingly. The new Bz hardware changes also the way we wake it (grab NIC access) and the way we disable bus mastering, update the driver code accordingly. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.00a137364a95.I059a2abac948965458862941ee7db6a2e1076fa6@changeid Signed-off-by: Luca Coelho commit 7e6dffda95d09bf008db0a35aee9045cb78b191f Author: Johannes Berg Date: Mon Aug 2 21:58:50 2021 +0300 iwlwifi: read MAC address from correct place on Bz On Bz devices, the MAC address CSRs changed from 0x380 to 0x30. Change the boolean configuration "mac_addr_from_csr" to hold the base address instead, and set it correctly for the different devices using this feature. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.928c7983f014.Ic5ba92d98946c1b4640280a05dcfd75119c0f0c0@changeid Signed-off-by: Luca Coelho commit d01408ee3a2bdfb1a6e0ae086c628dccf27ab811 Author: Johannes Berg Date: Mon Aug 2 21:58:49 2021 +0300 iwlwifi: give Bz devices their own name The real name isn't determined yet, but give them a new name that isn't clashing with older devices. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.46b86c8074b2.I94d58b8e622ca87658dc05b05483fb954d526eab@changeid Signed-off-by: Luca Coelho commit d98cee05e3fdc7499583deb224eda52af577eae8 Author: Johannes Berg Date: Mon Aug 2 21:58:48 2021 +0300 iwlwifi: split off Bz devices into their own family These devices have some places with different behaviour required, so split them off into their own family as they should be. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.90257303559f.I4c4342229dcb9513099a3152605f0947423e86dc@changeid Signed-off-by: Luca Coelho commit e75bc5f3f110aa6c4c372e574bd2c37a8cad495f Author: Mukesh Sisodiya Date: Mon Aug 2 21:58:47 2021 +0300 iwlwifi: yoyo: cleanup internal buffer allocation in D3 With recent changes in the firmware SRAM debug during D3 is enabled by default and need not be enabled by driver. cleaning the code to align the same. Signed-off-by: Mukesh Sisodiya Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802215208.8535203d0ef7.Ib1695ce5de921b0472d0b1052e729e071573b863@changeid Signed-off-by: Luca Coelho commit 105167830d5fa7ca39d764c28e8f72bef5a16528 Author: Johannes Berg Date: Mon Aug 2 17:28:29 2021 +0300 iwlwifi: mvm: treat MMPDUs in iwl_mvm_mac_tx() as bcast There's no need for all the complicated conditions here, any bufferable MMPDUs or MMPDUs for client interfaces are already coming through the TXQ interface, not iwl_mvm_mac_tx(). Simplify the logic. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.3939f7c5c43a.I1d5cb5262e31a000023d79acbb897b8db50adf0d@changeid Signed-off-by: Luca Coelho commit 366fc672d6250bd747b745111b6a0d16b62aa60b Author: Johannes Berg Date: Mon Aug 2 17:28:28 2021 +0300 iwlwifi: mvm: clean up number of HW queues Since switching to mac80211 TXQs, we no longer need to advertise more hardware queues than ACs, since we don't even set QUEUE_CONTROL anyway, so the vif->hw_queue[] mapping array won't be used. All we need (at least for now) is for hw->queues to indicate that we have enough queues to handle QoS. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.80611a3c1ee7.I8a3d2b269421b6d8bada8c12cce3e095e6cfaeed@changeid Signed-off-by: Luca Coelho commit c6ce1c74ef2923b8ffd85f7f8b486f804f343b39 Author: Johannes Berg Date: Mon Aug 2 17:28:27 2021 +0300 iwlwifi: mvm: avoid static queue number aliasing When TVQM is enabled (iwl_mvm_has_new_tx_api() is true), then queue numbers are just sequentially assigned 0, 1, 2, ... Prior to TVQM, in DQA, there were some statically allocated queue numbers: * IWL_MVM_DQA_AUX_QUEUE == 1, * both IWL_MVM_DQA_INJECT_MONITOR_QUEUE and IWL_MVM_DQA_P2P_DEVICE_QUEUE == 2, and * IWL_MVM_DQA_AP_PROBE_RESP_QUEUE == 9. Now, these values are assigned to the members mvm->aux_queue, mvm->snif_queue, mvm->probe_queue and mvm->p2p_dev_queue by default. Normally, this doesn't really matter, and if TVQM is in fact available we override them to the real values after allocating a queue for use there. However, this allocation doesn't always happen. For example, for mvm->p2p_dev_queue (== 2) it only happens when the P2P Device interface is started, if any. If it's not started, the value in mvm->p2p_dev_queue remains 2. This wouldn't really matter all that much if it weren't for iwl_mvm_is_static_queue() which checks a queue number against one of those four static numbers. Now, if no P2P Device or monitor interface is added then queue 2 may be dynamically allocated, yet alias mvm->p2p_dev_queue or mvm->snif_queue, and thus iwl_mvm_is_static_queue() erroneously returns true for it. If it then gets full, all interface queues are stopped, instead of just backpressuring against the one TXQ that's really the only affected one. This clearly can lead to issues, as everything is stopped even if just a single TXQ filled its corresponding HW queue, if it happens to have an appropriate number (2 or 9, AUX is always reassigned.) Due to a mac80211 bug, this also led to a situation in which the queues remained stopped across a deauthentication and then attempts to connect to a new AP started failing, but that's fixed separately. Fix all of this by simply initializing the queue numbers to the invalid value until they're used, if TVQM is enabled, and also setting them back to that value when the queues are later freed again. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.2e47e623f9e2.I9b0830dafbb68ef35b7b8f0f46160abec02ac7d0@changeid Signed-off-by: Luca Coelho commit 5993c90ccb56b34aaedfd77a1c67c7a2039090ee Author: Zheng Yongjun Date: Mon Aug 2 17:28:26 2021 +0300 iwlwifi: use DEFINE_MUTEX() for mutex lock mutex lock can be initialized automatically with DEFINE_MUTEX() rather than explicitly calling mutex_init(). Signed-off-by: Zheng Yongjun Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.2a583d006739.Ia782c08525397b6430b1c877a870d688a7f3f494@changeid Signed-off-by: Luca Coelho commit 2b06127df02fbca66d0098e9a1d3eaf62bb5e9c8 Author: Tom Rix Date: Mon Aug 2 17:28:25 2021 +0300 iwlwifi: remove trailing semicolon in macro definition The macro use will already have a semicolon. Signed-off-by: Tom Rix Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.3db450ebbb3c.Ic63f85b85a043256318da49d7b5a63f7dddf3986@changeid Signed-off-by: Luca Coelho commit 0f5d44ac6e55551798dd3da0ff847c8df5990822 Author: Zhang Qilong Date: Mon Aug 2 17:28:24 2021 +0300 iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed If beacon_inject_active is true, we will return without freeing beacon. Fid that by freeing it before returning. Signed-off-by: Zhang Qilong [reworded the commit message] Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.d16206ca60fc.I9984a9b442c84814c307cee3213044e24d26f38a@changeid Signed-off-by: Luca Coelho commit cd7ae5493448e12183e0b01070f060d617dd1edd Author: Wei Yongjun Date: Mon Aug 2 17:28:23 2021 +0300 iwlwifi: mvm: fix old-style static const declaration GCC reports warning as follows: drivers/net/wireless/intel/iwlwifi/mvm/rfi.c:14:1: warning: 'static' is not at beginning of declaration [-Wold-style-declaration] 14 | const static struct iwl_rfi_lut_entry iwl_rfi_table[IWL_RFI_LUT_SIZE] = { | ^~~~~ Move static to the beginning of declaration. Fixes: 21254908cbe9 ("iwlwifi: mvm: add RFI-M support") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.f60b39bbb0c0.I8b0ad9105003d13cc4aa64fc957aec9582e8b26d@changeid Signed-off-by: Luca Coelho commit c1868c0b78892a8b2329dae835786a8a7f643fe2 Author: Luca Coelho Date: Mon Aug 2 17:28:22 2021 +0300 iwlwifi: mvm: remove check for vif in iwl_mvm_vif_from_mac80211() This check is useless, because we would return NULL in that case and none of the callers actually check that the return value was not NULL before accessing it. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.f1c4844a2650.If4dc009e22cda51099a1dc4237d04bf4313055d6@changeid Signed-off-by: Luca Coelho commit 02289645a085eedb55b185da2766b5c6f9492577 Author: Luca Coelho Date: Mon Aug 2 17:28:21 2021 +0300 iwlwifi: pcie: remove spaces from queue names If we use spaces in the queue names, we get files with spaces in their name in procfs, which is ugly. Remove the spaces. Reported-by: Joe Perches Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.0ef8aedd4f9b.If527b9ae5bf8de8c6877d4b6a21ed8d81b0f877e@changeid Signed-off-by: Luca Coelho commit de34d1c1d30d6d9373f536522c04b86b54711c3b Author: Johannes Berg Date: Mon Aug 2 17:28:20 2021 +0300 iwlwifi: mvm: restrict FW SMPS request The firmware SMPS request should only be honoured if the connection is currently with HE and on 160 MHz, so check that and then potentially reapply any request if the BW changes. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.0cdcac5660da.I9ee7956fd4f48399855d1f97728bc58b36caf112@changeid Signed-off-by: Luca Coelho commit a6dfbd040e26d0fa429545d37ca9d3dc8a80cf3b Author: Johannes Berg Date: Mon Aug 2 17:28:19 2021 +0300 iwlwifi: mvm: set replay counter on key install When installing a (new) key, set the replay counter so that after FW restart the firmware has the correct value of the replay counters. This doesn't have a large effect - for frames that reach the driver, it will do a replay check, and when installing a new key, the counter is normally zero to start with (not for GTK though, if joining the BSS for the first time). Since this only affects frames handled entirely by the FW, and that's restricted to a few unicast management frames, the only affect here is for those after a firmware restart. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.1cedf2ca7bb6.I2e609c28eaa301436e6740f4f1beca838f69a96a@changeid Signed-off-by: Luca Coelho commit 1a81bddf7f47443240b7703bf9e5ffb12c4261cf Author: Mordechay Goodstein Date: Mon Aug 2 17:28:18 2021 +0300 iwlwifi: mvm: remove trigger EAPOL time event EAPOL failure results in deauthentication with various reasons, not related to AUTH failure specifically, so we just merge AUTH failure with failed to assoc to AP. Signed-off-by: Mordechay Goodstein Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802172232.2ff350d85eab.I02c5b5d29c0d5c2e014bd1081b07ed33772ae04d@changeid Signed-off-by: Luca Coelho commit 8fc3015d0d35f42ee57c04bfe3c17f112afce5fe Author: Mordechay Goodstein Date: Mon Aug 2 17:09:44 2021 +0300 iwlwifi: iwl-dbg-tlv: add info about loading external dbg bin This helps understand why and what debug capabilities are running. Signed-off-by: Mordechay Goodstein Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.98980f8bd17f.Ifcedf415a545a87cb341a4142085b5723d8cac4d@changeid Signed-off-by: Luca Coelho commit 16cff731a3a17d30b1e556c474b6dddb09c64b41 Author: Ilan Peer Date: Mon Aug 2 17:09:43 2021 +0300 iwlwifi: mvm: Add support for hidden network scan on 6GHz band Add support for discovery of hidden networks on the 6GHz band, by including the scan request direct SSIDs in the FW scan request command: - In case a short SSID matches one of the direct SSIDs in the scan request command, add the matching SSID in the same offset in the 'direct_ssids' array. - Otherwise, add the SSID in one of the available slots. Additionally, as a preparation to handle hidden APs, refactor iwl_mvm_umac_scan_cfg_channels_v6_6g() the function. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.ffb540a70212.Ia2bb9bc9435b833820bcc7dc30adcedb5a5a9869@changeid Signed-off-by: Luca Coelho commit deedf9b97cd4ef45da476c9bdd2a5f3276053956 Author: Ilan Peer Date: Mon Aug 2 17:09:42 2021 +0300 iwlwifi: mvm: Do not use full SSIDs in 6GHz scan The scan request processing populated the direct SSIDs in the FW scan request command also for 6GHz scan, which is not needed and might result in unexpected behavior. Fix the code to add the direct SSIDs only in case the scan is not a 6GHz scan. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.f465937c7bbf.Ic11a1659ddda850c3ec1b1afbe9e2b9577ac1800@changeid Signed-off-by: Luca Coelho commit 2a1d2fcf2bedd5aef9e7cc638211ffdef062e5dd Author: Luca Coelho Date: Mon Aug 2 17:09:41 2021 +0300 iwlwifi: print PNVM complete notification status in hexadecimal This value is not a simple incrementing integer, it contains some flags as well, so reading it in hexadecimal is easier. Change the print to do it in hex instead of decimal. Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.5e35f930d0ed.I5f94575a835f060bdc8ed3477871256f8a2cbaaa@changeid Signed-off-by: Luca Coelho commit e63aafea74393e6c6ca0dd439e72021830a0fcac Author: Johannes Berg Date: Mon Aug 2 17:09:40 2021 +0300 iwlwifi: pcie: dump error on FW reset handshake failures If the firmware crashes while we're waiting for the reset handshake then it cannot possibly make progress anymore, and we will just time out the wait. That's pointless, so just stop waiting at that point. Additionally, if it never acknowledges the reset handshake, something went wrong. Dump an error in both of these cases, but we need to do it synchronously here since the device will be turned off. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.8b6a33544b4b.I55f97f70f8efa64db064a9207177a094c60ac8f1@changeid Signed-off-by: Luca Coelho commit b8221b0f750a05a7ae9cbca84932e2a36a3ee658 Author: Johannes Berg Date: Mon Aug 2 17:09:39 2021 +0300 iwlwifi: prepare for synchronous error dumps In some cases it may be necessary to synchronously create a firmware error report, add the necessary infrastructure for this. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.481b6642f0fc.I7c9c958408a285e3d19aceed2a5a3341cfc08382@changeid Signed-off-by: Luca Coelho commit 6ac5720086c8b176794eb74c5cc09f8b79017f38 Author: Johannes Berg Date: Mon Aug 2 17:09:38 2021 +0300 iwlwifi: pcie: free RBs during configure When switching op-modes, or more generally when reconfiguring, we might switch the RB size. In _iwl_pcie_rx_init() we have a comment saying we must free all RBs since we might switch the size, but this is actually too late: the switch has been done and we'll free the buffers with the wrong size. Fix this by always freeing the buffers, if any, at the start of configure, instead of only after the size may have changed. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.42d7c93279c4.I07f74e65aab0e3d965a81206fcb289dc92d74878@changeid Signed-off-by: Luca Coelho commit 95fe8d89bb8c9c114ca3e46f8b2457f894f55746 Author: Johannes Berg Date: Mon Aug 2 17:09:37 2021 +0300 iwlwifi: pcie: optimise struct iwl_rx_mem_buffer layout On 64-bit machines, struct iwl_rx_mem_buffer has a lot of padding due to the use of pointers after the small items. Move the list entry before them, and while at it also add documentation for it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.6a62255b3df0.I47bb36530a3c2cdbd73454c796ce608ee2a32a6c@changeid Signed-off-by: Luca Coelho commit 2f308f008f1ccda4dcf9816c7dad0a33fbffdd18 Author: Johannes Berg Date: Mon Aug 2 17:09:36 2021 +0300 iwlwifi: mvm: avoid FW restart while shutting down If the firmware crashes while we're already shutting down the system, there isn't much we can do since the shutdown process is continuing and we wanted to do that. Don't do a FW restart, with the implied debug collection, in this case. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.43a7351ae6bd.I164d48ce4379accf76ea0637983fd946d52dc6f5@changeid Signed-off-by: Luca Coelho commit 0eb5a554bb49bf62f929612dd964e4a834b71a81 Author: Johannes Berg Date: Mon Aug 2 17:09:35 2021 +0300 iwlwifi: nvm: enable IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF The device is capable of receiving MU-MIMO frames with 8 symbols, enable the bit here that says so. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.90cf2eb42794.I692e6d0fde6e99a1db97d2e678952f043f48f603@changeid Signed-off-by: Luca Coelho commit 1269ba1ce35d91799a43fc52e9eeb04364f50dfd Author: Shaul Triebitz Date: Mon Aug 2 17:09:34 2021 +0300 iwlwifi: mvm: set BROADCAST_TWT_SUPPORTED in MAC policy If broadcast TWT is supported in the BSS, tell the firmware about it by setting the BROADCAST_TWT_SUPPORTED in the MAC context command. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.736c3b1bc915.I10583bb6f808aa60954da26106bbc8c26620cbe8@changeid Signed-off-by: Luca Coelho commit f2d1bdf053d0cafff61a32103b20403958cb5232 Author: Mordechay Goodstein Date: Mon Aug 2 17:09:33 2021 +0300 iwlwifi: iwl-nvm-parse: set STBC flags for HE phy capabilities Our HW supersets STBC for HE but never set it in assoc IE, fix it by setting it and enable using it. Signed-off-by: Mordechay Goodstein Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20210802170640.0108f3e322b6.Ib25a91b5c48ff1fb2185b86a9e4bf5eec637df90@changeid Signed-off-by: Luca Coelho commit adf9ae0d159d3dc94f58d788fc4757c8749ac0df Author: Johannes Berg Date: Tue Jul 13 23:47:10 2021 +0200 um: fix stub location calculation In commit 9f0b4807a44f ("um: rework userspace stubs to not hard-code stub location") I changed stub_segv_handler() to do a calculation with a pointer to a stack variable to find the data page that we're using for the stack and the rest of the data. This same commit was meant to do it as well for stub_clone_handler(), but the change inadvertently went into commit 84b2789d6115 ("um: separate child and parent errors in clone stub") instead. This was reported to not be compiled correctly by gcc 5, causing the code to crash here. I'm not sure why, perhaps it's UB because the var isn't initialized? In any case, this trick always seemed bad, so just create a new inline function that does the calculation in assembly. Reported-by: subashab@codeaurora.org Fixes: 9f0b4807a44f ("um: rework userspace stubs to not hard-code stub location") Fixes: 84b2789d6115 ("um: separate child and parent errors in clone stub") Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 6a241d2923c2c0f6893c78c79421ceb3935691fd Author: Johannes Berg Date: Tue Aug 17 17:53:29 2021 +0200 um: virt-pci: fix uapi documentation The identifier names in the documentation here didn't match the real ones, and the reserved was missing. Fix that. Reported-by: Bjorn Helgaas Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit bc5c49d79206b40ad16e055837a33b6dc6160bed Author: Johannes Berg Date: Wed Aug 11 16:58:26 2021 +0200 um: enable VMAP_STACK This works just fine, so select HAVE_ARCH_VMAP_STACK to let users enable VMAP_STACK if desired. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 4a22c4cebd61f67bd8a2c79f8dae10df074f62b9 Author: Johannes Berg Date: Wed Aug 11 16:58:25 2021 +0200 um: virt-pci: don't do DMA from stack When enabling VMAP_STACK, SG helpers immediately complained that we were doing DMA from stack. Use per-CPU variables to avoid that. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 1568cb0e6d97f233a5a3e37c27677bb6a0d44b4d Author: Johannes Berg Date: Tue Jul 6 23:12:42 2021 +0200 hostfs: support splice_write There's really no good reason not to, and e.g. trace-cmd currently requires it for the temporary per-CPU files. Hook up splice_write just like everyone else does. Signed-off-by: Johannes Berg Signed-off-by: Richard Weinberger commit 7ad28e0df7ee9dbcb793bb88dd81d4d22bb9a10e Author: Johannes Berg Date: Fri Jun 25 10:34:37 2021 +0200 um: virtio_uml: fix memory leak on init failures If initialization fails, e.g. because the connection failed, we leak the 'vu_dev'. Fix that. Reported by smatch. Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver") Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Signed-off-by: Richard Weinberger commit 21976f2b747edd9350336cdd6700b792a3bc2170 Author: Johannes Berg Date: Fri Jun 25 10:34:36 2021 +0200 um: virtio_uml: include linux/virtio-uml.h This fixes a sparse warning, since the function defined here should have a declaration (or be static). Reported-by: kernel test robot Fixes: 43c590cb8666 ("um: virtio/pci: enable suspend/resume") Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Signed-off-by: Richard Weinberger commit 68fdb64485014802152725a4aec63296847f740e Author: Johannes Berg Date: Fri Jun 25 10:34:35 2021 +0200 lib/logic_iomem: fix sparse warnings A couple of sparse warnings happened here due to casts on the prints, a missing static and a missing include. Fix all of them. Reported-by: kernel test robot Fixes: ca2e334232b6 ("lib: add iomem emulation (logic_iomem)") Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Signed-off-by: Richard Weinberger commit b76dd9302af7803aac62243ae94d53067fc819b4 Author: Johannes Berg Date: Fri Jun 25 10:34:34 2021 +0200 um: make PCI emulation driver init/exit static The functions aren't used elsewhere, so they can be static. Reported-by: kernel test robot Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Johannes Berg Acked-By: Anton Ivanov Signed-off-by: Richard Weinberger commit 0bcc7ca40bd823193224e9f38bafbd8325aaf566 Author: J. Bruce Fields Date: Tue Aug 24 22:36:03 2021 -0400 nfsd: fix crash on LOCKT on reexported NFSv3 Unlike other filesystems, NFSv3 tries to use fl_file in the GETLK case. Signed-off-by: J. Bruce Fields Signed-off-by: Chuck Lever commit bb0a55bb7148a49e549ee992200860e7a040d3a5 Author: J. Bruce Fields Date: Fri Aug 20 17:02:06 2021 -0400 nfs: don't allow reexport reclaims In the reexport case, nfsd is currently passing along locks with the reclaim bit set. The client sends a new lock request, which is granted if there's currently no conflict--even if it's possible a conflicting lock could have been briefly held in the interim. We don't currently have any way to safely grant reclaim, so for now let's just deny them all. I'm doing this by passing the reclaim bit to nfs and letting it fail the call, with the idea that eventually the client might be able to do something more forgiving here. Signed-off-by: J. Bruce Fields Acked-by: Anna Schumaker Signed-off-by: Chuck Lever commit b840be2f00c0bc00d993f8f76e251052b83e4382 Author: J. Bruce Fields Date: Fri Aug 20 17:02:05 2021 -0400 lockd: don't attempt blocking locks on nfs reexports As in the v4 case, it doesn't work well to block waiting for a lock on an nfs filesystem. As in the v4 case, that means we're depending on the client to poll. It's probably incorrect to depend on that, but I *think* clients do poll in practice. In any case, it's an improvement over hanging the lockd thread indefinitely as we currently are. Signed-off-by: J. Bruce Fields Acked-by: Anna Schumaker Signed-off-by: Chuck Lever commit f657f8eef3ff870552c9fd2839e0061046f44618 Author: J. Bruce Fields Date: Fri Aug 20 17:02:04 2021 -0400 nfs: don't atempt blocking locks on nfs reexports NFS implements blocking locks by blocking inside its lock method. In the reexport case, this blocks the nfs server thread, which could lead to deadlocks since an nfs server thread might be required to unlock the conflicting lock. It also causes a crash, since the nfs server thread assumes it can free the lock when its lm_notify lock callback is called. Ideal would be to make the nfs lock method return without blocking in this case, but for now it works just not to attempt blocking locks. The difference is just that the original client will have to poll (as it does in the v4.0 case) instead of getting a callback when the lock's available. Signed-off-by: J. Bruce Fields Acked-by: Anna Schumaker Signed-off-by: Chuck Lever commit 8c09e896cef8d908dd9a20a9f2a5c3fcb9799de3 Author: Zhangfei Gao Date: Tue Jul 13 10:54:34 2021 +0800 PCI: Allow PASID on fake PCIe devices without TLP prefixes Some systems, e.g., HiSilicon KunPeng920 and KunPeng930, have devices that appear as PCI but are actually on the AMBA bus. Some of these fake PCI devices support a PASID-like feature and they do have a working PASID capability even though they do not use the PCIe Transport Layer Protocol and do not support TLP prefixes. Add a pasid_no_tlp bit for this "PASID works without TLP prefixes" case and update pci_enable_pasid() so it can enable PASID on these devices. Set this bit for HiSilicon KunPeng920 and KunPeng930. [bhelgaas: squashed, commit log] Suggested-by: Bjorn Helgaas Link: https://lore.kernel.org/r/1626144876-11352-2-git-send-email-zhangfei.gao@linaro.org Link: https://lore.kernel.org/r/1626144876-11352-3-git-send-email-zhangfei.gao@linaro.org Signed-off-by: Zhangfei Gao Signed-off-by: Jean-Philippe Brucker Signed-off-by: Zhou Wang Signed-off-by: Bjorn Helgaas commit 48b2e71c2e53263ebbb6798bbf208e191937e691 Author: Kumar Kartikeya Dwivedi Date: Thu Aug 26 17:39:10 2021 +0530 samples: bpf: Fix uninitialized variable in xdp_redirect_cpu While at it, also improve help output when CPU number is greater than possible. Fixes: e531a220cc59 ("samples: bpf: Convert xdp_redirect_cpu to XDP samples helper") Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210826120910.454081-1-memxor@gmail.com commit e0be99864d99712d86feff67c552eee9ef50ae44 Author: Konrad Dybcio Date: Fri Jun 18 13:14:34 2021 +0200 clk: qcom: mmcc-msm8994: Add MSM8992 support MSM8992 features less clocks & GDSCS and has different freq tables for some of them. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210618111435.595689-3-konrad.dybcio@somainline.org Signed-off-by: Stephen Boyd commit 4d5b4572c4753f2637ea9ac7eda465a1ca0d6f7b Author: Konrad Dybcio Date: Fri Jun 18 13:14:33 2021 +0200 clk: qcom: Add msm8994 MMCC driver Add a driver for managing MultiMedia SubSystem clocks on msm8994 and its derivatives. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210618111435.595689-2-konrad.dybcio@somainline.org Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 7972609631fd74163494b8b23a233b6d4862e795 Author: Konrad Dybcio Date: Fri Jun 18 13:14:32 2021 +0200 dt-bindings: clock: Add support for MSM8992/4 MMCC Document the multimedia clock controller found on MSM8992/4. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20210618111435.595689-1-konrad.dybcio@somainline.org Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 3599bc5101b36d9ff88da17fe65b001aeadd9c62 Author: Yucong Sun Date: Wed Aug 25 11:47:45 2021 -0700 selftests/bpf: Reduce more flakyness in sockmap_listen This patch adds similar retry logic to more places where read() is used, to reduce flakyness in slow CI environment. Signed-off-by: Yucong Sun Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825184745.2680830-1-fallentree@fb.com commit 9bb6cfc3c77e68dc54647152ec4e1b5f2d16f569 Author: Vladimir Lypak Date: Thu Aug 5 09:06:57 2021 +0000 clk: qcom: Add Global Clock Controller driver for MSM8953 This driver provides clocks, resets and power domains for MSM8953 and compatible SoCs: APQ8053, SDM450, SDA450, SDM632, SDA632. Signed-off-by: Vladimir Lypak Signed-off-by: Adam Skladowski Reviewed-by: Konrad Dybcio Signed-off-by: Sireesh Kodali Link: https://lore.kernel.org/r/IPvVnyRWbHuQFswiFz0W08Kj1dKoH55ddQVyIIPhMJw@cp7-web-043.plabs.ch Signed-off-by: Stephen Boyd commit 1b9de19e244d79c1f8db208a0691f97426aef81f Author: Vladimir Lypak Date: Thu Aug 5 09:06:42 2021 +0000 dt-bindings: clock: add Qualcomm MSM8953 GCC driver bindings Add bindings and compatible to document MSM8953 GCC (Global Clock Controller) driver. Signed-off-by: Vladimir Lypak Signed-off-by: Adam Skladowski Signed-off-by: Sireesh Kodali Link: https://lore.kernel.org/r/Q6uB3NRxqtD8Prsmliv8ZdsTXGeviv7lb2jQ743jr1E@cp4-web-036.plabs.ch Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit da09577ab562e2700f0aba3f17cc741717ca9e38 Author: Bjorn Andersson Date: Wed Aug 25 13:45:17 2021 -0700 clk: qcom: gcc-sdm660: Replace usage of parent_names Using parent_data and parent_hws, instead of parent_names, does protect against some cases of incompletely defined clock trees. While it turns out that the bug being chased this time was totally unrelated, this patch converts the SDM660 GCC driver to avoid such issues. The "xo" fixed_factor clock is unused within the gcc driver, but referenced from the DSI PHY. So it's left in place until the DSI driver is updated. Tested-by: Marijn Suijten Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Marijn Suijten Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210825204517.1278130-1-bjorn.andersson@linaro.org [sboyd@kernel.org: Reduce diff by moving enum and tables back to original position in previous patch] Signed-off-by: Stephen Boyd commit a61ca021fe28ab7163ca879fc3532c3cca25063c Author: Stephen Boyd Date: Thu Aug 26 11:49:14 2021 -0700 clk: qcom: gcc-sdm660: Move parent tables after PLLs In the next patch we're going to change these tables to reference the PLL structures directly. Let's move them here so the diff is easier to read. No functional change in this patch. Signed-off-by: Stephen Boyd commit 72cfc73f4663abe0b5c420d255c932ae5e7c126d Author: Dmitry Baryshkov Date: Sat Jul 31 22:50:34 2021 +0300 clk: qcom: use devm_pm_runtime_enable and devm_pm_clk_create Use two new helpers instead of pm_runtime_enable() and pm_clk_create(), removing the need for calling pm_runtime_disable and pm_clk_destroy(). Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210731195034.979084-4-dmitry.baryshkov@linaro.org Signed-off-by: Stephen Boyd commit a649136b17af6361355874a10e9219390c266a2c Author: Dmitry Baryshkov Date: Sat Jul 31 22:50:33 2021 +0300 PM: runtime: add devm_pm_clk_create helper A typical code pattern for pm_clk_create() call is to call it in the _probe function and to call pm_clk_destroy() both from _probe error path and from _remove function. For some drivers the whole remove function would consist of the call to pm_remove_disable(). Add helper function to replace this bolierplate piece of code. Calling devm_pm_clk_create() removes the need for calling pm_clk_destroy() both in the probe()'s error path and in the remove() function. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210731195034.979084-3-dmitry.baryshkov@linaro.org Acked-by: Rafael J. Wysocki Signed-off-by: Stephen Boyd commit b3636a3a2c51715736d3ec45f635ed03191962ce Author: Dmitry Baryshkov Date: Sat Jul 31 22:50:32 2021 +0300 PM: runtime: add devm_pm_runtime_enable helper A typical code pattern for pm_runtime_enable() call is to call it in the _probe function and to call pm_runtime_disable() both from _probe error path and from _remove function. For some drivers the whole remove function would consist of the call to pm_remove_disable(). Add helper function to replace this bolierplate piece of code. Calling devm_pm_runtime_enable() removes the need for calling pm_runtime_disable() both in the probe()'s error path and in the remove() function. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210731195034.979084-2-dmitry.baryshkov@linaro.org Acked-by: Rafael J. Wysocki Signed-off-by: Stephen Boyd commit d6be5d0ad304e81d4719ee47c429493aab033e38 Author: Alexander Gordeev Date: Tue Aug 24 15:30:22 2021 +0200 s390/smp: do not use nodat_stack for secondary CPU start The secondary CPU start C routine uses nodat_stack as a interim stack before finally switching to kernel_stack. Such scheme is superfluous, since the assembler restart interrupt handler (that secondary CPU starter is called from) does not need to use any stack for switching into DAT mode. Once DAT is on, any stack including virtually- mapped one could be used. Avoid the use of nodat_stack and smp_start_secondary() helper. Instead, initiate kernel_stack directly from the restart interrupt handler. Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 915fea04f9320d0f4ab6ecbb6bf759eebcd2c41d Author: Alexander Gordeev Date: Tue Aug 24 15:30:21 2021 +0200 s390/smp: enable DAT before CPU restart callback is called The restart interrupt is triggered whenever a secondary CPU is brought online, a remote function call dispatched from another CPU or a manual PSW restart is initiated and causes the system to kdump. The handling routine is always called with DAT turned off. It then initializes the stack frame and invokes a callback. The existing callbacks handle DAT as follows: * __do_restart() and __machine_kexec() turn in on upon entry; * __ipl_run(), __reipl_run() and __dump_run() do not turn it right away, but all of them call diag308() - which turns DAT on, but only if kasan is enabled; In addition to the described complexity all callbacks (and the functions they call) should avoid kasan instrumentation while DAT is off. This update enables DAT in the assembler restart handler and relieves any callbacks (which are mostly C functions) from dealing with DAT altogether. There are four types of CPU restart that initialize control registers in different ways: 1. Start of secondary CPU on boot - control registers are inherited from the IPL CPU; 2. Restart of online CPU - control registers of the CPU being restarted are kept; 3. Hotplug of offline CPU - control registers are inherited from the starting CPU; 4. Start of offline CPU triggered by manual PSW restart - the control registers are read from the absolute lowcore and contain the boot time IPL CPU values updated with all follow-up calls of smp_ctl_set_bit() and smp_ctl_clear_bit() routines; In first three cases contents of the control registers is the most recent. In the latter case control registers are good enough to facilitate successful completion of kdump operation. Suggested-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit e7dc78d3d9ad1e70f2e955bdfef807a9f1dfcce7 Author: Heiko Carstens Date: Wed Aug 25 16:52:44 2021 +0200 s390: update defconfigs Ingo Franzki reported that our defconfig and debug_config went out of sync with respect to DM_INTEGRITY. Fix it. Reported-by: Ingo Franzki Signed-off-by: Heiko Carstens commit cabebb697c98fb1f05cc950a747a9b6ec61a5b01 Author: Harald Freudenberger Date: Wed Aug 25 10:55:02 2021 +0200 s390/ap: fix state machine hang after failure to enable irq If for any reason the interrupt enable for an ap queue fails the state machine run for the queue returned wrong return codes to the caller. So the caller assumed interrupt support for this queue in enabled and thus did not re-establish the high resolution timer used for polling. In the end this let to a hang for the user space process waiting "forever" for the reply. This patch reworks these return codes to return correct indications for the caller to re-establish the timer when a queue runs without interrupt support. Please note that this is fixing a wrong behavior after a first failure (enable interrupt support for the queue) failed. However, looks like this occasionally happens on KVM systems. Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit 52c64e5f7b79ce5c366ea88e7f02d81affeb1300 Merge: 6479f7588651c d3efd26af2e04 Author: Mark Brown Date: Thu Aug 26 19:15:14 2021 +0100 Merge series "ASoC: wcd9335: Firx some resources leak in the probe and remove function" from Christophe JAILLET : The first 2 patches are sraightforward and look logical to me. However, the 3rd one in purely speculative. It is based on the fact that a comment states that we enable some irqs on some slave ports. That said, it writes 0xFF in some registers. So, I guess that we should disable these irqs when the driver is removed. That said, writing 0x00 at the same place looks logical to me. This cis untested and NOT based on any documentation. Just a blind fix. Review with care. You'll be warned :) Christophe JAILLET (3): ASoC: wcd9335: Fix a double irq free in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Disable irq on slave ports in the remove function sound/soc/codecs/wcd9335.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.30.2 commit 61d861cf478576d85d6032f864360a34b26084b1 Author: Nicholas Kazlauskas Date: Wed May 13 11:58:50 2020 -0400 drm/amd/display: Move AllowDRAMSelfRefreshOrDRAMClockChangeInVblank to bounding box [Why] This is a global parameter, not a per pipe parameter and it's useful for experimenting with the prefetch schedule to be adjustable from the SOC bb. [How] Add a parameter to the SOC bb, default is the existing policy for all DCN. Fill it in when filling SOC bb parameters. Revert the policy to use MinDCFClk at the same time since that's not going to give us P-State in most cases on the spreadsheet. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403 Signed-off-by: Nicholas Kazlauskas Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b6d585041fd084ca28b605f8c9ca43aae9800ab1 Author: Aurabindo Pillai Date: Wed Aug 25 11:53:05 2021 -0400 drm/amd/display: Remove duplicate dml init [Why & How] DML is initialized again unnecessarily after its done conditionally. Remove the duplicate initialization Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403 Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a7a9d11e12fcc32160d55e8612e72e5ab51b15dc Author: Jerry (Fangzhi) Zuo Date: Wed Jun 17 20:34:33 2020 -0400 drm/amd/display: Update bounding box states (v2) [Why] Drop hardcoded dispclk, dppclk, phyclk [How] Read the corresponding values from clock table entries already populated. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403 Cc: stable@vger.kernel.org Signed-off-by: Jerry (Fangzhi) Zuo Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 0bbf06d888734041e813b916d7821acd4f72005a Author: Aurabindo Pillai Date: Tue Aug 24 15:10:50 2021 -0400 drm/amd/display: Update number of DCN3 clock states [Why & How] The DCN3 SoC parameter num_states was calculated but not saved into the object. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403 Cc: stable@vger.kernel.org Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 192fb630fbd49eb1d27dceaf16e9676fe915f385 Author: Hawking Zhang Date: Thu Aug 26 13:54:53 2021 +0800 drm/amdgpu: disable GFX CGCG in aldebaran disable GFX CGCG and CGLS to workaround a hardware issue found in aldebaran. Signed-off-by: Hawking Zhang Reviewed-by: John Clements Signed-off-by: Alex Deucher commit 54e6badbedd89f2cca29809c54c53e56da6f6558 Author: John Clements Date: Thu Aug 26 15:10:39 2021 +0800 drm/amdgpu: Clear RAS interrupt status on aldebaran resolve register address issue for detecting/clearing RAS interrupt Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 3c4ff2dcc0dffbfa79f7f55237f502a74ed018b7 Author: John Clements Date: Thu Aug 26 13:55:52 2021 +0800 drm/amdgpu: Add support for RAS XGMI err query Update XGMI RAS to support error query on aldebaran Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 1ec06c2dee679e9f089e78ed20cb74ee90155f61 Author: Sean Keely Date: Thu Aug 19 21:26:14 2021 -0500 drm/amdkfd: Account for SH/SE count when setting up cu masks. On systems with multiple SH per SE compute_static_thread_mgmt_se# is split into independent masks, one for each SH, in the upper and lower 16 bits. We need to detect this and apply cu masking to each SH. The cu mask bits are assigned first to each SE, then to alternate SHs, then finally to higher CU id. This ensures that the maximum number of SPIs are engaged as early as possible while balancing CU assignment to each SH. v2: Use max SH/SE rather than max SH in cu_per_sh. v3: Fix comment blocks, ensure se_mask is initially zero filled, and correctly assign se.sh.cu positions to unset bits in cu_mask. Signed-off-by: Sean Keely Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit ea870730d83fc13a5fa2bd0e175176d7ac8a400a Merge: 29848a034ac74 ffc95d1b8edb8 7fa005caa35ed eb0feefd4c025 Author: Alex Williamson Date: Thu Aug 26 11:08:50 2021 -0600 Merge branches 'v5.15/vfio/spdx-license-cleanups', 'v5.15/vfio/dma-valid-waited-v3', 'v5.15/vfio/vfio-pci-core-v5' and 'v5.15/vfio/vfio-ap' into v5.15/vfio/next commit 6479f7588651cbc9c91e61c20ff39119cbc8feba Author: Pierre-Louis Bossart Date: Tue Aug 17 11:40:54 2021 -0500 ASoC: soc-pcm: test refcount before triggering On start/pause_release/resume, when more than one FE is connected to the same BE, it's possible that the trigger is sent more than once. This is not desirable, we only want to trigger a BE once, which is straightforward to implement with a refcount. For stop/pause/suspend, the problem is more complicated: the check implemented in snd_soc_dpcm_can_be_free_stop() may fail due to a conceptual deadlock when we trigger the BE before the FE. In this case, the FE states have not yet changed, so there are corner cases where the TRIGGER_STOP is never sent - the dual case of start where multiple triggers might be sent. This patch suggests an unconditional trigger in all cases, without checking the FE states, using a refcount protected by a spinlock. Signed-off-by: Pierre-Louis Bossart Message-Id: <20210817164054.250028-3-pierre-louis.bossart@linux.intel.com> Signed-off-by: Mark Brown commit 0c75fc7193387776c10f7c7b440d93496e3d5e21 Author: Pierre-Louis Bossart Date: Tue Aug 17 11:40:53 2021 -0500 ASoC: soc-pcm: protect BE dailink state changes in trigger When more than one FE is connected to a BE, e.g. in a mixing use case, the BE can be triggered multiple times when the FE are opened/started concurrently. This race condition is problematic in the case of SoundWire BE dailinks, and this is not desirable in a general case. The code carefully checks when the BE can be stopped or hw_free'ed, but the trigger code does not use any mutual exclusion. Fix by using the same spinlock already used to check FE states, and set the state before the trigger. In case of errors, the initial state will be restored. This patch does not change how the triggers are handled, it only makes sure the states are handled in critical sections. Signed-off-by: Pierre-Louis Bossart Message-Id: <20210817164054.250028-2-pierre-louis.bossart@linux.intel.com> Signed-off-by: Mark Brown commit d3efd26af2e044ff2b48d38bb871630282d77e60 Author: Christophe JAILLET Date: Mon Aug 16 07:25:28 2021 +0200 ASoC: wcd9335: Disable irq on slave ports in the remove function The probe calls 'wcd9335_setup_irqs()' to enable interrupts on all slave ports. This must be undone in the remove function. Add a 'wcd9335_teardown_irqs()' function that undoes 'wcd9335_setup_irqs()' function, and call it from the remove function. Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") Signed-off-by: Christophe JAILLET Message-Id: <8f761244d79bd4c098af8a482be9121d3a486d1b.1629091028.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Mark Brown commit fc6fc81caa63900cef9ebb8b2e365c3ed5a9effb Author: Christophe JAILLET Date: Mon Aug 16 07:25:20 2021 +0200 ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function If 'wcd9335_setup_irqs()' fails, me must release the memory allocated in 'wcd_clsh_ctrl_alloc()', as already done in the remove function. Add an error handling path and the missing 'wcd_clsh_ctrl_free()' call. Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") Signed-off-by: Christophe JAILLET Message-Id: <6dc12372f09fabb70bf05941dbe6a1382dc93e43.1629091028.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Mark Brown commit 7a6a723e98aa45f393e6add18f7309dfffa1b0e2 Author: Christophe JAILLET Date: Mon Aug 16 07:25:10 2021 +0200 ASoC: wcd9335: Fix a double irq free in the remove function There is no point in calling 'free_irq()' explicitly for 'WCD9335_IRQ_SLIMBUS' in the remove function. The irqs are requested in 'wcd9335_setup_irqs()' using a resource managed function (i.e. 'devm_request_threaded_irq()'). 'wcd9335_setup_irqs()' requests all what is defined in the 'wcd9335_irqs' structure. This structure has only one entry for 'WCD9335_IRQ_SLIMBUS'. So 'devm_request...irq()' + explicit 'free_irq()' would lead to a double free. Remove the unneeded 'free_irq()' from the remove function. Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec") Signed-off-by: Christophe JAILLET Message-Id: <0614d63bc00edd7e81dd367504128f3d84f72efa.1629091028.git.christophe.jaillet@wanadoo.fr> Signed-off-by: Mark Brown commit 7fa005caa35ed92563b9e9d88d319b2623763a77 Author: Max Gurtovoy Date: Thu Aug 26 13:39:12 2021 +0300 vfio/pci: Introduce vfio_pci_core.ko Now that vfio_pci has been split into two source modules, one focusing on the "struct pci_driver" (vfio_pci.c) and a toolbox library of code (vfio_pci_core.c), complete the split and move them into two different kernel modules. As before vfio_pci.ko continues to present the same interface under sysfs and this change will have no functional impact. Splitting into another module and adding exports allows creating new HW specific VFIO PCI drivers that can implement device specific functionality, such as VFIO migration interfaces or specialized device requirements. Signed-off-by: Max Gurtovoy Signed-off-by: Jason Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-14-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 85c94dcffcb775bafffd6e966db49253e1b789d9 Author: Jason Gunthorpe Date: Thu Aug 26 13:39:11 2021 +0300 vfio: Use kconfig if XX/endif blocks instead of repeating 'depends on' This results in less kconfig wordage and a simpler understanding of the required "depends on" to create the menu structure. The next patch increases the nesting level a lot so this is a nice preparatory simplification. Signed-off-by: Jason Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-13-yishaih@nvidia.com Signed-off-by: Alex Williamson commit ca4ddaac7fa710a250bbd650cc719425bec973a0 Author: Jason Gunthorpe Date: Thu Aug 26 13:39:10 2021 +0300 vfio: Use select for eventfd If VFIO_VIRQFD is required then turn on eventfd automatically. The majority of kconfig users of the EVENTFD use select not depends on. Signed-off-by: Jason Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-12-yishaih@nvidia.com Signed-off-by: Alex Williamson commit cc6711b0bf36de068b10490198d05ac168377989 Author: Max Gurtovoy Date: Thu Aug 26 13:39:09 2021 +0300 PCI / VFIO: Add 'override_only' support for VFIO PCI sub system Expose an 'override_only' helper macro (i.e. PCI_DRIVER_OVERRIDE_DEVICE_VFIO) for VFIO PCI sub system and add the required code to prefix its matching entries with "vfio_" in modules.alias file. It allows VFIO device drivers to include match entries in the modules.alias file produced by kbuild that are not used for normal driver autoprobing and module autoloading. Drivers using these match entries can be connected to the PCI device manually, by userspace, using the existing driver_override sysfs. For example the resulting modules.alias may have: alias pci:v000015B3d00001021sv*sd*bc*sc*i* mlx5_core alias vfio_pci:v000015B3d00001021sv*sd*bc*sc*i* mlx5_vfio_pci alias vfio_pci:v*d*sv*sd*bc*sc*i* vfio_pci In this example mlx5_core and mlx5_vfio_pci match to the same PCI device. The kernel will autoload and autobind to mlx5_core but the kernel and udev mechanisms will ignore mlx5_vfio_pci. When userspace wants to change a device to the VFIO subsystem it can implement a generic algorithm: 1) Identify the sysfs path to the device: /sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0 2) Get the modalias string from the kernel: $ cat /sys/bus/pci/devices/0000:01:00.0/modalias pci:v000015B3d00001021sv000015B3sd00000001bc02sc00i00 3) Prefix it with vfio_: vfio_pci:v000015B3d00001021sv000015B3sd00000001bc02sc00i00 4) Search modules.alias for the above string and select the entry that has the fewest *'s: alias vfio_pci:v000015B3d00001021sv*sd*bc*sc*i* mlx5_vfio_pci 5) modprobe the matched module name: $ modprobe mlx5_vfio_pci 6) cat the matched module name to driver_override: echo mlx5_vfio_pci > /sys/bus/pci/devices/0000:01:00.0/driver_override 7) unbind device from original module echo 0000:01:00.0 > /sys/bus/pci/devices/0000:01:00.0/driver/unbind 8) probe PCI drivers (or explicitly bind to mlx5_vfio_pci) echo 0000:01:00.0 > /sys/bus/pci/drivers_probe The algorithm is independent of bus type. In future the other buses with VFIO device drivers, like platform and ACPI, can use this algorithm as well. This patch is the infrastructure to provide the information in the modules.alias to userspace. Convert the only VFIO pci_driver which results in one new line in the modules.alias: alias vfio_pci:v*d*sv*sd*bc*sc*i* vfio_pci Later series introduce additional HW specific VFIO PCI drivers, such as mlx5_vfio_pci. Signed-off-by: Max Gurtovoy Signed-off-by: Jason Gunthorpe Acked-by: Bjorn Helgaas # for pci.h Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-11-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 343b7258687ecfbb363bfda8833a7cf641aac524 Author: Max Gurtovoy Date: Thu Aug 26 13:39:08 2021 +0300 PCI: Add 'override_only' field to struct pci_device_id Add 'override_only' field to struct pci_device_id to be used as part of pci_match_device(). When set, a driver only matches the entry when dev->driver_override is set to that driver. In addition, add a helper macro named 'PCI_DEVICE_DRIVER_OVERRIDE' to enable setting some data on it. Next patch from this series will use the above functionality. Signed-off-by: Max Gurtovoy Signed-off-by: Jason Gunthorpe Acked-by: Bjorn Helgaas Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-10-yishaih@nvidia.com Signed-off-by: Alex Williamson commit c61302aa48f7c46b5c9d893109488af951be12e4 Author: Yishai Hadas Date: Thu Aug 26 13:39:07 2021 +0300 vfio/pci: Move module parameters to vfio_pci.c This is a preparation before splitting vfio_pci.ko to 2 modules. As module parameters are a kind of uAPI they need to stay on vfio_pci.ko to avoid a user visible impact. For now continue to keep the implementation of these options in vfio_pci_core.c. Arguably they are vfio_pci functionality, but further splitting of vfio_pci_core.c will be better done in another series Signed-off-by: Yishai Hadas Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20210826103912.128972-9-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 2fb89f56a624fd74e6e15154f3e9fdceca98b784 Author: Max Gurtovoy Date: Thu Aug 26 13:39:06 2021 +0300 vfio/pci: Move igd initialization to vfio_pci.c igd is related to the vfio_pci pci_driver implementation, move it out of vfio_pci_core.c. This is preparation for splitting vfio_pci.ko into 2 drivers. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-8-yishaih@nvidia.com Signed-off-by: Alex Williamson commit ff53edf6d6ab0970f86595b3f5d179df51848723 Author: Max Gurtovoy Date: Thu Aug 26 13:39:05 2021 +0300 vfio/pci: Split the pci_driver code out of vfio_pci_core.c Split the vfio_pci driver into two logical parts, the 'struct pci_driver' (vfio_pci.c) which implements "Generic VFIO support for any PCI device" and a library of code (vfio_pci_core.c) that helps implementing a struct vfio_device on top of a PCI device. vfio_pci.ko continues to present the same interface under sysfs and this change should have no functional impact. Following patches will turn vfio_pci and vfio_pci_core into a separate module. This is a preparation for allowing another module to provide the pci_driver and allow that module to customize how VFIO is setup, inject its own operations, and easily extend vendor specific functionality. At this point the vfio_pci_core still contains a lot of vfio_pci functionality mixed into it. Following patches will move more of the large scale items out, but another cleanup series will be needed to get everything. Signed-off-by: Max Gurtovoy Signed-off-by: Jason Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-7-yishaih@nvidia.com Signed-off-by: Alex Williamson commit c39f8fa76cdd0c96f82fa785a0d6c92afe8f4a77 Author: Max Gurtovoy Date: Thu Aug 26 13:39:04 2021 +0300 vfio/pci: Include vfio header in vfio_pci_core.h The vfio_device structure is embedded into the vfio_pci_core_device structure, so there is no reason for not including the header file in the vfio_pci_core header as well. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-6-yishaih@nvidia.com Signed-off-by: Alex Williamson commit bf9fdc9a74cf61fe9f646c43eac4823481f1e20a Author: Max Gurtovoy Date: Thu Aug 26 13:39:03 2021 +0300 vfio/pci: Rename ops functions to fit core namings This is another preparation patch for separating the vfio_pci driver to a subsystem driver and a generic pci driver. This patch doesn't change any logic. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-5-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 536475109c82841126ca341ef0f138e7298880c1 Author: Max Gurtovoy Date: Thu Aug 26 13:39:02 2021 +0300 vfio/pci: Rename vfio_pci_device to vfio_pci_core_device This is a preparation patch for separating the vfio_pci driver to a subsystem driver and a generic pci driver. This patch doesn't change any logic. The new vfio_pci_core_device structure will be the main structure of the core driver and later on vfio_pci_device structure will be the main structure of the generic vfio_pci driver. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-4-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 9a389938695a068a3149c2d21a16c34b63ca002f Author: Max Gurtovoy Date: Thu Aug 26 13:39:01 2021 +0300 vfio/pci: Rename vfio_pci_private.h to vfio_pci_core.h This is a preparation patch for separating the vfio_pci driver to a subsystem driver and a generic pci driver. This patch doesn't change any logic. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-3-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 1cbd70fe37870b938463fd0a4a07e45fc4a3db3c Author: Max Gurtovoy Date: Thu Aug 26 13:39:00 2021 +0300 vfio/pci: Rename vfio_pci.c to vfio_pci_core.c This is a preparation patch for separating the vfio_pci driver to a subsystem driver and a generic pci driver. This patch doesn't change any logic. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20210826103912.128972-2-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 127c92feb74a6721f62587f1b89128808f049cf1 Merge: f80e21489590c f196ae282070d Author: Thomas Gleixner Date: Thu Aug 26 18:20:50 2021 +0200 Merge tag 'timers-v5.15' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull timer driver updates from Daniel Lezcano: - Prioritize the ARM architected timer on Exynos platform when the architecture is ARM64 (Will Deacon) - Mark the Exynos timer as a per CPU timer (Will Deacon) - DT conversion to yaml for the rockchip platform (Ezequiel Garcia) - Fix IRQ setup if there are two channels on the sh_cmt timer (Phong Hoang) - Use bitfield helper macros in the Ingenic timer (Zhou Yanjie) - Clear any pending interrupt to prevent an abort of the suspend on the Mediatek platform (Fengquan Chen) - Add DT bindings for new Ingenic SoCs (Zhou Yanjie) Link: https://lore.kernel.org/r/c14ad27a-b1c6-6043-0f5e-71dd984bb4ba@linaro.org commit 03b8df8d43ecc3c5724e6bfb80bc0b9ea2aa2612 Author: Darrick J. Wong Date: Sat Aug 21 19:24:53 2021 -0700 iomap: standardize tracepoint formatting and storage Print all the offset, pos, and length quantities in hexadecimal. While we're at it, update the types of the tracepoint structure fields to match the types of the values being recorded in them. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner commit 46d4703b1db4c86ab5acb2331b10df999f005e8e Author: Xiao Ni Date: Wed Aug 18 13:57:48 2021 +0800 md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard We are seeing the following warning in raid10_handle_discard. [ 695.110751] ============================= [ 695.131439] WARNING: suspicious RCU usage [ 695.151389] 4.18.0-319.el8.x86_64+debug #1 Not tainted [ 695.174413] ----------------------------- [ 695.192603] drivers/md/raid10.c:1776 suspicious rcu_dereference_check() usage! [ 695.225107] other info that might help us debug this: [ 695.260940] rcu_scheduler_active = 2, debug_locks = 1 [ 695.290157] no locks held by mkfs.xfs/10186. In the first loop of function raid10_handle_discard. It already determines which disk need to handle discard request and add the rdev reference count rdev->nr_pending. So the conf->mirrors will not change until all bios come back from underlayer disks. It doesn't need to use rcu_dereference to get rdev. Cc: stable@vger.kernel.org Fixes: d30588b2731f ('md/raid10: improve raid10 discard request') Signed-off-by: Xiao Ni Acked-by: Guoqing Jiang Signed-off-by: Song Liu commit 2eaf1635f9d62a2774c1c8114db24456dfd00721 Author: Takashi Iwai Date: Thu Aug 26 17:47:52 2021 +0200 ALSA: hda: Disable runtime resume at shutdown Although we modified the codec shutdown callback to perform runtime-suspend, it's still not fully effective, as this may be resumed again at any time later. For fixing such an unwanted resume, this patch replaces pm_runtime_suspend() with pm_runtime_force_suspend(), and call pm_runtime_disable() afterward. It assures to keep the device suspended. Also for code simplification, we apply the code unconditionally; when it's been already suspended, nothing would happen by calls of snd_pcm_suspend_all() and pm_runtime_force_suspend(), just proceed to pm_runtime_disable(). Fixes: b98444ed597d ("ALSA: hda: Suspend codec at shutdown") Reported-and-tested-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20210826154752.25674-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 307d522f5eb86cd6ac8c905f5b0577dedac54ec5 Author: Eric W. Biederman Date: Wed Jun 23 16:44:32 2021 -0500 signal/seccomp: Refactor seccomp signal and coredump generation Factor out force_sig_seccomp from the seccomp signal generation and place it in kernel/signal.c. The function force_sig_seccomp takes a parameter force_coredump to indicate that the sigaction field should be reset to SIGDFL so that a coredump will be generated when the signal is delivered. force_sig_seccomp is then used to replace both seccomp_send_sigsys and seccomp_init_siginfo. force_sig_info_to_task gains an extra parameter to force using the default signal action. With this change seccomp is no longer a special case and there becomes exactly one place do_coredump is called from. Further it no longer becomes necessary for __seccomp_filter to call do_group_exit. Acked-by: Kees Cook Link: https://lkml.kernel.org/r/87r1gr6qc4.fsf_-_@disp2133 Signed-off-by: "Eric W. Biederman" commit 1a0182785a6d2f9e626b861406bdd587642b218e Author: Xinhao Liu Date: Thu Aug 26 21:37:36 2021 +0800 RDMA/hns: Delete unnecessary blank lines. Just delete unnecessary blank lines. Link: https://lore.kernel.org/r/1629985056-57004-8-git-send-email-liangwenpeng@huawei.com Signed-off-by: Xinhao Liu Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit ae2854c5d318c8415e2f033b29fcfcb81a9e9aa7 Author: Yixing Liu Date: Thu Aug 26 21:37:35 2021 +0800 RDMA/hns: Encapsulate the qp db as a function Encapsulate qp db into two functions: user and kernel. Link: https://lore.kernel.org/r/1629985056-57004-7-git-send-email-liangwenpeng@huawei.com Signed-off-by: Yixing Liu Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 7fac71691b61777d938226d06e5034746d482ef3 Author: Wenpeng Liang Date: Thu Aug 26 21:37:34 2021 +0800 RDMA/hns: Adjust the order in which irq are requested and enabled It should first alloc workqueue and request irq, and finally enable irq. Link: https://lore.kernel.org/r/1629985056-57004-6-git-send-email-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit ab5cbb9d287ce72bd4bd6efea112f87ca34caa44 Author: Weihang Li Date: Thu Aug 26 21:37:33 2021 +0800 RDMA/hns: Remove RST2RST error prints for hw v1 There is no need to prints error for hw_v1. Link: https://lore.kernel.org/r/1629985056-57004-5-git-send-email-liangwenpeng@huawei.com Signed-off-by: Weihang Li Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit fe164fc8d7b246987c54841e0d4e929a72d837e8 Author: Wenpeng Liang Date: Thu Aug 26 21:37:32 2021 +0800 RDMA/hns: Remove dqpn filling when modify qp from Init to Init According to the IB specification, the destination qpn is allowed to be filled into the qpc only when the qp transitions from Init to RTR, so this code is unused. Link: https://lore.kernel.org/r/1629985056-57004-4-git-send-email-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit d2e0ccffcdd7209fc9881c8970d2a7e28dcb43b9 Author: Wenpeng Liang Date: Thu Aug 26 21:37:31 2021 +0800 RDMA/hns: Fix QP's resp incomplete assignment The resp passed to the user space represents the enable flag of qp, incomplete assignment will cause some features of the user space to be disabled. Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp") Fixes: aba457ca890c ("RDMA/hns: Support owner mode doorbell") Link: https://lore.kernel.org/r/1629985056-57004-3-git-send-email-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit e788a3cd5787aca74e0ee00202d4dca64b43f043 Author: Wenpeng Liang Date: Thu Aug 26 21:37:30 2021 +0800 RDMA/hns: Fix query destination qpn The bit width of dqpn is 24 bits, using u8 will cause truncation error. Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/1629985056-57004-2-git-send-email-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit a3616a3c02722d1edb95acc7fceade242f6553ba Author: Eric W. Biederman Date: Mon Jul 26 14:23:11 2021 -0500 signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die In the fpsp040 code when copyin or copyout fails call force_sigsegv(SIGSEGV) instead of do_exit(SIGSEGV). This solves a couple of problems. Because do_exit embeds the ptrace stop PTRACE_EVENT_EXIT a complete stack frame needs to be present for that to work correctly. There is always the information needed for a ptrace stop where get_signal is called. So exiting with a signal solves the ptrace issue. Further exiting with a signal ensures that all of the threads in a process are killed not just the thread that malfunctioned. Which avoids confusing userspace. To make force_sigsegv(SIGSEGV) work in fpsp040_die modify the code to save all of the registers and jump to ret_from_exception (which ultimately calls get_signal) after fpsp040_die returns. v2: Updated the branches to use gas's pseudo ops that automatically calculate the best branch instruction to use for the purpose. v1: https://lkml.kernel.org/r/87a6m8kgtx.fsf_-_@disp2133 Link: https://lkml.kernel.org/r/87tukghjfs.fsf_-_@disp2133 Acked-by: Geert Uytterhoeven Signed-off-by: "Eric W. Biederman" commit 57dbbe590f152e5e8a3ff8bf5ba163df34eeae0b Author: Leonardo Bras Date: Tue Aug 17 03:39:29 2021 -0300 powerpc/pseries/iommu: Rename "direct window" to "dma window" A previous change introduced the usage of DDW as a bigger indirect DMA mapping when the DDW available size does not map the whole partition. As most of the code that manipulates direct mappings was reused for indirect mappings, it's necessary to rename all names and debug/info messages to reflect that it can be used for both kinds of mapping. This should cause no behavioural change, just adjust naming. Signed-off-by: Leonardo Bras Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-12-leobras.c@gmail.com commit 381ceda88c4c4c8345cad1cffa6328892f15dca6 Author: Leonardo Bras Date: Tue Aug 17 03:39:28 2021 -0300 powerpc/pseries/iommu: Make use of DDW for indirect mapping So far it's assumed possible to map the guest RAM 1:1 to the bus, which works with a small number of devices. SRIOV changes it as the user can configure hundreds VFs and since phyp preallocates TCEs and does not allow IOMMU pages bigger than 64K, it has to limit the number of TCEs per a PE to limit waste of physical pages. As of today, if the assumed direct mapping is not possible, DDW creation is skipped and the default DMA window "ibm,dma-window" is used instead. By using DDW, indirect mapping can get more TCEs than available for the default DMA window, and also get access to using much larger pagesizes (16MB as implemented in qemu vs 4k from default DMA window), causing a significant increase on the maximum amount of memory that can be IOMMU mapped at the same time. Indirect mapping will only be used if direct mapping is not a possibility. For indirect mapping, it's necessary to re-create the iommu_table with the new DMA window parameters, so iommu_alloc() can use it. Removing the default DMA window for using DDW with indirect mapping is only allowed if there is no current IOMMU memory allocated in the iommu_table. enable_ddw() is aborted otherwise. Even though there won't be both direct and indirect mappings at the same time, we can't reuse the DIRECT64_PROPNAME property name, or else an older kexec()ed kernel can assume direct mapping, and skip iommu_alloc(), causing undesirable behavior. So a new property name DMA64_PROPNAME "linux,dma64-ddr-window-info" was created to represent a DDW that does not allow direct mapping. Signed-off-by: Leonardo Bras Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-11-leobras.c@gmail.com commit 8599395d34f2dd7b77bef42da1d99798e7a3d58f Author: Leonardo Bras Date: Tue Aug 17 03:39:27 2021 -0300 powerpc/pseries/iommu: Find existing DDW with given property name At the moment pseries stores information about created directly mapped DDW window in DIRECT64_PROPNAME. With the objective of implementing indirect DMA mapping with DDW, it's necessary to have another propriety name to make sure kexec'ing into older kernels does not break, as it would if we reuse DIRECT64_PROPNAME. In order to have this, find_existing_ddw_windows() needs to be able to look for different property names. Extract find_existing_ddw_windows() into find_existing_ddw_windows_named() and calls it with current property name. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-10-leobras.c@gmail.com commit a5fd95120c653962a9e75e260a35436b96d2c991 Author: Leonardo Bras Date: Tue Aug 17 03:39:26 2021 -0300 powerpc/pseries/iommu: Update remove_dma_window() to accept property name Update remove_dma_window() so it can be used to remove DDW with a given property name. This enables the creation of new property names for DDW, so we can have different usage for it, like indirect mapping. Also, add return values to it so we can check if the property was found while removing the active DDW. This allows skipping the remaining property names while reducing the impact of multiple property names. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-9-leobras.c@gmail.com commit fc8cba8f989fb98e496b33a78476861e246c42a0 Author: Leonardo Bras Date: Tue Aug 17 03:39:25 2021 -0300 powerpc/pseries/iommu: Reorganize iommu_table_setparms*() with new helper Add a new helper _iommu_table_setparms(), and use it in iommu_table_setparms() and iommu_table_setparms_lpar() to avoid duplicated code. Also, setting tbl->it_ops was happening outsite iommu_table_setparms*(), so move it to the new helper. Since we need the iommu_table_ops to be declared before used, declare iommu_table_lpar_multi_ops and iommu_table_pseries_ops to before their respective iommu_table_setparms*(). Signed-off-by: Leonardo Bras Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-8-leobras.c@gmail.com commit 7ed2ed2db2685a285cb09ab330dc4efea0b64022 Author: Leonardo Bras Date: Tue Aug 17 03:39:24 2021 -0300 powerpc/pseries/iommu: Add ddw_property_create() and refactor enable_ddw() Code used to create a ddw property that was previously scattered in enable_ddw() is now gathered in ddw_property_create(), which deals with allocation and filling the property, letting it ready for of_property_add(), which now occurs in sequence. This created an opportunity to reorganize the second part of enable_ddw(): Without this patch enable_ddw() does, in order: kzalloc() property & members, create_ddw(), fill ddwprop inside property, ddw_list_new_entry(), do tce_setrange_multi_pSeriesLP_walk in all memory, of_add_property(), and list_add(). With this patch enable_ddw() does, in order: create_ddw(), ddw_property_create(), of_add_property(), ddw_list_new_entry(), do tce_setrange_multi_pSeriesLP_walk in all memory, and list_add(). This change requires of_remove_property() in case anything fails after of_add_property(), but we get to do tce_setrange_multi_pSeriesLP_walk in all memory, which looks the most expensive operation, only if everything else succeeds. Also, the error path got remove_ddw() replaced by a new helper __remove_dma_window(), which only removes the new DDW with an rtas-call. For this, a new helper clean_dma_window() was needed to clean anything that could left if walk_system_ram_range() fails. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-7-leobras.c@gmail.com commit 2ca73c54ce24489518a56d816331b774044c2445 Author: Leonardo Bras Date: Tue Aug 17 03:39:23 2021 -0300 powerpc/pseries/iommu: Allow DDW windows starting at 0x00 enable_ddw() currently returns the address of the DMA window, which is considered invalid if has the value 0x00. Also, it only considers valid an address returned from find_existing_ddw if it's not 0x00. Changing this behavior makes sense, given the users of enable_ddw() only need to know if direct mapping is possible. It can also allow a DMA window starting at 0x00 to be used. This will be helpful for using a DDW with indirect mapping, as the window address will be different than 0x00, but it will not map the whole partition. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-6-leobras.c@gmail.com commit 92a23219299cedde52e3298788484f4875d5ce0f Author: Leonardo Bras Date: Tue Aug 17 03:39:22 2021 -0300 powerpc/pseries/iommu: Add ddw_list_new_entry() helper There are two functions creating direct_window_list entries in a similar way, so create a ddw_list_new_entry() to avoid duplicity and simplify those functions. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-5-leobras.c@gmail.com commit 4ff8677a0b192a58d998d1d34fc5168203041a24 Author: Leonardo Bras Date: Tue Aug 17 03:39:21 2021 -0300 powerpc/pseries/iommu: Add iommu_pseries_alloc_table() helper Creates a helper to allow allocating a new iommu_table without the need to reallocate the iommu_group. This will be helpful for replacing the iommu_table for the new DMA window, after we remove the old one with iommu_tce_table_put(). Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-4-leobras.c@gmail.com commit 3c33066a21903076722a2881556a92aa3cd7d359 Author: Leonardo Bras Date: Tue Aug 17 03:39:20 2021 -0300 powerpc/kernel/iommu: Add new iommu_table_in_use() helper Having a function to check if the iommu table has any allocation helps deciding if a tbl can be reset for using a new DMA window. It should be enough to replace all instances of !bitmap_empty(tbl...). iommu_table_in_use() skips reserved memory, so we don't need to worry about releasing it before testing. This causes iommu_table_release_pages() to become unnecessary, given it is only used to remove reserved memory for testing. Also, only allow storing reserved memory values in tbl if they are valid in the table, so there is no need to check it in the new helper. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-3-leobras.c@gmail.com commit 0c634bafe3bbee7a36dca7f1277057e05bf14d91 Author: Leonardo Bras Date: Tue Aug 17 03:39:19 2021 -0300 powerpc/pseries/iommu: Replace hard-coded page shift Some functions assume IOMMU page size can only be 4K (pageshift == 12). Update them to accept any page size passed, so we can use 64K pages. In the process, some defines like TCE_SHIFT were made obsolete, and then removed. IODA3 Revision 3.0_prd1 (OpenPowerFoundation), Figures 3.4 and 3.5 show a RPN of 52-bit, and considers a 12-bit pageshift, so there should be no need of using TCE_RPN_MASK, which masks out any bit after 40 in rpn. It's usage removed from tce_build_pSeries(), tce_build_pSeriesLP(), and tce_buildmulti_pSeriesLP(). Most places had a tbl struct, so using tbl->it_page_shift was simple. tce_free_pSeriesLP() was a special case, since callers not always have a tbl struct, so adding a tceshift parameter seems the right thing to do. Signed-off-by: Leonardo Bras Reviewed-by: Alexey Kardashevskiy Reviewed-by: Frederic Barrat Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210817063929.38701-2-leobras.c@gmail.com commit 9a245d0e1f006bc7ccf0285d0d520ed304d00c4a Author: Srikar Dronamraju Date: Thu Aug 26 15:35:20 2021 +0530 powerpc/numa: Update cpu_cpu_map on CPU online/offline cpu_cpu_map holds all the CPUs in the DIE. However in PowerPC, when onlining/offlining of CPUs, this mask doesn't get updated. This mask is however updated when CPUs are added/removed. So when both operations like online/offline of CPUs and adding/removing of CPUs are done simultaneously, then cpumaps end up broken. WARNING: CPU: 13 PID: 1142 at kernel/sched/topology.c:898 build_sched_domains+0xd48/0x1720 Modules linked in: rpadlpar_io rpaphp mptcp_diag xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag bonding tls nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set rfkill nf_tables nfnetlink pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 13 PID: 1142 Comm: kworker/13:2 Not tainted 5.13.0-rc6+ #28 Workqueue: events cpuset_hotplug_workfn NIP: c0000000001caac8 LR: c0000000001caac4 CTR: 00000000007088ec REGS: c00000005596f220 TRAP: 0700 Not tainted (5.13.0-rc6+) MSR: 8000000000029033 CR: 48828222 XER: 00000009 CFAR: c0000000001ea698 IRQMASK: 0 GPR00: c0000000001caac4 c00000005596f4c0 c000000001c4a400 0000000000000036 GPR04: 00000000fffdffff c00000005596f1d0 0000000000000027 c0000018cfd07f90 GPR08: 0000000000000023 0000000000000001 0000000000000027 c0000018fe68ffe8 GPR12: 0000000000008000 c00000001e9d1880 c00000013a047200 0000000000000800 GPR16: c000000001d3c7d0 0000000000000240 0000000000000048 c000000010aacd18 GPR20: 0000000000000001 c000000010aacc18 c00000013a047c00 c000000139ec2400 GPR24: 0000000000000280 c000000139ec2520 c000000136c1b400 c000000001c93060 GPR28: c00000013a047c20 c000000001d3c6c0 c000000001c978a0 000000000000000d NIP [c0000000001caac8] build_sched_domains+0xd48/0x1720 LR [c0000000001caac4] build_sched_domains+0xd44/0x1720 Call Trace: [c00000005596f4c0] [c0000000001caac4] build_sched_domains+0xd44/0x1720 (unreliable) [c00000005596f670] [c0000000001cc5ec] partition_sched_domains_locked+0x3ac/0x4b0 [c00000005596f710] [c0000000002804e4] rebuild_sched_domains_locked+0x404/0x9e0 [c00000005596f810] [c000000000283e60] rebuild_sched_domains+0x40/0x70 [c00000005596f840] [c000000000284124] cpuset_hotplug_workfn+0x294/0xf10 [c00000005596fc60] [c000000000175040] process_one_work+0x290/0x590 [c00000005596fd00] [c0000000001753c8] worker_thread+0x88/0x620 [c00000005596fda0] [c000000000181704] kthread+0x194/0x1a0 [c00000005596fe10] [c00000000000ccec] ret_from_kernel_thread+0x5c/0x70 Instruction dump: 485af049 60000000 2fa30800 409e0028 80fe0000 e89a00f8 e86100e8 38da0120 7f88e378 7ce53b78 4801fb91 60000000 <0fe00000> 39000000 38e00000 38c00000 Fix this by updating cpu_cpu_map aka cpumask_of_node() on every CPU online/offline. Signed-off-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100521.412639-5-srikar@linux.vnet.ibm.com commit 544a09ee7434b949552266d20ece538d35535bd5 Author: Srikar Dronamraju Date: Thu Aug 26 15:35:19 2021 +0530 powerpc/numa: Print debug statements only when required Currently, a debug message gets printed every time an attempt to add(remove) a CPU. However this is redundant if the CPU is already added (removed) from the node. Signed-off-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100521.412639-4-srikar@linux.vnet.ibm.com commit 506c2075ffd8db352c53201ef166948a272e3bce Author: Srikar Dronamraju Date: Thu Aug 26 15:35:18 2021 +0530 powerpc/numa: convert printk to pr_xxx Convert the remaining printk to pr_xxx One advantage would be all prints will now have prefix "numa:" from pr_fmt(). [ convert printk(KERN_ERR) to pr_warn : Suggested by Laurent Dufour ] Suggested-by: Michael Ellerman Signed-off-by: Srikar Dronamraju [mpe: Rebase onto powerpc/next, s/WARNING/Warning/] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100521.412639-3-srikar@linux.vnet.ibm.com commit 544af6429777cefae2f8af9a9866df5e8cb21763 Author: Srikar Dronamraju Date: Thu Aug 26 15:35:17 2021 +0530 powerpc/numa: Drop dbg in favour of pr_debug powerpc supported numa=debug which is not documented. This option was used to print early debug output. However something more flexible can be achieved by using CONFIG_DYNAMIC_DEBUG. Hence drop dbg (and numa=debug) in favour of pr_debug Suggested-by: Michael Ellerman Signed-off-by: Srikar Dronamraju [mpe: Rebase on to powerpc/next form2 affinity changes] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100521.412639-2-srikar@linux.vnet.ibm.com commit 5bf63497b8ddf53d8973f68076119e482639b2bb Author: Srikar Dronamraju Date: Thu Aug 26 15:34:01 2021 +0530 powerpc/smp: Enable CACHE domain for shared processor Currently CACHE domain is not enabled on shared processor mode PowerVM LPARS. On PowerVM systems, 'ibm,thread-group' device-tree property 2 under cpu-device-node indicates which all CPUs share L2-cache. However 'ibm,thread-group' device-tree property 2 is a relatively new property. In absence of 'ibm,thread-group' property 2, 'l2-cache' device property under cpu-device-node could help system to identify CPUs sharing L2-cache. However this property is not exposed by PhyP in shared processor mode configurations. In absence of properties that inform OS about which CPUs share L2-cache, fallback on core boundary. Here are some stats from Power9 shared LPAR with the changes. $ lscpu Architecture: ppc64le Byte Order: Little Endian CPU(s): 32 On-line CPU(s) list: 0-31 Thread(s) per core: 8 Core(s) per socket: 1 Socket(s): 3 NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K NUMA node0 CPU(s): 16-23 NUMA node1 CPU(s): 0-15,24-31 Physical sockets: 2 Physical chips: 1 Physical cores/chip: 10 Before patch $ grep -r . /sys/kernel/debug/sched/domains/cpu0/domain*/name Before /sys/kernel/debug/sched/domains/cpu0/domain0/name:SMT /sys/kernel/debug/sched/domains/cpu0/domain1/name:DIE /sys/kernel/debug/sched/domains/cpu0/domain2/name:NUMA After /sys/kernel/debug/sched/domains/cpu0/domain0/name:SMT /sys/kernel/debug/sched/domains/cpu0/domain1/name:CACHE /sys/kernel/debug/sched/domains/cpu0/domain2/name:DIE /sys/kernel/debug/sched/domains/cpu0/domain3/name:NUMA $ awk '/domain/{print $1, $2}' /proc/schedstat | sort -u | sed -e 's/00000000,//g' Before domain0 00000055 domain0 000000aa domain0 00005500 domain0 0000aa00 domain0 00550000 domain0 00aa0000 domain0 55000000 domain0 aa000000 domain1 00ff0000 domain1 ff00ffff domain2 ffffffff After domain0 00000055 domain0 000000aa domain0 00005500 domain0 0000aa00 domain0 00550000 domain0 00aa0000 domain0 55000000 domain0 aa000000 domain1 000000ff domain1 0000ff00 domain1 00ff0000 domain1 ff000000 domain2 ff00ffff domain2 ffffffff domain3 ffffffff (Lower is better) perf stat -a -r 5 -n perf bench sched pipe | tail -n 2 Before 153.798 +- 0.142 seconds time elapsed ( +- 0.09% ) After 111.545 +- 0.652 seconds time elapsed ( +- 0.58% ) which is an improvement of 27.47% Signed-off-by: Srikar Dronamraju Reviewed-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100401.412519-4-srikar@linux.vnet.ibm.com commit b8b928030332a0ca16d42433eb2c3085600d8704 Author: Srikar Dronamraju Date: Thu Aug 26 15:34:00 2021 +0530 powerpc/smp: Update cpu_core_map on all PowerPc systems lscpu() uses core_siblings to list the number of sockets in the system. core_siblings is set using topology_core_cpumask. While optimizing the powerpc bootup path, Commit 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask"). it was found that updating cpu_core_mask() ended up taking a lot of time. It was thought that on Powerpc, cpu_core_mask() would always be same as cpu_cpu_mask() i.e number of sockets will always be equal to number of nodes. As an optimization, cpu_core_mask() was made a snapshot of cpu_cpu_mask(). However that was found to be false with PowerPc KVM guests, where each node could have more than one socket. So with Commit c47f892d7aa6 ("powerpc/smp: Reintroduce cpu_core_mask"), cpu_core_mask was updated based on chip_id but in an optimized way using some mask manipulations and chip_id caching. However on non-PowerNV and non-pseries KVM guests (i.e not implementing cpu_to_chip_id(), continued to use a copy of cpu_cpu_mask(). There are two issues that were noticed on such systems 1. lscpu would report one extra socket. On a IBM,9009-42A (aka zz system) which has only 2 chips/ sockets/ nodes, lscpu would report Architecture: ppc64le Byte Order: Little Endian CPU(s): 160 On-line CPU(s) list: 0-159 Thread(s) per core: 8 Core(s) per socket: 6 Socket(s): 3 <-------------- NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K L2 cache: 512K L3 cache: 10240K NUMA node0 CPU(s): 0-79 NUMA node1 CPU(s): 80-159 2. Currently cpu_cpu_mask is updated when a core is added/removed. However its not updated when smt mode switching or on CPUs are explicitly offlined. However all other percpu masks are updated to ensure only active/online CPUs are in the masks. This results in build_sched_domain traces since there will be CPUs in cpu_cpu_mask() but those CPUs are not present in SMT / CACHE / MC / NUMA domains. A loop of threads running smt mode switching and core add/remove will soon show this trace. Hence cpu_cpu_mask has to be update at smt mode switch. This will have impact on cpu_core_mask(). cpu_core_mask() is a snapshot of cpu_cpu_mask. Different CPUs within the same socket will end up having different cpu_core_masks since they are snapshots at different points of time. This means when lscpu will start reporting many more sockets than the actual number of sockets/ nodes / chips. Different ways to handle this problem: A. Update the snapshot aka cpu_core_mask for all CPUs whenever cpu_cpu_mask is updated. This would a non-optimal solution. B. Instead of a cpumask_var_t, make cpu_core_map a cpumask pointer pointing to cpu_cpu_mask. However percpu cpumask pointer is frowned upon and we need a clean way to handle PowerPc KVM guest which is not a snapshot. C. Update cpu_core_masks all PowerPc systems like in PowerPc KVM guests using mask manipulations. This approach is relatively simple and unifies with the existing code. D. On top of 3, we could also resurrect get_physical_package_id which could return a nid for the said CPU. However this is not needed at this time. Option C is the preferred approach for now. While this is somewhat a revert of Commit 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask"). 1. Plain revert has some conflicts 2. For chip_id == -1, the cpu_core_mask is made identical to cpu_cpu_mask, unlike previously where cpu_core_mask was set to a core if chip_id doesn't exist. This goes by the principle that if chip_id is not exposed, then sockets / chip / node share the same set of CPUs. With the fix, lscpu o/p would be Architecture: ppc64le Byte Order: Little Endian CPU(s): 160 On-line CPU(s) list: 0-159 Thread(s) per core: 8 Core(s) per socket: 6 Socket(s): 2 <-------------- NUMA node(s): 2 Model: 2.2 (pvr 004e 0202) Model name: POWER9 (architected), altivec supported Hypervisor vendor: pHyp Virtualization type: para L1d cache: 32K L1i cache: 32K L2 cache: 512K L3 cache: 10240K NUMA node0 CPU(s): 0-79 NUMA node1 CPU(s): 80-159 Fixes: 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask") Signed-off-by: Srikar Dronamraju Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100401.412519-3-srikar@linux.vnet.ibm.com commit 8efd249babea2fec268cff90b9f5ca723dbb7499 Author: Srikar Dronamraju Date: Thu Aug 26 15:33:59 2021 +0530 powerpc/smp: Fix a crash while booting kvm guest with nr_cpus=2 Aneesh reported a crash with a fairly recent upstream kernel when booting kernel whose commandline was appended with nr_cpus=2 1:mon> e cpu 0x1: Vector: 300 (Data Access) at [c000000008a67bd0] pc: c00000000002557c: cpu_to_chip_id+0x3c/0x100 lr: c000000000058380: start_secondary+0x460/0xb00 sp: c000000008a67e70 msr: 8000000000001033 dar: 10 dsisr: 80000 current = 0xc00000000891bb00 paca = 0xc0000018ff981f80 irqmask: 0x03 irq_happened: 0x01 pid = 0, comm = swapper/1 Linux version 5.13.0-rc3-15704-ga050a6d2b7e8 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #433 SMP Tue May 25 02:38:49 CDT 2021 1:mon> t [link register ] c000000000058380 start_secondary+0x460/0xb00 [c000000008a67e70] c000000008a67eb0 (unreliable) [c000000008a67eb0] c0000000000589d4 start_secondary+0xab4/0xb00 [c000000008a67f90] c00000000000c654 start_secondary_prolog+0x10/0x14 Current code assumes that num_possible_cpus() is always greater than threads_per_core. However this may not be true when using nr_cpus=2 or similar options. Handle the case where num_possible_cpus() is not an exact multiple of threads_per_core. Fixes: c1e53367dab1 ("powerpc/smp: Cache CPU to chip lookup") Reported-by: Aneesh Kumar K.V Signed-off-by: Srikar Dronamraju Debugged-by: Michael Ellerman Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826100401.412519-2-srikar@linux.vnet.ibm.com commit 3e18e271182206c996a3a7efbbe70c66307ef137 Author: Joel Stanley Date: Thu Aug 26 21:56:53 2021 +0930 powerpc/configs/microwatt: Enable options for systemd When booting with systemd these options are required. This increases the image by about 50KB, or 2%. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826122653.3236867-4-joel@jms.id.au commit ef4fcaf99cd27eb48790f2adc4eff456dbe1dec4 Author: Joel Stanley Date: Thu Aug 26 21:56:52 2021 +0930 powerpc/configs/microwattt: Enable Liteeth Liteeth is the network device used by Microwatt. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826122653.3236867-3-joel@jms.id.au commit 602d0f96563c2e0b8e1ddb22ac46bf7f58480d64 Author: Joel Stanley Date: Thu Aug 26 21:56:51 2021 +0930 powerpc/microwatt: Add Ethernet to device tree The liteeth network device is used in the Microwatt soc. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210826122653.3236867-2-joel@jms.id.au commit 8149238ffd210875f5a77e3c654bb59b58da35e3 Author: Christophe Leroy Date: Wed Aug 25 13:34:45 2021 +0000 powerpc: Redefine HMT_xxx macros as empty on PPC32 HMT_xxx macros are macros for adjusting thread priority (hardware multi-threading) are macros inherited from PPC64 via commit 5f7c690728ac ("[PATCH] powerpc: Merged ppc_asm.h") Those instructions are pointless on PPC32, but some common fonctions like arch_cpu_idle() use them. So make them empty on PPC32 to avoid those instructions. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c5a07fadea33d640ad10cecf0ac8faaec1c524e0.1629898474.git.christophe.leroy@csgroup.eu commit f50da6edbf1ebf35dd8070847bfab5cb988d472b Author: Aneesh Kumar K.V Date: Wed Aug 25 09:54:47 2021 +0530 powerpc/doc: Fix htmldocs errors Fix make htmldocs related errors with the newly added associativity.rst doc file. Reported-by: Stephen Rothwell Tested-by: Stephen Rothwell # build test Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210825042447.106219-1-aneesh.kumar@linux.ibm.com commit 627e66f29aa28f267395aab0dabc1c757d84aead Merge: 465e333e77a69 5bd4ae07e7970 Author: Michael Ellerman Date: Fri Aug 27 00:49:06 2021 +1000 Merge changes from Paul Gortmaker Merge the changes to retire the legacy WR sbc8548 and sbc8641 platforms from Paul. These were sent as a pull request, but I rebased them onto rc2 so as not to pull too many unrelated changes in to my next. Description from Paul's pull request follows: In v2.6.27 (2008, 917f0af9e5a9) the sbc8260 support was implicitly retired by not being carried forward through the ppc --> powerpc device tree transition. Then, in v3.6 (2012, b048b4e17cbb) we retired the support for the sbc8560 boards. Next, in v4.18 (2017, 3bc6cf5a86e5) we retired the support for the 2006 vintage sbc834x boards. The sbc8548 and sbc8641d boards were maybe 1-2 years newer than the sbc834x boards, but it is also 3+ years later, so it makes sense to now retire them as well - which is what is done here. These two remaining WR boards were based on the Freescale MPC8548-CDS and the MPC8641D-HPCN reference board implementations. Having had the chance to use these and many other Fsl ref boards, I know this: The Freescale reference boards were typically produced in limited quantity and primarily available to BSP developers and hardware designers, and not likely to have found a 2nd life with hobbyists and/or collectors. It was good to have that BSP code subjected to mainline review and hence also widely available back in the day. But given the above, we should probably also be giving serious consideration to retiring additional similar age/type reference board platforms as well. I've always felt it is important for us to be proactive in retiring old code, since it has a genuine non-zero carrying cost, as described in the 930d52c012b8 merge log. But for the here and now, we just clean up the remaining BSP code that I had added for SBC platforms. Link: https://lore.kernel.org/r/20210824174209.GB160508@windriver.com commit 5bd4ae07e7970d73e3372910e60bb38623ac3064 Author: Paul Gortmaker Date: Thu Jan 7 14:18:59 2021 -0500 MAINTAINERS: update for Paul Gortmaker Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman commit d7c1814f2f4f812d7a39447f975abdc095dbf7aa Author: Paul Gortmaker Date: Thu Jan 7 13:45:32 2021 -0500 powerpc: retire sbc8641d board support The support was for this was added to mainline over 12 years ago, in v2.6.26 [4e8aae89a35d] just around the ppc --> powerpc migration. I believe the board was introduced shortly after the sbc8548 board, making it roughly a 14 year old platform - with the CPU speed and memory size typical for that era. I haven't had one of these boards for several years, and availability was discontinued several years before that. Given that, there is no point in adding a burden to testing coverage that builds all possible defconfigs, so it makes sense to remove it. Of course it will remain in the git history forever, for anyone who happens to find a functional board and wants to tinker with it. Acked-by: Scott Wood Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman commit c12adb0678446b3284a6135dc5fa7aa3b6a968a5 Author: Paul Gortmaker Date: Thu Jan 7 08:40:38 2021 -0500 powerpc: retire sbc8548 board support The support was for this was mainlined 13 years ago, in v2.6.25 [0e0fffe88767] just around the ppc --> powerpc migration. I believe the board was introduced a year or two before that, so it is roughly a 15 year old platform - with the CPU speed and memory size that was typical for that era. I haven't had one of these boards for several years, and availability was discontinued several years before that. Given that, there is no point in adding a burden to testing coverage that builds all possible defconfigs, so it makes sense to remove it. Of course it will remain in the git history forever, for anyone who happens to find a functional board and wants to tinker with it. Acked-by: Scott Wood Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman commit 6e9c846aa0c53673c5d53925a6122aa0e53a9795 Merge: d5f78f50fff3c 26cfc0dbe43aa Author: Mark Brown Date: Thu Aug 26 15:09:52 2021 +0100 Merge remote-tracking branch 'spi/for-5.15' into spi-next commit d5f78f50fff3c69915bde28be901b8da56da7e06 Merge: e22ce8eb631bd ea4ab99cb58cc Author: Mark Brown Date: Thu Aug 26 15:09:50 2021 +0100 Merge remote-tracking branch 'spi/for-5.14' into spi-linus commit 0487d4fc42d7f31a56cfd9e2237f9ebd889e6112 Author: Hans de Goede Date: Thu Aug 26 16:08:22 2021 +0200 platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call As pointed out be Kees Cook if we return -EIO because the obj->type != ACPI_TYPE_BUFFER, then we must kfree the output buffer before the return. Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver") Reported-by: Kees Cook Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20210826140822.71198-1-hdegoede@redhat.com commit 515b436be291ff197c52198282bbb19e79c9d197 Merge: dac825b6a6bdc 917f07719b133 Author: Mark Brown Date: Thu Aug 26 15:08:30 2021 +0100 Merge series "Patches to update for rockchip i2s" from Sugar Zhang : These patches fixup or update for rockchip i2s. Changes in v3: - Drop property 'rockchip,playback-only', 'rockchip,capture-only'. Implement it by 'dma-names' of DT instead. Changes in v2: - split property trcm into single 'trcm-sync-tx-only' and 'trcm-sync-rx-only' suggested by Nicolas. - split property trcm into single 'trcm-sync-tx-only' and 'trcm-sync-rx-only' suggested by Nicolas. - drop change-id Sugar Zhang (12): ASoC: rockchip: i2s: Add support for set bclk ratio ASoC: rockchip: i2s: Fixup clk div error ASoC: rockchip: i2s: Improve dma data transfer efficiency ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Fix concurrency between tx/rx ASoC: rockchip: i2s: Reset the controller if soft reset failed ASoC: dt-bindings: rockchip: Document reset property for i2s ASoC: rockchip: i2s: Make playback/capture optional ASoC: rockchip: i2s: Add compatible for more SoCs ASoC: dt-bindings: rockchip: Add compatible strings for more SoCs ASoC: rockchip: i2s: Add support for frame inversion ASoC: dt-bindings: rockchip: i2s: Document property TRCM Xiaotan Luo (1): ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B Xing Zheng (1): ASoC: rockchip: i2s: Add support for TRCM property .../devicetree/bindings/sound/rockchip-i2s.yaml | 19 ++ sound/soc/rockchip/rockchip_i2s.c | 278 +++++++++++++++------ sound/soc/rockchip/rockchip_i2s.h | 10 +- 3 files changed, 224 insertions(+), 83 deletions(-) -- 2.7.4 commit dac825b6a6bdca41347e25f07354ad94fdc97445 Merge: 11a08e05079a9 e79ef3c2cfe0b Author: Mark Brown Date: Thu Aug 26 15:08:28 2021 +0100 Merge series "Patches to update for rockchip spdif" from Sugar Zhang : These patches fixup or update for rockchip spdif. Sugar Zhang (4): ASoC: rockchip: spdif: Mark SPDIF_SMPDR as volatile ASoC: rockchip: spdif: Fix some coding style ASoC: rockchip: spdif: Add support for rk3568 spdif ASoC: dt-bindings: rockchip: Add compatible for rk3568 spdif .../devicetree/bindings/sound/rockchip-spdif.yaml | 1 + sound/soc/rockchip/rockchip_spdif.c | 38 ++++++++++++---------- 2 files changed, 22 insertions(+), 17 deletions(-) -- 2.7.4 commit fb49d9946f96081f9a05d8f305b3f40285afe4a9 Author: Kees Cook Date: Wed Aug 25 09:07:49 2021 -0700 platform/x86: dell-smbios-wmi: Avoid false-positive memcpy() warning In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Since all the size checking has already happened, use input.pointer (void *) so memcpy() doesn't get confused about how much is being written. Avoids this false-positive warning when run-time memcpy() strict bounds checking is enabled: memcpy: detected field-spanning write (size 4096) of single field (size 36) WARNING: CPU: 0 PID: 357 at drivers/platform/x86/dell/dell-smbios-wmi.c:74 run_smbios_call+0x110/0x1e0 [dell_smbios] Cc: Hans de Goede Cc: Mark Gross Cc: Mario Limonciello Cc: "Pali Rohár" Cc: Andy Shevchenko Cc: "Uwe Kleine-König" Cc: Dell.Client.Kernel@dell.com Cc: platform-driver-x86@vger.kernel.org Reported-by: Andy Lavr Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210825160749.3891090-1-keescook@chromium.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 55879dc4d095232609fe81498c1b43f042708eef Author: Dan Carpenter Date: Wed Aug 25 10:23:57 2021 +0300 platform/x86: ISST: use semi-colons instead of commas The code works the same either way, but it's better to use semi-colons to separate statements. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210825072357.GA12957@kili Signed-off-by: Hans de Goede commit 828857f6709f1b13582049a1ef84eadb07f50c05 Author: Jiapeng Chong Date: Wed Aug 25 18:37:02 2021 +0800 platform/x86: asus-wmi: Fix "unsigned 'retval' is never less than zero" smatch warning Eliminate the follow smatch warnings: drivers/platform/x86/asus-wmi.c:478 panel_od_write() warn: unsigned 'retval' is never less than zero. drivers/platform/x86/asus-wmi.c:566 panel_od_write() warn: unsigned 'retval' is never less than zero. drivers/platform/x86/asus-wmi.c:1451 panel_od_write() warn: unsigned 'retval' is never less than zero. Reported-by: Abaci Robot Fixes: 98829e84dc67 ("asus-wmi: Add dgpu disable method") Fixes: 382b91db8044 ("asus-wmi: Add egpu enable method") Fixes: ca91ea34778f ("asus-wmi: Add panel overdrive functionality") Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/1629887822-23918-1-git-send-email-jiapeng.chong@linux.alibaba.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit b72067c64b226fc42fd5262cfbb675ec68fb4934 Author: Dan Carpenter Date: Tue Aug 24 14:36:54 2021 +0300 platform/x86: asus-wmi: Delete impossible condition The "asus->throttle_thermal_policy_mode" variable is a u8 so it can't be negative. And we always verify that the value is valid before setting the policy mode so there is no need to check again here. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210824113654.GA31143@kili Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8ebcb6c94c712ee15679c8ee6a40598077b9a9af Author: Andy Shevchenko Date: Mon Aug 23 12:32:22 2021 +0300 platform/x86: hp_accel: Convert to be a platform driver ACPI core in conjunction with platform driver core provides an infrastructure to enumerate ACPI devices. Use it in order to remove a lot of boilerplate code. Signed-off-by: Andy Shevchenko Tested-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20210823093222.19544-3-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 34570a898eef01b5311bfc9c448877eb717d3285 Author: Andy Shevchenko Date: Mon Aug 23 12:32:21 2021 +0300 platform/x86: hp_accel: Remove _INI method call According to ACPI specification the _INI method must be called when device is enumerated first time. After that there is no need to repeat the procedure. Convert the lis3lv02d_acpi_init() to be a stub (Note, we may not remove it because it is called unconditionally by the accelerometer main driver). Signed-off-by: Andy Shevchenko Tested-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20210823093222.19544-2-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 917f07719b133093680ed57dd7b5bc30b6a5b45d Author: Sugar Zhang Date: Thu Aug 26 12:03:12 2021 +0800 ASoC: rockchip: i2s: Add support for frame inversion This patch adds support for frame inversion. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950594-14345-2-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit d5ceed036f7cde29bf17173e9a9c8bbde0a70389 Author: Sugar Zhang Date: Thu Aug 26 12:03:11 2021 +0800 ASoC: dt-bindings: rockchip: Add compatible strings for more SoCs This patch adds compatible strings for more SoCs. Signed-off-by: Sugar Zhang Acked-by: Rob Herring Link: https://lore.kernel.org/r/1629950594-14345-1-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit f005dc6db136a477166dd86e983351fec9129cce Author: Sugar Zhang Date: Thu Aug 26 12:02:38 2021 +0800 ASoC: rockchip: i2s: Add compatible for more SoCs This patch adds more compatible strings for SoCs. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950562-14281-5-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 4455f26a551c86e31c7d27495903a11c3d660034 Author: Sugar Zhang Date: Thu Aug 26 12:02:37 2021 +0800 ASoC: rockchip: i2s: Make playback/capture optional There are some controllers which support playback only or capture only. so, make it optional. and initial capability by 'dma-names' of DT. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950562-14281-4-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 1bf56843e664eef2525bdbfae6a561e98910f676 Author: Xiaotan Luo Date: Thu Aug 26 12:02:36 2021 +0800 ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B - DSP_A: PCM delay 1 bit mode, L data MSB after FRM LRC - DSP_B: PCM no delay mode, L data MSB during FRM LRC Signed-off-by: Xiaotan Luo Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950562-14281-3-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 296713a3609deaf4ad2c460ffe196c09084792e0 Author: Sugar Zhang Date: Thu Aug 26 12:02:35 2021 +0800 ASoC: dt-bindings: rockchip: Document reset property for i2s This patch documents reset property for i2s. Signed-off-by: Sugar Zhang Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/1629950562-14281-2-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 53ca9b9777b95cdd689181d7c547e38dc79adad0 Author: Sugar Zhang Date: Thu Aug 26 12:01:50 2021 +0800 ASoC: rockchip: i2s: Fix regmap_ops hang API 'set_fmt' maybe called when PD is off, in the situation, any register access will hang the system. so, enable PD before r/w register. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950520-14190-4-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 7a2df53bc090a161713da057df7455b39f6cd00d Author: Sugar Zhang Date: Thu Aug 26 12:01:49 2021 +0800 ASoC: rockchip: i2s: Improve dma data transfer efficiency This patch changes dma data burst from 4 to 8 to improve data transfer efficiency. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950520-14190-3-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 6b76bcc004b046ea3c8eb66bbc6954f1d23cc2af Author: Sugar Zhang Date: Thu Aug 26 12:01:48 2021 +0800 ASoC: rockchip: i2s: Fixup clk div error MCLK maybe not precise as required because of PLL, but which still can be used and no side effect. so, using DIV_ROUND_CLOSEST instead div. e.g. set mclk to 11289600 Hz, but get 11289598 Hz. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950520-14190-2-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit ebfea67125767a779af63ae6de176709713c8826 Author: Sugar Zhang Date: Thu Aug 26 12:01:47 2021 +0800 ASoC: rockchip: i2s: Add support for set bclk ratio This patch adds support for set bclk ratio from machine driver. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629950520-14190-1-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit e79ef3c2cfe0b39878496eac87450698a2e84e3f Author: Sugar Zhang Date: Tue Aug 24 18:16:02 2021 +0800 ASoC: dt-bindings: rockchip: Add compatible for rk3568 spdif This patch adds compatible string for rk3568 spdif. Signed-off-by: Sugar Zhang Acked-by: Rob Herring Link: https://lore.kernel.org/r/1629800162-12824-5-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit c5d4f09feb9f74e704d87a304f0c20001488fe10 Author: Sugar Zhang Date: Tue Aug 24 18:16:01 2021 +0800 ASoC: rockchip: spdif: Add support for rk3568 spdif This patch adds support for rk3568 spdif which is the same with rk3366. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629800162-12824-4-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit acc8b9d117912c2d5952868fba0d4fca49cde3c8 Author: Sugar Zhang Date: Tue Aug 24 18:16:00 2021 +0800 ASoC: rockchip: spdif: Fix some coding style This patch fix some coding style. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629800162-12824-3-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit 023a3f3a1c4f9be9cc1ae92579ba816120fb5807 Author: Sugar Zhang Date: Tue Aug 24 18:15:59 2021 +0800 ASoC: rockchip: spdif: Mark SPDIF_SMPDR as volatile This patch marks SPDIF_SMPDR as volatile to make it resaonable, which also requires marking it as readable, even though it isn't. Signed-off-by: Sugar Zhang Link: https://lore.kernel.org/r/1629800162-12824-2-git-send-email-sugar.zhang@rock-chips.com Signed-off-by: Mark Brown commit bb2853a6a421a052268eee00fd5d3f6b3504b2b1 Author: Nguyen Dinh Phi Date: Mon Aug 23 08:06:41 2021 +0800 tty: Fix data race between tiocsti() and flush_to_ldisc() The ops->receive_buf() may be accessed concurrently from these two functions. If the driver flushes data to the line discipline receive_buf() method while tiocsti() is waiting for the ops->receive_buf() to finish its work, the data race will happen. For example: tty_ioctl |tty_ldisc_receive_buf ->tioctsi | ->tty_port_default_receive_buf | ->tty_ldisc_receive_buf ->hci_uart_tty_receive | ->hci_uart_tty_receive ->h4_recv | ->h4_recv In this case, the h4 receive buffer will be overwritten by the latecomer, and we will lost the data. Hence, change tioctsi() function to use the exclusive lock interface from tty_buffer to avoid the data race. Reported-by: syzbot+97388eb9d31b997fe1d0@syzkaller.appspotmail.com Reviewed-by: Jiri Slaby Signed-off-by: Nguyen Dinh Phi Link: https://lore.kernel.org/r/20210823000641.2082292-1-phind.uet@gmail.com Cc: stable Signed-off-by: Greg Kroah-Hartman commit 74d2fb7e708433b7397d9647ea7ec1cbcb0ae379 Author: Tang Bin Date: Sun Aug 22 11:28:06 2021 +0800 serial: vt8500: Use of_device_get_match_data Retrieve OF match data, it's better and cleaner to use 'of_device_get_match_data' over 'of_match_device'. Signed-off-by: Zhang Shengju Signed-off-by: Tang Bin Link: https://lore.kernel.org/r/20210822032806.3256-4-tangbin@cmss.chinamobile.com Signed-off-by: Greg Kroah-Hartman commit a6a65f9ee0937d02e8084ee1ed305e38aae848e6 Author: Tang Bin Date: Sun Aug 22 11:28:05 2021 +0800 serial: tegra: Use of_device_get_match_data Retrieve OF match data, it's better and cleaner to use 'of_device_get_match_data' over 'of_match_device'. Signed-off-by: Zhang Shengju Signed-off-by: Tang Bin Link: https://lore.kernel.org/r/20210822032806.3256-3-tangbin@cmss.chinamobile.com Signed-off-by: Greg Kroah-Hartman commit 618bf2b04bd6a903a9ebf0edb8d1700ba9a1a6da Author: Tang Bin Date: Sun Aug 22 11:28:04 2021 +0800 serial: 8250_ingenic: Use of_device_get_match_data Retrieve OF match data, it's better and cleaner to use 'of_device_get_match_data' over 'of_match_device'. Acked-by: Paul Cercueil Signed-off-by: Zhang Shengju Signed-off-by: Tang Bin Link: https://lore.kernel.org/r/20210822032806.3256-2-tangbin@cmss.chinamobile.com Signed-off-by: Greg Kroah-Hartman commit fa934fc1a8679f0704dddaefb6946c3da26c58a5 Author: Tang Bin Date: Mon Aug 23 19:07:54 2021 +0800 tty: serial: linflexuart: Remove redundant check to simplify the code In the function uart_add_one_port(), it can return zero or non-zero, so remove redundant check to simplify the code. Signed-off-by: Zhang Shengju Signed-off-by: Tang Bin Link: https://lore.kernel.org/r/20210823110754.11232-1-tangbin@cmss.chinamobile.com Signed-off-by: Greg Kroah-Hartman commit 77216702c8f6288f948ee230772b4612b835c5d6 Author: Chuanjia Liu Date: Mon Aug 23 11:27:58 2021 +0800 PCI: mediatek: Use PCI domain to handle ports detection Use of_get_pci_domain_nr() to get the pci domain. If the "linux,pci-domain" property is present, we assume that the PCIe bridge is an individual bridge, hence we only need to parse one port. Link: https://lore.kernel.org/r/20210823032800.1660-5-chuanjia.liu@mediatek.com Signed-off-by: Chuanjia Liu [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit bd5305dcabbc208560521bc0617f0a82715e41c9 Author: Fugang Duan Date: Mon Aug 23 17:18:01 2021 +0800 tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp Do software reset for communication port on imx7ulp and imx8qxp after the port is registered if the UART controller support the feature. Do partition reset with LPUART's power on, LPUART registers will keep the previous status, like on i.MX8QXP platform, which is not expected action, so need to set the RST bit of GLOBAL register to reset all uart internal logic and registers. Currently, only i.MX7ULP and i.MX8QXP LPUART controllers include global register that support the software reset. Signed-off-by: Fugang Duan Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20210823091801.17447-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 48422152a8f1c290f74d8fb16ec6c77a1263834c Author: Fugang Duan Date: Mon Aug 23 16:17:33 2021 +0800 tty: serial: fsl_lpuart: enable two stop bits for lpuart32 Add two stop bits support. User can run the command to enable two stop bits for test: stty cstopb -F /dev/ttyLPx Signed-off-by: Fugang Duan Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20210823081733.31941-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit d5c38948448abc2bb6b36dbf85a554bf4748885e Author: Andy Duan Date: Thu Aug 19 10:10:33 2021 +0800 tty: serial: fsl_lpuart: fix the wrong mapbase value Register offset needs to be applied on mapbase also. dma_tx/rx_request use the physical address of UARTDATA. Register offset is currently only applied to membase (the corresponding virtual addr) but not on mapbase. Fixes: 24b1e5f0e83c ("tty: serial: lpuart: add imx7ulp support") Reviewed-by: Leonard Crestez Signed-off-by: Adriana Reus Signed-off-by: Sherry Sun Signed-off-by: Andy Duan Link: https://lore.kernel.org/r/20210819021033.32606-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 436960bb0045854119a61efab20578f55b311a87 Author: Chuanjia Liu Date: Mon Aug 23 11:27:57 2021 +0800 PCI: mediatek: Add new method to get irq number Use platform_get_irq_byname() to get the irq number if the "interrupt-names" property is defined. Link: https://lore.kernel.org/r/20210823032800.1660-4-chuanjia.liu@mediatek.com Signed-off-by: Chuanjia Liu [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 2285c496392979c9ac9d84e19a313ee9212d9b62 Author: Dan Carpenter Date: Wed Aug 25 10:24:35 2021 +0300 mxser: use semi-colons instead of commas This code works, but it's cleaner to use semi-colons at the end of a statement instead of a comma. Acked-by: Jiri Slaby Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210825072435.GB13013@kili Signed-off-by: Greg Kroah-Hartman commit 87e8657ba99cac87b84c7f8ead91b44d88345504 Author: Chuanjia Liu Date: Mon Aug 23 11:27:56 2021 +0800 PCI: mediatek: Add new method to get shared pcie-cfg base address For the new dts format, add a new method to get shared pcie-cfg base address and use it to configure the PCIECFG controller Link: https://lore.kernel.org/r/20210823032800.1660-3-chuanjia.liu@mediatek.com Signed-off-by: Chuanjia Liu Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit aa6eca5b81663a59e1a8765481eb48fa2edfab05 Author: Chuanjia Liu Date: Mon Aug 23 11:27:55 2021 +0800 dt-bindings: PCI: mediatek: Update the Device tree bindings There are two independent PCIe controllers in MT2712 and MT7622 platform. Each of them should contain an independent MSI domain. In old dts architecture, MSI domain will be inherited from the root bridge, and all of the devices will share the same MSI domain. Hence that, the PCIe devices will not work properly if the irq number which required is more than 32. Split the PCIe node for MT2712 and MT7622 platform to comply with the hardware design and fix MSI issue. Link: https://lore.kernel.org/r/20210823032800.1660-2-chuanjia.liu@mediatek.com Signed-off-by: Chuanjia Liu Signed-off-by: Lorenzo Pieralisi Reviewed-by: Rob Herring Acked-by: Ryder Lee commit 322003b907d6c74d16154091bca492a2b2829ac0 Author: Dan Carpenter Date: Wed Aug 25 10:24:05 2021 +0300 tty: moxa: use semi-colons instead of commas This code works but it's cleaner to use a semi-colon to end a statement instead of a comma. Acked-by: Jiri Slaby Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20210825072405.GA13013@kili Signed-off-by: Greg Kroah-Hartman commit ca5537c9be13c205492e704c5a3016f54b2fefec Merge: e22ce8eb631bd d287801c49715 Author: Mark Brown Date: Thu Aug 26 13:45:27 2021 +0100 Merge remote-tracking branch 'regmap/for-5.15' into regmap-next commit 26cfc0dbe43aae60dc03af27077775244f26c167 Author: Quanyang Wang Date: Thu Aug 26 08:59:30 2021 +0800 spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible The function wait_for_completion_interruptible_timeout will return -ERESTARTSYS immediately when receiving SIGKILL signal which is sent by "jffs2_gcd_mtd" during umounting jffs2. This will break the SPI memory operation because the data transmitting may begin before the command or address transmitting completes. Use wait_for_completion_timeout to prevent the process from being interruptible. Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller") Signed-off-by: Quanyang Wang Link: https://lore.kernel.org/r/20210826005930.20572-1-quanyang.wang@windriver.com Signed-off-by: Mark Brown commit 11a08e05079a9328023d236b82bd7981bcde0852 Author: Colin Ian King Date: Thu Aug 26 12:26:11 2021 +0100 ASoC: mediatek: mt8195: Fix spelling mistake "bitwiedh" -> "bitwidth" There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210826112611.10356-1-colin.king@canonical.com Signed-off-by: Mark Brown commit d212dcee27c1f89517181047e5485fcbba4a25c2 Author: Pali Rohár Date: Fri Aug 20 17:50:20 2021 +0200 PCI: aardvark: Fix masking and unmasking legacy INTx interrupts irq_mask and irq_unmask callbacks need to be properly guarded by raw spin locks as masking/unmasking procedure needs atomic read-modify-write operation on hardware register. Link: https://lore.kernel.org/r/20210820155020.3000-1-pali@kernel.org Reported-by: Marc Zyngier Signed-off-by: Pali Rohár Signed-off-by: Lorenzo Pieralisi Acked-by: Marc Zyngier Cc: stable@vger.kernel.org commit d287801c497151a44e5577fb3bbab673fe52e7b0 Merge: 29c34975c9391 67021f25d9529 Author: Mark Brown Date: Thu Aug 26 13:40:35 2021 +0100 Merge series "Use raw spinlocks in the ls-extirq driver" from Vladimir Oltean : The ls-extirq irqchip driver accesses regmap inside its implementation of the struct irq_chip :: irq_set_type method, and currently regmap only knows to lock using normal spinlocks. But the method above wants raw spinlock context, so this isn't going to work and triggers a "[ BUG: Invalid wait context ]" splat. The best we can do given the arrangement of the code is to patch regmap and the syscon driver: regmap to support raw spinlocks, and syscon to request them on behalf of its ls-extirq consumer. Link: https://lore.kernel.org/lkml/20210825135438.ubcuxm5vctt6ne2q@skbuf/T/#u Vladimir Oltean (2): regmap: teach regmap to use raw spinlocks if requested in the config mfd: syscon: request a regmap with raw spinlocks for some devices drivers/base/regmap/internal.h | 4 ++++ drivers/base/regmap/regmap.c | 35 +++++++++++++++++++++++++++++----- drivers/mfd/syscon.c | 16 ++++++++++++++++ include/linux/regmap.h | 2 ++ 4 files changed, 52 insertions(+), 5 deletions(-) -- 2.25.1 base-commit: 6efb943b8616ec53a5e444193dccf1af9ad627b5 commit 9e62ec0e661ca7161e5830bdbf8e69831b41e866 Author: Rob Herring Date: Mon Aug 23 11:51:26 2021 -0500 arm/arm64: dts: Fix remaining dtc 'unit_address_format' warnings Fix all the remaining dtc 'unit_address_format' warnings except for the ones related to 'register-bit-led'. For those, we need to decide on and document the node name. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20210823165126.2320910-1-robh@kernel.org' Signed-off-by: Arnd Bergmann commit d98a30ccdc839947c9233369744341d1fa54439c Author: Chunfeng Yun Date: Thu Aug 26 16:36:37 2021 +0800 usb: mtu3: fix random remote wakeup Some platforms, e.g. 8183/8192, use low level latch way to keep wakeup signal, it may latch a wrong signal if debounce more time, and enable wakeup earlier. ____________________ ip_sleep ____/ \__________ ___________________ wakeup_signal ____________/ \______ _______________________________ wakeup_en _______/ ^ ^ |(1) |(2) latch wakeup_signal mistakenly at (1), should latch it at (2); Workaround: delay about 100us to enable wakeup, meanwhile decrease debounce time. Fixes: b1a344589eea ("usb: mtu3: support ip-sleep wakeup for MT8183") Cc: stable@vger.kernel.org Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210826083637.33237-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 50fdcb56c41904c3535687a0e1e1dbd9423a8f9a Author: Chunfeng Yun Date: Thu Aug 26 16:36:36 2021 +0800 usb: mtu3: return successful suspend status Forgot 'return 0;' when suspend successfully, make the mistake when I split patches. Fixes: 6b587394c65c ("usb: mtu3: support suspend/resume for dual-role mode") Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210826083637.33237-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 4ce186665e7c3e9edde648dfb373ca0d213fb312 Author: Chunfeng Yun Date: Thu Aug 26 10:51:43 2021 +0800 usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint xhci-mtk depends on xhci's internal virt_dev when it retrieves its internal data from usb_host_endpoint both in add_endpoint and drop_endpoint callbacks. But when setup packet was retired by transaction errors in xhci_setup_device() path, a virt_dev for the slot is newly created with real_port 0. This leads to xhci-mtks's NULL pointer dereference from drop_endpoint callback as xhci-mtk assumes that virt_dev's real_port is always started from one. The similar problems were addressed by [1] but that can't cover the failure cases from setup_device. This patch drops the usages of xhci's virt_dev in xhci-mtk's drop_endpoint callback by adopting hashtable for searching mtk's schedule entity from a given usb_host_endpoint pointer instead of searching a linked list. So mtk's drop_endpoint callback doesn't have to rely on virt_dev at all. [1] f351f4b63dac ("usb: xhci-mtk: fix oops when unbind driver") Signed-off-by: Ikjoon Jang Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210826025144.51992-5-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 926d60ae64a623db3c1afcc524c23709615893d7 Author: Chunfeng Yun Date: Tue Aug 17 16:36:29 2021 +0800 usb: xhci-mtk: modify the SOF/ITP interval for mt8195 There are 4 USB controllers on MT8195, the controllers (IP1~IP3, exclude IP0) have a wrong default SOF/ITP interval which is calculated from the frame counter clock 24Mhz by default, but in fact, the frame counter clock is 48Mhz, so we should set the accurate interval according to 48Mhz for those controllers. Note: the first controller no need set it. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-9-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 82799c80b46a151abc693b20ffea08bfba14be8e Author: Chunfeng Yun Date: Tue Aug 17 16:36:28 2021 +0800 usb: xhci-mtk: add a member of num_esit Add a member num_esit to save the number of esit, then no need caculate it in some functions. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-8-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 614c8c67a071d44be54266b78c21e2a505ac1b32 Author: Chunfeng Yun Date: Tue Aug 17 16:36:27 2021 +0800 usb: xhci-mtk: check boundary before check tt check_sch_tt() will access fs_bus_bw[] array, check boundary firstly to avoid out-of-bounds issue. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-7-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 451d3912586aad3f71f1c97780a1c21e3de98413 Author: Chunfeng Yun Date: Tue Aug 17 16:36:26 2021 +0800 usb: xhci-mtk: update fs bus bandwidth by bw_budget_table Use @bw_budget_table[] to update fs bus bandwidth due to not all microframes consume @bw_cost_per_microframe, see setup_sch_info(). Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-6-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit de5107f473190538a65aac7edea85209cd5c1a8f Author: Chunfeng Yun Date: Tue Aug 17 16:36:25 2021 +0800 usb: xhci-mtk: fix issue of out-of-bounds array access Bus bandwidth array access is based on esit, increase one will cause out-of-bounds issue; for example, when esit is XHCI_MTK_MAX_ESIT, will overstep boundary. Fixes: 7c986fbc16ae ("usb: xhci-mtk: get the microframe boundary for ESIT") Cc: Reported-by: Stan Lu Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-5-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 7465d7b66ac73db87b9eb99be01500093f80b575 Author: Chunfeng Yun Date: Tue Aug 17 16:36:24 2021 +0800 usb: xhci-mtk: support option to disable usb2 ports Add support to disable specific usb2 host ports, it's useful when a usb2 port is disabled on some platforms, but enabled on others for the same SoC. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-4-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 7f85c16f40d8be5656fb3476909db5c3a5a9c6ea Author: Chunfeng Yun Date: Tue Aug 17 16:36:23 2021 +0800 usb: xhci-mtk: fix use-after-free of mtk->hcd BUG: KASAN: use-after-free in usb_hcd_is_primary_hcd+0x38/0x60 Call trace: dump_backtrace+0x0/0x3dc show_stack+0x20/0x2c dump_stack+0x15c/0x1d4 print_address_description+0x7c/0x510 kasan_report+0x164/0x1ac __asan_report_load8_noabort+0x44/0x50 usb_hcd_is_primary_hcd+0x38/0x60 xhci_mtk_runtime_suspend+0x68/0x148 pm_generic_runtime_suspend+0x90/0xac __rpm_callback+0xb8/0x1f4 rpm_callback+0x54/0x1d0 rpm_suspend+0x4e0/0xc84 __pm_runtime_suspend+0xc4/0x114 xhci_mtk_probe+0xa58/0xd00 This may happen when probe fails, needn't suspend it synchronously, fix it by using pm_runtime_put_noidle(). Reported-by: Pi Hsun Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-3-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit e2cd76907fcc8c7438a50b4c44a8073f2228208c Author: Chunfeng Yun Date: Tue Aug 17 16:36:22 2021 +0800 dt-bindings: usb: mtk-xhci: add compatible for mt8195 There are 4 USB controllers on MT8195, the controllers (IP1~IP3, exclude IP0) have a wrong default SOF/ITP interval which is calculated from the frame counter clock 24Mhz by default, but in fact, the frame counter clock is 48Mhz, so we should set the accurate interval according to 48Mhz. Here add a new compatible for MT8195, it's also supported in driver. But the first controller (IP0) has no such issue, we prefer to use generic compatible, e.g. mt8192's compatible. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-2-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 51018cde5b55b7b0d65af0d363531cddd360fe11 Author: Chunfeng Yun Date: Tue Aug 17 16:36:21 2021 +0800 dt-bindings: usb: mtk-xhci: add optional property to disable usb2 ports Add support to disable specific usb2 host ports, it's useful when a usb2 port is disabled on some platforms, but enabled on others for the same SoC, another case is that the different package may support different number of ports. Reviewed-by: Rob Herring Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/1629189389-18779-1-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 6f15a2a09cecb7a2faba4a75bbd101f6f962294b Author: Christophe JAILLET Date: Wed Aug 18 21:32:49 2021 +0200 usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()' If an error occurs after a successful 'clk_prepare_enable()' call, it must be undone by a corresponding 'clk_disable_unprepare()' call. This call is already present in the remove function. Add this call in the error handling path and reorder the code so that the 'clk_prepare_enable()' call happens later in the function. The goal is to have as much managed resources functions as possible before the 'clk_prepare_enable()' call in order to keep the error handling path simple. While at it, remove the now unneeded 'clk' variable. Fixes: c87dca047849 ("usb: bdc: Add clock enable for new chips with a separate BDC clock") Acked-by: Florian Fainelli Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f8a4a6897deb0c8cb2e576580790303550f15fcd.1629314734.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 Author: Christophe JAILLET Date: Wed Aug 18 21:32:38 2021 +0200 usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available If no suitable DMA configuration is available, a previous 'bdc_phy_init()' call must be undone by a corresponding 'bdc_phy_exit()' call. Branch to the existing error handling path instead of returning directly. Fixes: cc29d4f67757 ("usb: bdc: Add support for USB phy") Acked-by: Florian Fainelli Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/0c5910979f39225d5d8fe68c9ab1c147c68ddee1.1629314734.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit f2a9797b4efe54c94cc5ceb82ce1a4fba8b70a51 Author: Chunfeng Yun Date: Fri Aug 20 14:59:13 2021 +0800 Revert "usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint" I find the patch introduce some issues, e.g. 1. oops happens when xhci_gen_setup() failed, and hash is not init but try to destroy it; 2. memory leakage happens when fail to insert ep, need free sch_ep, or insert ep after insert int list; 3. memory leakage happens when fail to allocate sch_array, need destroy rhashtable; 4. it's better to check ep->hcpriv when drop ep; so prefer to revert this patch, and resend it after the issues are fixed. This reverts commit b8731209958a1dffccc2888121f4c0280c990550. Cc: Ikjoon Jang Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210820065913.64490-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 76d55a633ab61e70cb56720830e7be3dec0842fe Author: Chunfeng Yun Date: Fri Aug 20 14:59:12 2021 +0800 Revert "usb: xhci-mtk: relax TT periodic bandwidth allocation" As discussed in following patch: https://patchwork.kernel.org/patch/12420339 No need calculate number of uframes again, but should use value form check_sch_tt(), if we plan to remove extra CS, also can do it in check_sch_tt(). So revert this patch, and prepare to send new patch for it. This reverts commit 548011957d1d72e0b662300c8b32b81d593b796e. Cc: Ikjoon Jang Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20210820065913.64490-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit de940244e8987a76d73fb2b0057ecd494cbfeefd Author: Rui Miguel Silva Date: Thu Aug 19 19:09:29 2021 +0100 usb: isp1760: clean never read udc_enabled warning When CONFIG_USB_ISP1761_UDC is not enabled the udc_enabled variable is never used since it is short circuited before in the logic operations. This would trigger the following warning by clang analyzer: drivers/usb/isp1760/isp1760-core.c:490:2: warning: Value stored to 'udc_enabled' is never read [clang-analyzer-deadcode.DeadStores] udc_enabled = ((devflags & ISP1760_FLAG_ISP1763) || ^ drivers/usb/isp1760/isp1760-core.c:490:2: note: Value stored to 'udc_enabled' is never read Just swap the other of the operands in the logic operations. Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210819180929.1327349-6-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 7d1d3882fd9da1ee42fe3ad3a5ffd41fb8204380 Author: Rui Miguel Silva Date: Thu Aug 19 19:09:28 2021 +0100 usb: isp1760: do not shift in uninitialized slot Even though it is not expected, and would trigger a WARN_ON, killing a transfer in a uninitialized slot this sequence is warned by clang analyzer, twice: drivers/usb/isp1760/isp1760-hcd.c:1976:18: warning: The result of the left shift is undefined because the right operand is negative [clang-analyzer-core.UndefinedBinaryOperatorResult] skip_map |= (1 << qh->slot); drivers/usb/isp1760/isp1760-hcd.c:1983:18: warning: The result of the left shift is undefined because the right operand is negative [clang-analyzer-core.UndefinedBinaryOperatorResult] skip_map |= (1 << qh->slot); Only set skip map if slot is active. Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210819180929.1327349-5-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 5e4cd1b6556302fe6a457e525c256cbef3563543 Author: Rui Miguel Silva Date: Thu Aug 19 19:09:27 2021 +0100 usb: isp1760: do not reset retval We do not really need to reset retval before get used bellow. This will avoid the clang-analyzer warning: drivers/usb/isp1760/isp1760-hcd.c:1919:2: warning: Value stored to 'retval' is never read [clang-analyzer-deadcode.DeadStores] retval = 0; Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210819180929.1327349-4-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 8e58b7710d6634ed46ae26fedb8459f84f08fd51 Author: Rui Miguel Silva Date: Thu Aug 19 19:09:26 2021 +0100 usb: isp1760: check maxpacketsize before using it When checking if we need one more packet on a bulk pipe we may, even though not probable at all, get there with a zero maxpacketsize. In that case for sure no packet, no even a one more, will be allocated. This will clean the clang-analyzer warning: drivers/usb/isp1760/isp1760-hcd.c:1856:38: warning: Division by zero [clang-analyzer-core.DivideZero] && !(urb->transfer_buffer_length % Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210819180929.1327349-3-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 8472896f39cfab2d8fec9ca746070aaf02609169 Author: Rui Miguel Silva Date: Thu Aug 19 19:09:25 2021 +0100 usb: isp1760: ignore return value for bus change pattern We do not care about the return value of that read between the scratch register write and read, we really just want to make sure that the pattern in the bus get changed to make sure we are testing correctly the scratch pattern. Clang-analyzer complains about the never read scratch variable: >> drivers/usb/isp1760/isp1760-hcd.c:735:2: warning: Value stored to 'scratch' is never read [clang-analyzer-deadcode.DeadStores] scratch = isp1760_hcd_read(hcd, HC_CHIP_ID_HIGH); Just ignore the return value of that CHIP_ID_HIGH read, add more information to the comment above why we are doing this. And as at it, just do a small format change in the error message bellow. Signed-off-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20210819180929.1327349-2-rui.silva@linaro.org Signed-off-by: Greg Kroah-Hartman commit 9fe3c93f9de702fa764351201c574a9d0769fab3 Author: Wei Ming Chen Date: Sat Aug 21 22:26:47 2021 +0800 usb: gadget: Add description for module parameter The description for "qlen" is missing, and there is a description for this parameter in "Documentation/usb/gadget_printer.rst" Signed-off-by: Wei Ming Chen Link: https://lore.kernel.org/r/20210821142647.2904-1-jj251510319013@gmail.com Signed-off-by: Greg Kroah-Hartman commit 66cce9e73ec61967ed1f97f30cee79bd9a2bb7ee Author: Shuah Khan Date: Thu Aug 19 16:59:37 2021 -0600 usbip:vhci_hcd USB port can get stuck in the disabled state When a remote usb device is attached to the local Virtual USB Host Controller Root Hub port, the bound device driver may send a port reset command. vhci_hcd accepts port resets only when the device doesn't have port address assigned to it. When reset happens device is in assigned/used state and vhci_hcd rejects it leaving the port in a stuck state. This problem was found when a blue-tooth or xbox wireless dongle was passed through using usbip. A few drivers reset the port during probe including mt76 driver specific to this bug report. Fix the problem with a change to honor reset requests when device is in used state (VDEV_ST_USED). Reported-and-tested-by: Michael Suggested-by: Michael Signed-off-by: Shuah Khan Link: https://lore.kernel.org/r/20210819225937.41037-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 5289253b01d7bfa5e8ae23fdc2482acacd301e7d Author: Anirudh Rayabharam Date: Sat Aug 21 00:31:22 2021 +0530 usbip: clean up code in vhci_device_unlink_cleanup The cleanup code for unlink_tx and unlink_rx lists is almost the same. So, extract it into a new function and call it for both unlink_rx and unlink_tx. Also, remove unnecessary log messages. Signed-off-by: Anirudh Rayabharam Link: https://lore.kernel.org/r/20210820190122.16379-3-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman commit 258c81b341c8025d79073ce2d6ce19dcdc7d10d2 Author: Anirudh Rayabharam Date: Sat Aug 21 00:31:21 2021 +0530 usbip: give back URBs for unsent unlink requests during cleanup In vhci_device_unlink_cleanup(), the URBs for unsent unlink requests are not given back. This sometimes causes usb_kill_urb to wait indefinitely for that urb to be given back. syzbot has reported a hung task issue [1] for this. To fix this, give back the urbs corresponding to unsent unlink requests (unlink_tx list) similar to how urbs corresponding to unanswered unlink requests (unlink_rx list) are given back. [1]: https://syzkaller.appspot.com/bug?id=08f12df95ae7da69814e64eb5515d5a85ed06b76 Reported-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com Tested-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com Reviewed-by: Shuah Khan Signed-off-by: Anirudh Rayabharam Link: https://lore.kernel.org/r/20210820190122.16379-2-mail@anirudhrb.com Signed-off-by: Greg Kroah-Hartman commit 5786b433f721059f65b55a5ed0520ff5c375697d Author: Cai Huoqing Date: Mon Aug 23 12:58:07 2021 +0800 usb: gadget: aspeed: Remove repeated verbose license text remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210823045807.49-1-caihuoqing@baidu.com Signed-off-by: Greg Kroah-Hartman commit 0b9f6cc845ce8ea4ee72bfabbaf9bfbf68f5fbde Author: Cai Huoqing Date: Sun Aug 22 12:30:05 2021 +0800 usb: gadget: mass_storage: Remove repeated verbose license text remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210822043005.192-1-caihuoqing@baidu.com Signed-off-by: Greg Kroah-Hartman commit 7c75bde329d7e2a93cf86a5c15c61f96f1446cdc Author: Nadezda Lutovinova Date: Thu Aug 19 19:33:23 2021 +0300 usb: musb: musb_dsps: request_irq() after initializing musb If IRQ occurs between calling dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev(), then null pointer dereference occurs since glue->musb wasn't initialized yet. The patch puts initializing of neccesery data before registration of the interrupt handler. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Nadezda Lutovinova Link: https://lore.kernel.org/r/20210819163323.17714-1-lutovinova@ispras.ru Signed-off-by: Greg Kroah-Hartman commit 465e333e77a697fe8bfe4e24c6be1795f50c4fda Merge: 806c0e6e7e97a 0c8fb653d487d Author: Michael Ellerman Date: Thu Aug 26 21:21:11 2021 +1000 Merge branch 'topic/ppc-kvm' into next Merge some KVM patches we are keeping in a topic branch in case there are any merge conflicts that need resolving. commit 806c0e6e7e97adc17389c8dc1f52d4736f49299b Author: Christophe Leroy Date: Mon Aug 23 08:24:21 2021 +0000 powerpc: Refactor verification of MSR_RI 40x and BOOKE don't have MSR_RI therefore all tests involving MSR_RI may be problematic on those plateforms. Create helpers to check or set MSR_RI in regs, and use them in common code. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c2fb93708196734f4176dda334aaa3055f213b89.1629707037.git.christophe.leroy@csgroup.eu commit 133c17a1788d68c9fff59d5f724a4ba14647a16d Author: Christophe Leroy Date: Mon Aug 23 08:24:20 2021 +0000 powerpc: Remove MSR_PR check in interrupt_exit_{user/kernel}_prepare() In those hot functions that are called at every interrupt, any saved cycle is worth it. interrupt_exit_user_prepare() and interrupt_exit_kernel_prepare() are called from three places: - From entry_32.S - From interrupt_64.S - From interrupt_exit_user_restart() and interrupt_exit_kernel_restart() In entry_32.S, there are inambiguously called based on MSR_PR: interrupt_return: lwz r4,_MSR(r1) addi r3,r1,STACK_FRAME_OVERHEAD andi. r0,r4,MSR_PR beq .Lkernel_interrupt_return bl interrupt_exit_user_prepare ... .Lkernel_interrupt_return: bl interrupt_exit_kernel_prepare In interrupt_64.S, that's similar: interrupt_return_\srr\(): ld r4,_MSR(r1) andi. r0,r4,MSR_PR beq interrupt_return_\srr\()_kernel interrupt_return_\srr\()_user: /* make backtraces match the _kernel variant */ addi r3,r1,STACK_FRAME_OVERHEAD bl interrupt_exit_user_prepare ... interrupt_return_\srr\()_kernel: addi r3,r1,STACK_FRAME_OVERHEAD bl interrupt_exit_kernel_prepare In interrupt_exit_user_restart() and interrupt_exit_kernel_restart(), MSR_PR is verified respectively by BUG_ON(!user_mode(regs)) and BUG_ON(user_mode(regs)) prior to calling interrupt_exit_user_prepare() and interrupt_exit_kernel_prepare(). The verification in interrupt_exit_user_prepare() and interrupt_exit_kernel_prepare() are therefore useless and can be removed. Signed-off-by: Christophe Leroy Acked-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/385ead49ccb66a259b25fee3eebf0bd4094068f3.1629707037.git.christophe.leroy@csgroup.eu commit d9db6e420268b2d561731468a31f0b15e2e9a145 Author: Xiongwei Song Date: Sat Aug 7 09:02:39 2021 +0800 powerpc/64e: Get dear offset with _DEAR macro Use _DEAR to get the offset of dear register in pr_regs for 64e cpus. Signed-off-by: Xiongwei Song Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210807010239.416055-5-sxwjean@me.com commit 4872cbd0ca35ca5b20d52e2539e7e1950f126e7b Author: Xiongwei Song Date: Sat Aug 7 09:02:38 2021 +0800 powerpc: Add dear as a synonym for pt_regs.dar register Create an anonymous union for dar and dear regsiters, we can reference dear to get the effective address when CONFIG_4xx=y or CONFIG_BOOKE=y. Otherwise, reference dar. This makes code more clear. Signed-off-by: Xiongwei Song [mpe: Reword commit title] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210807010239.416055-4-sxwjean@me.com commit cfa47772ca8d53d7a6c9b331a7f6e7c4c9827214 Author: Xiongwei Song Date: Sat Aug 7 09:02:37 2021 +0800 powerpc/64e: Get esr offset with _ESR macro Use _ESR to get the offset of esr register in pr_regs for 64e cpus. Signed-off-by: Xiongwei Song Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210807010239.416055-3-sxwjean@me.com commit 4f8e78c0757e3c5a65d9d8ac76e2434c71a78f5a Author: Xiongwei Song Date: Sat Aug 7 09:02:36 2021 +0800 powerpc: Add esr as a synonym for pt_regs.dsisr Create an anonymous union for dsisr and esr regsiters, we can reference esr to get the exception detail when CONFIG_4xx=y or CONFIG_BOOKE=y. Otherwise, reference dsisr. This makes code more clear. Signed-off-by: Xiongwei Song [mpe: Reword commit title] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210807010239.416055-2-sxwjean@me.com commit e42edf9b9d126bb1c743f2e7984877ba27f09fe7 Author: Jordan Niethe Date: Thu Jul 29 14:13:17 2021 +1000 selftests: Skip TM tests on synthetic TM implementations Transactional Memory was removed from the architecture in ISA v3.1. For threads running in P8/P9 compatibility mode on P10 a synthetic TM implementation is provided. In this implementation, tbegin. always sets cr0 eq meaning the abort handler is always called. This is not an issue as users of TM are expected to have a fallback non transactional way to make forward progress in the abort handler. The TEXASR indicates if a transaction failure is due to a synthetic implementation. Some of the TM self tests need a non-degenerate TM implementation for their testing to be meaningful so check for a synthetic implementation and skip the test if so. Signed-off-by: Jordan Niethe Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210729041317.366612-2-jniethe5@gmail.com commit c95278a0534449efc64ac8169382bce217963be2 Author: Jordan Niethe Date: Thu Jul 29 14:13:16 2021 +1000 selftests/powerpc: Add missing clobbered register to to ptrace TM tests ISA v3.1 removes TM but includes a synthetic implementation for backwards compatibility. With this implementation, the tests ptrace-tm-spd-gpr and ptrace-tm-gpr should never be able to make any forward progress and eventually should be killed by the timeout. Instead on a P10 running in P9 mode, ptrace_tm_gpr fails like so: test: ptrace_tm_gpr tags: git_version:unknown Starting the child ... ... GPR[27]: 1 Expected: 2 GPR[28]: 1 Expected: 2 GPR[29]: 1 Expected: 2 GPR[30]: 1 Expected: 2 GPR[31]: 1 Expected: 2 [FAIL] Test FAILED on line 98 failure: ptrace_tm_gpr selftests: ptrace-tm-gpr [FAIL] The problem is in the inline assembly of the child. r0 is loaded with a value in the child's transaction abort handler but this register is not included in the clobbers list. This means it is possible that this statement: cptr[1] = 0; which is meant to signal the parent to wait may actually use the value placed into r0 by the inline assembly incorrectly signal the parent to continue. By inspection the same problem is present in ptrace-tm-spd-gpr. Adding r0 to the clobbbers list makes the test fail correctly via a timeout on a P10 running in P8/P9 compatibility mode. Suggested-by: Michael Neuling Signed-off-by: Jordan Niethe Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210729041317.366612-1-jniethe5@gmail.com commit 0f887ac82971cbde59e563d6490c05c6b15aa82f Author: Chunyan Zhang Date: Thu Aug 26 17:15:49 2021 +0800 spi: add sprd ADI for sc9863 and ums512 This patch adds support for sc9863 and ums512. Signed-off-by: Chunyan Zhang Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210826091549.2138125-5-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit f15e60d460391d16bdad2e446e9dca4f264ccdfe Author: Chunyan Zhang Date: Thu Aug 26 17:15:48 2021 +0800 spi: Convert sprd ADI bindings to yaml Convert spi-sprd-adi.txt to yaml. Signed-off-by: Chunyan Zhang Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210826091549.2138125-4-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 1abade64563ef5388db545b55cf158e849f6e717 Author: Nehal Bakulchandra Shah Date: Tue Aug 24 00:14:48 2021 +0530 usb: dwc3: pci: add support for AMD's newer generation platform. AMD's latest platforms has DWC3 controller. Add the PCI ID and properties for the same. Signed-off-by: Nehal Bakulchandra Shah Acked-by: Felipe Balbi Link: https://lore.kernel.org/r/20210823184449.2796184-2-Nehal-Bakulchandra.shah@amd.com Signed-off-by: Greg Kroah-Hartman commit deecae7d96843fceebae06445b3f4bf8cceca31a Merge: bc8e05d6b9658 ee7da21ac4c3b Author: David S. Miller Date: Thu Aug 26 12:13:52 2021 +0100 Merge branch 'LiteETH-driver' Joel Stanley says: ==================== net: Add LiteETH network driver This adds a driver for the LiteX network device, LiteEth. v4 Fixes the bindings and adds r-b tags from Gabriel and Rob. v3 Updates the bindings to describe the slots in a way that makes more sense for the hardware, instead of trying to fit some existing properties. The driver is updated to use these bindings, and fix some issues pointed out by Gabriel. v2 Addresses feedback from Jakub, with detailed changes in each patch. It also moves to the litex register accessors so the system works on big endian litex platforms. I tested with mor1k on an Arty A7-100T. I have removed the mdio aspects of the driver as they are not needed for basic operation. I will continue to work on adding support in the future, but I don't think it needs to block the mac driver going in. The binding describes the mdio registers, and has been fixed to not show any warnings against dtschema master. LiteEth is a simple driver for the FPGA based Ethernet device used in various RISC-V, PowerPC's microwatt, OpenRISC's mor1k and other FPGA based systems on chip. ==================== Signed-off-by: David S. Miller commit ee7da21ac4c3be1f618b6358e0a38739a5d1773e Author: Joel Stanley Date: Thu Aug 26 07:51:06 2021 +0930 net: Add driver for LiteX's LiteETH network interface LiteX is a soft system-on-chip that targets FPGAs. LiteETH is a basic network device that is commonly used in LiteX designs. The driver was first written in 2017 and has been maintained by the LiteX community in various trees. Thank you to all who have contributed. Co-developed-by: Gabriel Somlo Co-developed-by: David Shah Co-developed-by: Stafford Horne Signed-off-by: Joel Stanley Tested-by: Gabriel Somlo Reviewed-by: Gabriel Somlo Signed-off-by: David S. Miller commit b0f8d3077f8feacbd2642fce6e65d3bf04f57501 Author: Joel Stanley Date: Thu Aug 26 07:51:05 2021 +0930 dt-bindings: net: Add bindings for LiteETH LiteETH is a small footprint and configurable Ethernet core for FPGA based system on chips. The hardware is parametrised by the size and number of the slots in it's receive and send buffers. These are described as properties, with the commonly used values set as the default. Signed-off-by: Joel Stanley Signed-off-by: David S. Miller commit 6a48d0ae01a6ab05ae5e78328546a2f5f6d3054a Author: Nadezda Lutovinova Date: Thu Aug 19 18:48:18 2021 +0300 usb: dwc3: imx8mp: request irq after initializing dwc3 If IRQ occurs between calling devm_request_threaded_irq() and initializing dwc3_imx->dwc3, then null pointer dereference occurs since dwc3_imx->dwc3 is used in dwc3_imx8mp_interrupt(). The patch puts registration of the interrupt handler after initializing of neccesery data. Found by Linux Driver Verification project (linuxtesting.org). Reviewed-by: Fabio Estevam Acked-by: Felipe Balbi Signed-off-by: Nadezda Lutovinova Link: https://lore.kernel.org/r/20210819154818.18334-1-lutovinova@ispras.ru Signed-off-by: Greg Kroah-Hartman commit 3b66ca9783d1d1b7be7bf41e8934ca2eaf50a9c0 Author: Chunyan Zhang Date: Thu Aug 26 17:15:47 2021 +0800 spi: sprd: Add ADI r3 support ADI r3p0 is used on SC9863 and UMS512 SoCs. Signed-off-by: Chunyan Zhang Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20210826091549.2138125-3-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d Author: Chunyan Zhang Date: Thu Aug 26 17:15:46 2021 +0800 spi: sprd: Fix the wrong WDG_LOAD_VAL Use 50ms as default timeout value and the time clock is 32768HZ. The original value of WDG_LOAD_VAL is not correct, so this patch fixes it. Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system") Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20210826091549.2138125-2-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 Author: Evgeny Novikov Date: Wed Aug 25 20:09:02 2021 +0300 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe ehci_orion_drv_probe() did not account for possible errors of clk_prepare_enable() that in particular could cause invocation of clk_disable_unprepare() on clocks that were not prepared/enabled yet, e.g. in remove or on handling errors of usb_add_hcd() in probe. Though, there were several patches fixing different issues with clocks in this driver, they did not solve this problem. Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe() to avoid calls of clk_disable_unprepare() without previous successful invocation of clk_prepare_enable(). Found by Linux Driver Verification project (linuxtesting.org). Fixes: 8c869edaee07 ("ARM: Orion: EHCI: Add support for enabling clocks") Co-developed-by: Kirill Shilimanov Reviewed-by: Andrew Lunn Acked-by: Alan Stern Signed-off-by: Evgeny Novikov Signed-off-by: Kirill Shilimanov Link: https://lore.kernel.org/r/20210825170902.11234-1-novikov@ispras.ru Signed-off-by: Greg Kroah-Hartman commit 67021f25d95292d285dd213c58401642b98eaf24 Author: Vladimir Oltean Date: Wed Aug 25 23:50:40 2021 +0300 regmap: teach regmap to use raw spinlocks if requested in the config Some drivers might access regmap in a context where a raw spinlock is held. An example is drivers/irqchip/irq-ls-extirq.c, which calls regmap_update_bits() from struct irq_chip :: irq_set_type, which is a method called by __irq_set_trigger() under the desc->lock raw spin lock. Since desc->lock is a raw spin lock and the regmap internal lock for mmio is a plain spinlock (which can become sleepable on RT), this is an invalid locking scheme and we get a splat stating that this is a "[ BUG: Invalid wait context ]". It seems reasonable for regmap to have an option use a raw spinlock too, so add that in the config such that drivers can request it. Suggested-by: Mark Brown Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20210825205041.927788-2-vladimir.oltean@nxp.com Signed-off-by: Mark Brown commit 2fd276c3ee4bd42eb034f8954964a5ae74187c6b Author: Robin Murphy Date: Wed Aug 25 16:42:03 2021 +0100 ASoC: dwc: Get IRQ optionally The IRQ is explicitly optional, so use platform_get_irq_optional() and avoid platform_get_irq() logging a spurious error when trying to use the thing in DMA mode. Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/c857f334e3c9e651e088b675b3938cb5f798b133.1629906123.git.robin.murphy@arm.com Signed-off-by: Mark Brown commit bc8e05d6b9658b6b59cb770d981064244cdc574b Author: Jonathan Lemon Date: Wed Aug 25 14:17:33 2021 -0700 ptp: ocp: Simplify Kconfig. Remove the 'imply' statements, these apparently are not doing what I expected. Platform modules which are used by the driver still need to be enabled in the overall config for them to be used, but there isn't a hard dependency on them. Use 'depend' for selectable modules which provide functions used directly by the driver. Signed-off-by: Jonathan Lemon Reviewed-by: Arnd Bergmann Reviewed-by: Randy Dunlap Signed-off-by: David S. Miller commit 669bc5a188b40a4edc9c2a42e5b32f19182767d9 Author: Mathias Nyman Date: Fri Aug 20 15:35:03 2021 +0300 xhci: Add bus number to some debug messages As we register two usb buses for each xHC, and systems with several hosts are more and more common it is getting hard to follow the flow of debug messages without knowing which bus they belong to Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0d9b9f533bf1aa555fcd28fa459332b7731316b3 Author: Mathias Nyman Date: Fri Aug 20 15:35:02 2021 +0300 xhci: Add additional dynamic debug to follow URBs in cancel and error cases. Add more debugging messages to follow what happends to a URB internally in special cases like URB cancel, halted endpoints and endpoint reset. Helps tracking issues like URB never given back by host. Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2847c46c61486fd8bca9136a6e27177212e78c69 Author: Mathias Nyman Date: Fri Aug 20 15:35:01 2021 +0300 Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" This reverts commit 5d5323a6f3625f101dbfa94ba3ef7706cce38760. That commit effectively disabled Intel host initiated U1/U2 lpm for devices with periodic endpoints. Before that commit we disabled host initiated U1/U2 lpm if the exit latency was larger than any periodic endpoint service interval, this is according to xhci spec xhci 1.1 specification section 4.23.5.2 After that commit we incorrectly checked that service interval was smaller than U1/U2 inactivity timeout. This is not relevant, and can't happen for Intel hosts as previously set U1/U2 timeout = 105% * service interval. Patch claimed it solved cases where devices can't be enumerated because of bandwidth issues. This might be true but it's a side effect of accidentally turning off lpm. exit latency calculations have been revised since then Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 94f339147fc3eb9edef7ee4ef6e39c569c073753 Author: Mathias Nyman Date: Fri Aug 20 15:35:00 2021 +0300 xhci: Fix failure to give back some cached cancelled URBs. Only TDs with status TD_CLEARING_CACHE will be given back after cache is cleared with a set TR deq command. xhci_invalidate_cached_td() failed to set the TD_CLEARING_CACHE status for some cancelled TDs as it assumed an endpoint only needs to clear the TD it stopped on. This isn't always true. For example with streams enabled an endpoint may have several stream rings, each stopping on a different TDs. Note that if an endpoint has several stream rings, the current code will still only clear the cache of the stream pointed to by the last cancelled TD in the cancel list. This patch only focus on making sure all canceled TDs are given back, avoiding hung task after device removal. Another fix to solve clearing the caches of all stream rings with cancelled TDs is needed, but not as urgent. This issue was simultanously discovered and debugged by by Tao Wang, with a slightly different fix proposal. Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps") Cc: #5.12 Reported-by: Tao Wang Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4843b4b5ec64b875a5e334f280508f1f75e7d3e4 Author: Mathias Nyman Date: Fri Aug 20 15:34:59 2021 +0300 xhci: fix even more unsafe memory usage in xhci tracing Removes static char buffer usage in the following decode functions: xhci_decode_ctrl_ctx() xhci_decode_slot_context() xhci_decode_usbsts() xhci_decode_doorbell() xhci_decode_ep_context() Caller must provide a buffer to use. In tracing use __get_str() as recommended to pass buffer. Minor changes are needed in other xhci code as these functions are also used elsewhere Cc: Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cbf286e8ef8337308c259ff5b9ce2e74d403be5a Author: Mathias Nyman Date: Fri Aug 20 15:34:58 2021 +0300 xhci: fix unsafe memory usage in xhci tracing Removes static char buffer usage in the following decode functions: xhci_decode_trb() xhci_decode_ptortsc() Caller must provide a buffer to use. In tracing use __get_str() as recommended to pass buffer. Minor chanes are needed in xhci debugfs code as these functions are also used there. Changes include moving XHCI_MSG_MAX definititon from xhci-trace.h to xhci.h Cc: Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210820123503.2605901-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4b33433ee734661e5d50851f9bbe7934fc2b1928 Author: Heiner Kallweit Date: Wed Aug 25 18:29:48 2021 +0200 r8169: add rtl_enable_exit_l1 This adds a function for what has been magic register writes so far. It's based on recent changes to vendor drivers r8101, r8168, r8125, and deals with events that trigger an early ASPM L1 exit. Description of the bits has been kindly provided by Realtek. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 9af771d2ec044ffc19192711ac29f1d5c31dc181 Author: Paolo Abeni Date: Thu Aug 26 09:30:42 2021 +0200 selftests/net: allow GRO coalesce test on veth This change extends the existing GRO coalesce test to allow running on top of a veth pair, so that no H/W dep is required to run them. By default gro.sh will use the veth backend, and will try to use exiting H/W in loopback mode if a specific device name is provided with the '-i' command line option. No functional change is intended for the loopback-based tests, just move all the relevant initialization/cleanup code into the related script. Introduces a new initialization helper script for the veth backend, and plugs the correct helper script according to the provided command line. Additionally, enable veth-based tests by default. v1 -> v2: - drop unused code in setup_veth_ns() - Willem Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 1a7f67e618d42e9870dcd9fb0c7b2682d71fd631 Merge: 622909e51a002 e130338eed5de Author: Catalin Marinas Date: Thu Aug 26 11:49:33 2021 +0100 Merge branch 'for-next/entry' into for-next/core * for-next/entry: : More entry.S clean-ups and conversion to C. arm64: entry: call exit_to_user_mode() from C arm64: entry: move bulk of ret_to_user to C arm64: entry: clarify entry/exit helpers arm64: entry: consolidate entry/exit helpers commit 622909e51a00222a7e74cc8f703e533dc5c22d63 Merge: fd264b310579e 7a062ce31807e 50cb99fa89aa2 fa5ca80db89e8 Author: Catalin Marinas Date: Thu Aug 26 11:49:27 2021 +0100 Merge branches 'for-next/mte', 'for-next/misc' and 'for-next/kselftest', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: arm64/perf: Replace '0xf' instances with ID_AA64DFR0_PMUVER_IMP_DEF * for-next/mte: : Miscellaneous MTE improvements. arm64/cpufeature: Optionally disable MTE via command-line arm64: kasan: mte: remove redundant mte_report_once logic arm64: kasan: mte: use a constant kernel GCR_EL1 value arm64: avoid double ISB on kernel entry arm64: mte: optimize GCR_EL1 modification on kernel entry/exit Documentation: document the preferred tag checking mode feature arm64: mte: introduce a per-CPU tag checking mode preference arm64: move preemption disablement to prctl handlers arm64: mte: change ASYNC and SYNC TCF settings into bitfields arm64: mte: rename gcr_user_excl to mte_ctrl arm64: mte: avoid TFSRE0_EL1 related operations unless in async mode * for-next/misc: : Miscellaneous updates. arm64: Do not trap PMSNEVFR_EL1 arm64: mm: fix comment typo of pud_offset_phys() arm64: signal32: Drop pointless call to sigdelsetmask() arm64/sve: Better handle failure to allocate SVE register storage arm64: Document the requirement for SCR_EL3.HCE arm64: head: avoid over-mapping in map_memory arm64/sve: Add a comment documenting the binutils needed for SVE asm arm64/sve: Add some comments for sve_save/load_state() arm64: replace in_irq() with in_hardirq() arm64: mm: Fix TLBI vs ASID rollover arm64: entry: Add SYM_CODE annotation for __bad_stack arm64: fix typo in a comment arm64: move the (z)install rules to arch/arm64/Makefile arm64/sve: Make fpsimd_bind_task_to_cpu() static arm64: unnecessary end 'return;' in void functions arm64/sme: Document boot requirements for SME arm64: use __func__ to get function name in pr_err arm64: SSBS/DIT: print SSBS and DIT bit when printing PSTATE arm64: cpufeature: Use defined macro instead of magic numbers arm64/kexec: Test page size support with new TGRAN range values * for-next/kselftest: : Kselftest additions for arm64. kselftest/arm64: signal: Add a TODO list for signal handling tests kselftest/arm64: signal: Add test case for SVE register state in signals kselftest/arm64: signal: Verify that signals can't change the SVE vector length kselftest/arm64: signal: Check SVE signal frame shows expected vector length kselftest/arm64: signal: Support signal frames with SVE register data kselftest/arm64: signal: Add SVE to the set of features we can check for kselftest/arm64: pac: Fix skipping of tests on systems without PAC kselftest/arm64: mte: Fix misleading output when skipping tests kselftest/arm64: Add a TODO list for floating point tests kselftest/arm64: Add tests for SVE vector configuration kselftest/arm64: Validate vector lengths are set in sve-probe-vls kselftest/arm64: Provide a helper binary and "library" for SVE RDVL kselftest/arm64: Ignore check_gcr_el1_cswitch binary commit ce6a7007048b0abcf263a2b43a63d18614802e53 Author: Pavel Skripkin Date: Tue Aug 24 10:27:13 2021 +0300 staging: r8188eu: remove {read,write}_macreg These 2 functions are unused, so they can be simply removed Signed-off-by: Pavel Skripkin Acked-by: Fabio M. De Francesco Link: https://lore.kernel.org/r/d591e29d77da73790c71f7a8e508a8b16fd48f65.1629789580.git.paskripkin@gmail.com Signed-off-by: Greg Kroah-Hartman commit 419025b3b4190ee867ef4fc48fb3bd7da2e67a0c Merge: 7c7b363d62a51 8ce8a6fce9bfd Author: Marc Zyngier Date: Thu Aug 26 11:36:12 2021 +0100 Merge branch kvm-arm64/misc-5.15 into kvmarm-master/next * kvm-arm64/misc-5.15: : Misc improvements for 5.15: : : - Account the number of VMID-wide TLB invalidations as : remote TLB flushes : - Fix comments in the VGIC code : - Cleanup the PMU IMPDEF identification : - Streamline the TGRAN2 usage : - Avoid advertising a 52bit IPA range for non-64KB configs : - Avoid spurious signalling when a HW-mapped interrupt is in the : A+P state on entry, and in the P state on exit, but that the : physical line is not pending anymore. : - Bunch of minor cleanups KVM: arm64: Trim guest debug exception handling Signed-off-by: Marc Zyngier commit 50cb99fa89aa2bec2cab2f9917010bbd7769bfa3 Author: Alexandru Elisei Date: Tue Aug 24 16:45:23 2021 +0100 arm64: Do not trap PMSNEVFR_EL1 Commit 31c00d2aeaa2 ("arm64: Disable fine grained traps on boot") zeroed the fine grained trap registers to prevent unwanted register traps from occuring. However, for the PMSNEVFR_EL1 register, the corresponding HDFG{R,W}TR_EL2.nPMSNEVFR_EL1 fields must be 1 to disable trapping. Set both fields to 1 if FEAT_SPEv1p2 is detected to disable read and write traps. Fixes: 31c00d2aeaa2 ("arm64: Disable fine grained traps on boot") Cc: # 5.13.x Signed-off-by: Alexandru Elisei Reviewed-by: Mark Brown Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20210824154523.906270-1-alexandru.elisei@arm.com Signed-off-by: Catalin Marinas commit 8ce8a6fce9bfd3fcabe230ad104e2caf08b2e58d Author: Raghavendra Rao Ananta Date: Mon Aug 23 22:39:40 2021 +0000 KVM: arm64: Trim guest debug exception handling The switch-case for handling guest debug exception covers all the debug exception classes, but functionally, doesn't do anything with them other than ESR_ELx_EC_WATCHPT_LOW. Moreover, even though handled well, the 'default' case could be confusing from a security point of view, stating that the guests' actions can potentially flood the syslog. But in reality, the code is unreachable. Hence, trim down the function to only handle the case with ESR_ELx_EC_WATCHPT_LOW with a simple 'if' check. Suggested-by: Marc Zyngier Signed-off-by: Raghavendra Rao Ananta Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20210823223940.1878930-1-rananta@google.com commit 3f60c32f15b0d2956074d684526b128505be0bb7 Author: Saurav Girepunje Date: Sun Aug 22 01:53:08 2021 +0530 staging: r8188eu: core: remove condition with no effect Remove the condition with no effect (if == else) in rtw_led.c file. Acked-by: Phillip Potter Signed-off-by: Saurav Girepunje Link: https://lore.kernel.org/r/YSFgrLUfXzgcT6k4@user Signed-off-by: Greg Kroah-Hartman commit f7766f1b0030e7af179a5e75df52838268102fab Author: Michael Straube Date: Tue Aug 24 14:36:21 2021 +0200 staging: r8188eu: remove ethernet.h header file There are only two definitions from ethernet.h used in the driver. Namely: #define ETHERNET_HEADER_SIZE 14 /* Ethernet Header Length */ #define LLC_HEADER_SIZE 6 /* LLC Header Length */ Both are only used in the file core/rtw_recv.c. Replace the usage of ETHERNET_HEADER_SIZE with ETH_HLEN, move the definition of LLC_HEADER_SIZE into rtw_recv.h and remove the now unused ethernet.h header file. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210824123621.10801-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f09dc911bd26c26bee20e349eb19eaf861c27aab Author: Michael Straube Date: Tue Aug 24 14:36:20 2021 +0200 staging: r8188eu: remove ip.h header file The struct ip_options declared in ip.h is only unsed in the optlength macro which is also defined in ip.h and not used in the driver code. All other definitions/declarations in ip.h are duplicated from . Remove the ip.h header file and its includes. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210824123621.10801-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 68ad97bc5a1b9b5b2c3717ae8c5ca1071d3a88f5 Author: Michael Straube Date: Tue Aug 24 14:36:19 2021 +0200 staging: r8188eu: remove if_ether.h header file All constants, declarations and macros in if_ether.h are either duplicated from or unused. Remove the file if_ether.h and its includes. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210824123621.10801-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f228d1d50904e6a9ac91560578b935b1d853122b Author: Pavel Skripkin Date: Mon Aug 23 21:40:59 2021 +0300 staging: r8188eu: make rtw_deinit_intf_priv return void rtw_deinit_intf_priv() always return success, so there is no need in return value Acked-by: Michael Straube Acked-by: Phillip Potter Acked-by: Martin Kaiser Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20210823184059.19742-1-paskripkin@gmail.com Signed-off-by: Greg Kroah-Hartman commit bd5f258affb124a5bd9d3be94628951b0a8a14c6 Author: Michael Straube Date: Mon Aug 23 14:01:06 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in os_dep/recv_linux.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, the buffer is properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0b704920fba990ad6d0e731f315c71a2422d02cb Author: Michael Straube Date: Mon Aug 23 14:01:05 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in hal/rtl8188eu_xmit.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, the buffer is properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 544984a774f2802c928c92358106f9863fe112ab Author: Michael Straube Date: Mon Aug 23 14:01:04 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in core/rtw_xmit.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, all buffers are properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2d4fe65101b5216838c1d92e6c39a150fc72c837 Author: Michael Straube Date: Mon Aug 23 14:01:03 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in core/rtw_security.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, all buffers are properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit d0624c3379a17b9c6c267378831cdaa60c0af835 Author: Michael Straube Date: Mon Aug 23 14:01:02 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in core/rtw_recv.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, all buffers are properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 129f4197f22d407d47d05babb538bef7339c6cdb Author: Michael Straube Date: Mon Aug 23 14:01:01 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in core/rtw_mp.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, the buffer is properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 08cff18916f5a1d918a902d1f8fe1ef76c2520d4 Author: Michael Straube Date: Mon Aug 23 14:01:00 2021 +0200 staging: r8188eu: use is_multicast_ether_addr in core/rtw_mlme.c Use is_multicast_ether_addr instead of custom macro IS_MCAST, the buffer is properly aligned. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8aa824f2ec1b66fdbf7e5b87e519bced35a35114 Author: Michael Straube Date: Mon Aug 23 14:00:59 2021 +0200 staging: r8188eu: ensure proper alignment for eth address buffers Add __aligned(2) to eth address buffers in structs rx_pkt_attrib and pkt_attrib to ensure proper alignment for usage with functions from Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823120106.9633-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2a3afb168ea7002884ce7e56f5c2e061420a3bcf Author: Michael Straube Date: Sun Aug 22 13:40:14 2021 +0200 staging: r8188eu: remove unnecessary parentheses Remove unnecessary parentheses to improve readability. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210822114014.21584-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f9f72f7f722e32d8f5645e53c1ca90347dedc95c Author: Michael Straube Date: Sun Aug 22 13:40:13 2021 +0200 staging: r8188eu: remove dead code if (0) is never true, remove code that is never executed. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210822114014.21584-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3eaa30d1623e109143c2e30b5738720c1816b851 Author: Michael Straube Date: Mon Aug 23 21:30:28 2021 +0200 staging: r8188eu: remove 5 GHz code The driver is for chips that do not operate in the 5 GHz band. Remove some 5 GHz related code. Acked-by: Phillip Potter Acked-by: Martin Kaiser Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210823193028.12391-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8d82693b0b562086935d23b55877d007b03c532a Author: Michael Straube Date: Sat Aug 21 17:51:51 2021 +0200 staging: r8188eu: remove cmd_osdep.h header file All functions declared in the cmd_osdep.h header file are only used in a single c source file. Make the functions static and remove the header file and its includes. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210821155151.25822-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6ca88cb5e8478e6694b4cccfb2d331435d5bb77c Author: Larry Finger Date: Sat Aug 21 10:14:59 2021 -0500 staging: r8188eu: Make mult-byte entities in dhcp header be big endian The 16- and 32-bit quantities in the dhcp message definition must be big endian. Acked-by: Phillip Potter Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20210821151459.26078-1-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit e92e5f30ad320474346bfd5884cf170ad8c88968 Author: Phillip Potter Date: Sat Aug 21 11:56:15 2021 +0100 staging: r8188eu: change declaration of Efuse_Read1ByteFromFakeContent Remove forward declaration of Efuse_Read1ByteFromFakeContent function from core/rtw_efuse.c, as the function is defined in full directly after this and therefore this forward declaration is redundant. In addition, convert the storage class of the function to static, as the function is only used with rtw_efuse.c, and tidy up the signature alignment. Acked-by: Fabio M. De Francesco Acked-by: Michael Straube Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20210821105615.6307-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 2d29f81ce82208626f4278d6aa9faa5547c5bf02 Author: Xiangyang Zhang Date: Sat Aug 21 16:18:24 2021 +0800 staging: r8188eu: Fix a resource leak in update_bcn_wps_ie The "pbackup_remainder_ie" variable is not freed when "pwps_ie_src" is null Fixes: 15865124feed ("staging: r8188eu: introduce new core dir for RTL8188eu driver") Acked-by: Michael Straube Signed-off-by: Xiangyang Zhang Link: https://lore.kernel.org/r/20210821081824.14745-1-xyz.sun.ok@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5598e47a79b4300ba3ff2a8c7f44a4f8ed4af20d Author: Martin Kaiser Date: Sat Aug 21 18:48:59 2021 +0200 staging: r8188eu: set pipe only once Set the pipe for reading or writing in usbctrl_vendorreq only once. There's no need to set it again for every retry. This patch is an adaptation of commit 889ed8b5e374 ("staging: rtl8188eu: set pipe only once") for the new r8188eu driver. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-10-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit f7231a04e4f12757ca46d99dd6e7b71deea25300 Author: Martin Kaiser Date: Sat Aug 21 18:48:58 2021 +0200 staging: r8188eu: remove unused members of struct _io_ops Remove function pointers which are not used by the r8188eu driver. Acked-by: Michael Straube Acked-by: Phillip Potter Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-9-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 22d0d6104e4d6c7d86ade11888422762db15ab75 Author: Martin Kaiser Date: Sat Aug 21 18:48:57 2021 +0200 staging: r8188eu: clean up the usb_writeN Remove unnecessary variables, check the length. Acked-by: Michael Straube Acked-by: Phillip Potter Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-8-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit e8baed3c765e0f88f4107c52a3505f52d174b41f Author: Martin Kaiser Date: Sat Aug 21 18:48:56 2021 +0200 staging: r8188eu: clean up the usb_writeXY functions Remove unnecessary variables, summarize declarations and assignments. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-7-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 0d3e1be506dda7a0a3d43fad4d943cfbfabadd39 Author: Martin Kaiser Date: Sat Aug 21 18:48:55 2021 +0200 staging: r8188eu: clean up the usb_readXY functions Remove unnecessary variables, summarize declarations and assignments. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 2214ea8299f5dcf1201521ab527b750ec53fbba8 Author: Martin Kaiser Date: Sat Aug 21 18:48:54 2021 +0200 staging: r8188eu: remove an unused enum The VENDOR_READ and VENDOR_WRITE defines are not used. Acked-by: Michael Straube Acked-by: Phillip Potter Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit f410923ad5f577d08bad22bdb11d9660a2a75d25 Author: Martin Kaiser Date: Sat Aug 21 18:48:53 2021 +0200 staging: r8188eu: rewrite usb vendor request defines Replace the numeric values with USB constants to make their meaning clearer. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 805ac0da01f867d5b3412a77110e970063f698c0 Author: Martin Kaiser Date: Sat Aug 21 18:48:52 2021 +0200 staging: rtl8188eu: use actual request type as parameter At the moment, usbctrl_vendorreq's requesttype parameter must be set to 1 for reading and 0 for writing. It's then converted to the actual bmRequestType for the USB control request. We can simplify the code and avoid this conversion if the caller passes the actual bmRequestType. This patch is an adaptation of commit 788fde031027 ("staging: rtl8188eu: use actual request type as parameter") for the new r8188eu driver. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 74f64654ecd22f8e29580f93435406622c90d975 Author: Martin Kaiser Date: Sat Aug 21 18:48:51 2021 +0200 staging: r8188eu: remove unused define _HCI_OPS_OS_C_ is not used in the r8188eu driver. Remove it. Acked-by: Michael Straube Acked-by: Phillip Potter Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 65945da601e816875426b5866746ced4acbc85e6 Author: Martin Kaiser Date: Sat Aug 21 18:48:50 2021 +0200 staging: r8188eu: remove unnecessary cast name is a const char * by default. This type should be ok for r8188eu. Acked-by: Phillip Potter Acked-by: Michael Straube Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20210821164859.4351-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 9bfb54a8c88e025b9ae1fe19afd6500a206dbba5 Author: Michael Straube Date: Wed Aug 25 12:08:42 2021 +0200 staging: rtl8723bs: remove header file ethernet.h The header file ehternet.h defines only two constants. #define ETHERNET_HEADER_SIZE 14 /* Ethernet Header Length */ #define LLC_HEADER_SIZE 6 /* LLC Header Length */ Both are only used in the file core/rtw_recv.c and ETHERNET_HEADER_SIZE just duplicates the in-kernel constant ETH_HLEN. Replace the usage of ETHERNET_HEADER_SIZE with ETH_HLEN, move the definition of LLC_HEADER_SIZE into rtw_rev.h (renamed to LLC_HEADER_LENGTH) and remove the now unused header file ethernet.h. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210825100842.13217-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 07e7f36da8abb4563d145399270c0b92f8d79ff7 Author: Len Baker Date: Tue Aug 24 11:00:39 2021 +0200 staging/rtl8192u: Prefer kcalloc over open coded arithmetic As noted in the "Deprecated Interfaces, Language Features, Attributes, and Conventions" documentation [1], size calculations (especially multiplication) should not be performed in memory allocator (or similar) function arguments due to the risk of them overflowing. This could lead to values wrapping around and a smaller allocation being made than the caller was expecting. Using those allocations could lead to linear overflows of heap memory and other misbehaviors. In this case these aren't actually dynamic sizes: both sides of the multiplication are constant values. However it is best to refactor these anyway, just to keep the open-coded math idiom out of code. So, use the purpose specific kcalloc() function instead of the argument size * count in the kzalloc() function. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments Reviewed-by: Kees Cook Signed-off-by: Len Baker Link: https://lore.kernel.org/r/20210824090039.GA7999@titan Signed-off-by: Greg Kroah-Hartman commit c4b30776bf2941e0d17d3f164e54e553b2456888 Author: Len Baker Date: Tue Aug 24 10:59:58 2021 +0200 staging/rtl8192u: Initialize variables in the definition block Initialize the pre_cmd_cnt, post_cmd_cnt and rf_cmd_cnt variables in the definition block as it is not necessary to do this in the middle of the function. Signed-off-by: Len Baker Link: https://lore.kernel.org/r/20210824073643.GA7396@titan Signed-off-by: Greg Kroah-Hartman commit 7dfe9fac786769e1a49fa350158d39b4fef237ba Author: Len Baker Date: Tue Aug 24 09:25:43 2021 +0200 staging/rtl8192u: Avoid CamelCase in names of variables Avoid CameCase in the names of all local variables inside the function rtl8192_phy_SwChnlStepByStep(). Signed-off-by: Len Baker Link: https://lore.kernel.org/r/20210824072545.7321-2-len.baker@gmx.com Signed-off-by: Greg Kroah-Hartman commit 07abf8b41eaf28ea6e342730b91d5a62fa914431 Author: Fabio Aiuto Date: Mon Aug 23 16:12:03 2021 +0200 staging: rtl8723bs: remove unused rtw_set_802_11_bssid() function remove rtw_set_802_11_bssid() function left unused after wext routines removal. Signed-off-by: Fabio Aiuto Link: https://lore.kernel.org/r/b3d1756b6ae4be7ca4fc50e12bd7e10587a6020c.1629727333.git.fabioaiuto83@gmail.com Signed-off-by: Greg Kroah-Hartman commit b516456cedb66439f33c8878f73bf5dad0223471 Author: Fabio Aiuto Date: Mon Aug 23 16:12:02 2021 +0200 staging: rtl8723bs: remove functions notifying wext events remove functions that once were meant to notify wext events to userspace. Now they are donig nothing useful so just remove them. Signed-off-by: Fabio Aiuto Link: https://lore.kernel.org/r/0d745350ff3d411dda329b8c1e2261361570db6e.1629727333.git.fabioaiuto83@gmail.com Signed-off-by: Greg Kroah-Hartman commit 105bc6b94f0587f1d37c5f3581f94455a2e52722 Author: Fabio Aiuto Date: Mon Aug 23 16:12:01 2021 +0200 staging: rtl8723bs: fix logical continuation issue fix the following post-commit hook checkpatch issue: CHECK: Logical continuations should be on the previous line 52: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:389: + if (padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_ + || padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_ CHECK: Logical continuations should be on the previous line 53: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:390: + || padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_ + || padapter->securitypriv.dot11PrivacyAlgrthm == _AES_) Signed-off-by: Fabio Aiuto Link: https://lore.kernel.org/r/5d4e7ab18005e69e8cc162619149d6fa93568875.1629727333.git.fabioaiuto83@gmail.com Signed-off-by: Greg Kroah-Hartman commit fafb8a21a5c9b899b251994332da1eae01bf44ef Author: Fabio Aiuto Date: Mon Aug 23 16:12:00 2021 +0200 staging: rtl8723bs: fix code indent issues fix the following post commit hook checkpatch issues: ERROR: code indent should use tabs where possible 2463: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:388: + if (padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_$ ERROR: code indent should use tabs where possible 2464: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:389: + || padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_$ ERROR: code indent should use tabs where possible 2465: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:390: + || padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)$ ERROR: code indent should use tabs where possible 2466: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:391: + /* WPS open need to enable multicast */$ ERROR: code indent should use tabs where possible 2467: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:392: + /* check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == true) */$ ERROR: code indent should use tabs where possible 2468: FILE: drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:393: + rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);$ Signed-off-by: Fabio Aiuto Link: https://lore.kernel.org/r/aa394052c8d81b4a00356adf5f98fc3c81f8b1d9.1629727333.git.fabioaiuto83@gmail.com Signed-off-by: Greg Kroah-Hartman commit 174ac41a7aafb31041cba3fe54ccd89b9daeef5d Author: Fabio Aiuto Date: Mon Aug 23 16:11:59 2021 +0200 staging: rtl8723bs: remove obsolete wext support cfg80211 has been fully implemented so remove all wext and wext private handlers and their registration. Now wext userspace calls can be managed via cfg80211 wext compatibility. Signed-off-by: Fabio Aiuto Link: https://lore.kernel.org/r/61c4bb20bbb6ce30e4ddd01aa73de3f686a99445.1629727333.git.fabioaiuto83@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7d761b084b3c785e1fbbe707fbdf7baba905c6ad Author: Sergio Paracuellos Date: Mon Aug 23 19:08:03 2021 +0200 staging: mt7621-pci: fix hang when nothing is connected to pcie ports When nothing is connected to pcie ports, each port is set to reset state. When this occurs, next access result in a hang on boot as follows: mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK) mt7621-pci 1e140000.pcie: pcie1 no card, disable it (RST & CLK) mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK) [ HANGS HERE ] Fix this just detecting 'nothing is connected state' to avoid next accesses to pcie port related configuration registers. Fixes: b99cc3a2b6b6 ("staging: mt7621-pci: avoid custom 'map_irq' function") Cc: stable Reported-by: DENG Qingfang Signed-off-by: Sergio Paracuellos Link: https://lore.kernel.org/r/20210823170803.2108-1-sergio.paracuellos@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8b325d2a099e6fa0f3e1113fc1e7b590360594fa Merge: 723783d077e39 90bd5bee50f2a Author: David S. Miller Date: Thu Aug 26 10:47:43 2021 +0100 Merge tag 'mac80211-next-for-net-next-2021-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== A few more things: * Use correct DFS domain for self-managed devices * some preparations for transmit power element handling and other 6 GHz regulatory handling * TWT support in AP mode in mac80211 ==================== Signed-off-by: David S. Miller commit 723783d077e39c256a1fafebbd97cbb14207c28f Author: Yunsheng Lin Date: Thu Aug 26 10:49:47 2021 +0800 sock: remove one redundant SKB_FRAG_PAGE_ORDER macro Both SKB_FRAG_PAGE_ORDER are defined to the same value in net/core/sock.c and drivers/vhost/net.c. Move the SKB_FRAG_PAGE_ORDER definition to net/core/sock.h, as both net/core/sock.c and drivers/vhost/net.c include it, and it seems a reasonable file to put the macro. Signed-off-by: Yunsheng Lin Acked-by: Jason Wang Signed-off-by: David S. Miller commit 9fdbbe8443a372088c809eb8f2cf4488a41333e8 Merge: bb4544c6d415d c387eea58f931 Author: Arnd Bergmann Date: Thu Aug 26 11:45:06 2021 +0200 Merge tag 'zynq-dt-for-v5.15' of https://github.com/Xilinx/linux-xlnx into arm/dt ARM: dts: Zynq DT changes for v5.15 - Enable nand flash controller for ebaz4205 board * tag 'zynq-dt-for-v5.15' of https://github.com/Xilinx/linux-xlnx: ARM: dts: ebaz4205: enable NAND support ARM: dts: zynq: add NAND flash controller node Link: https://lore.kernel.org/r/f3dc69c8-8a22-e938-4ddf-b1052b8c1437@monstr.eu Signed-off-by: Arnd Bergmann commit 5e8243e66b4d80eeaf9ed8cb0235ff133630a014 Author: Yang Yingliang Date: Wed Aug 25 14:34:47 2021 +0800 octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg() If otx2_mbox_get_rsp() fails, otx2_set_flowkey_cfg() need return an error code. Fixes: e7938365459f ("octeontx2-pf: Fix algorithm index in MCAM rules with RSS action") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: David S. Miller commit bb4544c6d415d42018ecd67826c0ac714bf86b7d Merge: c4d3928250de9 9d508827c7939 Author: Arnd Bergmann Date: Thu Aug 26 11:37:55 2021 +0200 Merge tag 'v5.15-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/dt io-domains for rk3188 and rv1108, sfc (flash) support fpr rv1108 and some cleanups. * tag 'v5.15-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Add SFC to RV1108 ARM: dts: rockchip: add io-domains nodes to rv1108.dtsi ARM: dts: rockchip: add io-domains node to rk3188.dtsi ARM: dts: rockchip: remove interrupt-names from iommu nodes ARM: dts: rockchip: rename timer compatible strings for rk3066a ARM: dts: rockchip: add space after &grf on rk3188 ARM: dts: rockchip: rename pcfg_* nodenames for rk3066/rk3188 Link: https://lore.kernel.org/r/4142796.VLH7GnMWUR@phil Signed-off-by: Arnd Bergmann commit 79cd0bb66e359f5f9398de9d2e86eac776947691 Merge: 07e7e1c9969ff 75b4c5deef011 Author: Arnd Bergmann Date: Thu Aug 26 11:32:31 2021 +0200 Merge tag 'zynq-soc-for-v5.15' of https://github.com/Xilinx/linux-xlnx into arm/defconfig ARM: dts: Zynq SoC changes for v5.15 - Enable PL35X nand driver in multi_v7_defconfig * tag 'zynq-soc-for-v5.15' of https://github.com/Xilinx/linux-xlnx: ARM: configs: multi_v7: enable PL35x NAND controller Link: https://lore.kernel.org/r/5a25f882-103f-4df0-0d90-868d264c900b@monstr.eu Signed-off-by: Arnd Bergmann commit 51e321fed0ff8d64eff809a4ee0547254cdcc4a1 Author: Yang Yingliang Date: Wed Aug 25 09:42:14 2021 +0930 soc: aspeed-lpc-ctrl: Fix clock cleanup in error path Move syscon_regmap_lookup_by_compatible() above the devm_clk_get() to avoid missing clk_disable_unprepare(). Fixes: 2f9b25fa6682 ("soc: aspeed: Re-enable FWH2AHB on AST2600") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Joel Stanley Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20210824085522.1849410-1-yangyingliang@huawei.com Link: https://lore.kernel.org/r/20210825001214.3056193-1-joel@jms.id.au' Signed-off-by: Arnd Bergmann commit 06779631d18ff2901af604eadea0d7b2193db7a1 Merge: 9b3878a99ad60 09f3824342f66 Author: Arnd Bergmann Date: Thu Aug 26 11:29:06 2021 +0200 Merge tag 'reset-for-v5.15' of git://git.pengutronix.de/pza/linux into arm/drivers Reset controller updates for v5.15 Add support for the SC7280 PDC Global and RZ/G2L USB/PHY reset controllers, convert UniPhier glue device tree bindings to json-schema and remove a leftover mention of ZTE zx2967 from Kconfig. * tag 'reset-for-v5.15' of git://git.pengutronix.de/pza/linux: reset: simple: remove ZTE details in Kconfig help reset: renesas: Add RZ/G2L usbphy control driver dt-bindings: reset: Document RZ/G2L USBPHY Control bindings dt-bindings: reset: Convert UniPhier glue reset to json-schema reset: qcom: Add PDC Global reset signals for WPSS dt-bindings: reset: pdc: Add PDC Global bindings dt-bindings: reset: aoss: Add AOSS reset controller binding Link: https://lore.kernel.org/r/d42a75fc17ce718ef1b3fa4c5d3f5c7fb0bd2bc2.camel@pengutronix.de Signed-off-by: Arnd Bergmann commit 9b3878a99ad606fe76a50a290273d7b801f0f895 Merge: 5c785014b67fb 9e5747c57807a Author: Arnd Bergmann Date: Thu Aug 26 11:17:45 2021 +0200 Merge tag 'v5.15-rockchip-driver1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/drivers Yaml conversion of io-domain bindings and addition of rk3568 io domains. * tag 'v5.15-rockchip-driver1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: io-domain: Remove unneeded semicolon soc: rockchip: io-domain: add rk3568 support dt-bindings: power: add rk3568-pmu-io-domain support dt-bindings: soc: rockchip: add rockchip-io-domain.yaml object to grf.yaml dt-bindings: power: convert rockchip-io-domain.txt to YAML soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Link: https://lore.kernel.org/r/9718620.EvYhyI6sBW@phil Signed-off-by: Arnd Bergmann commit 90bd5bee50f2a209ba66f013866959a56ff400b9 Author: Sriram R Date: Thu Aug 26 05:08:50 2021 +0530 cfg80211: use wiphy DFS domain if it is self-managed Currently during CAC start or other radar events, the DFS domain is fetched from cfg based on global DFS domain, even if the wiphy regdomain disagrees. But this could be different in case of self managed wiphy's in case the self managed driver updates its database or supports regions which has DFS domain set to UNSET in cfg80211 local regdomain. So for explicitly self-managed wiphys, just use their DFS domain. Signed-off-by: Sriram R Link: https://lore.kernel.org/r/1629934730-16388-1-git-send-email-srirrama@codeaurora.org Signed-off-by: Johannes Berg commit 366e7ad6ba5f4cb2ffd0b7316e404d6ee9c0f401 Author: Ingo Molnar Date: Thu Aug 26 10:47:09 2021 +0200 sched/fair: Mark tg_is_idle() an inline in the !CONFIG_FAIR_GROUP_SCHED case It's not actually used in the !CONFIG_FAIR_GROUP_SCHED case: kernel/sched/fair.c:488:12: warning: ‘tg_is_idle’ defined but not used [-Wunused-function] Keep around a placeholder nevertheless, for API completeness. Mark it inline, so the compiler doesn't think it must be used. Fixes: 304000390f88: ("sched: Cgroup SCHED_IDLE support") Signed-off-by: Ingo Molnar Cc: Josh Don Cc: Peter Zijlstra (Intel) Cc: Vincent Guittot commit a69bbd2f77a6e26b2b1c3d7fcc5c715169dc01c5 Author: Michael Straube Date: Thu Aug 19 13:22:00 2021 +0200 staging: r8188eu: remove unused function rtw_remove_bcn_ie() Function rtw_remove_bcn_ie() is not used anywhere, remove it. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210819112200.32030-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit fbdbd861c8be66dc6d87f3bdeaec41d7a8efde9a Author: Michael Straube Date: Thu Aug 19 13:21:59 2021 +0200 staging: r8188eu: remove unused function rtw_add_bcn_ie() Function rtw_add_bcn_ie() is not used anywhere, remove it. Acked-by: Phillip Potter Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210819112200.32030-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 30e98ce81bbb51f78134dbeca232f1d4ab215434 Author: Yang Li Date: Fri Aug 20 17:08:25 2021 +0800 staging: r8188eu: remove unneeded semicolon Eliminate the following coccicheck warning: ./drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c:73:66-67: Unneeded semicolon ./drivers/staging/r8188eu/hal/rtl8188e_hal_init.c:2225:68-69: Unneeded semicolon ./drivers/staging/r8188eu/core/rtw_xmit.c:615:75-76: Unneeded semicolon Reported-by: Abaci Robot Signed-off-by: Yang Li Link: https://lore.kernel.org/r/1629450505-28247-1-git-send-email-yang.lee@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman commit b13cead1eca5d8f26eda6c85fb0d6f618f154cdb Merge: 7fe2f1bc15be0 a0c007b3f6455 Author: David S. Miller Date: Thu Aug 26 09:41:50 2021 +0100 Merge branch 'ionic-next' Shannon Nelson says: ==================== ionic: queue and filter mgmt updates After a pair of simple code cleanups, we change the mac filter management to split the updates between the driver's filter list and the device's filter list so that we can keep the calls to dev_uc_sync() and dev_mc_sync() under the netif_addr_lock in ndo_set_rx_mode, and then sync the driver's list to the device later in the rx_mode work task. ==================== Signed-off-by: David S. Miller commit a0c007b3f6455641c5ba7fb5c474401d82387121 Author: Shannon Nelson Date: Wed Aug 25 18:24:50 2021 -0700 ionic: handle mac filter overflow Make sure we go into PROMISC mode when we have too many filters by specifically counting the filters that successfully get saved to the firmware. The device advertises max_ucast_filters and max_mcast_filters, but really only has max_ucast_filters slots available for uc and mc filters combined. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 8b41517313e571344a116cb75f8fc994c5447ffb Author: Shannon Nelson Date: Wed Aug 25 18:24:49 2021 -0700 ionic: refactor ionic_lif_addr to remove a layer The filter counting in ionic_lif_addr() really isn't useful, and potentially misleading, especially when we're checking in ionic_lif_rx_mode() to see if we need to go into PROMISC mode. We can safely refactor this and remove a calling layer. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 969f843946041a8ac10a5af06127a68ab7880ad5 Author: Shannon Nelson Date: Wed Aug 25 18:24:48 2021 -0700 ionic: sync the filters in the work task In order to separate the atomic needs of __dev_uc_sync() and __dev_mc_sync() from the safe rx_mode handling, we need to have the ndo handler manipulate the driver's filter list, and later have the driver sync the filters to the firmware, outside of the atomic context. Here we put __dev_mc_sync() and __dev_uc_sync() back into the ndo callback to give them their netif_addr_lock context and have them update the driver's filter list, flagging changes that should be made to the device filter list. Later, in the rx_mode handler, we read those hints and sync up the device's list as needed. It is possible for multiple add/delete requests to come from the stack before the rx_mode task processes the list, but the handling of the sync status flag should keep everything sorted correctly. For example, if a delete of an existing filter is followed by another add before the rx_mode task is run, as can happen when going in and out of a bond, the add will cancel the delete and no actual changes will be sent to the device. We also add a check in the watchdog to see if there are any stray unsync'd filters, possibly left over from a filter overflow and waiting to get sync'd after some other filter gets removed to make room. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit b941ea057177daf7dd661959803f351808754e6e Author: Shannon Nelson Date: Wed Aug 25 18:24:47 2021 -0700 ionic: flatten calls to set-rx-mode Since only two functions call through ionic_set_rx_mode(), one that can sleep and one that can't, we can split the function and put the bits of code into the callers. This removes an unnecessary calling layer. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 56c8a53b6280732a6e8ae386eec09ca97c9c5373 Author: Shannon Nelson Date: Wed Aug 25 18:24:46 2021 -0700 ionic: remove old work task types With the move of mac filter handling to outside of the ndo_rx_mode context using the IONIC_DW_TYPE_RX_MODE, we no longer are using IONIC_DW_TYPE_RX_ADDR_ADD and IONIC_DW_TYPE_RX_ADDR_DEL and they can be removed. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 86a0727b096dfeb90c10e74b4d6e70c1c237b29a Author: Kees Cook Date: Thu Aug 19 10:45:37 2021 -0700 staging: wlan-ng: Avoid duplicate header in tx/rx frames Instead of open-coding the same header details in the tx/rx frames, directly include the actual struct. Rename associated variables to the more verbose of the two versions. This also has the benefit of being able to replace a field-spanning memcpy() with a direct assignment, helping clear the way for coming FORTIFY_SOURCE improvements. "diffoscope" reports no object code differences after this change, excepting the selection of different registers when switching from memcpy() to direct assignment: --- drivers/staging/wlan-ng/prism2usb.o.before +++ drivers/staging/wlan-ng/prism2usb.o.after ├── objdump --line-numbers --disassemble --demangle --reloc --no-show-raw-insn --section=.text {} │ @@ -4887,24 +4887,24 @@ │ sub %rdi,%rcx │ add $0x3c,%ecx │ shr $0x3,%ecx │ rep stos %rax,%es:(%rdi) │ mov $0x8,%eax │ movl $0x123,0x23e(%rbx) │ mov %ax,0x244(%rbx) │ - mov (%rdx),%rcx │ - mov %rcx,0x246(%rbx) │ - mov 0x8(%rdx),%rcx │ - mov %rcx,0x24e(%rbx) │ - mov 0x10(%rdx),%rcx │ - mov %rcx,0x256(%rbx) │ - mov 0x18(%rdx),%ecx │ - mov %ecx,0x25e(%rbx) │ - movzwl 0x1c(%rdx),%edx │ - mov %dx,0x262(%rbx) │ + mov (%rdx),%rax │ + mov %rax,0x246(%rbx) │ + mov 0x8(%rdx),%rax │ + mov %rax,0x24e(%rbx) │ + mov 0x10(%rdx),%rax │ + mov %rax,0x256(%rbx) │ + mov 0x18(%rdx),%eax │ + mov %eax,0x25e(%rbx) │ + movzwl 0x1c(%rdx),%eax │ + mov %ax,0x262(%rbx) │ cmpq $0x0,0x0(%rbp) │ movzwl 0x70(%rsi),%eax │ je 477a │ add $0x8,%eax │ mov $0x44,%r12d │ mov %ax,0x264(%rbx) │ mov 0x70(%r13),%edx Cc: Romain Perier Cc: Allen Pais Cc: Ivan Safonov Cc: Arnd Bergmann Cc: linux-staging@lists.linux.dev Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210819174537.3499227-3-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman commit 6277fbfdd29ca2fbf5da33e3931087b5356c770b Author: Kees Cook Date: Thu Aug 19 10:45:36 2021 -0700 staging: wlan-ng: Remove pointless a3/a4 union There is no need for the a3/a4 union. The two structs are identical except for the addition of a4. Excepting one place, the structs are only ever used in the union, and the union is always allocated at full size. The one instance of the a3-specific struct can be replaced with the full version, as no sizing information is used. Replace the union with the a4 version of the struct. "diffoscope" reports there are no object code differences after this change. Cc: Allen Pais Cc: Romain Perier Cc: Chen Lin Cc: Ivan Safonov Cc: Arnd Bergmann Cc: linux-staging@lists.linux.dev Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210819174537.3499227-2-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman commit 55cdf7d7b2a187d0c2bcf11ed70e2eeb192713da Author: Michael Straube Date: Thu Aug 19 17:29:14 2021 +0200 staging: r8188eu: use GFP_ATOMIC under spinlock kmalloc() in function update_bcn_wps_ie() is called under a spinlock so the allocation have to be atomic. -> update_beacon() <- takes a spinlock -> update_bcn_vendor_spec_ie() -> update_bcn_wps_ie() Fixes: 79f712ea994de ("staging: r8188eu: Remove wrappers for kalloc() and kzalloc()") Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210819152914.17482-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 89b9f3f39a088a7a0f833621dc62acb201a37ac5 Author: Michael Straube Date: Thu Aug 19 11:24:23 2021 +0200 staging: r8188eu: fix scheduling while atomic bugs These allocations are sometimes done under a spin lock so they have to be atomic. The function call tree is: -> update_beacon() <- takes a spin lock -> update_BCNTIM() -> set_tx_beacon_cmd() Fixes: 79f712ea994de ("staging: r8188eu: Remove wrappers for kalloc() and kzalloc()") Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20210819092423.4349-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit b0345850ad770c5164bf6d4a0aa0c40ef2419cb0 Author: Wen Gong Date: Fri Aug 20 08:20:40 2021 -0400 mac80211: parse transmit power envelope element Parse and store the transmit power envelope element. Signed-off-by: Wen Gong Link: https://lore.kernel.org/r/20210820122041.12157-8-wgong@codeaurora.org Signed-off-by: Johannes Berg commit ad31393b98e4addbc5f1ccc484bfbb8d07c92056 Author: Wen Gong Date: Fri Aug 20 08:20:39 2021 -0400 ieee80211: add definition for transmit power envelope element IEEE Std 802.11ax™-2021 makes changes to the transmit power envelope element, adjust the code accordingly. Signed-off-by: Wen Gong Link: https://lore.kernel.org/r/20210820122041.12157-7-wgong@codeaurora.org Signed-off-by: Johannes Berg commit a1ef61825469b874920f4afb889e1a92353680ff Author: Wen Gong Date: Fri Aug 20 08:20:35 2021 -0400 ieee80211: add definition of regulatory info in 6 GHz operation information IEEE Std 802.11ax™-2021 added regulatory info subfield in HE operation element, add it to the header file. Signed-off-by: Wen Gong Link: https://lore.kernel.org/r/20210820122041.12157-3-wgong@codeaurora.org Signed-off-by: Johannes Berg commit 7fe2f1bc15be08779246f1d46efbaec8b141c9b7 Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:59 2021 +0200 nfc: st95hf: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 994a63434133fdfcf1faea7d9daf3451afdff237 Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:58 2021 +0200 nfc: st21nfca: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 2603ca8720409667e2250f370ea2827c073336df Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:57 2021 +0200 nfc: st-nci: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit 9b3f66bc0eca844bf269befdd620ecf527170e20 Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:56 2021 +0200 nfc: pn544: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit d8eb4eb0ef1da9f6792cd749378be425278ba973 Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:55 2021 +0200 nfc: mrvl: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit ffb239e29518578c45f278fccd32db958ff59174 Author: Krzysztof Kozlowski Date: Wed Aug 25 16:24:54 2021 +0200 nfc: microread: remove unused header includes Do not include unnecessary headers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit a65ab973c1669d3edc27719527bb3906f7b09918 Author: Utkarsh Verma Date: Wed Aug 25 21:53:02 2021 +0530 USB: serial: replace symbolic permissions by octal permissions Replace symbolic permission macros with octal permission numbers because octal permission numbers are easier to read and understand instead of their symbolic macro names. No functional change. Suggested-by: Lukas Bulwahn Signed-off-by: Utkarsh Verma Signed-off-by: Johan Hovold commit 6a371bafe613b7746c3d3ac486bdb3035f77e029 Author: Kim Phillips Date: Tue Aug 17 17:10:48 2021 -0500 perf/x86/amd/ibs: Add bitfield definitions in new header Add with bitfield definitions for IBS MSRs, and demonstrate usage within the driver. Also move 'struct perf_ibs_data' where it can be shared with the perf tool that will soon be using it. No functional changes. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210817221048.88063-9-kim.phillips@amd.com commit 05485745ad482c1910a45f23a5c255f6a0df0f46 Author: Kim Phillips Date: Tue Aug 17 17:10:47 2021 -0500 perf/amd/uncore: Allow the driver to be built as a module Add support to build the AMD uncore driver as a module. This is in order to facilitate development without having to reboot the kernel in most cases. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210817221048.88063-8-kim.phillips@amd.com commit 9164d9493a792682143af12b182be12d7c32b195 Author: Kim Phillips Date: Tue Aug 17 17:10:46 2021 -0500 x86/cpu: Add get_llc_id() helper function Factor out a helper function rather than export cpu_llc_id, which is needed in order to be able to build the AMD uncore driver as a module. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210817221048.88063-7-kim.phillips@amd.com commit 0a0b53e0c3793c0930d258786702d48d21fc6383 Author: Kim Phillips Date: Tue Aug 17 17:10:45 2021 -0500 perf/amd/uncore: Clean up header use, use Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210817221048.88063-6-kim.phillips@amd.com commit 6cf295b21608f9253037335f47cd0dfcce812d81 Author: Kim Phillips Date: Tue Aug 17 17:10:44 2021 -0500 perf/amd/uncore: Simplify code, use free_percpu()'s built-in check for NULL free_percpu() has its own check for NULL, no need to open-code it. Signed-off-by: Kim Phillips Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210817221048.88063-5-kim.phillips@amd.com commit ffec09f9c7d7b21b0aff29dd5c3972f4631c0b6b Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:15:54 2021 +0200 perf/hw_breakpoint: Replace deprecated CPU-hotplug functions The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210803141621.780504-12-bigeasy@linutronix.de commit eda8a2c599d1ff874a63de7684b430740e747dea Author: Sebastian Andrzej Siewior Date: Tue Aug 3 16:15:53 2021 +0200 perf/x86/intel: Replace deprecated CPU-hotplug functions The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock(). Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20210803141621.780504-11-bigeasy@linutronix.de commit 4f32da76a1401dcd088930f0ac8658425524368b Author: Colin Ian King Date: Wed Aug 4 12:57:10 2021 +0100 perf/x86: Remove unused assignment to pointer 'e' The pointer 'e' is being assigned a value that is never read, the assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20210804115710.109608-1-colin.king@canonical.com commit 46466ae3a105d9620e1355e33125a413b8c6ce18 Merge: 3f2cbe3810a60 ccf26483416a3 Author: Ingo Molnar Date: Thu Aug 26 09:14:05 2021 +0200 Merge branch 'perf/urgent' into perf/core, to pick up fixes Signed-off-by: Ingo Molnar commit a290f510a178830a01bfc06e66a54bbe4ece5d2a Author: Palmer Dabbelt Date: Wed Aug 25 22:52:45 2021 -0700 RISC-V: Fix VDSO build for !MMU We don't have a VDSO for the !MMU configurations, so don't try to build one. Fixes: fde9c59aebaf ("riscv: explicitly use symbol offsets for VDSO") Signed-off-by: Palmer Dabbelt commit 803930ee35fafd005fd978d0c0a0d8db5bcba654 Author: Jason Wang Date: Sat Aug 7 15:14:27 2021 +0800 riscv: use strscpy to replace strlcpy The strlcpy should not be used because it doesn't limit the source length. As linus says, it's a completely useless function if you can't implicitly trust the source string - but that is almost always why people think they should use it! All in all the BSD function will lead some potential bugs. But the strscpy doesn't require reading memory from the src string beyond the specified "count" bytes, and since the return value is easier to error-check than strlcpy()'s. In addition, the implementation is robust to the string changing out from underneath it, unlike the current strlcpy() implementation. Thus, We prefer using strscpy instead of strlcpy. Signed-off-by: Jason Wang Signed-off-by: Palmer Dabbelt commit 7d8eb202719b967d4794e679bdb40017685e6515 Merge: 571a9233fcd44 c626f3864bbbb Author: Dave Airlie Date: Thu Aug 26 13:23:57 2021 +1000 Merge tag 'exynos-drm-next-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next Two fixups - Fix missing unlock issue in exynos_drm_g2d.c - Fix a build warning in exynos_drm_dma.c One cleanup - Replace atomic_t with refcount_t in exynos_drm_g2d.c Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/20210821172825.54720-1-inki.dae@samsung.com commit 571a9233fcd44309399ee273d7ce12dc49564839 Merge: 0def4b732b20e fed0289394173 Author: Dave Airlie Date: Thu Aug 26 13:05:10 2021 +1000 Merge tag 'drm/tegra/for-5.15-rc1' of ssh://git.freedesktop.org/git/tegra/linux into drm-next drm/tegra: Changes for v5.15-rc1 The bulk of these changes is a more modern ABI that can be efficiently used on newer SoCs as well as older ones. The userspace parts for this are available here: - libdrm support: https://gitlab.freedesktop.org/tagr/drm/-/commits/drm-tegra-uabi-v8 - VAAPI driver: https://github.com/cyndis/vaapi-tegra-driver In addition, existing userspace from the grate reverse-engineering project has been updated to use this new ABI: - X11 driver: https://github.com/grate-driver/xf86-video-opentegra - 3D driver: https://github.com/grate-driver/grate Other than that, there's also support for display memory bandwidth management for various generations and a bit of cleanup. Signed-off-by: Dave Airlie From: Thierry Reding Link: https://patchwork.freedesktop.org/patch/msgid/20210813163616.2822355-1-thierry.reding@gmail.com commit 0def4b732b20e7621b88f675d0e9f92f3219c1c9 Merge: 697b6e28d0e8e 81fd23e2b3ccf Author: Dave Airlie Date: Thu Aug 26 12:46:52 2021 +1000 Merge commit '81fd23e2b3ccf71c807e671444e8accaba98ca53' of https://git.pengutronix.de/git/lst/linux into drm-next things are still slow in etnaviv land. Just one hardware support addition for the GPU found on the NXP Layerscape LS1028A SoC from Michael and the GEM mmap cleanup from Thomas. Signed-off-by: Dave Airlie From: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/4d16197fa5e4147117fea842f1ed9f0fdadb1d57.camel@pengutronix.de commit eb529c5b10b9401a0f2d1f469e82c6a0ba98082c Author: Daniel Xu Date: Wed Aug 25 18:48:31 2021 -0700 bpf: Fix bpf-next builds without CONFIG_BPF_EVENTS This commit fixes linker errors along the lines of: s390-linux-ld: task_iter.c:(.init.text+0xa4): undefined reference to `btf_task_struct_ids'` Fix by defining btf_task_struct_ids unconditionally in kernel/bpf/btf.c since there exists code that unconditionally uses btf_task_struct_ids. Reported-by: kernel test robot Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/05d94748d9f4b3eecedc4fddd6875418a396e23c.1629942444.git.dxu@dxuuu.xyz commit 697b6e28d0e8ed87a0bc1bf1d2c1a3f3abbce9d3 Merge: 397ab98e2d69c 90a9266269eb9 Author: Dave Airlie Date: Thu Aug 26 12:18:26 2021 +1000 Merge tag 'amd-drm-next-5.15-2021-08-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.15-2021-08-20: amdgpu: - embed hw fence into job - Misc SMU fixes - PSP TA code cleanup - RAS fixes - PWM fan speed fixes - DC workqueue cleanups - SR-IOV fixes - gfxoff delayed work fix - Pin domain check fix amdkfd: - SVM fixes radeon: - Code cleanup Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20210820172335.4190-1-alexander.deucher@amd.com commit 0584e965fb2517f41b7057ffa26f3b6e15a53754 Merge: 7d789bd0089ad 574ee20928675 Author: Alexei Starovoitov Date: Wed Aug 25 17:40:36 2021 -0700 Merge branch 'bpf: tcp: Allow bpf-tcp-cc to call bpf_(get|set)sockopt' Martin KaFai says: ==================== This set allows the bpf-tcp-cc to call bpf_setsockopt. One use case is to allow a bpf-tcp-cc switching to another cc during init(). For example, when the tcp flow is not ecn ready, the bpf_dctcp can switch to another cc by calling setsockopt(TCP_CONGESTION). bpf_getsockopt() is also added to have a symmetrical API, so less usage surprise. v2: - Not allow switching to kernel's tcp_cdg because it is the only kernel tcp-cc that stores a pointer to icsk_ca_priv. Please see the commit log in patch 1 for details. Test is added in patch 4 to check switching to tcp_cdg. - Refactor the logic finding the offset of a func ptr in the "struct tcp_congestion_ops" to prog_ops_moff() in patch 1. - bpf_setsockopt() has been disabled in release() since v1 (please see commit log in patch 1 for reason). bpf_getsockopt() is also disabled together in release() in v2 to avoid usage surprise because both of them are usually expected to be available together. bpf-tcp-cc can already use PTR_TO_BTF_ID to read from tcp_sock. ==================== Signed-off-by: Alexei Starovoitov commit 574ee209286755ae57449196bfa11a90d2d724e5 Author: Martin KaFai Lau Date: Tue Aug 24 10:30:26 2021 -0700 bpf: selftests: Add dctcp fallback test This patch makes the bpf_dctcp test to fallback to cubic by using setsockopt(TCP_CONGESTION) when the tcp flow is not ecn ready. It also checks setsockopt() is not available to release(). The settimeo() from the network_helpers.h is used, so the local one is removed. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210824173026.3979130-1-kafai@fb.com commit 3d7789831df9bda0941bda41cface6687b7c3e04 Author: Martin KaFai Lau Date: Tue Aug 24 10:30:19 2021 -0700 bpf: selftests: Add connect_to_fd_opts to network_helpers The next test requires to setsockopt(TCP_CONGESTION) before connect(), so a new arg is needed for the connect_to_fd() to specify the cc's name. This patch adds a new "struct network_helper_opts" for the future option needs. It starts with the "cc" and "timeout_ms" option. A new helper connect_to_fd_opts() is added to take the new "const struct network_helper_opts *opts" as an arg. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210824173019.3977910-1-kafai@fb.com commit 700dcf0f447691f35abc7121f234457f90fcfb1c Author: Martin KaFai Lau Date: Tue Aug 24 10:30:13 2021 -0700 bpf: selftests: Add sk_state to bpf_tcp_helpers.h Add sk_state define to bpf_tcp_helpers.h. Rename the existing global variable "sk_state" in the kfunc_call test to "sk_state_res". Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210824173013.3977316-1-kafai@fb.com commit eb18b49ea758ec052ac2a12c6bb204e1e877ec31 Author: Martin KaFai Lau Date: Tue Aug 24 10:30:07 2021 -0700 bpf: tcp: Allow bpf-tcp-cc to call bpf_(get|set)sockopt This patch allows the bpf-tcp-cc to call bpf_setsockopt. One use case is to allow a bpf-tcp-cc switching to another cc during init(). For example, when the tcp flow is not ecn ready, the bpf_dctcp can switch to another cc by calling setsockopt(TCP_CONGESTION). During setsockopt(TCP_CONGESTION), the new tcp-cc's init() will be called and this could cause a recursion but it is stopped by the current trampoline's logic (in the prog->active counter). While retiring a bpf-tcp-cc (e.g. in tcp_v[46]_destroy_sock()), the tcp stack calls bpf-tcp-cc's release(). To avoid the retiring bpf-tcp-cc making further changes to the sk, bpf_setsockopt is not available to the bpf-tcp-cc's release(). This will avoid release() making setsockopt() call that will potentially allocate new resources. Although the bpf-tcp-cc already has a more powerful way to read tcp_sock from the PTR_TO_BTF_ID, it is usually expected that bpf_getsockopt and bpf_setsockopt are available together. Thus, bpf_getsockopt() is also added to all tcp_congestion_ops except release(). When the old bpf-tcp-cc is calling setsockopt(TCP_CONGESTION) to switch to a new cc, the old bpf-tcp-cc will be released by bpf_struct_ops_put(). Thus, this patch also puts the bpf_struct_ops_map after a rcu grace period because the trampoline's image cannot be freed while the old bpf-tcp-cc is still running. bpf-tcp-cc can only access icsk_ca_priv as SCALAR. All kernel's tcp-cc is also accessing the icsk_ca_priv as SCALAR. The size of icsk_ca_priv has already been raised a few times to avoid extra kmalloc and memory referencing. The only exception is the kernel's tcp_cdg.c that stores a kmalloc()-ed pointer in icsk_ca_priv. To avoid the old bpf-tcp-cc accidentally overriding this tcp_cdg's pointer value stored in icsk_ca_priv after switching and without over-complicating the bpf's verifier for this one exception in tcp_cdg, this patch does not allow switching to tcp_cdg. If there is a need, bpf_tcp_cdg can be implemented and then use the bpf_sk_storage as the extended storage. bpf_sk_setsockopt proto has only been recently added and used in bpf-sockopt and bpf-iter-tcp, so impose the tcp_cdg limitation in the same proto instead of adding a new proto specifically for bpf-tcp-cc. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210824173007.3976921-1-kafai@fb.com commit a051b2e56f2aa287b37ab0134a8af852f84e3f8e Author: Jun Miao Date: Tue Aug 24 10:43:58 2021 +0800 selftests/x86: Fix error: variably modified 'altstack_data' at file scope A glibc 2.34 feature adds support for variable MINSIGSTKSZ and SIGSTKSZ. When _DYNAMIC_STACK_SIZE_SOURCE or _GNU_SOURCE are defined, MINSIGSTKSZ and SIGSTKSZ are no longer constant on Linux. glibc 2.34 flags code paths assuming MINSIGSTKSZ or SIGSTKSZ are constant. Fix these error in x86 test. Feature description and build error: NEWS for version 2.34 ===================== Major new features: * Add _SC_MINSIGSTKSZ and _SC_SIGSTKSZ. When _DYNAMIC_STACK_SIZE_SOURCE or _GNU_SOURCE are defined, MINSIGSTKSZ and SIGSTKSZ are no longer constant on Linux. MINSIGSTKSZ is redefined to sysconf(_SC_MINSIGSTKSZ) and SIGSTKSZ is redefined to sysconf (_SC_SIGSTKSZ). This supports dynamic sized register sets for modern architectural features like Arm SVE. ===================== If _SC_SIGSTKSZ_SOURCE or _GNU_SOURCE are defined, MINSIGSTKSZ and SIGSTKSZ are redefined as: /* Default stack size for a signal handler: sysconf (SC_SIGSTKSZ). */ # undef SIGSTKSZ # define SIGSTKSZ sysconf (_SC_SIGSTKSZ) /* Minimum stack size for a signal handler: SIGSTKSZ. */ # undef MINSIGSTKSZ # define MINSIGSTKSZ SIGSTKSZ Compilation will fail if the source assumes constant MINSIGSTKSZ or SIGSTKSZ. Build error with the GNU C Library 2.34: DEBUG: | sigreturn.c:150:13: error: variably modified 'altstack_data' at file scope | sigreturn.c:150:13: error: variably modified 'altstack_data' at file scope DEBUG: | 150 | static char altstack_data[SIGSTKSZ]; | 150 | static char altstack_data[SIGSTKSZ]; DEBUG: | | ^~~~~~~~~~~~~ DEBUG: | single_step_syscall.c:60:22: error: variably modified 'altstack_data' at file scope DEBUG: | 60 | static unsigned char altstack_data[SIGSTKSZ]; DEBUG: | | ^~~~~~~~~~~~~ Fixed commit log to improve formatting and clarity: Shuah Khan Link: https://sourceware.org/pipermail/libc-alpha/2021-January/121996.html Link: https://sourceware.org/pipermail/libc-alpha/2021-August/129718.html Suggested-by: Jianwei Hu Signed-off-by: Jun Miao Signed-off-by: Shuah Khan commit f35534a2bcc7fd614a11aa7e3d91a0b1d6c962fb Author: Vineet Gupta Date: Thu Oct 1 16:42:15 2020 -0700 ARC: mm: hack to allow 2 level build with 4 level code PMD_SHIFT is mapped to PUD_SHIFT or PGD_SHIFT by asm-generic/pgtable-* but only for !__ASSEMBLY__ tlbex.S asm code has PTRS_PER_PTE which uses PMD_SHIFT hence barfs for CONFIG_PGTABLE_LEVEL={2,3} and works for 4. So add a workaround local to tlbex.S - the proper fix is to change asm-generic/pgtable-* headers to expose the defines for __ASSEMBLY__ too Signed-off-by: Vineet Gupta commit fe6cb7b043b69cd9498616592bb9e28648fb4f7a Author: Vineet Gupta Date: Fri Sep 13 15:25:52 2019 -0700 ARC: mm: disintegrate pgtable.h into levels and flags - pgtable-bits-arcv2.h (MMU specific page table flags) - pgtable-levels.h (paging levels) No functional changes, but paves way for easy addition of new MMU code with different bits and levels etc Signed-off-by: Vineet Gupta commit 2cc1121bc993ca3090cc4267bc38d3da61b68602 Author: Vineet Gupta Date: Thu Oct 1 19:39:15 2020 -0700 ARC: mm: disintegrate mmu.h (arcv2 bits out) non functional change Tested-by: kernel test robot Signed-off-by: Vineet Gupta commit d035f84d834cd09d0c083f4d4cb3e46c2ae56cb2 Author: Yifan Zhang Date: Wed Aug 25 17:05:09 2021 +0800 drm/amdgpu: rename amdgpu_bo_get_preferred_pin_domain amdgpu_bo_get_preferred_pin_domain is used for page tables creation, which is not involved with page pinning. And it is used in more cases than display scanout, modify its documentation as well. Signed-off-by: Yifan Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 416e1fab475281905e6a45883bc7e5ac8b3f0248 Author: Evan Quan Date: Thu Aug 19 12:14:20 2021 +0800 drm/amdgpu: drop redundant cancel_delayed_work_sync call As those _sw_fini() APIs follow just after _suspend() APIs. And the cancel_delayed_work_sync was already called in latter. Signed-off-by: Evan Quan Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit 859e4659273f1df3a23e3990826bcb41e85f68a5 Author: Evan Quan Date: Thu Aug 19 12:07:59 2021 +0800 drm/amdgpu: add missing cleanups for more ASICs on UVD/VCE suspend This is a supplement for commit below: "drm/amdgpu: add missing cleanups for Polaris12 UVD/VCE on suspend". Signed-off-by: Evan Quan Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit bf756fb833cbe8c6881c964f09db718bade6e591 Author: Evan Quan Date: Tue Aug 17 14:06:21 2021 +0800 drm/amdgpu: add missing cleanups for Polaris12 UVD/VCE on suspend Perform proper cleanups on UVD/VCE suspend: powergate enablement, clockgating enablement and dpm disablement. This can fix some hangs observed on suspending when UVD/VCE still using(e.g. issue "pm-suspend" when video is still playing). Signed-off-by: Evan Quan Signed-off-by: xinhui pan Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit 3998f0b8bc49ec784990971dc1f16bf367b19078 Author: Ronnie Sahlberg Date: Wed Aug 25 21:16:56 2021 +1000 cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED RHBZ: 1994393 If we hit a STATUS_USER_SESSION_DELETED for the Create part in the Create/QueryDirectory compound that starts a directory scan we will leak EDEADLK back to userspace and surprise glibc and the application. Pick this up initiate_cifs_search() and retry a small number of tries before we return an error to userspace. Cc: stable@vger.kernel.org Reported-by: Xiaoli Feng Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 8b51a8e64443b95fb9fec9f76f1c93777b35310a Author: Shubhrajyoti Datta Date: Tue Jul 13 12:30:11 2021 +0530 i2c: cadence: Implement save restore The zynqmp platform now supports chip-off so the registers can lose context. Implement save restore for i2c module. Since we have only a couple of registers an unconditional restore is done. Acked-by: Michal Simek Signed-off-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang commit 661e8a88e8317eb9ffe69c69d6cb4876370fe7e2 Author: Sergey Shtylyov Date: Sun Jul 4 17:47:54 2021 +0300 i2c: xlp9xx: fix main IRQ check Iff platform_get_irq() returns 0 for the main IRQ, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision... Fixes: 2bbd681ba2b ("i2c: xlp9xx: Driver for Netlogic XLP9XX/5XX I2C controller") Signed-off-by: Sergey Shtylyov Reviewed-by: George Cherian Signed-off-by: Wolfram Sang commit 58fb7c643d346e2364404554f531cfa6a1a3917c Author: Sergey Shtylyov Date: Sun Jul 4 17:38:45 2021 +0300 i2c: mt65xx: fix IRQ check Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision... Fixes: ce38815d39ea ("I2C: mediatek: Add driver for MediaTek I2C controller") Signed-off-by: Sergey Shtylyov Reviewed-by: Qii Wang Signed-off-by: Wolfram Sang commit 332c404a55ef3b39837e958284275622a2a4849d Author: Steve French Date: Tue Aug 24 16:14:53 2021 -0500 cifs: add cifs_common directory to MAINTAINERS file With some files moving into the cifs_common directory, we need to add it to the CIFS entry in the MAINTAINERS file. Suggested-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 38f4910b8b26d3a940167f207bddfcc589310c8a Author: Steve French Date: Tue Aug 24 12:07:46 2021 -0500 cifs: cifs_md4 convert to SPDX identifier Add SPDX license identifier and replace license boilerplate for cifs_md4.c Signed-off-by: Steve French commit 42c21973fa3c0f4898330fa30d327fbab67b5460 Author: Ronnie Sahlberg Date: Fri Aug 20 09:32:56 2021 +1000 cifs: create a MD4 module and switch cifs.ko to use it MD4 support will likely be removed from the crypto directory, but is needed for compression of NTLMSSP in SMB3 mounts. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 71c02863246167b3d1639b8278681ca8ebedcb4e Author: Ronnie Sahlberg Date: Thu Aug 19 20:34:59 2021 +1000 cifs: fork arc4 and create a separate module for it for cifs and other users We can not drop ARC4 and basically destroy CIFS connectivity for almost all CIFS users so create a new forked ARC4 module that CIFS and other subsystems that have a hard dependency on ARC4 can use. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c Author: Ronnie Sahlberg Date: Thu Aug 19 20:34:58 2021 +1000 cifs: remove support for NTLM and weaker authentication algorithms for SMB1. This removes the dependency to DES. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 18d04062f83b3eedb64e9f64ede26ee83ae7f152 Author: Shyam Prasad N Date: Tue Aug 10 10:22:28 2021 +0000 cifs: enable fscache usage even for files opened as rw So far, the fscache implementation we had supports only a small set of use cases. Particularly for files opened with O_RDONLY. This commit enables it even for rw based file opens. It also enables the reuse of cached data in case of mount option (cache=singleclient) where it is guaranteed that this is the only client (and server) which operates on the files. There's also a single line change in fscache.c to get around a bug seen in fscache. Signed-off-by: Shyam Prasad N Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit 3d2b50e0e7682b2453ccfac775ad7c2c1d5ceb45 Author: Steve French Date: Fri Aug 20 18:10:36 2021 -0500 oid_registry: Add OIDs for missing Spnego auth mechanisms to Macs In testing mounts to Macs, noticed that the OIDS for some GSSAPI/SPNEGO auth mechanisms sent by the server were not recognized and were missing from the header. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7321be2663da5922343cc121f1ff04924cee2e76 Author: Steve French Date: Mon Aug 23 13:52:12 2021 -0500 smb3: fix posix extensions mount option We were incorrectly initializing the posix extensions in the conversion to the new mount API. CC: # 5.11+ Reported-by: Christian Brauner Acked-by: Christian Brauner Suggested-by: Namjae Jeon Signed-off-by: Steve French commit d72c74197b70bc3c95152f351a568007bffa3e11 Author: Ding Hui Date: Tue Aug 17 22:55:10 2021 +0800 cifs: fix wrong release in sess_alloc_buffer() failed path smb_buf is allocated by small_smb_init_no_tc(), and buf type is CIFS_SMALL_BUFFER, so we should use cifs_small_buf_release() to release it in failed path. Signed-off-by: Ding Hui Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 Author: Len Baker Date: Tue Aug 17 12:27:09 2021 +0200 CIFS: Fix a potencially linear read overflow strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated. Also, the strnlen() call does not avoid the read overflow in the strlcpy function when a not NUL-terminated string is passed. So, replace this block by a call to kstrndup() that avoids this type of overflow and does the same. Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions") Signed-off-by: Len Baker Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Jeff Layton Signed-off-by: Steve French commit 7ee656c3ac3d047b4cf1269f83ac9d6c0bba916b Author: Christoph Hellwig Date: Wed Aug 25 18:31:08 2021 +0200 nbd: remove nbd->destroy_complete The nbd->destroy_complete pointer is not really needed. For creating a device without a specific index we now simplify skip devices marked NBD_DESTROY_ON_DISCONNECT as there is not much point to reuse them. For device creation with a specific index there is no real need to treat the case of a requested but not finished disconnect different than any other device that is being shutdown, i.e. we can just return an error, as a slightly different race window would anyway. Fixes: 6e4df4c64881 ("nbd: reduce the nbd_index_mutex scope") Reported-by: Tetsuo Handa Reported-by: syzbot+2c98885bcd769f56b6d6@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-7-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit 438cd318c8dfa5228ffd43af1b98d7cd7d92e1c6 Author: Christoph Hellwig Date: Wed Aug 25 18:31:07 2021 +0200 nbd: only return usable devices from nbd_find_unused Device marked as NBD_DESTROY_ON_DISCONNECT can and should be skipped given that they won't survive the disconnect. So skip them and try to grab a reference directly and just continue if the the devices is being torn down or created and thus has a zero refcount. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-6-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit b190300decb352a0b865d7aa379e89b17d772a43 Author: Tetsuo Handa Date: Wed Aug 25 18:31:06 2021 +0200 nbd: set nbd->index before releasing nbd_index_mutex Set nbd->index before releasing nbd_index_mutex, as populate_nbd_status() might access nbd->index as soon as nbd_index_mutex is released. Fixes: 6e4df4c64881 ("nbd: reduce the nbd_index_mutex scope") Signed-off-by: Tetsuo Handa [hch: split from a larger patch] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-5-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit 75b7f62aa65d5c496391ec2c3db3561aaf81a403 Author: Tetsuo Handa Date: Wed Aug 25 18:31:05 2021 +0200 nbd: prevent IDR lookups from finding partially initialized devices Previously nbd_index_mutex was held during whole add/remove/lookup operations in order to guarantee that partially initialized devices are not reachable via idr_find() or idr_for_each(). But now that partially initialized devices become reachable as soon as idr_alloc() succeeds, we need to skip partially initialized devices. Since it seems that all functions use refcount_inc_not_zero(&nbd->refs) in order to skip destroying devices, update nbd->refs from zero to non-zero as the last step of device initialization in order to also skip partially initialized devices. Fixes: 6e4df4c64881 ("nbd: reduce the nbd_index_mutex scope") Signed-off-by: Tetsuo Handa [hch: split from a larger patch, added comments] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-4-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit 409e0ff10ead30a620ee48acb6d4545d9cb95359 Author: Christoph Hellwig Date: Wed Aug 25 18:31:04 2021 +0200 nbd: reset NBD to NULL when restarting in nbd_genl_connect When nbd_genl_connect restarts to wait for a disconnecting device, nbd needs to be reset to NULL. Do that by facoring out a helper to find an unused device. Fixes: 6177b56c96ff ("nbd: refactor device search and allocation in nbd_genl_connect") Reported-by: Tetsuo Handa Reported-by: Hillf Danton Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-3-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit 93f63bc41f699318807df202a175d564c26bda87 Author: Tetsuo Handa Date: Wed Aug 25 18:31:03 2021 +0200 nbd: add missing locking to the nbd_dev_add error path idr_remove needs external synchronization. Fixes: 6e4df4c64881 ("nbd: reduce the nbd_index_mutex scope") Signed-off-by: Tetsuo Handa [hch: split from a larger patch] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210825163108.50713-2-hch@lst.de Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe commit 3673fdeafd5f9d9aa90b35f7e11a556fe0cbbe62 Author: Changcheng Deng Date: Mon Aug 23 20:03:38 2021 -0700 kselftest:sched: remove duplicate include in cs_prctl_test.c Clean up the following includecheck warning: ./tools/testing/selftests/sched/cs_prctl_test.c: Include files sys/types.h and sys/wait.h are included more than once. No functional change. Fixed commit header and log: Shuah Khan Reported-by: Zeal Robot Signed-off-by: Changcheng Deng Signed-off-by: Shuah Khan commit d538ddb97e066571e4fc58b832f40739621b42bb Author: Baolin Wang Date: Wed Aug 25 09:49:04 2021 +0800 selftests: openat2: Fix testing failure for O_LARGEFILE flag The openat2 test suite fails on ARM64 because the definition of O_LARGEFILE is different on ARM64. Fix the problem by defining the correct O_LARGEFILE definition on ARM64. "openat2 unexpectedly returned # 3['.../tools/testing/selftests/openat2'] with 208000 (!= 208000) not ok 102 openat2 with incompatible flags (O_PATH | O_LARGEFILE) fails with -22 (Invalid argument)" Fixed change log to improve formatting and clarity: Shuah Khan Signed-off-by: Baolin Wang Reviewed-by: Aleksa Sarai Acked-by: Christian Brauner Signed-off-by: Shuah Khan commit 7d789bd0089ad2a6cc2315f281018bfafae820bc Merge: 35cba2988fc65 33a6bef8cf920 Author: Alexei Starovoitov Date: Wed Aug 25 12:22:01 2021 -0700 Merge branch 'selftests: xsk: various simplifications' Magnus Karlsson says: ==================== This patch set mainly contains various simplifications to the xsk selftests. The only exception is the introduction of packet streams that describes what the Tx process should send and what the Rx process should receive. If it receives anything else, the test fails. This mechanism can be used to produce tests were all packets are not received by the Rx thread or modified in some way. An example of this is if an XDP program does XDP_PASS on some of the packets. This patch set will be followed by another patch set that implements a new structure that will facilitate adding new tests. A couple of new tests will also be included in that patch set. v2 -> v3: * Reworked patch 12 so that it now has functions for creating and destroying ifobjects. Simplifies the code. [Maciej] * The packet stream now allocates the supplied buffer array length, instead of the default one. [Maciej] * pkt_stream_get_pkt() now returns NULL when indexing a non-existing packet. [Maciej] * pkt_validate() is now is_pkt_valid(). [Maciej] * Slowed down packet sending speed even more in patch 11 so that slow systems do not silenty drop packets in skb mode. v1 -> v2: * Dropped the patch with per process limit changes as it is not needed [Yonghong] * Improved the commit message of patch 1 [Yonghong] * Fixed a spelling error in patch 9 Thanks: Magnus ==================== Acked-by: Maciej Fijalkowski Signed-off-by: Alexei Starovoitov commit 33a6bef8cf92017ff48e3bd597d7d60652f37b6d Author: Magnus Karlsson Date: Wed Aug 25 11:37:22 2021 +0200 selftests: xsk: Preface options with opt Preface all options with opt_ and make them booleans. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-17-magnus.karlsson@gmail.com commit 279bdf6b79d5f6a4decbf2699092b55c8c782eec Author: Magnus Karlsson Date: Wed Aug 25 11:37:21 2021 +0200 selftests: xsk: Make enums lower case Make enums lower case as that is the standard. Also drop the unnecessary TEST_MODE_UNCONFIGURED mode. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-16-magnus.karlsson@gmail.com commit 29f128b38b346a16dc6749b66f20fca29430d271 Author: Magnus Karlsson Date: Wed Aug 25 11:37:20 2021 +0200 selftests: xsk: Generate packets from specification Generate packets from a specification instead of something hard coded. The idea is that a test generates one or more packet specifications and provides it/them to both Tx and Rx. The Tx thread will generate from this specification and Rx will validate that it receives what is in the specification. The specification can be the same on both ends, meaning that everything that was sent should be received, or different which means that Rx will only receive part of the sent packets. Currently, the packet specification is the same for both Rx and Tx and the same for each test. This will change in later work as features and tests are added. The data path functions are also renamed to better reflect what actions they are performing after introducing this feature. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-15-magnus.karlsson@gmail.com commit 960b6e0153fb383bd634313fbd41bd4813dd73fc Author: Magnus Karlsson Date: Wed Aug 25 11:37:19 2021 +0200 selftests: xsk: Generate packet directly in umem Generate the packet directly in the umem instead of in a temporary buffer that is copied out. Simplifies the code and improves performance. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-14-magnus.karlsson@gmail.com commit 1034b03e54ac80f093619ead6c3b77d0c3086a2b Author: Magnus Karlsson Date: Wed Aug 25 11:37:18 2021 +0200 selftests: xsk: Simplify cleanup of ifobjects Simpify the cleanup of ifobjects right before the program exits by introducing functions for creating and destroying these objects. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-13-magnus.karlsson@gmail.com commit ab7c95abb5f9d05470ede8e75a105c81c2dbf2c1 Author: Magnus Karlsson Date: Wed Aug 25 11:37:17 2021 +0200 selftests: xsk: Decrease sending speed Decrease sending speed to avoid potentially overflowing some buffers in the skb case that leads to dropped packets we cannot control (and thus the tests may generate false negatives). Decrease batch size and introduce a usleep in the transmit thread to not overflow the receiver. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-12-magnus.karlsson@gmail.com commit b04fdc4ce31fe5ae411737ec6705fcdfc493d6c8 Author: Magnus Karlsson Date: Wed Aug 25 11:37:16 2021 +0200 selftests: xsk: Validate tx stats on tx thread Validate the tx stats on the Tx thread instead of the Rx thread. Depending on your settings, you might not be allowed to query the statistics of a socket you do not own, so better to do this on the correct thread to start with. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-11-magnus.karlsson@gmail.com commit 0d41f59f458a4f08353f7aba64bbc6388a858265 Author: Magnus Karlsson Date: Wed Aug 25 11:37:15 2021 +0200 selftests: xsk: Simplify packet validation in xsk tests Simplify packet validation in the xsk selftests by performing it at once for every packet. The current code performed this per batch and did this on copied packet data. Make it simpler and faster by validating it at once and on the umem packet data thus skipping the copy and the memory allocation for the temprary buffer. The optional packet dump feature is also simplified in the same manner. Memory allocation and copying is removed and the dump is performed directly on the umem data. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-10-magnus.karlsson@gmail.com commit 9da2ea4fe8d10060a417a71f808df7e825660867 Author: Magnus Karlsson Date: Wed Aug 25 11:37:14 2021 +0200 selftests: xsk: Rename worker_* functions that are not thread entry points Rename worker_* functions that are not thread entry points to something else. This was confusing. Now only thread entry points are worker_something. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-9-magnus.karlsson@gmail.com commit d40ba9d33ae8ed937234fd12b7303a997406bd87 Author: Magnus Karlsson Date: Wed Aug 25 11:37:13 2021 +0200 selftests: xsk: Disassociate umem size with packets sent Disassociate the number of packets sent with the number of buffers in the umem. This so we can loop over the umem to test more things. Set the size of the umem to be a multiple of 2M. A requirement for huge pages that are needed in unaligned mode. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-8-magnus.karlsson@gmail.com commit 9c5ce931b16ea83fa01e5e4ca95b5172f1cde01a Author: Magnus Karlsson Date: Wed Aug 25 11:37:12 2021 +0200 selftests: xsk: Remove end-of-test packet Get rid of the end-of-test packet and just count the number of packets received and quit when the expected number as been received. Simplifies the code. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-7-magnus.karlsson@gmail.com commit 1314c3537f661002a65999784c0f3f42d7de87f6 Author: Magnus Karlsson Date: Wed Aug 25 11:37:11 2021 +0200 selftests: xsk: Simplify the retry code Simplify the retry code and make it more efficient by waiting first, instead of trying immediately which always fails due to the asynchronous nature of xsk socket close. Also decrease the wait time to significantly lower the run-time of the test suite. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-6-magnus.karlsson@gmail.com commit 083be682d97695979e1bdfac1d4274234555f77b Author: Magnus Karlsson Date: Wed Aug 25 11:37:10 2021 +0200 selftests: xsk: Return correct error codes Return the correct error codes so they can be printed correctly. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-5-magnus.karlsson@gmail.com commit 13a6ebd9084a398b93e3e06ca59254df9aa95336 Author: Magnus Karlsson Date: Wed Aug 25 11:37:09 2021 +0200 selftests: xsk: Remove unused variables Remove unused variables and typedefs. The *_npkts variables are incremented but never used. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-4-magnus.karlsson@gmail.com commit 25c0a30541e4a7ddb4b45c2c923f799c76c95ef5 Author: Magnus Karlsson Date: Wed Aug 25 11:37:08 2021 +0200 selftests: xsk: Remove the num_tx_packets option Remove the number of tx packet option as this should be decided by the test itself. Also change the number of packets to be sent to 4096 speeding up the execution. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-3-magnus.karlsson@gmail.com commit d18b09bf67bb821807de202a1b8d239a946118e7 Author: Magnus Karlsson Date: Wed Aug 25 11:37:07 2021 +0200 selftests: xsk: Remove color mode Remove color mode since it does not add any value and having less code means less maintenance which is a good thing. Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210825093722.10219-2-magnus.karlsson@gmail.com commit 0c6e1d7fd5e7560fdc4bb3418c2c0f0d7a95bf76 Author: Hao Xu Date: Thu Aug 26 01:58:56 2021 +0800 io_uring: don't free request to slab It's not necessary to free the request back to slab when we fail to get sqe, just move it to state->free_list. Signed-off-by: Hao Xu Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20210825175856.194299-1-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe commit 9d68cd9120e4e3af38f843e165631c323b86b4e4 Author: Vitaly Kuznetsov Date: Wed Aug 25 15:38:57 2021 +0200 hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer Commit adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") introduced a notion of maximum packet size and for KVM and FCOPY drivers set it to the length of the receive buffer. VSS driver wasn't updated, this means that the maximum packet size is now VMBUS_DEFAULT_MAX_PKT_SIZE (4k). Apparently, this is not enough. I'm observing a packet of 6304 bytes which is being truncated to 4096. When VSS driver tries to read next packet from ring buffer it starts from the wrong offset and receives garbage. Set the maximum packet size to 'HV_HYP_PAGE_SIZE * 2' in VSS driver. This matches the length of the receive buffer and is in line with other utils drivers. Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20210825133857.847866-1-vkuznets@redhat.com Signed-off-by: Wei Liu commit eb0feefd4c025b2697464d141f7ff178095f34df Author: Jason Gunthorpe Date: Mon Aug 23 11:42:04 2021 -0300 vfio/ap_ops: Convert to use vfio_register_group_dev() This is straightforward conversion, the ap_matrix_mdev is actually serving as the vfio_device and we can replace all the mdev_get_drvdata()'s with a simple container_of() or a dev_get_drvdata() for sysfs paths. Cc: Alex Williamson Cc: Cornelia Huck Cc: kvm@vger.kernel.org Cc: Christoph Hellwig Reviewed-by: Tony Krowiak Reviewed-by: Christoph Hellwig Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/0-v4-0203a4ab0596+f7-vfio_ap_jgg@nvidia.com Signed-off-by: Alex Williamson commit 13b11b316f52272ccbf2f664b14a740cc616526f Author: Michal Simek Date: Wed Aug 25 09:46:28 2021 +0200 dt-bindings: Add vendor prefix for Topic Embedded Systems Add vendor prefix for Topic Embedded Systems (http://topic.nl). Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/b6e42012977876c421672a84bdb7636be819d664.1629877585.git.michal.simek@xilinx.com Signed-off-by: Rob Herring commit 2fcf9a178ba1f2d4f2bf715312b84508850701d2 Author: Geert Uytterhoeven Date: Wed Aug 25 11:40:40 2021 +0200 of: fdt: Rename reserve_elfcorehdr() to fdt_reserve_elfcorehdr() On ia64/allmodconfig: drivers/of/fdt.c:609:20: error: conflicting types for 'reserve_elfcorehdr'; have 'void(void)' 609 | static void __init reserve_elfcorehdr(void) | ^~~~~~~~~~~~~~~~~~ arch/ia64/include/asm/meminit.h:43:12: note: previous declaration of 'reserve_elfcorehdr' with type 'int(u64 *, u64 *)' {aka 'int(long long unsigned int *, long long unsigned int *)'} 43 | extern int reserve_elfcorehdr(u64 *start, u64 *end); | ^~~~~~~~~~~~~~~~~~ Fix this by prefixing the FDT function name with "fdt_". Fixes: f7e7ce93aac13118 ("of: fdt: Add generic support for handling elf core headers property") Reported-by: kernel test robot Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/f6eabbbce0fba6da3da0264c1e1cf23c01173999.1629884393.git.geert+renesas@glider.be Signed-off-by: Rob Herring commit 1cc5b9a411e43aa2cb5060429ede6c50217bad90 Author: Sumeet Pawnikar Date: Fri Aug 20 17:22:33 2021 +0530 powercap: Add Power Limit4 support for Alder Lake SoC Add Power Limit4 support for Alder Lake SoC. Signed-off-by: Sumeet Pawnikar Acked-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit d0e936adbd2250cb03f2e840c6651d18edc22ace Author: Srinivas Pandruvada Date: Thu Aug 19 19:40:06 2021 -0700 cpufreq: intel_pstate: Process HWP Guaranteed change notification It is possible that HWP guaranteed ratio is changed in response to change in power and thermal limits. For example when Intel Speed Select performance profile is changed or there is change in TDP, hardware can send notifications. It is possible that the guaranteed ratio is increased. This creates an issue when turbo is disabled, as the old limits set in MSR_HWP_REQUEST are still lower and hardware will clip to older limits. This change enables HWP interrupt and process HWP interrupts. When guaranteed is changed, calls cpufreq_update_policy() so that driver callbacks are called to update to new HWP limits. This callback is called from a delayed workqueue of 10ms to avoid frequent updates. Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 950809cd6ca2ff2e2bb9d826c4d9e35d134d7de0 Author: Srinivas Pandruvada Date: Thu Aug 19 19:40:05 2021 -0700 thermal: intel: Allow processing of HWP interrupt Add a weak function to process HWP (Hardware P-states) notifications and move updating HWP_STATUS MSR to this function. This allows HWP interrupts to be processed by the intel_pstate driver in HWP mode by overriding the implementation. Signed-off-by: Srinivas Pandruvada Acked-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 97e03410bc5f6a20d46b15740c2eae240f766e39 Author: Adrian Huang Date: Thu Aug 19 15:14:16 2021 +0800 ACPI: tables: FPDT: Do not print FW_BUG message if record types are reserved In ACPI 6.4 spec, record types "0x0002-0xffff" of FPDT Performance Record Types [1] and record types "0x0003-0xffff" of Runtime Performance Record Types [2] are reserved. Users might be confused with the FW_BUG message, and they think this is the FW issue. Here is the example in a Lenovo box: ACPI: FPDT 0x00000000A820A000 000044 (v01 LENOVO THINKSYS 00000100 01000013) ACPI: Reserving FPDT table memory at [mem 0xa820a000-0xa820a043] ACPI FPDT: [Firmware Bug]: Invalid record 4113 found So, remove the FW_BUG message to avoid confusion since those types are reserved in ACPI 6.4 spec. [1] https://uefi.org/specs/ACPI/6.4/05_ACPI_Software_Programming_Model/ACPI_Software_Programming_Model.html#fpdt-performance-record-types-table [2] https://uefi.org/specs/ACPI/6.4/05_ACPI_Software_Programming_Model/ACPI_Software_Programming_Model.html#runtime-performance-record-types-table Signed-off-by: Adrian Huang Acked-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit 1a20d409c874255086e2f42a729826d490294c91 Author: Ulrich Huber Date: Tue Aug 24 14:57:44 2021 +0200 ACPI: button: Add DMI quirk for Lenovo Yoga 9 (14INTL5) The Lenovo Yoga 9 (14INTL5)'s ACPI _LID is bugged: After hibernation the lid is initially reported as closed. Once closing and then reopening the lid reports the lid as open again. This leads to the conclusion that the initial notification of the lid is missing but subsequent notifications are correct. In order fo the Linux LID code to handle this device properly the lid_init_state must be set to ACPI_BUTTON_LID_INIT_OPEN. Signed-off-by: Ulrich Huber Signed-off-by: Rafael J. Wysocki commit 145eba1aaec9f6798c30842d201920a80f9049a3 Author: Cai Huoqing Date: Mon Aug 23 12:26:22 2021 +0800 RDMA/hfi1: Convert to SPDX identifier use SPDX-License-Identifier instead of a verbose license text Link: https://lore.kernel.org/r/20210823042622.109-1-caihuoqing@baidu.com Signed-off-by: Cai Huoqing Signed-off-by: Jason Gunthorpe commit d164bf64a9006ceafb534e411784a2f77de909c9 Author: Cai Huoqing Date: Mon Aug 23 10:35:30 2021 +0800 IB/rdmavt: Convert to SPDX identifier use SPDX-License-Identifier instead of a verbose license text Link: https://lore.kernel.org/r/20210823023530.48-1-caihuoqing@baidu.com Signed-off-by: Cai Huoqing Signed-off-by: Jason Gunthorpe commit 437b38c51162f8b87beb28a833c4d5dc85fa864e Author: Lorenzo Pieralisi Date: Mon Aug 23 11:46:18 2021 +0100 ACPI: Add memory semantics to acpi_os_map_memory() The memory attributes attached to memory regions depend on architecture specific mappings. For some memory regions, the attributes specified by firmware (eg uncached) are not sufficient to determine how a memory region should be mapped by an OS (for instance a region that is define as uncached in firmware can be mapped as Normal or Device memory on arm64) and therefore the OS must be given control on how to map the region to match the expected mapping behaviour (eg if a mapping is requested with memory semantics, it must allow unaligned accesses). Rework acpi_os_map_memory() and acpi_os_ioremap() back-end to split them into two separate code paths: acpi_os_memmap() -> memory semantics acpi_os_ioremap() -> MMIO semantics The split allows the architectural implementation back-ends to detect the default memory attributes required by the mapping in question (ie the mapping API defines the semantics memory vs MMIO) and map the memory accordingly. Link: https://lore.kernel.org/linux-arm-kernel/31ffe8fc-f5ee-2858-26c5-0fd8bdd68702@arm.com Tested-by: Hanjun Guo Signed-off-by: Lorenzo Pieralisi Acked-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Rafael J. Wysocki commit 35cba2988fc65239d10566edc03cc0978382c25f Merge: 3bbc8ee7c363a 576d47bb1a926 Author: Alexei Starovoitov Date: Wed Aug 25 10:37:06 2021 -0700 Merge branch 'bpf: Add bpf_task_pt_regs() helper' Daniel Xu says: ==================== The motivation behind this helper is to access userspace pt_regs in a kprobe handler. uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a kprobe handler. The final case (kernelspace pt_regs in uprobe) is pretty rare (usermode helper) so I think that can be solved later if necessary. More concretely, this helper is useful in doing BPF-based DWARF stack unwinding. Currently the kernel can only do framepointer based stack unwinds for userspace code. This is because the DWARF state machines are too fragile to be computed in kernelspace [0]. The idea behind DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace stack (while in prog context) and send it up to userspace for unwinding (probably with libunwind) [1]. This would effectively enable profiling applications with -fomit-frame-pointer using kprobes and uprobes. [0]: https://lkml.org/lkml/2012/2/10/356 [1]: https://github.com/danobi/bpf-dwarf-walk Changes from v1: - Conwolidate BTF_ID decls for task_struct - Enable bpf_get_current_task_btf() for all prog types - Enable bpf_task_pt_regs() for all prog types - Use ASSERT_* macros instead of CHECK ==================== Signed-off-by: Alexei Starovoitov commit 576d47bb1a926fe8162253e0bca28e9bede8cf48 Author: Daniel Xu Date: Mon Aug 23 19:43:50 2021 -0700 bpf: selftests: Add bpf_task_pt_regs() selftest This test retrieves the uprobe's pt_regs in two different ways and compares the contents in an arch-agnostic way. Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/5581eb8800f6625ec8813fe21e9dce1fbdef4937.1629772842.git.dxu@dxuuu.xyz commit dd6e10fbd9fb86a571d925602c8a24bb4d09a2a7 Author: Daniel Xu Date: Mon Aug 23 19:43:49 2021 -0700 bpf: Add bpf_task_pt_regs() helper The motivation behind this helper is to access userspace pt_regs in a kprobe handler. uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a kprobe handler. The final case (kernelspace pt_regs in uprobe) is pretty rare (usermode helper) so I think that can be solved later if necessary. More concretely, this helper is useful in doing BPF-based DWARF stack unwinding. Currently the kernel can only do framepointer based stack unwinds for userspace code. This is because the DWARF state machines are too fragile to be computed in kernelspace [0]. The idea behind DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace stack (while in prog context) and send it up to userspace for unwinding (probably with libunwind) [1]. This would effectively enable profiling applications with -fomit-frame-pointer using kprobes and uprobes. [0]: https://lkml.org/lkml/2012/2/10/356 [1]: https://github.com/danobi/bpf-dwarf-walk Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/e2718ced2d51ef4268590ab8562962438ab82815.1629772842.git.dxu@dxuuu.xyz commit a396eda5517ac958fb4eb7358f4708eb829058c4 Author: Daniel Xu Date: Mon Aug 23 19:43:48 2021 -0700 bpf: Extend bpf_base_func_proto helpers with bpf_get_current_task_btf() bpf_get_current_task() is already supported so it's natural to also include the _btf() variant for btf-powered helpers. This is required for non-tracing progs to use bpf_task_pt_regs() in the next commit. Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/f99870ed5f834c9803d73b3476f8272b1bb987c0.1629772842.git.dxu@dxuuu.xyz commit 33c5cb36015ac1034b50b823fae367e908d05147 Author: Daniel Xu Date: Mon Aug 23 19:43:47 2021 -0700 bpf: Consolidate task_struct BTF_ID declarations No need to have it defined 5 times. Once is enough. Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/6dcefa5bed26fe1226f26683f36819bb53ec19a2.1629772842.git.dxu@dxuuu.xyz commit 1b07d00a15d6a96d1a36b6a284c4fd5f2e2fa383 Author: Daniel Xu Date: Mon Aug 23 19:43:46 2021 -0700 bpf: Add BTF_ID_LIST_GLOBAL_SINGLE macro Same as BTF_ID_LIST_SINGLE macro except defines a global ID. Signed-off-by: Daniel Xu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/a867a97517df42fd3953eeb5454402b57e74538f.1629772842.git.dxu@dxuuu.xyz commit 5845e703f9b5f949dc1db4122b7fc6d8563048a2 Author: Xujun Leng Date: Wed Aug 25 23:05:26 2021 +0800 arm64: mm: fix comment typo of pud_offset_phys() Fix a typo in the comment of macro pud_offset_phys(). Signed-off-by: Xujun Leng Link: https://lore.kernel.org/r/20210825150526.12582-1-lengxujun2007@126.com Signed-off-by: Catalin Marinas commit eb653eda1e91dd3e7d1d2448d528d033dbfbe78f Author: Junxian Huang Date: Wed Aug 25 17:43:12 2021 +0800 RDMA/hns: Bugfix for incorrect association between dip_idx and dgid dip_idx and dgid should be a one-to-one mapping relationship, but when qp_num loops back to the start number, it may happen that two different dgid are assiociated to the same dip_idx incorrectly. One solution is to store the qp_num that is not assigned to dip_idx in an array. When a dip_idx needs to be allocated to a new dgid, an spare qp_num is extracted and assigned to dip_idx. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Link: https://lore.kernel.org/r/1629884592-23424-4-git-send-email-liangwenpeng@huawei.com Signed-off-by: Junxian Huang Signed-off-by: Yangyang Li Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 074f315fc54a9ce45559a44ca36d9fa1ee1ea2cd Author: Junxian Huang Date: Wed Aug 25 17:43:11 2021 +0800 RDMA/hns: Bugfix for the missing assignment for dip_idx When the dgid-dip_idx mapping relationship exists, dip should be assigned. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Link: https://lore.kernel.org/r/1629884592-23424-3-git-send-email-liangwenpeng@huawei.com Signed-off-by: Junxian Huang Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 4303e61264c45cb535255c5b76400f5c4ab1305d Author: Junxian Huang Date: Wed Aug 25 17:43:10 2021 +0800 RDMA/hns: Bugfix for data type of dip_idx dip_idx is associated with qp_num whose data type is u32. However, dip_idx is incorrectly defined as u8 data in the hns_roce_dip struct, which leads to data truncation during value assignment. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Link: https://lore.kernel.org/r/1629884592-23424-2-git-send-email-liangwenpeng@huawei.com Signed-off-by: Junxian Huang Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 9bed8a70716ba65d300b9cc30eb7e0276353f7bf Author: Yixing Liu Date: Wed Aug 25 17:19:29 2021 +0800 RDMA/hns: Fix incorrect lsn field In RNR NAK screnario, according to the specification, when no credit is available, only the first fragment of the send request can be sent. The LSN(Limit Sequence Number) field should be 0 or the entire packet will be resent. Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/1629883169-2306-1-git-send-email-liangwenpeng@huawei.com Signed-off-by: Yixing Liu Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe commit 9f72daf7edfa8f7e86ce8940d52266b5e931dcb0 Author: Nicolas Saenz Julienne Date: Wed Aug 25 12:54:15 2021 +0200 cgroup/cpuset: Avoid memory migration when nodemasks match With the introduction of ee9707e8593d ("cgroup/cpuset: Enable memory migration for cpuset v2") attaching a process to a different cgroup will trigger a memory migration regardless of whether it's really needed. Memory migration is an expensive operation, so bypass it if the nodemasks passed to cpuset_migrate_mm() are equal. Note that we're not only avoiding the migration work itself, but also a call to lru_cache_disable(), which triggers and flushes an LRU drain work on every online CPU. Signed-off-by: Nicolas Saenz Julienne Signed-off-by: Tejun Heo commit 24de5838db7044401c719042e95f646d72a78c49 Author: Will Deacon Date: Wed Aug 25 10:39:11 2021 +0100 arm64: signal32: Drop pointless call to sigdelsetmask() Commit 77097ae503b1 ("most of set_current_blocked() callers want SIGKILL/SIGSTOP removed from set") extended set_current_blocked() to remove SIGKILL and SIGSTOP from the new signal set and updated all callers accordingly. Unfortunately, this collided with the merge of the arm64 architecture, which duly removes these signals when restoring the compat sigframe, as this was what was previously done by arch/arm/. Remove the redundant call to sigdelsetmask() from compat_restore_sigframe(). Reported-by: Al Viro Signed-off-by: Will Deacon Link: https://lore.kernel.org/r/20210825093911.24493-1-will@kernel.org Signed-off-by: Catalin Marinas commit fc3bf30f1ba8b3e8e4f56eb932f971598bbe400c Author: Shaokun Zhang Date: Wed Aug 25 11:21:14 2021 +0800 RDMA/irdma: Remove the repeated declaration Functions 'irdma_alloc_ws_node_id' and 'irdma_free_ws_node_id' are declared twice, so remove the repeated declaration. Link: https://lore.kernel.org/r/1629861674-53343-1-git-send-email-zhangshaokun@hisilicon.com Signed-off-by: Shaokun Zhang Signed-off-by: Jason Gunthorpe commit 5f5a650999d5718af766fc70a120230b04235a6f Author: Håkon Bugge Date: Thu Aug 12 18:12:35 2021 +0200 RDMA/core/sa_query: Retry SA queries A MAD packet is sent as an unreliable datagram (UD). SA requests are sent as MAD packets. As such, SA requests or responses may be silently dropped. IB Core's MAD layer has a timeout and retry mechanism, which amongst other, is used by RDMA CM. But it is not used by SA queries. The lack of retries of SA queries leads to long specified timeout, and error being returned in case of packet loss. The ULP or user-land process has to perform the retry. Fix this by taking advantage of the MAD layer's retry mechanism. First, a check against a zero timeout is added in rdma_resolve_route(). In send_mad(), we set the MAD layer timeout to one tenth of the specified timeout and the number of retries to 10. The special case when timeout is less than 10 is handled. With this fix: # ucmatose -c 1000 -S 1024 -C 1 runs stable on an Infiniband fabric. Without this fix, we see an intermittent behavior and it errors out with: cmatose: event: RDMA_CM_EVENT_ROUTE_ERROR, error: -110 (110 is ETIMEDOUT) Link: https://lore.kernel.org/r/1628784755-28316-1-git-send-email-haakon.bugge@oracle.com Signed-off-by: Håkon Bugge Signed-off-by: Jason Gunthorpe commit 7aa6d700b089d960a03f6459898c096f4346990c Merge: c1ff860065741 21e39809fd7c4 Author: Mark Brown Date: Wed Aug 25 16:05:26 2021 +0100 Merge remote-tracking branch 'regulator/for-5.15' into regulator-next commit c1ff8600657411cdc51da170a5f51b8ecc7a90e2 Merge: e22ce8eb631bd ccb2a74eec211 Author: Mark Brown Date: Wed Aug 25 16:05:24 2021 +0100 Merge remote-tracking branch 'regulator/for-5.14' into regulator-linus commit bd7ffbc3ca12629aeb66fb9e28cf42b7f37e3e3b Author: Alyssa Rosenzweig Date: Tue Aug 24 13:30:27 2021 -0400 drm/panfrost: Clamp lock region to Bifrost minimum When locking a region, we currently clamp to a PAGE_SIZE as the minimum lock region. While this is valid for Midgard, it is invalid for Bifrost, where the minimum locking size is 8x larger than the 4k page size. Add a hardware definition for the minimum lock region size (corresponding to KBASE_LOCK_REGION_MIN_SIZE_LOG2 in kbase) and respect it. Signed-off-by: Alyssa Rosenzweig Tested-by: Chris Morgan Reviewed-by: Steven Price Reviewed-by: Rob Herring Cc: Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-4-alyssa.rosenzweig@collabora.com commit a77b58825d7221d4a45c47881c35a47ba003aa73 Author: Alyssa Rosenzweig Date: Tue Aug 24 13:30:26 2021 -0400 drm/panfrost: Use u64 for size in lock_region Mali virtual addresses are 48-bit. Use a u64 instead of size_t to ensure we can express the "lock everything" condition as ~0ULL without overflow. This code was silently broken on any platform where a size_t is less than 48-bits; in particular, it was broken on 32-bit armv7 platforms which remain in use with panfrost. (Mainly RK3288) Signed-off-by: Alyssa Rosenzweig Suggested-by: Rob Herring Tested-by: Chris Morgan Reviewed-by: Steven Price Reviewed-by: Rob Herring Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") Cc: Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-3-alyssa.rosenzweig@collabora.com commit b5fab345654c603c07525100d744498f28786929 Author: Alyssa Rosenzweig Date: Tue Aug 24 13:30:25 2021 -0400 drm/panfrost: Simplify lock_region calculation In lock_region, simplify the calculation of the region_width parameter. This field is the size, but encoded as ceil(log2(size)) - 1. ceil(log2(size)) may be computed directly as fls(size - 1). However, we want to use the 64-bit versions as the amount to lock can exceed 32-bits. This avoids undefined (and completely wrong) behaviour when locking all memory (size ~0). In this case, the old code would "round up" ~0 to the nearest page, overflowing to 0. Since fls(0) == 0, this would calculate a region width of 10 + 0 = 10. But then the code would shift by (region_width - 11) = -1. As shifting by a negative number is undefined, UBSAN flags the bug. Of course, even if it were defined the behaviour is wrong, instead of locking all memory almost none would get locked. The new form of the calculation corrects this special case and avoids the undefined behaviour. Signed-off-by: Alyssa Rosenzweig Reported-and-tested-by: Chris Morgan Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") Cc: Reviewed-by: Steven Price Reviewed-by: Rob Herring Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-2-alyssa.rosenzweig@collabora.com commit 185981958c920dd28e35cba7cda69486c8551781 Author: David Howells Date: Thu Jun 3 10:51:28 2021 +0100 cachefiles: Use file_inode() rather than accessing ->f_inode Use the file_inode() helper rather than accessing ->f_inode directly. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431192403.2908479.4590814090994846904.stgit@warthog.procyon.org.uk/ commit a7e20e31f6c063d928868ecc8e2effb7d4b9fe1b Author: David Howells Date: Wed May 12 14:10:09 2021 +0100 netfs: Move cookie debug ID to struct netfs_cache_resources Move the cookie debug ID from struct netfs_read_request to struct netfs_cache_resources and drop the 'cookie_' prefix. This makes it available for things that want to use netfs_cache_resources without having a netfs_read_request. Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: linux-cachefs@redhat.com Link: https://lore.kernel.org/r/162431190784.2908479.13386972676539789127.stgit@warthog.procyon.org.uk/ commit 4c5e413994e632fc317e521b207d372e28184aef Author: David Howells Date: Fri Jun 4 11:37:45 2021 +0100 fscache: Select netfs stats if fscache stats are enabled Unconditionally select the stats produced by the netfs lib if fscache stats are enabled as the former are displayed in the latter's procfile. Signed-off-by: David Howells cc: linux-cachefs@redhat.com Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/162280352566.3319242.10615341893991206961.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/162431189627.2908479.9165349423842063755.stgit@warthog.procyon.org.uk/ commit 1266b4a7ecb679587dc4d098abe56ea53313d569 Author: Gao Xiang Date: Wed Aug 25 20:07:57 2021 +0800 erofs: fix double free of 'copied' Dan reported a new smatch warning [1] "fs/erofs/inode.c:210 erofs_read_inode() error: double free of 'copied'" Due to new chunk-based format handling logic, the error path can be called after kfree(copied). Set "copied = NULL" after kfree(copied) to fix this. [1] https://lore.kernel.org/r/202108251030.bELQozR7-lkp@intel.com Link: https://lore.kernel.org/r/20210825120757.11034-1-hsiangkao@linux.alibaba.com Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files") Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 37e8abff2bebbf9947d6b784f5c75ed48a717089 Author: Thomas Gleixner Date: Wed Aug 25 12:33:14 2021 +0200 locking/rtmutex: Dequeue waiter on ww_mutex deadlock The rt_mutex based ww_mutex variant queues the new waiter first in the lock's rbtree before evaluating the ww_mutex specific conditions which might decide that the waiter should back out. This check and conditional exit happens before the waiter is enqueued into the PI chain. The failure handling at the call site assumes that the waiter, if it is the top most waiter on the lock, is queued in the PI chain and then proceeds to adjust the unmodified PI chain, which results in RB tree corruption. Dequeue the waiter from the lock waiter list in the ww_mutex error exit path to prevent this. Fixes: add461325ec5 ("locking/rtmutex: Extend the rtmutex core to support ww_mutex") Reported-by: Sebastian Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210825102454.042280541@linutronix.de commit c3123c431447da99db160264506de9897c003513 Author: Thomas Gleixner Date: Wed Aug 25 12:33:12 2021 +0200 locking/rtmutex: Dont dereference waiter lockless The new rt_mutex_spin_on_onwer() loop checks whether the spinning waiter is still the top waiter on the lock by utilizing rt_mutex_top_waiter(), which is broken because that function contains a sanity check which dereferences the top waiter pointer to check whether the waiter belongs to the lock. That's wrong in the lockless spinwait case: CPU 0 CPU 1 rt_mutex_lock(lock) rt_mutex_lock(lock); queue(waiter0) waiter0 == rt_mutex_top_waiter(lock) rt_mutex_spin_on_onwer(lock, waiter0) { queue(waiter1) waiter1 == rt_mutex_top_waiter(lock) ... top_waiter = rt_mutex_top_waiter(lock) leftmost = rb_first_cached(&lock->waiters); -> signal dequeue(waiter1) destroy(waiter1) w = rb_entry(leftmost, ....) BUG_ON(w->lock != lock) <- UAF The BUG_ON() is correct for the case where the caller holds lock->wait_lock which guarantees that the leftmost waiter entry cannot vanish. For the lockless spinwait case it's broken. Create a new helper function which avoids the pointer dereference and just compares the leftmost entry pointer with current's waiter pointer to validate that currrent is still elegible for spinning. Fixes: 992caf7f1724 ("locking/rtmutex: Add adaptive spinwait mechanism") Reported-by: Sebastian Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20210825102453.981720644@linutronix.de commit 21e39809fd7c4b8ff3662f23e0168e87594c8ca8 Author: Chen-Yu Tsai Date: Wed Aug 25 11:37:04 2021 +0800 regulator: vctrl: Avoid lockdep warning in enable/disable ops vctrl_enable() and vctrl_disable() call regulator_enable() and regulator_disable(), respectively. However, vctrl_* are regulator ops and should not be calling the locked regulator APIs. Doing so results in a lockdep warning. Instead of exporting more internal regulator ops, model the ctrl supply as an actual supply to vctrl-regulator. At probe time this driver still needs to use the consumer API to fetch its constraints, but otherwise lets the regulator core handle the upstream supply for it. The enable/disable/is_enabled ops are not removed, but now only track state internally. This preserves the original behavior with the ops being available, but one could argue that the original behavior was already incorrect: the internal state would not match the upstream supply if that supply had another consumer that enabled the supply, while vctrl-regulator was not enabled. The lockdep warning is as follows: WARNING: possible circular locking dependency detected 5.14.0-rc6 #2 Not tainted ------------------------------------------------------ swapper/0/1 is trying to acquire lock: ffffffc011306d00 (regulator_list_mutex){+.+.}-{3:3}, at: regulator_lock_dependent (arch/arm64/include/asm/current.h:19 include/linux/ww_mutex.h:111 drivers/regulator/core.c:329) but task is already holding lock: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at: regulator_lock_recursive (drivers/regulator/core.c:156 drivers/regulator/core.c:263) which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (regulator_ww_class_mutex){+.+.}-{3:3}: __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 include/asm-generic/atomic-long.h:29 kernel/locking/mutex.c:103 kernel/locking/mutex.c:144 kernel/locking/mutex.c:963) ww_mutex_lock (kernel/locking/mutex.c:1199) regulator_lock_recursive (drivers/regulator/core.c:156 drivers/regulator/core.c:263) regulator_lock_dependent (drivers/regulator/core.c:343) regulator_enable (drivers/regulator/core.c:2808) set_machine_constraints (drivers/regulator/core.c:1536) regulator_register (drivers/regulator/core.c:5486) devm_regulator_register (drivers/regulator/devres.c:196) reg_fixed_voltage_probe (drivers/regulator/fixed.c:289) platform_probe (drivers/base/platform.c:1427) [...] -> #1 (regulator_ww_class_acquire){+.+.}-{0:0}: regulator_lock_dependent (include/linux/ww_mutex.h:129 drivers/regulator/core.c:329) regulator_enable (drivers/regulator/core.c:2808) set_machine_constraints (drivers/regulator/core.c:1536) regulator_register (drivers/regulator/core.c:5486) devm_regulator_register (drivers/regulator/devres.c:196) reg_fixed_voltage_probe (drivers/regulator/fixed.c:289) [...] -> #0 (regulator_list_mutex){+.+.}-{3:3}: __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4) kernel/locking/lockdep.c:3174 (discriminator 4) kernel/locking/lockdep.c:3789 (discriminator 4) kernel/locking/lockdep.c:5015 (discriminator 4)) lock_acquire (arch/arm64/include/asm/percpu.h:39 kernel/locking/lockdep.c:438 kernel/locking/lockdep.c:5627) __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 include/asm-generic/atomic-long.h:29 kernel/locking/mutex.c:103 kernel/locking/mutex.c:144 kernel/locking/mutex.c:963) mutex_lock_nested (kernel/locking/mutex.c:1125) regulator_lock_dependent (arch/arm64/include/asm/current.h:19 include/linux/ww_mutex.h:111 drivers/regulator/core.c:329) regulator_enable (drivers/regulator/core.c:2808) vctrl_enable (drivers/regulator/vctrl-regulator.c:400) _regulator_do_enable (drivers/regulator/core.c:2617) _regulator_enable (drivers/regulator/core.c:2764) regulator_enable (drivers/regulator/core.c:308 drivers/regulator/core.c:2809) _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072) dev_pm_opp_set_rate (drivers/opp/core.c:1164) set_target (drivers/cpufreq/cpufreq-dt.c:62) __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216 drivers/cpufreq/cpufreq.c:2271) cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2)) cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563) subsys_interface_register (drivers/base/bus.c:?) cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819) dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344) [...] other info that might help us debug this: Chain exists of: regulator_list_mutex --> regulator_ww_class_acquire --> regulator_ww_class_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(regulator_ww_class_mutex); lock(regulator_ww_class_acquire); lock(regulator_ww_class_mutex); lock(regulator_list_mutex); *** DEADLOCK *** 6 locks held by swapper/0/1: #0: ffffff8002d32188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock (drivers/base/dd.c:1030) #1: ffffffc0111a0520 (cpu_hotplug_lock){++++}-{0:0}, at: cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2792 (discriminator 2)) #2: ffffff8002a8d918 (subsys mutex#9){+.+.}-{3:3}, at: subsys_interface_register (drivers/base/bus.c:1033) #3: ffffff800341bb90 (&policy->rwsem){+.+.}-{3:3}, at: cpufreq_online (include/linux/bitmap.h:285 include/linux/cpumask.h:405 drivers/cpufreq/cpufreq.c:1399) #4: ffffffc011f0b7b8 (regulator_ww_class_acquire){+.+.}-{0:0}, at: regulator_enable (drivers/regulator/core.c:2808) #5: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at: regulator_lock_recursive (drivers/regulator/core.c:156 drivers/regulator/core.c:263) stack backtrace: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6 #2 7c8f8996d021ed0f65271e6aeebf7999de74a9fa Hardware name: Google Scarlet (DT) Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:161) show_stack (arch/arm64/kernel/stacktrace.c:218) dump_stack_lvl (lib/dump_stack.c:106 (discriminator 2)) dump_stack (lib/dump_stack.c:113) print_circular_bug (kernel/locking/lockdep.c:?) check_noncircular (kernel/locking/lockdep.c:?) __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4) kernel/locking/lockdep.c:3174 (discriminator 4) kernel/locking/lockdep.c:3789 (discriminator 4) kernel/locking/lockdep.c:5015 (discriminator 4)) lock_acquire (arch/arm64/include/asm/percpu.h:39 kernel/locking/lockdep.c:438 kernel/locking/lockdep.c:5627) __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606 include/asm-generic/atomic-long.h:29 kernel/locking/mutex.c:103 kernel/locking/mutex.c:144 kernel/locking/mutex.c:963) mutex_lock_nested (kernel/locking/mutex.c:1125) regulator_lock_dependent (arch/arm64/include/asm/current.h:19 include/linux/ww_mutex.h:111 drivers/regulator/core.c:329) regulator_enable (drivers/regulator/core.c:2808) vctrl_enable (drivers/regulator/vctrl-regulator.c:400) _regulator_do_enable (drivers/regulator/core.c:2617) _regulator_enable (drivers/regulator/core.c:2764) regulator_enable (drivers/regulator/core.c:308 drivers/regulator/core.c:2809) _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072) dev_pm_opp_set_rate (drivers/opp/core.c:1164) set_target (drivers/cpufreq/cpufreq-dt.c:62) __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216 drivers/cpufreq/cpufreq.c:2271) cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2)) cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563) subsys_interface_register (drivers/base/bus.c:?) cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819) dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344) [...] Reported-by: Brian Norris Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20210825033704.3307263-3-wenst@chromium.org Signed-off-by: Mark Brown commit 98e47570ba985f2310586c80409238200fa3170f Author: Chen-Yu Tsai Date: Wed Aug 25 11:37:03 2021 +0800 regulator: vctrl: Use locked regulator_get_voltage in probe path In commit e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage"), all calls to get/set the voltage of the control regulator were switched to unlocked versions to avoid deadlocks. However, the call in the probe path is done without regulator locks held. In this case the locked version should be used. Switch back to the locked regulator_get_voltage() in the probe path to avoid any mishaps. Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20210825033704.3307263-2-wenst@chromium.org Signed-off-by: Mark Brown commit a8946f032eeace6eeb4e51e518275010e5528660 Author: Shengjiu Wang Date: Wed Aug 25 15:14:41 2021 +0800 ASoC: imx-rpmsg: change dev_err to dev_err_probe for -EPROBE_DEFER Change dev_err to dev_err_probe for no need print error message when defer probe happens. Fixes: 39f8405c3e50 ("ASoC: imx-rpmsg: Add machine driver for audio base on rpmsg") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1629875681-16373-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 8d3019b63b3d92c9b5f1548f600485d39262bbe1 Author: Derek Fang Date: Wed Aug 25 12:03:46 2021 +0800 ASoC: rt5682: Fix the vol+ button detection issue Fix the wrong button vol+ detection issue with some brand headsets by fine tuning the threshold of button vol+ and SAR ADC button accuracy. Signed-off-by: Derek Fang Link: https://lore.kernel.org/r/20210825040346.28346-1-derek.fang@realtek.com Signed-off-by: Mark Brown commit dc2d01c754c378a4748ac72c5516d45da7640123 Author: Peter Ujfalusi Date: Wed Aug 25 15:25:19 2021 +0300 ASoC: Intel: bytcr_rt5640: Make rt5640_jack_gpio/rt5640_jack2_gpio static Marking the two jack gpio as static fixes the following Sparse errors: sound/soc/intel/boards/bytcr_rt5640.c:468:26: error: symbol 'rt5640_jack_gpio' was not declared. Should it be static? sound/soc/intel/boards/bytcr_rt5640.c:475:26: error: symbol 'rt5640_jack2_gpio' was not declared. Should it be static? Fixes: 9ba00856686ad ("ASoC: Intel: bytcr_rt5640: Add support for HP Elite Pad 1000G2 jack-detect") Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20210825122519.3364-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 2d02e7d7d04f54fa573685a92c4a34eb8a76c9de Merge: 88939e7375735 e6d0b92ac00b5 Author: Mark Brown Date: Wed Aug 25 14:14:30 2021 +0100 Merge branch 'for-5.14' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-5.15 commit 1d1cf156dc176e30eeaced5cf1450d582d387b81 Author: Christoph Hellwig Date: Wed Aug 25 09:54:38 2021 +0200 sg: pass the device name to blk_trace_setup Fix a regression that passed a NULL device name to blk_trace_setup accidentally. Fixes: aebbb5831fbd ("sg: do not allocate a gendisk") Reported-by: syzbot+f74aa89114a236643919@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Reviewed-by: Max Gurtovoy Link: https://lore.kernel.org/r/20210825075438.1883687-1-hch@lst.de Signed-off-by: Jens Axboe commit 1e294970fc00f45c1f17fb442c26a7e3fc9789b1 Author: Shaokun Zhang Date: Wed Aug 25 14:19:51 2021 +0800 block, bfq: cleanup the repeated declaration Function 'bfq_entity_to_bfqq' is declared twice, so remove the repeated declaration and blank line. Cc: Paolo Valente Cc: Jens Axboe Signed-off-by: Shaokun Zhang Link: https://lore.kernel.org/r/1629872391-46399-1-git-send-email-zhangshaokun@hisilicon.com Signed-off-by: Jens Axboe commit cc40b7225151f611ef837f6403cfaeadc7af214a Author: Eric Biggers Date: Tue Aug 24 22:59:18 2021 -0700 blk-crypto: fix check for too-large dun_bytes dun_bytes needs to be less than or equal to the IV size of the encryption mode, not just less than or equal to BLK_CRYPTO_MAX_IV_SIZE. Currently this doesn't matter since blk_crypto_init_key() is never actually passed invalid values, but we might as well fix this. Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq") Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20210825055918.51975-1-ebiggers@kernel.org Signed-off-by: Jens Axboe commit e3f30ab28ac866256169153157f466d90f44f122 Merge: 9270c565b031c 246b184fffdce Author: David S. Miller Date: Wed Aug 25 13:44:30 2021 +0100 Merge branch 'pktgen-samples-next' Juhee Kang says: ==================== samples: pktgen: enhance the ability to print the execution results of samples This patch series improves the ability to print the execution result of pktgen samples by adding a line which calls the function before termination and adding trap SIGINT. Also, this series documents the latest pktgen usage options. Currently, pktgen samples print the execution result when terminated usually. However, sample03 is not working properly. This is results of sample04 and sample03: # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample04_many_flows.sh -n 1 Running... ctrl^C to stop Device: eth0@0 Result: OK: 19(c5+d13) usec, 1 (60byte,0frags) 51762pps 24Mb/sec (24845760bps) errors: 0 # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample03_burst_single_flow.sh -n 1 Running... ctrl^C to stop Because sample03 doesn't call the function which prints the execution result when terminated normally, unlike other samples. So the first commit solves this issue by adding a line which calls the function before termination. Also, all pktgen samples are able to send infinite messages per thread by setting the count option to 0, and pktgen is stopped by Ctrl-C. However, the sample besides sample{3...5} don't work appropriately because Ctrl-C stops the script, not just pktgen. This is results of samples: # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample04_many_flows.sh -n 0 Running... ctrl^C to stop ^CDevice: eth0@0 Result: OK: 569657(c569538+d118) usec, 84650 (60byte,0frags) 148597pps 71Mb/sec (71326560bps) errors: 0 # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample01_simple.sh -n 0 Running... ctrl^C to stop ^C # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample02_multiqueue.sh -n 0 Running... ctrl^C to stop ^C # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample06_numa_awared_queue_irq_affinity.sh -n 0 Running... ctrl^C to stop ^C # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_bench_xmit_mode_netif_receive.sh -n 0 Running... ctrl^C to stop ^C # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_bench_xmit_mode_queue_xmit.sh -n 0 Running... ctrl^C to stop ^C So the second commit solves this issue by adding trap SIGINT. Also, changes control_c function to print_results to maintain consistency with other samples on the first commit and second commit. And current pktgen.rst documentation doesn't add the latest pktgen sample usage options such as count and IPv6, and so on. Also, the old pktgen sample scripts are still included in the document. The old scripts were removed by the commit a4b6ade8359f ("samples/pktgen: remove remaining old pktgen sample scripts"). Thus, the last commit documents the latest pktgen sample usage and removes old sample scripts. And fixes a minor typo. ==================== Signed-off-by: David S. Miller commit 246b184fffdcead3710228e3bff744ce8c9828a3 Author: Juhee Kang Date: Wed Aug 25 19:57:17 2021 +0900 pktgen: document the latest pktgen usage options Currently, the pktgen.rst documentation doesn't cover the latest pktgen sample usage options such as count and IPv6, and so on. Also, this documentation includes the old sample scripts which are no longer use because it was removed by the commit a4b6ade8359f ("samples/pktgen : remove remaining old pktgen sample scripts") Thus, this commit documents pktgen sample usage using the latest options and removes old sample scripts, and fixes a minor typo. Signed-off-by: Juhee Kang Signed-off-by: David S. Miller commit 6c882bdc4bcd63e164f05738e7677b8a62fc0ec1 Author: Juhee Kang Date: Wed Aug 25 19:57:16 2021 +0900 samples: pktgen: add trap SIGINT for printing execution result All pktgen samples can send indefinitely num messages per thread by setting the count option to 0(-n 0). If running sample with setting count 0 and press Ctrl-C to stop this program, the program prints the result of the execution so far. Currently, the samples besides sample{3...5} don't work properly. Because Ctrl-C stops the script, not just pktgen. This is results of samples: # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample04_many_flows.sh -n 0 Running... ctrl^C to stop ^CDevice: eth0@0 Result: OK: 569657(c569538+d118) usec, 84650 (60byte,0frags) 148597pps 71Mb/sec (71326560bps) errors: 0 # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample01_simple.sh -n 0 Running... ctrl^C to stop ^C In order to solve this, this commit adds trap SIGINT. Also, this commit changes control_c function to print_result to maintain consistency with other samples. Signed-off-by: Juhee Kang Signed-off-by: David S. Miller commit c0e9422c4e6ca9abd4bd6e1598400c7231eb600b Author: Juhee Kang Date: Wed Aug 25 19:57:15 2021 +0900 samples: pktgen: fix to print when terminated normally Currently, most pktgen samples print the execution result when the program is terminated normally. However, sample03 doesn't work appropriately. This is results of samples: # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample04_many_flows.sh -n 1 Running... ctrl^C to stop Device: eth0@0 Result: OK: 19(c5+d13) usec, 1 (60byte,0frags) 51762pps 24Mb/sec (24845760bps) errors: 0 # DEV=eth0 DEST_IP=10.1.0.1 DST_MAC=00:11:22:33:44:55 ./pktgen_sample03_burst_single_flow.sh -n 1 Running... ctrl^C to stop The reason why it doesn't print the execution result when the program is terminated usually is that sample03 doesn't call the function which prints the result, unlike other samples. So, this commit solves this issue by calling the function before termination. Also, this commit changes control_c function to print_result to maintain consistency with other samples. Signed-off-by: Juhee Kang Signed-off-by: David S. Miller commit 9270c565b031cb54f74e9f0e326f2fcef020c872 Merge: fbcf8a340150a 66c312ea1d374 Author: David S. Miller Date: Wed Aug 25 13:39:02 2021 +0100 Merge branch 'octeontx2-traffic-shaping' Sunil Goutham says: ==================== Octeontx2: Traffic shaping and SDP link config support This patch series adds support for traffic shaping configuration on all silicons available after 96xx C0. And also adds SDP link related configuration needed when Octeon is connected as an end-point and traffic needs to flow from end-point to host and vice versa. Series also has other changes like - New mbox messages in admin function driver for PF/VF drivers to retrieve available HW resource count. HW resources like block LFs, bandwidth profiles etc are covered. - Added PTP device ID for new CN10K and 95O silicons. - etc ==================== Signed-off-by: David S. Miller commit 66c312ea1d3749783440f12e8dfb6db45512ea14 Author: Sunil Goutham Date: Wed Aug 25 17:48:46 2021 +0530 octeontx2-af: Add mbox to retrieve bandwidth profile free count Added mbox for PF/VF drivers to retrieve current ingress bandwidth profile free count. Also added current policer timeunit configuration info based on which ratelimiting decisions can be taken by PF/VF drivers. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 18603683d7663b3a4da31ce8296a3049f4464e50 Author: Sunil Goutham Date: Wed Aug 25 17:48:45 2021 +0530 octeontx2-af: Remove channel verification while installing MCAM rules New usecases are popping up where in user wants to install common MCAM filters for all interfaces. Having channel verification will result in duplicating such MCAM filters for each of the ingress interface. Hence removed channel verification. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit a8b90c9d26d64993f7649794be8144a74431a274 Author: Subbaraya Sundeep Date: Wed Aug 25 17:48:44 2021 +0530 octeontx2-af: Add PTP device id for CN10K and 95O silcons CN10K slicon has different device id for PTP device. Hence this patch updates the driver with new id. Though ptp driver being a separate driver AF manages configuring PTP block by all PFs. To manage ptp, AF driver checks in its probe whether 1. ptp hardware device found on silicon 2. A driver is bound to ptp device 3. The ptp driver probe is successful In failure of cases 1 and 3, AF proceeds with out ptp and for case 2 defers the probe. This patch refactors code also to check for all the PTP device ids given in ptp device ids table for case 1. Also added PTP device ID for 95O silicon Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 275e5d175de12dc9df594733b2f6738e5199e261 Author: George Cherian Date: Wed Aug 25 17:48:43 2021 +0530 octeontx2-af: Add free rsrc count mbox msg Upon receiving the MBOX_MSG_FREE_RSRC_CNT, the AF will find out the current number of free resources and reply it back to the requester. No guarantee is given on the future state of the free resources yet. If another requester sends MBOX_MSG_ATTACH_RESOURCES after this call, the number of available resources might change. Signed-off-by: George Cherian Signed-off-by: Stanislaw Kardach Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit fe1939bb23407f2110eecff212ba4c07c4c83fd3 Author: Radha Mohan Chintakuntla Date: Wed Aug 25 17:48:42 2021 +0530 octeontx2-af: Add SDP interface support Added support for packet IO via SDK links which is used when Octeon is connected as a end-point. Traffic host to end-point and vice versa flow through SDP links. This patch also support dual SDP blocks supported in 98xx silicon. Signed-off-by: Radha Mohan Chintakuntla Signed-off-by: Nalla Pradeep Signed-off-by: Subrahmanyam Nilla Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit aefaa8c71555de4db7fc8d9247a2c896dfdf0eb0 Author: Harman Kalra Date: Wed Aug 25 17:48:41 2021 +0530 octeontx2-af: nix and lbk in loop mode in 98xx In 98xx, there are 2 NIX blocks and 4 LBK blocks present. The way these NIX-LBK should be configured depends on the use case. By default loopback functionality is supported in AF VF pairs which are attached to NIX0 and NIX1 LFs alternatively to ensure load balancing. NIX0 transmits a packet to LBK1 which will be received by NIX1 and packet transmitted by NIX1 will get received by NIX0 via LBK2. There are some requirements where only one AF VF is used and respective NIX is expected to operate in a mode where it can receive it own packet back. This can be achieved if NIX0 sends packet to LBK0 and not LBK1. Adding a flag in LF alloc request mailbox which can setup NIX0 to use LBK0 and NIX1 can use LBK3. Signed-off-by: Harman Kalra Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 039190bb353a16657b44c5833bcad57e029c6934 Author: Subbaraya Sundeep Date: Wed Aug 25 17:48:40 2021 +0530 octeontx2-pf: cleanup transmit link deriving logic Unlike OcteonTx2, the channel numbers used by CGX/RPM and LBK on CN10K silicons aren't fixed in HW. They are SW programmable, hence we cannot derive transmit link from static channel numbers anymore. Get the same from admin function via mailbox. Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 72e192a163d0959d4e74342850a31b241baba422 Author: Jerin Jacob Date: Wed Aug 25 17:48:39 2021 +0530 octeontx2-af: Allow to configure flow tag LSB byte as RSS adder Before C0 HW revision, The RSS adder was computed based the following static formula. rss_adder<7:0> = flow_tag<7:0> ^ flow_tag<15:8> ^ flow_tag<23:16> ^ flow_tag<31:24> The above scheme has the following drawbacks: 1) It is not in line with other standard NIC behavior. 2) There can be an SW use case where SW can compute the hash upfront using Toeplitz function and predict the queue selection to optimize some packet lookup function. The nonstandard way of doing XOR makes the consumer to not predict the queue selection. C0 HW revision onwards, The HW can configure the rss_adder<7:0> as flow_tag<7:0> to align with standard NICs. This patch adds an option to select legacy RSS adder mode vs standard NIC behavior by setting NIX_LF_RSS_TAG_LSB_AS_ADDER flag. Since this bit field is used as reserved in old HW revisions, No need to have an additional HW version check. Signed-off-by: Jerin Jacob Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit d06411632e80d0ef4472a7cace28a6e3669d169a Author: Nithin Dabilpuram Date: Wed Aug 25 17:48:38 2021 +0530 octeontx2-af: enable tx shaping feature for 96xx C0 Starting from 96xx C0 onwards all silicons support traffic shaping. This patch enables that feature along with other changes - When PIR/CIR shaping config is modified, toggle SW_XOFF for config to take effect - Before SMQ flush, clear SW_XOFF at all parent schedulers - Support to read current transmit scheduler configuration via mbox Signed-off-by: Nithin Dabilpuram Signed-off-by: Geetha sowjanya Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 3c69a5f22223fa3e312689ec218b5059784d49d7 Author: Kajol Jain Date: Wed Aug 18 22:45:56 2021 +0530 powerpc/perf: Fix the check for SIAR value Incase of random sampling, there can be scenarios where Sample Instruction Address Register(SIAR) may not latch to the sampled instruction and could result in the value of 0. In these scenarios it is preferred to return regs->nip. These corner cases are seen in the previous generation (p9) also. Patch adds the check for SIAR value along with regs_use_siar and siar_valid checks so that the function will return regs->nip incase SIAR is zero. Patch drops the code under PPMU_P10_DD1 flag check which handles SIAR 0 case only for Power10 DD1. Fixes: 2ca13a4cc56c9 ("powerpc/perf: Use regs->nip when SIAR is zero") Signed-off-by: Kajol Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210818171556.36912-3-kjain@linux.ibm.com commit cc90c6742ef5b438f4cb86029d7a794bd0a44a06 Author: Kajol Jain Date: Wed Aug 18 22:45:55 2021 +0530 powerpc/perf: Drop the case of returning 0 as instruction pointer Drop the case of returning 0 as instruction pointer since kernel never executes at 0 and userspace almost never does either. Fixes: e6878835ac47 ("powerpc/perf: Sample only if SIAR-Valid bit is set in P7+") Signed-off-by: Kajol Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210818171556.36912-2-kjain@linux.ibm.com commit b1643084d164cea0c107a39bcdf0119fc52619af Author: Kajol Jain Date: Wed Aug 18 22:45:54 2021 +0530 powerpc/perf: Use stack siar instead of mfspr Minor optimization in the 'perf_instruction_pointer' function code by making use of stack siar instead of mfspr. Fixes: 75382aa72f06 ("powerpc/perf: Move code to select SIAR or pt_regs into perf_read_regs") Signed-off-by: Kajol Jain Tested-by: Nageswara R Sastry Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210818171556.36912-1-kjain@linux.ibm.com commit aaa4db12ef7bdc3e343580d1d3c0b2a8874fc1fb Author: Pavel Begunkov Date: Wed Aug 25 12:25:47 2021 +0100 io_uring: accept directly into fixed file table As done with open opcodes, allow accept to skip installing fd into processes' file tables and put it directly into io_uring's fixed file table. Same restrictions and design as for open. Suggested-by: Josh Triplett Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Link: https://lore.kernel.org/r/6d16163f376fac7ac26a656de6b42199143e9721.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a7083ad5e30767ede4ff49d7471ea9c078702db2 Author: Pavel Begunkov Date: Wed Aug 25 12:25:46 2021 +0100 io_uring: hand code io_accept() fd installing Make io_accept() to handle file descriptor allocations and installation. A preparation patch for bypassing file tables. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Link: https://lore.kernel.org/r/5b73d204caa0ce979ccb98136695b60f52a3d98c.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b9445598d8c60a1379887b957024b71343965f74 Author: Pavel Begunkov Date: Wed Aug 25 12:25:45 2021 +0100 io_uring: openat directly into fixed fd table Instead of opening a file into a process's file table as usual and then registering the fd within io_uring, some users may want to skip the first step and place it directly into io_uring's fixed file table. This patch adds such a capability for IORING_OP_OPENAT and IORING_OP_OPENAT2. The behaviour is controlled by setting sqe->file_index, where 0 implies the old behaviour using normal file tables. If non-zero value is specified, then it will behave as described and place the file into a fixed file slot sqe->file_index - 1. A file table should be already created, the slot should be valid and empty, otherwise the operation will fail. Keep the error codes consistent with IORING_OP_FILES_UPDATE, ENXIO and EINVAL on inappropriate fixed tables, and return EBADF on collision with already registered file. Note: IOSQE_FIXED_FILE can't be used to switch between modes, because accept takes a file, and it already uses the flag with a different meaning. Suggested-by: Josh Triplett Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Link: https://lore.kernel.org/r/e9b33d1163286f51ea707f87d95bd596dada1e65.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d32f89da7fa8ccc8b3fb8f909d61e42b9bc39329 Author: Pavel Begunkov Date: Wed Aug 25 12:25:44 2021 +0100 net: add accept helper not installing fd Introduce and reuse a helper that acts similarly to __sys_accept4_file() but returns struct file instead of installing file descriptor. Will be used by io_uring. Signed-off-by: Pavel Begunkov Acked-by: Jakub Kicinski Signed-off-by: Jens Axboe Acked-by: David S. Miller Link: https://lore.kernel.org/r/c57b9e8e818d93683a3d24f8ca50ca038d1da8c4.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit bbac7a92a46f0876e588722ebe552ddfe6fd790f Author: Johannes Berg Date: Mon Aug 9 11:24:09 2021 +0200 dmaengine: ioat: depends on !UML Now that UML has PCI support, this driver must depend also on !UML since it pokes at X86_64 architecture internals that don't exist on ARCH=um. Reported-by: Geert Uytterhoeven Signed-off-by: Johannes Berg Acked-by: Dave Jiang Link: https://lore.kernel.org/r/20210809112409.a3a0974874d2.I2ffe3d11ed37f735da2f39884a74c953b258b995@changeid Signed-off-by: Vinod Koul commit 9806eb5c79579e200f88660e043706eb490547e6 Author: Dave Jiang Date: Fri Aug 6 10:38:37 2021 -0700 dmaengine: idxd: set descriptor allocation size to threshold for swq Since submission is sent to limited portal, the actual wq size for shared wq is set by the threshold rather than the wq size. When the wq type is shared, set the allocated descriptors to the threshold. Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/162827151733.3459223.3829837172226042408.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit 0b030f54f094fcd42f4a607a675c1851129a58c8 Author: Dave Jiang Date: Fri Aug 6 10:37:40 2021 -0700 dmaengine: idxd: make submit failure path consistent on desc freeing The submission path for dmaengine API does not do descriptor freeing on failure. Also, with the abort mechanism, the freeing of descriptor happens when the abort callback is completed. Therefore free descriptor on all error paths for submission call to make things consistent. Also remove the double free that would happen on abort in idxd_dma_tx_submit() call. Fixes: 6b4b87f2c31a ("dmaengine: idxd: fix submission race window") Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/162827146072.3459011.10255348500504659810.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Vinod Koul commit fbcf8a340150abd20bf44fc706362b0827157fe8 Author: Cai Huoqing Date: Wed Aug 25 14:25:13 2021 +0800 net: ethernet: actions: Add helper dependency on COMPILE_TEST it's helpful for complie test in other platform(e.g.X86) Signed-off-by: Cai Huoqing Signed-off-by: David S. Miller commit 7bc416f1471686faa8030cd5338f6a5370e01b25 Author: Lukas Bulwahn Date: Mon Aug 23 22:27:29 2021 +0200 netfilter: x_tables: handle xt_register_template() returning an error value Commit fdacd57c79b7 ("netfilter: x_tables: never register tables by default") introduces the function xt_register_template(), and in one case, a call to that function was missing the error-case handling. Handle when xt_register_template() returns an error value. This was identified with the clang-analyzer's Dead-Store analysis. Signed-off-by: Lukas Bulwahn Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6c89dac5b98573222798a6b9c4973a031eea89ee Author: Pablo Neira Ayuso Date: Wed Aug 18 13:56:39 2021 +0200 netfilter: ctnetlink: missing counters and timestamp in nfnetlink_{log,queue} Add counters and timestamps (if available) to the conntrack object that is represented in nfnetlink_log and _queue messages. Signed-off-by: Pablo Neira Ayuso commit 1c74b89171c39eabc0faba7eb0500c3d73a0e1d1 Author: Nithin Dabilpuram Date: Wed Aug 25 11:16:21 2021 +0530 octeontx2-af: Wait for TX link idle for credits change NIX_AF_TX_LINKX_NORM_CREDIT holds running counter of tx credits available per link. But, tx credits should be configured based on MTU config. So MTU change needs tx credit count update. An issue exists whereby when both PF & VF are enabled and PF traffic is flowing, if VF requests for MTU update, updating the NORM_CREDIT register will lead to corruption of credit count and subsequent deadlock of tx link as the NORM_CREDIT register holds running count. This patch provides workaround by pausing link traffic using NIX_AF_TL1X_SW_XOFF, waiting for existing packets to drain, and used credits be returned before updating new credit count. Signed-off-by: Nithin Dabilpuram Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Signed-off-by: David S. Miller commit 906999c9b653dc27d22d9a7f53a5a6637c0e670e Author: Nithin Dabilpuram Date: Wed Aug 25 11:09:04 2021 +0530 octeontx2-af: Change the order of queue work and interrupt disable Clear and disable interrupt before queueing work as there might be a chance that work gets completed on other core faster and interrupt enable as a part of the work completes before interrupt disable in the interrupt context. This leads to permanent disable of interrupt. Signed-off-by: Nithin Dabilpuram Signed-off-by: Sunil Goutham Signed-off-by: Geetha sowjanya Signed-off-by: David S. Miller commit ae2c341eb010b5a78499fcf6a97ca47056d217ae Author: Geetha sowjanya Date: Wed Aug 25 11:05:03 2021 +0530 octeontx2-af: cn10k: Set cache lines for NPA batch alloc Set NPA batch allocation engine to process 35 cache lines per turn on CN10k platform. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit bd1431db0b8131098a285c8cc6a357629b4362e5 Author: Florian Westphal Date: Mon Aug 16 17:16:26 2021 +0200 netfilter: ecache: remove nf_exp_event_notifier structure Reuse the conntrack event notofier struct, this allows to remove the extra register/unregister functions and avoids a pointer in struct net. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b86c0e6429dac2458694495aeebf15f4fe6b269d Author: Florian Westphal Date: Mon Aug 16 17:16:25 2021 +0200 netfilter: ecache: prepare for event notifier merge This prepares for merge for ct and exp notifier structs. The 'fcn' member is renamed to something unique. Second, the register/unregister api is simplified. There is only one implementation so there is no need to do any error checking. Replace the EBUSY logic with WARN_ON_ONCE. This allows to remove error unwinding. The exp notifier register/unregister function is removed in a followup patch. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b3afdc17586392e023ac57155970269d03d4e886 Author: Florian Westphal Date: Mon Aug 16 17:16:24 2021 +0200 netfilter: ecache: add common helper for nf_conntrack_eventmask_report nf_ct_deliver_cached_events and nf_conntrack_eventmask_report are very similar. Split nf_conntrack_eventmask_report into a common helper function that can be used for both cases. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9291f0902d0c3d2af8def02dc1387481d25b0a7e Author: Florian Westphal Date: Mon Aug 16 17:16:23 2021 +0200 netfilter: ecache: remove another indent level ... by changing: if (unlikely(ret < 0 || missed)) { if (ret < 0) { to if (likely(ret >= 0 && !missed)) goto out; if (ret < 0) { After this nf_conntrack_eventmask_report and nf_ct_deliver_cached_events look pretty much the same, next patch moves common code to a helper. This patch has no effect on generated code. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 478374a3c15f369e57fdd79d64d7a1d2eb307e16 Author: Florian Westphal Date: Mon Aug 16 17:16:22 2021 +0200 netfilter: ecache: remove one indent level nf_conntrack_eventmask_report and nf_ct_deliver_cached_events shared most of their code. This unifies the layout by changing if (nf_ct_is_confirmed(ct)) { foo } to if (!nf_ct_is_confirmed(ct))) return foo This removes one level of indentation. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 87e5ef4b19cec86c861e3ebab3a5d840ecc2f4a4 Author: Shaokun Zhang Date: Wed Aug 25 14:34:31 2021 +0800 mctp: Remove the repeated declaration Function 'mctp_dev_get_rtnl' is declared twice, so remove the repeated declaration. Cc: Jeremy Kerr Cc: Matt Johnston Cc: "David S. Miller" Cc: Jakub Kicinski Signed-off-by: Shaokun Zhang Signed-off-by: David S. Miller commit 45bc6125d1429b6d9db8595c794b5d71a09fef7d Merge: b87a542c5bb42 cbe8cd7d83e25 Author: David S. Miller Date: Wed Aug 25 11:19:38 2021 +0100 Merge tag 'linux-can-next-for-5.15-20210825' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine says: ==================== pull-request: can-next 2021-08-25 this is a pull request of 4 patches for net-next/master. The first patch is by Cai Huoqing, and enables COMPILE_TEST for the rcar CAN drivers. Lad Prabhakar contributes a patch for the rcar_canfd driver, fixing a redundant assignment. The last 2 patches are by Tang Bin, target the mscan driver, and clean up the driver by converting it to of_device_get_match_data() and removing a useless BUG_ON. ==================== Signed-off-by: David S. Miller commit b87a542c5bb42fb101ada5294b87fd2df0cab429 Merge: 6956fa394a474 0d13a1a464a02 Author: David S. Miller Date: Wed Aug 25 11:18:17 2021 +0100 Merge branch 'ravb-gbit-refactor' Biju Das says: ==================== Add Factorisation code to support Gigabit Ethernet driver The DMAC and EMAC blocks of Gigabit Ethernet IP found on RZ/G2L SoC are similar to the R-Car Ethernet AVB IP. The Gigabit Ethernet IP consists of Ethernet controller (E-MAC), Internal TCP/IP Offload Engine (TOE) and Dedicated Direct memory access controller (DMAC). With a few changes in the driver we can support both IPs. This patch series aims to add factorisation code to support RZ/G2L SoC, hardware feature bits for gPTP feature, Multiple irq feature and optional reset support. Ref:- * https://lore.kernel.org/linux-renesas-soc/TYCPR01MB59334319695607A2683C1A5E86E59@TYCPR01MB5933.jpnprd01.prod.outlook.com/T/#t ==================== Signed-off-by: David S. Miller commit 0d13a1a464a023379291218ac051e2bf8f46b5d1 Author: Biju Das Date: Wed Aug 25 08:01:54 2021 +0100 ravb: Add reset support Reset support is present on R-Car. Let's support it, if it is available. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 511d74d9d86ceccb3463fd49adf9de95d4cb3772 Author: Biju Das Date: Wed Aug 25 08:01:53 2021 +0100 ravb: Factorise ravb_emac_init function The E-MAC IP on the R-Car AVB module has different initialization parameters for RX frame size, duplex settings, different offset for transfer speed setting and has magic packet detection support compared to E-MAC on RZ/G2L Gigabit Ethernet module. Factorise the ravb_emac_init function to support the later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit eb4fd127448b173df15b4e92ace016467b2fc441 Author: Biju Das Date: Wed Aug 25 08:01:52 2021 +0100 ravb: Factorise ravb_dmac_init function The DMAC IP on the R-Car AVB module has different initialization parameters for RCR, TGC, TCCR, RIC0, RIC2, and TIC compared to DMAC IP on the RZ/G2L Gigabit Ethernet module. Factorise the ravb_dmac_init function to support the later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 80f35a0df0866ad0eb88575bbdeba6c81123c20b Author: Biju Das Date: Wed Aug 25 08:01:51 2021 +0100 ravb: Factorise ravb_set_features RZ/G2L supports HW checksum on RX and TX whereas R-Car supports on RX. Factorise ravb_set_features to support this feature. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit cb21104f2c35c97a1c803c48f26ad99ff5c5c9d4 Author: Biju Das Date: Wed Aug 25 08:01:50 2021 +0100 ravb: Factorise ravb_adjust_link function R-Car supports 100 and 1000 Mbps transfer speed whereas RZ/G2L in addition support 10Mbps. Factorise ravb_adjust_link function in order to support 10Mbps speed. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit d5d95c11365bc880669bbc52786b176cf60dcd92 Author: Biju Das Date: Wed Aug 25 08:01:49 2021 +0100 ravb: Factorise ravb_rx function R-Car uses an extended descriptor in RX whereas, RZ/G2L uses normal descriptor in RX. Factorise the ravb_rx function to support the later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 7870a41848abf8ae634e2de54effbbf32d2a472d Author: Biju Das Date: Wed Aug 25 08:01:48 2021 +0100 ravb: Factorise ravb_ring_init function The ravb_ring_init function uses an extended descriptor in RX for R-Car and normal descriptor for RZ/G2L. Add a helper function for RX ring buffer allocation to support later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 1ae22c19e75cfbd36b24b43f9d8649b1988a4dff Author: Biju Das Date: Wed Aug 25 08:01:47 2021 +0100 ravb: Factorise ravb_ring_format function The ravb_ring_format function uses an extended descriptor in RX for R-Car compared to the normal descriptor for RZ/G2L. Factorise RX ring buffer buildup to extend the support for later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit bf46b7578404f6fbde0bc2e1ea60fe0fd6f207a8 Author: Biju Das Date: Wed Aug 25 08:01:46 2021 +0100 ravb: Factorise ravb_ring_free function R-Car uses extended descriptor in RX, whereas RZ/G2L uses normal descriptor. Factorise ravb_ring_free function so that it can support later SoC. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit a69a3d094de38007ce54e4e1411b5769ed66a426 Author: Biju Das Date: Wed Aug 25 08:01:45 2021 +0100 ravb: Add ptp_cfg_active to struct ravb_hw_info There are some H/W differences for the gPTP feature between R-Car Gen3, R-Car Gen2, and RZ/G2L as below. 1) On R-Car Gen3, gPTP support is active in config mode. 2) On R-Car Gen2, gPTP support is not active in config mode. 3) RZ/G2L does not support the gPTP feature. Add a ptp_cfg_active hw feature bit to struct ravb_hw_info for supporting gPTP active in config mode for R-Car Gen3. This patch also removes enum ravb_chip_id, chip_id from both struct ravb_hw_info and struct ravb_private, as it is unused. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 8f27219a6191679333e703daf8bb66e5a1241aed Author: Biju Das Date: Wed Aug 25 08:01:44 2021 +0100 ravb: Add no_ptp_cfg_active to struct ravb_hw_info There are some H/W differences for the gPTP feature between R-Car Gen3, R-Car Gen2, and RZ/G2L as below. 1) On R-Car Gen2, gPTP support is not active in config mode. 2) On R-Car Gen3, gPTP support is active in config mode. 3) RZ/G2L does not support the gPTP feature. Add a no_ptp_cfg_active hw feature bit to struct ravb_hw_info for handling gPTP for R-Car Gen2. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 6de19fa0e9f7d8d1033810df1e53ae5b0c7b0d65 Author: Biju Das Date: Wed Aug 25 08:01:43 2021 +0100 ravb: Add multi_irq to struct ravb_hw_info R-Car Gen3 supports separate interrupts for E-MAC and DMA queues, whereas R-Car Gen2 and RZ/G2L have a single interrupt instead. Add a multi_irq hw feature bit to struct ravb_hw_info to enable this only for R-Car Gen3. Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit c81d894226b94439c543e9cfac406c8024172fd7 Author: Biju Das Date: Wed Aug 25 08:01:42 2021 +0100 ravb: Remove the macros NUM_TX_DESC_GEN[23] For addressing 4 bytes alignment restriction on transmission buffer for R-Car Gen2 we use 2 descriptors whereas it is a single descriptor for other cases. Replace the macros NUM_TX_DESC_GEN[23] with magic number and add a comment to explain it. Signed-off-by: Biju Das Suggested-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Signed-off-by: David S. Miller commit 6956fa394a474404d76f4c0584c70bcaefa7659e Merge: 1ca8a193cade7 8ded9160928e5 Author: David S. Miller Date: Wed Aug 25 11:14:34 2021 +0100 Merge branch 'dsa-sja1105-vlan-tags' Vladimir Oltean says: ==================== Make sja1105 treat tag_8021q VLANs more like real DSA tags This series solves a nuisance with the sja1105 driver, which is that non-DSA tagged packets sent directly by the DSA master would still exit the switch just fine. We also had an issue for packets coming from the outside world with a crafted DSA tag, the switch would not reject that tag but think it was valid. ==================== commit 8ded9160928e545c2e694b77a87263fa078ff4c6 Author: Vladimir Oltean Date: Tue Aug 24 20:15:02 2021 +0300 net: dsa: tag_sja1105: stop asking the sja1105 driver in sja1105_xmit_tpid Introduced in commit 38b5beeae7a4 ("net: dsa: sja1105: prepare tagger for handling DSA tags and VLAN simultaneously"), the sja1105_xmit_tpid function solved quite a different problem than our needs are now. Then, we used best-effort VLAN filtering and we were using the xmit_tpid to tunnel packets coming from an 8021q upper through the TX VLAN allocated by tag_8021q to that egress port. The need for a different VLAN protocol depending on switch revision came from the fact that this in itself was more of a hack to trick the hardware into accepting tunneled VLANs in the first place. Right now, we deny 8021q uppers (see sja1105_prechangeupper). Even if we supported them again, we would not do that using the same method of {tunneling the VLAN on egress, retagging the VLAN on ingress} that we had in the best-effort VLAN filtering mode. It seems rather simpler that we just allocate a VLAN in the VLAN table that is simply not used by the bridge at all, or by any other port. Anyway, I have 2 gripes with the current sja1105_xmit_tpid: 1. When sending packets on behalf of a VLAN-aware bridge (with the new TX forwarding offload framework) plus untagged (with the tag_8021q VLAN added by the tagger) packets, we can see that on SJA1105P/Q/R/S and later (which have a qinq_tpid of ETH_P_8021AD), some packets sent through the DSA master have a VLAN protocol of 0x8100 and others of 0x88a8. This is strange and there is no reason for it now. If we have a bridge and are therefore forced to send using that bridge's TPID, we can as well blend with that bridge's VLAN protocol for all packets. 2. The sja1105_xmit_tpid introduces a dependency on the sja1105 driver, because it looks inside dp->priv. It is desirable to keep as much separation between taggers and switch drivers as possible. Now it doesn't do that anymore. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit b0b8c67eaa5c65f8426017e78fcce12dc7d85110 Author: Vladimir Oltean Date: Tue Aug 24 20:15:01 2021 +0300 net: dsa: sja1105: drop untagged packets on the CPU and DSA ports The sja1105 driver is a bit special in its use of VLAN headers as DSA tags. This is because in VLAN-aware mode, the VLAN headers use an actual TPID of 0x8100, which is understood even by the DSA master as an actual VLAN header. Furthermore, control packets such as PTP and STP are transmitted with no VLAN header as a DSA tag, because, depending on switch generation, there are ways to steer these control packets towards a precise egress port other than VLAN tags. Transmitting control packets as untagged means leaving a door open for traffic in general to be transmitted as untagged from the DSA master, and for it to traverse the switch and exit a random switch port according to the FDB lookup. This behavior is a bit out of line with other DSA drivers which have native support for DSA tagging. There, it is to be expected that the switch only accepts DSA-tagged packets on its CPU port, dropping everything that does not match this pattern. We perhaps rely a bit too much on the switches' hardware dropping on the CPU port, and place no other restrictions in the kernel data path to avoid that. For example, sja1105 is also a bit special in that STP/PTP packets are transmitted using "management routes" (sja1105_port_deferred_xmit): when sending a link-local packet from the CPU, we must first write a SPI message to the switch to tell it to expect a packet towards multicast MAC DA 01-80-c2-00-00-0e, and to route it towards port 3 when it gets it. This entry expires as soon as it matches a packet received by the switch, and it needs to be reinstalled for the next packet etc. All in all quite a ghetto mechanism, but it is all that the sja1105 switches offer for injecting a control packet. The driver takes a mutex for serializing control packets and making the pairs of SPI writes of a management route and its associated skb atomic, but to be honest, a mutex is only relevant as long as all parties agree to take it. With the DSA design, it is possible to open an AF_PACKET socket on the DSA master net device, and blast packets towards 01-80-c2-00-00-0e, and whatever locking the DSA switch driver might use, it all goes kaput because management routes installed by the driver will match skbs sent by the DSA master, and not skbs generated by the driver itself. So they will end up being routed on the wrong port. So through the lens of that, maybe it would make sense to avoid that from happening by doing something in the network stack, like: introduce a new bit in struct sk_buff, like xmit_from_dsa. Then, somewhere around dev_hard_start_xmit(), introduce the following check: if (netdev_uses_dsa(dev) && !skb->xmit_from_dsa) kfree_skb(skb); Ok, maybe that is a bit drastic, but that would at least prevent a bunch of problems. For example, right now, even though the majority of DSA switches drop packets without DSA tags sent by the DSA master (and therefore the majority of garbage that user space daemons like avahi and udhcpcd and friends create), it is still conceivable that an aggressive user space program can open an AF_PACKET socket and inject a spoofed DSA tag directly on the DSA master. We have no protection against that; the packet will be understood by the switch and be routed wherever user space says. Furthermore: there are some DSA switches where we even have register access over Ethernet, using DSA tags. So even user space drivers are possible in this way. This is a huge hole. However, the biggest thing that bothers me is that udhcpcd attempts to ask for an IP address on all interfaces by default, and with sja1105, it will attempt to get a valid IP address on both the DSA master as well as on sja1105 switch ports themselves. So with IP addresses in the same subnet on multiple interfaces, the routing table will be messed up and the system will be unusable for traffic until it is configured manually to not ask for an IP address on the DSA master itself. It turns out that it is possible to avoid that in the sja1105 driver, at least very superficially, by requesting the switch to drop VLAN-untagged packets on the CPU port. With the exception of control packets, all traffic originated from tag_sja1105.c is already VLAN-tagged, so only STP and PTP packets need to be converted. For that, we need to uphold the equivalence between an untagged and a pvid-tagged packet, and to remember that the CPU port of sja1105 uses a pvid of 4095. Now that we drop untagged traffic on the CPU port, non-aggressive user space applications like udhcpcd stop bothering us, and sja1105 effectively becomes just as vulnerable to the aggressive kind of user space programs as other DSA switches are (ok, users can also create 8021q uppers on top of the DSA master in the case of sja1105, but in future patches we can easily deny that, but it still doesn't change the fact that VLAN-tagged packets can still be injected over raw sockets). Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 73ceab8326522cc06af9036c15fa2c21fdbdf4b0 Author: Vladimir Oltean Date: Tue Aug 24 20:15:00 2021 +0300 net: dsa: sja1105: prevent tag_8021q VLANs from being received on user ports Currently it is possible for an attacker to craft packets with a fake DSA tag and send them to us, and our user ports will accept them and preserve that VLAN when transmitting towards the CPU. Then the tagger will be misled into thinking that the packets came on a different port than they really came on. Up until recently there wasn't a good option to prevent this from happening. In SJA1105P and later, the MAC Configuration Table introduced two options called: - DRPSITAG: Drop Single Inner Tagged Frames - DRPSOTAG: Drop Single Outer Tagged Frames Because the sja1105 driver classifies all VLANs as "outer VLANs" (S-Tags), it would be in principle possible to enable the DRPSOTAG bit on ports using tag_8021q, and drop on ingress all packets which have a VLAN tag. When the switch is VLAN-unaware, this works, because it uses a custom TPID of 0xdadb, so any "tagged" packets received on a user port are probably a spoofing attempt. But when the switch overall is VLAN-aware, and some ports are standalone (therefore they use tag_8021q), the TPID is 0x8100, and the port can receive a mix of untagged and VLAN-tagged packets. The untagged ones will be classified to the tag_8021q pvid, and the tagged ones to the VLAN ID from the packet header. Yes, it is true that since commit 4fbc08bd3665 ("net: dsa: sja1105: deny 8021q uppers on ports") we no longer support this mixed mode, but that is a temporary limitation which will eventually be lifted. It would be nice to not introduce one more restriction via DRPSOTAG, which would make the standalone ports of a VLAN-aware switch drop genuinely VLAN-tagged packets. Also, the DRPSOTAG bit is not available on the first generation of switches (SJA1105E, SJA1105T). So since one of the key features of this driver is compatibility across switch generations, this makes it an even less desirable approach. The breakthrough comes from commit bef0746cf4cc ("net: dsa: sja1105: make sure untagged packets are dropped on ingress ports with no pvid"), where it became obvious that untagged packets are not dropped even if the ingress port is not in the VMEMB_PORT vector of that port's pvid. However, VLAN-tagged packets are subject to VLAN ingress checking/dropping. This means that instead of using the catch-all DRPSOTAG bit introduced in SJA1105P, we can drop tagged packets on a per-VLAN basis, and this is already compatible with SJA1105E/T. This patch adds an "allowed_ingress" argument to sja1105_vlan_add(), and we call it with "false" for tag_8021q VLANs on user ports. The tag_8021q VLANs still need to be allowed, of course, on ingress to DSA ports and CPU ports. We also need to refine the drop_untagged check in sja1105_commit_pvid to make it not freak out about this new configuration. Currently it will try to keep the configuration consistent between untagged and pvid-tagged packets, so if the pvid of a port is 1 but VLAN 1 is not in VMEMB_PORT, packets tagged with VID 1 will behave the same as untagged packets, and be dropped. This behavior is what we want for ports under a VLAN-aware bridge, but for the ports with a tag_8021q pvid, we want untagged packets to be accepted, but packets tagged with a header recognized by the switch as a tag_8021q VLAN to be dropped. So only restrict the drop_untagged check to apply to the bridge_pvid, not to the tag_8021q_pvid. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 1ca8a193cade7f49801cc79e20d5f2a123991cdf Author: DENG Qingfang Date: Wed Aug 25 00:52:52 2021 +0800 net: dsa: mt7530: manually set up VLAN ID 0 The driver was relying on dsa_slave_vlan_rx_add_vid to add VLAN ID 0. After the blamed commit, VLAN ID 0 won't be set up anymore, breaking software bridging fallback on VLAN-unaware bridges. Manually set up VLAN ID 0 to fix this. Fixes: 06cfb2df7eb0 ("net: dsa: don't advertise 'rx-vlan-filter' when not needed") Signed-off-by: DENG Qingfang Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit e93826d35c647bd68c83af9ca97bba6eb3b2b711 Merge: 807d1032e09a4 c1a3e9f98dde4 Author: David S. Miller Date: Wed Aug 25 11:06:54 2021 +0100 Merge branch 'mana-EQ-sharing' Haiyang Zhang says: ==================== net: mana: Add support for EQ sharing The existing code uses (1 + #vPorts * #Queues) MSIXs, which may exceed the device limit. Support EQ sharing, so that multiple vPorts can share the same set of MSIXs. ==================== Signed-off-by: David S. Miller commit c1a3e9f98dde4782290d2c4871e42b7e76ad5593 Author: Haiyang Zhang Date: Tue Aug 24 09:46:01 2021 -0700 net: mana: Add WARN_ON_ONCE in case of CQE read overflow This is not an expected case normally. Add WARN_ON_ONCE in case of CQE read overflow, instead of failing silently. Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit 1e2d0824a9c3de5371a46601aac0c14af5c0a50a Author: Haiyang Zhang Date: Tue Aug 24 09:46:00 2021 -0700 net: mana: Add support for EQ sharing The existing code uses (1 + #vPorts * #Queues) MSIXs, which may exceed the device limit. Support EQ sharing, so that multiple vPorts (NICs) can share the same set of MSIXs. And, report the EQ-sharing capability bit to the host, which means the host can potentially offer more vPorts and queues to the VM. Also update the resource limit checking and error handling for better robustness. Now, we support up to 256 virtual ports per VF (it was 16/VF), and support up to 64 queues per vPort (it was 16). Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit e1b5683ff62e7b328317aec08869495992053e9d Author: Haiyang Zhang Date: Tue Aug 24 09:45:59 2021 -0700 net: mana: Move NAPI from EQ to CQ The existing code has NAPI threads polling on EQ directly. To prepare for EQ sharing among vPorts, move NAPI from EQ to CQ so that one EQ can serve multiple CQs from different vPorts. The "arm bit" is only set when CQ processing is completed to reduce the number of EQ entries, which in turn reduce the number of interrupts on EQ. Signed-off-by: Haiyang Zhang Signed-off-by: David S. Miller commit 807d1032e09a42732c374304554a088c6b5e8f92 Author: Shaokun Zhang Date: Wed Aug 25 11:06:55 2021 +0800 netxen_nic: Remove the repeated declaration Function 'netxen_rom_fast_read' is declared twice, so remove the repeated declaration. Cc: Manish Chopra Cc: Rahul Verma Cc: "David S. Miller" Cc: Jakub Kicinski Signed-off-by: Shaokun Zhang Signed-off-by: David S. Miller commit bc4f128d867289df2310d7e589372502a5d6e0cd Author: Nathan Chancellor Date: Tue Aug 24 13:51:04 2021 -0700 cxgb4: Properly revert VPD changes Clang warns: drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2785:2: error: variable 'kw_offset' is uninitialized when used here [-Werror,-Wuninitialized] FIND_VPD_KW(i, "RV"); ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2776:39: note: expanded from macro 'FIND_VPD_KW' var = pci_vpd_find_info_keyword(vpd, kw_offset, vpdr_len, name); \ ^~~~~~~~~ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2748:34: note: initialize the variable 'kw_offset' to silence this warning unsigned int vpdr_len, kw_offset, id_len; ^ = 0 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2785:2: error: variable 'vpdr_len' is uninitialized when used here [-Werror,-Wuninitialized] FIND_VPD_KW(i, "RV"); ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2776:50: note: expanded from macro 'FIND_VPD_KW' var = pci_vpd_find_info_keyword(vpd, kw_offset, vpdr_len, name); \ ^~~~~~~~ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2748:23: note: initialize the variable 'vpdr_len' to silence this warning unsigned int vpdr_len, kw_offset, id_len; ^ = 0 2 errors generated. The series "PCI/VPD: Convert more users to the new VPD API functions" was applied to net-next when it should have been applied to the PCI tree because of build errors. However, commit 82e34c8a9bdf ("Revert "Revert "cxgb4: Search VPD with pci_vpd_find_ro_info_keyword()""") reapplied a change, resulting in the warning above. Properly revert commit 8d63ee602da3 ("cxgb4: Search VPD with pci_vpd_find_ro_info_keyword()") to fix the warning and restore proper functionality. This also reverts commit 3a93bedea050 ("cxgb4: Remove unused vpd_param member ec") to avoid future merge conflicts, as that change has been applied to the PCI tree. Link: https://lore.kernel.org/r/20210823120929.7c6f7a4f@canb.auug.org.au/ Link: https://lore.kernel.org/r/1ca29408-7bc7-4da5-59c7-87893c9e0442@gmail.com/ Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit cb0f8b034c761346bac72abe2685f52e9f8c8bd0 Merge: d484dc2b21a71 6bb3ab4913e97 Author: David S. Miller Date: Wed Aug 25 11:02:35 2021 +0100 Merge branch 'mptcp-next' Mat Martineau says: ==================== mptcp: Optimize output options and add MP_FAIL This patch set contains two groups of changes that we've been testing in the MPTCP tree. The first optimizes the code path and data structure for populating MPTCP option headers when transmitting. Patch 1 reorganizes code to reduce the number of conditionals that need to be evaluated in common cases. Patch 2 rearranges struct mptcp_out_options to save 80 bytes (on x86_64). The next five patches add partial support for the MP_FAIL option as defined in RFC 8684. MP_FAIL is an option header used to cleanly handle MPTCP checksum failures. When the MPTCP checksum detects an error in the MPTCP DSS header or the data mapped by that header, the receiver uses a TCP RST with MP_FAIL to close the subflow that experienced the error and provide associated MPTCP sequence number information to the peer. RFC 8684 also describes how a single-subflow connection can discard corrupt data and remain connected under certain conditions using MP_FAIL, but that feature is not implemented here. Patches 3-5 implement MP_FAIL transmit and receive, and integrates with checksum validation. Patches 6 & 7 add MP_FAIL selftests and the MIBs required for those tests. ==================== Signed-off-by: David S. Miller commit 6bb3ab4913e97b083561d22f5afe1124b7ec4954 Author: Geliang Tang Date: Tue Aug 24 16:26:19 2021 -0700 selftests: mptcp: add MP_FAIL mibs check This patch added a function chk_fail_nr to check the mibs for MP_FAIL. Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit eb7f33654dc146aeb1ff245dae6e48b759dd8985 Author: Geliang Tang Date: Tue Aug 24 16:26:18 2021 -0700 mptcp: add the mibs for MP_FAIL This patch added the mibs for MP_FAIL: MPTCP_MIB_MPFAILTX and MPTCP_MIB_MPFAILRX. Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 478d770008b03ed9d74bdc8add2315b7fd124ecc Author: Geliang Tang Date: Tue Aug 24 16:26:17 2021 -0700 mptcp: send out MP_FAIL when data checksum fails When a bad checksum is detected, set the send_mp_fail flag to send out the MP_FAIL option. Add a new function mptcp_has_another_subflow() to check whether there's only a single subflow. When multiple subflows are in use, close the affected subflow with a RST that includes an MP_FAIL option and discard the data with the bad checksum. Set the sk_state of the subsocket to TCP_CLOSE, then the flag MPTCP_WORK_CLOSE_SUBFLOW will be set in subflow_sched_work_if_closed, and the subflow will be closed. When a single subfow is in use, temporarily handled by sending MP_FAIL with a RST too. Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 5580d41b758af12134d5c6b4c385fc25d0c6bfb0 Author: Geliang Tang Date: Tue Aug 24 16:26:16 2021 -0700 mptcp: MP_FAIL suboption receiving This patch added handling for receiving MP_FAIL suboption. Add a new members mp_fail and fail_seq in struct mptcp_options_received. When MP_FAIL suboption is received, set mp_fail to 1 and save the sequence number to fail_seq. Then invoke mptcp_pm_mp_fail_received to deal with the MP_FAIL suboption. Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit c25aeb4e095355eec3beb6a2b2b30322bd6d0dd4 Author: Geliang Tang Date: Tue Aug 24 16:26:15 2021 -0700 mptcp: MP_FAIL suboption sending This patch added the MP_FAIL suboption sending support. Add a new flag named send_mp_fail in struct mptcp_subflow_context. If this flag is set, send out MP_FAIL suboption. Add a new member fail_seq in struct mptcp_out_options to save the data sequence number to put into the MP_FAIL suboption. An MP_FAIL option could be included in a RST or on the subflow-level ACK. Suggested-by: Paolo Abeni Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit d7b269083786dca3b1b0141bde6cea834062b691 Author: Paolo Abeni Date: Tue Aug 24 16:26:14 2021 -0700 mptcp: shrink mptcp_out_options struct After the previous patch we can alias with a union several fields in mptcp_out_options. Such struct is stack allocated and memset() for each plain TCP out packet. Every saved byted counts. Before: pahole -EC mptcp_out_options # ... /* size: 136, cachelines: 3, members: 17 */ After: pahole -EC mptcp_out_options # ... /* size: 56, cachelines: 1, members: 9 */ Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 1bff1e43a30e2f7500a49d47fd26a425643a6a37 Author: Paolo Abeni Date: Tue Aug 24 16:26:13 2021 -0700 mptcp: optimize out option generation Currently we have several protocol constraints on MPTCP options generation (e.g. MPC and MPJ subopt are mutually exclusive) and some additional ones required by our implementation (e.g. almost all ADD_ADDR variant are mutually exclusive with everything else). We can leverage the above to optimize the out option generation: we check DSS/MPC/MPJ presence in a mutually exclusive way, avoiding many unneeded conditionals in the common cases. Additionally extend the existing constraints on ADD_ADDR opt on all subvariants, so that it becomes fully mutually exclusive with the above and we can skip another conditional statement for the common case. This change is also needed by the next patch. Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit 081551266d2fbf6ce69a30c13a355ee476b2e745 Author: Masahiro Yamada Date: Thu Jul 29 23:00:23 2021 +0900 x86/build: Move the install rule to arch/x86/Makefile Currently, the install target in arch/x86/Makefile descends into arch/x86/boot/Makefile to invoke the shell script, but there is no good reason to do so. arch/x86/Makefile can run the shell script directly. Signed-off-by: Masahiro Yamada Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20210729140023.442101-2-masahiroy@kernel.org commit d484dc2b21a71642665159d2f7c33828e637ab91 Merge: 38cbd6e77f85c a90ec84837325 Author: David S. Miller Date: Wed Aug 25 10:57:19 2021 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2021-08-24 Vinicius Costa Gomes says: This adds support for PCIe PTM (Precision Time Measurement) to the igc driver. PCIe PTM allows the NIC and Host clocks to be compared more precisely, improving the clock synchronization accuracy. Patch 1/4 reverts a commit that made pci_enable_ptm() private to the PCI subsystem, reverting makes it possible for it to be called from the drivers. Patch 2/4 adds the pcie_ptm_enabled() helper. Patch 3/4 calls pci_enable_ptm() from the igc driver. Patch 4/4 implements the PCIe PTM support. Exposing it via the .getcrosststamp() API implies that the time measurements are made synchronously with the ioctl(). The hardware was implemented so the most convenient way to retrieve that information would be asynchronously. So, to follow the expectations of the ioctl() we have to use less convenient ways, triggering an PCIe PTM dialog every time a ioctl() is received. Some questions are raised (also pointed out in the commit message): 1. Using convert_art_ns_to_tsc() is too x86 specific, there should be a common way to create a 'system_counterval_t' from a timestamp. 2. convert_art_ns_to_tsc() says that it should only be used when X86_FEATURE_TSC_KNOWN_FREQ is true, but during tests it works even when it returns false. Should that check be done? ==================== Signed-off-by: David S. Miller commit 38cbd6e77f85c7fbf5a34a0aebf9c3e6d01fc214 Merge: fbd029df29c67 df0d6f7a342cd Author: David S. Miller Date: Wed Aug 25 10:55:43 2021 +0100 Merge branch 'lan7800-improvements' John Efstathiades says: ==================== LAN7800 driver improvements This patch set introduces a number of improvements and fixes for problems found during testing of a modification to add a NAPI-style approach to packet handling to improve performance. NOTE: the NAPI changes are not part of this patch set and the issues fixed by this patch set are not coupled to the NAPI changes. Patch 1 fixes white space and style issues Patch 2 removes an unused timer Patch 3 introduces macros to set the internal packet FIFO flow control levels, which makes it easier to update the levels in future. Patch 4 removes an unused queue Patch 5 (updated for v2) introduces function return value checks and error propagation to various parts of the driver where a return code was captured but then ignored. This patch is completely different to patch 5 in version 1 of this patch set. The changes in the v1 patch 5 are being set aside for the time being. Patch 6 updates the LAN7800 MAC reset code to ensure there is no PHY register access in progress when the MAC is reset. This change prevents a kernel exception that can otherwise occur. Patch 7 fixes problems with system suspend and resume handling while the device is transmitting and receiving data. Patch 8 fixes problems with auto-suspend and resume handling and depends on changes introduced by patch 7. Patch 9 fixes problems with device disconnect handling that can result in kernel exceptions and/or hang. Patch 10 limits the rate at which driver warning messages are emitted. ==================== Signed-off-by: David S. Miller commit df0d6f7a342cd8e4fad1dff4ca262462300223f7 Author: John Efstathiades Date: Tue Aug 24 19:56:13 2021 +0100 lan78xx: Limit number of driver warning messages Device removal can result in a large burst of driver warning messages (20 - 30) sent to the kernel log. Most of these are register read/write failures. This change limits the rate at which these messages are emitted. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 77dfff5bb7e20ce1eaaf4c599d9c54a8f4331124 Author: John Efstathiades Date: Tue Aug 24 19:56:12 2021 +0100 lan78xx: Fix race condition in disconnect handling If there is a device disconnect at roughly the same time as a deferred PHY link reset there is a race condition that can result in a kernel lock up due to a null pointer dereference in the driver's deferred work handling routine lan78xx_delayedwork(). The following changes fix this problem. Add new status flag EVENT_DEV_DISCONNECT to indicate when the device has been removed and use it to prevent operations, such as register access, that will fail once the device is removed. Stop processing of deferred work items when the driver's USB disconnect handler is invoked. Disconnect the PHY only after the network device has been unregistered and all delayed work has been cancelled. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 5f4cc6e25148cc141f97afb41b4dfe9eb1cce613 Author: John Efstathiades Date: Tue Aug 24 19:56:11 2021 +0100 lan78xx: Fix race conditions in suspend/resume handling If the interface is given an IP address while the device is suspended (as a result of an auto-suspend event) there is a race between lan78xx_resume() and lan78xx_open() that can result in an exception or failure to handle incoming packets. The following changes fix this problem. Introduce a mutex to serialise operations in the network interface open and stop entry points with respect to the USB driver suspend and resume entry points. Move Tx and Rx data path start/stop to lan78xx_start() and lan78xx_stop() respectively and flush the packet FIFOs before starting the Tx and Rx data paths. This prevents the MAC and FIFOs getting out of step and delivery of malformed packets to the network stack. Stop processing of received packets before disconnecting the PHY from the MAC to prevent a kernel exception caused by handling packets after the PHY device has been removed. Refactor device auto-suspend code to make it consistent with the the system suspend code and make the suspend handler easier to read. Add new code to stop wake-on-lan packets or PHY events resuming the host or device from suspend if the device has not been opened (typically after an IP address is assigned). This patch is dependent on changes to lan78xx_suspend() and lan78xx_resume() introduced in the previous patch of this patch set. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit e1210fe63bf8b080edd0805240e90b81b6b069c1 Author: John Efstathiades Date: Tue Aug 24 19:56:10 2021 +0100 lan78xx: Fix partial packet errors on suspend/resume The MAC can get out of step with the internal packet FIFOs if the system goes to sleep when the link is active, especially at high data rates. This can result in partial frames in the packet FIFOs that in result in malformed frames being delivered to the host. This occurs because the driver does not enable/disable the internal packet FIFOs in step with the corresponding MAC data path. The following changes fix this problem. Update code that enables/disables the MAC receiver and transmitter to the more general Rx and Tx data path, where the data path in each direction consists of both the MAC function (Tx or Rx) and the corresponding packet FIFO. In the receive path the packet FIFO must be enabled before the MAC receiver but disabled after the MAC receiver. In the transmit path the opposite is true: the packet FIFO must be enabled after the MAC transmitter but disabled before the MAC transmitter. The packet FIFOs can be flushed safely once the corresponding data path is stopped. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit b1f6696daafebea243ed59ed18a8b10cfd33b474 Author: John Efstathiades Date: Tue Aug 24 19:56:09 2021 +0100 lan78xx: Fix exception on link speed change An exception is sometimes seen when the link speed is changed from auto-negotiation to a fixed speed, or vice versa. The exception occurs when the MAC is reset (due to the link speed change) at the same time as the PHY state machine is accessing a PHY register. The following changes fix this problem. Rework the MAC reset to ensure there is no outstanding MDIO register transaction before the reset and then wait until the reset is complete before allowing any further MAC register access. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 3415f6baaddb9b39d7112247ab39ef3c700f882e Author: John Efstathiades Date: Tue Aug 24 19:56:08 2021 +0100 lan78xx: Add missing return code checks There are many places in the driver where the return code from a function call is captured but without a subsequent test of the return code and appropriate action taken. This patch adds the missing return code tests and action. In most cases the action is an early exit from the calling function. The function lan78xx_set_suspend() was also updated to make it consistent with lan78xx_suspend(). Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 40b8452fa8b4567ab7d862c7d4c3d02f635f17fd Author: John Efstathiades Date: Tue Aug 24 19:56:07 2021 +0100 lan78xx: Remove unused pause frame queue Remove the pause frame queue from the driver. It is initialised but not actually used. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit dc35f8548e005b8a32fedaa5b01d52585eba5f1d Author: John Efstathiades Date: Tue Aug 24 19:56:06 2021 +0100 lan78xx: Set flow control threshold to prevent packet loss Set threshold at which flow control is triggered to 3/4 full of the internal Rx packet FIFO to prevent packet drops at high data rates. The new setting reduces the number of dropped UDP frames and TCP retransmit requests especially on less capable CPUs. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 3bef6b9e98888456805331201c0d8587c14fa108 Author: John Efstathiades Date: Tue Aug 24 19:56:05 2021 +0100 lan78xx: Remove unused timer Remove kernel timer that is not used by the driver. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 9ceec7d33adf9647293f24d2fd9a055b89c63864 Author: John Efstathiades Date: Tue Aug 24 19:56:04 2021 +0100 lan78xx: Fix white space and style issues Fix white space and code style issues identified by checkpatch. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller commit 88939e737573552310d9ef4caf74501f67306bfc Merge: 0be10d7122ceb 5f8c991e89509 Author: Mark Brown Date: Wed Aug 25 10:50:21 2021 +0100 Merge series "ASoC: mediatek: Add support for MT8195 SoC" from Trevor Wu : This series of patches adds support for Mediatek AFE of MT8195 SoC. Patches are based on broonie tree "for-next" branch. Changes since v4: - removed sof related code Changes since v3: - fixed warnings found by kernel test robot - removed unused critical section - corrected the lock protected sections on etdm driver - added DPTX and HDMITX audio support Changes since v2: - added audio clock gate control - added 'mediatek' prefix to private dts properties - added consumed clocks to dt-bindins and adopted suggestions from Rob - refined clock usage and remove unused clock and control code - fixed typos Changes since v1: - fixed some problems related to dt-bindings - added some missing properties to dt-bindings - added depency declaration on dt-bindings - fixed some warnings found by kernel test robot Trevor Wu (11): ASoC: mediatek: mt8195: update mediatek common driver ASoC: mediatek: mt8195: support audsys clock control ASoC: mediatek: mt8195: support etdm in platform driver ASoC: mediatek: mt8195: support adda in platform driver ASoC: mediatek: mt8195: support pcm in platform driver ASoC: mediatek: mt8195: add platform driver dt-bindings: mediatek: mt8195: add audio afe document ASoC: mediatek: mt8195: add machine driver with mt6359, rt1019 and rt5682 ASoC: mediatek: mt8195: add DPTX audio support ASoC: mediatek: mt8195: add HDMITX audio support dt-bindings: mediatek: mt8195: add mt8195-mt6359-rt1019-rt5682 document .../bindings/sound/mt8195-afe-pcm.yaml | 184 + .../sound/mt8195-mt6359-rt1019-rt5682.yaml | 47 + sound/soc/mediatek/Kconfig | 24 + sound/soc/mediatek/Makefile | 1 + sound/soc/mediatek/common/mtk-afe-fe-dai.c | 22 +- sound/soc/mediatek/common/mtk-base-afe.h | 10 +- sound/soc/mediatek/mt8195/Makefile | 15 + sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 441 +++ sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 109 + sound/soc/mediatek/mt8195/mt8195-afe-common.h | 158 + sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 3281 +++++++++++++++++ sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 214 ++ sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 15 + .../soc/mediatek/mt8195/mt8195-audsys-clkid.h | 93 + sound/soc/mediatek/mt8195/mt8195-dai-adda.c | 830 +++++ sound/soc/mediatek/mt8195/mt8195-dai-etdm.c | 2639 +++++++++++++ sound/soc/mediatek/mt8195/mt8195-dai-pcm.c | 389 ++ .../mt8195/mt8195-mt6359-rt1019-rt5682.c | 1087 ++++++ sound/soc/mediatek/mt8195/mt8195-reg.h | 2796 ++++++++++++++ 19 files changed, 12350 insertions(+), 5 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/mt8195-afe-pcm.yaml create mode 100644 Documentation/devicetree/bindings/sound/mt8195-mt6359-rt1019-rt5682.yaml create mode 100644 sound/soc/mediatek/mt8195/Makefile create mode 100644 sound/soc/mediatek/mt8195/mt8195-afe-clk.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-afe-clk.h create mode 100644 sound/soc/mediatek/mt8195/mt8195-afe-common.h create mode 100644 sound/soc/mediatek/mt8195/mt8195-afe-pcm.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-audsys-clk.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-audsys-clk.h create mode 100644 sound/soc/mediatek/mt8195/mt8195-audsys-clkid.h create mode 100644 sound/soc/mediatek/mt8195/mt8195-dai-adda.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-dai-etdm.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-dai-pcm.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-mt6359-rt1019-rt5682.c create mode 100644 sound/soc/mediatek/mt8195/mt8195-reg.h -- 2.18.0 commit 6d61b8e66d343d61b650f9a2ca4d8746dc6cf774 Author: Masahiro Yamada Date: Thu Jul 29 23:00:22 2021 +0900 x86/build: Remove the left-over bzlilo target Commit f279b49f13bd ("x86/boot: Modernize genimage script; hdimage+EFI support") removed the bzlilo target from arch/x86/boot/Makefile. Remove the left-over from arch/x86/Makefile. Signed-off-by: Masahiro Yamada Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20210729140023.442101-1-masahiroy@kernel.org commit fbd029df29c6701a2df02ec69923caef5811eabd Merge: 755f905340802 a884daa61a7d9 Author: David S. Miller Date: Wed Aug 25 10:43:22 2021 +0100 Merge branch 'xen-harden-netfront' Juergen Gross says: ==================== xen: harden netfront against malicious backends Xen backends of para-virtualized devices can live in dom0 kernel, dom0 user land, or in a driver domain. This means that a backend might reside in a less trusted environment than the Xen core components, so a backend should not be able to do harm to a Xen guest (it can still mess up I/O data, but it shouldn't be able to e.g. crash a guest by other means or cause a privilege escalation in the guest). Unfortunately netfront in the Linux kernel is fully trusting its backend. This series is fixing netfront in this regard. It was discussed to handle this as a security problem, but the topic was discussed in public before, so it isn't a real secret. It should be mentioned that a similar series has been posted some years ago by Marek Marczykowski-Górecki, but this series has not been applied due to a Xen header not having been available in the Xen git repo at that time. Additionally my series is fixing some more DoS cases. ==================== Signed-off-by: David S. Miller commit a884daa61a7d91650987e855464526aef219590f Author: Juergen Gross Date: Tue Aug 24 12:28:09 2021 +0200 xen/netfront: don't trust the backend response data blindly Today netfront will trust the backend to send only sane response data. In order to avoid privilege escalations or crashes in case of malicious backends verify the data to be within expected limits. Especially make sure that the response always references an outstanding request. Note that only the tx queue needs special id handling, as for the rx queue the id is equal to the index in the ring page. Introduce a new indicator for the device whether it is broken and let the device stop working when it is set. Set this indicator in case the backend sets any weird data. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: David S. Miller commit 21631d2d741a64a073e167c27769e73bc7844a2f Author: Juergen Gross Date: Tue Aug 24 12:28:08 2021 +0200 xen/netfront: disentangle tx_skb_freelist The tx_skb_freelist elements are in a single linked list with the request id used as link reference. The per element link field is in a union with the skb pointer of an in use request. Move the link reference out of the union in order to enable a later reuse of it for requests which need a populated skb pointer. Rename add_id_to_freelist() and get_id_from_freelist() to add_id_to_list() and get_id_from_list() in order to prepare using those for other lists as well. Define ~0 as value to indicate the end of a list and place that value into the link for a request not being on the list. When freeing a skb zero the skb pointer in the request. Use a NULL value of the skb pointer instead of skb_entry_is_link() for deciding whether a request has a skb linked to it. Remove skb_entry_set_link() and open code it instead as it is really trivial now. Signed-off-by: Juergen Gross Signed-off-by: David S. Miller commit 162081ec33c2686afa29d91bf8d302824aa846c7 Author: Juergen Gross Date: Tue Aug 24 12:28:07 2021 +0200 xen/netfront: don't read data from request on the ring page In order to avoid a malicious backend being able to influence the local processing of a request build the request locally first and then copy it to the ring page. Any reading from the request influencing the processing in the frontend needs to be done on the local instance. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: David S. Miller commit 8446066bf8c1f9f7b7412c43fbea0fb87464d75b Author: Juergen Gross Date: Tue Aug 24 12:28:06 2021 +0200 xen/netfront: read response from backend only once In order to avoid problems in case the backend is modifying a response on the ring page while the frontend has already seen it, just read the response into a local buffer in one go and then operate on that buffer only. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: David S. Miller commit 755f905340802e2efb1ea96b9ce0f442916c2645 Author: Alok Prasad Date: Tue Aug 24 04:02:46 2021 +0000 qed: Enable automatic recovery on error condition. This patch enables automatic recovery by default in case of various error condition like fw assert , hardware error etc. This also ensure driver can handle multiple iteration of assertion conditions. Signed-off-by: Ariel Elior Signed-off-by: Shai Malin Signed-off-by: Igor Russkikh Signed-off-by: Alok Prasad Signed-off-by: David S. Miller commit 406f42fa0d3cbcea3766c3111d79ac5afe711c5b Author: Gilad Naaman Date: Thu Aug 19 10:17:27 2021 +0300 net-next: When a bond have a massive amount of VLANs with IPv6 addresses, performance of changing link state, attaching a VRF, changing an IPv6 address, etc. go down dramtically. The source of most of the slow down is the `dev_addr_lists.c` module, which mainatins a linked list of HW addresses. When using IPv6, this list grows for each IPv6 address added on a VLAN, since each IPv6 address has a multicast HW address associated with it. When performing any modification to the involved links, this list is traversed many times, often for nothing, all while holding the RTNL lock. Instead, this patch adds an auxilliary rbtree which cuts down traversal time significantly. Performance can be seen with the following script: #!/bin/bash ip netns del test || true 2>/dev/null ip netns add test echo 1 | ip netns exec test tee /proc/sys/net/ipv6/conf/all/keep_addr_on_down > /dev/null set -e ip -n test link add foo type veth peer name bar ip -n test link add b1 type bond ip -n test link add florp type vrf table 10 ip -n test link set bar master b1 ip -n test link set foo up ip -n test link set bar up ip -n test link set b1 up ip -n test link set florp up VLAN_COUNT=1500 BASE_DEV=b1 echo Creating vlans ip netns exec test time -p bash -c "for i in \$(seq 1 $VLAN_COUNT); do ip -n test link add link $BASE_DEV name foo.\$i type vlan id \$i; done" echo Bringing them up ip netns exec test time -p bash -c "for i in \$(seq 1 $VLAN_COUNT); do ip -n test link set foo.\$i up; done" echo Assiging IPv6 Addresses ip netns exec test time -p bash -c "for i in \$(seq 1 $VLAN_COUNT); do ip -n test address add dev foo.\$i 2000::\$i/64; done" echo Attaching to VRF ip netns exec test time -p bash -c "for i in \$(seq 1 $VLAN_COUNT); do ip -n test link set foo.\$i master florp; done" On an Intel(R) Xeon(R) CPU E5-2650 v3 @ 2.30GHz machine, the performance before the patch is (truncated): Creating vlans real 108.35 Bringing them up real 4.96 Assiging IPv6 Addresses real 19.22 Attaching to VRF real 458.84 After the patch: Creating vlans real 5.59 Bringing them up real 5.07 Assiging IPv6 Addresses real 5.64 Attaching to VRF real 25.37 Cc: David S. Miller Cc: Jakub Kicinski Cc: Lu Wei Cc: Xiongfeng Wang Cc: Taehee Yoo Signed-off-by: Gilad Naaman Signed-off-by: David S. Miller commit f80c8e6864eb14b71f58c1a159654e4f379673a6 Author: ChanWoo Lee Date: Wed Aug 25 16:46:01 2021 +0900 mmc: queue: Remove unused parameters(request_queue) In function mmc_exit_request, the request_queue structure(*q) is not used. I remove the unnecessary code related to the request_queue structure. Signed-off-by: ChanWoo Lee Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20210825074601.8881-1-cw9316.lee@samsung.com Signed-off-by: Ulf Hansson commit dba914b248845492080162c0b604a5e25e52dc7b Author: Claudiu Beznea Date: Wed Aug 25 11:19:31 2021 +0300 mmc: pwrseq: sd8787: fix compilation warning Fixed compilation warning "cast from pointer to integer of different size [-Wpointer-to-int-cast]" Fixes: b2832b96fcf5 ("mmc: pwrseq: sd8787: add support for wilc1000") Reported-by: kernel test robot Reported-by: Stephen Rothwell Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20210825081931.598934-1-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit e72a55f2e5ddcfb3dce0701caf925ce435b87682 Author: Nishad Kamdar Date: Wed Aug 25 00:47:26 2021 +0530 mmc: core: Return correct emmc response in case of ioctl error When a read/write command is sent via ioctl to the kernel, and the command fails, the actual error response of the emmc is not sent to the user. IOCTL read/write tests are carried out using commands 17 (Single BLock Read), 24 (Single Block Write), 18 (Multi Block Read), 25 (Multi Block Write) The tests are carried out on a 64Gb emmc device. All of these tests try to access an "out of range" sector address (0x09B2FFFF). It is seen that without the patch the response received by the user is not OUT_OF_RANGE error (R1 response 31st bit is not set) as per JEDEC specification. After applying the patch proper response is seen. This is because the function returns without copying the response to the user in case of failure. This patch fixes the issue. Hence, this memcpy is required whether we get an error response or not. Therefor it is moved up from the current position up to immediately after we have called mmc_wait_for_req(). The test code and the output of only the CMD17 is included in the commit to limit the message length. CMD17 (Test Code Snippet): ========================== printf("Forming CMD%d\n", opt_idx); /* single block read */ cmd.blksz = 512; cmd.blocks = 1; cmd.write_flag = 0; cmd.opcode = 17; //cmd.arg = atoi(argv[3]); cmd.arg = 0x09B2FFFF; /* Expecting response R1B */ cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC; memset(data, 0, sizeof(__u8) * 512); mmc_ioc_cmd_set_data(cmd, data); printf("Sending CMD%d: ARG[0x%08x]\n", opt_idx, cmd.arg); if(ioctl(fd, MMC_IOC_CMD, &cmd)) perror("Error"); printf("\nResponse: %08x\n", cmd.response[0]); CMD17 (Output without patch): ============================= test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17 Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4 Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 0x09B2FFF] Forming CMD17 Sending CMD17: ARG[0x09b2ffff] Error: Connection timed out Response: 00000000 (Incorrect response) CMD17 (Output with patch): ========================== test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17 [sudo] password for test: Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4 Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 09B2FFFF] Forming CMD17 Sending CMD17: ARG[0x09b2ffff] Error: Connection timed out Response: 80000900 (Correct OUT_OF_ERROR response as per JEDEC specification) Signed-off-by: Nishad Kamdar Reviewed-by: Avri Altman Link: https://lore.kernel.org/r/20210824191726.8296-1-nishadkamdar@gmail.com Signed-off-by: Ulf Hansson commit 45334ee13858de4c8c8c781b3b0f94b7b81e9e69 Author: Haibo Chen Date: Wed Aug 18 19:16:51 2021 +0800 mmc: sdhci-esdhc-imx: Select the correct mode for auto tuning USDHC hardware auto tuning circuit support check 1/4/8 data lines and cmd line. Out of reset uSDHC, it default select check 4 data lines and do not check cmd line. This is incorrect if we use 8 data lines. So need to config the auto tuning mode according to current bus width. Signed-off-by: Haibo Chen Link: https://lore.kernel.org/r/1629285415-7495-2-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit a0dbbdc2036e7406bf937912f7997c0b34042464 Author: Haibo Chen Date: Wed Aug 18 19:16:50 2021 +0800 mmc: sdhci-esdhc-imx: Remove redundant code for manual tuning For manual tuning method, already call esdhc_prepare_tuning() config the necessary registers, so remove the redundant code in esdhc_writew_le() for SDHCI_HOST_CONTROL2. Signed-off-by: Haibo Chen Link: https://lore.kernel.org/r/1629285415-7495-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 0d6d75d2a2c341ce99f0549fa28bee93fa56505d Author: Heiko Carstens Date: Tue Jul 13 16:57:13 2021 +0200 KVM: s390: generate kvm hypercall functions Generate kvm hypercall functions with a macro instead of duplicating the more or less identical code seven times. This also reduces number of lines of code. However the main purpose is to get rid of as many as possible open coded error prone register asm constructs in s390 architecture code. For the only user of kvm_hypercall identical code is created before/after this patch (drivers/s390/virtio/virtio_ccw.c). Reviewed-by: Christian Borntraeger Acked-by: Christian Borntraeger Link: https://lore.kernel.org/r/20210713145713.2815167-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 70aa5d39826528e77f5595a5f9297d919112d396 Author: Peter Oberparleiter Date: Fri Aug 13 15:05:05 2021 +0200 s390/sclp: add tracing of SCLP interactions Add tracing of interactions between the SCLP base driver, firmware and other drivers to support problem determination in case of SCLP-related issues. For that purpose this patch introduces two new s390dbf debug areas: - sclp: An abbreviated log of all common interactions - sclp_err: A full log of failed or abnormal interactions Tracing of full SCCB contents can be enabled for the sclp area by setting its debug level to maximum (6). Overview of added trace events: * Firmware interaction: - SRV1: Service call about to be issued - SRV2: Service call was issued - INT: Interrupt received * Driver interaction: - RQAD: Request was added - RQOK: Request success - RQAB: Request aborted - RQTM: Request timed out - REG: Event listener registered - UREG: Event listener unregistered - EVNT: Event callback - STCG: State-change callback * Abnormal events: - TMO: A timeout occurred - UNEX: Unexpected SCCB completion * Other (not traced at default level): - SYN1: Synchronous wait start - SYN2: Synchronous wait end Since the SCLP interface is used by console drivers this patch also moves s390dbf printks outside the critical section protected by debug area locks to prevent a potential deadlock that would otherwise be introduced between console_owner --> sclp_lock --> sclp_debug.lock. Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit d72541f945127b4873dace501406a1bc8cd8e1e9 Author: Peter Oberparleiter Date: Fri Aug 13 15:05:04 2021 +0200 s390/debug: add early tracing support Debug areas can currently only be used after s390dbf initialization which occurs as a postcore_initcall. This is too late for tracing earlier code such as that related to console_init(). This patch introduces a macro for defining a statically initialized debug area that can be used to trace very early code. The macro is made available for built-in code only because modules are never running during early boot. Example usage: 1. Define static debug area: DEFINE_STATIC_DEBUG_INFO(my_debug, "my_debug", 4, 1, 16, &debug_hex_ascii_view); 2. Add trace entry: debug_event(&my_debug, 0, "DATA", 4); Note: The debug area is automatically registered in debugfs during boot. A driver must not call any of the debug_register()/_unregister() functions on a static debug_info_t! Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 9372a82892c2caa6bccab9a4081166fa769699f8 Author: Peter Oberparleiter Date: Fri Aug 13 15:05:03 2021 +0200 s390/debug: fix debug area life cycle Currently allocation and registration of s390dbf debug areas are tied together. As a result, a debug area cannot be unregistered and re-registered while any process has an associated debugfs file open. Fix this by splitting alloc/release from register/unregister. Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 1204777867e8486a88dbb4793fe256b31ea05eeb Author: Peter Oberparleiter Date: Fri Aug 13 15:05:02 2021 +0200 s390/debug: keep debug data on resize Any previously recorded s390dbf debug data is reset when a debug area is resized using the 'pages' sysfs attribute. This can make live-debugging unnecessarily complex. Fix this by copying existing debug data to the newly allocated debug area when resizing. Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit 2879048c7ea1bcfbacda5af5f555666134323e3a Author: Heiko Carstens Date: Tue Aug 24 17:21:12 2021 +0200 s390/diag: make restart_part2 a local label Avoid that the "restart_part2" label, which is in the middle of a function, appears in /proc/kallsyms. Signed-off-by: Heiko Carstens commit c4f0e5cfde354b1d6cf2388c0920264985c6c139 Author: Heiko Carstens Date: Tue Aug 24 15:21:44 2021 +0200 s390/mm,pageattr: fix walk_pte_level() early exit In case of splitting to 4k mapping the early exit in walk_pte_level() must only be taken iff flags is equal to SET_MEMORY_4K. Currently the early exit is taken if the flag is set, and also others might be set. This may lead to the situation that a mapping is split but other changes are not done, like e.g. setting pages to R/W. There is currently no such caller, but there might be in the future. Fixes: b3e1a00c8fa4 ("s390/mm: implement set_memory_4k()") Signed-off-by: Heiko Carstens commit 8b5f08b484bd948e1bedcd5a637a4f7609f1c7c1 Author: Heiko Carstens Date: Tue Aug 24 14:15:50 2021 +0200 s390: fix typo in linker script Rename amod31 to amode31 like it was supposed to be. Fixes: c78d0c7484f0 ("s390: rename dma section to amode31") Signed-off-by: Heiko Carstens commit 28be5743c6306b3070012c00ca2ff2bff5c02258 Author: Sven Schnelle Date: Mon Aug 23 21:20:36 2021 +0200 s390: remove do_signal() prototype and do_notify_resume() function Both are no longer used since the conversion to generic entry, therefore remove them. Fixes: 56e62a737028 ("s390: convert to generic entry") Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 0c1abe7c28902067bad2865a582c461f57dccd61 Author: Randy Dunlap Date: Thu Aug 5 22:01:49 2021 -0700 s390/crypto: fix all kernel-doc warnings in vfio_ap_ops.c The 0day bot reported some kernel-doc warnings in this file so clean up all of the kernel-doc and use proper kernel-doc formatting. There are no more kernel-doc errors or warnings reported in this file. Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Jason Gunthorpe Cc: Tony Krowiak Cc: Halil Pasic Cc: Jason Herne Cc: Harald Freudenberger Cc: linux-s390@vger.kernel.org Reviewed-by: Tony Krowiak Link: https://lore.kernel.org/r/20210806050149.9614-1-rdunlap@infradead.org Signed-off-by: Heiko Carstens commit 1f3f76812d5dfc791193b39c2140a8bd09962c0e Author: Niklas Schnelle Date: Fri Jul 16 11:53:37 2021 +0200 s390/pci: improve DMA translation init and exit Currently zpci_dma_init_device()/zpci_dma_exit_device() is called as part of zpci_enable_device()/zpci_disable_device() and errors for zpci_dma_exit_device() are always ignored even if we could abort. Improve upon this by moving zpci_dma_exit_device() out of zpci_disable_device() and check for errors whenever we have a way to abort the current operation. Note that for example in zpci_event_hard_deconfigured() the device is expected to be gone so we really can't abort and proceed even in case of error. Similarly move the cc == 3 special case out of zpci_unregister_ioat() and into the callers allowing to abort when finding an already disabled devices precludes proceeding with the operation. While we are at it log IOAT register/unregister errors in the s390 debugfs log, Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit cc049eecfb7adc4bfecd05eb25e425d8def96fce Author: Niklas Schnelle Date: Thu Jul 22 11:44:08 2021 +0200 s390/pci: simplify CLP List PCI handling Currently clp_get_state() and clp_refresh_fh() awkwardly use the clp_list_pci() callback mechanism to find the entry for a specific FID and update its zdev, respectively return its state. This is both needlessly complex and means we are always going through the entire PCI function list even if the FID has already been found. Instead lets introduce a clp_find_pci() function to find a specific entry and share the CLP List PCI request handling code with clp_list_pci(). With that in place we can also easily make the function handle a simple out parameter instead of directly altering the zdev allowing easier access to the updated function handle by the caller. Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 8256adda1f44ea1ec763711aefcd25f8c0cf93f3 Author: Niklas Schnelle Date: Thu Jul 22 12:38:29 2021 +0200 s390/pci: handle FH state mismatch only on disable Instead of always treating CLP_RC_SETPCIFN_ALRDY as success and blindly updating the function handle restrict this special handling to the disable case by moving it into zpci_disable_device() and still treating it as an error while also updating the function handle such that a subsequent zpci_disable_device() succeeds or the caller can ignore the error when aborting is not an option such as for zPCI event 0x304. Also print this occurrence to the log such that an admin can tell why a disable operation returned an error. A mismatch between the state of the underlying device and our view of it can naturally happen when the device suddenly enters the error state but we haven't gotten the error notification yet, it must not happen on enable though. Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit f7addcdd527a6dddfebe20c358b87bdb95624612 Author: Niklas Schnelle Date: Wed Jul 21 19:58:54 2021 +0200 s390/pci: fix misleading rc in clp_set_pci_fn() Currently clp_set_pci_fn() always returns 0 as long as the CLP request itself succeeds even if the operation itself returns a response code other than CLP_RC_OK or CLP_RC_SETPCIFN_ALRDY. This is highly misleading because calling code assumes that a zero rc means that the operation was successful. Fix this by returning the response code or cc on failure with the exception of the special handling for CLP_RC_SETPCIFN_ALRDY. Also let's not assume that the returned function handle for CLP_RC_SETPCIFN_ALRDY is 0, we don't need it anyway. Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit e8f06683d40e705da2d85bc6bc498e651d1ef31b Author: Alexander Gordeev Date: Fri Aug 6 12:55:09 2021 +0200 s390/boot: factor out offset_vmlinux_info() function Move offsetting all of vmlinux_info fields to a separate function for better readability. Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit ddd63c85ef67ea9ea7282ad35eafb6568047126e Author: Alexander Gordeev Date: Fri Aug 6 12:55:08 2021 +0200 s390/kasan: fix large PMD pages address alignment check It is currently possible to initialize a large PMD page when the address is not aligned on page boundary. Signed-off-by: Alexander Gordeev Reviewed-by: Vasily Gorbik Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit c42257d64079f41af5debcba9dcd15dad3b2969e Author: Julian Wiedmann Date: Mon Jun 7 11:18:45 2021 +0200 s390/zcrypt: remove gratuitious NULL check in .remove() callbacks As .remove() is only called after a successful .probe() call, we can trust that the drvdata is valid. Signed-off-by: Julian Wiedmann Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit b5adbbf896d8375a1054ac56ac23194ac483ae96 Author: Julian Wiedmann Date: Mon Jun 7 11:18:44 2021 +0200 s390/ap: use the common driver-data pointer The device struct provides a pointer for driver-private data. Use this in the zcrypt drivers (as vfio_ap already does), and then remove the custom pointer from the AP device structs. As really_probe() will always clear the drvdata pointer on error, we no longer have to do so ourselves. Signed-off-by: Julian Wiedmann Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit c8c68c5fca47add52f7830a4e791434e98ba69c7 Author: Julian Wiedmann Date: Mon Jun 7 11:18:43 2021 +0200 s390/ap: use the common device_driver pointer The device struct itself already contains a pointer to its driver. Use this consistently, instead of duplicating it. Signed-off-by: Julian Wiedmann Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit 81a076171e72dcb6545a8a508b800aec59d6e82b Author: Niklas Schnelle Date: Fri Aug 6 12:12:11 2021 +0200 s390/pci: reset zdev->zbus on registration failure On failure to register a struct zpci_dev with a struct zpci_bus we left a dangling pointer in zdev->zbus. As zpci_create_device() bails if zpci_bus_device_register() fails this is of no consequence but still bad practice. Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 02368b7cf6c7badefa13741aed7a8b91d9a11b19 Author: Niklas Schnelle Date: Fri Aug 6 10:28:40 2021 +0200 s390/pci: cleanup resources only if necessary It's currently safe to call zpci_cleanup_bus_resources() even if the resources were never created but it makes no sense so check zdev->has_resources before we call zpci_cleanup_bus_resources() in zpci_release_device(). Reviewed-by: Matthew Rosato Acked-by: Pierre Morel Signed-off-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 315511166469a641c1b838eaca6bdd3af5c362c4 Author: Masahiro Yamada Date: Thu Aug 12 01:45:18 2021 +0900 microblaze: move core-y in arch/microblaze/Makefile to arch/microblaze/Kbuild Use obj-y to clean up Makefile. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20210811164518.187497-1-masahiroy@kernel.org Signed-off-by: Michal Simek commit 0c8fb653d487d2873f5eefdcaf4cecff4e103828 Author: Nicholas Piggin Date: Thu Aug 12 02:00:44 2021 +1000 powerpc/64s: Remove WORT SPR from POWER9/10 This register is not architected and not implemented in POWER9 or 10, it just reads back zeroes for compatibility. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/r/20210811160134.904987-11-npiggin@gmail.com commit 1782663897945a5cf28e564ba5eed730098e9aa4 Author: Nicholas Piggin Date: Thu Aug 12 02:00:43 2021 +1000 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live After the L1 saves its PMU SPRs but before loading the L2's PMU SPRs, switch the pmcregs_in_use field in the L1 lppaca to the value advertised by the L2 in its VPA. On the way out of the L2, set it back after saving the L2 PMU registers (if they were in-use). This transfers the PMU liveness indication between the L1 and L2 at the points where the registers are not live. This fixes the nested HV bug for which a workaround was added to the L0 HV by commit 63279eeb7f93a ("KVM: PPC: Book3S HV: Always save guest pmu for guest capable of nesting"), which explains the problem in detail. That workaround is no longer required for guests that include this bug fix. Fixes: 360cae313702 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/r/20210811160134.904987-10-npiggin@gmail.com commit f2e29db156523bf08a0524e0f4306a641912c6d9 Author: Fabiano Rosas Date: Thu Aug 12 02:00:42 2021 +1000 KVM: PPC: Book3S HV Nested: save_hv_return_state does not require trap argument vcpu is already anargument so vcpu->arch.trap can be used directly. Signed-off-by: Fabiano Rosas Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-9-npiggin@gmail.com commit 7c3ded5735141ff4d049747c9f76672a8b737c49 Author: Fabiano Rosas Date: Thu Aug 12 02:00:41 2021 +1000 KVM: PPC: Book3S HV Nested: Stop forwarding all HFUs to L1 If the nested hypervisor has no access to a facility because it has been disabled by the host, it should also not be able to see the Hypervisor Facility Unavailable that arises from one of its guests trying to access the facility. This patch turns a HFU that happened in L2 into a Hypervisor Emulation Assistance interrupt and forwards it to L1 for handling. The ones that happened because L1 explicitly disabled the facility for L2 are still let through, along with the corresponding Cause bits in the HFSCR. Signed-off-by: Fabiano Rosas [np: move handling into kvmppc_handle_nested_exit] Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-8-npiggin@gmail.com commit 8b210a880b35ba75eb42b79dfd65e369c1feb119 Author: Nicholas Piggin Date: Thu Aug 12 02:00:40 2021 +1000 KVM: PPC: Book3S HV Nested: Make nested HFSCR state accessible When the L0 runs a nested L2, there are several permutations of HFSCR that can be relevant. The HFSCR that the L1 vcpu L1 requested, the HFSCR that the L1 vcpu may use, and the HFSCR that is actually being used to run the L2. The L1 requested HFSCR is not accessible outside the nested hcall handler, so copy that into a new kvm_nested_guest.hfscr field. The permitted HFSCR is taken from the HFSCR that the L1 runs with, which is also not accessible while the hcall is being made. Move this into a new kvm_vcpu_arch.hfscr_permitted field. These will be used by the next patch to improve facility handling for nested guests, and later by facility demand faulting patches. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-7-npiggin@gmail.com commit 7487cabc7ed2f7716bf304e4e97c57fd995cf70e Author: Fabiano Rosas Date: Thu Aug 12 02:00:39 2021 +1000 KVM: PPC: Book3S HV Nested: Sanitise vcpu registers As one of the arguments of the H_ENTER_NESTED hypercall, the nested hypervisor (L1) prepares a structure containing the values of various hypervisor-privileged registers with which it wants the nested guest (L2) to run. Since the nested HV runs in supervisor mode it needs the host to write to these registers. To stop a nested HV manipulating this mechanism and using a nested guest as a proxy to access a facility that has been made unavailable to it, we have a routine that sanitises the values of the HV registers before copying them into the nested guest's vcpu struct. However, when coming out of the guest the values are copied as they were back into L1 memory, which means that any sanitisation we did during guest entry will be exposed to L1 after H_ENTER_NESTED returns. This patch alters this sanitisation to have effect on the vcpu->arch registers directly before entering and after exiting the guest, leaving the structure that is copied back into L1 unchanged (except when we really want L1 to access the value, e.g the Cause bits of HFSCR). Signed-off-by: Fabiano Rosas Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Reviewed-by: Nicholas Piggin Link: https://lore.kernel.org/r/20210811160134.904987-6-npiggin@gmail.com commit d82b392d9b3556b63e3f9916cf057ea847e173a9 Author: Nicholas Piggin Date: Thu Aug 12 02:00:38 2021 +1000 KVM: PPC: Book3S HV Nested: Fix TM softpatch HFAC interrupt emulation Have the TM softpatch emulation code set up the HFAC interrupt and return -1 in case an instruction was executed with HFSCR bits clear, and have the interrupt exit handler fall through to the HFAC handler. When the L0 is running a nested guest, this ensures the HFAC interrupt is correctly passed up to the L1. The "direct guest" exit handler will turn these into PROGILL program interrupts so functionality in practice will be unchanged. But it's possible an L1 would want to handle these in a different way. Also rearrange the FAC interrupt emulation code to match the HFAC format while here (mainly, adding the FSCR_INTR_CAUSE mask). Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-5-npiggin@gmail.com commit 4782e0cd0d184d727ad3b0cfe20d1d44d9f98239 Author: Nicholas Piggin Date: Thu Aug 12 02:00:37 2021 +1000 KVM: PPC: Book3S HV P9: Fixes for TM softpatch interrupt NIP The softpatch interrupt sets HSRR0 to the faulting instruction +4, so it should subtract 4 for the faulting instruction address in the case it is a TM softpatch interrupt (the instruction was not executed) and it was not emulated. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-4-npiggin@gmail.com commit daac40e8d7a63ab8608132a7cfce411986feac32 Author: Nicholas Piggin Date: Thu Aug 12 02:00:36 2021 +1000 KVM: PPC: Book3S HV: Remove TM emulation from POWER7/8 path TM fake-suspend emulation is only used by POWER9. Remove it from the old code path. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-3-npiggin@gmail.com commit fd42b7b09c602c904452c0c3e5955ca21d8e387a Author: Nicholas Piggin Date: Thu Aug 12 02:00:35 2021 +1000 KVM: PPC: Book3S HV: Initialise vcpu MSR with MSR_ME It is possible to create a VCPU without setting the MSR before running it, which results in a warning in kvmhv_vcpu_entry_p9() that MSR_ME is not set. This is pretty harmless because the MSR_ME bit is added to HSRR1 before HRFID to guest, and a normal qemu guest doesn't hit it. Initialise the vcpu MSR with MSR_ME set. Reported-by: Alexey Kardashevskiy Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20210811160134.904987-2-npiggin@gmail.com commit cbe8cd7d83e251bff134a57ea4b6378db992ad82 Author: Tang Bin Date: Mon Aug 23 22:10:33 2021 +0800 can: mscan: mpc5xxx_can: mpc5xxx_can_probe(): remove useless BUG_ON() In the function mpc5xxx_can_probe(), the variable 'data' has already been determined in the above code, so the BUG_ON() in this place is useless, remove it. Link: https://lore.kernel.org/r/20210823141033.17876-1-tangbin@cmss.chinamobile.com Signed-off-by: Tang Bin Signed-off-by: Marc Kleine-Budde commit a4583c1deb1b6e574ec0f4095d5a44d7160353f1 Author: Tang Bin Date: Mon Aug 23 19:33:38 2021 +0800 can: mscan: mpc5xxx_can: mpc5xxx_can_probe(): use of_device_get_match_data to simplify code Retrieve OF match data, it's better and cleaner to use 'of_device_get_match_data' over 'of_match_device'. Link: https://lore.kernel.org/r/20210823113338.3568-4-tangbin@cmss.chinamobile.com Signed-off-by: Tang Bin Signed-off-by: Marc Kleine-Budde commit 1d38ec4974143827631d44a6a2a4c069fc4c05bd Author: Lad Prabhakar Date: Fri Aug 20 17:14:49 2021 +0100 can: rcar_canfd: rcar_canfd_handle_channel_tx(): fix redundant assignment Fix redundant assignment of 'priv' to itself in rcar_canfd_handle_channel_tx(). Fixes: 76e9353a80e9 ("can: rcar_canfd: Add support for RZ/G2L family") Link: https://lore.kernel.org/r/20210820161449.18169-1-prabhakar.mahadev-lad.rj@bp.renesas.com Reported-by: kernel test robot Signed-off-by: Lad Prabhakar Signed-off-by: Marc Kleine-Budde commit ac4224087312d7212bd3411f1e393f4b7cb1ff15 Author: Cai Huoqing Date: Wed Aug 25 14:23:41 2021 +0800 can: rcar: Kconfig: Add helper dependency on COMPILE_TEST it's helpful for complie test in other platform(e.g.X86) Link: https://lore.kernel.org/r/20210825062341.2332-1-caihuoqing@baidu.com Signed-off-by: Cai Huoqing Signed-off-by: Marc Kleine-Budde commit c42dd069be8dfc9b2239a5c89e73bbd08ab35de0 Author: Sishuai Gong Date: Wed Aug 25 07:52:20 2021 +0200 configfs: fix a race in configfs_lookup() When configfs_lookup() is executing list_for_each_entry(), it is possible that configfs_dir_lseek() is calling list_del(). Some unfortunate interleavings of them can cause a kernel NULL pointer dereference error Thread 1 Thread 2 //configfs_dir_lseek() //configfs_lookup() list_del(&cursor->s_sibling); list_for_each_entry(sd, ...) Fix this by grabbing configfs_dirent_lock in configfs_lookup() while iterating ->s_children. Signed-off-by: Sishuai Gong Signed-off-by: Christoph Hellwig commit d07f132a225c013e59aa77f514ad9211ecab82ee Author: Christoph Hellwig Date: Wed Aug 25 07:50:32 2021 +0200 configfs: fold configfs_attach_attr into configfs_lookup This makes it more clear what gets added to the dcache and prepares for an additional locking fix. Signed-off-by: Christoph Hellwig commit 899587c8d0908e5124fd074d52bf05b4b0633a79 Author: Christoph Hellwig Date: Wed Aug 25 07:43:55 2021 +0200 configfs: simplify the configfs_dirent_is_ready Return the error directly instead of using a goto. Signed-off-by: Christoph Hellwig commit 417b962ddeca2b70eb72d28c87541bdad4e234f8 Author: Christoph Hellwig Date: Wed Aug 25 07:42:44 2021 +0200 configfs: return -ENAMETOOLONG earlier in configfs_lookup Just like most other file systems: get the simple checks out of the way first. Signed-off-by: Christoph Hellwig commit fde9c59aebafb91caeed816cc510b56f14aa63ae Author: Saleem Abdulrasool Date: Wed Aug 4 17:32:14 2021 +0000 riscv: explicitly use symbol offsets for VDSO The current implementation of the `__rt_sigaction` reference computed an absolute offset relative to the mapped base of the VDSO. While this can be handled in the medlow model, the medany model cannot handle this as it is meant to be position independent. The current implementation relied on the BFD linker relaxing the PC-relative relocation into an absolute relocation as it was a near-zero address allowing it to be referenced relative to `zero`. We now extract the offsets and create a generated header allowing the build with LLVM and lld to succeed as we no longer depend on the linker rewriting address references near zero. This change was largely modelled after the ARM64 target which does something similar. Signed-off-by: Saleem Abdulrasool Tested-by: Nathan Chancellor Signed-off-by: Palmer Dabbelt commit 32e19d12fc7c0bd027b3e657e790f986ac80d837 Merge: 0bffa153a2f46 e9e3d5f9e34c0 Author: Steve French Date: Tue Aug 24 23:39:46 2021 -0500 Merge pull request #69 from namjaejeon/cifsd-for-next ksmbd-fixes commit e9e3d5f9e34c00b57dbec0d422cf2ad7318c0155 Author: Namjae Jeon Date: Wed Aug 25 09:57:09 2021 +0900 MAINTAINERS: ksmbd: add cifs_common directory to ksmbd entry The codes that shared between cifs and ksmbd will move into the cifs_common directory. This patch add it to the ksmbd entry in the MAINTAINERS file. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 1923b544bf6094f7c3a86692de8a026b9d52efc1 Author: Namjae Jeon Date: Wed Aug 25 09:42:22 2021 +0900 MAINTAINERS: ksmbd: update my email address My email address in ksmbd entry will be not available in a few days. Update it to my own kernel.org address. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 8341dcfbd8dda98a3b2836a421016f7d88e35b1c Author: Jisheng Zhang Date: Thu Aug 5 00:30:59 2021 +0800 riscv: Enable Undefined Behavior Sanitizer UBSAN Select ARCH_HAS_UBSAN_SANITIZE_ALL in order to allow the user to enable CONFIG_UBSAN_SANITIZE_ALL and instrument the entire kernel for ubsan checks. VDSO is excluded because its build doesn't include the __ubsan_handle_*() functions from lib/ubsan.c, and the VDSO has no sane way to report errors even if it has definitions of these functions. Passed lib/test_ubsan.c test. Signed-off-by: Jisheng Zhang Signed-off-by: Palmer Dabbelt commit 7f85b04b08ca264923358e2c4e93422bad59a6e0 Author: Jisheng Zhang Date: Thu Aug 5 00:29:08 2021 +0800 riscv: Keep the riscv Kconfig selects sorted Move three Kconfig selects: ARCH_STACKWALK, ARCH_SUPPORTS_ATOMIC_RMW and ARCH_SUPPORTS_DEBUG_PAGEALLOC to the right place. Signed-off-by: Jisheng Zhang Signed-off-by: Palmer Dabbelt commit 9401f4e46cf6965e23738f70e149172344a01eef Author: Christophe Leroy Date: Tue Mar 2 08:48:11 2021 +0000 powerpc: Use lwarx/ldarx directly instead of PPC_LWARX/LDARX macros Force the eh flag at 0 on PPC32. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1fc81f07cabebb875b963e295408cc3dd38c8d85.1614674882.git.christophe.leroy@csgroup.eu commit 19e932eb6ea47f4f37513eb2ae0daee19117765c Author: Christophe Leroy Date: Tue Aug 17 16:00:14 2021 +0000 powerpc/ptrace: Make user_mode() common to PPC32 and PPC64 Today we have: #ifdef __powerpc64__ #define user_mode(regs) ((((regs)->msr) >> MSR_PR_LG) & 0x1) #else #define user_mode(regs) (((regs)->msr & MSR_PR) != 0) #endif With ppc64_defconfig, we get: if (!user_mode(regs)) 14b4: e9 3e 01 08 ld r9,264(r30) 14b8: 71 29 40 00 andi. r9,r9,16384 14bc: 41 82 07 a4 beq 1c60 <.emulate_instruction+0x7d0> If taking the ppc32 definition of user_mode(), the exact same code is generated for ppc64_defconfig. So, only keep one version of user_mode(), preferably the one not using MSR_PR_LG which should be kept internal to reg.h. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/000a28c51808bbd802b505af42d2cb316c2be7d3.1629216000.git.christophe.leroy@csgroup.eu commit 316389e904f968d24d44cd96a6d171ee1ef269cf Author: Christophe Leroy Date: Fri Jun 25 10:58:33 2021 +0000 powerpc/syscalls: Simplify do_mmap2() When shift is nul, operations remain valid so no test needed. And 'ret' is unnecessary. And use IS_ALIGNED() to check alignment, that's more clear. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/373ec500f386374bc5735007df3d3869eac47be1.1624618701.git.christophe.leroy@csgroup.eu commit e084728393a58e7fdafeee2e6b20e0faff09b557 Author: Christophe Leroy Date: Thu Jul 8 16:49:43 2021 +0000 powerpc/ptdump: Convert powerpc to GENERIC_PTDUMP This patch converts powerpc to the generic PTDUMP implementation. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/03166d569526be70214fe9370a7bad219d2f41c8.1625762907.git.christophe.leroy@csgroup.eu commit cf98d2b6eea6a1b2c43f85680ad58fcc3ea9496b Author: Christophe Leroy Date: Thu Jul 8 16:49:42 2021 +0000 powerpc/ptdump: Reduce level numbers by 1 in note_page() and add p4d level Do the same as commit f8f0d0b6fa20 ("mm: ptdump: reduce level numbers by 1 in note_page()") and add missing p4d level. This will align powerpc to the users of generic ptdump. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d76495c574132b197b445a1f133755cca4b912a4.1625762906.git.christophe.leroy@csgroup.eu commit 64b87b0c70e0fd28352895cba3c0a9631e0072dd Author: Christophe Leroy Date: Thu Jul 8 16:49:41 2021 +0000 powerpc/ptdump: Remove unused 'page_size' parameter note_page_update_state() doesn't use page_size. Remove it. Could also be removed to note_page() but as a following patch will remove all current users of note_page(), just leave it as is for now. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e2f80d052001155251bfe009c360d0c5d9242c6b.1625762906.git.christophe.leroy@csgroup.eu commit 11f27a7fa4ca27935de74e3eb052bdc430d5f8d8 Author: Christophe Leroy Date: Thu Jul 8 16:49:40 2021 +0000 powerpc/ptdump: Use DEFINE_SHOW_ATTRIBUTE() Use DEFINE_SHOW_ATTRIBUTE() instead of open coding open() and fops. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b864a92693ca8413ef0b19f0c12065c212899b6e.1625762905.git.christophe.leroy@csgroup.eu commit 33e1402435cb9f3021439a15935ea2dc69ec1844 Author: Christophe Leroy Date: Tue Aug 24 07:56:35 2021 +0000 powerpc: Avoid link stack corruption in misc asm functions bl;mflr is used at several places to get code position. Use bcl 20,31,+4 instead of bl in order to preserve link stack. See commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption in __get_datapage()") for details. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c6eabb4fb6c156f75d56dcbcc6f243e5ac0fba42.1629791763.git.christophe.leroy@csgroup.eu commit f5007dbf4da729baa850b33a64dc3cc53757bdf8 Author: Christophe Leroy Date: Tue Aug 24 07:56:26 2021 +0000 powerpc/booke: Avoid link stack corruption in several places Use bcl 20,31,+4 instead of bl in order to preserve link stack. See commit c974809a26a1 ("powerpc/vdso: Avoid link stack corruption in __get_datapage()") for details. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/e9fbc285eceb720e6c0e032ef47fe8b05f669b48.1629791751.git.christophe.leroy@csgroup.eu commit 113ec9ccc8049c3772f0eab46b62c5d6654c09f7 Author: Christophe Leroy Date: Fri Aug 20 05:16:05 2021 +0000 powerpc/32: indirect function call use bctrl rather than blrl in ret_from_kernel_thread Copied from commit 89bbe4c798bc ("powerpc/64: indirect function call use bctrl rather than blrl in ret_from_kernel_thread") blrl is not recommended to use as an indirect function call, as it may corrupt the link stack predictor. This is not a performance critical path but this should be fixed for consistency. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/91b1d242525307ceceec7ef6e832bfbacdd4501b.1629436472.git.christophe.leroy@csgroup.eu commit 9b5ac8ab4e8bf5636d1d425aee68ddf45af12057 Author: Adrian Hunter Date: Tue Aug 24 14:41:50 2021 +0300 scsi: ufs: Fix ufshcd_request_sense_async() for Samsung KLUFG8RHDA-B2D1 Samsung KLUFG8RHDA-B2D1 does not clear the unit attention condition if the length is zero. So go back to requesting all the sense data, as it was before patch "scsi: ufs: Request sense data asynchronously". That is simpler than creating and maintaining a quirk for affected devices. Link: https://lore.kernel.org/r/20210824114150.2105-1-adrian.hunter@intel.com Signed-off-by: Adrian Hunter Signed-off-by: Martin K. Petersen commit 313bf281f2091552f509fd05a74172c70ce7572f Author: Alim Akhtar Date: Thu Aug 19 22:41:31 2021 +0530 scsi: ufs: ufs-exynos: Fix static checker warning clk_get_rate() returns unsigned long and currently this driver stores the return value in u32 type, resulting the below warning: Fixed smatch warnings: drivers/scsi/ufs/ufs-exynos.c:286 exynos_ufs_get_clk_info() warn: wrong type for 'ufs->mclk_rate' (should be 'ulong') drivers/scsi/ufs/ufs-exynos.c:287 exynos_ufs_get_clk_info() warn: wrong type for 'pclk_rate' (should be 'ulong') Link: https://lore.kernel.org/r/20210819171131.55912-1-alim.akhtar@samsung.com Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs") Reported-by: Dan Carpenter Signed-off-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit b3e2c72af1d553a646c86bbb4c0be278686a295a Author: Martin K. Petersen Date: Mon Aug 16 22:50:13 2021 -0400 scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI Use the SCSI midlayer interfaces to query protection interval, reference tag, and per-command DIX flags. Link: https://lore.kernel.org/r/20210817025014.12085-2-martin.petersen@oracle.com Cc: Sreekanth Reddy Cc: Kashyap Desai Signed-off-by: Martin K. Petersen commit 125c12f71783a2aa394f6e16a5de3424ad4f7dfb Author: Martin K. Petersen Date: Mon Aug 16 22:50:14 2021 -0400 scsi: lpfc: Use the proper SCSI midlayer interfaces for PI Use the SCSI midlayer interfaces to query protection interval, reference tag, per-command DIX flags, and logical block count. Link: https://lore.kernel.org/r/20210817025014.12085-3-martin.petersen@oracle.com CC: James Smart CC: Dick Kennedy Reviewed-by: James Smart Signed-off-by: Martin K. Petersen commit 9eb636b639b43dc17fd4081359403ab2af8f4046 Author: James Smart Date: Mon Aug 16 09:29:01 2021 -0700 scsi: lpfc: Copyright updates for 14.0.0.1 patches Update copyrights to 2021 for files modified in the 14.0.0.1 patch set. Link: https://lore.kernel.org/r/20210816162901.121235-17-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 2dbf7cde53bec4f4d197b9d9af6f0fd6c37e5959 Author: James Smart Date: Mon Aug 16 09:29:00 2021 -0700 scsi: lpfc: Update lpfc version to 14.0.0.1 Update lpfc version to 14.0.0.1 Link: https://lore.kernel.org/r/20210816162901.121235-16-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit acbaa8c8ed17e768dab3f09f457fd265d7c94848 Author: James Smart Date: Mon Aug 16 09:28:59 2021 -0700 scsi: lpfc: Add bsg support for retrieving adapter cmf data Add a bsg ioctl to allow user applications to retrieve the adapter congestion management framework buffer. Link: https://lore.kernel.org/r/20210816162901.121235-15-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 74a7baa2a3ee8be200ea5421fe025d5eb8621a6a Author: James Smart Date: Mon Aug 16 09:28:58 2021 -0700 scsi: lpfc: Add cmf_info sysfs entry Allow abbreviated cm framework status information to be obtained via sysfs. Link: https://lore.kernel.org/r/20210816162901.121235-14-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 9f77870870d8cd42407a6df7bdc1347c8c9536ed Author: James Smart Date: Mon Aug 16 09:28:57 2021 -0700 scsi: lpfc: Add debugfs support for cm framework buffers Add support via debugfs to report the cm statistics, cm enablement, and rx monitor information. Link: https://lore.kernel.org/r/20210816162901.121235-13-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 7481811c3ac39498636acdbcc4cab74ae2a1ffe5 Author: James Smart Date: Mon Aug 16 09:28:56 2021 -0700 scsi: lpfc: Add support for maintaining the cm statistics buffer Add the logic to move the congestion management and event information into the cmd statistics buffer maintained for the adapter. The update includes rolling up values for the last minute, hour, and day information. Link: https://lore.kernel.org/r/20210816162901.121235-12-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 17b27ac5922454ff7de91cbed458643608c36abc Author: James Smart Date: Mon Aug 16 09:28:55 2021 -0700 scsi: lpfc: Add rx monitoring statistics The driver provides overwatch of the cm behavior by maintaining a set of rx I/O statistics. This information is also used in later updating of the cm statistics buffer. Link: https://lore.kernel.org/r/20210816162901.121235-11-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 02243836ad6f384284f10302e6b820b893960d1c Author: James Smart Date: Mon Aug 16 09:28:54 2021 -0700 scsi: lpfc: Add support for the CM framework Complete the enablement of the cm framework feature in the adapter. Perform the following: - Detect the presence of the congestion management framework feature. When the cm framework is present: - Issue the SET_FEATURE command to enable the feature. - Register the cm statistics buffer with the adapter. - Read the cm enablement buffer to determine the cm framework state for cm management. When cm management is enabled: - Monitor all FPIN and congestion signalling events, incrementing counters. - Regularly sync with the adapter to communicate congestion events and to receive an rx request limit. - Monitor requests for rx data and ensure that no more than the adapter prescribed limit is issued on the link. If the limit is exceeded, SCSI and/or NVMe traffic is temporarily suspended. - Maintain the minute, hourly, daily statistics buffer. - Monitor for congestion enablement change events, causing a reread of the enablement buffer and acting on any change in enablement. And: - Add teardown logic, including buffer deregistration, on adapter detachment or reset. Link: https://lore.kernel.org/r/20210816162901.121235-10-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit daebf93fc3a5d12b3bc928aebb168c68e754dda2 Author: James Smart Date: Mon Aug 16 09:28:53 2021 -0700 scsi: lpfc: Add cmfsync WQE support When congestion mgmt is enabled, cmf has the driver regularly issue a command to synchronize reporting of congestion mgmt events such as fpin and signal delivery. This patch adds the definition of the CMF_SYNC WQE and its CQE fields as well as support for issuing the command. The patch also adds the few remaining cmf-related SLI additions, such as feature definition for enablement of CMF and notifications to the driver if the cm enablement mode changes. Link: https://lore.kernel.org/r/20210816162901.121235-9-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 72df8a452883b0be334396acba07df77c3c3f6c7 Author: James Smart Date: Mon Aug 16 09:28:52 2021 -0700 scsi: lpfc: Add support for cm enablement buffer As part of the cmf framework, the firmware maintains a table with congestion related state information, specifically whether enabled and if enabled, whether monitoring or actively managing congestion. Add definition of the table and add support to read the table from the adapter and determine if it is enabled. In support of this, the READ_OBJECT mailbox command definition is added to the driver. Link: https://lore.kernel.org/r/20210816162901.121235-8-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 8c42a65c391732254d4da66aac6c6f9ed1a290ae Author: James Smart Date: Mon Aug 16 09:28:51 2021 -0700 scsi: lpfc: Add cm statistics buffer support The cmf framework requires the driver to maintain a cm statistics table, accessible inband, of congestion related statistics that are reported per minute, rolled up to per hour, and rolled up again per day. Several days worth may be maintained. The table is registered with the adapter when the MIB feature is enabled. Add definition of the table and add support to register the table with the adapter. Includes definition and initialization of event counters that are later added to the statistics table. Link: https://lore.kernel.org/r/20210816162901.121235-7-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 9064aeb2df8e8185f649afa4600edcd8f6a9f6fd Author: James Smart Date: Mon Aug 16 09:28:50 2021 -0700 scsi: lpfc: Add EDC ELS support When congestion management is enabled, issue EDC ELS to register congestion signaling capabilities with the fabric. The response handling will process the fabric parameters and set the reporting parameters. Similarly, add support for receiving an EDC request from the fabric generating a corresponding response. Implement handlers for congestion signals from the fabric and maintain statistics for them. Link: https://lore.kernel.org/r/20210816162901.121235-6-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 428569e66fa7ef4a41fbea9fa80f559914a74667 Author: James Smart Date: Mon Aug 16 09:28:49 2021 -0700 scsi: lpfc: Expand FPIN and RDF receive logging Expand FPIN logging: - Display Attached Port Names for Link Integrity and Peer Congestion events - Log Delivery, Peer Congestion, and Congestion events - Sanity check FPIN descriptor lengths when processing FPIN descriptors. Log RDF events when congestion logging is enabled. Link: https://lore.kernel.org/r/20210816162901.121235-5-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit c6a5c747a3f9b035f836ba084416a4336291f276 Author: James Smart Date: Mon Aug 16 09:28:48 2021 -0700 scsi: lpfc: Add MIB feature enablement support MIB support is currently limited to detecting support in the adapter and ensuring FDMI support is enabled if present. For the new framework MIB support also requires active enablement of support via the SET_FEATURES command with the firmware. Rework the MIB detection and enablement for the following: - Move detection away from the get_sli4_parameters routine, and into the hba_setup path. get_sli4_parameters is only called once at attachment while hba_setup is called as part of any SLI port reset path. This ensures detection after firmware download. - Update SET_FEATURES mbx command for the MIB enablement feature and add support for the feature. - Create the cmf_setup routine to encapsulate the detection of MIB support and perform the enablement of the MIB support feature. Link: https://lore.kernel.org/r/20210816162901.121235-4-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 3b0009c8be75bb5e4d5385e500735c07ec104467 Author: James Smart Date: Mon Aug 16 09:28:47 2021 -0700 scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware Implement the SET_HOST_DATA mbox command to set date / time during initialization. It is used by the firmware for various purposes including congestion management and firmware dumps. Link: https://lore.kernel.org/r/20210816162901.121235-3-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 54404d357284d1405d98c424951357d970f41168 Author: James Smart Date: Mon Aug 16 09:28:46 2021 -0700 scsi: fc: Add EDC ELS definition Add Exchange Diagnostic Capabilities (EDC) ELS definition and the following capability descriptors: - Link Fault Capability Descriptor - Congestion Signaling Capability Descriptor Definitions taken from FC-LS-5 r5.01 Link: https://lore.kernel.org/r/20210816162901.121235-2-jsmart2021@gmail.com Signed-off-by: James Smart Signed-off-by: Martin K. Petersen commit 922ad26ebeaa8531f3dec4f38e9e5b6381244b20 Author: Keoseong Park Date: Wed Aug 18 18:41:39 2021 +0900 scsi: ufs: ufshpb: Fix typo in comments Change "allcation" to "allocation". Link: https://lore.kernel.org/r/1891546521.01629282781634.JavaMail.epsvc@epcpadp4 Signed-off-by: Keoseong Park Signed-off-by: Martin K. Petersen commit 0da66348c26ffde19d69ed7770514d202afde222 Author: Kashyap Desai Date: Wed Aug 18 13:47:55 2021 +0530 scsi: mpi3mr: Set up IRQs in resume path Driver is not setting up IRQs in the resume path. As a result, hibernation path is broken and controller will not be operational after system is resumed. Set up IRQs to handle the hibernation case. Link: https://lore.kernel.org/r/20210818081755.1274470-1-kashyap.desai@broadcom.com Cc: sathya.prakash@broadcom.com Cc: thenzl@redhat.com Reported-by: Marco Patalano Tested-by: Marco Patalano Signed-off-by: Kashyap Desai Signed-off-by: Martin K. Petersen commit 04a71cdc46a94b13ee876290ad961b4886e24c76 Author: Halil Pasic Date: Mon Aug 23 15:34:58 2021 +0200 scsi: core: scsi_ioctl: Fix error code propagation in SG_IO Link: https://lore.kernel.org/r/20210823133458.3536824-1-pasic@linux.ibm.com Fixes: f2542a3be327 ("scsi: scsi_ioctl: Move the "block layer" SCSI ioctl handling to drivers/scsi") Reviewed-by: Christoph Hellwig Signed-off-by: Halil Pasic Signed-off-by: Martin K. Petersen commit 6c9783e6296e8c7bf45464c00a52c457b4c321b5 Author: Keoseong Park Date: Mon Aug 23 18:07:14 2021 +0900 scsi: ufs: ufshpb: Fix possible memory leak When HPB pinned region exists and mctx allocation for this region fails, a memory leak is possible because memory is not released for the subregion table of the current region. Free memory for the subregion table of the current region. Link: https://lore.kernel.org/r/1891546521.01629711601304.JavaMail.epsvc@epcpadp3 Reviewed-by: Bart Van Assche Signed-off-by: Keoseong Park Signed-off-by: Martin K. Petersen commit 1259d5f0f5ef1ce39463b9cf3db7a1757acbeb69 Author: Colin Ian King Date: Fri Aug 20 16:18:35 2021 +0100 scsi: snic: Fix spelling mistake 'progres' -> 'progress' There is a spelling mistake in a SNIC_HOST_INFO message. Fix it. Link: https://lore.kernel.org/r/20210820151835.59804-1-colin.king@canonical.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 1c22e327545c3eb4f43db5099fe8f134798d98a9 Author: Hannes Reinecke Date: Fri Aug 20 11:54:05 2021 +0200 scsi: ncr53c8xx: Remove unused code Link: https://lore.kernel.org/r/20210820095405.12801-4-hare@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit f434e4984f5f2ce373902f14b816cc6f4ab809d9 Author: Hannes Reinecke Date: Fri Aug 20 11:54:04 2021 +0200 scsi: ncr53c8xx: Complete all commands during bus reset ncr_reset_bus() will complete all outstanding commands anyway, so there's no need to single out a specific command. Link: https://lore.kernel.org/r/20210820095405.12801-3-hare@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 227a13cf12f9d1a35c40033dd00e5cb87a5db932 Author: Hannes Reinecke Date: Fri Aug 20 11:54:03 2021 +0200 scsi: ncr53c8xx: Remove 'sync_reset' argument from ncr_reset_bus() Always '1', so we can remove it. Link: https://lore.kernel.org/r/20210820095405.12801-2-hare@suse.de Reviewed-by: Christoph Hellwig Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit f38a032b165d812b0ba8378a5cd237c0888ff65f Author: Dave Chinner Date: Tue Aug 24 19:13:04 2021 -0700 xfs: fix I_DONTCACHE Yup, the VFS hoist broke it, and nobody noticed. Bulkstat workloads make it clear that it doesn't work as it should. Fixes: dae2f8ed7992 ("fs: Lift XFS_IDONTCACHE to the VFS layer") Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit a37c5c26693eadb3aa4101d8fe955e40d206b386 Author: Kangmin Park Date: Mon Aug 23 19:21:18 2021 +0900 net: bridge: change return type of br_handle_ingress_vlan_tunnel br_handle_ingress_vlan_tunnel() is only referenced in br_handle_frame(). If br_handle_ingress_vlan_tunnel() is called and return non-zero value, goto drop in br_handle_frame(). But, br_handle_ingress_vlan_tunnel() always return 0. So, the routines that check the return value and goto drop has no meaning. Therefore, change return type of br_handle_ingress_vlan_tunnel() to void and remove if statement of br_handle_frame(). Signed-off-by: Kangmin Park Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20210823102118.17966-1-l4stpr0gr4m@gmail.com Signed-off-by: Jakub Kicinski commit 7844ec21a915cc60f1e2cd8682b943b916a7d2fc Author: Po-Hsu Lin Date: Mon Aug 23 16:58:54 2021 +0800 selftests/net: Use kselftest skip code for skipped tests There are several test cases in the net directory are still using exit 0 or exit 1 when they need to be skipped. Use kselftest framework skip code instead so it can help us to distinguish the return status. Criterion to filter out what should be fixed in net directory: grep -r "exit [01]" -B1 | grep -i skip This change might cause some false-positives if people are running these test scripts directly and only checking their return codes, which will change from 0 to 4. However I think the impact should be small as most of our scripts here are already using this skip code. And there will be no such issue if running them with the kselftest framework. Signed-off-by: Po-Hsu Lin Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://lore.kernel.org/r/20210823085854.40216-1-po-hsu.lin@canonical.com Signed-off-by: Jakub Kicinski commit 79fbd3e1241cea83dded06db2b8bcd5893d877d7 Author: Maor Gottlieb Date: Tue Aug 24 17:25:31 2021 +0300 RDMA: Use the sg_table directly and remove the opencoded version from umem This allows using the normal sg_table APIs and makes all the code cleaner. Remove sgt, nents and nmapd from ib_umem. Link: https://lore.kernel.org/r/20210824142531.3877007-4-maorg@nvidia.com Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 3e302dbc6774a27edaea39a1d5107f0c12e35cf2 Author: Maor Gottlieb Date: Tue Aug 24 17:25:30 2021 +0300 lib/scatterlist: Fix wrong update of orig_nents orig_nents should represent the number of entries with pages, but __sg_alloc_table_from_pages sets orig_nents as the number of total entries in the table. This is wrong when the API is used for dynamic allocation where not all the table entries are mapped with pages. It wasn't observed until now, since RDMA umem who uses this API in the dynamic form doesn't use orig_nents implicit or explicit by the scatterlist APIs. Fix it by changing the append API to track the SG append table state and have an API to free the append table according to the total number of entries in the table. Now all APIs set orig_nents as number of enries with pages. Fixes: 07da1223ec93 ("lib/scatterlist: Add support in dynamic allocation of SG table from pages") Link: https://lore.kernel.org/r/20210824142531.3877007-3-maorg@nvidia.com Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 67d69e9d1a6c889d98951c1d74b19332ce0565af Author: Richard Guy Briggs Date: Mon Aug 23 22:04:09 2021 -0400 audit: move put_tree() to avoid trim_trees refcount underflow and UAF AUDIT_TRIM is expected to be idempotent, but multiple executions resulted in a refcount underflow and use-after-free. git bisect fingered commit fb041bb7c0a9 ("locking/refcount: Consolidate implementations of refcount_t") but this patch with its more thorough checking that wasn't in the x86 assembly code merely exposed a previously existing tree refcount imbalance in the case of tree trimming code that was refactored with prune_one() to remove a tree introduced in commit 8432c7006297 ("audit: Simplify locking around untag_chunk()") Move the put_tree() to cover only the prune_one() case. Passes audit-testsuite and 3 passes of "auditctl -t" with at least one directory watch. Cc: Jan Kara Cc: Will Deacon Cc: Alexander Viro Cc: Seiji Nishikawa Cc: stable@vger.kernel.org Fixes: 8432c7006297 ("audit: Simplify locking around untag_chunk()") Signed-off-by: Richard Guy Briggs Reviewed-by: Jan Kara [PM: reformatted/cleaned-up the commit description] Signed-off-by: Paul Moore commit b261dba2fdb2c2656935a048cdbc6f2d24231e08 Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:06 2021 +0200 arm64: kdump: Remove custom linux,usable-memory-range handling Remove the architecture-specific code for handling the "linux,usable-memory-range" property under the "/chosen" node in DT, as the platform-agnostic FDT core code already takes care of this. Signed-off-by: Geert Uytterhoeven Acked-by: Catalin Marinas Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/7356c531c49a24b4a55577bf8e46d93f4d8ae460.1628670468.git.geert+renesas@glider.be commit 57beb9bd18fca085e6627526d64d68b6080f605c Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:05 2021 +0200 arm64: kdump: Remove custom linux,elfcorehdr handling Remove the architecture-specific code for handling the "linux,elfcorehdr" property under the "/chosen" node in DT, as the platform-agnostic handling in the FDT core code already takes care of this. Signed-off-by: Geert Uytterhoeven Acked-by: Catalin Marinas Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/3b8f801f9b92066855e87f3079fafc153ab20f69.1628670468.git.geert+renesas@glider.be commit 2931ea847dcc54275cda8c39c548b03347d4943b Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:04 2021 +0200 riscv: Remove non-standard linux,elfcorehdr handling RISC-V uses platform-specific code to locate the elf core header in memory. However, this does not conform to the standard "linux,elfcorehdr" DT bindings, as it relies on a reserved memory node with the "linux,elfcorehdr" compatible value, instead of on a "linux,elfcorehdr" property under the "/chosen" node. The non-compliant code can just be removed, as the standard behavior is already implemented by platform-agnostic handling in the FDT core code. Fixes: 5640975003d0234d ("RISC-V: Add crash kernel support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/41c75d6ee3114ae6304f8afe0051895af91200ee.1628670468.git.geert+renesas@glider.be commit bf2e8609734bd773610d414b72eb1cfe09b4c24d Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:03 2021 +0200 of: fdt: Use IS_ENABLED(CONFIG_BLK_DEV_INITRD) instead of #ifdef Replace the conditional compilation using "#ifdef CONFIG_BLK_DEV_INITRD" by a check for "IS_ENABLED(CONFIG_BLK_DEV_INITRD)", to increase compile coverage and to simplify the code. Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/604c13747f09d800da6a7c12f661e1ec146f1dfd.1628670468.git.geert+renesas@glider.be commit 2af2b50acf9b9c38080a45f32a9c162e2a0f2de2 Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:02 2021 +0200 of: fdt: Add generic support for handling usable memory range property Add support for handling the "linux,usable-memory-range" property in the "/chosen" node to the FDT core code. This can co-exist safely with the architecture-specific handling, until the latter has been removed. Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/3bd69bada93ee59b7d23c38b3527fc1654e19343.1628670468.git.geert+renesas@glider.be commit f7e7ce93aac13118281bcef8407b5df1a6b16822 Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:01 2021 +0200 of: fdt: Add generic support for handling elf core headers property There are two methods to specify the location of the elf core headers: using the "elfcorehdr=" kernel parameter, as handled by generic code in kernel/crash_dump.c, or using the "linux,elfcorehdr" property under the "/chosen" node in the Device Tree, as handled by architecture-specific code in arch/arm64/mm/init.c. Extend support for "linux,elfcorehdr" to all platforms supporting DT by adding platform-agnostic handling for handling this property to the FDT core code. This can co-exist safely with the architecture-specific handling, until the latter has been removed. This requires moving the call to of_scan_flat_dt() up, as the code scanning the "/chosen" node now needs to be aware of the values of "#address-cells" and "#size-cells". Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/c7e46e50aaf87ef49bdaa61358d25b122f32b7df.1628670468.git.geert+renesas@glider.be commit 33709413014cd5b8e54d4d9efa07a30ba028e1db Author: Geert Uytterhoeven Date: Wed Aug 11 10:51:00 2021 +0200 crash_dump: Make elfcorehdr address/size symbols always visible Make the forward declarations of elfcorehdr_addr and elfcorehdr_size, and the definitions of ELFCORE_ADDR_MAX and ELFCORE_ADDR_ERR always available, like is done for phys_initrd_start and phys_initrd_size. Code referring to these symbols can then just check for IS_ENABLED(CONFIG_CRASH_DUMP), instead of requiring conditional compilation using an #ifdef, thus preparing to increase compile coverage. Suggested-by: Rob Herring Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/ba965ca613c0cc82c1ec2fe353ee34fb13b36474.1628670468.git.geert+renesas@glider.be commit 0b3813014c865a74b6322a4512de6610abf999b6 Author: Krzysztof Kozlowski Date: Fri Aug 20 17:03:52 2021 +0200 dt-bindings: memory: convert Samsung Exynos DMC to dtschema Convert Samsung Exynos5422 SoC frequency and voltage scaling for Dynamic Memory Controller to DT schema format using json-schema. Signed-off-by: Krzysztof Kozlowski Acked-by: Lukasz Luba Link: https://lore.kernel.org/r/20210820150353.161161-3-krzysztof.kozlowski@canonical.com Signed-off-by: Rob Herring commit c507f1523106c266927813f4da64b8c42e5ea7e0 Author: Krzysztof Kozlowski Date: Fri Aug 20 17:03:51 2021 +0200 dt-bindings: devfreq: event: convert Samsung Exynos PPMU to dtschema Convert Samsung Exynos PPMU bindings to DT schema format using json-schema. The example is quite different due to the nature of dtschema examples parsing (no overriding via-label allowed). New bindings contain copied description from previous bindings document, therefore the license is set as GPL-2.0-only. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210820150353.161161-2-krzysztof.kozlowski@canonical.com Signed-off-by: Rob Herring commit 3bbc8ee7c363a83aa192d796ad37b6bf462a2947 Merge: d7af7e497f030 594a116b2aa19 Author: Alexei Starovoitov Date: Tue Aug 24 14:48:43 2021 -0700 Merge branch 'Improve XDP samples usability and output' Kumar Kartikeya says: ==================== This set revamps XDP samples related to redirection to show better output and implement missing features consolidating all their differences and giving them a consistent look and feel, by implementing common features and command line options. Some of the TODO items like reporting redirect error numbers (ENETDOWN, EINVAL, ENOSPC, etc.) have also been implemented. Some of the features are: * Received packet statistics * xdp_redirect/xdp_redirect_map tracepoint statistics * xdp_redirect_err/xdp_redirect_map_err tracepoint statistics (with support for showing exact errno) * xdp_cpumap_enqueue/xdp_cpumap_kthread tracepoint statistics * xdp_devmap_xmit tracepoint statistics * xdp_exception tracepoint statistics * Per ifindex pair devmap_xmit stats shown dynamically (for xdp_monitor) to decompose the total. * Use of BPF skeleton and BPF static linking to share BPF programs. * Use of vmlinux.h and tp_btf for raw_tracepoint support. * Removal of redundant -N/--native-mode option (enforced by default now) * ... and massive cleanups all over the place. All tracepoints also use raw_tp now, and tracepoints like xdp_redirect are only enabled when requested explicitly to capture successful redirection statistics. The set of programs converted as part of this series are: * xdp_redirect_cpu * xdp_redirect_map_multi * xdp_redirect_map * xdp_redirect * xdp_monitor Explanation of the output: There is now a concise output mode by default that shows primarily four fields: rx/s Number of packets received per second redir/s Number of packets successfully redirected per second err,drop/s Aggregated count of errors per second (including dropped packets) xmit/s Number of packets transmitted on the output device per second Some examples: ; sudo ./xdp_redirect_map veth0 veth1 -s Redirecting from veth0 (ifindex 15; driver veth) to veth1 (ifindex 14; driver veth) veth0->veth1 0 rx/s 0 redir/s 0 err,drop/s 0 xmit/s veth0->veth1 9,998,660 rx/s 9,998,658 redir/s 0 err,drop/s 9,998,654 xmit/s ... There is also a verbose mode, that can also be enabled by default using -v (--verbose). The output mode can be switched dynamically at runtime using Ctrl + \ (SIGQUIT). To make the concise output more useful, the errors that occur are expanded inline (as if verbose mode was enabled) to let the user pin down the source of the problem without having to clutter output (or possibly miss it) or always use verbose mode. For instance, let's consider a case where the output device link state is set to down while redirection is happening: [...] veth0->veth1 24,503,376 rx/s 0 err,drop/s 24,503,372 xmit/s veth0->veth1 25,044,775 rx/s 0 err,drop/s 25,044,783 xmit/s veth0->veth1 25,263,046 rx/s 4 err,drop/s 25,263,028 xmit/s redirect_err 4 error/s ENETDOWN 4 error/s [...] The same holds for xdp_exception actions. An example of how a complete xdp_redirect_map session would look: ; sudo ./xdp_redirect_map veth0 veth1 Redirecting from veth0 (ifindex 5; driver veth) to veth1 (ifindex 4; driver veth) veth0->veth1 7,411,506 rx/s 0 err,drop/s 7,411,470 xmit/s veth0->veth1 8,931,770 rx/s 0 err,drop/s 8,931,771 xmit/s ^\ veth0->veth1 8,787,295 rx/s 0 err,drop/s 8,787,325 xmit/s receive total 8,787,295 pkt/s 0 drop/s 0 error/s cpu:7 8,787,295 pkt/s 0 drop/s 0 error/s redirect_err 0 error/s xdp_exception 0 hit/s xmit veth0->veth1 8,787,325 xmit/s 0 drop/s 0 drv_err/s 2.00 bulk-avg cpu:7 8,787,325 xmit/s 0 drop/s 0 drv_err/s 2.00 bulk-avg veth0->veth1 8,842,610 rx/s 0 err,drop/s 8,842,606 xmit/s receive total 8,842,610 pkt/s 0 drop/s 0 error/s cpu:7 8,842,610 pkt/s 0 drop/s 0 error/s redirect_err 0 error/s xdp_exception 0 hit/s xmit veth0->veth1 8,842,606 xmit/s 0 drop/s 0 drv_err/s 2.00 bulk-avg cpu:7 8,842,606 xmit/s 0 drop/s 0 drv_err/s 2.00 bulk-avg ^C Packets received : 33,973,181 Average packets/s : 4,246,648 Packets transmitted : 33,973,172 Average transmit/s : 4,246,647 The xdp_redirect tracepoint (for success stats) needs to be enabled explicitly using --stats/-s. Documentation for entire output and options is provided when user specifies --help/-h with a sample. Changelog: ---------- v3 -> v4: v3: https://lore.kernel.org/bpf/20210728165552.435050-1-memxor@gmail.com * Address all feedback from Daniel * Use READ_ONCE/WRITE_ONCE from linux/compiler.h (cannot directly include due to conflicts with vmlinux.h) * Fix MAX_CPUS hardcoding by switching to mmapable array maps, that are resized based on the value of libbpf_num_possible_cpus * s/ELEMENTS_OF/ARRAY_SIZE/g * Use tools/include/linux/hashtable.h * Coding style fixes * Remove hyperlinks for tracepoints * Split into smaller reviewable changes * Restore support for specifying custom xdp_redirect_cpu cpumap prog with some enhancements, including built-in programs for common actions (pass, drop, redirect). By default, cpumap prog is now disabled. * Misc bug fixes all over the place The printing stuff is a lot more basic without hyperlink support, hence it has not been exported into a more general facility. v2 -> v3 v2: https://lore.kernel.org/bpf/20210721212833.701342-1-memxor@gmail.com * Address all feedback from Andrii * Replace usage of libbpf hashmap (internal API) with custom one * Rename ATOMIC_* macros to NO_TEAR_* to better reflect their use * Use size_t as a portable word sized data type * Set libbpf_set_strict_mode * Invert conditions in BPF programs to exit early and reduce nesting * Use canonical SEC("xdp") naming for all XDP BPF progams * Add missing help description for cpumap enqueue and kthread tracepoints * Move private struct declarations from xdp_sample_user.h to .c file * Improve help output for cpumap enqueue and cpumap kthread tracepoints * Fix a bug where keys array for BPF_MAP_LOOKUP_BATCH is overallocated * Fix some conditions for printing stats (earlier only checked pps, now pps, drop, err and print if any is greater than zero) * Fix alloc_stats_record to properly return and cleanup allocated memory on allocation failure instead of calling exit(3) * Bump bpf_map_lookup_batch count to 32 to reduce lookup time with multiple devices in map * Fix a bug where devmap_xmit_multi stats are not printed when previous record is missing (i.e. when the first time stats are printed), by simply using a dummy record that is zeroed out * Also print per-CPU counts for devmap_xmit_multi which we collect already * Change mac_map to be BPF_MAP_TYPE_HASH instead of array to prevent resizing to a large size when max_ifindex is high, in xdp_redirect_map_multi * Fix instance of strerror(errno) in sample_install_xdp to use saved errno * Provide a usage function from samples helper * Provide a fix where incorrect stats are shown for parallel sessions of xdp_redirect_* samples by introducing matching support for input device(s), output device(s) and cpumap map id for enqueue and kthread stats. Only xdp_monitor doesn't filter stats, all others do. RFC (v1) -> v2 RFC (v1): https://lore.kernel.org/bpf/20210528235250.2635167-1-memxor@gmail.com * Address all feedback from Andrii * Use BPF static linking * Use vmlinux.h * Use BPF_PROG macro * Use global variables instead of maps * Use of tp_btf for raw_tracepoint progs * Switch to timerfd for polling * Use libbpf hashmap for maintaing device sets for per ifindex pair devmap_xmit stats * Fix Makefile to specify object dependencies properly * Use in-tree bpftool * ... misc fixes and cleanups all over the place ==================== Signed-off-by: Alexei Starovoitov commit 594a116b2aa1985dbb5318c2be39b64b74ebff84 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:10 2021 +0530 samples: bpf: Convert xdp_redirect_map_multi to XDP samples helper Use the libbpf skeleton facility and other utilities provided by XDP samples helper. Also adapt to change of type of mac address map, so that no resizing is required. Add a new flag for sample mask that skips priting the from_device->to_device heading for each line, as xdp_redirect_map_multi may have two devices but the flow of data may be bidirectional, so the output would be confusing. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-23-memxor@gmail.com commit a29b3ca17ee69e3e5182f1ed29be6b6ec306c149 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:09 2021 +0530 samples: bpf: Convert xdp_redirect_map_multi_kern.o to XDP samples helper One of the notable changes is using a BPF_MAP_TYPE_HASH instead of array map to store mac addresses of devices, as the resizing behavior was based on max_ifindex, which unecessarily maximized the capacity of map beyond what was needed. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-22-memxor@gmail.com commit bbe65865aa05fdbd20e37bbd3b2c95a0e9e24416 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:08 2021 +0530 samples: bpf: Convert xdp_redirect_map to XDP samples helper Use the libbpf skeleton facility and other utilities provided by XDP samples helper. Since get_mac_addr is already provided by XDP samples helper, we drop it. Also convert to XDP samples helper similar to prior samples to minimize duplication of code. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-21-memxor@gmail.com commit 54af769db92a47be8a9d23a4434dbd343b36f216 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:07 2021 +0530 samples: bpf: Convert xdp_redirect_map_kern.o to XDP samples helper Also update it to use consistent SEC("xdp") and SEC("xdp_devmap") naming, and use global variable instead of BPF map for copying the mac address. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-20-memxor@gmail.com commit e531a220cc59282a3f371608f1a6fa960416e231 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:06 2021 +0530 samples: bpf: Convert xdp_redirect_cpu to XDP samples helper Use the libbpf skeleton facility and other utilities provided by XDP samples helper. Similar to xdp_monitor, xdp_redirect_cpu was quite featureful except a few minor omissions (e.g. redirect errno reporting). All of these have been moved to XDP samples helper, hence drop the unneeded code and convert to usage of helpers provided by it. One of the important changes here is dropping of mprog-disable option, as we make that the default. Also, we support built-in programs for some common actions on the packet when it reaches kthread (pass, drop, redirect to device). If the user still needs to install a custom program, they can still supply a BPF object, however the program should be suitably tagged with SEC("xdp_cpumap") annotation so that the expected attach type is correct when updating our cpumap map element. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-19-memxor@gmail.com commit 79ccf4529ee67510fdad8ecdfcf37528d353a36c Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:05 2021 +0530 samples: bpf: Convert xdp_redirect_cpu_kern.o to XDP samples helper Similar to xdp_monitor_kern, a lot of these BPF programs have been reimplemented properly consolidating missing features from other XDP samples. Hence, drop the unneeded code and rename to .bpf.c suffix. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-18-memxor@gmail.com commit b926c55d856cbe2593c44e783b31e2cdb0ef6371 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:04 2021 +0530 samples: bpf: Convert xdp_redirect to XDP samples helper Use the libbpf skeleton facility and other utilities provided by XDP samples helper. One important note: The XDP samples helper handles ownership of installed XDP programs on devices, including responding to SIGINT and SIGTERM, so drop the code here and use the helpers we provide going forward for all xdp_redirect* conversions. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-17-memxor@gmail.com commit 66fc4ca85d910bdeecf019c3999bc2df7c80b726 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:03 2021 +0530 samples: bpf: Convert xdp_redirect_kern.o to XDP samples helper We moved swap_src_dst_mac to xdp_sample.bpf.h to be shared with other potential users, so drop it while moving code to the new file. Also, consistently use SEC("xdp") naming instead. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-16-memxor@gmail.com commit 6e1051a54e3100df59dae01c24ff4a6d6027e303 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:02 2021 +0530 samples: bpf: Convert xdp_monitor to XDP samples helper Use the libbpf skeleton facility and other utilities provided by XDP samples helper. A lot of the code in xdp_monitor and xdp_redirect_cpu has been moved to the xdp_sample_user.o helper, so we remove the duplicate functions here that are no longer needed. Thanks to BPF skeleton, we no longer depend on order of tracepoints to uninstall them on startup. Instead, the sample mask is used to install the needed tracepoints. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-15-memxor@gmail.com commit 3f19956010d26906e84baec4cd9c48bd8808de96 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:01 2021 +0530 samples: bpf: Convert xdp_monitor_kern.o to XDP samples helper We already moved all the functionality it provided in XDP samples helper userspace and kernel BPF object, so just delete the unneeded code. We also add generation of BPF skeleton and compilation using clang -target bpf for files ending with .bpf.c suffix (to denote that they use vmlinux.h). Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-14-memxor@gmail.com commit 384b6b3bbf0d3b60ca118459a91b7b8ce1dcd6bd Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:50:00 2021 +0530 samples: bpf: Add vmlinux.h generation support Also, take this opportunity to depend on in-tree bpftool, so that we can use static linking support in subsequent commits for XDP samples BPF helper object. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-13-memxor@gmail.com commit af93d58c27b6ac4154f1651f47be2a159f8ce30f Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:59 2021 +0530 samples: bpf: Add devmap_xmit tracepoint statistics support This adds support for retrieval and printing for devmap_xmit total and mutli mode tracepoint. For multi mode, we keep a hash map entry for each redirection stream, such that we can dynamically add and remove entries on output. The from_match and to_match will be set by individual samples when setting up the XDP program on these devices. The multi mode tracepoint is also handy for xdp_redirect_map_multi, where up to 32 devices can be specified. Also add samples_init_pre_load macro to finally set up the resized maps and mmap them in place for low overhead stats retrieval. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-12-memxor@gmail.com commit 5f116212f4018fc9aa7a2a828b27aab540b8e5fa Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:58 2021 +0530 samples: bpf: Add BPF support for devmap_xmit tracepoint This adds support for the devmap_xmit tracepoint, and its multi device variant that can be used to obtain streams for each individual net_device to net_device redirection. This is useful for decomposing total xmit stats in xdp_monitor. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-11-memxor@gmail.com commit d771e217506adcfbfb08c693fb9332ee4859d61d Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:57 2021 +0530 samples: bpf: Add cpumap tracepoint statistics support This consolidates retrieval and printing into the XDP sample helper. For the kthread stats, it expands xdp_stats separately with its own per-CPU stats. For cpumap enqueue, we display FROM->TO stats also with its per-CPU stats. The help out explains in detail the various aspects of the output. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-10-memxor@gmail.com commit 0cf3c2fc4b1afbd8d9c376754af34c1d2bd56de7 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:56 2021 +0530 samples: bpf: Add BPF support for cpumap tracepoints These are invoked in two places, when the XDP frame or SKB (for generic XDP) enqueued to the ptr_ring (cpumap_enqueue) and when kthread processes the frame after invoking the CPUMAP program for it (returning stats for the batch). We use cpumap_map_id to filter on the map_id as a way to avoid printing incorrect stats for parallel sessions of xdp_redirect_cpu. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-9-memxor@gmail.com commit 82c450803a917da6edb34a0a769d0b5a0b10990c Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:55 2021 +0530 samples: bpf: Add xdp_exception tracepoint statistics support This implements the retrieval and printing, as well the help output. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-8-memxor@gmail.com commit 451588764e2f3e3ab197b23c7958f750707e2a24 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:54 2021 +0530 samples: bpf: Add BPF support for xdp_exception tracepoint This would allow us to store stats for each XDP action, including their per-CPU counts. Consolidating this here allows all redirect samples to detect xdp_exception events. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-7-memxor@gmail.com commit 1d930fd2cdbf5e156c32c73ea7f3d5b12bdc41d7 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:53 2021 +0530 samples: bpf: Add redirect tracepoint statistics support This implements per-errno reporting (for the ones we explicitly recognize), adds some help output, and implements the stats retrieval and printing functions. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-6-memxor@gmail.com commit 323140389405e5d5d2020b2e3e04863d12cf3e32 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:52 2021 +0530 samples: bpf: Add BPF support for redirect tracepoint This adds the shared BPF file that will be used going forward for sharing tracepoint programs among XDP redirect samples. Since vmlinux.h conflicts with tools/include for READ_ONCE/WRITE_ONCE and ARRAY_SIZE, they are copied in to xdp_sample.bpf.h along with other helpers that will be required. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-5-memxor@gmail.com commit 156f886cf69715265f7b65cb4153bce8f8570326 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:51 2021 +0530 samples: bpf: Add basic infrastructure for XDP samples This file implements some common helpers to consolidate differences in features and functionality between the various XDP samples and give them a consistent look, feel, and reporting capabilities. This commit only adds support for receive statistics, which does not rely on any tracepoint, but on the XDP program installed on the device by each XDP redirect sample. Some of the key features are: * A concise output format accompanied by helpful text explaining its fields. * An elaborate output format building upon the concise one, and folding out details in case of errors and staying out of view otherwise. * Printing driver names for devices redirecting packets. * Getting mac address for interface. * Printing summarized total statistics for the entire session. * Ability to dynamically switch between concise and verbose mode, using SIGQUIT (Ctrl + \). In later patches, the support will be extended for each tracepoint with its own custom output in concise and verbose mode. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-4-memxor@gmail.com commit f2e85d4a751663514c1e84ea65f334ce1ca13a28 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:50 2021 +0530 tools: include: Add ethtool_drvinfo definition to UAPI header Instead of copying the whole header in, just add the struct definitions we need for now. In the future it can be synced as a copy of in-tree header if required. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-3-memxor@gmail.com commit 50b796e645a5d217fd9d8648ec594241e6f1dd57 Author: Kumar Kartikeya Dwivedi Date: Sat Aug 21 05:49:49 2021 +0530 samples: bpf: Fix a couple of warnings cookie_uid_helper_example.c: In function ‘main’: cookie_uid_helper_example.c:178:69: warning: ‘ -j ACCEPT’ directive writing 10 bytes into a region of size between 8 and 58 [-Wformat-overflow=] 178 | sprintf(rules, "iptables -A OUTPUT -m bpf --object-pinned %s -j ACCEPT", | ^~~~~~~~~~ /home/kkd/src/linux/samples/bpf/cookie_uid_helper_example.c:178:9: note: ‘sprintf’ output between 53 and 103 bytes into a destination of size 100 178 | sprintf(rules, "iptables -A OUTPUT -m bpf --object-pinned %s -j ACCEPT", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 179 | file); | ~~~~~ Fix by using snprintf and a sufficiently sized buffer. tracex4_user.c:35:15: warning: ‘write’ reading 12 bytes from a region of size 11 [-Wstringop-overread] 35 | key = write(1, "\e[1;1H\e[2J", 12); /* clear screen */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use size as 11. Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210821002010.845777-2-memxor@gmail.com commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 Author: Andrey Ignatov Date: Fri Aug 20 09:39:35 2021 -0700 bpf: Fix possible out of bound write in narrow load handling Fix a verifier bug found by smatch static checker in [0]. This problem has never been seen in prod to my best knowledge. Fixing it still seems to be a good idea since it's hard to say for sure whether it's possible or not to have a scenario where a combination of convert_ctx_access() and a narrow load would lead to an out of bound write. When narrow load is handled, one or two new instructions are added to insn_buf array, but before it was only checked that cnt >= ARRAY_SIZE(insn_buf) And it's safe to add a new instruction to insn_buf[cnt++] only once. The second try will lead to out of bound write. And this is what can happen if `shift` is set. Fix it by making sure that if the BPF_RSH instruction has to be added in addition to BPF_AND then there is enough space for two more instructions in insn_buf. The full report [0] is below: kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array kernel/bpf/verifier.c 12282 12283 insn->off = off & ~(size_default - 1); 12284 insn->code = BPF_LDX | BPF_MEM | size_code; 12285 } 12286 12287 target_size = 0; 12288 cnt = convert_ctx_access(type, insn, insn_buf, env->prog, 12289 &target_size); 12290 if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) || ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Bounds check. 12291 (ctx_field_size && !target_size)) { 12292 verbose(env, "bpf verifier is misconfigured\n"); 12293 return -EINVAL; 12294 } 12295 12296 if (is_narrower_load && size < target_size) { 12297 u8 shift = bpf_ctx_narrow_access_offset( 12298 off, size, size_default) * 8; 12299 if (ctx_field_size <= 4) { 12300 if (shift) 12301 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, ^^^^^ increment beyond end of array 12302 insn->dst_reg, 12303 shift); --> 12304 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg, ^^^^^ out of bounds write 12305 (1 << size * 8) - 1); 12306 } else { 12307 if (shift) 12308 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH, 12309 insn->dst_reg, 12310 shift); 12311 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg, ^^^^^^^^^^^^^^^ Same. 12312 (1ULL << size * 8) - 1); 12313 } 12314 } 12315 12316 new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); 12317 if (!new_prog) 12318 return -ENOMEM; 12319 12320 delta += cnt - 1; 12321 12322 /* keep walking new program and skip insns we just inserted */ 12323 env->prog = new_prog; 12324 insn = new_prog->insnsi + i + delta; 12325 } 12326 12327 return 0; 12328 } [0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/ v1->v2: - clarify that problem was only seen by static checker but not in prod; Fixes: 46f53a65d2de ("bpf: Allow narrow loads with offset > 0") Reported-by: Dan Carpenter Signed-off-by: Andrey Ignatov Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820163935.1902398-1-rdna@fb.com commit 32b2397c1e56f33b0b1881def965bb89bd12f448 Author: sumiyawang Date: Sun Aug 22 19:49:09 2021 +0800 libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind There is a use after free crash when the pmem driver tears down its mapping while I/O is still inbound. This is triggered by driver unbind, "ndctl destroy-namespace", while I/O is in flight. Fix the sequence of blk_cleanup_queue() vs memunmap(). The crash signature is of the form: BUG: unable to handle page fault for address: ffffc90080200000 CPU: 36 PID: 9606 Comm: systemd-udevd Call Trace: ? pmem_do_bvec+0xf9/0x3a0 ? xas_alloc+0x55/0xd0 pmem_rw_page+0x4b/0x80 bdev_read_page+0x86/0xb0 do_mpage_readpage+0x5d4/0x7a0 ? lru_cache_add+0xe/0x10 mpage_readpages+0xf9/0x1c0 ? bd_link_disk_holder+0x1a0/0x1a0 blkdev_readpages+0x1d/0x20 read_pages+0x67/0x1a0 ndctl Call Trace in vmcore: PID: 23473 TASK: ffff88c4fbbe8000 CPU: 1 COMMAND: "ndctl" __schedule schedule blk_mq_freeze_queue_wait blk_freeze_queue blk_cleanup_queue pmem_release_queue devm_action_release release_nodes devres_release_all device_release_driver_internal device_driver_detach unbind_store Cc: Signed-off-by: sumiyawang Reviewed-by: yongduan Link: https://lore.kernel.org/r/1629632949-14749-1-git-send-email-sumiyawang@tencent.com Fixes: 50f44ee7248a ("mm/devm_memremap_pages: fix final page put race") Signed-off-by: Dan Williams commit a79a9c765f95a73e087f11f0994297cd69987bda Author: Vineet Gupta Date: Mon Sep 16 10:54:34 2019 -0700 ARC: mm: move MMU specific bits out of entry code ... ... to avoid polluting shared entry code (across three ISA variants) with ISA/MMU specific code. Cc: Jose Abreu Signed-off-by: Vineet Gupta commit 89d0d42412a116563c28c763d9c1bdee83b5b6af Author: Vineet Gupta Date: Fri Sep 13 15:20:01 2019 -0700 ARC: mm: move MMU specific bits out of ASID allocator And while at it, rewrite commentary on ASID allocator Signed-off-by: Vineet Gupta commit be43b096ed787bad9e1a74f79486159c6cd6e648 Author: Vineet Gupta Date: Wed Sep 30 18:58:16 2020 -0700 ARC: mm: non-functional code movement/cleanup Signed-off-by: Vineet Gupta commit e93e59ac1e699d07a2bfd0bb03f36b0d2f931834 Author: Vineet Gupta Date: Wed Oct 30 16:54:32 2019 -0700 ARC: mm: pmd_populate* to use the canonical set_pmd (and drop pmd_set) Signed-off-by: Vineet Gupta commit da773cf20eb3745e18be995e00be0d57aa862564 Author: Vineet Gupta Date: Thu Sep 12 12:01:04 2019 -0700 ARC: ioremap: use more commonly used PAGE_KERNEL based uncached flag and remove the one off uncached definition for ARC Signed-off-by: Vineet Gupta commit 1b4013b9aebca87636dc9edc8903ffa87267704f Author: Vineet Gupta Date: Mon Oct 28 13:49:41 2019 -0700 ARC: mm: Enable STRICT_MM_TYPECHECKS In the past I've refrained from doing this (at least 2 times) due to the slight code bloat due to ABI implications of pte_t etc becoming struct Per ARC ABI, functions return struct via memory and not through register r0, even if the struct would fit in register(s) - caller allocates space on stack and passes the address as first arg (r0), shifting rest of args by one - callee creates return struct in memory (referenced via r0) This time around the code actually shrunk slightly (due to subtle inlining heuristic effects), but still slightly inefficient due to return values passed through memory. That however seems like a small cost compared to maintenance burden given the impending new mmu support for page walk etc Signed-off-by: Vineet Gupta commit 366440eec855dad6527adaf2f1dcc305fb5eef99 Author: Vineet Gupta Date: Mon Oct 28 12:02:47 2019 -0700 ARC: mm: Fixes to allow STRICT_MM_TYPECHECKS Signed-off-by: Vineet Gupta commit 47910ca3ce946662f950d700f26e51c563a9821f Author: Vineet Gupta Date: Fri Sep 13 13:19:44 2019 -0700 ARC: mm: move mmu/cache externs out to setup.h Don't pollute mmu.h and cache.h with ARC internal bootlog/setup related functions. Move them aside to setup.h Signed-off-by: Vineet Gupta commit 12e7804c264143c63d1cae7e3a62d21fbed06f59 Author: Vineet Gupta Date: Mon Sep 9 16:59:59 2019 -0700 ARC: mm: remove tlb paranoid code This was used back in arc700 days when ASID allocator was fragile. Not needed in last 5 years Signed-off-by: Vineet Gupta commit 6128df5be48f48d63efdc7c52022dd163f612373 Author: Vineet Gupta Date: Mon Jan 13 09:16:06 2020 -0800 ARC: mm: use SCRATCH_DATA0 register for caching pgdir in ARCv2 only MMU SCRATCH_DATA0 register is intended to cache task pgd. However in ARC700 SMP port, it has to be repurposed for re-entrant interrupt handling, while UP port doesn't. We currently handle these use-cases using a fabricated #define which has usual issues of dependency nesting and obvious ugliness. So clean this up: for ARC700 don't use to cache pgd (even in UP) and do the opposite for ARCv2. And while here, switch to canonical pgd_offset(). Acked-by: Mike Rapoport Signed-off-by: Vineet Gupta commit 288ff7de62af0936353c9394de9d0b2c6dd22c80 Author: Vineet Gupta Date: Mon Sep 9 17:36:34 2019 -0700 ARC: retire MMUv1 and MMUv2 support There's no known/active customer using them with latest kernels anyways. Removal helps cleanup code and remove the hack for MMU_VER to MMU_V[3-4] conversion Signed-off-by: Vineet Gupta commit 767a697e75769fdae092a15d92bf562d5631a490 Author: Vineet Gupta Date: Thu Aug 5 23:38:44 2021 -0700 ARC: retire ARC750 support There's no known/active customer using them with latest kernels anyways. Signed-off-by: Vineet Gupta commit 301014cf6d72836dd5fd5b3e9c92633f35b298c0 Author: Vineet Gupta Date: Mon May 11 13:27:23 2020 -0700 ARC: atomic_cmpxchg/atomic_xchg: implement relaxed variants And move them out of cmpxchg.h to canonical atomic.h Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit ddc348c44d82d0b55236210d5606ac868e6cc364 Author: Vineet Gupta Date: Sat May 9 00:15:36 2020 -0700 ARC: cmpxchg/xchg: implement relaxed variants (LLSC config only) It only makes sense to do this for the LLSC config Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit e188f3330a13df904d77003846eafd3edf99009d Author: Vineet Gupta Date: Wed May 6 15:13:25 2020 -0700 ARC: cmpxchg/xchg: rewrite as macros to make type safe Existing code forces/assume args to type "long" which won't work in LP64 regime, so prepare code for that Interestingly this should be a non functional change but I do see some codegen changes | bloat-o-meter vmlinux-cmpxchg-A vmlinux-cmpxchg-B | add/remove: 0/0 grow/shrink: 17/12 up/down: 218/-150 (68) | | Function old new delta | rwsem_optimistic_spin 518 550 +32 | rwsem_down_write_slowpath 1244 1274 +30 | __do_sys_perf_event_open 2576 2600 +24 | down_read 192 200 +8 | __down_read 192 200 +8 ... | task_work_run 168 148 -20 | dma_fence_chain_walk.part 760 736 -24 | __genradix_ptr_alloc 674 646 -28 Total: Before=6187409, After=6187477, chg +0.00% Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit ecf51c9fa0960fd25cd66f2280fb1980b0d2e300 Author: Vineet Gupta Date: Wed May 6 14:41:12 2020 -0700 ARC: xchg: !LLSC: remove UP micro-optimization/hack It gets in the way of cleaning things up and is a maintenance pain-in-neck ! Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit 9d011e12075dc51fb57f8203a08cc5229fbcb2ef Author: Vineet Gupta Date: Tue May 5 13:54:24 2020 -0700 ARC: bitops: fls/ffs to take int (vs long) per asm-generic defines Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit cea43147905f1c2b7b48104a5304cf5229f45bec Author: Vineet Gupta Date: Tue Sep 4 16:11:29 2018 -0700 ARC: switch to generic bitops - !LLSC now only needs a single spinlock for atomics and bitops - Some codegen changes (slight bloat) with generic bitops 1. code increase due to LD-check-atomic paradigm vs. unconditonal atomic (but dirty'ing the cache line even if set already). So despite increase, generic is right thing to do. 2. code decrease (but use of costlier instructions such as DIV vs. shifts based math) due to signed arithmetic. This needs to be revisited seperately. arc: static inline int test_bit(unsigned int nr, const volatile unsigned long *addr) ^^^^^^^^^^^^ generic: static inline int test_bit(int nr, const volatile unsigned long *addr) ^^^ Link: https://lore.kernel.org/r/20180830135749.GA13005@arm.com Signed-off-by: Will Deacon Acked-by: Peter Zijlstra (Intel) [vgupta: wrote patch based on Will's poc, analysed codegen diffs] Signed-off-by: Vineet Gupta commit b64be6836993c431e54fad239fcba0543854ee35 Author: Vineet Gupta Date: Mon Apr 13 18:07:49 2020 -0700 ARC: atomics: implement relaxed variants The current ARC fetch/return atomics provide fully ordered semantics only with 2 full barriers around the operation. Instead implement them as relaxed variants without any barriers and rely on generic code to generate the fully-ordered, acquire and release varaints by adding the appropriate full barriers. This helps elide some extra barriers in case of acquire/release/relaxed calls. bloat-o-meter for hsdk defconfig shows codegen improvements, although numbers below inflated due to unrelated inlining heuristic changes | bloat-o-meter vmlinux-643babe34fd7-non-relaxed vmlinux-45aa05cb44d7-relaxed | add/remove: 2/5 grow/shrink: 42/1222 up/down: 4158/-14312 (-10154) | Function old new delta | .. | sys_renameat 462 476 +14 | ip_mc_inc_group 424 436 +12 | do_read_cache_page 1882 1894 +12 | .. | refcount_dec_and_mutex_lock 254 250 -4 | refcount_dec_and_lock_irqsave 258 254 -4 | refcount_dec_and_lock 254 250 -4 | .. | tcp_v6_route_req 246 238 -8 | tcp_v4_destroy_sock 286 278 -8 | tcp_twsk_unique 352 344 -8 Link: https://lore.kernel.org/r/20180830144344.GW24142@hirez.programming.kicks-ass.net Suggested-by: Peter Zijlstra (Intel) Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit 7e8f8cbb43990861e5881594e14d491f81931f8d Author: Vineet Gupta Date: Mon Apr 13 17:41:24 2020 -0700 ARC: atomic64: LLSC: elide unused atomic_{and,or,xor,andnot}_return This is a non-functional change since those wrappers are not used in kernel sources at all. Link: http://lists.infradead.org/pipermail/linux-snps-arc/2018-August/004246.html Suggested-by: Peter Zijlstra (Intel) Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit ca766f04ad1dc4527e3e388fe3736e6b1bf0e6b2 Author: Vineet Gupta Date: Tue May 5 22:59:57 2020 -0700 ARC: atomic: !LLSC: use int data type consistently Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit b1040148b2ea4ecbdb60c0d20393f4d15eee13ac Author: Vineet Gupta Date: Tue Jan 21 09:56:33 2020 -0800 ARC: atomic: !LLSC: remove hack in atomic_set() for for UP !LLSC atomics use spinlock (SMP) or irq-disable (UP) to implement criticla regions. UP atomic_set() however was "cheating" by not doing any of that so and still being functional. Remove this anomaly (primarily as cleanup for future code improvements) given that this config is not worth hassle of special case code. Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit b0f839b4b91588c24bac8d320f7fc9fe2dea4517 Author: Vineet Gupta Date: Tue Aug 3 20:26:09 2021 -0700 ARC: atomics: disintegrate header Non functional change, to ease future addition/removal Acked-by: Peter Zijlstra (Intel) Signed-off-by: Vineet Gupta commit 6b5ff0405e4190f23780362ea324b250bc495683 Author: Randy Dunlap Date: Mon Aug 16 14:05:33 2021 -0700 ARC: export clear_user_page() for modules 0day bot reports a build error: ERROR: modpost: "clear_user_page" [drivers/media/v4l2-core/videobuf-dma-sg.ko] undefined! so export it in arch/arc/ to fix the build error. In most ARCHes, clear_user_page() is a macro. OTOH, in a few ARCHes it is a function and needs to be exported. PowerPC exported it in 2004. It looks like nds32 and nios2 still need to have it exported. Fixes: 4102b53392d63 ("ARC: [mm] Aliasing VIPT dcache support 2/4") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Guenter Roeck Cc: linux-snps-arc@lists.infradead.org Signed-off-by: Vineet Gupta commit 82a423053eb3cf27209c78ce1852ea18d173722a Author: Changcheng Deng Date: Sat Aug 14 00:30:38 2021 +0800 arch/arc/kernel/: fix misspellings using codespell tool Some typos are found out by codespell tool: ./intc-compact.c:145: prioity ==> priority ./smp.c:286: recevier ==> receiver ./stacktrace.c:152 prelogue ==> prologue Fix typos found by codespell. Reported-by: Zeal Robot Signed-off-by: Changcheng Deng Signed-off-by: Yi Wang Signed-off-by: Vineet Gupta commit f63693e3ae1bdb5dd8ba2bcd4d9dcb5bc28d9111 Merge: 8c0bb89e8e4dd 6cbca1ee0d74e Author: Alexei Starovoitov Date: Tue Aug 24 14:17:53 2021 -0700 Merge branch 'bpf: Allow bpf_get_netns_cookie in BPF_PROG_TYPE_SK_MSG' Xu Liu says: ==================== We'd like to be able to identify netns from sk_msg hooks to accelerate local process communication form different netns. ==================== Signed-off-by: Alexei Starovoitov commit 6cbca1ee0d74ea14d7b6cff16745b66b8f0fda5c Author: Xu Liu Date: Fri Aug 20 15:17:12 2021 +0800 selftests/bpf: Test for get_netns_cookie Add test to use get_netns_cookie() from BPF_PROG_TYPE_SK_MSG. Signed-off-by: Xu Liu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820071712.52852-3-liuxu623@gmail.com commit fab60e29fcc6d60396da20d63d45fd0d305ba4e4 Author: Xu Liu Date: Fri Aug 20 15:17:11 2021 +0800 bpf: Allow bpf_get_netns_cookie in BPF_PROG_TYPE_SK_MSG We'd like to be able to identify netns from sk_msg hooks to accelerate local process communication form different netns. Signed-off-by: Xu Liu Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820071712.52852-2-liuxu623@gmail.com commit 8c0bb89e8e4ddc3519b1a2cf1d503f6b3d1cd38a Merge: a6258837c8a81 00e1116031e15 Author: Alexei Starovoitov Date: Tue Aug 24 14:01:11 2021 -0700 Merge branch 'selftests/bpf: minor fixups' Li Zhijian says: ==================== Fix a few issues reported by 0Day/LKP during runing selftests/bpf. Changelog: V2: - folded previous similar standalone patch to [1/5], and add acked tag from Song Liu - add acked tag to [2/5], [3/5] from Song Liu - [4/5]: move test_bpftool.py to TEST_PROGS_EXTENDED, files in TEST_GEN_PROGS_EXTENDED are generated by make. Otherwise, it will break out-of-tree install: 'make O=/kselftest-build SKIP_TARGETS= V=1 -C tools/testing/selftests install INSTALL_PATH=/kselftest-install' - [5/5]: new patch ==================== Signed-off-by: Alexei Starovoitov commit 00e1116031e154098c55441e4936b32e4b20b31c Author: Li Zhijian Date: Fri Aug 20 10:55:49 2021 +0800 selftests/bpf: Exit with KSFT_SKIP if no Makefile found This would happend when we run the tests after install kselftests root@lkp-skl-d01 ~# /kselftests/run_kselftest.sh -t bpf:test_doc_build.sh TAP version 13 1..1 # selftests: bpf: test_doc_build.sh perl: warning: Setting locale failed. perl: warning: Please check that your locale settings: LANGUAGE = (unset), LC_ALL = (unset), LC_ADDRESS = "en_US.UTF-8", LC_NAME = "en_US.UTF-8", LC_MONETARY = "en_US.UTF-8", LC_PAPER = "en_US.UTF-8", LC_IDENTIFICATION = "en_US.UTF-8", LC_TELEPHONE = "en_US.UTF-8", LC_MEASUREMENT = "en_US.UTF-8", LC_TIME = "en_US.UTF-8", LC_NUMERIC = "en_US.UTF-8", LANG = "en_US.UTF-8" are supported and installed on your system. perl: warning: Falling back to the standard locale ("C"). # skip: bpftool files not found! # ok 1 selftests: bpf: test_doc_build.sh # SKIP Signed-off-by: Li Zhijian Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820025549.28325-1-lizhijian@cn.fujitsu.com commit 404bd9ff5d7ccb938ab033f6971c6ee2b8384387 Author: Li Zhijian Date: Fri Aug 20 09:55:56 2021 +0800 selftests/bpf: Add missing files required by test_bpftool.sh for installing test_bpftool.sh relies on bpftool and test_bpftool.py. 'make install' will install bpftool to INSTALL_PATH/bpf/bpftool, and export it to PATH so that it can be used after installing. Signed-off-by: Li Zhijian Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820015556.23276-5-lizhijian@cn.fujitsu.com commit 7a3bdca20b10fb93a34aca22e19c4b27c5602edb Author: Li Zhijian Date: Fri Aug 20 09:55:55 2021 +0800 selftests/bpf: Add default bpftool built by selftests to PATH For 'make run_tests': selftests will build bpftool into tools/testing/selftests/bpf/tools/sbin/bpftool by default. ================== root@lkp-skl-d01 /opt/rootfs/v5.14-rc4# make -C tools/testing/selftests/bpf run_tests make: Entering directory '/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf' MKDIR include MKDIR libbpf MKDIR bpftool [...] GEN /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/tools/build/bpftool/profiler.skel.h CC /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/tools/build/bpftool/prog.o GEN /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/tools/build/bpftool/pid_iter.skel.h CC /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/tools/build/bpftool/pids.o LINK /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/tools/build/bpftool/bpftool INSTALL bpftool GEN vmlinux.h [...] # test_feature_dev_json (test_bpftool.TestBpftool) ... ERROR # test_feature_kernel (test_bpftool.TestBpftool) ... ERROR # test_feature_kernel_full (test_bpftool.TestBpftool) ... ERROR # test_feature_kernel_full_vs_not_full (test_bpftool.TestBpftool) ... ERROR # test_feature_macros (test_bpftool.TestBpftool) ... Error: bug: failed to retrieve CAP_BPF status: Invalid argument # ERROR # # ====================================================================== # ERROR: test_feature_dev_json (test_bpftool.TestBpftool) # ---------------------------------------------------------------------- # Traceback (most recent call last): # File "/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/test_bpftool.py", line 57, in wrapper # return f(*args, iface, **kwargs) # File "/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/test_bpftool.py", line 82, in test_feature_dev_json # res = bpftool_json(["feature", "probe", "dev", iface]) # File "/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/test_bpftool.py", line 42, in bpftool_json # res = _bpftool(args) # File "/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/test_bpftool.py", line 34, in _bpftool # return subprocess.check_output(_args) # File "/usr/lib/python3.7/subprocess.py", line 395, in check_output # **kwargs).stdout # File "/usr/lib/python3.7/subprocess.py", line 487, in run # output=stdout, stderr=stderr) # subprocess.CalledProcessError: Command '['bpftool', '-j', 'feature', 'probe', 'dev', 'dummy0']' returned non-zero exit status 255. # ================== Signed-off-by: Li Zhijian Signed-off-by: Alexei Starovoitov Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20210820015556.23276-4-lizhijian@cn.fujitsu.com commit 5a980b5baf3942653d30c451416ca485ec09577f Author: Li Zhijian Date: Fri Aug 20 09:55:54 2021 +0800 selftests/bpf: Make test_doc_build.sh work from script directory Previously, it fails as below: ------------- root@lkp-skl-d01 /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf# ./test_doc_build.sh ++ realpath --relative-to=/opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf ./test_doc_build.sh + SCRIPT_REL_PATH=test_doc_build.sh ++ dirname test_doc_build.sh + SCRIPT_REL_DIR=. ++ realpath /opt/rootfs/v5.14-rc4/tools/testing/selftests/bpf/./../../../../ + KDIR_ROOT_DIR=/opt/rootfs/v5.14-rc4 + cd /opt/rootfs/v5.14-rc4 + for tgt in docs docs-clean + make -s -C /opt/rootfs/v5.14-rc4/. docs make: *** No rule to make target 'docs'. Stop. + for tgt in docs docs-clean + make -s -C /opt/rootfs/v5.14-rc4/. docs-clean make: *** No rule to make target 'docs-clean'. Stop. ----------- Reported-by: kernel test robot Signed-off-by: Li Zhijian Signed-off-by: Alexei Starovoitov Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20210820015556.23276-3-lizhijian@cn.fujitsu.com commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 Author: Li Zhijian Date: Fri Aug 20 09:55:53 2021 +0800 selftests/bpf: Enlarge select() timeout for test_maps 0Day robot observed that it's easily timeout on a heavy load host. ------------------- # selftests: bpf: test_maps # Fork 1024 tasks to 'test_update_delete' # Fork 1024 tasks to 'test_update_delete' # Fork 100 tasks to 'test_hashmap' # Fork 100 tasks to 'test_hashmap_percpu' # Fork 100 tasks to 'test_hashmap_sizes' # Fork 100 tasks to 'test_hashmap_walk' # Fork 100 tasks to 'test_arraymap' # Fork 100 tasks to 'test_arraymap_percpu' # Failed sockmap unexpected timeout not ok 3 selftests: bpf: test_maps # exit=1 # selftests: bpf: test_lru_map # nr_cpus:8 ------------------- Since this test will be scheduled by 0Day to a random host that could have only a few cpus(2-8), enlarge the timeout to avoid a false NG report. In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps', and knew 10S is likely enough, but i still perfer to a larger value 30. Reported-by: kernel test robot Signed-off-by: Li Zhijian Signed-off-by: Alexei Starovoitov Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com commit ea4ab99cb58cc9f8d64c0961ff9a059825f304cf Author: Matija Glavinic Pecotic Date: Tue Aug 24 11:25:56 2021 +0200 spi: davinci: invoke chipselect callback Davinci needs to configure chipselect on transfer. Fixes: 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional") Signed-off-by: Matija Glavinic Pecotic Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/735fb7b0-82aa-5b9b-85e4-53f0c348cc0e@nokia.com Signed-off-by: Mark Brown commit 2f617f4df8dfef68f175160d533f5820a368023e Author: Philip Yang Date: Wed Aug 18 09:34:53 2021 -0400 drm/amdkfd: map SVM range with correct access permission Restore retry fault or prefetch range, or restore svm range after eviction to map range to GPU with correct read or write access permission. Range may includes multiple VMAs, update GPU page table with offset of prange, number of pages for each VMA according VMA access permission. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit bf608ebc364e204ced4fc09c0e0a4c33fe671344 Author: Hu Haowen Date: Sat Aug 21 17:40:59 2021 +0800 docs/zh_TW: add translations for zh_TW/filesystems Create new translations for zh_TW/filesystems and link them to index. Signed-off-by: Hu Haowen Link: https://lore.kernel.org/r/20210821094059.64300-3-src.res@email.cn Signed-off-by: Jonathan Corbet commit ac8fa1bdc02671ff9c3e548878e68886b3f5daee Author: Hu Haowen Date: Sat Aug 21 17:40:58 2021 +0800 docs/zh_TW: add translations for zh_TW/cpu-freq Create new translations for zh_TW/cpu-freq and link them to index. Signed-off-by: Hu Haowen Link: https://lore.kernel.org/r/20210821094059.64300-2-src.res@email.cn Signed-off-by: Jonathan Corbet commit e5cb9494fe799f7358554d5b66568ac16e305499 Author: Hu Haowen Date: Sat Aug 21 17:40:57 2021 +0800 docs/zh_TW: add translations for zh_TW/arm64 Create new translations for zh_TW/arm64 and link them to index. Signed-off-by: Hu Haowen Link: https://lore.kernel.org/r/20210821094059.64300-1-src.res@email.cn Signed-off-by: Jonathan Corbet commit ff891a2e6431f79c239ab0c5bc05834c0235821c Author: Philip Yang Date: Sun Aug 15 14:42:33 2021 -0400 drm/amdkfd: check access permisson to restore retry fault Check range access permission to restore GPU retry fault, if GPU retry fault on address which belongs to VMA, and VMA has no read or write permission requested by GPU, failed to restore the address. The vm fault event will pass back to user space. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit f24d991bb9641d9467d2a0096239c58bf3d2b388 Author: John Clements Date: Tue Aug 24 14:56:53 2021 +0800 drm/amdgpu: Update RAS XGMI Error Query Resolve bug querying error on unsupported ASIC Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 3907c492184e13a5d8d336963a6ec1f6ebe0064d Author: John Clements Date: Tue Aug 24 13:24:25 2021 +0800 drm/amdgpu: Add driver infrastructure for MCA RAS Add MCA specific IP blocks targetting RAS features Reviewed-by: Hawking Zhang Signed-off-by: John Clements Signed-off-by: Alex Deucher commit 3341d30d1cc7c37ca5fd49b7f9b0f3cce66c727e Author: Praful Swarnakar Date: Thu Aug 19 21:31:37 2021 +0530 drm/amd/display: Add Logging for HDMI color depth information [Why] Recent HDMI2.0 HF1-1 V-Swing testing showed that logging deep color status helps in validation of testcase. [How] Add logging based on various color depths and pixel encoding formats. Signed-off-by: Praful Swarnakar Reviewed-by: Hersen Wu Signed-off-by: Alex Deucher commit 30acef3c4ad1a9112c851cd3c75704fc665174da Author: Candice Li Date: Wed Aug 18 19:33:27 2021 +0800 drm/amd/amdgpu: consolidate PSP TA init shared buf functions Signed-off-by: Candice Li Reviewed-by: John Clements Signed-off-by: Alex Deucher commit 355e3e4ccc2cd4b29cc37546474448a8f02e3bbc Author: Candice Li Date: Mon Aug 23 15:17:35 2021 +0800 drm/amd/amdgpu: add name field back to ras_common_if Adding name field back to ras_common_if to work around error injection failure with amdgpuras tool. Signed-off-by: Candice Li Reviewed-by: John Clements Signed-off-by: Alex Deucher commit a47f6a5806da4f24fbb66148a1519bf72fe060db Author: Borislav Petkov Date: Tue Aug 24 11:42:47 2021 +0200 drm/amdgpu: Fix build with missing pm_suspend_target_state module export Building a randconfig here triggered: ERROR: modpost: "pm_suspend_target_state" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! because the module export of that symbol happens in kernel/power/suspend.c which is enabled with CONFIG_SUSPEND. The ifdef guards in amdgpu_acpi_is_s0ix_supported(), however, test for CONFIG_PM_SLEEP which is defined like this: config PM_SLEEP def_bool y depends on SUSPEND || HIBERNATE_CALLBACKS and that randconfig has: # CONFIG_SUSPEND is not set CONFIG_HIBERNATE_CALLBACKS=y leading to the module export missing. Change the ifdeffery to depend directly on CONFIG_SUSPEND. Fixes: 5706cb3c910c ("drm/amdgpu: fix checking pmops when PM_SLEEP is not enabled") Reviewed-by: Lijo Lazar Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/YSP6Lv53QV0cOAsd@zn.tnic Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a5f61dd41273d75c63f226ab66d2e69dfe4dd045 Author: Christophe JAILLET Date: Sun Aug 22 23:23:25 2021 +0200 drm/radeon: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Reviewed-by: Christian König Signed-off-by: Christophe JAILLET Signed-off-by: Alex Deucher commit 8a1d1bdb845affbb2a9887826e5e991e290bde56 Author: Christophe JAILLET Date: Sun Aug 22 23:21:43 2021 +0200 drm/amdgpu: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Reviewed-by: Christian König Signed-off-by: Christophe JAILLET Signed-off-by: Alex Deucher commit f270921a17b94ae7c1acfc8cead4108c03e6550f Author: Mukul Joshi Date: Thu Aug 19 13:18:04 2021 -0400 drm/amdkfd: CWSR with sw scheduler on Aldebaran and Arcturus Program trap handler settings to enable CWSR with software scheduler on Aldebaran and Arcturus. Signed-off-by: Mukul Joshi Reviewed-by: Amber Lin Signed-off-by: Alex Deucher commit 7301757ea1fbead24f7c5687f828940a698a95db Author: Shashank Sharma Date: Fri Aug 20 10:20:02 2021 +0530 drm/amdgpu/OLAND: clip the ref divider max value This patch limits the ref_div_max value to 100, during the calculation of PLL feedback reference divider. With current value (128), the produced fb_ref_div value generates unstable output at particular frequencies. Radeon driver limits this value at 100. On Oland, when we try to setup mode 2048x1280@60 (a bit weird, I know), it demands a clock of 221270 Khz. It's been observed that the PLL calculations using values 128 and 100 are vastly different, and look like this: +------------------------------------------+ |Parameter |AMDGPU |Radeon | | | | | +-------------+----------------------------+ |Clock feedback | | |divider max | 128 | 100 | |cap value | | | | | | | | | | | +------------------------------------------+ |ref_div_max | | | | | 42 | 20 | | | | | | | | | +------------------------------------------+ |ref_div | 42 | 20 | | | | | +------------------------------------------+ |fb_div | 10326 | 8195 | +------------------------------------------+ |fb_div | 1024 | 163 | +------------------------------------------+ |fb_dev_p | 4 | 9 | |frac fb_de^_p| | | +----------------------------+-------------+ With ref_div_max value clipped at 100, AMDGPU driver can also drive videmode 2048x1280@60 (221Mhz) and produce proper output without any blanking and distortion on the screen. PS: This value was changed from 128 to 100 in Radeon driver also, here: https://github.com/freedesktop/drm-tip/commit/4b21ce1b4b5d262e7d4656b8ececc891fc3cb806 V1: Got acks from: Acked-by: Alex Deucher Acked-by: Christian König V2: - Restricting the changes only for OLAND, just to avoid any regression for other cards. - Changed unsigned -> unsigned int to make checkpatch quiet. V3: Apply the change on SI family (not only oland) (Christian) Cc: Alex Deucher Cc: Christian König Cc: Eddy Qin Reviewed-by: Christian König Signed-off-by: Shashank Sharma Signed-off-by: Alex Deucher commit 234b4fd9176c60480190ef4f75cc1b920df58329 Author: Eric Yang Date: Fri Jul 9 17:47:39 2021 -0400 drm/amd/display: refactor riommu invalidation wa [Why] A cleaner solution, only done once on boot. [How] Remove previous workaround and configure an extra vmid one time on boot Reviewed-by: Kazlauskas Nicholas Acked-by: Solomon Chiu Signed-off-by: Eric Yang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8137a49e1567726eb10fcf55ad141ac19804ca6b Author: Yanteng Si Date: Sat Aug 21 16:18:00 2021 +0800 docs/zh_CN: Modify the translator tag and fix the wrong word Fix a wrong word; Fix old Original tag; Remove unnecessary blank lines; Modify the translator tag to be consistent with the current. Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/20210821081800.2205103-1-siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit d4477209c8fbc1bb0035ca44426e02238f68c5fd Author: Mark Rutland Date: Tue Aug 17 10:16:21 2021 +0100 Documentation/features/vm: correct huge-vmap APIs In commit: bbc180a5adb05ee8 ("mm: HUGE_VMAP arch support cleanup") We replaced: * ioremap_pud_enabled() with arch_vmap_pud_supported() * ioremap_pmd_enabled() with arch_vmap_pmd_supported() Update the documentation accordingly. Signed-off-by: Mark Rutland Cc: Andrew Morton Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Nicholas Piggin Cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/20210817091621.16799-1-mark.rutland@arm.com Signed-off-by: Jonathan Corbet commit c19430eec84f7440651266e5f5a811df3d6f46ae Author: Jinay Jain Date: Thu Aug 12 08:25:28 2021 -0700 Documentation: block: blk-mq: Fix small typo in multi-queue docs Fixed a small typo in the documentation for multi-queue block IO. Signed-off-by: Jinay Jain Link: https://lore.kernel.org/r/20210812152528.300668-1-jinaybjain@gmail.com Signed-off-by: Jonathan Corbet commit fe450eeb4e6f1c19d088c99d2206ecabb8d0892b Author: Changbin Du Date: Sat Aug 14 09:48:31 2021 +0800 Documentation: in_irq() cleanup Replace the obsolete and ambiguos macro in_irq() with new macro in_hardirq(). Signed-off-by: Changbin Du Link: https://lore.kernel.org/r/20210814014831.53083-1-changbin.du@gmail.com Signed-off-by: Jonathan Corbet commit f08fe9d29366c0204c3d571fa0088b1f0efd1a17 Author: Pali Rohár Date: Sat Aug 14 14:48:05 2021 +0200 Documentation: arm: marvell: Add 88F6825 model into list 88F6825 is just 88F6820 but without encryption acceleration hardware and is used e.g. in DTS file arch/arm/boot/dts/armada-385-clearfog-gtr.dtsi Signed-off-by: Pali Rohár Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20210814124805.14568-1-pali@kernel.org Signed-off-by: Jonathan Corbet commit 59c6a716b14ba3092ea685b6274d5233c18cc194 Author: SeongJae Park Date: Thu Aug 12 09:50:30 2021 +0000 Documentation/process/maintainer-pgp-guide: Replace broken link to PGP path finder PGP pathfinder[1], which is suggested for finding a trust path to unknown PGP keys by 'maintainer-pgp-guide.rst', is not working now. This commit replaces it with other available tools. [1] https://pgp.cs.uu.nl/ Signed-off-by: SeongJae Park Reviewed-by: Konstantin Ryabitsev Link: https://lore.kernel.org/r/20210812095030.4704-2-sj38.park@gmail.com Signed-off-by: Jonathan Corbet commit 8c7a729d09644dafbb90207c35cab495d3a33175 Author: Alexander Aring Date: Mon Aug 23 14:31:43 2021 -0400 Documentation: locking: fix references This patch fixes file references from txt to rst file ending in ww-mutex-design.rst and futex-requeue-pi.rst. While on it fix a spelling issue "desgin" to "design" reported by Matthew Wilcox. Signed-off-by: Alexander Aring Link: https://lore.kernel.org/r/20210823183143.1691344-1-aahringo@redhat.com Signed-off-by: Jonathan Corbet commit a6e6d722957273afebf26b9a36b90acfc27dca8a Author: Dan Williams Date: Tue Aug 24 09:06:07 2021 -0700 libnvdimm/labels: Add claim class helpers In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. CXL labels do have the concept of a claim class represented by an "abstraction" identifier. It turns out both label implementations use the same ids, but EFI encodes them as GUIDs and CXL labels encode them as UUIDs. For now abstract out the claim class such that the UUID vs GUID distinction can later be hidden in the helper. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982116719.1124374.9917866609080940364.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 8b03aa0e0e5aea61d5a7fc6434faba2a05a6095b Author: Dan Williams Date: Tue Aug 24 09:06:02 2021 -0700 libnvdimm/labels: Add type-guid helpers In preparation for CXL label support, which does not have the type-guid concept, wrap the existing users with nsl_set_type_guid, and nsl_validate_type_guid. Recall that the type-guid is a value in the ACPI NFIT table to indicate how the memory range is used / should be presented to upper layers. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982116208.1124374.13938280892226800953.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit de8fa48b9a281e69f944c58ae2adbd8a277787a6 Author: Dan Williams Date: Tue Aug 24 09:05:57 2021 -0700 libnvdimm/labels: Add blk special cases for nlabel and position helpers In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. Finish off the BLK-mode specific helper conversion with the nlabel and position behaviour that is specific to EFI v1.2 labels and not the original v1.1 definition. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982115698.1124374.10182273478536799613.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit f56541a7122c68ef3074e41c2cb14182eb11d3a5 Author: Dan Williams Date: Tue Aug 24 09:05:51 2021 -0700 libnvdimm/labels: Add blk isetcookie set / validation helpers In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. Given BLK-mode is not even supported on CXL push hide the BLK-mode specific details inside the helpers. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982115185.1124374.13459190993792729776.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 7cd35b2920500908eb3d9d00939f2aea3e8f8361 Author: Dan Williams Date: Tue Aug 24 09:05:46 2021 -0700 libnvdimm/labels: Add a checksum calculation helper In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. CXL labels support checksums by default, but early versions of the EFI labels did not. Add a validate function that can return true in the case the label format does not implement a checksum. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982114637.1124374.6966639787307077105.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 8176f147891258a8eb42bf5579fa344fef34e5bc Author: Dan Williams Date: Tue Aug 24 09:05:41 2021 -0700 libnvdimm/labels: Introduce label setter helpers In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. Reported-by: kernel test robot Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982114123.1124374.17153270107594686116.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit 9761b02d40de4b7f9f4947f801b69993817883ee Author: Dan Williams Date: Tue Aug 24 09:05:35 2021 -0700 libnvdimm/labels: Add isetcookie validation helper In preparation to handle CXL labels with the same code that handles EFI labels, add a specific interleave-set-cookie validation helper rather than a getter since the CXL label type does not support this concept. The answer for CXL labels will always be true. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982113550.1124374.206762177785773038.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit b4366a827f6cf6e58c93e076e335d9ee9ee0480f Author: Dan Williams Date: Tue Aug 24 09:05:30 2021 -0700 libnvdimm/labels: Introduce getters for namespace label fields In preparation for LIBNVDIMM to manage labels on CXL devices deploy helpers that abstract the label type from the implementation. The CXL label format is mostly similar to the EFI label format with concepts / fields added, like dynamic region creation and label type guids, and other concepts removed like BLK-mode and interleave-set-cookie ids. In addition to nsl_get_* helpers there is the nsl_ref_name() helper that returns a pointer to a label field rather than copying the data. Where changes touch the old whitespace style, update to clang-format expectations. Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/162982113002.1124374.15922077050771304490.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams commit a90ec84837325df4b9a6798c2cc0df202b5680bd Author: Vinicius Costa Gomes Date: Mon Jul 26 20:36:57 2021 -0700 igc: Add support for PTP getcrosststamp() i225 supports PCIe Precision Time Measurement (PTM), allowing us to support the PTP_SYS_OFFSET_PRECISE ioctl() in the driver via the getcrosststamp() function. The easiest way to expose the PTM registers would be to configure the PTM dialogs to run periodically, but the PTP_SYS_OFFSET_PRECISE ioctl() semantics are more aligned to using a kind of "one-shot" way of retrieving the PTM timestamps. But this causes a bit more code to be written: the trigger registers for the PTM dialogs are not cleared automatically. i225 can be configured to send "fake" packets with the PTM information, adding support for handling these types of packets is left for the future. PTM improves the accuracy of time synchronization, for example, using phc2sys, while a simple application is sending packets as fast as possible. First, without .getcrosststamp(): phc2sys[191.382]: enp4s0 sys offset -959 s2 freq -454 delay 4492 phc2sys[191.482]: enp4s0 sys offset 798 s2 freq +1015 delay 4069 phc2sys[191.583]: enp4s0 sys offset 962 s2 freq +1418 delay 3849 phc2sys[191.683]: enp4s0 sys offset 924 s2 freq +1669 delay 3753 phc2sys[191.783]: enp4s0 sys offset 664 s2 freq +1686 delay 3349 phc2sys[191.883]: enp4s0 sys offset 218 s2 freq +1439 delay 2585 phc2sys[191.983]: enp4s0 sys offset 761 s2 freq +2048 delay 3750 phc2sys[192.083]: enp4s0 sys offset 756 s2 freq +2271 delay 4061 phc2sys[192.183]: enp4s0 sys offset 809 s2 freq +2551 delay 4384 phc2sys[192.283]: enp4s0 sys offset -108 s2 freq +1877 delay 2480 phc2sys[192.383]: enp4s0 sys offset -1145 s2 freq +807 delay 4438 phc2sys[192.484]: enp4s0 sys offset 571 s2 freq +2180 delay 3849 phc2sys[192.584]: enp4s0 sys offset 241 s2 freq +2021 delay 3389 phc2sys[192.684]: enp4s0 sys offset 405 s2 freq +2257 delay 3829 phc2sys[192.784]: enp4s0 sys offset 17 s2 freq +1991 delay 3273 phc2sys[192.884]: enp4s0 sys offset 152 s2 freq +2131 delay 3948 phc2sys[192.984]: enp4s0 sys offset -187 s2 freq +1837 delay 3162 phc2sys[193.084]: enp4s0 sys offset -1595 s2 freq +373 delay 4557 phc2sys[193.184]: enp4s0 sys offset 107 s2 freq +1597 delay 3740 phc2sys[193.284]: enp4s0 sys offset 199 s2 freq +1721 delay 4010 phc2sys[193.385]: enp4s0 sys offset -169 s2 freq +1413 delay 3701 phc2sys[193.485]: enp4s0 sys offset -47 s2 freq +1484 delay 3581 phc2sys[193.585]: enp4s0 sys offset -65 s2 freq +1452 delay 3778 phc2sys[193.685]: enp4s0 sys offset 95 s2 freq +1592 delay 3888 phc2sys[193.785]: enp4s0 sys offset 206 s2 freq +1732 delay 4445 phc2sys[193.885]: enp4s0 sys offset -652 s2 freq +936 delay 2521 phc2sys[193.985]: enp4s0 sys offset -203 s2 freq +1189 delay 3391 phc2sys[194.085]: enp4s0 sys offset -376 s2 freq +955 delay 2951 phc2sys[194.185]: enp4s0 sys offset -134 s2 freq +1084 delay 3330 phc2sys[194.285]: enp4s0 sys offset -22 s2 freq +1156 delay 3479 phc2sys[194.386]: enp4s0 sys offset 32 s2 freq +1204 delay 3602 phc2sys[194.486]: enp4s0 sys offset 122 s2 freq +1303 delay 3731 Statistics for this run (total of 2179 lines), in nanoseconds: average: -1.12 stdev: 634.80 max: 1551 min: -2215 With .getcrosststamp() via PCIe PTM: phc2sys[367.859]: enp4s0 sys offset 6 s2 freq +1727 delay 0 phc2sys[367.959]: enp4s0 sys offset -2 s2 freq +1721 delay 0 phc2sys[368.059]: enp4s0 sys offset 5 s2 freq +1727 delay 0 phc2sys[368.160]: enp4s0 sys offset -1 s2 freq +1723 delay 0 phc2sys[368.260]: enp4s0 sys offset -4 s2 freq +1719 delay 0 phc2sys[368.360]: enp4s0 sys offset -5 s2 freq +1717 delay 0 phc2sys[368.460]: enp4s0 sys offset 1 s2 freq +1722 delay 0 phc2sys[368.560]: enp4s0 sys offset -3 s2 freq +1718 delay 0 phc2sys[368.660]: enp4s0 sys offset 5 s2 freq +1725 delay 0 phc2sys[368.760]: enp4s0 sys offset -1 s2 freq +1721 delay 0 phc2sys[368.860]: enp4s0 sys offset 0 s2 freq +1721 delay 0 phc2sys[368.960]: enp4s0 sys offset 0 s2 freq +1721 delay 0 phc2sys[369.061]: enp4s0 sys offset 4 s2 freq +1725 delay 0 phc2sys[369.161]: enp4s0 sys offset 1 s2 freq +1724 delay 0 phc2sys[369.261]: enp4s0 sys offset 4 s2 freq +1727 delay 0 phc2sys[369.361]: enp4s0 sys offset 8 s2 freq +1732 delay 0 phc2sys[369.461]: enp4s0 sys offset 7 s2 freq +1733 delay 0 phc2sys[369.561]: enp4s0 sys offset 4 s2 freq +1733 delay 0 phc2sys[369.661]: enp4s0 sys offset 1 s2 freq +1731 delay 0 phc2sys[369.761]: enp4s0 sys offset 1 s2 freq +1731 delay 0 phc2sys[369.861]: enp4s0 sys offset -5 s2 freq +1725 delay 0 phc2sys[369.961]: enp4s0 sys offset -4 s2 freq +1725 delay 0 phc2sys[370.062]: enp4s0 sys offset 2 s2 freq +1730 delay 0 phc2sys[370.162]: enp4s0 sys offset -7 s2 freq +1721 delay 0 phc2sys[370.262]: enp4s0 sys offset -3 s2 freq +1723 delay 0 phc2sys[370.362]: enp4s0 sys offset 1 s2 freq +1726 delay 0 phc2sys[370.462]: enp4s0 sys offset -3 s2 freq +1723 delay 0 phc2sys[370.562]: enp4s0 sys offset -1 s2 freq +1724 delay 0 phc2sys[370.662]: enp4s0 sys offset -4 s2 freq +1720 delay 0 phc2sys[370.762]: enp4s0 sys offset -7 s2 freq +1716 delay 0 phc2sys[370.862]: enp4s0 sys offset -2 s2 freq +1719 delay 0 Statistics for this run (total of 2179 lines), in nanoseconds: average: 0.14 stdev: 5.03 max: 48 min: -27 For reference, the statistics for runs without PCIe congestion show that the improvements from enabling PTM are less dramatic. For two runs of 16466 entries: without PTM: avg -0.04 stdev 10.57 max 39 min -42 with PTM: avg 0.01 stdev 4.20 max 19 min -16 One possible explanation is that when PTM is not enabled, and there's a lot of traffic in the PCIe fabric, some register reads will take more time than the others because of congestion on the PCIe fabric. When PTM is enabled, even if the PTM dialogs take more time to complete under heavy traffic, the time measurements do not depend on the time to read the registers. This was implemented following the i225 EAS version 0.993. Signed-off-by: Vinicius Costa Gomes Tested-by: Dvora Fuxbrumer Signed-off-by: Tony Nguyen commit 1b5d73fb862414106cf270a1a7300ce8ae77de83 Author: Vinicius Costa Gomes Date: Mon Jul 26 20:36:56 2021 -0700 igc: Enable PCIe PTM Enables PCIe PTM (Precision Time Measurement) support in the igc driver. Notifies the PCI devices that PCIe PTM should be enabled. PCIe PTM is similar protocol to PTP (Precision Time Protocol) running in the PCIe fabric, it allows devices to report time measurements from their internal clocks and the correlation with the PCIe root clock. The i225 NIC exposes some registers that expose those time measurements, those registers will be used, in later patches, to implement the PTP_SYS_OFFSET_PRECISE ioctl(). Signed-off-by: Vinicius Costa Gomes Tested-by: Dvora Fuxbrumer Signed-off-by: Tony Nguyen commit 890317950fcaafbc16372d1b9855bcadf0fc5843 Author: Heiner Kallweit Date: Sun Aug 22 16:01:08 2021 +0200 scsi: cxlflash: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Link: https://lore.kernel.org/r/b5f71c97-61fb-86cb-6bec-84b042392ce7@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit fc9279298e3a903dce511caa5fe9eda298a7949e Author: Heiner Kallweit Date: Sun Aug 22 15:59:21 2021 +0200 cxgb4: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Link: https://lore.kernel.org/r/db576a3e-e877-b37b-98ed-cfc03d225ab3@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit f9f3caa8dcd73a145861b69cc1f4bcd1b6fb0f81 Author: Heiner Kallweit Date: Sun Aug 22 15:58:26 2021 +0200 cxgb4: Remove unused vpd_param member ec Member ec isn't used, so remove it. Link: https://lore.kernel.org/r/30648e95-bfb9-9af3-0c8f-dd3e34df8b6b@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 52f0a1e007703a99d77cc43fcb8661158d86c861 Author: Heiner Kallweit Date: Sun Aug 22 15:57:27 2021 +0200 cxgb4: Validate VPD checksum with pci_vpd_check_csum() Validate the VPD checksum with pci_vpd_check_csum() to simplify the code. Link: https://lore.kernel.org/r/70404ece-0036-c0ce-f824-f5637e54115e@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 0ff25f6a17c76d50e5d4bdd29bb69ad173a3cde1 Author: Heiner Kallweit Date: Sun Aug 22 15:56:24 2021 +0200 bnxt: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Link: https://lore.kernel.org/r/f062921c-ad33-3b3e-8ada-b53427a9cd4a@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 550cd7c1b45b568ccac28fd46663799f1ff8a62d Author: Heiner Kallweit Date: Sun Aug 22 15:55:23 2021 +0200 bnxt: Read VPD with pci_vpd_alloc() Use pci_vpd_alloc() to dynamically allocate a properly sized buffer and read the full VPD data into it. This simplifies the code, and we no longer have to make assumptions about VPD size. Link: https://lore.kernel.org/r/62522a24-f39a-2b35-1577-1fbb41695bed@gmail.com Reported-by: kernel test robot Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 1d070108354b6c77a41931b16e8007255b70f90b Merge: e73f0f0ee7541 c0c81245dac7c Author: Stephen Boyd Date: Tue Aug 24 11:40:25 2021 -0700 Merge tag 'v5.15-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - YAML conversion of rk3399 clock controller binding - Removal of GRF dependency for the rk3328/rk3036 pll types - some clock tree fixes * tag 'v5.15-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: make rk3308 ddrphy4x clock critical clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types dt-bindings: clk: Convert rockchip,rk3399-cru to DT schema clk: rockchip: Add support for hclk_sfc on rk3036 clk: rockchip: rk3036: fix up the sclk_sfc parent error clk: rockchip: add dt-binding clkid for hclk_sfc on rk3036 commit 3831cba07a4bf96bc75fb963451a49d7f676c7d6 Author: Heiner Kallweit Date: Sun Aug 22 15:54:23 2021 +0200 bnx2x: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Use strncasecmp() to match Vendor ID instead of comparing with lower- and upper-case hex string. [bhelgaas: convert to strncasecmp()] Link: https://lore.kernel.org/r/a9f730cf-e31e-902b-7b39-0ff2e99636e0@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 923ba4604a9be794e4ef4911f6c5e15b4bb39b3f Merge: e73f0f0ee7541 faa8605f9f92e Author: Stephen Boyd Date: Tue Aug 24 11:39:04 2021 -0700 Merge tag 'for-5.15-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into clk-nvidia Pull a Tegra clk driver cleanup from Thierry Reding: The FUSE driver has been updated to take manual control of the FUSE clock over suspend/resume cycles, so the CLK_IS_CRITICAL flag can now be dropped. * tag 'for-5.15-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: clk: tegra: Remove CLK_IS_CRITICAL flag from fuse clock soc/tegra: fuse: Enable fuse clock on suspend for Tegra124 soc/tegra: fuse: Add runtime PM support soc/tegra: fuse: Clear fuse->clk on driver probe failure soc/tegra: pmc: Prevent racing with cpuilde driver soc/tegra: bpmp: Remove unused including commit a1cde1f0172eefe55c97310b27aca2076fdaff01 Merge: 5f1fc9726ff79 e8425dd55abb1 Author: Stephen Boyd Date: Tue Aug 24 11:37:53 2021 -0700 Merge tag 'renesas-clk-for-v5.15-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull more Renesas clk driver updates from Geert Uytterhoeven: - Make CLK_R9A06G032 invisible * tag 'renesas-clk-for-v5.15-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: Make CLK_R9A06G032 invisible commit 014408cd624e9fd2820f4a593b710325ee05fec9 Author: Vinicius Costa Gomes Date: Mon Jul 26 20:36:55 2021 -0700 PCI: Add pcie_ptm_enabled() Add a predicate that returns if PCIe PTM (Precision Time Measurement) is enabled. It will only return true if it's enabled in all the ports in the path from the device to the root. Signed-off-by: Vinicius Costa Gomes Acked-by: Bjorn Helgaas Signed-off-by: Tony Nguyen commit 8c85bdafdd307fb4b5a3f6f2de9720684239a37d Author: Krzysztof Kozlowski Date: Fri Aug 20 17:03:50 2021 +0200 dt-bindings: devfreq: event: convert Samsung Exynos NoCP to dtschema Convert Samsung Exynos NoC Probe bindings to DT schema format using json-schema. New bindings contain copied description from previous bindings document, therefore the license is set as GPL-2.0-only. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210820150353.161161-1-krzysztof.kozlowski@canonical.com Signed-off-by: Rob Herring commit 90e7a6de62781c27d6a111fccfb19b807f9b6887 Author: Maor Gottlieb Date: Tue Aug 24 17:25:29 2021 +0300 lib/scatterlist: Provide a dedicated function to support table append RDMA is the only in-kernel user that uses __sg_alloc_table_from_pages to append pages dynamically. In the next patch. That mode will be extended and that function will get more parameters. So separate it into a unique function to make such change more clear. Link: https://lore.kernel.org/r/20210824142531.3877007-2-maorg@nvidia.com Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit f674aacd5005184acf3cf7b851a299573d64fdd6 Author: Chunyan Zhang Date: Tue Aug 24 15:02:12 2021 +0800 spi: sprd: fill offset only to RD_CMD register for reading from slave device RD_CMD can accept slave address offset only, higher bits are reserved. Writing the whole slave address including slave base seems unnecessary. Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20210824070212.2089255-3-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 2b961c51f4d35c45116b21936b563cbb78fba540 Author: Chunyan Zhang Date: Tue Aug 24 15:02:11 2021 +0800 spi: sprd: Make sure offset not equal to slave address size The slave register offset shouldn't equal to the max slave address which ADI can support to access. Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20210824070212.2089255-2-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 5dc349ec131c6d40aeb2545064e285f0025fbb39 Author: Chunyan Zhang Date: Tue Aug 24 15:02:10 2021 +0800 spi: sprd: Pass offset instead of physical address to adi_read/_write() The register offset would be added a physical address base and then pass to the function sprd_adt_read()/_write() each time before calling them. So we can do that within these two functions instead, that would make the code more clear. Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20210824070212.2089255-1-zhang.lyra@gmail.com Signed-off-by: Mark Brown commit 0be10d7122ceb8f322086283420a59ee89c1947f Author: Changcheng Deng Date: Mon Aug 23 20:00:15 2021 -0700 ASoC: SOF: intel: remove duplicate include Clean up the following includecheck warning: ./sound/soc/sof/intel/pci-tng.c: shim.h is included more than once. No functional change. Reported-by: Zeal Robot Signed-off-by: Changcheng Deng Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20210824030015.57267-1-deng.changcheng@zte.com.cn Signed-off-by: Mark Brown commit 86956e70761b3292156d668e87126844334dd71b Author: Tony Krowiak Date: Mon Aug 23 17:20:47 2021 -0400 s390/vfio-ap: replace open coded locks for VFIO_GROUP_NOTIFY_SET_KVM notification It was pointed out during an unrelated patch review that locks should not be open coded - i.e., writing the algorithm of a standard lock in a function instead of using a lock from the standard library. The setting and testing of a busy flag and sleeping on a wait_event is the same thing a lock does. The open coded locks are invisible to lockdep, so potential locking problems are not detected. This patch removes the open coded locks used during VFIO_GROUP_NOTIFY_SET_KVM notification. The busy flag and wait queue were introduced to resolve a possible circular locking dependency reported by lockdep when starting a secure execution guest configured with AP adapters and domains. Reversing the order in which the kvm->lock mutex and matrix_dev->lock mutex are locked resolves the issue reported by lockdep, thus enabling the removal of the open coded locks. Signed-off-by: Tony Krowiak Acked-by: Halil Pasic Link: https://lore.kernel.org/r/20210823212047.1476436-3-akrowiak@linux.ibm.com Signed-off-by: Alex Williamson commit 1e753732bda6dcf888ea0b90b2a91ac1c1a0bae9 Author: Tony Krowiak Date: Mon Aug 23 17:20:46 2021 -0400 s390/vfio-ap: r/w lock for PQAP interception handler function pointer The function pointer to the interception handler for the PQAP instruction can get changed during the interception process. Let's add a semaphore to struct kvm_s390_crypto to control read/write access to the function pointer contained therein. The semaphore must be locked for write access by the vfio_ap device driver when notified that the KVM pointer has been set or cleared. It must be locked for read access by the interception framework when the PQAP instruction is intercepted. Signed-off-by: Tony Krowiak Reviewed-by: Jason Gunthorpe Reviewed-by: Christian Borntraeger Link: https://lore.kernel.org/r/20210823212047.1476436-2-akrowiak@linux.ibm.com Signed-off-by: Alex Williamson commit 5f8c991e8950971cd1f81b61f79c83a511ad9fc8 Author: Trevor Wu Date: Thu Aug 19 16:41:44 2021 +0800 dt-bindings: mediatek: mt8195: add mt8195-mt6359-rt1019-rt5682 document This patch adds document for mt8195 board with mt6359, rt1019 and rt5682 Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-12-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit ef46cd42ecf00f0468df3ad1bf0f30db9634a04a Author: Trevor Wu Date: Thu Aug 19 16:41:43 2021 +0800 ASoC: mediatek: mt8195: add HDMITX audio support This patch adds HDMITX audio support on mt8195-mt6359-rt1019-rt5682 board. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-11-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit e581e3014cc4acee9025aa5704cf85a36a572b95 Author: Trevor Wu Date: Thu Aug 19 16:41:42 2021 +0800 ASoC: mediatek: mt8195: add DPTX audio support This patch adds DPTX audio support on mt8195-mt6359-rt1019-rt5682 board. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-10-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 40d605df0a7bf7723ed690f502f364c5320de440 Author: Trevor Wu Date: Thu Aug 19 16:41:41 2021 +0800 ASoC: mediatek: mt8195: add machine driver with mt6359, rt1019 and rt5682 This patch adds support for mt8195 board with mt6359, rt1019 and rt5682. Signed-off-by: Trevor Wu Reported-by: kernel test robot Link: https://lore.kernel.org/r/20210819084144.18483-9-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit b5bac34fcfb444e33f532e291ad1394ca05887e8 Author: Trevor Wu Date: Thu Aug 19 16:41:40 2021 +0800 dt-bindings: mediatek: mt8195: add audio afe document This patch adds mt8195 audio afe document. In order to support dynamic clock reparenting for ADDA and ETDM, PLL and MUX clocks are requested even though they are not consumed by afe directly. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-8-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 6746cc858259985a945a07075a19ec4d24352407 Author: Trevor Wu Date: Thu Aug 19 16:41:39 2021 +0800 ASoC: mediatek: mt8195: add platform driver This patch adds mt8195 platform and affiliated driver. Signed-off-by: Trevor Wu Reported-by: kernel test robot Link: https://lore.kernel.org/r/20210819084144.18483-7-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 1f95c019115cc503c4c47fd7108675a56cdb29b4 Author: Trevor Wu Date: Thu Aug 19 16:41:38 2021 +0800 ASoC: mediatek: mt8195: support pcm in platform driver This patch adds mt8195 pcm dai driver. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-6-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 3de3eba588bb7f6c39bf12de5761ff75c53b9961 Author: Trevor Wu Date: Thu Aug 19 16:41:37 2021 +0800 ASoC: mediatek: mt8195: support adda in platform driver This patch adds mt8195 adda dai driver. audio_h clock is used by ADSP bus and ADDA module. When ADDA requires audio_h clock, it is switched to APLL1, otherwise it is switched to Xtal_26m so that APLL1 can be turned off when audio feature is not used. ADSP bus only requires that the clock is on, so dynamic reparenting is used for the purpose of lowering power consumption. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-5-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 1de9a54acafba2f0e3ea2856ad0b22556d59ec45 Author: Trevor Wu Date: Thu Aug 19 16:41:36 2021 +0800 ASoC: mediatek: mt8195: support etdm in platform driver This patch adds mt8195 tdm/i2s dai driver. MCLK clock tree is as follows. PLL -> MUX -> DIVIDER -> MCLK For PLL source of MCLK, driver only supports APLL1 and APLL2 now. APLL3 and APLL4 are used to track external clock source, so they are only used when slave input is connected. For example, case 1: (HDMI RX connected) DL memif (a1sys) -> etdm out2 (clk from apll1/apll2) -> codec case 2: (HDMI RX disconnected) HDMI RX -> a3sys -> UL memif (a3sys) -> DL memif (a3sys) -> .... -> etdm out2 (clk from apll3) -> codec We keep all modules in the pipeline working on the same clock domain. MCLK is expected to output the clock generated from the same clock source as the pipeline, so dynamic reparenting is required for MCLK configuration. As a result, clk_set_parent() is used to select PLL source, and clk_set_rate() is used to configure divider to get MCLK output rate. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-4-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit d62ad762f67585acfb5e03f71b28a52dc4604cf2 Author: Trevor Wu Date: Thu Aug 19 16:41:35 2021 +0800 ASoC: mediatek: mt8195: support audsys clock control This patch adds mt8195 audio cg control. Audio clock gates are registered to CCF for reference count and clock parent management. Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20210819084144.18483-3-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit cab2b9e5fc0e868ed8453ef4f433c795bda8bf84 Author: Trevor Wu Date: Thu Aug 19 16:41:34 2021 +0800 ASoC: mediatek: mt8195: update mediatek common driver Update mediatek common driver to support MT8195 Signed-off-by: Trevor Wu Reported-by: kernel test robot Link: https://lore.kernel.org/r/20210819084144.18483-2-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit e6d0b92ac00b53121a35b2a1ce8d393dc9179fdf Author: Charles Keepax Date: Tue Aug 24 11:15:52 2021 +0100 ASoC: wm_adsp: Put debugfs_remove_recursive back in This patch reverts commit acbf58e53041 ("ASoC: wm_adsp: Let soc_cleanup_component_debugfs remove debugfs"), and adds an alternate solution to the issue. That patch removes the call to debugfs_remove_recursive, which cleans up the DSPs debugfs. The intention was to avoid an unbinding issue on an out of tree driver/platform. The issue with the patch is it means the driver no longer cleans up its own debugfs, instead relying on ASoC to remove recurive on the parent debugfs node. This is conceptually rather unclean, but also it would prevent DSPs being added/removed independently of ASoC and soon we are going to be upstreaming some non-audio parts with these DSPs, which will require this. Finally, it seems the issue on the platform is a result of the wm_adsp2_cleanup_debugfs getting called twice. This is very likely a problem on the platform side and will be resolved there. But in the mean time make the code a little more robust to such issues, and again conceptually a bit nicer, but clearing the debugfs_root variable in the DSP structure when the debugfs is removed. Fixes: acbf58e53041 ("ASoC: wm_adsp: Let soc_cleanup_component_debugfs remove debugfs" Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20210824101552.1119-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit ffc95d1b8edb80d2dab77f2e8a823c8d93b06419 Author: Anthony Yznaga Date: Mon Aug 23 09:35:50 2021 -0700 vfio/type1: Fix vfio_find_dma_valid return vfio_find_dma_valid is defined to return WAITED on success if it was necessary to wait. However, the loop forgets the WAITED value returned by vfio_wait() and returns 0 in a later iteration. Fix it. Signed-off-by: Anthony Yznaga Reviewed-by: Steve Sistare Link: https://lore.kernel.org/r/1629736550-2388-1-git-send-email-anthony.yznaga@oracle.com Signed-off-by: Alex Williamson commit 37c3193fa4d7ddf93947264fa38d71120ff20c2a Author: Shunsuke Nakamura Date: Fri Aug 20 18:39:07 2021 +0900 libperf tests: Fix verbose printing libperf's verbose printing checks the -v option every time the macro _T_ START is called. Since there are currently four libperf tests registered, the macro _T_ START is called four times, but verbose printing after the second time is not output. Resets the index of the element processed by getopt() and fix verbose printing so that it prints in all tests. Signed-off-by: Shunsuke Nakamura Acked-by: Rob Herring Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20210820093908.734503-3-nakamura.shun@fujitsu.com Signed-off-by: Arnaldo Carvalho de Melo commit 29848a034ac749622f5ef4686f9e48d69254f4dc Author: Cai Huoqing Date: Tue Aug 24 08:37:49 2021 +0800 vfio-pci/zdev: Remove repeated verbose license text The SPDX and verbose license text are redundant, however in this case the verbose license indicates a GPL v2 only while SPDX specifies v2+. Remove the verbose license and correct SPDX to the more restricted version. Signed-off-by: Cai Huoqing Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/r/20210824003749.1039-1-caihuoqing@baidu.com [aw: commit log] Signed-off-by: Alex Williamson commit ce73af80876dba7b855fe36d1ec473f77300c214 Author: Nghia Le Date: Tue Aug 24 15:59:47 2021 +0700 perf tools: Add missing newline at the end of header file Add missing newline at the end of file parse-sublevel-options.h. Thus removing relevant warning reported by checkpatch. Signed-off-by: Nghia Le Reviewed-by: Lukas Bulwahn Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http //lore.kernel.org/lkml/20210824085947.224062-1-nghialm78@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit ab78130e6e99e74c2c6d5670fa3e7f290e07c2c5 Author: Cai Huoqing Date: Sun Aug 22 12:36:43 2021 +0800 vfio: platform: reset: Convert to SPDX identifier use SPDX-License-Identifier instead of a verbose license text Signed-off-by: Cai Huoqing Link: https://lore.kernel.org/r/20210822043643.2040-1-caihuoqing@baidu.com Signed-off-by: Alex Williamson commit 1d71eb53e45187f58089d32b51e27784c791d90e Author: Vinicius Costa Gomes Date: Mon Jul 26 20:36:54 2021 -0700 Revert "PCI: Make pci_enable_ptm() private" Make pci_enable_ptm() accessible from the drivers. Exposing this to the driver enables the driver to use the 'ptm_enabled' field of 'pci_dev' to check if PTM is enabled or not. This reverts commit ac6c26da29c1 ("PCI: Make pci_enable_ptm() private"). Signed-off-by: Vinicius Costa Gomes Acked-by: Bjorn Helgaas Signed-off-by: Tony Nguyen commit df87589475e73b9e34369a075b6b5375f0daa7d6 Author: Heiner Kallweit Date: Sun Aug 22 15:53:23 2021 +0200 bnx2x: Read VPD with pci_vpd_alloc() Use pci_vpd_alloc() to dynamically allocate a properly sized buffer and read the full VPD data into it. This simplifies the code, and we no longer have to make assumptions about VPD size. Link: https://lore.kernel.org/r/821a334d-ff9d-386e-5f42-9b620ab3dbfa@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 35e7f1be7972be8da9d0a37bd89bcc4b990c6e67 Author: Heiner Kallweit Date: Sun Aug 22 15:52:01 2021 +0200 bnx2: Replace open-coded byte swapping with swab32s() Read NVRAM directly into buffer and use swab32s() to byte swap it in-place instead of reading it into the end of the buffer and swapping it manually while copying it. [bhelgaas: commit log] Link: https://lore.kernel.org/r/e4ac6229-1df5-8760-3a87-1ad0ace87137@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 1a41fdb805705251fc61715167cadc0829de587a Author: Heiner Kallweit Date: Sun Aug 22 15:50:50 2021 +0200 bnx2: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Link: https://lore.kernel.org/r/7ca2b8b5-4c94-f644-1d80-b2ffb8df2d05@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 2d57dd6673a87ea23d8660257162d6280fe7b2e6 Author: Heiner Kallweit Date: Sun Aug 22 15:49:36 2021 +0200 sfc: falcon: Search VPD with pci_vpd_find_ro_info_keyword() Use pci_vpd_find_ro_info_keyword() to search for keywords in VPD to simplify the code. Replace netif_err() with pci_err() because the netdevice isn't registered yet, which results in very ugly messages. Use kmemdup_nul() instead of open-coding it. This is the same as 37838aa437c7 ("sfc: Search VPD with pci_vpd_find_ro_info_keyword()"), just for the falcon chip version. Link: https://lore.kernel.org/r/898282a1-13bd-17bc-2e9a-d3dcd336b46c@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 667bb0e8f7106c6ca3b30254a7fdcd1ea04d3580 Author: Heiner Kallweit Date: Sun Aug 22 15:48:33 2021 +0200 sfc: falcon: Read VPD with pci_vpd_alloc() Use pci_vpd_alloc() to dynamically allocate a properly sized buffer and read the full VPD data into it. This avoids having to allocate a buffer on the stack, and we don't have to make any assumptions on VPD size and location of information in VPD. This is the same as 5119e20facfa ("sfc: Read VPD with pci_vpd_alloc()"), just for the falcon chip version. Link: https://lore.kernel.org/r/2a8d069e-9516-50d8-6520-2614222c8f5f@gmail.com Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 Author: Niklas Cassel Date: Wed Aug 11 11:05:19 2021 +0000 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN A user space process should not need the CAP_SYS_ADMIN capability set in order to perform a BLKREPORTZONE ioctl. Getting the zone report is required in order to get the write pointer. Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable that a user space process that can read/write from/to the device, also can get the write pointer. (Since e.g. writes have to be at the write pointer.) Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls") Signed-off-by: Niklas Cassel Reviewed-by: Damien Le Moal Reviewed-by: Aravind Ramesh Reviewed-by: Adam Manzanares Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Cc: stable@vger.kernel.org # v4.10+ Link: https://lore.kernel.org/r/20210811110505.29649-3-Niklas.Cassel@wdc.com Signed-off-by: Jens Axboe commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 Author: Niklas Cassel Date: Wed Aug 11 11:05:18 2021 +0000 blk-zoned: allow zone management send operations without CAP_SYS_ADMIN Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissions as write(). (write() does not require CAP_SYS_ADMIN). Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if the fd was successfully opened with FMODE_WRITE. (They do not require CAP_SYS_ADMIN). Currently, zone management send operations require both CAP_SYS_ADMIN and that the fd was successfully opened with FMODE_WRITE. Remove the CAP_SYS_ADMIN requirement, so that zone management send operations match the access control requirement of write(), BLKSECDISCARD and BLKZEROOUT. Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls") Signed-off-by: Niklas Cassel Reviewed-by: Damien Le Moal Reviewed-by: Aravind Ramesh Reviewed-by: Adam Manzanares Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Cc: stable@vger.kernel.org # v4.10+ Link: https://lore.kernel.org/r/20210811110505.29649-2-Niklas.Cassel@wdc.com Signed-off-by: Jens Axboe commit 62283c6c9d4c1018badcd0b9c5b6ca66d978fa0d Author: Jing Yangyang Date: Mon Aug 23 23:07:02 2021 -0700 include:libata: fix boolreturn.cocci warnings ./include/linux/libata.h:1462:8-9:WARNING: return of 0/1 in function 'ata_is_host_link' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Reported-by: Zeal Robot Signed-off-by: Jing Yangyang Link: https://lore.kernel.org/r/20210824060702.59006-1-deng.changcheng@zte.com.cn Signed-off-by: Jens Axboe commit 158ee7b65653d9f841823c249014c2d0dfdeeb8f Author: Christoph Hellwig Date: Tue Aug 24 17:18:23 2021 +0200 block: mark blkdev_fsync static blkdev_fsync is only used inside of block_dev.c since the removal of the raw drіver. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210824151823.1575100-1-hch@lst.de Signed-off-by: Jens Axboe commit 9f2869921f2a102e209297d4f742f34b46ed3d36 Author: Christoph Hellwig Date: Tue Aug 24 16:43:10 2021 +0200 block: refine the disk_live check in del_gendisk hidden gendisks will never be marked live. Fixes: 40b3a52ffc5b ("block: add a sanity check for a live disk in del_gendisk") Reported-by: Bruno Goncalves Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210824144310.1487816-1-hch@lst.de Signed-off-by: Jens Axboe commit 1743fa54c9e8247000e060fcdab406ab3a808223 Author: Dmitry Osipenko Date: Fri Aug 20 03:45:36 2021 +0300 mmc: sdhci-tegra: Enable MMC_CAP2_ALT_GPT_TEGRA Tegra20/30/114/124 Android devices place GPT at a non-standard location. Enable GPT entry scanning at that location. Signed-off-by: Dmitry Osipenko Acked-by: Thierry Reding Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20210820004536.15791-5-digetx@gmail.com Signed-off-by: Jens Axboe commit dc913385dd74e625271482c30aefedd1e5af7b8c Author: Dmitry Osipenko Date: Fri Aug 20 03:45:35 2021 +0300 mmc: block: Support alternative_gpt_sector() operation Support generic alternative_gpt_sector() block device operation. It calculates location of GPT entry for eMMC of NVIDIA Tegra Android devices. Add new MMC_CAP2_ALT_GPT_TEGRA flag that enables scanning of alternative GPT sector and add raw_boot_mult field to mmc_ext_csd which allows to get size of the boot partitions that is needed for the calculation. Signed-off-by: Dmitry Osipenko Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20210820004536.15791-4-digetx@gmail.com Signed-off-by: Jens Axboe commit 466d9c4904deb25e2e8dcd29d3a998f4e3fa7c17 Author: Dmitry Osipenko Date: Fri Aug 20 03:45:34 2021 +0300 partitions/efi: Support non-standard GPT location Support looking up GPT at a non-standard location specified by a block device driver. Acked-by: Davidlohr Bueso Reviewed-by: Christoph Hellwig Signed-off-by: Dmitry Osipenko Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20210820004536.15791-3-digetx@gmail.com Signed-off-by: Jens Axboe commit 0bdfbca8a623e262e0f343b143151000a300cbaf Author: Dmitry Osipenko Date: Fri Aug 20 03:45:33 2021 +0300 block: Add alternative_gpt_sector() operation Add alternative_gpt_sector() block device operation which specifies alternative location of a GPT entry. This allows us to support Android devices that have GPT entry at a non-standard location and can't be repartitioned easily. Reviewed-by: Christoph Hellwig Suggested-by: Christoph Hellwig Signed-off-by: Dmitry Osipenko Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20210820004536.15791-2-digetx@gmail.com Signed-off-by: Jens Axboe commit 7559b7d7d651d397debbcd838bd49ec4b9e0a4a4 Author: Mark Brown Date: Tue Aug 24 16:34:17 2021 +0100 arm64/sve: Better handle failure to allocate SVE register storage Currently we "handle" failure to allocate the SVE register storage by doing a BUG_ON() and hoping for the best. This is obviously not great and the memory allocation failure will already be loud enough without the BUG_ON(). As the comment says it is a corner case but let's try to do a bit better, remove the BUG_ON() and add code to handle the failure in the callers. For the ptrace and signal code we can return -ENOMEM gracefully however we have no real error reporting path available to us for the SVE access trap so instead generate a SIGKILL if the allocation fails there. This at least means that we won't try to soldier on and end up trying to access the nonexistant state and while it's obviously not ideal for userspace SIGKILL doesn't allow any handling so minimises the ABI impact, making it easier to improve the interface later if we come up with a better idea. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210824153417.18371-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit e3849765037b85e61b2432ded488ee9fb3ff126d Author: Marc Zyngier Date: Thu Aug 12 20:02:13 2021 +0100 arm64: Document the requirement for SCR_EL3.HCE It is amazing that we never documented this absolutely basic requirement: if you boot the kernel at EL2, you'd better enable the HVC instruction from EL3. Really, just do it. Signed-off-by: Marc Zyngier Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20210812190213.2601506-6-maz@kernel.org Signed-off-by: Catalin Marinas commit 90268574a3e8a6b883bd802d702a2738577e1006 Author: Mark Rutland Date: Mon Aug 23 11:12:53 2021 +0100 arm64: head: avoid over-mapping in map_memory The `compute_indices` and `populate_entries` macros operate on inclusive bounds, and thus the `map_memory` macro which uses them also operates on inclusive bounds. We pass `_end` and `_idmap_text_end` to `map_memory`, but these are exclusive bounds, and if one of these is sufficiently aligned (as a result of kernel configuration, physical placement, and KASLR), then: * In `compute_indices`, the computed `iend` will be in the page/block *after* the final byte of the intended mapping. * In `populate_entries`, an unnecessary entry will be created at the end of each level of table. At the leaf level, this entry will map up to SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend to map. As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may violate the boot protocol and map physical address past the 2MiB-aligned end address we are permitted to map. As we map these with Normal memory attributes, this may result in further problems depending on what these physical addresses correspond to. The final entry at each level may require an additional table at that level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate enough memory for this. Avoid the extraneous mapping by having map_memory convert the exclusive end address to an inclusive end address by subtracting one, and do likewise in EARLY_ENTRIES() when calculating the number of required tables. For clarity, comments are updated to more clearly document which boundaries the macros operate on. For consistency with the other macros, the comments in map_memory are also updated to describe `vstart` and `vend` as virtual addresses. Fixes: 0370b31e4845 ("arm64: Extend early page table code to allow for larger kernels") Cc: # 4.16.x Signed-off-by: Mark Rutland Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Steve Capper Cc: Will Deacon Acked-by: Will Deacon Link: https://lore.kernel.org/r/20210823101253.55567-1-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit 04fa17d1368c1f49801c852aac874d99ba5a6d20 Author: Mark Brown Date: Mon Aug 16 13:50:23 2021 +0100 arm64/sve: Add a comment documenting the binutils needed for SVE asm At some point it would be nice to avoid the need to manually encode SVE instructions, add a note of the binutils version required to save looking it up. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210816125024.8112-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit 38ee3c5e36a134050df93ab911d4713e30a6cde5 Author: Mark Brown Date: Thu Aug 12 21:11:43 2021 +0100 arm64/sve: Add some comments for sve_save/load_state() The use of macros for the actual function bodies means legibility is always going to be a bit of a challenge, especially while we can't rely on SVE support in the toolchain, but this helps a little. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20210812201143.35578-1-broonie@kernel.org Signed-off-by: Catalin Marinas commit fe72d08a961f9e09a7b04c15904a98f7c8cd537e Author: Bean Huo Date: Wed Aug 18 00:42:07 2021 +0200 mmc: core: Issue HPI in case the BKOPS timed out If the BKOPS timed out, the card is probably still busy in the R1_STATE_PRG. Rather than continue as nothing has happened and hitting and error for the next command being sent, let's try to abort the running BKOPS by sending a HPI command to get back into R1_STATE_TRAN. Signed-off-by: Bean Huo Link: https://lore.kernel.org/r/20210817224208.153652-2-huobean@gmail.com Signed-off-by: Ulf Hansson commit f6f607070aa6f0c730c5ca38e888c88f34bea7d6 Author: ChanWoo Lee Date: Tue Aug 24 16:39:34 2021 +0900 mmc: queue: Match the data type of max_segments Each function has a different data type for max_segments, Modify to match unsigned short(host->max_segs). * unsigned short max_segs; /* see blk_queue_max_segments */ 1) Return type : unsigned int static unsigned int mmc_get_max_segments(struct mmc_host *host) { return host->can_dma_map_merge ? MMC_DMA_MAP_MERGE_SEGMENTS : host->max_segs; } 2) Parameter type : int mmc_alloc_sg(mmc_get_max_segments(host), gfp); -> static struct scatterlist *mmc_alloc_sg(int sg_len, gfp_t gfp) 3) Parameter type : unsigned short blk_queue_max_segments(mq->queue, mmc_get_max_segments(host)); -> void blk_queue_max_segments(struct request_queue *q, unsigned short max_segments) Signed-off-by: ChanWoo Lee Acked-by: Coly Li Link: https://lore.kernel.org/r/20210824073934.19727-1-cw9316.lee@samsung.com Signed-off-by: Ulf Hansson commit b048457c54e4dcf3e326ddd4974d5e3d2a74d03b Author: Christophe JAILLET Date: Sun Aug 22 15:48:37 2021 +0200 mmc: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/b617f284e2ab8b6b48fff150eba1638641646edd.1629640046.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 89d74b30f44371c2fc388f7fb172a583977ef0d8 Author: Christophe JAILLET Date: Sat Aug 21 23:13:07 2021 +0200 memstick: switch from 'pci_' to 'dma_' API The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below. It has been compile tested. No memory allocation in involved in this patch, so no GFP_ tweak is needed. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f6fe24f2372c8c627a08ace7187bfe60d35788b6.1629580314.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 2b50c81fb7284d9122b98e8227cd8c6495238bd6 Author: Christophe JAILLET Date: Sat Aug 21 23:17:15 2021 +0200 memstick: r592: Change the name of the 'pci_driver' structure to be consistent This driver is all about r592. Axe the reference to r852 in the 'pci_driver' structure name. This is likely a copy/paste typo left as is when the driver has been created. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/258f76acc73d5c448b9cb5dab4c39d80d517c7a9.1629580585.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 09cedbd8dbc057c07885cfacdcdb09ef4880c5cb Author: Claudiu Beznea Date: Fri Aug 20 12:28:02 2021 +0300 mmc: pwrseq: add wilc1000_sdio dependency for pwrseq_sd8787 pwseq_sd8787 could also be used with wilc1000_sdio driver. Add a dependency for this. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20210820092803.78523-4-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit b2832b96fcf50270d69dae3f95bf14949ff638e4 Author: Claudiu Beznea Date: Fri Aug 20 12:28:01 2021 +0300 mmc: pwrseq: sd8787: add support for wilc1000 Add new compatible for wilc1000 devices and specify the delay in .data member of struct of_device_id. WILC1000, WILC3000 devices needs a minimum of 5ms delay b/w reset and power lines. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20210820092803.78523-3-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit 2c2eaf882f7b4d8bb9a68856eae9cb0b7d77f371 Author: Claudiu Beznea Date: Fri Aug 20 12:28:00 2021 +0300 dt-bindings: mmc: Extend pwrseq-sd8787 binding for wilc1000 Extend the DT bindings to support wilc1000 devices. Signed-off-by: Claudiu Beznea Acked-by: Rob Herring Link: https://lore.kernel.org/r/20210820092803.78523-2-claudiu.beznea@microchip.com Signed-off-by: Ulf Hansson commit 4bdda3db47db079b9b487ea05fd6ca7dbd71c4e7 Author: Haibo Chen Date: Thu Aug 19 19:52:18 2021 +0800 dt-bindings: mmc: fsl-imx-esdhc: change the pinctrl-names rule Change the pinctrl-names rule to cover all cases. Signed-off-by: Haibo Chen Acked-by: Rob Herring Link: https://lore.kernel.org/r/1629373938-9226-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit 3a62c333497b164868fdcd241842a1dd4e331825 Merge: 95d1d2490c278 cce1689eb58d2 Author: Jakub Kicinski Date: Tue Aug 24 07:36:56 2021 -0700 Merge branch 'ethtool-extend-coalesce-uapi' Yufeng Mo says: ==================== ethtool: extend coalesce uAPI In order to support some configuration in coalesce uAPI, this series extend coalesce uAPI and add support for CQE mode. Below is some test result with HNS3 driver: 1. old ethtool(ioctl) + new kernel: estuary:/$ ethtool -c eth0 Coalesce parameters for eth0: Adaptive RX: on TX: on stats-block-usecs: 0 sample-interval: 0 pkt-rate-low: 0 pkt-rate-high: 0 rx-usecs: 20 rx-frames: 0 rx-usecs-irq: 0 rx-frames-irq: 0 tx-usecs: 20 tx-frames: 0 tx-usecs-irq: 0 tx-frames-irq: 0 rx-usecs-low: 0 rx-frame-low: 0 tx-usecs-low: 0 tx-frame-low: 0 rx-usecs-high: 0 rx-frame-high: 0 tx-usecs-high: 0 tx-frame-high: 0 2. ethtool(netlink with cqe mode) + kernel without cqe mode: estuary:/$ ethtool -c eth0 Coalesce parameters for eth0: Adaptive RX: on TX: on stats-block-usecs: n/a sample-interval: n/a pkt-rate-low: n/a pkt-rate-high: n/a rx-usecs: 20 rx-frames: 0 rx-usecs-irq: n/a rx-frames-irq: n/a tx-usecs: 20 tx-frames: 0 tx-usecs-irq: n/a tx-frames-irq: n/a rx-usecs-low: n/a rx-frame-low: n/a tx-usecs-low: n/a tx-frame-low: n/a rx-usecs-high: 0 rx-frame-high: n/a tx-usecs-high: 0 tx-frame-high: n/a CQE mode RX: n/a TX: n/a 3. ethool(netlink with cqe mode) + kernel with cqe mode: estuary:/$ ethtool -c eth0 Coalesce parameters for eth0: Adaptive RX: on TX: on stats-block-usecs: n/a sample-interval: n/a pkt-rate-low: n/a pkt-rate-high: n/a rx-usecs: 20 rx-frames: 0 rx-usecs-irq: n/a rx-frames-irq: n/a tx-usecs: 20 tx-frames: 0 tx-usecs-irq: n/a tx-frames-irq: n/a rx-usecs-low: n/a rx-frame-low: n/a tx-usecs-low: n/a tx-frame-low: n/a rx-usecs-high: 0 rx-frame-high: n/a tx-usecs-high: 0 tx-frame-high: n/a CQE mode RX: off TX: off 4. ethool(netlink without cqe mode) + kernel with cqe mode: estuary:/$ ethtool -c eth0 Coalesce parameters for eth0: Adaptive RX: on TX: on stats-block-usecs: n/a sample-interval: n/a pkt-rate-low: n/a pkt-rate-high: n/a rx-usecs: 20 rx-frames: 0 rx-usecs-irq: n/a rx-frames-irq: n/a tx-usecs: 20 tx-frames: 0 tx-usecs-irq: n/a tx-frames-irq: n/a rx-usecs-low: n/a rx-frame-low: n/a tx-usecs-low: n/a tx-frame-low: n/a rx-usecs-high: 0 rx-frame-high: n/a tx-usecs-high: 0 tx-frame-high: n/a Change log: V2 -> V3: fix some warning on W=1 builds in #2 V1 -> V2: 1. fix compile error using allmodconfig in #2 2. move some property-related modifications from #2 to #1 for better review suggested by Jakub Kicinski. Change log from RFC: V3 -> V4: add document explaining the difference between CQE and EQE in #1 suggested by Jakub Kicinski. V2 -> V3: 1. split #1 into adding new parameter and adding new attributes. 2. use NLA_POLICY_MAX(NLA_U8, 1) instead of NLA_U8. 3. modify the description of CQE in Document. V1 -> V2: refactor #1 in V1 suggestted by Jakub Kicinski. ==================== Link: https://lore.kernel.org/r/1629444920-25437-1-git-send-email-moyufeng@huawei.com Signed-off-by: Jakub Kicinski commit cce1689eb58d2fe3219da2ecd27cef8e644c4cc6 Author: Yufeng Mo Date: Fri Aug 20 15:35:20 2021 +0800 net: hns3: add ethtool support for CQE/EQE mode configuration Add support in ethtool for switching EQE/CQE mode. Signed-off-by: Yufeng Mo Signed-off-by: Huazhong Tan Signed-off-by: Jakub Kicinski commit 9f0c6f4b7475dd97e1f0eed81dd6ff173cf8c7fc Author: Yufeng Mo Date: Fri Aug 20 15:35:19 2021 +0800 net: hns3: add support for EQE/CQE mode configuration For device whose version is above V3(include V3), the GL can select EQE or CQE mode, so adds support for it. In CQE mode, the coalesced timer will restart when the first new completion occurs, while in EQE mode, the timer will not restart. Signed-off-by: Yufeng Mo Signed-off-by: Huazhong Tan Signed-off-by: Jakub Kicinski commit f3ccfda1931977b80267ba54070a1aeafa18f6ca Author: Yufeng Mo Date: Fri Aug 20 15:35:18 2021 +0800 ethtool: extend coalesce setting uAPI with CQE mode In order to support more coalesce parameters through netlink, add two new parameter kernel_coal and extack for .set_coalesce and .get_coalesce, then some extra info can return to user with the netlink API. Signed-off-by: Yufeng Mo Signed-off-by: Huazhong Tan Signed-off-by: Jakub Kicinski commit 029ee6b14356b94120bedb852dcdaefc0a282cf1 Author: Yufeng Mo Date: Fri Aug 20 15:35:17 2021 +0800 ethtool: add two coalesce attributes for CQE mode Currently, there are many drivers who support CQE mode configuration, some configure it as a fixed when initialized, some provide an interface to change it by ethtool private flags. In order to make it more generic, add two new 'ETHTOOL_A_COALESCE_USE_CQE_TX' and 'ETHTOOL_A_COALESCE_USE_CQE_RX' coalesce attributes, then these parameters can be accessed by ethtool netlink coalesce uAPI. Also add an new structure kernel_ethtool_coalesce, then the new parameter can be added into this struct. Signed-off-by: Yufeng Mo Signed-off-by: Huazhong Tan Signed-off-by: Jakub Kicinski commit 95d1d2490c278ea316a4350f4c24818275fb989c Author: Jakub Kicinski Date: Mon Aug 23 11:01:35 2021 -0700 netdevice: move xdp_rxq within netdev_rx_queue Both struct netdev_rx_queue and struct xdp_rxq_info are cacheline aligned. This causes extra padding before and after the xdp_rxq member. Move the member upfront, so that it's naturally aligned. Before: /* size: 256, cachelines: 4, members: 6 */ /* sum members: 160, holes: 1, sum holes: 40 */ /* padding: 56 */ /* paddings: 1, sum paddings: 36 */ /* forced alignments: 1, forced holes: 1, sum forced holes: 40 */ After: /* size: 192, cachelines: 3, members: 6 */ /* padding: 32 */ /* paddings: 1, sum paddings: 36 */ /* forced alignments: 1 */ Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20210823180135.1153608-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fb43ebc83e069625cfeeb2490efc3ffa0013bfa4 Author: Nathan Chancellor Date: Fri Aug 13 10:11:58 2021 -0700 drm/i915/selftest: Fix use of err in igt_reset_{fail, nop}_engine() Clang warns: In file included from drivers/gpu/drm/i915/gt/intel_reset.c:1514: drivers/gpu/drm/i915/gt/selftest_hangcheck.c:465:62: warning: variable 'err' is uninitialized when used here [-Wuninitialized] pr_err("[%s] Create context failed: %d!\n", engine->name, err); ^~~ ... drivers/gpu/drm/i915/gt/selftest_hangcheck.c:580:62: warning: variable 'err' is uninitialized when used here [-Wuninitialized] pr_err("[%s] Create context failed: %d!\n", engine->name, err); ^~~ ... 2 warnings generated. This appears to be a copy and paste issue. Use ce directly using the %pe specifier to pretty print the error code so that err is not used uninitialized in these functions. Fixes: 3a7b72665ea5 ("drm/i915/selftest: Bump selftest timeouts for hangcheck") Reported-by: Dan Carpenter Signed-off-by: Nathan Chancellor Reviewed-by: Joonas Lahtinen Signed-off-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20210813171158.2665823-1-nathan@kernel.org (cherry picked from commit ac5a2dff428ab59b5c5bbb4b28311141aa461c07) Signed-off-by: Jani Nikula commit 2c772cf5fe20ef0adf7691c5df1e4b5843e0a109 Author: Dan Carpenter Date: Fri Aug 13 14:36:00 2021 +0300 drm/i915/gt: Potential error pointer dereference in pinned_context() If the intel_engine_create_pinned_context() function returns an error pointer, then dereferencing "ce" will Oops. Use "vm" instead of "ce->vm". Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration") Signed-off-by: Dan Carpenter Reviewed-by: Thomas Hellström Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20210813113600.GC30697@kili (cherry picked from commit ff12ce2c9cb1cd09017151424db66de803984abc) Signed-off-by: Jani Nikula commit 3070d934a0b870575ce37da671dfdc969b153412 Author: Matt Roper Date: Mon Aug 16 13:41:12 2021 -0700 drm/i915/adl_p: Also disable underrun recovery with MSO One of the cases that the bspec lists for when underrun recovery must be disabled is "COG;" that note actually refers to eDP multi-segmented operation (MSO). Let's ensure the this additional restriction is honored by the driver. Bspec: 50351 Cc: Ville Syrjälä Fixes: ba3b049f4774 ("drm/i915/adl_p: Allow underrun recovery when possible") Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20210816204112.2960624-1-matthew.d.roper@intel.com Reviewed-by: José Roberto de Souza (cherry picked from commit c00e14cd4d3fbc5469d6e367371f9e4786a08c03) Signed-off-by: Jani Nikula commit 37bf34e10ccf71667af5f89a645289796d2c92f4 Author: Kees Cook Date: Tue Aug 17 16:33:57 2021 -0700 drm/i915: Use designated initializers for init/exit table The kernel builds with -Werror=designated-init, and __designated_init is used by CONFIG_GCC_PLUGIN_RANDSTRUCT for automatically selected (all function pointer) structures. Include the field names in the init/exit table. Avoids warnings like: drivers/gpu/drm/i915/i915_module.c:59:4: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init] Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: David Airlie Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Fixes: a04ea6ae7c67 ("drm/i915: Use a table for i915_init/exit (v2)") Signed-off-by: Kees Cook Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210817233357.2379455-1-keescook@chromium.org (cherry picked from commit 90fd2194a0cc52eb7a61dfa6412a0e498c58c688) Signed-off-by: Jani Nikula commit d9cf3bd531844ffbfe94b16e417037a16efc988d Author: Pavel Begunkov Date: Mon Jul 19 11:53:00 2021 +0100 bio: fix page leak bio_add_hw_page failure __bio_iov_append_get_pages() doesn't put not appended pages on bio_add_hw_page() failure, so potentially leaking them, fix it. Also, do the same for __bio_iov_iter_get_pages(), even though it looks like it can't be triggered by userspace in this case. Fixes: 0512a75b98f8 ("block: Introduce REQ_OP_ZONE_APPEND") Cc: stable@vger.kernel.org # 5.8+ Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1edfa6a2ffd66d55e6345a477df5387d2c1415d0.1626653825.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 4420f5b1be7b117330526f3eabd13d840f510b15 Author: Steven Rostedt (VMware) Date: Mon Aug 23 10:00:07 2021 -0400 tracing/doc: Fix table format in histogram code The addition of the buckets conversion for the histogram code, updated the documentation table of available conversions, but did not update the format to accommodate the extra size needed to cover the description. Link: https://lkml.kernel.org/r/20210823100007.71ce2ba9@oasis.local.home Reported-by: Stephen Rothwell Tested-by: Stephen Rothwell Signed-off-by: Steven Rostedt (VMware) commit 3f6e276270de935296caea6fb10a545f7388478b Author: Haibo Chen Date: Wed Aug 18 17:17:57 2021 +0800 dt-bindings: mmc: fsl-imx-esdhc: add a new compatible string Lack a compatible string "fsl,imx6sll-usdhc", so add it here. Signed-off-by: Haibo Chen Acked-by: Rob Herring Link: https://lore.kernel.org/r/1629278277-7313-1-git-send-email-haibo.chen@nxp.com Signed-off-by: Ulf Hansson commit d7428bc26fc767942c38d74b80299bcd4f01e7cb Author: Maxim Devaev Date: Sat Aug 21 16:40:04 2021 +0300 usb: gadget: f_hid: optional SETUP/SET_REPORT mode f_hid provides the OUT Endpoint as only way for receiving reports from the host. SETUP/SET_REPORT method is not supported, and this causes a number of compatibility problems with various host drivers, especially in the case of keyboard emulation using f_hid. - Some hosts do not support the OUT Endpoint and ignore it, so it becomes impossible for the gadget to receive a report from the host. In the case of a keyboard, the gadget loses the ability to receive the status of the LEDs. - Some BIOSes/UEFIs can't work with HID devices with the OUT Endpoint at all. This may be due to their bugs or incomplete implementation of the HID standard. For example, absolutely all Apple UEFIs can't handle the OUT Endpoint if it goes after IN Endpoint in the descriptor and require the reverse order (OUT, IN) which is a violation of the standard. Other hosts either do not initialize gadgets with a descriptor containing the OUT Endpoint completely (like some HP and DELL BIOSes and embedded firmwares like on KVM switches), or initialize them, but will not poll the IN Endpoint. This patch adds configfs option no_out_endpoint=1 to disable the OUT Endpoint and allows f_hid to receive reports from the host via SETUP/SET_REPORT. Previously, there was such a feature in f_hid, but it was replaced by the OUT Endpoint [1] in the commit 99c515005857 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT"). So this patch actually returns the removed functionality while making it optional. For backward compatibility reasons, the OUT Endpoint mode remains the default behaviour. - The OUT Endpoint mode provides the report queue and reduces USB overhead (eliminating SETUP routine) on transmitting a report from the host. - If the SETUP/SET_REPORT mode is used, there is no report queue, so the userspace will only read last report. For classic HID devices like keyboards this is not a problem, since it's intended to transmit the status of the LEDs and only the last report is important. This mode provides better compatibility with strange and buggy host drivers. Both modes passed USBCV tests. Checking with the USB protocol analyzer also confirmed that everything is working as it should and the new mode ensures operability in all of the described cases. Link: https://www.spinics.net/lists/linux-usb/msg65494.html [1] Reviewed-by: Maciej Żenczykowski Acked-by: Felipe Balbi Signed-off-by: Maxim Devaev Link: https://lore.kernel.org/r/20210821134004.363217-1-mdevaev@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8c61951b372d83b426a66dafc9c4ac24b3ce3335 Merge: 96e9df335ae3c 2564a2d4418ba Author: Greg Kroah-Hartman Date: Tue Aug 24 15:39:01 2021 +0200 Merge tag 'soundwire-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next Vinod writes: soundwire updates for 5.15-rc1 - Core has updates to support SoundWire mockup device (includes tag from asoc), improved error handling and slave status. - Drivers has update on Intel driver for new quriks and better handling of errors and suspend routines * tag 'soundwire-5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: cadence: do not extend reset delay soundwire: intel: conditionally exit clock stop mode on system suspend soundwire: intel: skip suspend/resume/wake when link was not started soundwire: intel: fix potential race condition during power down soundwire: cadence: override PDI configurations to create loopback soundwire: cadence: add debugfs interface for PDI loopbacks soundwire: stream: don't program mockup device ports soundwire: bus: squelch error returned by mockup devices soundwire: add flag to ignore all command/control for mockup devices soundwire: stream: don't abort bank switch on Command_Ignored/-ENODATA soundwire: cadence: add paranoid check on self-clearing bits soundwire: dmi-quirks: add quirk for Intel 'Bishop County' NUC M15 soundwire: bus: update Slave status in sdw_clear_slave_status soundwire: cadence: Remove ret variable from sdw_cdns_irq() soundwire: bus: filter out more -EDATA errors on clock stop soundwire: dmi-quirks: add ull suffix for SoundWire _ADR values ASoC: Intel: boards: sof_sdw: add SoundWire mockup codecs for tests ASoC: soc-acpi: tgl: add table for SoundWire mockup devices ASoC: soc-acpi: cnl: add table for SoundWire mockup devices ASoC: codecs: add SoundWire mockup device support commit bfadee4554c3782bfbc5943866bd2ad44d631e50 Author: Biju Das Date: Tue Aug 17 10:03:13 2021 +0100 dt-bindings: mmc: renesas,sdhi: Doc