commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f Author: Linus Torvalds Date: Sun Oct 2 14:09:07 2022 -0700 Linux 6.0 commit a962b54e162c2977ff37905726cab29728380835 Merge: febae48afe606 e2062df704dea Author: Linus Torvalds Date: Sun Oct 2 10:00:45 2022 -0700 Merge tag 'i2c-for-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Add missing DT bindings for STM32 and a resource leak fix for DaVinci" * tag 'i2c-for-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: davinci: fix PM disable depth imbalance in davinci_i2c_probe dt-bindings: i2c: st,stm32-i2c: Document wakeup-source property dt-bindings: i2c: st,stm32-i2c: Document interrupt-names property commit febae48afe6063105a0fad83d8e12a6addda7c6a Merge: 534b0abc627a4 6b959ba22d34c Author: Linus Torvalds Date: Sun Oct 2 09:41:27 2022 -0700 Merge tag 'perf-urgent-2022-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc perf fixes from Ingo Molnar: - Fix a PMU enumeration/initialization bug on Intel Alder Lake CPUs - Fix KVM guest PEBS register handling - Fix race/reentry bug in perf_output_read_group() reading of PMU counters * tag 'perf-urgent-2022-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix reentry problem in perf_output_read_group() perf/x86/core: Completely disable guest PEBS via guest's global_ctrl perf/x86/intel: Fix unchecked MSR access error for Alder Lake N commit 534b0abc627a4034ecaf177e780b1680e61b37f4 Merge: b357fd1c2afc1 df5b035b5683d Author: Linus Torvalds Date: Sun Oct 2 09:30:35 2022 -0700 Merge tag 'x86_urgent_for_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Add the respective UP last level cache mask accessors in order not to cause segfaults when lscpu accesses their representation in sysfs - Fix for a race in the alternatives batch patching machinery when kprobes are set * tag 'x86_urgent_for_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cacheinfo: Add a cpu_llc_shared_mask() UP variant x86/alternative: Fix race in try_get_desc() commit e2062df704dea47efe16edcaa2316d7b5ecca64f Author: Zhang Qilong Date: Thu Sep 29 22:30:38 2022 +0800 i2c: davinci: fix PM disable depth imbalance in davinci_i2c_probe The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. Fixes: 17f88151ff190 ("i2c: davinci: Add PM Runtime Support") Signed-off-by: Zhang Qilong Reviewed-by: Bartosz Golaszewski Signed-off-by: Wolfram Sang commit 367d4c887acd2be7524bd532ae9446ed2f508c3c Author: Marek Vasut Date: Mon Sep 26 22:46:53 2022 +0200 dt-bindings: i2c: st,stm32-i2c: Document wakeup-source property Document wakeup-source property. This fixes dtbs_check warnings when building current Linux DTs: " arch/arm/boot/dts/stm32mp153c-dhcom-drc02.dtb: i2c@40015000: Unevaluated properties are not allowed ('wakeup-source' was unexpected) " Signed-off-by: Marek Vasut Acked-by: Rob Herring Signed-off-by: Wolfram Sang commit f938a5295cedf7fdcc4f1caad0ac1a9be1f1a5f5 Author: Marek Vasut Date: Mon Sep 26 22:46:31 2022 +0200 dt-bindings: i2c: st,stm32-i2c: Document interrupt-names property Document interrupt-names property with "event" and "error" interrupt names. This fixes dtbs_check warnings when building current Linux DTs: " arch/arm/boot/dts/stm32mp153c-dhcom-drc02.dtb: i2c@40015000: Unevaluated properties are not allowed ('interrupt-names' was unexpected) " Signed-off-by: Marek Vasut Acked-by: Rob Herring Signed-off-by: Wolfram Sang commit b357fd1c2afc1a3e1b73dc4574bb7ac0e3bd4193 Merge: 89f2ddce78cc2 0fb9703a3eade Author: Linus Torvalds Date: Sat Oct 1 09:39:42 2022 -0700 Merge tag 'usb-6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are some tiny USB and Thunderbolt driver fixes and quirks. Included in here are: - three uas/usb-storage driver quirks to get the devices working properly due to broken firmware images in them (they can not run at high data rates, and are also throttled on other operating systems because of this) - thunderbolt bugfix for plug event delays - typec runtime warning removal - dwc3 st driver bugfix. Note, a follow-on fix for this will end up coming in for 6.1-rc1 as the developers are still arguing over what the final solution will be, but this should be sufficient for now All of these have been in linux-next with no reported problems" * tag 'usb-6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: uas: ignore UAS for Thinkplus chips usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS uas: add no-uas quirk for Hiksemi usb_disk usb: dwc3: st: Fix node's child name usb: typec: ucsi: Remove incorrect warning thunderbolt: Explicitly reset plug events delay back to USB4 spec value commit 89f2ddce78cc2a397065de8df509364d37c058da Merge: 2a4b6e13e170a 3a99c4474112f Author: Linus Torvalds Date: Sat Oct 1 09:27:18 2022 -0700 Merge tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - some fixes for the v4l2 ioctl handler logic - a fix for an out of bound access in the DVB videobuf2 handler - three driver fixes (rkvdec, mediatek/vcodek and uvcvideo) * tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: rkvdec: Disable H.264 error detection media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ) media: dvb_vb2: fix possible out of bound access media: v4l2-ioctl.c: fix incorrect error path media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args() media: uvcvideo: Fix InterfaceProtocol for Quanta camera commit 2a4b6e13e170a5c0c201a1858a8f5a61f98eb11e Merge: ffb4d94b43146 1c8e2349f2d03 Author: Linus Torvalds Date: Sat Oct 1 09:13:29 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more hotfixes from Andrew Morton: "One MAINTAINERS update, two MM fixes, both cc:stable" The previous pull wasn't fated to be the last one.. * tag 'mm-hotfixes-stable-2022-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: damon/sysfs: fix possible memleak on damon_sysfs_add_target mm: fix BUG splat with kvmalloc + GFP_ATOMIC MAINTAINERS: drop entry to removed file in ARM/RISCPC ARCHITECTURE commit 1c8e2349f2d033f634d046063b704b2ca6c46972 Author: Levi Yun Date: Mon Sep 26 16:06:11 2022 +0000 damon/sysfs: fix possible memleak on damon_sysfs_add_target When damon_sysfs_add_target couldn't find proper task, New allocated damon_target structure isn't registered yet, So, it's impossible to free new allocated one by damon_sysfs_destroy_targets. By calling damon_add_target as soon as allocating new target, Fix this possible memory leak. Link: https://lkml.kernel.org/r/20220926160611.48536-1-sj@kernel.org Fixes: a61ea561c871 ("mm/damon/sysfs: link DAMON for virtual address spaces monitoring") Signed-off-by: Levi Yun Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Cc: [5.17.x] Signed-off-by: Andrew Morton commit 30c19366636f72515679aa10dad61a4d988d4c9a Author: Florian Westphal Date: Mon Sep 26 17:16:50 2022 +0200 mm: fix BUG splat with kvmalloc + GFP_ATOMIC Martin Zaharinov reports BUG with 5.19.10 kernel: kernel BUG at mm/vmalloc.c:2437! invalid opcode: 0000 [#1] SMP CPU: 28 PID: 0 Comm: swapper/28 Tainted: G W O 5.19.9 #1 [..] RIP: 0010:__get_vm_area_node+0x120/0x130 __vmalloc_node_range+0x96/0x1e0 kvmalloc_node+0x92/0xb0 bucket_table_alloc.isra.0+0x47/0x140 rhashtable_try_insert+0x3a4/0x440 rhashtable_insert_slow+0x1b/0x30 [..] bucket_table_alloc uses kvzalloc(GPF_ATOMIC). If kmalloc fails, this now falls through to vmalloc and hits code paths that assume GFP_KERNEL. Link: https://lkml.kernel.org/r/20220926151650.15293-1-fw@strlen.de Fixes: a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") Signed-off-by: Florian Westphal Suggested-by: Michal Hocko Link: https://lore.kernel.org/linux-mm/Yy3MS2uhSgjF47dy@pc636/T/#t Acked-by: Michal Hocko Reported-by: Martin Zaharinov Cc: Uladzislau Rezki (Sony) Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit b674deddeb49fd37b8f20a15b658abde6671e2a8 Author: Lukas Bulwahn Date: Mon Sep 19 09:52:55 2022 +0200 MAINTAINERS: drop entry to removed file in ARM/RISCPC ARCHITECTURE Commit c1fe8d054c0a ("ARM: riscpc: use GENERIC_IRQ_MULTI_HANDLER") removes arch/arm/include/asm/hardware/entry-macro-iomd.S, but missed to adjust MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Drop the file entry to the removed file in ARM/RISCPC ARCHITECTURE. Link: https://lkml.kernel.org/r/20220919075255.386-1-lukas.bulwahn@gmail.com Fixes: c1fe8d054c0a ("ARM: riscpc: use GENERIC_IRQ_MULTI_HANDLER") Signed-off-by: Lukas Bulwahn Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Russell King Signed-off-by: Andrew Morton commit ffb4d94b4314655cea60ab7962756e6bab72fc7e Merge: e5fa173f9a472 414208e48963f Author: Linus Torvalds Date: Fri Sep 30 16:25:52 2022 -0700 Merge tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Some last minute amd fixes: - VCN 4.x and GC 11.x fixes, mostly around fw" * tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu/gfx11: switch to amdgpu_gfx_rlc_init_microcode drm/amdgpu: add helper to init rlc firmware drm/amdgpu: add helper to init rlc fw in header v2_4 drm/amdgpu: add helper to init rlc fw in header v2_3 drm/amdgpu: add helper to init rlc fw in header v2_2 drm/amdgpu: add helper to init rlc fw in header v2_1 drm/amdgpu: add helper to init rlc fw in header v2_0 drm/amdgpu: save rlcv/rlcp ucode version in amdgpu_gfx drm/amdgpu: Enable sram on vcn_4_0_2 drm/amdgpu: Enable VCN DPG for GC11_0_1 commit e5fa173f9a472dec2f8d5fb63d5c8824c49c6e51 Merge: c816f2e9813d2 daaa2fbe678ef Author: Linus Torvalds Date: Fri Sep 30 16:19:41 2022 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver fixes from Stephen Boyd: "Here's the last batch of clk driver fixes for this release. These patches fix serious problems, for example, i.MX has an issue where changing the NAND clk frequency hangs the system. On Allwinner H6 the GPU is being overclocked which could lead to long term hardware damage. And finally on some Broadcom SoCs the serial console stopped working because the clk tree hierarchy description got broken by an inadvertant DT node name change. That's fixed by using 'clock-output-names' to generate a stable and unique name for clks so the framework can properly link things up. There's also a couple build fixes in here. One to fix CONFIG_OF=n builds and one to avoid an array out of bounds bug that happens during clk registration on microchip. I hope that KASAN would have found that OOB problem, but probably KASAN wasn't attempted. Instead LLVM/clang compilation caused an oops, while GCC didn't" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx93: drop of_match_ptr clk: iproc: Do not rely on node name for correct PLL setup clk: sunxi-ng: h6: Fix default PLL GPU rate clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks clk: microchip: mpfs: make the rtc's ahb clock critical clk: microchip: mpfs: fix clk_cfg array bounds violation clk: ingenic-tcu: Properly enable registers before accessing timers commit c816f2e9813d218b36343c67b443c77c539ea294 Merge: 920541bb0b9bf 8e8bf60a67547 Author: Linus Torvalds Date: Fri Sep 30 16:03:19 2022 -0700 Merge tag 'perf-tools-fixes-for-v6.0-2022-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fail the 'perf test record' entry on error, fixing a regression where just setup stuff like allocating memory and not the actual things being tested failed. - Fixup disabling of -Wdeprecated-declarations for the python scripting engine, the previous attempt had a brown paper bag thinko. - Fix branch stack sampling test to include sanity check for branch filter on PowerPC. - Update is_ignored_symbol function to match the kernel ignored list, fixing running the 'perf test' entry that compares resolving symbols from kallsyms to resolving from vmlinux. - Augment the data source type with ARM's neoverse_spe list, the previous code was limited in its search resolving the data source. - Fix some clang 5 variable set but unused cases. - Get a perf cgroup more portably in BPF as the __builtin_preserve_enum_value builtin is not available in older versions of clang. In those cases we can forgo BPF's CO-RE (Compile Once, Run Everywhere). - More Fixes for Intel's hybrid CPU model. * tag 'perf-tools-fixes-for-v6.0-2022-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf build: Fixup disabling of -Wdeprecated-declarations for the python scripting engine perf tests mmap-basic: Remove unused variable to address clang 15 warning perf parse-events: Ignore clang 15 warning about variable set but unused in bison produced code perf tests record: Fail the test if the 'errs' counter is not zero perf test: Fix test case 87 ("perf record tests") for hybrid systems perf arm-spe: augment the data source type with neoverse_spe list perf tests vmlinux-kallsyms: Update is_ignored_symbol function to match the kernel ignored list perf tests powerpc: Fix branch stack sampling test to include sanity check for branch filter perf parse-events: Remove "not supported" hybrid cache events perf print-events: Fix "perf list" can not display the PMU prefix for some hybrid cache events perf tools: Get a perf cgroup more portably in BPF commit 920541bb0b9bf08d1455890694fbb2bbffb7a12b Merge: 70575e77839f4 394265079b6c2 Author: Linus Torvalds Date: Fri Sep 30 15:49:13 2022 -0700 Merge tag 'for-linus-6.0' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "A small fix to the reported set of supported CPUID bits, and selftests fixes: - Skip tests that require EPT when it is not available - Do not hang when a test fails with an empty stack trace - avoid spurious failure when running access_tracking_perf_test in a KVM guest - work around GCC's tendency to optimize loops into mem*() functions, which breaks because the guest code in selftests cannot call into PLTs - fix -Warray-bounds error in fix_hypercall_test" * tag 'for-linus-6.0' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Compare insn opcodes directly in fix_hypercall_test KVM: selftests: Implement memcmp(), memcpy(), and memset() for guest use KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest KVM: selftests: Gracefully handle empty stack traces KVM: selftests: replace assertion with warning in access_tracking_perf_test KVM: selftests: Skip tests that require EPT when it is not available commit 414208e48963fdb136240d7f59c15e627832d288 Merge: 6643b3836f390 0fd85e89b5bf1 Author: Daniel Vetter Date: Fri Sep 30 23:10:55 2022 +0200 Merge tag 'amd-drm-fixes-6.0-2022-09-30-1' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-09-30-1: amdgpu: - VCN 4.x fixes - RLC fixes for GC 11.x Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220930210454.542719-1-alexander.deucher@amd.com commit 0fd85e89b5bf18447e56099a010ee5be5dc9f2b0 Author: Hawking Zhang Date: Fri Sep 16 00:48:27 2022 +0800 drm/amdgpu/gfx11: switch to amdgpu_gfx_rlc_init_microcode switch to common helper to initialize rlc firmware for gfx11 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit 04fa38cce6e02be4362cd889780d58ec275c4d26 Author: Hawking Zhang Date: Fri Sep 16 00:21:50 2022 +0800 drm/amdgpu: add helper to init rlc firmware To initialzie rlc firmware according to rlc firmware header version v2: squash in backwards compat fix Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit b33139ee15352043123b81b32ca1a6a84340eb5d Author: Hawking Zhang Date: Wed Sep 21 21:55:52 2022 +0800 drm/amdgpu: add helper to init rlc fw in header v2_4 To initialize rlc firmware in header v2_4 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit c1c3f41ffb1bd262e40d68938af68c6ab53a41f8 Author: Hawking Zhang Date: Wed Sep 21 21:53:52 2022 +0800 drm/amdgpu: add helper to init rlc fw in header v2_3 To initialize rlc firmware in header v2_3 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit bcecb6524881c54ded92f14a6cf2406d5c439637 Author: Hawking Zhang Date: Wed Sep 21 21:52:31 2022 +0800 drm/amdgpu: add helper to init rlc fw in header v2_2 To initialize rlc firmware in header v2_2 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit 90df15124526176ff03c246362c196a047c8a39a Author: Hawking Zhang Date: Wed Sep 21 21:50:33 2022 +0800 drm/amdgpu: add helper to init rlc fw in header v2_1 To initialize rlc firmware in header v2_1 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit 2f3f958602721c7915ddb1f2a0e8dc5031bc0151 Author: Hawking Zhang Date: Wed Sep 21 21:48:27 2022 +0800 drm/amdgpu: add helper to init rlc fw in header v2_0 To initialize rlc firmware in header v2_0 Signed-off-by: Hawking Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit af81a9201e0112e9c4ca7258e32cd28baf19f31a Author: Hawking Zhang Date: Tue Sep 13 19:18:25 2022 +0800 drm/amdgpu: save rlcv/rlcp ucode version in amdgpu_gfx cache rlcv/rlcvp ucode version info in amdgpu_gfx structure Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 70575e77839f4c5337ce2653b39b86bb365a870e Merge: 7bc6e90d7aa41 a43ae8057cc15 Author: Linus Torvalds Date: Fri Sep 30 09:41:34 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Some last minute fixes. The virtio-blk one is the most important one since it was actually seen in the field, but the rest of them are small and clearly safe, everything here has been in next for a while" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vdpa/mlx5: Fix MQ to support non power of two num queues vduse: prevent uninitialized memory accesses virtio-blk: Fix WARN_ON_ONCE in virtio_queue_rq() virtio_test: fixup for vq reset virtio-crypto: fix memory-leak vdpa/ifcvf: fix the calculation of queuepair commit 7bc6e90d7aa4170039abe80b9f4e8c8e4eb35091 Merge: a0debc4c7a7e1 6c84501a3c38a Author: Linus Torvalds Date: Fri Sep 30 09:33:33 2022 -0700 Merge tag 'block-6.0-2022-09-29' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A single NVMe pull request via Christoph with a few fixes that should go into the 6.0 release: - Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices (Michael Kelley) - Disable Write Zeroes on Phison E3C/E4C (Tina Hsu)" * tag 'block-6.0-2022-09-29' of git://git.kernel.dk/linux: nvme-pci: disable Write Zeroes on Phison E3C/E4C nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices commit a0debc4c7a7e1a4adf0866b105e9e4f29002c2ca Merge: d649d2c49baa4 d59bd748db0a9 Author: Linus Torvalds Date: Fri Sep 30 09:28:39 2022 -0700 Merge tag 'io_uring-6.0-2022-09-29' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Two fixes that should go into 6.0: - Tweak the single issuer logic to register the task at creation, rather than at first submit. SINGLE_ISSUER was added for 6.0, and after some discussion on this, we decided to make it a bit stricter while it's still possible to do so (Dylan). - Stefan from Samba had some doubts on the level triggered poll that was added for this release. Rather than attempt to mess around with it now, just do the quick one-liner to disable it for release and we have time to discuss and change it for 6.1 instead (me)" * tag 'io_uring-6.0-2022-09-29' of git://git.kernel.dk/linux: io_uring/poll: disable level triggered poll io_uring: register single issuer task at creation commit d649d2c49baa4336bf65a02fc8e9d42c8ef2db6b Merge: 89e10b860cbf8 40158dbf7eb2b Author: Linus Torvalds Date: Fri Sep 30 08:54:14 2022 -0700 Merge tag 'pstore-v6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore revert from Kees Cook: "A misbehavior with some compression backends in pstore was just discovered due to the recent crypto acomp migration. Since we're so close to release, it seems better to just simply revert it, and we can figure out what's going on without leaving it broken for a release. - Revert crypto acomp migration (Guilherme G. Piccoli)" * tag 'pstore-v6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: Revert "pstore: migrate to crypto acomp interface" commit 89e10b860cbf8015dd77aaa90839fb0ef65e0619 Merge: 5a77386984b51 4335417da2b8d Author: Linus Torvalds Date: Fri Sep 30 08:30:10 2022 -0700 Merge tag 'gpio-fixes-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "One more fix for the upcoming release: - fix the check for pwm support on non-A8K platforms in gpio-mvebu" * tag 'gpio-fixes-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mvebu: Fix check for pwm support on non-A8K platforms commit 40158dbf7eb2b13d8851fe0b875b4c3170ea15db Author: Guilherme G. Piccoli Date: Thu Sep 29 18:55:15 2022 -0300 Revert "pstore: migrate to crypto acomp interface" This reverts commit e4f0a7ec586b7644107839f5394fb685cf1aadcc. When using this new interface, both efi_pstore and ramoops backends are unable to properly decompress dmesg if using zstd, lz4 and lzo algorithms (and maybe more). It does succeed with deflate though. The message observed in the kernel log is: [2.328828] pstore: crypto_acomp_decompress failed, ret = -22! The pstore infrastructure is able to collect the dmesg with both backends tested, but since decompression fails it's unreadable. With this revert everything is back to normal. Fixes: e4f0a7ec586b ("pstore: migrate to crypto acomp interface") Cc: Ard Biesheuvel Signed-off-by: Guilherme G. Piccoli Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220929215515.276486-1-gpiccoli@igalia.com commit 5a77386984b513ebfb2700e70dac44509fc81aa9 Merge: 987a926c1d8a4 6643b3836f390 Author: Linus Torvalds Date: Fri Sep 30 08:12:04 2022 -0700 Merge tag 'drm-fixes-2022-09-30-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Last set of fixes for 6.0 hopefully - minor bridge fixes, i915 fixes, and a bunch of amdgpu fixes for new IP blocks, along with a couple of regression fixes. Should be all set for merge window next week. amdgpu: - GC 11.x fixes - SMU 13.x fixes - DCN 3.1.4 fixes - DCN 3.2.x fixes - GC 9.x fix - Fence fix - SR-IOV supend/resume fix - PSR regression fix i915: - Restrict forced preemption to the active context - Restrict perf_limit_reasons to the supported platforms - gen11+ bridge: - analogix: Revert earlier suspend fix - lt8912b: Fix corrupt display output" * tag 'drm-fixes-2022-09-30-1' of git://anongit.freedesktop.org/drm/drm: (26 commits) drm/amd/display: Prevent OTG shutdown during PSR SU drm/i915/gt: Perf_limit_reasons are only available for Gen11+ drm/amdgpu: Add amdgpu suspend-resume code path under SRIOV drm/amdgpu: Remove fence_process in count_emitted drm/amdgpu: Correct the position in patch_cond_exec drm/amd/display: fill in clock values when DPM is not enabled drm/amd/display: Avoid unnecessary pixel rate divider programming drm/amd/display: Remove assert for odm transition case drm/amd/display: Fix typo in get_pixel_rate_div drm/amd/display: Fix audio on display after unplugging another drm/amd/display: Add explicit FIFO disable for DP blank drm/amd/display: Wrap OTG disable workaround with FIFO control drm/amd/display: Do DIO FIFO enable after DP video stream enable drm/amd/display: Update DCN32 to use new SR latencies drm/amd/display: Avoid avoid unnecessary pixel rate divider programming drm/amdkfd: fix dropped interrupt in kfd_int_process_v11 drm/amdgpu: pass queue size and is_aql_queue to MES drm/amdkfd: fix MQD init for GFX11 in init_mqd drm/amd/pm: use adverse selection for dpm features unsupported by driver drm/amd/pm: enable gfxoff feature for SMU 13.0.0 ... commit 394265079b6c271fdc191ac31b1ebfbee3dd6d63 Author: Sean Christopherson Date: Wed Sep 28 23:36:47 2022 +0000 KVM: selftests: Compare insn opcodes directly in fix_hypercall_test Directly compare the expected versus observed hypercall instructions when verifying that KVM patched in the native hypercall (FIX_HYPERCALL_INSN quirk enabled). gcc rightly complains that doing a 4-byte memcpy() with an "unsigned char" as the source generates an out-of-bounds accesses. Alternatively, "exp" and "obs" could be declared as 3-byte arrays, but there's no known reason to copy locally instead of comparing directly. In function ‘assert_hypercall_insn’, inlined from ‘guest_main’ at x86_64/fix_hypercall_test.c:91:2: x86_64/fix_hypercall_test.c:63:9: error: array subscript ‘unsigned int[0]’ is partly outside array bounds of ‘unsigned char[1]’ [-Werror=array-bounds] 63 | memcpy(&exp, exp_insn, sizeof(exp)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ x86_64/fix_hypercall_test.c: In function ‘guest_main’: x86_64/fix_hypercall_test.c:42:22: note: object ‘vmx_hypercall_insn’ of size 1 42 | extern unsigned char vmx_hypercall_insn; | ^~~~~~~~~~~~~~~~~~ x86_64/fix_hypercall_test.c:25:22: note: object ‘svm_hypercall_insn’ of size 1 25 | extern unsigned char svm_hypercall_insn; | ^~~~~~~~~~~~~~~~~~ In function ‘assert_hypercall_insn’, inlined from ‘guest_main’ at x86_64/fix_hypercall_test.c:91:2: x86_64/fix_hypercall_test.c:64:9: error: array subscript ‘unsigned int[0]’ is partly outside array bounds of ‘unsigned char[1]’ [-Werror=array-bounds] 64 | memcpy(&obs, obs_insn, sizeof(obs)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ x86_64/fix_hypercall_test.c: In function ‘guest_main’: x86_64/fix_hypercall_test.c:25:22: note: object ‘svm_hypercall_insn’ of size 1 25 | extern unsigned char svm_hypercall_insn; | ^~~~~~~~~~~~~~~~~~ x86_64/fix_hypercall_test.c:42:22: note: object ‘vmx_hypercall_insn’ of size 1 42 | extern unsigned char vmx_hypercall_insn; | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make: *** [../lib.mk:135: tools/testing/selftests/kvm/x86_64/fix_hypercall_test] Error 1 Fixes: 6c2fa8b20d0c ("selftests: KVM: Test KVM_X86_QUIRK_FIX_HYPERCALL_INSN") Cc: Oliver Upton Signed-off-by: Sean Christopherson Reviewed-by: Oliver Upton Message-Id: <20220928233652.783504-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 6b6f71484bf4fbe169fdbd401c829d8981365fd2 Author: Sean Christopherson Date: Wed Sep 28 23:36:46 2022 +0000 KVM: selftests: Implement memcmp(), memcpy(), and memset() for guest use Implement memcmp(), memcpy(), and memset() to override the compiler's built-in versions in order to guarantee that the compiler won't generate out-of-line calls to external functions via the PLT. This allows the helpers to be safely used in guest code, as KVM selftests don't support dynamic loading of guest code. Steal the implementations from the kernel's generic versions, sans the optimizations in memcmp() for unaligned accesses. Put the utilities in a separate compilation unit and build with -ffreestanding to fudge around a gcc "feature" where it will optimize memset(), memcpy(), etc... by generating a recursive call. I.e. the compiler optimizes itself into infinite recursion. Alternatively, the individual functions could be tagged with optimize("no-tree-loop-distribute-patterns"), but using "optimize" for anything but debug is discouraged, and Linus NAK'd the use of the flag in the kernel proper[*]. https://lore.kernel.org/lkml/CAHk-=wik-oXnUpfZ6Hw37uLykc-_P0Apyn2XuX-odh-3Nzop8w@mail.gmail.com Cc: Andrew Jones Cc: Anup Patel Cc: Atish Patra Cc: Christian Borntraeger Cc: Janosch Frank Cc: Claudio Imbrenda Signed-off-by: Sean Christopherson Message-Id: <20220928233652.783504-2-seanjc@google.com> Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini commit aae2e72229cdb21f90df2dbe4244c977e5d3265b Author: Jim Mattson Date: Thu Sep 22 16:18:54 2022 -0700 KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest The only thing reported by CPUID.9 is the value of IA32_PLATFORM_DCA_CAP[31:0] in EAX. This MSR doesn't even exist in the guest, since CPUID.1:ECX.DCA[bit 18] is clear in the guest. Clear CPUID.9 in KVM_GET_SUPPORTED_CPUID. Fixes: 24c82e576b78 ("KVM: Sanitize cpuid") Signed-off-by: Jim Mattson Message-Id: <20220922231854.249383-1-jmattson@google.com> Signed-off-by: Paolo Bonzini commit 09636efd1bd164ac782ff0d3a714db2c53964776 Author: David Matlack Date: Thu Sep 22 16:17:23 2022 -0700 KVM: selftests: Gracefully handle empty stack traces Bail out of test_dump_stack() if the stack trace is empty rather than invoking addr2line with zero addresses. The problem with the latter is that addr2line will block waiting for addresses to be passed in via stdin, e.g. if running a selftest from an interactive terminal. Opportunistically fix up the comment that mentions skipping 3 frames since only 2 are skipped in the code. Cc: Vipin Sharma Cc: Sean Christopherson Signed-off-by: David Matlack Message-Id: <20220922231724.3560211-1-dmatlack@google.com> [Small tweak to keep backtrace() call close to if(). - Paolo] Signed-off-by: Paolo Bonzini commit 6336a810db5c7e8e48b55b12fbb5e9cbd36a3d19 Author: Emanuele Giuseppe Esposito Date: Mon Sep 26 04:29:23 2022 -0400 KVM: selftests: replace assertion with warning in access_tracking_perf_test Page_idle uses {ptep/pmdp}_clear_young_notify which in turn calls the mmu notifier callback ->clear_young(), which purposefully does not flush the TLB. When running the test in a nested guest, point 1. of the test doc header is violated, because KVM TLB is unbounded by size and since no flush is forced, KVM does not update the sptes accessed/idle bits resulting in guest assertion failure. More precisely, only the first ACCESS_WRITE in run_test() actually makes visible changes, because sptes are created and the accessed bit is set to 1 (or idle bit is 0). Then the first mark_memory_idle() passes since access bit is still one, and sets all pages as idle (or not accessed). When the next write is performed, the update is not flushed therefore idle is still 1 and next mark_memory_idle() fails. Signed-off-by: Emanuele Giuseppe Esposito Message-Id: <20220926082923.299554-1-eesposit@redhat.com> Signed-off-by: Paolo Bonzini commit 6643b3836f3908c4f77883b2fae72451e85cf3ca Merge: 91462afa42e6b 7738be973fc4e Author: Dave Airlie Date: Fri Sep 30 09:28:00 2022 +1000 Merge tag 'drm-intel-fixes-2022-09-29' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Restrict forced preemption to the active context (Chris) - Restrict perf_limit_reasons to the supported platforms - gen11+ (Ashutosh) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YzXAkH1a32pYJD33@intel.com commit 91462afa42e6b8c5a148a44482c893f1800c513d Merge: 153a97b4e3de7 83ca5fb40e758 Author: Dave Airlie Date: Fri Sep 30 09:03:03 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-09-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-09-29: amdgpu: - GC 11.x fixes - SMU 13.x fixes - DCN 3.1.4 fixes - DCN 3.2.x fixes - GC 9.x fix - Fence fix - SR-IOV supend/resume fix - PSR regression fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220929144003.8363-1-alexander.deucher@amd.com commit 153a97b4e3de713c05b6bd42d734a2f9eeaf7968 Merge: f76349cf41451 cc62d98bd56d4 Author: Dave Airlie Date: Fri Sep 30 08:50:29 2022 +1000 Merge tag 'drm-misc-fixes-2022-09-29' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * bridge/analogix: Revert earlier suspend fix * bridge/lt8912b: Fix corrupt display output Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YzWvHhaqHhYirn4L@linux-uq9g commit 987a926c1d8a40e4256953b04771fbdb63bc7938 Merge: 511cce163b75b 06bbaa6dc53cb Author: Linus Torvalds Date: Thu Sep 29 14:37:45 2022 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull coredump fix from Al Viro: "Fix for breakage in dump_user_range()" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: [coredump] don't use __kernel_write() on kmap_local_page() commit 541540b9045c2665d6736a77c776ac81d4225eec Author: Sonny Jiang Date: Thu Sep 29 12:26:45 2022 -0400 drm/amdgpu: Enable sram on vcn_4_0_2 Enable sram on vcn_4_0_2 Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit a3aded135e84a581ba567c30ecddff47c8b6cfcf Author: Sonny Jiang Date: Thu Sep 29 12:24:27 2022 -0400 drm/amdgpu: Enable VCN DPG for GC11_0_1 Enable VCN DPG on GC11_0_1 Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 8e8bf60a675473a034ecfcb7a842b98868ed74a3 Author: Arnaldo Carvalho de Melo Date: Thu Sep 29 15:20:16 2022 -0300 perf build: Fixup disabling of -Wdeprecated-declarations for the python scripting engine A brown paper bag where -Wno-error=deprecated-declarations was added from compiler output when the right thing is to add -Wno-deprecated-declarations, fix it. Fixes: 4ee3c4da8b1b9c22 ("perf scripting python: Do not build fail on deprecation warnings") Signed-off-by: Arnaldo Carvalho de Melo commit 5551717bddb0c8aa78c4d2f8846624e2cf6816f7 Author: Jiri Olsa Date: Thu Sep 29 16:05:14 2022 +0200 perf tests mmap-basic: Remove unused variable to address clang 15 warning A clang 15 build reveal several unused-but-set variables, removing the 'foo' variable in tests/mmap-basic.o object to address one of those cases. Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ian Rogers Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220929140514.226807-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5149a427d27751da95b04fabe98ab65f412b5777 Author: Jiri Olsa Date: Thu Sep 29 10:13:47 2022 +0200 perf parse-events: Ignore clang 15 warning about variable set but unused in bison produced code clang 15 now warns: 46 65.20 fedora:rawhide : FAIL clang version 15.0.0 (Fedora 15.0.0-3.fc38) util/parse-events-bison.c:1401:9: error: variable 'parse_events_nerrs' set but not used [-Werror,-Wunused-but-set-variable] int yynerrs = 0; ^ #define yynerrs parse_events_nerrs ^ 1 error generated. make[3]: *** [/git/perf-6.0.0-rc7/tools/build/Makefile.build:139: util] Error 2 Just ignore one more compiler warning for the bison generated C code. Committer notes: Older clangs don't know about -Wunused-but-set-variable, so we need to add -Wno-unknown-warning-option to avoid this: 37 44.92 fedora:32 : FAIL clang version 10.0.1 (Fedora 10.0.1-3.fc32) error: unknown warning option '-Wno-unused-but-set-variable'; did you mean '-Wno-unused-const-variable'? [-Werror,-Wunknown-warning-option] make[3]: *** [/git/perf-6.0.0-rc7/tools/build/Makefile.build:139: util] Error 2 Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ian Rogers Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/lkml/20220929140514.226807-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 511cce163b75bc3933fa3de769a82bb7e8663f2b Merge: da9eede6b2423 3b04cba7add09 Author: Linus Torvalds Date: Thu Sep 29 08:32:53 2022 -0700 Merge tag 'net-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wifi and can. Current release - regressions: - phy: don't WARN for PHY_UP state in mdio_bus_phy_resume() - wifi: fix locking in mac80211 mlme - eth: - revert "net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()" - mlxbf_gige: fix an IS_ERR() vs NULL bug in mlxbf_gige_mdio_probe Previous releases - regressions: - wifi: fix regression with non-QoS drivers Previous releases - always broken: - mptcp: fix unreleased socket in accept queue - wifi: - don't start TX with fq->lock to fix deadlock - fix memory corruption in minstrel_ht_update_rates() - eth: - macb: fix ZynqMP SGMII non-wakeup source resume failure - mt7531: only do PLL once after the reset - usbnet: fix memory leak in usbnet_disconnect() Misc: - usb: qmi_wwan: add new usb-id for Dell branded EM7455" * tag 'net-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (30 commits) mptcp: fix unreleased socket in accept queue mptcp: factor out __mptcp_close() without socket lock net: ethernet: mtk_eth_soc: fix mask of RX_DMA_GET_SPORT{,_V2} net: mscc: ocelot: fix tagged VLAN refusal while under a VLAN-unaware bridge can: c_can: don't cache TX messages for C_CAN cores ice: xsk: drop power of 2 ring size restriction for AF_XDP ice: xsk: change batched Tx descriptor cleaning net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 selftests: Fix the if conditions of in test_extra_filter() net: phy: Don't WARN for PHY_UP state in mdio_bus_phy_resume() net: stmmac: power up/down serdes in stmmac_open/release wifi: mac80211: mlme: Fix double unlock on assoc success handling wifi: mac80211: mlme: Fix missing unlock on beacon RX wifi: mac80211: fix memory corruption in minstrel_ht_update_rates() wifi: mac80211: fix regression with non-QoS drivers wifi: mac80211: ensure vif queues are operational after start wifi: mac80211: don't start TX with fq->lock to fix deadlock wifi: cfg80211: fix MCS divisor value net: hippi: Add missing pci_disable_device() in rr_init_one() net/mlxbf_gige: Fix an IS_ERR() vs NULL bug in mlxbf_gige_mdio_probe ... commit da9eede6b2423381d592b832a7c5ba0082f2e905 Merge: 71f187570592e e62563db857f8 Author: Linus Torvalds Date: Thu Sep 29 08:22:53 2022 -0700 Merge tag 'input-for-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - small fixes for iqs62x-keys and melfas_mip4 drivers - corrected register address in snvs_pwrkey driver - Synaptic driver will stop trying to use intertouch (native) mode on some Lenovo AMD devices * tag 'input-for-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address Input: synaptics - disable Intertouch for Lenovo T14 and P14s AMD G1 Input: iqs62x-keys - drop unused device node references Input: melfas_mip4 - fix return value check in mip4_probe() commit 6c84501a3c38adaf1c3486fb80b972f728ad8fd1 Merge: 4c66a326b5ab7 d14c273132aec Author: Jens Axboe Date: Thu Sep 29 09:04:02 2022 -0600 Merge tag 'nvme-6.0-2022-09-29' of git://git.infradead.org/nvme into block-6.0 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.1 - fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices (Michael Kelley) - disable Write Zeroes on Phison E3C/E4C (Tina Hsu)" * tag 'nvme-6.0-2022-09-29' of git://git.infradead.org/nvme: nvme-pci: disable Write Zeroes on Phison E3C/E4C nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices commit 83ca5fb40e758e0a0257bf4e3a1148dd52c6d0f2 Author: Leo Li Date: Mon Sep 26 17:53:55 2022 -0400 drm/amd/display: Prevent OTG shutdown during PSR SU [Why] Enabling Z10 optimizations allows DMUB to disable the OTG during PSR link-off. This theoretically saves power by putting more of the display hardware to sleep. However, we observe that with PSR SU, it causes visual artifacts, higher power usage, and potential system hang. This is partly due to an odd behavior with the VStartup interrupt used to signal DRM vblank events. If the OTG is toggled on/off during a PSR link on/off cycle, the vstartup interrupt fires twice in quick succession. This generates incorrectly timed vblank events. Additionally, it can cause cursor updates to generate visual artifacts. Note that this is not observed with PSR1 since PSR is fully disabled when there are vblank event requestors. Cursor updates are also artifact-free, likely because there are no selectively-updated (SU) frames that can generate artifacts. [How] A potential solution is to disable z10 idle optimizations only when fast updates (flips & cursor updates) are committed. A mechanism to do so would require some thoughtful design. Let's just disable idle optimizations for PSR2 for now. Fixes: 7cc191ee7621 ("drm/amd/display: Implement MPO PSR SU") Reported-by: August Wikerfors Link: https://lore.kernel.org/r/c1f8886a-5624-8f49-31b1-e42b6d20dcf5@augustwikerfors.se/ Tested-by: August Wikerfors Reviewed-by: Harry Wentland Signed-off-by: Leo Li Signed-off-by: Alex Deucher commit 25c5e67cdf744cbb93fd06647611d3036218debe Author: Arnaldo Carvalho de Melo Date: Wed Sep 28 12:55:43 2022 -0300 perf tests record: Fail the test if the 'errs' counter is not zero We were just checking for the 'err' variable, when we should really see if there was some of the many checked errors that don't stop the test right away. Detected with clang 15.0.0: 44 75.23 fedora:37 : FAIL clang version 15.0.0 (Fedora 15.0.0-2.fc37) tests/perf-record.c:68:16: error: variable 'errs' set but not used [-Werror,-Wunused-but-set-variable] int err = -1, errs = 0, i, wakeups = 0; ^ 1 error generated. The patch introducing this 'perf test' entry had that check: + return (err < 0 || errs > 0) ? -1 : 0; But at some point we lost that: - return (err < 0 || errs > 0) ? -1 : 0; + if (err == -EACCES) + return TEST_SKIP; + if (err < 0) + return TEST_FAIL; + return TEST_OK Put it back. Fixes: 2cf88f4614c996e5 ("perf test: Use skip in PERF_RECORD_*") Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/YzR0n5QhsH9VyYB0@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 457c8b60267054869513ab1fb5513abb0a566dd0 Author: Zhengjun Xing Date: Tue Sep 27 13:15:13 2022 +0800 perf test: Fix test case 87 ("perf record tests") for hybrid systems The test case 87 ("perf record tests") failed on hybrid systems,the event "cpu/br_inst_retired.near_call/p" is only for non-hybrid system. Correct the test event to support both non-hybrid and hybrid systems. Before: # ./perf test 87 87: perf record tests : FAILED! After: # ./perf test 87 87: perf record tests : Ok Fixes: 24f378e66021f559 ("perf test: Add basic perf record tests") Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220927051513.3768717-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 71f187570592e74d32db4f52e7f50a64c11ee621 Merge: 81bcd4b522cf1 141f3d6256e58 Author: Linus Torvalds Date: Thu Sep 29 05:40:59 2022 -0700 Merge tag 'ata-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fixes from Damien Le Moal: "Three late patches to fix problems discovered recently: - Add a horkage to disable link power management by default for the Pioneer BDR-207M and BDR-205 DVD drives (from Niklas) - Two patches to fix setting the maximum queue depth of libsas owned ATA devices (from me)" * tag 'ata-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata-sata: Fix device queue depth control ata: libata-scsi: Fix initialization of device queue depth libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 commit 81bcd4b522cf1dc312385b79b144153aff0cf0c6 Merge: c3e0e1e23c704 4f196cb64b693 Author: Linus Torvalds Date: Thu Sep 29 05:35:32 2022 -0700 Merge tag 'loongarch-fixes-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Some trivial fixes and cleanup" * tag 'loongarch-fixes-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Clean up loongson3_smp_ops declaration LoongArch: Fix and cleanup csr_era handling in do_ri() LoongArch: Align the address of kernel_entry to 4KB commit 4f196cb64b693c64f8f981432b1ff326b7ea1c28 Author: Yanteng Si Date: Tue Sep 27 12:34:56 2022 +0800 LoongArch: Clean up loongson3_smp_ops declaration Since loongson3_smp_ops is not used in LoongArch anymore, let's remove it for cleanup. Fixes: f2ac457a6138 ("LoongArch: Add CPU definition headers") Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen commit 06e76acec70d1381b9a96e6014d5587d84201f82 Author: Huacai Chen Date: Mon Sep 26 22:33:39 2022 +0800 LoongArch: Fix and cleanup csr_era handling in do_ri() We don't emulate reserved instructions and just send a signal to the current process now. So we don't need to call compute_return_era() to add 4 (point to the next instruction) to csr_era in pt_regs. RA/ERA's backup/restore is cleaned up as well. Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit 2938431e9338bf4e8d434513d3a5832d64c0fa8b Author: Huacai Chen Date: Mon Sep 26 22:25:29 2022 +0800 LoongArch: Align the address of kernel_entry to 4KB Align the address of kernel_entry to 4KB, to avoid early tlb miss exception in case the entry code crosses page boundary. Signed-off-by: Huacai Chen commit 3b04cba7add093d0d8267cf70a333ca8fe8233ca Merge: 3e1308a7c88ba 30e51b923e436 Author: Jakub Kicinski Date: Wed Sep 28 19:05:39 2022 -0700 Merge branch 'mptcp-properly-clean-up-unaccepted-subflows' Mat Martineau says: ==================== mptcp: Properly clean up unaccepted subflows Patch 1 factors out part of the mptcp_close() function for use by a caller that already owns the socket lock. This is a prerequisite for patch 2. Patch 2 is the fix that fully cleans up the unaccepted subflow sockets. ==================== Link: https://lore.kernel.org/r/20220927193158.195729-1-mathew.j.martineau@linux.intel.com Signed-off-by: Jakub Kicinski commit 30e51b923e436b631e8d5b77fa5e318c6b066dc7 Author: Menglong Dong Date: Tue Sep 27 12:31:58 2022 -0700 mptcp: fix unreleased socket in accept queue The mptcp socket and its subflow sockets in accept queue can't be released after the process exit. While the release of a mptcp socket in listening state, the corresponding tcp socket will be released too. Meanwhile, the tcp socket in the unaccept queue will be released too. However, only init subflow is in the unaccept queue, and the joined subflow is not in the unaccept queue, which makes the joined subflow won't be released, and therefore the corresponding unaccepted mptcp socket will not be released to. This can be reproduced easily with following steps: 1. create 2 namespace and veth: $ ip netns add mptcp-client $ ip netns add mptcp-server $ sysctl -w net.ipv4.conf.all.rp_filter=0 $ ip netns exec mptcp-client sysctl -w net.mptcp.enabled=1 $ ip netns exec mptcp-server sysctl -w net.mptcp.enabled=1 $ ip link add red-client netns mptcp-client type veth peer red-server \ netns mptcp-server $ ip -n mptcp-server address add 10.0.0.1/24 dev red-server $ ip -n mptcp-server address add 192.168.0.1/24 dev red-server $ ip -n mptcp-client address add 10.0.0.2/24 dev red-client $ ip -n mptcp-client address add 192.168.0.2/24 dev red-client $ ip -n mptcp-server link set red-server up $ ip -n mptcp-client link set red-client up 2. configure the endpoint and limit for client and server: $ ip -n mptcp-server mptcp endpoint flush $ ip -n mptcp-server mptcp limits set subflow 2 add_addr_accepted 2 $ ip -n mptcp-client mptcp endpoint flush $ ip -n mptcp-client mptcp limits set subflow 2 add_addr_accepted 2 $ ip -n mptcp-client mptcp endpoint add 192.168.0.2 dev red-client id \ 1 subflow 3. listen and accept on a port, such as 9999. The nc command we used here is modified, which makes it use mptcp protocol by default. $ ip netns exec mptcp-server nc -l -k -p 9999 4. open another *two* terminal and use each of them to connect to the server with the following command: $ ip netns exec mptcp-client nc 10.0.0.1 9999 Input something after connect to trigger the connection of the second subflow. So that there are two established mptcp connections, with the second one still unaccepted. 5. exit all the nc command, and check the tcp socket in server namespace. And you will find that there is one tcp socket in CLOSE_WAIT state and can't release forever. Fix this by closing all of the unaccepted mptcp socket in mptcp_subflow_queue_clean() with __mptcp_close(). Now, we can ensure that all unaccepted mptcp sockets will be cleaned by __mptcp_close() before they are released, so mptcp_sock_destruct(), which is used to clean the unaccepted mptcp socket, is not needed anymore. The selftests for mptcp is ran for this commit, and no new failures. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Fixes: 6aeed9045071 ("mptcp: fix race on unaccepted mptcp sockets") Cc: stable@vger.kernel.org Reviewed-by: Jiang Biao Reviewed-by: Mengen Sun Acked-by: Paolo Abeni Signed-off-by: Menglong Dong Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 26d3e21ce1aab6cb19069c510fac8e7474445b18 Author: Menglong Dong Date: Tue Sep 27 12:31:57 2022 -0700 mptcp: factor out __mptcp_close() without socket lock Factor out __mptcp_close() from mptcp_close(). The caller of __mptcp_close() should hold the socket lock, and cancel mptcp work when __mptcp_close() returns true. This function will be used in the next commit. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Fixes: 6aeed9045071 ("mptcp: fix race on unaccepted mptcp sockets") Cc: stable@vger.kernel.org Reviewed-by: Jiang Biao Reviewed-by: Mengen Sun Acked-by: Paolo Abeni Signed-off-by: Menglong Dong Signed-off-by: Mat Martineau Signed-off-by: Jakub Kicinski commit 3e1308a7c88ba149baa08ddffedee30c6b3224a0 Merge: c9da02bfb1112 b3056ae2b5785 Author: Jakub Kicinski Date: Wed Sep 28 19:04:43 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ice: xsk: ZC changes Maciej Fijalkowski says: This set consists of two fixes to issues that were either pointed out on indirectly (John was reviewing AF_XDP selftests that were testing ice's ZC support) mailing list or were directly reported by customers. First patch allows user space to see done descriptor in CQ even after a single frame being transmitted and second patch removes the need for having HW rings sized to power of 2 number of descriptors when used against AF_XDP. I also forgot to mention that due to the current Tx cleaning algorithm, 4k HW ring was broken and these two patches bring it back to life, so we kill two birds with one stone. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: xsk: drop power of 2 ring size restriction for AF_XDP ice: xsk: change batched Tx descriptor cleaning ==================== Link: https://lore.kernel.org/r/20220927164112.4011983-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c9da02bfb1112461e048d3b736afb1873f6f4ccf Author: Daniel Golle Date: Tue Sep 27 16:30:02 2022 +0100 net: ethernet: mtk_eth_soc: fix mask of RX_DMA_GET_SPORT{,_V2} The bitmasks applied in RX_DMA_GET_SPORT and RX_DMA_GET_SPORT_V2 macros were swapped. Fix that. Reported-by: Chen Minqiang Fixes: 160d3a9b192985 ("net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support") Acked-by: Lorenzo Bianconi Signed-off-by: Daniel Golle Link: https://lore.kernel.org/r/YzMW+mg9UsaCdKRQ@makrotopia.org Signed-off-by: Jakub Kicinski commit 276d37eb449133bc22872b8f0a6f878e120deeff Author: Vladimir Oltean Date: Tue Sep 27 15:20:42 2022 +0300 net: mscc: ocelot: fix tagged VLAN refusal while under a VLAN-unaware bridge Currently the following set of commands fails: $ ip link add br0 type bridge # vlan_filtering 0 $ ip link set swp0 master br0 $ bridge vlan port vlan-id swp0 1 PVID Egress Untagged $ bridge vlan add dev swp0 vid 10 Error: mscc_ocelot_switch_lib: Port with more than one egress-untagged VLAN cannot have egress-tagged VLANs. Dumping ocelot->vlans, one can see that the 2 egress-untagged VLANs on swp0 are vid 1 (the bridge PVID) and vid 4094, a PVID used privately by the driver for VLAN-unaware bridging. So this is why bridge vid 10 is refused, despite 'bridge vlan' showing a single egress untagged VLAN. As mentioned in the comment added, having this private VLAN does not impose restrictions to the hardware configuration, yet it is a bookkeeping problem. There are 2 possible solutions. One is to make the functions that operate on VLAN-unaware pvids: - ocelot_add_vlan_unaware_pvid() - ocelot_del_vlan_unaware_pvid() - ocelot_port_setup_dsa_8021q_cpu() - ocelot_port_teardown_dsa_8021q_cpu() call something different than ocelot_vlan_member_(add|del)(), the latter being the real problem, because it allocates a struct ocelot_bridge_vlan *vlan which it adds to ocelot->vlans. We don't really *need* the private VLANs in ocelot->vlans, it's just that we have the extra convenience of having the vlan->portmask cached in software (whereas without these structures, we'd have to create a raw ocelot_vlant_rmw_mask() procedure which reads back the current port mask from hardware). The other solution is to filter out the private VLANs from ocelot_port_num_untagged_vlans(), since they aren't what callers care about. We only need to do this to the mentioned function and not to ocelot_port_num_tagged_vlans(), because private VLANs are never egress-tagged. Nothing else seems to be broken in either solution, but the first one requires more rework which will conflict with the net-next change 36a0bf443585 ("net: mscc: ocelot: set up tag_8021q CPU ports independent of user port affinity"), and I'd like to avoid that. So go with the other one. Fixes: 54c319846086 ("net: mscc: ocelot: enforce FDB isolation when VLAN-unaware") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220927122042.1100231-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit daaa2fbe678efdaced53d1c635f4d326751addf8 Author: Peng Fan Date: Tue Aug 30 11:31:31 2022 +0800 clk: imx93: drop of_match_ptr There is build warning when CONFIG_OF is not selected. >> drivers/clk/imx/clk-imx93.c:324:34: warning: 'imx93_clk_of_match' >> defined but not used [-Wunused-const-variable=] 324 | static const struct of_device_id imx93_clk_of_match[] = { | ^~~~~~~~~~~~~~~~~~ The driver only support DT table, no sense to use of_match_ptr. Fixes: 24defbe194b6 ("clk: imx: add i.MX93 clk") Reported-by: kernel test robot Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20220830033137.4149542-3-peng.fan@oss.nxp.com Reviewed-by: Abel Vesa Signed-off-by: Stephen Boyd commit 1b24a132eba7a1c19475ba2510ec1c00af3ff914 Author: Florian Fainelli Date: Mon Sep 5 09:15:03 2022 -0700 clk: iproc: Do not rely on node name for correct PLL setup After commit 31fd9b79dc58 ("ARM: dts: BCM5301X: update CRU block description") a warning from clk-iproc-pll.c was generated due to a duplicate PLL name as well as the console stopped working. Upon closer inspection it became clear that iproc_pll_clk_setup() used the Device Tree node unit name as an unique identifier as well as a parent name to parent all clocks under the PLL. BCM5301X was the first platform on which that got noticed because of the DT node unit name renaming but the same assumptions hold true for any user of the iproc_pll_clk_setup() function. The first 'clock-output-names' property is always guaranteed to be unique as well as providing the actual desired PLL clock name, so we utilize that to register the PLL and as a parent name of all children clock. Fixes: 5fe225c105fd ("clk: iproc: add initial common clock support") Signed-off-by: Florian Fainelli Acked-by: Rafał Miłecki Link: https://lore.kernel.org/r/20220905161504.1526-1-f.fainelli@gmail.com Signed-off-by: Stephen Boyd commit d59bd748db0a97a5d6a33b284b6c58b7f6f4f768 Author: Jens Axboe Date: Wed Sep 28 09:49:28 2022 -0600 io_uring/poll: disable level triggered poll Stefan reports that there are issues with the level triggered notification. Since we're late in the cycle, and it was introduced for the 6.0 release, just disable it at prep time and we can bring this back when Samba is happy with it. Reported-by: Stefan Metzmacher Reviewed-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit 4014e916fd0cea19b559890588d70b4e9f44b87f Author: Jernej Skrabec Date: Wed Sep 28 22:01:22 2022 +0200 clk: sunxi-ng: h6: Fix default PLL GPU rate In commit 4167ac8a657e ("clk: sunxi-ng: sun50i: h6: Modify GPU clock configuration to support DFS") divider M0 was forced to be 1 in order to support DFS. However, that left N as it is, at high value of 36. On boards without devfreq enabled (all of them in kernel 6.0), this effectively sets GPU frequency to 864 MHz. This is about 100 MHz above maximum supported frequency. In order to fix this, let's set N to 18 (register value 17). That way default frequency of 432 MHz is preserved. Fixes: 4167ac8a657e ("clk: sunxi-ng: sun50i: h6: Modify GPU clock configuration to support DFS") Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220928200122.3963509-1-jernej.skrabec@gmail.com Signed-off-by: Stephen Boyd commit 7738be973fc4e2ba22154fafd3a5d7b9666f9abf Author: Ashutosh Dixit Date: Wed Sep 28 12:02:12 2022 -0700 drm/i915/gt: Perf_limit_reasons are only available for Gen11+ Register GT0_PERF_LIMIT_REASONS (0x1381a8) is available only for Gen11+. Therefore ensure perf_limit_reasons sysfs files are created only for Gen11+. Otherwise on Gen < 5 accessing these files results in the following oops: <1> [88.829420] BUG: unable to handle page fault for address: ffffc90000bb81a8 <1> [88.829438] #PF: supervisor read access in kernel mode <1> [88.829447] #PF: error_code(0x0000) - not-present page This patch is a backport of the drm-tip commit 0d2d201095e9 ("drm/i915: Perf_limit_reasons are only available for Gen11+") to drm-intel-fixes. The backport is not identical to the original, it only includes the sysfs portions of if. The debugfs portion is not available in drm-intel-fixes so has not been backported. Bspec: 20008 Bug: https://gitlab.freedesktop.org/drm/intel/-/issues/6863 Fixes: fa68bff7cf27 ("drm/i915/gt: Add sysfs throttle frequency interfaces") Signed-off-by: Ashutosh Dixit Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20220919162401.2077713-1-ashutosh.dixit@intel.com (backported from commit 0d2d201095e9f141d6a9fb44320afce761f8b5c2) commit b1ff1bfe81e763420afd5f3f25f0b3cbfd97055c Author: Han Xu Date: Thu Sep 15 10:09:59 2022 -0500 clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks There is no dedicate parent clock for QSPI so SET_RATE_PARENT flag should not be used. For instance, the default parent clock for QSPI is pll2_bus, which is also the parent clock for quite a few modules, such as MMDC, once GPMI NAND set clock rate for EDO5 mode can cause system hang due to pll2_bus rate changed. Fixes: f1541e15e38e ("clk: imx6sx: Switch to clk_hw based API") Signed-off-by: Han Xu Link: https://lore.kernel.org/r/20220915150959.3646702-1-han.xu@nxp.com Tested-by: Fabio Estevam Reviewed-by: Abel Vesa Signed-off-by: Stephen Boyd commit c3e0e1e23c70455916ff3472072437b3605c6cfe Merge: e817c070fd9f8 c0cca6a66458a Author: Linus Torvalds Date: Wed Sep 28 11:54:57 2022 -0700 Merge tag 'irq_urgent_for_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull more irqchip fixes from Borislav Petkov: "More irqchip fixes for 6.0 from Marc Zyngier. Stuff got left hanging due to the whole Plumbers and vacations commotion. - A couple of configuration fixes for the recently merged Loongarch drivers - A fix to avoid dynamic allocation of a cpumask which was causing issues with PREEMPT_RT and the GICv3 ITS - A tightening of an error check in the stm32 exti driver" * tag 'irq_urgent_for_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/loongson-pch-lpc: Add dependence on LoongArch irqchip: Select downstream irqchip drivers for LoongArch CPU irqchip/gic-v3-its: Remove cpumask_var_t allocation irqchip/stm32-exti: Remove check on always false condition commit e817c070fd9f813774defd8ef5e0349108e924e0 Merge: b1cab78ba3921 e7afa79a3b35a Author: Linus Torvalds Date: Wed Sep 28 11:36:31 2022 -0700 Merge tag 'mmc-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "A couple of MMC fixes. This time there is also a fix for the ARM SCMI firmware driver, which has been acked by Sudeep Holla, the maintainer. MMC core: - Terminate infinite loop in SD-UHS voltage switch MMC host: - hsq: Fix kernel crash in the recovery path - moxart: Fix bus width configurations - sdhci: Fix kernel panic for cqe irq ARM_SCMI: - Fixup clock management by reverting 'firmware: arm_scmi: Add clock management to the SCMI power domain'" * tag 'mmc-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: hsq: Fix data stomping during mmc recovery Revert "firmware: arm_scmi: Add clock management to the SCMI power domain" mmc: core: Terminate infinite loop in SD-UHS voltage switch mmc: moxart: fix 4-bit bus width and remove 8-bit bus width mmc: sdhci: Fix host->cmd is null commit 06bbaa6dc53cb72040db952053432541acb9adc7 Author: Al Viro Date: Mon Sep 26 11:59:14 2022 -0400 [coredump] don't use __kernel_write() on kmap_local_page() passing kmap_local_page() result to __kernel_write() is unsafe - random ->write_iter() might (and 9p one does) get unhappy when passed ITER_KVEC with pointer that came from kmap_local_page(). Fix by providing a variant of __kernel_write() that takes an iov_iter from caller (__kernel_write() becomes a trivial wrapper) and adding dump_emit_page() that parallels dump_emit(), except that instead of __kernel_write() it uses __kernel_write_iter() with ITER_BVEC source. Fixes: 3159ed57792b "fs/coredump: use kmap_local_page()" Signed-off-by: Al Viro commit 3d87f6c3be0df4a0f6d0ca719550a7bc77e520bf Merge: 6726d552a6912 05d27090b6dc8 Author: Stephen Boyd Date: Wed Sep 28 10:52:14 2022 -0700 Merge tag 'clk-microchip-fixes-6.0' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-fixes Pull Microchip clock fixes for Polarfire SoCs: - fix panic at boot in clock initialization when building with clang-15 - make RTC's AHB clock critical as rtc will stop if the AHB interface clock is disabled * tag 'clk-microchip-fixes-6.0' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: microchip: mpfs: make the rtc's ahb clock critical clk: microchip: mpfs: fix clk_cfg array bounds violation commit af2faee54d591904050d69a55b6e429565bbe389 Merge: 44d70bb561dac 81d192c2ce741 Author: Jakub Kicinski Date: Wed Sep 28 10:48:38 2022 -0700 Merge tag 'linux-can-fixes-for-6.0-20220928' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2022-09-28 The patch is by me and targets the c_can driver. It disables an optimization in the TX path of C_CAN cores which causes problems. * tag 'linux-can-fixes-for-6.0-20220928' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: c_can: don't cache TX messages for C_CAN cores ==================== Link: https://lore.kernel.org/r/20220928090629.1124190-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit df5b035b5683d6a25f077af889fb88e09827f8bc Author: Borislav Petkov Date: Fri Aug 19 19:47:44 2022 +0200 x86/cacheinfo: Add a cpu_llc_shared_mask() UP variant On a CONFIG_SMP=n kernel, the LLC shared mask is 0, which prevents __cache_amd_cpumap_setup() from doing the L3 masks setup, and more specifically from setting up the shared_cpu_map and shared_cpu_list files in sysfs, leading to lscpu from util-linux getting confused and segfaulting. Add a cpu_llc_shared_mask() UP variant which returns a mask with a single bit set, i.e., for CPU0. Fixes: 2b83809a5e6d ("x86/cpu/amd: Derive L3 shared_cpu_map from cpu_llc_shared_mask") Reported-by: Saurabh Sengar Signed-off-by: Borislav Petkov Cc: Link: https://lore.kernel.org/r/1660148115-302-1-git-send-email-ssengar@linux.microsoft.com commit b1cab78ba392162a5ef11173d02db6e182e04edd Author: Shakeel Butt Date: Mon Sep 26 19:59:31 2022 +0000 Revert "net: set proper memcg for net_init hooks allocations" This reverts commit 1d0403d20f6c281cb3d14c5f1db5317caeec48e9. Anatoly Pugachev reported that the commit 1d0403d20f6c ("net: set proper memcg for net_init hooks allocations") is somehow causing the sparc64 VMs failed to boot and the VMs boot fine with that patch reverted. So, revert the patch for now and later we can debug the issue. Link: https://lore.kernel.org/all/20220918092849.GA10314@u164.east.ru/ Reported-by: Anatoly Pugachev Signed-off-by: Shakeel Butt Cc: Vasily Averin Cc: Jakub Kicinski Cc: Michal Koutný Cc: Andrew Morton Cc: cgroups@vger.kernel.org Cc: sparclinux@vger.kernel.org Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org Tested-by: Anatoly Pugachev Acked-by: Johannes Weiner Fixes: 1d0403d20f6c ("net: set proper memcg for net_init hooks allocations") Reviewed-by: Muchun Song Acked-by: Roman Gushchin Signed-off-by: Linus Torvalds commit 74a61d53a6d1ca1172d85964d15c83c2cc3670b3 Author: Jing Zhang Date: Mon Sep 26 21:03:16 2022 +0800 perf arm-spe: augment the data source type with neoverse_spe list When synthesizing event with SPE data source, commit 4e6430cbb1a9("perf arm-spe: Use SPE data source for neoverse cores") augment the type with source information by MIDR. However, is_midr_in_range only compares the first entry in neoverse_spe. Change is_midr_in_range to is_midr_in_range_list to traverse the neoverse_spe array so that all neoverse cores synthesize event with data source packet. Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores") Reviewed-by: Ali Saidi Reviewed-by: Leo Yan Signed-off-by: Jing Zhang Cc: Alexander Shishkin Cc: Ali Saidi Cc: German Gomez Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: linux-arm-kernel@lists.infradead.org Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shuai Xue Cc: Timothy Hayes Cc: Will Deacon Cc: Zhuo Song Link: https://lore.kernel.org/r/1664197396-42672-1-git-send-email-renyu.zj@linux.alibaba.com Signed-off-by: Arnaldo Carvalho de Melo commit 506442439317153c1aa646fcb35f8678d42efce9 Author: Athira Rajeev Date: Wed Sep 28 10:22:18 2022 +0530 perf tests vmlinux-kallsyms: Update is_ignored_symbol function to match the kernel ignored list The testcase “vmlinux-kallsyms.c” fails in powerpc. vmlinux symtab matches kallsyms: FAILED! This test look at the symbols in the vmlinux DSO and check if we find all of them in the kallsyms dso. But from the powerpc logs , observed that the failure happens for: ERR : 0xc0000000000fe9c8: .Lmfspr_table not on kallsyms ERR : 0xc0000000001009c8: .Lmtspr_table not on kallsyms These are labels ( with .L) in the source code and has to be ignored. Reference code with .Lmtspr_table: arch/powerpc/xmon/spr_access.S The testcases invokes is_ignored_symbol() function to ignore hidden symbols in the dso like local symbols. This function is adapted from is_ignored_symbol() kernel function in code: scripts/kallsyms.c . The kernel function got some updates which is not reflected in the testcase function and the new updates also handles ignoring "labels". Below is the changes that went in the kernel function. /* Symbol names that begin with the following are ignored.*/ static const char * const ignored_prefixes[] = { "$", /* local symbols for ARM, MIPS, etc. */ - ".LASANPC", /* s390 kasan local symbols */ + ".L", /* local labels, .LBB,.Ltmpxxx,.L__unnamed_xx,.LASANPC, etc. */ "__crc_", /* modversions */ "__efistub_", /* arm64 EFI stub namespace */ - "__kvm_nvhe_", /* arm64 non-VHE KVM namespace */ + "__kvm_nvhe_$", /* arm64 local symbols in non-VHE KVM namespace */ + "__kvm_nvhe_.L", /* arm64 local symbols in non-VHE KVM namespace */ "__AArch64ADRPThunk_", /* arm64 lld */ "__ARMV5PILongThunk_", /* arm lld */ "__ARMV7PILongThunk_", This change is part of below commits and will handle the symbols with “.L” commit d4c858643263 ("kallsyms: ignore all local labels prefixed by '.L'") commit 6ccf9cb557bd ("KVM: arm64: Symbolize the nVHE HYP addresses") Update the testcase function to include the new changes. Reported-by: Disha Goel Signed-off-by: Athira Jajeev Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20220928045218.37322-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 141f3d6256e58103ece1c3dd2835e871f1dde240 Author: Damien Le Moal Date: Sat Sep 24 15:18:26 2022 +0900 ata: libata-sata: Fix device queue depth control The function __ata_change_queue_depth() uses the helper ata_scsi_find_dev() to get the ata_device structure of a scsi device and set that device maximum queue depth. However, when the ata device is managed by libsas, ata_scsi_find_dev() returns NULL, turning __ata_change_queue_depth() into a nop, which prevents the user from setting the maximum queue depth of ATA devices used with libsas based HBAs. Fix this by renaming __ata_change_queue_depth() to ata_change_queue_depth() and adding a pointer to the ata_device structure of the target device as argument. This pointer is provided by ata_scsi_change_queue_depth() using ata_scsi_find_dev() in the case of a libata managed device and by sas_change_queue_depth() using sas_to_ata_dev() in the case of a libsas managed ata device. Signed-off-by: Damien Le Moal Tested-by: John Garry commit 6a8438de524346f2ac73b0b493980c336ebce688 Author: Damien Le Moal Date: Sat Sep 24 14:44:11 2022 +0900 ata: libata-scsi: Fix initialization of device queue depth For SATA devices supporting NCQ, drivers using libsas first initialize a scsi device queue depth based on the controller and device capabilities, leading to the scsi device queue_depth field being 32 (ATA maximum queue depth) for most setup. However, if libata was loaded using the force=[ID]]noncq argument, the default queue depth should be set to 1 to reflect the fact that queuable commands will never be used. This is consistent with manually setting a device queue depth to 1 through sysfs as that disables NCQ use for the device. Fix ata_scsi_dev_config() to honor the noncq parameter by sertting the device queue depth to 1 for devices that do not have the ATA_DFLAG_NCQ flag set. Signed-off-by: Damien Le Moal Tested-by: John Garry commit 81d192c2ce74157e717e1fc4b68791f82f7499d4 Author: Marc Kleine-Budde Date: Fri Sep 23 13:42:23 2022 +0200 can: c_can: don't cache TX messages for C_CAN cores As Jacob noticed, the optimization introduced in 387da6bc7a82 ("can: c_can: cache frames to operate as a true FIFO") doesn't properly work on C_CAN, but on D_CAN IP cores. The exact reasons are still unknown. For now disable caching if CAN frames in the TX path for C_CAN cores. Fixes: 387da6bc7a82 ("can: c_can: cache frames to operate as a true FIFO") Link: https://lore.kernel.org/all/20220928083354.1062321-1-mkl@pengutronix.de Link: https://lore.kernel.org/all/15a8084b-9617-2da1-6704-d7e39d60643b@gmail.com Reported-by: Jacob Kroon Tested-by: Jacob Kroon Cc: stable@vger.kernel.org # v5.15 Signed-off-by: Marc Kleine-Budde commit 44d70bb561dac9363f45787aa93dfca36877ee01 Merge: 797666cd5af04 6546646a7fb0d Author: Jakub Kicinski Date: Tue Sep 27 16:52:45 2022 -0700 Merge tag 'wireless-2022-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== A few late-comer fixes: * locking in mac80211 MLME * non-QoS driver crash/regression * minstrel memory corruption * TX deadlock * TX queues not always enabled * HE/EHT bitrate calculation * tag 'wireless-2022-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: mlme: Fix double unlock on assoc success handling wifi: mac80211: mlme: Fix missing unlock on beacon RX wifi: mac80211: fix memory corruption in minstrel_ht_update_rates() wifi: mac80211: fix regression with non-QoS drivers wifi: mac80211: ensure vif queues are operational after start wifi: mac80211: don't start TX with fq->lock to fix deadlock wifi: cfg80211: fix MCS divisor value ==================== Link: https://lore.kernel.org/r/20220927135923.45312-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 49c13ed0316d55d73f1c81c66a7e2abd743f9ae6 Merge: 46452d3786a82 7bea67a994300 Author: Linus Torvalds Date: Tue Sep 27 16:49:42 2022 -0700 Merge tag 'soc-fixes-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "This should be the last set of bugfixes in the SoC tree: - Two fixes for Arm integrator, dealing with a regression caused by invalid DT properties combined with a change in dma address translation, and missing device_type annotations on the PCI bus - Fixes for drivers/reset/, addressing bugs in i.MX8MP, Sparx5 and NPCM8XX platforms - Bjorn Andersson's email address changes in the MAINTAINERS file - Multiple minor fixes to Qualcomm dts files, and a change to the remoteproc firmware filename that did not match the actual path in the linux-firmware package - Minor code fixes for the Allwinner/sunxi SRAM driver, and the broadcom STB Bus Interface Unit driver - A build fix for the sunplus sp7021 platform - Two dts fixes for TI OMAP family SoCs, addressing an extraneous usb4 device node and an incorrect DMA handle" * tag 'soc-fixes-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: dts: integrator: Fix DMA ranges ARM: dts: integrator: Tag PCI host with device_type ARM: sunplus: fix serial console kconfig and build problems reset: npcm: fix iprst2 and iprst4 setting arm64: dts: qcom: sm8350: fix UFS PHY serdes size soc: bcm: brcmstb: biuctrl: Avoid double of_node_put() arm64: dts: qcom: sc8280xp-x13s: Update firmware location soc: sunxi: sram: Fix debugfs info for A64 SRAM C soc: sunxi: sram: Fix probe function ordering issues soc: sunxi: sram: Prevent the driver from being unbound soc: sunxi: sram: Actually claim SRAM regions ARM: dts: am5748: keep usb4_tm disabled reset: microchip-sparx5: issue a reset on startup reset: imx7: Fix the iMX8MP PCIe PHY PERST support MAINTAINERS: Update Bjorn's email address arm64: dts: qcom: sc7280: move USB wakeup-source property arm64: dts: qcom: thinkpad-x13s: Fix firmware location arm64: dts: qcom: sm8150: Fix fastrpc iommu values ARM: dts: am33xx: Fix MMCHS0 dma properties commit a43ae8057cc154fd26a3a23c0e8643bef104d995 Author: Eli Cohen Date: Mon Sep 12 15:50:19 2022 +0300 vdpa/mlx5: Fix MQ to support non power of two num queues RQT objects require that a power of two value be configured for both rqt_max_size and rqt_actual size. For create_rqt, make sure to round up to the power of two the value of given by the user who created the vdpa device and given by ndev->rqt_size. The actual size is also rounded up to the power of two using the current number of VQs given by ndev->cur_num_vqs. Same goes with modify_rqt where we need to make sure act size is power of two based on the new number of QPs. Without this patch, attempt to create a device with non power of two QPs would result in error from firmware. Fixes: 52893733f2c5 ("vdpa/mlx5: Add multiqueue support") Signed-off-by: Eli Cohen Message-Id: <20220912125019.833708-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 46f8a29272e51b6df7393d58fc5cb8967397ef2b Author: Maxime Coquelin Date: Wed Aug 31 17:49:23 2022 +0200 vduse: prevent uninitialized memory accesses If the VDUSE application provides a smaller config space than the driver expects, the driver may use uninitialized memory from the stack. This patch prevents it by initializing the buffer passed by the driver to store the config value. This fix addresses CVE-2022-2308. Cc: stable@vger.kernel.org # v5.15+ Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Reviewed-by: Xie Yongji Acked-by: Jason Wang Signed-off-by: Maxime Coquelin Message-Id: <20220831154923.97809-1-maxime.coquelin@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Chaitanya Kulkarni commit 37fafe6b61e4f15d977982635bb785f4e605f7cd Author: Suwan Kim Date: Wed Aug 31 00:01:53 2022 +0900 virtio-blk: Fix WARN_ON_ONCE in virtio_queue_rq() If a request fails at virtio_queue_rqs(), it is inserted to requeue_list and passed to virtio_queue_rq(). Then blk_mq_start_request() can be called again at virtio_queue_rq() and trigger WARN_ON_ONCE like below trace because request state was already set to MQ_RQ_IN_FLIGHT in virtio_queue_rqs() despite the failure. [ 1.890468] ------------[ cut here ]------------ [ 1.890776] WARNING: CPU: 2 PID: 122 at block/blk-mq.c:1143 blk_mq_start_request+0x8a/0xe0 [ 1.891045] Modules linked in: [ 1.891250] CPU: 2 PID: 122 Comm: journal-offline Not tainted 5.19.0+ #44 [ 1.891504] Hardware name: ChromiumOS crosvm, BIOS 0 [ 1.891739] RIP: 0010:blk_mq_start_request+0x8a/0xe0 [ 1.891961] Code: 12 80 74 22 48 8b 4b 10 8b 89 64 01 00 00 8b 53 20 83 fa ff 75 08 ba 00 00 00 80 0b 53 24 c1 e1 10 09 d1 89 48 34 5b 41 5e c3 <0f> 0b eb b8 65 8b 05 2b 39 b6 7e 89 c0 48 0f a3 05 39 77 5b 01 0f [ 1.892443] RSP: 0018:ffffc900002777b0 EFLAGS: 00010202 [ 1.892673] RAX: 0000000000000000 RBX: ffff888004bc0000 RCX: 0000000000000000 [ 1.892952] RDX: 0000000000000000 RSI: ffff888003d7c200 RDI: ffff888004bc0000 [ 1.893228] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff888004bc0100 [ 1.893506] R10: ffffffffffffffff R11: ffffffff8185ca10 R12: ffff888004bc0000 [ 1.893797] R13: ffffc90000277900 R14: ffff888004ab2340 R15: ffff888003d86e00 [ 1.894060] FS: 00007ffa143a4640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 1.894412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.894682] CR2: 00005648577d9088 CR3: 00000000053da004 CR4: 0000000000170ee0 [ 1.894953] Call Trace: [ 1.895139] [ 1.895303] virtblk_prep_rq+0x1e5/0x280 [ 1.895509] virtio_queue_rq+0x5c/0x310 [ 1.895710] ? virtqueue_add_sgs+0x95/0xb0 [ 1.895905] ? _raw_spin_unlock_irqrestore+0x16/0x30 [ 1.896133] ? virtio_queue_rqs+0x340/0x390 [ 1.896453] ? sbitmap_get+0xfa/0x220 [ 1.896678] __blk_mq_issue_directly+0x41/0x180 [ 1.896906] blk_mq_plug_issue_direct+0xd8/0x2c0 [ 1.897115] blk_mq_flush_plug_list+0x115/0x180 [ 1.897342] blk_add_rq_to_plug+0x51/0x130 [ 1.897543] blk_mq_submit_bio+0x3a1/0x570 [ 1.897750] submit_bio_noacct_nocheck+0x418/0x520 [ 1.897985] ? submit_bio_noacct+0x1e/0x260 [ 1.897989] ext4_bio_write_page+0x222/0x420 [ 1.898000] mpage_process_page_bufs+0x178/0x1c0 [ 1.899451] mpage_prepare_extent_to_map+0x2d2/0x440 [ 1.899603] ext4_writepages+0x495/0x1020 [ 1.899733] do_writepages+0xcb/0x220 [ 1.899871] ? __seccomp_filter+0x171/0x7e0 [ 1.900006] file_write_and_wait_range+0xcd/0xf0 [ 1.900167] ext4_sync_file+0x72/0x320 [ 1.900308] __x64_sys_fsync+0x66/0xa0 [ 1.900449] do_syscall_64+0x31/0x50 [ 1.900595] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1.900747] RIP: 0033:0x7ffa16ec96ea [ 1.900883] Code: b8 4a 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 02 f8 ff 8b 7c 24 0c 89 c2 b8 4a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 43 03 f8 ff 8b 44 24 [ 1.901302] RSP: 002b:00007ffa143a3ac0 EFLAGS: 00000293 ORIG_RAX: 000000000000004a [ 1.901499] RAX: ffffffffffffffda RBX: 0000560277ec6fe0 RCX: 00007ffa16ec96ea [ 1.901696] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000016 [ 1.901884] RBP: 0000560277ec5910 R08: 0000000000000000 R09: 00007ffa143a4640 [ 1.902082] R10: 00007ffa16e4d39e R11: 0000000000000293 R12: 00005602773f59e0 [ 1.902459] R13: 0000000000000000 R14: 00007fffbfc007ff R15: 00007ffa13ba4000 [ 1.902763] [ 1.902877] ---[ end trace 0000000000000000 ]--- To avoid calling blk_mq_start_request() twice, This patch moves the execution of blk_mq_start_request() to the end of virtblk_prep_rq(). And instead of requeuing failed request to plug list in the error path of virtblk_add_req_batch(), it uses blk_mq_requeue_request() to change failed request state to MQ_RQ_IDLE. Then virtblk can safely handle the request on the next trial. Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()") Reported-by: Alexandre Courbot Tested-by: Alexandre Courbot Signed-off-by: Suwan Kim Message-Id: <20220830150153.12627-1-suwan.kim027@gmail.com> Signed-off-by: Michael S. Tsirkin Acked-by: Stefan Hajnoczi Reviewed-by: Pankaj Raghav commit dbe449d8f8f2ef91af729f0adcc9bef785873168 Author: Xuan Zhuo Date: Tue Aug 30 19:05:49 2022 +0800 virtio_test: fixup for vq reset Fix virtio test compilation failure caused by vq reset. ../../drivers/virtio/virtio_ring.c: In function ‘vring_create_virtqueue_packed’: ../../drivers/virtio/virtio_ring.c:1999:8: error: ‘struct virtqueue’ has no member named ‘reset’ 1999 | vq->vq.reset = false; | ^ ../../drivers/virtio/virtio_ring.c: In function ‘__vring_new_virtqueue’: ../../drivers/virtio/virtio_ring.c:2493:8: error: ‘struct virtqueue’ has no member named ‘reset’ 2493 | vq->vq.reset = false; | ^ ../../drivers/virtio/virtio_ring.c: In function ‘virtqueue_resize’: ../../drivers/virtio/virtio_ring.c:2587:18: error: ‘struct virtqueue’ has no member named ‘num_max’ 2587 | if (num > vq->vq.num_max) | ^ ../../drivers/virtio/virtio_ring.c:2596:11: error: ‘struct virtio_device’ has no member named ‘config’ 2596 | if (!vdev->config->disable_vq_and_reset) | ^~ ../../drivers/virtio/virtio_ring.c:2599:11: error: ‘struct virtio_device’ has no member named ‘config’ 2599 | if (!vdev->config->enable_vq_after_reset) | ^~ ../../drivers/virtio/virtio_ring.c:2602:12: error: ‘struct virtio_device’ has no member named ‘config’ 2602 | err = vdev->config->disable_vq_and_reset(_vq); | ^~ ../../drivers/virtio/virtio_ring.c:2614:10: error: ‘struct virtio_device’ has no member named ‘config’ 2614 | if (vdev->config->enable_vq_after_reset(_vq)) | ^~ make: *** [: virtio_ring.o] Error 1 Signed-off-by: Xuan Zhuo Message-Id: <20220830110549.103168-1-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 1bedcf22c081a6e9943f09937b2da8d3ef52d20d Author: lei he Date: Mon Sep 19 15:51:58 2022 +0800 virtio-crypto: fix memory-leak Fix memory-leak for virtio-crypto akcipher request, this problem is introduced by 59ca6c93387d3(virtio-crypto: implement RSA algorithm). The leak can be reproduced and tested with the following script inside virtual machine: #!/bin/bash LOOP_TIMES=10000 # required module: pkcs8_key_parser, virtio_crypto modprobe pkcs8_key_parser # if CONFIG_PKCS8_PRIVATE_KEY_PARSER=m modprobe virtio_crypto # if CONFIG_CRYPTO_DEV_VIRTIO=m rm -rf /tmp/data dd if=/dev/random of=/tmp/data count=1 bs=230 # generate private key and self-signed cert openssl req -nodes -x509 -newkey rsa:2048 -keyout key.pem \ -outform der -out cert.der \ -subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=always.com/emailAddress=yy@always.com" # convert private key from pem to der openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER -out key.der # add key PRIV_KEY_ID=`cat key.der | keyctl padd asymmetric test_priv_key @s` echo "priv key id = "$PRIV_KEY_ID PUB_KEY_ID=`cat cert.der | keyctl padd asymmetric test_pub_key @s` echo "pub key id = "$PUB_KEY_ID # query key keyctl pkey_query $PRIV_KEY_ID 0 keyctl pkey_query $PUB_KEY_ID 0 # here we only run pkey_encrypt becasuse it is the fastest interface function bench_pub() { keyctl pkey_encrypt $PUB_KEY_ID 0 /tmp/data enc=pkcs1 >/tmp/enc.pub } # do bench_pub in loop to obtain the memory leak for (( i = 0; i < ${LOOP_TIMES}; ++i )); do bench_pub done Signed-off-by: lei he Acked-by: Michael S. Tsirkin Reviewed-by: Gonglei Message-Id: <20220919075158.3625-1-helei.sig11@bytedance.com> Signed-off-by: Michael S. Tsirkin commit db5db1a00d0816207be3a0166fcb4f523eaf3b52 Author: Angus Chen Date: Fri Sep 23 17:10:13 2022 +0800 vdpa/ifcvf: fix the calculation of queuepair The q_pair_id to address a queue pair in the lm bar should be calculated by queue_id / 2 rather than queue_id / nr_vring. Fixes: 2ddae773c93b ("vDPA/ifcvf: detect and use the onboard number of queues directly") Signed-off-by: Angus Chen Reviewed-by: Jason Wang Reviewed-by: Michael S. Tsirkin Acked-by: Zhu Lingshan Message-Id: <20220923091013.191-1-angus.chen@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin commit 3b7329cf5a767c1be38352d43066012e220ad43c Author: Bokun Zhang Date: Wed Sep 28 00:30:04 2022 +0800 drm/amdgpu: Add amdgpu suspend-resume code path under SRIOV - Under SRIOV, we need to send REQ_GPU_FINI to the hypervisor during the suspend time. Furthermore, we cannot request a mode 1 reset under SRIOV as VF. Therefore, we will skip it as it is called in suspend_noirq() function. - In the resume code path, we need to send REQ_GPU_INIT to the hypervisor and also resume PSP IP block under SRIOV. Signed-off-by: Bokun Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 11e38360cc15e2d5995449d19030b13a67d73cb3 Author: Jiadong.Zhu Date: Fri Sep 23 21:17:53 2022 +0800 drm/amdgpu: Remove fence_process in count_emitted The function amdgpu_fence_count_emitted used in work_hander should not call amdgpu_fence_process which must be used in irq handler. Reviewed-by: Christian König Signed-off-by: Jiadong.Zhu Signed-off-by: Alex Deucher commit b3e45b18e5c40f1f7e5f6383953343f96f963b13 Author: Jiadong.Zhu Date: Thu Sep 15 15:19:20 2022 +0800 drm/amdgpu: Correct the position in patch_cond_exec The current position calulated in gfx_v9_0_ring_emit_patch_cond_exec underflows when the wptr is divisible by ring->buf_mask + 1. Reviewed-by: Christian König Signed-off-by: Jiadong.Zhu Signed-off-by: Alex Deucher commit 2d3907c152611a0d65efe54b93972320dcce1565 Author: Samson Tam Date: Fri Sep 9 17:16:32 2022 -0400 drm/amd/display: fill in clock values when DPM is not enabled [Why] For individual feature testing, PMFW may not report all clock values back. Driver will default them to 0 but this will cause the BB table to be skipped and default to one state with max clocks. [How] Add helper function to scan through initial clock values and populate them with default clock limits so that BB table can be built. Add dpm_enabled flag to check when DPM is not enabled and to trigger helper function. Reviewed-by: Jun Lei Acked-by: Jasdeep Dhillon Signed-off-by: Samson Tam Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a28acf7091babf4248b042326946cee7736f796a Author: Taimur Hassan Date: Tue Sep 13 18:35:20 2022 -0400 drm/amd/display: Avoid unnecessary pixel rate divider programming [Why] Programming pixel rate divider when FIFO is enabled can cause FIFO error. [How] Skip divider programming when divider values are the same to prevent FIFO error. Reviewed-by: Alvin Lee Acked-by: Jasdeep Dhillon Signed-off-by: Taimur Hassan Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8dd2e87dbd49ba0b6afc1dd22a5930d797cf423f Author: Eric Bernstein Date: Mon Mar 21 10:42:34 2022 -0400 drm/amd/display: Remove assert for odm transition case Remove assert that will hit during odm transition case, since this is a valid case. Signed-off-by: Eric Bernstein Reviewed-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 391ce355e72bd5713afc85ec5acc955294499dcf Author: Taimur Hassan Date: Wed Sep 14 16:25:31 2022 -0400 drm/amd/display: Fix typo in get_pixel_rate_div [Why & How] Some FIFO errors still occur due to reading wrong pixel rate divider. Fix typo to prevent FIFO error. Reviewed-by: Nicholas Kazlauskas Acked-by: Jasdeep Dhillon Signed-off-by: Taimur Hassan Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1ec5c0e1289c70c8e7dd93a988d945ad5bc3f4b1 Author: Aric Cyr Date: Wed Sep 14 12:54:52 2022 -0400 drm/amd/display: Fix audio on display after unplugging another Revert "dc: skip audio setup when audio stream is enabled" This reverts commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 [why] We have minimal pipe split transition method to avoid pipe allocation outage.However, this method will invoke audio setup which cause audio output stuck once pipe reallocate. [how] skip audio setup for pipelines which audio stream has been enabled Reviewed-by: Martin Leung Acked-by: Jasdeep Dhillon Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 85096a73f4dc223b5848e41ce40afc5ee913079e Author: Nicholas Kazlauskas Date: Thu Sep 8 11:11:47 2022 -0400 drm/amd/display: Add explicit FIFO disable for DP blank [Why] We rely on DMCUB to do this when disabling the link but it should actually come before we disable the DP VID stream. If we don't then the FIFO can end up with underflow that persists the next time it's enabled. [How] Add a DCN314 specific blank sequence that will disable the DIG FIFO first. Reviewed-by: Syed Hassan Acked-by: Jasdeep Dhillon Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ec669ef2e2cf277f3e73d842bb3bda1c3ea2ea73 Author: Nicholas Kazlauskas Date: Thu Sep 8 14:17:01 2022 -0400 drm/amd/display: Wrap OTG disable workaround with FIFO control [Why] The DIO FIFO will underflow if we turn off the OTG before we turn off the FIFO. Since this happens as part of the OTG workaround and we don't reset the FIFO afterwards we see the error persist. [How] Add disable FIFO before the disable CRTC and enable FIFO after enabling the CRTC. Reviewed-by: Syed Hassan Acked-by: Jasdeep Dhillon Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dd37fba90e72a48998d9f0eb5497088ea2b02ad1 Author: Nicholas Kazlauskas Date: Wed Sep 7 10:11:34 2022 -0400 drm/amd/display: Do DIO FIFO enable after DP video stream enable [Why] Avoids a race condition where DIO FIFO can underflow due to no incoming data available. [How] Shift the FIFO enable below stream enable. Make sure fullness level is written before the DIO reset takes place and that we're not doing it twice. Reviewed-by: Syed Hassan Acked-by: Jasdeep Dhillon Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b6d1c39bc637fe4879d610e6687b1d4224c4b2fb Author: Alvin Lee Date: Tue Sep 13 11:06:31 2022 -0400 drm/amd/display: Update DCN32 to use new SR latencies [Description] Update to new SR latencies for DCN32 Reviewed-by: Nevenko Stupar Reviewed-by: Jun Lei Acked-by: Jasdeep Dhillon Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 783d446749c09eb34178cb8600a9a93d3b99e35d Author: Taimur Hassan Date: Tue Sep 13 16:04:06 2022 -0400 drm/amd/display: Avoid avoid unnecessary pixel rate divider programming [Why] Programming pixel rate divider when FIFO is enabled can cause FIFO error. [How] Skip divider programming when divider values are the same to prevent FIFO error. Reviewed-by: Nicholas Kazlauskas Acked-by: Jasdeep Dhillon Signed-off-by: Taimur Hassan Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 664883ddde67971d59764f2dda855183ecf8bc46 Author: Graham Sider Date: Fri Sep 23 10:07:15 2022 -0400 drm/amdkfd: fix dropped interrupt in kfd_int_process_v11 Shader wave interrupts were getting dropped in event_interrupt_wq_v11 if the PRIV bit was set to 1. This would often lead to a hang. Until debugger logic is upstreamed, expand comment to stop early return. Signed-off-by: Graham Sider Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 91ef6cfd30bf75763f41e7a4bc119883fe190606 Author: Graham Sider Date: Mon Sep 19 13:57:14 2022 -0400 drm/amdgpu: pass queue size and is_aql_queue to MES Update mes_v11_api_def.h add_queue API with is_aql_queue parameter. Also re-use gds_size for the queue size (unused for KFD). MES requires the queue size in order to compute the actual wptr offset within the queue RB since it increases monotonically for AQL queues. v2: Make is_aql_queue assign clearer Signed-off-by: Graham Sider Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit a9b4700279f21c5c1a3425630dea86d338ab13b2 Author: Graham Sider Date: Tue Sep 20 17:16:13 2022 -0400 drm/amdkfd: fix MQD init for GFX11 in init_mqd Set remaining compute_static_thread_mgmt_se* accordingly. Signed-off-by: Graham Sider Acked-by: Alex Deucher Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit b9caeadf5cb89566412b94b14a1583419aeba45e Author: Evan Quan Date: Thu Sep 1 11:45:02 2022 +0800 drm/amd/pm: use adverse selection for dpm features unsupported by driver It's vbios and pmfw instead of driver who decide whether some dpm features is supported or not. Driver just de-selects those features which are not permitted on user's request. Thus, we use adverse selects model. Signed-off-by: Evan Quan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 3c480531a4b1652561fd16824c16be8b8a3ba8f1 Author: Evan Quan Date: Wed Aug 3 16:46:47 2022 +0800 drm/amd/pm: enable gfxoff feature for SMU 13.0.0 The feature is ready with latest 78.58.0 PMFW. Signed-off-by: Evan Quan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 7516777434570833469252c16e5fd7d8f73c45be Author: Evan Quan Date: Fri Aug 26 19:30:20 2022 +0800 drm/amdgpu: avoid gfx register accessing during gfxoff Make sure gfxoff is disabled before gfx register accessing. Signed-off-by: Evan Quan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit efd608fa7403ba106412b437f873929e2c862e28 Author: Nadav Amit Date: Wed Sep 21 18:09:32 2022 +0000 x86/alternative: Fix race in try_get_desc() I encountered some occasional crashes of poke_int3_handler() when kprobes are set, while accessing desc->vec. The text poke mechanism claims to have an RCU-like behavior, but it does not appear that there is any quiescent state to ensure that nobody holds reference to desc. As a result, the following race appears to be possible, which can lead to memory corruption. CPU0 CPU1 ---- ---- text_poke_bp_batch() -> smp_store_release(&bp_desc, &desc) [ notice that desc is on the stack ] poke_int3_handler() [ int3 might be kprobe's so sync events are do not help ] -> try_get_desc(descp=&bp_desc) desc = __READ_ONCE(bp_desc) if (!desc) [false, success] WRITE_ONCE(bp_desc, NULL); atomic_dec_and_test(&desc.refs) [ success, desc space on the stack is being reused and might have non-zero value. ] arch_atomic_inc_not_zero(&desc->refs) [ might succeed since desc points to stack memory that was freed and might be reused. ] Fix this issue with small backportable patch. Instead of trying to make RCU-like behavior for bp_desc, just eliminate the unnecessary level of indirection of bp_desc, and hold the whole descriptor as a global. Anyhow, there is only a single descriptor at any given moment. Fixes: 1f676247f36a4 ("x86/alternatives: Implement a better poke_int3_handler() completion scheme") Signed-off-by: Nadav Amit Signed-off-by: Peter Zijlstra (Intel) Cc: stable@kernel.org Link: https://lkml.kernel.org/r/20220920224743.3089-1-namit@vmware.com commit b3056ae2b57858b02b376b3fed6077040caf14b4 Author: Maciej Fijalkowski Date: Thu Sep 1 12:40:40 2022 +0200 ice: xsk: drop power of 2 ring size restriction for AF_XDP We had multiple customers in the past months that reported commit 296f13ff3854 ("ice: xsk: Force rings to be sized to power of 2") makes them unable to use ring size of 8160 in conjunction with AF_XDP. Remove this restriction. Fixes: 296f13ff3854 ("ice: xsk: Force rings to be sized to power of 2") CC: Alasdair McWilliam Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 29322791bc8b4f42fc65734840826e3ddc30921e Author: Maciej Fijalkowski Date: Thu Sep 1 12:40:39 2022 +0200 ice: xsk: change batched Tx descriptor cleaning AF_XDP Tx descriptor cleaning in ice driver currently works in a "lazy" way - descriptors are not cleaned immediately after send. We rather hold on with cleaning until we see that free space in ring drops below particular threshold. This was supposed to reduce the amount of unnecessary work related to cleaning and instead of keeping the ring empty, ring was rather saturated. In AF_XDP realm cleaning Tx descriptors implies producing them to CQ. This is a way of letting know user space that particular descriptor has been sent, as John points out in [0]. We tried to implement serial descriptor cleaning which would be used in conjunction with batched cleaning but it made code base more convoluted and probably harder to maintain in future. Therefore we step away from batched cleaning in a current form in favor of an approach where we set RS bit on every last descriptor from a batch and clean always at the beginning of ice_xmit_zc(). This means that we give up a bit of Tx performance, but this doesn't hurt l2fwd scenario which is way more meaningful than txonly as this can be treaten as AF_XDP based packet generator. l2fwd is not hurt due to the fact that Tx side is much faster than Rx and Rx is the one that has to catch Tx up. FWIW Tx descriptors are still produced in a batched way. [0]: https://lore.kernel.org/bpf/62b0a20232920_3573208ab@john.notmuch/ Fixes: 126cdfe1007a ("ice: xsk: Improve AF_XDP ZC Tx and use batching API") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 797666cd5af041ffb66642fff62f7389f08566a2 Author: Frank Wunderlich Date: Mon Sep 26 17:07:40 2022 +0200 net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 Add support for Dell 5811e (EM7455) with USB-id 0x413c:0x81c2. Signed-off-by: Frank Wunderlich Cc: stable@vger.kernel.org Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/20220926150740.6684-3-linux@fw-web.de Signed-off-by: Jakub Kicinski commit e62563db857f81d75c5726a35bc0180bed6d1540 Author: Sebastian Krzyszkowiak Date: Tue Sep 27 07:15:45 2022 -0700 Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address Both i.MX6 and i.MX8 reference manuals list 0xBF8 as SNVS_HPVIDR1 (chapters 57.9 and 6.4.5 respectively). Without this, trying to read the revision number results in 0 on all revisions, causing the i.MX6 quirk to apply on all platforms, which in turn causes the driver to synthesise power button release events instead of passing the real one as they happen even on platforms like i.MX8 where that's not wanted. Fixes: 1a26c920717a ("Input: snvs_pwrkey - send key events for i.MX6 S, DL and Q") Tested-by: Martin Kepplinger Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Mattijs Korpershoek Cc: Link: https://lore.kernel.org/r/4599101.ElGaqSPkdT@pliszka Signed-off-by: Dmitry Torokhov commit 46452d3786a82bd732ba73fb308ae5cbe4e1e591 Merge: a1375562c0a87 c35fbea48659e Author: Linus Torvalds Date: Tue Sep 27 07:14:58 2022 -0700 Merge tag 'sound-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few device-specific fixes, mostly for ASoC. All look small / trivial enough" * tag 'sound-6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: intel-dsp-config: add missing RaptorLake PCI IDs ASoC: tas2770: Reinit regcache on reset ASoC: nau8824: Fix semaphore is released unexpectedly ASoC: Intel: sof_sdw: add support for Dell SKU 0AFF ASoC: imx-card: Fix refcount issue with of_node_put ASoC: rt5640: Fix the issue of the abnormal JD2 status commit c0cca6a66458a0daa627774de7ca2b678a6bb3d8 Merge: 57646d6769f13 e7ccba7728cff Author: Borislav Petkov Date: Tue Sep 27 15:29:33 2022 +0200 Merge tag 'irqchip-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull more irqchip fixes for 6.0 from Marc Zyngier: - A couple of configuration fixes for the recently merged Loongarch drivers - A fix to avoid dynamic allocation of a cpumask which was causing issues with PREEMPT_RT and the GICv3 ITS - A tightening of an error check in the stm32 exti driver Link: https://lore.kernel.org/r/20220916085158.2592518-1-maz@kernel.org commit 0f816e024f2fb5a52ebd42daf07233a5b45c25dd Author: David Matlack Date: Mon Sep 26 10:14:57 2022 -0700 KVM: selftests: Skip tests that require EPT when it is not available Skip selftests that require EPT support in the VM when it is not available. For example, if running on a machine where kvm_intel.ept=N since KVM does not offer EPT support to guests if EPT is not supported on the host. This commit causes vmx_dirty_log_test to be skipped instead of failing on hosts where kvm_intel.ept=N. Signed-off-by: David Matlack Message-Id: <20220926171457.532542-1-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit e7afa79a3b35a27a046a2139f8b20bd6b98155c2 Author: Wenchao Chen Date: Fri Sep 16 17:05:06 2022 +0800 mmc: hsq: Fix data stomping during mmc recovery The block device uses multiple queues to access emmc. There will be up to 3 requests in the hsq of the host. The current code will check whether there is a request doing recovery before entering the queue, but it will not check whether there is a request when the lock is issued. The request is in recovery mode. If there is a request in recovery, then a read and write request is initiated at this time, and the conflict between the request and the recovery request will cause the data to be trampled. Signed-off-by: Wenchao Chen Fixes: 511ce378e16f ("mmc: Add MMC host software queue support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220916090506.10662-1-wenchao.chen666@gmail.com Signed-off-by: Ulf Hansson commit bc7a319844891746135dc1f34ab9df78d636a3ac Author: Wang Yufen Date: Fri Sep 23 15:02:37 2022 +0800 selftests: Fix the if conditions of in test_extra_filter() The socket 2 bind the addr in use, bind should fail with EADDRINUSE. So if bind success or errno != EADDRINUSE, testcase should be failed. Fixes: 3ca8e4029969 ("soreuseport: BPF selection functional test") Signed-off-by: Wang Yufen Link: https://lore.kernel.org/r/1663916557-10730-1-git-send-email-wangyufen@huawei.com Signed-off-by: Paolo Abeni commit 0fb9703a3eade0bb84c635705d9c795345e55053 Author: Hongling Zeng Date: Fri Sep 23 10:46:35 2022 +0800 uas: ignore UAS for Thinkplus chips The UAS mode of Thinkplus(0x17ef, 0x3899) is reported to influence performance and trigger kernel panic on several platforms with the following error message: [ 39.702439] xhci_hcd 0000:0c:00.3: ERROR Transfer event for disabled endpoint or incorrect stream ring [ 39.702442] xhci_hcd 0000:0c:00.3: @000000026c61f810 00000000 00000000 1b000000 05038000 [ 720.545894][13] Workqueue: usb_hub_wq hub_event [ 720.550971][13] ffff88026c143c38 0000000000016300 ffff8802755bb900 ffff880 26cb80000 [ 720.559673][13] ffff88026c144000 ffff88026ca88100 0000000000000000 ffff880 26cb80000 [ 720.568374][13] ffff88026cb80000 ffff88026c143c50 ffffffff8186ae25 ffff880 26ca880f8 [ 720.577076][13] Call Trace: [ 720.580201][13] [] schedule+0x35/0x80 [ 720.586137][13] [] schedule_preempt_disabled+0xe/0x10 [ 720.593623][13] [] __mutex_lock_slowpath+0x164/0x1e0 [ 720.601012][13] [] mutex_lock+0x2f/0x40 [ 720.607141][13] [] usb_disconnect+0x59/0x290 Falling back to USB mass storage can solve this problem, so ignore UAS function of this chip. Acked-by: Alan Stern Cc: stable Signed-off-by: Hongling Zeng Link: https://lore.kernel.org/r/1663902249837086.19.seg@mailgw Signed-off-by: Greg Kroah-Hartman commit e00b488e813f0f1ad9f778e771b7cd2fe2877023 Author: Hongling Zeng Date: Fri Sep 23 10:46:25 2022 +0800 usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS The UAS mode of Hiksemi USB_HDD is reported to fail to work on several platforms with the following error message, then after re-connecting the device will be offlined and not working at all. [ 592.518442][ 2] sd 8:0:0:0: [sda] tag#17 uas_eh_abort_handler 0 uas-tag 18 inflight: CMD [ 592.527575][ 2] sd 8:0:0:0: [sda] tag#17 CDB: Write(10) 2a 00 03 6f 88 00 00 04 00 00 [ 592.536330][ 2] sd 8:0:0:0: [sda] tag#0 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD [ 592.545266][ 2] sd 8:0:0:0: [sda] tag#0 CDB: Write(10) 2a 00 07 44 1a 88 00 00 08 00 These disks have a broken uas implementation, the tag field of the status iu-s is not set properly,so we need to fall-back to usb-storage. Acked-by: Alan Stern Cc: stable Signed-off-by: Hongling Zeng Link: https://lore.kernel.org/r/1663901185-21067-1-git-send-email-zenghongling@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit a625a4b8806cc1e928b7dd2cca1fee709c9de56e Author: Hongling Zeng Date: Fri Sep 23 10:46:13 2022 +0800 uas: add no-uas quirk for Hiksemi usb_disk The UAS mode of Hiksemi is reported to fail to work on several platforms with the following error message, then after re-connecting the device will be offlined and not working at all. [ 592.518442][ 2] sd 8:0:0:0: [sda] tag#17 uas_eh_abort_handler 0 uas-tag 18 inflight: CMD [ 592.527575][ 2] sd 8:0:0:0: [sda] tag#17 CDB: Write(10) 2a 00 03 6f 88 00 00 04 00 00 [ 592.536330][ 2] sd 8:0:0:0: [sda] tag#0 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD [ 592.545266][ 2] sd 8:0:0:0: [sda] tag#0 CDB: Write(10) 2a 00 07 44 1a 88 00 00 08 00 These disks have a broken uas implementation, the tag field of the status iu-s is not set properly,so we need to fall-back to usb-storage. Acked-by: Alan Stern Cc: stable Signed-off-by: Hongling Zeng Link: https://lore.kernel.org/r/1663901173-21020-1-git-send-email-zenghongling@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit f5c5936d6b4dfd3f9a145be5bc6ff27eb706bc39 Author: Patrice Chotard Date: Mon Sep 26 14:43:59 2022 +0200 usb: dwc3: st: Fix node's child name Update node's child name from "dwc3" to "usb", this fixes the following issue: [3.773852] usb-st-dwc3 8f94000.dwc3: failed to find dwc3 core node Fixes: 3120910a099b ("ARM: dts: stih407-family: Harmonize DWC USB3 DT nodes name") Reported-by: Jerome Audu Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20220926124359.304770-1-patrice.chotard@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 415ba26cb73f7d22a892043301b91b57ae54db02 Author: Heikki Krogerus Date: Thu Sep 22 17:59:24 2022 +0300 usb: typec: ucsi: Remove incorrect warning Sink only devices do not have any source capabilities, so the driver should not warn about that. Also DRP (Dual Role Power) capable devices, such as USB Type-C docking stations, do not return any source capabilities unless they are plugged to a power supply themselves. Fixes: 1f4642b72be7 ("usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4") Reported-by: Paul Menzel Cc: Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20220922145924.80667-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ea64cdfad124922c931633e39287c5a31a9b14a1 Author: Lukas Wunner Date: Fri Sep 23 06:09:52 2022 +0200 net: phy: Don't WARN for PHY_UP state in mdio_bus_phy_resume() Commit 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") introduced a WARN() on resume from system sleep if a PHY is not in PHY_HALTED state. Commit 6dbe852c379f ("net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume()") added an exemption for PHY_READY state from the WARN(). It turns out PHY_UP state needs to be exempted as well because the following may happen on suspend: mdio_bus_phy_suspend() phy_stop_machine() phydev->state = PHY_UP # if (phydev->state >= PHY_UP) Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Link: https://lore.kernel.org/netdev/2b1a1588-505e-dff3-301d-bfc1fb14d685@samsung.com/ Signed-off-by: Lukas Wunner Acked-by: Florian Fainelli Cc: Xiaolei Wang Link: https://lore.kernel.org/r/8128fdb51eeebc9efbf3776a4097363a1317aaf1.1663905575.git.lukas@wunner.de Signed-off-by: Paolo Abeni commit f208ce4d45c5884eae2b8a67bed1c3d646cafc15 Merge: f76349cf41451 31f87f705b3c1 Author: Greg Kroah-Hartman Date: Tue Sep 27 10:47:36 2022 +0200 Merge tag 'thunderbolt-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: "thunderbolt: Fix for v6.0 final This includes a single fix from Mario that resets the plug event delay back to the USB4 spec value. This has been in linux-next with no reported issues." * tag 'thunderbolt-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Explicitly reset plug events delay back to USB4 spec value commit 49725ffc15fc4e9fae68c55b691fd25168cbe5c1 Author: Junxiao Chang Date: Fri Sep 23 13:04:48 2022 +0800 net: stmmac: power up/down serdes in stmmac_open/release This commit fixes DMA engine reset timeout issue in suspend/resume with ADLink I-Pi SMARC Plus board which dmesg shows: ... [ 54.678271] PM: suspend exit [ 54.754066] intel-eth-pci 0000:00:1d.2 enp0s29f2: PHY [stmmac-3:01] driver [Maxlinear Ethernet GPY215B] (irq=POLL) [ 54.755808] intel-eth-pci 0000:00:1d.2 enp0s29f2: Register MEM_TYPE_PAGE_POOL RxQ-0 ... [ 54.780482] intel-eth-pci 0000:00:1d.2 enp0s29f2: Register MEM_TYPE_PAGE_POOL RxQ-7 [ 55.784098] intel-eth-pci 0000:00:1d.2: Failed to reset the dma [ 55.784111] intel-eth-pci 0000:00:1d.2 enp0s29f2: stmmac_hw_setup: DMA engine initialization failed [ 55.784115] intel-eth-pci 0000:00:1d.2 enp0s29f2: stmmac_open: Hw setup failed ... The issue is related with serdes which impacts clock. There is serdes in ADLink I-Pi SMARC board ethernet controller. Please refer to commit b9663b7ca6ff78 ("net: stmmac: Enable SERDES power up/down sequence") for detial. When issue is reproduced, DMA engine clock is not ready because serdes is not powered up. To reproduce DMA engine reset timeout issue with hardware which has serdes in GBE controller, install Ubuntu. In Ubuntu GUI, click "Power Off/Log Out" -> "Suspend" menu, it disables network interface, then goes to sleep mode. When it wakes up, it enables network interface again. Stmmac driver is called in this way: 1. stmmac_release: Stop network interface. In this function, it disables DMA engine and network interface; 2. stmmac_suspend: It is called in kernel suspend flow. But because network interface has been disabled(netif_running(ndev) is false), it does nothing and returns directly; 3. System goes into S3 or S0ix state. Some time later, system is waken up by keyboard or mouse; 4. stmmac_resume: It does nothing because network interface has been disabled; 5. stmmac_open: It is called to enable network interace again. DMA engine is initialized in this API, but serdes is not power on so there will be DMA engine reset timeout issue. Similarly, serdes powerdown should be added in stmmac_release. Network interface might be disabled by cmd "ifconfig eth0 down", DMA engine, phy and mac have been disabled in ndo_stop callback, serdes should be powered down as well. It doesn't make sense that serdes is on while other components have been turned off. If ethernet interface is in enabled state(netif_running(ndev) is true) before suspend/resume, the issue couldn't be reproduced because serdes could be powered up in stmmac_resume. Because serdes_powerup is added in stmmac_open, it doesn't need to be called in probe function. Fixes: b9663b7ca6ff78 ("net: stmmac: Enable SERDES power up/down sequence") Signed-off-by: Junxiao Chang Reviewed-by: Voon Weifeng Tested-by: Jimmy JS Chen Tested-by: Looi, Hong Aun Link: https://lore.kernel.org/r/20220923050448.1220250-1-junxiao.chang@intel.com Signed-off-by: Paolo Abeni commit 6546646a7fb0d7fe1caef947889497c16aaecc8c Author: Rafael Mendonca Date: Sun Sep 25 11:34:19 2022 -0300 wifi: mac80211: mlme: Fix double unlock on assoc success handling Commit 6911458dc428 ("wifi: mac80211: mlme: refactor assoc success handling") moved the per-link setup out of ieee80211_assoc_success() into a new function ieee80211_assoc_config_link() but missed to remove the unlock of 'sta_mtx' in case of HE capability/operation missing on HE AP, which leads to a double unlock: ieee80211_assoc_success() { ... ieee80211_assoc_config_link() { ... if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) && (!elems->he_cap || !elems->he_operation)) { mutex_unlock(&sdata->local->sta_mtx); ... } ... } ... mutex_unlock(&sdata->local->sta_mtx); ... } Fixes: 6911458dc428 ("wifi: mac80211: mlme: refactor assoc success handling") Signed-off-by: Rafael Mendonca Link: https://lore.kernel.org/r/20220925143420.784975-1-rafaelmendsr@gmail.com Signed-off-by: Johannes Berg commit 883b8dc1a8766464d5bde4d97e1d7c795d990d31 Author: Rafael Mendonca Date: Sat Sep 24 15:40:41 2022 -0300 wifi: mac80211: mlme: Fix missing unlock on beacon RX Commit 98b0b467466c ("wifi: mac80211: mlme: use correct link_sta") switched to link station instead of deflink and added some checks to do that, which are done with the 'sta_mtx' mutex held. However, the error path of these checks does not unlock 'sta_mtx' before returning. Fixes: 98b0b467466c ("wifi: mac80211: mlme: use correct link_sta") Signed-off-by: Rafael Mendonca Link: https://lore.kernel.org/r/20220924184042.778676-1-rafaelmendsr@gmail.com Signed-off-by: Johannes Berg commit be92292b90bfdc31f332c962882b6d3ea0285fdf Author: Paweł Lenkow Date: Mon Sep 19 17:01:35 2022 +0200 wifi: mac80211: fix memory corruption in minstrel_ht_update_rates() During our testing of WFM200 module over SDIO on i.MX6Q-based platform, we discovered a memory corruption on the system, tracing back to the wfx driver. Using kfence, it was possible to trace it back to the root cause, which is hw->max_rates set to 8 in wfx_init_common, while the maximum defined by IEEE80211_TX_TABLE_SIZE is 4. This causes array out-of-bounds writes during updates of the rate table, as seen below: BUG: KFENCE: memory corruption in kfree_rcu_work+0x320/0x36c Corrupted memory at 0xe0a4ffe0 [ 0x03 0x03 0x03 0x03 0x01 0x00 0x00 0x02 0x02 0x02 0x09 0x00 0x21 0xbb 0xbb 0xbb ] (in kfence-#81): kfree_rcu_work+0x320/0x36c process_one_work+0x3ec/0x920 worker_thread+0x60/0x7a4 kthread+0x174/0x1b4 ret_from_fork+0x14/0x2c 0x0 kfence-#81: 0xe0a4ffc0-0xe0a4ffdf, size=32, cache=kmalloc-64 allocated by task 297 on cpu 0 at 631.039555s: minstrel_ht_update_rates+0x38/0x2b0 [mac80211] rate_control_tx_status+0xb4/0x148 [mac80211] ieee80211_tx_status_ext+0x364/0x1030 [mac80211] ieee80211_tx_status+0xe0/0x118 [mac80211] ieee80211_tasklet_handler+0xb0/0xe0 [mac80211] tasklet_action_common.constprop.0+0x11c/0x148 __do_softirq+0x1a4/0x61c irq_exit+0xcc/0x104 call_with_stack+0x18/0x20 __irq_svc+0x80/0xb0 wq_worker_sleeping+0x10/0x100 wq_worker_sleeping+0x10/0x100 schedule+0x50/0xe0 schedule_timeout+0x2e0/0x474 wait_for_completion+0xdc/0x1ec mmc_wait_for_req_done+0xc4/0xf8 mmc_io_rw_extended+0x3b4/0x4ec sdio_io_rw_ext_helper+0x290/0x384 sdio_memcpy_toio+0x30/0x38 wfx_sdio_copy_to_io+0x88/0x108 [wfx] wfx_data_write+0x88/0x1f0 [wfx] bh_work+0x1c8/0xcc0 [wfx] process_one_work+0x3ec/0x920 worker_thread+0x60/0x7a4 kthread+0x174/0x1b4 ret_from_fork+0x14/0x2c 0x0 After discussion on the wireless mailing list it was clarified that the issue has been introduced by: commit ee0e16ab756a ("mac80211: minstrel_ht: fill all requested rates") and fix shall be in minstrel_ht_update_rates in rc80211_minstrel_ht.c. Fixes: ee0e16ab756a ("mac80211: minstrel_ht: fill all requested rates") Link: https://lore.kernel.org/all/12e5adcd-8aed-f0f7-70cc-4fb7b656b829@camlingroup.com/ Link: https://lore.kernel.org/linux-wireless/20220915131445.30600-1-lech.perczak@camlingroup.com/ Cc: Jérôme Pouiller Cc: Johannes Berg Cc: Peter Seiderer Cc: Kalle Valo Cc: Krzysztof Drobiński , Signed-off-by: Paweł Lenkow Signed-off-by: Lech Perczak Reviewed-by: Peter Seiderer Reviewed-by: Jérôme Pouiller Acked-by: Felix Fietkau Signed-off-by: Johannes Berg commit d873697ef2b7e1b6fdd8e9d449d9354bd5d29a4a Author: Hans de Goede Date: Sun Sep 18 21:20:52 2022 +0200 wifi: mac80211: fix regression with non-QoS drivers Commit 10cb8e617560 ("mac80211: enable QoS support for nl80211 ctrl port") changed ieee80211_tx_control_port() to aways call __ieee80211_select_queue() without checking local->hw.queues. __ieee80211_select_queue() returns a queue-id between 0 and 3, which means that now ieee80211_tx_control_port() may end up setting the queue-mapping for a skb to a value higher then local->hw.queues if local->hw.queues is less then 4. Specifically this is a problem for ralink rt2500-pci cards where local->hw.queues is 2. There this causes rt2x00queue_get_tx_queue() to return NULL and the following error to be logged: "ieee80211 phy0: rt2x00mac_tx: Error - Attempt to send packet over invalid queue 2", after which association with the AP fails. Other callers of __ieee80211_select_queue() skip calling it when local->hw.queues < IEEE80211_NUM_ACS, add the same check to ieee80211_tx_control_port(). This fixes ralink rt2500-pci and similar cards when less then 4 tx-queues no longer working. Fixes: 10cb8e617560 ("mac80211: enable QoS support for nl80211 ctrl port") Cc: Markus Theil Suggested-by: Stanislaw Gruszka Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220918192052.443529-1-hdegoede@redhat.com Signed-off-by: Johannes Berg commit 527008e5e87600a389feb8a57042c928ecca195d Author: Alexander Wetzel Date: Thu Sep 15 15:09:46 2022 +0200 wifi: mac80211: ensure vif queues are operational after start Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync. When a new vif is created the queues may end up in an inconsistent state and be inoperable: Communication not using iTXQ will work, allowing to e.g. complete the association. But the 4-way handshake will time out. The sta will not send out any skbs queued in iTXQs. All normal attempts to start the queues will fail when reaching this state. local->queue_stop_reasons will have marked all queues as operational but vif.txqs_stopped will still be set, creating an inconsistent internal state. In reality this seems to be race between the mac80211 function ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet: Depending on the driver and the timing the queues may end up to be operational or not. Cc: stable@vger.kernel.org Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped") Signed-off-by: Alexander Wetzel Acked-by: Felix Fietkau Link: https://lore.kernel.org/r/20220915130946.302803-1-alexander@wetzel-home.de Signed-off-by: Johannes Berg commit b7ce33df1ce2b6631234233c5367bcfe9c67fbe9 Author: Alexander Wetzel Date: Thu Sep 15 14:41:20 2022 +0200 wifi: mac80211: don't start TX with fq->lock to fix deadlock ieee80211_txq_purge() calls fq_tin_reset() and ieee80211_purge_tx_queue(); Both are then calling ieee80211_free_txskb(). Which can decide to TX the skb again. There are at least two ways to get a deadlock: 1) When we have a TDLS teardown packet queued in either tin or frags ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit() while we still hold fq->lock. ieee80211_txq_enqueue() will thus deadlock. 2) A variant of the above happens if aggregation is up and running: In that case ieee80211_iface_work() will deadlock with the original task: The original tasks already holds fq->lock and tries to get sta->lock after kicking off ieee80211_iface_work(). But the worker can get sta->lock prior to the original task and will then spin for fq->lock. Avoid these deadlocks by not sending out any skbs when called via ieee80211_free_txskb(). Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20220915124120.301918-1-alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 64e966d1e84b29c9fa916cfeaabbf4013703942e Author: Tamizh Chelvam Raja Date: Thu Sep 8 23:40:34 2022 +0530 wifi: cfg80211: fix MCS divisor value The Bitrate for HE/EHT MCS6 is calculated wrongly due to the incorrect MCS divisor value for mcs6. Fix it with the proper value. previous mcs_divisor value = (11769/6144) = 1.915527 fixed mcs_divisor value = (11377/6144) = 1.851725 Fixes: 9c97c88d2f4b ("cfg80211: Add support to calculate and report 4096-QAM HE rates") Signed-off-by: Tamizh Chelvam Raja Link: https://lore.kernel.org/r/20220908181034.9936-1-quic_tamizhr@quicinc.com Signed-off-by: Johannes Berg commit 3a99c4474112f49a5459933d8758614002ca0ddc Author: Nicolas Dufresne Date: Fri Jun 10 13:52:11 2022 +0100 media: rkvdec: Disable H.264 error detection Quite often, the HW get stuck in error condition if a stream error was detected. As documented, the HW should stop immediately and self reset. There is likely a problem or a miss-understanding of the self reset mechanism, as unless we make a long pause, the next command will then report an error even if there is no error in it. Disabling error detection fixes the issue, and let the decoder continue after an error. This patch is safe for backport into older kernels. Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") Signed-off-by: Nicolas Dufresne Reviewed-by: Brian Norris Tested-by: Brian Norris Reviewed-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit a2d2e593d39bc2f29a1cd5e3779af457fd26490c Author: Nícolas F. R. A. Prado Date: Fri Jun 17 21:39:06 2022 +0100 media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ) Commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") removed support for calling platform_get_resource(..., IORESOURCE_IRQ, ...) on DT-based drivers, but the probe() function of mtk-vcodec's encoder was still making use of it. This caused the encoder driver to fail probe. Since the platform_get_resource() call was only being used to check for the presence of the interrupt (its returned resource wasn't even used) and platform_get_irq() was already being used to get the IRQ, simply drop the use of platform_get_resource(IORESOURCE_IRQ) and handle the failure of platform_get_irq(), to get the driver probing again. [hverkuil: drop unused struct resource *res] Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") Signed-off-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 37238699073e7e93f05517e529661151173cd458 Author: Hangyu Hua Date: Thu May 19 03:17:43 2022 +0100 media: dvb_vb2: fix possible out of bound access vb2_core_qbuf and vb2_core_querybuf don't check the range of b->index controlled by the user. Fix this by adding range checking code before using them. Fixes: 57868acc369a ("media: videobuf2: Add new uAPI for DVB streaming I/O") Signed-off-by: Hangyu Hua Reviewed-by: Sergey Senozhatsky Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit f0da34f32920c16f34acb692cf1646465bd40c04 Author: Hans Verkuil Date: Wed May 18 14:06:31 2022 +0100 media: v4l2-ioctl.c: fix incorrect error path If allocating array_buf fails, or copying data from userspace into that buffer fails, then just free memory and return the error. Don't attempt to call video_put_user() since there is no point, and it would copy back data on error even if INFO_FL_ALWAYS_COPY wasn't set. So if writing the array back to userspace fails, then don't go to out_array_args, instead just continue with the regular code that just returns the error unless 'always_copy' is set. Update the VIDIOC_G/S/TRY_EXT_CTRLS ioctls to set the ALWAYS_COPY flag since they now need it. Before this worked due to this buggy code, but now that that is fixed these ioctls need to set this flag explicitly. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 4e768c8e34e639cff66a0f175bc4aebf472e4305 Author: Hans Verkuil Date: Mon Mar 21 08:33:56 2022 +0000 media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args() The v4l2_compat_get_array_args() function can leave uninitialized memory in the buffer it is passed. So zero it before copying array elements from userspace into the buffer. Signed-off-by: Hans Verkuil Reported-by: syzbot+ff18193ff05f3f87f226@syzkaller.appspotmail.com Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit d14c273132aec81a1a8107c9ab4865b89e7910a7 Author: Tina Hsu Date: Thu Sep 22 14:16:30 2022 +0800 nvme-pci: disable Write Zeroes on Phison E3C/E4C E3C/E4C SSDs do support the Write Zeroes command in theory, but have very bad performance when using it. As the firmware has been frozen for these products we can not expect firmware improvements for it, so disable Write Zeroes. Signed-off-by: Tina Hsu [hch: update the commit message] Signed-off-by: Christoph Hellwig commit c292a337d0e45a292c301e3cd51c35aa0ae91e95 Author: Michael Kelley Date: Thu Sep 22 21:49:09 2022 -0700 nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices The IOC_PR_CLEAR and IOC_PR_RELEASE ioctls are non-functional on NVMe devices because the nvme_pr_clear() and nvme_pr_release() functions set the IEKEY field incorrectly. The IEKEY field should be set only when the key is zero (i.e, not specified). The current code does it backwards. Furthermore, the NVMe spec describes the persistent reservation "clear" function as an option on the reservation release command. The current implementation of nvme_pr_clear() erroneously uses the reservation register command. Fix these errors. Note that NVMe version 1.3 and later specify that setting the IEKEY field will return an error of Invalid Field in Command. The fix will set IEKEY when the key is zero, which is appropriate as these ioctls consider a zero key to be "unspecified", and the intention of the spec change is to require a valid key. Tested on a version 1.4 PCI NVMe device in an Azure VM. Fixes: 1673f1f08c88 ("nvme: move block_device_operations and ns/ctrl freeing to common code") Fixes: 1d277a637a71 ("NVMe: Add persistent reservation ops") Signed-off-by: Michael Kelley Signed-off-by: Christoph Hellwig commit ea08aec7e77bfd6599489ec430f9f859ab84575a Author: Niklas Cassel Date: Mon Sep 26 18:38:09 2022 +0000 libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 Commit 1527f69204fe ("ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile") added an explicit entry for AMD Green Sardine AHCI controller using the board_ahci_mobile configuration (this configuration has later been renamed to board_ahci_low_power). The board_ahci_low_power configuration enables support for low power modes. This explicit entry takes precedence over the generic AHCI controller entry, which does not enable support for low power modes. Therefore, when commit 1527f69204fe ("ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile") was backported to stable kernels, it make some Pioneer optical drives, which was working perfectly fine before the commit was backported, stop working. The real problem is that the Pioneer optical drives do not handle low power modes correctly. If these optical drives would have been tested on another AHCI controller using the board_ahci_low_power configuration, this issue would have been detected earlier. Unfortunately, the board_ahci_low_power configuration is only used in less than 15% of the total AHCI controller entries, so many devices have never been tested with an AHCI controller with low power modes. Fixes: 1527f69204fe ("ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile") Cc: stable@vger.kernel.org Reported-by: Jaap Berkhout Signed-off-by: Niklas Cassel Reviewed-by: Mario Limonciello Signed-off-by: Damien Le Moal commit a1375562c0a87f0fa2eaf3e8ce15824696d4170a Merge: 3800a713b6070 e400ad8b7e6a1 Author: Linus Torvalds Date: Mon Sep 26 14:53:38 2022 -0700 Merge tag 'x86_urgent_for_v6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: - A performance fix for recent large AMD systems that avoids an ancient cpu idle hardware workaround - A new Intel model number. Folks like these upstream as soon as possible so that each developer doing feature development doesn't need to carry their own #define - SGX fixes for a userspace crash and a rare kernel warning * tag 'x86_urgent_for_v6.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems x86/sgx: Handle VA page allocation failure for EAUG on PF. x86/sgx: Do not fail on incomplete sanitization on premature stop of ksgxd x86/cpu: Add CPU model numbers for Meteor Lake commit 7bea67a994300c7dff827d1eb2344c180d1ffd93 Author: Linus Walleij Date: Mon Sep 26 09:33:11 2022 +0200 ARM: dts: integrator: Fix DMA ranges A recent change affecting the behaviour of phys_to_dma() to actually require the device tree ranges to work unmasked a bug in the Integrator DMA ranges. The PL110 uses the CMA allocator to obtain coherent allocations from a dedicated 1MB video memory, leading to the following call chain: drm_gem_cma_create() dma_alloc_attrs() dma_alloc_from_dev_coherent() __dma_alloc_from_coherent() dma_get_device_base() phys_to_dma() translate_phys_to_dma() phys_to_dma() by way of translate_phys_to_dma() will nowadays not provide 1:1 mappings unless the ranges are properly defined in the device tree and reflected into the dev->dma_range_map. There is a bug in the device trees because the DMA ranges are incorrectly specified, and the patch uncovers this bug. Solution: - Fix the LB (logic bus) ranges to be 1-to-1 like they should have always been. - Provide a 1:1 dma-ranges attribute to the PL110. - Mark the PL110 display controller as DMA coherent. This makes the DMA ranges work right and makes the PL110 framebuffer work again. Fixes: af6f23b88e95 ("ARM/dma-mapping: use the generic versions of dma_to_phys/phys_to_dma by default") Signed-off-by: Linus Walleij Cc: Christoph Hellwig Cc: Arnd Bergmann Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220926073311.1610568-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit 3800a713b6070d4f03fb43613a7b7d536a99b2b7 Merge: 3a710532cfe58 59298997df89e Author: Linus Torvalds Date: Mon Sep 26 13:23:15 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull last (?) hotfixes from Andrew Morton: "26 hotfixes. 8 are for issues which were introduced during this -rc cycle, 18 are for earlier issues, and are cc:stable" * tag 'mm-hotfixes-stable-2022-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (26 commits) x86/uaccess: avoid check_object_size() in copy_from_user_nmi() mm/page_isolation: fix isolate_single_pageblock() isolation behavior mm,hwpoison: check mm when killing accessing process mm/hugetlb: correct demote page offset logic mm: prevent page_frag_alloc() from corrupting the memory mm: bring back update_mmu_cache() to finish_fault() frontswap: don't call ->init if no ops are registered mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() mm: fix madivse_pageout mishandling on non-LRU page powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush mm: gup: fix the fast GUP race against THP collapse mm: fix dereferencing possible ERR_PTR vmscan: check folio_test_private(), not folio_get_private() mm: fix VM_BUG_ON in __delete_from_swap_cache() tools: fix compilation after gfp_types.h split mm/damon/dbgfs: fix memory leak when using debugfs_lookup() mm/migrate_device.c: copy pte dirty bit to page mm/migrate_device.c: add missing flush_cache_page() mm/migrate_device.c: flush TLB while holding PTL x86/mm: disable instrumentations of mm/pgprot.c ... commit 0dc383796f9c59d7297190aa864b986eaf2f73e6 Author: ruanjinjie Date: Fri Sep 23 17:43:20 2022 +0800 net: hippi: Add missing pci_disable_device() in rr_init_one() Add missing pci_disable_device() if rr_init_one() fails Signed-off-by: ruanjinjie Link: https://lore.kernel.org/r/20220923094320.3109154-1-ruanjinjie@huawei.com Signed-off-by: Jakub Kicinski commit 4774db8dfc6a2e6649920ebb2fc8e2f062c2080d Author: Peng Wu Date: Fri Sep 23 02:36:40 2022 +0000 net/mlxbf_gige: Fix an IS_ERR() vs NULL bug in mlxbf_gige_mdio_probe The devm_ioremap() function returns NULL on error, it doesn't return error pointers. Fixes: 3a1a274e933f ("mlxbf_gige: compute MDIO period based on i1clk") Signed-off-by: Peng Wu Link: https://lore.kernel.org/r/20220923023640.116057-1-wupeng58@huawei.com Signed-off-by: Jakub Kicinski commit c635ebe8d911a93bd849a9419b01a58783de76f1 Author: Rafael Mendonca Date: Thu Sep 22 14:51:08 2022 -0300 cxgb4: fix missing unlock on ETHOFLD desc collect fail path The label passed to the QDESC_GET for the ETHOFLD TXQ, RXQ, and FLQ, is the 'out' one, which skips the 'out_unlock' label, and thus doesn't unlock the 'uld_mutex' before returning. Additionally, since commit 5148e5950c67 ("cxgb4: add EOTID tracking and software context dump"), the access to these ETHOFLD hardware queues should be protected by the 'mqprio_mutex' instead. Fixes: 2d0cb84dd973 ("cxgb4: add ETHOFLD hardware queue support") Fixes: 5148e5950c67 ("cxgb4: add EOTID tracking and software context dump") Signed-off-by: Rafael Mendonca Reviewed-by: Rahul Lakkireddy Link: https://lore.kernel.org/r/20220922175109.764898-1-rafaelmendsr@gmail.com Signed-off-by: Jakub Kicinski commit 3a710532cfe586710738670fb7e1ee44fc3c9b5c Merge: f76349cf41451 a078dff870136 Author: Linus Torvalds Date: Mon Sep 26 13:10:11 2022 -0700 Merge tag 'ext4_for_linus_fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull missed ext4 fix from Ted Ts'o: "Fix an potential unitialzied variable bug; this was a fixup that I had forgotten to apply before the last pull request for ext4. My bad" * tag 'ext4_for_linus_fixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fixup possible uninitialized variable access in ext4_mb_choose_next_group_cr1() commit 6e23ec0ba92d426c77a73a9ccab16346e5e0ef49 Author: Hangyu Hua Date: Fri Sep 23 10:00:46 2022 +0800 net: sched: act_ct: fix possible refcount leak in tcf_ct_init() nf_ct_put need to be called to put the refcount got by tcf_ct_fill_params to avoid possible refcount leak when tcf_ct_flow_table_get fails. Fixes: c34b961a2492 ("net/sched: act_ct: Create nf flow table per zone") Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220923020046.8021-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski commit 59298997df89e19aad426d4ae0a7e5037074da5a Author: Kees Cook Date: Mon Sep 19 13:16:48 2022 -0700 x86/uaccess: avoid check_object_size() in copy_from_user_nmi() The check_object_size() helper under CONFIG_HARDENED_USERCOPY is designed to skip any checks where the length is known at compile time as a reasonable heuristic to avoid "likely known-good" cases. However, it can only do this when the copy_*_user() helpers are, themselves, inline too. Using find_vmap_area() requires taking a spinlock. The check_object_size() helper can call find_vmap_area() when the destination is in vmap memory. If show_regs() is called in interrupt context, it will attempt a call to copy_from_user_nmi(), which may call check_object_size() and then find_vmap_area(). If something in normal context happens to be in the middle of calling find_vmap_area() (with the spinlock held), the interrupt handler will hang forever. The copy_from_user_nmi() call is actually being called with a fixed-size length, so check_object_size() should never have been called in the first place. Given the narrow constraints, just replace the __copy_from_user_inatomic() call with an open-coded version that calls only into the sanitizers and not check_object_size(), followed by a call to raw_copy_from_user(). [akpm@linux-foundation.org: no instrument_copy_from_user() in my tree...] Link: https://lkml.kernel.org/r/20220919201648.2250764-1-keescook@chromium.org Link: https://lore.kernel.org/all/CAOUHufaPshtKrTWOz7T7QFYUNVGFm0JBjvM700Nhf9qEL9b3EQ@mail.gmail.com Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") Signed-off-by: Kees Cook Reported-by: Yu Zhao Reported-by: Florian Lehner Suggested-by: Andrew Morton Acked-by: Peter Zijlstra (Intel) Tested-by: Florian Lehner Cc: Matthew Wilcox Cc: Josh Poimboeuf Cc: Dave Hansen Cc: Signed-off-by: Andrew Morton commit 80e2b584f3abfc31c3fe5573007f0d1d10810fde Author: Zi Yan Date: Tue Sep 13 22:39:13 2022 -0400 mm/page_isolation: fix isolate_single_pageblock() isolation behavior set_migratetype_isolate() does not allow isolating MIGRATE_CMA pageblocks unless it is used for CMA allocation. isolate_single_pageblock() did not have the same behavior when it is used together with set_migratetype_isolate() in start_isolate_page_range(). This allows alloc_contig_range() with migratetype other than MIGRATE_CMA, like MIGRATE_MOVABLE (used by alloc_contig_pages()), to isolate first and last pageblock but fail the rest. The failure leads to changing migratetype of the first and last pageblock to MIGRATE_MOVABLE from MIGRATE_CMA, corrupting the CMA region. This can happen during gigantic page allocations. Like Doug said here: https://lore.kernel.org/linux-mm/a3363a52-883b-dcd1-b77f-f2bb378d6f2d@gmail.com/T/#u, for gigantic page allocations, the user would notice no difference, since the allocation on CMA region will fail as well as it did before. But it might hurt the performance of device drivers that use CMA, since CMA region size decreases. Fix it by passing migratetype into isolate_single_pageblock(), so that set_migratetype_isolate() used by isolate_single_pageblock() will prevent the isolation happening. Link: https://lkml.kernel.org/r/20220914023913.1855924-1-zi.yan@sent.com Fixes: b2c9e2fbba32 ("mm: make alloc_contig_range work at pageblock granularity") Signed-off-by: Zi Yan Reported-by: Doug Berger Cc: David Hildenbrand Cc: Doug Berger Cc: Mike Kravetz Cc: Signed-off-by: Andrew Morton commit 77677cdbc2aa4b5d5d839562793d3d126201d18d Author: Shuai Xue Date: Wed Sep 14 14:49:35 2022 +0800 mm,hwpoison: check mm when killing accessing process The GHES code calls memory_failure_queue() from IRQ context to queue work into workqueue and schedule it on the current CPU. Then the work is processed in memory_failure_work_func() by kworker and calls memory_failure(). When a page is already poisoned, commit a3f5d80ea401 ("mm,hwpoison: send SIGBUS with error virutal address") make memory_failure() call kill_accessing_process() that: - holds mmap locking of current->mm - does pagetable walk to find the error virtual address - and sends SIGBUS to the current process with error info. However, the mm of kworker is not valid, resulting in a null-pointer dereference. So check mm when killing the accessing process. [akpm@linux-foundation.org: remove unrelated whitespace alteration] Link: https://lkml.kernel.org/r/20220914064935.7851-1-xueshuai@linux.alibaba.com Fixes: a3f5d80ea401 ("mm,hwpoison: send SIGBUS with error virutal address") Signed-off-by: Shuai Xue Reviewed-by: Miaohe Lin Acked-by: Naoya Horiguchi Cc: Huang Ying Cc: Baolin Wang Cc: Bixuan Cui Cc: Signed-off-by: Andrew Morton commit 317314527d173e1f139ceaf8cb87cb1746abf240 Author: Doug Berger Date: Wed Sep 14 12:09:17 2022 -0700 mm/hugetlb: correct demote page offset logic With gigantic pages it may not be true that struct page structures are contiguous across the entire gigantic page. The nth_page macro is used here in place of direct pointer arithmetic to correct for this. Mike said: : This error could cause addressing exceptions. However, this is only : possible in configurations where CONFIG_SPARSEMEM && : !CONFIG_SPARSEMEM_VMEMMAP. Such a configuration option is rare and : unknown to be the default anywhere. Link: https://lkml.kernel.org/r/20220914190917.3517663-1-opendmb@gmail.com Fixes: 8531fc6f52f5 ("hugetlb: add hugetlb demote page support") Signed-off-by: Doug Berger Reviewed-by: Mike Kravetz Reviewed-by: Oscar Salvador Reviewed-by: Anshuman Khandual Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit dac22531bbd4af2426c4e29e05594415ccfa365d Author: Maurizio Lombardi Date: Fri Jul 15 14:50:13 2022 +0200 mm: prevent page_frag_alloc() from corrupting the memory A number of drivers call page_frag_alloc() with a fragment's size > PAGE_SIZE. In low memory conditions, __page_frag_cache_refill() may fail the order 3 cache allocation and fall back to order 0; In this case, the cache will be smaller than the fragment, causing memory corruptions. Prevent this from happening by checking if the newly allocated cache is large enough for the fragment; if not, the allocation will fail and page_frag_alloc() will return NULL. Link: https://lkml.kernel.org/r/20220715125013.247085-1-mlombard@redhat.com Fixes: b63ae8ca096d ("mm/net: Rename and move page fragment handling from net/ to mm/") Signed-off-by: Maurizio Lombardi Reviewed-by: Alexander Duyck Cc: Chen Lin Cc: Jakub Kicinski Cc: Signed-off-by: Andrew Morton commit 70427f6e9ecfc8c5f977b21dd9f846b3bda02500 Author: Sergei Antonov Date: Thu Sep 8 23:48:09 2022 +0300 mm: bring back update_mmu_cache() to finish_fault() Running this test program on ARMv4 a few times (sometimes just once) reproduces the bug. int main() { unsigned i; char paragon[SIZE]; void* ptr; memset(paragon, 0xAA, SIZE); ptr = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_ANON | MAP_SHARED, -1, 0); if (ptr == MAP_FAILED) return 1; printf("ptr = %p\n", ptr); for (i=0;i<10000;i++){ memset(ptr, 0xAA, SIZE); if (memcmp(ptr, paragon, SIZE)) { printf("Unexpected bytes on iteration %u!!!\n", i); break; } } munmap(ptr, SIZE); } In the "ptr" buffer there appear runs of zero bytes which are aligned by 16 and their lengths are multiple of 16. Linux v5.11 does not have the bug, "git bisect" finds the first bad commit: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Before the commit update_mmu_cache() was called during a call to filemap_map_pages() as well as finish_fault(). After the commit finish_fault() lacks it. Bring back update_mmu_cache() to finish_fault() to fix the bug. Also call update_mmu_tlb() only when returning VM_FAULT_NOPAGE to more closely reproduce the code of alloc_set_pte() function that existed before the commit. On many platforms update_mmu_cache() is nop: x86, see arch/x86/include/asm/pgtable ARMv6+, see arch/arm/include/asm/tlbflush.h So, it seems, few users ran into this bug. Link: https://lkml.kernel.org/r/20220908204809.2012451-1-saproj@gmail.com Fixes: f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") Signed-off-by: Sergei Antonov Acked-by: Kirill A. Shutemov Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 37dcc673d065d9823576cd9f2484a72531e1cba6 Author: Christoph Hellwig Date: Fri Sep 9 15:08:29 2022 +0200 frontswap: don't call ->init if no ops are registered If no frontswap module (i.e. zswap) was registered, frontswap_ops will be NULL. In such situation, swapon crashes with the following stack trace: Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000020a4fab000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] SMP Modules linked in: zram fsl_dpaa2_eth pcs_lynx phylink ahci_qoriq crct10dif_ce ghash_ce sbsa_gwdt fsl_mc_dpio nvme lm90 nvme_core at803x xhci_plat_hcd rtc_fsl_ftm_alarm xgmac_mdio ahci_platform i2c_imx ip6_tables ip_tables fuse Unloaded tainted modules: cppc_cpufreq():1 CPU: 10 PID: 761 Comm: swapon Not tainted 6.0.0-rc2-00454-g22100432cf14 #1 Hardware name: SolidRun Ltd. SolidRun CEX7 Platform, BIOS EDK II Jun 21 2022 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : frontswap_init+0x38/0x60 lr : __do_sys_swapon+0x8a8/0x9f4 sp : ffff80000969bcf0 x29: ffff80000969bcf0 x28: ffff37bee0d8fc00 x27: ffff80000a7f5000 x26: fffffcdefb971e80 x25: ffffaba797453b90 x24: 0000000000000064 x23: ffff37c1f209d1a8 x22: ffff37bee880e000 x21: ffffaba797748560 x20: ffff37bee0d8fce4 x19: ffffaba797748488 x18: 0000000000000014 x17: 0000000030ec029a x16: ffffaba795a479b0 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000000001 x11: ffff37c63c0aba18 x10: 0000000000000000 x9 : ffffaba7956b8c88 x8 : ffff80000969bcd0 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffffaba79730f000 x2 : ffff37bee0d8fc00 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: frontswap_init+0x38/0x60 __do_sys_swapon+0x8a8/0x9f4 __arm64_sys_swapon+0x28/0x3c invoke_syscall+0x78/0x100 el0_svc_common.constprop.0+0xd4/0xf4 do_el0_svc+0x38/0x4c el0_svc+0x34/0x10c el0t_64_sync_handler+0x11c/0x150 el0t_64_sync+0x190/0x194 Code: d000e283 910003fd f9006c41 f946d461 (f9400021) ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20220909130829.3262926-1-hch@lst.de Fixes: 1da0d94a3ec8 ("frontswap: remove support for multiple ops") Reported-by: Nathan Chancellor Signed-off-by: Christoph Hellwig Signed-off-by: Liu Shixin Cc: Konrad Rzeszutek Wilk Cc: Signed-off-by: Andrew Morton commit 2b7aa91ba0e86b8643f5d3c83874c80599c731d7 Author: Naoya Horiguchi Date: Thu Sep 8 13:11:50 2022 +0900 mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() NULL pointer dereference is triggered when calling thp split via debugfs on the system with offlined memory blocks. With debug option enabled, the following kernel messages are printed out: page:00000000467f4890 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121c000 flags: 0x17fffc00000000(node=0|zone=2|lastcpupid=0x1ffff) raw: 0017fffc00000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: unmovable page page:000000007d7ab72e is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1248! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 16 PID: 20964 Comm: bash Tainted: G I 6.0.0-rc3-foll-numa+ #41 ... RIP: 0010:split_huge_pages_write+0xcf4/0xe30 This shows that page_to_nid() in page_zone() is unexpectedly called for an offlined memmap. Use pfn_to_online_page() to get struct page in PFN walker. Link: https://lkml.kernel.org/r/20220908041150.3430269-1-naoya.horiguchi@linux.dev Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") [visible after d0dc12e86b319] Signed-off-by: Naoya Horiguchi Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Reviewed-by: Yang Shi Acked-by: Michal Hocko Reviewed-by: Miaohe Lin Reviewed-by: Oscar Salvador Acked-by: Kirill A. Shutemov Cc: Matthew Wilcox Cc: Muchun Song Cc: [5.10+] Signed-off-by: Andrew Morton commit 58d426a7ba92870d489686dfdb9d06b66815a2ab Author: Minchan Kim Date: Thu Sep 8 08:12:04 2022 -0700 mm: fix madivse_pageout mishandling on non-LRU page MADV_PAGEOUT tries to isolate non-LRU pages and gets a warning from isolate_lru_page below. Fix it by checking PageLRU in advance. ------------[ cut here ]------------ trying to isolate tail page WARNING: CPU: 0 PID: 6175 at mm/folio-compat.c:158 isolate_lru_page+0x130/0x140 Modules linked in: CPU: 0 PID: 6175 Comm: syz-executor.0 Not tainted 5.18.12 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:isolate_lru_page+0x130/0x140 Link: https://lore.kernel.org/linux-mm/485f8c33.2471b.182d5726afb.Coremail.hantianshuo@iie.ac.cn/ Link: https://lkml.kernel.org/r/20220908151204.762596-1-minchan@kernel.org Fixes: 1a4e58cce84e ("mm: introduce MADV_PAGEOUT") Signed-off-by: Minchan Kim Reported-by: 韩天ç`• Suggested-by: Yang Shi Acked-by: Yang Shi Cc: Signed-off-by: Andrew Morton commit bedf03416913d88c796288f9dca109a53608c745 Author: Yang Shi Date: Wed Sep 7 11:01:44 2022 -0700 powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush The IPI broadcast is used to serialize against fast-GUP, but fast-GUP will move to use RCU instead of disabling local interrupts in fast-GUP. Using an IPI is the old-styled way of serializing against fast-GUP although it still works as expected now. And fast-GUP now fixed the potential race with THP collapse by checking whether PMD is changed or not. So IPI broadcast in radix pmd collapse flush is not necessary anymore. But it is still needed for hash TLB. Link: https://lkml.kernel.org/r/20220907180144.555485-2-shy828301@gmail.com Suggested-by: Aneesh Kumar K.V Signed-off-by: Yang Shi Acked-by: David Hildenbrand Acked-by: Peter Xu Cc: Christophe Leroy Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: "Kirill A. Shutemov" Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Signed-off-by: Andrew Morton commit 70cbc3cc78a997d8247b50389d37c4e1736019da Author: Yang Shi Date: Wed Sep 7 11:01:43 2022 -0700 mm: gup: fix the fast GUP race against THP collapse Since general RCU GUP fast was introduced in commit 2667f50e8b81 ("mm: introduce a general RCU get_user_pages_fast()"), a TLB flush is no longer sufficient to handle concurrent GUP-fast in all cases, it only handles traditional IPI-based GUP-fast correctly. On architectures that send an IPI broadcast on TLB flush, it works as expected. But on the architectures that do not use IPI to broadcast TLB flush, it may have the below race: CPU A CPU B THP collapse fast GUP gup_pmd_range() <-- see valid pmd gup_pte_range() <-- work on pte pmdp_collapse_flush() <-- clear pmd and flush __collapse_huge_page_isolate() check page pinned <-- before GUP bump refcount pin the page check PTE <-- no change __collapse_huge_page_copy() copy data to huge page ptep_clear() install huge pmd for the huge page return the stale page discard the stale page The race can be fixed by checking whether PMD is changed or not after taking the page pin in fast GUP, just like what it does for PTE. If the PMD is changed it means there may be parallel THP collapse, so GUP should back off. Also update the stale comment about serializing against fast GUP in khugepaged. Link: https://lkml.kernel.org/r/20220907180144.555485-1-shy828301@gmail.com Fixes: 2667f50e8b81 ("mm: introduce a general RCU get_user_pages_fast()") Acked-by: David Hildenbrand Acked-by: Peter Xu Signed-off-by: Yang Shi Reviewed-by: John Hubbard Cc: "Aneesh Kumar K.V" Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: "Kirill A. Shutemov" Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Signed-off-by: Andrew Morton commit a43206156263fbaf1f2b7f96257441f331e91bb7 Author: Peilin Ye Date: Thu Sep 22 21:25:51 2022 -0700 usbnet: Fix memory leak in usbnet_disconnect() Currently usbnet_disconnect() unanchors and frees all deferred URBs using usb_scuttle_anchored_urbs(), which does not free urb->context, causing a memory leak as reported by syzbot. Use a usb_get_from_anchor() while loop instead, similar to what we did in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"). Also free urb->sg. Reported-and-tested-by: syzbot+dcd3e13cf4472f2e0ba1@syzkaller.appspotmail.com Fixes: 69ee472f2706 ("usbnet & cdc-ether: Autosuspend for online devices") Fixes: 638c5115a794 ("USBNET: support DMA SG") Signed-off-by: Peilin Ye Link: https://lore.kernel.org/r/20220923042551.2745-1-yepeilin.cs@gmail.com Signed-off-by: Jakub Kicinski commit 7cae596bc31f900bb72492ff40c7f5addf72fa19 Author: Dylan Yudaken Date: Mon Sep 26 10:09:25 2022 -0700 io_uring: register single issuer task at creation Instead of picking the task from the first submitter task, rather use the creator task or in the case of disabled (IORING_SETUP_R_DISABLED) the enabling task. This approach allows a lot of simplification of the logic here. This removes init logic from the submission path, which can always be a bit confusing, but also removes the need for locking to write (or read) the submitter_task. Users that want to move a ring before submitting can create the ring disabled and then enable it on the submitting task. Signed-off-by: Dylan Yudaken Fixes: 97bbdc06a444 ("io_uring: add IORING_SETUP_SINGLE_ISSUER") Signed-off-by: Jens Axboe commit a078dff870136090b5779ca2831870a6c5539d36 Author: Jan Kara Date: Thu Sep 22 11:09:29 2022 +0200 ext4: fixup possible uninitialized variable access in ext4_mb_choose_next_group_cr1() Variable 'grp' may be left uninitialized if there's no group with suitable average fragment size (or larger). Fix the problem by initializing it earlier. Link: https://lore.kernel.org/r/20220922091542.pkhedytey7wzp5fi@quack3 Fixes: 83e80a6e3543 ("ext4: use buckets for cr 1 block scan instead of rbtree") Cc: stable@kernel.org Reported-by: Dan Carpenter Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o commit 6052a4c11fd893234e085edf7bf2e00a33a79d4e Author: Sasha Levin Date: Fri Sep 23 19:47:36 2022 -0400 Revert "net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()" This reverts commit fe2c9c61f668cde28dac2b188028c5299cedcc1e. On Tue, Sep 13, 2022 at 05:48:58PM +0100, Russell King (Oracle) wrote: >What happens if this is built as a module, and the module is loaded, >binds (and creates the directory), then is removed, and then re- >inserted? Nothing removes the old directory, so doesn't >debugfs_create_dir() fail, resulting in subsequent failure to add >any subsequent debugfs entries? > >I don't think this patch should be backported to stable trees until >this point is addressed. Revert until a proper fix is available as the original behavior was better. Cc: Marcin Wojtas Cc: Eric Dumazet Cc: Paolo Abeni Cc: stable@kernel.org Reported-by: Russell King Fixes: fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") Signed-off-by: Sasha Levin Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20220923234736.657413-1-sashal@kernel.org Signed-off-by: Jakub Kicinski commit 6ef7d362123ecb5bf6d163bb9c7fd6ba2d8c968c Author: Chris Wilson Date: Wed Sep 21 15:52:58 2022 +0200 drm/i915/gt: Restrict forced preemption to the active context When we submit a new pair of contexts to ELSP for execution, we start a timer by which point we expect the HW to have switched execution to the pending contexts. If the promotion to the new pair of contexts has not occurred, we declare the executing context to have hung and force the preemption to take place by resetting the engine and resubmitting the new contexts. This can lead to an unfair situation where almost all of the preemption timeout is consumed by the first context which just switches into the second context immediately prior to the timer firing and triggering the preemption reset (assuming that the timer interrupts before we process the CS events for the context switch). The second context hasn't yet had a chance to yield to the incoming ELSP (and send the ACk for the promotion) and so ends up being blamed for the reset. If we see that a context switch has occurred since setting the preemption timeout, but have not yet received the ACK for the ELSP promotion, rearm the preemption timer and check again. This is especially significant if the first context was not schedulable and so we used the shortest timer possible, greatly increasing the chance of accidentally blaming the second innocent context. Fixes: 3a7a92aba8fb ("drm/i915/execlists: Force preemption") Fixes: d12acee84ffb ("drm/i915/execlists: Cancel banned contexts on schedule-out") Reported-by: Tvrtko Ursulin Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Andi Shyti Reviewed-by: Andrzej Hajda Tested-by: Andrzej Hajda Cc: # v5.5+ Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20220921135258.1714873-1-andrzej.hajda@intel.com (cherry picked from commit 107ba1a2c705f4358f2602ec2f2fd821bb651f42) Signed-off-by: Rodrigo Vivi commit f4a2aade6809c6573f420c6fc1031797dfe8a4d2 Author: Athira Rajeev Date: Wed Sep 21 20:22:54 2022 +0530 perf tests powerpc: Fix branch stack sampling test to include sanity check for branch filter Commit b55878c90ab92a24 ("perf test: Add test for branch stack sampling") added test for branch stack sampling. There is a sanity check in the beginning to skip the test if the hardware doesn't support branch stack sampling. Snippet <<>> skip the test if the hardware doesn't support branch stack sampling perf record -b -o- -B true > /dev/null 2>&1 || exit 2 <<>> But the testcase also uses branch sample types: save_type, any. if any platform doesn't support the branch filters used in the test, the testcase will fail. In powerpc, currently mutliple branch filters are not supported and hence this test fails in powerpc. Fix the sanity check to look at the support for branch filters used in this test before proceeding with the test. Fixes: b55878c90ab92a24 ("perf test: Add test for branch stack sampling") Reported-by: Disha Goel Reviewed-by: Kajol Jain Signed-off-by: Athira Jajeev Cc: German Gomez Cc: Jiri Olsa Cc: linuxppc-dev@lists.ozlabs.org Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Link: https://lore.kernel.org/r/20220921145255.20972-2-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 71c86cda750b001100e0d6dc04a88449b7381a59 Author: Zhengjun Xing Date: Fri Sep 23 11:00:13 2022 +0800 perf parse-events: Remove "not supported" hybrid cache events By default, we create two hybrid cache events, one is for cpu_core, and another is for cpu_atom. But Some hybrid hardware cache events are only available on one CPU PMU. For example, the 'L1-dcache-load-misses' is only available on cpu_core, while the 'L1-icache-loads' is only available on cpu_atom. We need to remove "not supported" hybrid cache events. By extending is_event_supported() to global API and using it to check if the hybrid cache events are supported before being created, we can remove the "not supported" hybrid cache events. Before: # ./perf stat -e L1-dcache-load-misses,L1-icache-loads -a sleep 1 Performance counter stats for 'system wide': 52,570 cpu_core/L1-dcache-load-misses/ cpu_atom/L1-dcache-load-misses/ cpu_core/L1-icache-loads/ 1,471,817 cpu_atom/L1-icache-loads/ 1.004915229 seconds time elapsed After: # ./perf stat -e L1-dcache-load-misses,L1-icache-loads -a sleep 1 Performance counter stats for 'system wide': 54,510 cpu_core/L1-dcache-load-misses/ 1,441,286 cpu_atom/L1-icache-loads/ 1.005114281 seconds time elapsed Fixes: 30def61f64bac5f5 ("perf parse-events: Create two hybrid cache events") Reported-by: Yi Ammy Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jin Yao Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220923030013.3726410-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e28c07871c3f2107e316c2590d4703496bd114f4 Author: Zhengjun Xing Date: Fri Sep 23 11:00:12 2022 +0800 perf print-events: Fix "perf list" can not display the PMU prefix for some hybrid cache events Some hybrid hardware cache events are only available on one CPU PMU. For example, 'L1-dcache-load-misses' is only available on cpu_core. We have supported in the perf list clearly reporting this info, the function works fine before but recently the argument "config" in API is_event_supported() is changed from "u64" to "unsigned int" which caused a regression, the "perf list" then can not display the PMU prefix for some hybrid cache events. For the hybrid systems, the PMU type ID is stored at config[63:32], define config to "unsigned int" will miss the PMU type ID information, then the regression happened, the config should be defined as "u64". Before: # ./perf list |grep "Hardware cache event" L1-dcache-load-misses [Hardware cache event] L1-dcache-loads [Hardware cache event] L1-dcache-stores [Hardware cache event] L1-icache-load-misses [Hardware cache event] L1-icache-loads [Hardware cache event] LLC-load-misses [Hardware cache event] LLC-loads [Hardware cache event] LLC-store-misses [Hardware cache event] LLC-stores [Hardware cache event] branch-load-misses [Hardware cache event] branch-loads [Hardware cache event] dTLB-load-misses [Hardware cache event] dTLB-loads [Hardware cache event] dTLB-store-misses [Hardware cache event] dTLB-stores [Hardware cache event] iTLB-load-misses [Hardware cache event] node-load-misses [Hardware cache event] node-loads [Hardware cache event] After: # ./perf list |grep "Hardware cache event" L1-dcache-loads [Hardware cache event] L1-dcache-stores [Hardware cache event] L1-icache-load-misses [Hardware cache event] LLC-load-misses [Hardware cache event] LLC-loads [Hardware cache event] LLC-store-misses [Hardware cache event] LLC-stores [Hardware cache event] branch-load-misses [Hardware cache event] branch-loads [Hardware cache event] cpu_atom/L1-icache-loads/ [Hardware cache event] cpu_core/L1-dcache-load-misses/ [Hardware cache event] cpu_core/node-load-misses/ [Hardware cache event] cpu_core/node-loads/ [Hardware cache event] dTLB-load-misses [Hardware cache event] dTLB-loads [Hardware cache event] dTLB-store-misses [Hardware cache event] dTLB-stores [Hardware cache event] iTLB-load-misses [Hardware cache event] Fixes: 9b7c7728f4e4ba8d ("perf parse-events: Break out tracepoint and printing") Reported-by: Yi Ammy Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220923030013.3726410-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e42c9c54f2e731885ea2bd92c478c85d879637a6 Author: Namhyung Kim Date: Thu Sep 22 23:32:05 2022 -0700 perf tools: Get a perf cgroup more portably in BPF The perf_event_cgrp_id can be different on other configurations. To be more portable as CO-RE, it needs to get the cgroup subsys id using the bpf_core_enum_value() helper. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Hao Luo Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220923063205.772936-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4335417da2b8d6d9b2d4411b5f9e248e5bb2d380 Author: Pali Rohár Date: Thu Jul 14 20:33:25 2022 +0200 gpio: mvebu: Fix check for pwm support on non-A8K platforms pwm support incompatible with Armada 80x0/70x0 API is not only in Armada 370, but also in Armada XP, 38x and 39x. So basically every non-A8K platform. Fix check for pwm support appropriately. Fixes: 85b7d8abfec7 ("gpio: mvebu: add pwm support for Armada 8K/7K") Signed-off-by: Pali Rohár Signed-off-by: Bartosz Golaszewski commit f76349cf41451c5c42a99f18a9163377e4b364ff Author: Linus Torvalds Date: Sun Sep 25 14:01:02 2022 -0700 Linux 6.0-rc7 commit 5e049663f678938dd56812ba870a471060f8ce28 Merge: 4207d59567c01 80fa46d6b9e7b Author: Linus Torvalds Date: Sun Sep 25 09:03:31 2022 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Regression and bug fixes: - Performance regression fix from 5.18 on a Rasberry Pi - Fix extent parsing bug which triggers a BUG_ON when a (corrupted) extent tree has has a non-root node when zero entries. - Fix a livelock where in the right (wrong) circumstances a large number of nfsd threads can try to write to a nearly full file system, and retry for hours(!)" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: limit the number of retries after discarding preallocations blocks ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 ext4: use buckets for cr 1 block scan instead of rbtree ext4: use locality group preallocation for small closed files ext4: make directory inode spreading reflect flexbg size ext4: avoid unnecessary spreading of allocations among groups ext4: make mballoc try target group first even with mb_optimize_scan commit 4207d59567c017be284dbebc5d3fb5a2037a5df5 Merge: f0cc7c00089bf b3bbcc5d1da1b Author: Linus Torvalds Date: Sun Sep 25 08:53:52 2022 -0700 Merge tag 'dax-and-nvdimm-fixes-v6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull NVDIMM and DAX fixes from Dan Williams: "A recently discovered one-line fix for devdax that further addresses a v5.5 regression, and (a bit embarrassing) a small batch of fixes that have been sitting in my fixes tree for weeks. The older fixes have soaked in linux-next during that time and address an fsdax infinite loop and some other minor fixups. - Fix a infinite loop bug in fsdax - Fix memory-type detection for devdax (EINJ regression) - Small cleanups" * tag 'dax-and-nvdimm-fixes-v6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: devdax: Fix soft-reservation memory description fsdax: Fix infinite loop in dax_iomap_rw() nvdimm/namespace: drop nested variable in create_namespace_pmem() ndtest: Cleanup all of blk namespace specific code pmem: fix a name collision commit f0cc7c00089bf923259370fefc1d4f48d7252fc5 Merge: 105a36f3694ed b7af938f4379a Author: Linus Torvalds Date: Sun Sep 25 08:44:46 2022 -0700 Merge tag 'i2c-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C driver bugfixes for mlxbf and imx, a few documentation fixes after the rework this cycle, and one hardening for the i2c-mux core" * tag 'i2c-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: mux: harden i2c_mux_alloc() against integer overflows i2c: mlxbf: Fix frequency calculation i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() i2c: mlxbf: incorrect base address passed during io write Documentation: i2c: fix references to other documents MAINTAINERS: remove Nehal Shah from AMD MP2 I2C DRIVER i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible commit 2fd003ee8ade6b7f2777becc6f9917d7c313784f Author: Mark Pearson Date: Sat Sep 24 22:16:00 2022 -0700 Input: synaptics - disable Intertouch for Lenovo T14 and P14s AMD G1 Since intertouch was enabled for the T14 and P14s AMD G1 laptops there have been a number of reports of touchpads not working well. Debugging this with Synaptics they noted that intertouch should not be enabled as SMBUS host notify is not available on these laptops. Reverting the previous commit (e4ce4d3a939d97bea045eafa13ad1195695f91ce) to restore functionality back to what it was. Note - we are working with Synaptics to see if there is a better solution, but nothing is confirmed as yet. Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20220920193936.8709-1-markpearson@lenovo.com Signed-off-by: Dmitry Torokhov commit e336d85e5b08c9d206a89b2b95c0c7bb47c64a56 Author: Jeff LaBundy Date: Sat Sep 17 14:09:22 2022 -0500 Input: iqs62x-keys - drop unused device node references Each call to device/fwnode_get_named_child_node() must be matched with a call to fwnode_handle_put() once the corresponding node is no longer in use. This ensures a reference count remains balanced in the case of dynamic device tree support. Currently, the driver never calls fwnode_handle_put(). This patch adds the missing calls. Fixes: ce1cb0eec85b ("input: keyboard: Add support for Azoteq IQS620A/621/622/624/625") Signed-off-by: Jeff LaBundy Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/YyYbYvlkq5cy55dc@nixie71 Signed-off-by: Dmitry Torokhov commit a54dc27bd25f20ee3ea2009584b3166d25178243 Author: Yang Yingliang Date: Sat Sep 24 11:07:15 2022 +0800 Input: melfas_mip4 - fix return value check in mip4_probe() devm_gpiod_get_optional() may return ERR_PTR(-EPROBE_DEFER), add a minus sign to fix it. Fixes: 6ccb1d8f78bd ("Input: add MELFAS MIP4 Touchscreen driver") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220924030715.1653538-1-yangyingliang@huawei.com Signed-off-by: Dmitry Torokhov commit b3bbcc5d1da1b654091dad15980b3d58fdae0fc6 Merge: 17d9c15c9b9e7 67feaba413ec6 Author: Dan Williams Date: Sat Sep 24 18:14:12 2022 -0700 Merge branch 'for-6.0/dax' into libnvdimm-fixes Pick up another "Soft Reservation" fix for v6.0-final on top of some straggling nvdimm fixes that missed v5.19. commit 67feaba413ec68daf4124e9870878899b4ed9a0e Author: Dan Williams Date: Fri Sep 23 15:05:56 2022 -0700 devdax: Fix soft-reservation memory description The "hmem" platform-devices that are created to represent the platform-advertised "Soft Reserved" memory ranges end up inserting a resource that causes the iomem_resource tree to look like this: 340000000-43fffffff : hmem.0 340000000-43fffffff : Soft Reserved 340000000-43fffffff : dax0.0 This is because insert_resource() reparents ranges when they completely intersect an existing range. This matters because code that uses region_intersects() to scan for a given IORES_DESC will only check that top-level 'hmem.0' resource and not the 'Soft Reserved' descendant. So, to support EINJ (via einj_error_inject()) to inject errors into memory hosted by a dax-device, be sure to describe the memory as IORES_DESC_SOFT_RESERVED. This is a follow-on to: commit b13a3e5fd40b ("ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP") ...that fixed EINJ support for "Soft Reserved" ranges in the first instance. Fixes: 262b45ae3ab4 ("x86/efi: EFI soft reservation to E820 enumeration") Reported-by: Ricardo Sandoval Torres Tested-by: Ricardo Sandoval Torres Cc: Cc: Tony Luck Cc: Omar Avelar Cc: Rafael J. Wysocki Cc: Mark Gross Link: https://lore.kernel.org/r/166397075670.389916.7435722208896316387.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 105a36f3694edc680f3e9318cdd3c03722e42554 Merge: 23b99237f86df 32ef9e5054ec0 Author: Linus Torvalds Date: Sat Sep 24 17:41:17 2022 -0700 Merge tag 'kbuild-fixes-v6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix build error for the combination of SYSTEM_TRUSTED_KEYRING=y and X509_CERTIFICATE_PARSER=m - Fix DEBUG_INFO_SPLIT to generate debug info for GCC 11+ and Clang 12+ - Revive debug info for assembly files - Remove unused code * tag 'kbuild-fixes-v6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: Makefile.debug: re-enable debug info for .S files Makefile.debug: set -g unconditional on CONFIG_DEBUG_INFO_SPLIT certs: make system keyring depend on built-in x509 parser Kconfig: remove unused function 'menu_get_root_menu' scripts/clang-tools: remove unused module commit 23b99237f86df34cbcefa81d1fa45bc316b4a124 Merge: 42f9508b3bcb4 1918f2b20c3de Author: Linus Torvalds Date: Sat Sep 24 17:35:42 2022 -0700 Merge tag 's390-6.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Vasily Gorbik: - Fix potential hangs in VFIO AP driver * tag 's390-6.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/vfio-ap: bypass unnecessary processing of AP resources commit 42f9508b3bcb4214491a327238170963a59a309d Merge: 1a61b828566fb 9614369a042a3 Author: Linus Torvalds Date: Sat Sep 24 08:53:57 2022 -0700 Merge tag 'pm-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an uninitialized variable usage in the operating performance points code and add missing DT bindings for it. Specifics: - Fix uninitialized variable usage in dev_pm_opp_config_clks_simple() (Christophe JAILLET) - Add missing OPP DT properties (Rob Herring)" * tag 'pm-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: dt-bindings: opp: Add missing (unevaluated|additional)Properties on child nodes OPP: Fix an un-initialized variable usage commit 1a61b828566fba088d3baa0dc3e440b51fdf9ce2 Merge: 7e2cd21e02b35 2bc54aaa65d21 Author: Linus Torvalds Date: Sat Sep 24 08:46:07 2022 -0700 Merge tag 'char-misc-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are three tiny driver fixes for 6.0-rc7. They include: - phy driver reset bugfix - fpga memleak bugfix - counter irq config bugfix The first two have been in linux-next for a while, the last one has only been added to my tree in the past few days, but was in linux-next under a different commit id. I couldn't pull directly from the counter tree due to some gpg key propagation issue, so I took the commit directly from email instead" * tag 'char-misc-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: counter: 104-quad-8: Fix skipped IRQ lines during events configuration fpga: m10bmc-sec: Fix possible memory leak of flash_buf phy: marvell: phy-mvebu-a3700-comphy: Remove broken reset support commit 7e2cd21e02b35483ce8ea88da5732d4d3ec3a6c9 Merge: 1772094f12a7b 643792048ee84 Author: Linus Torvalds Date: Sat Sep 24 08:42:55 2022 -0700 Merge tag 'tty-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small, and late, serial driver fixes for 6.0-rc7 to resolve some reported problems. Included in here are: - tegra icount accounting fixes, including a framework function that other drivers will be converted over to using in 6.1-rc1. - fsl_lpuart reset bugfix - 8250 omap 485 bugfix - sifive serial clock bugfix The last three patches have not shown up in linux-next due to them being added to my tree only 2 days ago, but they are tiny and self-contained and the developers say they resolve issues that they have with 6.0-rc. The other three have been in linux-next for a while with no reported issues" * tag 'tty-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: sifive: enable clocks for UART when probed serial: 8250: omap: Use serial8250_em485_supported serial: fsl_lpuart: Reset prior to registration serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting serial: Create uart_xmit_advance() commit 1772094f12a7b180aa9ab849586f891b14d06d1f Merge: aae8dda51964f df02452f3df06 Author: Linus Torvalds Date: Sat Sep 24 08:36:10 2022 -0700 Merge tag 'cgroup-for-6.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Add Waiman Long as a cpuset maintainer - cgroup_get_from_id() could be fed a kernfs ID which doesn't point to a cgroup directory but a knob file and then crash. Error out if the lookup kernfs_node isn't a directory. * tag 'cgroup-for-6.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cpuset: Add Waiman Long as a cpuset maintainer commit aae8dda51964ff9d3f1dc96528b853826667efad Merge: 3db61221f4e8f c0feea594e058 Author: Linus Torvalds Date: Sat Sep 24 08:32:59 2022 -0700 Merge tag 'wq-for-6.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "Just one patch to improve flush lockdep coverage" * tag 'wq-for-6.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: don't skip lockdep work dependency in cancel_work_sync() commit 3db61221f4e8f18d1dd6e45dbe9e3702ff2d67ab Merge: 0be27f7be2e5d e775f93f2ab97 Author: Linus Torvalds Date: Sat Sep 24 08:27:08 2022 -0700 Merge tag 'io_uring-6.0-2022-09-23' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single fix for an issue with un-reaped IOPOLL requests on ring exit" * tag 'io_uring-6.0-2022-09-23' of git://git.kernel.dk/linux: io_uring: ensure that cached task references are always put on exit commit 0be27f7be2e5def5577de097fb420af09acf0983 Merge: a63f2e7cb1107 4c66a326b5ab7 Author: Linus Torvalds Date: Sat Sep 24 08:22:53 2022 -0700 Merge tag 'block-6.0-2022-09-22' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Fix a regression that's been plaguing us by reverting the offending commit, as attempts to both reproduce the issue and fix it in a saner fashion have failed. Fix for a potential oops condition in the s390 dasd block driver" * tag 'block-6.0-2022-09-22' of git://git.kernel.dk/linux: Revert "block: freeze the queue earlier in del_gendisk" s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup commit b7ca8d5f56e6c57b671ceb8de1361d2a5a495087 Author: Andy Moreton Date: Thu Sep 22 22:12:18 2022 +0100 sfc: correct filter_table_remove method for EF10 PFs A previous patch added a wrapper function to take a lock around efx_mcdi_filter_table_remove(), but only changed EF10 VFs' method table to call it. Change it in the PF method table too. Fixes: 77eb40749d73 ("sfc: move table locking into filter_table_{probe,remove} methods") Signed-off-by: Andy Moreton Signed-off-by: Edward Cree Link: https://lore.kernel.org/r/20220922211218.814-1-ecree@xilinx.com Signed-off-by: Jakub Kicinski commit 32ef9e5054ec0321b9336058c58ec749e9c6b0fe Author: Nick Desaulniers Date: Mon Sep 19 10:45:47 2022 -0700 Makefile.debug: re-enable debug info for .S files Alexey reported that the fraction of unknown filename instances in kallsyms grew from ~0.3% to ~10% recently; Bill and Greg tracked it down to assembler defined symbols, which regressed as a result of: commit b8a9092330da ("Kbuild: do not emit debug info for assembly with LLVM_IAS=1") In that commit, I allude to restoring debug info for assembler defined symbols in a follow up patch, but it seems I forgot to do so in commit a66049e2cf0e ("Kbuild: make DWARF version a choice") Link: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=31bf18645d98b4d3d7357353be840e320649a67d Fixes: b8a9092330da ("Kbuild: do not emit debug info for assembly with LLVM_IAS=1") Reported-by: Alexey Alexandrov Reported-by: Bill Wendling Reported-by: Greg Thelen Reviewed-by: Nathan Chancellor Suggested-by: Masahiro Yamada Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 61f2b7c7497ba96cdde5bbaeb9e07f4c48f41f97 Author: Nick Desaulniers Date: Mon Sep 19 10:30:30 2022 -0700 Makefile.debug: set -g unconditional on CONFIG_DEBUG_INFO_SPLIT Dmitrii, Fangrui, and Mashahiro note: Before GCC 11 and Clang 12 -gsplit-dwarf implicitly uses -g2. Fix CONFIG_DEBUG_INFO_SPLIT for gcc-11+ & clang-12+ which now need -g specified in order for -gsplit-dwarf to work at all. -gsplit-dwarf has been mutually exclusive with -g since support for CONFIG_DEBUG_INFO_SPLIT was introduced in commit 866ced950bcd ("kbuild: Support split debug info v4") I don't think it ever needed to be. Link: https://lore.kernel.org/lkml/20220815013317.26121-1-dmitrii.bundin.a@gmail.com/ Link: https://lore.kernel.org/lkml/CAK7LNARPAmsJD5XKAw7m_X2g7Fi-CAAsWDQiP7+ANBjkg7R7ng@mail.gmail.com/ Link: https://reviews.llvm.org/D80391 Cc: Andi Kleen Reported-by: Dmitrii Bundin Reported-by: Fangrui Song Reported-by: Masahiro Yamada Suggested-by: Dmitrii Bundin Reviewed-by: Nathan Chancellor Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit e775f93f2ab976a2cdb4a7b53063cbe890904f73 Author: Jens Axboe Date: Fri Sep 23 13:44:56 2022 -0600 io_uring: ensure that cached task references are always put on exit io_uring caches task references to avoid doing atomics for each of them per request. If a request is put from the same task that allocated it, then we can maintain a per-ctx cache of them. This obviously relies on io_uring always pruning caches in a reliable way, and there's currently a case off io_uring fd release where we can miss that. One example is a ring setup with IOPOLL, which relies on the task polling for completions, which will free them. However, if such a task submits a request and then exits or closes the ring without reaping the completion, then ring release will reap and put. If release happens from that very same task, the completed request task refs will get put back into the cache pool. This is problematic, as we're now beyond the point of pruning caches. Manually drop these caches after doing an IOPOLL reap. This releases references from the current task, which is enough. If another task happens to be doing the release, then the caching will not be triggered and there's no issue. Cc: stable@vger.kernel.org Fixes: e98e49b2bbf7 ("io_uring: extend task put optimisations") Reported-by: Homin Rhee Signed-off-by: Jens Axboe commit a63f2e7cb1107ab124f80407e5eb8579c04eb7a9 Merge: 1707c39ae309b 13b0566962914 Author: Linus Torvalds Date: Fri Sep 23 15:28:51 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "These are all very simple and self-contained, although the CFI jump-table fix touches the generic linker script as that's where the problematic macro lives. - Fix false positive "sleeping while atomic" warning resulting from the kPTI rework taking a mutex too early. - Fix possible overflow in AMU frequency calculation - Fix incorrect shift in CMN PMU driver which causes problems with newer versions of the IP - Reduce alignment of the CFI jump table to avoid huge kernel images and link errors with !4KiB page size configurations" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: vmlinux.lds.h: CFI: Reduce alignment of jump-table to function alignment perf/arm-cmn: Add more bits to child node address offset field arm64: topology: fix possible overflow in amu_fie_setup() arm64: mm: don't acquire mutex when rewriting swapper commit e400ad8b7e6a1b9102123c6240289a811501f7d9 Author: Dave Hansen Date: Thu Sep 22 11:47:45 2022 -0700 ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems Old, circa 2002 chipsets have a bug: they don't go idle when they are supposed to. So, a workaround was added to slow the CPU down and ensure that the CPU waits a bit for the chipset to actually go idle. This workaround is ancient and has been in place in some form since the original kernel ACPI implementation. But, this workaround is very painful on modern systems. The "inl()" can take thousands of cycles (see Link: for some more detailed numbers and some fun kernel archaeology). First and foremost, modern systems should not be using this code. Typical Intel systems have not used it in over a decade because it is horribly inferior to MWAIT-based idle. Despite this, people do seem to be tripping over this workaround on AMD system today. Limit the "dummy wait" workaround to Intel systems. Keep Modern AMD systems from tripping over the workaround. Remotely modern Intel systems use intel_idle instead of this code and will, in practice, remain unaffected by the dummy wait. Reported-by: K Prateek Nayak Suggested-by: Rafael J. Wysocki Signed-off-by: Dave Hansen Reviewed-by: Mario Limonciello Tested-by: K Prateek Nayak Link: https://lore.kernel.org/all/20220921063638.2489-1-kprateek.nayak@amd.com/ Link: https://lkml.kernel.org/r/20220922184745.3252932-1-dave.hansen@intel.com commit 2154aca21408752eaa3eeaf2ba6e942724ff2a4d Author: Masahiro Yamada Date: Mon Sep 12 15:52:10 2022 +0900 certs: make system keyring depend on built-in x509 parser Commit e90886291c7c ("certs: make system keyring depend on x509 parser") is not the right fix because x509_load_certificate_list() can be modular. The combination of CONFIG_SYSTEM_TRUSTED_KEYRING=y and CONFIG_X509_CERTIFICATE_PARSER=m still results in the following error: LD .tmp_vmlinux.kallsyms1 ld: certs/system_keyring.o: in function `load_system_certificate_list': system_keyring.c:(.init.text+0x8c): undefined reference to `x509_load_certificate_list' make: *** [Makefile:1169: vmlinux] Error 1 Fixes: e90886291c7c ("certs: make system keyring depend on x509 parser") Signed-off-by: Masahiro Yamada Tested-by: Adam Borowski commit 03764b30a4f0185a97515d616e60e2e00c558583 Author: Zeng Heng Date: Mon Sep 12 17:48:38 2022 +0800 Kconfig: remove unused function 'menu_get_root_menu' There is nowhere calling `menu_get_root_menu` function, so remove it. Signed-off-by: Zeng Heng Signed-off-by: Masahiro Yamada commit 237fe72749425f2cd3132bf54fa6b98807c27938 Author: yangxingwu Date: Tue Sep 13 04:07:53 2022 +0000 scripts/clang-tools: remove unused module Remove unused imported 'os' module. Signed-off-by: yangxingwu Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit df02452f3df069a59bc9e69c84435bf115cb6e37 Author: Ming Lei Date: Fri Sep 23 19:51:19 2022 +0800 cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace. Reported-by: Marco Patalano Fixes: 6b658c4863c1 ("scsi: cgroup: Add cgroup_get_from_id()") Cc: Muneendra Signed-off-by: Ming Lei Acked-by: Mukesh Ojha Cc: stable@vger.kernel.org # v5.14+ Signed-off-by: Tejun Heo commit 1707c39ae309bf91965aa6f04d63816a090d90a1 Merge: 33a4e37ebc8cc d7f06bdd6ee87 Author: Linus Torvalds Date: Fri Sep 23 09:12:18 2022 -0700 Merge tag 'driver-core-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two tiny driver core fixes for 6.0-rc7 that resolve some oft-reported problems. The first is a revert of the "fw_devlink.strict=1" default option that we keep trying to enable, but we keep finding platforms that this just breaks everything on. So again, we need it reverted and hopefully it can be worked on in future releases. The second is a sysfs file-size bugfix that resolves an issue that many people are starting to hit as the fix it is fixing also was backported to stable kernels. The util-linux developers are starting to get bugreports about sysfs files that contain no data because of this problem, and this fix which has been in linux-next in the bitfield tree for a long time, resolves it. I'm submitting it here as it needs to be merged for 6.0-final, not for 6.1-rc1. Both of these have been in linux-next with no reported issues, only reports were that these fixed problems" * tag 'driver-core-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: drivers/base: Fix unsigned comparison to -1 in CPUMAP_FILE_MAX_BYTES Revert "driver core: Set fw_devlink.strict=1 by default" commit 33a4e37ebc8ccdfe2c51306b1a40d9e7d17b4691 Merge: 9395cd7cef456 47af6c640ed82 Author: Linus Torvalds Date: Fri Sep 23 09:07:08 2022 -0700 Merge tag 'usb-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver fixes and ids from Greg KH: "Here are a few small USB and Thunderbolt driver fixes and new device ids for 6.0-rc7. They contain: - new usb-serial driver ids - documentation build warning fix in USB hub code - flexcop-usb long-posted bugfix (the v4l maintainer for this is MIA so I have finally picked this up as it is a fix for a reported problem.) - dwc3 64bit DMA bugfix - new thunderbolt device ids - typec build error fix All of these have been in linux-next with no reported issues" * tag 'usb-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: anx7411: Fix build error without CONFIG_POWER_SUPPLY media: flexcop-usb: fix endpoint type check USB: serial: option: add Quectel RM520N USB: serial: option: add Quectel BG95 0x0203 composition thunderbolt: Add support for Intel Maple Ridge single port controller usb: dwc3: core: leave default DMA if the controller does not support 64-bit DMA USB: core: Fix RST error in hub.c commit 9395cd7cef45698a7fd64f53cf97ce511e1334ba Merge: a7b7751aeb134 a52540522c954 Author: Linus Torvalds Date: Fri Sep 23 08:59:16 2022 -0700 Merge tag 'landlock-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fix from Mickaël Salaün: "Fix out-of-tree builds for Landlock tests" * tag 'landlock-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Fix out-of-tree builds commit a7b7751aeb1348a4358724719aac5310597144fc Merge: 317fab7ec55d5 c589e3ca27c9f Author: Linus Torvalds Date: Fri Sep 23 08:51:05 2022 -0700 Merge tag 'riscv-for-linus-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A handful of build fixes for the T-Head errata, including some functional issues the compilers found - A fix for a nasty sigreturn bug * tag 'riscv-for-linus-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Avoid coupling the T-Head CMOs and Zicbom riscv: fix a nasty sigreturn bug... riscv: make t-head erratas depend on MMU riscv: fix RISCV_ISA_SVPBMT kconfig dependency warning RISC-V: Clean up the Zicbom block size probing commit 2653853e2a2a21a9b87d976044863cf776035b8e Merge: c69badd1d7469 ae358d71d4623 Author: Arnd Bergmann Date: Fri Sep 23 17:45:13 2022 +0200 Merge tag 'reset-fixes-for-v6.0' of git://git.pengutronix.de/pza/linux into arm/fixes Reset controller fixes for v6.0 Fix the i.MX8MP PCIe PHY PERST bit polarity, issue the Sparx5 "switch" reset (which turned out to be a rather more global reset) early on startup, stubbing out the reset controller driver, and fix the NPCM8XX USB reset sequence by setting IPSRST4 bits in the correct register. * tag 'reset-fixes-for-v6.0' of git://git.pengutronix.de/pza/linux: reset: npcm: fix iprst2 and iprst4 setting reset: microchip-sparx5: issue a reset on startup reset: imx7: Fix the iMX8MP PCIe PHY PERST support Link: https://lore.kernel.org/r/20220923143519.41735-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 317fab7ec55d5a150bce46f37efbc942013a8c5b Merge: 526e826285602 69604fe76e58c Author: Linus Torvalds Date: Fri Sep 23 08:42:30 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "As everyone back came back from conferences, here are the pending patches for Linux 6.0. ARM: - Fix for kmemleak with pKVM s390: - Fixes for VFIO with zPCI - smatch fix x86: - Ensure XSAVE-capable hosts always allow FP and SSE state to be saved and restored via KVM_{GET,SET}_XSAVE - Fix broken max_mmu_rmap_size stat - Fix compile error with old glibc that doesn't have gettid()" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Inject #UD on emulated XSETBV if XSAVES isn't enabled KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES KVM: x86: Reinstate kvm_vcpu_arch.guest_supported_xcr0 KVM: x86/mmu: add missing update to max_mmu_rmap_size selftests: kvm: Fix a compile error in selftests/kvm/rseq_test.c KVM: s390: pci: register pci hooks without interpretation KVM: s390: pci: fix GAIT physical vs virtual pointers usage KVM: s390: Pass initialized arg even if unused KVM: s390: pci: fix plain integer as NULL pointer warnings KVM: arm64: Use kmemleak_free_part_phys() to unregister hyp_mem_base commit 526e8262856027cea38c45a5ff45fbe4204aed04 Merge: 22565ae784134 ce6b8ccdef959 Author: Linus Torvalds Date: Fri Sep 23 08:31:24 2022 -0700 Merge tag 'for-linus-6.0-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A single fix for an issue in the xenbus driver (initialization of multi-page rings for Xen PV devices)" * tag 'for-linus-6.0-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/xenbus: fix xenbus_setup_ring() commit 22565ae784134282e03912023456151a61db479c Merge: bf682942cd26c 8288206c27856 Author: Linus Torvalds Date: Fri Sep 23 08:18:55 2022 -0700 Merge tag 'drm-fixes-2022-09-23-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular fixes for the week, i915, mediatek, hisilicon, mgag200 and panel have some small fixes. amdgpu has more stack size fixes for clang build, and fixes for new IPs, but all with low regression chances since they are for stuff new in v6.0. i915: - avoid a general protection failure when using perf/OA - avoid kernel warnings on driver release amdgpu: - SDMA 6.x fix - GPUVM TF fix - DCN 3.2.x fixes - DCN 3.1.x fixes - SMU 13.x fixes - Clang stack size fixes for recently enabled DML code - Fix drm dirty callback change on non-atomic cases - USB4 display fix mediatek: - dsi: Add atomic {destroy,duplicate}_state, reset callbacks - dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() - Fix wrong dither settings hisilicon: - Depend on MMU mgag200: - Fix console on G200ER panel: - Fix innolux_g121i1_l01 bus format" * tag 'drm-fixes-2022-09-23-1' of git://anongit.freedesktop.org/drm/drm: (30 commits) MAINTAINERS: switch graphics to airlied other addresses drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() drm/amd/display: Reduce number of arguments of dml314's CalculateFlipSchedule() drm/amd/display: Reduce number of arguments of dml314's CalculateWatermarksAndDRAMSpeedChangeSupport() drm/amdgpu: don't register a dirty callback for non-atomic drm/amd/pm: drop the pptable related workarounds for SMU 13.0.0 drm/amd/pm: add support for 3794 pptable for SMU13.0.0 drm/amd/display: correct num_dsc based on HW cap drm/amd/display: Disable OTG WA for the plane_state NULL case on DCN314 drm/amd/display: Add shift and mask for ICH_RESET_AT_END_OF_LINE drm/amd/display: increase dcn315 pstate change latency drm/amd/display: Fix DP MST timeslot issue when fallback happened drm/amd/display: Display distortion after hotplug 5K tiled display drm/amd/display: Update dummy P-state search to use DCN32 DML drm/amd/display: skip audio setup when audio stream is enabled drm/amd/display: update gamut remap if plane has changed drm/amd/display: Assume an LTTPR is always present on fixed_vs links drm/amd/display: fix dcn315 memory channel count and width read drm/amd/display: Fix double cursor on non-video RGB MPO drm/amd/display: Only consider pixle rate div policy for DCN32+ ... commit c69badd1d74690e5b5b4d5c3c254a1e64bcc1ac9 Merge: 4952aa696a9f2 40e9541959100 Author: Arnd Bergmann Date: Fri Sep 23 16:44:37 2022 +0200 Merge tag 'qcom-arm64-fixes-for-6.0' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 DTS fixes for 6.0 This corrects invalid IOMMU streams for the SM8150 CDSP FastRPC, moves the wakeup-source of SC7280 USB nodes to the correct place, fixes the SM8350 UFS PHY serdes size to not overlap with the other subnodes and updates the firmware location for the Lenovo ThinkPad X13s to match the movement in linux-firmware. It also updates MAINTAINERS and .mailmap to reflect the changes in my email address. * tag 'qcom-arm64-fixes-for-6.0' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sm8350: fix UFS PHY serdes size arm64: dts: qcom: sc8280xp-x13s: Update firmware location MAINTAINERS: Update Bjorn's email address arm64: dts: qcom: sc7280: move USB wakeup-source property arm64: dts: qcom: thinkpad-x13s: Fix firmware location arm64: dts: qcom: sm8150: Fix fastrpc iommu values Link: https://lore.kernel.org/r/20220921142939.1310163-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 4952aa696a9f221c5e34e5961e02fca41ef67ad6 Author: Linus Walleij Date: Mon Sep 19 11:26:08 2022 +0200 ARM: dts: integrator: Tag PCI host with device_type The DT parser is dependent on the PCI device being tagged as device_type = "pci" in order to parse memory ranges properly. Fix this up. Signed-off-by: Linus Walleij Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220919092608.813511-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit cc62d98bd56d45de4531844ca23913a15136c05b Author: Brian Norris Date: Mon Aug 22 18:08:04 2022 -0700 Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" This reverts commit 211f276ed3d96e964d2d1106a198c7f4a4b3f4c0. For quite some time, core DRM helpers already ensure that any relevant connectors/CRTCs/etc. are disabled, as well as their associated components (e.g., bridges) when suspending the system. Thus, analogix_dp_bridge_{enable,disable}() already get called, which in turn call drm_panel_{prepare,unprepare}(). This makes these drm_panel_*() calls redundant. Besides redundancy, there are a few problems with this handling: (1) drm_panel_{prepare,unprepare}() are *not* reference-counted APIs and are not in general designed to be handled by multiple callers -- although some panel drivers have a coarse 'prepared' flag that mitigates some damage, at least. So at a minimum this is redundant and confusing, but in some cases, this could be actively harmful. (2) The error-handling is a bit non-standard. We ignored errors in suspend(), but handled errors in resume(). And recently, people noticed that the clk handling is unbalanced in error paths, and getting *that* right is not actually trivial, given the current way errors are mostly ignored. (3) In the particular way analogix_dp_{suspend,resume}() get used (e.g., in rockchip_dp_*(), as a late/early callback), we don't necessarily have a proper PM relationship between the DP/bridge device and the panel device. So while the DP bridge gets resumed, the panel's parent device (e.g., platform_device) may still be suspended, and so any prepare() calls may fail. So remove the superfluous, possibly-harmful suspend()/resume() handling of panel state. Fixes: 211f276ed3d9 ("drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time") Link: https://lore.kernel.org/all/Yv2CPBD3Picg%2FgVe@google.com/ Signed-off-by: Brian Norris Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20220822180729.1.I8ac5abe3a4c1c6fd5c061686c6e883c22f69022c@changeid commit 69604fe76e58c9d195e48b41d019b07fc27ce9d7 Merge: 50b2d49bafa16 189e7d876e48d Author: Paolo Bonzini Date: Fri Sep 23 10:06:08 2022 -0400 Merge tag 'kvm-s390-master-6.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD More pci fixes Fix for a code analyser warning commit 6bf8e846e4bf336db7e451a6b42ca8c02f99fb0f Merge: f8497b3e9650a 728c2af6ad8c8 Author: Jakub Kicinski Date: Fri Sep 23 06:58:53 2022 -0700 Merge branch 'net-mt7531-pll-reset-fixes' Alexander Couzens says: ==================== net: mt7531: pll & reset fixes ==================== Link: https://lore.kernel.org/r/20220917000734.520253-1-lynxis@fe80.eu Signed-off-by: Jakub Kicinski commit 728c2af6ad8c809f66639b70e4fd8c67c57c66e7 Author: Alexander Couzens Date: Sat Sep 17 02:07:34 2022 +0200 net: mt7531: ensure all MACs are powered down before reset The datasheet [1] explicit describes it as requirement for a reset. [1] MT7531 Reference Manual for Development Board rev 1.0, page 735 Signed-off-by: Alexander Couzens Signed-off-by: Jakub Kicinski commit 42bc4fafe359ed6b73602b7a2dba0dd99588f8ce Author: Alexander Couzens Date: Sat Sep 17 02:07:33 2022 +0200 net: mt7531: only do PLL once after the reset Move the PLL init of the switch out of the pad configuration of the port 6 (usally cpu port). Fix a unidirectional 100 mbit limitation on 1 gbit or 2.5 gbit links for outbound traffic on port 5 or port 6. Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch") Cc: stable@vger.kernel.org Signed-off-by: Alexander Couzens Signed-off-by: Jakub Kicinski commit f8497b3e9650a0d094a3995c644dfedd32e8cde7 Author: Lukas Bulwahn Date: Thu Sep 22 13:40:53 2022 +0200 MAINTAINERS: rectify file entry in TEAM DRIVER Commit bbb774d921e2 ("net: Add tests for bonding and team address list management") adds the net team driver tests in the directory: tools/testing/selftests/drivers/net/team/ The file entry in MAINTAINERS for the TEAM DRIVER however refers to: tools/testing/selftests/net/team/ Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken file pattern. Repair this file entry in TEAM DRIVER. Signed-off-by: Lukas Bulwahn Acked-by: Benjamin Poirier Link: https://lore.kernel.org/r/20220922114053.10883-1-lukas.bulwahn@gmail.com Signed-off-by: Jakub Kicinski commit 13b0566962914e167cb3238fbe29ced618f07a27 Author: Will Deacon Date: Thu Sep 22 22:57:15 2022 +0100 vmlinux.lds.h: CFI: Reduce alignment of jump-table to function alignment Due to undocumented, hysterical raisins on x86, the CFI jump-table sections in .text are needlessly aligned to PMD_SIZE in the vmlinux linker script. When compiling a CFI-enabled arm64 kernel with a 64KiB page-size, a PMD maps 512MiB of virtual memory and so the .text section increases to a whopping 940MiB and blows the final Image up to 960MiB. Others report a link failure. Since the CFI jump-table requires only instruction alignment, reduce the alignment directives to function alignment for parity with other parts of the .text section. This reduces the size of the .text section for the aforementioned 64KiB page size arm64 kernel to 19MiB for a much more reasonable total Image size of 39MiB. Cc: Sami Tolvanen Cc: Mark Rutland Cc: "Mohan Rao .vanimina" Cc: Kees Cook Cc: Nathan Chancellor Cc: Link: https://lore.kernel.org/all/CAL_GTzigiNOMYkOPX1KDnagPhJtFNqSK=1USNbS0wUL4PW6-Uw@mail.gmail.com/ Fixes: cf68fffb66d6 ("add support for Clang CFI") Reviewed-by: Mark Rutland Tested-by: Mark Rutland Reviewed-by: Sami Tolvanen Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20220922215715.13345-1-will@kernel.org Signed-off-by: Will Deacon commit 7e1e2acb7b16c0464b9cbfe243cbaec03198039f Merge: b58e731783a0c e3c95edb1bd8b Author: Arnd Bergmann Date: Fri Sep 23 14:28:59 2022 +0200 Merge tag 'sunxi-drivers-fixes-for-6.0-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes sunxi SRAM controller fixes for - loading/unloading - claiming regions - debugfs info * tag 'sunxi-drivers-fixes-for-6.0-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: soc: sunxi: sram: Fix debugfs info for A64 SRAM C soc: sunxi: sram: Fix probe function ordering issues soc: sunxi: sram: Prevent the driver from being unbound soc: sunxi: sram: Actually claim SRAM regions Link: https://lore.kernel.org/r/YyeN0m78+m9nNEah@kista.localdomain Signed-off-by: Arnd Bergmann commit b58e731783a0cfdc82ec13951fefdc7dd6ce36a2 Merge: 415da412257b1 90d000288e115 Author: Arnd Bergmann Date: Fri Sep 23 14:28:16 2022 +0200 Merge tag 'arm-soc/for-6.0/drivers-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom SoCs driver fixes for 6.0, please pull the following: - Florian fixes a double of_node_put() in the Broadcom STB Bus Interface Unit driver * tag 'arm-soc/for-6.0/drivers-fixes-v2' of https://github.com/Broadcom/stblinux: soc: bcm: brcmstb: biuctrl: Avoid double of_node_put() Link: https://lore.kernel.org/r/20220918205038.3017866-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 415da412257b1595b8f05f2d7c7815b41f00757e Merge: 1e6989a3357c8 2a906db2824b7 Author: Arnd Bergmann Date: Fri Sep 23 14:27:39 2022 +0200 Merge tag 'omap-for-6.0/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Two fixes for omaps A fix to remove usb4 from am5748 as it does not exist on the SoC, and a fix for am335x mmc dma that wired direct and should not use the xbar. Note that the am5748 fix depends on the recent deferred probe regression fixes to boot. I ended up picking the merge commit to base it on as it describes what got fixed quite nicely rather than a -rc tag. * tag 'omap-for-6.0/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am5748: keep usb4_tm disabled ARM: dts: am33xx: Fix MMCHS0 dma properties Link: https://lore.kernel.org/r/pull-1663140667-273537@atomide.com Signed-off-by: Arnd Bergmann commit 1e6989a3357c85ddc1c691eaf872ccd2e21f5a10 Author: Randy Dunlap Date: Wed Aug 31 17:08:21 2022 -0700 ARM: sunplus: fix serial console kconfig and build problems Fix kconfig dependency warnings and subsequent build errors: WARNING: unmet direct dependencies detected for SERIAL_SUNPLUS Depends on [n]: TTY [=n] && HAS_IOMEM [=y] && (ARCH_SUNPLUS [=y] || COMPILE_TEST [=n]) Selected by [y]: - SOC_SP7021 [=y] && ARCH_SUNPLUS [=y] WARNING: unmet direct dependencies detected for SERIAL_SUNPLUS_CONSOLE Depends on [n]: TTY [=n] && HAS_IOMEM [=y] && SERIAL_SUNPLUS [=y] Selected by [y]: - SOC_SP7021 [=y] && ARCH_SUNPLUS [=y] (samples, not all:) drivers/tty/serial/sunplus-uart.c:342: undefined reference to `uart_get_baud_rate' arm-linux-gnueabi-ld: drivers/tty/serial/sunplus-uart.c:379: undefined reference to `uart_update_timeout' drivers/tty/serial/sunplus-uart.c:526: undefined reference to `uart_console_write' arm-linux-gnueabi-ld: drivers/tty/serial/sunplus-uart.c:274: undefined reference to `tty_flip_buffer_push' arm-linux-gnueabi-ld: drivers/tty/serial/sunplus-uart.o:(.data+0xa8): undefined reference to `uart_console_device' drivers/tty/serial/sunplus-uart.c:720: undefined reference to `uart_register_driver' arm-linux-gnueabi-ld: drivers/tty/serial/sunplus-uart.c:726: undefined reference to `uart_unregister_driver' drivers/tty/serial/sunplus-uart.c:551: undefined reference to `uart_parse_options' arm-linux-gnueabi-ld: drivers/tty/serial/sunplus-uart.c:553: undefined reference to `uart_set_options' This is the same technique that is used 2 times in arch/arm/mach-versatile/Kconfig. Fixes: 0aa94eea8d95 ("ARM: sunplus: Add initial support for Sunplus SP7021 SoC") Reported-by: kernel test robot Signed-off-by: Randy Dunlap Cc: Qin Jian Cc: Necip Fazil Yildiran Cc: Arnd Bergmann Cc: linux-arm-kernel@lists.infradead.org Cc: patches@armlinux.org.uk Signed-off-by: Arnd Bergmann commit f22bd29ba19a43e758b192429613e04aa7abb70d Author: Radhey Shyam Pandey Date: Wed Sep 21 19:06:10 2022 +0530 net: macb: Fix ZynqMP SGMII non-wakeup source resume failure When GEM is in SGMII mode and disabled as a wakeup source, the power management controller can power down the entire full power domain(FPD) if none of the FPD devices are in use. Incase of FPD off, there are below ethernet link up issues on non-wakeup suspend/resume. To fix it add phy_exit() in suspend and phy_init() in the resume path which reinitializes PS GTR SGMII lanes. $ echo +20 > /sys/class/rtc/rtc0/wakealarm $ echo mem > /sys/power/state After resume: $ ifconfig eth0 up xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout phy phy-fd400000.phy.0: phy poweron failed --> -110 xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout SIOCSIFFLAGS: Connection timed out phy phy-fd400000.phy.0: phy poweron failed --> -110 Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization") Signed-off-by: Radhey Shyam Pandey Signed-off-by: David S. Miller commit 195624d9c26b64c6856863da30ec578a790feec4 Author: Patrick Rohr Date: Tue Sep 20 12:48:25 2022 -0700 tun: support not enabling carrier in TUNSETIFF This change adds support for not enabling carrier during TUNSETIFF interface creation by specifying the IFF_NO_CARRIER flag. Our tests make heavy use of tun interfaces. In some scenarios, the test process creates the interface but another process brings it up after the interface is discovered via netlink notification. In that case, it is not possible to create a tun/tap interface with carrier off without it racing against the bring up. Immediately setting carrier off via TUNSETCARRIER is still too late. Signed-off-by: Patrick Rohr Cc: Maciej Żenczykowski Cc: Lorenzo Colitti Cc: Jason Wang Cc: Stephen Hemminger Cc: Nicolas Dichtel Reviewed-by: Maciej Żenczykowski Acked-by: Jason Wang Reviewed-by: Nicolas Dichtel Signed-off-by: David S. Miller commit 051ad2788d35ca07aec8402542e5d38429f2426a Author: Francesco Dolcini Date: Thu Sep 22 14:43:05 2022 +0200 drm/bridge: lt8912b: fix corrupted image output Correct I2C address for the register list in lt8912_write_lvds_config(), these registers are on the first I2C address (0x48), the current function is just writing garbage to the wrong registers and this creates multiple issues (artifacts and output completely corrupted) on some HDMI displays. Correct I2C address comes from Lontium documentation and it is the one used on other out-of-tree LT8912B drivers [1]. [1] https://github.com/boundarydevices/linux/blob/boundary-imx_5.10.x_2.0.0/drivers/video/lt8912.c#L296 Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") Signed-off-by: Francesco Dolcini Signed-off-by: Philippe Schenker Acked-by: Adrien Grassein Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220922124306.34729-4-dev@pschenker.ch commit 6dd1de12e1243f2013e4fabf31e99e63b1a860d0 Author: Philippe Schenker Date: Thu Sep 22 14:43:04 2022 +0200 drm/bridge: lt8912b: set hdmi or dvi mode The Lontium LT8912 does have a setting for DVI or HDMI. This patch reads from EDID what the display needs and sets it accordingly. Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") Signed-off-by: Philippe Schenker Acked-by: Adrien Grassein Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220922124306.34729-3-dev@pschenker.ch commit da73a94fa282f78d485bd0aab36c8ac15b6f792c Author: Philippe Schenker Date: Thu Sep 22 14:43:03 2022 +0200 drm/bridge: lt8912b: add vsync hsync Currently the bridge driver does not take care whether or not the display needs positive/negative vertical/horizontal syncs. Pass these two flags to the bridge from the EDID that was read out from the display. Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") Signed-off-by: Philippe Schenker Acked-by: Adrien Grassein Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220922124306.34729-2-dev@pschenker.ch commit 3c6656337852e9f1a4079d172f3fddfbf00868f9 Author: Ulf Hansson Date: Mon Sep 19 14:20:33 2022 +0200 Revert "firmware: arm_scmi: Add clock management to the SCMI power domain" This reverts commit a3b884cef873 ("firmware: arm_scmi: Add clock management to the SCMI power domain"). Using the GENPD_FLAG_PM_CLK tells genpd to gate/ungate the consumer device's clock(s) during runtime suspend/resume through the PM clock API. More precisely, in genpd_runtime_resume() the clock(s) for the consumer device would become ungated prior to the driver-level ->runtime_resume() callbacks gets invoked. This behaviour isn't a good fit for all platforms/drivers. For example, a driver may need to make some preparations of its device in its ->runtime_resume() callback, like calling clk_set_rate() before the clock(s) should be ungated. In these cases, it's easier to let the clock(s) to be managed solely by the driver, rather than at the PM domain level. For these reasons, let's drop the use GENPD_FLAG_PM_CLK for the SCMI PM domain, as to enable it to be more easily adopted across ARM platforms. Fixes: a3b884cef873 ("firmware: arm_scmi: Add clock management to the SCMI power domain") Cc: Nicolas Pitre Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson Tested-by: Peng Fan Acked-by: Sudeep Holla Link: https://lore.kernel.org/r/20220919122033.86126-1-ulf.hansson@linaro.org commit 8288206c27856f6f56d35aacf3a48ee923e1d3e2 Author: Dave Airlie Date: Fri Sep 23 15:36:12 2022 +1000 MAINTAINERS: switch graphics to airlied other addresses My linux.ie address is in a bad place. also add dri-devel for agpgart. Signed-off-by: Dave Airlie commit 3b38b65ed076fa93f1b0d5fb97c55a9bf692cc49 Merge: 73646baf68444 d8a79c0305491 Author: Dave Airlie Date: Fri Sep 23 13:18:21 2022 +1000 Merge tag 'drm-misc-fixes-2022-09-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull * drm/hisilicon: Depend on MMU * drm/mgag200: Fix console on G200ER * drm/panel: Fix innolux_g121i1_l01 bus format Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YyxtXS588at6S4wg@linux-uq9g commit 73646baf68444e24284516ddd4dac43ddb3162d4 Merge: 387df878fdcf6 90144dd8b0d13 Author: Dave Airlie Date: Fri Sep 23 13:15:29 2022 +1000 Merge tag 'mediatek-drm-fixes-6.0' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes for Linux 6.0 1. dsi: Add atomic {destroy,duplicate}_state, reset callbacks 2. drm/mediatek: Fix wrong dither settings 3. dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patchwork.freedesktop.org/patch/msgid/20220921235624.23580-1-chunkuang.hu@kernel.org commit 387df878fdcf63ce497109c4e1eb805a7df9043f Merge: d21fc11109ca0 f525ed19437d3 Author: Dave Airlie Date: Fri Sep 23 11:12:06 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-09-21' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-09-21: amdgpu: - SDMA 6.x fix - GPUVM TF fix - DCN 3.2.x fixes - DCN 3.1.x fixes - SMU 13.x fixes - Clang stack size fixes for recently enabled DML code - Fix drm dirty callback change on non-atomic cases - USB4 display fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220921220605.6136-1-alexander.deucher@amd.com commit bf682942cd26ce9cd5e87f73ae099b383041e782 Merge: 3c0f396a386c8 e0e0747de0ea3 Author: Linus Torvalds Date: Thu Sep 22 14:43:55 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three small and pretty obvious fixes, all in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mpt3sas: Fix return value check of dma_get_required_mask() scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() scsi: qedf: Fix a UAF bug in __qedf_probe() commit 3c0f396a386c81715e34472566cdd8f39dde5a6a Merge: c69cf88cda5fa e45cc288724f0 Author: Linus Torvalds Date: Thu Sep 22 14:37:58 2022 -0700 Merge tag 'slab-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fix a possible use-after-free in SLUB's kmem_cache removal, introduced in this cycle, by Feng Tang. - WQ_MEM_RECLAIM dependency fix for the workqueue-based cpu slab flushing introduced in 5.15, by Maurizio Lombardi. - Add missing KASAN hooks in two kmalloc entry paths, by Peter Collingbourne. - A BUG_ON() removal in SLUB's kmem_cache creation when allocation fails (too small to possibly happen in practice, syzbot used fault injection), by Chao Yu. * tag 'slab-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. mm/slab_common: fix possible double free of kmem_cache kasan: call kasan_malloc() from __kmalloc_*track_caller() mm/slub: fix to return errno if kmalloc() fails commit 50b2d49bafa16e6311ab2da82f5aafc5f9ada99b Author: Sean Christopherson Date: Wed Aug 24 03:30:57 2022 +0000 KVM: x86: Inject #UD on emulated XSETBV if XSAVES isn't enabled Inject #UD when emulating XSETBV if CR4.OSXSAVE is not set. This also covers the "XSAVE not supported" check, as setting CR4.OSXSAVE=1 #GPs if XSAVE is not supported (and userspace gets to keep the pieces if it forces incoherent vCPU state). Add a comment to kvm_emulate_xsetbv() to call out that the CPU checks CR4.OSXSAVE before checking for intercepts. AMD'S APM implies that #UD has priority (says that intercepts are checked before #GP exceptions), while Intel's SDM says nothing about interception priority. However, testing on hardware shows that both AMD and Intel CPUs prioritize the #UD over interception. Fixes: 02d4160fbd76 ("x86: KVM: add xsetbv to the emulator") Cc: stable@vger.kernel.org Cc: Vitaly Kuznetsov Signed-off-by: Sean Christopherson Message-Id: <20220824033057.3576315-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a1020a25e69755a8a1a37735d674b91d6f02939f Author: Dr. David Alan Gilbert Date: Wed Aug 24 03:30:56 2022 +0000 KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES Allow FP and SSE state to be saved and restored via KVM_{G,SET}_XSAVE on XSAVE-capable hosts even if their bits are not exposed to the guest via XCR0. Failing to allow FP+SSE first showed up as a QEMU live migration failure, where migrating a VM from a pre-XSAVE host, e.g. Nehalem, to an XSAVE host failed due to KVM rejecting KVM_SET_XSAVE. However, the bug also causes problems even when migrating between XSAVE-capable hosts as KVM_GET_SAVE won't set any bits in user_xfeatures if XSAVE isn't exposed to the guest, i.e. KVM will fail to actually migrate FP+SSE. Because KVM_{G,S}ET_XSAVE are designed to allowing migrating between hosts with and without XSAVE, KVM_GET_XSAVE on a non-XSAVE (by way of fpu_copy_guest_fpstate_to_uabi()) always sets the FP+SSE bits in the header so that KVM_SET_XSAVE will work even if the new host supports XSAVE. Fixes: ad856280ddea ("x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0") bz: https://bugzilla.redhat.com/show_bug.cgi?id=2079311 Cc: stable@vger.kernel.org Cc: Leonardo Bras Signed-off-by: Dr. David Alan Gilbert [sean: add comment, massage changelog] Signed-off-by: Sean Christopherson Message-Id: <20220824033057.3576315-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit ee519b3a2ae3027c341bce829ee8c51f4f494f5b Author: Sean Christopherson Date: Wed Aug 24 03:30:55 2022 +0000 KVM: x86: Reinstate kvm_vcpu_arch.guest_supported_xcr0 Reinstate the per-vCPU guest_supported_xcr0 by partially reverting commit 988896bb6182; the implicit assessment that guest_supported_xcr0 is always the same as guest_fpu.fpstate->user_xfeatures was incorrect. kvm_vcpu_after_set_cpuid() isn't the only place that sets user_xfeatures, as user_xfeatures is set to fpu_user_cfg.default_features when guest_fpu is allocated via fpu_alloc_guest_fpstate() => __fpstate_reset(). guest_supported_xcr0 on the other hand is zero-allocated. If userspace never invokes KVM_SET_CPUID2, supported XCR0 will be '0', whereas the allowed user XFEATURES will be non-zero. Practically speaking, the edge case likely doesn't matter as no sane userspace will live migrate a VM without ever doing KVM_SET_CPUID2. The primary motivation is to prepare for KVM intentionally and explicitly setting bits in user_xfeatures that are not set in guest_supported_xcr0. Because KVM_{G,S}ET_XSAVE can be used to svae/restore FP+SSE state even if the host doesn't support XSAVE, KVM needs to set the FP+SSE bits in user_xfeatures even if they're not allowed in XCR0, e.g. because XCR0 isn't exposed to the guest. At that point, the simplest fix is to track the two things separately (allowed save/restore vs. allowed XCR0). Fixes: 988896bb6182 ("x86/kvm/fpu: Remove kvm_vcpu_arch.guest_supported_xcr0") Cc: stable@vger.kernel.org Cc: Leonardo Bras Signed-off-by: Sean Christopherson Message-Id: <20220824033057.3576315-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 604f533262aea08671a74c2fd630c7deb9eb3c0d Author: Miaohe Lin Date: Wed Sep 7 16:06:57 2022 +0800 KVM: x86/mmu: add missing update to max_mmu_rmap_size The update to statistic max_mmu_rmap_size is unintentionally removed by commit 4293ddb788c1 ("KVM: x86/mmu: Remove redundant spte present check in mmu_set_spte"). Add missing update to it or max_mmu_rmap_size will always be nonsensical 0. Fixes: 4293ddb788c1 ("KVM: x86/mmu: Remove redundant spte present check in mmu_set_spte") Signed-off-by: Miaohe Lin Message-Id: <20220907080657.42898-1-linmiaohe@huawei.com> Signed-off-by: Paolo Bonzini commit 561cafebb2cf97b0927b4fb0eba22de6200f682e Author: Jinrong Liang Date: Tue Aug 2 15:12:40 2022 +0800 selftests: kvm: Fix a compile error in selftests/kvm/rseq_test.c The following warning appears when executing: make -C tools/testing/selftests/kvm rseq_test.c: In function ‘main’: rseq_test.c:237:33: warning: implicit declaration of function ‘gettid’; did you mean ‘getgid’? [-Wimplicit-function-declaration] (void *)(unsigned long)gettid()); ^~~~~~ getgid /usr/bin/ld: /tmp/ccr5mMko.o: in function `main': ../kvm/tools/testing/selftests/kvm/rseq_test.c:237: undefined reference to `gettid' collect2: error: ld returned 1 exit status make: *** [../lib.mk:173: ../kvm/tools/testing/selftests/kvm/rseq_test] Error 1 Use the more compatible syscall(SYS_gettid) instead of gettid() to fix it. More subsequent reuse may cause it to be wrapped in a lib file. Signed-off-by: Jinrong Liang Message-Id: <20220802071240.84626-1-cloudliang@tencent.com> Signed-off-by: Paolo Bonzini commit b4ac28a32f589d389e5391f5b546c17a484915dc Merge: 29250ba51bc1c 522c9a64c7049 Author: Paolo Bonzini Date: Thu Sep 22 17:01:33 2022 -0400 Merge tag 'kvmarm-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.0, take #2 - Fix kmemleak usage in Protected KVM (again) commit e45cc288724f0cfd497bb5920bcfa60caa335729 Author: Maurizio Lombardi Date: Mon Sep 19 18:39:29 2022 +0200 mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. Commit 5a836bf6b09f ("mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context") moved all flush_cpu_slab() invocations to the global workqueue to avoid a problem related with deactivate_slab()/__free_slab() being called from an IRQ context on PREEMPT_RT kernels. When the flush_all_cpu_locked() function is called from a task context it may happen that a workqueue with WQ_MEM_RECLAIM bit set ends up flushing the global workqueue, this will cause a dependency issue. workqueue: WQ_MEM_RECLAIM nvme-delete-wq:nvme_delete_ctrl_work [nvme_core] is flushing !WQ_MEM_RECLAIM events:flush_cpu_slab WARNING: CPU: 37 PID: 410 at kernel/workqueue.c:2637 check_flush_dependency+0x10a/0x120 Workqueue: nvme-delete-wq nvme_delete_ctrl_work [nvme_core] RIP: 0010:check_flush_dependency+0x10a/0x120[ 453.262125] Call Trace: __flush_work.isra.0+0xbf/0x220 ? __queue_work+0x1dc/0x420 flush_all_cpus_locked+0xfb/0x120 __kmem_cache_shutdown+0x2b/0x320 kmem_cache_destroy+0x49/0x100 bioset_exit+0x143/0x190 blk_release_queue+0xb9/0x100 kobject_cleanup+0x37/0x130 nvme_fc_ctrl_free+0xc6/0x150 [nvme_fc] nvme_free_ctrl+0x1ac/0x2b0 [nvme_core] Fix this bug by creating a workqueue for the flush operation with the WQ_MEM_RECLAIM bit set. Fixes: 5a836bf6b09f ("mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context") Cc: Signed-off-by: Maurizio Lombardi Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Vlastimil Babka commit c69cf88cda5faca0e411babb67ac0d8bfd8b4646 Merge: 504c25cb76a9c aaa58141a5d76 Author: Linus Torvalds Date: Thu Sep 22 11:10:11 2022 -0700 Merge tag 'soc-fixes-6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Another set of fixes for fixes for the soc tree: - A fix for the interrupt number on at91/lan966 ethernet PHYs - A second round of fixes for NXP i.MX series, including a couple of build issues, and board specific DT corrections on TQMa8MPQL, imx8mp-venice-gw74xx and imx8mm-verdin for reliability and partially broken functionality - Several fixes for Rockchip SoCs, addressing a USB issue on BPI-R2-Pro, wakeup on Gru-Bob and reliability of high-speed SD cards, among other minor issues - A fix for a long-running naming mistake that prevented the moxart mmc driver from working at all - Multiple Arm SCMI firmware fixes for hardening some corner cases" * tag 'soc-fixes-6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits) arm64: dts: imx8mp-venice-gw74xx: fix port/phy validation ARM: dts: lan966x: Fix the interrupt number for internal PHYs arm64: dts: imx8mp-venice-gw74xx: fix ksz9477 cpu port arm64: dts: imx8mp-venice-gw74xx: fix CAN STBY polarity dt-bindings: memory-controllers: fsl,imx8m-ddrc: drop Leonard Crestez arm64: dts: tqma8mqml: Include phy-imx8-pcie.h header arm64: defconfig: enable ARCH_NXP arm64: dts: imx8mp-tqma8mpql-mba8mpxl: add missing pinctrl for RTC alarm ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer arm64: dts: imx8mm-verdin: extend pmic voltages arm64: dts: rockchip: Remove 'enable-active-low' from rk3566-quartz64-a arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma arm64: dts: rockchip: fix property for usb2 phy supply on rk3568-evb1-v10 arm64: dts: rockchip: fix property for usb2 phy supply on rock-3a arm64: dts: imx8ulp: add #reset-cells for pcc arm64: dts: tqma8mpxl-ba8mpxl: Fix button GPIOs arm64: dts: imx8mn: remove GPU power domain reset arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz arm64: dts: imx8mm: Reverse CPLD_Dn GPIO label mapping on MX8Menlo arm64: dts: rockchip: fix upper usb port on BPI-R2-Pro ... commit 504c25cb76a9cb805407f7701b25a1fbd48605fa Merge: 129e7152184b0 83e4b196838d9 Author: Linus Torvalds Date: Thu Sep 22 10:58:13 2022 -0700 Merge tag 'net-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wifi, netfilter and can. A handful of awaited fixes here - revert of the FEC changes, bluetooth fix, fixes for iwlwifi spew. We added a warning in PHY/MDIO code which is triggering on a couple of platforms in a false-positive-ish way. If we can't iron that out over the week we'll drop it and re-add for 6.1. I've added a new "follow up fixes" section for fixes to fixes in 6.0-rcs but it may actually give the false impression that those are problematic or that more testing time would have caught them. So likely a one time thing. Follow up fixes: - nf_tables_addchain: fix nft_counters_enabled underflow - ebtables: fix memory leak when blob is malformed - nf_ct_ftp: fix deadlock when nat rewrite is needed Current release - regressions: - Revert "fec: Restart PPS after link state change" and the related "net: fec: Use a spinlock to guard `fep->ptp_clk_on`" - Bluetooth: fix HCIGETDEVINFO regression - wifi: mt76: fix 5 GHz connection regression on mt76x0/mt76x2 - mptcp: fix fwd memory accounting on coalesce - rwlock removal fall out: - ipmr: always call ip{,6}_mr_forward() from RCU read-side critical section - ipv6: fix crash when IPv6 is administratively disabled - tcp: read multiple skbs in tcp_read_skb() - mdio_bus_phy_resume state warning fallout: - eth: ravb: fix PHY state warning splat during system resume - eth: sh_eth: fix PHY state warning splat during system resume Current release - new code bugs: - wifi: iwlwifi: don't spam logs with NSS>2 messages - eth: mtk_eth_soc: enable XDP support just for MT7986 SoC Previous releases - regressions: - bonding: fix NULL deref in bond_rr_gen_slave_id - wifi: iwlwifi: mark IWLMEI as broken Previous releases - always broken: - nf_conntrack helpers: - irc: tighten matching on DCC message - sip: fix ct_sip_walk_headers - osf: fix possible bogus match in nf_osf_find() - ipvlan: fix out-of-bound bugs caused by unset skb->mac_header - core: fix flow symmetric hash - bonding, team: unsync device addresses on ndo_stop - phy: micrel: fix shared interrupt on LAN8814" * tag 'net-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits) selftests: forwarding: add shebang for sch_red.sh bnxt: prevent skb UAF after handing over to PTP worker net: marvell: Fix refcounting bugs in prestera_port_sfp_bind() net: sched: fix possible refcount leak in tc_new_tfilter() net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD udp: Use WARN_ON_ONCE() in udp_read_skb() selftests: bonding: cause oops in bond_rr_gen_slave_id bonding: fix NULL deref in bond_rr_gen_slave_id net: phy: micrel: fix shared interrupt on LAN8814 net/smc: Stop the CLC flow if no link to map buffers on ice: Fix ice_xdp_xmit() when XDP TX queue number is not sufficient net: atlantic: fix potential memory leak in aq_ndev_close() can: gs_usb: gs_usb_set_phys_id(): return with error if identify is not supported can: gs_usb: gs_can_open(): fix race dev->can.state condition can: flexcan: flexcan_mailbox_read() fix return value for drop = true net: sh_eth: Fix PHY state warning splat during system resume net: ravb: Fix PHY state warning splat during system resume netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed netfilter: ebtables: fix memory leak when blob is malformed netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() ... commit 129e7152184b0224f9ca3f91b870acc14c64e1fa Merge: 5e0a93e42756f 5f56a74cc0a6d Author: Linus Torvalds Date: Thu Sep 22 10:27:38 2022 -0700 Merge tag 'efi-urgent-for-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Use the right variable to check for shim insecure mode - Wipe setup_data field when booting via EFI - Add missing error check to efibc driver * tag 'efi-urgent-for-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: libstub: check Shim mode using MokSBStateRT efi: x86: Wipe setup_data on pure EFI boot efi: efibc: Guard against allocation failure commit 5e0a93e42756fa93b69fe8848cf8dda7cee5d13a Merge: 9597f088c9fc0 69bef19d6b970 Author: Linus Torvalds Date: Thu Sep 22 10:17:29 2022 -0700 Merge tag 'gpio-fixes-for-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a NULL-pointer dereference at driver unbind and a potential resource leak in error path in gpio-mockup - make the irqchip immutable in gpio-ftgpio010 - fix dereferencing a potentially uninitialized variable in gpio-tqmx86 - fix interrupt registering in gpiolib's character device code * tag 'gpio-fixes-for-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully gpio: tqmx86: fix uninitialized variable girq gpio: ftgpio010: Make irqchip immutable gpio: mockup: Fix potential resource leakage when register a chip gpio: mockup: fix NULL pointer dereference when removing debugfs commit 9597f088c9fc0a9a1de402426f57ff0a18cd069e Merge: dc164f4fb00a0 999e4eaa4b369 Author: Linus Torvalds Date: Thu Sep 22 10:12:21 2022 -0700 Merge tag 'perf-tools-fixes-for-v6.0-2022-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix polling of system-wide events related to mixing per-cpu and per-thread events. - Do not check if /proc/modules is unchanged when copying /proc/kcore, that doesn't get in the way of post processing analysis. - Include program header in ELF files generated for JIT files, so that they can be opened by tools using elfutils libraries. - Enter namespaces when synthesizing build-ids. - Fix some bugs related to a recent cpu_map overhaul where we should be using an index and not the cpu number. - Fix BPF program ELF section name, using the naming expected by libbpf when using BPF counters in 'perf stat'. - Add a new test for perf stat cgroup BPF counter. - Adjust check on 'perf test wp' for older kernels, where the PERF_EVENT_IOC_MODIFY_ATTRIBUTES ioctl isn't supported. - Sync x86 cpufeatures with the kernel sources, no changes in tooling. * tag 'perf-tools-fixes-for-v6.0-2022-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf tools: Honor namespace when synthesizing build-ids tools headers cpufeatures: Sync with the kernel sources perf kcore_copy: Do not check /proc/modules is unchanged libperf evlist: Fix polling of system-wide events perf record: Fix cpu mask bit setting for mixed mmaps perf test: Skip wp modify test on old kernels perf jit: Include program header in ELF files perf test: Add a new test for perf stat cgroup BPF counter perf stat: Use evsel->core.cpus to iterate cpus in BPF cgroup counters perf stat: Fix cpu map index in bperf cgroup code perf stat: Fix BPF program section name commit ae358d71d4623ed0a466a7498f8ce25c7fda22d1 Author: Tomer Maimon Date: Thu Sep 22 18:38:56 2022 +0300 reset: npcm: fix iprst2 and iprst4 setting In NPCM8XX USB reset sequence, iprst2 register was set with iprst4 value and iprst4 register wasn´t set. This fix sets the correct IP reset values in iprst2 and iprst4 registers in NPCM8XX USB reset sequence. Fixes: fc5d2a2f4aa5 ("reset: npcm: Add NPCM8XX support") Signed-off-by: Tomer Maimon Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220922153856.23326-1-tmaimon77@gmail.com commit 80fa46d6b9e7b1527bfd2197d75431fd9c382161 Author: Theodore Ts'o Date: Thu Sep 1 18:03:14 2022 -0400 ext4: limit the number of retries after discarding preallocations blocks This patch avoids threads live-locking for hours when a large number threads are competing over the last few free extents as they blocks getting added and removed from preallocation pools. From our bug reporter: A reliable way for triggering this has multiple writers continuously write() to files when the filesystem is full, while small amounts of space are freed (e.g. by truncating a large file -1MiB at a time). In the local filesystem, this can be done by simply not checking the return code of write (0) and/or the error (ENOSPACE) that is set. Over NFS with an async mount, even clients with proper error checking will behave this way since the linux NFS client implementation will not propagate the server errors [the write syscalls immediately return success] until the file handle is closed. This leads to a situation where NFS clients send a continuous stream of WRITE rpcs which result in ERRNOSPACE -- but since the client isn't seeing this, the stream of writes continues at maximum network speed. When some space does appear, multiple writers will all attempt to claim it for their current write. For NFS, we may see dozens to hundreds of threads that do this. The real-world scenario of this is database backup tooling (in particular, github.com/mdkent/percona-xtrabackup) which may write large files (>1TiB) to NFS for safe keeping. Some temporary files are written, rewound, and read back -- all before closing the file handle (the temp file is actually unlinked, to trigger automatic deletion on close/crash.) An application like this operating on an async NFS mount will not see an error code until TiB have been written/read. The lockup was observed when running this database backup on large filesystems (64 TiB in this case) with a high number of block groups and no free space. Fragmentation is generally not a factor in this filesystem (~thousands of large files, mostly contiguous except for the parts written while the filesystem is at capacity.) Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 29a5b8a137ac8eb410cc823653a29ac0e7b7e1b0 Author: Luís Henriques Date: Mon Aug 22 10:42:35 2022 +0100 ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->eh_entries) is non-zero when depth is > 0. And this will lead to problems because the EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this: [ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] [ 135.279247] ? preempt_count_add+0x6d/0xa0 [ 135.280358] ? percpu_counter_add_batch+0x55/0xb0 [ 135.281612] ? _raw_read_unlock+0x18/0x30 [ 135.282704] ext4_map_blocks+0x294/0x5a0 [ 135.283745] ? xa_load+0x6f/0xa0 [ 135.284562] ext4_mpage_readpages+0x3d6/0x770 [ 135.285646] read_pages+0x67/0x1d0 [ 135.286492] ? folio_add_lru+0x51/0x80 [ 135.287441] page_cache_ra_unbounded+0x124/0x170 [ 135.288510] filemap_get_pages+0x23d/0x5a0 [ 135.289457] ? path_openat+0xa72/0xdd0 [ 135.290332] filemap_read+0xbf/0x300 [ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40 [ 135.292192] new_sync_read+0x103/0x170 [ 135.293014] vfs_read+0x15d/0x180 [ 135.293745] ksys_read+0xa1/0xe0 [ 135.294461] do_syscall_64+0x3c/0x80 [ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This patch simply adds an extra check in __ext4_ext_check(), verifying that eh_entries is not 0 when eh_depth is > 0. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215941 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216283 Cc: Baokun Li Cc: stable@kernel.org Signed-off-by: Luís Henriques Reviewed-by: Jan Kara Reviewed-by: Baokun Li Link: https://lore.kernel.org/r/20220822094235.2690-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o commit 643792048ee84b199052e9c8f89253649ca78922 Author: Olof Johansson Date: Tue Sep 20 09:00:18 2022 -0700 serial: sifive: enable clocks for UART when probed When the PWM driver was changed to disable clocks if no PWMs are enabled, it ended up also disabling the shared parent with the UART, since the UART doesn't do any clock enablement on its own. To avoid these surprises, switch to clk_get_enabled(). Fixes: ace41d7564e655 ("pwm: sifive: Ensure the clk is enabled exactly once per running PWM") Cc: stable Cc: Uwe Kleine-König Cc: Emil Renner Berthing Cc: Palmer Dabbelt Cc: Paul Walmsley Reviewed-by: Palmer Dabbelt Reviewed-by: Uwe Kleine-König Acked-by: Palmer Dabbelt Signed-off-by: Olof Johansson Link: https://lore.kernel.org/r/20220920160017.7315-1-olof@lixom.net Signed-off-by: Greg Kroah-Hartman commit 1e005bfae83290f6673f8213a418cc0e12868c2d Author: Matthias Schiffer Date: Fri Sep 16 13:09:55 2022 +0200 serial: 8250: omap: Use serial8250_em485_supported 8250_omap uses em485, fill in rs485_supported accordingly. This makes RS485 work with 8250_omap again, which was broken with the introduction of the RS485 config sanitization. Fixes: be2e2cb1d2819 ("serial: Sanitize rs485_struct") Reviewed-by: Ilpo Järvinen Signed-off-by: Matthias Schiffer Link: https://lore.kernel.org/r/20220916110955.161099-1-matthias.schiffer@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 60f361722ad2ae5ee667d0b0545d40c42f754daf Author: Lukas Wunner Date: Sun Sep 11 10:22:01 2022 +0200 serial: fsl_lpuart: Reset prior to registration Since commit bd5305dcabbc ("tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp"), certain i.MX UARTs are reset after they've already been registered. Register state may thus be clobbered after user space has begun to open and access the UART. Avoid by performing the reset prior to registration. Fixes: bd5305dcabbc ("tty: serial: fsl_lpuart: do software reset for imx7ulp and imx8qxp") Cc: stable@vger.kernel.org # v5.15+ Cc: Fugang Duan Cc: Sherry Sun Reviewed-by: Ilpo Järvinen Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/72fb646c1b0b11c989850c55f52f9ff343d1b2fa.1662884345.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman commit 83e4b196838d90799a8879e5054a3beecf9ed256 Author: Hangbin Liu Date: Thu Sep 22 10:44:53 2022 +0800 selftests: forwarding: add shebang for sch_red.sh RHEL/Fedora RPM build checks are stricter, and complain when executable files don't have a shebang line, e.g. *** WARNING: ./kselftests/net/forwarding/sch_red.sh is executable but has no shebang, removing executable bit Fix it by adding shebang line. Fixes: 6cf0291f9517 ("selftests: forwarding: Add a RED test for SW datapath") Signed-off-by: Hangbin Liu Reviewed-by: Petr Machata Link: https://lore.kernel.org/r/20220922024453.437757-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit c31f26c8f69f776759cbbdfb38e40ea91aa0dd65 Author: Jakub Kicinski Date: Wed Sep 21 13:10:05 2022 -0700 bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not be used afterwards, as the worker may run before the rest of our code and free the skb, leading to a use-after-free. Since dev_kfree_skb_any() accepts NULL make the loss of ownership more obvious and set skb to NULL. Fixes: 83bb623c968e ("bnxt_en: Transmit and retrieve packet timestamps") Reviewed-by: Andy Gospodarek Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20220921201005.335390-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3aac7ada64d8c26ccc922f1ca966043c0dae88da Author: Liang He Date: Wed Sep 21 21:32:45 2022 +0800 net: marvell: Fix refcounting bugs in prestera_port_sfp_bind() In prestera_port_sfp_bind(), there are two refcounting bugs: (1) we should call of_node_get() before of_find_node_by_name() as it will automaitcally decrease the refcount of 'from' argument; (2) we should call of_node_put() for the break of the iteration for_each_child_of_node() as it will automatically increase and decrease the 'child'. Fixes: 52323ef75414 ("net: marvell: prestera: add phylink support") Signed-off-by: Liang He Reviewed-by: Yevhen Orlov Link: https://lore.kernel.org/r/20220921133245.4111672-1-windhl@126.com Signed-off-by: Jakub Kicinski commit c2e1cfefcac35e0eea229e148c8284088ce437b5 Author: Hangyu Hua Date: Wed Sep 21 17:27:34 2022 +0800 net: sched: fix possible refcount leak in tc_new_tfilter() tfilter_put need to be called to put the refount got by tp->ops->get to avoid possible refcount leak when chain->tmplt_ops != NULL and chain->tmplt_ops != tp->ops. Fixes: 7d5509fa0d3d ("net: sched: extend proto ops with 'put' callback") Signed-off-by: Hangyu Hua Reviewed-by: Vlad Buslov Link: https://lore.kernel.org/r/20220921092734.31700-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski commit 878e2405710aacfeeb19364c300f38b7a9abfe8f Author: Sean Anderson Date: Tue Sep 20 19:50:18 2022 -0400 net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD There is a separate receive path for small packets (under 256 bytes). Instead of allocating a new dma-capable skb to be used for the next packet, this path allocates a skb and copies the data into it (reusing the existing sbk for the next packet). There are two bytes of junk data at the beginning of every packet. I believe these are inserted in order to allow aligned DMA and IP headers. We skip over them using skb_reserve. Before copying over the data, we must use a barrier to ensure we see the whole packet. The current code only synchronizes len bytes, starting from the beginning of the packet, including the junk bytes. However, this leaves off the final two bytes in the packet. Synchronize the whole packet. To reproduce this problem, ping a HME with a payload size between 17 and 214 $ ping -s 17 which will complain rather loudly about the data mismatch. Small packets (below 60 bytes on the wire) do not have this issue. I suspect this is related to the padding added to increase the minimum packet size. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Sean Anderson Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220920235018.1675956-1-seanga2@gmail.com Signed-off-by: Jakub Kicinski commit 47af6c640ed82f111dbce0b3bf4083a91d61e324 Merge: 09431acde35f4 d640c4cb8f2f9 Author: Greg Kroah-Hartman Date: Thu Sep 22 15:43:18 2022 +0200 Merge tag 'usb-serial-6.0-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: "USB-serial fixes for 6.0-rc7 Here are some new modem device ids. All have been in linux-next with no reported issues." * tag 'usb-serial-6.0-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel RM520N USB: serial: option: add Quectel BG95 0x0203 composition commit db39dfdc1c3bd9da273902da12f01973792ff911 Author: Peilin Ye Date: Tue Sep 20 17:59:15 2022 -0700 udp: Use WARN_ON_ONCE() in udp_read_skb() Prevent udp_read_skb() from flooding the syslog. Suggested-by: Jakub Sitnicki Signed-off-by: Peilin Ye Link: https://lore.kernel.org/r/20220921005915.2697-1-yepeilin.cs@gmail.com Signed-off-by: Jakub Kicinski commit c5da4b68d2a8592a7535bb9e4523158088a6538b Merge: 2002fbac743b6 2ffd57327ff1e Author: Jakub Kicinski Date: Thu Sep 22 06:40:15 2022 -0700 Merge branch 'bonding-fix-null-deref-in-bond_rr_gen_slave_id' Jonathan Toppins says: ==================== bonding: fix NULL deref in bond_rr_gen_slave_id Fix a NULL dereference of the struct bonding.rr_tx_counter member because if a bond is initially created with an initial mode != zero (Round Robin) the memory required for the counter is never created and when the mode is changed there is never any attempt to verify the memory is allocated upon switching modes. ==================== Link: https://lore.kernel.org/r/cover.1663694476.git.jtoppins@redhat.com Signed-off-by: Jakub Kicinski commit 2ffd57327ff1e91ad675c1efd5f02a3d786e64d1 Author: Jonathan Toppins Date: Tue Sep 20 13:45:51 2022 -0400 selftests: bonding: cause oops in bond_rr_gen_slave_id This bonding selftest used to cause a kernel oops on aarch64 and should be architectures agnostic. Signed-off-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit 0e400d602f46360752e4b32ce842dba3808e15e6 Author: Jonathan Toppins Date: Tue Sep 20 13:45:52 2022 -0400 bonding: fix NULL deref in bond_rr_gen_slave_id Fix a NULL dereference of the struct bonding.rr_tx_counter member because if a bond is initially created with an initial mode != zero (Round Robin) the memory required for the counter is never created and when the mode is changed there is never any attempt to verify the memory is allocated upon switching modes. This causes the following Oops on an aarch64 machine: [ 334.686773] Unable to handle kernel paging request at virtual address ffff2c91ac905000 [ 334.694703] Mem abort info: [ 334.697486] ESR = 0x0000000096000004 [ 334.701234] EC = 0x25: DABT (current EL), IL = 32 bits [ 334.706536] SET = 0, FnV = 0 [ 334.709579] EA = 0, S1PTW = 0 [ 334.712719] FSC = 0x04: level 0 translation fault [ 334.717586] Data abort info: [ 334.720454] ISV = 0, ISS = 0x00000004 [ 334.724288] CM = 0, WnR = 0 [ 334.727244] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000008044d662000 [ 334.733944] [ffff2c91ac905000] pgd=0000000000000000, p4d=0000000000000000 [ 334.740734] Internal error: Oops: 96000004 [#1] SMP [ 334.745602] Modules linked in: bonding tls veth rfkill sunrpc arm_spe_pmu vfat fat acpi_ipmi ipmi_ssif ixgbe igb i40e mdio ipmi_devintf ipmi_msghandler arm_cmn arm_dsu_pmu cppc_cpufreq acpi_tad fuse zram crct10dif_ce ast ghash_ce sbsa_gwdt nvme drm_vram_helper drm_ttm_helper nvme_core ttm xgene_hwmon [ 334.772217] CPU: 7 PID: 2214 Comm: ping Not tainted 6.0.0-rc4-00133-g64ae13ed4784 #4 [ 334.779950] Hardware name: GIGABYTE R272-P31-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 [ 334.789244] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 334.796196] pc : bond_rr_gen_slave_id+0x40/0x124 [bonding] [ 334.801691] lr : bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] [ 334.807962] sp : ffff8000221733e0 [ 334.811265] x29: ffff8000221733e0 x28: ffffdbac8572d198 x27: ffff80002217357c [ 334.818392] x26: 000000000000002a x25: ffffdbacb33ee000 x24: ffff07ff980fa000 [ 334.825519] x23: ffffdbacb2e398ba x22: ffff07ff98102000 x21: ffff07ff981029c0 [ 334.832646] x20: 0000000000000001 x19: ffff07ff981029c0 x18: 0000000000000014 [ 334.839773] x17: 0000000000000000 x16: ffffdbacb1004364 x15: 0000aaaabe2f5a62 [ 334.846899] x14: ffff07ff8e55d968 x13: ffff07ff8e55db30 x12: 0000000000000000 [ 334.854026] x11: ffffdbacb21532e8 x10: 0000000000000001 x9 : ffffdbac857178ec [ 334.861153] x8 : ffff07ff9f6e5a28 x7 : 0000000000000000 x6 : 000000007c2b3742 [ 334.868279] x5 : ffff2c91ac905000 x4 : ffff2c91ac905000 x3 : ffff07ff9f554400 [ 334.875406] x2 : ffff2c91ac905000 x1 : 0000000000000001 x0 : ffff07ff981029c0 [ 334.882532] Call trace: [ 334.884967] bond_rr_gen_slave_id+0x40/0x124 [bonding] [ 334.890109] bond_xmit_roundrobin_slave_get+0x38/0xdc [bonding] [ 334.896033] __bond_start_xmit+0x128/0x3a0 [bonding] [ 334.901001] bond_start_xmit+0x54/0xb0 [bonding] [ 334.905622] dev_hard_start_xmit+0xb4/0x220 [ 334.909798] __dev_queue_xmit+0x1a0/0x720 [ 334.913799] arp_xmit+0x3c/0xbc [ 334.916932] arp_send_dst+0x98/0xd0 [ 334.920410] arp_solicit+0xe8/0x230 [ 334.923888] neigh_probe+0x60/0xb0 [ 334.927279] __neigh_event_send+0x3b0/0x470 [ 334.931453] neigh_resolve_output+0x70/0x90 [ 334.935626] ip_finish_output2+0x158/0x514 [ 334.939714] __ip_finish_output+0xac/0x1a4 [ 334.943800] ip_finish_output+0x40/0xfc [ 334.947626] ip_output+0xf8/0x1a4 [ 334.950931] ip_send_skb+0x5c/0x100 [ 334.954410] ip_push_pending_frames+0x3c/0x60 [ 334.958758] raw_sendmsg+0x458/0x6d0 [ 334.962325] inet_sendmsg+0x50/0x80 [ 334.965805] sock_sendmsg+0x60/0x6c [ 334.969286] __sys_sendto+0xc8/0x134 [ 334.972853] __arm64_sys_sendto+0x34/0x4c [ 334.976854] invoke_syscall+0x78/0x100 [ 334.980594] el0_svc_common.constprop.0+0x4c/0xf4 [ 334.985287] do_el0_svc+0x38/0x4c [ 334.988591] el0_svc+0x34/0x10c [ 334.991724] el0t_64_sync_handler+0x11c/0x150 [ 334.996072] el0t_64_sync+0x190/0x194 [ 334.999726] Code: b9001062 f9403c02 d53cd044 8b040042 (b8210040) [ 335.005810] ---[ end trace 0000000000000000 ]--- [ 335.010416] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 335.017279] SMP: stopping secondary CPUs [ 335.021374] Kernel Offset: 0x5baca8eb0000 from 0xffff800008000000 [ 335.027456] PHYS_OFFSET: 0x80000000 [ 335.030932] CPU features: 0x0000,0085c029,19805c82 [ 335.035713] Memory Limit: none [ 335.038756] Rebooting in 180 seconds.. The fix is to allocate the memory in bond_open() which is guaranteed to be called before any packets are processed. Fixes: 848ca9182a7d ("net: bonding: Use per-cpu rr_tx_counter") CC: Jussi Maki Signed-off-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit 2002fbac743b6e2391b4ed50ad9eb626768dd78a Author: Michael Walle Date: Tue Sep 20 16:16:19 2022 +0200 net: phy: micrel: fix shared interrupt on LAN8814 Since commit ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") the handler always returns IRQ_HANDLED, except in an error case. Before that commit, the interrupt status register was checked and if it was empty, IRQ_NONE was returned. Restore that behavior to play nice with the interrupt line being shared with others. Fixes: ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") Signed-off-by: Michael Walle Reviewed-by: Andrew Lunn Reviewed-by: Horatiu Vultur Reviewed-by: Divya Koppera Link: https://lore.kernel.org/r/20220920141619.808117-1-michael@walle.cc Signed-off-by: Jakub Kicinski commit 05d6f6d346fea2fa4580a0c2b6be207456bebb08 Author: Ilkka Koskinen Date: Mon Aug 8 12:54:55 2022 -0700 perf/arm-cmn: Add more bits to child node address offset field CMN-600 uses bits [27:0] for child node address offset while bits [30:28] are required to be zero. For CMN-650, the child node address offset field has been increased to include bits [29:0] while leaving only bit 30 set to zero. Let's include the missing two bits and assume older implementations comply with the spec and set bits [29:28] to 0. Signed-off-by: Ilkka Koskinen Fixes: 60d1504070c2 ("perf/arm-cmn: Support new IP features") Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/20220808195455.79277-1-ilkka@os.amperecomputing.com Signed-off-by: Will Deacon commit 09431acde35f46ac82fb5230c7479f1edc557c75 Author: Ren Zhijie Date: Tue Sep 20 16:44:31 2022 +0800 usb: typec: anx7411: Fix build error without CONFIG_POWER_SUPPLY Building without CONFIG_POWER_SUPPLY will fail: drivers/usb/typec/anx7411.o: In function `anx7411_detect_power_mode': anx7411.c:(.text+0x527): undefined reference to `power_supply_changed' drivers/usb/typec/anx7411.o: In function `anx7411_psy_set_prop': anx7411.c:(.text+0x90d): undefined reference to `power_supply_get_drvdata' anx7411.c:(.text+0x930): undefined reference to `power_supply_changed' drivers/usb/typec/anx7411.o: In function `anx7411_psy_get_prop': anx7411.c:(.text+0x94d): undefined reference to `power_supply_get_drvdata' drivers/usb/typec/anx7411.o: In function `anx7411_i2c_probe': anx7411.c:(.text+0x111d): undefined reference to `devm_power_supply_register' drivers/usb/typec/anx7411.o: In function `anx7411_work_func': anx7411.c:(.text+0x167c): undefined reference to `power_supply_changed' anx7411.c:(.text+0x1b55): undefined reference to `power_supply_changed' Add POWER_SUPPLY dependency to Kconfig. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Reviewed-by: Xin Ji Acked-by: Heikki Krogerus Signed-off-by: Ren Zhijie Link: https://lore.kernel.org/r/20220920084431.196258-1-renzhijie2@huawei.com Signed-off-by: Greg Kroah-Hartman commit 2bc54aaa65d2126ae629919175708a28ce7ef06e Author: William Breathitt Gray Date: Thu Sep 22 07:20:56 2022 -0400 counter: 104-quad-8: Fix skipped IRQ lines during events configuration IRQ trigger configuration is skipped if it has already been set before; however, the IRQ line still needs to be OR'd to irq_enabled because irq_enabled is reset for every events_configure call. This patch moves the irq_enabled OR operation update to before the irq_trigger check so that IRQ line enablement is not skipped. Fixes: c95cc0d95702 ("counter: 104-quad-8: Fix persistent enabled events bug") Cc: stable Link: https://lore.kernel.org/r/20220815122301.2750-1-william.gray@linaro.org/ Signed-off-by: William Breathitt Gray Link: https://lore.kernel.org/r/179eed11eaf225dbd908993b510df0c8f67b1230.1663844776.git.william.gray@linaro.org Signed-off-by: Greg Kroah-Hartman commit d4955c0ad77dbc684fc716387070ac24801b8bca Author: Sergey Shtylyov Date: Fri Sep 16 23:17:07 2022 +0300 arm64: topology: fix possible overflow in amu_fie_setup() cpufreq_get_hw_max_freq() returns max frequency in kHz as *unsigned int*, while freq_inv_set_max_ratio() gets passed this frequency in Hz as 'u64'. Multiplying max frequency by 1000 can potentially result in overflow -- multiplying by 1000ULL instead should avoid that... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: cd0ed03a8903 ("arm64: use activity monitors for frequency invariance") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/01493d64-2bce-d968-86dc-11a122a9c07d@omp.ru Signed-off-by: Will Deacon commit 61d2d1808b20da4a45a90b4bd61ae92f729bab78 Author: Mark Rutland Date: Tue Sep 20 14:47:31 2022 +0100 arm64: mm: don't acquire mutex when rewriting swapper Since commit: 47546a1912fc4a03 ("arm64: mm: install KPTI nG mappings with MMU enabled)" ... when building with CONFIG_DEBUG_ATOMIC_SLEEP=y and booting under QEMU TCG with '-cpu max', there's a boot-time splat: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 | in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 15, name: migration/0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | no locks held by migration/0/15. | irq event stamp: 28 | hardirqs last enabled at (27): [] _raw_spin_unlock_irq+0x3c/0x7c | hardirqs last disabled at (28): [] multi_cpu_stop+0x150/0x18c | softirqs last enabled at (0): [] copy_process+0x594/0x1964 | softirqs last disabled at (0): [<0000000000000000>] 0x0 | CPU: 0 PID: 15 Comm: migration/0 Not tainted 6.0.0-rc3-00002-g419b42ff7eef #3 | Hardware name: linux,dummy-virt (DT) | Stopper: multi_cpu_stop+0x0/0x18c <- stop_cpus.constprop.0+0xa0/0xfc | Call trace: | dump_backtrace.part.0+0xd0/0xe0 | show_stack+0x1c/0x5c | dump_stack_lvl+0x88/0xb4 | dump_stack+0x1c/0x38 | __might_resched+0x180/0x230 | __might_sleep+0x4c/0xa0 | __mutex_lock+0x5c/0x450 | mutex_lock_nested+0x30/0x40 | create_kpti_ng_temp_pgd+0x4fc/0x6d0 | kpti_install_ng_mappings+0x2b8/0x3b0 | cpu_enable_non_boot_scope_capabilities+0x7c/0xd0 | multi_cpu_stop+0xa0/0x18c | cpu_stopper_thread+0x88/0x11c | smpboot_thread_fn+0x1ec/0x290 | kthread+0x118/0x120 | ret_from_fork+0x10/0x20 Since commit: ee017ee353506fce ("arm64/mm: avoid fixmap race condition when create pud mapping") ... once the kernel leave the SYSTEM_BOOTING state, the fixmap pagetable entries are protected by the fixmap_lock mutex. The new KPTI rewrite code uses __create_pgd_mapping() to create a temporary pagetable. This happens in atomic context, after secondary CPUs are brought up and the kernel has left the SYSTEM_BOOTING state. Hence we try to acquire a mutex in atomic context, which is generally unsound (though benign in this case as the mutex should be free and all other CPUs are quiescent). This patch avoids the issue by pulling the mutex out of alloc_init_pud() and calling it at a higher level in the pagetable manipulation code. This allows it to be used without locking where one CPU is known to be in exclusive control of the machine, even after having left the SYSTEM_BOOTING state. Fixes: 47546a1912fc ("arm64: mm: install KPTI nG mappings with MMU enabled") Signed-off-by: Mark Rutland Cc: Ard Biesheuvel Cc: Catalin Marinas Cc: Will Deacon Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220920134731.1625740-1-mark.rutland@arm.com Signed-off-by: Will Deacon commit c35fbea48659ec99a4f532c9ee9e8692405afdd0 Author: Pierre-Louis Bossart Date: Thu Sep 22 12:00:14 2022 +0200 ALSA: hda: intel-dsp-config: add missing RaptorLake PCI IDs These two missed IDs need to be added for dynamic selection of drivers. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Link: https://lore.kernel.org/r/20220922100014.27080-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit cbdac8bc2cbf91b42a92869dc938b809054d4fae Merge: 79764ec772bc1 0a0342ede303f Author: Takashi Iwai Date: Thu Sep 22 13:47:09 2022 +0200 Merge tag 'asoc-fix-v6.0-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.0 A few device specific fixes, nothing too large, and a new device ID for a Dell laptop. commit 31f87f705b3c1635345d8e8a493697099b43e508 Author: Mario Limonciello Date: Wed Sep 21 09:54:32 2022 -0500 thunderbolt: Explicitly reset plug events delay back to USB4 spec value If any software has interacted with the USB4 registers before the Linux USB4 CM runs, it may have modified the plug events delay. It has been observed that if this value too large, it's possible that hotplugged devices will negotiate a fallback mode instead in Linux. To prevent this, explicitly align the plug events delay with the USB4 spec value of 10ms. Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg commit d7f06bdd6ee87fbefa05af5f57361d85e7715b11 Author: Phil Auld Date: Tue Sep 6 16:35:42 2022 -0400 drivers/base: Fix unsigned comparison to -1 in CPUMAP_FILE_MAX_BYTES As PAGE_SIZE is unsigned long, -1 > PAGE_SIZE when NR_CPUS <= 3. This leads to very large file sizes: topology$ ls -l total 0 -r--r--r-- 1 root root 18446744073709551615 Sep 5 11:59 core_cpus -r--r--r-- 1 root root 4096 Sep 5 11:59 core_cpus_list -r--r--r-- 1 root root 4096 Sep 5 10:58 core_id -r--r--r-- 1 root root 18446744073709551615 Sep 5 10:10 core_siblings -r--r--r-- 1 root root 4096 Sep 5 11:59 core_siblings_list -r--r--r-- 1 root root 18446744073709551615 Sep 5 11:59 die_cpus -r--r--r-- 1 root root 4096 Sep 5 11:59 die_cpus_list -r--r--r-- 1 root root 4096 Sep 5 11:59 die_id -r--r--r-- 1 root root 18446744073709551615 Sep 5 11:59 package_cpus -r--r--r-- 1 root root 4096 Sep 5 11:59 package_cpus_list -r--r--r-- 1 root root 4096 Sep 5 10:58 physical_package_id -r--r--r-- 1 root root 18446744073709551615 Sep 5 10:10 thread_siblings -r--r--r-- 1 root root 4096 Sep 5 11:59 thread_siblings_list Adjust the inequality to catch the case when NR_CPUS is configured to a small value. Fixes: 7ee951acd31a ("drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist") Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Yury Norov Cc: stable@vger.kernel.org Cc: feng xiangjun Reported-by: feng xiangjun Signed-off-by: Phil Auld Signed-off-by: Yury Norov Link: https://lore.kernel.org/r/20220906203542.1796629-1-pauld@redhat.com Signed-off-by: Greg Kroah-Hartman commit e738455b2c6dcdab03e45d97de36476f93f557d2 Author: Wen Gu Date: Tue Sep 20 14:43:09 2022 +0800 net/smc: Stop the CLC flow if no link to map buffers on There might be a potential race between SMC-R buffer map and link group termination. smc_smcr_terminate_all() | smc_connect_rdma() -------------------------------------------------------------- | smc_conn_create() for links in smcibdev | schedule links down | | smc_buf_create() | \- smcr_buf_map_usable_links() | \- no usable links found, | (rmb->mr = NULL) | | smc_clc_send_confirm() | \- access conn->rmb_desc->mr[]->rkey | (panic) During reboot and IB device module remove, all links will be set down and no usable links remain in link groups. In such situation smcr_buf_map_usable_links() should return an error and stop the CLC flow accessing to uninitialized mr. Fixes: b9247544c1bc ("net/smc: convert static link ID instances to support multiple links") Signed-off-by: Wen Gu Link: https://lore.kernel.org/r/1663656189-32090-1-git-send-email-guwen@linux.alibaba.com Signed-off-by: Paolo Abeni commit 763679f0eeff0185fc431498849bbc1c24460875 Author: Johan Hovold Date: Mon Aug 22 17:10:27 2022 +0200 media: flexcop-usb: fix endpoint type check Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type") tried to add an endpoint type sanity check for the single isochronous endpoint but instead broke the driver by checking the wrong descriptor or random data beyond the last endpoint descriptor. Make sure to check the right endpoint descriptor. Fixes: d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type") Cc: Oliver Neukum Cc: stable@vger.kernel.org # 5.9 Reported-by: Dongliang Mu Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220822151027.27026-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1 Author: Ard Biesheuvel Date: Tue Sep 20 17:08:23 2022 +0200 efi: libstub: check Shim mode using MokSBStateRT We currently check the MokSBState variable to decide whether we should treat UEFI secure boot as being disabled, even if the firmware thinks otherwise. This is used by shim to indicate that it is not checking signatures on boot images. In the kernel, we use this to relax lockdown policies. However, in cases where shim is not even being used, we don't want this variable to interfere with lockdown, given that the variable may be non-volatile and therefore persist across a reboot. This means setting it once will persistently disable lockdown checks on a given system. So switch to the mirrored version of this variable, called MokSBStateRT, which is supposed to be volatile, and this is something we can check. Cc: # v4.19+ Signed-off-by: Ard Biesheuvel Reviewed-by: Ilias Apalodimas Reviewed-by: Peter Jones commit 63bf28ceb3ebbe76048c3fb2987996ca1ae64f83 Author: Ard Biesheuvel Date: Thu Aug 4 15:39:48 2022 +0200 efi: x86: Wipe setup_data on pure EFI boot When booting the x86 kernel via EFI using the LoadImage/StartImage boot services [as opposed to the deprecated EFI handover protocol], the setup header is taken from the image directly, and given that EFI's LoadImage has no Linux/x86 specific knowledge regarding struct bootparams or struct setup_header, any absolute addresses in the setup header must originate from the file and not from a prior loading stage. Since we cannot generally predict where LoadImage() decides to load an image (*), such absolute addresses must be treated as suspect: even if a prior boot stage intended to make them point somewhere inside the [signed] image, there is no way to validate that, and if they point at an arbitrary location in memory, the setup_data nodes will not be covered by any signatures or TPM measurements either, and could be made to contain an arbitrary sequence of SETUP_xxx nodes, which could interfere quite badly with the early x86 boot sequence. (*) Note that, while LoadImage() does take a buffer/size tuple in addition to a device path, which can be used to provide the image contents directly, it will re-allocate such images, as the memory footprint of an image is generally larger than the PE/COFF file representation. Cc: # v5.10+ Link: https://lore.kernel.org/all/20220904165321.1140894-1-Jason@zx2c4.com/ Signed-off-by: Ard Biesheuvel Acked-by: Jason A. Donenfeld commit d21fc11109ca02e870794a53c0a236365e92c148 Merge: 521a547ced647 d119888b09bd5 Author: Dave Airlie Date: Thu Sep 22 15:31:02 2022 +1000 Merge tag 'drm-intel-fixes-2022-09-21' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes 2 gem context related fixes: - to avoid a general protection failure when using perf/OA (Chris) - to avoid kernel warnings on driver release (Janusz) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Yyt1CV+YIjKQZZMB@intel.com commit 83e80a6e3543f37f74c8e48a5f305b054b65ce2a Author: Jan Kara Date: Thu Sep 8 11:21:28 2022 +0200 ext4: use buckets for cr 1 block scan instead of rbtree Using rbtree for sorting groups by average fragment size is relatively expensive (needs rbtree update on every block freeing or allocation) and leads to wide spreading of allocations because selection of block group is very sentitive both to changes in free space and amount of blocks allocated. Furthermore selecting group with the best matching average fragment size is not necessary anyway, even more so because the variability of fragment sizes within a group is likely large so average is not telling much. We just need a group with large enough average fragment size so that we have high probability of finding large enough free extent and we don't want average fragment size to be too big so that we are likely to find free extent only somewhat larger than what we need. So instead of maintaing rbtree of groups sorted by fragment size keep bins (lists) or groups where average fragment size is in the interval [2^i, 2^(i+1)). This structure requires less updates on block allocation / freeing, generally avoids chaotic spreading of allocations into block groups, and still is able to quickly (even faster that the rbtree) provide a block group which is likely to have a suitably sized free space extent. This patch reduces number of block groups used when untarring archive with medium sized files (size somewhat above 64k which is default mballoc limit for avoiding locality group preallocation) to about half and thus improves write speeds for eMMC flash significantly. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@kernel.org Reported-and-tested-by: Stefan Wahren Tested-by: Ojaswin Mujoo Signed-off-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Link: https://lore.kernel.org/r/20220908092136.11770-5-jack@suse.cz Signed-off-by: Theodore Ts'o commit a9f2a2931d0e197ab28c6007966053fdababd53f Author: Jan Kara Date: Thu Sep 8 11:21:27 2022 +0200 ext4: use locality group preallocation for small closed files Curently we don't use any preallocation when a file is already closed when allocating blocks (from writeback code when converting delayed allocation). However for small files, using locality group preallocation is actually desirable as that is not specific to a particular file. Rather it is a method to pack small files together to reduce fragmentation and for that the fact the file is closed is actually even stronger hint the file would benefit from packing. So change the logic to allow locality group preallocation in this case. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@kernel.org Reported-and-tested-by: Stefan Wahren Tested-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Link: https://lore.kernel.org/r/20220908092136.11770-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 613c5a85898d1cd44e68f28d65eccf64a8ace9cf Author: Jan Kara Date: Thu Sep 8 11:21:26 2022 +0200 ext4: make directory inode spreading reflect flexbg size Currently the Orlov inode allocator searches for free inodes for a directory only in flex block groups with at most inodes_per_group/16 more directory inodes than average per flex block group. However with growing size of flex block group this becomes unnecessarily strict. Scale allowed difference from average directory count per flex block group with flex block group size as we do with other metrics. Tested-by: Stefan Wahren Tested-by: Ojaswin Mujoo Cc: stable@kernel.org Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220908092136.11770-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit 1940265ede6683f6317cba0d428ce6505eaca944 Author: Jan Kara Date: Thu Sep 8 11:21:25 2022 +0200 ext4: avoid unnecessary spreading of allocations among groups mb_set_largest_free_order() updates lists containing groups with largest chunk of free space of given order. The way it updates it leads to always moving the group to the tail of the list. Thus allocations looking for free space of given order effectively end up cycling through all groups (and due to initialization in last to first order). This spreads allocations among block groups which reduces performance for rotating disks or low-end flash media. Change mb_set_largest_free_order() to only update lists if the order of the largest free chunk in the group changed. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@kernel.org Reported-and-tested-by: Stefan Wahren Tested-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Jan Kara Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Link: https://lore.kernel.org/r/20220908092136.11770-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 4fca50d440cc5d4dc570ad5484cc0b70b381bc2a Author: Jan Kara Date: Thu Sep 8 11:21:24 2022 +0200 ext4: make mballoc try target group first even with mb_optimize_scan One of the side-effects of mb_optimize_scan was that the optimized functions to select next group to try were called even before we tried the goal group. As a result we no longer allocate files close to corresponding inodes as well as we don't try to expand currently allocated extent in the same group. This results in reaim regression with workfile.disk workload of upto 8% with many clients on my test machine: baseline mb_optimize_scan Hmean disk-1 2114.16 ( 0.00%) 2099.37 ( -0.70%) Hmean disk-41 87794.43 ( 0.00%) 83787.47 * -4.56%* Hmean disk-81 148170.73 ( 0.00%) 135527.05 * -8.53%* Hmean disk-121 177506.11 ( 0.00%) 166284.93 * -6.32%* Hmean disk-161 220951.51 ( 0.00%) 207563.39 * -6.06%* Hmean disk-201 208722.74 ( 0.00%) 203235.59 ( -2.63%) Hmean disk-241 222051.60 ( 0.00%) 217705.51 ( -1.96%) Hmean disk-281 252244.17 ( 0.00%) 241132.72 * -4.41%* Hmean disk-321 255844.84 ( 0.00%) 245412.84 * -4.08%* Also this is causing huge regression (time increased by a factor of 5 or so) when untarring archive with lots of small files on some eMMC storage cards. Fix the problem by making sure we try goal group first. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@kernel.org Reported-and-tested-by: Stefan Wahren Tested-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/all/20220727105123.ckwrhbilzrxqpt24@quack3/ Link: https://lore.kernel.org/all/0d81a7c2-46b7-6010-62a4-3e6cfc1628d6@i2se.com/ Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220908092136.11770-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 624aea6bede7fef24dc3daed83f37453c11ebb39 Merge: 114f398d48c57 8ac7132704f3f Author: Jakub Kicinski Date: Wed Sep 21 18:39:23 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-09-20 (ice) Michal re-sets TC configuration when changing number of queues. Mateusz moves the check and call for link-down-on-close to the specific path for downing/closing the interface. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix interface being down after reset with link-down-on-close flag on ice: config netdev tc before setting queues number ==================== Link: https://lore.kernel.org/r/20220920205344.1860934-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 114f398d48c571bb628187a7b2dd42695156781f Author: Larysa Zaremba Date: Mon Sep 19 15:43:46 2022 +0200 ice: Fix ice_xdp_xmit() when XDP TX queue number is not sufficient The original patch added the static branch to handle the situation, when assigning an XDP TX queue to every CPU is not possible, so they have to be shared. However, in the XDP transmit handler ice_xdp_xmit(), an error was returned in such cases even before static condition was checked, thus making queue sharing still impossible. Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") Signed-off-by: Larysa Zaremba Reviewed-by: Alexander Lobakin Link: https://lore.kernel.org/r/20220919134346.25030-1-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit f64780e3ccecf00477bb8f0a021f78205b27a610 Merge: 375a683321a33 198eb7e1b81d8 Author: Jakub Kicinski Date: Wed Sep 21 17:28:35 2022 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-09-19 (iavf, i40e) Norbert adds checking of buffer size for Rx buffer checks in iavf. Michal corrects setting of max MTU in iavf to account for MTU data provided by PF, fixes i40e to set VF max MTU, and resolves lack of rate limiting when value was less than divisor for i40e. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: Fix set max_tx_rate when it is lower than 1 Mbps i40e: Fix VF set max MTU size iavf: Fix set max MTU size with port VLAN and jumbo frames iavf: Fix bad page state ==================== Link: https://lore.kernel.org/r/20220919223428.572091-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 90144dd8b0d137d9e78ef34b3c418e51a49299ad Author: Nícolas F. R. A. Prado Date: Thu Aug 4 15:43:25 2022 -0400 drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() As the comment right before the mtk_dsi_stop() call advises, mtk_dsi_stop() should only be called after mtk_drm_crtc_atomic_disable(). That's because that function calls drm_crtc_wait_one_vblank(), which requires the vblank irq to be enabled. Previously mtk_dsi_stop(), being in mtk_dsi_poweroff() and guarded by a refcount, would only be called at the end of mtk_drm_crtc_atomic_disable(), through the call to mtk_crtc_ddp_hw_fini(). Commit cde7e2e35c28 ("drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs") moved the mtk_dsi_stop() call to mtk_output_dsi_disable(), causing it to be called before mtk_drm_crtc_atomic_disable(), and consequently generating vblank timeout warnings during suspend. Move the mtk_dsi_stop() call back to mtk_dsi_poweroff() so that we have a working vblank irq during mtk_drm_crtc_atomic_disable() and stop getting vblank timeout warnings. Fixes: cde7e2e35c28 ("drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs") Signed-off-by: Nícolas F. R. A. Prado Tested-by: Hsin-Yi Wang Reviewed-by: AngeloGioacchino Del Regno Tested-by: Allen-KH Cheng Link: http://lists.infradead.org/pipermail/linux-mediatek/2022-August/046713.html Signed-off-by: Chun-Kuang Hu commit f525ed19437d376736bed64ee7bc4afee82f2ba9 Author: Nathan Chancellor Date: Fri Sep 16 14:06:58 2022 -0700 drm/amd/display: Reduce number of arguments of dml314's CalculateFlipSchedule() Most of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer. This reduces the total amount of stack space that dml314_ModeSupportAndSystemConfigurationFull() uses by 112 bytes with LLVM 16 (1976 -> 1864), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/display_mode_vba_314.c:4020:6: error: stack frame size (2216) exceeds limit (2048) in 'dml314_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml314_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Link: https://github.com/ClangBuiltLinux/linux/issues/1710 Reported-by: "kernelci.org bot" Tested-by: Maíra Canal Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit faed5d0182480556cddb8343d9bad968387848f4 Author: Nathan Chancellor Date: Fri Sep 16 14:06:57 2022 -0700 drm/amd/display: Reduce number of arguments of dml314's CalculateWatermarksAndDRAMSpeedChangeSupport() Most of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer. This reduces the total amount of stack space that dml314_ModeSupportAndSystemConfigurationFull() uses by 240 bytes with LLVM 16 (2216 -> 1976), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn314/display_mode_vba_314.c:4020:6: error: stack frame size (2216) exceeds limit (2048) in 'dml314_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml314_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Link: https://github.com/ClangBuiltLinux/linux/issues/1710 Reported-by: "kernelci.org bot" Tested-by: Maíra Canal Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit abbc7a3dafb91b9d4ec56b70ec9a7520f8e13334 Author: Alex Deucher Date: Mon Sep 19 12:26:20 2022 -0400 drm/amdgpu: don't register a dirty callback for non-atomic Some asics still support non-atomic code paths. Fixes: 66f99628eb2440 ("drm/amdgpu: use dirty framebuffer helper") Reported-by: Arthur Marsh Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 88bab90f7a8aef3732a57cf33bf0ae121de8c7af Author: Evan Quan Date: Fri Sep 16 13:30:44 2022 +0800 drm/amd/pm: drop the pptable related workarounds for SMU 13.0.0 The pptable in the vbios is fully ready. The related workarounds in driver are not needed any more. Signed-off-by: Evan Quan Acked-by: Guchun Chen Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit dd4bc65c5bdf17ce8e74f91bca5e41b368b0e32b Author: Evan Quan Date: Fri Sep 16 13:19:29 2022 +0800 drm/amd/pm: add support for 3794 pptable for SMU13.0.0 Enable 3794 pptable support for SMU13.0.0. Signed-off-by: Evan Quan Acked-by: Guchun Chen Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 193b6a1934cc2e258e463e94fe3e94382c0bf458 Author: Charlene Liu Date: Sat Sep 10 15:08:51 2022 -0400 drm/amd/display: correct num_dsc based on HW cap [why] num_dsc is 3 for dcn314 based on HW capablity. Reviewed-by: Martin Leung Acked-by: Wayne Lin Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 29a1c581a5d873046302aa22c4a05124c5faefab Author: Nicholas Kazlauskas Date: Tue Sep 6 09:47:24 2022 -0400 drm/amd/display: Disable OTG WA for the plane_state NULL case on DCN314 [Why] This shouldn't trigger during tiled display hotplug/unplug but it does because one of the tiles can end up with a NULL plane state. This also doesn't guard against the hang that it was originally trying to resolve, and can instead cause DIO corruption due to OTG sync being lost. [How] This was reverted at one point out of DCN31 so revert it here too. Reviewed-by: Dmytro Laktyushkin Acked-by: Wayne Lin Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f528fa3989c53d4cf2ee22d306eb1a96ed0010e6 Author: Daniel Miess Date: Fri Sep 9 11:32:55 2022 -0400 drm/amd/display: Add shift and mask for ICH_RESET_AT_END_OF_LINE [Why] DP DSC compliance failing for dcn314 due to ICH_RESET_AT_END_OF_LINE shift and mask being missing [How] Add in shift and mask for ICH_RESET_AT_END_OF_LINE Reviewed-by: Nicholas Kazlauskas Acked-by: Wayne Lin Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dcc2527df918edfe297c5074ccc1f05eae361ca6 Author: Dmytro Laktyushkin Date: Wed Jul 27 13:02:44 2022 -0400 drm/amd/display: increase dcn315 pstate change latency [Why & How] Update after new measurment came in Reviewed-by: Jun Lei Acked-by: Wayne Lin Signed-off-by: Dmytro Laktyushkin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 20c6168b3c8aadef7d2853c925d99eb546bd5e1c Author: Cruise Hung Date: Thu Sep 8 22:04:09 2022 +0800 drm/amd/display: Fix DP MST timeslot issue when fallback happened [Why] When USB4 DP link training failed and fell back to lower link rate, the time slot calculation uses the verified_link_cap. And the verified_link_cap was not updated to the new one. It caused the wrong VC payload time-slot was allocated. [How] Updated verified_link_cap with the new one from cur_link_settings after the LT completes successfully. Reviewed-by: Jun Lei Acked-by: Wayne Lin Signed-off-by: Cruise Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 72002056f771a025a2e6b4578aeb538799cb9ba2 Author: Meenakshikumar Somasundaram Date: Wed Aug 31 13:27:07 2022 -0400 drm/amd/display: Display distortion after hotplug 5K tiled display [Why] During hot plug of specific 5K tiled display, sometimes both the tiles are not synchronized resulting in distortion. The reason is that otgs of both the tiles goes out of sync when otg workaround (dcnxxx_disable_otg_wa) is applied for bandwidth optimization. The otg workaround reenables otg but otg synchronization context is not reset and hence dc_trigger_sync() does not resynchronize otg again. [How] Implement reset_sync_context_for_pipe() to reset the otg synchronization context for the disabled pipe and its slave pipes when otg workaround is applied. Reviewed-by: Nicholas Kazlauskas Acked-by: Wayne Lin Signed-off-by: Meenakshikumar Somasundaram Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 056fb8cfbe213f6eb5e987a806583986a4ae8328 Author: George Shen Date: Thu Sep 1 18:30:37 2022 -0400 drm/amd/display: Update dummy P-state search to use DCN32 DML [Why] Current DCN3.2 logic for finding the dummy P-state index uses the DCN3.0 DML validation function instead of DCN3.2 DML. This can result in either unexpected DML VBA values, or unexpected dummy P-state index to be used. [How] Update the dummy P-state logic to use DCN3.2 DML validation function. Reviewed-by: Alvin Lee Reviewed-by: Nevenko Stupar Acked-by: Wayne Lin Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 Author: zhikzhai Date: Fri Aug 26 19:44:50 2022 +0800 drm/amd/display: skip audio setup when audio stream is enabled [why] We have minimal pipe split transition method to avoid pipe allocation outage.However, this method will invoke audio setup which cause audio output stuck once pipe reallocate. [how] skip audio setup for pipelines which audio stream has been enabled Reviewed-by: Charlene Liu Acked-by: Wayne Lin Signed-off-by: zhikzhai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 52bb21499cf54fa65b56d97cd0d68579c90207dd Author: Hugo Hu Date: Thu Sep 1 10:08:35 2022 +0800 drm/amd/display: update gamut remap if plane has changed [Why] The desktop plane and full-screen game plane may have different gamut remap coefficients, if switching between desktop and full-screen game without updating the gamut remap will cause incorrect color. [How] Update gamut remap if planes change. Reviewed-by: Dmytro Laktyushkin Acked-by: Wayne Lin Signed-off-by: Hugo Hu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 29956d0fded036a570bd8e7d4ea4b1a1730307d2 Author: Michael Strauss Date: Wed Aug 31 15:10:43 2022 -0400 drm/amd/display: Assume an LTTPR is always present on fixed_vs links [WHY] LTTPRs can in very rare instsances fail to increment DPCD LTTPR count. This results in aux-i LTTPR requests to be sent to the wrong DPCD address, which causes link training failure. [HOW] Override internal repeater count if fixed_vs flag is set for a given link Reviewed-by: George Shen Acked-by: Wayne Lin Signed-off-by: Michael Strauss Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit cb0eca01ad9756e853efec3301203c2b5b45aa9f Author: Dmytro Laktyushkin Date: Tue Aug 30 15:16:40 2022 -0400 drm/amd/display: fix dcn315 memory channel count and width read [Why & How] Correctly set ddr5 channel width to 8 bytes Reviewed-by: Jun Lei Acked-by: Wayne Lin Signed-off-by: Dmytro Laktyushkin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b261509952bc19d1012cf732f853659be6ebc61e Author: Leo Li Date: Tue Aug 30 16:38:16 2022 -0400 drm/amd/display: Fix double cursor on non-video RGB MPO [Why] DC makes use of layer_index (zpos) when picking the HW plane to enable HW cursor on. However, some compositors will not attach zpos information to each DRM plane. Consequently, in amdgpu, we default layer_index to 0 and do not update it. This causes said DC logic to enable HW cursor on all planes of the same layer_index, which manifests as a double cursor issue if one of the planes is scaled (and hence scaling the cursor as well). [How] Use DRM core helpers to calculate a normalized_zpos value for each drm_plane_state under each crtc, within the atomic state. This helper will first consider existing zpos values, and if identical/unset, fallback to plane ID ordering. The normalized_zpos is then passed to dc_plane_info during atomic check for later use by the cursor logic. Reviewed-by: Bhawanpreet Lakha Acked-by: Wayne Lin Signed-off-by: Leo Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 16c6077f2eea3c8321782d2fb0a6790532cd8c03 Author: Alvin Lee Date: Wed Aug 31 10:53:27 2022 -0400 drm/amd/display: Only consider pixle rate div policy for DCN32+ [Why and How] - Only consider pixel rate div policy for DCN32+ Reviewed-by: Martin Leung Acked-by: Wayne Lin Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 88d4cea24049de0fa073462b24ab471ecd685d8a Author: Chris Park Date: Mon Sep 12 22:36:49 2022 +0800 drm/amd/display: Port DCN30 420 logic to DCN32 [Why] 420 modes are limited by FMT buffer width of 4096 which requires multi-pipe support in form of ODM combine. If 420 modes have greater HActive than 4096, the DML logic should accomodate whether it should be rejected, or ODM combine 2:1 or 4:1 is triggered accordingly. [How] FMT Buffer limit of 4096 in DCN32. Force ODM combine depending on HActive and FMT Buffer limit. Reject modes if TMDS 420 and above 4096. Acked-by: Wayne Lin Signed-off-by: Chris Park Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 37a0bad677a76e51c5e9e53f5d9f8f4f3e77912f Author: Mukul Joshi Date: Wed Sep 7 10:46:58 2022 -0400 drm/amdgpu: Update PTE flags with TF enabled This patch updates the PTE flags when translate further (TF) is enabled: - With translate_further enabled, invalid PTEs can be 0. Reading consecutive invalid PTEs as 0 is considered a fault. To prevent this, ensure invalid PTEs have at least 1 bit set. - The current invalid PTE flags settings to translate a retry fault into a no-retry fault, doesn't work with TF enabled. As a result, update invalid PTE flags settings which works for both TF enabled and disabled case. Fixes: 352e683b72e79d ("drm/amdgpu: Enable translate_further to extend UTCL2 reach") Reviewed-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Mukul Joshi Signed-off-by: Alex Deucher commit 1918f2b20c3de73ef6f644979896e20a2e7dbb2d Author: Tony Krowiak Date: Tue Aug 23 11:06:42 2022 -0400 s390/vfio-ap: bypass unnecessary processing of AP resources It is not necessary to go through the process of validation, linking of queues to mdev and vice versa and filtering the APQNs assigned to the matrix mdev to build an AP configuration for a guest if an adapter or domain being assigned is already assigned to the matrix mdev. Likewise, it is not necessary to proceed through the process the unassignment of an adapter, domain or control domain if it is not assigned to the matrix mdev. Since it is not necessary to process assignment of a resource already assigned or process unassignment of a resource that is been assigned, this patch will bypass all assignment/unassignment operations for an adapter, domain or control domain under these circumstances. Not only is assignment of a duplicate adapter or domain unnecessary, it will also cause a hang situation when removing the matrix mdev to which it is assigned. The reason is because the same vfio_ap_queue objects with an APQN containing the APID of the adapter or APQI of the domain being assigned will get added multiple times to the hashtable that holds them. This results in the pprev and next pointers of the hlist_node (mdev_qnode field in the vfio_ap_queue object) pointing to the queue object itself resulting in an interminable loop when the mdev is removed and the queue table is iterated to reset the queues. Cc: stable@vger.kernel.org Fixes: 11cb2419fafe ("s390/vfio-ap: manage link between queue struct and matrix mdev") Reported-by: Matthew Rosato Signed-off-by: Tony Krowiak Reviewed-by: Halil Pasic Signed-off-by: Halil Pasic Signed-off-by: Vasily Gorbik commit b7af938f4379a884f15713319648a7653497a907 Author: Dan Carpenter Date: Thu Sep 15 14:30:58 2022 +0300 i2c: mux: harden i2c_mux_alloc() against integer overflows A couple years back we went through the kernel an automatically converted size calculations to use struct_size() instead. The struct_size() calculation is protected against integer overflows. However it does not make sense to use the result from struct_size() for additional math operations as that would negate any safeness. Fixes: 1f3b69b6b939 ("i2c: mux: Use struct_size() in devm_kzalloc()") Signed-off-by: Dan Carpenter Acked-by: Peter Rosin Reviewed-by: Gustavo A. R. Silva Signed-off-by: Wolfram Sang commit 37f071ec327b04c83d47637c5e5c2199b39899ca Author: Asmaa Mnebhi Date: Tue Sep 20 13:47:29 2022 -0400 i2c: mlxbf: Fix frequency calculation The i2c-mlxbf.c driver is currently broken because there is a bug in the calculation of the frequency. core_f, core_r and core_od are components read from hardware registers and are used to compute the frequency used to compute different timing parameters. The shifting mechanism used to get core_f, core_r and core_od is wrong. Use FIELD_GET to mask and shift the bitfields properly. Fixes: b5b5b32081cd206b (i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC) Reviewed-by: Khalil Blaiech Signed-off-by: Asmaa Mnebhi Signed-off-by: Wolfram Sang commit 999e4eaa4b3691acf85d094836260ec4b66c74fd Author: Namhyung Kim Date: Tue Sep 20 15:28:21 2022 -0700 perf tools: Honor namespace when synthesizing build-ids It needs to enter the namespace before reading a file. Fixes: 4183a8d70a288627 ("perf tools: Allow synthesizing the build id for kernel/modules/tasks in PERF_RECORD_MMAP2") Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220920222822.2171056-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 356edeca2e811642b5848605c2f5f9a7c6c32112 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: 7df548840c496b01 ("x86/bugs: Add "unknown" reporting for MMIO Stale Data") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Borislav Petkov Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Pawan Gupta Link: https://lore.kernel.org/lkml/YysTRji90sNn2p5f@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5b427df27b94aec1312cace48a746782a0925c53 Author: Adrian Hunter Date: Wed Sep 14 15:24:29 2022 +0300 perf kcore_copy: Do not check /proc/modules is unchanged /proc/kallsyms and /proc/modules are compared before and after the copy in order to ensure no changes during the copy. However /proc/modules also might change due to reference counts changing even though that does not make any difference. Any modules loaded or unloaded should be visible in changes to kallsyms, so it is not necessary to check /proc/modules also anyway. Remove the comparison checking that /proc/modules is unchanged. Fixes: fc1b691d7651d949 ("perf buildid-cache: Add ability to add kcore to the cache") Reported-by: Daniel Dao Signed-off-by: Adrian Hunter Tested-by: Daniel Dao Acked-by: Namhyung Kim Cc: Ian Rogers Cc: Jiri Olsa Link: https://lore.kernel.org/r/20220914122429.8770-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 6cc447964555df209c590756bd804d3bb9ce1fe0 Author: Adrian Hunter Date: Thu Sep 15 15:26:12 2022 +0300 libperf evlist: Fix polling of system-wide events Originally, (refer commit f90d194a867a5a1d ("perf evlist: Do not poll events that use the system_wide flag") there wasn't much reason to poll system-wide events because: 1. The mmaps get "merged" via set-output anyway (the per-cpu case) 2. perf reads all mmaps when any event is woken 3. system-wide mmaps do not fill up as fast as the mmaps for user selected events But there was 1 reason not to poll which was that it prevented correct termination due to POLLHUP on all user selected events. That issue is now easily resolved by using fdarray_flag__nonfilterable. With the advent of commit ae4f8ae16a078964 ("libperf evlist: Allow mixing per-thread and per-cpu mmaps"), system-wide mmaps can be used also in the per-thread case where reason 1 does not apply. Fix the omission of system-wide events from polling by using the fdarray_flag__nonfilterable flag. Example: Before: $ perf record --no-bpf-event -vvv -e intel_pt// --per-thread uname 2>err.txt Linux $ grep 'sys_perf_event_open.*=\|pollfd' err.txt sys_perf_event_open: pid 155076 cpu -1 group_fd -1 flags 0x8 = 5 sys_perf_event_open: pid 155076 cpu -1 group_fd -1 flags 0x8 = 6 sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 sys_perf_event_open: pid -1 cpu 1 group_fd -1 flags 0x8 = 9 sys_perf_event_open: pid -1 cpu 2 group_fd -1 flags 0x8 = 10 sys_perf_event_open: pid -1 cpu 3 group_fd -1 flags 0x8 = 11 sys_perf_event_open: pid -1 cpu 4 group_fd -1 flags 0x8 = 12 sys_perf_event_open: pid -1 cpu 5 group_fd -1 flags 0x8 = 13 sys_perf_event_open: pid -1 cpu 6 group_fd -1 flags 0x8 = 14 sys_perf_event_open: pid -1 cpu 7 group_fd -1 flags 0x8 = 15 thread_data[0x55fb43c29e80]: pollfd[0] <- event_fd=5 thread_data[0x55fb43c29e80]: pollfd[1] <- event_fd=6 thread_data[0x55fb43c29e80]: pollfd[2] <- non_perf_event fd=4 After: $ perf record --no-bpf-event -vvv -e intel_pt// --per-thread uname 2>err.txt Linux $ grep 'sys_perf_event_open.*=\|pollfd' err.txt sys_perf_event_open: pid 156316 cpu -1 group_fd -1 flags 0x8 = 5 sys_perf_event_open: pid 156316 cpu -1 group_fd -1 flags 0x8 = 6 sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 sys_perf_event_open: pid -1 cpu 1 group_fd -1 flags 0x8 = 9 sys_perf_event_open: pid -1 cpu 2 group_fd -1 flags 0x8 = 10 sys_perf_event_open: pid -1 cpu 3 group_fd -1 flags 0x8 = 11 sys_perf_event_open: pid -1 cpu 4 group_fd -1 flags 0x8 = 12 sys_perf_event_open: pid -1 cpu 5 group_fd -1 flags 0x8 = 13 sys_perf_event_open: pid -1 cpu 6 group_fd -1 flags 0x8 = 14 sys_perf_event_open: pid -1 cpu 7 group_fd -1 flags 0x8 = 15 thread_data[0x55cc19e58e80]: pollfd[0] <- event_fd=5 thread_data[0x55cc19e58e80]: pollfd[1] <- event_fd=6 thread_data[0x55cc19e58e80]: pollfd[2] <- event_fd=7 thread_data[0x55cc19e58e80]: pollfd[3] <- event_fd=9 thread_data[0x55cc19e58e80]: pollfd[4] <- event_fd=10 thread_data[0x55cc19e58e80]: pollfd[5] <- event_fd=11 thread_data[0x55cc19e58e80]: pollfd[6] <- event_fd=12 thread_data[0x55cc19e58e80]: pollfd[7] <- event_fd=13 thread_data[0x55cc19e58e80]: pollfd[8] <- event_fd=14 thread_data[0x55cc19e58e80]: pollfd[9] <- event_fd=15 thread_data[0x55cc19e58e80]: pollfd[10] <- non_perf_event fd=4 Fixes: ae4f8ae16a078964 ("libperf evlist: Allow mixing per-thread and per-cpu mmaps") Signed-off-by: Adrian Hunter Acked-by: Namhyung Kim Cc: Ian Rogers Cc: Jiri Olsa Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220915122612.81738-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ca76d7d2812b46124291f99c9b50aaf63a936f23 Author: Adrian Hunter Date: Thu Sep 15 15:26:11 2022 +0300 perf record: Fix cpu mask bit setting for mixed mmaps With mixed per-thread and (system-wide) per-cpu maps, the "any cpu" value -1 must be skipped when setting CPU mask bits. Prior to commit cbd7bfc7fd99acdd ("tools/perf: Fix out of bound access to cpu mask array") the invalid setting went unnoticed, but since then it causes perf record to fail with an error. Example: Before: $ perf record -e intel_pt// --per-thread uname Failed to initialize parallel data streaming masks After: $ perf record -e intel_pt// --per-thread uname Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.068 MB perf.data ] Fixes: ae4f8ae16a078964 ("libperf evlist: Allow mixing per-thread and per-cpu mmaps") Signed-off-by: Adrian Hunter Acked-by: Namhyung Kim Cc: Athira Rajeev Cc: Ian Rogers Cc: Jiri Olsa Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220915122612.81738-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e1dda48e4370043443e7d121d4b67a96fb70c75b Author: Namhyung Kim Date: Wed Sep 14 11:33:38 2022 -0700 perf test: Skip wp modify test on old kernels It uses PERF_EVENT_IOC_MODIFY_ATTRIBUTES ioctl. The kernel would return ENOTTY if it's not supported. Update the skip reason in that case. Committer notes: On s/390 the args aren't used, so need to be marked __maybe_unused. Reviewed-by: Ravi Bangoria Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Ravi Bangoria Link: https://lore.kernel.org/r/20220914183338.546357-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9614369a042a3a345ef7e2997c277aa8a271b8a0 Merge: 521a547ced647 c7e31e36d8a26 Author: Rafael J. Wysocki Date: Wed Sep 21 19:57:31 2022 +0200 Merge tag 'opp-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP fixes for 6.0 from Viresh Kumar: "- Fix un-initialized variable usage (Christophe JAILLET). - Add missing DT properties (Rob Herring)." * tag 'opp-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: dt-bindings: opp: Add missing (unevaluated|additional)Properties on child nodes OPP: Fix an un-initialized variable usage commit dc164f4fb00a0abebdfff132f8bc7291a28f5401 Merge: 26c95642d4190 bd71558d585ac Author: Linus Torvalds Date: Wed Sep 21 10:14:56 2022 -0700 Merge tag 'for-linus-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fixes from Richard Weinberger: - Various fixes for build warnings - Fix default kernel command line * tag 'for-linus-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: arch: um: Mark the stack non-executable to fix a binutils warning um: Prevent KASAN splats in dump_stack() um: fix default console kernel parameter um: Cleanup compiler warning in arch/x86/um/tls_32.c um: Cleanup syscall_handler_t cast in syscalls_32.h commit 26c95642d419028db590ae0c511d9ddcdbc51746 Merge: 88e6546b36771 e9f3f8f488005 Author: Linus Torvalds Date: Wed Sep 21 09:31:19 2022 -0700 Merge tag 'mips-fixes_6.0_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - fix missing export for Lantiq watchdog driver - fix ethernet phy interface setup for Loongson32 * tag 'mips-fixes_6.0_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Loongson32: Fix PHY-mode being left unspecified MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko commit 88e6546b36771daa145e7f6cf29f3496341634a6 Merge: 06f7db9499937 e0f1b21c504f0 Author: Linus Torvalds Date: Wed Sep 21 09:25:32 2022 -0700 Merge tag 'dmaengine-fix-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "A couple of small driver fixes: - xilinx_dma: devm_platform_ioremap_resource error handling, dma_set_mask_and_coherent failure handling, dt property read cleanup - refcount leak fix for of_xudma_dev_get() - zynqmp_dma: coverity fix for enum typecast" * tag 'dmaengine-fix-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling commit 06f7db9499937c6496d697a765ac05cdcd37f381 Merge: 5ce94102fb82f 154897807050c Author: Linus Torvalds Date: Wed Sep 21 09:12:52 2022 -0700 Merge tag 'iommu-fixes-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "Two fixes for Intel VT-d: - Check the right capability bit for 5-level page table support. - Revert a previous fix which caused a regression with Thunderbolt devices" * tag 'iommu-fixes-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Check correct capability for sagaw determination Revert "iommu/vt-d: Fix possible recursive locking in intel_iommu_init()" commit 5ce94102fb82f10e8810fb41bc8be504ecc58647 Merge: 48062bb264771 79764ec772bc1 Author: Linus Torvalds Date: Wed Sep 21 09:07:59 2022 -0700 Merge tag 'sound-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A bit more changes than wished, but still manageable amount. Most of commits are HD-audio specific device fixes / quirks, while there is a revert for the previous fix due to regressions and a double-free fix in ALSA core code" * tag 'sound-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: Revert "ALSA: usb-audio: Split endpoint setups for hw_params and prepare" ALSA: core: Fix double-free at snd_card_new() ALSA: hda/realtek: Add a quirk for HP OMEN 16 (8902) mute LED ALSA: hda/hdmi: Fix the converter reuse for the silent stream ALSA: hda/realtek: Add quirk for ASUS GA503R laptop ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack ALSA: hda/realtek: Re-arrange quirk table entries ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop ALSA: hda: Fix Nvidia dp infoframe ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 ALSA: hda/tegra: set depop delay for tegra ALSA: hda: add Intel 5 Series / 3400 PCI DID ALSA: hda: Fix hang at HD-audio codec unbinding due to refcount saturation commit 48062bb2647711a5ed7605f485dfcb8fc9938d9c Merge: 60891ec99e141 2e9ceb6728f1d Author: Linus Torvalds Date: Wed Sep 21 08:40:57 2022 -0700 Merge tag 'exfat-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat fix from Namjae Jeon: - fix integer overflow on large partitions * tag 'exfat-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix overflow for large capacity partition commit 189e7d876e48d7c791fe1c9c01516f70f5621a9f Author: Matthew Rosato Date: Tue Sep 20 15:30:25 2022 -0400 KVM: s390: pci: register pci hooks without interpretation The kvm registration hooks must be registered even if the facilities necessary for zPCI interpretation are unavailable, as vfio-pci-zdev will expect to use the hooks regardless. This fixes an issue where vfio-pci-zdev will fail its open function because of a missing kvm_register when running on hardware that does not support zPCI interpretation. Fixes: ca922fecda6c ("KVM: s390: pci: Hook to access KVM lowlevel from VFIO") Signed-off-by: Matthew Rosato Reviewed-by: Pierre Morel Link: https://lore.kernel.org/r/20220920193025.135655-1-mjrosato@linux.ibm.com Message-Id: <20220920193025.135655-1-mjrosato@linux.ibm.com> Signed-off-by: Janosch Frank commit 70ba8fae27758cc2679a948b03d8a9ca18f1dcb1 Author: Matthew Rosato Date: Wed Sep 7 11:59:52 2022 -0400 KVM: s390: pci: fix GAIT physical vs virtual pointers usage The GAIT and all of its entries must be represented by physical addresses as this structure is shared with underlying firmware. We can keep a virtual address of the GAIT origin in order to handle processing in the kernel, but when traversing the entries we must again convert the physical AISB stored in that GAIT entry into a virtual address in order to process it. Note: this currently doesn't fix a real bug, since virtual addresses are indentical to physical ones. Reviewed-by: Pierre Morel Acked-by: Nico Boehr Signed-off-by: Matthew Rosato Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20220907155952.87356-1-mjrosato@linux.ibm.com Message-Id: <20220907155952.87356-1-mjrosato@linux.ibm.com> Signed-off-by: Janosch Frank commit b3cefd6bf16e7234ffbd4209f6083060f4e35f59 Author: Janis Schoetterl-Glausch Date: Thu Aug 25 21:25:40 2022 +0200 KVM: s390: Pass initialized arg even if unused This silences smatch warnings reported by kbuild bot: arch/s390/kvm/gaccess.c:859 guest_range_to_gpas() error: uninitialized symbol 'prot'. arch/s390/kvm/gaccess.c:1064 access_guest_with_key() error: uninitialized symbol 'prot'. This is because it cannot tell that the value is not used in this case. The trans_exc* only examine prot if code is PGM_PROTECTION. Pass a dummy value for other codes. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Janis Schoetterl-Glausch Reviewed-by: Claudio Imbrenda Link: https://lore.kernel.org/r/20220825192540.1560559-1-scgl@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Janosch Frank commit e8c924a4fb6ef9a224423fb5542954acbda234b3 Author: Matthew Rosato Date: Thu Sep 15 13:55:14 2022 -0400 KVM: s390: pci: fix plain integer as NULL pointer warnings Fix some sparse warnings that a plain integer 0 is being used instead of NULL. Reported-by: kernel test robot Signed-off-by: Matthew Rosato Link: https://lore.kernel.org/r/20220915175514.167899-1-mjrosato@linux.ibm.com Signed-off-by: Christian Borntraeger Signed-off-by: Janosch Frank commit 375a683321a331697103a5ba2fed880b759c626d Merge: 65e5d27df6128 0f2211f1cf588 Author: Jakub Kicinski Date: Wed Sep 21 06:52:32 2022 -0700 Merge tag 'linux-can-fixes-for-6.0-20220921' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2022-09-21 The 1st patch is by me, targets the flexcan driver and fixes a potential system hang on single core systems under high CAN packet rate. The next 2 patches are also by me and target the gs_usb driver. A potential race condition during the ndo_open callback as well as the return value if the ethtool identify feature is not supported are fixed. * tag 'linux-can-fixes-for-6.0-20220921' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: gs_usb: gs_usb_set_phys_id(): return with error if identify is not supported can: gs_usb: gs_can_open(): fix race dev->can.state condition can: flexcan: flexcan_mailbox_read() fix return value for drop = true ==================== Link: https://lore.kernel.org/r/20220921083609.419768-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit babd04386b1df8c364cdaa39ac0e54349502e1e5 Author: Lieven Hey Date: Thu Sep 15 11:29:10 2022 +0200 perf jit: Include program header in ELF files The missing header makes it hard for programs like elfutils to open these files. Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols") Reviewed-by: Leo Yan Signed-off-by: Lieven Hey Tested-by: Leo Yan Cc: Leo Yan Link: https://lore.kernel.org/r/20220915092910.711036-1-lieven.hey@kdab.com Signed-off-by: Arnaldo Carvalho de Melo commit 7901086014bbaa3aeabcf060e0bbad6220427a3b Author: Namhyung Kim Date: Fri Sep 16 11:41:32 2022 -0700 perf test: Add a new test for perf stat cgroup BPF counter $ sudo ./perf test -v each-cgroup 96: perf stat --bpf-counters --for-each-cgroup test : --- start --- test child forked, pid 79600 test child finished with 0 ---- end ---- perf stat --bpf-counters --for-each-cgroup test: Ok Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220916184132.1161506-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8a92605daa9098fadb473fb30edafacc40033a05 Author: Namhyung Kim Date: Fri Sep 16 11:41:31 2022 -0700 perf stat: Use evsel->core.cpus to iterate cpus in BPF cgroup counters If it mixes core and uncore events, each evsel would have different cpu map. But it assumed they are same with evlist's all_cpus and accessed by the same index. This resulted in a crash like below. $ perf stat -a --bpf-counters --for-each_cgroup ^. -e cycles,imc/cas_count_read/ sleep 1 Segmentation fault While it's not recommended to use uncore events for cgroup aggregation, it should not crash. Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220916184132.1161506-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 3da35231d9e4949c4ae40e3ce653e7c468455d55 Author: Namhyung Kim Date: Fri Sep 16 11:41:30 2022 -0700 perf stat: Fix cpu map index in bperf cgroup code The previous cpu map introduced a bug in the bperf cgroup counter. This results in a failure when user gives a partial cpu map starting from non-zero. $ sudo ./perf stat -C 1-2 --bpf-counters --for-each-cgroup ^. sleep 1 libbpf: prog 'on_cgrp_switch': failed to create BPF link for perf_event FD 0: -9 (Bad file descriptor) Failed to attach cgroup program To get the FD of an evsel, it should use a map index not the CPU number. Fixes: 0255571a16059c8e ("perf cpumap: Switch to using perf_cpu_map API") Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: bpf@vger.kernel.org Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20220916184132.1161506-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0d77326c3369e255715ed2440a78894ccc98dd69 Author: Namhyung Kim Date: Fri Sep 16 11:41:29 2022 -0700 perf stat: Fix BPF program section name It seems the recent libbpf got more strict about the section name. I'm seeing a failure like this: $ sudo ./perf stat -a --bpf-counters --for-each-cgroup ^. sleep 1 libbpf: prog 'on_cgrp_switch': missing BPF prog type, check ELF section name 'perf_events' libbpf: prog 'on_cgrp_switch': failed to load: -22 libbpf: failed to load object 'bperf_cgroup_bpf' libbpf: failed to load BPF skeleton 'bperf_cgroup_bpf': -22 Failed to load cgroup skeleton The section name should be 'perf_event' (without the trailing 's'). Although it's related to the libbpf change, it'd be better fix the section name in the first place. Fixes: 944138f048f7d759 ("perf stat: Enable BPF counter with --for-each-cgroup") Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: bpf@vger.kernel.org Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20220916184132.1161506-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ab4bbde809ff7bc964f638d62959ec4272a8729a Merge: ab0b4b575b46d 468c9d928a8f3 Author: Greg Kroah-Hartman Date: Wed Sep 21 15:26:45 2022 +0200 Merge tag 'fpga-for-6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-linus Xu writes: FPGA Manager changes for 6.0-final Intel m10 bmc secure update - Russ's change fixes the memory leak for a sysfs node reading All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-6.0 branch). Signed-off-by: Xu Yilun * tag 'fpga-for-6.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: m10bmc-sec: Fix possible memory leak of flash_buf commit e9233917a7e53980664efbc565888163c0a33c3f Author: Brian Norris Date: Tue Sep 13 18:40:10 2022 -0700 mmc: core: Terminate infinite loop in SD-UHS voltage switch This loop intends to retry a max of 10 times, with some implicit termination based on the SD_{R,}OCR_S18A bit. Unfortunately, the termination condition depends on the value reported by the SD card (*rocr), which may or may not correctly reflect what we asked it to do. Needless to say, it's not wise to rely on the card doing what we expect; we should at least terminate the loop regardless. So, check both the input and output values, so we ensure we will terminate regardless of the SD card behavior. Note that SDIO learned a similar retry loop in commit 0797e5f1453b ("mmc: core: Fixup signal voltage switch"), but that used the 'ocr' result, and so the current pre-terminating condition looks like: rocr & ocr & R4_18V_PRESENT (i.e., it doesn't have the same bug.) This addresses a number of crash reports seen on ChromeOS that look like the following: ... // lots of repeated: ... <4>[13142.846061] mmc1: Skipping voltage switch <4>[13143.406087] mmc1: Skipping voltage switch <4>[13143.964724] mmc1: Skipping voltage switch <4>[13144.526089] mmc1: Skipping voltage switch <4>[13145.086088] mmc1: Skipping voltage switch <4>[13145.645941] mmc1: Skipping voltage switch <3>[13146.153969] INFO: task halt:30352 blocked for more than 122 seconds. ... Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure") Cc: Signed-off-by: Brian Norris Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20220914014010.2076169-1-briannorris@chromium.org Signed-off-by: Ulf Hansson commit 65e5d27df61283e5390f04b09dc79cd832f95607 Author: Jianglei Nie Date: Wed Sep 14 09:42:38 2022 +0800 net: atlantic: fix potential memory leak in aq_ndev_close() If aq_nic_stop() fails, aq_ndev_close() returns err without calling aq_nic_deinit() to release the relevant memory and resource, which will lead to a memory leak. We can fix it by deleting the if condition judgment and goto statement to call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak. Signed-off-by: Jianglei Nie Signed-off-by: David S. Miller commit 154897807050c1161cb2660e502fc0470d46b986 Author: Yi Liu Date: Wed Sep 21 10:40:54 2022 +0800 iommu/vt-d: Check correct capability for sagaw determination Check 5-level paging capability for 57 bits address width instead of checking 1GB large page capability. Fixes: 53fc7ad6edf2 ("iommu/vt-d: Correctly calculate sagaw value of IOMMU") Cc: stable@vger.kernel.org Reported-by: Raghunathan Srinivasan Signed-off-by: Yi Liu Reviewed-by: Jerry Snitselaar Reviewed-by: Kevin Tian Reviewed-by: Raghunathan Srinivasan Link: https://lore.kernel.org/r/20220916071212.2223869-2-yi.l.liu@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 7ebb5f8e001037efbdf18afabbbebf71bd98825e Author: Lu Baolu Date: Wed Sep 21 10:40:53 2022 +0800 Revert "iommu/vt-d: Fix possible recursive locking in intel_iommu_init()" This reverts commit 9cd4f1434479f1ac25c440c421fbf52069079914. Some issues were reported on the original commit. Some thunderbolt devices don't work anymore due to the following DMA fault. DMAR: DRHD: handling fault status reg 2 DMAR: [INTR-REMAP] Request device [09:00.0] fault index 0x8080 [fault reason 0x25] Blocked a compatibility format interrupt request Bring it back for now to avoid functional regression. Fixes: 9cd4f1434479f ("iommu/vt-d: Fix possible recursive locking in intel_iommu_init()") Link: https://lore.kernel.org/linux-iommu/485A6EA5-6D58-42EA-B298-8571E97422DE@getmailspring.com/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=216497 Cc: Mika Westerberg Cc: # 5.19.x Reported-and-tested-by: George Hilliard Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20220920081701.3453504-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 79a392a3b19a106e0268bfbe1b4cc31d85eeb552 Merge: 6a1dbfefdae4f d250889322276 Author: David S. Miller Date: Wed Sep 21 09:07:53 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: bugfixes for net The following set contains netfilter fixes for the *net* tree. Regressions (rc only): recent ebtables crash fix was incomplete, it added a memory leak. The patch to fix possible buffer overrun for BIG TCP in ftp conntrack tried to be too clever, we cannot re-use ct->lock: NAT engine might grab it again -> deadlock. Revert back to a global spinlock. Both from myself. Remove the documentation for the recently removed 'nf_conntrack_helper' sysctl as well, from Pablo Neira. The static_branch_inc() that guards the 'chain stats enabled' path needs to be deferred further, until the entire transaction was created. From Tetsuo Handa. Older bugs: Since 5.3: nf_tables_addchain may leak pcpu memory in error path when offloading fails. Also from Tetsuo Handa. ==================== Signed-off-by: David S. Miller commit 0f2211f1cf58876f00d2fd8839e0fdadf0786894 Author: Marc Kleine-Budde Date: Thu Aug 18 14:10:08 2022 +0200 can: gs_usb: gs_usb_set_phys_id(): return with error if identify is not supported Until commit 409c188c57cd ("can: tree-wide: advertise software timestamping capabilities") the ethtool_ops was only assigned for devices which support the GS_CAN_FEATURE_IDENTIFY feature. That commit assigns ethtool_ops unconditionally. This results on controllers without GS_CAN_FEATURE_IDENTIFY support for the following ethtool error: | $ ethtool -p can0 1 | Cannot identify NIC: Broken pipe Restore the correct error value by checking for GS_CAN_FEATURE_IDENTIFY in the gs_usb_set_phys_id() function. | $ ethtool -p can0 1 | Cannot identify NIC: Operation not supported While there use the variable "netdev" for the "struct net_device" pointer and "dev" for the "struct gs_can" pointer as in the rest of the driver. Fixes: 409c188c57cd ("can: tree-wide: advertise software timestamping capabilities") Link: http://lore.kernel.org/all/20220818143853.2671854-1-mkl@pengutronix.de Cc: Vincent Mailhol Signed-off-by: Marc Kleine-Budde commit 5440428b3da65408dba0241985acb7a05258b85e Author: Marc Kleine-Budde Date: Tue Sep 20 11:40:56 2022 +0200 can: gs_usb: gs_can_open(): fix race dev->can.state condition The dev->can.state is set to CAN_STATE_ERROR_ACTIVE, after the device has been started. On busy networks the CAN controller might receive CAN frame between and go into an error state before the dev->can.state is assigned. Assign dev->can.state before starting the controller to close the race window. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://lore.kernel.org/all/20220920195216.232481-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a09721dd47c8468b3f2fdd73f40422699ffe26dd Author: Marc Kleine-Budde Date: Thu Aug 11 10:25:44 2022 +0200 can: flexcan: flexcan_mailbox_read() fix return value for drop = true The following happened on an i.MX25 using flexcan with many packets on the bus: The rx-offload queue reached a length more than skb_queue_len_max. In can_rx_offload_offload_one() the drop variable was set to true which made the call to .mailbox_read() (here: flexcan_mailbox_read()) to _always_ return ERR_PTR(-ENOBUFS) and drop the rx'ed CAN frame. So can_rx_offload_offload_one() returned ERR_PTR(-ENOBUFS), too. can_rx_offload_irq_offload_fifo() looks as follows: | while (1) { | skb = can_rx_offload_offload_one(offload, 0); | if (IS_ERR(skb)) | continue; | if (!skb) | break; | ... | } The flexcan driver wrongly always returns ERR_PTR(-ENOBUFS) if drop is requested, even if there is no CAN frame pending. As the i.MX25 is a single core CPU, while the rx-offload processing is active, there is no thread to process packets from the offload queue. So the queue doesn't get any shorter and this results is a tight loop. Instead of always returning ERR_PTR(-ENOBUFS) if drop is requested, return NULL if no CAN frame is pending. Changes since v1: https://lore.kernel.org/all/20220810144536.389237-1-u.kleine-koenig@pengutronix.de - don't break in can_rx_offload_irq_offload_fifo() in case of an error, return NULL in flexcan_mailbox_read() in case of no pending CAN frame instead Fixes: 4e9c9484b085 ("can: rx-offload: Prepare for CAN FD support") Link: https://lore.kernel.org/all/20220811094254.1864367-1-mkl@pengutronix.de Cc: stable@vger.kernel.org # v5.5 Suggested-by: Uwe Kleine-König Reviewed-by: Uwe Kleine-König Tested-by: Thorsten Scherer Signed-off-by: Marc Kleine-Budde commit 69bef19d6b9700e96285f4b4e28691cda3dcd0d1 Author: Meng Li Date: Wed Sep 21 11:20:20 2022 +0800 gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below: Call trace: free_irq+0x204/0x360 lineevent_free+0x64/0x70 gpio_ioctl+0x598/0x6a0 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x5c/0x130 ...... el0t_64_sync+0x1a0/0x1a4 The reason of this issue is that calling request_threaded_irq() function failed, and then lineevent_free() is invoked to release the resource. Since the lineevent_state::irq was already set, so the subsequent invocation of free_irq() would trigger the above warning call trace. To fix this issue, set the lineevent_state::irq after the IRQ register successfully. Fixes: 468242724143 ("gpiolib: cdev: refactor lineevent cleanup into lineevent_free") Cc: stable@vger.kernel.org Signed-off-by: Meng Li Reviewed-by: Kent Gibson Signed-off-by: Bartosz Golaszewski commit 21a9acc162457402c74c5c1e16471fda6eb090c0 Author: Dongliang Mu Date: Mon Sep 19 11:12:49 2022 +0800 gpio: tqmx86: fix uninitialized variable girq The commit 924610607f19 ("gpio: tpmx86: Move PM device over to irq domain") adds a dereference of girq that may be uninitialized. Fix this by moving irq_domain_set_pm_device into if true branch as suggested by Marc Zyngier. Fixes: 924610607f19 ("gpio: tpmx86: Move PM device over to irq domain") Suggested-by: Marc Zyngier Signed-off-by: Dongliang Mu Acked-by: Marc Zyngier Signed-off-by: Bartosz Golaszewski commit bd71558d585ac61cfd799db7f25e78dca404dd7a Author: David Gow Date: Wed Sep 21 14:48:55 2022 +0800 arch: um: Mark the stack non-executable to fix a binutils warning Since binutils 2.39, ld will print a warning if any stack section is executable, which is the default for stack sections on files without a .note.GNU-stack section. This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"), but remained broken for UML, resulting in several warnings: /usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions /usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions /usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments to dodge the remaining warnings about LOAD segments with RWX permissions in the kallsyms objects. (Note that this flag is apparently not available on lld, so hide it behind a test for BFD, which is what the x86 patch does.) Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffcf9c5700e49c0aee42dcba9a12ba21338e8136 Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 Signed-off-by: David Gow Reviewed-by: Lukas Straub Tested-by: Lukas Straub Acked-by: Randy Dunlap # build-tested Signed-off-by: Richard Weinberger commit 6a1dbfefdae4f7809b3e277cc76785dac0ac1cd0 Author: Geert Uytterhoeven Date: Mon Sep 19 16:48:28 2022 +0200 net: sh_eth: Fix PHY state warning splat during system resume Since commit 744d23c71af39c7d ("net: phy: Warn about incorrect mdio_bus_phy_resume() state"), a warning splat is printed during system resume with Wake-on-LAN disabled: WARNING: CPU: 0 PID: 626 at drivers/net/phy/phy_device.c:323 mdio_bus_phy_resume+0xbc/0xe4 As the Renesas SuperH Ethernet driver already calls phy_{stop,start}() in its suspend/resume callbacks, it is sufficient to just mark the MAC responsible for managing the power state of the PHY. Fixes: fba863b816049b03 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Signed-off-by: Geert Uytterhoeven Reviewed-by: Florian Fainelli Reviewed-by: Sergey Shtylyov Link: https://lore.kernel.org/r/c6e1331b9bef61225fa4c09db3ba3e2e7214ba2d.1663598886.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 4924c0cdce75575295f8fa682851fb8e5d619dd2 Author: Geert Uytterhoeven Date: Mon Sep 19 16:48:00 2022 +0200 net: ravb: Fix PHY state warning splat during system resume Since commit 744d23c71af39c7d ("net: phy: Warn about incorrect mdio_bus_phy_resume() state"), a warning splat is printed during system resume with Wake-on-LAN disabled: WARNING: CPU: 0 PID: 1197 at drivers/net/phy/phy_device.c:323 mdio_bus_phy_resume+0xbc/0xc8 As the Renesas Ethernet AVB driver already calls phy_{stop,start}() in its suspend/resume callbacks, it is sufficient to just mark the MAC responsible for managing the power state of the PHY. Fixes: fba863b816049b03 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Signed-off-by: Geert Uytterhoeven Reviewed-by: Florian Fainelli Reviewed-by: Sergey Shtylyov Link: https://lore.kernel.org/r/8ec796f47620980fdd0403e21bd8b7200b4fa1d4.1663598796.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit d25088932227680988a6b794221e031a7232f137 Author: Florian Westphal Date: Tue Sep 20 18:31:30 2022 +0200 netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed We can't use ct->lock, this is already used by the seqadj internals. When using ftp helper + nat, seqadj will attempt to acquire ct->lock again. Revert back to a global lock for now. Fixes: c783a29c7e59 ("netfilter: nf_ct_ftp: prefer skb_linearize") Reported-by: Bruno de Paula Larini Signed-off-by: Florian Westphal commit 62ce44c4fff947eebdf10bb582267e686e6835c9 Author: Florian Westphal Date: Tue Sep 20 14:20:17 2022 +0200 netfilter: ebtables: fix memory leak when blob is malformed The bug fix was incomplete, it "replaced" crash with a memory leak. The old code had an assignment to "ret" embedded into the conditional, restore this. Fixes: 7997eff82828 ("netfilter: ebtables: reject blobs that don't provide all entry points") Reported-and-tested-by: syzbot+a24c5252f3e3ab733464@syzkaller.appspotmail.com Signed-off-by: Florian Westphal commit 9a4d6dd554b86e65581ef6b6638a39ae079b17ac Author: Tetsuo Handa Date: Mon Sep 12 22:58:51 2022 +0900 netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() It seems to me that percpu memory for chain stats started leaking since commit 3bc158f8d0330f0a ("netfilter: nf_tables: map basechain priority to hardware priority") when nft_chain_offload_priority() returned an error. Signed-off-by: Tetsuo Handa Fixes: 3bc158f8d0330f0a ("netfilter: nf_tables: map basechain priority to hardware priority") Signed-off-by: Florian Westphal commit 921ebde3c0d22c8cba74ce8eb3cc4626abff1ccd Author: Tetsuo Handa Date: Mon Sep 12 21:41:00 2022 +0900 netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() syzbot is reporting underflow of nft_counters_enabled counter at nf_tables_addchain() [1], for commit 43eb8949cfdffa76 ("netfilter: nf_tables: do not leave chain stats enabled on error") missed that nf_tables_chain_destroy() after nft_basechain_init() in the error path of nf_tables_addchain() decrements the counter because nft_basechain_init() makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag. Increment the counter immediately after returning from nft_basechain_init(). Link: https://syzkaller.appspot.com/bug?extid=b5d82a651b71cd8a75ab [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Tested-by: syzbot Fixes: 43eb8949cfdffa76 ("netfilter: nf_tables: do not leave chain stats enabled on error") Signed-off-by: Florian Westphal commit 76b907ee00c4a5cdd5d0adbacdaa1c1989385615 Author: Pablo Neira Ayuso Date: Fri Sep 9 12:42:11 2022 +0200 netfilter: conntrack: remove nf_conntrack_helper documentation This toggle has been already remove by b118509076b3 ("netfilter: remove nf_conntrack_helper sysctl and modparam toggles"). Remove the documentation entry for this toggle too. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 603ccb3aca717d04a4b1a04e3a7bc3b91eba33e8 Author: Bhupesh Sharma Date: Thu Sep 15 16:58:04 2022 +0530 MAINTAINERS: Add myself as a reviewer for Qualcomm ETHQOS Ethernet driver As suggested by Vinod, adding myself as the reviewer for the Qualcomm ETHQOS Ethernet driver. Recently I have enabled this driver on a few Qualcomm SoCs / boards and hence trying to keep a close eye on it. Signed-off-by: Bhupesh Sharma Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20220915112804.3950680-1-bhupesh.sharma@linaro.org Signed-off-by: Jakub Kicinski commit 8ac7132704f3fbd2095abb9459e5303ce8c9e559 Author: Mateusz Palczewski Date: Fri Aug 26 10:31:23 2022 +0200 ice: Fix interface being down after reset with link-down-on-close flag on When performing a reset on ice driver with link-down-on-close flag on interface would always stay down. Fix this by moving a check of this flag to ice_stop() that is called only when user wants to bring interface down. Fixes: ab4ab73fc1ec ("ice: Add ethtool private flag to make forcing link down optional") Signed-off-by: Mateusz Palczewski Tested-by: Petr Oros Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 122045ca770492660005c22379995506f13efea8 Author: Michal Swiatkowski Date: Mon Aug 8 11:58:54 2022 +0200 ice: config netdev tc before setting queues number After lowering number of tx queues the warning appears: "Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled!" Example command to reproduce: ethtool -L enp24s0f0 tx 36 rx 36 Fix this by setting correct tc mapping before setting real number of queues on netdev. Fixes: 0754d65bd4be5 ("ice: Add infrastructure for mqprio support via ndo_setup_tc") Signed-off-by: Michal Swiatkowski Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit da847246ab80610c5acca34df5893bee1d8cf7c2 Merge: 76dd07281338d 1461d212ab277 Author: Jakub Kicinski Date: Tue Sep 20 11:41:17 2022 -0700 Merge branch 'fixes-for-tc-taprio-software-mode' Vladimir Oltean says: ==================== Fixes for tc-taprio software mode While working on some new features for tc-taprio, I found some strange behavior which looked like bugs. I was able to eventually trigger a NULL pointer dereference. This patch set fixes 2 issues I saw. Detailed explanation in patches. ==================== Link: https://lore.kernel.org/r/20220915100802.2308279-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 1461d212ab277d8bba1a753d33e9afe03d81f9d4 Author: Vladimir Oltean Date: Thu Sep 15 13:08:02 2022 +0300 net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs taprio can only operate as root qdisc, and to that end, there exists the following check in taprio_init(), just as in mqprio: if (sch->parent != TC_H_ROOT) return -EOPNOTSUPP; And indeed, when we try to attach taprio to an mqprio child, it fails as expected: $ tc qdisc add dev swp0 root handle 1: mqprio num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:2 taprio num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI Error: sch_taprio: Can only be attached as root qdisc. (extack message added by me) But when we try to attach a taprio child to a taprio root qdisc, surprisingly it doesn't fail: $ tc qdisc replace dev swp0 root handle 1: taprio num_tc 8 \ map 0 1 2 3 4 5 6 7 queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI $ tc qdisc replace dev swp0 parent 1:2 taprio num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ base-time 0 sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI This is because tc_modify_qdisc() behaves differently when mqprio is root, vs when taprio is root. In the mqprio case, it finds the parent qdisc through p = qdisc_lookup(dev, TC_H_MAJ(clid)), and then the child qdisc through q = qdisc_leaf(p, clid). This leaf qdisc q has handle 0, so it is ignored according to the comment right below ("It may be default qdisc, ignore it"). As a result, tc_modify_qdisc() goes through the qdisc_create() code path, and this gives taprio_init() a chance to check for sch_parent != TC_H_ROOT and error out. Whereas in the taprio case, the returned q = qdisc_leaf(p, clid) is different. It is not the default qdisc created for each netdev queue (both taprio and mqprio call qdisc_create_dflt() and keep them in a private q->qdiscs[], or priv->qdiscs[], respectively). Instead, taprio makes qdisc_leaf() return the _root_ qdisc, aka itself. When taprio does that, tc_modify_qdisc() goes through the qdisc_change() code path, because the qdisc layer never finds out about the child qdisc of the root. And through the ->change() ops, taprio has no reason to check whether its parent is root or not, just through ->init(), which is not called. The problem is the taprio_leaf() implementation. Even though code wise, it does the exact same thing as mqprio_leaf() which it is copied from, it works with different input data. This is because mqprio does not attach itself (the root) to each device TX queue, but one of the default qdiscs from its private array. In fact, since commit 13511704f8d7 ("net: taprio offload: enforce qdisc to netdev queue mapping"), taprio does this too, but just for the full offload case. So if we tried to attach a taprio child to a fully offloaded taprio root qdisc, it would properly fail too; just not to a software root taprio. To fix the problem, stop looking at the Qdisc that's attached to the TX queue, and instead, always return the default qdiscs that we've allocated (and to which we privately enqueue and dequeue, in software scheduling mode). Since Qdisc_class_ops :: leaf is only called from tc_modify_qdisc(), the risk of unforeseen side effects introduced by this change is minimal. Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") Signed-off-by: Vladimir Oltean Reviewed-by: Vinicius Costa Gomes Signed-off-by: Jakub Kicinski commit db46e3a88a09c5cf7e505664d01da7238cd56c92 Author: Vladimir Oltean Date: Thu Sep 15 13:08:01 2022 +0300 net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly strange API design decision, qdisc->destroy() gets called even if qdisc->init() never succeeded, not exclusively since commit 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation"), but apparently also earlier (in the case of qdisc_create_dflt()). The taprio qdisc does not fully acknowledge this when it attempts full offload, because it starts off with q->flags = TAPRIO_FLAGS_INVALID in taprio_init(), then it replaces q->flags with TCA_TAPRIO_ATTR_FLAGS parsed from netlink (in taprio_change(), tail called from taprio_init()). But in taprio_destroy(), we call taprio_disable_offload(), and this determines what to do based on FULL_OFFLOAD_IS_ENABLED(q->flags). But looking at the implementation of FULL_OFFLOAD_IS_ENABLED() (a bitwise check of bit 1 in q->flags), it is invalid to call this macro on q->flags when it contains TAPRIO_FLAGS_INVALID, because that is set to U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on an invalid set of flags. As a result, it is possible to crash the kernel if user space forces an error between setting q->flags = TAPRIO_FLAGS_INVALID, and the calling of taprio_enable_offload(). This is because drivers do not expect the offload to be disabled when it was never enabled. The error that we force here is to attach taprio as a non-root qdisc, but instead as child of an mqprio root qdisc: $ tc qdisc add dev swp0 root handle 1: \ mqprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0 $ tc qdisc replace dev swp0 parent 1:1 \ taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 990000 sched-entry S 0x80 100000 \ flags 0x0 clockid CLOCK_TAI Unable to handle kernel paging request at virtual address fffffffffffffff8 [fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Call trace: taprio_dump+0x27c/0x310 vsc9959_port_setup_tc+0x1f4/0x460 felix_port_setup_tc+0x24/0x3c dsa_slave_setup_tc+0x54/0x27c taprio_disable_offload.isra.0+0x58/0xe0 taprio_destroy+0x80/0x104 qdisc_create+0x240/0x470 tc_modify_qdisc+0x1fc/0x6b0 rtnetlink_rcv_msg+0x12c/0x390 netlink_rcv_skb+0x5c/0x130 rtnetlink_rcv+0x1c/0x2c Fix this by keeping track of the operations we made, and undo the offload only if we actually did it. I've added "bool offloaded" inside a 4 byte hole between "int clockid" and "atomic64_t picos_per_byte". Now the first cache line looks like below: $ pahole -C taprio_sched net/sched/sch_taprio.o struct taprio_sched { struct Qdisc * * qdiscs; /* 0 8 */ struct Qdisc * root; /* 8 8 */ u32 flags; /* 16 4 */ enum tk_offsets tk_offset; /* 20 4 */ int clockid; /* 24 4 */ bool offloaded; /* 28 1 */ /* XXX 3 bytes hole, try to pack */ atomic64_t picos_per_byte; /* 32 0 */ /* XXX 8 bytes hole, try to pack */ spinlock_t current_entry_lock; /* 40 0 */ /* XXX 8 bytes hole, try to pack */ struct sched_entry * current_entry; /* 48 8 */ struct sched_gate_list * oper_sched; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ Fixes: 9c66d1564676 ("taprio: Add support for hardware offloading") Signed-off-by: Vladimir Oltean Reviewed-by: Vinicius Costa Gomes Signed-off-by: Jakub Kicinski commit 76dd07281338da6951fdab3432ced843fa87839c Author: Ido Schimmel Date: Fri Sep 16 11:48:21 2022 +0300 ipv6: Fix crash when IPv6 is administratively disabled The global 'raw_v6_hashinfo' variable can be accessed even when IPv6 is administratively disabled via the 'ipv6.disable=1' kernel command line option, leading to a crash [1]. Fix by restoring the original behavior and always initializing the variable, regardless of IPv6 support being administratively disabled or not. [1] BUG: unable to handle page fault for address: ffffffffffffffc8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 173e18067 P4D 173e18067 PUD 173e1a067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 3 PID: 271 Comm: ss Not tainted 6.0.0-rc4-custom-00136-g0727a9a5fbc1 #1396 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:raw_diag_dump+0x310/0x7f0 [...] Call Trace: __inet_diag_dump+0x10f/0x2e0 netlink_dump+0x575/0xfd0 __netlink_dump_start+0x67b/0x940 inet_diag_handler_cmd+0x273/0x2d0 sock_diag_rcv_msg+0x317/0x440 netlink_rcv_skb+0x15e/0x430 sock_diag_rcv+0x2b/0x40 netlink_unicast+0x53b/0x800 netlink_sendmsg+0x945/0xe60 ____sys_sendmsg+0x747/0x960 ___sys_sendmsg+0x13a/0x1e0 __sys_sendmsg+0x118/0x1e0 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 0daf07e52709 ("raw: convert raw sockets to RCU") Reported-by: Roberto Ricci Tested-by: Roberto Ricci Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220916084821.229287-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42 Author: Vladimir Oltean Date: Fri Sep 16 16:32:09 2022 +0300 net: enetc: deny offload of tc-based TSN features on VF interfaces TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetc_port_rd(), enetc_port_wr(). Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions. Moreover, attempting to access these registers crashes the kernel: $ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetc_setup_tc_taprio+0x170/0x47c lr : enetc_setup_tc_taprio+0x16c/0x47c Call trace: enetc_setup_tc_taprio+0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390 Split enetc_setup_tc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there. Fixes: 34c6adf1977b ("enetc: Configure the Time-Aware Scheduler via tc-taprio offload") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220916133209.3351399-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit fed38e64d9b99d65a36c0dbadc3d3f8ddd9ea030 Author: Vladimir Oltean Date: Fri Sep 16 16:32:08 2022 +0300 net: enetc: move enetc_set_psfp() out of the common enetc_set_features() The VF netdev driver shouldn't respond to changes in the NETIF_F_HW_TC flag; only PFs should. Moreover, TSN-specific code should go to enetc_qos.c, which should not be included in the VF driver. Fixes: 79e499829f3f ("net: enetc: add hw tc hw offload features for PSPF capability") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220916133209.3351399-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0507246d9e7aaac21e14d653eea7111106e6a136 Merge: 589c6eded10c7 26c013108c12b Author: Jakub Kicinski Date: Tue Sep 20 11:26:18 2022 -0700 Merge branch 'wireguard-patches-for-6-0-rc6' Jason A. Donenfeld says: ==================== wireguard patches for 6.0-rc6 1) The ratelimiter timing test doesn't help outside of development, yet it is currently preventing the module from being inserted on some kernels when it flakes at insertion time. So we disable it. 2) A fix for a build error on UML, caused by a recent change in a different tree. 3) A WARN_ON() is triggered by Kees' new fortified memcpy() patch, due to memcpy()ing over a sockaddr pointer with the size of a sockaddr_in[6]. The type safe fix is pretty simple. Given how classic of a thing sockaddr punning is, I suspect this may be the first in a few patches like this throughout the net tree, once Kees' fortify series is more widely deployed (current it's just in next). ==================== Link: https://lore.kernel.org/r/20220916143740.831881-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 26c013108c12b94bc023bf19198a4300596c98b1 Author: Jason A. Donenfeld Date: Fri Sep 16 15:37:40 2022 +0100 wireguard: netlink: avoid variable-sized memcpy on sockaddr Doing a variable-sized memcpy is slower, and the compiler isn't smart enough to turn this into a constant-size assignment. Further, Kees' latest fortified memcpy will actually bark, because the destination pointer is type sockaddr, not explicitly sockaddr_in or sockaddr_in6, so it thinks there's an overflow: memcpy: detected field-spanning write (size 28) of single field "&endpoint.addr" at drivers/net/wireguard/netlink.c:446 (size 16) Fix this by just assigning by using explicit casts for each checked case. Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Reviewed-by: Kees Cook Reported-by: syzbot+a448cda4dba2dac50de5@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski commit 8e25c02b8cce7063ae9f08cad51d246a60370bc9 Author: Jason A. Donenfeld Date: Fri Sep 16 15:37:39 2022 +0100 wireguard: selftests: do not install headers on UML Since 1b620d539ccc ("kbuild: disable header exports for UML in a straightforward way"), installing headers fails on UML, so just disable installing them, since they're not needed anyway on the architecture. Fixes: b438b3b8d6e6 ("wireguard: selftests: support UML") Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 684dec3cf45da2b0848298efae4adf3b2aeafeda Author: Jason A. Donenfeld Date: Fri Sep 16 15:37:38 2022 +0100 wireguard: ratelimiter: disable timings test by default A previous commit tried to make the ratelimiter timings test more reliable but in the process made it less reliable on other configurations. This is an impossible problem to solve without increasingly ridiculous heuristics. And it's not even a problem that actually needs to be solved in any comprehensive way, since this is only ever used during development. So just cordon this off with a DEBUG_ ifdef, just like we do for the trie's randomized tests, so it can be enabled while hacking on the code, and otherwise disabled in CI. In the process we also revert 151c8e499f47. Fixes: 151c8e499f47 ("wireguard: ratelimiter: use hrtimer in selftest") Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 589c6eded10c77a12b7b2cf235b6b19a2bdb91fa Author: Íñigo Huguet Date: Thu Sep 15 16:19:58 2022 +0200 sfc/siena: fix null pointer dereference in efx_hard_start_xmit Like in previous patch for sfc, prevent potential (but unlikely) NULL pointer dereference. Fixes: 12804793b17c ("sfc: decouple TXQ type from label") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Link: https://lore.kernel.org/r/20220915141958.16458-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 974bb793aded499491246f6f9826e26c2b127320 Author: Íñigo Huguet Date: Thu Sep 15 16:16:53 2022 +0200 sfc/siena: fix TX channel offset when using legacy interrupts As in previous commit for sfc, fix TX channels offset when efx_siena_separate_tx_channels is false (the default) Fixes: 25bde571b4a8 ("sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Link: https://lore.kernel.org/r/20220915141653.15504-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 60891ec99e141b74544d11e897a245ef06263052 Merge: 84a31938831f6 2dd7e7bc02829 Author: Linus Torvalds Date: Tue Sep 20 10:23:24 2022 -0700 Merge tag 'for-6.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - two fixes for hangs in the umount sequence where threads depend on each other and the work must be finished in the right order - in zoned mode, wait for flushing all block group metadata IO before finishing the zone * tag 'for-6.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: wait for extent buffer IOs before finishing a zone btrfs: fix hang during unmount when stopping a space reclaim worker btrfs: fix hang during unmount when stopping block group reclaim worker commit 84a31938831f6d2338ceffe630a1271ec2a51a59 Merge: f489921dba468 f52d74b190f8d Author: Linus Torvalds Date: Tue Sep 20 10:08:37 2022 -0700 Merge tag 'fs.fixes.v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs fix from Christian Brauner: "Beginning of the merge window we introduced the vfs{g,u}id_t types in b27c82e12965 ("attr: port attribute changes to new types") and changed various codepaths over including chown_common(). When userspace passes -1 for an ownership change the ownership fields in struct iattr stay uninitialized. Usually this is fine because any code making use of any fields in struct iattr must check the ->ia_valid field whether the value of interest has been initialized. That's true for all struct iattr passing code. However, over the course of the last year with more heavy use of KMSAN we found quite a few places that got this wrong. A recent one I fixed was 3cb6ee991496 ("9p: only copy valid iattrs in 9P2000.L setattr implementation"). But we also have LSM hooks. Actually we have two. The first one is security_inode_setattr() in notify_change() which does the right thing and passes the full struct iattr down to LSMs and thus LSMs can check whether it is initialized. But then we also have security_path_chown() which passes down a path argument and the target ownership as the filesystem would see it. For the latter we now generate the target values based on struct iattr and pass it down. However, when userspace passes -1 then struct iattr isn't initialized. This patch simply initializes ->ia_vfs{g,u}id with INVALID_VFS{G,U}ID so the hook continue to see invalid ownership when -1 is passed from userspace. The only LSM that cares about the actual values is Tomoyo. The vfs codepaths don't look at these fields without ->ia_valid being set so there's no harm in initializing ->ia_vfs{g,u}id. Arguably this is also safer since we can't end up copying valid ownership values when invalid ownership values should be passed. This only affects mainline. No kernel has been released with this and thus no backport is needed. The commit is thus marked with a Fixes: tag but annotated with "# mainline only" (I didn't quite remember what Greg said about how to tell stable autoselect to not bother with fixes for mainline only)" * tag 'fs.fixes.v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: open: always initialize ownership fields commit 7da5b13dccd99cfdc42940fc7adcb88647023292 Author: Guilherme G. Piccoli Date: Fri Sep 9 16:42:14 2022 -0300 efi: efibc: Guard against allocation failure There is a single kmalloc in this driver, and it's not currently guarded against allocation failure. Do it here by just bailing-out the reboot handler, in case this tentative allocation fails. Fixes: 416581e48679 ("efi: efibc: avoid efivar API for setting variables") Signed-off-by: Guilherme G. Piccoli Signed-off-by: Ard Biesheuvel commit f489921dba468b3d208a5234dcbf7f21a615f395 Merge: 521a547ced647 33a2d6bc3480f Author: Linus Torvalds Date: Tue Sep 20 08:38:55 2022 -0700 Merge tag 'execve-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve reverts from Kees Cook: "The recent work to support time namespace unsharing turns out to have some undesirable corner cases, so rather than allowing the API to stay exposed for another release, it'd be best to remove it ASAP, with the replacement getting another cycle of testing. Nothing is known to use this yet, so no userspace breakage is expected. For more details, see: https://lore.kernel.org/lkml/ed418e43ad28b8688cfea2b7c90fce1c@ispras.ru Summary: - Remove the recent 'unshare time namespace on vfork+exec' feature (Andrei Vagin)" * tag 'execve-v6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: Revert "fs/exec: allow to unshare a time namespace on vfork+exec" Revert "selftests/timens: add a test for vfork+exit" commit d547c1b717fc5a1e062307e1efdf81590ba9f6c1 Author: Tetsuo Handa Date: Wed Sep 14 18:51:54 2022 +0900 net: clear msg_get_inq in __get_compat_msghdr() syzbot is still complaining uninit-value in tcp_recvmsg(), for commit 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()") missed that __get_compat_msghdr() is called instead of copy_msghdr_from_user() when MSG_CMSG_COMPAT is specified. Signed-off-by: Tetsuo Handa Fixes: 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()") Reviewed-by: Jens Axboe Link: https://lore.kernel.org/r/d06d0f7f-696c-83b4-b2d5-70b5f2730a37@I-love.SAKURA.ne.jp Signed-off-by: Jakub Kicinski commit 68fe503c2b8065791c98979790a7b91e198d3006 Merge: cf412ec333250 2b5a8c8f59d9d Author: Jakub Kicinski Date: Tue Sep 20 08:22:20 2022 -0700 Merge branch 'ipmr-always-call-ip-6-_mr_forward-from-rcu-read-side-critical-section' Ido Schimmel says: ==================== ipmr: Always call ip{,6}_mr_forward() from RCU read-side critical section Patch #1 fixes a bug in ipmr code. Patch #2 adds corresponding test cases. ==================== Link: https://lore.kernel.org/r/20220914075339.4074096-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 2b5a8c8f59d9dff49f273bafbde57d5a7dc2706a Author: Ido Schimmel Date: Wed Sep 14 10:53:39 2022 +0300 selftests: forwarding: Add test cases for unresolved multicast routes Add IPv4 and IPv6 test cases for unresolved multicast routes, testing that queued packets are forwarded after installing a matching (S, G) route. The test cases can be used to reproduce the bugs fixed in "ipmr: Always call ip{,6}_mr_forward() from RCU read-side critical section". Signed-off-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit b07a9b26e2b1aa3711fd6935eccb08a463b1fb11 Author: Ido Schimmel Date: Wed Sep 14 10:53:38 2022 +0300 ipmr: Always call ip{,6}_mr_forward() from RCU read-side critical section These functions expect to be called from RCU read-side critical section, but this only happens when invoked from the data path via ip{,6}_mr_input(). They can also be invoked from process context in response to user space adding a multicast route which resolves a cache entry with queued packets [1][2]. Fix by adding missing rcu_read_lock() / rcu_read_unlock() in these call paths. [1] WARNING: suspicious RCU usage 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Not tainted ----------------------------- net/ipv4/ipmr.c:84 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by smcrouted/246: #0: ffffffff862389b0 (rtnl_mutex){+.+.}-{3:3}, at: ip_mroute_setsockopt+0x11c/0x1420 stack backtrace: CPU: 0 PID: 246 Comm: smcrouted Not tainted 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 Call Trace: dump_stack_lvl+0x91/0xb9 vif_dev_read+0xbf/0xd0 ipmr_queue_xmit+0x135/0x1ab0 ip_mr_forward+0xe7b/0x13d0 ipmr_mfc_add+0x1a06/0x2ad0 ip_mroute_setsockopt+0x5c1/0x1420 do_ip_setsockopt+0x23d/0x37f0 ip_setsockopt+0x56/0x80 raw_setsockopt+0x219/0x290 __sys_setsockopt+0x236/0x4d0 __x64_sys_setsockopt+0xbe/0x160 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [2] WARNING: suspicious RCU usage 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Not tainted ----------------------------- net/ipv6/ip6mr.c:69 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by smcrouted/246: #0: ffffffff862389b0 (rtnl_mutex){+.+.}-{3:3}, at: ip6_mroute_setsockopt+0x6b9/0x2630 stack backtrace: CPU: 1 PID: 246 Comm: smcrouted Not tainted 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 Call Trace: dump_stack_lvl+0x91/0xb9 vif_dev_read+0xbf/0xd0 ip6mr_forward2.isra.0+0xc9/0x1160 ip6_mr_forward+0xef0/0x13f0 ip6mr_mfc_add+0x1ff2/0x31f0 ip6_mroute_setsockopt+0x1825/0x2630 do_ipv6_setsockopt+0x462/0x4440 ipv6_setsockopt+0x105/0x140 rawv6_setsockopt+0xd8/0x690 __sys_setsockopt+0x236/0x4d0 __x64_sys_setsockopt+0xbe/0x160 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: ebc3197963fc ("ipmr: add rcu protection over (struct vif_device)->dev") Signed-off-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit cf412ec333250cb82bafe57169204e14a9f1c2ac Author: Alex Elder Date: Tue Sep 13 15:46:02 2022 -0500 net: ipa: properly limit modem routing table use IPA can route packets between IPA-connected entities. The AP and modem are currently the only such entities supported, and no routing is required to transfer packets between them. The number of entries in each routing table is fixed, and defined at initialization time. Some of these entries are designated for use by the modem, and the rest are available for the AP to use. The AP sends a QMI message to the modem which describes (among other things) information about routing table memory available for the modem to use. Currently the QMI initialization packet gives wrong information in its description of routing tables. What *should* be supplied is the maximum index that the modem can use for the routing table memory located at a given location. The current code instead supplies the total *number* of routing table entries. Furthermore, the modem is granted the entire table, not just the subset it's supposed to use. This patch fixes this. First, the ipa_mem_bounds structure is generalized so its "end" field can be interpreted either as a final byte offset, or a final array index. Second, the IPv4 and IPv6 (non-hashed and hashed) table information fields in the QMI ipa_init_modem_driver_req structure are changed to be ipa_mem_bounds rather than ipa_mem_array structures. Third, we set the "end" value for each routing table to be the last index, rather than setting the "count" to be the number of indices. Finally, instead of allowing the modem to use all of a routing table's memory, it is limited to just the portion meant to be used by the modem. In all versions of IPA currently supported, that is IPA_ROUTE_MODEM_COUNT (8) entries. Update a few comments for clarity. Fixes: 530f9216a9537 ("soc: qcom: ipa: AP/modem communications") Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20220913204602.1803004-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 1c48709e6d9d353acaaac1d8e33474756b121d78 Author: Liang He Date: Tue Sep 13 20:56:59 2022 +0800 of: mdio: Add of_node_put() when breaking out of for_each_xx In of_mdiobus_register(), we should call of_node_put() for 'child' escaped out of for_each_available_child_of_node(). Fixes: 66bdede495c7 ("of_mdio: Fix broken PHY IRQ in case of probe deferral") Co-developed-by: Miaoqian Lin Signed-off-by: Miaoqian Lin Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220913125659.3331969-1-windhl@126.com Signed-off-by: Jakub Kicinski commit d119888b09bd567e07c6b93a07f175df88857e02 Author: Chris Wilson Date: Fri Sep 16 11:24:03 2022 +0200 drm/i915/gem: Really move i915_gem_context.link under ref protection i915_perf assumes that it can use the i915_gem_context reference to protect its i915->gem.contexts.list iteration. However, this requires that we do not remove the context from the list until after we drop the final reference and release the struct. If, as currently, we remove the context from the list during context_close(), the link.next pointer may be poisoned while we are holding the context reference and cause a GPF: [ 4070.573157] i915 0000:00:02.0: [drm:i915_perf_open_ioctl [i915]] filtering on ctx_id=0x1fffff ctx_id_mask=0x1fffff [ 4070.574881] general protection fault, probably for non-canonical address 0xdead000000000100: 0000 [#1] PREEMPT SMP [ 4070.574897] CPU: 1 PID: 284392 Comm: amd_performance Tainted: G E 5.17.9 #180 [ 4070.574903] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017 [ 4070.574907] RIP: 0010:oa_configure_all_contexts.isra.0+0x222/0x350 [i915] [ 4070.574982] Code: 08 e8 32 6e 10 e1 4d 8b 6d 50 b8 ff ff ff ff 49 83 ed 50 f0 41 0f c1 04 24 83 f8 01 0f 84 e3 00 00 00 85 c0 0f 8e fa 00 00 00 <49> 8b 45 50 48 8d 70 b0 49 8d 45 50 48 39 44 24 10 0f 85 34 fe ff [ 4070.574990] RSP: 0018:ffffc90002077b78 EFLAGS: 00010202 [ 4070.574995] RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000000 [ 4070.575000] RDX: 0000000000000001 RSI: ffffc90002077b20 RDI: ffff88810ddc7c68 [ 4070.575004] RBP: 0000000000000001 R08: ffff888103242648 R09: fffffffffffffffc [ 4070.575008] R10: ffffffff82c50bc0 R11: 0000000000025c80 R12: ffff888101bf1860 [ 4070.575012] R13: dead0000000000b0 R14: ffffc90002077c04 R15: ffff88810be5cabc [ 4070.575016] FS: 00007f1ed50c0780(0000) GS:ffff88885ec80000(0000) knlGS:0000000000000000 [ 4070.575021] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4070.575025] CR2: 00007f1ed5590280 CR3: 000000010ef6f005 CR4: 00000000003706e0 [ 4070.575029] Call Trace: [ 4070.575033] [ 4070.575037] lrc_configure_all_contexts+0x13e/0x150 [i915] [ 4070.575103] gen8_enable_metric_set+0x4d/0x90 [i915] [ 4070.575164] i915_perf_open_ioctl+0xbc0/0x1500 [i915] [ 4070.575224] ? asm_common_interrupt+0x1e/0x40 [ 4070.575232] ? i915_oa_init_reg_state+0x110/0x110 [i915] [ 4070.575290] drm_ioctl_kernel+0x85/0x110 [ 4070.575296] ? update_load_avg+0x5f/0x5e0 [ 4070.575302] drm_ioctl+0x1d3/0x370 [ 4070.575307] ? i915_oa_init_reg_state+0x110/0x110 [i915] [ 4070.575382] ? gen8_gt_irq_handler+0x46/0x130 [i915] [ 4070.575445] __x64_sys_ioctl+0x3c4/0x8d0 [ 4070.575451] ? __do_softirq+0xaa/0x1d2 [ 4070.575456] do_syscall_64+0x35/0x80 [ 4070.575461] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 4070.575467] RIP: 0033:0x7f1ed5c10397 [ 4070.575471] Code: 3c 1c e8 1c ff ff ff 85 c0 79 87 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a9 da 0d 00 f7 d8 64 89 01 48 [ 4070.575478] RSP: 002b:00007ffd65c8d7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 4070.575484] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f1ed5c10397 [ 4070.575488] RDX: 00007ffd65c8d7c0 RSI: 0000000040106476 RDI: 0000000000000006 [ 4070.575492] RBP: 00005620972f9c60 R08: 000000000000000a R09: 0000000000000005 [ 4070.575496] R10: 000000000000000d R11: 0000000000000246 R12: 000000000000000a [ 4070.575500] R13: 000000000000000d R14: 0000000000000000 R15: 00007ffd65c8d7c0 [ 4070.575505] [ 4070.575507] Modules linked in: nls_ascii(E) nls_cp437(E) vfat(E) fat(E) i915(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) aesni_intel(E) crypto_simd(E) intel_gtt(E) cryptd(E) ttm(E) rapl(E) intel_cstate(E) drm_kms_helper(E) cfbfillrect(E) syscopyarea(E) cfbimgblt(E) intel_uncore(E) sysfillrect(E) mei_me(E) sysimgblt(E) i2c_i801(E) fb_sys_fops(E) mei(E) intel_pch_thermal(E) i2c_smbus(E) cfbcopyarea(E) video(E) button(E) efivarfs(E) autofs4(E) [ 4070.575549] ---[ end trace 0000000000000000 ]--- v3: fix incorrect syntax of spin_lock() replacing spin_lock_irqsave() v2: irqsave not required in a worker, neither conversion to irq safe elsewhere (Tvrtko), - perf: it's safe to call gen8_configure_context() even if context has been closed, no need to check, - drop unrelated cleanup (Andi, Tvrtko) Reported-by: Mark Janes Closes: https://gitlab.freedesktop.org/drm/intel/issues/6222 References: a4e7ccdac38e ("drm/i915: Move context management under GEM") Fixes: f8246cf4d9a9 ("drm/i915/gem: Drop free_work for GEM contexts") Signed-off-by: Chris Wilson Reviewed-by: Andi Shyti Signed-off-by: Janusz Krzysztofik Cc: Tvrtko Ursulin Cc: # v5.12+ Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20220916092403.201355-3-janusz.krzysztofik@linux.intel.com (cherry picked from commit ad3aa7c31efa5a09b0dba42e66cfdf77e0db7dc2) Signed-off-by: Rodrigo Vivi commit 5ce8f7444f8fbb5adee644590c0e4e1890ab004c Author: Janusz Krzysztofik Date: Fri Sep 16 11:24:02 2022 +0200 drm/i915/gem: Flush contexts on driver release Due to i915_perf assuming that it can use the i915_gem_context reference to protect its i915->gem.contexts.list iteration, we need to defer removal of the context from the list until last reference to the context is put. However, there is a risk of triggering kernel warning on contexts list not empty at driver release time if we deleagate that task to a worker for i915_gem_context_release_work(), unless that work is flushed first. Unfortunately, it is not flushed on driver release. Fix it. Instead of additionally calling flush_workqueue(), either directly or via a new dedicated wrapper around it, replace last call to i915_gem_drain_freed_objects() with existing i915_gem_drain_workqueue() that performs both tasks. Fixes: 75eefd82581f ("drm/i915: Release i915_gem_context from a worker") Suggested-by: Chris Wilson Signed-off-by: Janusz Krzysztofik Reviewed-by: Andi Shyti Cc: stable@kernel.org # v5.16+ Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20220916092403.201355-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit 1cec34442408a77ba5396b19725fed2c398005c3) Signed-off-by: Rodrigo Vivi commit 4c66a326b5ab784cddd72de07ac5b6210e9e1b06 Author: Christoph Hellwig Date: Mon Sep 19 16:40:49 2022 +0200 Revert "block: freeze the queue earlier in del_gendisk" This reverts commit a09b314005f3a0956ebf56e01b3b80339df577cc. Dusty Mabe reported consistent hang during CoreOS shutdown with a MD RAID1 setup. Although apparently similar hangs happened before, and this patch most likely is not the root cause it made it much more severe. Revert it until we can figure out what is going on with the md driver. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220919144049.978907-1-hch@lst.de Signed-off-by: Jens Axboe commit ab637d48363d7b8ee67ae089808a8bc6051d53c4 Author: Linus Walleij Date: Thu Sep 15 22:32:54 2022 +0200 gpio: ftgpio010: Make irqchip immutable This turns the FTGPIO010 irqchip immutable. Tested on the D-Link DIR-685. Cc: Marc Zyngier Signed-off-by: Linus Walleij Acked-by: Marc Zyngier Signed-off-by: Bartosz Golaszewski commit 02743c4091ccfb246f5cdbbe3f44b152d5d12933 Author: Andy Shevchenko Date: Tue Sep 20 16:30:31 2022 +0300 gpio: mockup: Fix potential resource leakage when register a chip If creation of software node fails, the locally allocated string array is left unfreed. Free it on error path. Fixes: 6fda593f3082 ("gpio: mockup: Convert to use software nodes") Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit b7df41a6f79dfb18ba2203f8c5f0e9c0b9b57f68 Author: Bartosz Golaszewski Date: Tue Sep 20 09:18:41 2022 +0200 gpio: mockup: fix NULL pointer dereference when removing debugfs We now remove the device's debugfs entries when unbinding the driver. This now causes a NULL-pointer dereference on module exit because the platform devices are unregistered *after* the global debugfs directory has been recursively removed. Fix it by unregistering the devices first. Fixes: 303e6da99429 ("gpio: mockup: remove gpio debugfs when remove device") Cc: Wei Yongjun Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski commit db4192a754ebd52300a28abe1a50dd18eae0eb12 Author: Cong Wang Date: Mon Sep 12 10:35:53 2022 -0700 tcp: read multiple skbs in tcp_read_skb() Before we switched to ->read_skb(), ->read_sock() was passed with desc.count=1, which technically indicates we only read one skb per ->sk_data_ready() call. However, for TCP, this is not true. TCP at least has sk_rcvlowat which intentionally holds skb's in receive queue until this watermark is reached. This means when ->sk_data_ready() is invoked there could be multiple skb's in the queue, therefore we have to read multiple skbs in tcp_read_skb() instead of one. Fixes: 965b57b469a5 ("net: Introduce a new proto_ops ->read_skb()") Reported-by: Peilin Ye Cc: John Fastabend Cc: Jakub Sitnicki Cc: Eric Dumazet Signed-off-by: Cong Wang Link: https://lore.kernel.org/r/20220912173553.235838-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni commit 79764ec772bc1346441ae1c4b1f3bd1991d634e8 Author: Takashi Iwai Date: Tue Sep 20 13:39:29 2022 +0200 Revert "ALSA: usb-audio: Split endpoint setups for hw_params and prepare" This reverts commit ff878b408a03bef5d610b7e2302702e16a53636e. Unfortunately the recent fix seems bringing another regressions with PulseAudio / pipewire, at least for Steinberg and MOTU devices. As a temporary solution, do a straight revert. The issue for Android will be revisited again later by another different fix (if any). Fixes: ff878b408a03 ("ALSA: usb-audio: Split endpoint setups for hw_params and prepare") Cc: BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216500 Link: https://lore.kernel.org/r/20220920113929.25162-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 90fdd1c1e9c49bcb46cde589dbdee94a6977086a Merge: 807e5eda20783 01b825f997ac2 Author: Paolo Abeni Date: Tue Sep 20 12:18:08 2022 +0200 Merge branch 'revert-fec-ptp-changes' Francesco Dolcini says: ==================== Revert fec PTP changes Revert the last 2 FEC PTP changes from Csókás Bence, they are causing multiple issues and we are at 6.0-rc5. ==================== Link: https://lore.kernel.org/r/20220912070143.98153-1-francesco.dolcini@toradex.com Signed-off-by: Paolo Abeni commit 01b825f997ac28f1e20309bafbf2068cd77c50a4 Author: Francesco Dolcini Date: Mon Sep 12 09:01:43 2022 +0200 Revert "net: fec: Use a spinlock to guard `fep->ptp_clk_on`" This reverts commit b353b241f1eb9b6265358ffbe2632fdcb563354f, this is creating multiple issues, just not ready to be merged yet. Link: https://lore.kernel.org/all/CAHk-=wj1obPoTu1AHj9Bd_BGYjdjDyPP+vT5WMj8eheb3A9WHw@mail.gmail.com/ Link: https://lore.kernel.org/all/20220907143915.5w65kainpykfobte@pengutronix.de/ Fixes: b353b241f1eb ("net: fec: Use a spinlock to guard `fep->ptp_clk_on`") Signed-off-by: Francesco Dolcini Reviewed-by: Andrew Lunn Tested-by: Marc Kleine-Budde Signed-off-by: Paolo Abeni commit 7b15515fc1ca3b320fe37793aaaf6f56cc964ef4 Author: Francesco Dolcini Date: Mon Sep 12 09:01:42 2022 +0200 Revert "fec: Restart PPS after link state change" This reverts commit f79959220fa5fbda939592bf91c7a9ea90419040, this is creating multiple issues, just not ready to be merged yet. Link: https://lore.kernel.org/all/20220905180542.GA3685102@roeck-us.net/ Link: https://lore.kernel.org/all/CAHk-=wj1obPoTu1AHj9Bd_BGYjdjDyPP+vT5WMj8eheb3A9WHw@mail.gmail.com/ Fixes: f79959220fa5 ("fec: Restart PPS after link state change") Signed-off-by: Francesco Dolcini Reviewed-by: Andrew Lunn Tested-by: Marc Kleine-Budde Signed-off-by: Paolo Abeni commit 807e5eda2078327d1adaf213cf7d6b3862cad1f4 Author: Rakesh Sankaranarayanan Date: Mon Sep 12 10:42:28 2022 +0530 net: dsa: microchip: lan937x: fix maximum frame length check Maximum frame length check is enabled in lan937x switch on POR, But it is found to be disabled on driver during port setup operation. Due to this, packets are not dropped when transmitted with greater than configured value. For testing, setup made for lan1->lan2 transmission and configured lan1 interface with a frame length (less than 1500 as mentioned in documentation) and transmitted packets with greater than configured value. Expected no packets at lan2 end, but packets observed at lan2. Based on the documentation, packets should get discarded if the actual packet length doesn't match the frame length configured. Frame length check should be disabled only for cascaded ports due to tailtags. This feature was disabled on ksz9477 series due to ptp issue, which is not in lan937x series. But since lan937x took ksz9477 as base, frame length check disabled here as well. Patch added to remove this portion from port setup so that maximum frame length check will be active for normal ports. Fixes: 55ab6ffaf378 ("net: dsa: microchip: add DSA support for microchip LAN937x") Signed-off-by: Rakesh Sankaranarayanan Link: https://lore.kernel.org/r/20220912051228.1306074-1-rakesh.sankaranarayanan@microchip.com Signed-off-by: Paolo Abeni commit f52d74b190f8d10ec01cd5774eca77c2186c8ab7 Author: Tetsuo Handa Date: Mon Sep 19 20:05:12 2022 +0900 open: always initialize ownership fields Beginning of the merge window we introduced the vfs{g,u}id_t types in b27c82e12965 ("attr: port attribute changes to new types") and changed various codepaths over including chown_common(). During that change we forgot to account for the case were the passed ownership value is -1. In this case the ownership fields in struct iattr aren't initialized but we rely on them being initialized by the time we generate the ownership to pass down to the LSMs. All the major LSMs don't care about the ownership values at all. Only Tomoyo uses them and so it took a while for syzbot to unearth this issue. Fix this by initializing the ownership fields and do it within the retry_deleg block. While notify_change() doesn't alter the ownership fields currently we shouldn't rely on it. Since no kernel has been released with these changes this does not needed to be backported to any stable kernels. [Christian Brauner (Microsoft) ] * rewrote commit message * use INVALID_VFS{G,U}ID macros Fixes: b27c82e12965 ("attr: port attribute changes to new types") # mainline only Reported-and-tested-by: syzbot+541e21dcc32c4046cba9@syzkaller.appspotmail.com Signed-off-by: Tetsuo Handa Reviewed-by: Seth Forshee (DigitalOcean) Signed-off-by: Christian Brauner (Microsoft) commit d8a79c03054911c375a2252627a429c9bc4615b6 Author: Randy Dunlap Date: Mon May 30 19:55:57 2022 -0700 drm/hisilicon: Add depends on MMU The Kconfig symbol depended on MMU but was dropped by the commit acad3fe650a5 ("drm/hisilicon: Removed the dependency on the mmu") because it already had as a dependency ARM64 that already selects MMU. But later, commit a0f25a6bb319 ("drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled") allowed the driver to be built for non-ARM64 when COMPILE_TEST is set but that could lead to unmet direct dependencies and linking errors. Prevent a kconfig warning when MMU is not enabled by making DRM_HISI_HIBMC depend on MMU. WARNING: unmet direct dependencies detected for DRM_TTM Depends on [n]: HAS_IOMEM [=y] && DRM [=m] && MMU [=n] Selected by [m]: - DRM_TTM_HELPER [=m] && HAS_IOMEM [=y] && DRM [=m] - DRM_HISI_HIBMC [=m] && HAS_IOMEM [=y] && DRM [=m] && PCI [=y] && (ARM64 || COMPILE_TEST [=y]) Fixes: acad3fe650a5 ("drm/hisilicon: Removed the dependency on the mmu") Signed-off-by: Randy Dunlap Cc: Gerd Hoffmann Cc: Thomas Zimmermann Cc: Xinliang Liu Cc: Tian Tao Cc: John Stultz Cc: Xinwei Kong Cc: Chen Feng Cc: Christian Koenig Cc: Huang Rui Cc: David Airlie Cc: Daniel Vetter Reviewed-by: Javier Martinez Canillas Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220531025557.29593-1-rdunlap@infradead.org commit 5415bec18c69d3aaa7d4e3b170c8b8c6bb24a823 Author: Thomas Zimmermann Date: Thu Sep 15 17:03:48 2022 +0200 drm/mgag200: Force 32 bpp on the console G200ER does not seem to support 24 bpp, so force the console to use 32 bpp. The problem got introduced when commit 73f54d5d9682 ("drm/mgag200: Remove special case for G200SE with <2 MiB") changed the preferred color depth from 32 bit to 24 bit. A setting of 24 is the correct color depth, but G200ER doesn't seem to be able to use the respective RGB888 color format. Using 24-bit color with forced 32 bpp works around the problem. Reported-by: Wang Yugui Signed-off-by: Thomas Zimmermann Tested-by: Wang Yugui Reviewed-by: Jocelyn Falempe Fixes: 73f54d5d9682 ("drm/mgag200: Remove special case for G200SE with <2 MiB") Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Link: https://patchwork.freedesktop.org/patch/msgid/20220915150348.31504-1-tzimmermann@suse.de commit 8ccac4edc8da764389d4fc18b1df740892006557 Author: Shailend Chand Date: Mon Sep 12 17:09:01 2022 -0700 gve: Fix GFP flags when allocing pages Use GFP_ATOMIC when allocating pages out of the hotpath, continue to use GFP_KERNEL when allocating pages during setup. GFP_KERNEL will allow blocking which allows it to succeed more often in a low memory enviornment but in the hotpath we do not want to allow the allocation to block. Fixes: 9b8dd5e5ea48b ("gve: DQO: Add RX path") Signed-off-by: Shailend Chand Signed-off-by: Jeroen de Borst Link: https://lore.kernel.org/r/20220913000901.959546-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit ae8ffba8baad651af706538e8c47d0a049d406c6 Author: Vadim Fedorenko Date: Fri Sep 16 02:49:32 2022 +0300 bnxt_en: fix flags to check for supported fw version The warning message of unsupported FW appears every time RX timestamps are disabled on the interface. The patch fixes the flags to correct set for the check. Fixes: 66ed81dcedc6 ("bnxt_en: Enable packet timestamping for all RX packets") Cc: Richard Cochran Signed-off-by: Vadim Fedorenko Reviewed-by: Andy Gospodarek Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20220915234932.25497-1-vfedorenko@novek.ru Signed-off-by: Jakub Kicinski commit 094cc3b649e27b43afb9bc44d3417668c3d53e19 Merge: 0ee513c773695 781b80f452fcc Author: Jakub Kicinski Date: Mon Sep 19 18:17:22 2022 -0700 Merge tag 'wireless-2022-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.0 Late stage fixes for v6.0. Temporarily mark iwlwifi's mei code broken as it breaks suspend for iwd users and also don't spam nss trimming messages. mt76 has fixes for aggregation sequence numbers and a regression related to the VHT extended NSS BW feature. * tag 'wireless-2022-09-19' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mt76: fix 5 GHz connection regression on mt76x0/mt76x2 wifi: mt76: fix reading current per-tid starting sequence number for aggregation wifi: iwlwifi: Mark IWLMEI as broken wifi: iwlwifi: don't spam logs with NSS>2 messages ==================== Link: https://lore.kernel.org/r/20220919105003.1EAE7C433B5@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 0ee513c773695e6fa6b615b24539f2a59c7c1f06 Merge: 0a242eb2913a4 b1cb8a71f1eae Author: Jakub Kicinski Date: Mon Sep 19 18:13:43 2022 -0700 Merge tag 'batadv-net-pullrequest-20220916' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - Fix hang up with small MTU hard-interface, by Shigeru Yoshida * tag 'batadv-net-pullrequest-20220916' of git://git.open-mesh.org/linux-merge: batman-adv: Fix hang up with small MTU hard-interface ==================== Link: https://lore.kernel.org/r/20220916160931.1412407-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 0a242eb2913a4aa3d6fbdb86559f27628e9466f3 Author: Íñigo Huguet Date: Wed Sep 14 13:11:35 2022 +0200 sfc: fix null pointer dereference in efx_hard_start_xmit Trying to get the channel from the tx_queue variable here is wrong because we can only be here if tx_queue is NULL, so we shouldn't dereference it. As the above comment in the code says, this is very unlikely to happen, but it's wrong anyway so let's fix it. I hit this issue because of a different bug that caused tx_queue to be NULL. If that happens, this is the error message that we get here: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [...] RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc] Fixes: 12804793b17c ("sfc: decouple TXQ type from label") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Acked-by: Edward Cree Link: https://lore.kernel.org/r/20220914111135.21038-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit f232af4295653afa4ade3230462b3be15ad16419 Author: Íñigo Huguet Date: Wed Sep 14 12:36:48 2022 +0200 sfc: fix TX channel offset when using legacy interrupts In legacy interrupt mode the tx_channel_offset was hardcoded to 1, but that's not correct if efx_sepparate_tx_channels is false. In that case, the offset is 0 because the tx queues are in the single existing channel at index 0, together with the rx queue. Without this fix, as soon as you try to send any traffic, it tries to get the tx queues from an uninitialized channel getting these errors: WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit+0x12e/0x170 [sfc] [...] RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc] [...] Call Trace: dev_hard_start_xmit+0xd7/0x230 sch_direct_xmit+0x9f/0x360 __dev_queue_xmit+0x890/0xa40 [...] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [...] RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc] [...] Call Trace: dev_hard_start_xmit+0xd7/0x230 sch_direct_xmit+0x9f/0x360 __dev_queue_xmit+0x890/0xa40 [...] Fixes: c308dfd1b43e ("sfc: fix wrong tx channel offset with efx_separate_tx_channels") Reported-by: Tianhao Zhao Signed-off-by: Íñigo Huguet Acked-by: Edward Cree Link: https://lore.kernel.org/r/20220914103648.16902-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 95b9fd760b7a32f738f225ec041c980e7941c73a Merge: 5e69163d3b993 35e60f1aadf6c Author: Jakub Kicinski Date: Mon Sep 19 18:01:04 2022 -0700 Merge tag 'for-net-2022-09-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix HCIGETDEVINFO regression * tag 'for-net-2022-09-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: Fix HCIGETDEVINFO regression ==================== Link: https://lore.kernel.org/r/20220909201642.3810565-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 5e69163d3b9931098922b3fc2f8e786af8c1f37e Author: Lorenzo Bianconi Date: Tue Sep 13 15:03:05 2022 +0200 net: ethernet: mtk_eth_soc: enable XDP support just for MT7986 SoC Disable page_pool/XDP support for MT7621 SoC in order fix a regression introduce adding XDP for MT7986 SoC. There is no a real use case for XDP on MT7621 since it is a low-end cpu. Moreover this patch reduces the memory footprint. Tested-by: Sergio Paracuellos Tested-by: Arınç ÜNAL Fixes: 23233e577ef9 ("net: ethernet: mtk_eth_soc: rely on page_pool for single page buffers") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/2bf31e27b888c43228b0d84dd2ef5033338269e2.1663074002.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 6fd2c68da55c552f86e401ebe40c4a619025ef69 Author: Haiyang Zhang Date: Sun Sep 11 13:40:05 2022 -0700 net: mana: Add rmb after checking owner bits Per GDMA spec, rmb is necessary after checking owner_bits, before reading EQ or CQ entries. Add rmb in these two places to comply with the specs. Cc: stable@vger.kernel.org Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reported-by: Sinan Kaya Signed-off-by: Haiyang Zhang Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1662928805-15861-1-git-send-email-haiyangz@microsoft.com Signed-off-by: Jakub Kicinski commit 6fb2dbdb26893b6423cbf419a56a85d824619fd8 Author: Jeroen de Borst Date: Tue Sep 13 11:53:19 2022 -0700 MAINTAINERS: gve: update developers Updating active developers. Signed-off-by: Jeroen de Borst Link: https://lore.kernel.org/r/20220913185319.1061909-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit 34513ada53eb3e3f711250d8dbc2de4de493d510 Author: Ido Schimmel Date: Fri Sep 9 18:38:30 2022 +0300 netdevsim: Fix hwstats debugfs file permissions The hwstats debugfs files are only writeable, but they are created with read and write permissions, causing certain selftests to fail [1]. Fix by creating the files with write permission only. [1] # ./test_offload.py Test destruction of generic XDP... Traceback (most recent call last): File "/home/idosch/code/linux/tools/testing/selftests/bpf/./test_offload.py", line 810, in simdev = NetdevSimDev() [...] Exception: Command failed: cat /sys/kernel/debug/netdevsim/netdevsim0//ports/0/dev/hwstats/l3/disable_ifindex cat: /sys/kernel/debug/netdevsim/netdevsim0//ports/0/dev/hwstats/l3/disable_ifindex: Invalid argument Fixes: 1a6d7ae7d63c ("netdevsim: Introduce support for L3 offload xstats") Reported-by: Jie2x Zhou Tested-by: Jie2x Zhou Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Link: https://lore.kernel.org/r/20220909153830.3732504-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 198eb7e1b81d8ba676d0f4f120c092032ae69a8e Author: Michal Jaron Date: Thu Sep 1 09:49:33 2022 +0200 i40e: Fix set max_tx_rate when it is lower than 1 Mbps While converting max_tx_rate from bytes to Mbps, this value was set to 0, if the original value was lower than 125000 bytes (1 Mbps). This would cause no transmission rate limiting to occur. This happened due to lack of check of max_tx_rate against the 1 Mbps value for max_tx_rate and the following division by 125000. Fix this issue by adding a helper i40e_bw_bytes_to_mbits() which sets max_tx_rate to minimum usable value of 50 Mbps, if its value is less than 1 Mbps, otherwise do the required conversion by dividing by 125000. Fixes: 5ecae4120a6b ("i40e: Refactor VF BW rate limiting") Signed-off-by: Michal Jaron Signed-off-by: Andrii Staikov Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit 372539def2824c43b6afe2403045b140f65c5acc Author: Michal Jaron Date: Tue Sep 13 15:38:36 2022 +0200 i40e: Fix VF set max MTU size Max MTU sent to VF is set to 0 during memory allocation. It cause that max MTU on VF is changed to IAVF_MAX_RXBUFFER and does not depend on data from HW. Set max_mtu field in virtchnl_vf_resource struct to inform VF in GET_VF_RESOURCES msg what size should be max frame. Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx") Signed-off-by: Michal Jaron Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 399c98c4dc50b7eb7e9f24da7ffdda6f025676ef Author: Michal Jaron Date: Tue Sep 13 15:38:35 2022 +0200 iavf: Fix set max MTU size with port VLAN and jumbo frames After setting port VLAN and MTU to 9000 on VF with ice driver there was an iavf error "PF returned error -5 (IAVF_ERR_PARAM) to our request 6". During queue configuration, VF's max packet size was set to IAVF_MAX_RXBUFFER but on ice max frame size was smaller by VLAN_HLEN due to making some space for port VLAN as VF is not aware whether it's in a port VLAN. This mismatch in sizes caused ice to reject queue configuration with ERR_PARAM error. Proper max_mtu is sent from ice PF to VF with GET_VF_RESOURCES msg but VF does not look at this. In iavf change max_frame from IAVF_MAX_RXBUFFER to max_mtu received from pf with GET_VF_RESOURCES msg to make vf's max_frame_size dependent from pf. Add check if received max_mtu is not in eligible range then set it to IAVF_MAX_RXBUFFER. Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx") Signed-off-by: Michal Jaron Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 182447b12144b7be9b63a273d27c5a11bd54960a Author: David Thompson Date: Fri Sep 2 12:42:47 2022 -0400 mlxbf_gige: clear MDIO gateway lock after read The MDIO gateway (GW) lock in BlueField-2 GIGE logic is set after read. This patch adds logic to make sure the lock is always cleared at the end of each MDIO transaction. Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") Reviewed-by: Asmaa Mnebhi Signed-off-by: David Thompson Link: https://lore.kernel.org/r/20220902164247.19862-1-davthompson@nvidia.com Signed-off-by: Jakub Kicinski commit 66039eb9015eee4f7ff0c99b83c65c7ecb3c8190 Author: Norbert Zulinski Date: Wed Sep 14 15:39:13 2022 +0200 iavf: Fix bad page state Fix bad page state, free inappropriate page in handling dummy descriptor. iavf_build_skb now has to check not only if rx_buffer is NULL but also if size is zero, same thing in iavf_clean_rx_irq. Without this patch driver would free page that will be used by napi_build_skb. Fixes: a9f49e006030 ("iavf: Fix handling of dummy receive descriptors") Signed-off-by: Norbert Zulinski Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 2975e4a282964dd14831e4612ac1b6b10745e5ba Author: Vincent Whitchurch Date: Wed Sep 7 12:05:33 2022 +0200 um: Prevent KASAN splats in dump_stack() Use READ_ONCE_NOCHECK() when reading the stack to prevent KASAN splats when dump_stack() is used. Fixes: 5b301409e8bc5d7fad ("UML: add support for KASAN under x86_64") Signed-off-by: Vincent Whitchurch Reviewed-by: Dmitry Vyukov Signed-off-by: Richard Weinberger commit 782b1f70f8a8b28571949d2ba43fe88b96d75ec3 Author: Christian Lamparter Date: Sat Aug 6 21:52:22 2022 +0200 um: fix default console kernel parameter OpenWrt's UML with 5.15 was producing odd errors/warnings during preinit part of the early userspace portion: |[ 0.000000] Kernel command line: ubd0=root.img root=98:0 console=tty |[...] |[ 0.440000] random: jshn: uninitialized urandom read (4 bytes read) |[ 0.460000] random: jshn: uninitialized urandom read (4 bytes read) |/etc/preinit: line 47: can't create /dev/tty: No such device or address |/etc/preinit: line 48: can't create /dev/tty: No such device or address |/etc/preinit: line 58: can't open /dev/tty: No such device or address |[...] repeated many times That "/dev/tty" came from the command line (which is automatically added if no console= parameter was specified for the uml binary). The TLDP project tells the following about the /dev/tty: | /dev/tty stands for the controlling terminal (if any) for the current | process.[...] | /dev/tty is something like a link to the actually terminal device[..] The "(if any)" is important here, since it's possible for processes to not have a controlling terminal. I think this was a simple typo and the author wanted tty0 there. CC: Thomas Meyer Fixes: d7ffac33631b ("um: stdio_console: Make preferred console") Signed-off-by: Christian Lamparter Signed-off-by: Richard Weinberger commit d27fff3499671dc23a08efd01cdb8b3764a391c4 Author: Lukas Straub Date: Fri Aug 26 15:29:31 2022 +0000 um: Cleanup compiler warning in arch/x86/um/tls_32.c arch.tls_array is statically allocated so checking for NULL doesn't make sense. This causes the compiler warning below. Remove the checks to silence these warnings. ../arch/x86/um/tls_32.c: In function 'get_free_idx': ../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] 68 | if (!t->arch.tls_array) | ^ In file included from ../arch/x86/um/asm/processor.h:10, from ../include/linux/rcupdate.h:30, from ../include/linux/rculist.h:11, from ../include/linux/pid.h:5, from ../include/linux/sched.h:14, from ../arch/x86/um/tls_32.c:7: ../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; | ^~~~~~~~~ ../arch/x86/um/tls_32.c: In function 'get_tls_entry': ../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] 243 | if (!t->arch.tls_array) | ^ ../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; | ^~~~~~~~~ Signed-off-by: Lukas Straub Acked-by: Randy Dunlap # build-tested Signed-off-by: Richard Weinberger commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 Author: Lukas Straub Date: Fri Aug 26 15:29:27 2022 +0000 um: Cleanup syscall_handler_t cast in syscalls_32.h Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 "um: Cleanup syscall_handler_t definition/cast, fix warning", remove the cast to to fix the compiler warning. Signed-off-by: Lukas Straub Acked-by: Randy Dunlap # build-tested Signed-off-by: Richard Weinberger commit 0a0342ede303fc420f3a388e1ae82da3ae8ff6bd Author: Martin Povišer Date: Mon Sep 19 19:34:53 2022 +0200 ASoC: tas2770: Reinit regcache on reset On probe of the ASoC component, the device is reset but the regcache is retained. This means the regcache gets out of sync if the codec is rebound to a sound card for a second time. Fix it by reinitializing the regcache to defaults after the device is reset. Fixes: b0bcbe615756 ("ASoC: tas2770: Fix calling reset in probe") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220919173453.84292-1-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 7042bde216ada135b2f88423ae714ab9a22e3a22 Author: SJLIN0 Date: Thu Sep 15 09:28:00 2022 +0800 ASoC: nau8824: Fix semaphore is released unexpectedly On resuming, we anticipate that the jack is detected before playback or capture. Therefore, we use semaphore to control the jack detection done without any bothering. During booting, the driver launches jack detection and releases the semaphore. However, it doesn't perceive the maniputation of semaphore is not like resuming procedure. This makes the semaphore's count value become to 2. There is more than one thread can enter into the critical section. This may get unexpected situation and make some chaos. Signed-off-by: SJLIN0 Signed-off-by: Wallace Lin Link: https://lore.kernel.org/r/20220915012800.825196-1-SJLIN0@nuvoton.com Signed-off-by: Mark Brown commit 522c9a64c7049f50c7b1299741c13fac3f231cd4 Author: Zenghui Yu Date: Thu Sep 8 21:06:59 2022 +0800 KVM: arm64: Use kmemleak_free_part_phys() to unregister hyp_mem_base With commit 0c24e061196c ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA"), kmemleak started to put the objects allocated with physical address onto object_phys_tree_root tree. The kmemleak_free_part() therefore no longer worked as expected on physically allocated objects (hyp_mem_base in this case) as it attempted to search and remove things in object_tree_root tree. Fix it by using kmemleak_free_part_phys() to unregister hyp_mem_base. This fixes an immediate crash when booting a KVM host in protected mode with kmemleak enabled. Signed-off-by: Zenghui Yu Acked-by: Catalin Marinas Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220908130659.2021-1-yuzenghui@huawei.com commit db7ba07108a48c0f95b74fabbfd5d63e924f992d Author: Stefan Haberland Date: Mon Sep 19 17:49:31 2022 +0200 s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL. The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held. Fix by checking the pavgroup pointer with lcu->lock held. Cc: # 2.6.25+ Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20220919154931.4123002-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 4a13c949501902d4e6b59cc693005f4ca352dc15 Author: Pierre-Louis Bossart Date: Mon Sep 19 13:46:40 2022 +0200 ASoC: Intel: sof_sdw: add support for Dell SKU 0AFF Yet another SKU that needs a quirk for jack detection and four-speaker support. BugLink: https://github.com/thesofproject/linux/issues/3777 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20220919114640.42803-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e9f3f8f488005f6da3cfb66070706770ecaef747 Author: Serge Semin Date: Mon Sep 12 00:10:09 2022 +0800 MIPS: Loongson32: Fix PHY-mode being left unspecified commit 0060c8783330 ("net: stmmac: implement support for passive mode converters via dt") has changed the plat->interface field semantics from containing the PHY-mode to specifying the MAC-PCS interface mode. Due to that the loongson32 platform code will leave the phylink interface uninitialized with the PHY-mode intended by the means of the actual platform setup. The commit-author most likely has just missed the arch-specific code to fix. Let's mend the Loongson32 platform code then by assigning the PHY-mode to the phy_interface field of the STMMAC platform data. Fixes: 0060c8783330 ("net: stmmac: implement support for passive mode converters via dt") Signed-off-by: Serge Semin Signed-off-by: Keguang Zhang Tested-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit 502550123bee6a2ffa438409b5b9aad4d6db3a8c Author: Randy Dunlap Date: Sat Sep 17 16:25:40 2022 -0700 MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko The lantiq WDT driver uses clk_get_io(), which is not exported, so export it to fix a build error: ERROR: modpost: "clk_get_io" [drivers/watchdog/lantiq_wdt.ko] undefined! Fixes: 287e3f3f4e68 ("MIPS: lantiq: implement support for clkdev api") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Thomas Bogendoerfer Cc: John Crispin Cc: linux-mips@vger.kernel.org Signed-off-by: Thomas Bogendoerfer commit d71608a877362becdc94191f190902fac1e64d35 Author: Feng Tang Date: Mon Sep 19 11:12:41 2022 +0800 mm/slab_common: fix possible double free of kmem_cache When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu' kunit test case cause a use-after-free error: BUG: KASAN: use-after-free in kobject_del+0x14/0x30 Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261 CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x87/0x2a5 print_report+0x103/0x1ed kasan_report+0xb7/0x140 kobject_del+0x14/0x30 kmem_cache_destroy+0x130/0x170 test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0 The cause is inside kmem_cache_destroy(): kmem_cache_destroy acquire lock/mutex shutdown_cache schedule_work(kmem_cache_release) (if RCU flag set) release lock/mutex kmem_cache_release (if RCU flag not set) In some certain timing, the scheduled work could be run before the next RCU flag checking, which can then get a wrong value and lead to double kmem_cache_release(). Fix it by caching the RCU flag inside protected area, just like 'refcnt' Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") Signed-off-by: Feng Tang Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Reviewed-by: Waiman Long Signed-off-by: Vlastimil Babka commit c3afa2a402d1ecefa59f88d55d9e765f52f75bd9 Author: Takashi Iwai Date: Mon Sep 19 14:35:16 2022 +0200 ALSA: core: Fix double-free at snd_card_new() During the code change to add the support for devres-managed card instance, we put an explicit kfree(card) call at the error path in snd_card_new(). This is needed for the early error path before the card is initialized with the device, but is rather superfluous and causes a double-free at the error path after the card instance is initialized, as the destructor of the card object already contains a kfree() call. This patch fixes the double-free situation by removing the superfluous kfree(). Meanwhile we need to call kfree() explicitly for the early error path, so it's added there instead. Fixes: e8ad415b7a55 ("ALSA: core: Add managed card creation") Reported-by: Rondreis Cc: Link: https://lore.kernel.org/r/CAB7eexL1zBnB636hwS27d-LdPYZ_R1-5fJS_h=ZbCWYU=UPWJg@mail.gmail.com Link: https://lore.kernel.org/r/20220919123516.28222-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 496322302bf1e58dc2ff134173527493105f51ab Author: Daniel Houldsworth Date: Sun Sep 18 18:13:00 2022 +0100 ALSA: hda/realtek: Add a quirk for HP OMEN 16 (8902) mute LED Similair to the HP OMEN 15, the HP OMEN 16 also needs ALC285_FIXUP_HP_MUTE_LED for the mute LED to work. [ Rearranged the entry in PCI SSID order by tiwai ] Signed-off-by: Daniel Houldsworth Cc: Link: https://lore.kernel.org/r/20220918171300.24693-1-dhould3@gmail.com Signed-off-by: Takashi Iwai commit 468c9d928a8f38fdfaa61b05e81473cc7c8a6461 Author: Russ Weight Date: Fri Sep 16 16:52:05 2022 -0700 fpga: m10bmc-sec: Fix possible memory leak of flash_buf There is an error check following the allocation of flash_buf that returns without freeing flash_buf. It makes more sense to do the error check before the allocation and the reordering eliminates the memory leak. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 154afa5c31cd ("fpga: m10bmc-sec: expose max10 flash update count") Signed-off-by: Russ Weight Reviewed-by: Tom Rix Acked-by: Xu Yilun Cc: Link: https://lore.kernel.org/r/20220916235205.106873-1-russell.h.weight@intel.com Signed-off-by: Xu Yilun commit a7c48a0ab87ae52c087d663e83e56b8225ac4cce Author: Heiko Schocher Date: Fri Aug 26 13:50:21 2022 -0300 drm/panel: simple: Fix innolux_g121i1_l01 bus_format innolux_g121i1_l01 sets bpc to 6, so use the corresponding bus format: MEDIA_BUS_FMT_RGB666_1X7X3_SPWG. Fixes: 4ae13e486866 ("drm/panel: simple: Add more properties to Innolux G121I1-L01") Signed-off-by: Heiko Schocher Signed-off-by: Fabio Estevam Signed-off-by: Marek Vasut Link: https://patchwork.freedesktop.org/patch/msgid/20220826165021.1592532-1-festevam@denx.de commit 521a547ced6477c54b4b0cc206000406c221b4d6 Author: Linus Torvalds Date: Sun Sep 18 13:44:14 2022 -0700 Linux 6.0-rc6 commit 7c18b453ef7237bc25b7cbd425a05ac1b6fb074b Merge: 38eddeedbbeac 805ce8614958c Author: Linus Torvalds Date: Sun Sep 18 13:26:59 2022 -0700 Merge tag 'parisc-for-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "Some small parisc architecture fixes for 6.0-rc6: One patch lightens up a previous commit and thus unbreaks building the debian kernel, which tries to configure a 64-bit kernel with the ARCH=parisc environment variable set. The other patches fixes asm/errno.h includes in the tools directory and cleans up memory allocation in the iosapic driver. Summary: - Allow configuring 64-bit kernel with ARCH=parisc - Fix asm/errno.h includes in tools directory for parisc and xtensa - Clean up iosapic memory allocation - Minor typo and spelling fixes" * tag 'parisc-for-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Allow CONFIG_64BIT with ARCH=parisc parisc: remove obsolete manual allocation aligning in iosapic tools/include/uapi: Fix for parisc and xtensa Input: hp_sdc: fix spelling typo in comment parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() commit 38eddeedbbeac33f26845c29e7414b9313ea70db Merge: a335366bad136 9bd3f728223eb Author: Linus Torvalds Date: Sun Sep 18 09:25:27 2022 -0700 Merge tag 'io_uring-6.0-2022-09-18' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Nothing really major here, but figured it'd be nicer to just get these flushed out for -rc6 so that the 6.1 branch will have them as well. That'll make our lives easier going forward in terms of development, and avoid trivial conflicts in this area. - Simple trace rename so that the returned opcode name is consistent with the enum definition (Stefan) - Send zc rsrc request vs notification lifetime fix (Pavel)" * tag 'io_uring-6.0-2022-09-18' of git://git.kernel.dk/linux: io_uring/opdef: rename SENDZC_NOTIF to SEND_ZC io_uring/net: fix zc fixed buf lifetime commit 9bd3f728223ebcfef8e9d087bdd142f0e388215d Author: Stefan Metzmacher Date: Fri Sep 16 23:36:25 2022 +0200 io_uring/opdef: rename SENDZC_NOTIF to SEND_ZC It's confusing to see the string SENDZC_NOTIF in ftrace output when using IORING_OP_SEND_ZC. Fixes: b48c312be05e8 ("io_uring/net: simplify zerocopy send user API") Signed-off-by: Stefan Metzmacher Cc: Pavel Begunkov Cc: Jens Axboe Cc: io-uring@vger.kernel.org Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/8e5cd8616919c92b6c3c7b6ea419fdffd5b97f3c.1663363798.git.metze@samba.org Signed-off-by: Jens Axboe commit e3366e0234971a09f0e16f0e6fa16f4cbae45e47 Author: Pavel Begunkov Date: Fri Sep 16 23:22:57 2022 +0100 io_uring/net: fix zc fixed buf lifetime Notifications usually outlive requests, so we need to pin buffers with it by assigning a rsrc to it instead of the request. Fixed: b48c312be05e8 ("io_uring/net: simplify zerocopy send user API") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/dd6406ff8a90887f2b36ed6205dac9fda17c1f35.1663366886.git.asml.silence@gmail.com Reviewed-by: Stefan Metzmacher Signed-off-by: Jens Axboe commit de24aceb07d426b6f1c59f33889d6a964770547b Author: Asmaa Mnebhi Date: Thu Sep 8 13:35:39 2022 -0400 i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments. Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC") Reviewed-by: Khalil Blaiech Signed-off-by: Asmaa Mnebhi Signed-off-by: Wolfram Sang commit 2a5be6d1340c0fefcee8a6489cff7fd88a0d5b85 Author: Asmaa Mnebhi Date: Thu Sep 8 13:35:38 2022 -0400 i2c: mlxbf: incorrect base address passed during io write Correct the base address used during io write. This bug had no impact over the overall functionality of the read and write transactions. MLXBF_I2C_CAUSE_OR_CLEAR=0x18 so writing to (smbus->io + 0x18) instead of (mst_cause->ioi + 0x18) actually writes to the sc_low_timeout register which just sets the timeout value before a read/write aborts. Fixes: b5b5b32081cd206b (i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC) Reviewed-by: Khalil Blaiech Signed-off-by: Asmaa Mnebhi Signed-off-by: Wolfram Sang commit c589e3ca27c9f608004b155d3acb2fab6f7a9f26 Author: Palmer Dabbelt Date: Thu Sep 15 10:09:00 2022 -0700 RISC-V: Avoid coupling the T-Head CMOs and Zicbom We could make the T-Head CMOs depend on a new-enough assembler to have Zicbom, but it's not strictly necessary because the T-Head CMOs circumvent the assembler. Fixes: 8f7e001e0325 ("RISC-V: Clean up the Zicbom block size probing") Reported-by: kernel test robot Reported-by: Conor Dooley Signed-off-by: Palmer Dabbelt Reviewed-by: Heiko Stuebner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220915170900.22685-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 762df359aa5849e010ef04c3ed79d57588ce17d9 Author: Al Viro Date: Fri Sep 24 01:55:27 2021 +0000 riscv: fix a nasty sigreturn bug... riscv has an equivalent of arm bug fixed by 653d48b22166 ("arm: fix really nasty sigreturn bug"); if signal gets caught by an interrupt that hits when we have the right value in a0 (-513), *and* another signal gets delivered upon sigreturn() (e.g. included into the blocked mask for the first signal and posted while the handler had been running), the syscall restart logics will see regs->cause equal to EXC_SYSCALL (we are in a syscall, after all) and a0 already restored to its original value (-513, which happens to be -ERESTARTNOINTR) and assume that we need to apply the usual syscall restart logics. Signed-off-by: Al Viro Fixes: e2c0cdfba7f6 ("RISC-V: User-facing API") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/YxJEiSq%2FCGaL6Gm9@ZenIV/ Signed-off-by: Palmer Dabbelt commit 2a2018c3ac84c2dc7cfbad117ce9339ea0914622 Author: Heiko Stuebner Date: Wed Sep 7 17:49:32 2022 +0200 riscv: make t-head erratas depend on MMU Both basic extensions of SVPBMT and ZICBOM depend on CONFIG_MMU. Make the T-Head errata implementations of the similar functionality also depend on it to prevent build errors. Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head") Fixes: d20ec7529236 ("riscv: implement cache-management errata for T-Head SoCs") Reported-by: kernel test robot Signed-off-by: Heiko Stuebner Reviewed-by: Guo Ren Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220907154932.2858518-1-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit 225e47ea20ea4f37031131f4fa7a6c281fac6657 Author: Randy Dunlap Date: Fri Jul 8 18:49:29 2022 -0700 riscv: fix RISCV_ISA_SVPBMT kconfig dependency warning RISCV_ISA_SVPBMT selects RISCV_ALTERNATIVE which depends on !XIP_KERNEL. Therefore RISCV_ISA_SVPBMT should also depend on !XIP_KERNEL so quieten this kconfig warning: WARNING: unmet direct dependencies detected for RISCV_ALTERNATIVE Depends on [n]: !XIP_KERNEL [=y] Selected by [y]: - RISCV_ISA_SVPBMT [=y] && 64BIT [=y] && MMU [=y] Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Signed-off-by: Randy Dunlap Cc: stable@vger.kernel.org Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220709014929.14221-1-rdunlap@infradead.org/ Signed-off-by: Palmer Dabbelt commit 5373b8a09d6e037ee0587cb5d9fe4cc09077deeb Author: Peter Collingbourne Date: Tue Sep 13 19:00:01 2022 -0700 kasan: call kasan_malloc() from __kmalloc_*track_caller() We were failing to call kasan_malloc() from __kmalloc_*track_caller() which was causing us to sometimes fail to produce KASAN error reports for allocations made using e.g. devm_kcalloc(), as the KASAN poison was not being initialized. Fix it. Signed-off-by: Peter Collingbourne Cc: # 5.15 Signed-off-by: Vlastimil Babka commit a335366bad1364a07f49df9da1fdfa6d411a5f39 Merge: 6879c2d3b9603 09eed5a1ed3c7 Author: Linus Torvalds Date: Fri Sep 16 12:58:17 2022 -0700 Merge tag 'gpio-fixes-for-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix the level-low interrupt type support in gpio-mpc8xxx - convert another two drivers to using immutable irq chips - MAINTAINERS update * tag 'gpio-fixes-for-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mt7621: Make the irqchip immutable gpio: ixp4xx: Make irqchip immutable MAINTAINERS: Update HiSilicon GPIO Driver maintainer gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx commit 9d55e7b0bdf9480a57b4fe87134e749cb18e281a Author: Wolfram Sang Date: Tue Sep 13 11:05:52 2022 +0100 Documentation: i2c: fix references to other documents Similar to commit fe99b819487d ("docs: i2c: i2c-sysfs: fix hyperlinks"), make other links in documentation consistent with the preferred way. Signed-off-by: Wolfram Sang Reviewed-by: Luca Ceresoli Tested-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 2c2c72ec111fd818d37fbe00e7df3042507d7663 Author: Wolfram Sang Date: Mon Sep 12 21:58:43 2022 +0100 MAINTAINERS: remove Nehal Shah from AMD MP2 I2C DRIVER His email bounced and given commit 88115ea6308d ("HID: amd_sfh: Remove name from maintainers list"), I assume he is no longer available as a maintainer. Signed-off-by: Wolfram Sang commit 085aacaa73163f4b8a89dec24ecb32cfacd34017 Author: Uwe Kleine-König Date: Mon Sep 12 15:20:40 2022 +0200 i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible pm_runtime_get_sync() returning 1 also means the device is powered. So resetting the chip registers in .remove() is possible and should be done. Reported-by: Dan Carpenter Fixes: d98bdd3a5b50 ("i2c: imx: Make sure to unregister adapter on remove()") Signed-off-by: Uwe Kleine-König Acked-by: Oleksij Rempel Signed-off-by: Wolfram Sang commit 40e9541959100e017533e18e44d07eed44f91dc5 Author: Johan Hovold Date: Fri Sep 16 11:36:03 2022 +0200 arm64: dts: qcom: sm8350: fix UFS PHY serdes size The size of the UFS PHY serdes register region is 0x1c4 and the corresponding 'reg' property should specifically not include the adjacent regions that are defined in the child node (e.g. tx and rx). Fixes: 59c7cf814783 ("arm64: dts: qcom: sm8350: Add UFS nodes") Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220916093603.24263-1-johan+linaro@kernel.org commit 96628951869c0dedf0377adca01c8675172d8639 Author: Peilin Ye Date: Thu Sep 8 16:15:23 2022 -0700 tcp: Use WARN_ON_ONCE() in tcp_read_skb() Prevent tcp_read_skb() from flooding the syslog. Suggested-by: Jakub Sitnicki Signed-off-by: Peilin Ye Signed-off-by: David S. Miller commit 5f80d6bd2b01de4cafac3302f58456bf860322fc Author: Jaroslav Kysela Date: Tue Sep 13 09:02:16 2022 +0200 ALSA: hda/hdmi: Fix the converter reuse for the silent stream When the user space pcm stream uses the silent stream converter, it is no longer allocated for the silent stream. Clear the appropriate flag in the hdmi_pcm_open() function. The silent stream setup may be applied in hdmi_pcm_close() (and the error path - open fcn) again. If the flag is not cleared, the reuse conditions for the silent stream converter in hdmi_choose_cvt() may improperly share this converter. Cc: Kai Vehmanen Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220913070216.3233974-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 6879c2d3b96039ff1668b4328a4d0dd3ea952cff Merge: 68e777e44c275 c297561bc98ad Author: Linus Torvalds Date: Fri Sep 16 07:06:05 2022 -0700 Merge tag 'pinctrl-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Nothing special, just driver fixes: - Fix IRQ wakeup and pins for UFS and SDC2 issues on the Qualcomm SC8180x - Fix the Rockchip driver to support interrupt on both rising and falling edges. - Name the Allwinner A100 R_PIO properly - Fix several issues with the Ocelot interrupts" * tag 'pinctrl-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: ocelot: Fix interrupt controller pinctrl: sunxi: Fix name for A100 R_PIO pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH pinctrl: qcom: sc8180x: Fix wrong pin numbers pinctrl: qcom: sc8180x: Fix gpio_wakeirq_map commit 68e777e44c275e8dbc36f5a187c366e982d6a129 Merge: 0158137d816f6 c4fa368466cc1 Author: Linus Torvalds Date: Fri Sep 16 06:58:04 2022 -0700 Merge tag 'block-6.0-2022-09-16' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Two fixes for -rc6: - Fix a mixup of sectors and bytes in the secure erase ioctl (Mikulas) - Fix for a bad return value for a non-blocking bio/blk queue enter call (me)" * tag 'block-6.0-2022-09-16' of git://git.kernel.dk/linux-block: blk-lib: fix blkdev_issue_secure_erase block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait commit 0158137d816f60115aae2d3b4acdc67383a05c01 Merge: 5763d7f29652f fc7222c3a9f56 Author: Linus Torvalds Date: Fri Sep 16 06:50:25 2022 -0700 Merge tag 'io_uring-6.0-2022-09-16' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "Two small patches: - Fix using an unsigned type for the return value, introduced in this release (Pavel) - Stable fix for a missing check for a fixed file on put (me)" * tag 'io_uring-6.0-2022-09-16' of git://git.kernel.dk/linux-block: io_uring/msg_ring: check file type before putting io_uring/rw: fix error'ed retry return values commit 5763d7f29652f94bdfc9dab87888f79ba6bb6c34 Merge: 714820c63914c 25100377a21ad Author: Linus Torvalds Date: Fri Sep 16 06:45:19 2022 -0700 Merge tag 'drm-fixes-2022-09-16' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This is the regular drm fixes pull. The i915 and misc fixes are fairly regular, but the amdgpu contains fixes for new hw blocks, the dcn314 specific path hookups and also has a bunch of fixes for clang stack size warnings which are a bit churny but fairly straightforward. This means it looks a little larger than usual. amdgpu: - BACO fixes for some RDNA2 boards - PCI AER fixes uncovered by a core PCI change - Properly hook up dirtyfb helper - RAS fixes for GC 11.x - TMR fix - DCN 3.2.x fixes - DCN 3.1.4 fixes - LLVM DML stack size fixes i915: - Revert a display patch around max DP source rate now that the proper WaEdpLinkRateDataReload is in place - Fix perf limit reasons bit position - Fix unclaimmed mmio registers on suspend flow with GuC - A vma_move_to_active fix for a regression with video decoding - DP DSP fix gma500: - Locking and IRQ fixes meson: - OSD1 display fixes panel-edp: - Fix Innolux timings rockchip: - DP/HDMI fixes" * tag 'drm-fixes-2022-09-16' of git://anongit.freedesktop.org/drm/drm: (42 commits) drm/amdgpu: make sure to init common IP before gmc drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega drm/amdgpu: move nbio ih_doorbell_range() into ih code for vega drm/rockchip: Fix return type of cdn_dp_connector_mode_valid drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage drm/amd/display: Reduce number of arguments of dml31's CalculateFlipSchedule() drm/amd/display: Reduce number of arguments of dml31's CalculateWatermarksAndDRAMSpeedChangeSupport() drm/amd/display: Reduce number of arguments of dml32_CalculatePrefetchSchedule() drm/amd/display: Reduce number of arguments of dml32_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport() drm/amd/display: Refactor SubVP calculation to remove FPU drm/amd/display: Limit user regamma to a valid value drm/amd/display: add workaround for subvp cursor corruption for DCN32/321 drm/amd/display: SW cursor fallback for SubVP drm/amd/display: Round cursor width up for MALL allocation drm/amd/display: Correct dram channel width for dcn314 drm/amd/display: Relax swizzle checks for video non-RGB formats on DCN314 drm/amd/display: Hook up DCN314 specific dml implementation drm/amd/display: Enable dlg and vba compilation for dcn314 drm/amd/display: Fix compilation errors on DCN314 drm/amd/display: Fix divide by zero in DML ... commit 714820c63914c7c4c1fd37fafdd2baa14cb605ec Merge: 3245cb65fd91c 8af8aed97bebe Author: Linus Torvalds Date: Fri Sep 16 06:41:44 2022 -0700 Merge tag '6.0-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Four smb3 fixes for stable: - important fix to revalidate mapping when doing direct writes - missing spinlock - two fixes to socket handling - trivial change to update internal version number for cifs.ko" * tag '6.0-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: add missing spinlock around tcon refcount cifs: always initialize struct msghdr smb_msg completely cifs: don't send down the destination address to sendmsg for a SOCK_STREAM cifs: revalidate mapping when doing direct writes commit 34d2d3367de3b815cc7cd5670e18c557f95cfe1e Merge: 21be1ad637493 bbb774d921e27 Author: David S. Miller Date: Fri Sep 16 14:34:01 2022 +0100 Merge branch 'net-unsync-addresses-from-ports' From: Benjamin Poirier To: netdev@vger.kernel.org Cc: Jay Vosburgh , Veaceslav Falico , Andy Gospodarek , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jiri Pirko , Shuah Khan , Jonathan Toppins , linux-kselftest@vger.kernel.org Subject: [PATCH net v3 0/4] Unsync addresses from ports when stopping aggregated devices Date: Wed, 7 Sep 2022 16:56:38 +0900 [thread overview] Message-ID: <20220907075642.475236-1-bpoirier@nvidia.com> (raw) This series fixes similar problems in the bonding and team drivers. Because of missing dev_{uc,mc}_unsync() calls, addresses added to underlying devices may be leftover after the aggregated device is deleted. Add the missing calls and a few related tests. v2: * fix selftest installation, see patch 3 v3: * Split lacpdu_multicast changes to their own patch, #1 * In ndo_{add,del}_slave methods, only perform address list changes when the aggregated device is up (patches 2 & 3) * Add selftest function related to the above change (patch 4) ==================== Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit bbb774d921e273ca262944c94011bc2cc888ebeb Author: Benjamin Poirier Date: Wed Sep 7 16:56:42 2022 +0900 net: Add tests for bonding and team address list management Test that the bonding and team drivers clean up an underlying device's address lists (dev->uc, dev->mc) when the aggregated device is deleted. Test addition and removal of the LACPDU multicast address on underlying devices by the bonding driver. v2: * add lag_lib.sh to TEST_FILES v3: * extend bond_listen_lacpdu_multicast test to init_state up and down cases * remove some superfluous shell syntax and 'set dev ... up' commands Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit bd60234222b2fd5573526da7bcd422801f271f5f Author: Benjamin Poirier Date: Wed Sep 7 16:56:41 2022 +0900 net: team: Unsync device addresses on ndo_stop Netdev drivers are expected to call dev_{uc,mc}_sync() in their ndo_set_rx_mode method and dev_{uc,mc}_unsync() in their ndo_stop method. This is mentioned in the kerneldoc for those dev_* functions. The team driver calls dev_{uc,mc}_unsync() during ndo_uninit instead of ndo_stop. This is ineffective because address lists (dev->{uc,mc}) have already been emptied in unregister_netdevice_many() before ndo_uninit is called. This mistake can result in addresses being leftover on former team ports after a team device has been deleted; see test_LAG_cleanup() in the last patch in this series. Add unsync calls at their expected location, team_close(). v3: * When adding or deleting a port, only sync/unsync addresses if the team device is up. In other cases, it is taken care of at the right time by ndo_open/ndo_set_rx_mode/ndo_stop. Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit 86247aba599e5b07d7e828e6edaaebb0ef2b1158 Author: Benjamin Poirier Date: Wed Sep 7 16:56:40 2022 +0900 net: bonding: Unsync device addresses on ndo_stop Netdev drivers are expected to call dev_{uc,mc}_sync() in their ndo_set_rx_mode method and dev_{uc,mc}_unsync() in their ndo_stop method. This is mentioned in the kerneldoc for those dev_* functions. The bonding driver calls dev_{uc,mc}_unsync() during ndo_uninit instead of ndo_stop. This is ineffective because address lists (dev->{uc,mc}) have already been emptied in unregister_netdevice_many() before ndo_uninit is called. This mistake can result in addresses being leftover on former bond slaves after a bond has been deleted; see test_LAG_cleanup() in the last patch in this series. Add unsync calls, via bond_hw_addr_flush(), at their expected location, bond_close(). Add dev_mc_add() call to bond_open() to match the above change. v3: * When adding or deleting a slave, only sync/unsync, add/del addresses if the bond is up. In other cases, it is taken care of at the right time by ndo_open/ndo_set_rx_mode/ndo_stop. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit 1d9a143ee3408349700f44a9197b7ae0e4faae5d Author: Benjamin Poirier Date: Wed Sep 7 16:56:39 2022 +0900 net: bonding: Share lacpdu_mcast_addr definition There are already a few definitions of arrays containing MULTICAST_LACPDU_ADDR and the next patch will add one more use. These all contain the same constant data so define one common instance for all bonding code. Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit 21be1ad637493f960ea754399d86f65f7e260250 Merge: 9124dbcc2dd6c 809f23c0423a4 Author: David S. Miller Date: Fri Sep 16 12:16:44 2022 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-09-08 (ice, iavf) This series contains updates to ice and iavf drivers. Dave removes extra unplug of auxiliary bus on reset which caused a scheduling while atomic to be reported for ice. Ding Hui defers setting of queues for TCs to ensure valid configuration and restores old config if invalid for ice. Sylwester fixes a check of setting MAC address to occur after result is received from PF for iavf driver. Brett changes check of ring tail to use software cached value as not all devices have access to register tail for iavf driver. ==================== Signed-off-by: David S. Miller commit 9124dbcc2dd6c51e81f97f63f7807118c4eb140a Author: Oleksandr Mazur Date: Thu Sep 8 16:14:46 2022 +0300 net: marvell: prestera: add support for for Aldrin2 Aldrin2 (98DX8525) is a Marvell Prestera PP, with 100G support. Signed-off-by: Oleksandr Mazur V2: - retarget to net tree instead of net-next; - fix missed colon in patch subject ('net marvell' vs 'net: mavell'); Signed-off-by: David S. Miller commit 94160108a70c8af17fa1484a37e05181c0e094af Author: Haimin Zhang Date: Thu Sep 8 20:19:27 2022 +0800 net/ieee802154: fix uninit value bug in dgram_sendmsg There is uninit value bug in dgram_sendmsg function in net/ieee802154/socket.c when the length of valid data pointed by the msg->msg_name isn't verified. We introducing a helper function ieee802154_sockaddr_check_size to check namelen. First we check there is addr_type in ieee802154_addr_sa. Then, we check namelen according to addr_type. Also fixed in raw_bind, dgram_bind, dgram_connect. Signed-off-by: Haimin Zhang Signed-off-by: David S. Miller commit e7ccba7728cff0e0f1299951571f209fcadcb7b1 Author: Jianmin Lv Date: Fri Sep 16 15:19:26 2022 +0800 irqchip/loongson-pch-lpc: Add dependence on LoongArch The loongson-pch-lpc driver may be selected in a random configuration, but it is only supported for LoongArch, So, the dependence on LoongArch is added for it to avoid compile error for a random configuration of other architetures. Reported-by: kernel test robot Signed-off-by: Jianmin Lv Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220916071926.28368-1-lvjianmin@loongson.cn commit ce6b8ccdef959ba86b2711e090e84a987a000bf7 Author: Juergen Gross Date: Thu Sep 15 15:05:45 2022 +0200 xen/xenbus: fix xenbus_setup_ring() Commit 4573240f0764 ("xen/xenbus: eliminate xenbus_grant_ring()") introduced an error for initialization of multi-page rings. Cc: stable@vger.kernel.org Fixes: 4573240f0764 ("xen/xenbus: eliminate xenbus_grant_ring()") Reported-by: Sander Eikelenboom Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Reviewed-by: Oleksandr Tyshchenko Signed-off-by: Juergen Gross commit 25100377a21ad40dae8be5a3ed361b87acec1479 Merge: 87d9862b25483 8787f6fab4138 Author: Dave Airlie Date: Fri Sep 16 17:49:46 2022 +1000 Merge tag 'drm-intel-fixes-2022-09-15' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Revert a display patch around max DP source rate now that the proper WaEdpLinkRateDataReload is in place. (Ville) - Fix perf limit reasons bit position. (Ashutosh) - Fix unclaimmed mmio registers on suspend flow with GuC. (Umesh) - A vma_move_to_active fix for a regression with video decoding. (Nirmoy) - DP DSP fix. (Ankit) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YyMtmGMXRLsURoM5@intel.com commit 87d9862b25483242a30bf45420cd8e7e1872a4be Merge: e2111ae2c1a6c b0b9408f13262 Author: Dave Airlie Date: Fri Sep 16 17:43:16 2022 +1000 Merge tag 'drm-misc-fixes-2022-09-15' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * gma500: Locking and IRQ fixes * meson: OSD1 display fixes * panel-edp: Fix Innolux timings * rockchip: DP/HDMI fixes Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YyMUpP1w21CPXq+I@linux-uq9g commit e2111ae2c1a6c8dd708243ef631d35a08c8be257 Merge: 80e78fcce86de a8671493d2074 Author: Dave Airlie Date: Fri Sep 16 17:00:12 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-09-14' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-09-14: amdgpu: - BACO fixes for some RDNA2 boards - PCI AER fixes uncovered by a core PCI change - Properly hook up dirtyfb helper - RAS fixes for GC 11.x - TMR fix - DCN 3.2.x fixes - DCN 3.1.4 fixes - LLVM DML stack size fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220914184030.6145-1-alexander.deucher@amd.com commit e0e0747de0ea3dd87cdbb0393311e17471a9baf1 Author: Sreekanth Reddy Date: Tue Sep 13 17:35:38 2022 +0530 scsi: mpt3sas: Fix return value check of dma_get_required_mask() Fix the incorrect return value check of dma_get_required_mask(). Due to this incorrect check, the driver was always setting the DMA mask to 63 bit. Link: https://lore.kernel.org/r/20220913120538.18759-2-sreekanth.reddy@broadcom.com Fixes: ba27c5cf286d ("scsi: mpt3sas: Don't change the DMA coherent mask after allocations") Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 601be20fc6a1b762044d2398befffd6bf236cebf Author: Rafael Mendonca Date: Tue Sep 13 23:49:24 2022 -0300 scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") made the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean up the allocated memory for the management command. Link: https://lore.kernel.org/r/20220914024924.695604-1-rafaelmendsr@gmail.com Fixes: 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") Reviewed-by: Himanshu Madhani Signed-off-by: Rafael Mendonca Signed-off-by: Martin K. Petersen commit fbfe96869b782364caebae0445763969ddb6ea67 Author: Letu Ren Date: Fri Nov 12 20:06:41 2021 +0800 scsi: qedf: Fix a UAF bug in __qedf_probe() In __qedf_probe(), if qedf->cdev is NULL which means qed_ops->common->probe() failed, then the program will goto label err1, and scsi_host_put() will free lport->host pointer. Because the memory qedf points to is allocated by libfc_host_alloc(), it will be freed by scsi_host_put(). However, the if statement below label err0 only checks whether qedf is NULL but doesn't check whether the memory has been freed. So a UAF bug can occur. There are two ways to reach the statements below err0. The first one is described as before, "qedf" should be set to NULL. The second one is goto "err0" directly. In the latter scenario qedf hasn't been changed and it has the initial value NULL. As a result the if statement is not reachable in any situation. The KASAN logs are as follows: [ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] [ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 2.312969] Call Trace: [ 2.312969] dump_stack_lvl+0x59/0x7b [ 2.312969] print_address_description+0x7c/0x3b0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] __kasan_report+0x160/0x1c0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] kasan_report+0x4b/0x70 [ 2.312969] ? kobject_put+0x25d/0x290 [ 2.312969] kasan_check_range+0x2ca/0x310 [ 2.312969] __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 [ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 [ 2.312969] ? rpm_resume+0xa5c/0x16e0 [ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 [ 2.312969] local_pci_probe+0x13c/0x1f0 [ 2.312969] pci_device_probe+0x37e/0x6c0 Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com Reported-by: Zheyu Ma Acked-by: Saurav Kashyap Co-developed-by: Wende Tan Signed-off-by: Wende Tan Signed-off-by: Letu Ren Signed-off-by: Martin K. Petersen commit 90d000288e115ca63452813c423f9dfd9f521c96 Author: Florian Fainelli Date: Thu Sep 15 12:01:59 2022 -0700 soc: bcm: brcmstb: biuctrl: Avoid double of_node_put() Commit 9a073d4fbb18 ("soc: bcm: brcmstb: biuctrl: Add missing of_node_put()") added what was thought to be a missing of_node_put() but now causes a double of_node_put() to be called, once from setup_hifcpubiuctrl_regs() and another time from brcmstb_biuctrl_init(). Ensure that setup_hifcpubiuctrl_regs() is not calling of_node_put() since it is not obvious it does that on one of its parameters. Fixes: 9a073d4fbb18 ("soc: bcm: brcmstb: biuctrl: Add missing of_node_put()") Reported-by: Jim Quinlan Signed-off-by: Florian Fainelli Change-Id: I1c405c36c2f06c8b8c0f684143b7a52db7e809f0 commit aaa58141a5d7647b14d812dde92b8d680e0985db Merge: 7b9a516a91827 f5fc22cbbdcd3 Author: Arnd Bergmann Date: Thu Sep 15 21:54:06 2022 +0200 Merge tag 'at91-fixes-6.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 6.0 #2 It contains a fix for LAN966 SoCs that corrects the interrupt number for internal PHYs. * tag 'at91-fixes-6.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: lan966x: Fix the interrupt number for internal PHYs Link: https://lore.kernel.org/r/20220915105833.4159850-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit fc7222c3a9f56271fba02aabbfbae999042f1679 Author: Jens Axboe Date: Thu Sep 15 11:44:35 2022 -0600 io_uring/msg_ring: check file type before putting If we're invoked with a fixed file, follow the normal rules of not calling io_fput_file(). Fixed files are permanently registered to the ring, and do not need putting separately. Cc: stable@vger.kernel.org Fixes: aa184e8671f0 ("io_uring: don't attempt to IOPOLL for MSG_RING requests") Signed-off-by: Jens Axboe commit ba1f818053b0668a1ce2fe86b840e81b592cc560 Author: Luke D. Jones Date: Thu Sep 15 20:09:21 2022 +1200 ALSA: hda/realtek: Add quirk for ASUS GA503R laptop The ASUS G15 2022 (GA503R) series laptop has the same node-to-DAC pairs as early models and the G14, this includes bass speakers which are by default mapped incorrectly to the 0x06 node. Add a quirk to use the same DAC pairs as the G14. Signed-off-by: Luke D. Jones Cc: Link: https://lore.kernel.org/r/20220915080921.35563-4-luke@ljones.dev Signed-off-by: Takashi Iwai commit bc2c23549ccd7105eb6ff0d4f0ac519285628673 Author: Luke D. Jones Date: Thu Sep 15 20:09:20 2022 +1200 ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack Fixes up the pincfg for ASUS ROG Strix G15 (G533Z) headphone combo jack [ Fixed the position in the quirk table by tiwai ] Signed-off-by: Luke D. Jones Cc: Link: https://lore.kernel.org/r/20220915080921.35563-3-luke@ljones.dev Signed-off-by: Takashi Iwai commit c611e659044168e7abcbae8ba1ea833521498fbb Author: Luke D. Jones Date: Thu Sep 15 20:09:19 2022 +1200 ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack Fixes up the pincfg for ASUS ROG Strix G513 headphone and mic combo jack [ Fixed the position in the quirk table by tiwai ] Signed-off-by: Luke D. Jones Cc: Link: https://lore.kernel.org/r/20220915080921.35563-2-luke@ljones.dev Signed-off-by: Takashi Iwai commit b16c8f229a58eaddfc58aab447253464abd3c85e Author: Takashi Iwai Date: Thu Sep 15 17:47:24 2022 +0200 ALSA: hda/realtek: Re-arrange quirk table entries A few entries have been mistakenly inserted in wrong positions without considering the SSID ordering. Place them at right positions. Fixes: b7557267c233 ("ALSA: hda/realtek: Add quirk for ASUS GA402") Fixes: 94db9cc8f8fa ("ALSA: hda/realtek: Add quirk for ASUS GU603") Fixes: 739d0959fbed ("ALSA: hda: Add quirk for ASUS Flow x13") Cc: Link: https://lore.kernel.org/r/20220915154724.31634-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 1885ff13d4c42910b37a0e3f7c2f182520f4eed1 Author: Callum Osmotherly Date: Thu Sep 15 22:36:08 2022 +0930 ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop Just as with the 5570 (and the other Dell laptops), this enables the two subwoofer speakers on the Dell Precision 5530 together with the main ones, significantly increasing the audio quality. I've tested this myself on a 5530 and can confirm it's working as expected. Signed-off-by: Callum Osmotherly Cc: Link: https://lore.kernel.org/r/YyMjQO3mhyXlMbCf@piranha Signed-off-by: Takashi Iwai commit 7b9a516a91827e7994a4df51593278c98aae2ce6 Merge: 96c9b511fc0fd f7fc391a5e282 Author: Arnd Bergmann Date: Thu Sep 15 16:17:47 2022 +0200 Merge tag 'imx-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.0, 2nd round: - A couple of TQMa8MPQL device tree fixes from Alexander Stein on button GPIOs and PCF85063 RTC alarm pinctrl. - Include phy-imx8-pcie.h header in tqma8mqml-mba8mx device tree to fix build errors when this SoM dtsi is included on customer carrier boards. - Remove GPU power domain reset from i.MX8MN device tree to fix a sporadical hang seen with GPUMIX powering up. - Correct CPLD_Dn GPIO label mapping for Toradex Verdin based Menlo board. - Add ARCH_NXP back to defconfig, which was dropped accidentally by commit 566e373fe047 ("arm64: Kconfig.platforms: Group NXP platforms together"). - Add missing #reset-cells for i.MX8ULP PCC clock controllers. - Update PMIC voltages for imx8mm-verdin board to fix an issue with one Toradex SKU that uses a consumer-grade chip that is capable of going up to 1.8GHz at 1.00V. - A series of imx8mp-venice-gw74xx device tree changes from Tim Harvey to fix things on CAN STBY polarity, KSZ9477 CPU uplink port and phy-mode. * tag 'imx-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mp-venice-gw74xx: fix port/phy validation arm64: dts: imx8mp-venice-gw74xx: fix ksz9477 cpu port arm64: dts: imx8mp-venice-gw74xx: fix CAN STBY polarity arm64: dts: tqma8mqml: Include phy-imx8-pcie.h header arm64: defconfig: enable ARCH_NXP arm64: dts: imx8mp-tqma8mpql-mba8mpxl: add missing pinctrl for RTC alarm arm64: dts: imx8mm-verdin: extend pmic voltages arm64: dts: imx8ulp: add #reset-cells for pcc arm64: dts: tqma8mpxl-ba8mpxl: Fix button GPIOs arm64: dts: imx8mn: remove GPU power domain reset arm64: dts: imx8mm: Reverse CPLD_Dn GPIO label mapping on MX8Menlo Signed-off-by: Arnd Bergmann commit ce001778dfc34804f2b1fa6faaad7ac888326afb Merge: 91062e663b261 14c7d90528374 Author: Greg Kroah-Hartman Date: Thu Sep 15 12:55:55 2022 +0200 Merge tag 'thunderbolt-for-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: "thunderbolt: Fix for v6.0-rc6 This includes a single commit adding missing PCI ID for Intel Maple Ridge Thunderbolt 4 single port controller. This has been in linux-next with no reported issues." * tag 'thunderbolt-for-v6.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Add support for Intel Maple Ridge single port controller commit d8ab4685adc1f78aef5ece1334a47ca1a8181745 Author: Greg Kroah-Hartman Date: Thu Sep 15 12:44:56 2022 +0200 Revert "driver core: Set fw_devlink.strict=1 by default" This reverts commit 71066545b48e4259f89481199a0bbc7c35457738. It causes boot problems on some systems, so revert it for now until it is worked out. Cc: Geert Uytterhoeven Cc: Saravana Kannan Fixes: 71066545b48e ("driver core: Set fw_devlink.strict=1 by default") Reported-by: Olof Johansson Link: https://lore.kernel.org/r/CAOesGMjQHhTUMBGHQcME4JBkZCof2NEQ4gaM1GWFgH40+LN9AQ@mail.gmail.com Signed-off-by: Greg Kroah-Hartman commit c4fa368466cc1b60bb92f867741488930ddd6034 Author: Mikulas Patocka Date: Wed Sep 14 16:55:51 2022 -0400 blk-lib: fix blkdev_issue_secure_erase There's a bug in blkdev_issue_secure_erase. The statement "unsigned int len = min_t(sector_t, nr_sects, max_sectors);" sets the variable "len" to the length in sectors, but the statement "bio->bi_iter.bi_size = len" treats it as if it were in bytes. The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len << SECTOR_SHIFT" are thinko. This patch fixes it. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org # v5.19 Fixes: 44abff2c0b97 ("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD") Link: https://lore.kernel.org/r/alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com Signed-off-by: Jens Axboe commit 805ce8614958c925877ba6b6dc26cdf9f8800474 Author: Helge Deller Date: Tue Sep 13 08:51:10 2022 +0200 parisc: Allow CONFIG_64BIT with ARCH=parisc The previous patch triggered a build failure for the debian kernel, which has CONFIG_64BIT enabled, uses the CROSS_COMPILER environment variable and uses ARCH=parisc to configure the kernel for 64-bit support. This patch weakens the previous patch while keeping the recommended way to configure the kernel with: ARCH=parisc -> build 32-bit kernel ARCH=parisc64 -> build 64-bit kernel while adding the possibility for debian to configure a 64-bit kernel even if ARCH=parisc is set (PA8X00 CPU has to be selected and CONFIG_64BIT needs to be enabled). The downside of this patch is, that we now have a small window open again where people may get it wrong: if they enable CONFIG_64BIT and try to compile with a 32-bit compiler. Fixes: 3dcfb729b5f4 ("parisc: Make CONFIG_64BIT available for ARCH=parisc64 only") Signed-off-by: Helge Deller Cc: # 5.15+ commit e359b70cc1c51138e166bd4a560e5c5995369a99 Author: Rolf Eike Beer Date: Wed Sep 14 16:23:02 2022 +0200 parisc: remove obsolete manual allocation aligning in iosapic kmalloc() returns memory with __assume_kmalloc_alignment, which is __alignof__(unsigned long long) for parisc. Signed-off-by: Rolf Eike Beer Signed-off-by: Helge Deller commit 0af4ed0c329ebb4cef95fda4fcdbfcdea0255442 Author: Yifan Zhang Date: Tue Aug 30 23:18:47 2022 +0800 drm/amdgpu/mes: zero the sdma_hqd_mask of 2nd SDMA engine for SDMA 6.0.1 there is only one SDMA engine in SDMA 6.0.1, the sdma_hqd_mask has to be zeroed for the 2nd engine, otherwise MES scheduler will consider 2nd engine exists and map/unmap SDMA queues to the non-existent engine. Signed-off-by: Yifan Zhang Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit a8671493d2074950553da3cf07d1be43185ef6c6 Author: Alex Deucher Date: Tue Aug 30 10:59:49 2022 -0400 drm/amdgpu: make sure to init common IP before gmc Move common IP init before GMC init so that HDP gets remapped before GMC init which uses it. This fixes the Unsupported Request error reported through AER during driver load. The error happens as a write happens to the remap offset before real remapping is done. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216373 The error was unnoticed before and got visible because of the commit referenced below. This doesn't fix anything in the commit below, rather fixes the issue in amdgpu exposed by the commit. The reference is only to associate this commit with below one so that both go together. Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e3163bc8ffdfdb405e10530b140135b2ee487f89 Author: Alex Deucher Date: Fri Sep 9 11:53:27 2022 -0400 drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega This mirrors what we do for other asics and this way we are sure the sdma doorbell range is properly initialized. There is a comment about the way doorbells on gfx9 work that requires that they are initialized for other IPs before GFX is initialized. However, the statement says that it applies to multimedia as well, but the VCN code currently initializes doorbells after GFX and there are no known issues there. In my testing at least I don't see any problems on SDMA. This is a prerequisite for fixing the Unsupported Request error reported through AER during driver load. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216373 The error was unnoticed before and got visible because of the commit referenced below. This doesn't fix anything in the commit below, rather fixes the issue in amdgpu exposed by the commit. The reference is only to associate this commit with below one so that both go together. Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit dc1d85cb790f2091eea074cee24a704b2d6c4a06 Author: Alex Deucher Date: Fri Sep 9 11:47:20 2022 -0400 drm/amdgpu: move nbio ih_doorbell_range() into ih code for vega This mirrors what we do for other asics and this way we are sure the ih doorbell range is properly initialized. There is a comment about the way doorbells on gfx9 work that requires that they are initialized for other IPs before GFX is initialized. In this case IH is initialized before GFX, so there should be no issue. This is a prerequisite for fixing the Unsupported Request error reported through AER during driver load. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216373 The error was unnoticed before and got visible because of the commit referenced below. This doesn't fix anything in the commit below, rather fixes the issue in amdgpu exposed by the commit. The reference is only to associate this commit with below one so that both go together. Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 29f894eca862f55e570d578571aa62b38d9ac9f4 Author: Manivannan Sadhasivam Date: Wed Sep 14 13:09:22 2022 +0530 arm64: dts: qcom: sc8280xp-x13s: Update firmware location The firmware location in linux-firmware has been changed to include the SoC name. So use the updated location in Thinkpad devicetree. Reviewed-by: Johan Hovold Tested-by: Steev Klimaszewski Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220914073922.7145-1-manivannan.sadhasivam@linaro.org commit a52540522c9541bfa3e499d2edba7bc0ca73a4ca Author: Mickaël Salaün Date: Fri Sep 9 12:34:02 2022 +0200 selftests/landlock: Fix out-of-tree builds These changes simplify the Makefile and handle these 5 ways to build Landlock tests: - make -C tools/testing/selftests/landlock - make -C tools/testing/selftests TARGETS=landlock gen_tar - make TARGETS=landlock kselftest-gen_tar - make TARGETS=landlock O=build kselftest-gen_tar - make -C /tmp/linux TARGETS=landlock O=/tmp/build kselftest-gen_tar This also makes $(KHDR_INCLUDES) available to other test collections when building in their directory. Fixes: f1227dc7d041 ("selftests/landlock: fix broken include of linux/landlock.h") Fixes: 3bb267a36185 ("selftests: drop khdr make target") Cc: Anders Roxell Cc: Guillaume Tucker Cc: Mark Brown Cc: Shuah Khan Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20220909103402.1501802-1-mic@digikod.net commit c297561bc98ad0f2a37ce0178ee3ba89ab586d70 Author: Horatiu Vultur Date: Fri Sep 9 16:59:42 2022 +0200 pinctrl: ocelot: Fix interrupt controller When an external device generated a level based interrupt then the interrupt controller could miss the interrupt. The reason is that the interrupt controller can detect only link changes. In the following example, if there is a PHY that generates an interrupt then the following would happen. The GPIO detected that the interrupt line changed, and then the 'ocelot_irq_handler' was called. Here it detects which GPIO line saw the change and for that will call the following: 1. irq_mask 2. phy interrupt routine 3. irq_eoi 4. irq_unmask And this works fine for simple cases, but if the PHY generates many interrupts, for example when doing PTP timestamping, then the following could happen. Again the function 'ocelot_irq_handler' will be called and then from here the following could happen: 1. irq_mask 2. phy interrupt routine 3. irq_eoi 4. irq_unmask Right before step 3(irq_eoi), the PHY will generate another interrupt. Now the interrupt controller will acknowledge the change in the interrupt line. So we miss the interrupt. A solution will be to use 'handle_level_irq' instead of 'handle_fasteoi_irq', because for this will change routine order of handling the interrupt. 1. irq_mask 2. irq_ack 3. phy interrupt routine 4. irq_unmask And now if the PHY will generate a new interrupt before irq_unmask, the interrupt controller will detect this because it already acknowledge the change in interrupt line at step 2(irq_ack). But this is not the full solution because there is another issue. In case there are 2 PHYs that share the interrupt line. For example phy1 generates an interrupt, then the following can happen: 1.irq_mask 2.irq_ack 3.phy0 interrupt routine 4.phy1 interrupt routine 5.irq_unmask In case phy0 will generate an interrupt while clearing the interrupt source in phy1, then the interrupt line will be kept down by phy0. So the interrupt controller will not see any changes in the interrupt line. The solution here is to update 'irq_unmask' such that it can detect if the interrupt line is still active or not. And if it is active then call again the procedure to clear the interrupts. But we don't want to do it every time, only if we know that the interrupt controller has not seen already that the interrupt line has changed. While at this, add support also for IRQ_TYPE_LEVEL_LOW. Fixes: be36abb71d878f ("pinctrl: ocelot: add support for interrupt controller") Signed-off-by: Horatiu Vultur Link: https://lore.kernel.org/r/20220909145942.844102-1-horatiu.vultur@microchip.com Signed-off-by: Linus Walleij commit 09eed5a1ed3c752892663976837eb4244c2f1984 Author: Sergio Paracuellos Date: Tue Sep 13 18:46:38 2022 +0200 gpio: mt7621: Make the irqchip immutable Commit 6c846d026d49 ("gpio: Don't fiddle with irqchips marked as immutable") added a warning to indicate if the gpiolib is altering the internals of irqchips. Following this change the following warnings are now observed for the mt7621 driver: gpio gpiochip0: (1e000600.gpio-bank0): not an immutable chip, please consider fixing it! gpio gpiochip1: (1e000600.gpio-bank1): not an immutable chip, please consider fixing it! gpio gpiochip2: (1e000600.gpio-bank2): not an immutable chip, please consider fixing it! Fix this by making the irqchip in the mt7621 driver immutable. Tested-by: Arınç ÜNAL Signed-off-by: Sergio Paracuellos Signed-off-by: Bartosz Golaszewski commit 35ca91d1338ae158f6dcc0de5d1e86197924ffda Author: Sergei Antonov Date: Wed Sep 7 23:57:53 2022 +0300 mmc: moxart: fix 4-bit bus width and remove 8-bit bus width According to the datasheet [1] at page 377, 4-bit bus width is turned on by bit 2 of the Bus Width Register. Thus the current bitmask is wrong: define BUS_WIDTH_4 BIT(1) BIT(1) does not work but BIT(2) works. This has been verified on real MOXA hardware with FTSDC010 controller revision 1_6_0. The corrected value of BUS_WIDTH_4 mask collides with: define BUS_WIDTH_8 BIT(2). Additionally, 8-bit bus width mode isn't supported according to the datasheet, so let's remove the corresponding code. [1] https://bitbucket.org/Kasreyn/mkrom-uc7112lx/src/master/documents/FIC8120_DS_v1.2.pdf Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") Signed-off-by: Sergei Antonov Cc: Jonas Jensen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220907205753.1577434-1-saproj@gmail.com Signed-off-by: Ulf Hansson commit faded9b5572a27c1eaec19f3a2759b4547507731 Author: Wenchao Chen Date: Wed Sep 7 11:58:47 2022 +0800 mmc: sdhci: Fix host->cmd is null When data crc occurs, the kernel will panic because host->cmd is null. Signed-off-by: Wenchao Chen Fixes: efe8f5c9b5e1 ("mmc: sdhci: Capture eMMC and SD card errors") Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20220907035847.13783-1-wenchao.chen666@gmail.com Signed-off-by: Ulf Hansson commit 3245cb65fd91cd514801bf91f5a3066d562f0ac4 Merge: d1221cea11fca de11663b75b0a Author: Linus Torvalds Date: Wed Sep 14 10:22:39 2022 +0100 Merge tag 'devicetree-fixes-for-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Update some stale binding maintainer emails - Fix property name error in apple,aic binding - Add missing param to of_dma_configure_id() stub - Fix an off-by-one error in unflatten_dt_nodes() * tag 'devicetree-fixes-for-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: pinctrl: qcom: drop non-working codeaurora.org emails dt-bindings: power: qcom,rpmpd: drop non-working codeaurora.org emails dt-bindings: apple,aic: Fix required item "apple,fiq-index" in affinity description dt-bindings: interconnect: fsl,imx8m-noc: drop Leonard Crestez of/device: Fix up of_dma_configure_id() stub MAINTAINERS: Update email of Neil Armstrong of: fdt: fix off-by-one error in unflatten_dt_nodes() commit bdc9b7396f7d4d6533e70fd8d5472f505b5ef58f Author: Callum Osmotherly Date: Wed Sep 14 18:44:00 2022 +0930 ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop The Dell Precision 5570 uses the same 4-speakers-on-ALC289 just like the previous Precision 5560. I replicated that patch onto this one, and can confirm that the audio is much better (the woofers are now working); I've tested it on my Dell Precision 5570. Signed-off-by: Callum Osmotherly Cc: Link: https://lore.kernel.org/r/YyGbWM5wEoFMbW2v@piranha Signed-off-by: Takashi Iwai commit 8af8aed97bebe8b26a340da5236e277c3d84a8ec Author: Steve French Date: Tue Sep 13 23:00:02 2022 -0500 cifs: update internal module number To 2.39 Signed-off-by: Steve French commit 621a41ae0834cec9cab312d600d2b9de41dc6eac Author: Paulo Alcantara Date: Tue Sep 13 21:34:51 2022 -0700 cifs: add missing spinlock around tcon refcount Add missing spinlock to protect updates on tcon refcount in cifs_put_tcon(). Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data") Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit b0b9408f132623dc88e78adb5282f74e4b64bb57 Author: Nathan Huckleberry Date: Tue Sep 13 13:55:55 2022 -0700 drm/rockchip: Fix return type of cdn_dp_connector_mode_valid The mode_valid field in drm_connector_helper_funcs is expected to be of type: enum drm_mode_status (* mode_valid) (struct drm_connector *connector, struct drm_display_mode *mode); The mismatched return type breaks forward edge kCFI since the underlying function definition does not match the function hook definition. The return type of cdn_dp_connector_mode_valid should be changed from int to enum drm_mode_status. Reported-by: Dan Carpenter Link: https://github.com/ClangBuiltLinux/linux/issues/1703 Cc: llvm@lists.linux.dev Signed-off-by: Nathan Huckleberry Reviewed-by: Nathan Chancellor Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20220913205555.155149-1-nhuck@google.com commit 05d27090b6dc88bce71a608d1271536e582b73d1 Author: Conor Dooley Date: Fri Sep 9 13:31:11 2022 +0100 clk: microchip: mpfs: make the rtc's ahb clock critical The onboard RTC's AHB bus clock must be kept running as the RTC will stop & lose track of time if the AHB interface clock is disabled. Fixes: 635e5e73370e ("clk: microchip: Add driver for Microchip PolarFire SoC") Signed-off-by: Conor Dooley Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220909123123.2699583-3-conor.dooley@microchip.com commit 5da39ac5d648cdbfdfa8bea0e0cde279ded5c7c2 Author: Conor Dooley Date: Fri Sep 9 13:31:10 2022 +0100 clk: microchip: mpfs: fix clk_cfg array bounds violation There is an array bounds violation present during clock registration, triggered by current code by only specific toolchains. This seems to fail gracefully in v6.0-rc1, using a toolchain build from the riscv- gnu-toolchain repo and with clang-15, and life carries on. While converting the driver to use standard clock structs/ops, kernel panics were seen during boot when built with clang-15: [ 0.581754] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b1 [ 0.591520] Oops [#1] [ 0.594045] Modules linked in: [ 0.597435] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-00011-g8e1459cf4eca #1 [ 0.606188] Hardware name: Microchip PolarFire-SoC Icicle Kit (DT) [ 0.613012] epc : __clk_register+0x4a6/0x85c [ 0.617759] ra : __clk_register+0x49e/0x85c [ 0.622489] epc : ffffffff803faf7c ra : ffffffff803faf74 sp : ffffffc80400b720 [ 0.630466] gp : ffffffff810e93f8 tp : ffffffe77fe60000 t0 : ffffffe77ffb3800 [ 0.638443] t1 : 000000000000000a t2 : ffffffffffffffff s0 : ffffffc80400b7c0 [ 0.646420] s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000 [ 0.654396] a2 : 0000000000000001 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.662373] a5 : ffffffff803a5810 a6 : 0000000200000022 a7 : 0000000000000006 [ 0.670350] s2 : ffffffff81099d48 s3 : ffffffff80d6e28e s4 : 0000000000000028 [ 0.678327] s5 : ffffffff810ed3c8 s6 : ffffffff810ed3d0 s7 : ffffffe77ffbc100 [ 0.686304] s8 : ffffffe77ffb1540 s9 : ffffffe77ffb1540 s10: 0000000000000008 [ 0.694281] s11: 0000000000000000 t3 : 00000000000000c6 t4 : 0000000000000007 [ 0.702258] t5 : ffffffff810c78c0 t6 : ffffffe77ff88cd0 [ 0.708125] status: 0000000200000120 badaddr: 00000000000000b1 cause: 000000000000000d [ 0.716869] [] devm_clk_hw_register+0x62/0xaa [ 0.723420] [] mpfs_clk_probe+0x1e0/0x244 In v6.0-rc1 and later, this issue is visible without the follow on patches doing the conversion using toolchains provided by our Yocto meta layer too. It fails on "clk_periph_timer" - which uses a different parent, that it tries to find using the macro: \#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].cfg.hw) If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw which is well beyond the end of the array. Amazingly, builds with GCC 11.1 see no problem here, booting correctly and hooking the parent up etc. Builds with clang-15 do not, with the above panic. Change the macro to use specific offsets depending on the parent rather than the dt-binding's clock IDs. Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control") CC: Nathan Chancellor Signed-off-by: Conor Dooley Reviewed-by: Claudiu Beznea Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220909123123.2699583-2-conor.dooley@microchip.com commit bedc8f76b3539ac4f952114b316bcc2251e808ce Author: Stefan Metzmacher Date: Wed Sep 14 05:25:47 2022 +0200 cifs: always initialize struct msghdr smb_msg completely So far we were just lucky because the uninitialized members of struct msghdr are not used by default on a SOCK_STREAM tcp socket. But as new things like msg_ubuf and sg_from_iter where added recently, we should play on the safe side and avoid potention problems in future. Signed-off-by: Stefan Metzmacher Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 17d3df38dc5f4cec9b0ac6eb79c1859b6e2693a4 Author: Stefan Metzmacher Date: Wed Sep 14 05:25:46 2022 +0200 cifs: don't send down the destination address to sendmsg for a SOCK_STREAM This is ignored anyway by the tcp layer. Signed-off-by: Stefan Metzmacher Cc: stable@vger.kernel.org Reviewed-by: Ronnie Sahlberg Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit f7fc391a5e28216150ab5390df35032309ead7e5 Author: Tim Harvey Date: Mon Sep 12 11:08:34 2022 -0700 arm64: dts: imx8mp-venice-gw74xx: fix port/phy validation Since commit 65ac79e18120 ("net: dsa: microchip: add the phylink get_caps") the phy-mode must be set otherwise the switch driver will assume "NA" mode and invalidate the port. Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 56f99b8d06ef1ed1c9730948f9f05ac2b930a20b Author: Stefan Roesch Date: Mon Sep 12 09:53:25 2022 -0700 block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait Today blk_queue_enter() and __bio_queue_enter() return -EBUSY for the nowait code path. This is not correct: they should return -EAGAIN instead. This problem was detected by fio. The following command exposed the above problem: t/io_uring -p0 -d128 -b4096 -s32 -c32 -F1 -B0 -R0 -X1 -n24 -P1 -u1 -O0 /dev/ng0n1 By applying the patch, the retry case is handled correctly in the slow path. Signed-off-by: Stefan Roesch Fixes: bfd343aa1718 ("blk-mq: don't wait in blk_mq_queue_enter() if __GFP_WAIT isn't set") Signed-off-by: Jens Axboe commit 41012d715d5d7b9751ae84b8fb255e404ac9c5d0 Author: Nathan Chancellor Date: Tue Aug 30 13:34:09 2022 -0700 drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage This function consumes a lot of stack space and it blows up the size of dml30_ModeSupportAndSystemConfigurationFull() with clang: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3542:6: error: stack frame size (2200) exceeds limit (2048) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Commit a0f7e7f759cf ("drm/amd/display: fix i386 frame size warning") aimed to address this for i386 but it did not help x86_64. To reduce the amount of stack space that dml30_ModeSupportAndSystemConfigurationFull() uses, mark UseMinimumDCFCLK() as noinline, using the _for_stack variant for documentation. While this will increase the total amount of stack usage between the two functions (1632 and 1304 bytes respectively), it will make sure both stay below the limit of 2048 bytes for these files. The aforementioned change does help reduce UseMinimumDCFCLK()'s stack usage so it should not be reverted in favor of this change. Link: https://github.com/ClangBuiltLinux/linux/issues/1681 Reported-by: "Sudip Mukherjee (Codethink)" Tested-by: Maíra Canal Reviewed-by: Rodrigo Siqueira Signed-off-by: Nathan Chancellor Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 21485d3da659b66c37d99071623af83ee1c6733d Author: Nathan Chancellor Date: Tue Aug 30 13:34:08 2022 -0700 drm/amd/display: Reduce number of arguments of dml31's CalculateFlipSchedule() Most of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer. This reduces the total amount of stack space that dml31_ModeSupportAndSystemConfigurationFull() uses by 112 bytes with LLVM 16 (1976 -> 1864), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c:3908:6: error: stack frame size (2216) exceeds limit (2048) in 'dml31_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml31_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Link: https://github.com/ClangBuiltLinux/linux/issues/1681 Reported-by: "Sudip Mukherjee (Codethink)" Tested-by: Maíra Canal Reviewed-by: Rodrigo Siqueira Signed-off-by: Nathan Chancellor Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 37934d4118e22bceb80141804391975078f31734 Author: Nathan Chancellor Date: Tue Aug 30 13:34:07 2022 -0700 drm/amd/display: Reduce number of arguments of dml31's CalculateWatermarksAndDRAMSpeedChangeSupport() Most of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer. This reduces the total amount of stack space that dml31_ModeSupportAndSystemConfigurationFull() uses by 240 bytes with LLVM 16 (2216 -> 1976), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/display_mode_vba_31.c:3908:6: error: stack frame size (2216) exceeds limit (2048) in 'dml31_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml31_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Link: https://github.com/ClangBuiltLinux/linux/issues/1681 Reported-by: "Sudip Mukherjee (Codethink)" Tested-by: Maíra Canal Reviewed-by: Rodrigo Siqueira Signed-off-by: Nathan Chancellor Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit a3fef74b1d48d89d4d911fcd7c2630d0eb6a0012 Author: Nathan Chancellor Date: Tue Aug 30 13:34:06 2022 -0700 drm/amd/display: Reduce number of arguments of dml32_CalculatePrefetchSchedule() Several of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer. This reduces the total amount of stack space that dml32_ModeSupportAndSystemConfigurationFull() uses by 208 bytes with LLVM 16 (1936 -> 1728), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1721:6: error: stack frame size (2152) exceeds limit (2048) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Additionally, while modifying the arguments to dml32_CalculatePrefetchSchedule(), use 'v' consistently, instead of 'v' mixed with 'mode_lib->vba'. Link: https://github.com/ClangBuiltLinux/linux/issues/1681 Reported-by: "Sudip Mukherjee (Codethink)" Tested-by: Maíra Canal Reviewed-by: Rodrigo Siqueira Signed-off-by: Nathan Chancellor Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit c4be0ac987f21e12e7ad23bc480e826d8c30de20 Author: Nathan Chancellor Date: Tue Aug 30 13:34:05 2022 -0700 drm/amd/display: Reduce number of arguments of dml32_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport() Most of the arguments are identical between the two call sites and they can be accessed through the 'struct vba_vars_st' pointer created at the top of dml32_ModeSupportAndSystemConfigurationFull(). This reduces the total amount of stack space that dml32_ModeSupportAndSystemConfigurationFull() uses by 216 bytes with LLVM 16 (2152 -> 1936), helping clear up the following clang warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1721:6: error: stack frame size (2152) exceeds limit (2048) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) ^ 1 error generated. Additionally, while modifying the arguments to dml32_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport(), use 'v' consistently, instead of 'v' mixed with 'mode_lib->vba'. Link: https://github.com/ClangBuiltLinux/linux/issues/1681 Reported-by: "Sudip Mukherjee (Codethink)" Tested-by: Maíra Canal Reviewed-by: Rodrigo Siqueira Signed-off-by: Nathan Chancellor Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit d978c51f8d1f4314c84cf50291156862a4c34fc8 Author: Alvin Lee Date: Sat Aug 6 01:58:00 2022 +0800 drm/amd/display: Refactor SubVP calculation to remove FPU Refactor calculation to remove floating point operations from dmub_srv. To ensure that 32-bit compilation works well, we use the div64 family of macros to do integer division for SubVP-related timing parameters. Cc: Maíra Canal Cc: Alex Deucher Cc: Isabella Basso Cc: Magali Lemes Tested-by: Daniel Wheeler Reviewed-by: Samson Tam Acked-by: Tom Chung Signed-off-by: Alvin Lee Co-developed-by: Aurabindo Pillai Signed-off-by: Aurabindo Pillai Co-developed-by: Rodrigo Siqueira Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 3601d620f22e37740cf73f8278eabf9f2aa19eb7 Author: Yao Wang1 Date: Mon Aug 22 18:30:31 2022 +0800 drm/amd/display: Limit user regamma to a valid value [Why] For HDR mode, we get total 512 tf_point and after switching to SDR mode we actually get 400 tf_point and the rest of points(401~512) still use dirty value from HDR mode. We should limit the rest of the points to max value. [How] Limit the value when coordinates_x.x > 1, just like what we do in translate_from_linear_space for other re-gamma build paths. Tested-by: Daniel Wheeler Reviewed-by: Krunoslav Kovac Reviewed-by: Aric Cyr Acked-by: Pavle Kotarac Signed-off-by: Yao Wang1 Signed-off-by: Alex Deucher commit ceb756004a30239c3a50dc237313e234b667077e Author: Aurabindo Pillai Date: Thu Aug 25 15:05:58 2022 -0400 drm/amd/display: add workaround for subvp cursor corruption for DCN32/321 [Why&How] Kernel does not have a means to tell the userspace to use software cursor. Due to lack of this functionality, reducing the max cursor size is the only way to ensure that power savings of Subview port feature is utilized for asics that support it. The workaround could be removed after cursor caching is fixed while a subviewport config is active. Tested-by: Daniel Wheeler Reviewed-by: Alvin Lee Acked-by: Pavle Kotarac Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 1bb8df66920a5549db2be92c23ab81fd06992e5d Author: Alvin Lee Date: Wed Aug 24 11:53:50 2022 -0400 drm/amd/display: SW cursor fallback for SubVP [Description] Leverage SW cursor fall back for SubVP when the cursor is too big. We want to take advantage of being able to fallback to SW cursor when possible because it's not worth it to disable MCLK switching because the cursor is slightly too big. Tested-by: Daniel Wheeler Reviewed-by: Aurabindo Pillai Acked-by: Pavle Kotarac Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 6acc6196a7320b3d2a391925c4c884fc07f0b3df Author: Taimur Hassan Date: Thu Aug 25 12:33:12 2022 -0400 drm/amd/display: Round cursor width up for MALL allocation [Why & How] When calculating cursor size for MALL allocation, the cursor width should be the actual width rounded up to 64 alignment. Additionally, the bit depth should vary depending on color format. Tested-by: Daniel Wheeler Reviewed-by: Alvin Lee Acked-by: Pavle Kotarac Signed-off-by: Taimur Hassan Signed-off-by: Alex Deucher commit 0b15b1ec8b74bd5c9a4e4cbadab82c0657832799 Author: Duncan Ma Date: Wed Aug 24 14:35:03 2022 -0400 drm/amd/display: Correct dram channel width for dcn314 [Why] The interpretation of the number of memory channels differ by memory type, and this affects channel width for the DML input. [How] Set dram channel width according to memory type for dcn314. Tested-by: Daniel Wheeler Reviewed-by: Nicholas Kazlauskas Reviewed-by: Jun Lei Acked-by: Pavle Kotarac Signed-off-by: Duncan Ma Signed-off-by: Alex Deucher commit 82c4018479fba63db8db7c7fbfd9e4afba95603a Author: Nicholas Kazlauskas Date: Wed Aug 24 10:51:21 2022 -0400 drm/amd/display: Relax swizzle checks for video non-RGB formats on DCN314 [Why] HW can support the display swizzle modes for video, and those are preferable over standard or linear for decode use. [How] Remove the check for DCN314. Tested-by: Daniel Wheeler Reviewed-by: Jun Lei Acked-by: Pavle Kotarac Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit ea45405d704e20826a899380c19ec163336f42ab Author: Nicholas Kazlauskas Date: Wed Aug 24 09:24:18 2022 -0400 drm/amd/display: Hook up DCN314 specific dml implementation [Why & How] Add support for the DML314 functions and hook up DCN314 to use them. This has some necessary additions for calculating Max VSTARTUP for future features, but there's also some changes that we have to make for pixel format/swizzle support. That will come in a following patch to make this transition easier to bisect. Tested-by: Daniel Wheeler Reviewed-by: Jun Lei Acked-by: Pavle Kotarac Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Deucher commit af2f2a256e048f1b83605eaae49948e4a6811ac1 Author: Rodrigo Siqueira Date: Thu Sep 1 16:07:19 2022 -0400 drm/amd/display: Enable dlg and vba compilation for dcn314 We were not using the VBA and DLG files for DCN314, but the next sequence of changes for DCN314 will require those files. This commit adds the necessary files to the Makefile. Cc: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 18aefea7fc71759a2405bc65eae057ffda3c429c Author: Rodrigo Siqueira Date: Thu Sep 1 16:00:52 2022 -0400 drm/amd/display: Fix compilation errors on DCN314 We have some compilation errors in some DML files from DCN314 that we never noticed because we were not compiling some of the DML files. This commit fixes those syntax errors before we enable the compilation. Cc: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit f9c182056b8ff7402a46c39c34d5c91133fdf9a4 Author: Aric Cyr Date: Wed Aug 24 16:34:53 2022 -0400 drm/amd/display: Fix divide by zero in DML [why] Incorrectly using MicroTileWidth instead of MacroTileWidth for calculations. [how] Remove all unused references to MicroTile and change them to MacroTile. Tested-by: Daniel Wheeler Reviewed-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Pavle Kotarac Signed-off-by: Aric Cyr Signed-off-by: Alex Deucher commit 269aad0919c7aedffc18dcf46393a1bec457af0a Author: Leo Chen Date: Wed Aug 24 15:34:24 2022 -0400 drm/amd/display: Fixing DIG FIFO Error [Why & How] DIG_FIFO_READ_START_LEVEL should only be set to default value (7) by software. Removed all instances of resetting the register to 0 Tested-by: Daniel Wheeler Reviewed-by: Nicholas Kazlauskas Acked-by: Pavle Kotarac Signed-off-by: Leo Chen Signed-off-by: Alex Deucher commit 58d97c99c99f4559072a5410ec0135271e24e95d Author: Alvin Lee Date: Tue Aug 23 17:14:03 2022 -0400 drm/amd/display: Update MBLK calculation for SubVP [Description] Update MBLK calculation according to hardware doc. For DCC case we were not allocation enough MALL due to an inaccurate MBLK calculation. Tested-by: Daniel Wheeler Reviewed-by: Jun Lei Acked-by: Pavle Kotarac Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 42ff33e63b83d0fd40985ccbb50ff54e320a3bd5 Author: Aurabindo Pillai Date: Thu Aug 11 16:42:12 2022 -0400 drm/amd/display: Revert "Fallback to SW cursor if SubVP + cursor too big" This reverts commit a4f1b04216023ff0f4cd89328b59ee6890248130 since returning false in case of SubVP results in no cursor being visible on desktop as there is no sw cursor fallback path on all platforms. Tested-by: Daniel Wheeler Reviewed-by: Alvin Lee Acked-by: Pavle Kotarac Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 86875d558b91cb46f43be112799c06ecce60ec1e Author: Candice Li Date: Wed Sep 7 15:52:04 2022 +0800 drm/amdgpu: Skip reset error status for psp v13_0_0 No need to reset error status since only umc ras supported on psp v13_0_0. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 8c5708d3da37b8c7c3c22c7e945b9a76a7c9539b Author: Alex Deucher Date: Tue Aug 30 11:08:09 2022 -0400 drm/amdgpu: add HDP remap functionality to nbio 7.7 Was missing before and would have resulted in a write to a non-existant register. Normally APUs don't use HDP, but other asics could use this code and APUs do use the HDP when used in passthrough. Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 36de13fdb04abef3ee03ade5129ab146de63983b Author: Yang Wang Date: Fri Sep 9 11:06:50 2022 +0800 drm/amdgpu: change the alignment size of TMR BO to 1M align TMR BO size TO tmr size is not necessary, modify the size to 1M to avoid re-create BO fail when serious VRAM fragmentation. v2: add new macro PSP_TMR_ALIGNMENT for TMR BO alignment size Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit df2c6e0c95ca22db5d6bea7e8169841c95426f8d Author: Candice Li Date: Wed Sep 7 15:58:59 2022 +0800 drm/amdgpu: Enable full reset when RAS is supported on gc v11_0_0 Enable full reset for RAS supported configuration on gc v11_0_0. v2: simplify the code. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 66f99628eb24409cb8feb5061f78283c8b65f820 Author: Hamza Mahfooz Date: Tue Sep 6 15:01:49 2022 -0400 drm/amdgpu: use dirty framebuffer helper Currently, we aren't handling DRM_IOCTL_MODE_DIRTYFB. So, use drm_atomic_helper_dirtyfb() as the dirty callback in the amdgpu_fb_funcs struct. Signed-off-by: Hamza Mahfooz Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6c20490663553cd7e07d8de8af482012329ab9d6 Author: Lijo Lazar Date: Thu Sep 8 08:28:57 2022 +0530 drm/amdgpu: Don't enable LTR if not supported As per PCIE Base Spec r4.0 Section 6.18 'Software must not enable LTR in an Endpoint unless the Root Complex and all intermediate Switches indicate support for LTR.' This fixes the Unsupported Request error reported through AER during ASPM enablement. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216455 The error was unnoticed before and got visible because of the commit referenced below. This doesn't fix anything in the commit below, rather fixes the issue in amdgpu exposed by the commit. The reference is only to associate this commit with below one so that both go together. Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()") Reported-by: Gustaw Smolarczyk Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher commit 7c6fb61a400bf3218c6504cb2d48858f98822c9d Author: Guchun Chen Date: Wed Sep 7 20:31:36 2022 +0800 drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards To avoid hardware intermittent failures. Signed-off-by: Guchun Chen Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 33a2d6bc3480f9f8ac8c8def29854f98cc8bfee2 Author: Andrei Vagin Date: Tue Sep 13 03:25:51 2022 -0700 Revert "fs/exec: allow to unshare a time namespace on vfork+exec" This reverts commit 133e2d3e81de5d9706cab2dd1d52d231c27382e5. Alexey pointed out a few undesirable side effects of the reverted change. First, it doesn't take into account that CLONE_VFORK can be used with CLONE_THREAD. Second, a child process doesn't enter a target time name-space, if its parent dies before the child calls exec. It happens because the parent clears vfork_done. Eric W. Biederman suggests installing a time namespace as a task gets a new mm. It includes all new processes cloned without CLONE_VM and all tasks that call exec(). This is an user API change, but we think there aren't users that depend on the old behavior. It is too late to make such changes in this release, so let's roll back this patch and introduce the right one in the next release. Cc: Alexey Izbyshev Cc: Christian Brauner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: "Eric W. Biederman" Cc: Florian Weimer Cc: Kees Cook Signed-off-by: Andrei Vagin Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220913102551.1121611-3-avagin@google.com commit 2b1e8921fc355ff5afda65690d6e40ce25b80cd7 Author: Andrei Vagin Date: Tue Sep 13 03:25:50 2022 -0700 Revert "selftests/timens: add a test for vfork+exit" The next patch reverts the code that this test verified. This reverts commit 6342140db6609a0c7d34f68c52b2947468e0e630. Signed-off-by: Andrei Vagin Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220913102551.1121611-2-avagin@google.com commit de11663b75b0a8f1cfeb00d3b4acec9bd5a49cad Author: Krzysztof Kozlowski Date: Sun Sep 11 13:25:20 2022 +0200 dt-bindings: pinctrl: qcom: drop non-working codeaurora.org emails Emails to codeaurora.org bounce ("Recipient address rejected: undeliverable address: No such user here."). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220911112520.203062-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 969d373228f6624de87aa0982d89a756e8e77471 Author: Krzysztof Kozlowski Date: Sun Sep 11 13:25:08 2022 +0200 dt-bindings: power: qcom,rpmpd: drop non-working codeaurora.org emails Emails to codeaurora.org bounce ("Recipient address rejected: undeliverable address: No such user here."). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220911112508.202995-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 94e9bc73d85aa6ecfe249e985ff57abe0ab35f34 Author: Linus Walleij Date: Sun Sep 11 21:07:51 2022 +0200 gpio: ixp4xx: Make irqchip immutable This turns the IXP4xx GPIO irqchip into an immutable irqchip, a bit different from the standard template due to being hierarchical. Tested on the IXP4xx which uses drivers/ata/pata_ixp4xx_cf.c for a rootfs on compact flash with IRQs from this GPIO block to the CF ATA controller. Cc: Marc Zyngier Signed-off-by: Linus Walleij Acked-by: Marc Zyngier Signed-off-by: Bartosz Golaszewski commit 1660c679d6d4779fbce937d0c9dc2af56e66e62d Author: Jay Fang Date: Thu Sep 8 19:21:51 2022 +0800 MAINTAINERS: Update HiSilicon GPIO Driver maintainer Add Jay Fang as the maintainer of the HiSilicon GPIO Driver, replacing Luo Jiaxing. Cc: Luo Jiaxing Signed-off-by: Jay Fang Acked-by: Jonathan Cameron Acked-by: Jiaxing Luo Signed-off-by: Bartosz Golaszewski commit 62bb0647b14646fa6c9aa25ecdf67ad18f13523c Author: Pavel Begunkov Date: Tue Sep 13 13:21:23 2022 +0100 io_uring/rw: fix error'ed retry return values Kernel test robot reports that we test negativity of an unsigned in io_fixup_rw_res() after a recent change, which masks error codes and messes up the return value in case I/O is re-retried and failed with an error. Fixes: 4d9cb92ca41dd ("io_uring/rw: fix short rw error handling") Reported-by: kernel test robot Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9754a0970af1861e7865f9014f735c70dc60bf79.1663071587.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d1221cea11fca0f6946bdd032a45b22cecfc0f99 Merge: e839a756012b6 bfbfb6182ad1d Author: Linus Torvalds Date: Tue Sep 13 15:11:38 2022 +0200 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull iov_iter fix from Al Viro: "Fix for a nfsd regression caused by the iov_iter stuff this window" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: nfsd_splice_actor(): handle compound pages commit da3b1c294d470b2cf3c7046cc9e0d5c66f0a6c65 Author: Janne Grunau Date: Fri Sep 9 15:50:54 2022 +0200 dt-bindings: apple,aic: Fix required item "apple,fiq-index" in affinity description The required list used "fiq-index" instead of "apple,fiq-index" described as property and used in the dts. Add the missing "apple," prefix. Fixes: dba07ad11384 ("dt-bindings: apple,aic: Add affinity description for per-cpu pseudo-interrupts") Signed-off-by: Janne Grunau Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20220909135103.98179-2-j@jannau.net Signed-off-by: Rob Herring commit d640c4cb8f2f933c0ca896541f9de7fb1ae245f4 Author: jerry meng Date: Mon Sep 5 14:35:33 2022 +0800 USB: serial: option: add Quectel RM520N add support for Quectel RM520N which is based on Qualcomm SDX62 chip. 0x0801: DIAG + NMEA + AT + MODEM + RMNET T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0801 Rev= 5.04 S: Manufacturer=Quectel S: Product=RM520N-GL S: SerialNumber=384af524 C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: jerry meng Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f8f67eff6847f9b8d753fa029723bcc54296055a Author: Carl Yin(殷张成) Date: Fri Sep 2 09:49:43 2022 +0000 USB: serial: option: add Quectel BG95 0x0203 composition Add support for the following Quectel BG95 composition: 0x0203: Diag + GNSS + Modem + ECM usb-devices output: T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0203 Rev= 0.00 S: Manufacturer=Quectel, Incorporated S: Product=Quectel LPWA Module S: SerialNumber=71d3a21b C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Carl Yin Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 2dd7e7bc02829eded71be2342a93dc035f5223f9 Author: Naohiro Aota Date: Fri Sep 9 15:59:55 2022 +0900 btrfs: zoned: wait for extent buffer IOs before finishing a zone Before sending REQ_OP_ZONE_FINISH to a zone, we need to ensure that ongoing IOs already finished. Or, we will see a "Zone Is Full" error for the IOs, as the ZONE_FINISH command makes the zone full. We ensure that with btrfs_wait_block_group_reservations() and btrfs_wait_ordered_roots() for a data block group. And, for a metadata block group, the comparison of alloc_offset vs meta_write_pointer mostly ensures IOs for the allocated region already sent. However, there still can be a little time frame where the IOs are sent but not yet completed. Introduce wait_eb_writebacks() to ensure such IOs are completed for a metadata block group. It walks the buffer_radix to find extent buffers in the block group and calls wait_on_extent_buffer_writeback() on them. Fixes: afba2bc036b0 ("btrfs: zoned: implement active zone tracking") CC: stable@vger.kernel.org # 5.19+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit a362bb864b8db4861977d00bd2c3222503ccc34b Author: Filipe Manana Date: Thu Sep 8 12:31:51 2022 +0100 btrfs: fix hang during unmount when stopping a space reclaim worker Often when running generic/562 from fstests we can hang during unmount, resulting in a trace like this: Sep 07 11:52:00 debian9 unknown: run fstests generic/562 at 2022-09-07 11:52:00 Sep 07 11:55:32 debian9 kernel: INFO: task umount:49438 blocked for more than 120 seconds. Sep 07 11:55:32 debian9 kernel: Not tainted 6.0.0-rc2-btrfs-next-122 #1 Sep 07 11:55:32 debian9 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Sep 07 11:55:32 debian9 kernel: task:umount state:D stack: 0 pid:49438 ppid: 25683 flags:0x00004000 Sep 07 11:55:32 debian9 kernel: Call Trace: Sep 07 11:55:32 debian9 kernel: Sep 07 11:55:32 debian9 kernel: __schedule+0x3c8/0xec0 Sep 07 11:55:32 debian9 kernel: ? rcu_read_lock_sched_held+0x12/0x70 Sep 07 11:55:32 debian9 kernel: schedule+0x5d/0xf0 Sep 07 11:55:32 debian9 kernel: schedule_timeout+0xf1/0x130 Sep 07 11:55:32 debian9 kernel: ? lock_release+0x224/0x4a0 Sep 07 11:55:32 debian9 kernel: ? lock_acquired+0x1a0/0x420 Sep 07 11:55:32 debian9 kernel: ? trace_hardirqs_on+0x2c/0xd0 Sep 07 11:55:32 debian9 kernel: __wait_for_common+0xac/0x200 Sep 07 11:55:32 debian9 kernel: ? usleep_range_state+0xb0/0xb0 Sep 07 11:55:32 debian9 kernel: __flush_work+0x26d/0x530 Sep 07 11:55:32 debian9 kernel: ? flush_workqueue_prep_pwqs+0x140/0x140 Sep 07 11:55:32 debian9 kernel: ? trace_clock_local+0xc/0x30 Sep 07 11:55:32 debian9 kernel: __cancel_work_timer+0x11f/0x1b0 Sep 07 11:55:32 debian9 kernel: ? close_ctree+0x12b/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? __trace_bputs+0x10b/0x170 Sep 07 11:55:32 debian9 kernel: close_ctree+0x152/0x5b3 [btrfs] Sep 07 11:55:32 debian9 kernel: ? evict_inodes+0x166/0x1c0 Sep 07 11:55:32 debian9 kernel: generic_shutdown_super+0x71/0x120 Sep 07 11:55:32 debian9 kernel: kill_anon_super+0x14/0x30 Sep 07 11:55:32 debian9 kernel: btrfs_kill_super+0x12/0x20 [btrfs] Sep 07 11:55:32 debian9 kernel: deactivate_locked_super+0x2e/0xa0 Sep 07 11:55:32 debian9 kernel: cleanup_mnt+0x100/0x160 Sep 07 11:55:32 debian9 kernel: task_work_run+0x59/0xa0 Sep 07 11:55:32 debian9 kernel: exit_to_user_mode_prepare+0x1a6/0x1b0 Sep 07 11:55:32 debian9 kernel: syscall_exit_to_user_mode+0x16/0x40 Sep 07 11:55:32 debian9 kernel: do_syscall_64+0x48/0x90 Sep 07 11:55:32 debian9 kernel: entry_SYSCALL_64_after_hwframe+0x63/0xcd Sep 07 11:55:32 debian9 kernel: RIP: 0033:0x7fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RSP: 002b:00007ffe914217c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 Sep 07 11:55:32 debian9 kernel: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7 Sep 07 11:55:32 debian9 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b57556cdd0 Sep 07 11:55:32 debian9 kernel: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570 Sep 07 11:55:32 debian9 kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 Sep 07 11:55:32 debian9 kernel: R13: 000055b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000 Sep 07 11:55:32 debian9 kernel: What happens is the following: 1) The cleaner kthread tries to start a transaction to delete an unused block group, but the metadata reservation can not be satisfied right away, so a reservation ticket is created and it starts the async metadata reclaim task (fs_info->async_reclaim_work); 2) Writeback for all the filler inodes with an i_size of 2K starts (generic/562 creates a lot of 2K files with the goal of filling metadata space). We try to create an inline extent for them, but we fail when trying to insert the inline extent with -ENOSPC (at cow_file_range_inline()) - since this is not critical, we fallback to non-inline mode (back to cow_file_range()), reserve extents, create extent maps and create the ordered extents; 3) An unmount starts, enters close_ctree(); 4) The async reclaim task is flushing stuff, entering the flush states one by one, until it reaches RUN_DELAYED_IPUTS. There it runs all current delayed iputs. After running the delayed iputs and before calling btrfs_wait_on_delayed_iputs(), one or more ordered extents complete, and btrfs_add_delayed_iput() is called for each one through btrfs_finish_ordered_io() -> btrfs_put_ordered_extent(). This results in bumping fs_info->nr_delayed_iputs from 0 to some positive value. So the async reclaim task blocks at btrfs_wait_on_delayed_iputs() waiting for fs_info->nr_delayed_iputs to become 0; 5) The current transaction is committed by the transaction kthread, we then start unpinning extents and end up calling btrfs_try_granting_tickets() through unpin_extent_range(), since we released some space. This results in satisfying the ticket created by the cleaner kthread at step 1, waking up the cleaner kthread; 6) At close_ctree() we ask the cleaner kthread to park; 7) The cleaner kthread starts the transaction, deletes the unused block group, and then calls kthread_should_park(), which returns true, so it parks. And at this point we have the delayed iputs added by the completion of the ordered extents still pending; 8) Then later at close_ctree(), when we call: cancel_work_sync(&fs_info->async_reclaim_work); We hang forever, since the cleaner was parked and no one else can run delayed iputs after that, while the reclaim task is waiting for the remaining delayed iputs to be completed. Fix this by waiting for all ordered extents to complete and running the delayed iputs before attempting to stop the async reclaim tasks. Note that we can not wait for ordered extents with btrfs_wait_ordered_roots() (or other similar functions) because that waits for the BTRFS_ORDERED_COMPLETE flag to be set on an ordered extent, but the delayed iput is added after that, when doing the final btrfs_put_ordered_extent(). So instead wait for the work queues used for executing ordered extent completion to be empty, which works because we do the final put on an ordered extent at btrfs_finish_ordered_io() (while we are in the unmount context). Fixes: d6fd0ae25c6495 ("Btrfs: fix missing delayed iputs on unmount") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 8a1f1e3d1eecf9d2359a2709e276743a67e145db Author: Filipe Manana Date: Thu Sep 8 12:31:50 2022 +0100 btrfs: fix hang during unmount when stopping block group reclaim worker During early unmount, at close_ctree(), we try to stop the block group reclaim task with cancel_work_sync(), but that may hang if the block group reclaim task is currently at btrfs_relocate_block_group() waiting for the flag BTRFS_FS_UNFINISHED_DROPS to be cleared from fs_info->flags. During unmount we only clear that flag later, after trying to stop the block group reclaim task. Fix that by clearing BTRFS_FS_UNFINISHED_DROPS before trying to stop the block group reclaim task and after setting BTRFS_FS_CLOSING_START, so that if the reclaim task is waiting on that bit, it will stop immediately after being woken, because it sees the filesystem is closing (with a call to btrfs_fs_closing()), and then returns immediately with -EINTR. Fixes: 31e70e527806c5 ("btrfs: fix hang during unmount when block group reclaim task is running") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 95363747a6f39e88a3052fcf6ce6237769495ce0 Author: Ben Hutchings Date: Tue Aug 25 23:27:40 2020 +0100 tools/include/uapi: Fix for parisc and xtensa tools/include/uapi/asm/errno.h currently attempts to include non-existent arch-specific errno.h header for xtensa. Remove this case so that is used instead, and add the missing arch-specific header for parisc. References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=ia64&ver=5.8.3-1%7Eexp1&stamp=1598340829&raw=1 Signed-off-by: Ben Hutchings Signed-off-by: Salvatore Bonaccorso Cc: # 5.10+ Signed-off-by: Helge Deller commit 4b9d1bc7911c9d9159c4881455c584cde99fbb19 Author: Jiangshan Yi Date: Tue Sep 6 13:49:01 2022 +0800 Input: hp_sdc: fix spelling typo in comment Fix spelling typo in comment. Reported-by: k2ci Signed-off-by: Jiangshan Yi Signed-off-by: Helge Deller commit d56ba9a04d7548d4149c46ec86a0e3cc41a70f4a Author: Shengjiu Wang Date: Tue Sep 13 17:00:01 2022 +0800 ASoC: imx-card: Fix refcount issue with of_node_put imx_card_parse_of will search all the node with loop, if there is defer probe happen in the middle of loop, the previous released codec node will be released twice, then cause refcount issue. Here assign NULL to pointer of released nodes to fix the issue. Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1663059601-29259-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 8f7e001e0325de63a42f23342ac3b8139150c5cf Author: Palmer Dabbelt Date: Mon Sep 12 23:48:01 2022 +0100 RISC-V: Clean up the Zicbom block size probing This fixes two issues: I truncated the warning's hart ID when porting to the 64-bit hart ID code, and the original code's warning handling could fire on an uninitialized hart ID. The biggest change here is that riscv_cbom_block_size is no longer initialized, as IMO the default isn't sane: there's nothing in the ISA that mandates any specific cache block size, so falling back to one will just silently produce the wrong answer on some systems. This also changes the probing order so the cache block size is known before enabling Zicbom support. CC: stable@vger.kernel.org CC: Andrew Jones CC: Heiko Stuebner CC: Atish Patra Fixes: 3aefb2ee5bdd ("riscv: implement Zicbom-based CMO instructions + the t-head variant") Fixes: 1631ba1259d6 ("riscv: Add support for non-coherent devices using zicbom extension") Reported-by: kernel test robot Reported-by: Conor Dooley Signed-off-by: Palmer Dabbelt [Conor: fixed the redefinition errors] Tested-by: Conor Dooley Signed-off-by: Conor Dooley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220912224800.998121-1-mail@conchuod.ie Signed-off-by: Palmer Dabbelt commit 0727a9a5fbc1151fcaebfa9772e9f68f5e38ba9e Author: Matthieu Baerts Date: Tue Sep 6 20:04:02 2022 +0200 Documentation: mptcp: fix pm_type formatting When looking at the rendered HTML version, we can see 'pm_type' is not displayed with a bold font: https://docs.kernel.org/5.19/networking/mptcp-sysctl.html The empty line under 'pm_type' is then removed to have the same style as the others. Fixes: 6bb63ccc25d4 ("mptcp: Add a per-namespace sysctl to set the default path manager type") Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20220906180404.1255873-2-matthieu.baerts@tessares.net Signed-off-by: Paolo Abeni commit 7288ff6ec795804b1b4632e535403d52bd2b3ce1 Author: Paolo Abeni Date: Tue Sep 6 20:04:01 2022 +0200 mptcp: fix fwd memory accounting on coalesce The intel bot reported a memory accounting related splat: [ 240.473094] ------------[ cut here ]------------ [ 240.478507] page_counter underflow: -4294828518 nr_pages=4294967290 [ 240.485500] WARNING: CPU: 2 PID: 14986 at mm/page_counter.c:56 page_counter_cancel+0x96/0xc0 [ 240.570849] CPU: 2 PID: 14986 Comm: mptcp_connect Tainted: G S 5.19.0-rc4-00739-gd24141fe7b48 #1 [ 240.581637] Hardware name: HP HP Z240 SFF Workstation/802E, BIOS N51 Ver. 01.63 10/05/2017 [ 240.590600] RIP: 0010:page_counter_cancel+0x96/0xc0 [ 240.596179] Code: 00 00 00 45 31 c0 48 89 ef 5d 4c 89 c6 41 5c e9 40 fd ff ff 4c 89 e2 48 c7 c7 20 73 39 84 c6 05 d5 b1 52 04 01 e8 e7 95 f3 01 <0f> 0b eb a9 48 89 ef e8 1e 25 fc ff eb c3 66 66 2e 0f 1f 84 00 00 [ 240.615639] RSP: 0018:ffffc9000496f7c8 EFLAGS: 00010082 [ 240.621569] RAX: 0000000000000000 RBX: ffff88819c9c0120 RCX: 0000000000000000 [ 240.629404] RDX: 0000000000000027 RSI: 0000000000000004 RDI: fffff5200092deeb [ 240.637239] RBP: ffff88819c9c0120 R08: 0000000000000001 R09: ffff888366527a2b [ 240.645069] R10: ffffed106cca4f45 R11: 0000000000000001 R12: 00000000fffffffa [ 240.652903] R13: ffff888366536118 R14: 00000000fffffffa R15: ffff88819c9c0000 [ 240.660738] FS: 00007f3786e72540(0000) GS:ffff888366500000(0000) knlGS:0000000000000000 [ 240.669529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 240.675974] CR2: 00007f966b346000 CR3: 0000000168cea002 CR4: 00000000003706e0 [ 240.683807] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 240.691641] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 240.699468] Call Trace: [ 240.702613] [ 240.705413] page_counter_uncharge+0x29/0x80 [ 240.710389] drain_stock+0xd0/0x180 [ 240.714585] refill_stock+0x278/0x580 [ 240.718951] __sk_mem_reduce_allocated+0x222/0x5c0 [ 240.729248] __mptcp_update_rmem+0x235/0x2c0 [ 240.734228] __mptcp_move_skbs+0x194/0x6c0 [ 240.749764] mptcp_recvmsg+0xdfa/0x1340 [ 240.763153] inet_recvmsg+0x37f/0x500 [ 240.782109] sock_read_iter+0x24a/0x380 [ 240.805353] new_sync_read+0x420/0x540 [ 240.838552] vfs_read+0x37f/0x4c0 [ 240.842582] ksys_read+0x170/0x200 [ 240.864039] do_syscall_64+0x5c/0x80 [ 240.872770] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 240.878526] RIP: 0033:0x7f3786d9ae8e [ 240.882805] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 6e 18 0a 00 e8 89 e8 01 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 [ 240.902259] RSP: 002b:00007fff7be81e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 240.910533] RAX: ffffffffffffffda RBX: 0000000000002000 RCX: 00007f3786d9ae8e [ 240.918368] RDX: 0000000000002000 RSI: 00007fff7be87ec0 RDI: 0000000000000005 [ 240.926206] RBP: 0000000000000005 R08: 00007f3786e6a230 R09: 00007f3786e6a240 [ 240.934046] R10: fffffffffffff288 R11: 0000000000000246 R12: 0000000000002000 [ 240.941884] R13: 00007fff7be87ec0 R14: 00007fff7be87ec0 R15: 0000000000002000 [ 240.949741] [ 240.952632] irq event stamp: 27367 [ 240.956735] hardirqs last enabled at (27366): [] mem_cgroup_uncharge_skmem+0x6a/0x80 [ 240.966848] hardirqs last disabled at (27367): [] refill_stock+0x282/0x580 [ 240.976017] softirqs last enabled at (27360): [] mptcp_recvmsg+0xaf/0x1340 [ 240.985273] softirqs last disabled at (27364): [] __mptcp_move_skbs+0x18c/0x6c0 [ 240.994872] ---[ end trace 0000000000000000 ]--- After commit d24141fe7b48 ("mptcp: drop SK_RECLAIM_* macros"), if rmem_fwd_alloc become negative, mptcp_rmem_uncharge() can try to reclaim a negative amount of pages, since the expression: reclaimable >= PAGE_SIZE will evaluate to true for any negative value of the int 'reclaimable': 'PAGE_SIZE' is an unsigned long and the negative integer will be promoted to a (very large) unsigned long value. Still after the mentioned commit, kfree_skb_partial() in mptcp_try_coalesce() will reclaim most of just released fwd memory, so that following charging of the skb delta size will lead to negative fwd memory values. At that point a racing recvmsg() can trigger the splat. Address the issue switching the order of the memory accounting operations. The fwd memory can still transiently reach negative values, but that will happen in an atomic scope and no code path could touch/use such value. Reported-by: kernel test robot Fixes: d24141fe7b48 ("mptcp: drop SK_RECLAIM_* macros") Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20220906180404.1255873-1-matthieu.baerts@tessares.net Signed-off-by: Paolo Abeni commit ca2dccdeeb49a7e408112d681bf447984c845292 Author: Ioana Ciornei Date: Tue Sep 6 16:04:51 2022 +0300 net: phy: aquantia: wait for the suspend/resume operations to finish The Aquantia datasheet notes that after issuing a Processor-Intensive MDIO operation, like changing the low-power state of the device, the driver should wait for the operation to finish before issuing a new MDIO command. The new aqr107_wait_processor_intensive_op() function is added which can be used after these kind of MDIO operations. At the moment, we are only adding it at the end of the suspend/resume calls. The issue was identified on a board featuring the AQR113C PHY, on which commands like 'ip link (..) up / down' issued without any delays between them would render the link on the PHY to remain down. The issue was easy to reproduce with a one-liner: $ ip link set dev ethX down; ip link set dev ethX up; \ ip link set dev ethX down; ip link set dev ethX up; Fixes: ac9e81c230eb ("net: phy: aquantia: add suspend / resume callbacks for AQR107 family") Signed-off-by: Ioana Ciornei Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220906130451.1483448-1-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit f89e409402e2aeb3bc3aa44d2b7a597959e4e6af Author: Mohan Kumar Date: Tue Sep 13 12:28:18 2022 +0530 ALSA: hda: Fix Nvidia dp infoframe Nvidia HDA HW expects infoframe data bytes order same for both HDMI and DP i.e infoframe data starts from 5th bytes offset. As dp infoframe structure has 4th byte as valid infoframe data, use hdmi infoframe structure for nvidia dp infoframe to match HW behvaior. Signed-off-by: Mohan Kumar Cc: Link: https://lore.kernel.org/r/20220913065818.13015-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai commit f5fc22cbbdcd349402faaddf1a07eb8403658ae8 Author: Horatiu Vultur Date: Mon Sep 12 21:26:29 2022 +0200 ARM: dts: lan966x: Fix the interrupt number for internal PHYs According to the datasheet the interrupts for internal PHYs are 80 and 81. Fixes: 6ad69e07def67c ("ARM: dts: lan966x: add MIIM nodes") Signed-off-by: Horatiu Vultur Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220912192629.461452-1-horatiu.vultur@microchip.com commit 38238be4e881a5d0abbe4872b4cd6ed790be06c8 Author: Yang Yingliang Date: Wed Aug 24 17:36:57 2022 +0800 parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() Add missing iounmap() before return from ccio_probe(), if ccio_init_resources() fails. Fixes: d46c742f827f ("parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()") Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit cbcdf8c4d35cd74aee8581eb2f0453e0ecab7b05 Author: huangwenhui Date: Tue Sep 13 13:46:22 2022 +0800 ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 Fixes headphone and headset microphone detection on Huawei WRT-WX9. Signed-off-by: huangwenhui Cc: Link: https://lore.kernel.org/r/20220913054622.15979-1-huangwenhuia@uniontech.com Signed-off-by: Takashi Iwai commit 3c4d8c24fb6c44f426e447b04800b0ed61a7b5ae Author: Mohan Kumar Date: Tue Sep 13 11:06:41 2022 +0530 ALSA: hda/tegra: set depop delay for tegra Reduce the suspend time by setting depop delay to 10ms for tegra. Signed-off-by: Mohan Kumar Cc: Link: https://lore.kernel.org/r/20220913053641.23299-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai commit 4d40ceef4745536289012670103c59264e0fb3ec Author: Kai Vehmanen Date: Mon Sep 12 21:37:16 2022 +0300 ALSA: hda: add Intel 5 Series / 3400 PCI DID Handle 0x3b57 variant with same AZX_DCAPS_INTEL_PCH_NOPM capabilities as 0x3b56. In practise this allow use of HDMI/DP display audio via i915. BugLink: https://gitlab.freedesktop.org/drm/intel/-/issues/2751 Signed-off-by: Kai Vehmanen Cc: Link: https://lore.kernel.org/r/20220912183716.2126312-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit bfbfb6182ad1d7d184b16f25165faad879147f79 Author: Al Viro Date: Sat Sep 10 22:14:02 2022 +0100 nfsd_splice_actor(): handle compound pages pipe_buffer might refer to a compound page (and contain more than a PAGE_SIZE worth of data). Theoretically it had been possible since way back, but nfsd_splice_actor() hadn't run into that until copy_page_to_iter() change. Fortunately, the only thing that changes for compound pages is that we need to stuff each relevant subpage in and convert the offset into offset in the first subpage. Acked-by: Chuck Lever Tested-by: Benjamin Coddington Fixes: f0f6b614f83d "copy_page_to_iter(): don't split high-order page in case of ITER_PIPE" Signed-off-by: Al Viro commit c3681de3b8f2e8aff0306e2d6c129ca15b70b79d Author: Tim Harvey Date: Mon Sep 12 11:08:33 2022 -0700 arm64: dts: imx8mp-venice-gw74xx: fix ksz9477 cpu port The CPU uplink port on the KSZ9477 is P5 not P6 - fix this. Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit e4ef0885632ed485961ac0962ad01be4ec9ec658 Author: Tim Harvey Date: Mon Sep 12 11:08:32 2022 -0700 arm64: dts: imx8mp-venice-gw74xx: fix CAN STBY polarity The CAN STBY poarlity is active-low. Specify it as such by removing the 'enable-active-high' property and updating the gpio property. Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 87fd9294e63e8fa7532b5e65b534c3001c654ef8 Author: Allen-KH Cheng Date: Thu Sep 8 22:12:05 2022 +0800 drm/mediatek: Fix wrong dither settings The width and height arguments in the cmdq packet for mtk_dither_config() are inverted. We fix the incorrect width and height for dither settings in mtk_dither_config(). Fixes: 73d3724745db ("drm/mediatek: Adjust to the alphabetic order for mediatek-drm") Co-developed-by: Yongqiang Niu Signed-off-by: Yongqiang Niu Signed-off-by: Allen-KH Cheng Reviewed-by: Matthias Brugger Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220908141205.18256-1-allen-kh.cheng@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit e839a756012b6cad7a4eeb67b0598ac3f349f863 Merge: 6504d82f44407 f0880e2cb7e1f Author: Linus Torvalds Date: Mon Sep 12 18:33:55 2022 -0400 Merge tag 'hyperv-fixes-signed-20220912' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix an error handling issue in DRM driver (Christophe JAILLET) - Fix some issues in framebuffer driver (Vitaly Kuznetsov) - Two typo fixes (Jason Wang, Shaomin Deng) - Drop unnecessary casting in kvp tool (Zhou Jie) * tag 'hyperv-fixes-signed-20220912' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region Drivers: hv: Always reserve framebuffer region for Gen1 VMs PCI: Move PCI_VENDOR_ID_MICROSOFT/PCI_DEVICE_ID_HYPERV_VIDEO definitions to pci_ids.h tools: hv: kvp: remove unnecessary (void*) conversions Drivers: hv: remove duplicate word in a comment tools: hv: Remove an extraneous "the" drm/hyperv: Fix an error handling path in hyperv_vmbus_probe() commit 6504d82f4440755d6fc1385532f84d0344243d61 Merge: 62d1cea7d66ee 13bd901418042 Author: Linus Torvalds Date: Mon Sep 12 17:53:46 2022 -0400 Merge tag 'nfs-for-5.20-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: - Fix SUNRPC call completion races with call_decode() that trigger a WARN_ON() - NFSv4.0 cannot support open-by-filehandle and NFS re-export - Revert "SUNRPC: Remove unreachable error condition" to allow handling of error conditions - Update suid/sgid mode bits after ALLOCATE and DEALLOCATE * tag 'nfs-for-5.20-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: Revert "SUNRPC: Remove unreachable error condition" NFSv4.2: Update mode bits after ALLOCATE and DEALLOCATE NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 SUNRPC: Fix call completion races with call_decode() commit 62d1cea7d66ee690de398e281470e78e94d085f7 Merge: 80e78fcce86de 00801cd92d91e Author: Linus Torvalds Date: Mon Sep 12 17:14:38 2022 -0400 Merge tag 'nfsd-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: "Address an NFSD regression introduced during the 6.0 merge window" * tag 'nfsd-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: fix regression with setting ACLs. commit 7500a99281dfed2d4a84771c933bcb9e17af279b Author: Ronnie Sahlberg Date: Mon Sep 12 13:04:46 2022 +1000 cifs: revalidate mapping when doing direct writes Kernel bugzilla: 216301 When doing direct writes we need to also invalidate the mapping in case we have a cached copy of the affected page(s) in memory or else subsequent reads of the data might return the old/stale content before we wrote an update to the server. Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 8d5356f9820dc48578fc50077f5a34905386e47f Author: Huacai Chen Date: Mon Aug 8 16:53:19 2022 +0800 irqchip: Select downstream irqchip drivers for LoongArch CPU LoongArch irqchips have a fixed hierarchy which currently can't be described by ACPI tables, so upstream irqchip drivers call downstream irqchip drivers' initialization directly. As a result, the top level (CPU-level) irqchip driver should explicitly select downstream drivers to avoid build errors. Reported-by: kernel test robot Signed-off-by: Huacai Chen Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220808085319.3350111-1-chenhuacai@loongson.cn commit f55a9b59e8f06e034368aeb48625359194e41f0e Author: Pierre Gondois Date: Mon Sep 12 16:18:57 2022 +0200 irqchip/gic-v3-its: Remove cpumask_var_t allocation Running a PREEMPT_RT kernel based on v5.19-rc3-rt4 on an Ampere Altra triggers: [ 22.616229] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 [ 22.616239] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 1884, name: kworker/80:1 [ 22.616243] preempt_count: 3, expected: 0 [ 22.616244] RCU nest depth: 0, expected: 0 [...] [ 22.616250] hardirqs last enabled at (33): _raw_spin_unlock_irq (/home/piegon01/linux/./arch/arm64/include/asm/irqflags.h:35) [ 22.616273] hardirqs last disabled at (34): __schedule (/home/piegon01/linux/kernel/sched/core.c:6432 (discriminator 1)) [ 22.616283] softirqs last enabled at (0): copy_process (/home/piegon01/linux/./include/linux/lockdep.h:191) [ 22.616297] softirqs last disabled at (0): 0x0 [ 22.616305] Preemption disabled at: [ 22.616307] __setup_irq (/home/piegon01/linux/kernel/irq/manage.c:1612) [ 22.616322] CPU: 80 PID: 1884 Comm: kworker/80:1 Tainted: G W [...] [ 22.616328] Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 [ 22.616333] Workqueue: events work_for_cpu_fn [ 22.616344] Call trace: [...] [ 22.616403] alloc_cpumask_var_node (/home/piegon01/linux/lib/cpumask.c:115) [ 22.616414] alloc_cpumask_var (/home/piegon01/linux/lib/cpumask.c:147) [ 22.616417] its_select_cpu (/home/piegon01/linux/drivers/irqchip/irq-gic-v3-its.c:1580) [ 22.616428] its_set_affinity (/home/piegon01/linux/drivers/irqchip/irq-gic-v3-its.c:1659) [ 22.616431] msi_domain_set_affinity (/home/piegon01/linux/kernel/irq/msi.c:501) [ 22.616440] irq_do_set_affinity (/home/piegon01/linux/kernel/irq/manage.c:276) [ 22.616443] irq_setup_affinity (/home/piegon01/linux/kernel/irq/manage.c:633) [ 22.616447] irq_startup (/home/piegon01/linux/kernel/irq/chip.c:280) [ 22.616453] __setup_irq (/home/piegon01/linux/kernel/irq/manage.c:1777) Follow the pattern established in commit cba4235e6031e ("genirq: Remove mask argument from setup_affinity()") and co to overcome this issue by defining a static struct cpumask and protecting it by a raw spinlock. Since its_select_cpu() can be executed with IRQs enabled or disabled, enforce that the cpumask computation is done with interrupts disabled. Signed-off-by: Pierre Gondois Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220912141857.1391343-1-pierre.gondois@arm.com commit 8fc7a6198a80bc39b6c5b3cc1a578e7d24f068a2 Author: Antonio Borneo Date: Wed Aug 17 14:57:58 2022 +0200 irqchip/stm32-exti: Remove check on always false condition The field drv_data is assigned during driver's probe, where it's already checked to be not NULL. Remove the always false check '!host_data->drv_data'. This fixes a warning "variable dereferenced before check" detected by '0-DAY CI Kernel Test Service'. Fixes: c297493336b7 ("irqchip/stm32-exti: Simplify irq description table") Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/202208131739.gJvcs9ls-lkp@intel.com/ Signed-off-by: Antonio Borneo Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220817125758.5975-1-antonio.borneo@foss.st.com commit 96c9b511fc0fd40880cd944b87c099e88db1a71d Author: Krzysztof Kozlowski Date: Fri Sep 9 17:30:34 2022 +0200 dt-bindings: memory-controllers: fsl,imx8m-ddrc: drop Leonard Crestez Emails to Leonard Crestez bounce ("550 5.4.1 Recipient address rejected: Access denied:), so change maintainer to Peng Fan from NXP. Signed-off-by: Krzysztof Kozlowski Acked-by: Peng Fan Link: https://lore.kernel.org/r/20220817065946.24303-2-krzysztof.kozlowski@linaro.org Link: https://lore.kernel.org/r/20220909153037.824092-1-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit 78c94808a459fc78a74780b5940ea1323217992d Merge: 02181e68275d2 ea89926d9690f Author: Arnd Bergmann Date: Mon Sep 12 16:39:21 2022 +0200 Merge tag 'v6.0-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Drop some not-specified properties, fix phy-supply properties, fix edp clock on Gru, fix usb port on BPI-R2-Pro, fix license typo, fix wlan-wake-pin on Gru-Bob and lower the sd-card speed on Quartz64-B * tag 'v6.0-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Remove 'enable-active-low' from rk3566-quartz64-a arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma arm64: dts: rockchip: fix property for usb2 phy supply on rk3568-evb1-v10 arm64: dts: rockchip: fix property for usb2 phy supply on rock-3a arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz arm64: dts: rockchip: fix upper usb port on BPI-R2-Pro arm64: dts: rockchip: Fix typo in lisense text for PX30.Core arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob arm64: dts: rockchip: Lower sd speed on quartz64-b Link: https://lore.kernel.org/r/2645885.mvXUDI8C0e@phil Signed-off-by: Arnd Bergmann commit 8787f6fab41380189865f5751c0f15b0c298b923 Author: Ville Syrjälä Date: Fri Sep 2 10:03:19 2022 +0300 Revert "drm/i915/display: Re-add check for low voltage sku for max dp source rate" This reverts commit d5929835080a60f9119d024fa42f315913942f76. With the Parade PS8461E MUX workaround (WaEdpLinkRateDataReload) implemented we can get finally rid of the is_low_voltage_sku() check that incorrectly prevents many machines from using the 8.1Gpbs link rate. Cc: Jason A. Donenfeld Cc: Ankit Nautiyal Cc: Jani Nikula Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5272 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6323 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220902070319.15395-2-ville.syrjala@linux.intel.com Tested-by: Aaron Ma Tested-by: Jason A. Donenfeld Reviewed-by: Jani Nikula (cherry picked from commit 483e3d87a37e804588ac8224aadd20a84593cafd) Signed-off-by: Rodrigo Vivi commit d654f60898d56ffda461ef4ffd7bbe15159feb8d Author: Ashutosh Dixit Date: Thu Sep 8 08:58:21 2022 -0700 drm/i915/gt: Fix perf limit reasons bit positions Perf limit reasons bit positions were off by one. Fixes: fa68bff7cf27 ("drm/i915/gt: Add sysfs throttle frequency interfaces") Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Ashutosh Dixit Acked-by: Andi Shyti Reviewed-by: Sujaritha Sundaresan Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20220908155821.1662110-1-ashutosh.dixit@intel.com Signed-off-by: Joonas Lahtinen (cherry picked from commit 60017f34fc334d1bb25476b0b0996b4073e76c90) Signed-off-by: Rodrigo Vivi commit aee5ae7c8492eaca2be20d202887c9c716ffc86f Author: Umesh Nerlige Ramappa Date: Sat Aug 27 00:21:35 2022 +0000 drm/i915/guc: Cancel GuC engine busyness worker synchronously The worker is canceled in gt_park path, but earlier it was assumed that gt_park path cannot sleep and the cancel is asynchronous. This caused a race with suspend flow where the worker runs after suspend and causes an unclaimed register access warning. Cancel the worker synchronously since the gt_park is indeed allowed to sleep. v2: Fix author name and sign-off mismatch Signed-off-by: Umesh Nerlige Ramappa Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4419 Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") Reviewed-by: Ashutosh Dixit Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220827002135.139349-1-umesh.nerlige.ramappa@intel.com Signed-off-by: Joonas Lahtinen (cherry picked from commit 31335aa8e08be3fe10c50aecd2f11aba77544a78) Signed-off-by: Rodrigo Vivi commit 08b812985996924c0ccf79d54a31fc9757c0a6ca Author: Nirmoy Das Date: Wed Sep 7 19:26:41 2022 +0200 drm/i915: Set correct domains values at _i915_vma_move_to_active Fix regression introduced by commit: "drm/i915: Individualize fences before adding to dma_resv obj" which sets obj->read_domains to 0 for both read and write paths. Also set obj->write_domain to 0 on read path which was removed by the commit. References: https://gitlab.freedesktop.org/drm/intel/-/issues/6639 Fixes: 420a07b841d0 ("drm/i915: Individualize fences before adding to dma_resv obj") Signed-off-by: Nirmoy Das Cc: # v5.16+ Cc: Matthew Auld Cc: Andrzej Hajda Reviewed-by: Andrzej Hajda Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220907172641.12555-1-nirmoy.das@intel.com (cherry picked from commit 04f7eb3d4582a0a4da67c86e55fda7de2df86d91) Signed-off-by: Rodrigo Vivi commit 0785691f5711a8f210bb15a5177c2999ebd3702e Author: Ankit Nautiyal Date: Fri Sep 2 16:02:19 2022 +0530 drm/i915/vdsc: Set VDSC PIC_HEIGHT before using for DP DSC Currently, pic_height of vdsc_cfg structure is being used to calculate slice_height, before it is set for DP. So taking out the lines to set pic_height from the helper intel_dp_dsc_compute_params() to individual encoders, and setting pic_height, before it is used to calculate slice_height for DP. Fixes: 5a6d866f8e1b ("drm/i915: Get slice height before computing rc params") Cc: Manasi Navare Cc: Vandita Kulkarni Cc: Matt Roper Signed-off-by: Ankit Nautiyal Reviewed-by: Vandita Kulkarni Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20220902103219.1168781-1-ankit.k.nautiyal@intel.com (cherry picked from commit e72df53dcb01ec58e0410da353551adf94c8d0f1) Signed-off-by: Rodrigo Vivi commit 70ae49c5ac876f0f4689889588544104209c09c4 Author: Fabio Estevam Date: Fri Sep 9 11:17:02 2022 -0300 arm64: dts: tqma8mqml: Include phy-imx8-pcie.h header imx8mm-tqma8mqml.dtsi has PCIe support, so it should include . Otherwise, there are build errors when this SoM dtsi is included on customers' carrier boards. While at it, remove the PCI header from imx8mm-tqma8mqml-mba8mx.dts, which is now unneeded. Fixes: 1d84283101fc ("arm64: dts: tqma8mqml: add PCIe support") Signed-off-by: Fabio Estevam Reviewed-by: Alexander Stein Signed-off-by: Shawn Guo commit 781b80f452fcc1cfc16ee41f12556626a9ced049 Author: Felix Fietkau Date: Wed Sep 7 11:52:28 2022 +0200 wifi: mt76: fix 5 GHz connection regression on mt76x0/mt76x2 Some users have reported being unable to connect to MT76x0 APs running mt76 after a commit enabling the VHT extneded NSS BW feature. Fix this regression by ensuring that this feature only gets enabled on drivers that support it Cc: stable@vger.kernel.org Fixes: d9fcfc1424aa ("mt76: enable the VHT extended NSS BW feature") Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220907095228.82072-1-nbd@nbd.name commit c3a510e2b53785df31d882a773c4c0780b4c825f Author: Felix Fietkau Date: Fri Aug 26 20:23:29 2022 +0200 wifi: mt76: fix reading current per-tid starting sequence number for aggregation The code was accidentally shifting register values down by tid % 32 instead of (tid * field_size) % 32. Cc: stable@vger.kernel.org Fixes: a28bef561a5c ("mt76: mt7615: re-enable offloading of sequence number assignment") Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220826182329.18155-1-nbd@nbd.name commit 8997f5c8a62760db69fd5c56116705796322c8ed Author: Toke Høiland-Jørgensen Date: Wed Sep 7 15:44:50 2022 +0200 wifi: iwlwifi: Mark IWLMEI as broken The iwlmei driver breaks iwlwifi when returning from suspend. The interface ends up in the 'down' state after coming back from suspend. And iwd doesn't touch the interface state, but wpa_supplicant does, so the bug only happens on iwd. The bug report[0] has been open for four months now, and no fix seems to be forthcoming. Since just disabling the iwlmei driver works as a workaround, let's mark the config option as broken until it can be fixed properly. [0] https://bugzilla.kernel.org/show_bug.cgi?id=215937 Fixes: 2da4366f9e2c ("iwlwifi: mei: add the driver to allow cooperation with CSME") Signed-off-by: Toke Høiland-Jørgensen Acked-by: Emmanuel Grumbach Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220907134450.1183045-1-toke@toke.dk commit 3c20d9618143c282b59dc29ce18e608992c24bc7 Author: Michael Walle Date: Wed Sep 7 09:06:26 2022 +0200 arm64: defconfig: enable ARCH_NXP Commit 566e373fe047 ("arm64: Kconfig.platforms: Group NXP platforms together") introduced a new symbol ARCH_NXP and made ARCH_LAYERSCAPE (among others) depend on it, but didn't enable it in the defconfig. Thus, now the defconfig doesn't include support for any NXP architectures anymore. Fix it. Fixes: 566e373fe047 ("arm64: Kconfig.platforms: Group NXP platforms together") Signed-off-by: Michael Walle Acked-by: Florian Fainelli Signed-off-by: Shawn Guo commit 45b91a158918e04a85bb8e814cbe1924a459fceb Author: Alexander Stein Date: Tue Sep 6 08:36:06 2022 +0200 arm64: dts: imx8mp-tqma8mpql-mba8mpxl: add missing pinctrl for RTC alarm Although the RTC is on the module, the RTC_EVENT# signal is connected on the mainboard. Already set by bootloader, but make it explicit in Linux as well. Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") Signed-off-by: Alexander Stein Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit b2ddf399d0555d3b517ed97f35767c054bbc6535 Author: Oder Chiou Date: Mon Sep 12 15:29:31 2022 +0800 ASoC: rt5640: Fix the issue of the abnormal JD2 status The patch fixes the issue of the abnormal JD2 status. Signed-off-by: Oder Chiou Reported-by: Sameer Pujar Link: https://lore.kernel.org/r/20220912072931.1856-1-oder_chiou@realtek.com Signed-off-by: Mark Brown commit 4eb5bbde3ccb710d3b85bfb13466612e56393369 Author: Binyi Han Date: Sun Sep 4 00:46:47 2022 -0700 mm: fix dereferencing possible ERR_PTR Smatch checker complains that 'secretmem_mnt' dereferencing possible ERR_PTR(). Let the function return if 'secretmem_mnt' is ERR_PTR, to avoid deferencing it. Link: https://lkml.kernel.org/r/20220904074647.GA64291@cloud-MacBookPro Fixes: 1507f51255c9f ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Binyi Han Reviewed-by: Andrew Morton Cc: Mike Rapoport Cc: Ammar Faizi Cc: Hagen Paul Pfeifer Cc: James Bottomley Cc: Signed-off-by: Andrew Morton commit 36a3b14b5febdaf0e7f70c4ca6f62c8ea75fabfe Author: Matthew Wilcox (Oracle) Date: Fri Sep 2 20:26:39 2022 +0100 vmscan: check folio_test_private(), not folio_get_private() These two predicates are the same for file pages, but are not the same for anonymous pages. Link: https://lkml.kernel.org/r/20220902192639.1737108-3-willy@infradead.org Fixes: 07f67a8dedc0 ("mm/vmscan: convert shrink_active_list() to use a folio") Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Hugh Dickins Signed-off-by: Andrew Morton commit b9eb7776e8a64f9d53e8fa1cd27acb3024c74893 Author: Matthew Wilcox (Oracle) Date: Fri Sep 2 20:26:38 2022 +0100 mm: fix VM_BUG_ON in __delete_from_swap_cache() Patch series "Folio fixes for 6.0". This patch (of 2): The recent folio conversion changed the VM_BUG_ON() to dump the folio we're storing instead of the entry we retrieved. This was a mistake; the entry we retrieved is the more interesting page to dump. Link: https://lkml.kernel.org/r/20220902192639.1737108-1-willy@infradead.org Link: https://lkml.kernel.org/r/20220902192639.1737108-2-willy@infradead.org Fixes: ceff9d3354e9 ("mm/swap: convert __delete_from_swap_cache() to a folio") Signed-off-by: Matthew Wilcox (Oracle) Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 283c05f66dcaecb0c6d5c55dd7e4dab5c631dd92 Author: Matthew Wilcox (Oracle) Date: Fri Sep 2 20:19:23 2022 +0100 tools: fix compilation after gfp_types.h split When gfp_types.h was split from gfp.h, it broke the radix test suite. Fix the test suite by using gfp_types.h in the tools gfp.h header. Link: https://lkml.kernel.org/r/20220902191923.1735933-1-willy@infradead.org Fixes: cb5a065b4ea9 (headers/deps: mm: Split out of ) Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Liam R. Howlett Reviewed-by: Yury Norov Cc: Ingo Molnar Signed-off-by: Andrew Morton commit 1552fd3ef7dbe07208b8ae84a0a6566adf7dfc9d Author: Greg Kroah-Hartman Date: Fri Sep 2 19:11:49 2022 +0000 mm/damon/dbgfs: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput(). Link: https://lkml.kernel.org/r/20220902191149.112434-1-sj@kernel.org Fixes: 75c1c2b53c78b ("mm/damon/dbgfs: support multiple contexts") Signed-off-by: Greg Kroah-Hartman Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit fd35ca3d12cc9922d7d9a35f934e72132dbc4853 Author: Alistair Popple Date: Fri Sep 2 10:35:53 2022 +1000 mm/migrate_device.c: copy pte dirty bit to page migrate_vma_setup() has a fast path in migrate_vma_collect_pmd() that installs migration entries directly if it can lock the migrating page. When removing a dirty pte the dirty bit is supposed to be carried over to the underlying page to prevent it being lost. Currently migrate_vma_*() can only be used for private anonymous mappings. That means loss of the dirty bit usually doesn't result in data loss because these pages are typically not file-backed. However pages may be backed by swap storage which can result in data loss if an attempt is made to migrate a dirty page that doesn't yet have the PageDirty flag set. In this case migration will fail due to unexpected references but the dirty pte bit will be lost. If the page is subsequently reclaimed data won't be written back to swap storage as it is considered uptodate, resulting in data loss if the page is subsequently accessed. Prevent this by copying the dirty bit to the page when removing the pte to match what try_to_migrate_one() does. Link: https://lkml.kernel.org/r/dd48e4882ce859c295c1a77612f66d198b0403f9.1662078528.git-series.apopple@nvidia.com Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages") Signed-off-by: Alistair Popple Acked-by: Peter Xu Reviewed-by: "Huang, Ying" Reported-by: "Huang, Ying" Acked-by: David Hildenbrand Cc: Alex Sierra Cc: Ben Skeggs Cc: Felix Kuehling Cc: huang ying Cc: Jason Gunthorpe Cc: John Hubbard Cc: Karol Herbst Cc: Logan Gunthorpe Cc: Lyude Paul Cc: Matthew Wilcox Cc: Nadav Amit Cc: Paul Mackerras Cc: Ralph Campbell Cc: Signed-off-by: Andrew Morton commit a3589e1d5fe39c3d9fdd291b111524b93d08bc32 Author: Alistair Popple Date: Fri Sep 2 10:35:52 2022 +1000 mm/migrate_device.c: add missing flush_cache_page() Currently we only call flush_cache_page() for the anon_exclusive case, however in both cases we clear the pte so should flush the cache. Link: https://lkml.kernel.org/r/5676f30436ab71d1a587ac73f835ed8bd2113ff5.1662078528.git-series.apopple@nvidia.com Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages") Signed-off-by: Alistair Popple Reviewed-by: David Hildenbrand Acked-by: Peter Xu Cc: Alex Sierra Cc: Ben Skeggs Cc: Felix Kuehling Cc: huang ying Cc: "Huang, Ying" Cc: Jason Gunthorpe Cc: John Hubbard Cc: Karol Herbst Cc: Logan Gunthorpe Cc: Lyude Paul Cc: Matthew Wilcox Cc: Nadav Amit Cc: Paul Mackerras Cc: Ralph Campbell Cc: Signed-off-by: Andrew Morton commit 60bae73708963de4a17231077285bd9ff2f41c44 Author: Alistair Popple Date: Fri Sep 2 10:35:51 2022 +1000 mm/migrate_device.c: flush TLB while holding PTL When clearing a PTE the TLB should be flushed whilst still holding the PTL to avoid a potential race with madvise/munmap/etc. For example consider the following sequence: CPU0 CPU1 ---- ---- migrate_vma_collect_pmd() pte_unmap_unlock() madvise(MADV_DONTNEED) -> zap_pte_range() pte_offset_map_lock() [ PTE not present, TLB not flushed ] pte_unmap_unlock() [ page is still accessible via stale TLB ] flush_tlb_range() In this case the page may still be accessed via the stale TLB entry after madvise returns. Fix this by flushing the TLB while holding the PTL. Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages") Link: https://lkml.kernel.org/r/9f801e9d8d830408f2ca27821f606e09aa856899.1662078528.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reported-by: Nadav Amit Reviewed-by: "Huang, Ying" Acked-by: David Hildenbrand Acked-by: Peter Xu Cc: Alex Sierra Cc: Ben Skeggs Cc: Felix Kuehling Cc: huang ying Cc: Jason Gunthorpe Cc: John Hubbard Cc: Karol Herbst Cc: Logan Gunthorpe Cc: Lyude Paul Cc: Matthew Wilcox Cc: Paul Mackerras Cc: Ralph Campbell Cc: Signed-off-by: Andrew Morton commit 818c4fdaa98769ce2d0bf64bc50a6c9af89290ea Author: Naohiro Aota Date: Wed Aug 24 17:47:26 2022 +0900 x86/mm: disable instrumentations of mm/pgprot.c Commit 4867fbbdd6b3 ("x86/mm: move protection_map[] inside the platform") moved accesses to protection_map[] from mem_encrypt_amd.c to pgprot.c. As a result, the accesses are now targets of KASAN (and other instrumentations), leading to the crash during the boot process. Disable the instrumentations for pgprot.c like commit 67bb8e999e0a ("x86/mm: Disable various instrumentations of mm/mem_encrypt.c and mm/tlb.c"). Before this patch, my AMD machine cannot boot since v6.0-rc1 with KASAN enabled, without anything printed. After the change, it successfully boots up. Fixes: 4867fbbdd6b3 ("x86/mm: move protection_map[] inside the platform") Link: https://lkml.kernel.org/r/20220824084726.2174758-1-naohiro.aota@wdc.com Signed-off-by: Naohiro Aota Cc: Anshuman Khandual Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit ac87ca0ea0102ec5dfd17c95eb9fa87a8bf54d61 Author: Dan Williams Date: Fri Aug 26 10:18:14 2022 -0700 mm/memory-failure: fall back to vma_address() when ->notify_failure() fails In the case where a filesystem is polled to take over the memory failure and receives -EOPNOTSUPP it indicates that page->index and page->mapping are valid for reverse mapping the failure address. Introduce FSDAX_INVALID_PGOFF to distinguish when add_to_kill() is being called from mf_dax_kill_procs() by a filesytem vs the typical memory_failure() path. Otherwise, vma_pgoff_address() is called with an invalid fsdax_pgoff which then trips this failing signature: kernel BUG at mm/memory-failure.c:319! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 13 PID: 1262 Comm: dax-pmd Tainted: G OE N 6.0.0-rc2+ #62 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:add_to_kill.cold+0x19d/0x209 [..] Call Trace: collect_procs.part.0+0x2c4/0x460 memory_failure+0x71b/0xba0 ? _printk+0x58/0x73 do_madvise.part.0.cold+0xaf/0xc5 Link: https://lkml.kernel.org/r/166153429427.2758201.14605968329933175594.stgit@dwillia2-xfh.jf.intel.com Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") Signed-off-by: Dan Williams Acked-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Christoph Hellwig Cc: Shiyang Ruan Cc: Darrick J. Wong Cc: Al Viro Cc: Dave Chinner Cc: Goldwyn Rodrigues Cc: Jane Chu Cc: Matthew Wilcox Cc: Ritesh Harjani Signed-off-by: Andrew Morton commit 65d3440e8d2e9e024ef2357f8ff021611b068c99 Author: Dan Williams Date: Fri Aug 26 10:18:07 2022 -0700 mm/memory-failure: fix detection of memory_failure() handlers Some pagemap types, like MEMORY_DEVICE_GENERIC (device-dax) do not even have pagemap ops which results in crash signatures like this: BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000000205073067 P4D 8000000205073067 PUD 2062b3067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 22 PID: 4535 Comm: device-dax Tainted: G OE N 6.0.0-rc2+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:memory_failure+0x667/0xba0 [..] Call Trace: ? _printk+0x58/0x73 do_madvise.part.0.cold+0xaf/0xc5 Check for ops before checking if the ops have a memory_failure() handler. Link: https://lkml.kernel.org/r/166153428781.2758201.1990616683438224741.stgit@dwillia2-xfh.jf.intel.com Fixes: 33a8f7f2b3a3 ("pagemap,pmem: introduce ->memory_failure()") Signed-off-by: Dan Williams Acked-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Christoph Hellwig Cc: Shiyang Ruan Cc: Darrick J. Wong Cc: Al Viro Cc: Dave Chinner Cc: Goldwyn Rodrigues Cc: Jane Chu Cc: Matthew Wilcox Cc: Ritesh Harjani Signed-off-by: Andrew Morton commit fd63612ae81159bd7e59762de478889315463ee8 Author: Dan Williams Date: Fri Aug 26 10:18:01 2022 -0700 xfs: fix SB_BORN check in xfs_dax_notify_failure() The SB_BORN flag is stored in the vfs superblock, not xfs_sb. Link: https://lkml.kernel.org/r/166153428094.2758201.7936572520826540019.stgit@dwillia2-xfh.jf.intel.com Fixes: 6f643c57d57c ("xfs: implement ->notify_failure() for XFS") Signed-off-by: Dan Williams Reviewed-by: Christoph Hellwig Cc: Shiyang Ruan Cc: Darrick J. Wong Cc: Al Viro Cc: Dave Chinner Cc: Goldwyn Rodrigues Cc: Jane Chu Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Ritesh Harjani Signed-off-by: Andrew Morton commit b14d067e850c19921cec2200bd8d179edf6a1aa6 Author: Dan Williams Date: Fri Aug 26 10:17:54 2022 -0700 xfs: quiet notify_failure EOPNOTSUPP cases Patch series "mm, xfs, dax: Fixes for memory_failure() handling". I failed to run the memory error injection section of the ndctl test suite on linux-next prior to the merge window and as a result some bugs were missed. While the new enabling targeted reflink enabled XFS filesystems the bugs cropped up in the surrounding cases of DAX error injection on ext4-fsdax and device-dax. One new assumption / clarification in this set is the notion that if a filesystem's ->notify_failure() handler returns -EOPNOTSUPP, then it must be the case that the fsdax usage of page->index and page->mapping are valid. I am fairly certain this is true for xfs_dax_notify_failure(), but would appreciate another set of eyes. This patch (of 4): XFS always registers dax_holder_operations regardless of whether the filesystem is capable of handling the notifications. The expectation is that if the notify_failure handler cannot run then there are no scenarios where it needs to run. In other words the expected semantic is that page->index and page->mapping are valid for memory_failure() when the conditions that cause -EOPNOTSUPP in xfs_dax_notify_failure() are present. A fallback to the generic memory_failure() path is expected so do not warn when that happens. Link: https://lkml.kernel.org/r/166153426798.2758201.15108211981034512993.stgit@dwillia2-xfh.jf.intel.com Link: https://lkml.kernel.org/r/166153427440.2758201.6709480562966161512.stgit@dwillia2-xfh.jf.intel.com Fixes: 6f643c57d57c ("xfs: implement ->notify_failure() for XFS") Signed-off-by: Dan Williams Reviewed-by: Christoph Hellwig Cc: Shiyang Ruan Cc: Darrick J. Wong Cc: Al Viro Cc: Dave Chinner Cc: Goldwyn Rodrigues Cc: Jane Chu Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Ritesh Harjani Signed-off-by: Andrew Morton commit 3d36424b3b5850bd92f3e89b953a430d7cfc88ef Author: Mel Gorman Date: Wed Aug 24 12:14:50 2022 +0100 mm/page_alloc: fix race condition between build_all_zonelists and page allocation Patrick Daly reported the following problem; NODE_DATA(nid)->node_zonelists[ZONELIST_FALLBACK] - before offline operation [0] - ZONE_MOVABLE [1] - ZONE_NORMAL [2] - NULL For a GFP_KERNEL allocation, alloc_pages_slowpath() will save the offset of ZONE_NORMAL in ac->preferred_zoneref. If a concurrent memory_offline operation removes the last page from ZONE_MOVABLE, build_all_zonelists() & build_zonerefs_node() will update node_zonelists as shown below. Only populated zones are added. NODE_DATA(nid)->node_zonelists[ZONELIST_FALLBACK] - after offline operation [0] - ZONE_NORMAL [1] - NULL [2] - NULL The race is simple -- page allocation could be in progress when a memory hot-remove operation triggers a zonelist rebuild that removes zones. The allocation request will still have a valid ac->preferred_zoneref that is now pointing to NULL and triggers an OOM kill. This problem probably always existed but may be slightly easier to trigger due to 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") which distinguishes between zones that are completely unpopulated versus zones that have valid pages not managed by the buddy allocator (e.g. reserved, memblock, ballooning etc). Memory hotplug had multiple stages with timing considerations around managed/present page updates, the zonelist rebuild and the zone span updates. As David Hildenbrand puts it memory offlining adjusts managed+present pages of the zone essentially in one go. If after the adjustments, the zone is no longer populated (present==0), we rebuild the zone lists. Once that's done, we try shrinking the zone (start+spanned pages) -- which results in zone_start_pfn == 0 if there are no more pages. That happens *after* rebuilding the zonelists via remove_pfn_range_from_zone(). The only requirement to fix the race is that a page allocation request identifies when a zonelist rebuild has happened since the allocation request started and no page has yet been allocated. Use a seqlock_t to track zonelist updates with a lockless read-side of the zonelist and protecting the rebuild and update of the counter with a spinlock. [akpm@linux-foundation.org: make zonelist_update_seq static] Link: https://lkml.kernel.org/r/20220824110900.vh674ltxmzb3proq@techsingularity.net Fixes: 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") Signed-off-by: Mel Gorman Reported-by: Patrick Daly Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: [4.9+] Signed-off-by: Andrew Morton commit 1b513f613731e2afc05550e8070d79fac80c661e Author: ChenXiaoSong Date: Tue Aug 9 14:47:30 2022 +0800 ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() Syzkaller reported BUG_ON as follows: ------------[ cut here ]------------ kernel BUG at fs/ntfs/dir.c:86! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 758 Comm: a.out Not tainted 5.19.0-next-20220808 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:ntfs_lookup_inode_by_name+0xd11/0x2d10 Code: ff e9 b9 01 00 00 e8 1e fe d6 fe 48 8b 7d 98 49 8d 5d 07 e8 91 85 29 ff 48 c7 45 98 00 00 00 00 e9 5a fb ff ff e8 ff fd d6 fe <0f> 0b e8 f8 fd d6 fe 0f 0b e8 f1 fd d6 fe 48 8b b5 50 ff ff ff 4c RSP: 0018:ffff888079607978 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000008000 RCX: 0000000000000000 RDX: ffff88807cf10000 RSI: ffffffff82a4a081 RDI: 0000000000000003 RBP: ffff888079607a70 R08: 0000000000000001 R09: ffff88807a6d01d7 R10: ffffed100f4da03a R11: 0000000000000000 R12: ffff88800f0fb110 R13: ffff88800f0ee000 R14: ffff88800f0fb000 R15: 0000000000000001 FS: 00007f33b63c7540(0000) GS:ffff888108580000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f33b635c090 CR3: 000000000f39e005 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: load_system_files+0x1f7f/0x3620 ntfs_fill_super+0xa01/0x1be0 mount_bdev+0x36a/0x440 ntfs_mount+0x3a/0x50 legacy_get_tree+0xfb/0x210 vfs_get_tree+0x8f/0x2f0 do_new_mount+0x30a/0x760 path_mount+0x4de/0x1880 __x64_sys_mount+0x2b3/0x340 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f33b62ff9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd0c471aa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f33b62ff9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd0c471be0 RBP: 00007ffd0c471c60 R08: 00007ffd0c471ae0 R09: 00007ffd0c471c24 R10: 0000000000000000 R11: 0000000000000202 R12: 000055bac5afc160 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- Fix this by adding sanity check on extended system files' directory inode to ensure that it is directory, just like ntfs_extend_init() when mounting ntfs3. Link: https://lkml.kernel.org/r/20220809064730.2316892-1-chenxiaosong2@huawei.com Signed-off-by: ChenXiaoSong Cc: Anton Altaparmakov Cc: Signed-off-by: Andrew Morton commit 80e78fcce86de0288793a0ef0f6acf37656ee4cf Author: Linus Torvalds Date: Sun Sep 11 16:22:01 2022 -0400 Linux 6.0-rc5 commit 4ed9c1e971b1f6474793da20496fa53c35d4a37b Merge: 087aa69a9f2b2 c17a2538704f9 Author: Linus Torvalds Date: Sun Sep 11 15:16:47 2022 -0400 Merge tag 'kbuild-fixes-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Remove unused scripts/gcc-ld script - Add zstd support to scripts/extract-ikconfig - Check 'make headers' for UML - Fix scripts/mksysmap to ignore local symbols * tag 'kbuild-fixes-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: mksysmap: Fix the mismatch of 'L0' symbols in System.map kbuild: disable header exports for UML in a straightforward way scripts/extract-ikconfig: add zstd compression support scripts: remove obsolete gcc-ld script commit 087aa69a9f2b2f1aaa173f976fec94058f623a9d Merge: 6429883ab1cab 3fe3fd5f30720 Author: Linus Torvalds Date: Sun Sep 11 07:48:21 2022 -0400 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Three small arm64 fixes, all related to optional architecture extensions: BTI, SME and 52-bit virtual addressing: - Disable in-kernel BTI when compiling with GCC, as it makes invalid assumptions about the distance between functions which has led to crashes when calling modules on a CPU with BTI support - Remove bogus TIF_SME flag management if memory allocation fails in the ptrace code - Fix the resume path when configured for 52-bit virtual addressing" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: fix resume for 52-bit enabled builds arm64/ptrace: Don't clear calling process' TIF_SME on OOM arm64/bti: Disable in kernel BTI when cross section thunks are broken commit 6429883ab1cab70464ed806ba18c1da0692017e9 Merge: 2ccd4502f512e 4e2a2ed96adcb Author: Linus Torvalds Date: Sun Sep 11 07:39:03 2022 -0400 Merge tag 'i2c-for-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Only documentation and DT binding fixes and improvements" * tag 'i2c-for-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: renesas,riic: Fix 'unevaluatedProperties' warnings docs: i2c: piix4: Fix typos, add markup, drop link docs: i2c: i2c-topology: reorder sections more logically docs: i2c: i2c-topology: fix incorrect heading docs: i2c: i2c-topology: fix typo commit 2ccd4502f512e04b6cc01995da730e8754529cf9 Merge: 134984dbcacd6 2380f1e8195ef Author: Linus Torvalds Date: Sun Sep 11 07:32:26 2022 -0400 Merge tag 'iommu-fixes-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Intel VT-d fixes from Lu Baolu: - Boot kdump kernels with VT-d scalable mode on - Calculate the right page table levels - Fix two recursive locking issues - Fix a lockdep splat issue - AMD IOMMU fixes: - Fix for completion-wait command to use full 64 bits of data - Fix PASID related issue where GPU sound devices failed to initialize - Fix for Virtio-IOMMU to report correct caching behavior, needed for use with VFIO * tag 'iommu-fixes-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu: Fix false ownership failure on AMD systems with PASID activated iommu/vt-d: Fix possible recursive locking in intel_iommu_init() iommu/virtio: Fix interaction with VFIO iommu/vt-d: Fix lockdep splat due to klist iteration in atomic context iommu/vt-d: Fix recursive lock issue in iommu_flush_dev_iotlb() iommu/vt-d: Correctly calculate sagaw value of IOMMU iommu/vt-d: Fix kdump kernels boot failure with scalable mode iommu/amd: use full 64-bit value in build_completion_wait() commit 134984dbcacd6e2242bd2d85aab605838614b6dd Merge: b96fbd602d357 727488e305b22 Author: Linus Torvalds Date: Sun Sep 11 07:21:56 2022 -0400 Merge tag 'mips-fixes_6.0_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - fix for loongson32 starup hang - fix for octeon irq setup problem - fix compiler warning for new CONFIG option - switch to SPARSEMEM_EXTREME for all platforms selecting SPARSEMEM * tag 'mips-fixes_6.0_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: Select SPARSEMEM_EXTREME MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() MIPS: octeon: Get rid of preprocessor directives around RESERVE32 MIPS: loongson32: ls1c: Fix hang during startup commit 2380f1e8195ef612deea1dc7a3d611c5d2b9b56a Author: Jason Gunthorpe Date: Fri Sep 9 16:46:31 2022 -0300 iommu: Fix false ownership failure on AMD systems with PASID activated The AMD IOMMU driver cannot activate PASID mode on a RID without the RID's translation being set to IDENTITY. Further it requires changing the RID's page table layout from the normal v1 IOMMU_DOMAIN_IDENTITY layout to a different v2 layout. It does this by creating a new iommu_domain, configuring that domain for v2 identity operation and then attaching it to the group, from within the driver. This logic assumes the group is already set to the IDENTITY domain and is being used by the DMA API. However, since the ownership logic is based on the group's domain pointer equaling the default domain to detect DMA API ownership, this causes it to look like the group is not attached to the DMA API any more. This blocks attaching drivers to any other devices in the group. In a real system this manifests itself as the HD-audio devices on some AMD platforms losing their device drivers. Work around this unique behavior of the AMD driver by checking for equality of IDENTITY domains based on their type, not their pointer value. This allows the AMD driver to have two IDENTITY domains for internal purposes without breaking the check. Have the AMD driver properly declare that the special domain it created is actually an IDENTITY domain. Cc: Robin Murphy Cc: stable@vger.kernel.org Fixes: 512881eacfa7 ("bus: platform,amba,fsl-mc,PCI: Add device DMA ownership management") Reported-by: Takashi Iwai Tested-by: Takashi Iwai Signed-off-by: Jason Gunthorpe Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/0-v1-ea566e16b06b+811-amd_owner_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 9cd4f1434479f1ac25c440c421fbf52069079914 Author: Lu Baolu Date: Sun Sep 11 11:18:45 2022 +0800 iommu/vt-d: Fix possible recursive locking in intel_iommu_init() The global rwsem dmar_global_lock was introduced by commit 3a5670e8ac932 ("iommu/vt-d: Introduce a rwsem to protect global data structures"). It is used to protect DMAR related global data from DMAR hotplug operations. The dmar_global_lock used in the intel_iommu_init() might cause recursive locking issue, for example, intel_iommu_get_resv_regions() is taking the dmar_global_lock from within a section where intel_iommu_init() already holds it via probe_acpi_namespace_devices(). Using dmar_global_lock in intel_iommu_init() could be relaxed since it is unlikely that any IO board must be hot added before the IOMMU subsystem is initialized. This eliminates the possible recursive locking issue by moving down DMAR hotplug support after the IOMMU is initialized and removing the uses of dmar_global_lock in intel_iommu_init(). Fixes: d5692d4af08cd ("iommu/vt-d: Fix suspicious RCU usage in probe_acpi_namespace_devices()") Reported-by: Robin Murphy Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/894db0ccae854b35c73814485569b634237b5538.1657034828.git.robin.murphy@arm.com Link: https://lore.kernel.org/r/20220718235325.3952426-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit b96fbd602d35739b5cdb49baa02048f2c41fdab1 Merge: 445e0bc7594a8 8d96bba75a43b Author: Linus Torvalds Date: Sat Sep 10 13:19:31 2022 -0400 Merge tag 's390-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix absolute zero lowcore corruption on kdump when CPU0 is offline - Fix lowcore protection setup for offline CPU restart * tag 's390-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/smp: enforce lowcore protection on CPU restart s390/boot: fix absolute zero lowcore corruption on boot commit 445e0bc7594a81d0e51d74c21a675c77369de4eb Merge: 16547b21b1c6c 88700d1396bae Author: Linus Torvalds Date: Sat Sep 10 13:02:10 2022 -0400 Merge tag 'hwmon-for-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix severe regression in asus-ec-sensors driver which resulted in EC driver failures - Fix various bugs in mr75203 driver - Fix byte order bug in tps23861 driver * tag 'hwmon-for-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (asus-ec-sensors) autoload module via DMI data hwmon: (mr75203) enable polling for all VM channels hwmon: (mr75203) fix multi-channel voltage reading hwmon: (mr75203) fix voltage equation for negative source input hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined dt-bindings: hwmon: (mr75203) fix "intel,vm-map" property to be optional hwmon: (tps23861) fix byte order in resistance register commit 16547b21b1c6c8e8c5546a5206ebccef3e28c92a Merge: ce888220d5c7a 9fc18f6d56d5b Author: Linus Torvalds Date: Sat Sep 10 12:18:19 2022 -0400 Merge tag 'dma-mapping-6.0-2022-09-10' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - revert a panic on swiotlb initialization failure (Yu Zhao) - fix the lookup for partial syncs in dma-debug (Robin Murphy) - fix a shift overflow in swiotlb (Chao Gao) - fix a comment typo in swiotlb (Chao Gao) - mark a function static now that all abusers are gone (Christoph Hellwig) * tag 'dma-mapping-6.0-2022-09-10' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: mark dma_supported static swiotlb: fix a typo swiotlb: avoid potential left shift overflow dma-debug: improve search for partial syncs Revert "swiotlb: panic if nslabs is too small" commit ead3d3c5b54f76da79c079e61bacb4279ec56965 Author: Takashi Iwai Date: Sat Sep 10 16:25:50 2022 +0200 ALSA: hda: Fix hang at HD-audio codec unbinding due to refcount saturation We fixed the potential deadlock at dynamic unbinding the HD-audio codec at the commit 7206998f578d ("ALSA: hda: Fix potential deadlock at codec unbinding"), but ironically, this caused another potential deadlock. The current code uses refcount_dec() and waits for the pending task with wait_event for dropping the refcount to 0. This works fine when PCMs are assigned and actually waiting for the refcount drop. Meanwhile, when there was no PCM assigned, the refcount_dec() call itself was supposed to drop to zero -- alas, it doesn't in reality; refcount_dec() complains, spews kernel warning and it saturates instead of dropping to 0, due to the nature of refcount_dec() implementation. This eventually blocks the wait_event() wakeup and the code get stuck there. For avoiding the problem, we call refcount_dec_and_test() and skips the sync-wait if it already reaches to zero. The patch does a slight code reshuffling to make sure to invoke other disconnect calls before the sync-wait, too. Fixes: 7206998f578d ("ALSA: hda: Fix potential deadlock at codec unbinding") Reported-by: Ville Syrjälä Tested-by: Ville Syrjälä Cc: Link: https://lore.kernel.org/r/YxtflWQnslMHVlU7@intel.com Link: https://lore.kernel.org/r/20220910142550.28494-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3fe3fd5f30720b4afd3345cc186808125e7f5848 Author: Joey Gouly Date: Fri Sep 9 13:43:11 2022 +0100 arm64: mm: fix resume for 52-bit enabled builds __cpu_setup() was changed to take the actual number of VA bits in x0, however the resume path was not updated at the same time. Load `vabits_actual` in the resume path, to ensure that the correct number of VA bits is used. This fixes booting v6.0-rc kernels on my Juno. Signed-off-by: Joey Gouly Fixes: 0aaa68532e9d ("arm64: mm: fix booting with 52-bit address space") Cc: Catalin Marinas Cc: Will Deacon Cc: Ard Biesheuvel Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220909124311.38489-1-joey.gouly@arm.com Signed-off-by: Will Deacon commit ce888220d5c7a805e0e155302a318d5d23e62950 Merge: e35be05d748a1 991df3dd5144f Author: Linus Torvalds Date: Fri Sep 9 17:40:28 2022 -0400 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Eight patches which looks like quite a large core change, but most of the diffstat is reverting the attempt to rejig reference counting introduced in the last merge window which caused issues with device and module removal. Of the remaining four patches, only the fix use-after-free is substantial" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mpt3sas: Fix use-after-free warning scsi: core: Fix a use-after-free scsi: core: Revert "Make sure that targets outlive devices" scsi: core: Revert "Make sure that hosts outlive targets" scsi: core: Revert "Simplify LLD module reference counting" scsi: core: Revert "Call blk_mq_free_tag_set() earlier" scsi: lpfc: Add missing destroy_workqueue() in error path scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE commit c17a2538704f926ee4d167ba625e09b1040d8439 Author: Youling Tang Date: Thu Sep 1 19:10:59 2022 +0800 mksysmap: Fix the mismatch of 'L0' symbols in System.map When System.map was generated, the kernel used mksysmap to filter the kernel symbols, we need to filter "L0" symbols in LoongArch architecture. $ cat System.map | grep L0 9000000000221540 t L0 The L0 symbol exists in System.map, but not in .tmp_System.map. When "cmp -s System.map .tmp_System.map" will show "Inconsistent kallsyms data" error message in link-vmlinux.sh script. Signed-off-by: Youling Tang Signed-off-by: Masahiro Yamada commit 35e60f1aadf6c02d77fdf42180fbf205aec7e8fc Author: Luiz Augusto von Dentz Date: Thu Sep 8 13:57:50 2022 -0700 Bluetooth: Fix HCIGETDEVINFO regression Recent changes breaks HCIGETDEVINFO since it changes the size of hci_dev_info. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Reported-by: Marek Szyprowski Signed-off-by: Luiz Augusto von Dentz commit e35be05d748a1b82c0bd3f62dafbad859a3bd027 Merge: 9ebc0ecb21b53 5ac251c8a05ce Author: Linus Torvalds Date: Fri Sep 9 15:08:40 2022 -0400 Merge tag 'driver-core-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some small driver core and debugfs fixes for 6.0-rc5. Included in here are: - multiple attempts to get the arch_topology code to work properly on non-cluster SMT systems. First attempt caused build breakages in linux-next and 0-day, second try worked. - debugfs fixes for a long-suffering memory leak. The pattern of debugfs_remove(debugfs_lookup(...)) turns out to leak dentries, so add debugfs_lookup_and_remove() to fix this problem. Also fix up the scheduler debug code that highlighted this problem. Fixes for other subsystems will be trickling in over the next few months for this same issue once the debugfs function is merged. All of these have been in linux-next since Wednesday with no reported problems" * tag 'driver-core-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: arch_topology: Make cluster topology span at least SMT CPUs sched/debug: fix dentry leak in update_sched_domain_debugfs debugfs: add debugfs_lookup_and_remove() driver core: fix driver_set_override() issue with empty strings Revert "arch_topology: Make cluster topology span at least SMT CPUs" arch_topology: Make cluster topology span at least SMT CPUs commit 9ebc0ecb21b53e1a592f4ac9af927f7ff605f306 Merge: d2b768c3d44af 745ed37277c5a Author: Linus Torvalds Date: Fri Sep 9 15:03:08 2022 -0400 Merge tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull via Christoph: - fix a use after free in nvmet (Bart Van Assche) - fix a use after free when detecting digest errors (Sagi Grimberg) - fix regression that causes sporadic TCP requests to time out (Sagi Grimberg) - fix two off by ones errors in the nvmet ZNS support (Dennis Maisenbacher) - requeue aen after firmware activation (Keith Busch) - Fix missing request flags in debugfs code (me) - Partition scan fix (Ming) * tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block: block: add missing request flags to debugfs code nvme: requeue aen after firmware activation nvmet: fix mar and mor off-by-one errors nvme-tcp: fix regression that causes sporadic requests to time out nvme-tcp: fix UAF when detecting digest errors nvmet: fix a use-after-free block: don't add partitions if GD_SUPPRESS_PART_SCAN is set commit d2b768c3d44af4ea19c0f52e718acca01ebb22e8 Merge: 0099baa879627 4d9cb92ca41dd Author: Linus Torvalds Date: Fri Sep 9 14:57:18 2022 -0400 Merge tag 'io_uring-6.0-2022-09-09' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Removed function that became unused after last week's merge (Jiapeng) - Two small fixes for kbuf recycling (Pavel) - Include address copy for zc send for POLLFIRST (Pavel) - Fix for short IO handling in the normal read/write path (Pavel) * tag 'io_uring-6.0-2022-09-09' of git://git.kernel.dk/linux-block: io_uring/rw: fix short rw error handling io_uring/net: copy addr for zc on POLL_FIRST io_uring: recycle kbuf recycle on tw requeue io_uring/kbuf: fix not advancing READV kbuf ring io_uring/notif: Remove the unused function io_notif_complete() commit 0099baa87962799d19b05d12f39ff13600482645 Merge: b7e00d6f55015 a261786fdc0a5 Author: Linus Torvalds Date: Fri Sep 9 14:46:44 2022 -0400 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Many bug fixes in several drivers: - Fix misuse of the DMA API in rtrs - Several irdma issues: hung task due to SQ flushing, incorrect capability reporting to userspace, improper error handling for MW corners, touching an uninitialized SGL for during invalidation. - hns was using the wrong page size limits for the HW, an incorrect calculation of wqe_shift causing WQE corruption, and mis computed a timer id. - Fix a crash in SRP triggered by blktests - Fix compiler errors by calling virt_to_page() with the proper type in siw - Userspace triggerable deadlock in ODP - mlx5 could use the wrong profile due to some driver loading races, counters were not working in some device configurations, and a crash on error unwind" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Report RNR NAK generation in device caps RDMA/irdma: Use s/g array in post send only when its valid RDMA/irdma: Return correct WC error for bind operation failure RDMA/irdma: Return error on MR deregister CQP failure RDMA/irdma: Report the correct max cqes from query device MAINTAINERS: Update maintainers of HiSilicon RoCE RDMA/mlx5: Fix UMR cleanup on error flow of driver init RDMA/mlx5: Set local port to one when accessing counters RDMA/mlx5: Rely on RoCE fw cap instead of devlink when setting profile IB/core: Fix a nested dead lock as part of ODP flow RDMA/siw: Pass a pointer to virt_to_page() RDMA/srp: Set scmnd->result only when scmnd is not NULL RDMA/hns: Remove the num_qpc_timer variable RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift RDMA/hns: Fix supported page size RDMA/cma: Fix arguments order in net device validation RDMA/irdma: Fix drain SQ hang with no completion RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg commit b7e00d6f55015f6995f41c60a5367f1065d37622 Merge: e35ff25f9fda4 2edb79a5fb303 Author: Linus Torvalds Date: Fri Sep 9 14:35:22 2022 -0400 Merge tag 'drm-fixes-2022-09-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "From a train in the Irish countryside, regular drm fixes for 6.0-rc5. This is mostly amdgpu/amdkfd and i915 fixes, then one panfrost, one ttm and one edid fix. Nothing too major going on. Hopefully a quiet week next week for LPC. edid: - Fix EDID 1.4 range-descriptor parsing ttm: - Fix ghost-object bulk moves i915: - Fix MIPI sequence block copy from BIOS' table - Fix PCODE min freq setup when GuC's SLPC is in use - Implement Workaround for eDP - Fix has_flat_ccs selection for DG1 amdgpu: - Firmware header fix - SMU 13.x fix - Debugfs memory leak fix - NBIO 7.7 fix - Firmware memory leak fix amdkfd: - Debug output fix panfrost: - Fix devfreq OPP" * tag 'drm-fixes-2022-09-10' of git://anongit.freedesktop.org/drm/drm: drm/panfrost: devfreq: set opp to the recommended one to configure regulator drm/ttm: cleanup the resource of ghost objects after locking them drm/amdgpu: prevent toc firmware memory leak drm/amdgpu: correct doorbell range/size value for CSDMA_DOORBELL_RANGE drm/amdkfd: print address in hex format rather than decimal drm/amd/display: fix memory leak when using debugfs_lookup() drm/amd/pm: add missing SetMGpuFanBoostLimitRpm mapping for SMU 13.0.7 drm/amd/amdgpu: add rlc_firmware_header_v2_4 to amdgpu_firmware_header drm/i915: consider HAS_FLAT_CCS() in needs_ccs_pages drm/i915: Implement WaEdpLinkRateDataReload drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC drm/i915/bios: Copy the whole MIPI sequence block drm/ttm: update bulk move object of ghost BO drm/edid: Handle EDID 1.4 range descriptor h/vfreq offsets commit e35ff25f9fda4385249f909bce21c8f759bc46d4 Merge: 22b2e2d6ab35f 2a2dfc869d334 Author: Linus Torvalds Date: Fri Sep 9 14:13:36 2022 -0400 Merge tag 'linux-kselftest-kunit-fixes-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit fixes from Shuah Khan: "Two fixes to test build and a fix for incorrect taint reason reporting" * tag 'linux-kselftest-kunit-fixes-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: tools: Add new "test" taint to kernel-chktaint kunit: fix Kconfig for build-in tests USB4 and Nitro Enclaves kunit: fix assert_type for comparison macros commit 22b2e2d6ab35fdef4439e27da2df208014d52eda Merge: 2fc1171d34def 20e0fbab16003 Author: Linus Torvalds Date: Fri Sep 9 14:06:10 2022 -0400 Merge tag 'riscv-for-linus-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A pair of device tree fixes for the Polarfire SOC - A fix to avoid overflowing the PMU counter array when firmware incorrectly reports the number of supported counters, which manifests on OpenSBI versions prior to 1.1 * tag 'riscv-for-linus-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: perf: RISC-V: fix access beyond allocated array riscv: dts: microchip: use an mpfs specific l2 compatible dt-bindings: riscv: sifive-l2: add a PolarFire SoC compatible commit 2fc1171d34deff70bf3a8338adab8ce46138aae3 Merge: 9b4509495418a a66de5283e166 Author: Linus Torvalds Date: Fri Sep 9 14:00:45 2022 -0400 Merge tag 'powerpc-6.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Fix crashes on bare metal due to the new plkps driver trying to probe and call the hypervisor on non-pseries machines. Thanks to Nathan Chancellor and Dan Horák. * tag 'powerpc-6.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries: Fix plpks crash on non-pseries commit 88700d1396bae72d9a4c23a48bbd98c1c2f53f3d Author: Eugene Shalygin Date: Fri Sep 9 17:56:53 2022 +0200 hwmon: (asus-ec-sensors) autoload module via DMI data Replace autoloading data based on the ACPI EC device with the DMI records for motherboards models. The ACPI method created a bug that when this driver returns error from the probe function because of the unsupported motherboard model, the ACPI subsystem concludes that the EC device does not work properly. Fixes: 5cd29012028d ("hwmon: (asus-ec-sensors) introduce ec_board_info struct for board data") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=216412 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2121844 Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20220909155654.123398-2-eugene.shalygin@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck commit 2edb79a5fb303dff577d6a0c7d571c3bab1d1455 Merge: b34c1d538951e 151e0e0fdb4d6 Author: Dave Airlie Date: Sat Sep 10 01:37:01 2022 +1000 Merge tag 'drm-intel-fixes-2022-09-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix MIPI sequence block copy from BIOS' table. (Ville) - Fix PCODE min freq setup when GuC's SLPC is in use. (Rodrigo) - Implement Workaround for eDP. (Ville) - Fix has_flat_ccs selection for DG1. (Matt) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Yxn1WpmUJnJpqq23@intel.com commit 727488e305b223ca69205ca5a3b99ace21bbbf5f Author: Alexander Sverdlin Date: Fri Sep 9 11:30:42 2022 +0200 mips: Select SPARSEMEM_EXTREME Commit c46173183657 ("MIPS: Add NUMA support for Loongson-3") has increased .bss size of the Octeon kernel from 16k to 16M. Providing the conditions for SPARSEMEM_EXTREME avoids the waste of memory. Thomas has tested the loogsoon64 kernel, where .bss is being reduced by this patch from 16.5M to 515k. Cc: Thomas Bogendoerfer Signed-off-by: Alexander Sverdlin Signed-off-by: Thomas Bogendoerfer commit b34c1d538951e1c3a6d5e585e4a95e78d8733064 Merge: c0521598a58cf d76034a427a26 Author: Dave Airlie Date: Sat Sep 10 01:30:02 2022 +1000 Merge tag 'drm-misc-fixes-2022-09-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * edid: Fix EDID 1.4 range-descriptor parsing * panfrost: Fix devfreq OPP * ttm: Fix ghost-object bulk moves Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YxniKN4rK4qPp+J9@linux-uq9g commit 4d9cb92ca41dd8e905a4569ceba4716c2f39c75a Author: Pavel Begunkov Date: Fri Sep 9 12:11:49 2022 +0100 io_uring/rw: fix short rw error handling We have a couple of problems, first reports of unexpected link breakage for reads when cqe->res indicates that the IO was done in full. The reason here is partial IO with retries. TL;DR; we compare the result in __io_complete_rw_common() against req->cqe.res, but req->cqe.res doesn't store the full length but rather the length left to be done. So, when we pass the full corrected result via kiocb_done() -> __io_complete_rw_common(), it fails. The second problem is that we don't try to correct res in io_complete_rw(), which, for instance, might be a problem for O_DIRECT but when a prefix of data was cached in the page cache. We also definitely don't want to pass a corrected result into io_rw_done(). The fix here is to leave __io_complete_rw_common() alone, always pass not corrected result into it and fix it up as the last step just before actually finishing the I/O. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Link: https://github.com/axboe/liburing/issues/643 Reported-by: Beld Zhang Signed-off-by: Jens Axboe commit 35b513a74eabf09bd718e04fd9e62b09c022807f Author: Sascha Hauer Date: Mon Aug 15 15:39:42 2022 +0200 drm/rockchip: vop2: Fix eDP/HDMI sync polarities The hsync/vsync polarities were not honoured for the eDP and HDMI ports. Add the register settings to configure the polarities as requested by the DRM_MODE_FLAG_PHSYNC/DRM_MODE_FLAG_PVSYNC flags. Signed-off-by: Sascha Hauer Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") Tested-by: Michael Riesch Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20220815133942.4051532-1-s.hauer@pengutronix.de commit 235fdbc32d559db21e580f85035c59372704f09e Author: Hans de Goede Date: Tue Sep 6 22:38:52 2022 +0200 drm/gma500: Fix (vblank) IRQs not working after suspend/resume Fix gnome-shell (and other page-flip users) hanging after suspend/resume because of the gma500's IRQs not working. This fixes 2 problems with the IRQ handling: 1. gma_power_off() calls gma_irq_uninstall() which does a free_irq(), but gma_power_on() called gma_irq_preinstall() + gma_irq_postinstall() which do not call request_irq. Replace the pre- + post-install calls with gma_irq_install() which does prep + request + post. 2. After fixing 1. IRQs still do not work on a Packard Bell Dot SC (Intel Atom N2600, cedarview) netbook. Cederview uses MSI interrupts and it seems that the BIOS re-configures things back to normal APIC based interrupts during S3 suspend. There is some MSI PCI-config registers save/restore code which tries to deal with this, but on the Packard Bell Dot SC this is not sufficient to restore MSI IRQ functionality after a suspend/resume. Replace the PCI-config registers save/restore with pci_disable_msi() on suspend + pci_enable_msi() on resume. Fixing e.g. gnome-shell hanging. Signed-off-by: Hans de Goede Signed-off-by: Patrik Jakobsson Link: https://patchwork.freedesktop.org/patch/msgid/20220906203852.527663-4-hdegoede@redhat.com commit b6f25c3b94f2aadbf5cbef954db4073614943d74 Author: Hans de Goede Date: Tue Sep 6 22:38:51 2022 +0200 drm/gma500: Fix WARN_ON(lock->magic != lock) error psb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex gets destroyed by drm_gem_object_release() move the drm_gem_object_release() call in psb_gem_free_object() to after the unpin to fix the below warning: [ 79.693962] ------------[ cut here ]------------ [ 79.693992] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0 [ 79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse [ 79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G W E 6.0.0-rc3+ #490 [ 79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 [ 79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0 [ 79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff <0f> 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11 [ 79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282 [ 79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000 [ 79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff [ 79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90 [ 79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138 [ 79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270 [ 79.694690] FS: 00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000 [ 79.694705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0 [ 79.694734] Call Trace: [ 79.694749] [ 79.694761] ? __schedule+0x47f/0x1670 [ 79.694796] ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx] [ 79.694830] ? lock_is_held_type+0xe3/0x140 [ 79.694864] ? ww_mutex_lock+0x38/0xa0 [ 79.694885] ? __cond_resched+0x1c/0x30 [ 79.694902] ww_mutex_lock+0x38/0xa0 [ 79.694925] psb_gem_unpin+0x27/0x1a0 [gma500_gfx] [ 79.694964] psb_gem_unpin+0x199/0x1a0 [gma500_gfx] [ 79.694996] drm_gem_object_release_handle+0x50/0x60 [ 79.695020] ? drm_gem_object_handle_put_unlocked+0xf0/0xf0 [ 79.695042] idr_for_each+0x4b/0xb0 [ 79.695066] ? _raw_spin_unlock_irqrestore+0x30/0x60 [ 79.695095] drm_gem_release+0x1c/0x30 [ 79.695118] drm_file_free.part.0+0x1ea/0x260 [ 79.695150] drm_release+0x6a/0x120 [ 79.695175] __fput+0x9f/0x260 [ 79.695203] task_work_run+0x59/0xa0 [ 79.695227] do_exit+0x387/0xbe0 [ 79.695250] ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 [ 79.695275] ? lockdep_hardirqs_on+0x7d/0x100 [ 79.695304] do_group_exit+0x33/0xb0 [ 79.695331] __x64_sys_exit_group+0x14/0x20 [ 79.695353] do_syscall_64+0x58/0x80 [ 79.695376] ? up_read+0x17/0x20 [ 79.695401] ? lock_is_held_type+0xe3/0x140 [ 79.695429] ? asm_exc_page_fault+0x22/0x30 [ 79.695450] ? lockdep_hardirqs_on+0x7d/0x100 [ 79.695473] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 79.695493] RIP: 0033:0x7ff1ccefe3f1 [ 79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7. [ 79.695607] RSP: 002b:00007ffed4413378 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 79.695629] RAX: ffffffffffffffda RBX: 00007ff1cd0159e0 RCX: 00007ff1ccefe3f1 [ 79.695644] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 79.695656] RBP: 0000000000000000 R08: ffffffffffffff80 R09: 00007ff1cd020b20 [ 79.695671] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff1cd0159e0 [ 79.695684] R13: 0000000000000000 R14: 00007ff1cd01aee8 R15: 00007ff1cd01af00 [ 79.695733] [ 79.695746] irq event stamp: 725979 [ 79.695757] hardirqs last enabled at (725979): [] finish_task_switch.isra.0+0xe4/0x3f0 [ 79.695780] hardirqs last disabled at (725978): [] __schedule+0xdd3/0x1670 [ 79.695803] softirqs last enabled at (725974): [] __irq_exit_rcu+0xed/0x160 [ 79.695825] softirqs last disabled at (725969): [] __irq_exit_rcu+0xed/0x160 [ 79.695845] ---[ end trace 0000000000000000 ]--- Signed-off-by: Hans de Goede Signed-off-by: Patrik Jakobsson Link: https://patchwork.freedesktop.org/patch/msgid/20220906203852.527663-3-hdegoede@redhat.com commit 63e37a79f7bd939314997e29c2f5a9f0ef184281 Author: Hans de Goede Date: Tue Sep 6 22:38:50 2022 +0200 drm/gma500: Fix BUG: sleeping function called from invalid context errors gma_crtc_page_flip() was holding the event_lock spinlock while calling crtc_funcs->mode_set_base() which takes ww_mutex. The only reason to hold event_lock is to clear gma_crtc->page_flip_event on mode_set_base() errors. Instead unlock it after setting gma_crtc->page_flip_event and on errors re-take the lock and clear gma_crtc->page_flip_event it it is still set. This fixes the following WARN/stacktrace: [ 512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870 [ 512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell [ 512.123031] preempt_count: 1, expected: 0 [ 512.123048] RCU nest depth: 0, expected: 0 [ 512.123066] INFO: lockdep is turned off. [ 512.123080] irq event stamp: 0 [ 512.123094] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 512.123134] hardirqs last disabled at (0): [] copy_process+0x9fc/0x1de0 [ 512.123176] softirqs last enabled at (0): [] copy_process+0x9fc/0x1de0 [ 512.123207] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 512.123233] Preemption disabled at: [ 512.123241] [<0000000000000000>] 0x0 [ 512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G W 5.19.0+ #1 [ 512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 [ 512.123323] Call Trace: [ 512.123346] [ 512.123370] dump_stack_lvl+0x5b/0x77 [ 512.123412] __might_resched.cold+0xff/0x13a [ 512.123458] ww_mutex_lock+0x1e/0xa0 [ 512.123495] psb_gem_pin+0x2c/0x150 [gma500_gfx] [ 512.123601] gma_pipe_set_base+0x76/0x240 [gma500_gfx] [ 512.123708] gma_crtc_page_flip+0x95/0x130 [gma500_gfx] [ 512.123808] drm_mode_page_flip_ioctl+0x57d/0x5d0 [ 512.123897] ? drm_mode_cursor2_ioctl+0x10/0x10 [ 512.123936] drm_ioctl_kernel+0xa1/0x150 [ 512.123984] drm_ioctl+0x21f/0x420 [ 512.124025] ? drm_mode_cursor2_ioctl+0x10/0x10 [ 512.124070] ? rcu_read_lock_bh_held+0xb/0x60 [ 512.124104] ? lock_release+0x1ef/0x2d0 [ 512.124161] __x64_sys_ioctl+0x8d/0xd0 [ 512.124203] do_syscall_64+0x58/0x80 [ 512.124239] ? do_syscall_64+0x67/0x80 [ 512.124267] ? trace_hardirqs_on_prepare+0x55/0xe0 [ 512.124300] ? do_syscall_64+0x67/0x80 [ 512.124340] ? rcu_read_lock_sched_held+0x10/0x80 [ 512.124377] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 512.124411] RIP: 0033:0x7fcc4a70740f [ 512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f [ 512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009 [ 512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034 [ 512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0 [ 512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0 [ 512.124647] Signed-off-by: Hans de Goede Signed-off-by: Patrik Jakobsson Link: https://patchwork.freedesktop.org/patch/msgid/20220906203852.527663-2-hdegoede@redhat.com commit 745ed37277c5a7202180aa276c87db1362c90fe5 Author: Jens Axboe Date: Thu Sep 8 17:26:59 2022 -0600 block: add missing request flags to debugfs code We're missing TIMED_OUT and RESV. Particularly the former is handy for debugging, let's get them added. Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit 9b4509495418a0effe964b0aad9a522be5a3b6d5 Merge: 725f3f3b2708d 5da431b71d4b9 Author: Linus Torvalds Date: Fri Sep 9 07:54:19 2022 -0400 Merge tag 'for-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more fixes to zoned mode and one regression fix for chunk limit: - Zoned mode fixes: - fix how wait/wake up is done when finishing zone - fix zone append limit in emulated mode - fix mount on devices with conventional zones - fix regression, user settable data chunk limit got accidentally lowered and causes allocation problems on some profiles (raid0, raid1)" * tag 'for-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix the max chunk size and stripe length calculation btrfs: zoned: fix mounting with conventional zones btrfs: zoned: set pseudo max append zone limit in zone emulation mode btrfs: zoned: fix API misuse of zone finish waiting commit 64ae13ed478428135cddc2f1113dff162d8112d4 Author: Ludovic Cintrat Date: Wed Sep 7 12:08:13 2022 +0200 net: core: fix flow symmetric hash __flow_hash_consistentify() wrongly swaps ipv4 addresses in few cases. This function is indirectly used by __skb_get_hash_symmetric(), which is used to fanout packets in AF_PACKET. Intrusion detection systems may be impacted by this issue. __flow_hash_consistentify() computes the addresses difference then swaps them if the difference is negative. In few cases src - dst and dst - src are both negative. The following snippet mimics __flow_hash_consistentify(): ``` #include #include int main(int argc, char** argv) { int diffs_d, diffd_s; uint32_t dst = 0xb225a8c0; /* 178.37.168.192 --> 192.168.37.178 */ uint32_t src = 0x3225a8c0; /* 50.37.168.192 --> 192.168.37.50 */ uint32_t dst2 = 0x3325a8c0; /* 51.37.168.192 --> 192.168.37.51 */ diffs_d = src - dst; diffd_s = dst - src; printf("src:%08x dst:%08x, diff(s-d)=%d(0x%x) diff(d-s)=%d(0x%x)\n", src, dst, diffs_d, diffs_d, diffd_s, diffd_s); diffs_d = src - dst2; diffd_s = dst2 - src; printf("src:%08x dst:%08x, diff(s-d)=%d(0x%x) diff(d-s)=%d(0x%x)\n", src, dst2, diffs_d, diffs_d, diffd_s, diffd_s); return 0; } ``` Results: src:3225a8c0 dst:b225a8c0, \ diff(s-d)=-2147483648(0x80000000) \ diff(d-s)=-2147483648(0x80000000) src:3225a8c0 dst:3325a8c0, \ diff(s-d)=-16777216(0xff000000) \ diff(d-s)=16777216(0x1000000) In the first case the addresses differences are always < 0, therefore __flow_hash_consistentify() always swaps, thus dst->src and src->dst packets have differents hashes. Fixes: c3f8324188fa8 ("net: Add full IPv6 addresses to flow_keys") Signed-off-by: Ludovic Cintrat Signed-off-by: David S. Miller commit 81225b2ea161af48e093f58e8dfee6d705b16af4 Author: Lu Wei Date: Wed Sep 7 18:12:04 2022 +0800 ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header If an AF_PACKET socket is used to send packets through ipvlan and the default xmit function of the AF_PACKET socket is changed from dev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option name of PACKET_QDISC_BYPASS, the skb->mac_header may not be reset and remains as the initial value of 65535, this may trigger slab-out-of-bounds bugs as following: ================================================================= UG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] PU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6 ardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 all Trace: print_address_description.constprop.0+0x1d/0x160 print_report.cold+0x4f/0x112 kasan_report+0xa3/0x130 ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan] ipvlan_start_xmit+0x29/0xa0 [ipvlan] __dev_direct_xmit+0x2e2/0x380 packet_direct_xmit+0x22/0x60 packet_snd+0x7c9/0xc40 sock_sendmsg+0x9a/0xa0 __sys_sendto+0x18a/0x230 __x64_sys_sendto+0x74/0x90 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is: 1. packet_snd() only reset skb->mac_header when sock->type is SOCK_RAW and skb->protocol is not specified as in packet_parse_headers() 2. packet_direct_xmit() doesn't reset skb->mac_header as dev_queue_xmit() In this case, skb->mac_header is 65535 when ipvlan_xmit_mode_l2() is called. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which use "skb->head + skb->mac_header", out-of-bound access occurs. This patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2() and reset mac header in multicast to solve this out-of-bound bug. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Lu Wei Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 725f3f3b2708d8f3fe56df8113bfdc7380d52dc9 Merge: 83dfc0e2fd008 873aefb376bbc Author: Linus Torvalds Date: Fri Sep 9 07:44:33 2022 -0400 Merge tag 'vfio-v6.0-rc5' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Fix zero page refcount leak (Alex Williamson) * tag 'vfio-v6.0-rc5' of https://github.com/awilliam/linux-vfio: vfio/type1: Unpin zero pages commit 83dfc0e2fd008b6fd2df70f6635cc4def41da056 Merge: d8a450a80ef1c 09e3e3159cd4d Author: Linus Torvalds Date: Fri Sep 9 07:36:10 2022 -0400 Merge tag 'sound-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Lots of small fixes for various drivers at this time, hopefully it will be the last big bump before 6.0 release. The significant changes are regression fixes for (yet again) HD-audio memory allocations and USB-audio PCM parameter handling, while there are many small ASoC device-specific fixes as well as a few out-of-bounds and race issues spotted by fuzzers" * tag 'sound-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits) ALSA: usb-audio: Clear fixed clock rate at closing EP ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() ALSA: hda: Once again fix regression of page allocations with IOMMU ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() ALSA: hda/tegra: Align BDL entry to 4KB boundary ALSA: hda/sigmatel: Fix unused variable warning for beep power change ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC ALSA: hda/sigmatel: Keep power up while beep is enabled ALSA: aloop: Fix random zeros in capture data when using jiffies timer ALSA: usb-audio: Split endpoint setups for hw_params and prepare ALSA: usb-audio: Register card again for iface over delayed_register option ALSA: usb-audio: Inform the delayed registration more properly ASoC: fsl_aud2htx: Add error handler for pm_runtime_enable ASoC: fsl_aud2htx: register platform component before registering cpu dai ASoC: SOF: ipc4-topology: fix alh_group_ida max value ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion ASoC: SOF: Kconfig: Make IPC_MESSAGE_INJECTOR depend on SND_SOC_SOF ASoC: SOF: Kconfig: Make IPC_FLOOD_TEST depend on SND_SOC_SOF ASoC: fsl_mqs: Fix supported clock DAI format ASoC: nau8540: Implement hw constraint for rates ... commit 6463d3930ba5b6addcfc8f80a4543976a2fc7656 Author: Stuart Menefy Date: Thu Sep 8 16:52:43 2022 +0100 drm/meson: Fix OSD1 RGB to YCbCr coefficient VPP_WRAP_OSD1_MATRIX_COEF22.Coeff22 is documented as being bits 0-12, not 16-28. Without this the output tends to have a pink hue, changing it results in better color accuracy. The vendor kernel doesn't use this register. However the code which sets VIU2_OSD1_MATRIX_COEF22 also uses bits 0-12. There is a slightly different style of registers for configuring some of the other matrices, which do use bits 16-28 for this coefficient, but those have names ending in MATRIX_COEF22_30, and this is not one of those. Signed-off-by: Stuart Menefy Fixes: 728883948b0d ("drm/meson: Add G12A Support for VIU setup") Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220908155243.687143-1-stuart.menefy@mathembedded.com commit 6836829c8ea453c9e3e518e61539e35881c8ed5f Author: Stuart Menefy Date: Thu Sep 8 16:51:03 2022 +0100 drm/meson: Correct OSD1 global alpha value VIU_OSD1_CTRL_STAT.GLOBAL_ALPHA is a 9 bit field, so the maximum value is 0x100 not 0xff. This matches the vendor kernel. Signed-off-by: Stuart Menefy Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220908155103.686904-1-stuart.menefy@mathembedded.com commit d8a450a80ef1c858c3095180f75284873d8297e8 Merge: 460a75a6f7cd2 faf59ec8c3c37 Author: Linus Torvalds Date: Fri Sep 9 07:31:17 2022 -0400 Merge tag 'perf-tools-fixes-for-v6.0-2022-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix per-thread mmaps for multi-threaded targets, noticed with 'perf top --pid' with multithreaded targets - Fix synthesis failure warnings in 'perf record' - Fix L2 Topdown metrics disappearance for raw events in 'perf stat' - Fix out of bound access in some CPU masks - Fix segfault if there is no CPU PMU table and a metric is sought, noticed when building with NO_JEVENTS=1 - Skip dummy event attr check in 'perf script' fixing nonsensical warning about UREGS attribute not set, as 'dummy' events have no samples - Fix 'iregs' field handling with dummy events on hybrid systems in 'perf script' - Prevent potential memory leak in c2c_he_zalloc() in 'perf c2c' - Don't install data files with x permissions - Fix types for print format in dlfilter-show-cycles - Switch deprecated openssl MD5_* functions to new EVP API in 'genelf' - Remove redundant word 'contention' in 'perf lock' help message * tag 'perf-tools-fixes-for-v6.0-2022-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf record: Fix synthesis failure warnings perf tools: Don't install data files with x permissions perf script: Fix Cannot print 'iregs' field for hybrid systems perf lock: Remove redundant word 'contention' in help message perf dlfilter dlfilter-show-cycles: Fix types for print format libperf evlist: Fix per-thread mmaps for multi-threaded targets perf c2c: Prevent potential memory leak in c2c_he_zalloc() perf genelf: Switch deprecated openssl MD5_* functions to new EVP API tools/perf: Fix out of bound access to cpu mask array perf affinity: Fix out of bound access to "sched_cpus" mask perf stat: Fix L2 Topdown metrics disappear for raw events perf script: Skip dummy event attr check perf metric: Return early if no CPU PMU table exists commit 460a75a6f7cd22b7b0522c00fe778c5146b9a96f Merge: f448dda895edc 47311db8e8f33 Author: Linus Torvalds Date: Fri Sep 9 07:27:44 2022 -0400 Merge tag 'trace-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: - Do not stop trace events in modules if TAINT_TEST is set - Do not clobber mount options when tracefs is mounted a second time - Prevent crash of kprobes in gate area - Add static annotation to some non global functions - Add some entries into the MAINTAINERS file - Fix check of event_mutex held when accessing trigger list - Add some __init/__exit annotations - Fix reporting of what called hardirq_{enable,disable}_ip function * tag 'trace-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracefs: Only clobber mode/uid/gid on remount if asked kprobes: Prohibit probes in gate area rv/reactor: add __init/__exit annotations to module init/exit funcs tracing: Fix to check event_mutex is held while accessing trigger list tracing: hold caller_addr to hardirq_{enable,disable}_ip tracepoint: Allow trace events in modules with TAINT_TEST MAINTAINERS: add scripts/tracing/ to TRACING MAINTAINERS: Add Runtime Verification (RV) entry rv/monitors: Make monitor's automata definition static commit f448dda895edcee1bd92a3ec6c4d9d210523b853 Merge: 506357871c18e 8cbb2b50ee2dc Author: Linus Torvalds Date: Fri Sep 9 07:23:29 2022 -0400 Merge tag 'asm-generic-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull SOFTIRQ_ON_OWN_STACK rework from Arnd Bergmann: "Just one fixup patch, reworking the softirq_on_own_stack logic for preempt-rt kernels as discussed in https://lore.kernel.org/all/CAHk-=wgZSD3W2y6yczad2Am=EfHYyiPzTn3CfXxrriJf9i5W5w@mail.gmail.com/" * tag 'asm-generic-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: Conditionally enable do_softirq_own_stack() via Kconfig. commit df2a60173a61a5acf44fca2cfb2d8d9f5b810a3f Merge: 26b1224903b3f 559c36c5a8d73 Author: David S. Miller Date: Fri Sep 9 10:06:34 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westhal says: ==================== netfilter: bugfixes for net The following set contains four netfilter patches for your *net* tree. When there are multiple Contact headers in a SIP message its possible the next headers won't be found because the SIP helper confuses relative and absolute offsets in the message. From Igor Ryzhov. Make the nft_concat_range self-test support socat, this makes the selftest pass on my test VM, from myself. nf_conntrack_irc helper can be tricked into opening a local port forward that the client never requested by embedding a DCC message in a PING request sent to the client. Fix from David Leadbeater. Both have been broken since the kernel 2.6.x days. The 'osf' match might indicate success while it could not find anything, broken since 5.2 . Fix from Pablo Neira. ==================== Signed-off-by: David S. Miller commit 14c7d905283744809e6b82efae2f490660a11cda Author: Gil Fine Date: Thu Sep 8 13:43:20 2022 +0300 thunderbolt: Add support for Intel Maple Ridge single port controller Add support for Maple Ridge discrete USB4 host controller from Intel which has a single USB4 port (versus the already supported dual port Maple Ridge USB4 host controller). Cc: stable@vger.kernel.org Signed-off-by: Gil Fine Signed-off-by: Mika Westerberg commit 00801cd92d91e94aa04d687f9bb9a9104e7c3d46 Author: NeilBrown Date: Thu Sep 8 12:08:40 2022 +1000 NFSD: fix regression with setting ACLs. A recent patch moved ACL setting into nfsd_setattr(). Unfortunately it didn't work as nfsd_setattr() aborts early if iap->ia_valid is 0. Remove this test, and instead avoid calling notify_change() when ia_valid is 0. This means that nfsd_setattr() will now *always* lock the inode. Previously it didn't if only a ATTR_MODE change was requested on a symlink (see Commit 15b7a1b86d66 ("[PATCH] knfsd: fix setattr-on-symlink error return")). I don't think this change really matters. Fixes: c0cbe70742f4 ("NFSD: add posix ACLs to struct nfsd_attrs") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7e9c323c52b379d261a72dc7bd38120a761a93cd Author: Chao Yu Date: Wed Aug 31 22:54:54 2022 +0800 mm/slub: fix to return errno if kmalloc() fails In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUG_ON(); kernel BUG at mm/slub.c:5893! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Call trace: sysfs_slab_add+0x258/0x260 mm/slub.c:5973 __kmem_cache_create+0x60/0x118 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335 kmem_cache_create+0x1c/0x28 mm/slab_common.c:390 f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline] f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808 f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149 mount_bdev+0x1b8/0x210 fs/super.c:1400 f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512 legacy_get_tree+0x30/0x74 fs/fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1530 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x914 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568 Cc: Fixes: 81819f0fc8285 ("SLUB core") Reported-by: syzbot+81684812ea68216e08c5@syzkaller.appspotmail.com Reviewed-by: Muchun Song Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Chao Yu Acked-by: David Rientjes Signed-off-by: Vlastimil Babka commit 47311db8e8f33011d90dee76b39c8886120cdda4 Author: Brian Norris Date: Fri Aug 26 17:44:17 2022 -0700 tracefs: Only clobber mode/uid/gid on remount if asked Users may have explicitly configured their tracefs permissions; we shouldn't overwrite those just because a second mount appeared. Only clobber if the options were provided at mount time. Note: the previous behavior was especially surprising in the presence of automounted /sys/kernel/debug/tracing/. Existing behavior: ## Pre-existing status: tracefs is 0755. # stat -c '%A' /sys/kernel/tracing/ drwxr-xr-x ## (Re)trigger the automount. # umount /sys/kernel/debug/tracing # stat -c '%A' /sys/kernel/debug/tracing/. drwx------ ## Unexpected: the automount changed mode for other mount instances. # stat -c '%A' /sys/kernel/tracing/ drwx------ New behavior (after this change): ## Pre-existing status: tracefs is 0755. # stat -c '%A' /sys/kernel/tracing/ drwxr-xr-x ## (Re)trigger the automount. # umount /sys/kernel/debug/tracing # stat -c '%A' /sys/kernel/debug/tracing/. drwxr-xr-x ## Expected: the automount does not change other mount instances. # stat -c '%A' /sys/kernel/tracing/ drwxr-xr-x Link: https://lkml.kernel.org/r/20220826174353.2.Iab6e5ea57963d6deca5311b27fb7226790d44406@changeid Cc: stable@vger.kernel.org Fixes: 4282d60689d4f ("tracefs: Add new tracefs file system") Signed-off-by: Brian Norris Signed-off-by: Steven Rostedt (Google) commit 1efda38d6f9ba26ac88b359c6277f1172db03f1e Author: Christian A. Ehrhardt Date: Wed Sep 7 22:09:17 2022 +0200 kprobes: Prohibit probes in gate area The system call gate area counts as kernel text but trying to install a kprobe in this area fails with an Oops later on. To fix this explicitly disallow the gate area for kprobes. Found by syzkaller with the following reproducer: perf_event_open$cgroup(&(0x7f00000001c0)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffff600000}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) Sample report: BUG: unable to handle page fault for address: fffffbfff3ac6000 PGD 6dfcb067 P4D 6dfcb067 PUD 6df8f067 PMD 6de4d067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 21978 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b-dirty #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 38 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: insn_get_prefixes arch/x86/lib/insn.c:131 [inline] insn_get_opcode arch/x86/lib/insn.c:272 [inline] insn_get_modrm+0x64a/0x7b0 arch/x86/lib/insn.c:343 insn_get_sib+0x29a/0x330 arch/x86/lib/insn.c:421 insn_get_displacement+0x350/0x6b0 arch/x86/lib/insn.c:464 insn_get_immediate arch/x86/lib/insn.c:632 [inline] insn_get_length arch/x86/lib/insn.c:707 [inline] insn_decode+0x43a/0x490 arch/x86/lib/insn.c:747 can_probe+0xfc/0x1d0 arch/x86/kernel/kprobes/core.c:282 arch_prepare_kprobe+0x79/0x1c0 arch/x86/kernel/kprobes/core.c:739 prepare_kprobe kernel/kprobes.c:1160 [inline] register_kprobe kernel/kprobes.c:1641 [inline] register_kprobe+0xb6e/0x1690 kernel/kprobes.c:1603 __register_trace_kprobe kernel/trace/trace_kprobe.c:509 [inline] __register_trace_kprobe+0x26a/0x2d0 kernel/trace/trace_kprobe.c:477 create_local_trace_kprobe+0x1f7/0x350 kernel/trace/trace_kprobe.c:1833 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:271 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9888 perf_try_init_event+0x12d/0x570 kernel/events/core.c:11261 perf_init_event kernel/events/core.c:11325 [inline] perf_event_alloc.part.0+0xf7f/0x36a0 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:12059 [inline] __do_sys_perf_event_open+0x4a8/0x2a00 kernel/events/core.c:12157 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f63ef7efaed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f63eef63028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f63ef90ff80 RCX: 00007f63ef7efaed RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00000000200001c0 RBP: 00007f63ef86019c R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000002 R14: 00007f63ef90ff80 R15: 00007f63eef43000 Modules linked in: CR2: fffffbfff3ac6000 ---[ end trace 0000000000000000 ]--- RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 38 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 ================================================================== Link: https://lkml.kernel.org/r/20220907200917.654103-1-lk@c--e.de cc: "Naveen N. Rao" cc: Anil S Keshavamurthy cc: "David S. Miller" Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Christian A. Ehrhardt Signed-off-by: Steven Rostedt (Google) commit 20e0fbab16003ae23a9e86a64bcb93e3121587ca Author: Sergey Matyukevich Date: Tue Aug 30 18:53:04 2022 +0300 perf: RISC-V: fix access beyond allocated array SBI firmware should report total number of firmware and hardware counters including unused ones or special ones. In this case the kernel doesn't need to make any assumptions about gaps in reported counters, e.g. excluded timer counter. That was fixed in OpenSBI v1.1 by commit 3f66465fb6bf ("lib: pmu: allow to use the highest available counter"). This kernel patch has no effect if SBI firmware behaves correctly. However it eliminates access beyond the allocated pmu_ctr_list if the kernel is used with OpenSBI older than v1.1. Fixes: e9991434596f ("RISC-V: Add perf platform driver based on SBI PMU extension") Signed-off-by: Sergey Matyukevich Reviewed-by: Atish Patra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220830155306.301714-2-geomatsi@gmail.com Signed-off-by: Palmer Dabbelt commit e3c95edb1bd8b9c2cb0caa6ae382fc8080f6a0ed Author: Samuel Holland Date: Sun Aug 14 23:12:43 2022 -0500 soc: sunxi: sram: Fix debugfs info for A64 SRAM C The labels were backward with respect to the register values. The SRAM is mapped to the CPU when the register value is 1. Fixes: 5e4fb6429761 ("drivers: soc: sunxi: add support for A64 and its SRAM C") Acked-by: Jernej Skrabec Signed-off-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220815041248.53268-7-samuel@sholland.org commit 81fa6fd13b5c43601fba8486f2385dbd7c1935e2 Author: Haitao Huang Date: Tue Sep 6 03:02:21 2022 +0300 x86/sgx: Handle VA page allocation failure for EAUG on PF. VM_FAULT_NOPAGE is expected behaviour for -EBUSY failure path, when augmenting a page, as this means that the reclaimer thread has been triggered, and the intention is just to round-trip in ring-3, and retry with a new page fault. Fixes: 5a90d2c3f5ef ("x86/sgx: Support adding of pages to an initialized enclave") Signed-off-by: Haitao Huang Signed-off-by: Jarkko Sakkinen Signed-off-by: Dave Hansen Reviewed-by: Reinette Chatre Tested-by: Vijay Dhanraj Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220906000221.34286-3-jarkko@kernel.org commit 49fad91a7b8941979c3e9a35f9894ac45bc5d3d6 Author: Samuel Holland Date: Sun Aug 14 23:12:42 2022 -0500 soc: sunxi: sram: Fix probe function ordering issues Errors from debugfs are intended to be non-fatal, and should not prevent the driver from probing. Since debugfs file creation is treated as infallible, move it below the parts of the probe function that can fail. This prevents an error elsewhere in the probe function from causing the file to leak. Do the same for the call to of_platform_populate(). Finally, checkpatch suggests an octal literal for the file permissions. Fixes: 4af34b572a85 ("drivers: soc: sunxi: Introduce SoC driver to map SRAMs") Fixes: 5828729bebbb ("soc: sunxi: export a regmap for EMAC clock reg on A64") Reviewed-by: Jernej Skrabec Signed-off-by: Samuel Holland Tested-by: Heiko Stuebner Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220815041248.53268-6-samuel@sholland.org commit 133e049a3f8c91b175029fb6a59b6039d5e79cba Author: Jarkko Sakkinen Date: Tue Sep 6 03:02:20 2022 +0300 x86/sgx: Do not fail on incomplete sanitization on premature stop of ksgxd Unsanitized pages trigger WARN_ON() unconditionally, which can panic the whole computer, if /proc/sys/kernel/panic_on_warn is set. In sgx_init(), if misc_register() fails or misc_register() succeeds but neither sgx_drv_init() nor sgx_vepc_init() succeeds, then ksgxd will be prematurely stopped. This may leave unsanitized pages, which will result a false warning. Refine __sgx_sanitize_pages() to return: 1. Zero when the sanitization process is complete or ksgxd has been requested to stop. 2. The number of unsanitized pages otherwise. Fixes: 51ab30eb2ad4 ("x86/sgx: Replace section->init_laundry_list with sgx_dirty_page_list") Reported-by: Paul Menzel Signed-off-by: Jarkko Sakkinen Signed-off-by: Dave Hansen Reviewed-by: Reinette Chatre Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-sgx/20220825051827.246698-1-jarkko@kernel.org/T/#u Link: https://lkml.kernel.org/r/20220906000221.34286-2-jarkko@kernel.org commit 90e10a1fcd9b24b4ba8c0d35136127473dcd829e Author: Samuel Holland Date: Sun Aug 14 23:12:41 2022 -0500 soc: sunxi: sram: Prevent the driver from being unbound This driver exports a regmap tied to the platform device (as opposed to a syscon, which exports a regmap tied to the OF node). Because of this, the driver can never be unbound, as that would destroy the regmap. Use builtin_platform_driver_probe() to enforce this limitation. Fixes: 5828729bebbb ("soc: sunxi: export a regmap for EMAC clock reg on A64") Reviewed-by: Jernej Skrabec Signed-off-by: Samuel Holland Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220815041248.53268-5-samuel@sholland.org commit fd362baad2e659ef0fb5652f023a606b248f1781 Author: Samuel Holland Date: Sun Aug 14 23:12:40 2022 -0500 soc: sunxi: sram: Actually claim SRAM regions sunxi_sram_claim() checks the sram_desc->claimed flag before updating the register, with the intent that only one device can claim a region. However, this was ineffective because the flag was never set. Fixes: 4af34b572a85 ("drivers: soc: sunxi: Introduce SoC driver to map SRAMs") Reviewed-by: Jernej Skrabec Signed-off-by: Samuel Holland Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220815041248.53268-4-samuel@sholland.org commit 809f23c0423a43266e47a7dc67e95b5cb4d1cbfc Author: Brett Creeley Date: Thu Sep 1 16:34:40 2022 +0200 iavf: Fix cached head and tail value for iavf_get_tx_pending The underlying hardware may or may not allow reading of the head or tail registers and it really makes no difference if we use the software cached values. So, always used the software cached values. Fixes: 9c6c12595b73 ("i40e: Detection and recovery of TX queue hung logic moved to service_task from tx_timeout") Signed-off-by: Brett Creeley Co-developed-by: Norbert Zulinski Signed-off-by: Norbert Zulinski Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit f66b98c868f2c1ffcb1139ea19d6f20983f1f9dc Author: Sylwester Dziedziuch Date: Thu Sep 1 16:32:06 2022 +0200 iavf: Fix change VF's mac address Previously changing mac address gives false negative because ip link set address return with RTNLINK: Permission denied. In iavf_set_mac was check if PF handled our mac set request, even before filter was added to list. Because this check returns always true and it never waits for PF's response. Move iavf_is_mac_handled to wait_event_interruptible_timeout instead of false. Now it will wait for PF's response and then check if address was added or rejected. Fixes: 35a2443d0910 ("iavf: Add waiting for response from PF in set mac") Signed-off-by: Sylwester Dziedziuch Co-developed-by: Norbert Zulinski Signed-off-by: Norbert Zulinski Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit a509702cac95a8b450228a037c8542f57e538e5b Author: Ding Hui Date: Wed Aug 17 18:53:18 2022 +0800 ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 ("ice: ethtool: Prohibit improper channel config for DCB") already disallow setting less queues than TCs. Another case is if we first set less queues, and later update more TCs config due to LLDP, ice_vsi_cfg_tc() will failed but left dirty num_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access. [ 95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated. [ 95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)! [ 95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0 [ 95.969621] general protection fault: 0000 [#1] SMP NOPTI [ 95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G U W O --------- -t - 4.18.0 #1 [ 95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021 [ 95.969992] RIP: 0010:devm_kmalloc+0xa/0x60 [ 95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 <8b> 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c [ 95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 [ 95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0 [ 95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200 [ 95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000 [ 95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100 [ 95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 [ 95.970981] FS: 00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000 [ 95.971108] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0 [ 95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 95.971530] PKRU: 55555554 [ 95.971573] Call Trace: [ 95.971622] ice_setup_rx_ring+0x39/0x110 [ice] [ 95.971695] ice_vsi_setup_rx_rings+0x54/0x90 [ice] [ 95.971774] ice_vsi_open+0x25/0x120 [ice] [ 95.971843] ice_open_internal+0xb8/0x1f0 [ice] [ 95.971919] ice_ena_vsi+0x4f/0xd0 [ice] [ 95.971987] ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice] [ 95.972082] ice_pf_dcb_cfg+0x29a/0x380 [ice] [ 95.972154] ice_dcbnl_setets+0x174/0x1b0 [ice] [ 95.972220] dcbnl_ieee_set+0x89/0x230 [ 95.972279] ? dcbnl_ieee_del+0x150/0x150 [ 95.972341] dcb_doit+0x124/0x1b0 [ 95.972392] rtnetlink_rcv_msg+0x243/0x2f0 [ 95.972457] ? dcb_doit+0x14d/0x1b0 [ 95.972510] ? __kmalloc_node_track_caller+0x1d3/0x280 [ 95.972591] ? rtnl_calcit.isra.31+0x100/0x100 [ 95.972661] netlink_rcv_skb+0xcf/0xf0 [ 95.972720] netlink_unicast+0x16d/0x220 [ 95.972781] netlink_sendmsg+0x2ba/0x3a0 [ 95.975891] sock_sendmsg+0x4c/0x50 [ 95.979032] ___sys_sendmsg+0x2e4/0x300 [ 95.982147] ? kmem_cache_alloc+0x13e/0x190 [ 95.985242] ? __wake_up_common_lock+0x79/0x90 [ 95.988338] ? __check_object_size+0xac/0x1b0 [ 95.991440] ? _copy_to_user+0x22/0x30 [ 95.994539] ? move_addr_to_user+0xbb/0xd0 [ 95.997619] ? __sys_sendmsg+0x53/0x80 [ 96.000664] __sys_sendmsg+0x53/0x80 [ 96.003747] do_syscall_64+0x5b/0x1d0 [ 96.006862] entry_SYSCALL_64_after_hwframe+0x65/0xca Only update num_txq/rxq when passed check, and restore tc_cfg if setup queue map failed. Fixes: a632b2a4c920 ("ice: ethtool: Prohibit improper channel config for DCB") Signed-off-by: Ding Hui Reviewed-by: Anatolii Gerasymenko Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit faf59ec8c3c3708c64ff76b50e6f757c6b4a1054 Author: Adrian Hunter Date: Wed Sep 7 19:24:58 2022 +0300 perf record: Fix synthesis failure warnings Some calls to synthesis functions set err < 0 but only warn about the failure and continue. However they do not set err back to zero, relying on subsequent code to do that. That changed with the introduction of option --synth. When --synth=no subsequent functions that set err back to zero are not called. Fix by setting err = 0 in those cases. Example: Before: $ perf record --no-bpf-event --synth=all -o /tmp/huh uname Couldn't synthesize bpf events. Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ] $ perf record --no-bpf-event --synth=no -o /tmp/huh uname Couldn't synthesize bpf events. After: $ perf record --no-bpf-event --synth=no -o /tmp/huh uname Couldn't synthesize bpf events. Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ] Fixes: 41b740b6e8a994e5 ("perf record: Add --synth option") Signed-off-by: Adrian Hunter Acked-by: Namhyung Kim Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220907162458.72817-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e43212e0f55dc2d6b15d6c174cc0a64b25fab5e7 Author: Eliav Farber Date: Thu Sep 8 15:24:34 2022 +0000 hwmon: (mr75203) enable polling for all VM channels Configure ip-polling register to enable polling for all voltage monitor channels. This enables reading the voltage values for all inputs other than just input 0. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR75203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-7-farbere@amazon.com Signed-off-by: Guenter Roeck commit 91a9e063cdcfca8fe642b078d6fae4ce49187975 Author: Eliav Farber Date: Thu Sep 8 15:24:33 2022 +0000 hwmon: (mr75203) fix multi-channel voltage reading Fix voltage allocation and reading to support all channels in all VMs. Prior to this change allocation and reading were done only for the first channel in each VM. This change counts the total number of channels for allocation, and takes into account the channel offset when reading the sample data register. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR75203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-6-farbere@amazon.com Signed-off-by: Guenter Roeck commit 0a9eaf616f29ca32068d2d8fe04eeef67505720d Author: Jiri Slaby Date: Thu Sep 8 08:04:26 2022 +0200 perf tools: Don't install data files with x permissions install(1), by default, installs with rwxr-xr-x permissions. Modify perf's Makefile to pass '-m 644' when installing: * Documentation/tips.txt * examples/bpf/* * perf-completion.sh * perf_dlfilter.h header * scripts/perl/Perf-Trace-Util/lib/Perf/Trace/* * scripts/perl/*.pl * tests/attr/* * tests/attr.py * tests/shell/lib/*.sh * trace/strace/groups/* All those are supposed to be non-executable. Either they are not scripts at all, or they don't have shebang. Signed-off-by: Cc: Adrian Hunter Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220908060426.9619-1-jslaby@suse.cz Signed-off-by: Arnaldo Carvalho de Melo commit 227a3a2fc31d8e4bb9c88d4804e19530af245b1b Author: Eliav Farber Date: Thu Sep 8 15:24:32 2022 +0000 hwmon: (mr75203) fix voltage equation for negative source input According to Moortec Embedded Voltage Monitor (MEVM) series 3 data sheet, the minimum input signal is -100mv and maximum input signal is +1000mv. The equation used to convert the digital word to voltage uses mixed types (*val signed and n unsigned), and on 64 bit machines also has different size, since sizeof(u32) = 4 and sizeof(long) = 8. So when measuring a negative input, n will be small enough, such that PVT_N_CONST * n < PVT_R_CONST, and the result of (PVT_N_CONST * n - PVT_R_CONST) will overflow to a very big positive 32 bit number. Then when storing the result in *val it will be the same value just in 64 bit (instead of it representing a negative number which will what happen when sizeof(long) = 4). When -1023 <= (PVT_N_CONST * n - PVT_R_CONST) <= -1 dividing the number by 1024 should result of in 0, but because ">> 10" is used, and the sign bit is used to fill the vacated bit positions, it results in -1 (0xf...fffff) which is wrong. This change fixes the sign problem and supports negative values by casting n to long and replacing the shift right with div operation. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR75203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-5-farbere@amazon.com Signed-off-by: Guenter Roeck commit bb9195bd6664d94d71647631593e09f705ff5edd Author: Eliav Farber Date: Thu Sep 8 15:24:31 2022 +0000 hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors This issue is relevant when "intel,vm-map" is set in device-tree, and defines a lower number of VMs than actually supported. This change is needed for all places that use pvt->v_num or vm_num later on in the code. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR75203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-4-farbere@amazon.com Signed-off-by: Guenter Roeck commit 81114fc3d27bf5b06b2137d2fd2b63da656a8b90 Author: Eliav Farber Date: Thu Sep 8 15:24:30 2022 +0000 hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined Bug - in case "intel,vm-map" is missing in device-tree ,'num' is set to 0, and no voltage channel infos are allocated. The reason num is set to 0 when "intel,vm-map" is missing is to set the entire pvt->vm_idx[] with incremental channel numbers, but it didn't take into consideration that same num is used later in devm_kcalloc(). If "intel,vm-map" does exist there is no need to set the unspecified channels with incremental numbers, because the unspecified channels can't be accessed in pvt_read_in() which is the only other place besides the probe functions that uses pvt->vm_idx[]. This change fixes the bug by moving the incremental channel numbers setting to be done only if "intel,vm-map" property is defined (starting loop from 0), and removing 'num = 0'. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR75203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-3-farbere@amazon.com Signed-off-by: Guenter Roeck commit d0b34d5bf7ffc4b906f1da901376c3caf0f0d7c0 Author: Eliav Farber Date: Thu Sep 8 15:24:29 2022 +0000 dt-bindings: hwmon: (mr75203) fix "intel,vm-map" property to be optional Change "intel,vm-map" property to be optional instead of required. The driver implementation indicates it is not mandatory to have "intel,vm-map" in the device tree: - probe doesn't fail in case it is absent. - explicit comment in code - "Incase intel,vm-map property is not defined, we assume incremental channel numbers". Fixes: 748022ef093f ("hwmon: Add DT bindings schema for PVT controller") Signed-off-by: Eliav Farber Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220908152449.35457-2-farbere@amazon.com Signed-off-by: Guenter Roeck commit 82b2425fad2dd47204b3da589b679220f8aacc0e Author: Zhengjun Xing Date: Thu Sep 8 15:00:30 2022 +0800 perf script: Fix Cannot print 'iregs' field for hybrid systems Commit b91e5492f9d7ca89 ("perf record: Add a dummy event on hybrid systems to collect metadata records") adds a dummy event on hybrid systems to fix the symbol "unknown" issue when the workload is created in a P-core but runs on an E-core. The added dummy event will cause "perf script -F iregs" to fail. Dummy events do not have "iregs" attribute set, so when we do evsel__check_attr, the "iregs" attribute check will fail, so the issue happened. The following commit [1] has fixed a similar issue by skipping the attr check for the dummy event because it does not have any samples anyway. It works okay for the normal mode, but the issue still happened when running the test in the pipe mode. In the pipe mode, it calls process_attr() which still checks the attr for the dummy event. This commit fixed the issue by skipping the attr check for the dummy event in the API evsel__check_attr, Otherwise, we have to patch everywhere when evsel__check_attr() is called. Before: #./perf record -o - --intr-regs=di,r8,dx,cx -e br_inst_retired.near_call:p -c 1000 --per-thread true 2>/dev/null|./perf script -F iregs |head -5 Samples for 'dummy:HG' event do not have IREGS attribute set. Cannot print 'iregs' field. 0x120 [0x90]: failed to process type: 64 # After: # ./perf record -o - --intr-regs=di,r8,dx,cx -e br_inst_retired.near_call:p -c 1000 --per-thread true 2>/dev/null|./perf script -F iregs |head -5 ABI:2 CX:0x55b8efa87000 DX:0x55b8efa7e000 DI:0xffffba5e625efbb0 R8:0xffff90e51f8ae100 ABI:2 CX:0x7f1dae1e4000 DX:0xd0 DI:0xffff90e18c675ac0 R8:0x71 ABI:2 CX:0xcc0 DX:0x1 DI:0xffff90e199880240 R8:0x0 ABI:2 CX:0xffff90e180dd7500 DX:0xffff90e180dd7500 DI:0xffff90e180043500 R8:0x1 ABI:2 CX:0x50 DX:0xffff90e18c583bd0 DI:0xffff90e1998803c0 R8:0x58 # [1]https://lore.kernel.org/lkml/20220831124041.219925-1-jolsa@kernel.org/ Fixes: b91e5492f9d7ca89 ("perf record: Add a dummy event on hybrid systems to collect metadata records") Suggested-by: Namhyung Kim Signed-off-by: Xing Zhengjun Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220908070030.3455164-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 3705a6ef4068cbc9c2344561345d09630fd278ec Author: Yang Jihong Date: Thu Sep 8 09:48:54 2022 +0800 perf lock: Remove redundant word 'contention' in help message Before: # perf lock -h Usage: perf lock [] {record|report|script|info|contention|contention} -D, --dump-raw-trace dump raw trace in ASCII -f, --force don't complain, do it -i, --input input file name -v, --verbose be more verbose (show symbol address, etc) --kallsyms kallsyms pathname --vmlinux vmlinux pathname After: # perf lock -h Usage: perf lock [] {record|report|script|info|contention} -D, --dump-raw-trace dump raw trace in ASCII -f, --force don't complain, do it -i, --input input file name -v, --verbose be more verbose (show symbol address, etc) --kallsyms kallsyms pathname --vmlinux vmlinux pathname Fixes: 528b9cab3b813a3b ("perf lock: Add 'contention' subcommand") Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220908014854.151203-1-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 23c619190318376769ad7b61504c2ea0703fb783 Author: Dave Ertman Date: Tue Aug 9 10:24:23 2022 -0700 ice: Don't double unplug aux on peer initiated reset In the IDC callback that is accessed when the aux drivers request a reset, the function to unplug the aux devices is called. This function is also called in the ice_prepare_for_reset function. This double call is causing a "scheduling while atomic" BUG. [ 662.676430] ice 0000:4c:00.0 rocep76s0: cqp opcode = 0x1 maj_err_code = 0xffff min_err_code = 0x8003 [ 662.676609] ice 0000:4c:00.0 rocep76s0: [Modify QP Cmd Error][op_code=8] status=-29 waiting=1 completion_err=1 maj=0xffff min=0x8003 [ 662.815006] ice 0000:4c:00.0 rocep76s0: ICE OICR event notification: oicr = 0x10000003 [ 662.815014] ice 0000:4c:00.0 rocep76s0: critical PE Error, GLPE_CRITERR=0x00011424 [ 662.815017] ice 0000:4c:00.0 rocep76s0: Requesting a reset [ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 [ 662.815475] BUG: scheduling while atomic: swapper/37/0/0x00010002 [ 662.815477] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill 8021q garp mrp stp llc vfat fat rpcrdma intel_rapl_msr intel_rapl_common sunrpc i10nm_edac rdma_ucm nfit ib_srpt libnvdimm ib_isert iscsi_target_mod x86_pkg_temp_thermal intel_powerclamp coretemp target_core_mod snd_hda_intel ib_iser snd_intel_dspcfg libiscsi snd_intel_sdw_acpi scsi_transport_iscsi kvm_intel iTCO_wdt rdma_cm snd_hda_codec kvm iw_cm ipmi_ssif iTCO_vendor_support snd_hda_core irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hwdep snd_seq snd_seq_device rapl snd_pcm snd_timer isst_if_mbox_pci pcspkr isst_if_mmio irdma intel_uncore idxd acpi_ipmi joydev isst_if_common snd mei_me idxd_bus ipmi_si soundcore i2c_i801 mei ipmi_devintf i2c_smbus i2c_ismt ipmi_msghandler acpi_power_meter acpi_pad rv(OE) ib_uverbs ib_cm ib_core xfs libcrc32c ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helpe r ttm [ 662.815546] nvme nvme_core ice drm crc32c_intel i40e t10_pi wmi pinctrl_emmitsburg dm_mirror dm_region_hash dm_log dm_mod fuse [ 662.815557] Preemption disabled at: [ 662.815558] [<0000000000000000>] 0x0 [ 662.815563] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S OE 5.17.1 #2 [ 662.815566] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021 [ 662.815568] Call Trace: [ 662.815572] [ 662.815574] dump_stack_lvl+0x33/0x42 [ 662.815581] __schedule_bug.cold.147+0x7d/0x8a [ 662.815588] __schedule+0x798/0x990 [ 662.815595] schedule+0x44/0xc0 [ 662.815597] schedule_preempt_disabled+0x14/0x20 [ 662.815600] __mutex_lock.isra.11+0x46c/0x490 [ 662.815603] ? __ibdev_printk+0x76/0xc0 [ib_core] [ 662.815633] device_del+0x37/0x3d0 [ 662.815639] ice_unplug_aux_dev+0x1a/0x40 [ice] [ 662.815674] ice_schedule_reset+0x3c/0xd0 [ice] [ 662.815693] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] [ 662.815712] ? bitmap_find_next_zero_area_off+0x45/0xa0 [ 662.815719] ice_send_event_to_aux+0x54/0x70 [ice] [ 662.815741] ice_misc_intr+0x21d/0x2d0 [ice] [ 662.815756] __handle_irq_event_percpu+0x4c/0x180 [ 662.815762] handle_irq_event_percpu+0xf/0x40 [ 662.815764] handle_irq_event+0x34/0x60 [ 662.815766] handle_edge_irq+0x9a/0x1c0 [ 662.815770] __common_interrupt+0x62/0x100 [ 662.815774] common_interrupt+0xb4/0xd0 [ 662.815779] [ 662.815780] [ 662.815780] asm_common_interrupt+0x1e/0x40 [ 662.815785] RIP: 0010:cpuidle_enter_state+0xd6/0x380 [ 662.815789] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 [ 662.815791] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202 [ 662.815793] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f [ 662.815795] RDX: 0000009a52da2d08 RSI: ffffffff93f8240b RDI: ffffffff93f53ee7 [ 662.815796] RBP: ff5e2bd11ff41928 R08: 0000000000000000 R09: 000000000002f8c0 [ 662.815797] R10: 0000010c3f18e2cf R11: 000000000000000f R12: 0000009a52da2d08 [ 662.815798] R13: ffffffff94ad7e20 R14: 0000000000000002 R15: 0000000000000000 [ 662.815801] cpuidle_enter+0x29/0x40 [ 662.815803] do_idle+0x261/0x2b0 [ 662.815807] cpu_startup_entry+0x19/0x20 [ 662.815809] start_secondary+0x114/0x150 [ 662.815813] secondary_startup_64_no_verify+0xd5/0xdb [ 662.815818] [ 662.815846] bad: scheduling from the idle thread! [ 662.815849] CPU: 37 PID: 0 Comm: swapper/37 Kdump: loaded Tainted: G S W OE 5.17.1 #2 [ 662.815852] Hardware name: Intel Corporation D50DNP/D50DNP, BIOS SE5C6301.86B.6624.D18.2111021741 11/02/2021 [ 662.815853] Call Trace: [ 662.815855] [ 662.815856] dump_stack_lvl+0x33/0x42 [ 662.815860] dequeue_task_idle+0x20/0x30 [ 662.815863] __schedule+0x1c3/0x990 [ 662.815868] schedule+0x44/0xc0 [ 662.815871] schedule_preempt_disabled+0x14/0x20 [ 662.815873] __mutex_lock.isra.11+0x3a8/0x490 [ 662.815876] ? __ibdev_printk+0x76/0xc0 [ib_core] [ 662.815904] device_del+0x37/0x3d0 [ 662.815909] ice_unplug_aux_dev+0x1a/0x40 [ice] [ 662.815937] ice_schedule_reset+0x3c/0xd0 [ice] [ 662.815961] irdma_iidc_event_handler.cold.7+0xb6/0xd3 [irdma] [ 662.815979] ? bitmap_find_next_zero_area_off+0x45/0xa0 [ 662.815985] ice_send_event_to_aux+0x54/0x70 [ice] [ 662.816011] ice_misc_intr+0x21d/0x2d0 [ice] [ 662.816033] __handle_irq_event_percpu+0x4c/0x180 [ 662.816037] handle_irq_event_percpu+0xf/0x40 [ 662.816039] handle_irq_event+0x34/0x60 [ 662.816042] handle_edge_irq+0x9a/0x1c0 [ 662.816045] __common_interrupt+0x62/0x100 [ 662.816048] common_interrupt+0xb4/0xd0 [ 662.816052] [ 662.816053] [ 662.816054] asm_common_interrupt+0x1e/0x40 [ 662.816057] RIP: 0010:cpuidle_enter_state+0xd6/0x380 [ 662.816060] Code: 49 89 c4 0f 1f 44 00 00 31 ff e8 65 d7 95 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 64 02 00 00 31 ff e8 ae c5 9c ff fb 45 85 f6 <0f> 88 12 01 00 00 49 63 d6 4c 2b 24 24 48 8d 04 52 48 8d 04 82 49 [ 662.816063] RSP: 0018:ff2c2c4f18edbe80 EFLAGS: 00000202 [ 662.816065] RAX: ff280805df140000 RBX: 0000000000000002 RCX: 000000000000001f [ 662.816067] RDX: 0000009a52da2d08 RSI: ffffffff93f8240b RDI: ffffffff93f53ee7 [ 662.816068] RBP: ff5e2bd11ff41928 R08: 0000000000000000 R09: 000000000002f8c0 [ 662.816070] R10: 0000010c3f18e2cf R11: 000000000000000f R12: 0000009a52da2d08 [ 662.816071] R13: ffffffff94ad7e20 R14: 0000000000000002 R15: 0000000000000000 [ 662.816075] cpuidle_enter+0x29/0x40 [ 662.816077] do_idle+0x261/0x2b0 [ 662.816080] cpu_startup_entry+0x19/0x20 [ 662.816083] start_secondary+0x114/0x150 [ 662.816087] secondary_startup_64_no_verify+0xd5/0xdb [ 662.816091] [ 662.816169] bad: scheduling from the idle thread! The correct place to unplug the aux devices for a reset is in the prepare_for_reset function, as this is a common place for all reset flows. It also has built in protection from being called twice in a single reset instance before the aux devices are replugged. Fixes: f9f5301e7e2d4 ("ice: Register auxiliary device to provide RDMA") Signed-off-by: Dave Ertman Tested-by: Helena Anna Dubel Signed-off-by: Tony Nguyen commit 506357871c18e06565840d71c2ef9f818e19f460 Merge: c5e68c4fa55c0 9c9c9da7aa108 Author: Linus Torvalds Date: Thu Sep 8 13:13:47 2022 -0400 Merge tag 'spi-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Several fixes that came in since the merge window, the major one being a fix for the spi-mux driver which was broken by the performance optimisations due to it peering inside the core's data structures more than it should" * tag 'spi-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi: Fix queue hang if previous transfer failed spi: mux: Fix mux interaction with fast path optimisations spi: cadence-quadspi: Disable irqs during indirect reads spi: bitbang: Fix lsb-first Rx commit c5e68c4fa55c0d65e28b4b566b50aee6c4185dab Merge: b1d27aa3b16a4 475043fabe8c5 Author: Linus Torvalds Date: Thu Sep 8 12:56:20 2022 -0400 Merge tag 'regulator-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One core fix here improving the error handling on enable failure, plus smaller fixes for the pfuze100 drive and the SPMI DT bindings" * tag 'regulator-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Fix qcom,spmi-regulator schema regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() regulator: core: Clean up on enable failure commit b1d27aa3b16a4689d5598abc545a88e5cda93f1d Merge: 26b1224903b3f f5723cfc01932 Author: Linus Torvalds Date: Thu Sep 8 12:51:58 2022 -0400 Merge tag 'regmap-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "A fix for how we handle controller constraints on SPI message sizes, only impacting systems with SPI controllers with very low limits like the AMD controller used in the Steam Deck" * tag 'regmap-fix-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: spi: Reserve space for register address/padding commit 75c523ac0c07a3f0a8eb5c6eb156cd7b3e50924f Merge: 748008e1da926 371a982cd2b01 Author: Jens Axboe Date: Thu Sep 8 10:20:18 2022 -0600 Merge tag 'nvme-6.0-2022-09-08' of git://git.infradead.org/nvme into block-6.0 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.1 - fix a use after free in nvmet (Bart Van Assche) - fix a use after free when detecting digest errors (Sagi Grimberg) - fix regression that causes sporadic TCP requests to time out (Sagi Grimberg) - fix two off by ones errors in the nvmet ZNS support (Dennis Maisenbacher) - requeue aen after firmware activation (Keith Busch)" * tag 'nvme-6.0-2022-09-08' of git://git.infradead.org/nvme: nvme: requeue aen after firmware activation nvmet: fix mar and mor off-by-one errors nvme-tcp: fix regression that causes sporadic requests to time out nvme-tcp: fix UAF when detecting digest errors nvmet: fix a use-after-free commit 8f7115c1923cd11146525f1615beb29018001964 Author: Chen-Yu Tsai Date: Thu Sep 8 16:54:53 2022 +0800 drm/panel-edp: Fix delays for Innolux N116BCA-EA1 Commit 52824ca4502d ("drm/panel-edp: Better describe eDP panel delays") clarified the various delays used for eDP panels, tying them to the eDP panel timing diagram. For Innolux N116BCA-EA1, .prepare_to_enable would be: t4_min + t5_min + t6_min + max(t7_max, t8_min) Since t4_min and t5_min are both 0, the panel can use either .enable or .prepare_to_enable. As .enable is better defined, switch to using .enable for this panel. Also add .disable = 50, based on the datasheet's t9_min value. This effectively makes the delays the same as delay_200_500_e80_d50. Cc: Douglas Anderson Fixes: 51d35631c970 ("drm/panel-simple: Add N116BCA-EA1") Signed-off-by: Chen-Yu Tsai Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20220908085454.1024167-1-wenst@chromium.org commit 1706623e940347ad23fdf77910eca4905dc37f91 Author: Adrian Hunter Date: Mon Sep 5 10:47:35 2022 +0300 perf dlfilter dlfilter-show-cycles: Fix types for print format Avoid compiler warning about format %llu that expects long long unsigned int but argument has type __u64. Reported-by: Arnaldo Carvalho de Melo Fixes: c3afd6e50fce824f ("perf dlfilter: Add dlfilter-show-cycles") Signed-off-by: Adrian Hunter Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220905074735.4513-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7864d8f7c088aad988c44c631f1ceed9179cf2cf Author: Adrian Hunter Date: Mon Sep 5 14:42:09 2022 +0300 libperf evlist: Fix per-thread mmaps for multi-threaded targets The offending commit removed mmap_per_thread(), which did not consider the different set-output rules for per-thread mmaps i.e. in the per-thread case set-output is used for file descriptors of the same thread not the same cpu. This was not immediately noticed because it only happens with multi-threaded targets and we do not have a test for that yet. Reinstate mmap_per_thread() expanding it to cover also system-wide per-cpu events i.e. to continue to allow the mixing of per-thread and per-cpu mmaps. Debug messages (with -vv) show the file descriptors that are opened with sys_perf_event_open. New debug messages are added (needs -vvv) that show also which file descriptors are mmapped and which are redirected with set-output. In the per-cpu case (cpu != -1) file descriptors for the same CPU are set-output to the first file descriptor for that CPU. In the per-thread case (cpu == -1) file descriptors for the same thread are set-output to the first file descriptor for that thread. Example (process 17489 has 2 threads): Before (but with new debug prints): $ perf record --no-bpf-event -vvv --per-thread -p 17489 sys_perf_event_open: pid 17489 cpu -1 group_fd -1 flags 0x8 = 5 sys_perf_event_open: pid 17490 cpu -1 group_fd -1 flags 0x8 = 6 libperf: idx 0: mmapping fd 5 libperf: idx 0: set output fd 6 -> 5 failed to mmap with 22 (Invalid argument) After: $ perf record --no-bpf-event -vvv --per-thread -p 17489 sys_perf_event_open: pid 17489 cpu -1 group_fd -1 flags 0x8 = 5 sys_perf_event_open: pid 17490 cpu -1 group_fd -1 flags 0x8 = 6 libperf: mmap_per_thread: nr cpu values (may include -1) 1 nr threads 2 libperf: idx 0: mmapping fd 5 libperf: idx 1: mmapping fd 6 [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.018 MB perf.data (15 samples) ] Per-cpu example (process 20341 has 2 threads, same as above): $ perf record --no-bpf-event -vvv -p 20341 sys_perf_event_open: pid 20341 cpu 0 group_fd -1 flags 0x8 = 5 sys_perf_event_open: pid 20342 cpu 0 group_fd -1 flags 0x8 = 6 sys_perf_event_open: pid 20341 cpu 1 group_fd -1 flags 0x8 = 7 sys_perf_event_open: pid 20342 cpu 1 group_fd -1 flags 0x8 = 8 sys_perf_event_open: pid 20341 cpu 2 group_fd -1 flags 0x8 = 9 sys_perf_event_open: pid 20342 cpu 2 group_fd -1 flags 0x8 = 10 sys_perf_event_open: pid 20341 cpu 3 group_fd -1 flags 0x8 = 11 sys_perf_event_open: pid 20342 cpu 3 group_fd -1 flags 0x8 = 12 sys_perf_event_open: pid 20341 cpu 4 group_fd -1 flags 0x8 = 13 sys_perf_event_open: pid 20342 cpu 4 group_fd -1 flags 0x8 = 14 sys_perf_event_open: pid 20341 cpu 5 group_fd -1 flags 0x8 = 15 sys_perf_event_open: pid 20342 cpu 5 group_fd -1 flags 0x8 = 16 sys_perf_event_open: pid 20341 cpu 6 group_fd -1 flags 0x8 = 17 sys_perf_event_open: pid 20342 cpu 6 group_fd -1 flags 0x8 = 18 sys_perf_event_open: pid 20341 cpu 7 group_fd -1 flags 0x8 = 19 sys_perf_event_open: pid 20342 cpu 7 group_fd -1 flags 0x8 = 20 libperf: mmap_per_cpu: nr cpu values 8 nr threads 2 libperf: idx 0: mmapping fd 5 libperf: idx 0: set output fd 6 -> 5 libperf: idx 1: mmapping fd 7 libperf: idx 1: set output fd 8 -> 7 libperf: idx 2: mmapping fd 9 libperf: idx 2: set output fd 10 -> 9 libperf: idx 3: mmapping fd 11 libperf: idx 3: set output fd 12 -> 11 libperf: idx 4: mmapping fd 13 libperf: idx 4: set output fd 14 -> 13 libperf: idx 5: mmapping fd 15 libperf: idx 5: set output fd 16 -> 15 libperf: idx 6: mmapping fd 17 libperf: idx 6: set output fd 18 -> 17 libperf: idx 7: mmapping fd 19 libperf: idx 7: set output fd 20 -> 19 [ perf record: Woken up 7 times to write data ] [ perf record: Captured and wrote 0.020 MB perf.data (17 samples) ] Fixes: ae4f8ae16a078964 ("libperf evlist: Allow mixing per-thread and per-cpu mmaps") Reported-by: Tomáš Trnka Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216441 Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220905114209.8389-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 13bd9014180425f5a35eaf3735971d582c299292 Author: Dan Aloni Date: Thu Sep 8 17:08:51 2022 +0300 Revert "SUNRPC: Remove unreachable error condition" This reverts commit efe57fd58e1cb77f9186152ee12a8aa4ae3348e0. The assumption that it is impossible to return an ERR pointer from rpc_run_task() no longer holds due to commit 25cf32ad5dba ("SUNRPC: Handle allocation failure in rpc_new_task()"). Fixes: 25cf32ad5dba ('SUNRPC: Handle allocation failure in rpc_new_task()') Fixes: efe57fd58e1c ('SUNRPC: Remove unreachable error condition') Signed-off-by: Dan Aloni Signed-off-by: Trond Myklebust commit d7a5118635e725d195843bda80cc5c964d93ef31 Author: Anna Schumaker Date: Wed Sep 7 16:34:21 2022 -0400 NFSv4.2: Update mode bits after ALLOCATE and DEALLOCATE The fallocate call invalidates suid and sgid bits as part of normal operation. We need to mark the mode bits as invalid when using fallocate with an suid so these will be updated the next time the user looks at them. This fixes xfstests generic/683 and generic/684. Reported-by: Yue Cui Fixes: 913eca1aea87 ("NFS: Fallocate should use the nfs4_fattr_bitmap") Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 3c8400532dd8305024ff6eea38707de20b1b9822 Author: Pavel Begunkov Date: Thu Sep 8 14:01:10 2022 +0100 io_uring/net: copy addr for zc on POLL_FIRST Every time we return from an issue handler and expect the request to be retried we should also setup it for async exec ourselves. Do that when we return on IORING_RECVSEND_POLL_FIRST in io_sendzc(), otherwise it'll re-read the address, which might be a surprise for the userspace. Fixes: 092aeedb750a9 ("io_uring: allow to pass addr into sendzc") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/ab1d0657890d6721339c56d2e161a4bba06f85d0.1662642013.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 02181e68275d28cab3c3f755852770367f1bc229 Author: Sergei Antonov Date: Wed Sep 7 20:53:41 2022 +0300 ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc". But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt contain compatible = "moxa,moxart-sdhci". Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver. Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different controller from FTSDC010. Suggested-by: Arnd Bergmann Signed-off-by: Sergei Antonov Cc: Jonas Jensen Link: https://lore.kernel.org/r/20220907175341.1477383-1-saproj@gmail.com' Signed-off-by: Arnd Bergmann commit d4f1920d07e8eb0f217f8f65c0bc5b20bb8e3b8c Merge: 12f09234bde51 40d30cf680cb7 Author: Arnd Bergmann Date: Thu Sep 8 16:12:25 2022 +0200 Merge tag 'scmi-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v6.0 Few fixes addressing possible out of bound access violations by hardening them, incorrect asynchronous resets by restricting them, incorrect SCMI tracing message format by harmonizing them, missing kernel-doc in optee transport, missing SCMI PM driver remove routine by adding it to avoid warning when scmi driver is unloaded and finally improve checks in the info_get operations. * tag 'scmi-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Harmonize SCMI tracing message format firmware: arm_scmi: Add SCMI PM driver remove routine firmware: arm_scmi: Fix the asynchronous reset requests firmware: arm_scmi: Harden accesses to the reset domains firmware: arm_scmi: Harden accesses to the sensor domains firmware: arm_scmi: Improve checks in the info_get operations firmware: arm_scmi: Fix missing kernel-doc in optee Link: https://lore.kernel.org/r/20220829174435.207911-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit d105d6920ec758125b69c0b097bf498348888a9d Author: Mark Brown Date: Fri Sep 2 14:28:02 2022 +0100 arm64/ptrace: Don't clear calling process' TIF_SME on OOM If allocating memory for the target SVE state in za_set() fails we clear TIF_SME for the ptracing task which is obviously not correct. If we are here we know that the target task already had neither TIF_SVE nor TIF_SME set since we only need to allocate if either the target had not used either SVE or SME and had no need to allocate state before or we just changed the vector length with vec_set_vector_length() which clears TIF_ for us on allocation failure so just remove the clear entirely. Reported-by: Wang ShaoBo Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220902132802.39682-1-broonie@kernel.org Signed-off-by: Will Deacon commit 09e3e3159cd4d3c9f3a1f025cb8e635d93c67c9a Merge: 809f44a0cc5ad b1cd3fd42db75 Author: Takashi Iwai Date: Thu Sep 8 14:24:05 2022 +0200 Merge tag 'asoc-fix-v6.0-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.0 Quite a few fixes here, all driver specific and fairly small. commit 26b1224903b3fb66e8aa564868d0d57648c32b15 Merge: 2f79cdfe58c13 2f09707d0c972 Author: Linus Torvalds Date: Thu Sep 8 08:15:01 2022 -0400 Merge tag 'net-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from rxrpc, netfilter, wireless and bluetooth subtrees. Current release - regressions: - skb: export skb drop reaons to user by TRACE_DEFINE_ENUM - bluetooth: fix regression preventing ACL packet transmission Current release - new code bugs: - dsa: microchip: fix kernel oops on ksz8 switches - dsa: qca8k: fix NULL pointer dereference for of_device_get_match_data Previous releases - regressions: - netfilter: clean up hook list when offload flags check fails - wifi: mt76: fix crash in chip reset fail - rxrpc: fix ICMP/ICMP6 error handling - ice: fix DMA mappings leak - i40e: fix kernel crash during module removal Previous releases - always broken: - ipv6: sr: fix out-of-bounds read when setting HMAC data. - tcp: TX zerocopy should not sense pfmemalloc status - sch_sfb: don't assume the skb is still around after enqueueing to child - netfilter: drop dst references before setting - wifi: wilc1000: fix DMA on stack objects - rxrpc: fix an insufficiently large sglist in rxkad_verify_packet_2() - fec: use a spinlock to guard `fep->ptp_clk_on` Misc: - usb: qmi_wwan: add Quectel RM520N" * tag 'net-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits) sch_sfb: Also store skb len before calling child enqueue net: phy: lan87xx: change interrupt src of link_up to comm_ready net/smc: Fix possible access to freed memory in link clear net: ethernet: mtk_eth_soc: check max allowed hash in mtk_ppe_check_skb net: skb: export skb drop reaons to user by TRACE_DEFINE_ENUM net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in vsc9959_sched_speed_set net: dsa: felix: disable cut-through forwarding for frames oversized for tc-taprio net: dsa: felix: tc-taprio intervals smaller than MTU should send at least one packet net: usb: qmi_wwan: add Quectel RM520N net: dsa: qca8k: fix NULL pointer dereference for of_device_get_match_data tcp: fix early ETIMEDOUT after spurious non-SACK RTO stmmac: intel: Simplify intel_eth_pci_remove() net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() ipv6: sr: fix out-of-bounds read when setting HMAC data. bonding: accept unsolicited NA message bonding: add all node mcast address when slave up bonding: use unspecified address if no available link local address wifi: use struct_group to copy addresses wifi: mac80211_hwsim: check length for virtio packets ... commit 2f79cdfe58c13949bbbb65ba5926abfe9561d0ec Author: Linus Torvalds Date: Wed Aug 31 09:46:12 2022 -0700 fs: only do a memory barrier for the first set_buffer_uptodate() Commit d4252071b97d ("add barriers to buffer_uptodate and set_buffer_uptodate") added proper memory barriers to the buffer head BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date will be guaranteed to actually see initialized state. However, that commit didn't _just_ add the memory barrier, it also ended up dropping the "was it already set" logic that the BUFFER_FNS() macro had. That's conceptually the right thing for a generic "this is a memory barrier" operation, but in the case of the buffer contents, we really only care about the memory barrier for the _first_ time we set the bit, in that the only memory ordering protection we need is to avoid anybody seeing uninitialized memory contents. Any other access ordering wouldn't be about the BH_Uptodate bit anyway, and would require some other proper lock (typically BH_Lock or the folio lock). A reader that races with somebody invalidating the buffer head isn't an issue wrt the memory ordering, it's a serialization issue. Now, you'd think that the buffer head operations don't matter in this day and age (and I certainly thought so), but apparently some loads still end up being heavy users of buffer heads. In particular, the kernel test robot reported that not having this bit access optimization in place caused a noticeable direct IO performance regression on ext4: fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression although you presumably need a fast disk and a lot of cores to actually notice. Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/ Reported-by: kernel test robot Tested-by: Fengwei Yin Cc: Mikulas Patocka Cc: Matthew Wilcox (Oracle) Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit f280b9872af1f58760b7731e973de57ffccfb0a4 Merge: 0066f1b0e2755 9cb636b5f6a8c Author: Linus Torvalds Date: Thu Sep 8 07:37:38 2022 -0400 Merge tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: "A couple of low-priority EFI fixes: - prevent the randstruct plugin from re-ordering EFI protocol definitions - fix a use-after-free in the capsule loader - drop unused variable" * tag 'efi-urgent-for-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: capsule-loader: Fix use-after-free in efi_capsule_write efi/x86: libstub: remove unused variable efi: libstub: Disable struct randomization commit d76034a427a2660b080bc155e4fd8f6393eefb48 Author: Clément Péron Date: Tue Sep 6 17:30:33 2022 +0200 drm/panfrost: devfreq: set opp to the recommended one to configure regulator Enabling panfrost GPU OPP with dynamic regulator will make OPP responsible to enable and configure it. Unfortunately OPP configure and enable the regulator when an OPP is asked to be set, which is not the case during panfrost_devfreq_init(). This leave the regulator unconfigured and if no GPU load is triggered, no OPP is asked to be set which make the regulator framework switching it off during regulator_late_cleanup() without noticing and therefore make the board hang as any access to GPU memory space make bus locks up. Call dev_pm_opp_set_opp() with the recommend OPP in panfrost_devfreq_init() to enable the regulator, this will properly configure and enable the regulator and will avoid any switch off by regulator_late_cleanup(). Suggested-by: Viresh Kumar Signed-off-by: Clément Péron Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20220906153034.153321-5-peron.clem@gmail.com commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 Author: Toke Høiland-Jørgensen Date: Mon Sep 5 21:21:36 2022 +0200 sch_sfb: Also store skb len before calling child enqueue Cong Wang noticed that the previous fix for sch_sfb accessing the queued skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue function was also calling qdisc_qstats_backlog_inc() after enqueue, which reads the pkt len from the skb cb field. Fix this by also storing the skb len, and using the stored value to increment the backlog after enqueueing. Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after enqueueing to child") Signed-off-by: Toke Høiland-Jørgensen Acked-by: Cong Wang Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk Signed-off-by: Paolo Abeni commit 5382033a35227c57a349d74752ad2527780159a9 Author: Arun Ramadoss Date: Mon Sep 5 20:57:50 2022 +0530 net: phy: lan87xx: change interrupt src of link_up to comm_ready Currently phy link up/down interrupt is enabled using the LAN87xx_INTERRUPT_MASK register. In the lan87xx_read_status function, phy link is determined using the T1_MODE_STAT_REG register comm_ready bit. comm_ready bit is set using the loc_rcvr_status & rem_rcvr_status. Whenever the phy link is up, LAN87xx_INTERRUPT_SOURCE link_up bit is set first but comm_ready bit takes some time to set based on local and remote receiver status. As per the current implementation, interrupt is triggered using link_up but the comm_ready bit is still cleared in the read_status function. So, link is always down. Initially tested with the shared interrupt mechanism with switch and internal phy which is working, but after implementing interrupt controller it is not working. It can fixed either by updating the read_status function to read from LAN87XX_INTERRUPT_SOURCE register or enable the interrupt mask for comm_ready bit. But the validation team recommends the use of comm_ready for link detection. This patch fixes by enabling the comm_ready bit for link_up in the LAN87XX_INTERRUPT_MASK_2 register (MISC Bank) and link_down in LAN87xx_INTERRUPT_MASK register. Fixes: 8a1b415d70b7 ("net: phy: added ethtool master-slave configuration support") Signed-off-by: Arun Ramadoss Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220905152750.5079-1-arun.ramadoss@microchip.com Signed-off-by: Paolo Abeni commit e3d3fd1cea22ada5a06284d7bbb6cd5794d8545a Author: Christian König Date: Wed Sep 7 11:56:22 2022 +0200 drm/ttm: cleanup the resource of ghost objects after locking them Otherwise lockdep will complain about cleaning up the bulk_move. Signed-off-by: Christian König Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220907100051.570641-1-christian.koenig@amd.com Fixes: d91c411c744b ("drm/ttm: update bulk move object of ghost BO") commit c0521598a58cfbba7bb0625d16124e32645c152f Merge: 7e18e42e4b280 aac4cec1ec45d Author: Dave Airlie Date: Thu Sep 8 16:09:41 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-09-07' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-09-07: amdgpu: - Firmware header fix - SMU 13.x fix - Debugfs memory leak fix - NBIO 7.7 fix - Firmware memory leak fix amdkfd: - Debug output fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220908032332.5880-1-alexander.deucher@amd.com commit aac4cec1ec45d72bd03eaf3fd772c5a609f5ed26 Author: Guchun Chen Date: Fri Sep 2 14:08:55 2022 +0800 drm/amdgpu: prevent toc firmware memory leak It's missed in psp fini. Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d832db12af4a057582011a590f60f32853680dd4 Author: Yifan Zhang Date: Tue Sep 6 13:09:20 2022 +0800 drm/amdgpu: correct doorbell range/size value for CSDMA_DOORBELL_RANGE current function mixes CSDMA_DOORBELL_RANGE and SDMA0_DOORBELL_RANGE range/size manipulation, while these 2 registers have difference size field mask. Remove range/size manipulation for SDMA0_DOORBELL_RANGE. Signed-off-by: Yifan Zhang Reviewed-by: Xiaojian Du Signed-off-by: Alex Deucher commit ae0448bc88b7827babda73edfe587ccc222baccc Author: Yifan Zhang Date: Sun Sep 4 15:53:27 2022 +0800 drm/amdkfd: print address in hex format rather than decimal Addresses should be printed in hex format. Signed-off-by: Yifan Zhang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit cbfac7fa491651c57926c99edeb7495c6c1aeac2 Author: Greg Kroah-Hartman Date: Fri Sep 2 15:01:05 2022 +0200 drm/amd/display: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput(). Cc: Harry Wentland Cc: Leo Li Cc: Rodrigo Siqueira Cc: Alex Deucher Cc: "Christian König" Cc: "Pan, Xinhui" Cc: David Airlie Cc: Daniel Vetter Cc: Wayne Lin Cc: hersen wu Cc: Wenjing Liu Cc: Patrik Jakobsson Cc: Thelford Williams Cc: Fangzhi Zuo Cc: Yongzhi Liu Cc: Mikita Lipski Cc: Jiapeng Chong Cc: Bhanuprakash Modem Cc: Sean Paul Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org Reviewed-by: Rodrigo Siqueira Signed-off-by: Greg Kroah-Hartman Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit bbcbd63231cbd1405ff8e987870b02abc6a4d669 Author: Evan Quan Date: Thu Sep 1 13:48:58 2022 +0800 drm/amd/pm: add missing SetMGpuFanBoostLimitRpm mapping for SMU 13.0.7 Missing SetMGpuFanBoostLimitRpm mapping leads to loading failure for SMU 13.0.7. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 992db92b07736ec98432a97b61c37dfe7bd06dd9 Author: Chengming Gui Date: Tue Sep 6 09:26:37 2022 +0800 drm/amd/amdgpu: add rlc_firmware_header_v2_4 to amdgpu_firmware_header Add missing structure to avoid incorrect size and version check. Signed-off-by: Chengming Gui Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit a66de5283e16602b74658289360505ceeb308c90 Author: Michael Ellerman Date: Wed Sep 7 09:37:17 2022 +1000 powerpc/pseries: Fix plpks crash on non-pseries As reported[1] by Nathan, the recently added plpks driver will crash if it's built into the kernel and booted on a non-pseries machine, eg powernv: kernel BUG at arch/powerpc/kernel/syscall.c:39! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV ... NIP system_call_exception+0x90/0x3d0 LR system_call_common+0xec/0x250 Call Trace: 0xc0000000035c3e10 (unreliable) system_call_common+0xec/0x250 --- interrupt: c00 at plpar_hcall+0x38/0x60 NIP: c0000000000e4300 LR: c00000000202945c CTR: 0000000000000000 REGS: c0000000035c3e80 TRAP: 0c00 Not tainted (6.0.0-rc4) MSR: 9000000002009033 CR: 28000284 XER: 00000000 ... NIP plpar_hcall+0x38/0x60 LR pseries_plpks_init+0x64/0x23c --- interrupt: c00 On powernv Linux is the hypervisor, so a hypercall just ends up going to the syscall path, which BUGs if the syscall (hypercall) didn't come from userspace. The fix is simply to not probe the plpks driver on non-pseries machines. [1] https://lore.kernel.org/linuxppc-dev/Yxe06fbq18Wv9y3W@dev-arch.thelio-3990X/ Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore") Reported-by: Nathan Chancellor Signed-off-by: Michael Ellerman Tested-by: Dan Horák Reviewed-by: Dan Horák Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20220907065038.1604504-1-mpe@ellerman.id.au commit 2a2dfc869d3345ccdd91322b023f4b0da84acbe7 Author: Joe Fradley Date: Tue Aug 23 21:19:33 2022 -0700 tools: Add new "test" taint to kernel-chktaint Commit c272612cb4a2 ("kunit: Taint the kernel when KUnit tests are run") added a new taint flag for when in-kernel tests run. This commit adds recognition of this new flag in kernel-chktaint. With this change the correct reason will be reported if the kernel is tainted because of a test run. Amended Commit log: Shuah Khan Reviewed-by: David Gow Signed-off-by: Joe Fradley Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit 336d28a8f38013a069f2d46e73aaa1880ef17a47 Author: Pavel Begunkov Date: Tue Sep 6 17:11:17 2022 +0100 io_uring: recycle kbuf recycle on tw requeue When we queue a request via tw for execution it's not going to be executed immediately, so when io_queue_async() hits IO_APOLL_READY and queues a tw but doesn't try to recycle/consume the buffer some other request may try to use the the buffer. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/a19bc9e211e3184215a58e129b62f440180e9212.1662480490.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit df6d3422d3eed27afa23df092b3ce147c558d1a8 Author: Pavel Begunkov Date: Tue Sep 6 17:11:16 2022 +0100 io_uring/kbuf: fix not advancing READV kbuf ring When we don't recycle a selected ring buffer we should advance the head of the ring, so don't just skip io_kbuf_recycle() for IORING_OP_READV but adjust the ring. Fixes: 934447a603b22 ("io_uring: do not recycle buffer in READV") Signed-off-by: Pavel Begunkov Reviewed-by: Dylan Yudaken Link: https://lore.kernel.org/r/a6d85e2611471bcb5d5dcd63a8342077ddc2d73d.1662480490.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 Author: Hyunwoo Kim Date: Wed Sep 7 09:07:14 2022 -0700 efi: capsule-loader: Fix use-after-free in efi_capsule_write A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel commit 5ac251c8a05ce074e5efac779debf82a15d870a3 Author: Yicong Yang Date: Mon Sep 5 20:26:15 2022 +0800 arch_topology: Make cluster topology span at least SMT CPUs Currently cpu_clustergroup_mask() will return CPU mask if cluster span more or the same CPUs as cpu_coregroup_mask(). This will result topology borken on non-Cluster SMT machines when building with CONFIG_SCHED_CLUSTER=y. Test with: qemu-system-aarch64 -enable-kvm -machine virt \ -net none \ -cpu host \ -bios ./QEMU_EFI.fd \ -m 2G \ -smp 48,sockets=2,cores=12,threads=2 \ -kernel $Image \ -initrd $Rootfs \ -nographic -append "rdinit=init console=ttyAMA0 sched_verbose loglevel=8" We'll get below error: [ 3.084568] BUG: arch topology borken [ 3.084570] the SMT domain not a subset of the CLS domain Since cluster is a level higher than SMT, fix this by making cluster spans at least SMT CPUs. Fixes: bfcc4397435d ("arch_topology: Limit span of cpu_clustergroup_mask()") Cc: Sudeep Holla Cc: Vincent Guittot Cc: Ionela Voinescu Cc: Greg KH Reviewed-by: Sudeep Holla Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20220905122615.12946-1-yangyicong@huawei.com Signed-off-by: Greg Kroah-Hartman commit 12ef2508f33db1654de2f22f75dd868141b8b305 Author: Krzysztof Kozlowski Date: Wed Sep 7 14:04:52 2022 +0200 dt-bindings: interconnect: fsl,imx8m-noc: drop Leonard Crestez Emails to Leonard Crestez bounce ("550 5.4.1 Recipient address rejected: Access denied:), so change maintainer to Peng Fan from NXP. Signed-off-by: Krzysztof Kozlowski Acked-by: Peng Fan Link: https://lore.kernel.org/r/20220907120452.52161-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968 Author: Yacan Liu Date: Tue Sep 6 21:01:39 2022 +0800 net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context. Here is a crash example: BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20 Fixes: bd4ad57718cc ("smc: initialize IB transport incl. PD, MR, QP, CQ, event, WR") Signed-off-by: Yacan Liu Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 1d10cd4da593bc0196a239dcc54dac24b6b0a74e Author: Ilpo Järvinen Date: Thu Sep 1 17:39:34 2022 +0300 serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting Tx'ing does not correctly account Tx'ed characters into icount.tx. Using uart_xmit_advance() fixes the problem. Fixes: 2d908b38d409 ("serial: Add Tegra Combined UART driver") Cc: # serial: Create uart_xmit_advance() Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220901143934.8850-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 754f68044c7dd6c52534ba3e0f664830285c4b15 Author: Ilpo Järvinen Date: Thu Sep 1 17:39:33 2022 +0300 serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting DMA complete & stop paths did not correctly account Tx'ed characters into icount.tx. Using uart_xmit_advance() fixes the problem. Fixes: e9ea096dd225 ("serial: tegra: add serial driver") Cc: # serial: Create uart_xmit_advance() Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220901143934.8850-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e77cab77f2cb3a1ca2ba8df4af45bb35617ac16d Author: Ilpo Järvinen Date: Thu Sep 1 17:39:32 2022 +0300 serial: Create uart_xmit_advance() A very common pattern in the drivers is to advance xmit tail index and do bookkeeping of Tx'ed characters. Create uart_xmit_advance() to handle it. Reviewed-by: Andy Shevchenko Cc: stable Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20220901143934.8850-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 91062e663b261815573ce00967b1895a99e668df Author: William Wu Date: Thu Sep 1 16:34:46 2022 +0800 usb: dwc3: core: leave default DMA if the controller does not support 64-bit DMA On some DWC3 controllers (e.g. Rockchip SoCs), the DWC3 core doesn't support 64-bit DMA address width. In this case, this driver should use the default 32-bit mask. Otherwise, the DWC3 controller will break if it runs on above 4GB physical memory environment. This patch reads the DWC_USB3_AWIDTH bits of GHWPARAMS0 which used for the DMA address width, and only configure 64-bit DMA mask if the DWC_USB3_AWIDTH is 64. Fixes: 45d39448b4d0 ("usb: dwc3: support 64 bit DMA in platform driver") Cc: stable Reviewed-by: Sven Peter Signed-off-by: William Wu Link: https://lore.kernel.org/r/20220901083446.3799754-1-william.wu@rock-chips.com Signed-off-by: Greg Kroah-Hartman commit f27b405ef43319a3ceefc2123245201a63ed4e00 Author: Lorenzo Bianconi Date: Mon Sep 5 14:41:28 2022 +0200 net: ethernet: mtk_eth_soc: check max allowed hash in mtk_ppe_check_skb Even if max hash configured in hw in mtk_ppe_hash_entry is MTK_PPE_ENTRIES - 1, check theoretical OOB accesses in mtk_ppe_check_skb routine Fixes: c4f033d9e03e9 ("net: ethernet: mtk_eth_soc: rework hardware flow table management") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 9cb252c4c1c53ae58bc565bab76e98133288f23a Author: Menglong Dong Date: Mon Sep 5 11:50:15 2022 +0800 net: skb: export skb drop reaons to user by TRACE_DEFINE_ENUM As Eric reported, the 'reason' field is not presented when trace the kfree_skb event by perf: $ perf record -e skb:kfree_skb -a sleep 10 $ perf script ip_defrag 14605 [021] 221.614303: skb:kfree_skb: skbaddr=0xffff9d2851242700 protocol=34525 location=0xffffffffa39346b1 reason: The cause seems to be passing kernel address directly to TP_printk(), which is not right. As the enum 'skb_drop_reason' is not exported to user space through TRACE_DEFINE_ENUM(), perf can't get the drop reason string from the 'reason' field, which is a number. Therefore, we introduce the macro DEFINE_DROP_REASON(), which is used to define the trace enum by TRACE_DEFINE_ENUM(). With the help of DEFINE_DROP_REASON(), now we can remove the auto-generate that we introduced in the commit ec43908dd556 ("net: skb: use auto-generation to convert skb drop reason to string"), and define the string array 'drop_reasons'. Hmmmm...now we come back to the situation that have to maintain drop reasons in both enum skb_drop_reason and DEFINE_DROP_REASON. But they are both in dropreason.h, which makes it easier. After this commit, now the format of kfree_skb is like this: $ cat /tracing/events/skb/kfree_skb/format name: kfree_skb ID: 1524 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:void * skbaddr; offset:8; size:8; signed:0; field:void * location; offset:16; size:8; signed:0; field:unsigned short protocol; offset:24; size:2; signed:0; field:enum skb_drop_reason reason; offset:28; size:4; signed:0; print fmt: "skbaddr=%p protocol=%u location=%p reason: %s", REC->skbaddr, REC->protocol, REC->location, __print_symbolic(REC->reason, { 1, "NOT_SPECIFIED" }, { 2, "NO_SOCKET" } ...... Fixes: ec43908dd556 ("net: skb: use auto-generation to convert skb drop reason to string") Link: https://lore.kernel.org/netdev/CANn89i+bx0ybvE55iMYf5GJM48WwV1HNpdm9Q6t-HaEstqpCSA@mail.gmail.com/ Reported-by: Eric Dumazet Signed-off-by: Menglong Dong Signed-off-by: David S. Miller commit 0e80707d94e4c88f9879bdafcbaceb13432ec1f4 Author: Lorenzo Bianconi Date: Tue Sep 6 16:36:32 2022 +0200 net: ethernet: mtk_eth_soc: fix typo in __mtk_foe_entry_clear Set ib1 state to MTK_FOE_STATE_UNBIND in __mtk_foe_entry_clear routine. Fixes: 33fc42de33278 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 559c36c5a8d730c49ef805a72b213d3bba155cc8 Author: Pablo Neira Ayuso Date: Wed Sep 7 10:26:18 2022 +0200 netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace. Fixes: 22c7652cdaa8 ("netfilter: nft_osf: Add version option support") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit e8d5dfd1d8747b56077d02664a8838c71ced948e Author: David Leadbeater Date: Fri Aug 26 14:56:57 2022 +1000 netfilter: nf_conntrack_irc: Tighten matching on DCC message CTCP messages should only be at the start of an IRC message, not anywhere within it. While the helper only decodes packes in the ORIGINAL direction, its possible to make a client send a CTCP message back by empedding one into a PING request. As-is, thats enough to make the helper believe that it saw a CTCP message. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: David Leadbeater Signed-off-by: Florian Westphal commit 91c98fe7941499e4127cdc359c30841b873dd43a Author: Jean-Philippe Brucker Date: Thu Aug 25 16:46:24 2022 +0100 iommu/virtio: Fix interaction with VFIO Commit e8ae0e140c05 ("vfio: Require that devices support DMA cache coherence") requires IOMMU drivers to advertise IOMMU_CAP_CACHE_COHERENCY, in order to be used by VFIO. Since VFIO does not provide to userspace the ability to maintain coherency through cache invalidations, it requires hardware coherency. Advertise the capability in order to restore VFIO support. The meaning of IOMMU_CAP_CACHE_COHERENCY also changed from "IOMMU can enforce cache coherent DMA transactions" to "IOMMU_CACHE is supported". While virtio-iommu cannot enforce coherency (of PCIe no-snoop transactions), it does support IOMMU_CACHE. We can distinguish different cases of non-coherent DMA: (1) When accesses from a hardware endpoint are not coherent. The host would describe such a device using firmware methods ('dma-coherent' in device-tree, '_CCA' in ACPI), since they are also needed without a vIOMMU. In this case mappings are created without IOMMU_CACHE. virtio-iommu doesn't need any additional support. It sends the same requests as for coherent devices. (2) When the physical IOMMU supports non-cacheable mappings. Supporting those would require a new feature in virtio-iommu, new PROBE request property and MAP flags. Device drivers would use a new API to discover this since it depends on the architecture and the physical IOMMU. (3) When the hardware supports PCIe no-snoop. It is possible for assigned PCIe devices to issue no-snoop transactions, and the virtio-iommu specification is lacking any mention of this. Arm platforms don't necessarily support no-snoop, and those that do cannot enforce coherency of no-snoop transactions. Device drivers must be careful about assuming that no-snoop transactions won't end up cached; see commit e02f5c1bb228 ("drm: disable uncached DMA optimization for ARM and arm64"). On x86 platforms, the host may or may not enforce coherency of no-snoop transactions with the physical IOMMU. But according to the above commit, on x86 a driver which assumes that no-snoop DMA is compatible with uncached CPU mappings will also work if the host enforces coherency. Although these issues are not specific to virtio-iommu, it could be used to facilitate discovery and configuration of no-snoop. This would require a new feature bit, PROBE property and ATTACH/MAP flags. Cc: stable@vger.kernel.org Fixes: e8ae0e140c05 ("vfio: Require that devices support DMA cache coherence") Signed-off-by: Jean-Philippe Brucker Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/20220825154622.86759-1-jean-philippe@linaro.org Signed-off-by: Joerg Roedel commit 35bf49e054214a0c7d3b0a0f8606f753f3f6ae96 Author: Lu Baolu Date: Tue Aug 23 14:15:57 2022 +0800 iommu/vt-d: Fix lockdep splat due to klist iteration in atomic context With CONFIG_INTEL_IOMMU_DEBUGFS enabled, below lockdep splat are seen when an I/O fault occurs on a machine with an Intel IOMMU in it. DMAR: DRHD: handling fault status reg 3 DMAR: [DMA Write NO_PASID] Request device [00:1a.0] fault addr 0x0 [fault reason 0x05] PTE Write access is not set DMAR: Dump dmar0 table entries for IOVA 0x0 DMAR: root entry: 0x0000000127f42001 DMAR: context entry: hi 0x0000000000001502, low 0x000000012d8ab001 ================================ WARNING: inconsistent lock state 5.20.0-0.rc0.20220812git7ebfc85e2cd7.10.fc38.x86_64 #1 Not tainted -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. rngd/1006 [HC1[1]:SC0[0]:HE0:SE1] takes: ff177021416f2d78 (&k->k_lock){?.+.}-{2:2}, at: klist_next+0x1b/0x160 {HARDIRQ-ON-W} state was registered at: lock_acquire+0xce/0x2d0 _raw_spin_lock+0x33/0x80 klist_add_tail+0x46/0x80 bus_add_device+0xee/0x150 device_add+0x39d/0x9a0 add_memory_block+0x108/0x1d0 memory_dev_init+0xe1/0x117 driver_init+0x43/0x4d kernel_init_freeable+0x1c2/0x2cc kernel_init+0x16/0x140 ret_from_fork+0x1f/0x30 irq event stamp: 7812 hardirqs last enabled at (7811): [] asm_sysvec_apic_timer_interrupt+0x16/0x20 hardirqs last disabled at (7812): [] irqentry_enter+0x54/0x60 softirqs last enabled at (7794): [] __irq_exit_rcu+0xf9/0x170 softirqs last disabled at (7787): [] __irq_exit_rcu+0xf9/0x170 The klist iterator functions using spin_*lock_irq*() but the klist insertion functions using spin_*lock(), combined with the Intel DMAR IOMMU driver iterating over klists from atomic (hardirq) context, where pci_get_domain_bus_and_slot() calls into bus_find_device() which iterates over klists. As currently there's no plan to fix the klist to make it safe to use in atomic context, this fixes the lockdep splat by avoid calling pci_get_domain_bus_and_slot() in the hardirq context. Fixes: 8ac0b64b9735 ("iommu/vt-d: Use pci_get_domain_bus_and_slot() in pgtable_walk()") Reported-by: Lennert Buytenhek Link: https://lore.kernel.org/linux-iommu/Yvo2dfpEh%2FWC+Wrr@wantstofly.org/ Link: https://lore.kernel.org/linux-iommu/YvyBdPwrTuHHbn5X@wantstofly.org/ Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20220819015949.4795-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit a349ffcb4daf77a4040ab5a6c95295bb533bf384 Author: Lu Baolu Date: Tue Aug 23 14:15:56 2022 +0800 iommu/vt-d: Fix recursive lock issue in iommu_flush_dev_iotlb() The per domain spinlock is acquired in iommu_flush_dev_iotlb(), which is possbile to be called in the interrupt context. For example, the drm-intel's CI system got completely blocked with below error: WARNING: inconsistent lock state 6.0.0-rc1-CI_DRM_11990-g6590d43d39b9+ #1 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88810440d678 (&domain->lock){+.?.}-{2:2}, at: iommu_flush_dev_iotlb.part.61+0x23/0x80 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0xd3/0x310 _raw_spin_lock+0x2a/0x40 domain_update_iommu_cap+0x20b/0x2c0 intel_iommu_attach_device+0x5bd/0x860 __iommu_attach_device+0x18/0xe0 bus_iommu_probe+0x1f3/0x2d0 bus_set_iommu+0x82/0xd0 intel_iommu_init+0xe45/0x102a pci_iommu_init+0x9/0x31 do_one_initcall+0x53/0x2f0 kernel_init_freeable+0x18f/0x1e1 kernel_init+0x11/0x120 ret_from_fork+0x1f/0x30 irq event stamp: 162354 hardirqs last enabled at (162354): [] _raw_spin_unlock_irqrestore+0x54/0x70 hardirqs last disabled at (162353): [] _raw_spin_lock_irqsave+0x4b/0x50 softirqs last enabled at (162338): [] __do_softirq+0x323/0x48e softirqs last disabled at (162349): [] irq_exit_rcu+0xb8/0xe0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&domain->lock); lock(&domain->lock); *** DEADLOCK *** 1 lock held by swapper/6/0: This coverts the spin_lock/unlock() into the irq save/restore varieties to fix the recursive locking issues. Fixes: ffd5869d93530 ("iommu/vt-d: Replace spin_lock_irqsave() with spin_lock()") Signed-off-by: Lu Baolu Acked-by: Lucas De Marchi Link: https://lore.kernel.org/r/20220817025650.3253959-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 53fc7ad6edf210b497230ce74b61b322a202470c Author: Lu Baolu Date: Tue Aug 23 14:15:55 2022 +0800 iommu/vt-d: Correctly calculate sagaw value of IOMMU The Intel IOMMU driver possibly selects between the first-level and the second-level translation tables for DMA address translation. However, the levels of page-table walks for the 4KB base page size are calculated from the SAGAW field of the capability register, which is only valid for the second-level page table. This causes the IOMMU driver to stop working if the hardware (or the emulated IOMMU) advertises only first-level translation capability and reports the SAGAW field as 0. This solves the above problem by considering both the first level and the second level when calculating the supported page table levels. Fixes: b802d070a52a1 ("iommu/vt-d: Use iova over first level") Cc: stable@vger.kernel.org Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20220817023558.3253263-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 0c5f6c0d8201a809a6585b07b6263e9db2c874a3 Author: Lu Baolu Date: Tue Aug 23 14:15:54 2022 +0800 iommu/vt-d: Fix kdump kernels boot failure with scalable mode The translation table copying code for kdump kernels is currently based on the extended root/context entry formats of ECS mode defined in older VT-d v2.5, and doesn't handle the scalable mode formats. This causes the kexec capture kernel boot failure with DMAR faults if the IOMMU was enabled in scalable mode by the previous kernel. The ECS mode has already been deprecated by the VT-d spec since v3.0 and Intel IOMMU driver doesn't support this mode as there's no real hardware implementation. Hence this converts ECS checking in copying table code into scalable mode. The existing copying code consumes a bit in the context entry as a mark of copied entry. It needs to work for the old format as well as for the extended context entries. As it's hard to find such a common bit for both legacy and scalable mode context entries. This replaces it with a per- IOMMU bitmap. Fixes: 7373a8cc38197 ("iommu/vt-d: Setup context and enable RID2PASID support") Cc: stable@vger.kernel.org Reported-by: Jerry Snitselaar Tested-by: Wen Jin Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20220817011035.3250131-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit ba912afbd611d3a5f22af247721a071ad1d5b9e0 Author: Alexander Sverdlin Date: Tue Sep 6 11:59:43 2022 +0200 MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() For irq_domain_associate() to work the virq descriptor has to be pre-allocated in advance. Otherwise the following happens: WARNING: CPU: 0 PID: 0 at .../kernel/irq/irqdomain.c:527 irq_domain_associate+0x298/0x2e8 error: virq128 is not allocated Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.78-... #1 ... Call Trace: [] show_stack+0x9c/0x130 [] dump_stack+0x90/0xd0 [] __warn+0x118/0x130 [] warn_slowpath_fmt+0x4c/0x70 [] irq_domain_associate+0x298/0x2e8 [] octeon_irq_init_ciu+0x4c8/0x53c [] of_irq_init+0x1e0/0x388 [] init_IRQ+0x4c/0xf4 [] start_kernel+0x404/0x698 Use irq_alloc_desc_at() to avoid the above problem. Signed-off-by: Alexander Sverdlin Signed-off-by: Thomas Bogendoerfer commit 25b327d4f818b9d41265ea3eea26d805216589b8 Author: Florian Westphal Date: Wed Aug 31 15:12:45 2022 +0200 selftests: nft_concat_range: add socat support There are different flavors of 'nc' around, this script fails on my test vm because 'nc' is 'nmap-ncat' which isn't 100% compatible. Add socat support and use it if available. Signed-off-by: Florian Westphal commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca Author: Igor Ryzhov Date: Wed Jun 5 12:32:40 2019 +0300 netfilter: nf_conntrack_sip: fix ct_sip_walk_headers ct_sip_next_header and ct_sip_get_header return an absolute value of matchoff, not a shift from current dataoff. So dataoff should be assigned matchoff, not incremented by it. This issue can be seen in the scenario when there are multiple Contact headers and the first one is using a hostname and other headers use IP addresses. In this case, ct_sip_walk_headers will work as follows: The first ct_sip_get_header call to will find the first Contact header but will return -1 as the header uses a hostname. But matchoff will be changed to the offset of this header. After that, dataoff should be set to matchoff, so that the next ct_sip_get_header call find the next Contact header. But instead of assigning dataoff to matchoff, it is incremented by it, which is not correct, as matchoff is an absolute value of the offset. So on the next call to the ct_sip_get_header, dataoff will be incorrect, and the next Contact header may not be found at all. Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper") Signed-off-by: Igor Ryzhov Signed-off-by: Florian Westphal commit 388f788341178b91d2a18e7d605126dab6732257 Author: Alexander Sverdlin Date: Tue Sep 6 10:32:39 2022 +0200 MIPS: octeon: Get rid of preprocessor directives around RESERVE32 Some of them were pointless because CONFIG_CAVIUM_RESERVE32 is now always defined, some were not enough (Yu Zhao reported "Failed to allocate CAVIUM_RESERVE32 memory area" error). Removing the directives allows for compiler coverage of RESERVE32 code and replacing one of [always-true] "ifdef" with a compiler conditional fixes the [cosmetic] error message. Fixes: 3e3114ac460e ("MIPS: Introduce CAVIUM_RESERVE32 Kconfig option") Signed-off-by: Alexander Sverdlin Signed-off-by: Thomas Bogendoerfer commit 0f51fa2a3ca19783e7817a6be76661cd9136d057 Merge: e1091e226a2ba a4bb481aeb9d8 Author: David S. Miller Date: Wed Sep 7 13:44:04 2022 +0100 Merge branch 'dsa-felix-fixes' Vladimir Oltean says: ==================== Fixes for Felix DSA driver calculation of tc-taprio guard bands This series fixes some bugs which are not quite new, but date from v5.13 when static guard bands were enabled by Michael Walle to prevent tc-taprio overruns. The investigation started when Xiaoliang asked privately what is the expected max SDU for a traffic class when its minimum gate interval is 10 us. The answer, as it turns out, is not an L1 size of 1250 octets, but 1245 octets, since otherwise, the switch will not consider frames for egress scheduling, because the static guard band is exactly as large as the time interval. The switch needs a minimum of 33 ns outside of the guard band to consider a frame for scheduling, and the reduction of the max SDU by 5 provides exactly for that. The fix for that (patch 1/3) is relatively small, but during testing, it became apparent that cut-through forwarding prevents oversized frame dropping from working properly. This is solved through the larger patch 2/3. Finally, patch 3/3 fixes one more tc-taprio locking problem found through code inspection. ==================== Signed-off-by: David S. Miller commit a4bb481aeb9d84cb53112a478e6db4705b794c34 Author: Vladimir Oltean Date: Mon Sep 5 20:01:25 2022 +0300 net: dsa: felix: access QSYS_TAG_CONFIG under tas_lock in vsc9959_sched_speed_set The read-modify-write of QSYS_TAG_CONFIG from vsc9959_sched_speed_set() runs unlocked with respect to the other functions that access it, which are vsc9959_tas_guard_bands_update(), vsc9959_qos_port_tas_set() and vsc9959_tas_clock_adjust(). All the others are under ocelot->tas_lock, so move the vsc9959_sched_speed_set() access under that lock as well, to resolve the concurrency. Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 843794bbdef83955ae5b43dfafc355c3786e2145 Author: Vladimir Oltean Date: Mon Sep 5 20:01:24 2022 +0300 net: dsa: felix: disable cut-through forwarding for frames oversized for tc-taprio Experimentally, it looks like when QSYS_QMAXSDU_CFG_7 is set to 605, frames even way larger than 601 octets are transmitted even though these should be considered as oversized, according to the documentation, and dropped. Since oversized frame dropping depends on frame size, which is only known at the EOF stage, and therefore not at SOF when cut-through forwarding begins, it means that the switch cannot take QSYS_QMAXSDU_CFG_* into consideration for traffic classes that are cut-through. Since cut-through forwarding has no UAPI to control it, and the driver enables it based on the mantra "if we can, then why not", the strategy is to alter vsc9959_cut_through_fwd() to take into consideration which tc's have oversize frame dropping enabled, and disable cut-through for them. Then, from vsc9959_tas_guard_bands_update(), we re-trigger the cut-through determination process. There are 2 strategies for vsc9959_cut_through_fwd() to determine whether a tc has oversized dropping enabled or not. One is to keep a bit mask of traffic classes per port, and the other is to read back from the hardware registers (a non-zero value of QSYS_QMAXSDU_CFG_* means the feature is enabled). We choose reading back from registers, because struct ocelot_port is shared with drivers (ocelot, seville) that don't support either cut-through nor tc-taprio, and we don't have a felix specific extension of struct ocelot_port. Furthermore, reading registers from the Felix hardware is quite cheap, since they are memory-mapped. Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 11afdc6526de0e0368c05da632a8c0d29fc60bb8 Author: Vladimir Oltean Date: Mon Sep 5 20:01:23 2022 +0300 net: dsa: felix: tc-taprio intervals smaller than MTU should send at least one packet The blamed commit broke tc-taprio schedules such as this one: tc qdisc replace dev $swp1 root taprio \ num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ base-time 0 \ sched-entry S 0x7f 990000 \ sched-entry S 0x80 10000 \ flags 0x2 because the gate entry for TC 7 (S 0x80 10000 ns) now has a static guard band added earlier than its 'gate close' event, such that packet overruns won't occur in the worst case of the largest packet possible. Since guard bands are statically determined based on the per-tc QSYS_QMAXSDU_CFG_* with a fallback on the port-based QSYS_PORT_MAX_SDU, we need to discuss what happens with TC 7 depending on kernel version, since the driver, prior to commit 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port"), did not touch QSYS_QMAXSDU_CFG_*, and therefore relied on QSYS_PORT_MAX_SDU. 1 (before vsc9959_tas_guard_bands_update): QSYS_PORT_MAX_SDU defaults to 1518, and at gigabit this introduces a static guard band (independent of packet sizes) of 12144 ns, plus QSYS::HSCH_MISC_CFG.FRM_ADJ (bit time of 20 octets => 160 ns). But this is larger than the time window itself, of 10000 ns. So, the queue system never considers a frame with TC 7 as eligible for transmission, since the gate practically never opens, and these frames are forever stuck in the TX queues and hang the port. 2 (after vsc9959_tas_guard_bands_update): Under the sole goal of enabling oversized frame dropping, we make an effort to set QSYS_QMAXSDU_CFG_7 to 1230 bytes. But QSYS_QMAXSDU_CFG_7 plays one more role, which we did not take into account: per-tc static guard band, expressed in L2 byte time (auto-adjusted for FCS and L1 overhead). There is a discrepancy between what the driver thinks (that there is no guard band, and 100% of min_gate_len[tc] is available for egress scheduling) and what the hardware actually does (crops the equivalent of QSYS_QMAXSDU_CFG_7 ns out of min_gate_len[tc]). In practice, this means that the hardware thinks it has exactly 0 ns for scheduling tc 7. In both cases, even minimum sized Ethernet frames are stuck on egress rather than being considered for scheduling on TC 7, even if they would fit given a proper configuration. Considering the current situation, with vsc9959_tas_guard_bands_update(), frames between 60 octets and 1230 octets in size are not eligible for oversized dropping (because they are smaller than QSYS_QMAXSDU_CFG_7), but won't be considered as eligible for scheduling either, because the min_gate_len[7] (10000 ns) minus the guard band determined by QSYS_QMAXSDU_CFG_7 (1230 octets * 8 ns per octet == 9840 ns) minus the guard band auto-added for L1 overhead by QSYS::HSCH_MISC_CFG.FRM_ADJ (20 octets * 8 ns per octet == 160 octets) leaves 0 ns for scheduling in the queue system proper. Investigating the hardware behavior, it becomes apparent that the queue system needs precisely 33 ns of 'gate open' time in order to consider a frame as eligible for scheduling to a tc. So the solution to this problem is to amend vsc9959_tas_guard_bands_update(), by giving the per-tc guard bands less space by exactly 33 ns, just enough for one frame to be scheduled in that interval. This allows the queue system to make forward progress for that port-tc, and prevents it from hanging. Fixes: 297c4de6f780 ("net: dsa: felix: re-enable TAS guard band mode") Reported-by: Xiaoliang Yang Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 8d96bba75a43ba564bf8732e955d9f519d2bbaec Author: Alexander Gordeev Date: Wed Jul 20 07:24:03 2022 +0200 s390/smp: enforce lowcore protection on CPU restart As result of commit 915fea04f932 ("s390/smp: enable DAT before CPU restart callback is called") the low-address protection bit gets mistakenly unset in control register 0 save area of the absolute zero memory. That area is used when manual PSW restart happened to hit an offline CPU. In this case the low-address protection for that CPU will be dropped. Reviewed-by: Heiko Carstens Fixes: 915fea04f932 ("s390/smp: enable DAT before CPU restart callback is called") Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik commit 12dd19c159659ec9050f45dc8a2ff3c3917f4be3 Author: Alexander Gordeev Date: Sat Aug 13 19:45:21 2022 +0200 s390/boot: fix absolute zero lowcore corruption on boot Crash dump always starts on CPU0. In case CPU0 is offline the prefix page is not installed and the absolute zero lowcore is used. However, struct lowcore::mcesad is never assigned and stays zero. That leads to __machine_kdump() -> save_vx_regs() call silently stores vector registers to the absolute lowcore at 0x11b0 offset. Fixes: a62bc0739253 ("s390/kdump: add support for vector extension") Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik commit 279c12df8d2efb28def9d037f288cbfb97c30fe2 Author: Pali Rohár Date: Tue Sep 6 12:54:31 2022 +0200 gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx Commit e39d5ef67804 ("powerpc/5xxx: extend mpc8xxx_gpio driver to support mpc512x gpios") implemented support for IRQ_TYPE_LEVEL_LOW flow type in mpc512x via falling edge type. Do same for mpc85xx which support was added in commit 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio"). Fixes probing of lm90 hwmon driver on mpc85xx based board which use level interrupt. Without it kernel prints error and refuse lm90 to work: [ 15.258370] genirq: Setting trigger mode 8 for irq 49 failed (mpc8xxx_irq_set_type+0x0/0xf8) [ 15.267168] lm90 0-004c: cannot request IRQ 49 [ 15.272708] lm90: probe of 0-004c failed with error -22 Fixes: 345e5c8a1cc3 ("powerpc: Add interrupt support to mpc8xxx_gpio") Signed-off-by: Pali Rohár Signed-off-by: Bartosz Golaszewski commit 809f44a0cc5ad4b1209467a6287f8ac0eb49d393 Author: Takashi Iwai Date: Wed Sep 7 12:04:21 2022 +0200 ALSA: usb-audio: Clear fixed clock rate at closing EP The recent commit c11117b634f4 ("ALSA: usb-audio: Refcount multiple accesses on the single clock") tries to manage the clock rate shared by several endpoints. This was intended for avoiding the unmatched rate by a different endpoint, but unfortunately, it introduced a regression for PulseAudio and pipewire, too; those applications try to probe the multiple possible rates (44.1k and 48kHz) and setting up the normal rate fails but only the last rate is applied. The cause is that the last sample rate is still left to the clock reference even after closing the endpoint, and this value is still used at the next open. It happens only when applications set up via PCM prepare but don't start/stop the stream; the rate is reset when the stream is stopped, but it's not cleared at close. This patch addresses the issue above, simply by clearing the rate set in the clock reference at the last close of each endpoint. Fixes: c11117b634f4 ("ALSA: usb-audio: Refcount multiple accesses on the single clock") Reported-by: Jason A. Donenfeld Tested-by: Jason A. Donenfeld Cc: Link: https://lore.kernel.org/all/YxXIWv8dYmg1tnXP@zx2c4.com/ Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/2620 Link: https://lore.kernel.org/r/20220907100421.6443-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 94a568ce32038d8ff9257004bb4632e60eb43a49 Author: John Sperbeck Date: Mon Aug 1 19:22:29 2022 +0000 iommu/amd: use full 64-bit value in build_completion_wait() We started using a 64 bit completion value. Unfortunately, we only stored the low 32-bits, so a very large completion value would never be matched in iommu_completion_wait(). Fixes: c69d89aff393 ("iommu/amd: Use 4K page for completion wait write-back semaphore") Signed-off-by: John Sperbeck Link: https://lore.kernel.org/r/20220801192229.3358786-1-jsperbeck@google.com Signed-off-by: Joerg Roedel commit 9fc18f6d56d5b79d527c17a8100a0965d18345cf Author: Christoph Hellwig Date: Sun Aug 21 16:06:44 2022 +0200 dma-mapping: mark dma_supported static Now that the remaining users in drivers are gone, this function can be marked static. Signed-off-by: Christoph Hellwig commit 43b919017fe755ccd2b19afb2dc2d3da8f840038 Author: Chao Gao Date: Fri Aug 26 17:50:46 2022 +0800 swiotlb: fix a typo "overwirte" isn't a word. It should be "overwrite". Signed-off-by: Chao Gao Signed-off-by: Christoph Hellwig commit 3f0461613ebcdc8c4073e235053d06d5aa58750f Author: Chao Gao Date: Fri Aug 19 16:45:37 2022 +0800 swiotlb: avoid potential left shift overflow The second operand passed to slot_addr() is declared as int or unsigned int in all call sites. The left-shift to get the offset of a slot can overflow if swiotlb size is larger than 4G. Convert the macro to an inline function and declare the second argument as phys_addr_t to avoid the potential overflow. Fixes: 26a7e094783d ("swiotlb: refactor swiotlb_tbl_map_single") Signed-off-by: Chao Gao Reviewed-by: Dongli Zhang Signed-off-by: Christoph Hellwig commit 2995b8002cefc7b0b00b8f9a0ce36601a8c390c0 Author: Robin Murphy Date: Mon Aug 15 20:28:40 2022 +0100 dma-debug: improve search for partial syncs When bucket_find_contains() tries to find the original entry for a partial sync, it manages to constrain its search in a way that is both too restrictive and not restrictive enough. A driver which only uses single mappings rather than scatterlists might not set max_seg_size, but could still technically perform a partial sync at an offset of more than 64KB into a sufficiently large mapping, so we could stop searching too early before reaching a legitimate entry. Conversely, if no valid entry is present and max_range is large enough, we can pointlessly search buckets that we've already searched, or that represent an impossible wrapping around the bottom of the address space. At worst, the (legitimate) case of max_seg_size == UINT_MAX can make the loop infinite. Replace the fragile and frankly hard-to-follow "range" logic with a simple counted loop for the number of possible hash buckets below the given address. Reported-by: Yunfei Wang Signed-off-by: Robin Murphy Signed-off-by: Christoph Hellwig commit 81c12e922b97b94f64e84aa9bfe5a9d1fca2dc25 Author: Yu Zhao Date: Wed Aug 31 00:38:18 2022 -0600 Revert "swiotlb: panic if nslabs is too small" This reverts commit 0bf28fc40d89b1a3e00d1b79473bad4e9ca20ad1. Reasons: 1. new panic()s shouldn't be added [1]. 2. It does no "cleanup" but breaks MIPS [2]. v2: properly solved the conflict [3] with commit 20347fca71a38 ("swiotlb: split up the global swiotlb lock") Reported-by: kernel test robot Reported-by: Dan Carpenter [1] https://lore.kernel.org/r/CAHk-=wit-DmhMfQErY29JSPjFgebx_Ld+pnerc4J2Ag990WwAA@mail.gmail.com/ [2] https://lore.kernel.org/r/20220820012031.1285979-1-yuzhao@google.com/ [3] https://lore.kernel.org/r/202208310701.LKr1WDCh-lkp@intel.com/ Fixes: 0bf28fc40d89b ("swiotlb: panic if nslabs is too small") Signed-off-by: Yu Zhao Signed-off-by: Christoph Hellwig commit a261786fdc0a5bed2e5f994dcc0ffeeeb0d662c7 Author: Sindhu-Devale Date: Tue Sep 6 17:32:44 2022 -0500 RDMA/irdma: Report RNR NAK generation in device caps Report RNR NAK generation when device capabilities are queried Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Sindhu-Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20220906223244.1119-6-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 2c8844431d065ae15a6b442f5769b60aeaaa07af Author: Sindhu-Devale Date: Tue Sep 6 17:32:43 2022 -0500 RDMA/irdma: Use s/g array in post send only when its valid Send with invalidate verb call can pass in an uninitialized s/g array with 0 sge's which is filled into irdma WQE and causes a HW asynchronous event. Fix this by using the s/g array in irdma post send only when its valid. Fixes: 551c46e ("RDMA/irdma: Add user/kernel shared libraries") Signed-off-by: Sindhu-Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20220906223244.1119-5-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit dcb23bbb1de7e009875fdfac2b8a9808a9319cc6 Author: Sindhu-Devale Date: Tue Sep 6 17:32:42 2022 -0500 RDMA/irdma: Return correct WC error for bind operation failure When a QP and a MR on a local host are in different PDs, the HW generates an asynchronous event (AE). The same AE is generated when a QP and a MW are in different PDs during a bind operation. Return the more appropriate IBV_WC_MW_BIND_ERR for the latter case by checking the OP type from the CQE in error. Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") Signed-off-by: Sindhu-Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20220906223244.1119-4-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 6b227bd32db778eddc6f3b22cc72a28dda0f2272 Author: Sindhu-Devale Date: Tue Sep 6 17:32:41 2022 -0500 RDMA/irdma: Return error on MR deregister CQP failure The MR deregister CQP can fail if an MW is bound to it. Return an appropriate error for this case. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Sindhu-Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20220906223244.1119-3-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 12faad5e5cf2372af2d51f348b697b5edf838daf Author: Sindhu-Devale Date: Tue Sep 6 17:32:40 2022 -0500 RDMA/irdma: Report the correct max cqes from query device Report the correct max cqes available to an application taking into account a reserved entry to detect overflow. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Sindhu-Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20220906223244.1119-2-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit ab0b4b575b46d29bf49dc86047dc2964125db722 Merge: 7e18e42e4b280 0a6fc70d76bdd Author: Greg Kroah-Hartman Date: Wed Sep 7 09:51:19 2022 +0200 Merge tag 'phy-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-misc-linus Vinod writes: "phy: fixes for 6.0 Fix for broken reset in marvell a3700-comphy" * tag 'phy-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: marvell: phy-mvebu-a3700-comphy: Remove broken reset support commit 4d8421f2dd88583cc7a4d6c2a5532c35e816a52a Author: Jason A. Donenfeld Date: Mon Sep 5 19:22:46 2022 +0200 wifi: iwlwifi: don't spam logs with NSS>2 messages I get a log line like this every 4 seconds when connected to my AP: [15650.221468] iwlwifi 0000:09:00.0: Got NSS = 4 - trimming to 2 Looking at the code, this seems to be related to a hardware limitation, and there's nothing to be done. In an effort to keep my dmesg manageable, downgrade this error to "debug" rather than "info". Cc: Johannes Berg Signed-off-by: Jason A. Donenfeld Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220905172246.105383-1-Jason@zx2c4.com commit 7a1ec84ffba9e90ac772ddb33ea9c3899ed8d2c9 Author: chen zhang Date: Wed Sep 7 10:32:55 2022 +0800 efi/x86: libstub: remove unused variable The variable "has_system_memory" is unused in function ‘adjust_memory_range_protection’, remove it. Signed-off-by: chen zhang Signed-off-by: Ard Biesheuvel commit 371a982cd2b01487295cd87abec82357e268457b Author: Keith Busch Date: Thu Sep 1 08:30:39 2022 -0700 nvme: requeue aen after firmware activation The driver prevents async event work while handling a processing paused event, but someone needs to restart it after the controller returns to a live state. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216400 Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit b7e97872a65e1d57b4451769610554c131f37a0a Author: Dennis Maisenbacher Date: Tue Sep 6 09:39:28 2022 +0200 nvmet: fix mar and mor off-by-one errors Maximum Active Resources (MAR) and Maximum Open Resources (MOR) are 0's based vales where a value of 0xffffffff indicates that there is no limit. Decrement the values that are returned by bdev_max_open_zones and bdev_max_active_zones as the block layer helpers are not 0's based. A 0 returned by the block layer helpers indicates no limit, thus convert it to 0xffffffff (U32_MAX). Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") Suggested-by: Niklas Cassel Signed-off-by: Dennis Maisenbacher Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit d29f59051d3a07b81281b2df2b8c9dfe4716067f Author: Tasos Sahanidis Date: Wed Sep 7 04:18:00 2022 +0300 ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis Cc: Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasossah.com Signed-off-by: Takashi Iwai commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 Author: Sreekanth Reddy Date: Tue Sep 6 19:19:08 2022 +0530 scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0 Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broadcom.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen commit 93d71986a60c37395e0a1d2f7fe170ef1e0a8ba4 Author: Xiu Jianfeng Date: Tue Sep 6 22:12:10 2022 +0800 rv/reactor: add __init/__exit annotations to module init/exit funcs Add missing __init/__exit annotations to module init/exit funcs. Link: https://lkml.kernel.org/r/20220906141210.132607-1-xiujianfeng@huawei.com Fixes: 135b881ea885 ("rv/reactor: Add the printk reactor") Fixes: e88043c0ac16 ("rv/reactor: Add the panic reactor") Signed-off-by: Xiu Jianfeng Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit cecf8e128ec69149fe53c9a7bafa505a4bee25d9 Author: Masami Hiramatsu (Google) Date: Sun Sep 4 13:12:29 2022 +0900 tracing: Fix to check event_mutex is held while accessing trigger list Since the check_user_trigger() is called outside of RCU read lock, this list_for_each_entry_rcu() caused a suspicious RCU usage warning. # echo hist:keys=pid > events/sched/sched_stat_runtime/trigger # cat events/sched/sched_stat_runtime/trigger [ 43.167032] [ 43.167418] ============================= [ 43.167992] WARNING: suspicious RCU usage [ 43.168567] 5.19.0-rc5-00029-g19ebe4651abf #59 Not tainted [ 43.169283] ----------------------------- [ 43.169863] kernel/trace/trace_events_trigger.c:145 RCU-list traversed in non-reader section!! ... However, this file->triggers list is safe when it is accessed under event_mutex is held. To fix this warning, adds a lockdep_is_held check to the list_for_each_entry_rcu(). Link: https://lkml.kernel.org/r/166226474977.223837.1992182913048377113.stgit@devnote2 Cc: stable@vger.kernel.org Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 54c3931957f6a6194d5972eccc36d052964b2abe Author: Yipeng Zou Date: Thu Sep 1 18:45:14 2022 +0800 tracing: hold caller_addr to hardirq_{enable,disable}_ip Currently, The arguments passing to lockdep_hardirqs_{on,off} was fixed in CALLER_ADDR0. The function trace_hardirqs_on_caller should have been intended to use caller_addr to represent the address that caller wants to be traced. For example, lockdep log in riscv showing the last {enabled,disabled} at __trace_hardirqs_{on,off} all the time(if called by): [ 57.853175] hardirqs last enabled at (2519): __trace_hardirqs_on+0xc/0x14 [ 57.853848] hardirqs last disabled at (2520): __trace_hardirqs_off+0xc/0x14 After use trace_hardirqs_xx_caller, we can get more effective information: [ 53.781428] hardirqs last enabled at (2595): restore_all+0xe/0x66 [ 53.782185] hardirqs last disabled at (2596): ret_from_exception+0xa/0x10 Link: https://lkml.kernel.org/r/20220901104515.135162-2-zouyipeng@huawei.com Cc: stable@vger.kernel.org Fixes: c3bc8fd637a96 ("tracing: Centralize preemptirq tracepoints and unify their usage") Signed-off-by: Yipeng Zou Signed-off-by: Steven Rostedt (Google) commit 54be5509422ebee333709c92441aa7185ca182fa Author: Alison Schofield Date: Mon Aug 29 10:10:48 2022 -0700 tracepoint: Allow trace events in modules with TAINT_TEST Commit 2852ca7fba9f ("panic: Taint kernel if tests are run") introduced a new taint type, TAINT_TEST, to signal that an in-kernel test module has been loaded. TAINT_TEST taint type defaults into a 'bad_taint' list for kernel tracing and blocks the creation of trace events. This causes a problem for CXL testing where loading the cxl_test module makes all CXL modules out-of-tree, blocking any trace events. Trace events are in development for CXL at the moment and this issue was found in test with v6.0-rc1. Link: https://lkml.kernel.org/r/20220829171048.263065-1-alison.schofield@intel.com Fixes: 2852ca7fba9f7 ("panic: Taint kernel if tests are run") Reported-by: Ira Weiny Suggested-by: Dan Williams Tested-by: Ira Weiny Reviewed-by: David Gow Signed-off-by: Alison Schofield Signed-off-by: Steven Rostedt (Google) commit f72c3a2d344b3933dedd42fdaf7d3e1aa4b8cce1 Author: Lukas Bulwahn Date: Thu Aug 25 13:59:27 2022 +0200 MAINTAINERS: add scripts/tracing/ to TRACING The files in scripts/tracing/ belong to the TRACING subsystem. Add a corresponding file entry for TRACING. Link: https://lkml.kernel.org/r/20220825115927.20598-1-lukas.bulwahn@gmail.com Signed-off-by: Lukas Bulwahn Signed-off-by: Steven Rostedt (Google) commit fa4b9df00af4a749d4d715d7e11562121b7885ac Author: Daniel Bristot de Oliveira Date: Tue Aug 23 17:33:16 2022 +0200 MAINTAINERS: Add Runtime Verification (RV) entry Add a Runtime Verification (RV) entry in the MAINTAINERS file with Steven Rostedt and myself as maintainers. Link: https://lkml.kernel.org/r/b24c13553b6947a8da16d884ca464e4233eb8fb7.1661268579.git.bristot@kernel.org Cc: Joe Perches Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit baf2c002402702accc30dcc8f19199f303638306 Author: Daniel Bristot de Oliveira Date: Tue Aug 23 17:20:29 2022 +0200 rv/monitors: Make monitor's automata definition static Monitor's automata definition is only used locally, so make them static for all existing monitors. Link: https://lore.kernel.org/all/202208210332.gtHXje45-lkp@intel.com Link: https://lore.kernel.org/all/202208210358.6HH3OrVs-lkp@intel.com Link: https://lkml.kernel.org/r/a50e27c3738d6ef809f4201857229fed64799234.1661266564.git.bristot@kernel.org Fixes: ccc319dcb450 ("rv/monitor: Add the wwnr monitor") Fixes: 8812d21219b9 ("rv/monitor: Add the wip monitor skeleton created by dot2k") Reported-by: kernel test robot Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 0066f1b0e27556381402db3ff31f85d2a2265858 Author: David Howells Date: Tue Sep 6 22:09:11 2022 +0100 afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked When trying to get a file lock on an AFS file, the server may return UAEAGAIN to indicate that the lock is already held. This is currently translated by the default path to -EREMOTEIO. Translate it instead to -EAGAIN so that we know we can retry it. Signed-off-by: David Howells Reviewed-by: Jeffrey E Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/166075761334.3533338.2591992675160918098.stgit@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit 19f516ea34f943edd5bfe9ca0c0050a7660c230c Merge: d2ec799d1c1be 25af7406df591 Author: Linus Torvalds Date: Tue Sep 6 21:27:05 2022 -0400 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fix from Russell King: "Just one fix for now for the AMBA bus code from Isaac Manjarres" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9229/1: amba: Fix use-after-free in amba_read_periphid() commit d2ec799d1c1be847d6a70704fe586ac4d14265c8 Merge: 53e99dcff61e1 2f44013e39984 Author: Linus Torvalds Date: Tue Sep 6 15:19:45 2022 -0400 Merge tag 'erofs-for-6.0-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix return codes in erofs_fscache_{meta_,}read_folio error paths - Fix potential wrong pcluster sizes for later non-4K lclusters - Fix in-memory pcluster use-after-free on UP platforms * tag 'erofs-for-6.0-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix pcluster use-after-free on UP platforms erofs: avoid the potentially wrong m_plen for big pcluster erofs: fix error return code in erofs_fscache_{meta_,}read_folio commit 151e0e0fdb4d6365305598af3b9072d44e896ef0 Author: Matthew Auld Date: Mon Sep 5 11:53:29 2022 +0100 drm/i915: consider HAS_FLAT_CCS() in needs_ccs_pages Just move the HAS_FLAT_CCS() check into needs_ccs_pages. This also then fixes i915_ttm_memcpy_allowed() which was incorrectly reporting true on DG1, even though it doesn't have small-BAR or flat-CCS. References: https://gitlab.freedesktop.org/drm/intel/-/issues/6605 Fixes: efeb3caf4341 ("drm/i915/ttm: disallow CPU fallback mode for ccs pages") Signed-off-by: Matthew Auld Cc: Nirmoy Das Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20220905105329.41455-1-matthew.auld@intel.com (cherry picked from commit 873fef8833ea794526b7f4179088e565078fe0e8) Signed-off-by: Rodrigo Vivi commit 672d6ca758651f0ec12cd0d59787067a5bde1c96 Author: Ville Syrjälä Date: Fri Sep 2 10:03:18 2022 +0300 drm/i915: Implement WaEdpLinkRateDataReload A lot of modern laptops use the Parade PS8461E MUX for eDP switching. The MUX can operate in jitter cleaning mode or redriver mode, the first one resulting in higher link quality. The jitter cleaning mode needs to know the link rate used and the MUX achieves this by snooping the LINK_BW_SET, LINK_RATE_SELECT and SUPPORTED_LINK_RATES DPCD accesses. When the MUX is powered down (seems this can happen whenever the display is turned off) it loses track of the snooped link rates so when we do the LINK_RATE_SELECT write it no longer knowns which link rate we're selecting, and thus it falls back to the lower quality redriver mode. This results in unstable high link rates (eg. usually 8.1Gbps link rate no longer works correctly). In order to avoid all that let's re-snoop SUPPORTED_LINK_RATES from the sink at the start of every link training. Unfortunately we don't have a way to detect the presence of the MUX. It looks like the set of laptops equipped with this MUX is fairly large and contains devices from multiple manufacturers. It may also still be growing with new models. So a quirk doesn't seem like a very easily maintainable option, thus we shall attempt to do this unconditionally on all machines that use LINK_RATE_SELECT. Hopefully this extra DPCD read doesn't cause issues for any unaffected machine. If that turns out to be the case we'll need to convert this into a quirk in the future. Cc: stable@vger.kernel.org Cc: Jason A. Donenfeld Cc: Ankit Nautiyal Cc: Jani Nikula Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220902070319.15395-1-ville.syrjala@linux.intel.com Tested-by: Aaron Ma Tested-by: Jason A. Donenfeld Reviewed-by: Jani Nikula (cherry picked from commit 25899c590cb5ba9b9f284c6ca8e7e9086793d641) Signed-off-by: Rodrigo Vivi commit e1cab970574c001d83e59ca8388c474a57a1afb6 Author: Rodrigo Vivi Date: Wed Aug 31 17:45:38 2022 -0400 drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC We need to inform PCODE of a desired ring frequencies so PCODE update the memory frequencies to us. rps->min_freq and rps->max_freq are the frequencies used in that request. However they were unset when SLPC was enabled and PCODE never updated the memory freq. v2 (as Suggested by Ashutosh): if SLPC is in use, let's pick the right frequencies from the get_ia_constants instead of the fake init of rps' min and max. v3: don't forget the max <= min return v4: Move all the freq conversion to intel_rps.c. And the max <= min check to where it belongs. v5: (Ashutosh) Fix old comment s/50 HZ/50 MHz and add a doc explaining the "raw format" Fixes: 7ba79a671568 ("drm/i915/guc/slpc: Gate Host RPS when SLPC is enabled") Cc: # v5.15+ Cc: Ashutosh Dixit Tested-by: Sushma Venkatesh Reddy Signed-off-by: Rodrigo Vivi Reviewed-by: Ashutosh Dixit Link: https://patchwork.freedesktop.org/patch/msgid/20220831214538.143950-1-rodrigo.vivi@intel.com (cherry picked from commit 018a7bdbb090b9155a6509a0d1a684db4afaa5b1) Signed-off-by: Rodrigo Vivi commit edca5a2c373db61efa959307c13ed9156b1c14d9 Author: Ville Syrjälä Date: Mon Aug 29 16:58:34 2022 +0300 drm/i915/bios: Copy the whole MIPI sequence block Turns out the MIPI sequence block version number and new block size fields are considered part of the block header and are not included in the reported new block size field itself. Bump up the block size appropriately so that we'll copy over the last five bytes of the block as well. For this particular machine those last five bytes included parts of the GPIO op for the backlight on sequence, causing the backlight no longer to turn back on: Sequence 6 - MIPI_SEQ_BACKLIGHT_ON Delay: 20000 us - GPIO index 0, number 0, set 0 (0x00) + GPIO index 1, number 70, set 1 (0x01) Cc: stable@vger.kernel.org Fixes: e163cfb4c96d ("drm/i915/bios: Make copies of VBT data blocks") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6652 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220829135834.8585-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit a06289f3f72431f3777af95ea1226b5b0abdc426) Signed-off-by: Rodrigo Vivi commit a81e18e963ce13ecfa4f0f11b185bc8372f203f8 Author: Tejun Heo Date: Tue Sep 6 06:52:58 2022 -1000 cpuset: Add Waiman Long as a cpuset maintainer Waiman has been very active with cpuset recently and I've been cc'ing him for cpuset related changes for a while now. Let's make him a cpuset maintainer. Signed-off-by: Tejun Heo Cc: Zefan Li Cc: Waiman Long commit 5da431b71d4b9be3c8cf6786eff9e2d41a5f9f65 Author: Qu Wenruo Date: Thu Aug 18 15:06:44 2022 +0800 btrfs: fix the max chunk size and stripe length calculation [BEHAVIOR CHANGE] Since commit f6fca3917b4d ("btrfs: store chunk size in space-info struct"), btrfs no longer can create larger data chunks than 1G: mkfs.btrfs -f -m raid1 -d raid0 $dev1 $dev2 $dev3 $dev4 mount $dev1 $mnt btrfs balance start --full $mnt btrfs balance start --full $mnt umount $mnt btrfs ins dump-tree -t chunk $dev1 | grep "DATA|RAID0" -C 2 Before that offending commit, what we got is a 4G data chunk: item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 9492758528) itemoff 15491 itemsize 176 length 4294967296 owner 2 stripe_len 65536 type DATA|RAID0 io_align 65536 io_width 65536 sector_size 4096 num_stripes 4 sub_stripes 1 Now what we got is only 1G data chunk: item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 6271533056) itemoff 15491 itemsize 176 length 1073741824 owner 2 stripe_len 65536 type DATA|RAID0 io_align 65536 io_width 65536 sector_size 4096 num_stripes 4 sub_stripes 1 This will increase the number of data chunks by the number of devices, not only increase system chunk usage, but also greatly increase mount time. Without a proper reason, we should not change the max chunk size. [CAUSE] Previously, we set max data chunk size to 10G, while max data stripe length to 1G. Commit f6fca3917b4d ("btrfs: store chunk size in space-info struct") completely ignored the 10G limit, but use 1G max stripe limit instead, causing above shrink in max data chunk size. [FIX] Fix the max data chunk size to 10G, and in decide_stripe_size_regular() we limit stripe_size to 1G manually. This should only affect data chunks, as for metadata chunks we always set the max stripe size the same as max chunk size (256M or 1G depending on fs size). Now the same script result the same old result: item 6 key (FIRST_CHUNK_TREE CHUNK_ITEM 9492758528) itemoff 15491 itemsize 176 length 4294967296 owner 2 stripe_len 65536 type DATA|RAID0 io_align 65536 io_width 65536 sector_size 4096 num_stripes 4 sub_stripes 1 Reported-by: Wang Yugui Fixes: f6fca3917b4d ("btrfs: store chunk size in space-info struct") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4efa8e314351cb3e7f229ddd3571069edf38f99a Author: Shang XiaoJing Date: Tue Sep 6 11:29:06 2022 +0800 perf c2c: Prevent potential memory leak in c2c_he_zalloc() Free allocated resources when zalloc() fails for members in c2c_he, to prevent potential memory leak in c2c_he_zalloc(). Signed-off-by: Shang XiaoJing Reviewed-by: Leo Yan Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220906032906.21395-4-shangxiaojing@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 6ea9da51a5c00c9d9309c4c9aa21cbe63c799c56 Author: Zixuan Tan Date: Fri Aug 26 01:00:58 2022 +0800 perf genelf: Switch deprecated openssl MD5_* functions to new EVP API Switch to the flavored EVP API like in test-libcrypto.c, and remove the bad gcc #pragma. Inspired-by: 5b245985a6de5ac1 ("tools build: Switch to new openssl API for test-libcrypto") Signed-off-by: Zixuan Tan Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/CABwm_eTnARC1GwMD-JF176k8WXU1Z0+H190mvXn61yr369qt6g@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit cbd7bfc7fd99acdde58ec2b0bce990158fba1654 Author: Athira Rajeev Date: Mon Sep 5 19:49:29 2022 +0530 tools/perf: Fix out of bound access to cpu mask array The cpu mask init code in "record__mmap_cpu_mask_init" function access "bits" array part of "struct mmap_cpu_mask". The size of this array is the value from cpu__max_cpu().cpu. This array is used to contain the cpumask value for each cpu. While setting bit for each cpu, it calls "set_bit" function which access index in "bits" array. If we provide a command line option to -C which is greater than the number of CPU's present in the system, the set_bit could access an array member which is out-of the array size. This is because currently, there is no boundary check for the CPU. This will result in seg fault: <<>> ./perf record -C 12341234 ls Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS Segmentation fault (core dumped) <<>> Debugging with gdb, points to function flow as below: <<>> set_bit record__mmap_cpu_mask_init record__init_thread_default_masks record__init_thread_masks cmd_record <<>> Fix this by adding boundary check for the array. After the patch: <<>> ./perf record -C 12341234 ls Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS Failed to initialize parallel data streaming masks <<>> With this fix, if -C is given a non-exsiting CPU, perf record will fail with: <<>> ./perf record -C 50 ls Failed to initialize parallel data streaming masks <<>> Reported-by: Nageswara R Sastry Signed-off-by: Athira Jajeev Tested-by: Arnaldo Carvalho de Melo Tested-by: Nageswara R Sastry Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20220905141929.7171-2-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 72cd652b73dd77df6f26bd450e804ee29232669f Author: Athira Rajeev Date: Mon Sep 5 19:49:28 2022 +0530 perf affinity: Fix out of bound access to "sched_cpus" mask The affinity code in "affinity_set" function access array named "sched_cpus". The size for this array is allocated in affinity_setup function which is nothing but value from get_cpu_set_size. This is used to contain the cpumask value for each cpu. While setting bit for each cpu, it calls "set_bit" function which access index in sched_cpus array. If we provide a command-line option to -C which is more than the number of CPU's present in the system, the set_bit could access an array member which is out-of the array size. This is because currently, there is no boundary check for the CPU. This will result in seg fault: <<>> ./perf stat -C 12323431 ls Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS Segmentation fault (core dumped) <<>> Fix this by adding boundary check for the array. After the fix from powerpc system: <<>> ./perf stat -C 12323431 ls 1>out Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS Performance counter stats for 'CPU(s) 12323431': msec cpu-clock context-switches cpu-migrations page-faults cycles instructions branches branch-misses 0.001192373 seconds time elapsed <<>> Reported-by: Nageswara R Sastry Signed-off-by: Athira Jajeev Tested-by: Arnaldo Carvalho de Melo Tested-by: Nageswara R Sastry Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20220905141929.7171-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit e1091e226a2bab4ded1fe26efba2aee1aab06450 Author: jerry.meng Date: Mon Sep 5 09:24:52 2022 +0800 net: usb: qmi_wwan: add Quectel RM520N add support for Quectel RM520N which is based on Qualcomm SDX62 chip. 0x0801: DIAG + NMEA + AT + MODEM + RMNET T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0801 Rev= 5.04 S: Manufacturer=Quectel S: Product=RM520N-GL S: SerialNumber=384af524 C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: jerry.meng Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/tencent_E50CA8A206904897C2D20DDAE90731183C05@qq.com Signed-off-by: Paolo Abeni commit d91c411c744b55e860fbafc9a499f4f22d64c762 Author: ZhenGuo Yin Date: Tue Sep 6 16:46:19 2022 +0800 drm/ttm: update bulk move object of ghost BO [Why] Ghost BO is released with non-empty bulk move object. There is a warning trace: WARNING: CPU: 19 PID: 1582 at ttm/ttm_bo.c:366 ttm_bo_release+0x2e1/0x2f0 [amdttm] Call Trace: amddma_resv_reserve_fences+0x10d/0x1f0 [amdkcl] amdttm_bo_put+0x28/0x30 [amdttm] amdttm_bo_move_accel_cleanup+0x126/0x200 [amdttm] amdgpu_bo_move+0x1a8/0x770 [amdgpu] ttm_bo_handle_move_mem+0xb0/0x140 [amdttm] amdttm_bo_validate+0xbf/0x100 [amdttm] [How] The resource of ghost BO should be moved to LRU directly, instead of using bulk move. The bulk move object of ghost BO should set to NULL before function ttm_bo_move_to_lru_tail_unlocked. v2: set bulk move to NULL manually if no resource associated with ghost BO Fixed: 5b951e487fd6bf5f ("drm/ttm: fix bulk move handling v2") Signed-off-by: ZhenGuo Yin Reviewed-by: Christian König Signed-off-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20220906084619.2545456-1-zhenguo.yin@amd.com commit 6b959ba22d34ca793ffdb15b5715457c78e38b1a Author: Yang Jihong Date: Fri Sep 2 16:29:18 2022 +0800 perf/core: Fix reentry problem in perf_output_read_group() perf_output_read_group may respond to IPI request of other cores and invoke __perf_install_in_context function. As a result, hwc configuration is modified. causing inconsistency and unexpected consequences. Interrupts are not disabled when perf_output_read_group reads PMU counter. In this case, IPI request may be received from other cores. As a result, PMU configuration is modified and an error occurs when reading PMU counter: CPU0 CPU1 __se_sys_perf_event_open perf_install_in_context perf_output_read_group smp_call_function_single for_each_sibling_event(sub, leader) { generic_exec_single if ((sub != event) && remote_function (sub->state == PERF_EVENT_STATE_ACTIVE)) | <----RAISE IPI-----+ __perf_install_in_context ctx_resched event_sched_out armpmu_del ... hwc->idx = -1; // event->hwc.idx is set to -1 ... sub->pmu->read(sub); armpmu_read armv8pmu_read_counter armv8pmu_read_hw_counter int idx = event->hw.idx; // idx = -1 u64 val = armv8pmu_read_evcntr(idx); u32 counter = ARMV8_IDX_TO_COUNTER(idx); // invalid counter = 30 read_pmevcntrn(counter) // undefined instruction Signed-off-by: Yang Jihong Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220902082918.179248-1-yangjihong1@huawei.com commit 42b998d4aa59b9dea51665e4f3be1d733c47e2bf Author: Christian Marangi Date: Sun Sep 4 23:53:19 2022 +0200 net: dsa: qca8k: fix NULL pointer dereference for of_device_get_match_data of_device_get_match_data is called on priv->dev before priv->dev is actually set. Move of_device_get_match_data after priv->dev is correctly set to fix this kernel panic. Fixes: 3bb0844e7bcd ("net: dsa: qca8k: cache match data to speed up access") Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220904215319.13070-1-ansuelsmth@gmail.com Signed-off-by: Paolo Abeni commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b Author: Neal Cardwell Date: Sat Sep 3 08:10:23 2022 -0400 tcp: fix early ETIMEDOUT after spurious non-SACK RTO Fix a bug reported and analyzed by Nagaraj Arankal, where the handling of a spurious non-SACK RTO could cause a connection to fail to clear retrans_stamp, causing a later RTO to very prematurely time out the connection with ETIMEDOUT. Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent report: (*1) Send one data packet on a non-SACK connection (*2) Because no ACK packet is received, the packet is retransmitted and we enter CA_Loss; but this retransmission is spurious. (*3) The ACK for the original data is received. The transmitted packet is acknowledged. The TCP timestamp is before the retrans_stamp, so tcp_may_undo() returns true, and tcp_try_undo_loss() returns true without changing state to Open (because tcp_is_sack() is false), and tcp_process_loss() returns without calling tcp_try_undo_recovery(). Normally after undoing a CA_Loss episode, tcp_fastretrans_alert() would see that the connection has returned to CA_Open and fall through and call tcp_try_to_open(), which would set retrans_stamp to 0. However, for non-SACK connections we hold the connection in CA_Loss, so do not fall through to call tcp_try_to_open() and do not set retrans_stamp to 0. So retrans_stamp is (erroneously) still non-zero. At this point the first "retransmission event" has passed and been recovered from. Any future retransmission is a completely new "event". However, retrans_stamp is erroneously still set. (And we are still in CA_Loss, which is correct.) (*4) After 16 minutes (to correspond with tcp_retries2=15), a new data packet is sent. Note: No data is transmitted between (*3) and (*4) and we disabled keep alives. The socket's timeout SHOULD be calculated from this point in time, but instead it's calculated from the prior "event" 16 minutes ago (step (*2)). (*5) Because no ACK packet is received, the packet is retransmitted. (*6) At the time of the 2nd retransmission, the socket returns ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) too far in the past (set at the time of (*2)). This commit fixes this bug by ensuring that we reuse in tcp_try_undo_loss() the same careful logic for non-SACK connections that we have in tcp_try_undo_recovery(). To avoid duplicating logic, we factor out that logic into a new tcp_is_non_sack_preventing_reopen() helper and call that helper from both undo functions. Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") Reported-by: Nagaraj Arankal Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gmail.com Signed-off-by: Paolo Abeni commit 37137ec26c2c03039d8064c00f6eae176841ee0d Author: Takashi Iwai Date: Tue Sep 6 11:03:19 2022 +0200 ALSA: hda: Once again fix regression of page allocations with IOMMU The last fix for trying to recover the regression on AMD platforms, unfortunately, leaded to yet another regression: it turned out that IOMMUs don't like the usage of raw page allocations. This is yet another attempt for addressing the log saga; at this time, we re-use the existing buffer allocation mechanism with SG-pages although we require only single pages. The SG buffer allocation itself was confirmed to work for stream buffers, so it's relatively easy to adapt for other places. The only problem is: although the HD-audio code is accessing the address directly via dmab->address field, SG-pages don't set up it. For the ease of adaption, we now set up the dmab->addr field from the address of the first page as default, so that it can run with the HD-audio driver code as-is without the excessive call of snd_sgbuf_get_addr() multiple times; that's the only change in the memalloc helper side. The rest is nothing but a flip of the dma_type field in the HD-audio side. Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again") Reported-by: Mikhail Gavrilov Tested-by: Mikhail Gavrilov Cc: Link: https://lore.kernel.org/r/CABXGCsO+kB2t5QyHY-rUe76npr1m0-5JOtt8g8SiHUo34ur7Ww@mail.gmail.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216112 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216363 Link: https://lore.kernel.org/r/20220906090319.23358-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit c0a454b9044fdc99486853aa424e5b3be2107078 Author: Mark Brown Date: Mon Sep 5 15:22:55 2022 +0100 arm64/bti: Disable in kernel BTI when cross section thunks are broken GCC does not insert a `bti c` instruction at the beginning of a function when it believes that all callers reach the function through a direct branch[1]. Unfortunately the logic it uses to determine this is not sufficiently robust, for example not taking account of functions being placed in different sections which may be loaded separately, so we may still see thunks being generated to these functions. If that happens, the first instruction in the callee function will result in a Branch Target Exception due to the missing landing pad. While this has currently only been observed in the case of modules having their main code loaded sufficiently far from their init section to require thunks it could potentially happen for other cases so the safest thing is to disable BTI for the kernel when building with an affected toolchain. [1]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671 Reported-by: D Scott Phillips [Bits of the commit message are lifted from his report & workaround] Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220905142255.591990-1-broonie@kernel.org Cc: # v5.10+ Signed-off-by: Will Deacon commit 2a906db2824b75444982f5e9df870106982afca8 Merge: 2eb502f496f77 6a6d9ecff14a2 Author: Tony Lindgren Date: Tue Sep 6 09:45:27 2022 +0300 Merge branch 'am5748-fix' into fixes commit 6a6d9ecff14a2a46c1deeffa3eb3825349639bdd Author: Romain Naour Date: Tue Aug 23 09:27:42 2022 +0200 ARM: dts: am5748: keep usb4_tm disabled Commit bcbb63b80284 ("ARM: dts: dra7: Separate AM57 dtsi files") disabled usb4_tm for am5748 devices since USB4 IP is not present in this SoC. The commit log explained the difference between AM5 and DRA7 families: AM5 and DRA7 SoC families have different set of modules in them so the SoC sepecific dtsi files need to be separated. e.g. Some of the major differences between AM576 and DRA76 DRA76x AM576x USB3 x USB4 x ATL x VCP x MLB x ISS x PRU-ICSS1 x PRU-ICSS2 x Then commit 176f26bcd41a ("ARM: dts: Add support for dra762 abz package") removed usb4_tm part from am5748.dtsi and introcuded new ti-sysc errors in dmesg: ti-sysc 48940000.target-module: clock get error for fck: -2 ti-sysc: probe of 48940000.target-module failed with error -2 Fixes: 176f26bcd41a ("ARM: dts: Add support for dra762 abz package") Signed-off-by: Romain Naour Signed-off-by: Romain Naour Message-Id: <20220823072742.351368-1-romain.naour@smile.fr> Reviewed-by: Roger Quadros Signed-off-by: Tony Lindgren commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf Author: Dongxiang Ke Date: Tue Sep 6 10:49:28 2022 +0800 ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai commit 8d44e6044a0e885acdd01813768a0b27906d64fd Author: Mohan Kumar Date: Mon Sep 5 22:54:20 2022 +0530 ALSA: hda/tegra: Align BDL entry to 4KB boundary AZA HW may send a burst read/write request crossing 4K memory boundary. The 4KB boundary is not guaranteed by Tegra HDA HW. Make SW change to include the flag AZX_DCAPS_4K_BDLE_BOUNDARY to align BDLE to 4K boundary. Signed-off-by: Mohan Kumar Link: https://lore.kernel.org/r/20220905172420.3801-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai commit 3770a42bb8ceb856877699257a43c0585a5d2996 Author: Sagi Grimberg Date: Mon Sep 5 18:07:06 2022 +0300 nvme-tcp: fix regression that causes sporadic requests to time out When we queue requests, we strive to batch as much as possible and also signal the network stack that more data is about to be sent over a socket with MSG_SENDPAGE_NOTLAST. This flag looks at the pending requests queued as well as queue->more_requests that is derived from the block layer last-in-batch indication. We set more_request=true when we flush the request directly from .queue_rq submission context (in nvme_tcp_send_all), however this is wrongly assuming that no other requests may be queued during the execution of nvme_tcp_send_all. Due to this, a race condition may happen where: 1. request X is queued as !last-in-batch 2. request X submission context calls nvme_tcp_send_all directly 3. nvme_tcp_send_all is preempted and schedules to a different cpu 4. request Y is queued as last-in-batch 5. nvme_tcp_send_all context sends request X+Y, however signals for both MSG_SENDPAGE_NOTLAST because queue->more_requests=true. ==> none of the requests is pushed down to the wire as the network stack is waiting for more data, both requests timeout. To fix this, we eliminate queue->more_requests and only rely on the queue req_list and send_list to be not-empty. Fixes: 122e5b9f3d37 ("nvme-tcp: optimize network stack with setting msg flags according to batch size") Reported-by: Jonathan Nicklin Signed-off-by: Sagi Grimberg Tested-by: Jonathan Nicklin Signed-off-by: Christoph Hellwig commit 160f3549a907a50e51a8518678ba2dcf2541abea Author: Sagi Grimberg Date: Mon Sep 5 13:54:17 2022 +0300 nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Reported-by: Daniel Wagner Signed-off-by: Sagi Grimberg Reviewed-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit b5a76cb38df779076a3cff624ce6a368d9bcf330 Author: Philippe Schenker Date: Thu Sep 1 12:01:51 2022 +0200 arm64: dts: imx8mm-verdin: extend pmic voltages Currently, we limited the voltages from the PMIC very strictly. This causes an issue with one Toradex SKU that uses a consumer-grade chip that is capable of going up to 1.8GHz at 1.00V. Extend the ranges to min/max values of the SoC operating ranges (table 10) in the datasheet. Detailed explanation as follows: BUCK2: - As already described above, the SKU with the consumer-grade chip needs a voltage of at least 1.00V. 1.05V is chosen now as this is listed as the maximum. Both industrial and consumer-grade chips have an absolute maximum rating of 1.15V which makes it still safe to put 1.05V - Lower the regulator-min value to the smallest value allowed from the Quad-A53, 1.2GHz version of the SoC BUCK3: - This regulator is used for SoC input voltages VDD_GPU, VDD_VPU and VDD_DRAM. - Use the smallest value of these three inputs as the regulator-min - Use the largest value of these three inputs as the regulator-max LDO2: - This LDO is used for VDD_SNVS_0P8 SoC input voltage. As this has a single nominal input voltage just put this in the middle of 0.8V. Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Philippe Schenker Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo commit 1f05f65bddd6958d25b133f886da49c1d4bff3fa Author: Alexandru Gagniuc Date: Mon Sep 5 09:28:04 2022 -0500 hwmon: (tps23861) fix byte order in resistance register The tps23861 registers are little-endian, and regmap_read_bulk() does not do byte order conversion. On BE machines, the bytes were swapped, and the interpretation of the resistance value was incorrect. To make it work on both big and little-endian machines, use le16_to_cpu() to convert the resitance register to host byte order. Signed-off-by: Alexandru Gagniuc Fixes: fff7b8ab22554 ("hwmon: add Texas Instruments TPS23861 driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220905142806.110598-1-mr.nuke.me@gmail.com Signed-off-by: Guenter Roeck commit 53e99dcff61e1523ec1c3628b2d564ba15d32eb7 Merge: 7e18e42e4b280 12f09234bde51 Author: Linus Torvalds Date: Mon Sep 5 17:44:48 2022 -0400 Merge tag 'soc-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "These are the expected fixes for the SoC tree. I have let the patches pile up a little too long, so this is bigger than I would have liked. - Minor build fixes for Broadcom STB and NXP i.MX8M SoCs as well\ as TEE firmware - Updates to the MAINTAINERS file for the PolarFire SoC - Minor DT fixes for Renesas White Hawk and Arm Versatile and Juno platforms - A fix for a missing dependnecy in the NXP DPIO driver - Broadcom BCA fixes to the newly added devicetree files - Multiple fixes for Microchip AT91 based SoCs, dealing with self-refresh timings and regulator settings in DT - Several DT fixes for NXP i.MX platforms, dealing with incorrect GPIO settings, extraneous nodes, and a wrong clock setting" * tag 'soc-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (45 commits) soc: fsl: select FSL_GUTS driver for DPIO ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time ARM: dts: at91: sama7g5ek: specify proper regulator output ranges ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh ARM: at91: pm: fix self-refresh for sama7g5 soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs ARM: configs: at91: remove CONFIG_MICROCHIP_PIT64B ARM: ixp4xx: fix typos in comments arm64: dts: renesas: r8a779g0: Fix HSCIF0 interrupt number tee: fix compiler warning in tee_shm_register() arm64: dts: freescale: verdin-imx8mp: fix atmel_mxt_ts reset polarity arm64: dts: freescale: verdin-imx8mm: fix atmel_mxt_ts reset polarity arm64: dts: imx8mp: Fix I2C5 GPIO assignment on i.MX8M Plus DHCOM arm64: dts: imx8mm-venice-gw7901: fix port/phy validation arm64: dts: verdin-imx8mm: add otg2 pd to usbphy soc: imx: gpcv2: Assert reset before ungating clock arm64: dts: ls1028a-qds-65bb: don't use in-band autoneg for 2500base-x ... commit 4fa07edbb7eacfb56b3aa64f590e9f38e7f1042c Author: Jiapeng Chong Date: Mon Sep 5 10:04:36 2022 +0800 io_uring/notif: Remove the unused function io_notif_complete() The function io_notif_complete() is defined in the notif.c file, but not called elsewhere, so delete this unused function. io_uring/notif.c:24:20: warning: unused function 'io_notif_complete' [-Wunused-function]. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2047 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20220905020436.51894-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Jens Axboe commit f0880e2cb7e1f8039a048fdd01ce45ab77247221 Author: Vitaly Kuznetsov Date: Sat Aug 27 15:03:45 2022 +0200 Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region Passed through PCI device sometimes misbehave on Gen1 VMs when Hyper-V DRM driver is also loaded. Looking at IOMEM assignment, we can see e.g. $ cat /proc/iomem ... f8000000-fffbffff : PCI Bus 0000:00 f8000000-fbffffff : 0000:00:08.0 f8000000-f8001fff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe ... fe0000000-fffffffff : PCI Bus 0000:00 fe0000000-fe07fffff : bb8c4f33-2ba2-4808-9f7f-02f3b4da22fe fe0000000-fe07fffff : 2ba2:00:02.0 fe0000000-fe07fffff : mlx4_core the interesting part is the 'f8000000' region as it is actually the VM's framebuffer: $ lspci -v ... 0000:00:08.0 VGA compatible controller: Microsoft Corporation Hyper-V virtual VGA (prog-if 00 [VGA controller]) Flags: bus master, fast devsel, latency 0, IRQ 11 Memory at f8000000 (32-bit, non-prefetchable) [size=64M] ... hv_vmbus: registering driver hyperv_drm hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Synthvid Version major 3, minor 5 hyperv_drm 0000:00:08.0: vgaarb: deactivate vga console hyperv_drm 0000:00:08.0: BAR 0: can't reserve [mem 0xf8000000-0xfbffffff] hyperv_drm 5620e0c7-8062-4dce-aeb7-520c7ef76171: [drm] Cannot request framebuffer, boot fb still active? Note: "Cannot request framebuffer" is not a fatal error in hyperv_setup_gen1() as the code assumes there's some other framebuffer device there but we actually have some other PCI device (mlx4 in this case) config space there! The problem appears to be that vmbus_allocate_mmio() can use dedicated framebuffer region to serve any MMIO request from any device. The semantics one might assume of a parameter named "fb_overlap_ok" aren't implemented because !fb_overlap_ok essentially has no effect. The existing semantics are really "prefer_fb_overlap". This patch implements the expected and needed semantics, which is to not allocate from the frame buffer space when !fb_overlap_ok. Note, Gen2 VMs are usually unaffected by the issue because framebuffer region is already taken by EFI fb (in case kernel supports it) but Gen1 VMs may have this region unclaimed by the time Hyper-V PCI pass-through driver tries allocating MMIO space if Hyper-V DRM/FB drivers load after it. Devices can be brought up in any sequence so let's resolve the issue by always ignoring 'fb_mmio' region for non-FB requests, even if the region is unclaimed. Reviewed-by: Michael Kelley Signed-off-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20220827130345.1320254-4-vkuznets@redhat.com Signed-off-by: Wei Liu commit 2a8a8afba0c3053d0ea8686182f6b2104293037e Author: Vitaly Kuznetsov Date: Sat Aug 27 15:03:44 2022 +0200 Drivers: hv: Always reserve framebuffer region for Gen1 VMs vmbus_reserve_fb() tries reserving framebuffer region iff 'screen_info.lfb_base' is set. Gen2 VMs seem to have it set by EFI and/or by the kernel EFI FB driver (or, in some edge cases like kexec, the address where the buffer was moved, see https://lore.kernel.org/all/20201014092429.1415040-1-kasong@redhat.com/) but on Gen1 VM it depends on bootloader behavior. With grub, it depends on 'gfxpayload=' setting but in some cases it is observed to be zero. That being said, relying on 'screen_info.lfb_base' to reserve framebuffer region is risky. For Gen1 VMs, it should always be possible to get the address from the dedicated PCI device instead. Check for legacy PCI video device presence and reserve the whole region for framebuffer on Gen1 VMs. Reviewed-by: Michael Kelley Signed-off-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20220827130345.1320254-3-vkuznets@redhat.com Signed-off-by: Wei Liu commit 8409fe92d88c332923130149fe209d1c882b286e Author: Vitaly Kuznetsov Date: Sat Aug 27 15:03:43 2022 +0200 PCI: Move PCI_VENDOR_ID_MICROSOFT/PCI_DEVICE_ID_HYPERV_VIDEO definitions to pci_ids.h There are already three places in kernel which define PCI_VENDOR_ID_MICROSOFT and two for PCI_DEVICE_ID_HYPERV_VIDEO and there's a need to use these from core VMBus code. Move the defines where they belong. No functional change. Reviewed-by: Michael Kelley Acked-by: Bjorn Helgaas # pci_ids.h Signed-off-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20220827130345.1320254-2-vkuznets@redhat.com Signed-off-by: Wei Liu commit 2258954234db7530e9d86bb32cd6ad54485ff926 Author: Zhou jie Date: Tue Aug 23 11:45:52 2022 +0800 tools: hv: kvp: remove unnecessary (void*) conversions Remove unnecessary void* type casting. Signed-off-by: Zhou jie Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20220823034552.8596-1-zhoujie@nfschina.com Signed-off-by: Wei Liu commit 676576d164b34a98589a9efee85f57240c07fef3 Author: Shaomin Deng Date: Sun Sep 4 11:48:08 2022 -0400 Drivers: hv: remove duplicate word in a comment Signed-off-by: Shaomin Deng Link: https://lore.kernel.org/r/20220904154808.26022-1-dengshaomin@cdjrlc.com Signed-off-by: Wei Liu commit 2f44013e39984c127c6efedf70e6b5f4e9dcf315 Author: Gao Xiang Date: Fri Sep 2 12:57:10 2022 +0800 erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIG_SMP disabled, KASAN reports as below: ================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789 CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90 The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing. Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead. Fixes: 73f5c66df3e2 ("staging: erofs: fix `erofs_workgroup_{try_to_freeze, unfreeze}'") Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220902045710.109530-1-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit ea0b7b0d59e81a9c1bc03f8696bb04851bc2ad22 Author: Yue Hu Date: Fri Aug 12 14:01:50 2022 +0800 erofs: avoid the potentially wrong m_plen for big pcluster Actually, 'compressedlcs' stores compressed block count rather than lcluster count. Therefore, the number of bits for shifting the count should be 'LOG_BLOCK_SIZE' rather than 'lclusterbits' although current lcluster size is 4K. The value of 'm_plen' will be wrong once we enable the non 4K-sized lcluster. Signed-off-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220812060150.8510-1-huyue2@coolpad.com Signed-off-by: Gao Xiang commit 5bd9628b784cc5e38e1c7ebb680bbd6ee741230e Author: Sun Ke Date: Mon Aug 15 11:48:29 2022 +0800 erofs: fix error return code in erofs_fscache_{meta_,}read_folio If erofs_fscache_alloc_request fail and then goto out, it will return 0. it should return a negative error code instead of 0. Fixes: d435d53228dd ("erofs: change to use asynchronous io for fscache readpage/readahead") Signed-off-by: Sun Ke Reviewed-by: Jingbo Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220815034829.3940803-1-sunke32@huawei.com Signed-off-by: Gao Xiang commit 8cbb2b50ee2dcb082675237eaaa48fe8479f8aa5 Author: Sebastian Andrzej Siewior Date: Thu Aug 25 10:25:05 2022 +0200 asm-generic: Conditionally enable do_softirq_own_stack() via Kconfig. Remove the CONFIG_PREEMPT_RT symbol from the ifdef around do_softirq_own_stack() and move it to Kconfig instead. Enable softirq stacks based on SOFTIRQ_ON_OWN_STACK which depends on HAVE_SOFTIRQ_ON_OWN_STACK and its default value is set to !PREEMPT_RT. This ensures that softirq stacks are not used on PREEMPT_RT and avoids a 'select' statement on an option which has a 'depends' statement. Link: https://lore.kernel.org/YvN5E%2FPrHfUhggr7@linutronix.de Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Arnd Bergmann commit beb432528c79e9613c85d250295288ef4beb14d7 Merge: 1621e70fc79d7 be318363daa29 Author: David S. Miller Date: Mon Sep 5 14:43:18 2022 +0100 Merge tag 'for-net-2022-09-02' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix regression preventing ACL packet transmission ==================== Signed-off-by: David S. Miller commit 6ca64ac2763149fb66c0b4bf12f5e0977a88e51d Author: Johannes Thumshirn Date: Mon Sep 5 05:38:24 2022 -0700 btrfs: zoned: fix mounting with conventional zones Since commit 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes"), we're only counting the bytes of a block group on an active zone as usable for metadata writes. But on a SMR drive, we don't have active zones and short circuit some of the logic. This leads to an error on mount, because we cannot reserve space for metadata writes. Fix this by also setting the BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE bit in the block-group's runtime flag if the zone is a conventional zone. Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit cac5c44c48c9fb9cc31bea15ebd9ef0c6462314f Author: Shin'ichiro Kawasaki Date: Fri Aug 26 16:42:15 2022 +0900 btrfs: zoned: set pseudo max append zone limit in zone emulation mode The commit 7d7672bc5d10 ("btrfs: convert count_max_extents() to use fs_info->max_extent_size") introduced a division by fs_info->max_extent_size. This max_extent_size is initialized with max zone append limit size of the device btrfs runs on. However, in zone emulation mode, the device is not zoned then its zone append limit is zero. This resulted in zero value of fs_info->max_extent_size and caused zero division error. Fix the error by setting non-zero pseudo value to max append zone limit in zone emulation mode. Set the pseudo value based on max_segments as suggested in the commit c2ae7b772ef4 ("btrfs: zoned: revive max_zone_append_bytes"). Fixes: 7d7672bc5d10 ("btrfs: convert count_max_extents() to use fs_info->max_extent_size") CC: stable@vger.kernel.org # 5.12+ Reviewed-by: Johannes Thumshirn Reviewed-by: Naohiro Aota Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: David Sterba commit d5b81ced74afded85619ffbbe9c32ba9d82c9b1e Author: Naohiro Aota Date: Wed Aug 31 13:55:48 2022 +0900 btrfs: zoned: fix API misuse of zone finish waiting The commit 2ce543f47843 ("btrfs: zoned: wait until zone is finished when allocation didn't progress") implemented a zone finish waiting mechanism to the write path of zoned mode. However, using wait_var_event()/wake_up_all() on fs_info->zone_finish_wait is wrong and wait_var_event() just hangs because no one ever wakes it up once it goes into sleep. Instead, we can simply use wait_on_bit_io() and clear_and_wake_up_bit() on fs_info->flags with a proper barrier installed. Fixes: 2ce543f47843 ("btrfs: zoned: wait until zone is finished when allocation didn't progress") CC: stable@vger.kernel.org # 5.16+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 1621e70fc79d77dfeef4e4ba90e125405a274db3 Author: Christophe JAILLET Date: Fri Sep 2 18:26:56 2022 +0200 stmmac: intel: Simplify intel_eth_pci_remove() There is no point to call pcim_iounmap_regions() in the remove function, this frees a managed resource that would be release by the framework anyway. Signed-off-by: Christophe JAILLET Reviewed-by: Andy Shevchenko Signed-off-by: David S. Miller commit fe2c9c61f668cde28dac2b188028c5299cedcc1e Author: Greg Kroah-Hartman Date: Fri Sep 2 15:41:11 2022 +0200 net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up to be much simpler logic and only create the root debugfs directory once when the driver is first accessed. That resolves the memory leak and makes things more obvious as to what the intent is. Cc: Marcin Wojtas Cc: Russell King Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Cc: stable Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") Signed-off-by: Greg Kroah-Hartman Signed-off-by: David S. Miller commit 51bdc8bb82525cd70feb92279c8b7660ad7948dd Author: Takashi Iwai Date: Mon Sep 5 15:06:30 2022 +0200 ALSA: hda/sigmatel: Fix unused variable warning for beep power change The newly added stac_check_power_status() caused a compile warning when CONFIG_SND_HDA_INPUT_BEEP is disabled. Fix it. Fixes: 414d38ba8710 ("ALSA: hda/sigmatel: Keep power up while beep is enabled") Reported-by: kernel test robot Link: https://lore.kernel.org/r/20220905130630.2845-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 Author: Bart Van Assche Date: Fri Aug 12 14:03:17 2022 -0700 nvmet: fix a use-after-free Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 Cc: stable@vger.kernel.org Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Bart Van Assche Signed-off-by: Christoph Hellwig commit 8423f0b6d513b259fdab9c9bf4aaa6188d054c2d Author: Takashi Iwai Date: Mon Sep 5 08:07:14 2022 +0200 ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant. Reported-and-tested-by: butt3rflyh4ck Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA@mail.gmail.com Link: https://lore.kernel.org/r/20220905060714.22549-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit bc7a2c9b17773c89f2f9c09ac9f9233716d6cd08 Author: Wenpeng Liang Date: Mon Sep 5 10:38:15 2022 +0800 MAINTAINERS: Update maintainers of HiSilicon RoCE Weihang has moved to work in other technical areas, and Haoyue will maintain this module instead of him. Signed-off-by: Wenpeng Liang Link: https://lore.kernel.org/r/20220905023815.1477684-1-liangwenpeng@huawei.com Signed-off-by: Leon Romanovsky commit 9b7d4be967f16f79a2283b2338709fcc750313ee Author: Maor Gottlieb Date: Mon Aug 29 12:02:29 2022 +0300 RDMA/mlx5: Fix UMR cleanup on error flow of driver init The cited commit removed from the cleanup flow of umr the checks if the resources were created. This could lead to null-ptr-deref in case that we had failure in mlx5_ib_stage_ib_reg_init stage. Fix it by adding new state to the umr that can say if the resources were created or not and check it in the umr cleanup flow before destroying the resources. Fixes: 04876c12c19e ("RDMA/mlx5: Move init and cleanup of UMR to umr.c") Reviewed-by: Michael Guralnik Signed-off-by: Maor Gottlieb Link: https://lore.kernel.org/r/4cfa61386cf202e9ce330e8d228ce3b25a36326e.1661763459.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 74b30b3ad5cec95d2647e796d10137438a098bc1 Author: Chris Mi Date: Mon Aug 29 12:02:28 2022 +0300 RDMA/mlx5: Set local port to one when accessing counters When accessing Ports Performance Counters Register (PPCNT), local port must be one if it is Function-Per-Port HCA that HCA_CAP.num_ports is 1. The offending patch can change the local port to other values when accessing PPCNT after enabling switchdev mode. The following syndrome will be printed: # cat /sys/class/infiniband/rdmap4s0f0/ports/2/counters/* # dmesg mlx5_core 0000:04:00.0: mlx5_cmd_check:756:(pid 12450): ACCESS_REG(0x805) op_mod(0x1) failed, status bad parameter(0x3), syndrome (0x1e5585) Fix it by setting local port to one for Function-Per-Port HCA. Fixes: 210b1f78076f ("IB/mlx5: When not in dual port RoCE mode, use provided port as native") Reviewed-by: Mark Bloch Signed-off-by: Chris Mi Link: https://lore.kernel.org/r/6c5086c295c76211169e58dbd610fb0402360bab.1661763459.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 9ca05b0f27de928be121cccf07735819dc9e1ed3 Author: Maher Sanalla Date: Mon Aug 29 12:02:27 2022 +0300 RDMA/mlx5: Rely on RoCE fw cap instead of devlink when setting profile When the RDMA auxiliary driver probes, it sets its profile based on devlink driverinit value. The latter might not be in sync with FW yet (In case devlink reload is not performed), thus causing a mismatch between RDMA driver and FW. This results in the following FW syndrome when the RDMA driver tries to adjust RoCE state, which fails the probe: "0xC1F678 | modify_nic_vport_context: roce_en set on a vport that doesn't support roce" To prevent this, select the PF profile based on FW RoCE capability instead of relying on devlink driverinit value. To provide backward compatibility of the RoCE disable feature, on older FW's where roce_rw is not set (FW RoCE capability is read-only), keep the current behavior e.g., rely on devlink driverinit value. Fixes: fbfa97b4d79f ("net/mlx5: Disable roce at HCA level") Reviewed-by: Shay Drory Reviewed-by: Michael Guralnik Reviewed-by: Saeed Mahameed Signed-off-by: Maher Sanalla Link: https://lore.kernel.org/r/cb34ce9a1df4a24c135cb804db87f7d2418bd6cc.1661763459.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 85eaeb5058f0f04dffb124c97c86b4f18db0b833 Author: Yishai Hadas Date: Wed Aug 24 09:10:36 2022 +0300 IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by using mmput_async(). From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be available. [1] [64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: 2 flags:0x00004000 [64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] [64843.077719] Call Trace: [64843.077722] [64843.077724] __schedule+0x23d/0x590 [64843.077729] schedule+0x4e/0xb0 [64843.077735] schedule_preempt_disabled+0xe/0x10 [64843.077740] __mutex_lock.constprop.0+0x263/0x490 [64843.077747] __mutex_lock_slowpath+0x13/0x20 [64843.077752] mutex_lock+0x34/0x40 [64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] [64843.077808] __mmu_notifier_release+0x1a4/0x200 [64843.077816] exit_mmap+0x1bc/0x200 [64843.077822] ? walk_page_range+0x9c/0x120 [64843.077828] ? __cond_resched+0x1a/0x50 [64843.077833] ? mutex_lock+0x13/0x40 [64843.077839] ? uprobe_clear_state+0xac/0x120 [64843.077860] mmput+0x5f/0x140 [64843.077867] ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core] [64843.077931] pagefault_real_mr+0x9a/0x140 [mlx5_ib] [64843.077962] pagefault_mr+0xb4/0x550 [mlx5_ib] [64843.077992] pagefault_single_data_segment.constprop.0+0x2ac/0x560 [mlx5_ib] [64843.078022] mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib] [64843.078051] process_one_work+0x22b/0x3d0 [64843.078059] worker_thread+0x53/0x410 [64843.078065] ? process_one_work+0x3d0/0x3d0 [64843.078073] kthread+0x12a/0x150 [64843.078079] ? set_kthread_struct+0x50/0x50 [64843.078085] ret_from_fork+0x22/0x30 [64843.078093] Fixes: 36f30e486dce ("IB/core: Improve ODP to use hmm_range_fault()") Reviewed-by: Maor Gottlieb Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/74d93541ea533ef7daec6f126deb1072500aeb16.1661251841.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky commit 766a96dc558385be735a370db867e302c8f22153 Author: Alan Stern Date: Thu Sep 1 10:36:34 2022 -0400 USB: core: Fix RST error in hub.c A recent commit added an invalid RST expression to a kerneldoc comment in hub.c. The fix is trivial. Fixes: 9c6d778800b9 ("USB: core: Prevent nested device-reset calls") Cc: Reported-by: Stephen Rothwell Reviewed-by: Bagas Sanjaya Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YxDDcsLtRZ7c20pq@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit c2e406596571659451f4b95e37ddfd5a8ef1d0dc Author: Greg Kroah-Hartman Date: Fri Sep 2 14:31:07 2022 +0200 sched/debug: fix dentry leak in update_sched_domain_debugfs Kuyo reports that the pattern of using debugfs_remove(debugfs_lookup()) leaks a dentry and with a hotplug stress test, the machine eventually runs out of memory. Fix this up by using the newly created debugfs_lookup_and_remove() call instead which properly handles the dentry reference counting logic. Cc: Major Chen Cc: stable Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Daniel Bristot de Oliveira Cc: Valentin Schneider Cc: Matthias Brugger Reported-by: Kuyo Chang Tested-by: Kuyo Chang Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20220902123107.109274-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit dec9b2f1e0455a151a7293c367da22ab973f713e Author: Greg Kroah-Hartman Date: Fri Sep 2 16:59:15 2022 +0200 debugfs: add debugfs_lookup_and_remove() There is a very common pattern of using debugfs_remove(debufs_lookup(..)) which results in a dentry leak of the dentry that was looked up. Instead of having to open-code the correct pattern of calling dput() on the dentry, create debugfs_lookup_and_remove() to handle this pattern automatically and properly without any memory leaks. Cc: stable Reported-by: Kuyo Chang Tested-by: Kuyo Chang Link: https://lore.kernel.org/r/YxIaQ8cSinDR881k@kroah.com Signed-off-by: Greg Kroah-Hartman commit 5666a274a6d54372d6b79b1f78682a9d827e679e Author: Greg Kroah-Hartman Date: Thu Sep 1 18:37:34 2022 +0200 driver core: fix driver_set_override() issue with empty strings Python likes to send an empty string for some sysfs files, including the driver_override field. When commit 23d99baf9d72 ("PCI: Use driver_set_override() instead of open-coding") moved the PCI core to use the driver core function instead of hand-rolling their own handler, this showed up as a regression from some userspace tools, like DPDK. Fix this up by actually looking at the length of the string first instead of trusting that userspace got it correct. Fixes: 23d99baf9d72 ("PCI: Use driver_set_override() instead of open-coding") Cc: Krzysztof Kozlowski Cc: Bjorn Helgaas Cc: "Rafael J. Wysocki" Cc: Andy Shevchenko Cc: stable Reported-by: Stephen Hemminger Tested-by: Huisong Li Reviewed-by: Stephen Hemminger Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220901163734.3583106-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit ea89926d9690f055fd8da929f6621a760e8e0f14 Author: Fabio Estevam Date: Sat Aug 27 14:51:40 2022 -0300 arm64: dts: rockchip: Remove 'enable-active-low' from rk3566-quartz64-a The 'enable-active-low' property is not a valid one. Only 'enable-active-high' is valid, and when this property is absent the gpio regulator will act as active low by default. Remove the invalid 'enable-active-low' property. Fixes: b33a22a1e7c4 ("arm64: dts: rockchip: add basic dts for Pine64 Quartz64-A") Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20220827175140.1696699-2-festevam@denx.de Signed-off-by: Heiko Stuebner commit a994b34b9abb9c08ee09e835b4027ff2147f9d94 Author: Fabio Estevam Date: Sat Aug 27 14:51:39 2022 -0300 arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma The 'enable-active-low' property is not a valid one. Only 'enable-active-high' is valid, and when this property is absent the gpio regulator will act as active low by default. Remove the invalid 'enable-active-low' property. Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM") Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20220827175140.1696699-1-festevam@denx.de Signed-off-by: Heiko Stuebner commit 1988e3ef0544bbe54cffa4ec30a5883e5a08c2b6 Author: Michael Riesch Date: Mon Sep 5 08:43:35 2022 +0200 arm64: dts: rockchip: fix property for usb2 phy supply on rk3568-evb1-v10 The property "vbus-supply" was copied from the vendor kernel but is not available in mainstream. Use correct property "phy-supply". Fixes: d6cfb110b0fd ("arm64: dts: rockchip: add usb3 support to rk3568-evb1-v10") Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20220905064335.104650-2-michael.riesch@wolfvision.net Signed-off-by: Heiko Stuebner commit 43e1d6d3b45c4e7e25171ec04a10d09969b0f889 Author: Michael Riesch Date: Mon Sep 5 08:43:34 2022 +0200 arm64: dts: rockchip: fix property for usb2 phy supply on rock-3a The property "vbus-supply" was copied from the vendor kernel but is not available in mainstream. Use correct property "phy-supply". Fixes: 254a1f6a29e7 ("arm64: dts: rockchip: add usb3 support to the radxa rock3 model a") Signed-off-by: Michael Riesch Link: https://lore.kernel.org/r/20220905064335.104650-1-michael.riesch@wolfvision.net Signed-off-by: Heiko Stuebner commit 84a53580c5d2138c7361c7c3eea5b31827e63b35 Author: David Lebrun Date: Fri Sep 2 10:45:06 2022 +0100 ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual length of the SECRET attribute, it is possible to provide invalid combinations (e.g., secret = "", secretlen = 64). This case is not checked in the code and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=, info=) at net/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600, extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 , family=, family=) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00, family=0xffffffff82fef6c0 ) at net/netlink/genetlink.c:775 #3 genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 ) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=, msg=0xffffc90000ba7e48, len=) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end $1 = 0xffff88800b1b76c0 (gdb) p/x secret $2 = 0xffff88800b1b76c0 (gdb) p slen $3 = 64 '@' The OOB data can then be read back from userspace by dumping HMAC state. This commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET. Reported-by: Lucas Leong Tested: verified that EINVAL is correctly returned when secretlen > len(secret) Fixes: 4f4853dc1c9c1 ("ipv6: sr: implement API to control SR HMAC structure") Signed-off-by: David Lebrun Signed-off-by: David S. Miller commit 060ad609fa38e9a62fd5f79d0aaf83f94e6f0e36 Merge: c90714017cb3f 592335a4164c3 Author: David S. Miller Date: Mon Sep 5 10:07:05 2022 +0100 Merge branch 'bonding-fixes' Hangbin Liu says: ==================== bonding: fix lladdr finding and confirmation This patch set fixed 3 issues when setting lladdr as bonding IPv6 target. Please see each patch for the details. v2: separate the patch to 3 parts ==================== Signed-off-by: David S. Miller commit 592335a4164c3c41f57967223a1e1efe3a0c6eb3 Author: Hangbin Liu Date: Tue Aug 30 17:37:22 2022 +0800 bonding: accept unsolicited NA message The unsolicited NA message with all-nodes multicast dest address should be valid, as this also means the link could reach the target. Also rename bond_validate_ns() to bond_validate_na(). Reported-by: LiLiang Fixes: 5e1eeef69c0f ("bonding: NS target should accept link local address") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit fd16eb948ea8b28afb03e11a5b11841e6ac2aa2b Author: Hangbin Liu Date: Tue Aug 30 17:37:21 2022 +0800 bonding: add all node mcast address when slave up When a link is enslave to bond, it need to set the interface down first. This makes the slave remove mac multicast address 33:33:00:00:00:01(The IPv6 multicast address ff02::1 is kept even when the interface down). When bond set the slave up, ipv6_mc_up() was not called due to commit c2edacf80e15 ("bonding / ipv6: no addrconf for slaves separately from master"). This is not an issue before we adding the lladdr target feature for bonding, as the mac multicast address will be added back when bond interface up and join group ff02::1. But after adding lladdr target feature for bonding. When user set a lladdr target, the unsolicited NA message with all-nodes multicast dest will be dropped as the slave interface never add 33:33:00:00:00:01 back. Fix this by calling ipv6_mc_up() to add 33:33:00:00:00:01 back when the slave interface up. Reported-by: LiLiang Fixes: 5e1eeef69c0f ("bonding: NS target should accept link local address") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit b7f14132bf58256e841774ae07d3ffb7a841c2bc Author: Hangbin Liu Date: Tue Aug 30 17:37:20 2022 +0800 bonding: use unspecified address if no available link local address When ns_ip6_target was set, the ipv6_dev_get_saddr() will be called to get available source address and send IPv6 neighbor solicit message. If the target is global address, ipv6_dev_get_saddr() will get any available src address. But if the target is link local address, ipv6_dev_get_saddr() will only get available address from our interface, i.e. the corresponding bond interface. But before bond interface up, all the address is tentative, while ipv6_dev_get_saddr() will ignore tentative address. This makes we can't find available link local src address, then bond_ns_send() will not be called and no NS message was sent. Finally bond interface will keep in down state. Fix this by sending NS with unspecified address if there is no available source address. Reported-by: LiLiang Fixes: 5e1eeef69c0f ("bonding: NS target should accept link local address") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit e0f1b21c504f050de83922dd49e6a425dad2d518 Author: Shravya Kumbham Date: Tue May 24 13:19:13 2022 +0530 dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning Typecast the flags variable with (enum dma_ctrl_flags) in zynqmp_dma_prep_memcpy function to fix the coverity warning. Addresses-Coverity: Event mixed_enum_type. Signed-off-by: Shravya Kumbham Signed-off-by: Harini Katakam Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1653378553-28548-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Vinod Koul commit f9fdb0b86f087c2b7f6c6168dd0985a3c1eda87e Author: Liang He Date: Wed Jul 20 15:32:34 2022 +0800 dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() We should call of_node_put() for the reference returned by of_parse_phandle() in fail path or when it is not used anymore. Here we only need to move the of_node_put() before the check. Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") Signed-off-by: Liang He Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20220720073234.1255474-1-windhl@126.com Signed-off-by: Vinod Koul commit 5fa383a25fd8a16a73485c90da4e3e33a78b45cf Author: Peng Fan Date: Wed Aug 31 22:25:49 2022 +0800 arm64: dts: imx8ulp: add #reset-cells for pcc The binding file clock/imx8ulp-pcc-clock.yaml indicates '#reset-cells' is a required property, add it. Fixes: fe6291e96313 ("arm64: dts: imx8ulp: Add the basic dtsi file for imx8ulp") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit d707ff3470c22c8dc897b2ad4626749813cea913 Author: Alexander Stein Date: Fri Sep 2 10:20:15 2022 +0200 arm64: dts: tqma8mpxl-ba8mpxl: Fix button GPIOs They were in wrong order, so fix it by switching them. Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 347155d1fa85972ac19d1bf58ae3f3ce95e51a5d Author: Marco Felsch Date: Fri Aug 26 21:04:48 2022 +0200 arm64: dts: imx8mn: remove GPU power domain reset The PGC (power gating controller) already handles the reset for the GPUMIX power domain. By specifying it within the device tree the reset it issued a 2nd time. This confuses the hardware during power up and sporadically hangs the SoC. Fix this by removing the reset property and let the hardware handle the reset. Fixes: 9a0f3b157e22e ("arm64: dts: imx8mn: Enable GPU") Signed-off-by: Marco Felsch Signed-off-by: Lucas Stach Tested-by: Adam Ford Signed-off-by: Shawn Guo commit 7e18e42e4b280c85b76967a9106a13ca61c16179 Author: Linus Torvalds Date: Sun Sep 4 13:10:01 2022 -0700 Linux 6.0-rc4 commit 5995497296ade7716c8e70899e02235f2b6d9f5d Merge: 685ed983e2dc3 6cf07810e9ef8 Author: Linus Torvalds Date: Sun Sep 4 11:33:22 2022 -0700 Merge tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix handling of PCI domains in /proc on 32-bit systems using the recently added support for numbering buses from zero for each domain. - A fix and a revert for some changes to use READ/WRITE_ONCE() which caused problems with KASAN enabled due to sanitisation calls being introduced in low-level paths that can't cope with it. - Fix build errors on 32-bit caused by the syscall table being misaligned sometimes. - Two fixes to get IBM Cell native machines booting again, which had bit-rotted while my QS22 was temporarily out of action. - Fix the papr_scm driver to not assume the order of events returned by the hypervisor is stable, and a related compile fix. Thanks to Aneesh Kumar K.V, Christophe Leroy, Jordan Niethe, Kajol Jain, Masahiro Yamada, Nathan Chancellor, Pali Rohár, Vaibhav Jain, and Zhouyi Zhou. * tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/papr_scm: Ensure rc is always initialized in papr_scm_pmu_register() Revert "powerpc/irq: Don't open code irq_soft_mask helpers" powerpc: Fix hard_irq_disable() with sanitizer powerpc/rtas: Fix RTAS MSR[HV] handling for Cell Revert "powerpc: Remove unused FW_FEATURE_NATIVE references" powerpc: align syscall table for ppc32 powerpc/pci: Enable PCI domains in /proc when PCI bus numbers are not unique powerpc/papr_scm: Fix nvdimm event mappings commit 685ed983e2dc330680a076a1fd37ebe04017df91 Merge: b0839b281c427 29250ba51bc1c Author: Linus Torvalds Date: Sun Sep 4 11:27:14 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "s390: - PCI interpretation compile fixes RISC-V: - fix unused variable warnings in vcpu_timer.c - move extern sbi_ext declarations to a header x86: - check validity of argument to KVM_SET_MP_STATE - use guest's global_ctrl to completely disable guest PEBS - fix a memory leak on memory allocation failure - mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES - fix build failure with Clang integrated assembler - fix MSR interception - always flush TLBs when enabling dirty logging" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: check validity of argument to KVM_SET_MP_STATE perf/x86/core: Completely disable guest PEBS via guest's global_ctrl KVM: x86: fix memoryleak in kvm_arch_vcpu_create() KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES KVM: s390: pci: Hook to access KVM lowlevel from VFIO riscv: kvm: move extern sbi_ext declarations to a header riscv: kvm: vcpu_timer: fix unused variable warnings KVM: selftests: Fix ambiguous mov in KVM_ASM_SAFE() KVM: selftests: Fix KVM_EXCEPTION_MAGIC build with Clang KVM: VMX: Heed the 'msr' argument in msr_write_intercepted() kvm: x86: mmu: Always flush TLBs when enabling dirty logging kvm: x86: mmu: Drop the need_remote_flush() function commit b0839b281c427e844143dba3893e25c83cdd6c17 Author: Nick Desaulniers Date: Thu Sep 1 10:59:13 2022 -0700 Makefile.extrawarn: re-enable -Wformat for clang; take 2 -Wformat was recently re-enabled for builds with clang, then quickly re-disabled, due to concerns stemming from the frequency of default argument promotion related warning instances. commit 258fafcd0683 ("Makefile.extrawarn: re-enable -Wformat for clang") commit 21f9c8a13bb2 ("Revert "Makefile.extrawarn: re-enable -Wformat for clang"") ISO WG14 has ratified N2562 to address default argument promotion explicitly for printf, as part of the upcoming ISO C2X standard. The behavior of clang was changed in clang-16 to not warn for the cited cases in all language modes. Add a version check, so that users of clang-16 now get the full effect of -Wformat. For older clang versions, re-enable flags under the -Wformat group that way users still get some useful checks related to format strings, without noisy default argument promotion warnings. I intentionally omitted -Wformat-y2k and -Wformat-security from being re-enabled, which are also part of -Wformat in clang-16. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Link: https://github.com/llvm/llvm-project/issues/57102 Link: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2562.pdf Suggested-by: Justin Stitt Suggested-by: Nathan Chancellor Suggested-by: Youngmin Nam Signed-off-by: Nick Desaulniers Reviewed-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 Author: Swati Agarwal Date: Wed Aug 17 11:41:25 2022 +0530 dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure The driver does not handle the failure case while calling dma_set_mask_and_coherent API. In case of failure, capture the return value of API and then report an error. Addresses-coverity: Unchecked return value (CHECKED_RETURN) Signed-off-by: Swati Agarwal Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/20220817061125.4720-4-swati.agarwal@xilinx.com Signed-off-by: Vinod Koul commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 Author: Swati Agarwal Date: Wed Aug 17 11:41:24 2022 +0530 dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property Free the allocated resources for missing xlnx,num-fstores property. Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20220817061125.4720-3-swati.agarwal@xilinx.com Signed-off-by: Vinod Koul commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d Author: Swati Agarwal Date: Wed Aug 17 11:41:23 2022 +0530 dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling Add missing cleanup in devm_platform_ioremap_resource(). When probe fails remove dma channel resources and disable clocks in accordance with the order of resources allocated . Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com Signed-off-by: Vinod Koul commit 8123437cf46ea5a0f6ca5cb3c528d8b6db97b9c2 Author: zain wang Date: Tue Aug 30 13:16:17 2022 -0700 arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz We've found the AUX channel to be less reliable with PCLK_EDP at a higher rate (typically 25 MHz). This is especially important on systems with PSR-enabled panels (like Gru-Kevin), since we make heavy, constant use of AUX. According to Rockchip, using any rate other than 24 MHz can cause "problems between syncing the PHY an PCLK", which leads to all sorts of unreliabilities around register operations. Fixes: d67a38c5a623 ("arm64: dts: rockchip: move core edp from rk3399-kevin to shared chromebook") Reviewed-by: Douglas Anderson Signed-off-by: zain wang Signed-off-by: Brian Norris Link: https://lore.kernel.org/r/20220830131212.v2.1.I98d30623f13b785ca77094d0c0fd4339550553b6@changeid Signed-off-by: Heiko Stuebner commit 8194a356226ce6f53e1d98b44c0436c583db89d2 Author: Marek Vasut Date: Wed Aug 24 00:13:20 2022 +0200 arm64: dts: imx8mm: Reverse CPLD_Dn GPIO label mapping on MX8Menlo The CPLD_Dn GPIO assignment between SoM and CPLD has now been clarified in schematic and the assignment is reversed. Update the DT to match the hardware. Fixes: 510c527b4ff57 ("arm64: dts: imx8mm: Add i.MX8M Mini Toradex Verdin based Menlo board") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit c90714017cb3f197e71c7ff1317335b96d4d19e8 Merge: d9c0103b9cb0e 2aec909912da5 Author: David S. Miller Date: Sun Sep 4 11:23:11 2022 +0100 Merge tag 'wireless-2022-09-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes berg says: ==================== We have a handful of fixes: - fix DMA from stack in wilc1000 driver - fix crash on chip reset failure in mt7921e - fix for the reported warning on aggregation timer expiry - check packet lengths in hwsim virtio paths - fix compiler warnings/errors with AAD construction by using struct_group - fix Intel 4965 driver rate scale operation - release channel contexts correctly in mac80211 mlme code ==================== Signed-off-by: David S. Miller commit 414d38ba871092aeac4ed097ac4ced89486646f7 Author: Takashi Iwai Date: Sun Sep 4 09:27:50 2022 +0200 ALSA: hda/sigmatel: Keep power up while beep is enabled It seems that the beep playback doesn't work well on IDT codec devices when the codec auto-pm is enabled. Keep the power on while the beep switch is enabled. Link: https://bugzilla.suse.com/show_bug.cgi?id=1200544 Link: https://lore.kernel.org/r/20220904072750.26164-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0d1b756acf60da5004c1e20ca4462f0c257bf6e1 Author: Linus Walleij Date: Fri Sep 2 23:59:18 2022 +0200 RDMA/siw: Pass a pointer to virt_to_page() Functions that work on a pointer to virtual memory such as virt_to_pfn() and users of that function such as virt_to_page() are supposed to pass a pointer to virtual memory, ideally a (void *) or other pointer. However since many architectures implement virt_to_pfn() as a macro, this function becomes polymorphic and accepts both a (unsigned long) and a (void *). If we instead implement a proper virt_to_pfn(void *addr) function the following happens (occurred on arch/arm): drivers/infiniband/sw/siw/siw_qp_tx.c:32:23: warning: incompatible integer to pointer conversion passing 'dma_addr_t' (aka 'unsigned int') to parameter of type 'const void *' [-Wint-conversion] drivers/infiniband/sw/siw/siw_qp_tx.c:32:37: warning: passing argument 1 of 'virt_to_pfn' makes pointer from integer without a cast [-Wint-conversion] drivers/infiniband/sw/siw/siw_qp_tx.c:538:36: warning: incompatible integer to pointer conversion passing 'unsigned long long' to parameter of type 'const void *' [-Wint-conversion] Fix this with an explicit cast. In one case where the SIW SGE uses an unaligned u64 we need a double cast modifying the virtual address (va) to a platform-specific uintptr_t before casting to a (void *). Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Cc: linux-rdma@vger.kernel.org Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220902215918.603761-1-linus.walleij@linaro.org Signed-off-by: Leon Romanovsky commit 7726d4c3e60bfe206738894267414a5f10510f1a Merge: 65eea2c060aee 6890381720b27 Author: Linus Torvalds Date: Sat Sep 3 21:27:27 2022 -0700 Merge tag 'gpio-fixes-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "A a set of fixes from the GPIO subsystem. Most are small driver fixes except the realtek-otto driver patch which is pretty big but addresses a significant flaw that can cause the CPU to stay infinitely busy on uncleared ISR on some platforms. Summary: - MAINTAINERS update - fix resource leaks in gpio-mockup and gpio-pxa - add missing locking in gpio-pca953x - use 32-bit I/O in gpio-realtek-otto - make irq_chip structures immutable in four more drivers" * tag 'gpio-fixes-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: ws16c48: Make irq_chip immutable gpio: 104-idio-16: Make irq_chip immutable gpio: 104-idi-48: Make irq_chip immutable gpio: 104-dio-48e: Make irq_chip immutable gpio: realtek-otto: switch to 32-bit I/O gpio: pca953x: Add mutex_lock for regcache sync in PM gpio: mockup: remove gpio debugfs when remove device gpio: pxa: use devres for the clock struct MAINTAINERS: rectify entry for XILINX GPIO DRIVER commit 2e9ceb6728f1dc2fa4b5d08f37d88cbc49a20a62 Author: Yuezhang Mo Date: Thu Jul 28 10:01:26 2022 +0800 exfat: fix overflow for large capacity partition Using int type for sector index, there will be overflow in a large capacity partition. For example, if storage with sector size of 512 bytes and partition capacity is larger than 2TB, there will be overflow. Fixes: 1b6138385499 ("exfat: reduce block requests when zeroing a cluster") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Acked-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 6890381720b27a41f2d9e68cce241336342ea3b7 Author: William Breathitt Gray Date: Fri Sep 2 13:45:26 2022 -0400 gpio: ws16c48: Make irq_chip immutable Kernel warns about mutable irq_chips: "not an immutable chip, please consider fixing!" Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the new helper functions, and call the appropriate gpiolib functions. Signed-off-by: William Breathitt Gray Signed-off-by: Bartosz Golaszewski commit 410a5041aa60d91ff66a861560e7c879d664270f Author: William Breathitt Gray Date: Fri Sep 2 13:45:25 2022 -0400 gpio: 104-idio-16: Make irq_chip immutable Kernel warns about mutable irq_chips: "not an immutable chip, please consider fixing!" Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the new helper functions, and call the appropriate gpiolib functions. Signed-off-by: William Breathitt Gray Signed-off-by: Bartosz Golaszewski commit fa1329f9e402c1351ad821080eba9b7cda758ac6 Author: William Breathitt Gray Date: Fri Sep 2 13:45:24 2022 -0400 gpio: 104-idi-48: Make irq_chip immutable Kernel warns about mutable irq_chips: "not an immutable chip, please consider fixing!" Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the new helper functions, and call the appropriate gpiolib functions. Signed-off-by: William Breathitt Gray Signed-off-by: Bartosz Golaszewski commit 35f0aa7727b092520bf91374768a4fdafd4a4fe3 Author: William Breathitt Gray Date: Fri Sep 2 13:45:23 2022 -0400 gpio: 104-dio-48e: Make irq_chip immutable Kernel warns about mutable irq_chips: "not an immutable chip, please consider fixing!" Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the new helper functions, and call the appropriate gpiolib functions. Signed-off-by: William Breathitt Gray Signed-off-by: Bartosz Golaszewski commit 65eea2c060aee3bf6d27ea365360059fbd4eeff4 Merge: f0c5f7ea81202 e9ea0b30ada00 Author: Linus Torvalds Date: Sat Sep 3 13:23:11 2022 -0700 Merge tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - a minor fix for the Xen grant driver - a small series fixing a recently introduced problem in the Xen blkfront/blkback drivers with negotiation of feature usage * tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() xen-blkfront: Cache feature_persistent value before advertisement xen-blkfront: Advertise feature-persistent as user requested xen-blkback: Advertise feature-persistent as user requested commit f0c5f7ea81202e997f321d59bdd0c3f5c12ddea7 Merge: cda9a8486c48f ac9284db6b7b4 Author: Linus Torvalds Date: Sat Sep 3 13:21:01 2022 -0700 Merge tag 'loongarch-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix several build errors or warnings, cleanup some code, and adjust arch_do_signal_or_restart() to adapt generic entry" * tag 'loongarch-fixes-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: mm: Remove the unneeded result variable LoongArch: Fix arch_remove_memory() undefined build error LoongArch: Fix section mismatch due to acpi_os_ioremap() LoongArch: Improve dump_tlb() output messages LoongArch: Adjust arch_do_signal_or_restart() to adapt generic entry LoongArch: Avoid orphan input sections commit cda9a8486c48f09dabfec0c17ab109e352fe368e Merge: 6433fe06f6989 7c8d42fdf1a84 Author: Linus Torvalds Date: Sat Sep 3 13:17:33 2022 -0700 Merge tag 's390-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Update defconfigs - Fix linker script to align nospec tables correctly to avoid potentially unbootable kernel with some config options - Fix alignment check in prepare_hugepage_range() for 2GB hugepages to avoid BUG in __unmap_hugepage_range() for unaligned mappings later - Remove useless hugepage address alignment in hugetlb fault handling * tag 's390-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages s390: update defconfigs s390: fix nospec table alignments s390/mm: remove useless hugepage address alignment commit 6433fe06f698936e02f79bf18f69be766e4f53aa Merge: 42cf58c272ee1 9c9c71168f797 Author: Linus Torvalds Date: Sat Sep 3 13:09:46 2022 -0700 Merge tag 'input-for-v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - GT1158 ID added to Goodix touchscreen driver - Boeder Force Feedback Wheel USB added to iforce joystick driver - fixup for iforce driver to avoid hangups - fix autoloading of rk805-pwrkey driver. * tag 'input-for-v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: iforce - add support for Boeder Force Feedback Wheel Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag Input: goodix - add compatible string for GT1158 MAINTAINERS: add include/dt-bindings/input to INPUT DRIVERS Input: rk805-pwrkey - fix module autoloading Input: goodix - add support for GT1158 dt-bindings: input: touchscreen: add compatible string for Goodix GT1158 commit d958edb9eef115cdd6709face6ab46fefd74324b Merge: 1709c70c31e05 0dec364ffeb61 Author: Palmer Dabbelt Date: Sat Sep 3 12:30:23 2022 -0700 Merge tag 'dt-fixes-for-palmer-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git into fixes Microchip RISC-V devicetree fixes for 6.0-rc4 (or later) A fix for the warnings introduced in rc3 as part of fixing the console spam from the L2's isr. Signed-off-by: Conor Dooley * tag 'dt-fixes-for-palmer-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git: riscv: dts: microchip: use an mpfs specific l2 compatible dt-bindings: riscv: sifive-l2: add a PolarFire SoC compatible commit 42cf58c272ee1dae902e8cc1166c246589abd1d8 Merge: c53b3dcb9942b 902e02ea93853 Author: Linus Torvalds Date: Sat Sep 3 10:34:02 2022 -0700 Merge tag 'tty-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty/serial/vt driver fixes for 6.0-rc4 that resolve a number of reported issues: - n_gsm fixups for previous changes that caused problems - much-reported serdev crash fix that showed up in 6.0-rc1 - vt font selection bugfix - kerneldoc build warning fixes - other tiny serial core fixes All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: n_gsm: avoid call of sleeping functions from atomic context tty: n_gsm: replace kicktimer with delayed_work tty: n_gsm: initialize more members at gsm_alloc_mux() tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() tty: serial: atmel: Preserve previous USART mode if RS485 disabled tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete tty: Fix lookahead_buf crash with serdev serial: fsl_lpuart: RS485 RTS polariy is inverse vt: Clear selection before changing the font serial: document start_rx member at struct uart_ops commit c53b3dcb9942b8ed7f81ee3921c4085d87070c73 Merge: 9a61442cba0e9 e230a4455ac3e Author: Linus Torvalds Date: Sat Sep 3 10:32:17 2022 -0700 Merge tag 'staging-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are three small staging driver fixes for 6.0-rc4 that resolve some reported problems and add some a device id: - new device id for r8188eu driver - use-after-free bugfixes for the rtl8712 driver - fix up firmware dependency problem for the r8188eu driver All of these have been in linux-next for a while with no reported problems" * tag 'staging-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8712: fix use after free bugs staging: r8188eu: Add Rosewill USB-N150 Nano to device tables staging: r8188eu: add firmware dependency commit 748008e1da926a814cc0a054c81ca614408b1b0c Author: Ming Lei Date: Tue Aug 23 18:38:19 2022 +0800 block: don't add partitions if GD_SUPPRESS_PART_SCAN is set Commit b9684a71fca7 ("block, loop: support partitions without scanning") adds GD_SUPPRESS_PART_SCAN for replacing part function of GENHD_FL_NO_PART. But looks blk_add_partitions() is missed, since loop doesn't want to add partitions if GENHD_FL_NO_PART was set. And it causes regression on libblockdev (as called from udisks) which operates with the LO_FLAGS_PARTSCAN. Fixes the issue by not adding partitions if GD_SUPPRESS_PART_SCAN is set. Fixes: b9684a71fca7 ("block, loop: support partitions without scanning") Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220823103819.395776-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9a61442cba0e93de5e505b9f43d04d1afa6f18c1 Merge: 777464261d12f abb5f3f4b1f5f Author: Linus Torvalds Date: Sat Sep 3 10:27:25 2022 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Here's a collection of primarily clk driver fixes, with a couple fixes to the core framework. We had to revert out a commit that affected boot on some devices that have the CLK_OPS_PARENT_ENABLE flag set. It isn't critical to have that fix so we'll try again next time. Driver side fixes include: - Plug an OF-node refcount bug in the TI clk driver - Fix the error handling in the raspberry pi firmware get_rate so that errors don't look like valid frequencies - Avoid going out of bounds in the raspberry pi driver too if the video firmware returns something we're not expecting" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" clk: bcm: rpi: Show clock id limit in error case clk: bcm: rpi: Add missing newline clk: bcm: rpi: Prevent out-of-bounds access clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate clk: core: Fix runtime PM sequence in clk_core_unprepare() clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops clk: ti: Fix missing of_node_get() ti_find_clock_provider() commit 777464261d12f4b011fff68de36a4a1075691cd9 Merge: 8782fb61cc848 f233d2be38dbb Author: Linus Torvalds Date: Sat Sep 3 10:24:30 2022 -0700 Merge tag 'hwmon-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix out of bounds access in gpio-fan driver - Fix VOUT margin caching in PMBus core - Avoid error message after -EPROBE_DEFER from devm_regulator_register() * tag 'hwmon-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (gpio-fan) Fix array out of bounds access hwmon: (pmbus) Fix vout margin caching hwmon: (pmbus) Use dev_err_probe() to filter -EPROBE_DEFER error messages commit 8782fb61cc848364e1e1599d76d3c9dd58a1cc06 Author: Steven Price Date: Fri Sep 2 12:26:12 2022 +0100 mm: pagewalk: Fix race between unmap and page walker The mmap lock protects the page walker from changes to the page tables during the walk. However a read lock is insufficient to protect those areas which don't have a VMA as munmap() detaches the VMAs before downgrading to a read lock and actually tearing down PTEs/page tables. For users of walk_page_range() the solution is to simply call pte_hole() immediately without checking the actual page tables when a VMA is not present. We now never call __walk_page_range() without a valid vma. For walk_page_range_novma() the locking requirements are tightened to require the mmap write lock to be taken, and then walking the pgd directly with 'no_vma' set. This in turn means that all page walkers either have a valid vma, or it's that special 'novma' case for page table debugging. As a result, all the odd '(!walk->vma && !walk->no_vma)' tests can be removed. Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn Signed-off-by: Steven Price Cc: Vlastimil Babka Cc: Thomas Hellström Cc: Konstantin Khlebnikov Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 2aec909912da55a6e469fd6ee8412080a5433ed2 Author: Johannes Berg Date: Mon Aug 29 11:46:38 2022 +0200 wifi: use struct_group to copy addresses We sometimes copy all the addresses from the 802.11 header for the AAD, which may cause complaints from fortify checks. Use struct_group() to avoid the compiler warnings/errors. Change-Id: Ic3ea389105e7813b22095b295079eecdabde5045 Signed-off-by: Johannes Berg commit 8c0427842aaef161a38ac83b7e8d8fe050b4be04 Author: Soenke Huster Date: Fri Sep 2 10:19:58 2022 +0200 wifi: mac80211_hwsim: check length for virtio packets An invalid packet with a length shorter than the specified length in the netlink header can lead to use-after-frees and slab-out-of-bounds in the processing of the netlink attributes, such as the following: BUG: KASAN: slab-out-of-bounds in __nla_validate_parse+0x1258/0x2010 Read of size 2 at addr ffff88800ac7952c by task kworker/0:1/12 Workqueue: events hwsim_virtio_rx_work Call Trace: dump_stack_lvl+0x45/0x5d print_report.cold+0x5e/0x5e5 kasan_report+0xb1/0x1c0 __nla_validate_parse+0x1258/0x2010 __nla_parse+0x22/0x30 hwsim_virtio_handle_cmd.isra.0+0x13f/0x2d0 hwsim_virtio_rx_work+0x1b2/0x370 process_one_work+0x8df/0x1530 worker_thread+0x575/0x11a0 kthread+0x29d/0x340 ret_from_fork+0x22/0x30 Discarding packets with an invalid length solves this. Therefore, skb->len must be set at reception. Change-Id: Ieaeb9a4c62d3beede274881a7c2722c6c6f477b6 Signed-off-by: Soenke Huster Signed-off-by: Johannes Berg commit 69371801f929ff4b3c846a45b9d49db631897cd9 Author: Johannes Berg Date: Fri Sep 2 16:11:14 2022 +0200 wifi: mac80211: fix locking in auth/assoc timeout If we hit an authentication or association timeout, we only release the chanctx for the deflink, and the other link(s) are released later by ieee80211_vif_set_links(), but we're not locking this correctly. Fix the locking here while releasing the channels and links. Change-Id: I9e08c1a5434592bdc75253c1abfa6c788f9f39b1 Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") Signed-off-by: Johannes Berg commit 7a2c6d1616be5d49c0dae2c876af3fe20e71a111 Author: Johannes Berg Date: Fri Sep 2 16:11:15 2022 +0200 wifi: mac80211: mlme: release deflink channel in error case In the prep_channel error case we didn't release the deflink channel leaving it to be left around. Fix that. Change-Id: If0dfd748125ec46a31fc6045a480dc28e03723d2 Signed-off-by: Johannes Berg commit 4a86c5462616e0d690ad3c94dc84c3b5f1ea5631 Author: Mukesh Sisodiya Date: Fri Sep 2 16:11:31 2022 +0200 wifi: mac80211: fix link warning in RX agg timer expiry The rx data link pointer isn't set from the RX aggregation timer, resulting in a later warning. Fix that by setting it to the first valid link for now, with a FIXME to worry about statistics later, it's not very important since it's just the timeout case. Reported-by: Hans de Goede Link: https://lore.kernel.org/r/498d714c-76be-9d04-26db-a1206878de5e@redhat.com Fixes: 56057da4569b ("wifi: mac80211: rx: track link in RX data") Signed-off-by: Mukesh Sisodiya Signed-off-by: Johannes Berg commit ac9284db6b7b4af150940186b633a233d4ca2bed Author: ye xingchen Date: Fri Aug 26 07:29:03 2022 +0000 LoongArch: mm: Remove the unneeded result variable Return the value pa_to_nid() directly instead of storing it in another redundant variable. Reported-by: Zeal Robot Signed-off-by: ye xingchen Signed-off-by: Huacai Chen commit 1a470ce4e9106cc4c3c0edfb2e213dcbb7224dc4 Author: Yupeng Li Date: Wed Aug 31 13:40:17 2022 +0800 LoongArch: Fix arch_remove_memory() undefined build error The kernel build error when unslected CONFIG_MEMORY_HOTREMOVE because arch_remove_memory() is needed by mm/memory_hotplug.c but undefined. Some build error messages like: LD vmlinux.o MODPOST vmlinux.symvers MODINFO modules.builtin.modinfo GEN modules.builtin LD .tmp_vmlinux.kallsyms1 loongarch64-linux-gnu-ld: mm/memory_hotplug.o: in function `.L242': memory_hotplug.c:(.ref.text+0x930): undefined reference to `arch_remove_memory' make: *** [Makefile:1169：vmlinux] 错误 1 Removed CONFIG_MEMORY_HOTREMOVE requirement and rearrange the file refer to the definitions of other platform architectures. Signed-off-by: Yupeng Li Signed-off-by: Caicai Signed-off-by: Huacai Chen commit e0fba87c854347007fb9fc873e890b686cc61302 Author: Huacai Chen Date: Fri Sep 2 22:33:42 2022 +0800 LoongArch: Fix section mismatch due to acpi_os_ioremap() Now acpi_os_ioremap() is marked with __init because it calls memblock_ is_memory() which is also marked with __init in the !ARCH_KEEP_MEMBLOCK case. However, acpi_os_ioremap() is called by ordinary functions such as acpi_os_{read, write}_memory() and causes section mismatch warnings: WARNING: modpost: vmlinux.o: section mismatch in reference: acpi_os_read_memory (section: .text) -> acpi_os_ioremap (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: acpi_os_write_memory (section: .text) -> acpi_os_ioremap (section: .init.text) Fix these warnings by selecting ARCH_KEEP_MEMBLOCK unconditionally and removing the __init modifier of acpi_os_ioremap(). This can also give a chance to track "memory" and "reserved" memblocks after early boot. Signed-off-by: Huacai Chen commit ad6846196ab62287e3ba094bb52647132f1998cd Author: Huacai Chen Date: Wed Aug 31 14:22:43 2022 +0800 LoongArch: Improve dump_tlb() output messages 1, Use nr/nx to replace ri/xi; 2, Add 0x prefix for hexadecimal data. Signed-off-by: Huacai Chen commit 0163005374598721e68b1f7dd84b53ce34b71889 Author: Huacai Chen Date: Wed Aug 31 11:19:27 2022 +0800 LoongArch: Adjust arch_do_signal_or_restart() to adapt generic entry Commit 8ba62d37949e248c69 ("task_work: Call tracehook_notify_signal from get_signal on all architectures") adjust arch_do_signal_or_restart() for all architectures. LoongArch hasn't been upstream yet at that time and can be still built successfully without adjustment because this function has a weak version with the correct prototype. It is obviously that we should convert LoongArch to use new API, otherwise some signal handlings will be lost. Signed-off-by: Huacai Chen commit 1429cfde90dc9c84789884d58ecd3bc2cad3dc9f Author: Ard Biesheuvel Date: Wed Aug 24 17:31:10 2022 +0200 LoongArch: Avoid orphan input sections Ensure that all input sections are listed explicitly in the linker script, and issue a warning otherwise. This ensures that the binary image matches the PE/COFF and other image metadata exactly, which is important for things like code signing. Signed-off-by: Ard Biesheuvel Signed-off-by: Huacai Chen commit d9c0103b9cb0e26272ac4d9a5912ab79e408fa83 Merge: cf5c15d1e966c aa626da947e9c Author: David S. Miller Date: Sat Sep 3 10:46:24 2022 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-09-02 (i40e, iavf) This series contains updates to i40e and iavf drivers. Przemyslaw adds reset to ADQ configuration to allow for setting of rate limit beyond TC0 for i40e. Ivan Vecera does not free client on failure to open which could cause NULL pointer dereference to occur on i40e. He also detaches device during reset to prevent NDO calls with could cause races for iavf. ==================== Signed-off-by: David S. Miller commit cf5c15d1e966c2e0c93a19e05ec164d83639b1d7 Merge: 3015c50384743 59ac325557b6c Author: David S. Miller Date: Sat Sep 3 10:44:01 2022 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== This series contains updates to ice driver only. Przemyslaw fixes memory leak of DMA memory due to incorrect freeing of rx_buf. Michal S corrects incorrect call to free memory. ==================== Signed-off-by: David S. Miller commit 3015c50384743eb14d20c907a400e10225da033b Author: Oleksij Rempel Date: Fri Sep 2 11:27:37 2022 +0200 net: dsa: microchip: fix kernel oops on ksz8 switches After driver refactoring we was running ksz9477 specific CPU port configuration on ksz8 family which ended with kernel oops. So, make sure we run this code only on ksz9477 compatible devices. Tested on KSZ8873 and KSZ9477. Fixes: da8cd08520f3 ("net: dsa: microchip: add support for common phylink mac link up") Signed-off-by: Oleksij Rempel Signed-off-by: David S. Miller commit c55f34b6aec2a8cb47eadaffea773e83bf85de91 Author: Paul Durrant Date: Thu Sep 1 12:55:54 2022 +0100 xen-netback: only remove 'hotplug-status' when the vif is actually destroyed Removing 'hotplug-status' in backend_disconnected() means that it will be removed even in the case that the frontend unilaterally disconnects (which it is free to do at any time). The consequence of this is that, when the frontend attempts to re-connect, the backend gets stuck in 'InitWait' rather than moving straight to 'Connected' (which it can do because the hotplug script has already run). Instead, the 'hotplug-status' mode should be removed in netback_remove() i.e. when the vif really is going away. Fixes: 0f4558ae9187 ("Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"") Signed-off-by: Paul Durrant Signed-off-by: David S. Miller commit c749b275056d4d1023af125b320c91a24d6856b8 Author: Greg Kroah-Hartman Date: Sat Sep 3 08:05:08 2022 +0200 Revert "arch_topology: Make cluster topology span at least SMT CPUs" This reverts commit 6b66ca0bac1b9cee7608d7c4dc59b699458b4cb8 as it breaks the build on some arches as reported by the kernel test robot. Link: https://lore.kernel.org/r/202209030824.SouwDV5M-lkp@intel.com Reported-by: kernel test robot Fixes: 6b66ca0bac1b ("arch_topology: Make cluster topology span at least SMT CPUs") Cc: Sudeep Holla Cc: Vincent Guittot Cc: Ionela Voinescu Cc: Yicong Yang Signed-off-by: Greg Kroah-Hartman commit b353b241f1eb9b6265358ffbe2632fdcb563354f Author: Csókás Bence Date: Thu Sep 1 16:04:03 2022 +0200 net: fec: Use a spinlock to guard `fep->ptp_clk_on` Mutexes cannot be taken in a non-preemptible context, causing a panic in `fec_ptp_save_state()`. Replacing `ptp_clk_mutex` by `tmreg_lock` fixes this. Fixes: 6a4d7234ae9a ("net: fec: ptp: avoid register access when ipg clock is disabled") Fixes: f79959220fa5 ("fec: Restart PPS after link state change") Reported-by: Marc Kleine-Budde Link: https://lore.kernel.org/all/20220827160922.642zlcd5foopozru@pengutronix.de/ Signed-off-by: Csókás Bence Tested-by: Francesco Dolcini # Toradex Apalis iMX6 Link: https://lore.kernel.org/r/20220901140402.64804-1-csokas.bence@prolan.hu Signed-off-by: Jakub Kicinski commit 7d650df99d528f674cc744719a00a20be1f912f8 Author: Wei Fang Date: Tue Aug 30 15:01:48 2022 +0800 net: fec: add pm_qos support on imx6q platform There is a very low probability that tx timeout will occur during suspend and resume stress test on imx6q platform. So we add pm_qos support to prevent system from entering low level idles which may affect the transmission of tx. Signed-off-by: Wei Fang Link: https://lore.kernel.org/r/20220830070148.2021947-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 05a5474efe93054893f1a7936398381e23ecea60 Merge: e7506d344bf18 0efe125cfb99e Author: Jakub Kicinski Date: Fri Sep 2 19:38:25 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: bug fixes for net 1. Fix IP address check in irc DCC conntrack helper, this should check the opposite direction rather than the destination address of the packets' direction, from David Leadbeater. 2. bridge netfilter needs to drop dst references, from Harsh Modi. This was fine back in the day the code was originally written, but nowadays various tunnels can pre-set metadata dsts on packets. 3. Remove nf_conntrack_helper sysctl and the modparam toggle, users need to explicitily assign the helpers to use via nftables or iptables. Conntrack helpers, by design, may be used to add dynamic port redirections to internal machines, so its necessary to restrict which hosts/peers are allowed to use them. It was discovered that improper checking in the irc DCC helper makes it possible to trigger the 'please do dynamic port forward' from outside by embedding a 'DCC' in a PING request; if the client echos that back a expectation/port forward gets added. The auto-assign-for-everything mechanism has been in "please don't do this" territory since 2012. From Pablo. 4. Fix a memory leak in the netdev hook error unwind path, also from Pablo. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_irc: Fix forged IP logic netfilter: nf_tables: clean up hook list when offload flags check fails netfilter: br_netfilter: Drop dst references before setting. netfilter: remove nf_conntrack_helper sysctl and modparam toggles ==================== Link: https://lore.kernel.org/r/20220901071238.3044-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit d895ec7938c431fe61a731939da76a6461bc6133 Merge: cec53f4c8df0b 7a3d2225f1ae9 Author: Linus Torvalds Date: Fri Sep 2 16:44:30 2022 -0700 Merge tag 'block-6.0-2022-09-02' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - error handling fix for the new auth code (Hannes Reinecke) - fix unhandled tcp states in nvmet_tcp_state_change (Maurizio Lombardi) - add NVME_QUIRK_BOGUS_NID for Lexar NM610 (Shyamin Ayesh) - Add documentation for the ublk driver merged in this merge window (Ming) * tag 'block-6.0-2022-09-02' of git://git.kernel.dk/linux-block: Documentation: document ublk nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() nvmet-auth: add missing goto in nvmet_setup_auth() nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610 commit cec53f4c8df0b3f45796127a31c10b86ec125f55 Merge: 1551f8f21e007 916d72c10a4ca Author: Linus Torvalds Date: Fri Sep 2 16:37:01 2022 -0700 Merge tag 'io_uring-6.0-2022-09-02' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - A single fix for over-eager retries for networking (Pavel) - Revert the notification slot support for zerocopy sends. It turns out that even after more than a year or development and testing, there's not full agreement on whether just using plain ordered notifications is Good Enough to avoid the complexity of using the notifications slots. Because of that, we decided that it's best left to a future final decision. We can always bring back this feature, but we can't really change it or remove it once we've released 6.0 with it enabled. The reverts leave the usual CQE notifications as the primary interface for knowing when data was sent, and when it was acked. (Pavel) * tag 'io_uring-6.0-2022-09-02' of git://git.kernel.dk/linux-block: selftests/net: return back io_uring zc send tests io_uring/net: simplify zerocopy send user API io_uring/notif: remove notif registration Revert "io_uring: rename IORING_OP_FILES_UPDATE" Revert "io_uring: add zc notification flush requests" selftests/net: temporarily disable io_uring zc test io_uring/net: fix overexcessive retries commit 1551f8f21e007e608fff00cf27caac8504283b43 Merge: 0c95f02269a1e 27893dfc1285f Author: Linus Torvalds Date: Fri Sep 2 16:20:24 2022 -0700 Merge tag '6.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Five fixes, all also marked for stable: - fixes for collapse range and insert range (also fixes xfstest generic/031) - memory leak fix" * tag '6.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix small mempool leak in SMB2_negotiate() smb3: use filemap_write_and_wait_range instead of filemap_write_and_wait smb3: fix temporary data corruption in insert range smb3: fix temporary data corruption in collapse range smb3: Move the flush out of smb2_copychunk_range() into its callers commit 0c95f02269a1ef6c3fae4f46bbdd7a4578d44b8f Merge: b307e704574bd 55e55920bbe3c Author: Linus Torvalds Date: Fri Sep 2 15:24:08 2022 -0700 Merge tag 'landlock-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fix from Mickaël Salaün: "This fixes a mis-handling of the LANDLOCK_ACCESS_FS_REFER right when multiple rulesets/domains are stacked. The expected behaviour was that an additional ruleset can only restrict the set of permitted operations, but in this particular case, it was potentially possible to re-gain the LANDLOCK_ACCESS_FS_REFER right" * tag 'landlock-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER commit b307e704574bd4187d4f46212e7ea8189b53f9ab Merge: 1e8e515edd6db 63f1560930e4e Author: Linus Torvalds Date: Fri Sep 2 15:03:12 2022 -0700 Merge tag 'mmc-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - Fix workaround for SD UHS-I voltage switch * tag 'mmc-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure mmc: core: Fix UHS-I SD 1.8V workaround branch commit 1e8e515edd6dbe15b86003d846fee005c12c0685 Merge: 0b3acd1cc0222 bfe632f6d0a13 Author: Linus Torvalds Date: Fri Sep 2 14:56:09 2022 -0700 Merge tag 'drm-fixes-2022-09-02' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular fixes pull. One core dma-buf fix, then two weeks of i915 fixes, a lot of amdgpu fixes mostly for new IP, and a bunch of msm fixes, mostly modesetting ones. Nothing seems too bad at this point. dma-buf/dma-resv: - Fence-handling fix i915: - GVT fixes including fix for a CommetLake regression in mmio table and misc doc and typo fixes - Fix CCS handling - Fix for guc requests after reset - Display DSI related fixes - Display backlight related fixes - Fix for a null pointer dereference - HDMI related quirk for ECS Liva Q2 with GLK graphics - Skip wm/ddb readout for disabled pipes amdgpu: - FRU error message fix - MES 11 updates - DCN 3.2.x fixes - DCN 3.1.4 fixes - Fix possible use after free in CS IOCTL - SMU 13.0.x fixes - Fix iolink reporting on devices with direct connections to CPU - GFX10 tap delay firmware fixes msm: - Fix for inconsistent indenting in msm_dsi_dphy_timing_calc_v3(). - Fix to make eDP the first connector in the connected list. - Fix to populate intf_cfg correctly before calling reset_intf_cfg(). - Specify the correct number of DSI regulators for SDM660. - Specify the correct number of DSI regulators for MSM8996. - Fix for removing DP_RECOVERED_CLOCK_OUT_EN bit for tps4 link training - Fix probe-deferral crash in gpu devfreq - Fix gpu debugfs deadlock" * tag 'drm-fixes-2022-09-02' of git://anongit.freedesktop.org/drm/drm: (51 commits) drm/amd/amdgpu: skip ucode loading if ucode_size == 0 drm/amdgpu: only init tap_delay ucode when it's included in ucode binary drm/amd/display: Fix black flash when switching from ODM2to1 to ODMBypass drm/amd/display: Fix check for stream and plane drm/amd/display: Re-initialize viewport after pipe merge drm/amd/display: Use correct plane for CAB cursor size allocation drm/amdgpu: ensure no PCIe peer access for CPU XGMI iolinks drm/amd/pm: bump SMU 13.0.0 driver_if header version drm/amd/pm: use vbios carried pptable for all SMU13.0.7 SKUs drm/amd/pm: use vbios carried pptable for those supported SKUs drm/amd/display: fix wrong register access drm/amd/display: use actual cursor size instead of max for CAB allocation drm/amd/display: disable display fresh from MALL on an edge case for DCN321 drm/amd/display: Fix CAB cursor size allocation for DCN32/321 drm/amd/display: Missing HPO instance added drm/amd/display: set dig fifo read start level to 7 before dig fifo reset drm/amdgpu: Fix use-after-free in amdgpu_cs_ioctl drm/amd/display: Fix OTG H timing reset for dcn314 drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming drm/amdgpu: Update mes_v11_api_def.h ... commit be318363daa2939453b4d80981de3e9c28b66135 Author: Luiz Augusto von Dentz Date: Thu Sep 1 17:24:13 2022 -0700 Bluetooth: hci_sync: Fix hci_read_buffer_size_sync hci_read_buffer_size_sync shall not use HCI_OP_LE_READ_BUFFER_SIZE_V2 sinze that is LE specific, instead it is hci_le_read_buffer_size_sync version that shall use it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216382 Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Luiz Augusto von Dentz commit aa626da947e9cd30c4cf727493903e1adbb2c0a0 Author: Ivan Vecera Date: Tue Aug 30 10:16:27 2022 +0200 iavf: Detach device during reset task iavf_reset_task() takes crit_lock at the beginning and holds it during whole call. The function subsequently calls iavf_init_interrupt_scheme() that grabs RTNL. Problem occurs when userspace initiates during the reset task any ndo callback that runs under RTNL like iavf_open() because some of that functions tries to take crit_lock. This leads to classic A-B B-A deadlock scenario. To resolve this situation the device should be detached in iavf_reset_task() prior taking crit_lock to avoid subsequent ndos running under RTNL and reattach the device at the end. Fixes: 62fe2a865e6d ("i40evf: add missing rtnl_lock() around i40evf_set_interrupt_capability") Cc: Jacob Keller Cc: Patryk Piotrowski Cc: SlawomirX Laba Tested-by: Vitaly Grinberg Signed-off-by: Ivan Vecera Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit fb8396aeda5872369a8ed6d2301e2c86e303c520 Author: Ivan Vecera Date: Tue Aug 16 18:22:30 2022 +0200 i40e: Fix kernel crash during module removal The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host# ethtool -t eth0 offline; ethtool -t eth0 offline 2. Remove recursively irdma module that also removes i40e module host# modprobe -r irdma Result: [ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished [ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished [ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init_state=2 status=-110 [ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2 [ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=0x3d dev=0x00 func=0x01 [ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1 [ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000030 [ 8687.768755] #PF: supervisor read access in kernel mode [ 8687.773895] #PF: error_code(0x0000) - not-present page [ 8687.779034] PGD 0 P4D 0 [ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G W I 5.19.0+ #2 [ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.0X.02.0001.051420190324 05/14/2019 [ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e] [ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb <48> 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b [ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202 [ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 0000000000000000 [ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833b2000 [ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 0000000000000000 [ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833b2ef0 [ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833b2008 [ 8687.870342] FS: 00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:0000000000000000 [ 8687.878427] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007706e0 [ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8687.905572] PKRU: 55555554 [ 8687.908286] Call Trace: [ 8687.910737] [ 8687.912843] i40e_remove+0x2c0/0x330 [i40e] [ 8687.917040] pci_device_remove+0x33/0xa0 [ 8687.920962] device_release_driver_internal+0x1aa/0x230 [ 8687.926188] driver_detach+0x44/0x90 [ 8687.929770] bus_remove_driver+0x55/0xe0 [ 8687.933693] pci_unregister_driver+0x2a/0xb0 [ 8687.937967] i40e_exit_module+0xc/0xf48 [i40e] Two offline tests cause IRDMA driver failure (ETIMEDOUT) and this failure is indicated back to i40e_client_subtask() that calls i40e_client_del_instance() to free client instance referenced by pf->cinst and sets this pointer to NULL. During the module removal i40e_remove() calls i40e_lan_del_device() that dereferences pf->cinst that is NULL -> crash. Do not remove client instance when client open callbacks fails and just clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs to take care about this situation (when netdev is up and client is NOT opened) in i40e_notify_client_of_netdev_close() and calls client close callback only when __I40E_CLIENT_INSTANCE_OPENED is set. Fixes: 0ef2d5afb12d ("i40e: KISS the client interface") Signed-off-by: Ivan Vecera Tested-by: Helena Anna Dubel Signed-off-by: Tony Nguyen commit 45bb006d3c924b1201ed43c87a96b437662dcaa8 Author: Przemyslaw Patynowski Date: Tue Aug 9 10:57:44 2022 +0200 i40e: Fix ADQ rate limiting for PF Fix HW rate limiting for ADQ. Fallback to kernel queue selection for ADQ, as it is network stack that decides which queue to use for transmit with ADQ configured. Reset PF after creation of VMDq2 VSIs required for ADQ, as to reprogram TX queue contexts in i40e_configure_tx_ring. Without this patch PF would limit TX rate only according to TC0. Fixes: a9ce82f744dc ("i40e: Enable 'channel' mode in mqprio for TC configs") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jan Sokolowski Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit 0b3acd1cc0222953035d18176b1e4aa06624fd6e Merge: ffb384c269dce 789bba82f63c3 Author: Linus Torvalds Date: Fri Sep 2 10:55:23 2022 -0700 Merge tag 'driver-core-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some small driver core fixes for some oft-reported problems in 6.0-rc1. They include: - a bunch of reverts to handle driver_deferred_probe_check_state() problems that were part of the 6.0-rc1 merge. - firmware_loader bugfixes now that the code is being properly tested and used by others - arch_topology fix - deferred driver probe bugfix to solve a long-suffering amba bus problem that many people have reported. All of these have been in linux-next for a while with no reported problems" * tag 'driver-core-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: firmware_loader: Fix memory leak in firmware upload firmware_loader: Fix use-after-free during unregister arch_topology: Silence early cacheinfo errors when non-existent driver core: Don't probe devices after bus_type.match() probe deferral Revert "iommu/of: Delete usage of driver_deferred_probe_check_state()" Revert "PM: domains: Delete usage of driver_deferred_probe_check_state()" Revert "net: mdio: Delete usage of driver_deferred_probe_check_state()" Revert "driver core: Delete driver_deferred_probe_check_state()" commit ffb384c269dce238c588e0e8e3a85c0ec098a904 Merge: fd59585c420df 0f022aaac9ff2 Author: Linus Torvalds Date: Fri Sep 2 10:50:08 2022 -0700 Merge tag 'char-misc-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc and other driver fixes for 6.0-rc4. Included in here are: - binder fixes for previous fixes, and a few more fixes uncovered by them. - iio driver fixes - soundwire driver fixes - fastrpc driver fixes for memory corruption on some hardware - peci driver fix - mhi driver fix All of these have been in linux-next with no reported problems" * tag 'char-misc-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: fix alloc->vma_vm_mm null-ptr dereference misc: fastrpc: increase maximum session count misc: fastrpc: fix memory corruption on open misc: fastrpc: fix memory corruption on probe soundwire: qcom: fix device status array range bus: mhi: host: Fix up null pointer access in mhi_irq_handler soundwire: qcom: remove duplicate reset control get iio: light: cm32181: make cm32181_pm_ops static iio: ad7292: Prevent regulator double disable dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins iio: adc: mcp3911: use correct formula for AD conversion iio: adc: mcp3911: correct "microchip,device-addr" property Revert "binder_alloc: Add missing mmap_lock calls when using the VMA" binder_alloc: Add missing mmap_lock calls when using the VMA binder: fix UAF of ref->proc caused by race condition iio: light: cm3605: Fix an error handling path in cm3605_probe() iio: adc: mcp3911: make use of the sign bit peci: cpu: Fix use-after-free in adev_release() peci: aspeed: fix error check return value of platform_get_irq() commit fd59585c420df1fc2df33bea2ed925b3373fbae2 Merge: 1a2f6a3722a7c fe0a2ac7c627b Author: Linus Torvalds Date: Fri Sep 2 10:43:46 2022 -0700 Merge tag 'usb-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt driver fixes from Greg KH: "Here are a lot of small USB and Thunderbolt driver fixes for 6.0-rc4 for reported problems. Included in here are: - new usb-serial driver ids - dwc3 driver bugfixes for reported problems with 6.0-rc1 - new device quirks, and reverts of some quirks that were incorrect - gadget driver bugfixes for reported problems - USB host controller bugfixes (xhci and others) - other small USB fixes, details in the shortlog - small thunderbolt driver fixes All of these have been in linux-next with no reported issues" * tag 'usb-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (51 commits) Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio" usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS USB: serial: ch341: fix disabled rx timer on older devices USB: serial: ch341: fix lost character on LCR updates USB: serial: cp210x: add Decagon UCA device id Revert "usb: add quirks for Lenovo OneLink+ Dock" usb: cdns3: fix issue with rearming ISO OUT endpoint usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS media: mceusb: Use new usb_control_msg_*() routines USB: core: Prevent nested device-reset calls USB: gadget: Fix obscure lockdep violation for udc_mutex usb: dwc2: fix wrong order of phy_power_on and phy_init usb: gadget: udc-xilinx: replace memcpy with memcpy_toio usb: typec: Remove retimers properly usb: dwc3: disable USB core PHY management usb: add quirks for Lenovo OneLink+ Dock USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id USB: serial: option: add Quectel EM060K modem ... commit 1a2f6a3722a7c127817af24efb309e5bf70afe36 Merge: cf3488fa25cdf 647e82dbf8512 Author: Linus Torvalds Date: Fri Sep 2 10:35:51 2022 -0700 Merge tag 'platform-drivers-x86-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Various small fixes and hardware-id additions" * tag 'platform-drivers-x86-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: p2sb: Fix UAF when caller uses resource name platform/x86: asus-wmi: Increase FAN_CURVE_BUF_LEN to 32 platform/mellanox: Remove redundant 'NULL' check platform/mellanox: Remove unnecessary code platform/mellanox: mlxreg-lc: Fix locking issue platform/mellanox: mlxreg-lc: Fix coverity warning platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes platform/x86: thinkpad_acpi: Explicitly set to balanced mode on startup platform/x86: asus-wmi: Fix the name of the mic-mute LED classdev platform/surface: aggregator_registry: Add HID devices for sensors and UCSI client to SP8 platform/surface: aggregator_registry: Rename HID device nodes based on new findings platform/surface: aggregator_registry: Rename HID device nodes based on their function platform/surface: aggregator_registry: Add support for Surface Laptop Go 2 platform/x86: x86-android-tablets: Fix broken touchscreen on Chuwi Hi8 with Windows BIOS platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask commit cf3488fa25cdfdd220dcc927ca30ea7256b037e0 Merge: 42e66b1cc3a07 5fbc49cef9191 Author: Linus Torvalds Date: Fri Sep 2 10:32:30 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "It's a lot smaller than last week, with the star of the show being a couple of fixes to head.S addressing a boot regression introduced by the recent overhaul of that code in non-default configurations (i.e. KASLR disabled). The first of those two resolves the issue reported (and bisected) by Mikulus in the wait_on_bit() thread. Summary: - Fix two boot issues caused by the recent head.S rework when !KASLR - Fix calculation of crashkernel memory reservation - Fix bogus error check in PMU IRQ probing code" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: Reserve enough pages for the initial ID map perf/arm_pmu_platform: fix tests for platform_get_irq() failure arm64: head: Ignore bogus KASLR displacement on non-relocatable kernels arm64/kexec: Fix missing extra range for crashkres_low. commit f0c86a2bae4fd12bfa8bad4d43fb59fb498cdd14 Author: Zhengjun Xing Date: Fri Aug 26 22:00:57 2022 +0800 perf stat: Fix L2 Topdown metrics disappear for raw events In perf/Documentation/perf-stat.txt, for "--td-level" the default "0" means the max level that the current hardware support. So we need initialize the stat_config.topdown_level to TOPDOWN_MAX_LEVEL when “--td-level=0” or no “--td-level” option. Otherwise, for the hardware with a max level is 2, the 2nd level metrics disappear for raw events in this case. The issue cannot be observed for the perf stat default or "--topdown" options. This commit fixes the raw events issue and removes the duplicated code for the perf stat default. Before: # ./perf stat -e "cpu-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,ref-cycles,branches,branch-misses,{slots,topdown-retiring,topdown-bad-spec,topdown-fe-bound,topdown-be-bound,topdown-heavy-ops,topdown-br-mispredict,topdown-fetch-lat,topdown-mem-bound}" sleep 1 Performance counter stats for 'sleep 1': 1.03 msec cpu-clock # 0.001 CPUs utilized 1 context-switches # 966.216 /sec 0 cpu-migrations # 0.000 /sec 60 page-faults # 57.973 K/sec 1,132,112 instructions # 1.41 insn per cycle 803,872 cycles # 0.777 GHz 1,909,120 ref-cycles # 1.845 G/sec 236,634 branches # 228.640 M/sec 6,367 branch-misses # 2.69% of all branches 4,823,232 slots # 4.660 G/sec 1,210,536 topdown-retiring # 25.1% Retiring 699,841 topdown-bad-spec # 14.5% Bad Speculation 1,777,975 topdown-fe-bound # 36.9% Frontend Bound 1,134,878 topdown-be-bound # 23.5% Backend Bound 189,146 topdown-heavy-ops # 182.756 M/sec 662,012 topdown-br-mispredict # 639.647 M/sec 1,097,048 topdown-fetch-lat # 1.060 G/sec 416,121 topdown-mem-bound # 402.063 M/sec 1.002423690 seconds time elapsed 0.002494000 seconds user 0.000000000 seconds sys After: # ./perf stat -e "cpu-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,ref-cycles,branches,branch-misses,{slots,topdown-retiring,topdown-bad-spec,topdown-fe-bound,topdown-be-bound,topdown-heavy-ops,topdown-br-mispredict,topdown-fetch-lat,topdown-mem-bound}" sleep 1 Performance counter stats for 'sleep 1': 1.13 msec cpu-clock # 0.001 CPUs utilized 1 context-switches # 882.128 /sec 0 cpu-migrations # 0.000 /sec 61 page-faults # 53.810 K/sec 1,137,612 instructions # 1.29 insn per cycle 881,477 cycles # 0.778 GHz 2,093,496 ref-cycles # 1.847 G/sec 236,356 branches # 208.496 M/sec 7,090 branch-misses # 3.00% of all branches 5,288,862 slots # 4.665 G/sec 1,223,697 topdown-retiring # 23.1% Retiring 767,403 topdown-bad-spec # 14.5% Bad Speculation 2,053,322 topdown-fe-bound # 38.8% Frontend Bound 1,244,438 topdown-be-bound # 23.5% Backend Bound 186,665 topdown-heavy-ops # 3.5% Heavy Operations # 19.6% Light Operations 725,922 topdown-br-mispredict # 13.7% Branch Mispredict # 0.8% Machine Clears 1,327,400 topdown-fetch-lat # 25.1% Fetch Latency # 13.7% Fetch Bandwidth 497,775 topdown-mem-bound # 9.4% Memory Bound # 14.1% Core Bound 1.002701530 seconds time elapsed 0.002744000 seconds user 0.000000000 seconds sys Fixes: 63e39aa6ae103451 ("perf stat: Support L2 Topdown events") Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220826140057.3289401-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7a3d2225f1ae9e591fefd65c3bb1715dc54d96f1 Author: Ming Lei Date: Fri Sep 2 23:23:02 2022 +0800 Documentation: document ublk Add documentation for ublk subsystem. It was supposed to be documented when merging the driver, but missing at that time. Cc: Bagas Sanjaya Cc: Jonathan Corbet Cc: Richard W.M. Jones Cc: Xiaoguang Wang Reviewed-by: Stefan Hajnoczi Reviewed-by: ZiyangZhang Signed-off-by: Ming Lei [axboe: correct MAINTAINERS addition] Signed-off-by: Jens Axboe commit 59ac325557b6c14f1f793b90d3946bc145ffa085 Author: Michal Swiatkowski Date: Wed Aug 17 10:53:20 2022 +0200 ice: use bitmap_free instead of devm_kfree pf->avail_txqs was allocated using bitmap_zalloc, bitmap_free should be used to free this memory. Fixes: 78b5713ac1241 ("ice: Alloc queue management bitmaps and arrays dynamically") Signed-off-by: Michal Swiatkowski Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7e753eb675f0523207b184558638ee2eed6c9ac2 Author: Przemyslaw Patynowski Date: Thu Aug 11 12:09:22 2022 +0200 ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused leak of already mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XDP_SETUP_XSK_POOL handler. Steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done Fixes: 617f3e1b588c ("ice: xsk: allocate separate memory for XDP SW ring") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Tested-by: Chandan (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit c7943bb324e503baeeba3df2bc5ca8a377111bfa Author: Ville Syrjälä Date: Sat Aug 27 00:34:51 2022 +0300 drm/edid: Handle EDID 1.4 range descriptor h/vfreq offsets EDID 1.4 introduced some extra flags in the range descriptor to support min/max h/vfreq >= 255. Consult them to correctly parse the vfreq limits. Note that some combinations of the flags are documented as "reserved" (as are some other values in the descriptor) but explicitly checking for those doesn't seem particularly worthwile since we end up with bogus results whether we decode them or not. v2: Increase the storage to u16 to make it work (Jani) Note the "reserved" values situation (Jani) v3: Document the EDID version number in the defines Drop some bogus (u8) casts Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6519 References: https://gitlab.freedesktop.org/drm/intel/-/issues/6484 Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220826213501.31490-2-ville.syrjala@linux.intel.com Reviewed-by: Manasi Navare commit 55e55920bbe3ccf516022c51f5527e7d026b8f1d Author: Mickaël Salaün Date: Wed Aug 31 22:38:40 2022 +0200 landlock: Fix file reparenting without explicit LANDLOCK_ACCESS_FS_REFER This change fixes a mis-handling of the LANDLOCK_ACCESS_FS_REFER right when multiple rulesets/domains are stacked. The expected behaviour was that an additional ruleset can only restrict the set of permitted operations, but in this particular case, it was potentially possible to re-gain the LANDLOCK_ACCESS_FS_REFER right. With the introduction of LANDLOCK_ACCESS_FS_REFER, we added the first globally denied-by-default access right. Indeed, this lifted an initial Landlock limitation to rename and link files, which was initially always denied when the source or the destination were different directories. This led to an inconsistent backward compatibility behavior which was only taken into account if no domain layer were using the new LANDLOCK_ACCESS_FS_REFER right. However, when restricting a thread with a new ruleset handling LANDLOCK_ACCESS_FS_REFER, all inherited parent rulesets/layers not explicitly handling LANDLOCK_ACCESS_FS_REFER would behave as if they were handling this access right and with all their rules allowing it. This means that renaming and linking files could became allowed by these parent layers, but all the other required accesses must also be granted: all layers must allow file removal or creation, and renaming and linking operations cannot lead to privilege escalation according to the Landlock policy. See detailed explanation in commit b91c3e4ea756 ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER"). To say it another way, this bug may lift the renaming and linking limitations of the initial Landlock version, and a same ruleset can enforce different restrictions depending on previous or next enforced ruleset (i.e. inconsistent behavior). The LANDLOCK_ACCESS_FS_REFER right cannot give access to data not already allowed, but this doesn't follow the contract of the first Landlock ABI. This fix puts back the limitation for sandboxes that didn't opt-in for this additional right. For instance, if a first ruleset allows LANDLOCK_ACCESS_FS_MAKE_REG on /dst and LANDLOCK_ACCESS_FS_REMOVE_FILE on /src, renaming /src/file to /dst/file is denied. However, without this fix, stacking a new ruleset which allows LANDLOCK_ACCESS_FS_REFER on / would now permit the sandboxed thread to rename /src/file to /dst/file . This change fixes the (absolute) rule access rights, which now always forbid LANDLOCK_ACCESS_FS_REFER except when it is explicitly allowed when creating a rule. Making all domain handle LANDLOCK_ACCESS_FS_REFER was an initial approach but there is two downsides: * it makes the code more complex because we still want to check that a rule allowing LANDLOCK_ACCESS_FS_REFER is legitimate according to the ruleset's handled access rights (i.e. ABI v1 != ABI v2); * it would not allow to identify if the user created a ruleset explicitly handling LANDLOCK_ACCESS_FS_REFER or not, which will be an issue to audit Landlock. Instead, this change adds an ACCESS_INITIALLY_DENIED list of denied-by-default rights, which (only) contains LANDLOCK_ACCESS_FS_REFER. All domains are treated as if they are also handling this list, but without modifying their fs_access_masks field. A side effect is that the errno code returned by rename(2) or link(2) *may* be changed from EXDEV to EACCES according to the enforced restrictions. Indeed, we now have the mechanic to identify if an access is denied because of a required right (e.g. LANDLOCK_ACCESS_FS_MAKE_REG, LANDLOCK_ACCESS_FS_REMOVE_FILE) or if it is denied because of missing LANDLOCK_ACCESS_FS_REFER rights. This may result in different errno codes than for the initial Landlock version, but this approach is more consistent and better for rename/link compatibility reasons, and it wasn't possible before (hence no backport to ABI v1). The layout1.rename_file test reflects this change. Add 4 layout1.refer_denied_by_default* test suites to check that the behavior of a ruleset not handling LANDLOCK_ACCESS_FS_REFER (ABI v1) is unchanged even if another layer handles LANDLOCK_ACCESS_FS_REFER (i.e. ABI v1 precedence). Make sure rule's absolute access rights are correct by testing with and without a matching path. Add test_rename() and test_exchange() helpers. Extend layout1.inval tests to check that a denied-by-default access right is not necessarily part of a domain's handled access rights. Test coverage for security/landlock is 95.3% of 599 lines according to gcc/gcov-11. Fixes: b91c3e4ea756 ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER") Reviewed-by: Paul Moore Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20220831203840.1370732-1-mic@digikod.net Cc: stable@vger.kernel.org [mic: Constify and slightly simplify test helpers] Signed-off-by: Mickaël Salaün commit 9c9c9da7aa108e6bf952c18289527a5234e4fc59 Author: David Jander Date: Thu Sep 1 14:36:30 2022 +0200 spi: spi: Fix queue hang if previous transfer failed The queue worker always needs to be kicked one final time after a transfer is done in order to transition to idle (ctlr->busy = false). Commit 69fa95905d40 ("spi: Ensure the io_mutex is held until spi_finalize_current_message()") moved this code into __spi_pump_messages(), but it was executed only if the transfer was successful. This condition check causes ctlr-busy to stay true in case of a failed transfer. This in turn causes that no new work is ever scheduled to the work queue. Fixes: 69fa95905d40 ("spi: Ensure the io_mutex is held until spi_finalize_current_message()") Reported-by: Vincent Whitchurch Signed-off-by: David Jander Link: https://lore.kernel.org/r/20220901123630.1098433-1-david@protonic.nl Signed-off-by: Mark Brown commit b30f7c8eb0780e1479a9882526e838664271f4c9 Author: Mark Brown Date: Thu Sep 1 13:07:32 2022 +0100 spi: mux: Fix mux interaction with fast path optimisations The spi-mux driver is rather too clever and attempts to resubmit any message that is submitted to it to the parent controller with some adjusted callbacks. This does not play at all nicely with the fast path which now sets flags on the message indicating that it's being handled through the fast path, we see async messages flagged as being on the fast path. Ideally the spi-mux code would duplicate the message but that's rather invasive and a bit fragile in that it relies on the mux knowing which fields in the message to copy. Instead teach the core that there are controllers which can't cope with the fast path and have the mux flag itself as being such a controller, ensuring that messages going via the mux don't get partially handled via the fast path. This will reduce the performance of any spi-mux connected device since we'll now always use the thread for both the actual controller and the mux controller instead of just the actual controller but given that we were always hitting the slow path anyway it's hopefully not too much of an additional cost and it allows us to keep the fast path. Fixes: ae7d2346dc89 ("spi: Don't use the message queue if possible in spi_sync") Reported-by: Casper Andersson Tested-by: Casper Andersson Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220901120732.49245-1-broonie@kernel.org Signed-off-by: Mark Brown commit e7506d344bf180096a86ec393515861fb5245915 Merge: 3261400639463 21457f4a91cb5 Author: David S. Miller Date: Fri Sep 2 12:45:32 2022 +0100 Merge tag 'rxrpc-fixes-20220901' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs David Howells says: ==================== rxrpc fixes Here are some fixes for AF_RXRPC: (1) Fix the handling of ICMP/ICMP6 packets. This is a problem due to rxrpc being switched to acting as a UDP tunnel, thereby allowing it to steal the packets before they go through the UDP Rx queue. UDP tunnels can't get ICMP/ICMP6 packets, however. This patch adds an additional encap hook so that they can. (2) Fix the encryption routines in rxkad to handle packets that have more than three parts correctly. The problem is that ->nr_frags doesn't count the initial fragment, so the sglist ends up too short. (3) Fix a problem with destruction of the local endpoint potentially getting repeated. (4) Fix the calculation of the time at which to resend. jiffies_to_usecs() gives microseconds, not nanoseconds. (5) Fix AFS to work out when callback promises and locks expire based on the time an op was issued rather than the time the first reply packet arrives. We don't know how long the server took between calculating the expiry interval and transmitting the reply. (6) Given (5), rxrpc_get_reply_time() is no longer used, so remove it. ==================== Signed-off-by: David S. Miller commit 3261400639463a853ba2b3be8bd009c2a8089775 Author: Eric Dumazet Date: Wed Aug 31 23:38:09 2022 +0000 tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report [1] showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using page_is_pfmemalloc() is moot, and possibly could give false positives. There has been attempts to make page_is_pfmemalloc() more robust, but not using it in the first place in this context is probably better, removing cpu cycles. Note to stable teams : You need to backport 84ce071e38a6 ("net: introduce __skb_fill_page_desc_noacc") as a prereq. Race is more probable after commit c07aea3ef4d4 ("mm: add a signature in struct page") because page_is_pfmemalloc() is now using low order bit from page->lru.next, which can change more often than page->index. Low order bit should never be set for lru.next (when used as an anchor in LRU list), so KCSAN report is mostly a false positive. Backporting to older kernel versions seems not necessary. [1] BUG: KCSAN: data-race in lru_add_fn / tcp_build_frag write to 0xffffea0004a1d2c8 of 8 bytes by task 18600 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:105 [inline] lru_add_fn+0x440/0x520 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 folio_batch_add_and_move mm/swap.c:263 [inline] folio_add_lru+0xf1/0x140 mm/swap.c:490 filemap_add_folio+0xf8/0x150 mm/filemap.c:948 __filemap_get_folio+0x510/0x6d0 mm/filemap.c:1981 pagecache_get_page+0x26/0x190 mm/folio-compat.c:104 grab_cache_page_write_begin+0x2a/0x30 mm/folio-compat.c:116 ext4_da_write_begin+0x2dd/0x5f0 fs/ext4/inode.c:2988 generic_perform_write+0x1d4/0x3f0 mm/filemap.c:3738 ext4_buffered_write_iter+0x235/0x3e0 fs/ext4/file.c:270 ext4_file_write_iter+0x2e3/0x1210 call_write_iter include/linux/fs.h:2187 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x468/0x760 fs/read_write.c:578 ksys_write+0xe8/0x1a0 fs/read_write.c:631 __do_sys_write fs/read_write.c:643 [inline] __se_sys_write fs/read_write.c:640 [inline] __x64_sys_write+0x3e/0x50 fs/read_write.c:640 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea0004a1d2c8 of 8 bytes by task 18611 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1740 [inline] __skb_fill_page_desc include/linux/skbuff.h:2422 [inline] skb_fill_page_desc include/linux/skbuff.h:2443 [inline] tcp_build_frag+0x613/0xb20 net/ipv4/tcp.c:1018 do_tcp_sendpages+0x3e8/0xaf0 net/ipv4/tcp.c:1075 tcp_sendpage_locked net/ipv4/tcp.c:1140 [inline] tcp_sendpage+0x89/0xb0 net/ipv4/tcp.c:1150 inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline] __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea0004a1d288 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Fixes: c07aea3ef4d4 ("mm: add a signature in struct page") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Shakeel Butt Reviewed-by: Shakeel Butt Signed-off-by: David S. Miller commit e2b224abd9bf45dcb55750479fc35970725a430b Author: Dan Carpenter Date: Wed Aug 31 17:47:56 2022 +0300 tipc: fix shift wrapping bug in map_get() There is a shift wrapping bug in this code so anything thing above 31 will return false. Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 9efd23297cca530bb35e1848665805d3fcdd7889 Author: Toke Høiland-Jørgensen Date: Wed Aug 31 23:52:18 2022 +0200 sch_sfb: Don't assume the skb is still around after enqueueing to child The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit 12f09234bde51810b3f7412b2b5c84af4c07cfb1 Merge: 194bebfea5a4e ab2866f12ca18 Author: Arnd Bergmann Date: Fri Sep 2 12:05:27 2022 +0200 Merge tag 'renesas-fixes-for-v6.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v6.0 - Fix the serial console on the Renesas White Hawk development board. * tag 'renesas-fixes-for-v6.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r8a779g0: Fix HSCIF0 interrupt number Link: https://lore.kernel.org/r/ab2866f12ca18747413ba41409231d44e0c6149b.1662111547.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 194bebfea5a4e4fddc4c9128ee0a81f0ec4d2e10 Merge: 9a472613f5bcc 3d074b750d2b4 Author: Arnd Bergmann Date: Fri Sep 2 11:29:03 2022 +0200 Merge tag 'at91-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes AT91 fixes for 6.0 It contains: - fixes for self-refresh on SAMA7G5 while in AT91 power management modes: one disabling a DDR PHY controller DLL which has been proved to be buggy and can introduce glitches that can cause unexpected behavior; one fixing the DDR PHY recalibration which cannot work for all possible cases (due to hardware bug) while using backup and self-refresh AT91 power management mode; - one defconfig fix to remove CONFIG_MICROCHIP_PIT64B from all AT91 defconfigs; - multiple device tree fixes for regulators to avoid having some of them enabled all the time and to describe min and max output ranges according to board capabilities. * tag 'at91-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time ARM: dts: at91: sama7g5ek: specify proper regulator output ranges ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh ARM: at91: pm: fix self-refresh for sama7g5 ARM: configs: at91: remove CONFIG_MICROCHIP_PIT64B Link: https://lore.kernel.org/r/20220902085744.4193554-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 9a472613f5bccf1b36837423495ae592a9c5182f Author: Mathew McBride Date: Thu Sep 1 05:21:49 2022 +0000 soc: fsl: select FSL_GUTS driver for DPIO The soc/fsl/dpio driver will perform a soc_device_match() to determine the optimal cache settings for a given CPU core. If FSL_GUTS is not enabled, this search will fail and the driver will not configure cache stashing for the given DPIO, and a string of "unknown SoC" messages will appear: fsl_mc_dpio dpio.7: unknown SoC version fsl_mc_dpio dpio.6: unknown SoC version fsl_mc_dpio dpio.5: unknown SoC version Fixes: 51da14e96e9b ("soc: fsl: dpio: configure cache stashing destination") Signed-off-by: Mathew McBride Reviewed-by: Ioana Ciornei Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220901052149.23873-2-matt@traverse.com.au' Signed-off-by: Arnd Bergmann commit 49f6d09bd0461ca1ef4042ceeb6cbf6268e69038 Merge: 06f0696444c71 1085f5080647f Author: Arnd Bergmann Date: Fri Sep 2 11:27:27 2022 +0200 Merge tag 'arm-soc/for-6.0/drivers-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom SoCs driver fixes for 6.0, please pull the following: - Liang fixes the legacy Broadcom STB ARM system suspend/resume code error paths that were leaking ioremap() and other of_* operations * tag 'arm-soc/for-6.0/drivers-fixes' of https://github.com/Broadcom/stblinux: soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs Link: https://lore.kernel.org/r/20220829225103.753223-2-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 06f0696444c710f5b3a0b4326227727782fbb49c Merge: 92c7c5b0f9588 f75fccbdc84fd Author: Arnd Bergmann Date: Fri Sep 2 11:26:49 2022 +0200 Merge tag 'arm-soc/for-6.0/devicetree' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 6.0, please pull the following: - William fixes a number of the recently submitted DTS files for 63178, 6846, 6878 to have correct PSCI node propertie as well as correct timer CPU masks * tag 'arm-soc/for-6.0/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: bcmbca: bcm6878: cosmetic change ARM: dts: bcmbca: bcm6878: fix timer node cpu mask flag ARM: dts: bcmbca: bcm6846: fix interrupt controller node ARM: dts: bcmbca: bcm6846: clean up psci node ARM: dts: bcmbca: bcm6846: fix timer node cpu mask flag ARM: dts: bcmbca: bcm63178: cosmetic change ARM: dts: bcmbca: bcm63178: fix interrupt controller node ARM: dts: bcmbca: bcm63178: clean up psci node ARM: dts: bcmbca: bcm63178: fix timer node cpu mask flag Link: https://lore.kernel.org/r/20220829225103.753223-1-f.fainelli@gmail.com Signed-off-by: Arnd Bergmann commit 92c7c5b0f9588c0cbc929b7a296b176c7c17a162 Merge: 251e5d715e4bf 422ab8fe15e30 Author: Arnd Bergmann Date: Fri Sep 2 11:19:27 2022 +0200 Merge tag 'juno-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Armv8 Juno fixes for v6.0 Couple of fixes to add missing MHU secure-irq and remove the legacy coresight 'slave-mode' property. * tag 'juno-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: juno: Add missing MHU secure-irq arm64: dts: arm: juno: Remove legacy Coresight 'slave-mode' property Link: https://lore.kernel.org/r/20220829174420.207880-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit e9ea0b30ada008f4e65933f449db6894832cb242 Author: Dan Carpenter Date: Thu Sep 1 18:35:20 2022 +0300 xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() The change from kcalloc() to kvmalloc() means that arg->nr_pages might now be large enough that the "args->nr_pages << PAGE_SHIFT" can result in an integer overflow. Fixes: b3f7931f5c61 ("xen/gntdev: switch from kcalloc() to kvcalloc()") Signed-off-by: Dan Carpenter Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/YxDROJqu/RPvR0bi@kili Signed-off-by: Juergen Gross commit fe8f65b018effbf473f53af3538d0c1878b8b329 Author: SeongJae Park Date: Wed Aug 31 16:58:24 2022 +0000 xen-blkfront: Cache feature_persistent value before advertisement Xen blkfront advertises its support of the persistent grants feature when it first setting up and when resuming in 'talk_to_blkback()'. Then, blkback reads the advertised value when it connects with blkfront and decides if it will use the persistent grants feature or not, and advertises its decision to blkfront. Blkfront reads the blkback's decision and it also makes the decision for the use of the feature. Commit 402c43ea6b34 ("xen-blkfront: Apply 'feature_persistent' parameter when connect"), however, made the blkfront's read of the parameter for disabling the advertisement, namely 'feature_persistent', to be done when it negotiate, not when advertise. Therefore blkfront advertises without reading the parameter. As the field for caching the parameter value is zero-initialized, it always advertises as the feature is disabled, so that the persistent grants feature becomes always disabled. This commit fixes the issue by making the blkfront does parmeter caching just before the advertisement. Fixes: 402c43ea6b34 ("xen-blkfront: Apply 'feature_persistent' parameter when connect") Cc: # 5.10.x Reported-by: Marek Marczykowski-Górecki Signed-off-by: SeongJae Park Tested-by: Marek Marczykowski-Górecki Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220831165824.94815-4-sj@kernel.org Signed-off-by: Juergen Gross commit 9f5e0fe5d05f7e8de7f39b2b10089834eb0ff787 Author: SeongJae Park Date: Wed Aug 31 16:58:23 2022 +0000 xen-blkfront: Advertise feature-persistent as user requested The advertisement of the persistent grants feature (writing 'feature-persistent' to xenbus) should mean not the decision for using the feature but only the availability of the feature. However, commit 74a852479c68 ("xen-blkfront: add a parameter for disabling of persistent grants") made a field of blkfront, which was a place for saving only the negotiation result, to be used for yet another purpose: caching of the 'feature_persistent' parameter value. As a result, the advertisement, which should follow only the parameter value, becomes inconsistent. This commit fixes the misuse of the semantic by making blkfront saves the parameter value in a separate place and advertises the support based on only the saved value. Fixes: 74a852479c68 ("xen-blkfront: add a parameter for disabling of persistent grants") Cc: # 5.10.x Suggested-by: Juergen Gross Signed-off-by: SeongJae Park Tested-by: Marek Marczykowski-Górecki Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220831165824.94815-3-sj@kernel.org Signed-off-by: Juergen Gross commit 06ba5d2e943e97bb66e75c152e87f1d2c7027a67 Author: SeongJae Park Date: Wed Aug 31 16:58:22 2022 +0000 xen-blkback: Advertise feature-persistent as user requested The advertisement of the persistent grants feature (writing 'feature-persistent' to xenbus) should mean not the decision for using the feature but only the availability of the feature. However, commit aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") made a field of blkback, which was a place for saving only the negotiation result, to be used for yet another purpose: caching of the 'feature_persistent' parameter value. As a result, the advertisement, which should follow only the parameter value, becomes inconsistent. This commit fixes the misuse of the semantic by making blkback saves the parameter value in a separate place and advertises the support based on only the saved value. Fixes: aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") Cc: # 5.10.x Suggested-by: Juergen Gross Signed-off-by: SeongJae Park Tested-by: Marek Marczykowski-Górecki Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220831165824.94815-2-sj@kernel.org Signed-off-by: Juergen Gross commit 6cf07810e9ef8535d60160d13bf0fd05f2af38e7 Author: Nathan Chancellor Date: Tue Aug 30 08:12:56 2022 -0700 powerpc/papr_scm: Ensure rc is always initialized in papr_scm_pmu_register() Clang warns: arch/powerpc/platforms/pseries/papr_scm.c:492:6: warning: variable 'rc' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] if (!p->stat_buffer_len) ^~~~~~~~~~~~~~~~~~~ arch/powerpc/platforms/pseries/papr_scm.c:523:64: note: uninitialized use occurs here dev_info(&p->pdev->dev, "nvdimm pmu didn't register rc=%d\n", rc); ^~ include/linux/dev_printk.h:150:67: note: expanded from macro 'dev_info' dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~ include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap' _p_func(dev, fmt, ##__VA_ARGS__); \ ^~~~~~~~~~~ arch/powerpc/platforms/pseries/papr_scm.c:492:2: note: remove the 'if' if its condition is always false if (!p->stat_buffer_len) ^~~~~~~~~~~~~~~~~~~~~~~~ arch/powerpc/platforms/pseries/papr_scm.c:484:8: note: initialize the variable 'rc' to silence this warning int rc, nodeid; ^ = 0 1 warning generated. The call to papr_scm_pmu_check_events() was eliminated but a return code was not added to the if statement. Add the same return code from papr_scm_pmu_check_events() for this condition so there is no more warning. Fixes: 9b1ac04698a4 ("powerpc/papr_scm: Fix nvdimm event mappings") Signed-off-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://github.com/ClangBuiltLinux/linux/issues/1701 Link: https://lore.kernel.org/r/20220830151256.1473169-1-nathan@kernel.org commit 684c68d92e2e1b97fa2f31c35c1b0f7671a8618a Author: Michael Ellerman Date: Wed Aug 31 23:10:52 2022 +1000 Revert "powerpc/irq: Don't open code irq_soft_mask helpers" This reverts commit ef5b570d3700fbb8628a58da0487486ceeb713cd. Zhouyi reported that commit is causing crashes when running rcutorture with KASAN enabled: BUG: using smp_processor_id() in preemptible [00000000] code: rcu_torture_rea/100 caller is rcu_preempt_deferred_qs_irqrestore+0x74/0xed0 CPU: 4 PID: 100 Comm: rcu_torture_rea Tainted: G W 5.19.0-rc5-next-20220708-dirty #253 Call Trace: dump_stack_lvl+0xbc/0x108 (unreliable) check_preemption_disabled+0x154/0x160 rcu_preempt_deferred_qs_irqrestore+0x74/0xed0 __rcu_read_unlock+0x290/0x3b0 rcu_torture_read_unlock+0x30/0xb0 rcutorture_one_extend+0x198/0x810 rcu_torture_one_read+0x58c/0xc90 rcu_torture_reader+0x12c/0x360 kthread+0x1e8/0x220 ret_from_kernel_thread+0x5c/0x64 KASAN will generate instrumentation instructions around the WRITE_ONCE(local_paca->irq_soft_mask, mask): 0xc000000000295cb0 <+0>: addis r2,r12,774 0xc000000000295cb4 <+4>: addi r2,r2,16464 0xc000000000295cb8 <+8>: mflr r0 0xc000000000295cbc <+12>: bl 0xc00000000008bb4c 0xc000000000295cc0 <+16>: mflr r0 0xc000000000295cc4 <+20>: std r31,-8(r1) 0xc000000000295cc8 <+24>: addi r3,r13,2354 0xc000000000295ccc <+28>: mr r31,r13 0xc000000000295cd0 <+32>: std r0,16(r1) 0xc000000000295cd4 <+36>: stdu r1,-48(r1) 0xc000000000295cd8 <+40>: bl 0xc000000000609b98 <__asan_store1+8> 0xc000000000295cdc <+44>: nop 0xc000000000295ce0 <+48>: li r9,1 0xc000000000295ce4 <+52>: stb r9,2354(r31) 0xc000000000295ce8 <+56>: addi r1,r1,48 0xc000000000295cec <+60>: ld r0,16(r1) 0xc000000000295cf0 <+64>: ld r31,-8(r1) 0xc000000000295cf4 <+68>: mtlr r0 If there is a context switch before "stb r9,2354(r31)", r31 may not equal to r13, in such case, irq soft mask will not work. The usual solution of marking the code ineligible for instrumentation forces the code out-of-line, which we would prefer to avoid. Christophe proposed a partial revert, but Nick raised some concerns with that. So for now do a full revert. Reported-by: Zhouyi Zhou [mpe: Construct change log based on Zhouyi's original report] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220831131052.42250-1-mpe@ellerman.id.au commit fe0a2ac7c627b064c479ad0c3b25e531d342e048 Author: Greg Kroah-Hartman Date: Fri Sep 2 09:10:08 2022 +0200 Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio" This reverts commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b as it throws up a bunch of sparse warnings as reported by the kernel test robot. Reported-by: kernel test robot Link: https://lore.kernel.org/r/202209020044.CX2PfZzM-lkp@intel.com Fixes: 8cb339f1c1f0 ("usb: gadget: udc-xilinx: replace memcpy with memcpy_toio") Cc: stable@vger.kernel.org Cc: Linus Walleij Cc: Piyush Mehta Signed-off-by: Greg Kroah-Hartman commit 0f022aaac9ff2ceff683231b43923c650c90b47e Merge: 1da52815d5f1b 4ef3f2aff1267 Author: Greg Kroah-Hartman Date: Fri Sep 2 08:59:45 2022 +0200 Merge tag 'soundwire-6.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-linus Vinod writes: "soundwire fixes for v6.0 This contains two fixes to qcom sdw driver which resolve duplicate reset control get and second one fixes device array indices." * tag 'soundwire-6.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: qcom: fix device status array range soundwire: qcom: remove duplicate reset control get commit 3e48940abee88b8dbbeeaf8a07e7b2b6be1271b3 Author: Pattara Teerapong Date: Thu Sep 1 14:40:36 2022 +0000 ALSA: aloop: Fix random zeros in capture data when using jiffies timer In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong Cc: Link: https://lore.kernel.org/r/20220901144036.4049060-1-pteerapong@chromium.org Signed-off-by: Takashi Iwai commit 7fdc77665f3d45c9da7c6edd4beadee9790f43aa Author: Heiner Kallweit Date: Wed Aug 31 21:20:49 2022 +0200 Revert "net: phy: meson-gxl: improve link-up behavior" This reverts commit 2c87c6f9fbddc5b84d67b2fa3f432fcac6d99d93. Meanwhile it turned out that the following commit is the proper workaround for the issue that 2c87c6f9fbdd tries to address. a3a57bf07de2 ("net: stmmac: work around sporadic tx issue on link-up") It's nor clear why the to be reverted commit helped for one user, for others it didn't make a difference. Fixes: 2c87c6f9fbdd ("net: phy: meson-gxl: improve link-up behavior") Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/8deeeddc-6b71-129b-1918-495a12dc11e3@gmail.com Signed-off-by: Jakub Kicinski commit bfe632f6d0a1371784dd9a11fa5a9aa2dbf53bf1 Merge: d7df5e2834d3f 0211c2a0ea600 Author: Dave Airlie Date: Fri Sep 2 11:26:29 2022 +1000 Merge tag 'drm-intel-fixes-2022-09-01' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix for a null pointer dereference (Lukasz) - HDMI related quirk for ECS Liva Q2 with GLK graphics (Diego) - Skip wm/ddb readout for disabled pipes (Ville) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YxC3GmSOpDiZTdIJ@intel.com commit 29250ba51bc1cbe8a87e923f76978b87c3247a8c Merge: 35906d23cf036 ca922fecda6ca Author: Paolo Bonzini Date: Thu Sep 1 19:21:27 2022 -0400 Merge tag 'kvm-s390-master-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD PCI interpretation compile fixes commit 35906d23cf036857738d49b0d9388376145dc017 Merge: 22c6a0ef6b263 3e5e56c60a147 Author: Paolo Bonzini Date: Thu Sep 1 19:21:09 2022 -0400 Merge tag 'kvm-riscv-fixes-6.0-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.0, take #1 - Fix unused variable warnings in vcpu_timer.c - Move extern sbi_ext declarations to a header commit 22c6a0ef6b2631cda406a9c0c26774b0b3463b7b Author: Paolo Bonzini Date: Thu Aug 11 12:41:25 2022 -0400 KVM: x86: check validity of argument to KVM_SET_MP_STATE An invalid argument to KVM_SET_MP_STATE has no effect other than making the vCPU fail to run at the next KVM_RUN. Since it is extremely unlikely that any userspace is relying on it, fail with -EINVAL just like for other architectures. Signed-off-by: Paolo Bonzini commit 87693645ae89d9f9779e0bc53606bf228ec36411 Author: Like Xu Date: Wed Aug 31 11:35:24 2022 +0800 perf/x86/core: Completely disable guest PEBS via guest's global_ctrl When a guest PEBS counter is cross-mapped by a host counter, software will remove the corresponding bit in the arr[global_ctrl].guest and expect hardware to perform a change of state "from enable to disable" via the msr_slot[] switch during the vmx transaction. The real world is that if user adjust the counter overflow value small enough, it still opens a tiny race window for the previously PEBS-enabled counter to write cross-mapped PEBS records into the guest's PEBS buffer, when arr[global_ctrl].guest has been prioritised (switch_msr_special stuff) to switch into the enabled state, while the arr[pebs_enable].guest has not. Close this window by clearing invalid bits in the arr[global_ctrl].guest. Cc: linux-perf-users@vger.kernel.org Cc: Kan Liang Cc: Peter Zijlstra Cc: Sean Christopherson Fixes: 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations") Signed-off-by: Like Xu Message-Id: <20220831033524.58561-1-likexu@tencent.com> Signed-off-by: Paolo Bonzini commit 3c0ba05ce9c92f94ef5b7f7f1e0102c4a3cd2a77 Author: Miaohe Lin Date: Thu Sep 1 20:23:00 2022 +0800 KVM: x86: fix memoryleak in kvm_arch_vcpu_create() When allocating memory for mci_ctl2_banks fails, KVM doesn't release mce_banks leading to memoryleak. Fix this issue by calling kfree() for it when kcalloc() fails. Fixes: 281b52780b57 ("KVM: x86: Add emulation for MSR_IA32_MCx_CTL2 MSRs.") Signed-off-by: Miaohe Lin Message-Id: <20220901122300.22298-1-linmiaohe@huawei.com> Signed-off-by: Paolo Bonzini commit 0204750bd4c6ccc2fb7417618477f10373b33f56 Author: Jim Mattson Date: Tue Aug 30 10:49:47 2022 -0700 KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES KVM should not claim to virtualize unknown IA32_ARCH_CAPABILITIES bits. When kvm_get_arch_capabilities() was originally written, there were only a few bits defined in this MSR, and KVM could virtualize all of them. However, over the years, several bits have been defined that KVM cannot just blindly pass through to the guest without additional work (such as virtualizing an MSR promised by the IA32_ARCH_CAPABILITES feature bit). Define a mask of supported IA32_ARCH_CAPABILITIES bits, and mask off any other bits that are set in the hardware MSR. Cc: Paolo Bonzini Fixes: 5b76a3cff011 ("KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry") Signed-off-by: Jim Mattson Reviewed-by: Vipin Sharma Reviewed-by: Xiaoyao Li Message-Id: <20220830174947.2182144-1-jmattson@google.com> Signed-off-by: Paolo Bonzini commit d7df5e2834d3f81412a669586d685bc87f18f7d7 Merge: c1dd5d29aceed 174974d8463b7 Author: Dave Airlie Date: Fri Sep 2 05:58:52 2022 +1000 Merge tag 'drm-msm-fixes-2022-08-27' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.0 - Fix for inconsistent indenting in function msm_dsi_dphy_timing_calc_v3. This fixes a smatch warning reported by kbot - Fix to make eDP the first connector in the connected list. This was mainly done to address a screen corruption issue we were seeing on sc7280 boards which have eDP as the primary display. The corruption itself is from usermode but we decided to fix it this way because things work correct with the primary display as the first one for usermode - Fix to populate intf_cfg correctly before calling reset_intf_cfg(). Without this, the display pipeline is not torn down correctly for writeback - Specify the correct number of DSI regulators for SDM660. It should have been 1 but 2 was mentioned - Specify the correct number of DSI regulators for MSM8996. It should have been 3 but 2 was mentioned - Fix for removing DP_RECOVERED_CLOCK_OUT_EN bit for tps4 link training for DP. This was causing link training failures and hence no display for a specific DP to HDMI cable on chromebooks - Fix probe-deferral crash in gpu devfreq - Fix gpu debugfs deadlock Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGtuY=jd44itwTkLXVqhnoKgY0BswPTrxDTxCiPG3WbmLA@mail.gmail.com commit c1dd5d29aceed251daf98cacd22817f38f76f94b Merge: a71f3950c803c 39c84b8e929db Author: Dave Airlie Date: Fri Sep 2 05:56:25 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-08-31' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-08-31: amdgpu: - FRU error message fix - MES 11 updates - DCN 3.2.x fixes - DCN 3.1.4 fixes - Fix possible use after free in CS IOCTL - SMU 13.0.x fixes - Fix iolink reporting on devices with direct connections to CPU - GFX10 tap delay firmware fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220831212312.5921-1-alexander.deucher@amd.com commit a71f3950c803cb18080746aaa8b66af122f32841 Merge: a54569b1f9721 a3f7c10a269d5 Author: Dave Airlie Date: Fri Sep 2 05:34:33 2022 +1000 Merge tag 'drm-misc-fixes-2022-08-31' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * dma-buf/dma-resv: Fence-handling fix Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Yw+pZnEbPxkJ1nHa@linux-uq9g.fritz.box commit 793f55b2971e3a95d77ad08e9da2a3dc6c946cd7 Author: Nico Pache Date: Wed Aug 10 19:40:56 2022 -0400 kunit: fix Kconfig for build-in tests USB4 and Nitro Enclaves Both the USB4 and Nitro Enclaves KUNIT tests are now able to be compiled if KUNIT is compiled as a module. This leads to issues if KUNIT is being packaged separately from the core kernel and when KUNIT is run baremetal without the required driver compiled into the kernel. Fixes: 635dcd16844b ("thunderbolt: test: Use kunit_test_suite() macro") Fixes: fe5be808fa6c ("nitro_enclaves: test: Use kunit_test_suite() macro") Signed-off-by: Nico Pache Reviewed-by: David Gow Reviewed-by: Andra Paraschiv Acked-by: Brendan Higgins Signed-off-by: Shuah Khan commit aded3cad909581c60335037112c4f86bbfe90f17 Author: Sander Vanheule Date: Sun Aug 21 17:01:47 2022 +0200 kunit: fix assert_type for comparison macros When replacing KUNIT_BINARY_*_MSG_ASSERTION() macros with KUNIT_BINARY_INT_ASSERTION(), the assert_type parameter was not always correctly transferred. Specifically, the following errors were introduced: - KUNIT_EXPECT_LE_MSG() uses KUNIT_ASSERTION - KUNIT_ASSERT_LT_MSG() uses KUNIT_EXPECTATION - KUNIT_ASSERT_GT_MSG() uses KUNIT_EXPECTATION A failing KUNIT_EXPECT_LE_MSG() test thus prevents further tests from running, while failing KUNIT_ASSERT_{LT,GT}_MSG() tests do not prevent further tests from running. This is contrary to the documentation, which states that failing KUNIT_EXPECT_* macros allow further tests to run, while failing KUNIT_ASSERT_* macros should prevent this. Revert the KUNIT_{ASSERTION,EXPECTATION} switches to fix the behaviour for the affected macros. Fixes: 40f39777ce4f ("kunit: decrease macro layering for integer asserts") Signed-off-by: Sander Vanheule Reviewed-by: Daniel Latypov Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit 6b66ca0bac1b9cee7608d7c4dc59b699458b4cb8 Author: Yicong Yang Date: Thu Aug 25 17:20:07 2022 +0800 arch_topology: Make cluster topology span at least SMT CPUs Currently cpu_clustergroup_mask() will return CPU mask if cluster span more or the same CPUs as cpu_coregroup_mask(). This will result topology borken on non-Cluster SMT machines when building with CONFIG_SCHED_CLUSTER=y. Test with: qemu-system-aarch64 -enable-kvm -machine virt \ -net none \ -cpu host \ -bios ./QEMU_EFI.fd \ -m 2G \ -smp 48,sockets=2,cores=12,threads=2 \ -kernel $Image \ -initrd $Rootfs \ -nographic \ -append "rdinit=init console=ttyAMA0 sched_verbose loglevel=8" We'll get below error: [ 3.084568] BUG: arch topology borken [ 3.084570] the SMT domain not a subset of the CLS domain Since cluster is a level higher than SMT, fix this by making cluster spans at least SMT CPUs. Fixes: bfcc4397435d ("arch_topology: Limit span of cpu_clustergroup_mask()") Cc: Sudeep Holla Cc: Vincent Guittot Cc: Ionela Voinescu Reviewed-by: Sudeep Holla Reviewed-by: Ionela Voinescu Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20220825092007.8129-1-yangyicong@huawei.com Signed-off-by: Greg Kroah-Hartman commit 42e66b1cc3a070671001f8a1e933a80818a192bf Merge: d330076e1d4b0 a8424a9b4522a Author: Linus Torvalds Date: Thu Sep 1 09:20:42 2022 -0700 Merge tag 'net-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth, bpf and wireless. Current release - regressions: - bpf: - fix wrong last sg check in sk_msg_recvmsg() - fix kernel BUG in purge_effective_progs() - mac80211: - fix possible leak in ieee80211_tx_control_port() - potential NULL dereference in ieee80211_tx_control_port() Current release - new code bugs: - nfp: fix the access to management firmware hanging Previous releases - regressions: - ip: fix triggering of 'icmp redirect' - sched: tbf: don't call qdisc_put() while holding tree lock - bpf: fix corrupted packets for XDP_SHARED_UMEM - bluetooth: hci_sync: fix suspend performance regression - micrel: fix probe failure Previous releases - always broken: - tcp: make global challenge ack rate limitation per net-ns and default disabled - tg3: fix potential hang-up on system reboot - mac802154: fix reception for no-daddr packets Misc: - r8152: add PID for the lenovo onelink+ dock" * tag 'net-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (56 commits) net/smc: Remove redundant refcount increase Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb" tcp: make global challenge ack rate limitation per net-ns and default disabled tcp: annotate data-race around challenge_timestamp net: dsa: hellcreek: Print warning only once ip: fix triggering of 'icmp redirect' sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb selftests: net: sort .gitignore file Documentation: networking: correct possessive "its" kcm: fix strp_init() order and cleanup mlxbf_gige: compute MDIO period based on i1clk ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler net: lan966x: improve error handle in lan966x_fdma_rx_get_frame() nfp: fix the access to management firmware hanging net: phy: micrel: Make the GPIO to be non-exclusive net: virtio_net: fix notification coalescing comments net/sched: fix netdevice reference leaks in attach_default_qdiscs() net: sched: tbf: don't call qdisc_put() while holding tree lock net: Use u64_stats_fetch_begin_irq() for stats fetch. net: dsa: xrs700x: Use irqsave variant for u64 stats update ... commit d330076e1d4b0cbaec477e1214f6f8df27da2bb8 Merge: 2880e1a175b9f 0495e337b7039 Author: Linus Torvalds Date: Thu Sep 1 09:14:56 2022 -0700 Merge tag 'slab-for-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - A fix from Waiman Long to avoid a theoretical deadlock reported by lockdep. * tag 'slab-for-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock commit 2880e1a175b9f31798f9d9482ee49187f61b5539 Merge: 2555283eb40df 5f3d9e8161bb8 Author: Linus Torvalds Date: Thu Sep 1 09:05:25 2022 -0700 Merge tag 'sound-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just handful changes at this time. The only major change is the regression fix about the x86 WC-page buffer allocation. The rest are trivial data-race fixes for ALSA sequencer core, the possible out-of-bounds access fixes in the new ALSA control hash code, and a few device-specific workarounds and fixes" * tag 'sound-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5 ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298 ALSA: control: Re-order bounds checking in get_ctl_id_hash() ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash() ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array ALSA: seq: Fix data-race at module auto-loading ALSA: seq: oss: Fix data-race for max_midi_devs access ALSA: memalloc: Revive x86-specific WC page allocations again commit 647e82dbf85124697be59a4b4cf00c0d38177dcb Author: Andy Shevchenko Date: Thu Sep 1 14:34:06 2022 +0300 platform/x86: p2sb: Fix UAF when caller uses resource name We have to copy only selected fields from the original resource. Because a PCI device will be removed immediately after getting its resources, we may not use any allocated data, hence we may not copy any pointers. Consider the following scenario: 1/ a caller of p2sb_bar() gets the resource; 2/ the resource has been copied by platform_device_add_data() in order to create a platform device; 3/ the platform device creation will call for the device driver's ->probe() as soon as a match found; 4/ the ->probe() takes given resources (see 2/) and tries to access one of its field, i.e. 'name', in the __devm_ioremap_resource() to create a pretty looking output; 5/ but the 'name' is a dangling pointer because p2sb_bar() removed a PCI device, which 'name' had been copied to the caller's memory. 6/ UAF (Use-After-Free) as a result. Kudos to Mika for the initial analisys of the issue. Fixes: 9745fb07474f ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support") Reported-by: kernel test robot Suggested-by: Mika Westerberg Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/ Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/ Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 5542dfc582f4a925f67bbfaf8f62ca83506032ae Author: Luke D. Jones Date: Sun Aug 28 19:46:38 2022 +1200 platform/x86: asus-wmi: Increase FAN_CURVE_BUF_LEN to 32 Fix for TUF laptops returning with an -ENOSPC on calling asus_wmi_evaluate_method_buf() when fetching default curves. The TUF method requires at least 32 bytes space. This also moves and changes the pr_debug() in fan_curve_check_present() to pr_warn() in fan_curve_get_factory_default() so that there is at least some indication in logs of why it fails. Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20220828074638.5473-1-luke@ljones.dev Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 789bba82f63c3e81dce426ba457fc7905b30ac6e Author: Russ Weight Date: Tue Aug 30 17:25:18 2022 -0700 firmware_loader: Fix memory leak in firmware upload In the case of firmware-upload, an instance of struct fw_upload is allocated in firmware_upload_register(). This data needs to be freed in fw_dev_release(). Create a new fw_upload_free() function in sysfs_upload.c to handle the firmware-upload specific memory frees and incorporate the missing kfree call for the fw_upload structure. Fixes: 97730bbb242c ("firmware_loader: Add firmware-upload support") Cc: stable Signed-off-by: Russ Weight Link: https://lore.kernel.org/r/20220831002518.465274-1-russell.h.weight@intel.com Signed-off-by: Greg Kroah-Hartman commit 8b40c38e37492b5bdf8e95b46b5cca9517a9957a Author: Russ Weight Date: Mon Aug 29 10:45:57 2022 -0700 firmware_loader: Fix use-after-free during unregister In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freeing the fw_upload_priv structure before it is dereferenced for the call to module_put(). This bug was found by the kernel test robot using CONFIG_KASAN while running the firmware selftests. device_unregister(&fw_sysfs->dev); module_put(fw_upload_priv->module); The problem is fixed by copying fw_upload_priv->module to a local variable for use when calling device_unregister(). Fixes: 97730bbb242c ("firmware_loader: Add firmware-upload support") Cc: stable Reported-by: kernel test robot Reviewed-by: Matthew Gerlach Signed-off-by: Russ Weight Link: https://lore.kernel.org/r/20220829174557.437047-1-russell.h.weight@intel.com Signed-off-by: Greg Kroah-Hartman commit 1b620d539ccc18a1aca1613d9ff078115a7891a1 Author: Masahiro Yamada Date: Thu Sep 1 10:12:52 2022 +0900 kbuild: disable header exports for UML in a straightforward way Previously 'make ARCH=um headers' stopped because of missing arch/um/include/uapi/asm/Kbuild. The error is not shown since commit ed102bf2afed ("um: Fix W=1 missing-include-dirs warnings") added arch/um/include/uapi/asm/Kbuild. Hard-code the unsupported architecture, so it works like before. Fixes: ed102bf2afed ("um: Fix W=1 missing-include-dirs warnings") Signed-off-by: Masahiro Yamada Acked-by: Richard Weinberger commit 916d72c10a4ca80ea51f1421e774cb765b53f28f Author: Pavel Begunkov Date: Thu Sep 1 11:54:05 2022 +0100 selftests/net: return back io_uring zc send tests Enable io_uring zerocopy send tests back and fix them up to follow the new inteface. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c8e5018c516093bdad0b6e19f2f9847dea17e4d2.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b48c312be05e83b55a4d58bf61f80b4a3288fb7e Author: Pavel Begunkov Date: Thu Sep 1 11:54:04 2022 +0100 io_uring/net: simplify zerocopy send user API Following user feedback, this patch simplifies zerocopy send API. One of the main complaints is that the current API is difficult with the userspace managing notification slots, and then send retries with error handling make it even worse. Instead of keeping notification slots change it to the per-request notifications model, which posts both completion and notification CQEs for each request when any data has been sent, and only one CQE if it fails. All notification CQEs will have IORING_CQE_F_NOTIF set and IORING_CQE_F_MORE in completion CQEs indicates whether to wait a notification or not. IOSQE_CQE_SKIP_SUCCESS is disallowed with zerocopy sends for now. This is less flexible, but greatly simplifies the user API and also the kernel implementation. We reuse notif helpers in this patch, but in the future there won't be need for keeping two requests. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/95287640ab98fc9417370afb16e310677c63e6ce.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 57f332246afa5929bdf2e7a5facddedb43549be4 Author: Pavel Begunkov Date: Thu Sep 1 11:54:03 2022 +0100 io_uring/notif: remove notif registration We're going to remove the userspace exposed zerocopy notification API, remove notification registration. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/6ff00b97be99869c386958a990593c9c31cf105b.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d9808ceb3129b811becebdee3ec96d189c83e56c Author: Pavel Begunkov Date: Thu Sep 1 11:54:02 2022 +0100 Revert "io_uring: rename IORING_OP_FILES_UPDATE" This reverts commit 4379d5f15b3fd4224c37841029178aa8082a242e. We removed notification flushing, also cleanup uapi preparation changes to not pollute it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/89edc3905350f91e1b6e26d9dbf42ee44fd451a2.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 23c12d5fc02fb0712c64f3e87a27fcfa78e8af9c Author: Pavel Begunkov Date: Thu Sep 1 11:54:01 2022 +0100 Revert "io_uring: add zc notification flush requests" This reverts commit 492dddb4f6e3a5839c27d41ff1fecdbe6c3ab851. Soon we won't have the very notion of notification flushing, so remove notification flushing requests. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/8850334ca56e65b413cb34fd158db81d7b2865a3.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 75847100c351c7a49dddd60d1d023bd3e6640682 Author: Pavel Begunkov Date: Thu Sep 1 11:54:00 2022 +0100 selftests/net: temporarily disable io_uring zc test We're going to change API, to avoid build problems with a couple of following commits, disable io_uring testing. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/12b7507223df04fbd12aa05fc0cb544b51d7ed79.1662027856.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2a9d683b48c8a87e61a4215792d44c90bcbbb536 Author: Trond Myklebust Date: Thu Aug 25 14:49:05 2022 -0400 NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 The NFSv4.0 protocol only supports open() by name. It cannot therefore be used with open_by_handle() and friends, nor can it be re-exported by knfsd. Reported-by: Chuck Lever III Fixes: 20fa19027286 ("nfs: add export operations") Signed-off-by: Trond Myklebust commit 17814819ac9829a437e06fbb5c7056a1f4f893da Author: Trond Myklebust Date: Wed Aug 31 17:28:13 2022 -0400 SUNRPC: Fix call completion races with call_decode() We need to make sure that the req->rq_private_buf is completely up to date before we make req->rq_reply_bytes_recvd visible to the call_decode() routine in order to avoid triggering the WARN_ON(). Reported-by: Benjamin Coddington Fixes: 72691a269f0b ("SUNRPC: Don't reuse bvec on retransmission of the request") Tested-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 9b03e79300100bcd36e77c8ce94ee7f47cd2f528 Author: Florian Fainelli Date: Fri Aug 5 16:07:36 2022 -0700 arch_topology: Silence early cacheinfo errors when non-existent Architectures which do not have cacheinfo such as ARM 32-bit would spit out the following during boot: Early cacheinfo failed, ret = -2 Treat -ENOENT specifically to silence this error since it means that the platform does not support reporting its cache information. Fixes: 3fcbf1c77d08 ("arch_topology: Fix cache attributes detection in the CPU hotplug path") Tested-by: Geert Uytterhoeven Tested-by: Michael Walle Reviewed-by: Sudeep Holla Reviewed-by: Conor Dooley Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220805230736.1562801-1-f.fainelli@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1da52815d5f1b654c89044db0cdc6adce43da1f1 Author: Carlos Llamas Date: Mon Aug 29 20:12:48 2022 +0000 binder: fix alloc->vma_vm_mm null-ptr dereference Syzbot reported a couple issues introduced by commit 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA"), in which we attempt to acquire the mmap_lock when alloc->vma_vm_mm has not been initialized yet. This can happen if a binder_proc receives a transaction without having previously called mmap() to setup the binder_proc->alloc space in [1]. Also, a similar issue occurs via binder_alloc_print_pages() when we try to dump the debugfs binder stats file in [2]. Sample of syzbot's crash report: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] CPU: 0 PID: 3755 Comm: syz-executor229 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 syz-executor229[3755] cmdline: ./syz-executor2294415195 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:__lock_acquire+0xd83/0x56d0 kernel/locking/lockdep.c:4923 [...] Call Trace: lock_acquire kernel/locking/lockdep.c:5666 [inline] lock_acquire+0x1ab/0x570 kernel/locking/lockdep.c:5631 down_read+0x98/0x450 kernel/locking/rwsem.c:1499 mmap_read_lock include/linux/mmap_lock.h:117 [inline] binder_alloc_new_buf_locked drivers/android/binder_alloc.c:405 [inline] binder_alloc_new_buf+0xa5/0x19e0 drivers/android/binder_alloc.c:593 binder_transaction+0x242e/0x9a80 drivers/android/binder.c:3199 binder_thread_write+0x664/0x3220 drivers/android/binder.c:3986 binder_ioctl_write_read drivers/android/binder.c:5036 [inline] binder_ioctl+0x3470/0x6d00 drivers/android/binder.c:5323 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] ================================================================== Fix these issues by setting up alloc->vma_vm_mm pointer during open() and caching directly from current->mm. This guarantees we have a valid reference to take the mmap_lock during scenarios described above. [1] https://syzkaller.appspot.com/bug?extid=f7dc54e5be28950ac459 [2] https://syzkaller.appspot.com/bug?extid=a75ebe0452711c9e56d9 Fixes: 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA") Cc: # v5.15+ Cc: Liam R. Howlett Reported-by: syzbot+f7dc54e5be28950ac459@syzkaller.appspotmail.com Reported-by: syzbot+a75ebe0452711c9e56d9@syzkaller.appspotmail.com Reviewed-by: Liam R. Howlett Acked-by: Todd Kjos Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20220829201254.1814484-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 689a2d9f9332a27b1379ef230396e944f949a72b Author: Johan Hovold Date: Mon Aug 29 10:05:31 2022 +0200 misc: fastrpc: increase maximum session count The SC8280XP platform uses 14 sessions for the compute DSP so increment the maximum session count. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220829080531.29681-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit d245f43aab2b61195d8ebb64cef7b5a08c590ab4 Author: Johan Hovold Date: Mon Aug 29 10:05:30 2022 +0200 misc: fastrpc: fix memory corruption on open The probe session-duplication overflow check incremented the session count also when there were no more available sessions so that memory beyond the fixed-size slab-allocated session array could be corrupted in fastrpc_session_alloc() on open(). Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") Cc: stable@vger.kernel.org # 5.1 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220829080531.29681-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9baa1415d9abdd1e08362ea2dcfadfacee8690b5 Author: Johan Hovold Date: Mon Aug 29 10:05:29 2022 +0200 misc: fastrpc: fix memory corruption on probe Add the missing sanity check on the probed-session count to avoid corrupting memory beyond the fixed-size slab-allocated session array when there are more than FASTRPC_MAX_SESSIONS sessions defined in the devicetree. Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") Cc: stable@vger.kernel.org # 5.1 Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220829080531.29681-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 256577983763141390f1729f1512f613f32f2486 Merge: 645b5ed871f40 478814a558419 Author: Jens Axboe Date: Thu Sep 1 08:11:11 2022 -0600 Merge tag 'nvme-6.0-2022-09-01' of git://git.infradead.org/nvme into block-6.0 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.0 - error handling fix for the new auth code (Hannes Reinecke) - fix unhandled tcp states in nvmet_tcp_state_change (Maurizio Lombardi) - add NVME_QUIRK_BOGUS_NID for Lexar NM610 (Shyamin Ayesh)" * tag 'nvme-6.0-2022-09-01' of git://git.infradead.org/nvme: nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() nvmet-auth: add missing goto in nvmet_setup_auth() nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610 commit c61feaee68b9735be06f162bc046c7f1959efb0c Author: Hu Xiaoying Date: Thu Sep 1 12:57:37 2022 +0800 usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS USB external storage device(0x0b05:1932), use gnome-disk-utility tools to test usb write < 30MB/s. if does not to load module of uas for this device, can increase the write speed from 20MB/s to >40MB/s. Suggested-by: Matthias Kaehlcke Acked-by: Alan Stern Signed-off-by: Hu Xiaoying Link: https://lore.kernel.org/r/20220901045737.3438046-1-huxiaoying@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 25e9fbf0fd38868a429feabc38abebfc6dbf6542 Author: Isaac J. Manjarres Date: Wed Aug 17 11:40:26 2022 -0700 driver core: Don't probe devices after bus_type.match() probe deferral Both __device_attach_driver() and __driver_attach() check the return code of the bus_type.match() function to see if the device needs to be added to the deferred probe list. After adding the device to the list, the logic attempts to bind the device to the driver anyway, as if the device had matched with the driver, which is not correct. If __device_attach_driver() detects that the device in question is not ready to match with a driver on the bus, then it doesn't make sense for the device to attempt to bind with the current driver or continue attempting to match with any of the other drivers on the bus. So, update the logic in __device_attach_driver() to reflect this. If __driver_attach() detects that a driver tried to match with a device that is not ready to match yet, then the driver should not attempt to bind with the device. However, the driver can still attempt to match and bind with other devices on the bus, as drivers can be bound to multiple devices. So, update the logic in __driver_attach() to reflect this. Fixes: 656b8035b0ee ("ARM: 8524/1: driver cohandle -EPROBE_DEFER from bus_type.match()") Cc: stable@vger.kernel.org Cc: Saravana Kannan Reported-by: Guenter Roeck Tested-by: Guenter Roeck Tested-by: Linus Walleij Reviewed-by: Saravana Kannan Signed-off-by: Isaac J. Manjarres Link: https://lore.kernel.org/r/20220817184026.3468620-1-isaacmanjarres@google.com Signed-off-by: Greg Kroah-Hartman commit ff878b408a03bef5d610b7e2302702e16a53636e Author: Takashi Iwai Date: Thu Sep 1 14:41:36 2022 +0200 ALSA: usb-audio: Split endpoint setups for hw_params and prepare One of the former changes for the endpoint management was the more consistent setup of endpoints at hw_params. snd_usb_endpoint_configure() is a single function that does the full setup, and it's called from both PCM hw_params and prepare callbacks. Although the EP setup at the prepare phase is usually skipped (by checking need_setup flag), it may be still effective in some cases like suspend/resume that requires the interface setup again. As it's a full and single setup, the invocation of snd_usb_endpoint_configure() includes not only the USB interface setup but also the buffer release and allocation. OTOH, doing the buffer release and re-allocation at PCM prepare phase is rather superfluous, and better to be done only in the hw_params phase. For those optimizations, this patch splits the endpoint setup to two phases: snd_usb_endpoint_set_params() and snd_usb_endpoint_prepare(), to be called from hw_params and from prepare, respectively. Note that this patch changes the driver operation slightly, effectively moving the USB interface setup again to PCM prepare stage instead of hw_params stage, while the buffer allocation and such initializations are still done at hw_params stage. And, the change of the USB interface setup timing (moving to prepare) gave an interesting "fix", too: it was reported that the recent kernels caused silent output at the beginning on playbacks on some devices on Android, and this change casually fixed the regression. It seems that those devices are picky about the sample rate change (or the interface change?), and don't follow the too immediate rate changes. Meanwhile, Android operates the PCM in the following order: - open, then hw_params with the possibly highest sample rate - close without prepare - re-open, hw_params with the normal sample rate - prepare, and start streaming This procedure ended up the hw_params twice with different rates, and because the recent kernel did set up the sample rate twice one and after, it screwed up the device. OTOH, the earlier kernels didn't set up the USB interface at hw_params, hence this problem didn't appear. Now, with this patch, the USB interface setup is again back to the prepare phase, and it works around the problem automagically. Although we should address the sample rate problem in a more solid way in future, let's keep things working as before for now. Fixes: bf6313a0ff76 ("ALSA: usb-audio: Refactor endpoint management") Cc: Reported-by: chihhao chen Link: https://lore.kernel.org/r/87e6d6ae69d68dc588ac9acc8c0f24d6188375c3.camel@mediatek.com Link: https://lore.kernel.org/r/20220901124136.4984-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 791ae8e8960efbf2e331eae7110db65b4f9f9083 Author: Vadim Pasternak Date: Tue Aug 23 23:19:37 2022 +0300 platform/mellanox: Remove redundant 'NULL' check Remove 'NULL' check for 'data->hpdev.client' in error flow of mlxreg_lc_probe(). It cannot be 'NULL' at this point. Fixes: b4b830a34d80 ("platform/mellanox: mlxreg-lc: Fix error flow and extend verbosity") Reported-by: Dan Carpenter Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20220823201937.46855-5-vadimp@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 2f92fdd043d548a14287889742e147f8ed4ee03d Author: Vadim Pasternak Date: Tue Aug 23 23:19:36 2022 +0300 platform/mellanox: Remove unnecessary code Remove redundant 'NULL' check for of if 'data->notifier'. Replace 'return err' by 'return 0' in mlxreg_lc_probe(). Fixes: 62f9529b8d5c87b ("platform/mellanox: mlxreg-lc: Add initial support for Nvidia line card devices") Reported-by: Dan Carpenter Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20220823201937.46855-4-vadimp@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 1e092b7faa6b507125b69c92a51bb22c2d549d37 Author: Vadim Pasternak Date: Tue Aug 23 23:19:35 2022 +0300 platform/mellanox: mlxreg-lc: Fix locking issue Fix locking issues: - mlxreg_lc_state_update() takes a lock when set or clear "MLXREG_LC_POWERED". - All the devices can be deleted before MLXREG_LC_POWERED flag is cleared. To fix it: - Add lock() / unlock() at the beginning / end of mlxreg_lc_event_handler() and remove locking from mlxreg_lc_power_on_off() and mlxreg_lc_enable_disable() - Add locked version of mlxreg_lc_state_update() - mlxreg_lc_state_update_locked() for using outside mlxreg_lc_event_handler(). (2) Remove redundant NULL check for of if 'data->notifier'. Fixes: 62f9529b8d5c87b ("platform/mellanox: mlxreg-lc: Add initial support for Nvidia line card devices") Reported-by: Dan Carpenter Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20220823201937.46855-3-vadimp@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 17c2bd6bea4c32fe691c1f9ebcc20fd48d77454a Author: Vadim Pasternak Date: Tue Aug 23 23:19:34 2022 +0300 platform/mellanox: mlxreg-lc: Fix coverity warning Fix smatch warning: drivers/platform/mellanox/mlxreg-lc.c:866 mlxreg_lc_probe() warn: passing zero to 'PTR_ERR' by removing 'err = PTR_ERR(regmap)'. Fixes: b4b830a34d80 ("platform/mellanox: mlxreg-lc: Fix error flow and extend verbosity") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20220823201937.46855-2-vadimp@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c3b82d26bc85f5fc2fef5ec8cce17c89633a55a8 Author: Hans de Goede Date: Mon Aug 29 18:35:44 2022 +0200 platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes 2 keymap fixes for the Acer Aspire One AOD270 and the same hardware rebranded as Packard Bell Dot SC: 1. The F2 key is marked with a big '?' symbol on the Packard Bell Dot SC, this sends WMID_HOTKEY_EVENTs with a scancode of 0x27 add a mapping for this. 2. Scancode 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate input event with the "Video Bus" input device events. But on these devices the "Video Bus" does not send events for this key. Map 0x61 to KEY_UNKNOWN instead of using KE_IGNORE so that udev/hwdb can override it on these devs. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220829163544.5288-1-hdegoede@redhat.com commit 5fbc49cef91916140a305f22f7430e9a7ea0c6b4 Author: Ard Biesheuvel Date: Fri Aug 26 18:48:00 2022 +0200 arm64: mm: Reserve enough pages for the initial ID map The logic that conditionally allocates one additional page at each swapper page table level if KASLR is enabled is also applied to the initial ID map, now that we have started using the same set of macros to allocate the space for it. However, the placement of the kernel in physical memory might result in additional pages being needed at any level, even if KASLR is disabled in the build. So account for this in the computation. Fixes: c3cee924bd85 ("arm64: head: cover entire kernel image in initial ID map") Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220826164800.2059148-1-ardb@kernel.org Signed-off-by: Will Deacon commit 6bb0d64c100091e131cd16710b62fda3319cd0af Author: Yu Zhe Date: Thu Aug 25 09:18:44 2022 +0800 perf/arm_pmu_platform: fix tests for platform_get_irq() failure The platform_get_irq() returns negative error codes. It can't actually return zero. Signed-off-by: Yu Zhe Link: https://lore.kernel.org/r/20220825011844.8536-1-yuzhe@nfschina.com Signed-off-by: Will Deacon commit e62b9e6f25fc99be07c3b7b284262ee74ed645a9 Author: Ard Biesheuvel Date: Sat Aug 27 09:09:04 2022 +0200 arm64: head: Ignore bogus KASLR displacement on non-relocatable kernels Even non-KASLR kernels can be built as relocatable, to work around broken bootloaders that violate the rules regarding physical placement of the kernel image - in this case, the physical offset modulo 2 MiB is used as the KASLR offset, and all absolute symbol references are fixed up in the usual way. This workaround is enabled by default. CONFIG_RELOCATABLE can also be disabled entirely, in which case the relocation code and the code that captures the offset are omitted from the build. However, since commit aacd149b6238 ("arm64: head: avoid relocating the kernel twice for KASLR"), this code got out of sync, and we still add the offset to the kernel virtual address before populating the page tables even though we never capture it. This means we add a bogus value instead, breaking the boot entirely. Fixes: aacd149b6238 ("arm64: head: avoid relocating the kernel twice for KASLR") Signed-off-by: Ard Biesheuvel Tested-by: Mikulas Patocka Link: https://lore.kernel.org/r/20220827070904.2216989-1-ardb@kernel.org Signed-off-by: Will Deacon commit 4831be702b95047c89b3fa5728d07091e9e9f7c9 Author: Levi Yun Date: Wed Aug 31 19:39:13 2022 +0900 arm64/kexec: Fix missing extra range for crashkres_low. Like crashk_res, Calling crash_exclude_mem_range function with crashk_low_res area would need extra crash_mem range too. Add one more extra cmem slot in case of crashk_low_res is used. Signed-off-by: Levi Yun Fixes: 944a45abfabc ("arm64: kdump: Reimplement crashkernel=X") Cc: # 5.19.x Acked-by: Baoquan He Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220831103913.12661-1-ppbuk5246@gmail.com Signed-off-by: Will Deacon commit 21457f4a91cb522f1a3ad9741ff1d25fadfaa3c5 Author: David Howells Date: Wed Aug 31 13:24:44 2022 +0100 rxrpc: Remove rxrpc_get_reply_time() which is no longer used Remove rxrpc_get_reply_time() as that is no longer used now that the call issue time is used instead of the reply time. Signed-off-by: David Howells commit 7903192c4b4a82d792cb0dc5e2779a2efe60d45b Author: David Howells Date: Wed Aug 31 13:16:42 2022 +0100 afs: Use the operation issue time instead of the reply time for callbacks rxrpc and kafs between them try to use the receive timestamp on the first data packet (ie. the one with sequence number 1) as a base from which to calculate the time at which callback promise and lock expiration occurs. However, we don't know how long it took for the server to send us the reply from it having completed the basic part of the operation - it might then, for instance, have to send a bunch of a callback breaks, depending on the particular operation. Fix this by using the time at which the operation is issued on the client as a base instead. That should never be longer than the server's idea of the expiry time. Fixes: 781070551c26 ("afs: Fix calculation of callback expiry time") Fixes: 2070a3e44962 ("rxrpc: Allow the reply time to be obtained on a client call") Suggested-by: Jeffrey E Altman Signed-off-by: David Howells commit 214a9dc7d852216e83acac7b75bc18f01ce184c2 Author: David Howells Date: Tue Apr 5 13:34:09 2022 +0100 rxrpc: Fix calc of resend age Fix the calculation of the resend age to add a microsecond value as microseconds, not nanoseconds. Signed-off-by: David Howells commit d3d863036d688313f8d566b87acd7d99daf82749 Author: David Howells Date: Fri May 6 23:55:21 2022 +0100 rxrpc: Fix local destruction being repeated If the local processor work item for the rxrpc local endpoint gets requeued by an event (such as an incoming packet) between it getting scheduled for destruction and the UDP socket being closed, the rxrpc_local_destroyer() function can get run twice. The second time it can hang because it can end up waiting for cleanup events that will never happen. Signed-off-by: David Howells commit 0d40f728e28393a8817d1fcae923dfa3409e488c Author: David Howells Date: Wed Aug 24 22:39:28 2022 +0100 rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() rxkad_verify_packet_2() has a small stack-allocated sglist of 4 elements, but if that isn't sufficient for the number of fragments in the socket buffer, we try to allocate an sglist large enough to hold all the fragments. However, for large packets with a lot of fragments, this isn't sufficient and we need at least one additional fragment. The problem manifests as skb_to_sgvec() returning -EMSGSIZE and this then getting returned by userspace. Most of the time, this isn't a problem as rxrpc sets a limit of 5692, big enough for 4 jumbo subpackets to be glued together; occasionally, however, the server will ignore the reported limit and give a packet that's a lot bigger - say 19852 bytes with ->nr_frags being 7. skb_to_sgvec() then tries to return a "zeroth" fragment that seems to occur before the fragments counted by ->nr_frags and we hit the end of the sglist too early. Note that __skb_to_sgvec() also has an skb_walk_frags() loop that is recursive up to 24 deep. I'm not sure if I need to take account of that too - or if there's an easy way of counting those frags too. Fix this by counting an extra frag and allocating a larger sglist based on that. Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org commit ac56a0b48da86fd1b4389632fb7c4c8a5d86eefa Author: David Howells Date: Fri Aug 26 15:39:28 2022 +0100 rxrpc: Fix ICMP/ICMP6 error handling Because rxrpc pretends to be a tunnel on top of a UDP/UDP6 socket, allowing it to siphon off UDP packets early in the handling of received UDP packets thereby avoiding the packet going through the UDP receive queue, it doesn't get ICMP packets through the UDP ->sk_error_report() callback. In fact, it doesn't appear that there's any usable option for getting hold of ICMP packets. Fix this by adding a new UDP encap hook to distribute error messages for UDP tunnels. If the hook is set, then the tunnel driver will be able to see ICMP packets. The hook provides the offset into the packet of the UDP header of the original packet that caused the notification. An alternative would be to call the ->error_handler() hook - but that requires that the skbuff be cloned (as ip_icmp_error() or ipv6_cmp_error() do, though isn't really necessary or desirable in rxrpc's case is we want to parse them there and then, not queue them). Changes ======= ver #3) - Fixed an uninitialised variable. ver #2) - Fixed some missing CONFIG_AF_RXRPC_IPV6 conditionals. Fixes: 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook") Signed-off-by: David Howells commit 0495e337b7039191dfce6e03f5f830454b1fae6b Author: Waiman Long Date: Fri Aug 12 14:30:33 2022 -0400 mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock A circular locking problem is reported by lockdep due to the following circular locking dependency. +--> cpu_hotplug_lock --> slab_mutex --> kn->active --+ | | +-----------------------------------------------------+ The forward cpu_hotplug_lock ==> slab_mutex ==> kn->active dependency happens in kmem_cache_destroy(): cpus_read_lock(); mutex_lock(&slab_mutex); ==> sysfs_slab_unlink() ==> kobject_del() ==> kernfs_remove() ==> __kernfs_remove() ==> kernfs_drain(): rwsem_acquire(&kn->dep_map, ...); The backward kn->active ==> cpu_hotplug_lock dependency happens in kernfs_fop_write_iter(): kernfs_get_active(); ==> slab_attr_store() ==> cpu_partial_store() ==> flush_all(): cpus_read_lock() One way to break this circular locking chain is to avoid holding cpu_hotplug_lock and slab_mutex while deleting the kobject in sysfs_slab_unlink() which should be equivalent to doing a write_lock and write_unlock pair of the kn->active virtual lock. Since the kobject structures are not protected by slab_mutex or the cpu_hotplug_lock, we can certainly release those locks before doing the delete operation. Move sysfs_slab_unlink() and sysfs_slab_release() to the newly created kmem_cache_release() and call it outside the slab_mutex & cpu_hotplug_lock critical sections. There will be a slight delay in the deletion of sysfs files if kmem_cache_release() is called indirectly from a work function. Fixes: 5a836bf6b09f ("mm: slub: move flush_cpu_slab() invocations __free_slab() invocations out of IRQ context") Signed-off-by: Waiman Long Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Reviewed-by: Roman Gushchin Acked-by: David Rientjes Link: https://lore.kernel.org/all/YwOImVd+nRUsSAga@hyeyoo/ Signed-off-by: Vlastimil Babka commit f2aeea57504cbbc58da3c59b939fc16150087648 Author: Like Xu Date: Wed Aug 31 11:35:24 2022 +0800 perf/x86/core: Completely disable guest PEBS via guest's global_ctrl When a guest PEBS counter is cross-mapped by a host counter, software will remove the corresponding bit in the arr[global_ctrl].guest and expect hardware to perform a change of state "from enable to disable" via the msr_slot[] switch during the vmx transaction. The real world is that if user adjust the counter overflow value small enough, it still opens a tiny race window for the previously PEBS-enabled counter to write cross-mapped PEBS records into the guest's PEBS buffer, when arr[global_ctrl].guest has been prioritised (switch_msr_special stuff) to switch into the enabled state, while the arr[pebs_enable].guest has not. Close this window by clearing invalid bits in the arr[global_ctrl].guest. Fixes: 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations") Signed-off-by: Like Xu Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220831033524.58561-1-likexu@tencent.com commit 24919fdea6f8b31d7cdf32ac291bc5dd0b023878 Author: Kan Liang Date: Wed Aug 31 07:27:02 2022 -0700 perf/x86/intel: Fix unchecked MSR access error for Alder Lake N For some Alder Lake N machine, the below unchecked MSR access error may be triggered. [ 0.088017] rcu: Hierarchical SRCU implementation. [ 0.088017] unchecked MSR access error: WRMSR to 0x38f (tried to write 0x0001000f0000003f) at rIP: 0xffffffffb5684de8 (native_write_msr+0x8/0x30) [ 0.088017] Call Trace: [ 0.088017] [ 0.088017] __intel_pmu_enable_all.constprop.46+0x4a/0xa0 The Alder Lake N only has e-cores. The X86_FEATURE_HYBRID_CPU flag is not set. The perf cannot retrieve the correct CPU type via get_this_hybrid_cpu_type(). The model specific get_hybrid_cpu_type() is hardcode to p-core. The wrong CPU type is given to the PMU of the Alder Lake N. Since Alder Lake N isn't in fact a hybrid CPU, remove ALDERLAKE_N from the rest of {ALDER,RAPTOP}LAKE and create a non-hybrid PMU setup. The differences between Gracemont and the previous Tremont are, - Number of GP counters - Load and store latency Events - PEBS event_constraints - Instruction Latency support - Data source encoding - Memory access latency encoding Fixes: c2a960f7c574 ("perf/x86: Add new Alder Lake and Raptor Lake support") Reported-by: Jianfeng Gao Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220831142702.153110-1-kan.liang@linux.intel.com commit a6aedb58a887aa2ea142ee914ff4030d019584bf Merge: 58bfe7d8e3101 41ca302a697b6 Author: Greg Kroah-Hartman Date: Thu Sep 1 11:10:10 2022 +0200 Merge tag 'usb-serial-6.0-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: "USB-serial fixes for 6.0-rc4 Here are a couple of fixes for two long-standing issues with some older ch341 devices and a number of new device ids. All have been in linux-next with no reported issues." * tag 'usb-serial-6.0-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: ch341: fix disabled rx timer on older devices USB: serial: ch341: fix lost character on LCR updates USB: serial: cp210x: add Decagon UCA device id USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id USB: serial: option: add Quectel EM060K modem USB: serial: option: add support for OPPO R11 diag port commit 4ef3f2aff1267bfa6d5a90c42a30b927b8aa239b Author: Srinivas Kandagatla Date: Fri Jul 8 11:47:47 2022 +0100 soundwire: qcom: fix device status array range This patch updates device status array range from 11 to 12 as we will be reading status from device number 0 to device number 11 inclusive. Without this patch we can potentially access status array out of range during auto-enumeration. Fixes: aa1262ca6695 ("soundwire: qcom: Check device status before reading devid") Reported-by: Dan Carpenter Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220708104747.8722-1-srinivas.kandagatla@linaro.org Signed-off-by: Vinod Koul commit 2027f114686e0f3f1f39971964dfc618637c88c2 Author: Takashi Iwai Date: Wed Aug 31 14:59:01 2022 +0200 ALSA: usb-audio: Register card again for iface over delayed_register option When the delayed registration is specified via either delayed_register option or the quirk, we delay the invocation of snd_card_register() until the given interface. But if a wrong value has been set there and there are more interfaces over the given interface number, snd_card_register() call would be missing for those interfaces. This patch catches up those missing calls by fixing the comparison of the interface number. Now the call is skipped only if the processed interface is less than the given interface, instead of the exact match. Fixes: b70038ef4fea ("ALSA: usb-audio: Add delayed_register option") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216082 Link: https://lore.kernel.org/r/20220831125901.4660-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7e1afce5866e02b45bf88c27dd7de1b9dfade1cc Author: Takashi Iwai Date: Wed Aug 31 14:59:00 2022 +0200 ALSA: usb-audio: Inform the delayed registration more properly The info message that was added in the commit a4aad5636c72 ("ALSA: usb-audio: Inform devices that need delayed registration") is actually useful to know the need for the delayed registration. However, it turned out that this doesn't catch the all cases; namely, this warned only when a PCM stream is attached onto the existing PCM instance, but it doesn't count for a newly created PCM instance. This made confusion as if there were no further delayed registration. This patch moves the check to the code path for either adding a stream or creating a PCM instance. Also, make it simpler by checking the card->registered flag instead of querying each snd_device state. Fixes: a4aad5636c72 ("ALSA: usb-audio: Inform devices that need delayed registration") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216082 Link: https://lore.kernel.org/r/20220831125901.4660-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a8424a9b4522a3ab9f32175ad6d848739079071f Author: Yacan Liu Date: Tue Aug 30 23:23:14 2022 +0800 net/smc: Remove redundant refcount increase For passive connections, the refcount increment has been done in smc_clcsock_accept()-->smc_sock_alloc(). Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Signed-off-by: Yacan Liu Reviewed-by: Tony Lu Link: https://lore.kernel.org/r/20220830152314.838736-1-liuyacan@corp.netease.com Signed-off-by: Paolo Abeni commit 12f35199a2c0551187edbf8eb01379f0598659fa Author: yangx.jy@fujitsu.com Date: Wed Aug 31 08:16:29 2022 +0000 RDMA/srp: Set scmnd->result only when scmnd is not NULL This change fixes the following kernel NULL pointer dereference which is reproduced by blktests srp/007 occasionally. BUG: kernel NULL pointer dereference, address: 0000000000000170 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014 Workqueue: 0x0 (kblockd) RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp] Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9 RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282 RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000 RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001 R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000 R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0 Call Trace: __ib_process_cq+0xb7/0x280 [ib_core] ib_poll_handler+0x2b/0x130 [ib_core] irq_poll_softirq+0x93/0x150 __do_softirq+0xee/0x4b8 irq_exit_rcu+0xf7/0x130 sysvec_apic_timer_interrupt+0x8e/0xc0 Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent") Link: https://lore.kernel.org/r/20220831081626.18712-1-yangx.jy@fujitsu.com Signed-off-by: Xiao Yang Acked-by: Bart Van Assche Signed-off-by: Leon Romanovsky commit a54569b1f9721be11ca5b2c8a8bb3c652ebf576c Merge: b90cb10531903 6067c82c576af Author: Dave Airlie Date: Thu Sep 1 16:14:58 2022 +1000 Merge tag 'drm-intel-fixes-2022-08-26' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - GVT fixes including fix for a CommetLake regression in mmio table and misc doc and typo fixes - Fix CCS handling (Matt) - Fix for guc requests after reset (Daniele) - Display DSI related fixes (Jani) - Display backlight related fixes (Arun, Jouni) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YwjCTDFm7clXPgEu@intel.com commit 8fe4ce5836e932f5766317cb651c1ff2a4cd0506 Author: Bart Van Assche Date: Thu Aug 25 17:26:34 2022 -0700 scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed. This commit fixes the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/20220826002635.919423-1-bvanassche@acm.org Fixes: 65ca846a5314 ("scsi: core: Introduce {init,exit}_cmd_priv()") Cc: Ming Lei Cc: Christoph Hellwig Cc: Mike Christie Cc: Hannes Reinecke Cc: John Garry Cc: Li Zhijian Reported-by: Li Zhijian Tested-by: Li Zhijian Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit f782201ebc2b5f6c7a22e586e8eb81fe1d9e4801 Author: Bart Van Assche Date: Sun Aug 21 15:05:02 2022 -0700 scsi: core: Revert "Make sure that targets outlive devices" Revert the patch series "Call blk_mq_free_tag_set() earlier" because it introduces a deadlock if the scsi_remove_host() caller holds a reference on a device, target or host. Link: https://lore.kernel.org/r/20220821220502.13685-5-bvanassche@acm.org Fixes: fe442604199e ("scsi: core: Make sure that targets outlive devices") Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com Tested-by: Kenneth R. Crudup Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d94b2d00f7bfa0c555e7b8724b1faa037d57d150 Author: Bart Van Assche Date: Sun Aug 21 15:05:01 2022 -0700 scsi: core: Revert "Make sure that hosts outlive targets" Revert the patch series "Call blk_mq_free_tag_set() earlier" because it introduces a deadlock if the scsi_remove_host() caller holds a reference on a device, target or host. Link: https://lore.kernel.org/r/20220821220502.13685-4-bvanassche@acm.org Fixes: 16728aaba62e ("scsi: core: Make sure that hosts outlive targets") Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com Tested-by: Kenneth R. Crudup Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 70e8d057bef5367709f4eda15b8d9a40d1b45e90 Author: Bart Van Assche Date: Sun Aug 21 15:05:00 2022 -0700 scsi: core: Revert "Simplify LLD module reference counting" Revert the patch series "Call blk_mq_free_tag_set() earlier" because it introduces a deadlock if the scsi_remove_host() caller holds a reference on a device, target or host. Link: https://lore.kernel.org/r/20220821220502.13685-3-bvanassche@acm.org Fixes: 1a9283782df2 ("scsi: core: Simplify LLD module reference counting") Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com Tested-by: Kenneth R. Crudup Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 2b36209ca8182c5e0221dd416106d434de433d34 Author: Bart Van Assche Date: Sun Aug 21 15:04:59 2022 -0700 scsi: core: Revert "Call blk_mq_free_tag_set() earlier" Revert the patch series "Call blk_mq_free_tag_set() earlier" because it introduces a deadlock if the scsi_remove_host() caller holds a reference on a device, target or host. Link: https://lore.kernel.org/r/20220821220502.13685-2-bvanassche@acm.org Fixes: f323896fe6fa ("scsi: core: Call blk_mq_free_tag_set() earlier") Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com Tested-by: Kenneth R. Crudup Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit da6d507f5ff328f346b3c50e19e19993027b8ffd Author: Yang Yingliang Date: Tue Aug 23 12:42:37 2022 +0800 scsi: lpfc: Add missing destroy_workqueue() in error path Add the missing destroy_workqueue() before return from lpfc_sli4_driver_resource_setup() in the error path. Link: https://lore.kernel.org/r/20220823044237.285643-1-yangyingliang@huawei.com Fixes: 3cee98db2610 ("scsi: lpfc: Fix crash on driver unload in wq free") Reviewed-by: James Smart Signed-off-by: Yang Yingliang Signed-off-by: Martin K. Petersen commit c0a50cd389c3ed54831e240023dd12bafa56b3a6 Author: Hannes Reinecke Date: Wed Aug 24 08:00:33 2022 +0200 scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE When the driver hits an internal error condition returning DID_REQUEUE the I/O will be retried on the same ITL nexus. This will inhibit multipathing, resulting in endless retries even if the error could have been resolved by using a different ITL nexus. Return DID_TRANSPORT_DISRUPTED to allow for multipath to engage and route I/O to another ITL nexus. Link: https://lore.kernel.org/r/20220824060033.138661-1-hare@suse.de Reviewed-by: James Smart Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 0b4f688d53fdc2a731b9d9cdf0c96255bc024ea6 Author: Jakub Kicinski Date: Wed Aug 31 20:01:32 2022 -0700 Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb" This reverts commit 90fabae8a2c225c4e4936723c38857887edde5cc. Patch was applied hastily, revert and let the v2 be reviewed. Fixes: 90fabae8a2c2 ("sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb") Link: https://lore.kernel.org/all/87wnao2ha3.fsf@toke.dk/ Signed-off-by: Jakub Kicinski commit a3daac631e4824a68a5449f60dd86b90bb7be91a Merge: 52267ce25f60f 79e3602caa6f9 Author: Jakub Kicinski Date: Wed Aug 31 19:56:53 2022 -0700 Merge branch 'tcp-tcp-challenge-ack-fixes' Eric Dumazet says: ==================== tcp: tcp challenge ack fixes syzbot found a typical data-race addressed in the first patch. While we are at it, second patch makes the global rate limit per net-ns and disabled by default. ==================== Link: https://lore.kernel.org/r/20220830185656.268523-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit 79e3602caa6f9d59c4f66a268407080496dae408 Author: Eric Dumazet Date: Tue Aug 30 11:56:56 2022 -0700 tcp: make global challenge ack rate limitation per net-ns and default disabled Because per host rate limiting has been proven problematic (side channel attacks can be based on it), per host rate limiting of challenge acks ideally should be per netns and turned off by default. This is a long due followup of following commits: 083ae308280d ("tcp: enable per-socket rate limiting of all 'challenge acks'") f2b2c582e824 ("tcp: mitigate ACK loops for connections as tcp_sock") 75ff39ccc1bd ("tcp: make challenge acks less predictable") Signed-off-by: Eric Dumazet Cc: Jason Baron Acked-by: Neal Cardwell Signed-off-by: Jakub Kicinski commit 8c70521238b7863c2af607e20bcba20f974c969b Author: Eric Dumazet Date: Tue Aug 30 11:56:55 2022 -0700 tcp: annotate data-race around challenge_timestamp challenge_timestamp can be read an written by concurrent threads. This was expected, but we need to annotate the race to avoid potential issues. Following patch moves challenge_timestamp and challenge_count to per-netns storage to provide better isolation. Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") Reported-by: syzbot Signed-off-by: Eric Dumazet Acked-by: Neal Cardwell Signed-off-by: Jakub Kicinski commit 52267ce25f60f37ae40ccbca0b21328ebae5ae75 Author: Kurt Kanzenbach Date: Tue Aug 30 18:34:48 2022 +0200 net: dsa: hellcreek: Print warning only once In case the source port cannot be decoded, print the warning only once. This still brings attention to the user and does not spam the logs at the same time. Signed-off-by: Kurt Kanzenbach Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220830163448.8921-1-kurt@linutronix.de Signed-off-by: Jakub Kicinski commit eb55dc09b5dd040232d5de32812cc83001a23da6 Author: Nicolas Dichtel Date: Mon Aug 29 12:01:21 2022 +0200 ip: fix triggering of 'icmp redirect' __mkroute_input() uses fib_validate_source() to trigger an icmp redirect. My understanding is that fib_validate_source() is used to know if the src address and the gateway address are on the same link. For that, fib_validate_source() returns 1 (same link) or 0 (not the same network). __mkroute_input() is the only user of these positive values, all other callers only look if the returned value is negative. Since the below patch, fib_validate_source() didn't return anymore 1 when both addresses are on the same network, because the route lookup returns RT_SCOPE_LINK instead of RT_SCOPE_HOST. But this is, in fact, right. Let's adapat the test to return 1 again when both addresses are on the same link. CC: stable@vger.kernel.org Fixes: 747c14307214 ("ip: fix dflt addr selection for connected nexthop") Reported-by: kernel test robot Reported-by: Heng Qi Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220829100121.3821-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit 6726d552a6912e88cf63fe2bda87b2efa0efc7d0 Author: Aidan MacDonald Date: Fri Jun 17 13:22:54 2022 +0100 clk: ingenic-tcu: Properly enable registers before accessing timers Access to registers is guarded by ingenic_tcu_{enable,disable}_regs() so the stop bit can be cleared before accessing a timer channel, but those functions did not clear the stop bit on SoCs with a global TCU clock gate. Testing on the X1000 has revealed that the stop bits must be cleared _and_ the global TCU clock must be ungated to access timer registers. This appears to be the norm on Ingenic SoCs, and is specified in the documentation for the X1000 and numerous JZ47xx SoCs. If the stop bit isn't cleared, register writes don't take effect and the system can be left in a broken state, eg. the watchdog timer may not run. The bug probably went unnoticed because stop bits are zeroed when the SoC is reset, and the kernel does not set them unless a timer gets disabled at runtime. However, it is possible that a bootloader or a previous kernel (if using kexec) leaves the stop bits set and we should not rely on them being cleared. Fixing this is easy: have ingenic_tcu_{enable,disable}_regs() always clear the stop bit, regardless of the presence of a global TCU gate. Reviewed-by: Paul Cercueil Tested-by: Paul Cercueil Fixes: 4f89e4b8f121 ("clk: ingenic: Add driver for the TCU clocks") Cc: stable@vger.kernel.org Signed-off-by: Aidan MacDonald Link: https://lore.kernel.org/r/20220617122254.738900-1-aidanmacdonald.0x0@gmail.com Signed-off-by: Stephen Boyd commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 Author: David Leadbeater Date: Fri Aug 26 14:56:58 2022 +1000 netfilter: nf_conntrack_irc: Fix forged IP logic Ensure the match happens in the right direction, previously the destination used was the server, not the NAT host, as the comment shows the code intended. Additionally nf_nat_irc uses port 0 as a signal and there's no valid way it can appear in a DCC message, so consider port 0 also forged. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: David Leadbeater Signed-off-by: Pablo Neira Ayuso commit 2555283eb40df89945557273121e9393ef9b542b Author: Jann Horn Date: Wed Aug 31 19:06:00 2022 +0200 mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse anon_vma->degree tracks the combined number of child anon_vmas and VMAs that use the anon_vma as their ->anon_vma. anon_vma_clone() then assumes that for any anon_vma attached to src->anon_vma_chain other than src->anon_vma, it is impossible for it to be a leaf node of the VMA tree, meaning that for such VMAs ->degree is elevated by 1 because of a child anon_vma, meaning that if ->degree equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. This assumption is wrong because the ->degree optimization leads to leaf nodes being abandoned on anon_vma_clone() - an existing anon_vma is reused and no new parent-child relationship is created. So it is possible to reuse an anon_vma for one VMA while it is still tied to another VMA. This is an issue because is_mergeable_anon_vma() and its callers assume that if two VMAs have the same ->anon_vma, the list of anon_vmas attached to the VMAs is guaranteed to be the same. When this assumption is violated, vma_merge() can merge pages into a VMA that is not attached to the corresponding anon_vma, leading to dangling page->mapping pointers that will be dereferenced during rmap walks. Fix it by separately tracking the number of child anon_vmas and the number of VMAs using the anon_vma as their ->anon_vma. Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Cc: stable@kernel.org Acked-by: Michal Hocko Acked-by: Vlastimil Babka Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds commit 90fabae8a2c225c4e4936723c38857887edde5cc Author: Toke Høiland-Jørgensen Date: Wed Aug 31 11:21:03 2022 +0200 sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb When the GSO splitting feature of sch_cake is enabled, GSO superpackets will be broken up and the resulting segments enqueued in place of the original skb. In this case, CAKE calls consume_skb() on the original skb, but still returns NET_XMIT_SUCCESS. This can confuse parent qdiscs into assuming the original skb still exists, when it really has been freed. Fix this by adding the __NET_XMIT_STOLEN flag to the return value in this case. Fixes: 0c850344d388 ("sch_cake: Conditionally split GSO segments") Signed-off-by: Toke Høiland-Jørgensen Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Link: https://lore.kernel.org/r/20220831092103.442868-1-toke@toke.dk Signed-off-by: Jakub Kicinski commit 5515d21c6817bc27b0b13c61edf22b09b58bc647 Author: Tony Luck Date: Wed Aug 24 10:57:18 2022 -0700 x86/cpu: Add CPU model numbers for Meteor Lake Add model numbers for client and mobile parts. Signed-off-by: Tony Luck Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/20220824175718.232384-1-tony.luck@intel.com commit 39c84b8e929dbd4f63be7e04bf1a2bcd92b44177 Author: Chengming Gui Date: Tue Aug 30 16:33:01 2022 +0800 drm/amd/amdgpu: skip ucode loading if ucode_size == 0 Restrict the ucode loading check to avoid frontdoor loading error. Signed-off-by: Chengming Gui Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5a3a59981027b53ec0f729ad76a43ce2b64ad968 Author: Axel Rasmussen Date: Mon Aug 29 11:47:48 2022 -0700 selftests: net: sort .gitignore file This is the result of `sort tools/testing/selftests/net/.gitignore`, but preserving the comment at the top. Suggested-by: Jakub Kicinski Signed-off-by: Axel Rasmussen Link: https://lore.kernel.org/r/20220829184748.1535580-1-axelrasmussen@google.com Signed-off-by: Jakub Kicinski commit 404a5ad72011f5bd2bb90f0a035be7635e2bd839 Author: Randy Dunlap Date: Mon Aug 29 16:54:14 2022 -0700 Documentation: networking: correct possessive "its" Change occurrences of "it's" that are possessive to "its" so that they don't read as "it is". Signed-off-by: Randy Dunlap Cc: Jonathan Corbet Cc: Eric Dumazet Cc: Paolo Abeni Cc: Jiri Pirko Link: https://lore.kernel.org/r/20220829235414.17110-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf Author: Cong Wang Date: Sat Aug 27 11:13:14 2022 -0700 kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away. Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.com Reported-by: syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach") Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach") Cc: Tom Herbert Signed-off-by: Cong Wang Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski commit 3a1a274e933fca73fdc960cb1f60636cd285a265 Author: David Thompson Date: Fri Aug 26 11:59:16 2022 -0400 mlxbf_gige: compute MDIO period based on i1clk This patch adds logic to compute the MDIO period based on the i1clk, and thereafter write the MDIO period into the YU MDIO config register. The i1clk resource from the ACPI table is used to provide addressing to YU bootrecord PLL registers. The values in these registers are used to compute MDIO period. If the i1clk resource is not present in the ACPI table, then the current default hardcorded value of 430Mhz is used. The i1clk clock value of 430MHz is only accurate for boards with BF2 mid bin and main bin SoCs. The BF2 high bin SoCs have i1clk = 500MHz, but can support a slower MDIO period. Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") Reviewed-by: Asmaa Mnebhi Signed-off-by: David Thompson Link: https://lore.kernel.org/r/20220826155916.12491-1-davthompson@nvidia.com Signed-off-by: Jakub Kicinski commit abb5f3f4b1f5f0ad50eb067a00051d3587dec9fb Author: Stephen Boyd Date: Wed Aug 31 10:53:25 2022 -0700 Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" This reverts commit 35b0fac808b95eea1212f8860baf6ad25b88b087. Alexander reports that it causes boot failures on i.MX8M Plus based boards (specifically imx8mp-tqma8mpql-mba8mpxl.dts). Reported-by: Alexander Stein Cc: Chen-Yu Tsai Fixes: 35b0fac808b9 ("clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops") Link: https://lore.kernel.org/r/12115951.O9o76ZdvQC@steina-w Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20220831175326.2523912-1-sboyd@kernel.org commit c5e4d5e99162ba8025d58a3af7ad103f155d2df7 Merge: a1f764268f339 1122f40072731 Author: Linus Torvalds Date: Wed Aug 31 10:13:34 2022 -0700 Merge tag 'fscache-fixes-20220831' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache/cachefiles fixes from David Howells: - Fix kdoc on fscache_use/unuse_cookie(). - Fix the error returned by cachefiles_ondemand_copen() from an upcall result. - Fix the distribution of requests in on-demand mode in cachefiles to be fairer by cycling through them rather than picking the one with the lowest ID each time (IDs being reused). * tag 'fscache-fixes-20220831' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: cachefiles: make on-demand request distribution fairer cachefiles: fix error return code in cachefiles_ondemand_copen() fscache: fix misdocumented parameter commit a1f764268f3390406f4dcbe3d2f537f2424f22ca Merge: 2361d3841fddf 1ff89e06c2e5f Author: Linus Torvalds Date: Wed Aug 31 09:54:14 2022 -0700 Merge tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - NULL pointer dereference fix for Steam driver (Lee Jones) - memory leak fix for hidraw (Karthik Alapati) - regression fix for functionality of some UCLogic tables (Benjamin Tissoires) - a few new device IDs and device-specific quirks * tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: nintendo: fix rumble worker null pointer deref HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID HID: input: fix uclogic tablets HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list HID: add Lenovo Yoga C630 battery quirk HID: AMD_SFH: Add a DMI quirk entry for Chromebooks HID: thrustmaster: Add sparco wheel and fix array length hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo HID: asus: ROG NKey: Ignore portion of 0x5a report HID: hidraw: fix memory leak in hidraw_release() HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report commit 2361d3841fddffdd4b495a4510c507f0b8f17061 Merge: 9c9d1896fa92e 874b301985ef2 Author: Linus Torvalds Date: Wed Aug 31 09:47:06 2022 -0700 Merge tag 'v6.0-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a boot performance regression due to an unnecessary dependency on XOR_BLOCKS" * tag 'v6.0-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: lib - remove unneeded selection of XOR_BLOCKS commit 35503ce12a2c3d5d9a94e3cd85a06739b0120f79 Author: Jiri Olsa Date: Wed Aug 31 14:40:41 2022 +0200 perf script: Skip dummy event attr check Hongtao Yu reported problem when displaying uregs in perf script for system wide perf.data: # perf script -F uregs | head -10 Samples for 'dummy:HG' event do not have UREGS attribute set. Cannot print 'uregs' field. The problem is the extra dummy event added for system wide, which does not have proper sample_type setup. Skipping attr check completely for dummy event as suggested by Namhyung, because it does not have any samples anyway. Reported-by: Hongtao Yu Suggested-by: Namhyung Kim Signed-off-by: Jiri Olsa Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220831124041.219925-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9c9d1896fa92e05e7af5a7a47e335f834aa4248c Merge: dcf8e5633e2e6 dd9373402280c Author: Linus Torvalds Date: Wed Aug 31 09:23:16 2022 -0700 Merge tag 'lsm-pr-20220829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull LSM support for IORING_OP_URING_CMD from Paul Moore: "Add SELinux and Smack controls to the io_uring IORING_OP_URING_CMD. These are necessary as without them the IORING_OP_URING_CMD remains outside the purview of the LSMs (Luis' LSM patch, Casey's Smack patch, and my SELinux patch). They have been discussed at length with the io_uring folks, and Jens has given his thumbs-up on the relevant patches (see the commit descriptions). There is one patch that is not strictly necessary, but it makes testing much easier and is very trivial: the /dev/null IORING_OP_URING_CMD patch." * tag 'lsm-pr-20220829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: Smack: Provide read control for io_uring_cmd /dev/null: add IORING_OP_URING_CMD support selinux: implement the security_uring_cmd() LSM hook lsm,io_uring: add LSM hooks for the new uring_cmd file op commit 0dec364ffeb6149aae572ded1e34d4b444c23be6 Author: Conor Dooley Date: Thu Aug 25 19:04:18 2022 +0100 riscv: dts: microchip: use an mpfs specific l2 compatible PolarFire SoC does not have the same l2 cache controller as the fu540, featuring an extra interrupt. Appease the devicetree checker overlords by adding a PolarFire SoC specific compatible to fix the below sort of warnings: mpfs-polarberry.dtb: cache-controller@2010000: interrupts: [[1], [3], [4], [2]] is too long Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") Fixes: 34fc9cc3aebe ("riscv: dts: microchip: correct L2 cache interrupts") Reviewed-by: Heinrich Schuchardt Signed-off-by: Conor Dooley commit 17e4732d1d8a859fbb56e5f050e05d3142b88f96 Author: Conor Dooley Date: Thu Aug 25 19:04:17 2022 +0100 dt-bindings: riscv: sifive-l2: add a PolarFire SoC compatible The l2 cache on PolarFire SoC is cross between that of the fu540 and the fu740. It has the extra interrupt from the fu740 but the lower number of cache-sets. Add a specific compatible to avoid the likes of: mpfs-polarberry.dtb: cache-controller@2010000: interrupts: [[1], [3], [4], [2]] is too long Fixes: 34fc9cc3aebe ("riscv: dts: microchip: correct L2 cache interrupts") Reviewed-by: Rob Herring Signed-off-by: Conor Dooley commit ee0175b3b44288c74d5292c2a9c2c154f6c0317e Author: Sander Vanheule Date: Sun Aug 7 21:21:15 2022 +0200 gpio: realtek-otto: switch to 32-bit I/O By using 16-bit I/O on the GPIO peripheral, which is apparently not safe on MIPS, the IMR can end up containing garbage. This then results in interrupt triggers for lines that don't have an interrupt handler associated. The irq_desc lookup fails, and the ISR will not be cleared, keeping the CPU busy until reboot, or until another IMR operation restores the correct value. This situation appears to happen very rarely, for < 0.5% of IMR writes. Instead of using 8-bit or 16-bit I/O operations on the 32-bit memory mapped peripheral registers, switch to using 32-bit I/O only, operating on the entire bank for all single bit line settings. For 2-bit line settings, with 16-bit port values, stick to manual (un)packing. This issue has been seen on RTL8382M (HPE 1920-16G), RTL8391M (Netgear GS728TP v2), and RTL8393M (D-Link DGS-1210-52 F3, Zyxel GS1900-48). Reported-by: Luiz Angelo Daros de Luca # DGS-1210-52 Reported-by: Birger Koblitz # GS728TP Reported-by: Jan Hoffmann # 1920-16G Fixes: 0d82fb1127fb ("gpio: Add Realtek Otto GPIO support") Signed-off-by: Sander Vanheule Cc: Paul Cercueil Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 1122f40072731525c06b1371cfa30112b9b54d27 Author: Xin Yin Date: Thu Aug 25 10:09:45 2022 +0800 cachefiles: make on-demand request distribution fairer For now, enqueuing and dequeuing on-demand requests all start from idx 0, this makes request distribution unfair. In the weighty concurrent I/O scenario, the request stored in higher idx will starve. Searching requests cyclically in cachefiles_ondemand_daemon_read, makes distribution fairer. Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up cookie") Reported-by: Yongqing Li Signed-off-by: Xin Yin Signed-off-by: David Howells Reviewed-by: Jeffle Xu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20220817065200.11543-1-yinxin.x@bytedance.com/ # v1 Link: https://lore.kernel.org/r/20220825020945.2293-1-yinxin.x@bytedance.com/ # v2 commit c93ccd63b18c8d108c57b2bb0e5f3b058b9d2029 Author: Sun Ke Date: Fri Aug 26 10:35:15 2022 +0800 cachefiles: fix error return code in cachefiles_ondemand_copen() The cache_size field of copen is specified by the user daemon. If cache_size < 0, then the OPEN request is expected to fail, while copen itself shall succeed. However, returning 0 is indeed unexpected when cache_size is an invalid error code. Fix this by returning error when cache_size is an invalid error code. Changes ======= v4: update the code suggested by Dan v3: update the commit log suggested by Jingbo. Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up cookie") Signed-off-by: Sun Ke Suggested-by: Jeffle Xu Suggested-by: Dan Carpenter Signed-off-by: David Howells Reviewed-by: Gao Xiang Reviewed-by: Jingbo Xu Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20220818111935.1683062-1-sunke32@huawei.com/ # v2 Link: https://lore.kernel.org/r/20220818125038.2247720-1-sunke32@huawei.com/ # v3 Link: https://lore.kernel.org/r/20220826023515.3437469-1-sunke32@huawei.com/ # v4 commit 873aefb376bbc0ed1dd2381ea1d6ec88106fdbd4 Author: Alex Williamson Date: Mon Aug 29 21:05:40 2022 -0600 vfio/type1: Unpin zero pages There's currently a reference count leak on the zero page. We increment the reference via pin_user_pages_remote(), but the page is later handled as an invalid/reserved page, therefore it's not accounted against the user and not unpinned by our put_pfn(). Introducing special zero page handling in put_pfn() would resolve the leak, but without accounting of the zero page, a single user could still create enough mappings to generate a reference count overflow. The zero page is always resident, so for our purposes there's no reason to keep it pinned. Therefore, add a loop to walk pages returned from pin_user_pages_remote() and unpin any zero pages. Cc: stable@vger.kernel.org Reported-by: Luboslav Pivarc Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/166182871735.3518559.8884121293045337358.stgit@omen Signed-off-by: Alex Williamson commit ec1bd37123c607ca6485beb4542a792a4db765aa Author: Khalid Masum Date: Thu Aug 18 10:07:38 2022 +0600 fscache: fix misdocumented parameter This patch fixes two warnings generated by make docs. The functions fscache_use_cookie and fscache_unuse_cookie, both have a parameter named cookie. But they are documented with the name "object" with unclear description. Which generates the warning when creating docs. This commit will replace the currently misdocumented parameter names with the correct ones while adding proper descriptions. CC: Randy Dunlap Signed-off-by: Khalid Masum Signed-off-by: David Howells Link: https://lore.kernel.org/r/20220521142446.4746-1-khalid.masum.92@gmail.com/ # v1 Link: https://lore.kernel.org/r/20220818040738.12036-1-khalid.masum.92@gmail.com/ # v2 Link: https://lore.kernel.org/r/880d7d25753fb326ee17ac08005952112fcf9bdb.1657360984.git.mchehab@kernel.org/ # Mauro's version commit 41ca302a697b64a3dab4676e01d0d11bb184737d Author: Johan Hovold Date: Wed Aug 31 10:15:25 2022 +0200 USB: serial: ch341: fix disabled rx timer on older devices At least one older CH341 appears to have the RX timer enable bit inverted so that setting it disables the RX timer and prevents the FIFO from emptying until it is full. Only set the RX timer enable bit for devices with version newer than 0x27 (even though this probably affects all pre-0x30 devices). Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfiguration") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold commit 8e83622ae7ca481c76c8fd9579877f6abae64ca2 Author: Johan Hovold Date: Wed Aug 31 10:15:24 2022 +0200 USB: serial: ch341: fix lost character on LCR updates Disable LCR updates for pre-0x30 devices which use a different (unknown) protocol for line control and where the current register write causes the next received character to be lost. Note that updating LCR using the INIT command has no effect on these devices either. Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfiguration") Fixes: 55fa15b5987d ("USB: serial: ch341: fix baud rate and line-control handling") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold commit 814816d71e29934d0a76ee259b54c0b80c3b0e4a Author: Christophe Leroy Date: Tue Aug 23 18:36:35 2022 +0200 powerpc: Fix hard_irq_disable() with sanitizer As reported by Zhouyi Zhou, WRITE_ONCE() is not atomic as expected when KASAN or KCSAN are compiled in. Fix it by re-implementing it using inline assembly. Fixes: 077fc62b2b66 ("powerpc/irq: remove inline assembly in hard_irq_disable macro") Reported-by: Zhouyi Zhou Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a8298991b3df049a54ee8e558838e34265812014.1661272586.git.christophe.leroy@csgroup.eu commit c0955bf957be4bead01fae1d791476260da7325d Author: Duoming Zhou Date: Sat Aug 27 23:38:15 2022 +0800 ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler The function neigh_timer_handler() is a timer handler that runs in an atomic context. When used by rocker, neigh_timer_handler() calls "kzalloc(.., GFP_KERNEL)" that may sleep. As a result, the sleep in atomic context bug will happen. One of the processes is shown below: ofdpa_fib4_add() ... neigh_add_timer() (wait a timer) neigh_timer_handler() neigh_release() neigh_destroy() rocker_port_neigh_destroy() rocker_world_port_neigh_destroy() ofdpa_port_neigh_destroy() ofdpa_port_ipv4_neigh() kzalloc(sizeof(.., GFP_KERNEL) //may sleep This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to GFP_ATOMIC in order to mitigate the bug. Fixes: 00fc0c51e35b ("rocker: Change world_ops API and implementation to be switchdev independant") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller commit ceb4038472a4803e7046ed488b03d11551991514 Author: Johan Hovold Date: Mon Aug 29 16:25:50 2022 +0200 USB: serial: cp210x: add Decagon UCA device id Add the device id for Decagon Devices USB Cable Adapter. Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c046-1661523546680@msvc-mesg-web108 Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 3f5df3ac646e21a79a421ae4037c4ef0632bcaa9 Author: Ian Rogers Date: Tue Aug 30 09:48:40 2022 -0700 perf metric: Return early if no CPU PMU table exists Previous behavior is to segfault if there is no CPU PMU table and a metric is sought. To reproduce compile with NO_JEVENTS=1 then request a metric, for example, "perf stat -M IPC true". Committer testing: Before: $ make -k NO_JEVENTS=1 BUILD_BPF_SKEL=1 O=/tmp/build/perf-urgent -C tools/perf install-bin $ perf stat -M IPC true Segmentation fault (core dumped) $ After: $ perf stat -M IPC true Usage: perf stat [] [] -M, --metrics monitor specified metrics or metric groups (separated by ,) $ Fixes: 00facc760903be66 ("perf jevents: Switch build to use jevents.py") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Caleb Biggers Cc: Florian Fischer Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Miaoqian Lin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Richter Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220830164846.401143-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 518e26f11af2fe4f5bebf9a0351595d508c7077f Author: Haibo Chen Date: Wed Aug 31 18:37:35 2022 +0800 gpio: pca953x: Add mutex_lock for regcache sync in PM The regcache sync will set the cache_bypass = true, at that time, when there is regmap write operation, it will bypass the regmap cache, then the regcache sync will write back the value from cache to register, which is not as our expectation. Though regmap already use its internal lock to avoid such issue, but this driver force disable the regmap internal lock in its regmap config: disable_locking = true To avoid this issue, use the driver's own lock to do the protect in system PM. Fixes: b76574300504 ("gpio: pca953x: Restore registers after suspend/resume cycle") Signed-off-by: Haibo Chen Signed-off-by: Bartosz Golaszewski commit 77972a36ecc4db7fc7c68f0e80714263c5f03f65 Author: Pablo Neira Ayuso Date: Wed Aug 31 13:11:47 2022 +0200 netfilter: nf_tables: clean up hook list when offload flags check fails splice back the hook list so nft_chain_release_hook() has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 (size 96): comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s) hex dump (first 32 bytes): 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [] kmalloc include/linux/slab.h:600 [inline] [] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901 [] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline] [] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_tables_api.c:2073 [] nf_tables_addchain.constprop.0+0x10b/0x950 net/netfilter/nf_tables_api.c:2218 [] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_tables_api.c:2593 [] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink.c:517 [] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:638 [inline] [] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.c:656 [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [] sock_sendmsg_nosec net/socket.c:714 [inline] [] sock_sendmsg+0x56/0x80 net/socket.c:734 [] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482 [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [] __sys_sendmsg+0x88/0x100 net/socket.c:2565 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") Reported-by: syzbot+5fcdbfab6d6744c57418@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso commit 475043fabe8c58fb18c32c7942d8754897bd11fa Author: Jean-Philippe Brucker Date: Wed Aug 31 09:05:04 2022 +0100 regulator: Fix qcom,spmi-regulator schema The DT validator reports an error in the schema: Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.yaml: ignoring, error in schema: patternProperties: ^(5vs[1-2]|(l|s)[1-9][0-9]?|lvs[1-3])$: properties Move the unevaluatedProperties statement out of the properties section to fix it. Fixes: 0b3bbd7646b0 ("regulator: qcom,spmi-regulator: Convert to dtschema") Reviewed-by: Rob Herring Signed-off-by: Jean-Philippe Brucker Link: https://lore.kernel.org/r/20220831080503.17600-1-jean-philippe@linaro.org Signed-off-by: Mark Brown commit d047283a7034140ea5da759a494fd2274affdd46 Author: Harsh Modi Date: Tue Aug 30 22:36:03 2022 -0700 netfilter: br_netfilter: Drop dst references before setting. The IPv6 path already drops dst in the daddr changed case, but the IPv4 path does not. This change makes the two code paths consistent. Further, it is possible that there is already a metadata_dst allocated from ingress that might already be attached to skbuff->dst while following the bridge path. If it is not released before setting a new metadata_dst, it will be leaked. This is similar to what is done in bpf_set_tunnel_key() or ip6_route_input(). It is important to note that the memory being leaked is not the dst being set in the bridge code, but rather memory allocated from some other code path that is not being freed correctly before the skb dst is overwritten. An example of the leakage fixed by this commit found using kmemleak: unreferenced object 0xffff888010112b00 (size 256): comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. backtrace: [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 [<00000000a879497d>] process_backlog+0x93/0x190 [<00000000e41ade9f>] __napi_poll+0x28/0x170 [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 [<000000008942add0>] native_safe_halt+0x13/0x20 Florian Westphal says: "Original code was likely fine because nothing ever did set a skb->dst entry earlier than bridge in those days." Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Harsh Modi Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b118509076b39cc5e616c0680312b5caaca535fe Author: Pablo Neira Ayuso Date: Fri Aug 26 08:49:16 2022 +0200 netfilter: remove nf_conntrack_helper sysctl and modparam toggles __nf_ct_try_assign_helper() remains in place but it now requires a template to configure the helper. A toggle to disable automatic helper assignment was added by: a9006892643a ("netfilter: nf_ct_helper: allow to disable automatic helper assignment") in 2012 to address the issues described in "Secure use of iptables and connection tracking helpers". Automatic conntrack helper assignment was disabled by: 3bb398d925ec ("netfilter: nf_ct_helper: disable automatic helper assignment") back in 2016. This patch removes the sysctl and modparam toggles, users now have to rely on explicit conntrack helper configuration via ruleset. Update tools/testing/selftests/netfilter/nft_conntrack_helper.sh to check that auto-assignment does not happen anymore. Acked-by: Aaron Conole Signed-off-by: Pablo Neira Ayuso commit 58bfe7d8e31014d7ce246788df99c56e3cfe6c68 Author: Greg Kroah-Hartman Date: Wed Aug 31 10:34:25 2022 +0200 Revert "usb: add quirks for Lenovo OneLink+ Dock" This reverts commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58. The quirk does not work properly, more work is needed to determine what should be done here. Reported-by: Oliver Neukum Cc: Jean-Francois Le Fillatre Cc: stable Fixes: 3d5f70949f1b ("usb: add quirks for Lenovo OneLink+ Dock") Link: https://lore.kernel.org/r/9a17ea86-079f-510d-e919-01bc53a6d09f@gmx.com Signed-off-by: Greg Kroah-Hartman commit 150f7b11cb59670a147e88580a604ce3c6845a88 Author: Ricardo Ribalda Date: Mon Aug 22 15:17:54 2022 +0200 media: uvcvideo: Fix InterfaceProtocol for Quanta camera The Quanta 0408:4034 camera implements UVC 1.5, and thus sets bInterfaceProtocol to UVC_PC_PROTOCOL_15. Commit 95f03d973478 ("media: uvcvideo: Limit power line control for Quanta cameras") added a quirk for the device that incorrectly specified the UVC 1.0 protocol, rendering the quirk inoperative. Fix it. Link: https://lore.kernel.org/linux-media/20220822131754.102393-1-ribalda@chromium.org Fixes: 95f03d973478 ("media: uvcvideo: Limit power line control for Quanta cameras") Reviewed-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab commit 3d074b750d2b4c91962f10ea1df1c289ce0d3ce8 Author: Claudiu Beznea Date: Fri Aug 26 11:39:26 2022 +0300 ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time VDD_OTHER is not connected to any on board consumer thus it is not needed to keep it enabled all the time. Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-9-claudiu.beznea@microchip.com commit 617a0d9fe6867bf5b3b7272629cd780c27c877d9 Author: Claudiu Beznea Date: Fri Aug 26 11:39:25 2022 +0300 ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time ldo2 is not used by any consumer on sama5d27_wlsom1 board, thus don't keep it enabled all the time. Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 and wlsom1-ek") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-8-claudiu.beznea@microchip.com commit 7f41d52ced9e1b7ed4ff8e1ae9cacbf46b64e6db Author: Claudiu Beznea Date: Fri Aug 26 11:39:24 2022 +0300 ARM: dts: at91: sama7g5ek: specify proper regulator output ranges Min and max output ranges of regulators need to satisfy board requirements not PMIC requirements. Thus adjust device tree to cope with this. Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-7-claudiu.beznea@microchip.com commit 7737d93666eea282febf95e5fa3b3fde1f2549f3 Author: Claudiu Beznea Date: Fri Aug 26 11:39:23 2022 +0300 ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges Min and max output ranges of regulators need to satisfy board requirements not PMIC requirements. Thus adjust device tree to cope with this. Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-6-claudiu.beznea@microchip.com commit addf7efec23af2b67547800aa232d551945e7de2 Author: Claudiu Beznea Date: Fri Aug 26 11:39:22 2022 +0300 ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges Min and max output ranges of regulators need to satisfy board requirements not PMIC requirements. Thus adjust device tree to cope with this. Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 and wlsom1-ek") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-5-claudiu.beznea@microchip.com commit 7a94b83a7dc551607b6c4400df29151e6a951f07 Author: Claudiu Beznea Date: Fri Aug 26 11:39:21 2022 +0300 ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh On SAMA7G5, when resuming from backup and self-refresh, the bootloader performs DDR PHY recalibration by restoring the value of ZQ0SR0 (stored in RAM by Linux before going to backup and self-refresh). It has been discovered that the current procedure doesn't work for all possible values that might go to ZQ0SR0 due to hardware bug. The workaround to this is to avoid storing some values in ZQ0SR0. Thus Linux will read the ZQ0SR0 register and cache its value in RAM after processing it (using modified_gray_code array). The bootloader will restore the processed value. Fixes: d2d4716d8384 ("ARM: at91: pm: save ddr phy calibration data to securam") Suggested-by: Frederic Schumacher Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-4-claudiu.beznea@microchip.com commit a02875c4cbd6f3d2f33d70cc158a19ef02d4b84f Author: Claudiu Beznea Date: Fri Aug 26 11:39:20 2022 +0300 ARM: at91: pm: fix self-refresh for sama7g5 It has been discovered that on some parts, from time to time, self-refresh procedure doesn't work as expected. Debugging and investigating it proved that disabling AC DLL introduce glitches in RAM controllers which leads to unexpected behavior. This is confirmed as a hardware bug. DLL bypass disables 3 DLLs: 2 DX DLLs and AC DLL. Thus, keep only DX DLLs disabled. This introduce 6mA extra current consumption on VDDCORE when switching to any ULP mode or standby mode but the self-refresh procedure still works. Fixes: f0bbf17958e8 ("ARM: at91: pm: add self-refresh support for sama7g5") Suggested-by: Frederic Schumacher Signed-off-by: Claudiu Beznea Tested-by: Cristian Birsan Link: https://lore.kernel.org/r/20220826083927.3107272-3-claudiu.beznea@microchip.com commit 13a9d08c296228d18289de60b83792c586e1d073 Author: Dan Carpenter Date: Fri Aug 26 18:00:30 2022 +0300 net: lan966x: improve error handle in lan966x_fdma_rx_get_frame() Don't just print a warning. Clean up and return an error as well. Fixes: c8349639324a ("net: lan966x: Add FDMA functionality") Signed-off-by: Dan Carpenter Reviewed-by: Horatiu Vultur Link: https://lore.kernel.org/r/YwjgDm/SVd5c1tQU@kili Signed-off-by: Jakub Kicinski commit 642b2122c5df332a6df52dd1f91e552bc4356951 Author: Gao Xiao Date: Mon Aug 29 12:16:51 2022 +0200 nfp: fix the access to management firmware hanging When running `ethtool -p` with the old management firmware, the management firmware resource is not correctly released, which causes firmware related malfunction: all the access to management firmware hangs. It releases the management firmware resource when set id mode operation is not supported. Fixes: ccb9bc1dfa44 ("nfp: add 'ethtool --identify' support") Signed-off-by: Gao Xiao Reviewed-by: Louis Peens Signed-off-by: Simon Horman Reviewed-by: Jesse Brandeburg Link: https://lore.kernel.org/r/20220829101651.633840-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit 613c86977efd2a311683b09d7c5deaa0db49337c Merge: 4a4ce82212ef0 ffd7bdddaab19 Author: Jakub Kicinski Date: Tue Aug 30 23:01:47 2022 -0700 Merge tag 'ieee802154-for-net-2022-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan Stefan Schmidt says: ==================== ieee802154 for net 2022-08-29 - repeated word fix from Jilin Yuan. - missed return code setting in the cc2520 driver by Li Qiong. - fixing a potential race in by defering the workqueue destroy in the adf7242 driver by Lin Ma. - fixing a long standing problem in the mac802154 rx path to match corretcly by Miquel Raynal. * tag 'ieee802154-for-net-2022-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan: ieee802154: cc2520: add rc code in cc2520_tx() net: mac802154: Fix a condition in the receive path net/ieee802154: fix repeated words in comments ieee802154/adf7242: defer destroy_workqueue call ==================== Link: https://lore.kernel.org/r/20220829100308.2802578-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 4a4ce82212ef014d70f486a427005b2b5bab8e34 Author: Horatiu Vultur Date: Tue Aug 30 08:40:55 2022 +0200 net: phy: micrel: Make the GPIO to be non-exclusive The same GPIO line can be shared by multiple phys for the coma mode pin. If that is the case then, all the other phys that share the same line will failed to be probed because the access to the gpio line is not non-exclusive. Fix this by making access to the gpio line to be nonexclusive using flag GPIOD_FLAGS_BIT_NONEXCLUSIVE. This allows all the other PHYs to be probed. Fixes: 738871b09250ee ("net: phy: micrel: add coma mode GPIO") Reviewed-by: Andrew Lunn Signed-off-by: Horatiu Vultur Link: https://lore.kernel.org/r/20220830064055.2340403-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit fce1c23f629173e0db78b79a74f2052044a00e65 Author: Alvaro Karsz Date: Tue Aug 23 10:39:47 2022 +0300 net: virtio_net: fix notification coalescing comments Fix wording in comments for the notifications coalescing feature. Signed-off-by: Alvaro Karsz Acked-by: Michael S. Tsirkin Link: https://lore.kernel.org/r/20220823073947.14774-1-alvaro.karsz@solid-run.com Signed-off-by: Jakub Kicinski commit 478814a5584197fa1fb18377653626e3416e7cd6 Author: Maurizio Lombardi Date: Mon Aug 29 14:40:30 2022 +0200 nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change() TCP_FIN_WAIT2 and TCP_LAST_ACK were not handled, the connection is closing so we can ignore them and avoid printing the "unhandled state" warning message. [ 1298.852386] nvmet_tcp: queue 2 unhandled state 5 [ 1298.879112] nvmet_tcp: queue 7 unhandled state 5 [ 1298.884253] nvmet_tcp: queue 8 unhandled state 5 [ 1298.889475] nvmet_tcp: queue 9 unhandled state 5 v2: Do not call nvmet_tcp_schedule_release_queue(), just ignore the fin_wait2 and last_ack states. Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit da0342a3aa0357795224e6283df86444e1117168 Author: Hannes Reinecke Date: Wed Aug 24 09:23:16 2022 +0200 nvmet-auth: add missing goto in nvmet_setup_auth() There's a goto missing in nvmet_setup_auth(), causing a kernel oops when nvme_auth_extract_key() fails. Reported-by: Tal Lossos Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 200dccd07df21b504a2168960059f0a971bf415d Author: Shyamin Ayesh Date: Fri Aug 26 09:51:40 2022 -0700 nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610 Lexar NM610 reports bogus eui64 values that appear to be the same across all drives. Quirk them out so they are not marked as "non globally unique" duplicates. Signed-off-by: Shyamin Ayesh [patch formatting] Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 27893dfc1285f80f80f46b3b8c95f5d15d2e66d0 Author: Enzo Matsumiya Date: Tue Aug 30 19:51:51 2022 -0300 cifs: fix small mempool leak in SMB2_negotiate() In some cases of failure (dialect mismatches) in SMB2_negotiate(), after the request is sent, the checks would return -EIO when they should be rather setting rc = -EIO and jumping to neg_exit to free the response buffer from mempool. Signed-off-by: Enzo Matsumiya Cc: stable@vger.kernel.org Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 3e3761f1ec7df67d88cfca5e2ea98538f529e645 Author: Steve French Date: Mon Aug 29 11:53:41 2022 -0500 smb3: use filemap_write_and_wait_range instead of filemap_write_and_wait When doing insert range and collapse range we should be writing out the cached pages for the ranges affected but not the whole file. Fixes: c3a72bb21320 ("smb3: Move the flush out of smb2_copychunk_range() into its callers") Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: David Howells Signed-off-by: Steve French commit 910ab9eee0f61a243126d70e932e1301b5437583 Author: Hawking Zhang Date: Tue Aug 30 15:47:47 2022 +0800 drm/amdgpu: only init tap_delay ucode when it's included in ucode binary Not all the gfx10 variants need to integrate global tap_delay and per se tap_delay firmwares Only init tap_delay ucode when it does include in rlc ucode binary so driver doesn't send a null buffer to psp for firmware loading Signed-off-by: Hawking Zhang Reviewed-by: Jack Gui Signed-off-by: Alex Deucher commit 7b471c32e4cbfdd7a673b79321f6a26abecbf33b Author: Vladimir Stempen Date: Fri Aug 19 18:32:01 2022 -0400 drm/amd/display: Fix black flash when switching from ODM2to1 to ODMBypass [Why] On secondary display hotplug we switch primary stream from ODM2to1 to ODMBypass mode. Current logic will trigger disabling front end for this stream. [How] We need to check if prev_odm_pipe is equal to NULL in order to disable dangling planes in this scenario. Reviewed-by: Ariel Bernstein Acked-by: Brian Chang Signed-off-by: Vladimir Stempen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d6f84bab48745ea68814d596eb476a9c11ce76ae Author: Ethan Wellenreiter Date: Fri Aug 19 18:30:44 2022 -0400 drm/amd/display: Fix check for stream and plane [WHY] Function wasn't returning false when it had a no stream [HOW] Made it return false when it had no stream. Reviewed-by: Alvin Lee Acked-by: Brian Chang Signed-off-by: Ethan Wellenreiter Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f5b9c1ffabce5f4acbeabd3a03fd57b3970a13fe Author: Ethan Wellenreiter Date: Mon Aug 22 14:33:23 2022 -0400 drm/amd/display: Re-initialize viewport after pipe merge [Why] Pipes get merged in preparation for SubVP but if they don't get used, and are in ODM or some other multi pipe config, it would calculate the voltage level with a viewport of just one pipe from when they were split resulting in too low of a voltage level. [How] Made it so that the viewport and other timing settings get rebuilt and re- initialized after the pipe merge, before calculating the voltage level so it would calculate it correctly. Reviewed-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Brian Chang Signed-off-by: Ethan Wellenreiter Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6ffc967c36b42f864955cb2c5e8b3fded0baa918 Author: Aurabindo Pillai Date: Fri Aug 19 15:11:19 2022 -0400 drm/amd/display: Use correct plane for CAB cursor size allocation [Why&How] plane and stream variables used for cursor size allocation calculation were stale from previous iteration. Redo the iteration to find the correct cursor plane for the calculation. Reviewed-by: Alvin Lee Acked-by: Brian Chang Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b97e914552c3fcea71ce03f899e285f2178ec38b Author: Alex Sierra Date: Thu Aug 25 15:42:08 2022 -0500 drm/amdgpu: ensure no PCIe peer access for CPU XGMI iolinks [Why] Devices with CPU XGMI iolink do not support PCIe peer access. Signed-off-by: Alex Sierra Acked-by: Alex Deucher Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 2640174f4a139502f603f7bedf3a7011db714e1d Author: Evan Quan Date: Tue Aug 23 17:37:26 2022 +0800 drm/amd/pm: bump SMU 13.0.0 driver_if header version To suppress the warning about version mismatch with the latest 78.54.0 PMFW. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit b023053592646b1da9477b0b598f2cdd5d3f89d8 Author: Evan Quan Date: Tue Aug 23 16:07:18 2022 +0800 drm/amd/pm: use vbios carried pptable for all SMU13.0.7 SKUs For those SMU13.0.7 unsecure SKUs, the vbios carried pptable is ready to go. Use that one instead of hardcoded softpptable. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit d7e7546886eebf626569e38ff06d0a67b8b82757 Author: Evan Quan Date: Tue Aug 23 15:45:36 2022 +0800 drm/amd/pm: use vbios carried pptable for those supported SKUs For some SMU13.0.0 SKUs, the vbios carried pptable is ready to go. Use that one instead of hardcoded softpptable. Signed-off-by: Evan Quan Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit d0629cea1f97acc5e8d95ca2a42ddc72ed4ffa3b Author: Charlene Liu Date: Thu Aug 18 20:24:26 2022 -0400 drm/amd/display: fix wrong register access [why] fw version check was for release branch. for staging, it has a chance to enter wrong code path. Reviewed-by: Hansen Dsouza Acked-by: Brian Chang Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 595091c6ba35ba48c1f8186116bbbae2b208dce6 Author: Aurabindo Pillai Date: Thu Aug 18 17:55:01 2022 -0400 drm/amd/display: use actual cursor size instead of max for CAB allocation [Why&How] When calculating allocation for cursor size, get the real cursor through the HUBP instead of using the maximum cursor size for more optimal allocation Reviewed-by: Alvin Lee Reviewed-by: Nicholas Kazlauskas Acked-by: Brian Chang Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 94a82c9e3dffb88182a4ed0464dc0266ad0d7b45 Author: Aurabindo Pillai Date: Thu Aug 18 12:34:06 2022 -0400 drm/amd/display: disable display fresh from MALL on an edge case for DCN321 [Why&How] When using a 4k monitor when cursor caching is not supported due to framebuffer being on an uncacheable address, enabling display refresh from MALL would trigger corruption if SS is enabled. Prevent entering SS if we are on the edge case and cursor caching is not possible. Do this only if cursor size larger than a 64x64@4bpp. Pull the cursor size calculation out of if condition since cursor address may not be set on all platforms Reviewed-by: Alvin Lee Reviewed-by: Nicholas Kazlauskas Acked-by: Brian Chang Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4fd7f14b56b2e727dd66a62e217e57015da4e9fd Author: Aurabindo Pillai Date: Thu Aug 18 17:25:05 2022 -0400 drm/amd/display: Fix CAB cursor size allocation for DCN32/321 For calculating cursor size allocation, surface size was used, resulting in over allocation Reviewed-by: Alvin Lee Reviewed-by: Nicholas Kazlauskas Acked-by: Brian Chang Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6783e6bbc2457dbed351fb0d2477aa6060a7d32b Author: Leo Chen Date: Thu Aug 18 13:21:37 2022 -0400 drm/amd/display: Missing HPO instance added [Why & How] Number of encoder is set to 4 but only 3 instances are created. Reviewed-by: Charlene Liu Acked-by: Brian Chang Signed-off-by: Leo Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3e834a17a22cb8e9169c0b018d1a2df126977db3 Author: Wang Fudong Date: Wed Aug 17 17:47:50 2022 +0800 drm/amd/display: set dig fifo read start level to 7 before dig fifo reset [Why] DIG_FIFO_ERROR = 1 caused mst daisy chain 2nd monitor black. [How] We need to set dig fifo read start level = 7 before dig fifo reset during dig fifo enable according to hardware designer's suggestion. If it is zero, it will cause underflow or overflow and DIG_FIFO_ERROR = 1. Reviewed-by: Alvin Lee Reviewed-by: Aric Cyr Acked-by: Brian Chang Signed-off-by: Wang Fudong Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3c93603d9568c7c4b20ff1712ddc60e997d78df7 Author: YuBiao Wang Date: Wed Aug 24 15:56:04 2022 +0800 drm/amdgpu: Fix use-after-free in amdgpu_cs_ioctl [Why] In amdgpu_cs_ioctl, amdgpu_job_free could be performed ealier if there is -ERESTARTSYS error. In this case, job->hw_fence could be not initialized yet. Putting hw_fence during amdgpu_job_free could lead to a use-after-free warning. [How] Check if drm_sched_job_init is performed before job_free by checking s_fence. v2: Check hw_fence.ops instead since it could be NULL if fence is not initialized. Reverse the condition since !=NULL check is discouraged in kernel. Signed-off-by: YuBiao Wang Reviewed-by: Andrey Grodzovsky Signed-off-by: Alex Deucher commit d1b4a51a4ca8954f30cf4671b25c4f8637c45600 Author: Duncan Ma Date: Mon Aug 15 17:37:32 2022 -0400 drm/amd/display: Fix OTG H timing reset for dcn314 [Why] When ODM is enabled, H timing control register reset to 0. Div mode manual field get overwritten causing no display on certain modes for dcn314. [How] Use REG_UPDATE instead of REG_SET to set div_mode field. Reviewed-by: Charlene Liu Reviewed-by: Nicholas Kazlauskas Acked-by: Brian Chang Signed-off-by: Duncan Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 507fd7c400032b126747a5ae8cca2816d73f009a Author: George Shen Date: Wed Aug 10 22:06:17 2022 -0400 drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming [Why] Each index in the DPSTREAMCLK_CNTL register phyiscally maps 1-to-1 with HPO stream encoder instance. On the other hand, each index in DTBCLK_P_CNTL physically maps 1-to-1 with OTG instance. Current DCN32 DPSTREAMCLK_CLK programing assumes that OTG instance always maps 1-to-1 with HPO stream encoder instance. This is not always guaranteed and can result in blackscreen. [How] Program the correct dpstreamclk instance with the correct dtbclk_p source. Reviewed-by: Ariel Bernstein Acked-by: Brian Chang Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 47e04eed84bb07cc5b54462752a4bc7286ab8197 Author: Graham Sider Date: Mon Aug 15 13:28:19 2022 -0400 drm/amdgpu: Update mes_v11_api_def.h New GFX11 MES FW adds the trap_en bit. For now hardcode to 1 (traps enabled). Signed-off-by: Graham Sider Acked-by: Felix Kuehling Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit c8fea9273fd1be308668496badfcbd55183e0dd3 Author: Guchun Chen Date: Wed Aug 24 23:00:02 2022 +0800 drm/amdgpu: disable FRU access on special SIENNA CICHLID card Below driver load error will be printed, not friendly to end user. amdgpu: ATOM BIOS: 113-D603GLXE-077 [drm] FRU: Failed to get size field [drm:amdgpu_fru_get_product_info [amdgpu]] *ERROR* Failed to read FRU Manufacturer, ret:-5 Signed-off-by: Guchun Chen Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c Author: Gerald Schaefer Date: Fri Aug 19 18:53:43 2022 +0200 s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages The alignment check in prepare_hugepage_range() is wrong for 2 GB hugepages, it only checks for 1 MB hugepage alignment. This can result in kernel crash in __unmap_hugepage_range() at the BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings created with MAP_FIXED at unaligned address. Fix this by correctly handling multiple hugepage sizes, similar to the generic version of prepare_hugepage_range(). Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages") Cc: # 4.8+ Acked-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik commit bdbf57bca6bf0b76a0f2681014552b25917c26e1 Author: Heiko Carstens Date: Mon Aug 29 13:17:07 2022 +0200 s390: update defconfigs Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit c9305b6c1f52060377c72aebe3a701389e9f3172 Author: Josh Poimboeuf Date: Fri Aug 26 16:55:44 2022 -0700 s390: fix nospec table alignments Add proper alignment for .nospec_call_table and .nospec_return_table in vmlinux. [hca@linux.ibm.com]: The problem with the missing alignment of the nospec tables exist since a long time, however only since commit e6ed91fd0768 ("s390/alternatives: remove padding generation code") and with CONFIG_RELOCATABLE=n the kernel may also crash at boot time. The above named commit reduced the size of struct alt_instr by one byte, so its new size is 11 bytes. Therefore depending on the number of cpu alternatives the size of the __alt_instructions array maybe odd, which again also causes that the addresses of the nospec tables will be odd. If the address of __nospec_call_start is odd and the kernel is compiled With CONFIG_RELOCATABLE=n the compiler may generate code that loads the address of __nospec_call_start with a 'larl' instruction. This will generate incorrect code since the 'larl' instruction only works with even addresses. In result the members of the nospec tables will be accessed with an off-by-one offset, which subsequently may lead to addressing exceptions within __nospec_revert(). Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches") Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.1661557333.git.jpoimboe@kernel.org Cc: # 4.16 Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ff03b8846705e517f878585cf66c5d8fca1c38b2 Author: Gerald Schaefer Date: Fri Aug 19 19:40:11 2022 +0200 s390/mm: remove useless hugepage address alignment The failing address alignment to HPAGE_MASK in do_exception(), for hugetlb faults, was useless from the beginning. With 2 GB hugepage support it became wrong, but w/o further negative impact. Now it could have negative performance impact because it breaks the cacheline optimization for process_huge_page(). Therefore, remove it. Note that we still have failing address alignment by HW to PAGE_SIZE, for all page faults, not just hugetlb faults. So this patch will not fix UFFD_FEATURE_EXACT_ADDRESS for userfaultfd handling. It will just move the failing address for hugetlb faults a bit closer to the real address, at 4K page granularity, similar to normal page faults. Reviewed-by: Heiko Carstens Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik commit 6d0ef7241553f3553a0a2764c69b07892705924c Author: Stanislaw Gruszka Date: Mon Aug 15 09:37:37 2022 +0200 wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() This reverts commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 as it can cause invalid link quality command sent to the firmware and address the off-by-one issue by fixing condition of while loop. Cc: stable@vger.kernel.org Fixes: a8eb8e6f7159 ("wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220815073737.GA999388@wp.pl commit 40b717bfcefab28a0656b8caa5e43d5449e5a671 Author: Ajay.Kathat@microchip.com Date: Tue Aug 9 07:57:56 2022 +0000 wifi: wilc1000: fix DMA on stack objects Sometimes 'wilc_sdio_cmd53' is called with addresses pointing to an object on the stack. Use dynamically allocated memory for cmd53 instead of stack address which is not DMA'able. Fixes: 5625f965d764 ("wilc1000: move wilc driver out of staging") Reported-by: Michael Walle Suggested-by: Michael Walle Signed-off-by: Ajay Singh Reviewed-by: Michael Walle Tested-by: Michael Walle Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220809075749.62752-1-ajay.kathat@microchip.com commit e230a4455ac3e9b112f0367d1b8e255e141afae0 Author: Dan Carpenter Date: Tue Aug 30 17:55:07 2022 +0300 staging: rtl8712: fix use after free bugs _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") Cc: stable Reported-by: Zheng Wang Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili Signed-off-by: Greg Kroah-Hartman commit 51fd191422d987dfd75a711aae592069ebb03ec9 Author: Michael Walle Date: Fri Aug 26 13:56:05 2022 +0200 reset: microchip-sparx5: issue a reset on startup Originally this was used in by the switch core driver to issue a reset. But it turns out, this isn't just a switch core reset but instead it will reset almost the complete SoC. Instead of adding almost all devices of the SoC a shared reset line, issue the reset once early on startup. Keep the reset controller for backwards compatibility, but make the actual reset a noop. Suggested-by: Philipp Zabel Signed-off-by: Michael Walle Tested-by: Steen Hegelund on Sparx5 Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220826115607.1148489-2-michael@walle.cc commit 051d9eb403887bb11852b7a4f744728a6a4b1b58 Author: Richard Zhu Date: Tue Aug 30 15:46:01 2022 +0800 reset: imx7: Fix the iMX8MP PCIe PHY PERST support On i.MX7/iMX8MM/iMX8MQ, the initialized default value of PERST bit(BIT3) of SRC_PCIEPHY_RCR is 1b'1. But i.MX8MP has one inversed default value 1b'0 of PERST bit. And the PERST bit should be kept 1b'1 after power and clocks are stable. So fix the i.MX8MP PCIe PHY PERST support here. Fixes: e08672c03981 ("reset: imx7: Add support for i.MX8MP SoC") Signed-off-by: Richard Zhu Reviewed-by: Philipp Zabel Tested-by: Marek Vasut Tested-by: Richard Leitner Tested-by: Alexander Stein Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/1661845564-11373-5-git-send-email-hongxing.zhu@nxp.com commit 5ef251b9b73ff9f62aa5ac60427af05b2b594a55 Merge: c063643cb33b0 acc5495bf764e Author: Greg Kroah-Hartman Date: Tue Aug 30 16:13:32 2022 +0200 Merge tag 'mhi-fixes-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-linus Manivannan writes: "A single fix targeting the MHI host stack: - Since the commit 1227d2a20cd7 ("bus: mhi: host: Move IRQ allocation to controller registration phase"), the MHI context gets freed during mhi_unregister_controller(). But when the MHI IRQs are shared, the IRQ handler may get invoked during __free_irq() if CONFIG_DEBUG_SHIRQ is set. In that case, there will be a null pointer dereference because of trying to use the freed context struct. So for fixing the issue, let's check for the existence of the context struct at the start of the handler before handling the IRQ." * tag 'mhi-fixes-for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: Fix up null pointer access in mhi_irq_handler commit c063643cb33b05b5cb14bc3fd318fad58e8f83bb Merge: a582123d6f4c6 1c11289b34ab6 Author: Greg Kroah-Hartman Date: Tue Aug 30 16:12:25 2022 +0200 Merge tag 'peci-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/iwi/linux into char-misc-linus Iwona writes: "PECI fixes for v6.0 Two minor fixes: * cpu - Fix use-after-free in adev_release() * aspeed - Fix error check for platform_get_irq()" * tag 'peci-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/iwi/linux: peci: cpu: Fix use-after-free in adev_release() peci: aspeed: fix error check return value of platform_get_irq() commit b46a6b09fa056042a302b181a1941f0056944603 Author: Pawel Laszczak Date: Thu Aug 25 08:21:37 2022 +0200 usb: cdns3: fix issue with rearming ISO OUT endpoint ISO OUT endpoint is enabled during queuing first usb request in transfer ring and disabled when TRBERR is reported by controller. After TRBERR and before next transfer added to TR driver must again reenable endpoint but does not. To solve this issue during processing TRBERR event driver must set the flag EP_UPDATE_EP_TRBADDR in priv_ep->flags field. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: Acked-by: Peter Chen Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20220825062137.5766-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit d5dcc33677d7415c5f23b3c052f9e80cbab9ea4e Author: Pawel Laszczak Date: Thu Aug 25 08:22:07 2022 +0200 usb: cdns3: fix incorrect handling TRB_SMM flag for ISOC transfer The TRB_SMM flag indicates that DMA has completed the TD service with this TRB. Usually it’s a last TRB in TD. In case of ISOC transfer for bInterval > 1 each ISOC transfer contains more than one TD associated with usb request (one TD per ITP). In such case the TRB_SMM flag will be set in every TD and driver will recognize the end of transfer after processing the first TD with TRB_SMM. In result driver stops updating request->actual and returns incorrect actual length. To fix this issue driver additionally must check TRB_CHAIN which is not used for isochronous transfers. Fixes: 249f0a25e8be ("usb: cdns3: gadget: handle sg list use case at completion correctly") cc: Acked-by: Peter Chen Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20220825062207.5824-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 Author: Krishna Kurapati Date: Sat Aug 27 08:45:10 2022 +0530 usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS During cdrom emulation, the response to read_toc command must contain the cdrom address as the number of sectors (2048 byte sized blocks) represented either as an absolute value (when MSF bit is '0') or in terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. When MAC OS sends a read_toc request with MSF set to '1', the store_cdrom_address assumes that the address being provided is the LUN size represented in 512 byte sized blocks instead of 2048. It tries to modify the address further to convert it to 2048 byte sized blocks and store it in MSF format. This results in data transfer failures as the cdrom address being provided in the read_toc response is incorrect. Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound block devices") Cc: stable@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 608e58a0f4617977178131f5f68a3fce1d3f5316 Author: Alan Stern Date: Fri Aug 26 15:31:40 2022 -0400 media: mceusb: Use new usb_control_msg_*() routines Automatic kernel fuzzing led to a WARN about invalid pipe direction in the mceusb driver: ------------[ cut here ]------------ usb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40 WARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410 usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410 Code: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 <0f> 0b e9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41 RSP: 0018:ffffc900032becf0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000 RDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90 RBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000 R10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000 R13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0 Call Trace: usb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153 mceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline] mceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807 The reason for the warning is clear enough; the driver sends an unusual read request on endpoint 0 but does not set the USB_DIR_IN bit in the bRequestType field. More importantly, the whole situation can be avoided and the driver simplified by converting it over to the relatively new usb_control_msg_recv() and usb_control_msg_send() routines. That's what this fix does. Link: https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA@mail.gmail.com/ Cc: Mauro Carvalho Chehab Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkfnBFCSEVC6XZu@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 9c6d778800b921bde3bff3cff5003d1650f942d1 Author: Alan Stern Date: Fri Aug 26 15:31:32 2022 -0400 USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: ============================================ WARNING: possible recursive locking detected 5.18.0 #3 Not tainted -------------------------------------------- kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ... stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline] device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call within another. Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a reset_in_progress flag and testing it will prevent such errors in the future. Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/ Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 1016fc0c096c92dd0e6e0541daac7a7868169903 Author: Alan Stern Date: Fri Aug 26 15:31:17 2022 -0400 USB: gadget: Fix obscure lockdep violation for udc_mutex A recent commit expanding the scope of the udc_lock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form: ====================================================== WARNING: possible circular locking dependency detected 5.19.0-rc7+ #12510 Not tainted ------------------------------------------------------ udevadm/312 is trying to acquire lock: ffff80000aae1058 (udc_lock){+.+.}-{3:3}, at: usb_udc_uevent+0x54/0xe0 but task is already holding lock: ffff000002277548 (kn->active#4){++++}-{0:0}, at: kernfs_seq_start+0x34/0xe0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (kn->active#4){++++}-{0:0}:        lock_acquire+0x68/0x84        __kernfs_remove+0x268/0x380        kernfs_remove_by_name_ns+0x58/0xac        sysfs_remove_file_ns+0x18/0x24        device_del+0x15c/0x440 -> #2 (device_links_lock){+.+.}-{3:3}:        lock_acquire+0x68/0x84        __mutex_lock+0x9c/0x430        mutex_lock_nested+0x38/0x64        device_link_remove+0x3c/0xa0        _regulator_put.part.0+0x168/0x190        regulator_put+0x3c/0x54        devm_regulator_release+0x14/0x20 -> #1 (regulator_list_mutex){+.+.}-{3:3}:        lock_acquire+0x68/0x84        __mutex_lock+0x9c/0x430        mutex_lock_nested+0x38/0x64        regulator_lock_dependent+0x54/0x284        regulator_enable+0x34/0x80        phy_power_on+0x24/0x130        __dwc2_lowlevel_hw_enable+0x100/0x130        dwc2_lowlevel_hw_enable+0x18/0x40        dwc2_hsotg_udc_start+0x6c/0x2f0        gadget_bind_driver+0x124/0x1f4 -> #0 (udc_lock){+.+.}-{3:3}:        __lock_acquire+0x1298/0x20cc        lock_acquire.part.0+0xe0/0x230        lock_acquire+0x68/0x84        __mutex_lock+0x9c/0x430        mutex_lock_nested+0x38/0x64        usb_udc_uevent+0x54/0xe0 Evidently this was caused by the scope of udc_mutex being too large. The mutex is only meant to protect udc->driver along with a few other things. As far as I can tell, there's no reason for the mutex to be held while the gadget core calls a gadget driver's ->bind or ->unbind routine, or while a UDC is being started or stopped. (This accounts for link #1 in the chain above, where the mutex is held while the dwc2_hsotg_udc is started as part of driver probing.) Gadget drivers' ->disconnect callbacks are problematic. Even though usb_gadget_disconnect() will now acquire the udc_mutex, there's a window in usb_gadget_bind_driver() between the times when the mutex is released and the ->bind callback is invoked. If a disconnect occurred during that window, we could call the driver's ->disconnect routine before its ->bind routine. To prevent this from happening, it will be necessary to prevent a UDC from connecting while it has no gadget driver. This should be done already but it doesn't seem to be; currently usb_gadget_connect() has no check for this. Such a check will have to be added later. Some degree of mutual exclusion is required in soft_connect_store(), which can dereference udc->driver at arbitrary times since it is a sysfs callback. The solution here is to acquire the gadget's device lock rather than the udc_mutex. Since the driver core guarantees that the device lock is always held during driver binding and unbinding, this will make the accesses in soft_connect_store() mutually exclusive with any changes to udc->driver. Lastly, it turns out there is one place which should hold the udc_mutex but currently does not: The function_show() routine needs protection while it dereferences udc->driver. The missing lock and unlock calls are added. Link: https://lore.kernel.org/all/b2ba4245-9917-e399-94c8-03a383e7070e@samsung.com/ Fixes: 2191c00855b0 ("USB: gadget: Fix use-after-free Read in usb_udc_uevent()") Cc: Felipe Balbi Cc: stable@vger.kernel.org Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkfhdxA/I2nOcK7@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit f9b995b49a07bd0d43b0e490f59be84415c745ae Author: Heiner Kallweit Date: Tue Aug 23 19:58:42 2022 +0200 usb: dwc2: fix wrong order of phy_power_on and phy_init Since 1599069a62c6 ("phy: core: Warn when phy_power_on is called before phy_init") the driver complains. In my case (Amlogic SoC) the warning is: phy phy-fe03e000.phy.2: phy_power_on was called before phy_init So change the order of the two calls. The same change has to be done to the order of phy_exit() and phy_power_off(). Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") Cc: stable@vger.kernel.org Acked-by: Minas Harutyunyan Acked-by: Marek Szyprowski Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/dfcc6b40-2274-4e86-e73c-5c5e6aa3e046@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b Author: Piyush Mehta Date: Wed Aug 24 12:42:53 2022 +0530 usb: gadget: udc-xilinx: replace memcpy with memcpy_toio For ARM processor, unaligned access to device memory is not allowed. Method memcpy does not take care of alignment. USB detection failure with the unaligned address of memory access, with below kernel crash. To fix the unaligned address the kernel panic issue, replace memcpy with memcpy_toio method. Kernel crash: Unable to handle kernel paging request at virtual address ffff80000c05008a Mem abort info: ESR = 0x96000061 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000061 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000143b000 [ffff80000c05008a] pgd=100000087ffff003, p4d=100000087ffff003, pud=100000087fffe003, pmd=1000000800bcc003, pte=00680000a0010713 Internal error: Oops: 96000061 [#1] SMP Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.19-xilinx-v2022.1 #1 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x30/0x260 lr : __xudc_ep0_queue+0xf0/0x110 sp : ffff800008003d00 x29: ffff800008003d00 x28: ffff800009474e80 x27: 00000000000000a0 x26: 0000000000000100 x25: 0000000000000012 x24: ffff000800bc8080 x23: 0000000000000001 x22: 0000000000000012 x21: ffff000800bc8080 x20: 0000000000000012 x19: ffff000800bc8080 x18: 0000000000000000 x17: ffff800876482000 x16: ffff800008004000 x15: 0000000000004000 x14: 00001f09785d0400 x13: 0103020101005567 x12: 0781400000000200 x11: 00000000c5672a10 x10: 00000000000008d0 x9 : ffff800009463cf0 x8 : ffff8000094757b0 x7 : 0201010055670781 x6 : 4000000002000112 x5 : ffff80000c05009a x4 : ffff000800a15012 x3 : ffff00080362ad80 x2 : 0000000000000012 x1 : ffff000800a15000 x0 : ffff80000c050088 Call trace: __memcpy+0x30/0x260 xudc_ep0_queue+0x3c/0x60 usb_ep_queue+0x38/0x44 composite_ep0_queue.constprop.0+0x2c/0xc0 composite_setup+0x8d0/0x185c configfs_composite_setup+0x74/0xb0 xudc_irq+0x570/0xa40 __handle_irq_event_percpu+0x58/0x170 handle_irq_event+0x60/0x120 handle_fasteoi_irq+0xc0/0x220 handle_domain_irq+0x60/0x90 gic_handle_irq+0x74/0xa0 call_on_irq_stack+0x2c/0x60 do_interrupt_handler+0x54/0x60 el1_interrupt+0x30/0x50 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x78/0x7c arch_cpu_idle+0x18/0x2c do_idle+0xdc/0x15c cpu_startup_entry+0x28/0x60 rest_init+0xc8/0xe0 arch_call_rest_init+0x10/0x1c start_kernel+0x694/0x6d4 __primary_switched+0xa4/0xac Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support") Cc: stable@vger.kernel.org Reviewed-by: Linus Walleij Signed-off-by: Piyush Mehta Link: https://lore.kernel.org/r/20220824071253.1261096-1-piyush.mehta@amd.com Signed-off-by: Greg Kroah-Hartman commit b7cafb8b06a05c146bf75e5f666f8d84191d1ad4 Author: Heikki Krogerus Date: Thu Aug 25 17:04:11 2022 +0300 usb: typec: Remove retimers properly Retimer device class is left dangling when the typec module is unloaded. Attempts to reload the module failed with warning: "sysfs: cannot create duplicate filename '/class/retimer'" Fixing the issue by unregistering the class properly. Fixes: ddaf8d96f93b ("usb: typec: Add support for retimers") Reviewed-by: Prashant Malani Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20220825140411.10743-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6000b8d900cd5f52fbcd0776d0cc396e88c8c2ea Author: Johan Hovold Date: Thu Aug 25 15:18:36 2022 +0200 usb: dwc3: disable USB core PHY management The dwc3 driver manages its PHYs itself so the USB core PHY management needs to be disabled. Use the struct xhci_plat_priv hack added by commits 46034a999c07 ("usb: host: xhci-plat: add platform data support") and f768e718911e ("usb: host: xhci-plat: add priv quirk for skip PHY initialization") to propagate the setting for now. Fixes: 4e88d4c08301 ("usb: add a flag to skip PHY initialization to struct usb_hcd") Fixes: 178a0bce05cb ("usb: core: hcd: integrate the PHY wrapper into the HCD core") Tested-by: Matthias Kaehlcke Cc: stable Reviewed-by: Matthias Kaehlcke Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220825131836.19769-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58 Author: Jean-Francois Le Fillatre Date: Wed Aug 24 21:13:21 2022 +0200 usb: add quirks for Lenovo OneLink+ Dock The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers: 17ef:1018 upstream 17ef:1019 downstream Those two controllers both have problems with some USB3.0 devices, particularly self-powered ones. Typical error messages include: Timeout while waiting for setup device command device not accepting address X, error -62 unable to enumerate USB device By process of elimination the controllers themselves were identified as the cause of the problem. Through trial and error the issue was solved by using USB_QUIRK_RESET_RESUME for both chips. Signed-off-by: Jean-Francois Le Fillatre Cc: stable Link: https://lore.kernel.org/r/20220824191320.17883-1-jflf_kernel@gmx.com Signed-off-by: Greg Kroah-Hartman commit f612466ebecb12a00d9152344ddda6f6345f04dc Author: Wang Hai Date: Fri Aug 26 17:00:55 2022 +0800 net/sched: fix netdevice reference leaks in attach_default_qdiscs() In attach_default_qdiscs(), if a dev has multiple queues and queue 0 fails to attach qdisc because there is no memory in attach_one_default_qdisc(). Then dev->qdisc will be noop_qdisc by default. But the other queues may be able to successfully attach to default qdisc. In this case, the fallback to noqueue process will be triggered. If the original attached qdisc is not released and a new one is directly attached, this will cause netdevice reference leaks. The following is the bug log: veth0: default qdisc (fq_codel) fail, fallback to noqueue unregister_netdevice: waiting for veth0 to become free. Usage count = 32 leaked reference. qdisc_alloc+0x12e/0x210 qdisc_create_dflt+0x62/0x140 attach_one_default_qdisc.constprop.41+0x44/0x70 dev_activate+0x128/0x290 __dev_open+0x12a/0x190 __dev_change_flags+0x1a2/0x1f0 dev_change_flags+0x23/0x60 do_setlink+0x332/0x1150 __rtnl_newlink+0x52f/0x8e0 rtnl_newlink+0x43/0x70 rtnetlink_rcv_msg+0x140/0x3b0 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x1bb/0x290 netlink_sendmsg+0x37c/0x4e0 sock_sendmsg+0x5f/0x70 ____sys_sendmsg+0x208/0x280 Fix this bug by clearing any non-noop qdiscs that may have been assigned before trying to re-attach. Fixes: bf6dba76d278 ("net: sched: fallback to qdisc noqueue if default qdisc setup fail") Signed-off-by: Wang Hai Link: https://lore.kernel.org/r/20220826090055.24424-1-wanghai38@huawei.com Signed-off-by: Paolo Abeni commit 902e02ea9385373ce4b142576eef41c642703955 Author: Fedor Pchelkin Date: Mon Aug 29 16:16:40 2022 +0300 tty: n_gsm: avoid call of sleeping functions from atomic context Syzkaller reports the following problem: BUG: sleeping function called from invalid context at kernel/printk/printk.c:2347 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423 3 locks held by syz-executor423/1105: #0: ffff8881468b9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x90 drivers/tty/tty_ldisc.c:266 #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:952 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: do_tty_write drivers/tty/tty_io.c:975 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118 #2: ffff88801b06c398 (&gsm->tx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x150 drivers/tty/n_gsm.c:2717 irq event stamp: 3482 hardirqs last enabled at (3481): [] __get_reqs_available+0x143/0x2f0 fs/aio.c:946 hardirqs last disabled at (3482): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3482): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:159 softirqs last enabled at (3408): [] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (3401): [] asm_call_irq_on_stack+0x12/0x20 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304 console_lock+0x19/0x80 kernel/printk/printk.c:2347 do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909 con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296 gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720 do_tty_write drivers/tty/tty_io.c:1028 [inline] file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118 call_write_iter include/linux/fs.h:1903 [inline] aio_write+0x355/0x7b0 fs/aio.c:1580 __io_submit_one fs/aio.c:1952 [inline] io_submit_one+0xf45/0x1a90 fs/aio.c:1999 __do_sys_io_submit fs/aio.c:2058 [inline] __se_sys_io_submit fs/aio.c:2028 [inline] __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 The problem happens in the following control flow: gsmld_write(...) spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data con_write(...) do_con_write(...) console_lock() might_sleep() // -> bug As far as console_lock() might sleep it should not be called with spinlock held. The patch replaces tx_lock spinlock with mutex in order to avoid the problem. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 32dd59f96924 ("tty: n_gsm: fix race condition in gsmld_write()") Cc: stable Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Link: https://lore.kernel.org/r/20220829131640.69254-3-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman commit c9ab053e56ce13a949977398c8edc12e6c02fc95 Author: Fedor Pchelkin Date: Mon Aug 29 16:16:39 2022 +0300 tty: n_gsm: replace kicktimer with delayed_work A kick_timer timer_list is replaced with kick_timeout delayed_work to be able to synchronize with mutexes as a prerequisite for the introduction of tx_mutex. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") Cc: stable Reviewed-by: Jiri Slaby Suggested-by: Hillf Danton Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Link: https://lore.kernel.org/r/20220829131640.69254-2-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman commit 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Author: Tetsuo Handa Date: Sat Aug 27 22:47:19 2022 +0900 tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot Tested-by: syzbot Cc: stable Acked-by: Jiri Slaby Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman commit f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb Author: Mazin Al Haddad Date: Sun Aug 14 04:52:12 2022 +0300 tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmld_receive_buf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur. Fix this by avoiding the call to "gsm->receive()" in case the function is not initialized by adding a sanity check. Call Trace: gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 tiocsti drivers/tty/tty_io.c:2293 [inline] tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Link: https://syzkaller.appspot.com/bug?id=bdf035c61447f8c6e0e6920315d577cb5cc35ac5 Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") Cc: stable Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com Signed-off-by: Mazin Al Haddad Link: https://lore.kernel.org/r/20220814015211.84180-1-mazinalhaddad05@gmail.com Signed-off-by: Greg Kroah-Hartman commit 692a8ebcfc24f4a5bea0eb2967e450f584193da6 Author: Sergiu Moga Date: Wed Aug 24 17:29:03 2022 +0300 tty: serial: atmel: Preserve previous USART mode if RS485 disabled Whenever the atmel_rs485_config() driver method would be called, the USART mode is reset to normal mode before even checking if RS485 flag is set, thus resulting in losing the previous USART mode in the case where the checking fails. Some tools, such as `linux-serial-test`, lead to the driver calling this method when doing the setup of the serial port: after setting the port mode (Hardware Flow Control, Normal Mode, RS485 Mode, etc.), `linux-serial-test` tries to enable/disable RS485 depending on the commandline arguments that were passed. Example of how this issue could reveal itself: When doing a serial communication with Hardware Flow Control through `linux-serial-test`, the tool would lead to the driver roughly doing the following: - set the corresponding bit to 1 (ATMEL_US_USMODE_HWHS bit in the ATMEL_US_MR register) through the atmel_set_termios() to enable Hardware Flow Control - disable RS485 through the atmel_config_rs485() method Thus, when the latter is called, the mode will be reset and the previously set bit is unset, leaving USART in normal mode instead of the expected Hardware Flow Control mode. This fix ensures that this reset is only done if the checking for RS485 succeeds and that the previous mode is preserved otherwise. Fixes: e8faff7330a35 ("ARM: 6092/1: atmel_serial: support for RS485 communications") Cc: stable Reviewed-by: Ilpo Järvinen Signed-off-by: Sergiu Moga Link: https://lore.kernel.org/r/20220824142902.502596-1-sergiu.moga@microchip.com Signed-off-by: Greg Kroah-Hartman commit d5a2e0834364377a5d5a2fff1890a0b3f0bafd1f Author: Sherry Sun Date: Sun Aug 21 18:15:27 2022 +0800 tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete When the user initializes the uart port, and waits for the transmit engine to complete in lpuart32_set_termios(), if the UART TX fifo has dirty data and the UARTMODIR enable the flow control, the TX fifo may never be empty. So here we should disable the flow control first to make sure the transmit engin can complete. Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") Cc: stable Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20220821101527.10066-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 56c14fb4086b2de6921dd70251b19b364b909ea1 Author: Vincent Whitchurch Date: Thu Aug 18 13:50:26 2022 +0200 tty: Fix lookahead_buf crash with serdev Do not follow a NULL pointer if the tty_port_client_operations does not implement the ->lookahead_buf() callback, which is the case with serdev's ttyport. Reported-by: Hans de Goede Fixes: 6bb6fa6908ebd3 ("tty: Implement lookahead to process XON/XOFF timely") Reviewed-by: Ilpo Järvinen Signed-off-by: Vincent Whitchurch Link: https://lore.kernel.org/r/20220818115026.2237893-1-vincent.whitchurch@axis.com Signed-off-by: Greg Kroah-Hartman commit 846651eca073e2e02e37490a4a52752415d84781 Author: Shenwei Wang Date: Fri Aug 5 09:45:29 2022 -0500 serial: fsl_lpuart: RS485 RTS polariy is inverse The setting of RS485 RTS polarity is inverse in the current driver. When the property of 'rs485-rts-active-low' is enabled in the dts node, the RTS signal should be LOW during sending. Otherwise, if there is no such a property, the RTS should be HIGH during sending. Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Cc: stable Signed-off-by: Nicolas Diaz Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman commit 566f9c9f89337792070b5a6062dff448b3e7977f Author: Helge Deller Date: Sat Jul 30 20:50:18 2022 +0200 vt: Clear selection before changing the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable Tested-by: Khalid Masum Signed-off-by: Helge Deller Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman commit 25af7406df5915f04d5f1c8f081dabb0ead1cdcc Author: Isaac Manjarres Date: Thu Aug 18 18:28:51 2022 +0100 ARM: 9229/1: amba: Fix use-after-free in amba_read_periphid() After commit f2d3b9a46e0e ("ARM: 9220/1: amba: Remove deferred device addition"), it became possible for amba_read_periphid() to be invoked concurrently from two threads for a particular AMBA device. Consider the case where a thread (T0) is registering an AMBA driver, and searching for all of the devices it can match with on the AMBA bus. Suppose that another thread (T1) is executing the deferred probe work, and is searching through all of the AMBA drivers on the bus for a driver that matches a particular AMBA device. Assume that both threads begin operating on the same AMBA device and the device's peripheral ID is still unknown. In this scenario, the amba_match() function will be invoked for the same AMBA device by both threads, which means amba_read_periphid() can also be invoked by both threads, and both threads will be able to manipulate the AMBA device's pclk pointer without any synchronization. It's possible that one thread will initialize the pclk pointer, then the other thread will re-initialize it, overwriting the previous value, and both will race to free the same pclk, resulting in a use-after-free for whichever thread frees the pclk last. Add a lock per AMBA device to synchronize the handling with detecting the peripheral ID to avoid the use-after-free scenario. The following KFENCE bug report helped detect this problem: ================================================================== BUG: KFENCE: use-after-free read in clk_disable+0x14/0x34 Use-after-free read at 0x(ptrval) (in kfence-#19): clk_disable+0x14/0x34 amba_read_periphid+0xdc/0x134 amba_match+0x3c/0x84 __driver_attach+0x20/0x158 bus_for_each_dev+0x74/0xc0 bus_add_driver+0x154/0x1e8 driver_register+0x88/0x11c do_one_initcall+0x8c/0x2fc kernel_init_freeable+0x190/0x220 kernel_init+0x10/0x108 ret_from_fork+0x14/0x3c 0x0 kfence-#19: 0x(ptrval)-0x(ptrval), size=36, cache=kmalloc-64 allocated by task 8 on cpu 0 at 11.629931s: clk_hw_create_clk+0x38/0x134 amba_get_enable_pclk+0x10/0x68 amba_read_periphid+0x28/0x134 amba_match+0x3c/0x84 __device_attach_driver+0x2c/0xc4 bus_for_each_drv+0x80/0xd0 __device_attach+0xb0/0x1f0 bus_probe_device+0x88/0x90 deferred_probe_work_func+0x8c/0xc0 process_one_work+0x23c/0x690 worker_thread+0x34/0x488 kthread+0xd4/0xfc ret_from_fork+0x14/0x3c 0x0 freed by task 8 on cpu 0 at 11.630095s: amba_read_periphid+0xec/0x134 amba_match+0x3c/0x84 __device_attach_driver+0x2c/0xc4 bus_for_each_drv+0x80/0xd0 __device_attach+0xb0/0x1f0 bus_probe_device+0x88/0x90 deferred_probe_work_func+0x8c/0xc0 process_one_work+0x23c/0x690 worker_thread+0x34/0x488 kthread+0xd4/0xfc ret_from_fork+0x14/0x3c 0x0 Cc: Saravana Kannan Cc: patches@armlinux.org.uk Fixes: f2d3b9a46e0e ("ARM: 9220/1: amba: Remove deferred device addition") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Isaac J. Manjarres Signed-off-by: Russell King (Oracle) commit 4e2a2ed96adcb6151a15ea40db933d97f2ae7aaa Author: Lad Prabhakar Date: Mon Aug 29 22:47:30 2022 +0100 dt-bindings: i2c: renesas,riic: Fix 'unevaluatedProperties' warnings With 'unevaluatedProperties' support implemented, there's a number of warnings when running dtbs_check: arch/arm64/boot/dts/renesas/r9a07g043u11-smarc.dtb: i2c@10058000: Unevaluated properties are not allowed ('resets' was unexpected) From schema: Documentation/devicetree/bindings/i2c/renesas,riic.yaml The main problem is that bindings schema marks resets as a required property for RZ/G2L (and alike) SoC's but resets property is not part of schema. So to fix this just add a resets property with maxItems set to 1. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit b05972f01e7d30419987a1f221b5593668fd6448 Author: Zhengchao Shao Date: Fri Aug 26 09:39:30 2022 +0800 net: sched: tbf: don't call qdisc_put() while holding tree lock The issue is the same to commit c2999f7fb05b ("net: sched: multiq: don't call qdisc_put() while holding tree lock"). Qdiscs call qdisc_put() while holding sch tree spinlock, which results sleeping-while-atomic BUG. Fixes: c266f64dbfa2 ("net: sched: protect block state with mutex") Signed-off-by: Zhengchao Shao Link: https://lore.kernel.org/r/20220826013930.340121-1-shaozhengchao@huawei.com Signed-off-by: Paolo Abeni commit 45baad7dd98f4d83f67c86c28769d3184390e324 Author: Yixing Liu Date: Mon Aug 29 18:50:20 2022 +0800 RDMA/hns: Remove the num_qpc_timer variable The bt number of qpc_timer of HIP09 increases compared with that of HIP08. Therefore, qpc_timer_bt_num and num_qpc_timer do not match. As a result, the driver may fail to allocate qpc_timer. So the driver needs to uniquely uses qpc_timer_bt_num to represent the bt number of qpc_timer. Fixes: 0e40dc2f70cd ("RDMA/hns: Add timer allocation support for hip08") Link: https://lore.kernel.org/r/20220829105021.1427804-4-liangwenpeng@huawei.com Signed-off-by: Yixing Liu Signed-off-by: Wenpeng Liang Signed-off-by: Leon Romanovsky commit 0c8b5d6268d92d141bfd64d21c870d295a84dee1 Author: Wenpeng Liang Date: Mon Aug 29 18:50:19 2022 +0800 RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift The value of qp->rq.wqe_shift of HIP08 is always determined by the number of sge. So delete the wrong branch. Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/20220829105021.1427804-3-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang Signed-off-by: Leon Romanovsky commit 55af9d498556f0860eb89ffa7677e8d73f6f643f Author: Chengchang Tang Date: Mon Aug 29 18:50:18 2022 +0800 RDMA/hns: Fix supported page size The supported page size for hns is (4K, 128M), not (4K, 2G). Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") Link: https://lore.kernel.org/r/20220829105021.1427804-2-liangwenpeng@huawei.com Signed-off-by: Chengchang Tang Signed-off-by: Wenpeng Liang Signed-off-by: Leon Romanovsky commit 0a6fc70d76bddf98278af2ac000379c82aec8f11 Author: Pali Rohár Date: Mon Aug 29 10:30:46 2022 +0200 phy: marvell: phy-mvebu-a3700-comphy: Remove broken reset support Reset support for SATA PHY is somehow broken and after calling it, kernel is not able to detect and initialize SATA disk Samsung SSD 850 EMT0 [1]. Reset support was introduced in commit 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation") as part of complete rewrite of this driver. v1 patch series of that commit [2] did not contain reset support and was tested that is working fine with Ethernet, SATA and USB PHYs without issues too. So for now remove broken reset support and change implementation of power_off callback to power off all functions on specified lane (and not only selected function) because during startup kernel does not know which function was selected and configured by bootloader. Same logic was used also in v1 patch series of that commit. This change fixes issues with initialization of SATA disk Samsung SSD 850 and disk is working again, like before mentioned commit. Once problem with PHY reset callback is solved its functionality could be re-introduced. But for now it is unknown why it does not work. [1] - https://lore.kernel.org/r/20220531124159.3e4lgn2v462irbtz@shindev/ [2] - https://lore.kernel.org/r/20211028184242.22105-1-kabel@kernel.org/ Reported-by: Shinichiro Kawasaki Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation") Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Pali Rohár Tested-by: Shinichiro Kawasaki Link: https://lore.kernel.org/r/20220829083046.15082-1-pali@kernel.org Signed-off-by: Vinod Koul commit f233d2be38dbbb22299192292983037f01ab363c Author: Armin Wolf Date: Tue Aug 30 03:11:01 2022 +0200 hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477] SET = 0, FnV = 0 [ 807.987507] EA = 0, S1PTW = 0 [ 807.987536] FSC = 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV = 0, ISS = 0x00000005 [ 807.987801] CM = 0, WnR = 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000 [ 807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15.56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 0000000000000000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800747c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 000000001999997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 0000000000000000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e271b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 0000000000000009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff800369f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d0588060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end trace 8ded4c918658445b ]--- Fix this by checking the cooling state and return an error if it exceeds the maximum cooling state. Tested on a Raspberry Pi 3. Fixes: b5cf88e46bad ("(gpio-fan): Add thermal control hooks") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 8c8d28e1f10a0359f0c704be18cf744b3513acd2 Author: Bjorn Andersson Date: Fri Aug 19 07:25:49 2022 -0700 MAINTAINERS: Update Bjorn's email address Update the email address for Bjorn's maintainer entries and fill in .mailmap accordingly. Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220819142549.1605081-1-bjorn.andersson@linaro.org commit d5089f79b1e4fad445daa48382380a7e584603e2 Author: Johan Hovold Date: Tue Aug 2 17:26:42 2022 +0200 arm64: dts: qcom: sc7280: move USB wakeup-source property Move the USB-controller wakeup-source property to the dwc3 glue node to match the updated binding. Signed-off-by: Johan Hovold Reviewed-by: Matthias Kaehlcke Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220802152642.2516-1-johan+linaro@kernel.org commit b6a6535b339776d32fa515a18a93b1b317e9b063 Author: Steev Klimaszewski Date: Wed Aug 17 18:12:36 2022 -0500 arm64: dts: qcom: thinkpad-x13s: Fix firmware location The firmware for the Lenovo Thinkpad X13s has been submitted, accepted and merged upstream, so update to the correct path. Signed-off-by: Steev Klimaszewski Reviewed-by: Andrew Halaney Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220817231236.3971-1-steev@kali.org commit 1d330a6783c66ac6c569f14ecf8dd196d50c15e5 Author: Bhupesh Sharma Date: Fri Aug 19 11:09:45 2022 +0530 arm64: dts: qcom: sm8150: Fix fastrpc iommu values Fix the 'memory access' related crash seen while running Hexagon SDK example applications on the cdsp dsp available on sm8150 SoC based boards: qcom_q6v5_pas 8300000.remoteproc: fatal error received: EX:kernel:0x0:frpck_0_0:0xf5:PC=0xc020ceb0 This crash is caused by incorrect IOMMU SID values being used in the fastrpc node. Cc: Bjorn Andersson Cc: Rob Herring Suggested-by: Srinivas Kandagatla Signed-off-by: Bhupesh Sharma Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220819053945.4114430-1-bhupesh.sharma@linaro.org commit dcf8e5633e2e69ad60b730ab5905608b756a032f Author: Bart Van Assche Date: Tue Aug 23 12:59:25 2022 -0700 tracing: Define the is_signed_type() macro once There are two definitions of the is_signed_type() macro: one in and a second definition in . As suggested by Linus, move the definition of the is_signed_type() macro into the header file. Change the definition of the is_signed_type() macro to make sure that it does not trigger any sparse warnings with future versions of sparse for bitwise types. Link: https://lore.kernel.org/all/CAHk-=whjH6p+qzwUdx5SOVVHjS3WvzJQr6mDUwhEyTf6pJWzaQ@mail.gmail.com/ Link: https://lore.kernel.org/all/CAHk-=wjQGnVfb4jehFR0XyZikdQvCZouE96xR_nnf5kqaM5qqQ@mail.gmail.com/ Cc: Rasmus Villemoes Cc: Steven Rostedt Acked-by: Kees Cook Signed-off-by: Bart Van Assche Signed-off-by: Linus Torvalds commit 53b774718f784d614c8bfed20a3b32fb753604f3 Author: Bruce Duncan Date: Thu Aug 25 15:01:41 2022 +0200 docs: i2c: piix4: Fix typos, add markup, drop link [JD: Update the subject One more typo fixed Drop the link to lm-sensors' README, it's irrelevant] Signed-off-by: Bruce Duncan Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 9c9c71168f7979f3798b61c65b4530fbfbcf19d1 Author: Greg Tulli Date: Mon Aug 29 11:21:03 2022 -0700 Input: iforce - add support for Boeder Force Feedback Wheel Add a new iforce_device entry to support the Boeder Force Feedback Wheel device. Signed-off-by: Greg Tulli Link: https://lore.kernel.org/r/3256420-c8ac-31b-8499-3c488a9880fd@gmail.com Signed-off-by: Dmitry Torokhov commit 1085f5080647f0c9f357c270a537869191f7f2a1 Author: Liang He Date: Thu Jul 7 09:56:20 2022 +0800 soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path Fixes: 0b741b8234c8 ("soc: bcm: brcmstb: Add support for S2/S3/S5 suspend states (ARM)") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220707015620.306468-1-windhl@126.com Signed-off-by: Florian Fainelli commit acc5495bf764e7e441193f972d96c5d2887f6b8b Author: Qiang Yu Date: Fri Jul 22 11:17:18 2022 +0800 bus: mhi: host: Fix up null pointer access in mhi_irq_handler The irq handler for a shared IRQ ought to be prepared for running even now it's being freed. So let's check the pointer used by mhi_irq_handler to avoid null pointer access since it is probably released before freeing IRQ. Fixes: 1227d2a20cd7 ("bus: mhi: host: Move IRQ allocation to controller registration phase") Signed-off-by: Qiang Yu Reviewed-by: Manivannan Sadhasivam Tested-by: Kalle Valo Link: https://lore.kernel.org/r/1658459838-30802-1-git-send-email-quic_qianyu@quicinc.com [mani: added fixes tag] Signed-off-by: Manivannan Sadhasivam commit d68d289fbec70b50a25f5818964b26349320ddb5 Merge: b90cb10531903 5479d6d4bf122 Author: Linus Torvalds Date: Mon Aug 29 09:49:48 2022 -0700 Merge tag 'docs-6.0-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A handful of fixes for documentation and the docs build system" * tag 'docs-6.0-fixes' of git://git.lwn.net/linux: docs/conf.py: add function attribute '__fix_address' to conf.py Docs/admin-guide/mm/damon/usage: fix the example code snip docs: Update version number from 5.x to 6.x in README.rst docs/ja_JP/SubmittingPatches: Remove reference to submitting-drivers.rst docs: kerneldoc-preamble: Test xeCJK.sty before loading commit 0211c2a0ea600e25db3044daaeff4fe41c3ed6d9 Author: Ville Syrjälä Date: Fri Jun 17 22:59:48 2022 +0300 drm/i915: Skip wm/ddb readout for disabled pipes The stuff programmed into the wm/ddb registers of planes on disabled pipes doesn't matter. So during readout just leave our software state tracking for those zeroed. This should avoid us trying too hard to clean up after whatever mess the VBIOS/GOP left in there. The actual hardware state will get cleaned up if/when we enable the pipe anyway. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5711 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220617195948.24007-1-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy (cherry picked from commit b183db8f4783ca2efc9b47734f15aad9477a108a) Signed-off-by: Rodrigo Vivi commit 919bef7a106ade2bda73681bbc2f3678198f44fc Author: Diego Santa Cruz Date: Thu Jun 16 15:41:37 2022 +0300 drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk The quirk added in upstream commit 90c3e2198777 ("drm/i915/glk: Add Quirk for GLK NUC HDMI port issues.") is also required on the ECS Liva Q2. Note: Would be nicer to figure out the extra delay required for the retimer without quirks, however don't know how to check for that. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1326 Signed-off-by: Diego Santa Cruz Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220616124137.3184371-1-jani.nikula@intel.com (cherry picked from commit 08e9505fa8f9aa00072a47b6f234d89b6b27a89c) Signed-off-by: Rodrigo Vivi commit 458ec0c8f35963626ccd51c3d50b752de5f1b9d4 Author: Łukasz Bartosik Date: Tue Feb 1 16:33:54 2022 +0100 drm/i915: fix null pointer dereference Asus chromebook CX550 crashes during boot on v5.17-rc1 kernel. The root cause is null pointer defeference of bi_next in tgl_get_bw_info() in drivers/gpu/drm/i915/display/intel_bw.c. BUG: kernel NULL pointer dereference, address: 000000000000002e PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 1 Comm: swapper/0 Tainted: G U 5.17.0-rc1 Hardware name: Google Delbin/Delbin, BIOS Google_Delbin.13672.156.3 05/14/2021 RIP: 0010:tgl_get_bw_info+0x2de/0x510 ... [ 2.554467] Call Trace: [ 2.554467] [ 2.554467] intel_bw_init_hw+0x14a/0x434 [ 2.554467] ? _printk+0x59/0x73 [ 2.554467] ? _dev_err+0x77/0x91 [ 2.554467] i915_driver_hw_probe+0x329/0x33e [ 2.554467] i915_driver_probe+0x4c8/0x638 [ 2.554467] i915_pci_probe+0xf8/0x14e [ 2.554467] ? _raw_spin_unlock_irqrestore+0x12/0x2c [ 2.554467] pci_device_probe+0xaa/0x142 [ 2.554467] really_probe+0x13f/0x2f4 [ 2.554467] __driver_probe_device+0x9e/0xd3 [ 2.554467] driver_probe_device+0x24/0x7c [ 2.554467] __driver_attach+0xba/0xcf [ 2.554467] ? driver_attach+0x1f/0x1f [ 2.554467] bus_for_each_dev+0x8c/0xc0 [ 2.554467] bus_add_driver+0x11b/0x1f7 [ 2.554467] driver_register+0x60/0xea [ 2.554467] ? mipi_dsi_bus_init+0x16/0x16 [ 2.554467] i915_init+0x2c/0xb9 [ 2.554467] ? mipi_dsi_bus_init+0x16/0x16 [ 2.554467] do_one_initcall+0x12e/0x2b3 [ 2.554467] do_initcall_level+0xd6/0xf3 [ 2.554467] do_initcalls+0x4e/0x79 [ 2.554467] kernel_init_freeable+0xed/0x14d [ 2.554467] ? rest_init+0xc1/0xc1 [ 2.554467] kernel_init+0x1a/0x120 [ 2.554467] ret_from_fork+0x1f/0x30 [ 2.554467] ... Kernel panic - not syncing: Fatal exception Fixes: c64a9a7c05be ("drm/i915: Update memory bandwidth formulae") Signed-off-by: Łukasz Bartosik Reviewed-by: Radhakrishna Sripada Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220201153354.11971-1-lukasz.bartosik@semihalf.com (cherry picked from commit c247cd03898c4c43c3bce6d4014730403bc13032) Signed-off-by: Rodrigo Vivi commit 51fbbe8a3f8b9dd128fa98f6ea36058dfa3f36de Author: Jouni Högander Date: Mon Aug 22 17:08:36 2022 +0300 drm/i915/backlight: Disable pps power hook for aux based backlight Pps power hook seems to be problematic for backlight controlled via aux channel. Disable it for such cases. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3657 Cc: stable@vger.kernel.org Signed-off-by: Jouni Högander Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220822140836.534432-1-jouni.hogander@intel.com (cherry picked from commit 869e3bb7acb59d88c1226892136661810e8223a4) Signed-off-by: Rodrigo Vivi commit 2c4e19f873f4a389c2a557a84909cf4b78d3525a Author: Arun R Murthy Date: Mon Aug 8 09:27:50 2022 +0530 drm/i915/display: avoid warnings when registering dual panel backlight Commit 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") added support for multiple backlight devices on dual panel systems, but did so with error handling on -EEXIST from backlight_device_register(). Unfortunately, that triggered a warning in dmesg all the way down from sysfs_add_file_mode_ns() and sysfs_warn_dup(). Instead of optimistically always attempting to register with the default name ("intel_backlight", which we have to retain for backward compatibility), check if a backlight device with the name exists first, and, if so, use the card and connector based name. v2: reworked on top of the patch commit 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") v3: fixed the ref count leak(Jani N) Fixes: 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") Signed-off-by: Arun R Murthy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220808035750.3111046-1-arun.r.murthy@intel.com (cherry picked from commit 4234ea30051200fc6016de10e4d58369e60b38f1) Signed-off-by: Rodrigo Vivi commit 875c6d2711f6c97e58c52288b4231f3072711d61 Author: Jani Nikula Date: Tue Aug 16 18:37:21 2022 +0300 drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+ The VBT dual-link DSI backlight and CABC still use ports A and C, both in Bspec and code, while display 11+ DSI only supports ports A and B. Assume port C actually means port B for display 11+ when parsing VBT. Bspec: 20154 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6476 Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Reviewed-by: Stanislav Lisovskiy Link: https://patchwork.freedesktop.org/patch/msgid/8c462718bcc7b36a83e09d0a5eef058b6bc8b1a2.1660664162.git.jani.nikula@intel.com (cherry picked from commit ab55165d73a444606af1530cd0d6448b04370f68) Signed-off-by: Rodrigo Vivi commit e5e6886f4d7e34b6539abddb591d515271caa634 Author: Jani Nikula Date: Tue Aug 16 18:37:20 2022 +0300 drm/i915/dsi: filter invalid backlight and CABC ports Avoid using ports that aren't initialized in case the VBT backlight or CABC ports have invalid values. This fixes a NULL pointer dereference of intel_dsi->dsi_hosts[port] in such cases. Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Reviewed-by: Stanislav Lisovskiy Link: https://patchwork.freedesktop.org/patch/msgid/b0f4f087866257d280eb97d6bcfcefd109cc5fa2.1660664162.git.jani.nikula@intel.com (cherry picked from commit f4a6c7a454a6e71c5ccf25af82694213a9784013) Signed-off-by: Rodrigo Vivi commit 4595a25443447b9542b2a5ee7961eb290e94b496 Author: Daniele Ceraolo Spurio Date: Thu Aug 11 14:08:12 2022 -0700 drm/i915/guc: clear stalled request after a reset If the GuC CTs are full and we need to stall the request submission while waiting for space, we save the stalled request and where the stall occurred; when the CTs have space again we pick up the request submission from where we left off. If a full GT reset occurs, the state of all contexts is cleared and all non-guilty requests are unsubmitted, therefore we need to restart the stalled request submission from scratch. To make sure that we do so, clear the saved request after a reset. Fixes note: the patch that introduced the bug is in 5.15, but no officially supported platform had GuC submission enabled by default in that kernel, so the backport to that particular version (and only that one) can potentially be skipped. Fixes: 925dc1cf58ed ("drm/i915/guc: Implement GuC submission tasklet") Signed-off-by: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: John Harrison Cc: # v5.15+ Reviewed-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220811210812.3239621-1-daniele.ceraolospurio@intel.com (cherry picked from commit f922fbb0f2ad1fd3e3186f39c46673419e6d9281) Signed-off-by: Rodrigo Vivi commit e79a7417072265a85a36775e4e0f798154d39808 Author: Matthew Auld Date: Fri Aug 5 14:22:40 2022 +0100 drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can also trigger this with gem_lmem_swapping, if we modify the test to use slightly larger object sizes. Looking closer it looks like we have the following issues in migrate_copy(): - We are using plain integer in various places, which we can easily overflow with a large object. - We pass the entire object size (when the src is lmem) into emit_pte() and then try to copy it, which doesn't work, since we only have a few fixed sized windows in which to map the pages and perform the copy. With an object > 8M we therefore aren't properly copying the pages. And then with an object > 64M we trigger the GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER). So it looks like our copy handling for any object > 8M (which is our CHUNK_SZ) is currently broken on DG2. Fixes: da0595ae91da ("drm/i915/migrate: Evict and restore the flatccs capable lmem obj") Testcase: igt@gem_lmem_swapping Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Ramalingam C Reviewed-by: Ramalingam C Link: https://patchwork.freedesktop.org/patch/msgid/20220805132240.442747-2-matthew.auld@intel.com (cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2) Signed-off-by: Rodrigo Vivi commit 58091b4958008ef69899e5404f8f031c36b35fbf Merge: 1c23f9e627a7b b75ef35bb5779 Author: Rodrigo Vivi Date: Mon Aug 29 10:00:04 2022 -0400 Merge tag 'gvt-fixes-2022-08-22' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2022-08-22 - CometLake regression fix in mmio table rework (Alex) - misc kernel doc and typo fixes Signed-off-by: Rodrigo Vivi From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20220822031215.GJ1089@zhen-hp.sh.intel.com commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 Author: Slark Xiao Date: Wed Aug 10 11:30:50 2022 +0800 USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode We added PIDs for MV32-WA/WB MBIM mode before, now we need to add support for RmNet mode. Test evidence as below: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00f3 Rev=05.04 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00F3 USB Mobile Broadband S: SerialNumber=d7b4be8d C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00f4 Rev=05.04 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00F4 USB Mobile Broadband S: SerialNumber=d095087d C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option Signed-off-by: Slark Xiao [ johan: sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 001047ea241a9646010b2744451dfbc7289542f3 Author: Niek Nooijens Date: Mon Aug 1 10:39:25 2022 +0200 USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id works perfectly with: modprobe ftdi_sio echo "0590 00b2" | tee /sys/module/ftdi_sio/drivers/usb-serial\:ftdi_sio/new_id > /dev/null but doing this every reboot is a pain in the ass. Signed-off-by: Niek Nooijens Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f766f3abe6dbc9bf8b56a5d53c87e5a17942c154 Author: Yonglin Tan Date: Tue Jul 19 19:28:00 2022 +0800 USB: serial: option: add Quectel EM060K modem Add usb product id entry for the Quectel EM060K module. "MBIM mode": DIAG + NMEA + AT + MODEM + MBIM + QDSS T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030b Rev= 5.04 S: Manufacturer=Quectel S: Product=EM060K-GL S: SerialNumber=89fb57db C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 8 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 9 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#=12 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Yonglin Tan [ johan: mention QDSS port and sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 35508d2424097f9b6a1a17aac94f702767035616 Author: Yang Ling Date: Tue Aug 23 19:17:25 2022 +0800 MIPS: loongson32: ls1c: Fix hang during startup The RTCCTRL reg of LS1C is obselete. Writing this reg will cause system hang. Fixes: 60219c563c9b6 ("MIPS: Add RTC support for Loongson1C board") Signed-off-by: Yang Ling Tested-by: Keguang Zhang Acked-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit cb10b0f91c5f76de981ef927e7dadec60c5a5d96 Merge: 1bd3a383075c6 278d3ba61563c Author: David S. Miller Date: Mon Aug 29 13:02:27 2022 +0100 Merge branch 'u64_stats-fixups' Sebastian Andrzej Siewior says: ==================== net: u64_stats fixups for 32bit. while looking at the u64-stats patch https://lore.kernel.org/all/20220817162703.728679-10-bigeasy@linutronix.de I noticed that u64_stats_fetch_begin() is used. That suspicious thing about it is that network processing, including stats update, is performed in NAPI and so I would expect to see u64_stats_fetch_begin_irq() in order to avoid updates from NAPI during the read. This is only needed on 32bit-UP where the seqcount is not used. This is address in 2/2. The remaining user take some kind of precaution and may use u64_stats_fetch_begin(). I updated the previously mentioned patch to get rid of u64_stats_fetch_begin_irq(). If this is not considered stable patch worthy then it can be ignored and considred fixed by the other series which removes the special 32bit cases. The xrs700x driver reads and writes the counter from preemptible context so the only missing piece here is at least disable preemption on the writer side to avoid preemption while the writer is in progress. The possible reader would spin then until the writer completes its write critical section which is considered bad. This is addressed in 1/2 by using u64_stats_update_begin_irqsave() and so disable interrupts during the write critical section. The other closet resemblance I found is mdio_bus.c::mdiobus_stats_acct() where preemtion is disabled unconditionally. This is something I want to avoid since it also affects 64bit. ==================== Signed-off-by: David S. Miller commit 278d3ba61563ceed3cb248383ced19e14ec7bc1f Author: Sebastian Andrzej Siewior Date: Thu Aug 25 13:36:45 2022 +0200 net: Use u64_stats_fetch_begin_irq() for stats fetch. On 32bit-UP u64_stats_fetch_begin() disables only preemption. If the reader is in preemptible context and the writer side (u64_stats_update_begin*()) runs in an interrupt context (IRQ or softirq) then the writer can update the stats during the read operation. This update remains undetected. Use u64_stats_fetch_begin_irq() to ensure the stats fetch on 32bit-UP are not interrupted by a writer. 32bit-SMP remains unaffected by this change. Cc: "David S. Miller" Cc: Catherine Sullivan Cc: David Awogbemila Cc: Dimitris Michailidis Cc: Eric Dumazet Cc: Hans Ulli Kroll Cc: Jakub Kicinski Cc: Jeroen de Borst Cc: Johannes Berg Cc: Linus Walleij Cc: Paolo Abeni Cc: Simon Horman Cc: linux-arm-kernel@lists.infradead.org Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: oss-drivers@corigine.com Cc: stable@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3f8ae9fe0409698799e173f698b714f34570b64b Author: Sebastian Andrzej Siewior Date: Thu Aug 25 13:36:44 2022 +0200 net: dsa: xrs700x: Use irqsave variant for u64 stats update xrs700x_read_port_counters() updates the stats from a worker using the u64_stats_update_begin() version. This is okay on 32-UP since on the reader side preemption is disabled. On 32bit-SMP the writer can be preempted by the reader at which point the reader will spin on the seqcount until writer continues and completes the update. Assigning the mib_mutex mutex to the underlying seqcount would ensure proper synchronisation. The API for that on the u64_stats_init() side isn't available. Since it is the only user, just use disable interrupts during the update. Use u64_stats_update_begin_irqsave() on the writer side to ensure an uninterrupted update. Fixes: ee00b24f32eb8 ("net: dsa: add Arrow SpeedChips XRS700x driver") Cc: Andrew Lunn Cc: Florian Fainelli Cc: George McCollister Cc: Vivien Didelot Cc: Vladimir Oltean Signed-off-by: Sebastian Andrzej Siewior Acked-by: George McCollister Signed-off-by: David S. Miller commit 8d5fc280392735e4441b35de14f2f4860fa8d83c Author: Yan Xinyu Date: Thu Jul 14 18:20:37 2022 +0800 USB: serial: option: add support for OPPO R11 diag port Add support for OPPO R11 USB diag serial port to option driver. This phone uses Qualcomm Snapdragon 660 SoC. usb-devices output: T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=22d9 ProdID=276c Rev=04.04 S: Manufacturer=OPPO S: Product=SDM660-MTP _SN:09C6BCA7 S: SerialNumber=beb2c403 C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs Signed-off-by: Yan Xinyu Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit ca922fecda6caa5162409406dc3b663062d75089 Author: Pierre Morel Date: Fri Aug 19 14:29:45 2022 +0200 KVM: s390: pci: Hook to access KVM lowlevel from VFIO We have a cross dependency between KVM and VFIO when using s390 vfio_pci_zdev extensions for PCI passthrough To be able to keep both subsystem modular we add a registering hook inside the S390 core code. This fixes a build problem when VFIO is built-in and KVM is built as a module. Reported-by: Randy Dunlap Reported-by: kernel test robot Reviewed-by: Matthew Rosato Reviewed-by: Niklas Schnelle Signed-off-by: Pierre Morel Fixes: 09340b2fca007 ("KVM: s390: pci: add routines to start/stop interpretive execution") Cc: Acked-by: Janosch Frank Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20220819122945.9309-1-pmorel@linux.ibm.com Message-Id: <20220819122945.9309-1-pmorel@linux.ibm.com> Signed-off-by: Janosch Frank commit f04445fa099668ca1c9889c48e309f49740f92f0 Author: Claudiu Beznea Date: Fri Aug 26 11:39:19 2022 +0300 ARM: configs: at91: remove CONFIG_MICROCHIP_PIT64B Since commit f611af4c3bfa ("ARM: at91: Kconfig: implement PIT64B selection") there is no need to explicitly select PIT64B. Fixes: f611af4c3bfa ("ARM: at91: Kconfig: implement PIT64B selection") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-2-claudiu.beznea@microchip.com commit 92d5d6434d285510a3563ebace24306e240615e1 Author: Luca Ceresoli Date: Wed Aug 24 10:31:04 2022 +0200 docs: i2c: i2c-topology: reorder sections more logically The sequence of sections is a bit confusing here: * we list the mux locking scheme for existing drivers before introducing what mux locking schemes are * we list the caveats for each locking scheme (which are tricky) before the example of the simple use case Restructure it entirely with the following logic: * Intro ("I2C muxes and complex topologies") * Locking - mux-locked - example - caveats - parent-locked - example - caveats * Complex examples * Mux type of existing device drivers While there, also apply some other improvements: * convert the caveat list from a table (with only one column carrying content) to a bullet list. * add a small introductory text to bridge the gap from listing the use cases to telling about the hardware components to handle them and then the device drivers that implement those. * make empty lines usage more uniform Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Signed-off-by: Wolfram Sang commit 12c035a1a840e07a351c277d7a468269fa603000 Author: Luca Ceresoli Date: Wed Aug 24 10:31:03 2022 +0200 docs: i2c: i2c-topology: fix incorrect heading "Etc" here was never meant to be a heading, it became one while converting to ReST. It would be easy to just convert it to plain text, but rather remove it and add an introductory text before the list that conveys the same meaning but with a better reading flow. Fixes: ccf988b66d69 ("docs: i2c: convert to ReST and add to driver-api bookset") Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Signed-off-by: Wolfram Sang commit 6292b4ba607de5bcf4ab0e57892a2f8068e6b997 Author: Luca Ceresoli Date: Wed Aug 24 10:31:02 2022 +0200 docs: i2c: i2c-topology: fix typo "intension" should have probably been "intention", however "intent" seems even better. Reported-by: Bagas Sanjaya Signed-off-by: Luca Ceresoli Acked-by: Peter Rosin Signed-off-by: Wolfram Sang commit ffd7bdddaab193c38416fd5dd416d065517d266e Author: Li Qiong Date: Mon Aug 29 15:12:59 2022 +0800 ieee802154: cc2520: add rc code in cc2520_tx() The rc code is 0 at the error path "status & CC2520_STATUS_TX_UNDERFLOW". Assign rc code with '-EINVAL' at this error path to fix it. Signed-off-by: Li Qiong Link: https://lore.kernel.org/r/20220829071259.18330-1-liqiong@nfschina.com Signed-off-by: Stefan Schmidt commit f0da47118c7e93cdbbc6fb403dd729a5f2c90ee3 Author: Miquel Raynal Date: Fri Aug 26 16:29:54 2022 +0200 net: mac802154: Fix a condition in the receive path Upon reception, a packet must be categorized, either it's destination is the host, or it is another host. A packet with no destination addressing fields may be valid in two situations: - the packet has no source field: only ACKs are built like that, we consider the host as the destination. - the packet has a valid source field: it is directed to the PAN coordinator, as for know we don't have this information we consider we are not the PAN coordinator. There was likely a copy/paste error made during a previous cleanup because the if clause is now containing exactly the same condition as in the switch case, which can never be true. In the past the destination address was used in the switch and the source address was used in the if, which matches what the spec says. Cc: stable@vger.kernel.org Fixes: ae531b9475f6 ("ieee802154: use ieee802154_addr instead of *_sa variants") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 251e5d715e4bf6f286734b84de63c0eec210127c Author: Julia Lawall Date: Fri Aug 26 13:21:53 2022 +0200 ARM: ixp4xx: fix typos in comments Various spelling mistakes in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220318103729.157574-26-Julia.Lawall@inria.fr Link: https://lore.kernel.org/r/20220826112153.438829-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann commit a5b06d9f2a46b136d42536aa4120022dae448622 Merge: 43e403a286c54 eccd743970981 Author: Arnd Bergmann Date: Mon Aug 29 11:05:19 2022 +0200 Merge tag 'tee-fix-for-v6.0' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Add a missing include in the TEE subsystem * tag 'tee-fix-for-v6.0' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: fix compiler warning in tee_shm_register() Link: https://lore.kernel.org/r/YwdHcdEUib7obbbW@jade Signed-off-by: Arnd Bergmann commit 43e403a286c5428e979b0de2289fdc9485e9451d Merge: a3bedd242099a 6c939e28b1920 Author: Arnd Bergmann Date: Mon Aug 29 11:04:07 2022 +0200 Merge tag 'versatile-dts-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into arm/fixes These are some Versatile family DTS fixes, fixing some node names and clock names related to SPI. * tag 'versatile-dts-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator: ARM: dts: versatile: Update spi clock-names property ARM: dts: realview: Update spi clock-names property ARM: dts: integratorap: Update spi node properties Link: https://lore.kernel.org/r/CACRpkdZfTe8NSGR2ZCkn-1JcNobjfWeXqajSqcJMp8+WtY+2Xw@mail.gmail.com Signed-off-by: Arnd Bergmann commit a3bedd242099ab44e1aeb2330902334a89fd6bb4 Merge: c3069e822a48d 8f143b9f38498 Author: Arnd Bergmann Date: Mon Aug 29 11:02:27 2022 +0200 Merge tag 'imx-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.0: - Remove superfluous interrupt-names from imx8mq-tqma8mq RTC device to silence dtbs_check warning. - A few Verdin board fixes on CAN clock frequency, mcp251xfd interrupt, atmel_mxt_ts reset polarity and USB PHY. - Remove duplicated node and fix spi-flash compatible for imx6qdl-kontron-samx6i. - A couple of i.MX8M Plus DHCOM fixes from Marek Vasut on ECSPI1 pinmux and I2C5 GPIO assignment. - A couple of Venice fixes on SAI2 pin settings and phy-mode. - Drop in-band autoneg for 2500base-x phy-mode on ls1028a-qds-65bb board. - Revert the power device name setting change from imx8m-blk-ctrl driver, as it causes issue for sysfs cleanup path. - Fix gpcv2 driver to assert reset before ungating clock. * tag 'imx-fixes-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: freescale: verdin-imx8mp: fix atmel_mxt_ts reset polarity arm64: dts: freescale: verdin-imx8mm: fix atmel_mxt_ts reset polarity arm64: dts: imx8mp: Fix I2C5 GPIO assignment on i.MX8M Plus DHCOM arm64: dts: imx8mm-venice-gw7901: fix port/phy validation arm64: dts: verdin-imx8mm: add otg2 pd to usbphy soc: imx: gpcv2: Assert reset before ungating clock arm64: dts: ls1028a-qds-65bb: don't use in-band autoneg for 2500base-x ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node ARM: dts: imx6qdl-vicut1.dtsi: Fix node name backlight_led arm64: dts: imx8mq-tqma8mq: Remove superfluous interrupt-names arm64: dts: imx8mp: Adjust ECSPI1 pinmux on i.MX8M Plus DHCOM arm64: dts: imx8mp-venice-gw74xx: fix sai2 pin settings arm64: dts: imx8mm-verdin: use level interrupt for mcp251xfd arm64: dts: imx8mm-verdin: update CAN clock to 40MHz Revert "soc: imx: imx8m-blk-ctrl: set power device name" Link: https://lore.kernel.org/r/20220823092631.GV149610@dragon Signed-off-by: Arnd Bergmann commit c3069e822a48d8fd40b2a0855d840966a226aa1c Merge: b90cb10531903 3cbd673846772 Author: Arnd Bergmann Date: Mon Aug 29 10:55:36 2022 +0200 Merge branch 'polarfire/fixes' into arm/fixes Two updates for the MAINTAINERS file from Conor Dooley. * polarfire/fixes: MAINTAINERS: add the Polarfire SoC's i2c driver MAINTAINERS: add PolarFire SoC dt bindings commit 27cfde795a96aef1e859a5480489944b95421e46 Author: Michael Guralnik Date: Tue Aug 23 13:51:50 2022 +0300 RDMA/cma: Fix arguments order in net device validation Fix the order of source and destination addresses when resolving the route between server and client to validate use of correct net device. The reverse order we had so far didn't actually validate the net device as the server would try to resolve the route to itself, thus always getting the server's net device. The issue was discovered when running cm applications on a single host between 2 interfaces with same subnet and source based routing rules. When resolving the reverse route the source based route rules were ignored. Fixes: f887f2ac87c2 ("IB/cma: Validate routing of incoming requests") Link: https://lore.kernel.org/r/1c1ec2277a131d277ebcceec987fd338d35b775f.1661251872.git.leonro@nvidia.com Signed-off-by: Michael Guralnik Signed-off-by: Leon Romanovsky commit ab2866f12ca18747413ba41409231d44e0c6149b Author: Geert Uytterhoeven Date: Thu Aug 25 11:24:47 2022 +0200 arm64: dts: renesas: r8a779g0: Fix HSCIF0 interrupt number The interrupt number for the HSCIF0 serial port, which serves as the serial console on the White Hawk board, is incorrect, causing userspace to hang immediately as soon as it tries to print something. Kernel output is unaffected, as it is printed using polling. Fixes: 987da486d84a5643 ("arm64: dts: renesas: Add Renesas R8A779G0 SoC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/751dcef40d4534e856ed49b1d5b3a3e8d365ec42.1661419377.git.geert+renesas@glider.be commit c11efc57d4ccca47c5cf89341c4500acbb2c7599 Author: Thitat Auareesuksakul Date: Thu Aug 25 03:03:40 2022 +0700 scripts/extract-ikconfig: add zstd compression support Add extract-ikconfig support for kernel images compressed with zstd. Signed-off-by: Thitat Auareesuksakul Tested-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 86879fd277e8e76bf29d10c23e7562d86b9286a0 Author: Lukas Bulwahn Date: Thu Aug 25 11:15:17 2022 +0200 scripts: remove obsolete gcc-ld script Since commit 8564ed2b3888 ("Kbuild, lto: Add a gcc-ld script to let run gcc as ld") in 2014, there was not specific work on this the gcc-ld script other than treewide clean-ups. There are no users within the kernel tree, and probably no out-of-tree users either, and there is no dedicated maintainer in MAINTAINERS. Delete this obsolete gcc-ld script. Signed-off-by: Lukas Bulwahn Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 9c8b7a293f50253e694f19161c045817a938e551 Author: David Howells Date: Tue Aug 23 14:07:55 2022 +0100 smb3: fix temporary data corruption in insert range insert range doesn't discard the affected cached region so can risk temporarily corrupting file data. Also includes some minor cleanup (avoiding rereading inode size repeatedly unnecessarily) to make it clearer. Cc: stable@vger.kernel.org Fixes: 7fe6fe95b936 ("cifs: add FALLOC_FL_INSERT_RANGE support") Signed-off-by: David Howells cc: Ronnie Sahlberg Signed-off-by: Steve French commit fa30a81f255a56cccd89552cd6ce7ea6e8d8acc4 Author: Steve French Date: Tue Aug 23 14:07:41 2022 +0100 smb3: fix temporary data corruption in collapse range collapse range doesn't discard the affected cached region so can risk temporarily corrupting the file data. This fixes xfstest generic/031 I also decided to merge a minor cleanup to this into the same patch (avoiding rereading inode size repeatedly unnecessarily) to make it clearer. Cc: stable@vger.kernel.org Fixes: 5476b5dd82c8b ("cifs: add support for FALLOC_FL_COLLAPSE_RANGE") Reported-by: David Howells Tested-by: David Howells Reviewed-by: David Howells cc: Ronnie Sahlberg Signed-off-by: Steve French commit c3a72bb213209adfe981a4a92ea5746a778323e4 Author: David Howells Date: Tue Aug 23 14:07:28 2022 +0100 smb3: Move the flush out of smb2_copychunk_range() into its callers Move the flush out of smb2_copychunk_range() into its callers. This will allow the pagecache to be invalidated between the flush and the operation in smb3_collapse_range() and smb3_insert_range(). Signed-off-by: David Howells cc: Ronnie Sahlberg Signed-off-by: Steve French commit b90cb1053190353cc30f0fef0ef1f378ccc063c5 Author: Linus Torvalds Date: Sun Aug 28 15:05:29 2022 -0700 Linux 6.0-rc3 commit b467192ec7070d2d6d14ab5e6774a8afdcc9e89d Merge: 373eff576e580 0ebafe2ea879e Author: Linus Torvalds Date: Sun Aug 28 14:49:59 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more hotfixes from Andrew Morton: "Seventeen hotfixes. Mostly memory management things. Ten patches are cc:stable, addressing pre-6.0 issues" * tag 'mm-hotfixes-stable-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: .mailmap: update Luca Ceresoli's e-mail address mm/mprotect: only reference swap pfn page if type match squashfs: don't call kmalloc in decompressors mm/damon/dbgfs: avoid duplicate context directory creation mailmap: update email address for Colin King asm-generic: sections: refactor memory_intersects bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown Revert "memcg: cleanup racy sum avoidance code" mm/zsmalloc: do not attempt to free IS_ERR handle binder_alloc: add missing mmap_lock calls when using the VMA mm: re-allow pinning of zero pfns (again) vmcoreinfo: add kallsyms_num_syms symbol mailmap: update Guilherme G. Piccoli's email addresses writeback: avoid use-after-free after removing device shmem: update folio if shmem_replace_page() updates the page mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte commit 373eff576e580b6bbc1e709cd3ca0d100783431f Merge: 8379c0b31fbc5 5d7fef0804b0a Author: Linus Torvalds Date: Sun Aug 28 14:36:27 2022 -0700 Merge tag 'bitmap-6.0-rc3' of github.com:/norov/linux Pull bitmap fixes from Yury Norov: "Fix the reported issues, and implements the suggested improvements, for the version of the cpumask tests [1] that was merged with commit c41e8866c28c ("lib/test: introduce cpumask KUnit test suite"). These changes include fixes for the tests, and better alignment with the KUnit style guidelines" * tag 'bitmap-6.0-rc3' of github.com:/norov/linux: lib/cpumask_kunit: add tests file to MAINTAINERS lib/cpumask_kunit: log mask contents lib/test_cpumask: follow KUnit style guidelines lib/test_cpumask: fix cpu_possible_mask last test lib/test_cpumask: drop cpu_possible_mask full test commit 0ebafe2ea879e97fef6bd97f72303a6ccf39f092 Author: Luca Ceresoli Date: Fri Aug 26 15:05:15 2022 +0200 .mailmap: update Luca Ceresoli's e-mail address My Bootlin address is preferred from now on. Link: https://lkml.kernel.org/r/20220826130515.3011951-1-luca.ceresoli@bootlin.com Signed-off-by: Luca Ceresoli Cc: Arnd Bergmann Cc: Atish Patra Cc: Hans Verkuil Cc: Thomas Petazzoni Signed-off-by: Andrew Morton commit 3d2f78f08cd8388035ac375e731ec1ac1b79b09d Author: Peter Xu Date: Tue Aug 23 18:11:38 2022 -0400 mm/mprotect: only reference swap pfn page if type match Yu Zhao reported a bug after the commit "mm/swap: Add swp_offset_pfn() to fetch PFN from swap entry" added a check in swp_offset_pfn() for swap type [1]: kernel BUG at include/linux/swapops.h:117! CPU: 46 PID: 5245 Comm: EventManager_De Tainted: G S O L 6.0.0-dbg-DEV #2 RIP: 0010:pfn_swap_entry_to_page+0x72/0xf0 Code: c6 48 8b 36 48 83 fe ff 74 53 48 01 d1 48 83 c1 08 48 8b 09 f6 c1 01 75 7b 66 90 48 89 c1 48 8b 09 f6 c1 01 74 74 5d c3 eb 9e <0f> 0b 48 ba ff ff ff ff 03 00 00 00 eb ae a9 ff 0f 00 00 75 13 48 RSP: 0018:ffffa59e73fabb80 EFLAGS: 00010282 RAX: 00000000ffffffe8 RBX: 0c00000000000000 RCX: ffffcd5440000000 RDX: 1ffffffffff7a80a RSI: 0000000000000000 RDI: 0c0000000000042b RBP: ffffa59e73fabb80 R08: ffff9965ca6e8bb8 R09: 0000000000000000 R10: ffffffffa5a2f62d R11: 0000030b372e9fff R12: ffff997b79db5738 R13: 000000000000042b R14: 0c0000000000042b R15: 1ffffffffff7a80a FS: 00007f549d1bb700(0000) GS:ffff99d3cf680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000440d035b3180 CR3: 0000002243176004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: change_pte_range+0x36e/0x880 change_p4d_range+0x2e8/0x670 change_protection_range+0x14e/0x2c0 mprotect_fixup+0x1ee/0x330 do_mprotect_pkey+0x34c/0x440 __x64_sys_mprotect+0x1d/0x30 It triggers because pfn_swap_entry_to_page() could be called upon e.g. a genuine swap entry. Fix it by only calling it when it's a write migration entry where the page* is used. [1] https://lore.kernel.org/lkml/CAOUHufaVC2Za-p8m0aiHw6YkheDcrO-C3wRGixwDS32VTS+k1w@mail.gmail.com/ Link: https://lkml.kernel.org/r/20220823221138.45602-1-peterx@redhat.com Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive") Signed-off-by: Peter Xu Reported-by: Yu Zhao Tested-by: Yu Zhao Reviewed-by: David Hildenbrand Cc: "Huang, Ying" Cc: Signed-off-by: Andrew Morton commit 1f13dff09ffc8bcf6aa20639b638d813379c7f6b Author: Phillip Lougher Date: Mon Aug 22 22:54:30 2022 +0100 squashfs: don't call kmalloc in decompressors The decompressors may be called while in an atomic section. So move the kmalloc() out of this path, and into the "page actor" init function. This fixes a regression introduced by commit f268eedddf35 ("squashfs: extend "page actor" to handle missing pages") Link: https://lkml.kernel.org/r/20220822215430.15933-1-phillip@squashfs.org.uk Fixes: f268eedddf35 ("squashfs: extend "page actor" to handle missing pages") Reported-by: Chris Murphy Signed-off-by: Phillip Lougher Cc: Signed-off-by: Andrew Morton commit d26f60703606ab425eee9882b32a1781a8bed74d Author: Badari Pulavarty Date: Sun Aug 21 18:08:53 2022 +0000 mm/damon/dbgfs: avoid duplicate context directory creation When user tries to create a DAMON context via the DAMON debugfs interface with a name of an already existing context, the context directory creation fails but a new context is created and added in the internal data structure, due to absence of the directory creation success check. As a result, memory could leak and DAMON cannot be turned on. An example test case is as below: # cd /sys/kernel/debug/damon/ # echo "off" > monitor_on # echo paddr > target_ids # echo "abc" > mk_context # echo "abc" > mk_context # echo $$ > abc/target_ids # echo "on" > monitor_on <<< fails Return value of 'debugfs_create_dir()' is expected to be ignored in general, but this is an exceptional case as DAMON feature is depending on the debugfs functionality and it has the potential duplicate name issue. This commit therefore fixes the issue by checking the directory creation failure and immediately return the error in the case. Link: https://lkml.kernel.org/r/20220821180853.2400-1-sj@kernel.org Fixes: 75c1c2b53c78 ("mm/damon/dbgfs: support multiple contexts") Signed-off-by: Badari Pulavarty Signed-off-by: SeongJae Park Cc: [ 5.15.x] Signed-off-by: Andrew Morton commit ac733f6558ec86938e40433d88ec4e6148bac485 Author: Colin Ian King Date: Wed Aug 17 22:27:53 2022 +0100 mailmap: update email address for Colin King Colin King is working on kernel janitorial fixes in his spare time and using his Intel email is confusing. Use his gmail account as the default email address. Link: https://lkml.kernel.org/r/20220817212753.101109-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton commit 0c7d7cc2b4fe2e74ef8728f030f0f1674f9f6aee Author: Quanyang Wang Date: Fri Aug 19 16:11:45 2022 +0800 asm-generic: sections: refactor memory_intersects There are two problems with the current code of memory_intersects: First, it doesn't check whether the region (begin, end) falls inside the region (virt, vend), that is (virt < begin && vend > end). The second problem is if vend is equal to begin, it will return true but this is wrong since vend (virt + size) is not the last address of the memory region but (virt + size -1) is. The wrong determination will trigger the misreporting when the function check_for_illegal_area calls memory_intersects to check if the dma region intersects with stext region. The misreporting is as below (stext is at 0x80100000): WARNING: CPU: 0 PID: 77 at kernel/dma/debug.c:1073 check_for_illegal_area+0x130/0x168 DMA-API: chipidea-usb2 e0002000.usb: device driver maps memory from kernel text or rodata [addr=800f0000] [len=65536] Modules linked in: CPU: 1 PID: 77 Comm: usb-storage Not tainted 5.19.0-yocto-standard #5 Hardware name: Xilinx Zynq Platform unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0xb0/0x198 __warn from warn_slowpath_fmt+0x80/0xb4 warn_slowpath_fmt from check_for_illegal_area+0x130/0x168 check_for_illegal_area from debug_dma_map_sg+0x94/0x368 debug_dma_map_sg from __dma_map_sg_attrs+0x114/0x128 __dma_map_sg_attrs from dma_map_sg_attrs+0x18/0x24 dma_map_sg_attrs from usb_hcd_map_urb_for_dma+0x250/0x3b4 usb_hcd_map_urb_for_dma from usb_hcd_submit_urb+0x194/0x214 usb_hcd_submit_urb from usb_sg_wait+0xa4/0x118 usb_sg_wait from usb_stor_bulk_transfer_sglist+0xa0/0xec usb_stor_bulk_transfer_sglist from usb_stor_bulk_srb+0x38/0x70 usb_stor_bulk_srb from usb_stor_Bulk_transport+0x150/0x360 usb_stor_Bulk_transport from usb_stor_invoke_transport+0x38/0x440 usb_stor_invoke_transport from usb_stor_control_thread+0x1e0/0x238 usb_stor_control_thread from kthread+0xf8/0x104 kthread from ret_from_fork+0x14/0x2c Refactor memory_intersects to fix the two problems above. Before the 1d7db834a027e ("dma-debug: use memory_intersects() directly"), memory_intersects is called only by printk_late_init: printk_late_init -> init_section_intersects ->memory_intersects. There were few places where memory_intersects was called. When commit 1d7db834a027e ("dma-debug: use memory_intersects() directly") was merged and CONFIG_DMA_API_DEBUG is enabled, the DMA subsystem uses it to check for an illegal area and the calltrace above is triggered. [akpm@linux-foundation.org: fix nearby comment typo] Link: https://lkml.kernel.org/r/20220819081145.948016-1-quanyang.wang@windriver.com Fixes: 979559362516 ("asm/sections: add helpers to check for section data") Signed-off-by: Quanyang Wang Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Thierry Reding Cc: Signed-off-by: Andrew Morton commit dd0ff4d12dd284c334f7e9b07f8f335af856ac78 Author: Liu Shixin Date: Fri Aug 19 17:40:05 2022 +0800 bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem The vmemmap pages is marked by kmemleak when allocated from memblock. Remove it from kmemleak when freeing the page. Otherwise, when we reuse the page, kmemleak may report such an error and then stop working. kmemleak: Cannot insert 0xffff98fb6eab3d40 into the object search tree (overlaps existing) kmemleak: Kernel memory leak detector disabled kmemleak: Object 0xffff98fb6be00000 (size 335544320): kmemleak: comm "swapper", pid 0, jiffies 4294892296 kmemleak: min_count = 0 kmemleak: count = 0 kmemleak: flags = 0x1 kmemleak: checksum = 0 kmemleak: backtrace: Link: https://lkml.kernel.org/r/20220819094005.2928241-1-liushixin2@huawei.com Fixes: f41f2ed43ca5 (mm: hugetlb: free the vmemmap pages associated with each HugeTLB page) Signed-off-by: Liu Shixin Reviewed-by: Muchun Song Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 550842cc60987b269e31b222283ade3e1b6c7fc8 Author: Heming Zhao Date: Mon Aug 15 16:57:54 2022 +0800 ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown After commit 0737e01de9c4 ("ocfs2: ocfs2_mount_volume does cleanup job before return error"), any procedure after ocfs2_dlm_init() fails will trigger crash when calling ocfs2_dlm_shutdown(). ie: On local mount mode, no dlm resource is initialized. If ocfs2_mount_volume() fails in ocfs2_find_slot(), error handling will call ocfs2_dlm_shutdown(), then does dlm resource cleanup job, which will trigger kernel crash. This solution should bypass uninitialized resources in ocfs2_dlm_shutdown(). Link: https://lkml.kernel.org/r/20220815085754.20417-1-heming.zhao@suse.com Fixes: 0737e01de9c4 ("ocfs2: ocfs2_mount_volume does cleanup job before return error") Signed-off-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit dbb16df6443c59e8a1ef21c2272fcf387d600ddf Author: Shakeel Butt Date: Wed Aug 17 17:21:39 2022 +0000 Revert "memcg: cleanup racy sum avoidance code" This reverts commit 96e51ccf1af33e82f429a0d6baebba29c6448d0f. Recently we started running the kernel with rstat infrastructure on production traffic and begin to see negative memcg stats values. Particularly the 'sock' stat is the one which we observed having negative value. $ grep "sock " /mnt/memory/job/memory.stat sock 253952 total_sock 18446744073708724224 Re-run after couple of seconds $ grep "sock " /mnt/memory/job/memory.stat sock 253952 total_sock 53248 For now we are only seeing this issue on large machines (256 CPUs) and only with 'sock' stat. I think the networking stack increase the stat on one cpu and decrease it on another cpu much more often. So, this negative sock is due to rstat flusher flushing the stats on the CPU that has seen the decrement of sock but missed the CPU that has increments. A typical race condition. For easy stable backport, revert is the most simple solution. For long term solution, I am thinking of two directions. First is just reduce the race window by optimizing the rstat flusher. Second is if the reader sees a negative stat value, force flush and restart the stat collection. Basically retry but limited. Link: https://lkml.kernel.org/r/20220817172139.3141101-1-shakeelb@google.com Fixes: 96e51ccf1af33e8 ("memcg: cleanup racy sum avoidance code") Signed-off-by: Shakeel Butt Cc: "Michal Koutný" Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Muchun Song Cc: David Hildenbrand Cc: Yosry Ahmed Cc: Greg Thelen Cc: [5.15] Signed-off-by: Andrew Morton commit a5d2172180e8f94a8cfc7a7fa0243035629bf8d0 Author: Sergey Senozhatsky Date: Tue Aug 16 14:09:06 2022 +0900 mm/zsmalloc: do not attempt to free IS_ERR handle zsmalloc() now returns ERR_PTR values as handles, which zram accidentally can pass to zs_free(). Another bad scenario is when zcomp_compress() fails - handle has default -ENOMEM value, and zs_free() will try to free that "pointer value". Add the missing check and make sure that zs_free() bails out when ERR_PTR() is passed to it. Link: https://lkml.kernel.org/r/20220816050906.2583956-1-senozhatsky@chromium.org Fixes: c7e6f17b52e9 ("zsmalloc: zs_malloc: return ERR_PTR on failure") Signed-off-by: Sergey Senozhatsky Cc: Minchan Kim Cc: Nitin Gupta , Signed-off-by: Andrew Morton commit 44e602b4e52f70f04620bbbf4fe46ecb40170bde Author: Liam Howlett Date: Wed Aug 10 16:02:25 2022 +0000 binder_alloc: add missing mmap_lock calls when using the VMA Take the mmap_read_lock() when using the VMA in binder_alloc_print_pages() and when checking for a VMA in binder_alloc_new_buf_locked(). It is worth noting binder_alloc_new_buf_locked() drops the VMA read lock after it verifies a VMA exists, but may be taken again deeper in the call stack, if necessary. Link: https://lkml.kernel.org/r/20220810160209.1630707-1-Liam.Howlett@oracle.com Fixes: a43cfc87caaf (android: binder: stop saving a pointer to the VMA) Signed-off-by: Liam R. Howlett Reported-by: Ondrej Mosnacek Reported-by: Acked-by: Carlos Llamas Tested-by: Ondrej Mosnacek Cc: Minchan Kim Cc: Christian Brauner (Microsoft) Cc: Greg Kroah-Hartman Cc: Hridya Valsaraju Cc: Joel Fernandes Cc: Martijn Coenen Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Matthew Wilcox (Oracle) Cc: "Arve Hjønnevåg" Signed-off-by: Andrew Morton commit fcab34b433e2c13e333b2f53c4a8409eadc432c7 Author: Alex Williamson Date: Wed Aug 10 10:53:59 2022 -0600 mm: re-allow pinning of zero pfns (again) The below referenced commit makes the same error as 1c563432588d ("mm: fix is_pinnable_page against a cma page"), re-interpreting the logic to exclude pinning of the zero page, which breaks device assignment with vfio. To avoid further subtle mistakes, split the logic into discrete tests. [akpm@linux-foundation.org: simplify comment, per John] Link: https://lkml.kernel.org/r/166015037385.760108.16881097713975517242.stgit@omen Link: https://lore.kernel.org/all/165490039431.944052.12458624139225785964.stgit@omen Fixes: f25cbb7a95a2 ("mm: add zone device coherent type memory support") Signed-off-by: Alex Williamson Suggested-by: Matthew Wilcox Suggested-by: Felix Kuehling Tested-by: Slawomir Laba Reviewed-by: John Hubbard Cc: Alex Sierra Cc: Christoph Hellwig Cc: Alistair Popple Signed-off-by: Andrew Morton commit f09bddbd86619bf6213c96142a3b6b6a84818798 Author: Stephen Brennan Date: Mon Aug 8 13:54:10 2022 -0700 vmcoreinfo: add kallsyms_num_syms symbol The rest of the kallsyms symbols are useless without knowing the number of symbols in the table. In an earlier patch, I somehow dropped the kallsyms_num_syms symbol, so add it back in. Link: https://lkml.kernel.org/r/20220808205410.18590-1-stephen.s.brennan@oracle.com Fixes: 5fd8fea935a1 ("vmcoreinfo: include kallsyms symbols") Signed-off-by: Stephen Brennan Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 6c26d17eea01477f9223c4d5da8ebc2099e4f027 Author: Guilherme G. Piccoli Date: Thu Aug 4 17:22:07 2022 -0300 mailmap: update Guilherme G. Piccoli's email addresses Both @canonical and @ibm email addresses are invalid now; use my personal address instead. Link: https://lkml.kernel.org/r/20220804202207.439427-1-gpiccoli@igalia.com Signed-off-by: Guilherme G. Piccoli Signed-off-by: Andrew Morton commit f87904c075515f3e1d8f4a7115869d3b914674fd Author: Khazhismel Kumykov Date: Mon Aug 1 08:50:34 2022 -0700 writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback. Fix this by checking if the bdi_writeback is alive, similar to when scheduling writeback work. Since this requires wb->work_lock, and wb_inode_writeback_end() may get called from interrupt, switch wb->work_lock to an irqsafe lock. Link: https://lkml.kernel.org/r/20220801155034.3772543-1-khazhy@google.com Fixes: 45a2966fd641 ("writeback: fix bandwidth estimate for spiky workload") Signed-off-by: Khazhismel Kumykov Reviewed-by: Jan Kara Cc: Michael Stapelberg Cc: Wu Fengguang Cc: Alexander Viro Cc: Signed-off-by: Andrew Morton commit 9dfb3b8d655022760ca68af11821f1c63aa547c3 Author: Matthew Wilcox (Oracle) Date: Sat Jul 30 05:25:18 2022 +0100 shmem: update folio if shmem_replace_page() updates the page If we allocate a new page, we need to make sure that our folio matches that new page. If we do end up in this code path, we store the wrong page in the shmem inode's page cache, and I would rather imagine that data corruption ensues. This will be solved by changing shmem_replace_page() to shmem_replace_folio(), but this is the minimal fix. Link: https://lkml.kernel.org/r/20220730042518.1264767-1-willy@infradead.org Fixes: da08e9b79323 ("mm/shmem: convert shmem_swapin_page() to shmem_swapin_folio()") Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: William Kucharski Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton commit ab74ef708dc51df7cf2b8a890b9c6990fac5c0c6 Author: Miaohe Lin Date: Tue Jul 12 21:05:42 2022 +0800 mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte In MCOPY_ATOMIC_CONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepage_add_new_anon_rmap is called for them mistakenly because they're not vm_shared. This will corrupt the page->mapping used by page cache code. Link: https://lkml.kernel.org/r/20220712130542.18836-1-linmiaohe@huawei.com Fixes: f619147104c8 ("userfaultfd: add UFFDIO_CONTINUE ioctl") Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Cc: Axel Rasmussen Cc: Peter Xu Cc: Signed-off-by: Andrew Morton commit 8379c0b31fbc5d20946f617f8e2fe4791e6f58c1 Merge: c7bb3fbc1b499 f2c3bec215694 Author: Linus Torvalds Date: Sun Aug 28 10:44:04 2022 -0700 Merge tag 'for-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Fixes: - check that subvolume is writable when changing xattrs from security namespace - fix memory leak in device lookup helper - update generation of hole file extent item when merging holes - fix space cache corruption and potential double allocations; this is a rare bug but can be serious once it happens, stable backports and analysis tool will be provided - fix error handling when deleting root references - fix crash due to assert when attempting to cancel suspended device replace, add message what to do if mount fails due to missing replace item Regressions: - don't merge pages into bio if their page offset is not contiguous - don't allow large NOWAIT direct reads, this could lead to short reads eg. in io_uring" * tag 'for-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: add info when mount fails due to stale replace target btrfs: replace: drop assert for suspended replace btrfs: fix silent failure when deleting root reference btrfs: fix space cache corruption and potential double allocations btrfs: don't allow large NOWAIT direct reads btrfs: don't merge pages into bio if their page offset is not contiguous btrfs: update generation of hole file extent item when merging holes btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() btrfs: check if root is readonly while setting security xattr commit c7bb3fbc1b499b56a8819b56978c514fd63f66cc Merge: 2f23a7c914317 d291e703f420d Author: Linus Torvalds Date: Sun Aug 28 10:35:16 2022 -0700 Merge tag '6.0-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cfis fixes from Steve French: - two locking fixes (zero range, punch hole) - DFS 9 fix (padding), affecting some servers - three minor cleanup changes * tag '6.0-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Add helper function to check smb1+ server cifs: Use help macro to get the mid header size cifs: Use help macro to get the header preamble size cifs: skip extra NULL byte in filenames smb3: missing inode locks in punch hole smb3: missing inode locks in zero range commit 2f23a7c914317ac0b2a7e2bbe48dc00213652f98 Merge: 4459d800f71d0 00da0cb385d05 Author: Linus Torvalds Date: Sun Aug 28 10:10:23 2022 -0700 Merge tag 'x86-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Fix PAT on Xen, which caused i915 driver failures - Fix compat INT 80 entry crash on Xen PV guests - Fix 'MMIO Stale Data' mitigation status reporting on older Intel CPUs - Fix RSB stuffing regressions - Fix ORC unwinding on ftrace trampolines - Add Intel Raptor Lake CPU model number - Fix (work around) a SEV-SNP bootloader bug providing bogus values in boot_params->cc_blob_address, by ignoring the value on !SEV-SNP bootups. - Fix SEV-SNP early boot failure - Fix the objtool list of noreturn functions and annotate snp_abort(), which bug confused objtool on gcc-12. - Fix the documentation for retbleed * tag 'x86-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/ABI: Mention retbleed vulnerability info file for sysfs x86/sev: Mark snp_abort() noreturn x86/sev: Don't use cc_platform_has() for early SEV-SNP calls x86/boot: Don't propagate uninitialized boot_params->cc_blob_address x86/cpu: Add new Raptor Lake CPU model number x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/nospec: Fix i386 RSB stuffing x86/nospec: Unwreck the RSB stuffing x86/bugs: Add "unknown" reporting for MMIO Stale Data x86/entry: Fix entry_INT80_compat for Xen PV guests x86/PAT: Have pat_enabled() properly reflect state when running on Xen commit 4459d800f71d01042b36326fd8ece1f823b9da16 Merge: 611875d510a1e 11745ecfe8fea Author: Linus Torvalds Date: Sun Aug 28 10:05:42 2022 -0700 Merge tag 'perf-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf fixes from Ingo Molnar: "Misc fixes: an Arch-LBR fix, a PEBS enumeration fix, an Intel DS fix, PEBS constraints fix on Alder Lake CPUs and an Intel uncore PMU fix" * tag 'perf-urgent-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU perf/x86/intel: Fix pebs event constraints for ADL perf/x86/intel/ds: Fix precise store latency handling perf/x86/core: Set pebs_capable and PMU_FL_PEBS_ALL for the Baseline perf/x86/lbr: Enable the branch type for the Arch LBR by default commit 611875d510a1ea7bcdf0e58ff7eedda08199d77e Merge: 10d4879f9ef01 48648548ef764 Author: Linus Torvalds Date: Sun Aug 28 09:58:00 2022 -0700 Merge tag 'perf-tools-fixes-for-v6.0-2022-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fixup setup of weak groups when using 'perf stat --repeat', add a 'perf test' for it. - Fix memory leaks in 'perf sched record' detected with -fsanitize=address. - Fix build when PYTHON_CONFIG is user supplied. - Capitalize topdown metrics' names in 'perf stat', so that the output, sometimes parsed, matches the Intel SDM docs. - Make sure the documentation for the save_type filter about Intel systems with Arch LBR support (12th-Gen+ client or 4th-Gen Xeon+ server) reflects recent related kernel changes. - Fix 'perf record' man page formatting of description of support to hybrid systems. - Update arm64´s KVM header from the kernel sources. * tag 'perf-tools-fixes-for-v6.0-2022-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf stat: Capitalize topdown metrics' names perf docs: Update the documentation for the save_type filter perf sched: Fix memory leaks in __cmd_record detected with -fsanitize=address perf record: Fix manpage formatting of description of support to hybrid systems perf test: Stat test for repeat with a weak group perf stat: Clear evsel->reset_group for each stat run tools kvm headers arm64: Update KVM header from the kernel sources perf python: Fix build when PYTHON_CONFIG is user supplied commit 303e6da99429510b1e4edf833afe90ac8542e747 Author: Wei Yongjun Date: Mon Aug 22 04:10:25 2022 +0000 gpio: mockup: remove gpio debugfs when remove device GPIO mockup debugfs is created in gpio_mockup_probe() but forgot to remove when remove device. This patch add a devm managed callback for removing them. Signed-off-by: Wei Yongjun Signed-off-by: Bartosz Golaszewski commit ead54ced6321099978d30d62dc49c282a6e70574 Author: Shiraz Saleem Date: Wed Aug 24 10:43:59 2022 -0500 RDMA/irdma: Fix drain SQ hang with no completion SW generated completions for outstanding WRs posted on SQ after QP is in error target the wrong CQ. This causes the ib_drain_sq to hang with no completion. Fix this to generate completions on the right CQ. [ 863.969340] INFO: task kworker/u52:2:671 blocked for more than 122 seconds. [ 863.979224] Not tainted 5.14.0-130.el9.x86_64 #1 [ 863.986588] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 863.996997] task:kworker/u52:2 state:D stack: 0 pid: 671 ppid: 2 flags:0x00004000 [ 864.007272] Workqueue: xprtiod xprt_autoclose [sunrpc] [ 864.014056] Call Trace: [ 864.017575] __schedule+0x206/0x580 [ 864.022296] schedule+0x43/0xa0 [ 864.026736] schedule_timeout+0x115/0x150 [ 864.032185] __wait_for_common+0x93/0x1d0 [ 864.037717] ? usleep_range_state+0x90/0x90 [ 864.043368] __ib_drain_sq+0xf6/0x170 [ib_core] [ 864.049371] ? __rdma_block_iter_next+0x80/0x80 [ib_core] [ 864.056240] ib_drain_sq+0x66/0x70 [ib_core] [ 864.062003] rpcrdma_xprt_disconnect+0x82/0x3b0 [rpcrdma] [ 864.069365] ? xprt_prepare_transmit+0x5d/0xc0 [sunrpc] [ 864.076386] xprt_rdma_close+0xe/0x30 [rpcrdma] [ 864.082593] xprt_autoclose+0x52/0x100 [sunrpc] [ 864.088718] process_one_work+0x1e8/0x3c0 [ 864.094170] worker_thread+0x50/0x3b0 [ 864.099109] ? rescuer_thread+0x370/0x370 [ 864.104473] kthread+0x149/0x170 [ 864.109022] ? set_kthread_struct+0x40/0x40 [ 864.114713] ret_from_fork+0x22/0x30 Fixes: 81091d7696ae ("RDMA/irdma: Add SW mechanism to generate completions on error") Link: https://lore.kernel.org/r/20220824154358.117-1-shiraz.saleem@intel.com Reported-by: Kamal Heib Signed-off-by: Shiraz Saleem Signed-off-by: Leon Romanovsky commit 5f3d9e8161bb8cb23ab3b4678cd13f6e90a06186 Author: Takashi Iwai Date: Sun Aug 28 09:41:43 2022 +0200 ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5 The USB DAC from LH Labs (2522:0007) seems requiring the same quirk as Sony Walkman to set up the interface like UAC1; otherwise it gets the constant errors "usb_set_interface failed (-71)". This patch adds a quirk entry for addressing the buggy behavior. Reported-by: Lennert Van Alboom Cc: Link: https://lore.kernel.org/r/T3VPXtCc4uFws9Gfh2RjX6OdwM1RqfC6VqQr--_LMDyB2x5N3p9_q6AtPna17IXhHwBtcJVdXuS80ZZSCMjh_BafIbnzJPhbrkmhmWS6DlI=@vanalboom.org Link: https://lore.kernel.org/r/20220828074143.14736-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a2d57ebec1e15f0ac256eb8397e82b07adfaaacc Author: Kacper Michajłow Date: Sat Aug 27 22:33:28 2022 +0200 ALSA: hda/realtek: Add speaker AMP init for Samsung laptops with ALC298 Magic initialization sequence was extracted from Windows driver and cleaned up manually. Fixes internal speakers output. Link: https://bugzilla.kernel.org/show_bug.cgi?id=207423 Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1851518 Signed-off-by: Kacper Michajłow Cc: Link: https://lore.kernel.org/r/20220827203328.30363-1-kasper93@gmail.com Signed-off-by: Takashi Iwai commit 98e01215708b6d416345465c09dce2bd4868c67a Author: Tetsuo Handa Date: Sat Aug 27 20:36:27 2022 -0700 Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag syzbot is reporting hung task at __input_unregister_device() [1], for iforce_close() waiting at wait_event_interruptible() with dev->mutex held is blocking input_disconnect_device() from __input_unregister_device(). It seems that the cause is simply that commit c2b27ef672992a20 ("Input: iforce - wait for command completion when closing the device") forgot to call wake_up() after clear_bit(). Fix this problem by introducing a helper that calls clear_bit() followed by wake_up_all(). Reported-by: syzbot Fixes: c2b27ef672992a20 ("Input: iforce - wait for command completion when closing the device") Tested-by: syzbot Suggested-by: Fabio M. De Francesco Co-developed-by: Hillf Danton Signed-off-by: Hillf Danton Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/887021c3-4f13-40ce-c8b9-aa6e09faa3a7@I-love.SAKURA.ne.jp Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 10d4879f9ef01cc6190fafe4257d06f375bab92c Merge: b98f602df71aa 3bf1b1571224e Author: Linus Torvalds Date: Sat Aug 27 15:58:38 2022 -0700 Merge tag 'thermal-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Fix two issues introduced recently and one driver problem leading to a NULL pointer dereference in some cases. Specifics: - Add missing EXPORT_SYMBOL_GPL in the thermal core and add back the required 'trips' property to the thermal zone DT bindings (Daniel Lezcano) - Prevent the int340x_thermal driver from crashing when a package with a buffer of 0 length is returned by an ACPI control method evaluated by it (Lee, Chun-Yi)" * tag 'thermal-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR dt-bindings: thermal: Fix missing required property thermal/core: Add missing EXPORT_SYMBOL_GPL commit b98f602df71aa9612af3239a8d2a23b126e4357a Merge: 2b1ddb5950a65 6ca7076fbfaec Author: Linus Torvalds Date: Sat Aug 27 15:53:49 2022 -0700 Merge tag 'pm-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Make __resolve_freq() check the presence of the frequency table instead of checking whether or not the ->target_index() callback is implemented by the driver, because that need not be the case when __resolve_freq() is used (Lukasz Luba)" * tag 'pm-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: check only freq_table in __resolve_freq() commit 2b1ddb5950a65a6d5aa42ea381284d00fab7fb69 Merge: dee1873796aff 2413a85200ee9 Author: Linus Torvalds Date: Sat Aug 27 15:47:02 2022 -0700 Merge tag 'acpi-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix issues introduced by recent changes related to the handling of ACPI device properties and a coding mistake in the exit path of the ACPI processor driver. Specifics: - Prevent acpi_thermal_cpufreq_exit() from attempting to remove the same frequency QoS request multiple times (Riwen Lu) - Fix type detection for integer ACPI device properties (Stefan Binding) - Avoid emitting false-positive warnings when processing ACPI device properties and drop the useless default case from the acpi_copy_property_array_uint() macro (Sakari Ailus)" * tag 'acpi-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: property: Remove default association from integer maximum values ACPI: property: Ignore already existing data node tags ACPI: property: Fix type detection of unified integer reading functions ACPI: processor: Remove freq Qos request for all CPUs commit dee1873796aff90bb932b0e0073a0073863b4b94 Merge: 05519f2480a3e 41ac42f137080 Author: Linus Torvalds Date: Sat Aug 27 15:40:51 2022 -0700 Merge tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix double free of guarded storage and runtime instrumentation control blocks on fork() failure - Fix triggering write fault when VMA does not allow VM_WRITE * tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: do not trigger write fault when vma does not allow VM_WRITE s390: fix double free of GS and RI CBs on fork() failure commit 05519f2480a3e71053b892d4ea864e641949a77f Merge: 17b28d4267d9d c5deb27895e01 Author: Linus Torvalds Date: Sat Aug 27 15:38:00 2022 -0700 Merge tag 'for-linus-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - two minor cleanups - a fix of the xen/privcmd driver avoiding a possible NULL dereference in an error case * tag 'for-linus-6.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: fix error exit of privcmd_ioctl_dm_op() xen: move from strlcpy with unused retval to strscpy xen: x86: remove setting the obsolete config XEN_MAX_DOMAIN_MEMORY commit 17b28d4267d9d9dd11d42eea1d41cd3f5f5a4273 Merge: 89b749d8552d7 d4fefa4801a1c Author: Linus Torvalds Date: Sat Aug 27 15:31:12 2022 -0700 Merge tag 'audit-pr-20220826' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "Another small audit patch, this time to fix a bug where the return codes were not properly set before the audit filters were run, potentially resulting in missed audit records" * tag 'audit-pr-20220826' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: move audit_return_fixup before the filters commit 89b749d8552d78c4dd86dea86e2e6ba8aafab9fe Merge: d6ffe6067a549 a5a923038d70d Author: Linus Torvalds Date: Sat Aug 27 09:57:58 2022 -0700 Merge tag 'fbdev-for-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes and updates from Helge Deller: "Mostly just small patches, with the exception of the bigger indenting cleanups in the sisfb and radeonfb drivers. Two patches should be mentioned though: A fix-up for fbdev if the screen resize fails (by Shigeru Yoshida), and a potential divide by zero fix in fb_pm2fb (by Letu Ren). Summary: Major fixes: - Revert the changes for fbcon console when vc_resize() fails [Shigeru Yoshida] - Avoid a potential divide by zero error in fb_pm2fb [Letu Ren] Minor fixes: - Add missing pci_disable_device() in chipsfb_pci_init() [Yang Yingliang] - Fix tests for platform_get_irq() failure in omapfb [Yu Zhe] - Destroy mutex on freeing struct fb_info in fbsysfs [Shigeru Yoshida] Cleanups: - Move fbdev drivers from strlcpy to strscpy [Wolfram Sang] - Indenting fixes, comment fixes, ... [Jiapeng Chong & Jilin Yuan]" * tag 'fbdev-for-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: fbcon: Properly revert changes when vc_resize() failed fbdev: Move fbdev drivers from strlcpy to strscpy fbdev: omap: Remove unnecessary print function dev_err() fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() fbdev: fbcon: Destroy mutex on freeing struct fb_info fbdev: radeon: Clean up some inconsistent indenting fbdev: sisfb: Clean up some inconsistent indenting fbdev: fb_pm2fb: Avoid potential divide by zero error fbdev: ssd1307fb: Fix repeated words in comments fbdev: omapfb: Fix tests for platform_get_irq() failure commit d6ffe6067a54972564552ea45d320fb98db1ac5e Author: Mikulas Patocka Date: Fri Aug 26 16:43:51 2022 -0400 provide arch_test_bit_acquire for architectures that define test_bit Some architectures define their own arch_test_bit and they also need arch_test_bit_acquire, otherwise they won't compile. We also clean up the code by using the generic test_bit if that is equivalent to the arch-specific version. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Fixes: 8238b4579866 ("wait_on_bit: add an acquire memory barrier") Signed-off-by: Linus Torvalds commit 1bd3a383075c64d638e65d263c9267b08ee7733c Author: Jean-Francois Le Fillatre Date: Wed Aug 24 21:14:36 2022 +0200 r8152: add PID for the Lenovo OneLink+ Dock The Lenovo OneLink+ Dock contains an RTL8153 controller that behaves as a broken CDC device by default. Add the custom Lenovo PID to the r8152 driver to support it properly. Also, systems compatible with this dock provide a BIOS option to enable MAC address passthrough (as per Lenovo document "ThinkPad Docking Solutions 2017"). Add the custom PID to the MAC passthrough list too. Tested on a ThinkPad 13 1st gen with the expected results: passthrough disabled: Invalid header when reading pass-thru MAC addr passthrough enabled: Using pass-thru MAC addr XX:XX:XX:XX:XX:XX Signed-off-by: Jean-Francois Le Fillatre Signed-off-by: David S. Miller commit 48648548ef764dcb1f6ffc9c9f9057f7c610caa4 Author: Zhengjun Xing Date: Thu Aug 25 09:54:58 2022 +0800 perf stat: Capitalize topdown metrics' names Capitalize topdown metrics' names to follow the intel SDM. Before: # ./perf stat -a sleep 1 Performance counter stats for 'system wide': 228,094.05 msec cpu-clock # 225.026 CPUs utilized 842 context-switches # 3.691 /sec 224 cpu-migrations # 0.982 /sec 70 page-faults # 0.307 /sec 23,164,105 cycles # 0.000 GHz 29,403,446 instructions # 1.27 insn per cycle 5,268,185 branches # 23.097 K/sec 33,239 branch-misses # 0.63% of all branches 136,248,990 slots # 597.337 K/sec 32,976,450 topdown-retiring # 24.2% retiring 4,651,918 topdown-bad-spec # 3.4% bad speculation 26,148,695 topdown-fe-bound # 19.2% frontend bound 72,515,776 topdown-be-bound # 53.2% backend bound 6,008,540 topdown-heavy-ops # 4.4% heavy operations # 19.8% light operations 3,934,049 topdown-br-mispredict # 2.9% branch mispredict # 0.5% machine clears 16,655,439 topdown-fetch-lat # 12.2% fetch latency # 7.0% fetch bandwidth 41,635,972 topdown-mem-bound # 30.5% memory bound # 22.7% Core bound 1.013634593 seconds time elapsed After: # ./perf stat -a sleep 1 Performance counter stats for 'system wide': 228,081.94 msec cpu-clock # 225.003 CPUs utilized 824 context-switches # 3.613 /sec 224 cpu-migrations # 0.982 /sec 67 page-faults # 0.294 /sec 22,647,423 cycles # 0.000 GHz 28,870,551 instructions # 1.27 insn per cycle 5,167,099 branches # 22.655 K/sec 32,383 branch-misses # 0.63% of all branches 133,411,074 slots # 584.926 K/sec 32,352,607 topdown-retiring # 24.3% Retiring 4,456,977 topdown-bad-spec # 3.3% Bad Speculation 25,626,487 topdown-fe-bound # 19.2% Frontend Bound 70,955,316 topdown-be-bound # 53.2% Backend Bound 5,834,844 topdown-heavy-ops # 4.4% Heavy Operations # 19.9% Light Operations 3,738,781 topdown-br-mispredict # 2.8% Branch Mispredict # 0.5% Machine Clears 16,286,803 topdown-fetch-lat # 12.2% Fetch Latency # 7.0% Fetch Bandwidth 40,802,069 topdown-mem-bound # 30.6% Memory Bound # 22.6% Core Bound 1.013683125 seconds time elapsed Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220825015458.3252239-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 3126204ce3d9ab083cbdc2d61ab93746232eb89b Author: Kan Liang Date: Tue Aug 16 05:56:12 2022 -0700 perf docs: Update the documentation for the save_type filter Update the documentation to reflect the kernel changes. Signed-off-by: Kan Liang Cc: Andi Kleen Cc: Ian Rogers Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220816125612.2042397-2-kan.liang@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d72e5cf3cf69d4c68d3b54aea232451b0a8b69d3 Author: Ian Rogers Date: Wed Aug 24 07:57:33 2022 -0700 perf sched: Fix memory leaks in __cmd_record detected with -fsanitize=address An array of strings is passed to cmd_record but not freed. As cmd_record modifies the array, add another array as a copy that can be mutated allowing the original array contents to all be freed. Detected with -fsanitize=address. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220824145733.409005-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e89eaa611c7568d1288a2ccca88355a9434f2d47 Author: Andi Kleen Date: Thu Aug 18 03:01:27 2022 -0700 perf record: Fix manpage formatting of description of support to hybrid systems The Intel hybrid description is written in a different style than the rest of the perf record man page. There were some new command line options added after it which resulted in very strange section ordering. Move the hybrid include last. Also the sub sections in the hybrid document don't fit the record manpage well (especially since it talks about all kinds of unrelated commands). I left this for now, but would be better to separate this properly in the different man pages. It would be better to use sub sections for the other sections, but these don't seem to be supported in AsciiDoc? Some of the examples are still misrendered in the manpage with an indented troff command, but I don't know how to fix that. In any case it's now better than before. Signed-off-by: Andi Kleen Cc: zhengjun.xing@intel.com Link: https://lore.kernel.org/r/20220818100127.249401-1-ak@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 0c361c6eaba7fe1a29391540dd8797e850e49f21 Author: Ian Rogers Date: Mon Aug 22 14:33:52 2022 -0700 perf test: Stat test for repeat with a weak group Breaking a weak group requires multiple passes of an evlist, with multiple runs this can introduce bugs ultimately leading to segfaults. Add a test to cover this. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220822213352.75721-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit bf515f024e4c0ca46a1b08c4f31860c01781d8a5 Author: Ian Rogers Date: Mon Aug 22 14:33:51 2022 -0700 perf stat: Clear evsel->reset_group for each stat run If a weak group is broken then the reset_group flag remains set for the next run. Having reset_group set means the counter isn't created and ultimately a segfault. A simple reproduction of this is: # perf stat -r2 -e '{cycles,cycles,cycles,cycles,cycles,cycles,cycles,cycles,cycles,cycles}:W which will be added as a test in the next patch. Fixes: 4804e0111662d7d8 ("perf stat: Use affinity for opening events") Reviewed-by: Andi Kleen Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Tested-by: Xing Zhengjun Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220822213352.75721-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit dbcfe5ec3f9a5799d8b49ad2c81549bbfa8390e7 Author: Arnaldo Carvalho de Melo Date: Mon Dec 21 12:53:44 2020 -0300 tools kvm headers arm64: Update KVM header from the kernel sources To pick the changes from: ae3b1da95413614f ("KVM: arm64: Fix compile error due to sign extension") That doesn't result in any changes in tooling (when built on x86), only addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Marc Zyngier Cc: Namhyung Kim Cc: Yang Yingliang Link: https://lore.kernel.org/all/YwOMCCc4E79FuvDe@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bc9e7fe313d5e56d4d5f34bcc04d1165f94f86fb Author: James Clark Date: Thu Jul 28 10:39:46 2022 +0100 perf python: Fix build when PYTHON_CONFIG is user supplied The previous change to Python autodetection had a small mistake where the auto value was used to determine the Python binary, rather than the user supplied value. The Python binary is only used for one part of the build process, rather than the final linking, so it was producing correct builds in most scenarios, especially when the auto detected value matched what the user wanted, or the system only had a valid set of Pythons. Change it so that the Python binary path is derived from either the PYTHON_CONFIG value or PYTHON value, depending on what is specified by the user. This was the original intention. This error was spotted in a build failure an odd cross compilation environment after commit 4c41cb46a732fe82 ("perf python: Prefer python3") was merged. Fixes: 630af16eee495f58 ("perf tools: Use Python devtools for version autodetection rather than runtime") Signed-off-by: James Clark Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220728093946.1337642-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 3bf1b1571224e713f1a186de21b2204c06f1cb5e Merge: 7931e28098a4c d92e600f860ba Author: Rafael J. Wysocki Date: Sat Aug 27 15:07:58 2022 +0200 Merge branch 'thermal-core' Merge thermal control core fixes for 6.0-rc3: - Fix missing required property for thermal zone description (Daniel Lezcano). - Add missing export symbol for thermal_zone_device_register_with_trips() (Daniel Lezcano). * thermal-core: dt-bindings: thermal: Fix missing required property thermal/core: Add missing EXPORT_SYMBOL_GPL commit 2413a85200ee9cbed40d12c6e3b856752b089790 Merge: bd9594ae4c553 36527b9d88236 Author: Rafael J. Wysocki Date: Sat Aug 27 14:43:18 2022 +0200 Merge branch 'acpi-processor' into acpi * acpi-processor: ACPI: processor: Remove freq Qos request for all CPUs commit ebe5555c2f34505cdb1ae5c3de8b24e33740b3e0 Author: Tianyu Yuan Date: Thu Aug 25 10:08:45 2022 +0200 nfp: flower: fix ingress police using matchall filter Referenced commit introduced nfp_policer_validate in the progress installing rate limiter. This validate check the action id and will reject police with CONTINUE, which is required to support ingress police offload. Fix this issue by allowing FLOW_ACTION_CONTINUE as notexceed action id in nfp_policer_validate Fixes: d97b4b105ce7 ("flow_offload: reject offload for all drivers with invalid police parameters") Signed-off-by: Tianyu Yuan Reviewed-by: Baowen Zheng Reviewed-by: Louis Peens Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220825080845.507534-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit a87406f4adee9c53b311d8a1ba2849c69e29a6d0 Author: Andrey Zhadchenko Date: Thu Aug 25 05:03:26 2022 +0300 openvswitch: fix memory leak at failed datapath creation ovs_dp_cmd_new()->ovs_dp_change()->ovs_dp_set_upcall_portids() allocates array via kmalloc. If for some reason new_vport() fails during ovs_dp_cmd_new() dp->upcall_portids must be freed. Add missing kfree. Kmemleak example: unreferenced object 0xffff88800c382500 (size 64): comm "dump_state", pid 323, jiffies 4294955418 (age 104.347s) hex dump (first 32 bytes): 5e c2 79 e4 1f 7a 38 c7 09 21 38 0c 80 88 ff ff ^.y..z8..!8..... 03 00 00 00 0a 00 00 00 14 00 00 00 28 00 00 00 ............(... backtrace: [<0000000071bebc9f>] ovs_dp_set_upcall_portids+0x38/0xa0 [<000000000187d8bd>] ovs_dp_change+0x63/0xe0 [<000000002397e446>] ovs_dp_cmd_new+0x1f0/0x380 [<00000000aa06f36e>] genl_family_rcv_msg_doit+0xea/0x150 [<000000008f583bc4>] genl_rcv_msg+0xdc/0x1e0 [<00000000fa10e377>] netlink_rcv_skb+0x50/0x100 [<000000004959cece>] genl_rcv+0x24/0x40 [<000000004699ac7f>] netlink_unicast+0x23e/0x360 [<00000000c153573e>] netlink_sendmsg+0x24e/0x4b0 [<000000006f4aa380>] sock_sendmsg+0x62/0x70 [<00000000d0068654>] ____sys_sendmsg+0x230/0x270 [<0000000012dacf7d>] ___sys_sendmsg+0x88/0xd0 [<0000000011776020>] __sys_sendmsg+0x59/0xa0 [<000000002e8f2dc1>] do_syscall_64+0x3b/0x90 [<000000003243e7cb>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: b83d23a2a38b ("openvswitch: Introduce per-cpu upcall dispatch") Acked-by: Aaron Conole Signed-off-by: Andrey Zhadchenko Link: https://lore.kernel.org/r/20220825020326.664073-1-andrey.zhadchenko@virtuozzo.com Signed-off-by: Jakub Kicinski commit 3ce9f2bef75528936c78a7053301f5725f622f3a Author: Florian Fainelli Date: Wed Aug 24 19:39:51 2022 -0700 net: smsc911x: Stop and start PHY during suspend and resume Commit 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") unveiled that the smsc911x driver was not properly stopping and restarting the PHY during suspend/resume. Correct that by indicating that the MAC is in charge of PHY PM operations and ensure that all MDIO bus activity is quiescent during suspend. Tested-by: Geert Uytterhoeven Tested-by: Marek Szyprowski Fixes: fba863b81604 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Fixes: 2aa70f864955 ("net: smsc911x: Quieten netif during suspend") Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220825023951.3220-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit 2ca1c94ce0b65a2ce7512b718f3d8a0fe6224bca Author: Kai-Heng Feng Date: Fri Aug 26 08:25:30 2022 +0800 tg3: Disable tg3 device on system reboot to avoid triggering AER Commit d60cd06331a3 ("PM: ACPI: reboot: Use S5 for reboot") caused a reboot hang on one Dell servers so the commit was reverted. Someone managed to collect the AER log and it's caused by MSI: [ 148.762067] ACPI: Preparing to enter system sleep state S5 [ 148.794638] {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 5 [ 148.803731] {1}[Hardware Error]: event severity: recoverable [ 148.810191] {1}[Hardware Error]: Error 0, type: fatal [ 148.816088] {1}[Hardware Error]: section_type: PCIe error [ 148.822391] {1}[Hardware Error]: port_type: 0, PCIe end point [ 148.829026] {1}[Hardware Error]: version: 3.0 [ 148.834266] {1}[Hardware Error]: command: 0x0006, status: 0x0010 [ 148.841140] {1}[Hardware Error]: device_id: 0000:04:00.0 [ 148.847309] {1}[Hardware Error]: slot: 0 [ 148.852077] {1}[Hardware Error]: secondary_bus: 0x00 [ 148.857876] {1}[Hardware Error]: vendor_id: 0x14e4, device_id: 0x165f [ 148.865145] {1}[Hardware Error]: class_code: 020000 [ 148.870845] {1}[Hardware Error]: aer_uncor_status: 0x00100000, aer_uncor_mask: 0x00010000 [ 148.879842] {1}[Hardware Error]: aer_uncor_severity: 0x000ef030 [ 148.886575] {1}[Hardware Error]: TLP Header: 40000001 0000030f 90028090 00000000 [ 148.894823] tg3 0000:04:00.0: AER: aer_status: 0x00100000, aer_mask: 0x00010000 [ 148.902795] tg3 0000:04:00.0: AER: [20] UnsupReq (First) [ 148.910234] tg3 0000:04:00.0: AER: aer_layer=Transaction Layer, aer_agent=Requester ID [ 148.918806] tg3 0000:04:00.0: AER: aer_uncor_severity: 0x000ef030 [ 148.925558] tg3 0000:04:00.0: AER: TLP Header: 40000001 0000030f 90028090 00000000 The MSI is probably raised by incoming packets, so power down the device and disable bus mastering to stop the traffic, as user confirmed this approach works. In addition to that, be extra safe and cancel reset task if it's running. Cc: Josef Bacik Link: https://lore.kernel.org/all/b8db79e6857c41dab4ef08bdf826ea7c47e3bafc.1615947283.git.josef@toxicpanda.com/ BugLink: https://bugs.launchpad.net/bugs/1917471 Signed-off-by: Kai-Heng Feng Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20220826002530.1153296-1-kai.heng.feng@canonical.com Signed-off-by: Jakub Kicinski commit 7498a457ecf7ff2c4d379360aa8f24566bb1543e Author: Casper Andersson Date: Thu Aug 25 10:49:55 2022 +0200 net: sparx5: fix handling uneven length packets in manual extraction Packets that are not of length divisible by 4 (e.g. 77, 78, 79) would have the checksum included up to next multiple of 4 (a 77 bytes packet would have 3 bytes of ethernet checksum included). The check for the value expects it in host (Little) endian. Fixes: f3cad2611a77 ("net: sparx5: add hostmode with phylink support") Signed-off-by: Casper Andersson Reviewed-by: Steen Hegelund Link: https://lore.kernel.org/r/20220825084955.684637-1-casper.casan@gmail.com Signed-off-by: Jakub Kicinski commit 037c97b2886e1b0bcdd14f96bb595f843faa07da Merge: 2e085ec0e2d7a 2da8eb834b775 Author: Jakub Kicinski Date: Fri Aug 26 17:13:25 2022 -0700 Merge tag 'for-net-2022-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix handling of duplicate connection handle - Fix handling of HCI vendor opcode - Fix suspend performance regression - Fix build errors - Fix not handling shutdown condition on ISO sockets - Fix double free issue * tag 'for-net-2022-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn Bluetooth: move from strlcpy with unused retval to strscpy Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt Bluetooth: ISO: Fix not handling shutdown condition Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() Bluetooth: MGMT: Fix Get Device Flags Bluetooth: L2CAP: Fix build errors in some archs Bluetooth: hci_sync: Fix suspend performance regression Bluetooth: hci_event: Fix vendor (unknown) opcode status handling ==================== Link: https://lore.kernel.org/r/20220825234559.1837409-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 5479d6d4bf122d4b137659559a7bd17784b97b7e Author: Menglong Dong Date: Sat Aug 27 00:01:50 2022 +0800 docs/conf.py: add function attribute '__fix_address' to conf.py Stephen Rothwell reported htmldocs warning when merging net-next: Documentation/networking/kapi:26: net/core/skbuff.c:780: WARNING: Error in declarator or parameters Invalid C declaration: Expecting "(" in parameters. [error at 19] void __fix_address kfree_skb_reason (struct sk_buff *skb, enum skb_drop_reason reason) -------------------^ Add __fix_address keyword to c_id_attributes array in conf.py to fix the warning. Link: https://lore.kernel.org/linux-next/20220825154105.534d78ab@canb.auug.org.au/ Reported-by: Stephen Rothwell Signed-off-by: Menglong Dong Tested-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet commit 11745ecfe8fea4b4a4c322967a7605d2ecbd5080 Author: Stephane Eranian Date: Wed Aug 3 09:00:31 2022 -0700 perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU Existing code was generating bogus counts for the SNB IMC bandwidth counters: $ perf stat -a -I 1000 -e uncore_imc/data_reads/,uncore_imc/data_writes/ 1.000327813 1,024.03 MiB uncore_imc/data_reads/ 1.000327813 20.73 MiB uncore_imc/data_writes/ 2.000580153 261,120.00 MiB uncore_imc/data_reads/ 2.000580153 23.28 MiB uncore_imc/data_writes/ The problem was introduced by commit: 07ce734dd8ad ("perf/x86/intel/uncore: Clean up client IMC") Where the read_counter callback was replace to point to the generic uncore_mmio_read_counter() function. The SNB IMC counters are freerunnig 32-bit counters laid out contiguously in MMIO. But uncore_mmio_read_counter() is using a readq() call to read from MMIO therefore reading 64-bit from MMIO. Although this is okay for the uncore_perf_event_update() function because it is shifting the value based on the actual counter width to compute a delta, it is not okay for the uncore_pmu_event_start() which is simply reading the counter and therefore priming the event->prev_count with a bogus value which is responsible for causing bogus deltas in the perf stat command above. The fix is to reintroduce the custom callback for read_counter for the SNB IMC PMU and use readl() instead of readq(). With the change the output of perf stat is back to normal: $ perf stat -a -I 1000 -e uncore_imc/data_reads/,uncore_imc/data_writes/ 1.000120987 296.94 MiB uncore_imc/data_reads/ 1.000120987 138.42 MiB uncore_imc/data_writes/ 2.000403144 175.91 MiB uncore_imc/data_reads/ 2.000403144 68.50 MiB uncore_imc/data_writes/ Fixes: 07ce734dd8ad ("perf/x86/intel/uncore: Clean up client IMC") Signed-off-by: Stephane Eranian Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20220803160031.1379788-1-eranian@google.com commit dd9373402280cf4715fdc8fd5070f7d039e43511 Author: Casey Schaufler Date: Tue Aug 23 16:46:18 2022 -0700 Smack: Provide read control for io_uring_cmd Limit io_uring "cmd" options to files for which the caller has Smack read access. There may be cases where the cmd option may be closer to a write access than a read, but there is no way to make that determination. Cc: stable@vger.kernel.org Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Casey Schaufler Signed-off-by: Paul Moore commit e022620b5d056e822e42eb9bc0f24fcb97389d86 Merge: 012bd7e859df9 714f3cbd70a4d Author: Linus Torvalds Date: Fri Aug 26 11:32:53 2022 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "A bumper crop of arm64 fixes for -rc3. The largest change is fixing our parsing of the 'rodata=full' command line option, which kstrtobool() started treating as 'rodata=false'. The fix actually makes the parsing of that option much less fragile and updates the documentation at the same time. We still have a boot issue pending when KASLR is disabled at compile time, but there's a fresh fix on the list which I'll send next week if it holds up to testing. Summary: - Fix workaround for Cortex-A76 erratum #1286807 - Add workaround for AMU erratum #2457168 on Cortex-A510 - Drop reference to removed CONFIG_ARCH_RANDOM #define - Fix parsing of the "rodata=full" cmdline option - Fix a bunch of issues in the SME register state switching and sigframe code - Fix incorrect extraction of the CTR_EL0.CWG register field - Fix ACPI cache topology probing when the PPTT is not present - Trivial comment and whitespace fixes" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/sme: Don't flush SVE register state when handling SME traps arm64/sme: Don't flush SVE register state when allocating SME storage arm64/signal: Flush FPSIMD register state when disabling streaming mode arm64/signal: Raise limit on stack frames arm64/cache: Fix cache_type_cwg() for register generation arm64/sysreg: Guard SYS_FIELD_ macros for asm arm64/sysreg: Directly include bitfield.h arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly arm64: fix rodata=full arm64: Fix comment typo docs/arm64: elf_hwcaps: unify newlines in HWCAP lists arm64: adjust KASLR relocation after ARCH_RANDOM removal arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 commit 012bd7e859df9d6aa0a8ab4484c00aeded108071 Merge: c23f864dc7ef3 1709c70c31e05 Author: Linus Torvalds Date: Fri Aug 26 11:26:27 2022 -0700 Merge tag 'riscv-for-linus-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A handful of fixes for the Microchip device trees - A pair of fixes to eliminate build warnings * tag 'riscv-for-linus-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: dts: microchip: mpfs: remove pci axi address translation property riscv: dts: microchip: mpfs: remove bogus card-detect-delay riscv: dts: microchip: mpfs: remove ti,fifo-depth property riscv: dts: microchip: mpfs: fix incorrect pcie child node name riscv: traps: add missing prototype riscv: signal: fix missing prototype warning riscv: dts: microchip: correct L2 cache interrupts commit c23f864dc7ef37655021c43beae98321436cbd9a Merge: 78effb4a9b8c3 b83699ea1e629 Author: Linus Torvalds Date: Fri Aug 26 11:21:18 2022 -0700 Merge tag 'loongarch-fixes-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix a bunch of build errors/warnings, a poweroff error and an unbalanced locking in do_page_fault()" * tag 'loongarch-fixes-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: mm: Avoid unnecessary page fault retires on shared memory types LoongArch: Add subword xchg/cmpxchg emulation LoongArch: Cleanup headers to avoid circular dependency LoongArch: Cleanup reset routines with new API LoongArch: Fix build warnings in VDSO LoongArch: Select PCI_QUIRKS to avoid build error commit 78effb4a9b8c3589519b84759ac1757647072448 Merge: 3e5c673f0d75b 100d0ae82b5c2 Author: Linus Torvalds Date: Fri Aug 26 11:15:37 2022 -0700 Merge tag 'drm-fixes-2022-08-26-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Weekly fixes, lots of amdgpu fixes mostly for IP blocks introduced in 6.0-rc1, otherwise vc4, nouveau fixes. gem: - Fix handle release leak nouveau: - Fix fencing when moving BO vc4: - HDMI fixes amdgpu: - GFX 11.0 fixes - PSP XGMI handling fixes - GFX9 fix for compute-only IPs - Drop duplicated function call - Fix warning due to missing header - NBIO 7.7 fixes - DCN 3.1.4 fixes - SDMA 6.0 fixes - SMU 13.0 fixes - Arcturus GPUVM page table fix - MMHUB 1.0 fix amdkfd: - GC 10.3.7 fix radeon: - Delayed work flush fix" * tag 'drm-fixes-2022-08-26-1' of git://anongit.freedesktop.org/drm/drm: (21 commits) drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly drm/amdgpu: add MGCG perfmon setting for gfx11 drm/amdkfd: Fix isa version for the GC 10.3.7 drm/amdgpu: Fix page table setup on Arcturus drm/amd/pm: update SMU 13.0.0 driver_if header drm/amdgpu: add sdma instance check for gfx11 CGCG drm/amd/display: enable PCON support for dcn314 drm/amdgpu: enable NBIO IP v7.7.0 Clock Gating drm/amdgpu: add NBIO IP v7.7.0 Clock Gating support drm/amdgpu: add TX_POWER_CTRL_1 macro definitions for NBIO IP v7.7.0 nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf drm/radeon: add a force flush to delay work when radeon drm/amd/display: Include missing header drm/amdgpu: Remove the additional kfd pre reset call for sriov drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. drm/amdgpu: fix hive reference leak when adding xgmi device drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini drm/amdgpu: enable GFXOFF allow control for GC IP v11.0.1 drm/gem: Fix GEM handle release errors drm/vc4: hdmi: Rework power up ... commit 3e5c673f0d75bc22b3c26eade87e4db4f374cd34 Merge: 0b0861eb91cbf 645b5ed871f40 Author: Linus Torvalds Date: Fri Aug 26 11:05:54 2022 -0700 Merge tag 'block-6.0-2022-08-26' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - MD pull request via Song: - Fix for clustered raid (Guoqing Jiang) - req_op fix (Bart Van Assche) - Fix race condition in raid recreate (David Sloan) - loop configuration overflow fix (Siddh) - Fix missing commit_rqs call for certain conditions (Yu) * tag 'block-6.0-2022-08-26' of git://git.kernel.dk/linux-block: md: call __md_stop_writes in md_stop Revert "md-raid: destroy the bitmap after destroying the thread" md: Flush workqueue md_rdev_misc_wq in md_alloc() md/raid10: Fix the data type of an r10_sync_page_io() argument loop: Check for overflow while configuring loop blk-mq: fix io hung due to missing commit_rqs commit 0b0861eb91cbfdd04d6df5a031152914c1114c18 Merge: 5373081b99ed3 581711c46612c Author: Linus Torvalds Date: Fri Aug 26 11:01:52 2022 -0700 Merge tag 'io_uring-6.0-2022-08-26' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Add missing header file to the MAINTAINERS entry for io_uring (Ammar) - liburing and the kernel ship the same io_uring.h header, but one change we've had for a long time only in liburing is to ensure it's C++ safe. Add extern C around it, so we can more easily sync them in the future (Ammar) - Fix an off-by-one in the sync cancel added in this merge window (me) - Error handling fix for passthrough (Kanchan) - Fix for address saving for async execution for the zc tx support (Pavel) - Fix ordering for TCP zc notifications, so we always have them ordered correctly between "data was sent" and "data was acked". This isn't strictly needed with the notification slots, but we've been pondering disabling the slot support for 6.0 - and if we do, then we do require the ordering to be sane. Regardless of that, it's the sane thing to do in terms of API (Pavel) - Minor cleanup for indentation and lockdep annotation (Pavel) * tag 'io_uring-6.0-2022-08-26' of git://git.kernel.dk/linux-block: io_uring/net: save address for sendzc async execution io_uring: conditional ->async_data allocation io_uring/notif: order notif vs send CQEs io_uring/net: fix indentation io_uring/net: fix zc send link failing io_uring/net: fix must_hold annotation io_uring: fix submission-failure handling for uring-cmd io_uring: fix off-by-one in sync cancelation file check io_uring: uapi: Add `extern "C"` in io_uring.h for liburing MAINTAINERS: Add `include/linux/io_uring_types.h` commit a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Author: Shigeru Yoshida Date: Fri Aug 19 03:13:36 2022 +0900 fbdev: fbcon: Properly revert changes when vc_resize() failed fbcon_do_set_font() calls vc_resize() when font size is changed. However, if if vc_resize() failed, current implementation doesn't revert changes for font size, and this causes inconsistent state. syzbot reported unable to handle page fault due to this issue [1]. syzbot's repro uses fault injection which cause failure for memory allocation, so vc_resize() failed. This patch fixes this issue by properly revert changes for font related date when vc_resize() failed. Link: https://syzkaller.appspot.com/bug?id=3443d3a1fa6d964dd7310a0cb1696d165a3e07c4 [1] Reported-by: syzbot+a168dbeaaa7778273c1b@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida Signed-off-by: Helge Deller CC: stable@vger.kernel.org # 5.15+ commit 5373081b99ed3c8e6e3866c366bf43fd8b03013a Merge: 8238b4579866b 785538bfdd682 Author: Linus Torvalds Date: Fri Aug 26 10:29:56 2022 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Ten fixes. Of the three core changes, the two large ones are a complete reversion of the async rework and an ALUA timing rework (the latter shouldn't affect non-ALUA paths). The remaining patches are all small and all but one in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Revert "Rework asynchronous resume support" scsi: core: Fix passthrough retry counter handling scsi: ufs: core: Reduce the power mode change timeout scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq scsi: ufs: host: ufs-exynos: Make fsd_ufs_drvs static scsi: megaraid_sas: Remove unnecessary kfree() scsi: megaraid_sas: Fix double kfree() scsi: ufs: core: Enable link lost interrupt scsi: core: Allow the ALUA transitioning state enough time scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX commit dfb58b1796d19c8405a38eb457f97669440c59d4 Author: Pavel Begunkov Date: Fri Aug 26 17:15:47 2022 +0100 io_uring/net: fix overexcessive retries Length parameter of io_sg_from_iter() can be smaller than the iterator's size, as it's with TCP, so when we set from->count at the end of the function we truncate the iterator forcing TCP to return preliminary with a short send. It affects zerocopy sends with large payload sizes and leads to retries and possible request failures. Fixes: 3ff1a0d395c00 ("io_uring: enable managed frags with register buffers") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/0bc0d5179c665b4ef5c328377c84c7a1f298467e.1661530037.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 8238b4579866b7c1bb99883cfe102a43db5506ff Author: Mikulas Patocka Date: Fri Aug 26 09:17:08 2022 -0400 wait_on_bit: add an acquire memory barrier There are several places in the kernel where wait_on_bit is not followed by a memory barrier (for example, in drivers/md/dm-bufio.c:new_read). On architectures with weak memory ordering, it may happen that memory accesses that follow wait_on_bit are reordered before wait_on_bit and they may return invalid data. Fix this class of bugs by introducing a new function "test_bit_acquire" that works like test_bit, but has acquire memory ordering semantics. Signed-off-by: Mikulas Patocka Acked-by: Will Deacon Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit 707527956d90ea4f304188555a97144183af1e49 Author: Paul Moore Date: Fri Aug 19 16:20:33 2022 -0400 /dev/null: add IORING_OP_URING_CMD support This patch adds support for the io_uring command pass through, aka IORING_OP_URING_CMD, to the /dev/null driver. As with all of the /dev/null functionality, the implementation is just a simple sink where commands go to die, but it should be useful for developers who need a simple IORING_OP_URING_CMD test device that doesn't require any special hardware. Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Acked-by: Jens Axboe Signed-off-by: Paul Moore commit f4d653dcaa4e4056e1630423e6a8ece4869b544f Author: Paul Moore Date: Wed Aug 10 15:55:36 2022 -0400 selinux: implement the security_uring_cmd() LSM hook Add a SELinux access control for the iouring IORING_OP_URING_CMD command. This includes the addition of a new permission in the existing "io_uring" object class: "cmd". The subject of the new permission check is the domain of the process requesting access, the object is the open file which points to the device/file that is the target of the IORING_OP_URING_CMD operation. A sample policy rule is shown below: allow :io_uring { cmd }; Cc: stable@vger.kernel.org Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Paul Moore commit 2a5840124009f133bd09fd855963551fb2cefe22 Author: Luis Chamberlain Date: Fri Jul 15 12:16:22 2022 -0700 lsm,io_uring: add LSM hooks for the new uring_cmd file op io-uring cmd support was added through ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd"), this extended the struct file_operations to allow a new command which each subsystem can use to enable command passthrough. Add an LSM specific for the command passthrough which enables LSMs to inspect the command details. This was discussed long ago without no clear pointer for something conclusive, so this enables LSMs to at least reject this new file operation. [0] https://lkml.kernel.org/r/8adf55db-7bab-f59d-d612-ed906b948d19@schaufler-ca.com Cc: stable@vger.kernel.org Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Luis Chamberlain Acked-by: Jens Axboe Signed-off-by: Paul Moore commit 5934d9a0383619c14df91af8fd76261dc3de2f5f Author: Dan Carpenter Date: Fri Aug 26 18:01:10 2022 +0300 ALSA: control: Re-order bounds checking in get_ctl_id_hash() These two checks are in the reverse order so it might read one element beyond the end of the array. First check if the "i" is within bounds before using it. Fixes: 6ab55ec0a938 ("ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash()") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YwjgNh/gkG1hH7po@kili Signed-off-by: Takashi Iwai commit 2e085ec0e2d7afa14bcfbcd4c41240f5d3372bfe Merge: 4ba9d38bb5a32 a657182a5c515 Author: David S. Miller Date: Fri Aug 26 12:19:09 2022 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel borkmann says: ==================== The following pull-request contains BPF updates for your *net* tree. We've added 11 non-merge commits during the last 14 day(s) which contain a total of 13 files changed, 61 insertions(+), 24 deletions(-). The main changes are: 1) Fix BPF verifier's precision tracking around BPF ring buffer, from Kumar Kartikeya Dwivedi. 2) Fix regression in tunnel key infra when passing FLOWI_FLAG_ANYSRC, from Eyal Birger. 3) Fix insufficient permissions for bpf_sys_bpf() helper, from YiFei Zhu. 4) Fix splat from hitting BUG when purging effective cgroup programs, from Pu Lehui. 5) Fix range tracking for array poke descriptors, from Daniel Borkmann. 6) Fix corrupted packets for XDP_SHARED_UMEM in aligned mode, from Magnus Karlsson. 7) Fix NULL pointer splat in BPF sockmap sk_msg_recvmsg(), from Liu Jian. 8) Add READ_ONCE() to bpf_jit_limit when reading from sysctl, from Kuniyuki Iwashima. 9) Add BPF selftest lru_bug check to s390x deny list, from Daniel Müller. ==================== Signed-off-by: David S. Miller commit fa3fbe64037839f448dc569212bafc5a495d8219 Author: Deren Wu Date: Tue Aug 2 23:15:07 2022 +0800 wifi: mt76: mt7921e: fix crash in chip reset fail In case of drv own fail in reset, we may need to run mac_reset several times. The sequence would trigger system crash as the log below. Because we do not re-enable/schedule "tx_napi" before disable it again, the process would keep waiting for state change in napi_diable(). To avoid the problem and keep status synchronize for each run, goto final resource handling if drv own failed. [ 5857.353423] mt7921e 0000:3b:00.0: driver own failed [ 5858.433427] mt7921e 0000:3b:00.0: Timeout for driver own [ 5859.633430] mt7921e 0000:3b:00.0: driver own failed [ 5859.633444] ------------[ cut here ]------------ [ 5859.633446] WARNING: CPU: 6 at kernel/kthread.c:659 kthread_park+0x11d [ 5859.633717] Workqueue: mt76 mt7921_mac_reset_work [mt7921_common] [ 5859.633728] RIP: 0010:kthread_park+0x11d/0x150 [ 5859.633736] RSP: 0018:ffff8881b676fc68 EFLAGS: 00010202 ...... [ 5859.633766] Call Trace: [ 5859.633768] [ 5859.633771] mt7921e_mac_reset+0x176/0x6f0 [mt7921e] [ 5859.633778] mt7921_mac_reset_work+0x184/0x3a0 [mt7921_common] [ 5859.633785] ? mt7921_mac_set_timing+0x520/0x520 [mt7921_common] [ 5859.633794] ? __kasan_check_read+0x11/0x20 [ 5859.633802] process_one_work+0x7ee/0x1320 [ 5859.633810] worker_thread+0x53c/0x1240 [ 5859.633818] kthread+0x2b8/0x370 [ 5859.633824] ? process_one_work+0x1320/0x1320 [ 5859.633828] ? kthread_complete_and_exit+0x30/0x30 [ 5859.633834] ret_from_fork+0x1f/0x30 [ 5859.633842] Cc: stable@vger.kernel.org Fixes: 0efaf31dec57 ("mt76: mt7921: fix MT7921E reset failure") Signed-off-by: Deren Wu Link: https://lore.kernel.org/r/727eb5ffd3c7c805245e512da150ecf0a7154020.1659452909.git.deren.wu@mediatek.com Signed-off-by: Johannes Berg commit 343b62048ba4cec6b8b890092bcc200e1eb83424 Author: Mario Limonciello Date: Fri Aug 19 13:01:00 2022 -0500 platform/x86: thinkpad_acpi: Explicitly set to balanced mode on startup It was observed that on a Thinkpad T14 Gen1 (AMD) that the platform profile is starting up in 'low-power' mode after refreshing what the firmware had. This is most likely a firmware bug, but as a harmless workaround set the default profile to 'balanced' at thinkpad_acpi startup. Reported-by: madcatx@atlas.cz Link: https://bugzilla.kernel.org/show_bug.cgi?id=216347 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20220819180101.6383-1-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 4ba9d38bb5a3255390dc15d8ac81f656a968273c Merge: 4c612826bec14 55f0a4894484e Author: David S. Miller Date: Fri Aug 26 11:43:20 2022 +0100 Merge tag 'wireless-2022-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== pull-request: wireless-2022-08-26 Here are a couple of fixes for the current cycle, see the tag description below. Just a couple of fixes: * two potential leaks * use-after-free in certain scan races * warning in IBSS code * error return from a debugfs file was wrong * possible NULL-ptr-deref when station lookup fails Please pull and let me know if there's any problem. ==================== Signed-off-by: David S. Miller commit 874b301985ef2f89b8b592ad255e03fb6fbfe605 Author: Eric Biggers Date: Thu Aug 25 22:04:56 2022 -0700 crypto: lib - remove unneeded selection of XOR_BLOCKS CRYPTO_LIB_CHACHA_GENERIC doesn't need to select XOR_BLOCKS. It perhaps was thought that it's needed for __crypto_xor, but that's not the case. Enabling XOR_BLOCKS is problematic because the XOR_BLOCKS code runs a benchmark when it is initialized. That causes a boot time regression on systems that didn't have it enabled before. Therefore, remove this unnecessary and problematic selection. Fixes: e56e18985596 ("lib/crypto: add prompts back to crypto libraries") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit ee653d2d8f7c935a00f01a7654d889e8ce55b00e Author: PaddyKP_Yao Date: Thu Aug 25 08:43:05 2022 +0800 platform/x86: asus-wmi: Fix the name of the mic-mute LED classdev According to well-known-leds.txt, we should use "platform::micmute" instead of "asus::micmute" for the name of the mic-mute LED classdev. Signed-off-by: PaddyKP_Yao Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220825004305.709539-1-PaddyKP_Yao@asus.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 76648c867c6c03b8a468d9c9222025873ecc613d Author: Michael Wu Date: Fri Aug 19 10:45:41 2022 +0800 pinctrl: sunxi: Fix name for A100 R_PIO The name of A100 R_PIO driver should be sun50i-a100-r-pinctrl, not sun50iw10p1-r-pinctrl. Fixes: 473436e7647d6 ("pinctrl: sunxi: add support for the Allwinner A100 pin controller") Signed-off-by: Michael Wu Acked-by: Samuel Holland Link: https://lore.kernel.org/r/20220819024541.74191-1-michael@allwinnertech.com Signed-off-by: Linus Walleij commit ec6624452e36158d0813758d837f7a2263a4109d Merge: e9ac503883abb 4c612826bec14 Author: Andrew Morton Date: Thu Aug 25 21:45:38 2022 -0700 Merge branch 'linus' commit 100d0ae82b5c240a4dc17486698e67bf116bd598 Merge: 064d491f73464 b8983d42524f1 Author: Dave Airlie Date: Fri Aug 26 09:56:53 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-08-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-08-25: amdgpu: - GFX 11.0 fixes - PSP XGMI handling fixes - GFX9 fix for compute-only IPs - Drop duplicated function call - Fix warning due to missing header - NBIO 7.7 fixes - DCN 3.1.4 fixes - SDMA 6.0 fixes - SMU 13.0 fixes - Arcturus GPUVM page table fix - MMHUB 1.0 fix amdkfd: - GC 10.3.7 fix radeon: - Delayed work flush fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220825181243.5853-1-alexander.deucher@amd.com commit 064d491f73464f5c9cf56ac24f55118f6f4c54c2 Merge: 1c23f9e627a7b 6b04ce966a738 Author: Dave Airlie Date: Fri Aug 26 09:47:49 2022 +1000 Merge tag 'drm-misc-fixes-2022-08-25' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * gem: Fixes handle release leak * nouveau: Fix fencing when moving BO * vc4: HDMI fixes * Backmerging for v6.0-rc1 Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YwclSWheC+Ai+u+v@linux-uq9g commit 1709c70c31e05e6e87b2ffa0a2b4cc0da4b2c513 Merge: 92e55a865bc7b d951b20b9def7 Author: Palmer Dabbelt Date: Thu Aug 25 16:37:17 2022 -0700 Merge branch 'riscv-variable_fixes_without_kvm' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/linux.git into fixes This contains a pair of fixes for build-time warnings. * 'riscv-variable_fixes_without_kvm' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/linux.git: riscv: traps: add missing prototype riscv: signal: fix missing prototype warning commit 92e55a865bc7b3f89bb8c684f6846651868ee7d7 Merge: 96264230a6817 e4009c5fa77b4 Author: Palmer Dabbelt Date: Thu Aug 25 16:06:49 2022 -0700 Merge tag 'dt-fixes-for-palmer-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git into fixes Microchip RISC-V devicetree fixes for 6.0-rc3 Two sets of fixes this time around: - A fix for the interrupt ordering of the l2-cache controller. If the driver is enabled, it would spam the console /constantly/, rendering the system useless. - General cleanup for some bogus properties in the dt, part of my quest for zero dtbs_check warnings. On that note, the interrupt ordering adds a dtbs_check warning - but I considered that fixing the potentially useless system was more of a priority. Signed-off-by: Conor Dooley * tag 'dt-fixes-for-palmer-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git: riscv: dts: microchip: mpfs: remove pci axi address translation property riscv: dts: microchip: mpfs: remove bogus card-detect-delay riscv: dts: microchip: mpfs: remove ti,fifo-depth property riscv: dts: microchip: mpfs: fix incorrect pcie child node name riscv: dts: microchip: correct L2 cache interrupts commit 2da8eb834b775a9d1acea6214d3e4a78ac841e6e Author: Zhengping Jiang Date: Tue Aug 23 10:28:08 2022 -0700 Bluetooth: hci_sync: hold hdev->lock when cleanup hci_conn When disconnecting all devices, hci_conn_failed is used to cleanup hci_conn object when the hci_conn object cannot be aborted. The function hci_conn_failed requires the caller holds hdev->lock. Fixes: 9b3628d79b46f ("Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted") Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz commit cb0d160f813b23df2f4fe7af3237a026c44ed1aa Author: Wolfram Sang Date: Thu Aug 18 23:02:07 2022 +0200 Bluetooth: move from strlcpy with unused retval to strscpy Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Luiz Augusto von Dentz commit f48735a9aaf8258f39918e13adf464ccd7dce33b Author: Archie Pusaka Date: Tue Aug 23 12:39:22 2022 +0800 Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt To prevent multiple conn complete events, we shouldn't look up the conn with hci_lookup_le_connect, since it requires the state to be BT_CONNECT. By the time the duplicate event is processed, the state might have changed, so we end up processing the new event anyway. Change the lookup function to hci_conn_hash_lookup_ba. Fixes: d5ebaa7c5f6f6 ("Bluetooth: hci_event: Ignore multiple conn complete events") Signed-off-by: Archie Pusaka Reviewed-by: Sonny Sasaka Signed-off-by: Luiz Augusto von Dentz commit c572909376673d8c126ae2ee53ba754ff9327d98 Author: Luiz Augusto von Dentz Date: Thu Aug 18 14:31:42 2022 -0700 Bluetooth: ISO: Fix not handling shutdown condition In order to properly handle shutdown syscall the code shall not assume that the how argument is always SHUT_RDWR resulting in SHUTDOWN_MASK as that would result in poll to immediately report EPOLLHUP instead of properly waiting for disconnect_cfm (Disconnect Complete) which is rather important for the likes of BAP as the CIG may need to be reprogrammed. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz commit 3cfbc6ac22d62d0a06be9ce2996ba9fed75436cd Author: Tetsuo Handa Date: Wed Aug 17 20:14:36 2022 +0900 Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() syzbot is reporting double kfree() at remove_adv_monitor() [1], for commit 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv Monitor") forgot to remove duplicated mgmt_pending_remove() when merging "if (err) {" path and "if (!pending) {" path. Link: https://syzkaller.appspot.com/bug?extid=915a8416bf15895b8e07 [1] Reported-by: syzbot Fixes: 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv Monitor") Signed-off-by: Tetsuo Handa Signed-off-by: Luiz Augusto von Dentz commit 23b72814da1a094b4c065e0bb598249f310c5577 Author: Luiz Augusto von Dentz Date: Mon Aug 15 16:14:32 2022 -0700 Bluetooth: MGMT: Fix Get Device Flags Get Device Flags don't check if device does actually use an RPA in which case it shall only set HCI_CONN_FLAG_REMOTE_WAKEUP if LL Privacy is enabled. Signed-off-by: Luiz Augusto von Dentz commit b840304fb46cdf7012722f456bce06f151b3e81b Author: Luiz Augusto von Dentz Date: Fri Aug 12 15:33:57 2022 -0700 Bluetooth: L2CAP: Fix build errors in some archs This attempts to fix the follow errors: In function 'memcmp', inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9, inlined from 'l2cap_global_chan_by_psm' at net/bluetooth/l2cap_core.c:2003:15: ./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp' specified bound 6 exceeds source size 0 [-Werror=stringop-overread] 44 | #define __underlying_memcmp __builtin_memcmp | ^ ./include/linux/fortify-string.h:420:16: note: in expansion of macro '__underlying_memcmp' 420 | return __underlying_memcmp(p, q, size); | ^~~~~~~~~~~~~~~~~~~ In function 'memcmp', inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9, inlined from 'l2cap_global_chan_by_psm' at net/bluetooth/l2cap_core.c:2004:15: ./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp' specified bound 6 exceeds source size 0 [-Werror=stringop-overread] 44 | #define __underlying_memcmp __builtin_memcmp | ^ ./include/linux/fortify-string.h:420:16: note: in expansion of macro '__underlying_memcmp' 420 | return __underlying_memcmp(p, q, size); | ^~~~~~~~~~~~~~~~~~~ Fixes: 332f1795ca20 ("Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression") Signed-off-by: Luiz Augusto von Dentz commit 1fd02d56dae35b08e4cba8e6bd2c2e7ccff68ecc Author: Luiz Augusto von Dentz Date: Thu Aug 11 14:20:46 2022 -0700 Bluetooth: hci_sync: Fix suspend performance regression This attempts to fix suspend performance when there is no connections by not updating the event mask. Fixes: ef61b6ea1544 ("Bluetooth: Always set event mask on suspend") Signed-off-by: Luiz Augusto von Dentz commit b82a26d8633cc89367fac75beb3ec33061bea44a Author: Hans de Goede Date: Sun Aug 7 22:57:40 2022 +0200 Bluetooth: hci_event: Fix vendor (unknown) opcode status handling Commit c8992cffbe74 ("Bluetooth: hci_event: Use of a function table to handle Command Complete") was (presumably) meant to only refactor things without any functional changes. But it does have one undesirable side-effect, before *status would always be set to skb->data[0] and it might be overridden by some of the opcode specific handling. While now it always set by the opcode specific handlers. This means that if the opcode is not known *status does not get set any more at all! This behavior change has broken bluetooth support for BCM4343A0 HCIs, the hci_bcm.c code tries to configure UART attached HCIs at a higher baudraute using vendor specific opcodes. The BCM4343A0 does not support this and this used to simply fail: [ 25.646442] Bluetooth: hci0: BCM: failed to write clock (-56) [ 25.646481] Bluetooth: hci0: Failed to set baudrate After which things would continue with the initial baudraute. But now that hci_cmd_complete_evt() no longer sets status for unknown opcodes *status is left at 0. This causes the hci_bcm.c code to think the baudraute has been changed on the HCI side and to also adjust the UART baudrate, after which communication with the HCI is broken, leading to: [ 28.579042] Bluetooth: hci0: command 0x0c03 tx timeout [ 36.961601] Bluetooth: hci0: BCM: Reset failed (-110) And non working bluetooth. Fix this by restoring the previous default "*status = skb->data[0]" handling for unknown opcodes. Fixes: c8992cffbe74 ("Bluetooth: hci_event: Use of a function table to handle Command Complete") Signed-off-by: Hans de Goede Signed-off-by: Luiz Augusto von Dentz commit 91926d8b7e71aaf5f84f0cf208fc5a8b7a761050 Author: Michael Ellerman Date: Tue Aug 23 21:59:52 2022 +1000 powerpc/rtas: Fix RTAS MSR[HV] handling for Cell The semi-recent changes to MSR handling when entering RTAS (firmware) cause crashes on IBM Cell machines. An example trace: kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0) BUG: Unable to handle kernel instruction fetch Faulting instruction address: 0x2fff01a8 Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.0.0-rc2-00433-gede0a8d3307a #207 NIP: 000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000 REGS: c0000000015236b0 TRAP: 0400 Tainted: G W (6.0.0-rc2-00433-gede0a8d3307a) MSR: 0000000008001002 CR: 00000000 XER: 20000000 ... NIP 0x2fff01a8 LR 0x32608 Call Trace: 0xc00000000143c5f8 (unreliable) .rtas_call+0x224/0x320 .rtas_get_boot_time+0x70/0x150 .read_persistent_clock64+0x114/0x140 .read_persistent_wall_and_boot_offset+0x24/0x80 .timekeeping_init+0x40/0x29c .start_kernel+0x674/0x8f0 start_here_common+0x1c/0x50 Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell machines Linux runs with MSR[HV] set but also uses RTAS, provided by SLOF. Fix it by copying the MSR[HV] bit from the MSR value we've just read using mfmsr into the value used for RTAS. It seems like we could also fix it using an #ifdef CELL to set MSR[HV], but that doesn't work because it's possible to build a single kernel image that runs on both Cell native and pseries. Fixes: b6b1c3ce06ca ("powerpc/rtas: Keep MSR[RI] set when calling RTAS") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Michael Ellerman Reviewed-by: Jordan Niethe Link: https://lore.kernel.org/r/20220823115952.1203106-2-mpe@ellerman.id.au commit 310d1344e3c58cc2d625aa4e52cfcb7d8a26fcbf Author: Michael Ellerman Date: Tue Aug 23 21:59:51 2022 +1000 Revert "powerpc: Remove unused FW_FEATURE_NATIVE references" This reverts commit 79b74a68486765a4fe685ac4069bc71366c538f5. It broke booting on IBM Cell machines when the kernel is also built with CONFIG_PPC_PS3=y. That's because FW_FEATURE_NATIVE_ALWAYS = 0 does have an important effect, which is to clear the PS3 ALWAYS features from FW_FEATURE_ALWAYS. Note that CONFIG_PPC_NATIVE has since been renamed CONFIG_PPC_HASH_MMU_NATIVE. Fixes: 79b74a684867 ("powerpc: Remove unused FW_FEATURE_NATIVE references") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220823115952.1203106-1-mpe@ellerman.id.au commit c7acee3d2f128a38b68fb7af85dbbd91bfd0b4ad Author: Masahiro Yamada Date: Sun Aug 21 01:51:29 2022 +0900 powerpc: align syscall table for ppc32 Christophe Leroy reported that commit 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS") broke mpc85xx_defconfig + CONFIG_RELOCATABLE=y. LD vmlinux SYSMAP System.map SORTTAB vmlinux CHKREL vmlinux WARNING: 451 bad relocations c0b312a9 R_PPC_UADDR32 .head.text-0x3ff9ed54 c0b312ad R_PPC_UADDR32 .head.text-0x3ffac224 c0b312b1 R_PPC_UADDR32 .head.text-0x3ffb09f4 c0b312b5 R_PPC_UADDR32 .head.text-0x3fe184dc c0b312b9 R_PPC_UADDR32 .head.text-0x3fe183a8 ... The compiler emits a bunch of R_PPC_UADDR32, which is not supported by arch/powerpc/kernel/reloc_32.S. The reason is there exists an unaligned symbol. $ powerpc-linux-gnu-nm -n vmlinux ... c0b31258 d spe_aligninfo c0b31298 d __func__.0 c0b312a9 D sys_call_table c0b319b8 d __func__.0 Commit 7b4537199a4a is not the root cause. Even before that, I can reproduce the same issue for mpc85xx_defconfig + CONFIG_RELOCATABLE=y + CONFIG_MODVERSIONS=n. It is just that nobody noticed because when CONFIG_MODVERSIONS is enabled, a __crc_* symbol inserted before sys_call_table was hiding the unalignment issue. Adding alignment to the syscall table for ppc32 fixes the issue. Cc: stable@vger.kernel.org Reported-by: Christophe Leroy Signed-off-by: Masahiro Yamada Tested-by: Christophe Leroy [mpe: Trim change log discussion, add Cc stable] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/lkml/38605f6a-a568-f884-f06f-ea4da5b214f0@csgroup.eu/ Link: https://lore.kernel.org/r/20220820165129.1147589-1-masahiroy@kernel.org commit a657182a5c5150cdfacb6640aad1d2712571a409 Author: Daniel Borkmann Date: Thu Aug 25 23:26:47 2022 +0200 bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU: 1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x9c/0xc9 print_address_description.constprop.0+0x1f/0x1f0 ? bpf_int_jit_compile+0x1257/0x13f0 kasan_report.cold+0xeb/0x197 ? kvmalloc_node+0x170/0x200 ? bpf_int_jit_compile+0x1257/0x13f0 bpf_int_jit_compile+0x1257/0x13f0 ? arch_prepare_bpf_dispatcher+0xd0/0xd0 ? rcu_read_lock_sched_held+0x43/0x70 bpf_prog_select_runtime+0x3e8/0x640 ? bpf_obj_name_cpy+0x149/0x1b0 bpf_prog_load+0x102f/0x2220 ? __bpf_prog_put.constprop.0+0x220/0x220 ? find_held_lock+0x2c/0x110 ? __might_fault+0xd6/0x180 ? lock_downgrade+0x6e0/0x6e0 ? lock_is_held_type+0xa6/0x120 ? __might_fault+0x147/0x180 __sys_bpf+0x137b/0x6070 ? bpf_perf_link_attach+0x530/0x530 ? new_sync_read+0x600/0x600 ? __fget_files+0x255/0x450 ? lock_downgrade+0x6e0/0x6e0 ? fput+0x30/0x1a0 ? ksys_write+0x1a8/0x260 __x64_sys_bpf+0x7a/0xc0 ? syscall_enter_from_user_mode+0x21/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f917c4e2c2d The problem here is that a range of tnum_range(0, map->max_entries - 1) has limited ability to represent the concrete tight range with the tnum as the set of resulting states from value + mask can result in a superset of the actual intended range, and as such a tnum_in(range, reg->var_off) check may yield true when it shouldn't, for example tnum_range(0, 2) would result in 00XX -> v = 0000, m = 0011 such that the intended set of {0, 1, 2} is here represented by a less precise superset of {0, 1, 2, 3}. As the register is known const scalar, really just use the concrete reg->var_off.value for the upper index check. Fixes: d2e4c1e6c294 ("bpf: Constant map key tracking for prog array pokes") Reported-by: Hsin-Wei Hung Signed-off-by: Daniel Borkmann Cc: Shung-Hsi Yu Acked-by: John Fastabend Link: https://lore.kernel.org/r/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit d4fefa4801a1c2f9c0c7a48fbb0fdf384e89a4ab Author: Richard Guy Briggs Date: Thu Aug 25 15:32:40 2022 -0400 audit: move audit_return_fixup before the filters The success and return_code are needed by the filters. Move audit_return_fixup() before the filters. This was causing syscall auditing events to be missed. Link: https://github.com/linux-audit/audit-kernel/issues/138 Cc: stable@vger.kernel.org Fixes: 12c5e81d3fd0 ("audit: prepare audit_context for use in calling contexts beyond syscalls") Signed-off-by: Richard Guy Briggs [PM: manual merge required] Signed-off-by: Paul Moore commit 4c612826bec1441214816827979b62f84a097e91 Merge: 3f5c20055a640 d974730c8884c Author: Linus Torvalds Date: Thu Aug 25 14:03:58 2022 -0700 Merge tag 'net-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from ipsec and netfilter (with one broken Fixes tag). Current release - new code bugs: - dsa: don't dereference NULL extack in dsa_slave_changeupper() - dpaa: fix <1G ethernet on LS1046ARDB - neigh: don't call kfree_skb() under spin_lock_irqsave() Previous releases - regressions: - r8152: fix the RX FIFO settings when suspending - dsa: microchip: keep compatibility with device tree blobs with no phy-mode - Revert "net: macsec: update SCI upon MAC address change." - Revert "xfrm: update SA curlft.use_time", comply with RFC 2367 Previous releases - always broken: - netfilter: conntrack: work around exceeded TCP receive window - ipsec: fix a null pointer dereference of dst->dev on a metadata dst in xfrm_lookup_with_ifid - moxa: get rid of asymmetry in DMA mapping/unmapping - dsa: microchip: make learning configurable and keep it off while standalone - ice: xsk: prohibit usage of non-balanced queue id - rxrpc: fix locking in rxrpc's sendmsg Misc: - another chunk of sysctl data race silencing" * tag 'net-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (87 commits) net: lantiq_xrx200: restore buffer if memory allocation failed net: lantiq_xrx200: fix lock under memory pressure net: lantiq_xrx200: confirm skb is allocated before using net: stmmac: work around sporadic tx issue on link-up ionic: VF initial random MAC address if no assigned mac ionic: fix up issues with handling EAGAIN on FW cmds ionic: clear broken state on generation change rxrpc: Fix locking in rxrpc's sendmsg net: ethernet: mtk_eth_soc: fix hw hash reporting for MTK_NETSYS_V2 MAINTAINERS: rectify file entry in BONDING DRIVER i40e: Fix incorrect address type for IPv6 flow rules ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter net: Fix a data-race around sysctl_somaxconn. net: Fix a data-race around netdev_unregister_timeout_secs. net: Fix a data-race around gro_normal_batch. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_max_skb_frags. net: Fix a data-race around netdev_budget. ... commit d974730c8884cd784810b4f2fe903ac882a5fec9 Merge: a3a57bf07de23 c9c3b1775f80f Author: Jakub Kicinski Date: Thu Aug 25 12:41:41 2022 -0700 Merge branch 'net-lantiq_xrx200-fix-errors-under-memory-pressure' Aleksander Jan Bajkowski says: ==================== net: lantiq_xrx200: fix errors under memory pressure This series fixes issues that can occur in the driver under memory pressure. Situations when the system cannot allocate memory are rare, so the mentioned bugs have been fixed recently. The patches have been tested on a BT Home router with the Lantiq xRX200 chipset. Changelog: v3: - removed netdev_err() log from the first patch v2: - the second patch has been changed, so that under memory pressure situation the driver will not receive packets indefinitely regardless of the NAPI budget, - the third patch has been added. ==================== Link: https://lore.kernel.org/r/20220824215408.4695-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit c9c3b1775f80fa21f5bff874027d2ccb10f5d90c Author: Aleksander Jan Bajkowski Date: Wed Aug 24 23:54:08 2022 +0200 net: lantiq_xrx200: restore buffer if memory allocation failed In a situation where memory allocation fails, an invalid buffer address is stored. When this descriptor is used again, the system panics in the build_skb() function when accessing memory. Fixes: 7ea6cd16f159 ("lantiq: net: fix duplicated skb in rx descriptor ring") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Jakub Kicinski commit c4b6e9341f930e4dd089231c0414758f5f1f9dbd Author: Aleksander Jan Bajkowski Date: Wed Aug 24 23:54:07 2022 +0200 net: lantiq_xrx200: fix lock under memory pressure When the xrx200_hw_receive() function returns -ENOMEM, the NAPI poll function immediately returns an error. This is incorrect for two reasons: * the function terminates without enabling interrupts or scheduling NAPI, * the error code (-ENOMEM) is returned instead of the number of received packets. After the first memory allocation failure occurs, packet reception is locked due to disabled interrupts from DMA.. Fixes: fe1a56420cf2 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Jakub Kicinski commit c8b043702dc0894c07721c5b019096cebc8c798f Author: Aleksander Jan Bajkowski Date: Wed Aug 24 23:54:06 2022 +0200 net: lantiq_xrx200: confirm skb is allocated before using xrx200_hw_receive() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. Add a check in case build_skb() failed to allocate and return NULL. Fixes: e015593573b3 ("net: lantiq_xrx200: convert to build_skb") Reported-by: Eric Dumazet Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Jakub Kicinski commit a3a57bf07de23fe1ff779e0fdf710aa581c3ff73 Author: Heiner Kallweit Date: Wed Aug 24 22:34:49 2022 +0200 net: stmmac: work around sporadic tx issue on link-up This is a follow-up to the discussion in [0]. It seems to me that at least the IP version used on Amlogic SoC's sometimes has a problem if register MAC_CTRL_REG is written whilst the chip is still processing a previous write. But that's just a guess. Adding a delay between two writes to this register helps, but we can also simply omit the offending second write. This patch uses the second approach and is based on a suggestion from Qi Duan. Benefit of this approach is that we can save few register writes, also on not affected chip versions. [0] https://www.spinics.net/lists/netdev/msg831526.html Fixes: bfab27a146ed ("stmmac: add the experimental PCI support") Suggested-by: Qi Duan Suggested-by: Jerome Brunet Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/e99857ce-bd90-5093-ca8c-8cd480b5a0a2@gmail.com Signed-off-by: Jakub Kicinski commit ef332fe14b25f1599ef4c7cb61f3b5fb2192b546 Merge: 92df825ad2e4a bcf3a15642930 Author: Jakub Kicinski Date: Thu Aug 25 12:40:29 2022 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-08-24 (ixgbe, i40e) This series contains updates to ixgbe and i40e drivers. Jake stops incorrect resetting of SYSTIME registers when starting cyclecounter for ixgbe. Sylwester corrects a check on source IP address when validating destination for i40e. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: Fix incorrect address type for IPv6 flow rules ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter ==================== Link: https://lore.kernel.org/r/20220824193748.874343-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 92df825ad2e4a94895237cc2fe5b932a89ad1d56 Merge: b0f571ecd7943 19058be7c48ce Author: Jakub Kicinski Date: Thu Aug 25 12:40:17 2022 -0700 Merge branch 'ionic-bug-fixes' Shannon Nelson says: ==================== ionic: bug fixes These are a couple of maintenance bug fixes for the Pensando ionic networking driver. Mohamed takes care of a "plays well with others" issue where the VF spec is a bit vague on VF mac addresses, but certain customers have come to expect behavior based on other vendor drivers. Shannon addresses a couple of corner cases seen in internal stress testing. ==================== Link: https://lore.kernel.org/r/20220824165051.6185-1-snelson@pensando.io Signed-off-by: Jakub Kicinski commit 19058be7c48ceb3e60fa3948e24da1059bd68ee4 Author: R Mohamed Shah Date: Wed Aug 24 09:50:51 2022 -0700 ionic: VF initial random MAC address if no assigned mac Assign a random mac address to the VF interface station address if it boots with a zero mac address in order to match similar behavior seen in other VF drivers. Handle the errors where the older firmware does not allow the VF to set its own station address. Newer firmware will allow the VF to set the station mac address if it hasn't already been set administratively through the PF. Setting it will also be allowed if the VF has trust. Fixes: fbb39807e9ae ("ionic: support sr-iov operations") Signed-off-by: R Mohamed Shah Signed-off-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 0fc4dd452d6c14828eed6369155c75c0ac15bab3 Author: Shannon Nelson Date: Wed Aug 24 09:50:50 2022 -0700 ionic: fix up issues with handling EAGAIN on FW cmds In looping on FW update tests we occasionally see the FW_ACTIVATE_STATUS command fail while it is in its EAGAIN loop waiting for the FW activate step to finsh inside the FW. The firmware is complaining that the done bit is set when a new dev_cmd is going to be processed. Doing a clean on the cmd registers and doorbell before exiting the wait-for-done and cleaning the done bit before the sleep prevents this from occurring. Fixes: fbfb8031533c ("ionic: Add hardware init and device commands") Signed-off-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 9cb9dadb8f45c67e4310e002c2f221b70312b293 Author: Shannon Nelson Date: Wed Aug 24 09:50:49 2022 -0700 ionic: clear broken state on generation change There is a case found in heavy testing where a link flap happens just before a firmware Recovery event and the driver gets stuck in the BROKEN state. This comes from the driver getting interrupted by a FW generation change when coming back up from the link flap, and the call to ionic_start_queues() in ionic_link_status_check() fails. This can be addressed by having the fw_up code clear the BROKEN bit if seen, rather than waiting for a user to manually force the interface down and then back up. Fixes: 9e8eaf8427b6 ("ionic: stop watchdog when in broken state") Signed-off-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit b0f571ecd7943423c25947439045f0d352ca3dbf Author: David Howells Date: Wed Aug 24 17:35:45 2022 +0100 rxrpc: Fix locking in rxrpc's sendmsg Fix three bugs in the rxrpc's sendmsg implementation: (1) rxrpc_new_client_call() should release the socket lock when returning an error from rxrpc_get_call_slot(). (2) rxrpc_wait_for_tx_window_intr() will return without the call mutex held in the event that we're interrupted by a signal whilst waiting for tx space on the socket or relocking the call mutex afterwards. Fix this by: (a) moving the unlock/lock of the call mutex up to rxrpc_send_data() such that the lock is not held around all of rxrpc_wait_for_tx_window*() and (b) indicating to higher callers whether we're return with the lock dropped. Note that this means recvmsg() will not block on this call whilst we're waiting. (3) After dropping and regaining the call mutex, rxrpc_send_data() needs to go and recheck the state of the tx_pending buffer and the tx_total_len check in case we raced with another sendmsg() on the same call. Thinking on this some more, it might make sense to have different locks for sendmsg() and recvmsg(). There's probably no need to make recvmsg() wait for sendmsg(). It does mean that recvmsg() can return MSG_EOR indicating that a call is dead before a sendmsg() to that call returns - but that can currently happen anyway. Without fix (2), something like the following can be induced: WARNING: bad unlock balance detected! 5.16.0-rc6-syzkaller #0 Not tainted ------------------------------------- syz-executor011/3597 is trying to release lock (&call->user_mutex) at: [] rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748 but there are no more locks to release! other info that might help us debug this: no locks held by syz-executor011/3597. ... Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_unlock_imbalance_bug include/trace/events/lock.h:58 [inline] __lock_release kernel/locking/lockdep.c:5306 [inline] lock_release.cold+0x49/0x4e kernel/locking/lockdep.c:5657 __mutex_unlock_slowpath+0x99/0x5e0 kernel/locking/mutex.c:900 rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748 rxrpc_sendmsg+0x420/0x630 net/rxrpc/af_rxrpc.c:561 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae [Thanks to Hawkins Jiawei and Khalid Masum for their attempts to fix this] Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") Reported-by: syzbot+7f0483225d0c94cb3441@syzkaller.appspotmail.com Signed-off-by: David Howells Reviewed-by: Marc Dionne Tested-by: syzbot+7f0483225d0c94cb3441@syzkaller.appspotmail.com cc: Hawkins Jiawei cc: Khalid Masum cc: Dan Carpenter cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/166135894583.600315.7170979436768124075.stgit@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit cb15c7348737c6956652832832d0407f69b2aff3 Merge: 0947ae1121083 1800b2ac96d8b Author: Alexei Starovoitov Date: Thu Aug 25 12:07:46 2022 -0700 Merge branch 'Fix incorrect pruning for ARG_CONST_ALLOC_SIZE_OR_ZERO' Kumar Kartikeya Dwivedi says: ==================== A fix for a missing mark_chain_precision call that leads to eager pruning and loading of invalid programs when the more permissive case is in the straight line exploration. Please see the commit log for details, and selftest for an example. ==================== Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 1800b2ac96d8bc4ccdddc2ea9e83ecaffd54d3f2 Author: Kumar Kartikeya Dwivedi Date: Tue Aug 23 20:55:00 2022 +0200 selftests/bpf: Add regression test for pruning fix Add a test to ensure we do mark_chain_precision for the argument type ARG_CONST_ALLOC_SIZE_OR_ZERO. For other argument types, this was already done, but propagation for missing for this case. Without the fix, this test case loads successfully. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20220823185500.467-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 2fc31465c5373b5ca4edf2e5238558cb62902311 Author: Kumar Kartikeya Dwivedi Date: Tue Aug 23 20:52:59 2022 +0200 bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO Precision markers need to be propagated whenever we have an ARG_CONST_* style argument, as the verifier cannot consider imprecise scalars to be equivalent for the purposes of states_equal check when such arguments refine the return value (in this case, set mem_size for PTR_TO_MEM). The resultant mem_size for the R0 is derived from the constant value, and if the verifier incorrectly prunes states considering them equivalent where such arguments exist (by seeing that both registers have reg->precise as false in regsafe), we can end up with invalid programs passing the verifier which can do access beyond what should have been the correct mem_size in that explored state. To show a concrete example of the problem: 0000000000000000 : 0: r2 = *(u32 *)(r1 + 80) 1: r1 = *(u32 *)(r1 + 76) 2: r3 = r1 3: r3 += 4 4: if r3 > r2 goto +18 5: w2 = 0 6: *(u32 *)(r1 + 0) = r2 7: r1 = *(u32 *)(r1 + 0) 8: r2 = 1 9: if w1 == 0 goto +1 10: r2 = -1 0000000000000058 : 11: r1 = 0 ll 13: r3 = 0 14: call bpf_ringbuf_reserve 15: if r0 == 0 goto +7 16: r1 = r0 17: r1 += 16777215 18: w2 = 0 19: *(u8 *)(r1 + 0) = r2 20: r1 = r0 21: r2 = 0 22: call bpf_ringbuf_submit 00000000000000b8 : 23: w0 = 0 24: exit For the first case, the single line execution's exploration will prune the search at insn 14 for the branch insn 9's second leg as it will be verified first using r2 = -1 (UINT_MAX), while as w1 at insn 9 will always be 0 so at runtime we don't get error for being greater than UINT_MAX/4 from bpf_ringbuf_reserve. The verifier during regsafe just sees reg->precise as false for both r2 registers in both states, hence considers them equal for purposes of states_equal. If we propagated precise markers using the backtracking support, we would use the precise marking to then ensure that old r2 (UINT_MAX) was within the new r2 (1) and this would never be true, so the verification would rightfully fail. The end result is that the out of bounds access at instruction 19 would be permitted without this fix. Note that reg->precise is always set to true when user does not have CAP_BPF (or when subprog count is greater than 1 (i.e. use of any static or global functions)), hence this is only a problem when precision marks need to be explicitly propagated (i.e. privileged users with CAP_BPF). A simplified test case has been included in the next patch to prevent future regressions. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20220823185300.406-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 40bfe7a86d84cf08ac6a8fe2f0c8bf7a43edd110 Author: Thierry Reding Date: Wed Aug 24 17:32:56 2022 +0200 of/device: Fix up of_dma_configure_id() stub Since the stub version of of_dma_configure_id() was added in commit a081bd4af4ce ("of/device: Add input id to of_dma_configure()"), it has not matched the signature of the full function, leading to build failure reports when code using this function is built on !OF configurations. Fixes: a081bd4af4ce ("of/device: Add input id to of_dma_configure()") Cc: stable@vger.kernel.org Signed-off-by: Thierry Reding Reviewed-by: Frank Rowand Acked-by: Lorenzo Pieralisi Link: https://lore.kernel.org/r/20220824153256.1437483-1-thierry.reding@gmail.com Signed-off-by: Rob Herring commit 465d0eb0dc31ae26c05504668d3957db91e99799 Author: Kairui Song Date: Tue Aug 23 19:40:53 2022 +0800 Docs/admin-guide/mm/damon/usage: fix the example code snip The workflow example code is not working since it got the file names wrong. So fix this. Fixes: b18402726bd1 ("Docs/admin-guide/mm/damon/usage: document DAMON sysfs interface") Reviewed-by: SeongJae Park Signed-off-by: Kairui Song Link: https://lore.kernel.org/r/20220823114053.53305-1-ryncsn@gmail.com Signed-off-by: Jonathan Corbet commit 602684adb42a04858e23248b22d4931b7ef2ad7e Author: Lukas Bulwahn Date: Wed Aug 24 10:08:36 2022 +0200 docs: Update version number from 5.x to 6.x in README.rst A quick 'grep "5\.x" . -R' on Documentation shows that README.rst, 2.Process.rst and applying-patches.rst all mention the version number "5.x" for kernel releases. As the next release will be version 6.0, updating the version number to 6.x in README.rst seems reasonable. The description in 2.Process.rst is just a description of recent kernel releases, it was last updated in the beginning of 2020, and can be revisited at any time on a regular basis, independent of changing the version number from 5 to 6. So, there is no need to update this document now when transitioning from 5.x to 6.x numbering. The document applying-patches.rst is probably obsolete for most users anyway, a reader will sufficiently well understand the steps, even it mentions version 5 rather than version 6. So, do not update that to a version 6.x numbering scheme. Update version number from 5.x to 6.x in README.rst only. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220824080836.23087-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet commit b8983d42524f10ac6bf35bbce6a7cc8e45f61e04 Author: Qu Huang Date: Tue Aug 23 14:44:06 2022 +0800 drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly The mmVM_L2_CNTL3 register is not assigned an initial value Signed-off-by: Qu Huang Signed-off-by: Alex Deucher commit 61251b2cffea8c1811bbd2dbef175b65f64aaa86 Author: Likun Gao Date: Tue Aug 23 15:34:10 2022 +0800 drm/amdgpu: add MGCG perfmon setting for gfx11 Enable GFX11 MGCG perfmon setting. V2: set rlc to saft mode before setting. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ee8086dbc1585d9f4020a19447388246a5cff5c8 Author: Prike Liang Date: Wed Aug 24 11:16:51 2022 +0800 drm/amdkfd: Fix isa version for the GC 10.3.7 Correct the isa version for handling KFD test. Fixes: 7c4f4f197e0c ("drm/amdkfd: Add GC 10.3.6 and 10.3.7 KFD definitions") Signed-off-by: Prike Liang Reviewed-by: Aaron Liu Signed-off-by: Alex Deucher commit 894c9c540f8315007a4752320e2399bc2e0c46b7 Author: Mukul Joshi Date: Fri Aug 19 17:15:08 2022 -0400 drm/amdgpu: Fix page table setup on Arcturus When translate_further is enabled, page table depth needs to be updated. This was missing on Arcturus MMHUB init. This was causing address translations to fail for SDMA user-mode queues. Fixes: 352e683b72e7 ("drm/amdgpu: Enable translate_further to extend UTCL2 reach") Reviewed-by: Felix Kuehling Acked-by: Christian König Signed-off-by: Mukul Joshi Signed-off-by: Alex Deucher commit da1acbb12b33cbc651d8a7e956d254f1acc5034f Author: Evan Quan Date: Mon Aug 8 10:41:26 2022 +0800 drm/amd/pm: update SMU 13.0.0 driver_if header To fit the latest 78.53 PMFW. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 00047c3d967d7ef8adf8bac3c3579294a3bc0bb1 Author: Tim Huang Date: Mon Aug 22 13:30:44 2022 +0800 drm/amdgpu: add sdma instance check for gfx11 CGCG For some ASICs, like GFX IP v11.0.1, only have one SDMA instance, so not need to configure SDMA1_RLC_CGCG_CTRL for this case. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 4e3464badbeebb3528c457aefe91413f8a9070b6 Author: Roman Li Date: Mon Aug 22 12:37:10 2022 -0400 drm/amd/display: enable PCON support for dcn314 [Why] DCN314 supports PCON. [How] Explicitly enable it in dcn314 resources. Signed-off-by: Roman Li Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 16c01544e30a4b4cf5f3eaacf7a4c19a3622b597 Author: Tim Huang Date: Mon Aug 15 13:50:46 2022 +0800 drm/amdgpu: enable NBIO IP v7.7.0 Clock Gating Enable AMD_CG_SUPPORT_BIF_MGCG and AMD_CG_SUPPORT_BIF_LS support. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 2037769f995e45d3a368fb74983954b3ed8da178 Author: Tim Huang Date: Mon Aug 15 13:12:21 2022 +0800 drm/amdgpu: add NBIO IP v7.7.0 Clock Gating support Add BIF Clock Gating MGCG and LS support for NBIO IP v7.7.0. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit ad3b0b99113783f697579c7b09285916019865ea Author: Tim Huang Date: Mon Aug 15 13:03:49 2022 +0800 drm/amdgpu: add TX_POWER_CTRL_1 macro definitions for NBIO IP v7.7.0 Add the BIF0_PCIE_TX_POWER_CTRL_1 register offset and mask macro definitions for AMD_CG_SUPPORT_BIF_LS. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 3f5c20055a640b3758ece75dcaa6ac974fcae26d Merge: a86766c49e808 43626dade36fa Author: Linus Torvalds Date: Thu Aug 25 10:52:16 2022 -0700 Merge tag 'cgroup-for-6.0-rc2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull another cgroup fix from Tejun Heo: "Commit 4f7e7236435c ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") required the cgroup core to grab cpus_read_lock() before invoking ->attach(). Unfortunately, it missed adding cpus_read_lock() in cgroup_attach_task_all(). Fix it" * tag 'cgroup-for-6.0-rc2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() commit 43626dade36fa74d3329046f4ae2d7fdefe401c6 Author: Tetsuo Handa Date: Thu Aug 25 17:38:38 2022 +0900 cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does. Link: https://syzkaller.appspot.com/bug?extid=29d3a3b4d86c8136ad9e [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Fixes: 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") Signed-off-by: Tejun Heo commit 8531aa1659f7278d4f2ec7408cc000eaa8d85217 Author: Mathias Nyman Date: Thu Aug 25 18:08:40 2022 +0300 Revert "xhci: turn off port power in shutdown" This reverts commit 83810f84ecf11dfc5a9414a8b762c3501b328185. Turning off port power in shutdown did cause issues such as a laptop not proprly powering off, and some specific usb devies failing to enumerate the subsequent boot after a warm reset. So revert this. Fixes: 83810f84ecf1 ("xhci: turn off port power in shutdown") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 33e321586e37b642ad10594b9ef25a613555cd08 Author: Mathias Nyman Date: Thu Aug 25 18:08:39 2022 +0300 xhci: Add grace period after xHC start to prevent premature runtime suspend. After xHC controller is started, either in probe or resume, it can take a while before any of the connected usb devices are visible to the roothub due to link training. It's possible xhci driver loads, sees no acivity and suspends the host before the USB device is visible. In one testcase with a hotplugged xHC controller the host finally detected the connected USB device and generated a wake 500ms after host initial start. If hosts didn't suspend the device duringe training it probablty wouldn't take up to 500ms to detect it, but looking at specs reveal USB3 link training has a couple long timeout values, such as 120ms RxDetectQuietTimeout, and 360ms PollingLFPSTimeout. So Add a 500ms grace period that keeps polling the roothub for 500ms after start, preventing runtime suspend until USB devices are detected. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4a593a62a9e3a25ab4bc37f612e4edec144f7f43 Author: Mathias Nyman Date: Thu Aug 25 18:08:38 2022 +0300 xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exists (one roothub) This causes a null pointer dereference in reboot for those controllers. Check that the shared_hcd exists before trying to remove it. Fixes: e0fe986972f5 ("usb: host: xhci-plat: prepare operation w/o shared hcd") Reported-by: Alexey Sheplyakov Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit eeda05b5e92f51d9a09646ecb493f0a1e872a6ef Author: AngeloGioacchino Del Regno Date: Thu Jul 21 19:27:27 2022 +0200 drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks Add callbacks for atomic_destroy_state, atomic_duplicate_state and atomic_reset to restore functionality of the DSI driver: this solves vblank timeouts when another bridge is present in the chain. Tested bridge chain: DSI <=> ANX7625 => aux-bus panel Fixes: 7f6335c6a258 ("drm/mediatek: Modify dsi funcs to atomic operations") Signed-off-by: AngeloGioacchino Del Regno Tested-by: Chen-Yu Tsai Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220721172727.14624-1-angelogioacchino.delregno@collabora.com/ Signed-off-by: Chun-Kuang Hu commit c5deb27895e017a0267de0a20d140ad5fcc55a54 Author: Juergen Gross Date: Thu Aug 25 16:19:18 2022 +0200 xen/privcmd: fix error exit of privcmd_ioctl_dm_op() The error exit of privcmd_ioctl_dm_op() is calling unlock_pages() potentially with pages being NULL, leading to a NULL dereference. Additionally lock_pages() doesn't check for pin_user_pages_fast() having been completely successful, resulting in potentially not locking all pages into memory. This could result in sporadic failures when using the related memory in user mode. Fix all of that by calling unlock_pages() always with the real number of pinned pages, which will be zero in case pages being NULL, and by checking the number of pages pinned by pin_user_pages_fast() matching the expected number of pages. Cc: Fixes: ab520be8cd5d ("xen/privcmd: Add IOCTL_PRIVCMD_DM_OP") Reported-by: Rustam Subkhankulov Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/20220825141918.3581-1-jgross@suse.com Signed-off-by: Juergen Gross commit 00da0cb385d05a89226e150a102eb49d8abb0359 Author: Salvatore Bonaccorso Date: Mon Aug 1 11:15:30 2022 +0200 Documentation/ABI: Mention retbleed vulnerability info file for sysfs While reporting for the AMD retbleed vulnerability was added in 6b80b59b3555 ("x86/bugs: Report AMD retbleed vulnerability") the new sysfs file was not mentioned so far in the ABI documentation for sysfs-devices-system-cpu. Fix that. Fixes: 6b80b59b3555 ("x86/bugs: Report AMD retbleed vulnerability") Signed-off-by: Salvatore Bonaccorso Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220801091529.325327-1-carnil@debian.org commit c93c296fff6b369a7115916145047c8a3db6e27f Author: Borislav Petkov Date: Wed Aug 24 17:13:26 2022 +0200 x86/sev: Mark snp_abort() noreturn Mark both the function prototype and definition as noreturn in order to prevent the compiler from doing transformations which confuse objtool like so: vmlinux.o: warning: objtool: sme_enable+0x71: unreachable instruction This triggers with gcc-12. Add it and sev_es_terminate() to the objtool noreturn tracking array too. Sort it while at it. Suggested-by: Michael Matz Signed-off-by: Borislav Petkov Acked-by: Peter Zijlstra Link: https://lore.kernel.org/r/20220824152420.20547-1-bp@alien8.de commit 581711c46612c1fd7f98960f9ad53f04fdb89853 Author: Pavel Begunkov Date: Wed Aug 24 13:07:43 2022 +0100 io_uring/net: save address for sendzc async execution We usually copy all bits that a request needs from the userspace for async execution, so the userspace can keep them on the stack. However, send zerocopy violates this pattern for addresses and may reloads it e.g. from io-wq. Save the address if any in ->async_data as usual. Reported-by: Stefan Metzmacher Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d7512d7aa9abcd36e9afe1a4d292a24cb2d157e5.1661342812.git.asml.silence@gmail.com [axboe: fold in incremental fix] Signed-off-by: Jens Axboe commit b1cd3fd42db7593a2d24c06f1c53b8c886592080 Author: Shengjiu Wang Date: Thu Aug 25 20:27:40 2022 +0800 ASoC: fsl_aud2htx: Add error handler for pm_runtime_enable Call pm_runtime_disable() when error happens in probe() Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1661430460-5234-2-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit ea532c29972df96fda20393d9bf057e898f5e965 Author: Shengjiu Wang Date: Thu Aug 25 20:27:39 2022 +0800 ASoC: fsl_aud2htx: register platform component before registering cpu dai There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime() snd_soc_register_card() -> snd_soc_bind_card() -> snd_soc_add_pcm_runtime() -> adding cpu dai -> adding codec dai -> adding platform component. So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used. As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue. And the behavior of imx_pcm_dma_init() is same as common devm_snd_dmaengine_pcm_register(), so use devm_snd_dmaengine_pcm_register() instead Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1661430460-5234-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 1ff89e06c2e5fab30274e4b02360d4241d6e605e Author: Daniel J. Ogorchock Date: Wed Jul 13 16:20:59 2022 -0400 HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendo_hid_remove is called, in which the rumble_queue is destroyed. Avoid using that queue to defer rumble work once the controller state is set to JOYCON_CTLR_STATE_REMOVED. This eliminates the null pointer dereference. Signed-off-by: Daniel J. Ogorchock Signed-off-by: Jiri Kosina commit 41ac42f137080bc230b5882e3c88c392ab7f2d32 Author: Gerald Schaefer Date: Wed Aug 17 15:26:03 2022 +0200 s390/mm: do not trigger write fault when vma does not allow VM_WRITE For non-protection pXd_none() page faults in do_dat_exception(), we call do_exception() with access == (VM_READ | VM_WRITE | VM_EXEC). In do_exception(), vma->vm_flags is checked against that before calling handle_mm_fault(). Since commit 92f842eac7ee3 ("[S390] store indication fault optimization"), we call handle_mm_fault() with FAULT_FLAG_WRITE, when recognizing that it was a write access. However, the vma flags check is still only checking against (VM_READ | VM_WRITE | VM_EXEC), and therefore also calling handle_mm_fault() with FAULT_FLAG_WRITE in cases where the vma does not allow VM_WRITE. Fix this by changing access check in do_exception() to VM_WRITE only, when recognizing write access. Link: https://lkml.kernel.org/r/20220811103435.188481-3-david@redhat.com Fixes: 92f842eac7ee3 ("[S390] store indication fault optimization") Cc: Reported-by: David Hildenbrand Reviewed-by: Heiko Carstens Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik commit 13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9 Author: Brian Foster Date: Tue Aug 16 11:54:07 2022 -0400 s390: fix double free of GS and RI CBs on fork() failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the thread_struct of the associated task. These pointers are initially copied on fork() via arch_dup_task_struct() and then cleared via copy_thread() before fork() returns. If fork() happens to fail after the initial task dup and before copy_thread(), the newly allocated task and associated thread_struct memory are freed via free_task() -> arch_release_task_struct(). This results in a double free of the guarded storage and runtime info structs because the fields in the failed task still refer to memory associated with the source task. This problem can manifest as a BUG_ON() in set_freepointer() (with CONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled) when running trinity syscall fuzz tests on s390x. To avoid this problem, clear the associated pointer fields in arch_dup_task_struct() immediately after the new task is copied. Note that the RI flag is still cleared in copy_thread() because it resides in thread stack memory and that is where stack info is copied. Signed-off-by: Brian Foster Fixes: 8d9047f8b967c ("s390/runtime instrumentation: simplify task exit handling") Fixes: 7b83c6297d2fc ("s390/guarded storage: simplify task exit handling") Cc: # 4.15 Reviewed-by: Gerald Schaefer Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/r/20220816155407.537372-1-bfoster@redhat.com Signed-off-by: Vasily Gorbik commit 467249a7dff68451868ca79696aef69764193a8a Author: Even Xu Date: Tue Aug 23 09:10:59 2022 +0800 HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID Add device ID of Meteor Lake P into ishtp support list. Signed-off-by: Even Xu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit b871656aa4f54e04207f62bdd0d7572be1d86b36 Author: João H. Spies Date: Mon Aug 8 02:51:20 2022 +0000 pinctrl: rockchip: Enhance support for IRQ_TYPE_EDGE_BOTH Switching between falling/rising edges for IRQ_TYPE_EDGE_BOTH on pins that require debounce can cause the device to lose events due to a desync between pin state and irq type. This problem is resolved by switching between IRQ_TYPE_LEVEL_LOW and IRQ_TYPE_LEVEL_HIGH instead. Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Signed-off-by: João H. Spies Link: https://lore.kernel.org/r/20220808025121.110223-1-jhlspies@gmail.com Signed-off-by: Linus Walleij commit 6bb79f5b4c84a09cd6bed46ef3e46ef4fc21407d Author: Wolfram Sang Date: Thu Aug 18 23:01:22 2022 +0200 xen: move from strlcpy with unused retval to strscpy Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/20220818210122.7613-1-wsa+renesas@sang-engineering.com Signed-off-by: Juergen Gross commit ab0af755d40f2ea4ef01503e7bebf083f65c9062 Author: Lukas Bulwahn Date: Wed Aug 17 06:43:33 2022 +0200 xen: x86: remove setting the obsolete config XEN_MAX_DOMAIN_MEMORY Commit c70727a5bc18 ("xen: allow more than 512 GB of RAM for 64 bit pv-domains") from July 2015 replaces the config XEN_MAX_DOMAIN_MEMORY with a new config XEN_512GB, but misses to adjust arch/x86/configs/xen.config. As XEN_512GB defaults to yes, there is no need to explicitly set any config in xen.config. Just remove setting the obsolete config XEN_MAX_DOMAIN_MEMORY. Signed-off-by: Lukas Bulwahn Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220817044333.22310-1-lukas.bulwahn@gmail.com Signed-off-by: Juergen Gross commit b83699ea1e62951857c2d8648bd93a4744899eb7 Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: mm: Avoid unnecessary page fault retires on shared memory types Commit d92725256b4f22d0 ("mm: avoid unnecessary page fault retires on shared memory types") modifies do_page_fault() to handle the VM_FAULT_ COMPLETED case, but forget to change for LoongArch, so fix it as other architectures does. Fixes: d92725256b4f22d0 ("mm: avoid unnecessary page fault retires on shared memory types") Reviewed-by: Guo Ren Signed-off-by: Huacai Chen commit 720dc7ab252bbdf404cab7b909e26b31e602bf7e Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: Add subword xchg/cmpxchg emulation LoongArch only support 32-bit/64-bit xchg/cmpxchg in native. But percpu operation, qspinlock and some drivers need 8-bit/16-bit xchg/cmpxchg. We add subword xchg/cmpxchg emulation in this patch because the emulation has better performance than the generic implementation (on NUMA system), and it can fix some build errors meanwhile [1]. LoongArch's guarantee for forward progress (avoid many ll/sc happening at the same time and no one succeeds): We have the "exclusive access (with timeout) of ll" feature to avoid simultaneous ll (which also blocks other memory load/store on the same address), and the "random delay of sc" feature to avoid simultaneous sc. It is a mandatory requirement for multi-core LoongArch processors to implement such features, only except those single-core and dual-core processors (they also don't support multi-chip interconnection). Feature bits are introduced in CPUCFG3, bit 3 and bit 4 [2]. [1] https://lore.kernel.org/loongarch/CAAhV-H6vvkuOzy8OemWdYK3taj5Jn3bFX0ZTwE=twM8ywpBUYA@mail.gmail.com/T/#t [2] https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#_cpucfg Reported-by: Sudip Mukherjee (Codethink) Suggested-by: Linus Torvalds Signed-off-by: Rui Wang Signed-off-by: Huacai Chen commit 092e9ebe52a664f9f58e2d24136ae791fe71c6db Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: Cleanup headers to avoid circular dependency When enable GENERIC_IOREMAP, there will be circular dependency to cause build errors. The root cause is that pgtable.h shouldn't include io.h but pgtable.h need some macros defined in io.h. So cleanup those macros and remove the unnecessary inclusions, as other architectures do. Signed-off-by: Huacai Chen commit da48b67cfb6b4f115ae652dd5995c56fe2a2cf9b Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: Cleanup reset routines with new API Cleanup reset routines by using new do_kernel_power_off() instead of old pm_power_off(), and then simplify the whole file (reset.c) organization by inlining some functions. This cleanup also fix a poweroff error if EFI runtime is disabled. Signed-off-by: Huacai Chen commit 84e762060147582912581fd99cb25f3559ec8c22 Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: Fix build warnings in VDSO Fix build warnings in VDSO as below: arch/loongarch/vdso/vgettimeofday.c:9:5: warning: no previous prototype for '__vdso_clock_gettime' [-Wmissing-prototypes] 9 | int __vdso_clock_gettime(clockid_t clock, | ^~~~~~~~~~~~~~~~~~~~ arch/loongarch/vdso/vgettimeofday.c:15:5: warning: no previous prototype for '__vdso_gettimeofday' [-Wmissing-prototypes] 15 | int __vdso_gettimeofday(struct __kernel_old_timeval *tv, | ^~~~~~~~~~~~~~~~~~~ arch/loongarch/vdso/vgettimeofday.c:21:5: warning: no previous prototype for '__vdso_clock_getres' [-Wmissing-prototypes] 21 | int __vdso_clock_getres(clockid_t clock_id, | ^~~~~~~~~~~~~~~~~~~ arch/loongarch/vdso/vgetcpu.c:27:5: warning: no previous prototype for '__vdso_getcpu' [-Wmissing-prototypes] 27 | int __vdso_getcpu(unsigned int *cpu, unsigned int *node, struct getcpu_cache *unused) Reported-by: kernel test robot Signed-off-by: Huacai Chen commit 7c12bb8f59d36507bf70c35dae083dfe9cafc815 Author: Huacai Chen Date: Thu Aug 25 19:34:59 2022 +0800 LoongArch: Select PCI_QUIRKS to avoid build error PCI_LOONGSON is a mandatory for LoongArch and it is selected in Kconfig unconditionally, but its dependency PCI_QUIRKS is missing and may cause a build error when "make randconfig": arch/loongarch/pci/acpi.c: In function 'pci_acpi_setup_ecam_mapping': >> arch/loongarch/pci/acpi.c:103:29: error: 'loongson_pci_ecam_ops' undeclared (first use in this function) 103 | ecam_ops = &loongson_pci_ecam_ops; | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/pci/acpi.c:103:29: note: each undeclared identifier is reported only once for each function it appears in Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PCI_LOONGSON Depends on [n]: PCI [=y] && (MACH_LOONGSON64 [=y] || COMPILE_TEST [=y]) && (OF [=y] || ACPI [=y]) && PCI_QUIRKS [=n] Selected by [y]: - LOONGARCH [=y] Fix it by selecting PCI_QUIRKS unconditionally, too. Reported-by: kernel test robot Tested-by: Randy Dunlap Signed-off-by: Huacai Chen commit 78e1e867f44e6bdc72c0e6a2609a3407642fb30b Author: Xiaolei Wang Date: Thu Aug 25 19:19:22 2022 +0800 regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() The pfuze_chip::regulator_descs is an array of size PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators is the pointer to the real regulators of a specific device. The number of real regulator is supposed to be less than the PFUZE100_MAX_REGULATOR, so we should use the size of 'regulator_num * sizeof(struct pfuze_regulator)' in memcpy(). This fixes the out of bounds access bug reported by KASAN. Signed-off-by: Xiaolei Wang Link: https://lore.kernel.org/r/20220825111922.1368055-1-xiaolei.wang@windriver.com Signed-off-by: Mark Brown commit bd9594ae4c55351f134620ab890259820abf4c43 Author: Sakari Ailus Date: Thu Aug 25 14:17:15 2022 +0300 ACPI: property: Remove default association from integer maximum values Remove the default association from integer maximum value checks. It is not necessary and has caused a bug in other associations being unnoticed. Fixes: 923044133367 ("ACPI: property: Unify integer value reading functions") Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 2ea3b19792dbe32287b0c48f3ff7e866f61967c7 Author: Sakari Ailus Date: Wed Aug 24 14:59:56 2022 +0300 ACPI: property: Ignore already existing data node tags ACPI node pointers are attached to data node handles, in order to resolve string references to them. _DSD guide allows the same node to be reached from multiple parent nodes, leading the node enumeration algorithm to each such nodes more than once. As attached data already already exists, attaching data with the same tag will fail. Address this problem by ignoring nodes that have been already tagged. Fixes: 1d52f10917a7 ("ACPI: property: Tie data nodes to acpi handles") Reported-by: Pierre-Louis Bossart Signed-off-by: Sakari Ailus Tested-by: Pierre-Louis Bossart Signed-off-by: Rafael J. Wysocki commit 06865077b34c792181e3c4f82417a2888c6e7453 Author: Stefan Binding Date: Fri Aug 12 14:06:45 2022 +0100 ACPI: property: Fix type detection of unified integer reading functions The current code expects the type of the value to be an integer type, instead the value passed to the macro is a pointer. Ensure the size comparison uses the correct pointer type to choose the max value, instead of using the integer type. Fixes: 923044133367 ("ACPI: property: Unify integer value reading functions") Signed-off-by: Stefan Binding Reviewed-by: Sakari Ailus Tested-by: Sakari Ailus Tested-by: John Garry Acked-by: Ard Biesheuvel Signed-off-by: Rafael J. Wysocki commit 0cf731f9ebb5bf6f252055bebf4463a5c0bd490b Author: Lorenzo Bianconi Date: Tue Aug 23 14:24:07 2022 +0200 net: ethernet: mtk_eth_soc: fix hw hash reporting for MTK_NETSYS_V2 Properly report hw rx hash for mt7986 chipset accroding to the new dma descriptor layout. Fixes: 197c9e9b17b11 ("net: ethernet: mtk_eth_soc: introduce support for mt7986 chipset") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/091394ea4e705fbb35f828011d98d0ba33808f69.1661257293.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni commit a3f7c10a269d5b77dd5822ade822643ced3057f0 Author: Christian König Date: Wed Aug 10 19:26:17 2022 +0200 dma-buf/dma-resv: check if the new fence is really later Previously when we added a fence to a dma_resv object we always assumed the the newer than all the existing fences. With Jason's work to add an UAPI to explicit export/import that's not necessary the case any more. So without this check we would allow userspace to force the kernel into an use after free error. Since the change is very small and defensive it's probably a good idea to backport this to stable kernels as well just in case others are using the dma_resv object in the same way. Signed-off-by: Christian König Reviewed-by: Jason Ekstrand Link: https://patchwork.freedesktop.org/patch/msgid/20220810172617.140047-1-christian.koenig@amd.com Cc: stable@vger.kernel.org # v5.19+ commit 8db8be9cfc89935c97d791c7e6264e710a7e8a56 Author: Benjamin Tissoires Date: Mon Aug 22 08:22:47 2022 +0200 HID: input: fix uclogic tablets commit 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT") made the assumption that it was the only one handling tablets and thus kept an internal state regarding the tool. Turns out that the uclogic driver has a timer to release the in range bit, effectively making hid-input ignoring all in range information after the very first one. Fix that by having a more rationale approach which consists in forwarding every event and let the input stack filter out the duplicates. Reported-by: Stefan Hansson Fixes: 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT") Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 750ec977288d96e9a11424e3507ede097af732c4 Author: Aditya Garg Date: Sun Aug 21 08:04:45 2022 +0000 HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list The touchbar on Apple T2 Macs has 2 modes, one that shows the function keys and other that shows the media controls. The user can use the fn key on his keyboard to switch between the 2 modes. On Linux, if people were using an external keyboard or mouse, the touchbar failed to change modes on pressing the fn key with the following in dmesg :- [ 10.661445] apple-ib-als 0003:05AC:8262.0001: : USB HID v1.01 Device [Apple Inc. Ambient Light Sensor] on usb-bce-vhci-3/input0 [ 11.830992] apple-ib-touchbar 0003:05AC:8302.0007: input: USB HID v1.01 Keyboard [Apple Inc. Touch Bar Display] on usb-bce-vhci-6/input0 [ 12.139407] apple-ib-touchbar 0003:05AC:8102.0008: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input0 [ 12.211824] apple-ib-touchbar 0003:05AC:8102.0009: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input1 [ 14.219759] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 24.395670] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 34.635791] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110) [ 269.579233] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 1 (-110) Add the USB IDs of the touchbar found in T2 Macs to HID have special driver list to fix the issue. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 3a47fa7b14c7d9613909a844aba27f99d3c58634 Author: Steev Klimaszewski Date: Thu Aug 18 21:39:24 2022 -0500 HID: add Lenovo Yoga C630 battery quirk Similar to the Surface Go devices, the Elantech touchscreen/digitizer in the Lenovo Yoga C630 mistakenly reports the battery of the stylus, and always reports an empty battery. Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore this battery and prevent the erroneous low battery warnings. Signed-off-by: Steev Klimaszewski Signed-off-by: Jiri Kosina commit adada3f4930ac084740ea340bd8e94028eba4f22 Author: Akihiko Odaki Date: Tue Aug 16 19:21:20 2022 +0900 HID: AMD_SFH: Add a DMI quirk entry for Chromebooks Google Chromebooks use Chrome OS Embedded Controller Sensor Hub instead of Sensor Hub Fusion and leaves MP2 uninitialized, which disables all functionalities, even including the registers necessary for feature detections. The behavior was observed with Lenovo ThinkPad C13 Yoga. Signed-off-by: Akihiko Odaki Suggested-by: Mario Limonciello Acked-by: Basavaraj Natikar Signed-off-by: Jiri Kosina commit eccd7439709810127563e7e3e49b8b44c7b2791d Author: Jens Wiklander Date: Mon Aug 22 07:43:35 2022 +0200 tee: fix compiler warning in tee_shm_register() Include to avoid the warning: drivers/tee/tee_shm.c: In function 'tee_shm_register': >> drivers/tee/tee_shm.c:242:14: error: implicit declaration of function 'access_ok' [-Werror=implicit-function-declaration] 242 | if (!access_ok((void __user *)addr, length)) | ^~~~~~~~~ cc1: some warnings being treated as errors Fixes: 573ae4f13f63 ("tee: add overflow check in register_shm_helper()") Reviewed-by: Sumit Garg Reported-by: kernel test robot Signed-off-by: Jens Wiklander commit d9a17651f3749e69890db57ca66e677dfee70829 Author: Michael Hübner Date: Fri Aug 5 10:05:23 2022 +0200 HID: thrustmaster: Add sparco wheel and fix array length Add device id for the Sparco R383 Mod wheel. Fix wheel info array length to match actual wheel count present in the array. Signed-off-by: Michael Hübner Signed-off-by: Jiri Kosina commit e1fa076706209cc447d7a2abd0843a18277e5ef7 Author: Even Xu Date: Thu Aug 4 08:59:19 2022 +0800 hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message There is a timing issue captured during ishtp client sending stress tests. It was observed during stress tests that ISH firmware is getting out of ordered messages. This is a rare scenario as the current set of ISH client drivers don't send much data to firmware. But this may not be the case going forward. When message size is bigger than IPC MTU, ishtp splits the message into fragments and uses serialized async method to send message fragments. The call stack: ishtp_cl_send_msg_ipc->ipc_tx_callback(first fregment)-> ishtp_send_msg(with callback)->write_ipc_to_queue-> write_ipc_from_queue->callback->ipc_tx_callback(next fregment)...... When an ipc write complete interrupt is received, driver also calls write_ipc_from_queue->ipc_tx_callback in ISR to start sending of next fragment. Through ipc_tx_callback uses spin_lock to protect message splitting, as the serialized sending method will call back to ipc_tx_callback again, so it doesn't put sending under spin_lock, it causes driver cannot guarantee all fragments be sent in order. Considering this scenario: ipc_tx_callback just finished a fragment splitting, and not call ishtp_send_msg yet, there is a write complete interrupt happens, then ISR->write_ipc_from_queue ->ipc_tx_callback->ishtp_send_msg->write_ipc_to_queue...... Because ISR has higher exec priority than normal thread, this causes the new fragment be sent out before previous fragment. This disordered message causes invalid message to firmware. The solution is, to send fragments synchronously: Use ishtp_write_message writing fragments into tx queue directly one by one, instead of ishtp_send_msg only writing one fragment with completion callback. As no completion callback be used, so change ipc_tx_callback to ipc_tx_send. Signed-off-by: Even Xu Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 94553f8a218540d676efbf3f7827ed493d1057cf Author: Jason Wang Date: Thu Aug 4 08:58:14 2022 +0800 HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo The double `like' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Signed-off-by: Jiri Kosina commit 1c0cc9d11c665020cbeb80e660fb8929164407f4 Author: Josh Kilmer Date: Thu Jul 28 12:51:11 2022 -0500 HID: asus: ROG NKey: Ignore portion of 0x5a report On an Asus G513QY, of the 5 bytes in a 0x5a report, only the first byte is a meaningful keycode. The other bytes are zeroed out or hold garbage from the last packet sent to the keyboard. This patch fixes up the report descriptor for this event so that the general hid code will only process 1 byte for keycodes, avoiding spurious key events and unmapped Asus vendor usagepage code warnings. Signed-off-by: Josh Kilmer Signed-off-by: Jiri Kosina commit a5623a203cffe2d2b84d2f6c989d9017db1856af Author: Karthik Alapati Date: Thu Jul 28 21:13:17 2022 +0530 HID: hidraw: fix memory leak in hidraw_release() Free the buffered reports before deleting the list entry. BUG: memory leak unreferenced object 0xffff88810e72f180 (size 32): comm "softirq", pid 0, jiffies 4294945143 (age 16.080s) hex dump (first 32 bytes): 64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00 d..j............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemdup+0x23/0x50 mm/util.c:128 [] kmemdup include/linux/fortify-string.h:440 [inline] [] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521 [] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992 [] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065 [] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284 [] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670 [] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747 [] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474 [] expire_timers kernel/time/timer.c:1519 [inline] [] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790 [] __run_timers kernel/time/timer.c:1768 [inline] [] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803 [] __do_softirq+0xe6/0x2ea kernel/softirq.c:571 [] invoke_softirq kernel/softirq.c:445 [inline] [] __irq_exit_rcu kernel/softirq.c:650 [inline] [] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662 [] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106 [] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 [] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] [] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554 Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com Signed-off-by: Karthik Alapati Signed-off-by: Jiri Kosina commit 1a3887924a7e6edd331be76da7bf4c1e8eab4b1e Author: Ard Biesheuvel Date: Mon Aug 22 19:20:33 2022 +0200 efi: libstub: Disable struct randomization The EFI stub is a wrapper around the core kernel that makes it look like a EFI compatible PE/COFF application to the EFI firmware. EFI applications run on top of the EFI runtime, which is heavily based on so-called protocols, which are struct types consisting [mostly] of function pointer members that are instantiated and recorded in a protocol database. These structs look like the ideal randomization candidates to the randstruct plugin (as they only carry function pointers), but of course, these protocols are contracts between the firmware that exposes them, and the EFI applications (including our stubbed kernel) that invoke them. This means that struct randomization for EFI protocols is not a great idea, and given that the stub shares very little data with the core kernel that is represented as a randomizable struct, we're better off just disabling it completely here. Cc: # v4.14+ Reported-by: Daniel Marth Tested-by: Daniel Marth Signed-off-by: Ard Biesheuvel Acked-by: Kees Cook commit cd11d1a6114bd4bc6450ae59f6e110ec47362126 Author: Lee Jones Date: Fri Jul 8 08:40:09 2022 +0100 HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: linux-input@vger.kernel.org Fixes: c164d6abf3841 ("HID: add driver for Valve Steam Controller") Signed-off-by: Lee Jones Signed-off-by: Jiri Kosina commit 55f0a4894484e8d6ddf662f5aebbf3b4cb028541 Author: Dan Carpenter Date: Thu Jul 28 17:25:16 2022 +0300 wifi: mac80211: potential NULL dereference in ieee80211_tx_control_port() The ieee80211_lookup_ra_sta() function will sometimes set "sta" to NULL so add this NULL check to prevent an Oops. Fixes: 9dd1953846c7 ("wifi: nl80211/mac80211: clarify link ID in control port TX") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YuKcTAyO94YOy0Bu@kili Signed-off-by: Johannes Berg commit d776763f48084926b5d9e25507a3ddb7c9243d5e Author: Dan Carpenter Date: Thu Aug 4 10:03:21 2022 +0300 wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() The return type is supposed to be ssize_t, which is signed long, but "r" was declared as unsigned int. This means that on 64 bit systems we return positive values instead of negative error codes. Fixes: 80a3511d70e8 ("cfg80211: add debugfs HT40 allow map") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YutvOQeJm0UjLhwU@kili Signed-off-by: Johannes Berg commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 Author: Siddh Raman Pant Date: Sun Aug 14 20:45:12 2022 +0530 wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable@vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg commit 62b03f45c6352410d13bf0710d24ef6290632eb1 Author: Yang Yingliang Date: Thu Aug 18 12:33:49 2022 +0800 wifi: mac80211: fix possible leak in ieee80211_tx_control_port() Add missing dev_kfree_skb() in an error path in ieee80211_tx_control_port() to avoid a memory leak. Fixes: dd820ed6336a ("wifi: mac80211: return error from control port TX for drops") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220818043349.4168835-1-yangyingliang@huawei.com Signed-off-by: Johannes Berg commit 36fe8e4e5cb02131719612aea1e64379670d1846 Author: Lorenzo Bianconi Date: Tue Aug 23 15:22:23 2022 +0200 wifi: mac80211: always free sta in __sta_info_alloc in case of error Free sta pointer in __sta_info_alloc routine if sta_info_alloc_link() fails. Fixes: 246b39e4a1ba5 ("wifi: mac80211: refactor some sta_info link handling") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/a3d079208684cddbc25289f7f7e0fed795b0cad4.1661260857.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c Author: Siddh Raman Pant Date: Sat Aug 20 01:33:40 2022 +0530 wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done(). Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com Suggested-by: Johannes Berg Signed-off-by: Siddh Raman Pant Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me Signed-off-by: Johannes Berg commit 0382a35bef70ecc074db67192ff8d37737d02b21 Author: Pali Rohár Date: Sat Aug 20 13:51:13 2022 +0200 powerpc/pci: Enable PCI domains in /proc when PCI bus numbers are not unique On 32-bit powerpc systems with more PCIe controllers and more PCI domains, where on more PCI domains are same PCI numbers, when kernel is compiled with CONFIG_PROC_FS=y and CONFIG_PPC_PCI_BUS_NUM_DOMAIN_DEPENDENT=y options, kernel prints "proc_dir_entry 'pci/01' already registered" error message. proc_dir_entry 'pci/01' already registered WARNING: CPU: 0 PID: 1 at fs/proc/generic.c:377 proc_register+0x1a8/0x1ac ... NIP proc_register+0x1a8/0x1ac LR proc_register+0x1a8/0x1ac Call Trace: proc_register+0x1a8/0x1ac (unreliable) _proc_mkdir+0x78/0xa4 pci_proc_attach_device+0x11c/0x168 pci_proc_init+0x80/0x98 do_one_initcall+0x80/0x284 kernel_init_freeable+0x1f4/0x2a0 kernel_init+0x24/0x150 ret_from_kernel_thread+0x5c/0x64 This regression started appearing after commit 566356813082 ("powerpc/pci: Add config option for using all 256 PCI buses") in case in each mPCIe slot is connected PCIe card and therefore PCI bus 1 is populated in for every PCIe controller / PCI domain. The reason is that PCI procfs code expects that when PCI bus numbers are not unique across all PCI domains, function pci_proc_domain() returns true for domain dependent buses. Fix this issue by setting PCI_ENABLE_PROC_DOMAINS and PCI_COMPAT_DOMAIN_0 flags for 32-bit powerpc code when CONFIG_PPC_PCI_BUS_NUM_DOMAIN_DEPENDENT is enabled. Same approach is already implemented for 64-bit powerpc code (where PCI bus numbers are always domain dependent). Fixes: 566356813082 ("powerpc/pci: Add config option for using all 256 PCI buses") Signed-off-by: Pali Rohár [mpe: Trim change log oops message] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220820115113.30581-1-pali@kernel.org commit d291e703f420d5f8f999fe54f360d54d213bddb4 Author: Zhang Xiaoxu Date: Tue Aug 23 20:52:02 2022 +0800 cifs: Add helper function to check smb1+ server SMB1 server's header_preamble_size is not 0, add use is_smb1 function to simplify the code, no actual functional changes. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Zhang Xiaoxu Signed-off-by: Steve French commit b6b3624d016b980f917b46e6b964f943ac5ac56e Author: Zhang Xiaoxu Date: Tue Aug 23 20:52:01 2022 +0800 cifs: Use help macro to get the mid header size It's better to use MID_HEADER_SIZE because the unfolded expression too long. No actual functional changes, minor readability improvement. Signed-off-by: Zhang Xiaoxu Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9789de8bdc92a9ec95c9bc7b43e94de91acc4460 Author: Zhang Xiaoxu Date: Tue Aug 23 20:52:00 2022 +0800 cifs: Use help macro to get the header preamble size It's better to use HEADER_PREAMBLE_SIZE because the unfolded expression too long. No actual functional changes, minor readability improvement. Signed-off-by: Zhang Xiaoxu Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 24c7a64ea4764d70e4ac9b0a60ecd9b03c68435e Merge: b09da0126ce09 00cd7bf9f9e06 Author: Jakub Kicinski Date: Wed Aug 24 19:18:09 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix crash with malformed ebtables blob which do not provide all entry points, from Florian Westphal. 2) Fix possible TCP connection clogging up with default 5-days timeout in conntrack, from Florian. 3) Fix crash in nf_tables tproxy with unsupported chains, also from Florian. 4) Do not allow to update implicit chains. 5) Make table handle allocation per-netns to fix data race. 6) Do not truncated payload length and offset, and checksum offset. Instead report EINVAl. 7) Enable chain stats update via static key iff no error occurs. 8) Restrict osf expression to ip, ip6 and inet families. 9) Restrict tunnel expression to netdev family. 10) Fix crash when trying to bind again an already bound chain. 11) Flowtable garbage collector might leave behind pending work to delete entries. This patch comes with a previous preparation patch as dependency. 12) Allow net.netfilter.nf_conntrack_frag6_high_thresh to be lowered, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases netfilter: flowtable: fix stuck flows on cleanup due to pending work netfilter: flowtable: add function to invoke garbage collection immediately netfilter: nf_tables: disallow binding to already bound chain netfilter: nft_tunnel: restrict it to netdev family netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nf_tables: make table handle allocation per-netns friendly netfilter: nf_tables: disallow updates of implicit chain netfilter: nft_tproxy: restrict to prerouting hook netfilter: conntrack: work around exceeded receive window netfilter: ebtables: reject blobs that don't provide all entry points ==================== Link: https://lore.kernel.org/r/20220824220330.64283-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit b09da0126ce09bd84545e4a8e8697f2a5bdeb745 Author: Lukas Bulwahn Date: Wed Aug 24 09:29:45 2022 +0200 MAINTAINERS: rectify file entry in BONDING DRIVER Commit c078290a2b76 ("selftests: include bonding tests into the kselftest infra") adds the bonding tests in the directory: tools/testing/selftests/drivers/net/bonding/ The file entry in MAINTAINERS for the BONDING DRIVER however refers to: tools/testing/selftests/net/bonding/ Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken file pattern. Repair this file entry in BONDING DRIVER. Signed-off-by: Lukas Bulwahn Acked-by: Jonathan Toppins Link: https://lore.kernel.org/r/20220824072945.28606-1-lukas.bulwahn@gmail.com Signed-off-by: Jakub Kicinski commit 8d0268585b9c07dd01b77b63913a4f31ad99239b Author: Wolfram Sang Date: Thu Aug 18 23:01:17 2022 +0200 fbdev: Move fbdev drivers from strlcpy to strscpy Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Helge Deller commit 645b5ed871f408c9826a61276b97ea14048d439c Merge: c490a0b5a4f36 0dd84b319352b Author: Jens Axboe Date: Wed Aug 24 13:58:37 2022 -0600 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.0 Pull MD fixes from Song: "1. Fix for clustered raid, by Guoqing Jiang. 2. req_op fix, by Bart Van Assche. 3. Fix race condition in raid recreate, by David Sloan." * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: call __md_stop_writes in md_stop Revert "md-raid: destroy the bitmap after destroying the thread" md: Flush workqueue md_rdev_misc_wq in md_alloc() md/raid10: Fix the data type of an r10_sync_page_io() argument commit 144c467398aa9fb274583590c848e6d6388e89d9 Author: Jiapeng Chong Date: Wed Aug 24 19:44:55 2022 +0800 fbdev: omap: Remove unnecessary print function dev_err() The print function dev_err() is redundant because platform_get_irq() already prints an error. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1957 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Helge Deller commit 07c55c9803dea748d17a054000cbf1913ce06399 Author: Yang Yingliang Date: Fri Aug 19 16:57:52 2022 +0800 fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() Add missing pci_disable_device() in error path in chipsfb_pci_init(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit 58559dfc1ebba2ae0c7627dc8f8991ae1984c6e3 Author: Shigeru Yoshida Date: Sun Aug 21 20:17:31 2022 +0900 fbdev: fbcon: Destroy mutex on freeing struct fb_info It's needed to destroy bl_curve_mutex on freeing struct fb_info since the mutex is embedded in the structure and initialized when it's allocated. Signed-off-by: Shigeru Yoshida Signed-off-by: Helge Deller commit 1cd3bf3348b4a686cc955c9cd11034d7652219cd Author: Jiapeng Chong Date: Fri Aug 19 19:06:59 2022 +0800 fbdev: radeon: Clean up some inconsistent indenting No functional modification involved. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1932 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Helge Deller commit 3119cabcc5237c63fc5316409c5beada6304ca75 Author: Jiapeng Chong Date: Fri Aug 19 19:04:14 2022 +0800 fbdev: sisfb: Clean up some inconsistent indenting No functional modification involved. drivers/video/fbdev/sis/sis_main.c:6165 sisfb_probe() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:4266 sisfb_post_300_rwtest() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:2388 SISDoSense() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:2531 SiS_Sense30x() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:2382 SISDoSense() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:2250 sisfb_sense_crt1() warn: inconsistent indenting. drivers/video/fbdev/sis/sis_main.c:672 sisfb_validate_mode() warn: inconsistent indenting. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1934 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Helge Deller commit 19f953e7435644b81332dd632ba1b2d80b1e37af Author: Letu Ren Date: Thu Aug 18 18:44:24 2022 +0800 fbdev: fb_pm2fb: Avoid potential divide by zero error In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be copied from user, then go through `fb_set_var()` and `info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`. Along the path, `var->pixclock` won't be modified. This function checks whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is zero, there will be a divide by zero error. So, it is necessary to check whether denominator is zero to avoid crash. As this bug is found by Syzkaller, logs are listed below. divide error in pm2fb_check_var Call Trace: fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Reported-by: Zheyu Ma Signed-off-by: Letu Ren Signed-off-by: Helge Deller commit 868ce967af1ea5d946635f8f89f752319212d769 Author: Jilin Yuan Date: Tue Aug 16 21:07:13 2022 +0800 fbdev: ssd1307fb: Fix repeated words in comments Delete the redundant word 'set'. Signed-off-by: Jilin Yuan Signed-off-by: Helge Deller commit acf4c6205e862304681234a6a4375b478af12552 Author: Yu Zhe Date: Fri Aug 12 14:52:23 2022 +0800 fbdev: omapfb: Fix tests for platform_get_irq() failure The platform_get_irq() returns negative error codes. It can't actually return zero. Signed-off-by: Yu Zhe Signed-off-by: Helge Deller commit bcf3a156429306070afbfda5544f2b492d25e75b Author: Sylwester Dziedziuch Date: Fri Aug 19 12:45:52 2022 +0200 i40e: Fix incorrect address type for IPv6 flow rules It was not possible to create 1-tuple flow director rule for IPv6 flow type. It was caused by incorrectly checking for source IP address when validating user provided destination IP address. Fix this by changing ip6src to correct ip6dst address in destination IP address validation for IPv6 flow type. Fixes: efca91e89b67 ("i40e: Add flow director support for IPv6") Signed-off-by: Sylwester Dziedziuch Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 25d7a5f5a6bb15a2dae0a3f39ea5dda215024726 Author: Jacob Keller Date: Mon Aug 1 17:24:19 2022 -0700 ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter The ixgbe_ptp_start_cyclecounter is intended to be called whenever the cyclecounter parameters need to be changed. Since commit a9763f3cb54c ("ixgbe: Update PTP to support X550EM_x devices"), this function has cleared the SYSTIME registers and reset the TSAUXC DISABLE_SYSTIME bit. While these need to be cleared during ixgbe_ptp_reset, it is wrong to clear them during ixgbe_ptp_start_cyclecounter. This function may be called during both reset and link status change. When link changes, the SYSTIME counter is still operating normally, but the cyclecounter should be updated to account for the possibly changed parameters. Clearing SYSTIME when link changes causes the timecounter to jump because the cycle counter now reads zero. Extract the SYSTIME initialization out to a new function and call this during ixgbe_ptp_reset. This prevents the timecounter adjustment and avoids an unnecessary reset of the current time. This also restores the original SYSTIME clearing that occurred during ixgbe_ptp_reset before the commit above. Reported-by: Steve Payne Reported-by: Ilya Evenbach Fixes: a9763f3cb54c ("ixgbe: Update PTP to support X550EM_x devices") Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0dd84b319352bb8ba64752d4e45396d8b13e6018 Author: Guoqing Jiang Date: Wed Aug 17 20:05:14 2022 +0800 md: call __md_stop_writes in md_stop From the link [1], we can see raid1d was running even after the path raid_dtr -> md_stop -> __md_stop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. [1]. https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZcec6hQFm8nhg@mail.gmail.com/T/#m7f12bf90481c02c6d2da68c64aeed4779b7df74a Fixes: 48df498daf62 ("md: move bitmap_destroy to the beginning of __md_stop") Reported-by: Mikulas Patocka Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit 1d258758cf06a0734482989911d184dd5837ed4e Author: Guoqing Jiang Date: Wed Aug 17 20:05:13 2022 +0800 Revert "md-raid: destroy the bitmap after destroying the thread" This reverts commit e151db8ecfb019b7da31d076130a794574c89f6f. Because it obviously breaks clustered raid as noticed by Neil though it fixed KASAN issue for dm-raid, let's revert it and fix KASAN issue in next commit. [1]. https://lore.kernel.org/linux-raid/a6657e08-b6a7-358b-2d2a-0ac37d49d23a@linux.dev/T/#m95ac225cab7409f66c295772483d091084a6d470 Fixes: e151db8ecfb0 ("md-raid: destroy the bitmap after destroying the thread") Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu commit a86766c49e808bbb74b97d15cea4707a13d2ab52 Merge: e78bf8cbf005c 123d6455771ec Author: Linus Torvalds Date: Wed Aug 24 10:43:34 2022 -0700 Merge tag 'trace-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: - Fix build warning for when MODULES and FTRACE_WITH_DIRECT_CALLS are not set. A warning happens with ops_references_rec() defined but not used. * tag 'trace-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace: Fix build warning for ops_references_rec() not used commit 5e8daf906f890560df430d30617c692a794acb73 Author: David Sloan Date: Thu Aug 11 11:14:13 2022 -0600 md: Flush workqueue md_rdev_misc_wq in md_alloc() A race condition still exists when removing and re-creating md devices in test cases. However, it is only seen on some setups. The race condition was tracked down to a reference still being held to the kobject by the rdev in the md_rdev_misc_wq which will be released in rdev_delayed_delete(). md_alloc() waits for previous deletions by waiting on the md_misc_wq, but the md_rdev_misc_wq may still be holding a reference to a recently removed device. To fix this, also flush the md_rdev_misc_wq in md_alloc(). Signed-off-by: David Sloan [logang@deltatee.com: rewrote commit message] Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu commit 265ad47a40da581be77172b4a8e1fb72b2bd914a Author: Bart Van Assche Date: Wed Aug 10 11:20:12 2022 -0700 md/raid10: Fix the data type of an r10_sync_page_io() argument Fix the following sparse warning: drivers/md/raid10.c:2647:60: sparse: sparse: incorrect type in argument 5 (different base types) @@ expected restricted blk_opf_t [usertype] opf @@ got int rw @@ This patch does not change any functionality since REQ_OP_READ = READ = 0 and since REQ_OP_WRITE = WRITE = 1. Cc: Rong A Chen Cc: Jens Axboe Cc: Paul Menzel Fixes: 4ce4c73f662b ("md/core: Combine two sync_page_io() arguments") Reported-by: kernel test robot Signed-off-by: Bart Van Assche Signed-off-by: Song Liu commit a1d2eb51f0a33c28f5399a1610e66b3fbd24e884 Author: Paulo Alcantara Date: Fri Aug 19 17:00:19 2022 -0300 cifs: skip extra NULL byte in filenames Since commit: cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty alloc_path_with_tree_prefix() function was no longer including the trailing separator when @path is empty, although @out_len was still assuming a path separator thus adding an extra byte to the final filename. This has caused mount issues in some Synology servers due to the extra NULL byte in filenames when sending SMB2_CREATE requests with SMB2_FLAGS_DFS_OPERATIONS set. Fix this by checking if @path is not empty and then add extra byte for separator. Also, do not include any trailing NULL bytes in filename as MS-SMB2 requires it to be 8-byte aligned and not NULL terminated. Cc: stable@vger.kernel.org Fixes: 7eacba3b00a3 ("cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit e78bf8cbf005c3cc7dc4da55ce75152b71a1da0f Merge: c40e8341e3b3b d2139dfca361a Author: Linus Torvalds Date: Wed Aug 24 10:19:20 2022 -0700 Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull dmi update from Jean Delvare. Tiny cleanup. * 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware: dmi: Use the proper accessor for the version field commit 5d7fef0804b0a72a7efe196cd23b438edf84726c Author: Sander Vanheule Date: Tue Aug 23 08:12:23 2022 +0200 lib/cpumask_kunit: add tests file to MAINTAINERS cpumask related files are listed under the BITMAP API section, so the file with tests for cpumask should be added to that list. Signed-off-by: Sander Vanheule Reviewed-by: David Gow Acked-by: Yury Norov Signed-off-by: Yury Norov commit bf5413586b8dbdb8eedee41cfd1450a4e587e845 Author: Sander Vanheule Date: Tue Aug 23 08:12:22 2022 +0200 lib/cpumask_kunit: log mask contents For extra context, log the contents of the masks under test. This should help with finding out why a certain test fails. Link: https://lore.kernel.org/lkml/CABVgOSkPXBc-PWk1zBZRQ_Tt+Sz1ruFHBj3ixojymZF=Vi4tpQ@mail.gmail.com/ Suggested-by: David Gow Signed-off-by: Sander Vanheule Signed-off-by: Yury Norov commit d3c0ca4992cc21b0e1d7d8e530faa4ab16f8ec41 Author: Sander Vanheule Date: Tue Aug 23 08:12:21 2022 +0200 lib/test_cpumask: follow KUnit style guidelines The cpumask test suite doesn't follow the KUnit style guidelines, as laid out in Documentation/dev-tools/kunit/style.rst. The file is renamed to lib/cpumask_kunit.c to clearly distinguish it from other, non-KUnit, tests. Link: https://lore.kernel.org/lkml/346cb279-8e75-24b0-7d12-9803f2b41c73@riseup.net/ Suggested-by: Maíra Canal Signed-off-by: Sander Vanheule Reviewed-by: Maíra Canal Reviewed-by: David Gow Acked-by: Yury Norov Signed-off-by: Yury Norov commit fbbc94d8486c6d683650269154c9a7d8897f35d7 Author: Sander Vanheule Date: Tue Aug 23 08:12:20 2022 +0200 lib/test_cpumask: fix cpu_possible_mask last test Since cpumask_first() on the cpu_possible_mask must return at most nr_cpu_ids - 1 for a valid result, cpumask_last() cannot return anything larger than this value. As test_cpumask_weight() also verifies that the total weight of cpu_possible_mask must equal nr_cpu_ids, the last bit set in this mask must be at nr_cpu_ids - 1. Fixes: c41e8866c28c ("lib/test: introduce cpumask KUnit test suite") Link: https://lore.kernel.org/lkml/346cb279-8e75-24b0-7d12-9803f2b41c73@riseup.net/ Reported-by: Maíra Canal Signed-off-by: Sander Vanheule Tested-by: Maíra Canal Reviewed-by: David Gow Acked-by: Yury Norov Signed-off-by: Yury Norov commit 6afd9db630b037c7f0bc939368216512568de607 Author: Sander Vanheule Date: Tue Aug 23 08:12:19 2022 +0200 lib/test_cpumask: drop cpu_possible_mask full test When the number of CPUs that can possibly be brought online is known at boot time, e.g. when HOTPLUG is disabled, nr_cpu_ids may be smaller than NR_CPUS. In that case, cpu_possible_mask would not be completely filled, and cpumask_full(cpu_possible_mask) can return false for valid system configurations. Without this test, cpu_possible_mask contents are still constrained by a check on cpumask_weight(), as well as tests in test_cpumask_first(), test_cpumask_last(), test_cpumask_next(), and test_cpumask_iterators(). Fixes: c41e8866c28c ("lib/test: introduce cpumask KUnit test suite") Link: https://lore.kernel.org/lkml/346cb279-8e75-24b0-7d12-9803f2b41c73@riseup.net/ Reported-by: Maíra Canal Signed-off-by: Sander Vanheule Tested-by: Maíra Canal Reviewed-by: David Gow Signed-off-by: Yury Norov commit 5916943943d19a854238d50d1fe2047467cbeb3c Author: Pavel Begunkov Date: Wed Aug 24 13:07:42 2022 +0100 io_uring: conditional ->async_data allocation There are opcodes that need ->async_data only in some cases and allocation it unconditionally may hurt performance. Add an option to opdef to make move the allocation part from the core io_uring to opcode specific code. Note, we can't just set opdef->async_size to zero because there are other helpers that rely on it, e.g. io_alloc_async_data(). Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9dc62be9e88dd0ed63c48365340e8922d2498293.1661342812.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 53bdc88aac9a21aae937452724fa4738cd843795 Author: Pavel Begunkov Date: Wed Aug 24 13:07:41 2022 +0100 io_uring/notif: order notif vs send CQEs Currently, there is no ordering between notification CQEs and completions of the send flushing it, this quite complicates the userspace, especially since we don't flush notification when the send(+flush) request fails, i.e. there will be only one CQE. What we can do is to make sure that notification completions come only after sends. The easiest way to achieve this is to not try to complete a notification inline from io_sendzc() but defer it to task_work, considering that io-wq sendzc is disallowed CQEs will be naturally ordered because task_works will only be executed after we're done with submission and so inline completion. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/cddfd1c2bf91f22b9fe08e13b7dffdd8f858a151.1661342812.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 986e263def32eec89153babf469859d837507d34 Author: Pavel Begunkov Date: Wed Aug 24 13:07:40 2022 +0100 io_uring/net: fix indentation Fix up indentation before we get complaints from tooling. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/bd5754e3764215ccd7fb04cd636ea9167aaa275d.1661342812.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5a848b7c9e5e4d94390fbc391ccb81d40f3ccfb5 Author: Pavel Begunkov Date: Wed Aug 24 13:07:39 2022 +0100 io_uring/net: fix zc send link failing Failed requests should be marked with req_set_fail(), so links and cqe skipping work correctly, which is missing in io_sendzc(). Note, io_sendzc() return IOU_OK on failure, so the core code won't do the cleanup for us. Fixes: 06a5464be84e4 ("io_uring: wire send zc request type") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e47d46fda9db30154ce66a549bb0d3380b780520.1661342812.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2cacedc873ab5f5945d8f1b71804b0bcea0383ff Author: Pavel Begunkov Date: Wed Aug 24 13:07:38 2022 +0100 io_uring/net: fix must_hold annotation Fix up the io_alloc_notif()'s __must_hold as we don't have a ctx argument there but should get it from the slot instead. Reported-by: Stefan Metzmacher Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/cbb0a920f18e0aed590bf58300af817b9befb8a3.1661342812.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit c490a0b5a4f36da3918181a8acdc6991d967c5f3 Author: Siddh Raman Pant Date: Tue Aug 23 21:38:10 2022 +0530 loop: Check for overflow while configuring loop The userspace can configure a loop using an ioctl call, wherein a configuration of type loop_config is passed (see lo_ioctl()'s case on line 1550 of drivers/block/loop.c). This proceeds to call loop_configure() which in turn calls loop_set_status_from_info() (see line 1050 of loop.c), passing &config->info which is of type loop_info64*. This function then sets the appropriate values, like the offset. loop_device has lo_offset of type loff_t (see line 52 of loop.c), which is typdef-chained to long long, whereas loop_info64 has lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h). The function directly copies offset from info to the device as follows (See line 980 of loop.c): lo->lo_offset = info->lo_offset; This results in an overflow, which triggers a warning in iomap_iter() due to a call to iomap_iter_done() which has: WARN_ON_ONCE(iter->iomap.offset > iter->pos); Thus, check for negative value during loop_set_status_from_info(). Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e Reported-and-tested-by: syzbot+a8e049cd3abd342936b6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Siddh Raman Pant Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220823160810.181275-1-code@siddh.me Signed-off-by: Jens Axboe commit 0c4a95417ee4b1013ddf115fb6dbe36a2503a598 Merge: c624c58e08b15 3c9ba81d72047 Author: David S. Miller Date: Wed Aug 24 13:46:59 2022 +0100 Merge branch 'sysctl-data-races' Kuniyuki Iwashima says: ==================== net: sysctl: Fix data-races around net.core.XXX This series fixes data-races around all knobs in net_core_table and netns_core_table except for bpf stuff. These knobs are skipped: - 4 bpf knobs - netdev_rss_key: Written only once by net_get_random_once() and read-only knob - rps_sock_flow_entries: Protected with sock_flow_mutex - flow_limit_cpu_bitmap: Protected with flow_limit_update_mutex - flow_limit_table_len: Protected with flow_limit_update_mutex - default_qdisc: Protected with qdisc_mod_lock - warnings: Unused - high_order_alloc_disable: Protected with static_key_mutex - skb_defer_max: Already using READ_ONCE() - sysctl_txrehash: Already using READ_ONCE() Note 5th patch fixes net.core.message_cost and net.core.message_burst, and lib/ratelimit.c does not have an explicit maintainer. Changes: v3: * Fix build failures of CONFIG_SYSCTL=n case in 13th & 14th patches v2: https://lore.kernel.org/netdev/20220818035227.81567-1-kuniyu@amazon.com/ * Remove 4 bpf knobs and added 6 knobs v1: https://lore.kernel.org/netdev/20220816052347.70042-1-kuniyu@amazon.com/ ==================== Signed-off-by: David S. Miller commit 3c9ba81d72047f2e81bb535d42856517b613aba7 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:47:00 2022 -0700 net: Fix a data-race around sysctl_somaxconn. While reading sysctl_somaxconn, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 05e49cfc89e4f325eebbc62d24dd122e55f94c23 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:59 2022 -0700 net: Fix a data-race around netdev_unregister_timeout_secs. While reading netdev_unregister_timeout_secs, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 5aa3afe107d9 ("net: make unregister netdev warning timeout configurable") Signed-off-by: Kuniyuki Iwashima Acked-by: Dmitry Vyukov Signed-off-by: David S. Miller commit 8db24af3f02ebdbf302196006ebb270c4c3a2706 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:58 2022 -0700 net: Fix a data-race around gro_normal_batch. While reading gro_normal_batch, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 323ebb61e32b ("net: use listified RX for handling GRO_NORMAL skbs") Signed-off-by: Kuniyuki Iwashima Acked-by: Edward Cree Signed-off-by: David S. Miller commit a5612ca10d1aa05624ebe72633e0c8c792970833 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:57 2022 -0700 net: Fix data-races around sysctl_devconf_inherit_init_net. While reading sysctl_devconf_inherit_init_net, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 856c395cfa63 ("net: introduce a knob to control whether to inherit devconf config") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit af67508ea6cbf0e4ea27f8120056fa2efce127dd Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:56 2022 -0700 net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. While reading sysctl_fb_tunnels_only_for_init_net, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 79134e6ce2c9 ("net: do not create fallback tunnels for non-default namespaces") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit fa45d484c52c73f79db2c23b0cdfc6c6455093ad Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:55 2022 -0700 net: Fix a data-race around netdev_budget_usecs. While reading netdev_budget_usecs, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 7acf8a1e8a28 ("Replace 2 jiffies with sysctl netdev_budget_usecs to enable softirq tuning") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 657b991afb89d25fe6c4783b1b75a8ad4563670d Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:54 2022 -0700 net: Fix data-races around sysctl_max_skb_frags. While reading sysctl_max_skb_frags, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 5f74f82ea34c ("net:Add sysctl_max_skb_frags") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 2e0c42374ee32e72948559d2ae2f7ba3dc6b977c Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:53 2022 -0700 net: Fix a data-race around netdev_budget. While reading netdev_budget, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 51b0bdedb8e7 ("[NET]: Separate two usages of netdev_max_backlog.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit e59ef36f0795696ab229569c153936bfd068d21c Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:52 2022 -0700 net: Fix a data-race around sysctl_net_busy_read. While reading sysctl_net_busy_read, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 2d48d67fa8cd ("net: poll/select low latency socket support") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit c42b7cddea47503411bfb5f2f93a4154aaffa2d9 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:51 2022 -0700 net: Fix a data-race around sysctl_net_busy_poll. While reading sysctl_net_busy_poll, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 060212928670 ("net: add low latency socket poll") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit d2154b0afa73c0159b2856f875c6b4fe7cf6a95e Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:50 2022 -0700 net: Fix a data-race around sysctl_tstamp_allow_data. While reading sysctl_tstamp_allow_data, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: b245be1f4db1 ("net-timestamp: no-payload only sysctl") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 7de6d09f51917c829af2b835aba8bb5040f8e86a Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:49 2022 -0700 net: Fix data-races around sysctl_optmem_max. While reading sysctl_optmem_max, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 6bae8ceb90ba76cdba39496db936164fa672b9be Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:48 2022 -0700 ratelimit: Fix data-races in ___ratelimit(). While reading rs->interval and rs->burst, they can be changed concurrently via sysctl (e.g. net_ratelimit_state). Thus, we need to add READ_ONCE() to their readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 61adf447e38664447526698872e21c04623afb8e Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:47 2022 -0700 net: Fix data-races around netdev_tstamp_prequeue. While reading netdev_tstamp_prequeue, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 3b098e2d7c69 ("net: Consistent skb timestamping") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 5dcd08cd19912892586c6082d56718333e2d19db Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:46 2022 -0700 net: Fix data-races around netdev_max_backlog. While reading netdev_max_backlog, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. While at it, we remove the unnecessary spaces in the doc. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit bf955b5ab8f6f7b0632cdef8e36b14e4f6e77829 Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:45 2022 -0700 net: Fix data-races around weight_p and dev_weight_[rt]x_bias. While reading weight_p, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Also, dev_[rt]x_weight can be read/written at the same time. So, we need to use READ_ONCE() and WRITE_ONCE() for its access. Moreover, to use the same weight_p while changing dev_[rt]x_weight, we add a mutex in proc_do_dev_weight(). Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 1227c1771dd2ad44318aa3ab9e3a293b3f34ff2a Author: Kuniyuki Iwashima Date: Tue Aug 23 10:46:44 2022 -0700 net: Fix data-races around sysctl_[rw]mem_(max|default). While reading sysctl_[rw]mem_(max|default), they can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit c624c58e08b15105662b9ab9be23d14a6b945a49 Author: lily Date: Mon Aug 22 22:44:11 2022 -0700 net/core/skbuff: Check the return value of skb_copy_bits() skb_copy_bits() could fail, which requires a check on the return value. Signed-off-by: Li Zhong Signed-off-by: David S. Miller commit 76de008340ecf55fe4cfb54137b8a56d87a98f9f Merge: f79959220fa5f 17ecd4a4db478 Author: David S. Miller Date: Wed Aug 24 12:51:50 2022 +0100 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2022-08-24 1) Fix a refcount leak in __xfrm_policy_check. From Xin Xiong. 2) Revert "xfrm: update SA curlft.use_time". This violates RFC 2367. From Antony Antony. 3) Fix a comment on XFRMA_LASTUSED. From Antony Antony. 4) x->lastused is not cloned in xfrm_do_migrate. Fix from Antony Antony. 5) Serialize the calls to xfrm_probe_algs. From Herbert Xu. 6) Fix a null pointer dereference of dst->dev on a metadata dst in xfrm_lookup_with_ifid. From Nikolay Aleksandrov. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 6ab55ec0a938c7f943a4edba3d6514f775983887 Author: Zheyu Ma Date: Wed Aug 24 16:16:54 2022 +0800 ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash() Since the user can control the arguments provided to the kernel by the ioctl() system call, an out-of-bounds bug occurs when the 'id->name' provided by the user does not end with '\0'. The following log can reveal it: [ 10.002313] BUG: KASAN: stack-out-of-bounds in snd_ctl_find_id+0x36c/0x3a0 [ 10.002895] Read of size 1 at addr ffff888109f5fe28 by task snd/439 [ 10.004934] Call Trace: [ 10.007140] snd_ctl_find_id+0x36c/0x3a0 [ 10.007489] snd_ctl_ioctl+0x6cf/0x10e0 Fix this by checking the bound of 'id->name' in the loop. Fixes: c27e1efb61c5 ("ALSA: control: Use xarray for faster lookups") Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220824081654.3767739-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai commit f79959220fa5fbda939592bf91c7a9ea90419040 Author: Csókás Bence Date: Mon Aug 22 10:10:52 2022 +0200 fec: Restart PPS after link state change On link state change, the controller gets reset, causing PPS to drop out and the PHC to lose its time and calibration. So we restart it if needed, restoring calibration and time registers. Changes since v2: * Add `fec_ptp_save_state()`/`fec_ptp_restore_state()` * Use `ktime_get_real_ns()` * Use `BIT()` macro Changes since v1: * More ECR #define's * Stop PPS in `fec_ptp_stop()` Signed-off-by: Csókás Bence Signed-off-by: David S. Miller commit d5485d9dd24e1d04e5509916515260186eb1455c Author: Yang Yingliang Date: Mon Aug 22 10:53:46 2022 +0800 net: neigh: don't call kfree_skb() under spin_lock_irqsave() It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So add all skb to a tmp list, then free them after spin_unlock_irqrestore() at once. Fixes: 66ba215cb513 ("neigh: fix possible DoS due to net iface start/stop loop") Suggested-by: Denis V. Lunev Signed-off-by: Yang Yingliang Reviewed-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit cdaa0a407f1acd3a44861e3aea6e3c7349e668f1 Author: Tom Lendacky Date: Tue Aug 23 16:55:51 2022 -0500 x86/sev: Don't use cc_platform_has() for early SEV-SNP calls When running identity-mapped and depending on the kernel configuration, it is possible that the compiler uses jump tables when generating code for cc_platform_has(). This causes a boot failure because the jump table uses un-mapped kernel virtual addresses, not identity-mapped addresses. This has been seen with CONFIG_RETPOLINE=n. Similar to sme_encrypt_kernel(), use an open-coded direct check for the status of SNP rather than trying to eliminate the jump table. This preserves any code optimization in cc_platform_has() that can be useful post boot. It also limits the changes to SEV-specific files so that future compiler features won't necessarily require possible build changes just because they are not compatible with running identity-mapped. [ bp: Massage commit message. ] Fixes: 5e5ccff60a29 ("x86/sev: Add helper for validating pages in early enc attribute changes") Reported-by: Sean Christopherson Suggested-by: Sean Christopherson Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Cc: # 5.19.x Link: https://lore.kernel.org/all/YqfabnTRxFSM+LoX@google.com/ commit 4b1c742407571eff58b6de9881889f7ca7c4b4dc Author: Michael Roth Date: Tue Aug 23 11:07:34 2022 -0500 x86/boot: Don't propagate uninitialized boot_params->cc_blob_address In some cases, bootloaders will leave boot_params->cc_blob_address uninitialized rather than zeroing it out. This field is only meant to be set by the boot/compressed kernel in order to pass information to the uncompressed kernel when SEV-SNP support is enabled. Therefore, there are no cases where the bootloader-provided values should be treated as anything other than garbage. Otherwise, the uncompressed kernel may attempt to access this bogus address, leading to a crash during early boot. Normally, sanitize_boot_params() would be used to clear out such fields but that happens too late: sev_enable() may have already initialized it to a valid value that should not be zeroed out. Instead, have sev_enable() zero it out unconditionally beforehand. Also ensure this happens for !CONFIG_AMD_MEM_ENCRYPT as well by also including this handling in the sev_enable() stub function. [ bp: Massage commit message and comments. ] Fixes: b190a043c49a ("x86/sev: Add SEV-SNP feature detection/setup") Reported-by: Jeremi Piotrowski Reported-by: watnuss@gmx.de Signed-off-by: Michael Roth Signed-off-by: Borislav Petkov Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=216387 Link: https://lore.kernel.org/r/20220823160734.89036-1-michael.roth@amd.com commit 00cd7bf9f9e06769ef84d5102774c8becd6a498a Author: Eric Dumazet Date: Tue Aug 23 16:38:48 2022 -0700 netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases Currently, net.netfilter.nf_conntrack_frag6_high_thresh can only be lowered. I found this issue while investigating a probable kernel issue causing flakes in tools/testing/selftests/net/ip_defrag.sh In particular, these sysctl changes were ignored: ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1 ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000 >/dev/null 2>&1 This change is inline with commit 836196239298 ("net/ipfrag: let ip[6]frag_high_thresh in ns be higher than in init_net") Fixes: 8db3d41569bb ("netfilter: nf_defrag_ipv6: use net_generic infra") Signed-off-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso commit c7e31e36d8a262eb0bc2daf8f9b7481c83284386 Author: Rob Herring Date: Tue Aug 23 09:56:48 2022 -0500 dt-bindings: opp: Add missing (unevaluated|additional)Properties on child nodes In order to ensure only documented properties are present, node schemas must have unevaluatedProperties or additionalProperties set to false (typically). Signed-off-by: Rob Herring Signed-off-by: Viresh Kumar commit 2e6481a3f3ee6234ce577454e1d88aca55f51d47 Author: Peter Ujfalusi Date: Tue Aug 23 15:24:05 2022 +0300 ALSA: hda: intel-nhlt: Correct the handling of fmt_config flexible array The struct nhlt_format's fmt_config is a flexible array, it must not be used as normal array. When moving to the next nhlt_fmt_cfg we need to take into account the data behind the ->config.caps (indicated by ->config.size). Fixes: a864e8f159b13 ("ALSA: hda: intel-nhlt: verify config type") Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Jaska Uimonen Link: https://lore.kernel.org/r/20220823122405.18464-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai commit 3e7e04b747adea36f349715d9f0998eeebf15d72 Author: Takashi Iwai Date: Tue Aug 23 09:27:17 2022 +0200 ALSA: seq: Fix data-race at module auto-loading It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix. This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB24_ay6YzARpA1zgCsE7=H9CSJJzux618E=Ka4h0YdKn=qA@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9afb4b27349a499483ae0134282cefd0c90f480f Author: Pablo Neira Ayuso Date: Thu Nov 18 22:24:15 2021 +0100 netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace by Paul Blakey. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Reported-by: Paul Blakey Tested-by: Paul Blakey Signed-off-by: Pablo Neira Ayuso commit 759eebbcfafcefa23b59e912396306543764bd3c Author: Pablo Neira Ayuso Date: Mon Aug 22 23:13:00 2022 +0200 netfilter: flowtable: add function to invoke garbage collection immediately Expose nf_flow_table_gc_run() to force a garbage collector run from the offload infrastructure. Signed-off-by: Pablo Neira Ayuso commit e02f0d3970404bfea385b6edb86f2d936db0ea2b Author: Pablo Neira Ayuso Date: Mon Aug 22 11:06:39 2022 +0200 netfilter: nf_tables: disallow binding to already bound chain Update nft_data_init() to report EINVAL if chain is already bound. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Reported-by: Gwangun Jung Signed-off-by: Pablo Neira Ayuso commit 01e4092d53bc4fe122a6e4b6d664adbd57528ca3 Author: Pablo Neira Ayuso Date: Sun Aug 21 16:32:44 2022 +0200 netfilter: nft_tunnel: restrict it to netdev family Only allow to use this expression from NFPROTO_NETDEV family. Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support") Signed-off-by: Pablo Neira Ayuso commit 5f3b7aae14a706d0d7da9f9e39def52ff5fc3d39 Author: Pablo Neira Ayuso Date: Sun Aug 21 16:25:07 2022 +0200 netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families As it was originally intended, restrict extension to supported families. Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") Signed-off-by: Pablo Neira Ayuso commit 43eb8949cfdffa764b92bc6c54b87cbe5b0003fe Author: Pablo Neira Ayuso Date: Sun Aug 21 12:41:33 2022 +0200 netfilter: nf_tables: do not leave chain stats enabled on error Error might occur later in the nf_tables_addchain() codepath, enable static key only after transaction has been created. Fixes: 9f08ea848117 ("netfilter: nf_tables: keep chain counters away from hot path") Signed-off-by: Pablo Neira Ayuso commit 7044ab281febae9e2fa9b0b247693d6026166293 Author: Pablo Neira Ayuso Date: Sun Aug 21 11:55:19 2022 +0200 netfilter: nft_payload: do not truncate csum_offset and csum_type Instead report ERANGE if csum_offset is too long, and EOPNOTSUPP if type is not support. Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support") Signed-off-by: Pablo Neira Ayuso commit 94254f990c07e9ddf1634e0b727fab821c3b5bf9 Author: Pablo Neira Ayuso Date: Sun Aug 21 11:47:04 2022 +0200 netfilter: nft_payload: report ERANGE for too long offset and length Instead of offset and length are truncation to u8, report ERANGE. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit ab482c6b66a4a8c0a8c0b0f577a785cf9ff1c2e2 Author: Pablo Neira Ayuso Date: Sun Aug 21 10:52:48 2022 +0200 netfilter: nf_tables: make table handle allocation per-netns friendly mutex is per-netns, move table_netns to the pernet area. *read-write* to 0xffffffff883a01e8 of 8 bytes by task 6542 on cpu 0: nf_tables_newtable+0x6dc/0xc00 net/netfilter/nf_tables_api.c:1221 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv+0xa6a/0x13a0 net/netfilter/nfnetlink.c:652 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x652/0x730 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x643/0x740 net/netlink/af_netlink.c:1921 Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") Reported-by: Abhishek Shah Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 5dc52d83baac30decf5f3b371d5eb41dfa1d1412 Author: Pablo Neira Ayuso Date: Sun Aug 21 10:28:25 2022 +0200 netfilter: nf_tables: disallow updates of implicit chain Updates on existing implicit chain make no sense, disallow this. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso commit c40e8341e3b3bb27e3a65b06b5b454626234c4f0 Merge: 072c92b1b1ef6 763f4fb76e249 Author: Linus Torvalds Date: Tue Aug 23 19:33:28 2022 -0700 Merge tag 'cgroup-for-6.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - The psi data structure was changed to be allocated dynamically but it wasn't being cleared leading to it reporting garbage values and triggering spurious oom kills. - A deadlock involving cpuset and cpu hotplug. - When a controller is moved across cgroup hierarchies, css->rstat_css_node didn't get RCU drained properly from the previous list. * tag 'cgroup-for-6.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Fix race condition at rebind_subsystems() cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock sched/psi: Remove redundant cgroup_psi() when !CONFIG_CGROUPS sched/psi: Remove unused parameter nbytes of psi_trigger_create() sched/psi: Zero the memory of struct psi_group commit 072c92b1b1ef69c0e4898a70194ec2df70b15cd8 Merge: 062d26ad0b368 ad982c3be4e60 Author: Linus Torvalds Date: Tue Aug 23 19:26:48 2022 -0700 Merge tag 'audit-pr-20220823' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "A single fix for a potential double-free on a fsnotify error path" * tag 'audit-pr-20220823' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix potential double free on error path from fsnotify_add_inode_mark commit 062d26ad0b36829c0142e5b96a694f3cdb6eaa43 Merge: df0219d11b6f0 41191cf6bf565 Author: Linus Torvalds Date: Tue Aug 23 19:17:26 2022 -0700 Merge tag 'fs.fixes.v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull file_remove_privs() fix from Christian Brauner: "As part of Stefan's and Jens' work to add async buffered write support to xfs we refactored file_remove_privs() and added __file_remove_privs() to avoid calling __remove_privs() when IOCB_NOWAIT is passed. While debugging a recent performance regression report I found that during review we missed that commit faf99b563558 ("fs: add __remove_file_privs() with flags parameter") accidently changed behavior when dentry_needs_remove_privs() returns zero. Before the commit it would still call inode_has_no_xattr() setting the S_NOSEC bit and thereby avoiding even calling into dentry_needs_remove_privs() the next time this function is called. After that commit inode_has_no_xattr() would only be called if __remove_privs() had to be called. Restore the old behavior. This is likely the cause of the performance regression" * tag 'fs.fixes.v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: __file_remove_privs(): restore call to inode_has_no_xattr() commit 6067c82c576af13a6b1c892b42ac4a189aced8ee Author: Jouni Högander Date: Mon Aug 22 17:08:36 2022 +0300 drm/i915/backlight: Disable pps power hook for aux based backlight Pps power hook seems to be problematic for backlight controlled via aux channel. Disable it for such cases. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3657 Cc: stable@vger.kernel.org Signed-off-by: Jouni Högander Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220822140836.534432-1-jouni.hogander@intel.com (cherry picked from commit 869e3bb7acb59d88c1226892136661810e8223a4) Signed-off-by: Rodrigo Vivi commit 868e8e5156a1f8d92ca83fdbac6fd52798650792 Author: Arun R Murthy Date: Mon Aug 8 09:27:50 2022 +0530 drm/i915/display: avoid warnings when registering dual panel backlight Commit 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") added support for multiple backlight devices on dual panel systems, but did so with error handling on -EEXIST from backlight_device_register(). Unfortunately, that triggered a warning in dmesg all the way down from sysfs_add_file_mode_ns() and sysfs_warn_dup(). Instead of optimistically always attempting to register with the default name ("intel_backlight", which we have to retain for backward compatibility), check if a backlight device with the name exists first, and, if so, use the card and connector based name. v2: reworked on top of the patch commit 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") v3: fixed the ref count leak(Jani N) Fixes: 20f85ef89d94 ("drm/i915/backlight: use unique backlight device names") Signed-off-by: Arun R Murthy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220808035750.3111046-1-arun.r.murthy@intel.com (cherry picked from commit 4234ea30051200fc6016de10e4d58369e60b38f1) Signed-off-by: Rodrigo Vivi commit 13393f65b77445d8b0f99c7b605cc9ccc936586f Author: Jani Nikula Date: Tue Aug 16 18:37:21 2022 +0300 drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+ The VBT dual-link DSI backlight and CABC still use ports A and C, both in Bspec and code, while display 11+ DSI only supports ports A and B. Assume port C actually means port B for display 11+ when parsing VBT. Bspec: 20154 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6476 Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Reviewed-by: Stanislav Lisovskiy Link: https://patchwork.freedesktop.org/patch/msgid/8c462718bcc7b36a83e09d0a5eef058b6bc8b1a2.1660664162.git.jani.nikula@intel.com (cherry picked from commit ab55165d73a444606af1530cd0d6448b04370f68) Signed-off-by: Rodrigo Vivi commit 607f41768a1ef9c7721866b00fbdeeea5359bc07 Author: Jani Nikula Date: Tue Aug 16 18:37:20 2022 +0300 drm/i915/dsi: filter invalid backlight and CABC ports Avoid using ports that aren't initialized in case the VBT backlight or CABC ports have invalid values. This fixes a NULL pointer dereference of intel_dsi->dsi_hosts[port] in such cases. Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Reviewed-by: Stanislav Lisovskiy Link: https://patchwork.freedesktop.org/patch/msgid/b0f4f087866257d280eb97d6bcfcefd109cc5fa2.1660664162.git.jani.nikula@intel.com (cherry picked from commit f4a6c7a454a6e71c5ccf25af82694213a9784013) Signed-off-by: Rodrigo Vivi commit de2228c04150df8632ad22ee490de2ed579f64e8 Author: Daniele Ceraolo Spurio Date: Thu Aug 11 14:08:12 2022 -0700 drm/i915/guc: clear stalled request after a reset If the GuC CTs are full and we need to stall the request submission while waiting for space, we save the stalled request and where the stall occurred; when the CTs have space again we pick up the request submission from where we left off. If a full GT reset occurs, the state of all contexts is cleared and all non-guilty requests are unsubmitted, therefore we need to restart the stalled request submission from scratch. To make sure that we do so, clear the saved request after a reset. Fixes note: the patch that introduced the bug is in 5.15, but no officially supported platform had GuC submission enabled by default in that kernel, so the backport to that particular version (and only that one) can potentially be skipped. Fixes: 925dc1cf58ed ("drm/i915/guc: Implement GuC submission tasklet") Signed-off-by: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: John Harrison Cc: # v5.15+ Reviewed-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20220811210812.3239621-1-daniele.ceraolospurio@intel.com (cherry picked from commit f922fbb0f2ad1fd3e3186f39c46673419e6d9281) Signed-off-by: Rodrigo Vivi commit 8d905254162965c8e6be697d82c7dbf5d08f574d Author: Matthew Auld Date: Fri Aug 5 14:22:40 2022 +0100 drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can also trigger this with gem_lmem_swapping, if we modify the test to use slightly larger object sizes. Looking closer it looks like we have the following issues in migrate_copy(): - We are using plain integer in various places, which we can easily overflow with a large object. - We pass the entire object size (when the src is lmem) into emit_pte() and then try to copy it, which doesn't work, since we only have a few fixed sized windows in which to map the pages and perform the copy. With an object > 8M we therefore aren't properly copying the pages. And then with an object > 64M we trigger the GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER). So it looks like our copy handling for any object > 8M (which is our CHUNK_SZ) is currently broken on DG2. Fixes: da0595ae91da ("drm/i915/migrate: Evict and restore the flatccs capable lmem obj") Testcase: igt@gem_lmem_swapping Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Ramalingam C Reviewed-by: Ramalingam C Link: https://patchwork.freedesktop.org/patch/msgid/20220805132240.442747-2-matthew.auld@intel.com (cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2) Signed-off-by: Rodrigo Vivi commit 550e9a4d858ff0bf872522eb4a802d549b45ac96 Merge: 311806784228d 35419025cb1ee Author: Jakub Kicinski Date: Tue Aug 23 17:50:26 2022 -0700 Merge tag 'mlx5-fixes-2022-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2022-08-22 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2022-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Unlock on error in mlx5_sriov_enable() net/mlx5e: Fix use after free in mlx5e_fs_init() net/mlx5e: kTLS, Use _safe() iterator in mlx5e_tls_priv_tx_list_cleanup() net/mlx5: unlock on error path in esw_vfs_changed_event_handler() net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off net/mlx5e: TC, Add missing policer validation net/mlx5e: Fix wrong application of the LRO state net/mlx5: Avoid false positive lockdep warning by adding lock_class_key net/mlx5: Fix cmd error logging for manage pages cmd net/mlx5: Disable irq when locking lag_lock net/mlx5: Eswitch, Fix forwarding decision to uplink net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY net/mlx5e: Properly disable vlan strip on non-UL reps ==================== Link: https://lore.kernel.org/r/20220822195917.216025-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 311806784228d3c3a0b86f116d2ea8b9fa90500e Merge: 1eec80946a73e 9ead7e74bfd6d Author: Jakub Kicinski Date: Tue Aug 23 17:49:02 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ice: xsk: reduced queue count fixes Maciej Fijalkowski says: this small series is supposed to fix the issues around AF_XDP usage with reduced queue count on interface. Due to the XDP rings setup, some configurations can result in sockets not seeing traffic flowing. More about this in description of patch 2. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: xsk: use Rx ring's XDP ring when picking NAPI context ice: xsk: prohibit usage of non-balanced queue id ==================== Link: https://lore.kernel.org/r/20220822163257.2382487-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1a6052e1483f28808845e51a1c82c96e0e7cd419 Author: Stefan Wahren Date: Wed Jul 13 17:49:53 2022 +0200 clk: bcm: rpi: Show clock id limit in error case The clock id limit will be extended in the future, so it would be helpful to see the actual clock id limit in case the firmware response has been rejected. Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20220713154953.3336-4-stefan.wahren@i2se.com Acked-by: Florian Fainelli Reviewed-by: Ivan T. Ivanov Signed-off-by: Stephen Boyd commit 13b5cf8d6a0d4a5d289e1ed046cadc63b416db85 Author: Stefan Wahren Date: Wed Jul 13 17:49:52 2022 +0200 clk: bcm: rpi: Add missing newline Some log messages lacks the final newline. So add them. Fixes: 93d2725affd6 ("clk: bcm: rpi: Discover the firmware clocks") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20220713154953.3336-3-stefan.wahren@i2se.com Acked-by: Florian Fainelli Reviewed-by: Ivan T. Ivanov Signed-off-by: Stephen Boyd commit bc163555603e4ae9c817675ad80d618a4cdbfa2d Author: Stefan Wahren Date: Wed Jul 13 17:49:51 2022 +0200 clk: bcm: rpi: Prevent out-of-bounds access The while loop in raspberrypi_discover_clocks() relies on the assumption that the id of the last clock element is zero. Because this data comes from the Videocore firmware and it doesn't guarantuee such a behavior this could lead to out-of-bounds access. So fix this by providing a sentinel element. Fixes: 93d2725affd6 ("clk: bcm: rpi: Discover the firmware clocks") Link: https://github.com/raspberrypi/firmware/issues/1688 Suggested-by: Phil Elwell Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20220713154953.3336-2-stefan.wahren@i2se.com Acked-by: Florian Fainelli Reviewed-by: Ivan T. Ivanov Signed-off-by: Stephen Boyd commit e9ac503883abbd298b77477ccf60412bc0ca742f Merge: 1d9e325793db2 df0219d11b6f0 Author: Andrew Morton Date: Tue Aug 23 15:33:19 2022 -0700 Merge branch 'linus' commit 1eec80946a73e776fc9fe3209ca8fec2314fc76f Merge: 15f7cfae912ea 366c304741729 Author: Jakub Kicinski Date: Tue Aug 23 15:32:24 2022 -0700 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes This series includes 2 fixes for regressions introduced by the XDP multi-buffer feature, 1 devlink reload bug fix, and 1 SRIOV resource accounting bug fix. ==================== Link: https://lore.kernel.org/r/1661180814-19350-1-git-send-email-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 366c304741729e64d778c80555d9eb422cf5cc89 Author: Vikas Gupta Date: Mon Aug 22 11:06:54 2022 -0400 bnxt_en: fix LRO/GRO_HW features in ndo_fix_features callback LRO/GRO_HW should be disabled if there is an attached XDP program. BNXT_FLAG_TPA is the current setting of the LRO/GRO_HW. Using BNXT_FLAG_TPA to disable LRO/GRO_HW will cause these features to be permanently disabled once they are disabled. Fixes: 1dc4c557bfed ("bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff") Signed-off-by: Vikas Gupta Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 09a89cc59ad67794a11e1d3dd13c5b3172adcc51 Author: Vikas Gupta Date: Mon Aug 22 11:06:53 2022 -0400 bnxt_en: fix NQ resource accounting during vf creation on 57500 chips There are 2 issues: 1. We should decrement hw_resc->max_nqs instead of hw_resc->max_irqs with the number of NQs assigned to the VFs. The IRQs are fixed on each function and cannot be re-assigned. Only the NQs are being assigned to the VFs. 2. vf_msix is the total number of NQs to be assigned to the VFs. So we should decrement vf_msix from hw_resc->max_nqs. Fixes: b16b68918674 ("bnxt_en: Add SR-IOV support for 57500 chips.") Signed-off-by: Vikas Gupta Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 574b2bb9692fd3d45ed631ac447176d4679f3010 Author: Vikas Gupta Date: Mon Aug 22 11:06:52 2022 -0400 bnxt_en: set missing reload flag in devlink features Add missing devlink_set_features() API for callbacks reload_down and reload_up to function. Fixes: 228ea8c187d8 ("bnxt_en: implement devlink dev reload driver_reinit") Reviewed-by: Somnath Kotur Signed-off-by: Vikas Gupta Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 7dd3de7cb1d657a918c6b2bc673c71e318aa0c05 Author: Pavan Chebbi Date: Mon Aug 22 11:06:51 2022 -0400 bnxt_en: Use PAGE_SIZE to init buffer when multi buffer XDP is not in use Using BNXT_PAGE_MODE_BUF_SIZE + offset as buffer length value is not sufficient when running single buffer XDP programs doing redirect operations. The stack will complain on missing skb tail room. Fix it by using PAGE_SIZE when calling xdp_init_buff() for single buffer programs. Fixes: b231c3f3414c ("bnxt: refactor bnxt_rx_xdp to separate xdp_init_buff/xdp_prepare_buff") Reviewed-by: Somnath Kotur Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski commit 0947ae1121083d363d522ff7518ee72b55bd8d29 Author: Kuniyuki Iwashima Date: Tue Aug 23 14:58:04 2022 -0700 bpf: Fix a data-race around bpf_jit_limit. While reading bpf_jit_limit, it can be changed concurrently via sysctl, WRITE_ONCE() in __do_proc_doulongvec_minmax(). The size of bpf_jit_limit is long, so we need to add a paired READ_ONCE() to avoid load-tearing. Fixes: ede95a63b5e8 ("bpf: add bpf_jit_limit knob to restrict unpriv allocations") Signed-off-by: Kuniyuki Iwashima Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220823215804.2177-1-kuniyu@amazon.com commit 15f7cfae912ea1739c8844b7edf3621ba981a37a Author: Vladimir Oltean Date: Thu Aug 18 19:48:09 2022 +0300 net: dsa: microchip: make learning configurable and keep it off while standalone Address learning should initially be turned off by the driver for port operation in standalone mode, then the DSA core handles changes to it via ds->ops->port_bridge_flags(). Leaving address learning enabled while ports are standalone breaks any kind of communication which involves port B receiving what port A has sent. Notably it breaks the ksz9477 driver used with a (non offloaded, ports act as if standalone) bonding interface in active-backup mode, when the ports are connected together through external switches, for redundancy purposes. This fixes a major design flaw in the ksz9477 and ksz8795 drivers, which unconditionally leave address learning enabled even while ports operate as standalone. Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") Link: https://lore.kernel.org/netdev/CAFZh4h-JVWt80CrQWkFji7tZJahMfOToUJQgKS5s0_=9zzpvYQ@mail.gmail.com/ Reported-by: Brian Hutchinson Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220818164809.3198039-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e4009c5fa77b4356aa37ce002e9f9952dfd7a615 Author: Conor Dooley Date: Sat Aug 20 00:14:16 2022 +0100 riscv: dts: microchip: mpfs: remove pci axi address translation property An AXI master address translation table property was inadvertently added to the device tree & this was not caught by dtbs_check at the time. Remove the property - it should not be in mpfs.dtsi anyway as it would be more suitable in -fabric.dtsi nor does it actually apply to the version of the reference design we are using for upstream. Link: https://www.microsemi.com/document-portal/doc_download/1245812-polarfire-fpga-and-polarfire-soc-fpga-pci-express-user-guide # Section 1.3.3 Fixes: 528a5b1f2556 ("riscv: dts: microchip: add new peripherals to icicle kit device tree") Signed-off-by: Conor Dooley commit 2b55915d27dcaa35f54bad7925af0a76001079bc Author: Conor Dooley Date: Sat Aug 20 00:14:15 2022 +0100 riscv: dts: microchip: mpfs: remove bogus card-detect-delay Recent versions of dt-schema warn about a previously undetected undocumented property: arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dtb: mmc@20008000: Unevaluated properties are not allowed ('card-detect-delay' was unexpected) From schema: Documentation/devicetree/bindings/mmc/cdns,sdhci.yaml There are no GPIOs connected to MSSIO6B4 pin K3 so adding the common cd-debounce-delay-ms property makes no sense. The Cadence IP has a register that sets the card detect delay as "DP * tclk". On MPFS, this clock frequency is not configurable (it must be 200 MHz) & the FPGA comes out of reset with this register already set. Fixes: bc47b2217f24 ("riscv: dts: microchip: add the sundance polarberry") Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") Signed-off-by: Conor Dooley commit 72a05748cbd285567d69f173f8694e3471b79f20 Author: Conor Dooley Date: Sat Aug 20 00:14:14 2022 +0100 riscv: dts: microchip: mpfs: remove ti,fifo-depth property Recent versions of dt-schema warn about a previously undetected undocument property on the icicle & polarberry devicetrees: arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dtb: ethernet@20112000: ethernet-phy@8: Unevaluated properties are not allowed ('ti,fifo-depth' was unexpected) From schema: Documentation/devicetree/bindings/net/cdns,macb.yaml I know what you're thinking, the binding doesn't look to be the problem and I agree. I am not sure why a TI vendor property was ever actually added since it has no meaning... just get rid of it. Fixes: bc47b2217f24 ("riscv: dts: microchip: add the sundance polarberry") Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") Signed-off-by: Conor Dooley commit 3f67e69976035352db110443916bcce32c7f64ac Author: Conor Dooley Date: Sat Aug 20 00:14:13 2022 +0100 riscv: dts: microchip: mpfs: fix incorrect pcie child node name Recent versions of dt-schema complain about the PCIe controller's child node name: arch/riscv/boot/dts/microchip/mpfs-icicle-kit.dtb: pcie@2000000000: Unevaluated properties are not allowed ('clock-names', 'clocks', 'legacy-interrupt-controller', 'microchip,axi-m-atr0' were unexpected) From schema: Documentation/devicetree/bindings/pci/microchip,pcie-host.yaml Make the dts match the correct property name in the dts. Fixes: 528a5b1f2556 ("riscv: dts: microchip: add new peripherals to icicle kit device tree") Signed-off-by: Conor Dooley commit df0219d11b6f04251d38e345db4f9780cb32e2e2 Merge: 95607ad99b5a4 591d2108f3abc Author: Linus Torvalds Date: Tue Aug 23 13:42:31 2022 -0700 Merge tag 'parisc-for-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "Some interesting background to the current patchset: It turned out that the fldw instruction (which loads a 32-bit word from memory into one half of a FP register) failed on unaligned addresses and even trashed some other random FP register instead. It's a trivial one-liner fix in the exception handler but this failure dates back to the very beginnings of the parisc-port. It's strange that it was never noticed before. Another patch fixes an annoyance noticed by Randy Dunlap. Running "make ARCH=parisc64 randconfig" always returned a 32-bit config, although one would expect a 64-bit config. Masahiro Yamada suggested to mimik sparc Kconfig code, which fixed the issue nicely. This allowed to drop some compiler build checks too. Third, it's possible to build an optimized 32-bit kernel for PA8X00 (64-bit) CPUs, which then wouldn't start on 32-bit-only (PA1.x) machines. I've added a bootup check which prevents that and which prints a message to the console. This can be tested with qemu, which currently only supports 32-bit emulation. The other patches are usual clean-up stuff like added return value checks and typo fixes in comments. Summary: - Fix emulation of fldw instruction on unaligned addresses - Fix "make ARCH=parisc64 randconfig" to return a 64-bit config - Prevent boot if trying to boot a 32-bit kernel compiled for PA8X00 CPUs on 32-bit only machines - ccio-dma: Handle kmalloc failure in ccio_init_resources()" * tag 'parisc-for-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() parisc: led: Move from strlcpy with unused retval to strscpy parisc: ccio-dma: Fix typo in comment Revert "parisc: Show error if wrong 32/64-bit compiler is being used" parisc: Make CONFIG_64BIT available for ARCH=parisc64 only parisc: Fix exception handler for fldw and fstw instructions commit 95607ad99b5a4e3e69e025621165753718a6ea98 Merge: 6234806f8c9fe 9c80e79906b4c Author: Linus Torvalds Date: Tue Aug 23 13:33:08 2022 -0700 Merge tag 'mm-hotfixes-stable-2022-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Thirteen fixes, almost all for MM. Seven of these are cc:stable and the remainder fix up the changes which went into this -rc cycle" * tag 'mm-hotfixes-stable-2022-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: kprobes: don't call disarm_kprobe() for disabled kprobes mm/shmem: shmem_replace_page() remember NR_SHMEM mm/shmem: tmpfs fallocate use file_modified() mm/shmem: fix chattr fsflags support in tmpfs mm/hugetlb: support write-faults in shared mappings mm/hugetlb: fix hugetlb not supporting softdirty tracking mm/uffd: reset write protection when unregister with wp-mode mm/smaps: don't access young/dirty bit if pte unpresent mm: add DEVICE_ZONE to FOR_ALL_ZONES kernel/sys_ni: add compat entry for fadvise64_64 mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Revert "zram: remove double compression logic" get_maintainer: add Alan to .get_maintainer.ignore commit 6234806f8c9fe93f8db99cb47fc079ce78aabbd5 Merge: 3ee3d984102bc 41a55567b9e31 Author: Linus Torvalds Date: Tue Aug 23 13:23:07 2022 -0700 Merge tag 'linux-kselftest-kunit-fixes-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit fixes from Shuah Khan: "Fix for a mmc test and to load .kunit_test_suites section when CONFIG_KUNIT=m, and not just when KUnit is built-in" * tag 'linux-kselftest-kunit-fixes-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: module: kunit: Load .kunit_test_suites section when CONFIG_KUNIT=m mmc: sdhci-of-aspeed: test: Fix dependencies when KUNIT=m commit f2c3bec215694fb8bc0ef5010f2a758d1906fc2d Author: Anand Jain Date: Fri Aug 12 18:32:19 2022 +0800 btrfs: add info when mount fails due to stale replace target If the replace target device reappears after the suspended replace is cancelled, it blocks the mount operation as it can't find the matching replace-item in the metadata. As shown below, BTRFS error (device sda5): replace devid present without an active replace item To overcome this situation, the user can run the command btrfs device scan --forget and try the mount command again. And also, to avoid repeating the issue, superblock on the devid=0 must be wiped. wipefs -a device-path-to-devid=0. This patch adds some info when this situation occurs. Reported-by: Samuel Greiner Link: https://lore.kernel.org/linux-btrfs/b4f62b10-b295-26ea-71f9-9a5c9299d42c@balkonien.org/T/ CC: stable@vger.kernel.org # 5.0+ Signed-off-by: Anand Jain Signed-off-by: David Sterba commit 59a3991984dbc1fc47e5651a265c5200bd85464e Author: Anand Jain Date: Fri Aug 12 18:32:18 2022 +0800 btrfs: replace: drop assert for suspended replace If the filesystem mounts with the replace-operation in a suspended state and try to cancel the suspended replace-operation, we hit the assert. The assert came from the commit fe97e2e173af ("btrfs: dev-replace: replace's scrub must not be running in suspended state") that was actually not required. So just remove it. $ mount /dev/sda5 /btrfs BTRFS info (device sda5): cannot continue dev_replace, tgtdev is missing BTRFS info (device sda5): you may cancel the operation after 'mount -o degraded' $ mount -o degraded /dev/sda5 /btrfs <-- success. $ btrfs replace cancel /btrfs kernel: assertion failed: ret != -ENOTCONN, in fs/btrfs/dev-replace.c:1131 kernel: ------------[ cut here ]------------ kernel: kernel BUG at fs/btrfs/ctree.h:3750! After the patch: $ btrfs replace cancel /btrfs BTRFS info (device sda5): suspended dev_replace from /dev/sda5 (devid 1) to canceled Fixes: fe97e2e173af ("btrfs: dev-replace: replace's scrub must not be running in suspended state") CC: stable@vger.kernel.org # 5.0+ Signed-off-by: Anand Jain Signed-off-by: David Sterba commit 47bf225a8d2cccb15f7e8d4a1ed9b757dd86afd7 Author: Filipe Manana Date: Mon Aug 22 15:47:09 2022 +0100 btrfs: fix silent failure when deleting root reference At btrfs_del_root_ref(), if btrfs_search_slot() returns an error, we end up returning from the function with a value of 0 (success). This happens because the function returns the value stored in the variable 'err', which is 0, while the error value we got from btrfs_search_slot() is stored in the 'ret' variable. So fix it by setting 'err' with the error value. Fixes: 8289ed9f93bef2 ("btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling") CC: stable@vger.kernel.org # 5.16+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ced8ecf026fd8084cf175530ff85c76d6085d715 Author: Omar Sandoval Date: Tue Aug 23 11:28:13 2022 -0700 btrfs: fix space cache corruption and potential double allocations When testing space_cache v2 on a large set of machines, we encountered a few symptoms: 1. "unable to add free space :-17" (EEXIST) errors. 2. Missing free space info items, sometimes caught with a "missing free space info for X" error. 3. Double-accounted space: ranges that were allocated in the extent tree and also marked as free in the free space tree, ranges that were marked as allocated twice in the extent tree, or ranges that were marked as free twice in the free space tree. If the latter made it onto disk, the next reboot would hit the BUG_ON() in add_new_free_space(). 4. On some hosts with no on-disk corruption or error messages, the in-memory space cache (dumped with drgn) disagreed with the free space tree. All of these symptoms have the same underlying cause: a race between caching the free space for a block group and returning free space to the in-memory space cache for pinned extents causes us to double-add a free range to the space cache. This race exists when free space is cached from the free space tree (space_cache=v2) or the extent tree (nospace_cache, or space_cache=v1 if the cache needs to be regenerated). struct btrfs_block_group::last_byte_to_unpin and struct btrfs_block_group::progress are supposed to protect against this race, but commit d0c2f4fa555e ("btrfs: make concurrent fsyncs wait less when waiting for a transaction commit") subtly broke this by allowing multiple transactions to be unpinning extents at the same time. Specifically, the race is as follows: 1. An extent is deleted from an uncached block group in transaction A. 2. btrfs_commit_transaction() is called for transaction A. 3. btrfs_run_delayed_refs() -> __btrfs_free_extent() runs the delayed ref for the deleted extent. 4. __btrfs_free_extent() -> do_free_extent_accounting() -> add_to_free_space_tree() adds the deleted extent back to the free space tree. 5. do_free_extent_accounting() -> btrfs_update_block_group() -> btrfs_cache_block_group() queues up the block group to get cached. block_group->progress is set to block_group->start. 6. btrfs_commit_transaction() for transaction A calls switch_commit_roots(). It sets block_group->last_byte_to_unpin to block_group->progress, which is block_group->start because the block group hasn't been cached yet. 7. The caching thread gets to our block group. Since the commit roots were already switched, load_free_space_tree() sees the deleted extent as free and adds it to the space cache. It finishes caching and sets block_group->progress to U64_MAX. 8. btrfs_commit_transaction() advances transaction A to TRANS_STATE_SUPER_COMMITTED. 9. fsync calls btrfs_commit_transaction() for transaction B. Since transaction A is already in TRANS_STATE_SUPER_COMMITTED and the commit is for fsync, it advances. 10. btrfs_commit_transaction() for transaction B calls switch_commit_roots(). This time, the block group has already been cached, so it sets block_group->last_byte_to_unpin to U64_MAX. 11. btrfs_commit_transaction() for transaction A calls btrfs_finish_extent_commit(), which calls unpin_extent_range() for the deleted extent. It sees last_byte_to_unpin set to U64_MAX (by transaction B!), so it adds the deleted extent to the space cache again! This explains all of our symptoms above: * If the sequence of events is exactly as described above, when the free space is re-added in step 11, it will fail with EEXIST. * If another thread reallocates the deleted extent in between steps 7 and 11, then step 11 will silently re-add that space to the space cache as free even though it is actually allocated. Then, if that space is allocated *again*, the free space tree will be corrupted (namely, the wrong item will be deleted). * If we don't catch this free space tree corruption, it will continue to get worse as extents are deleted and reallocated. The v1 space_cache is synchronously loaded when an extent is deleted (btrfs_update_block_group() with alloc=0 calls btrfs_cache_block_group() with load_cache_only=1), so it is not normally affected by this bug. However, as noted above, if we fail to load the space cache, we will fall back to caching from the extent tree and may hit this bug. The easiest fix for this race is to also make caching from the free space tree or extent tree synchronous. Josef tested this and found no performance regressions. A few extra changes fall out of this change. Namely, this fix does the following, with step 2 being the crucial fix: 1. Factor btrfs_caching_ctl_wait_done() out of btrfs_wait_block_group_cache_done() to allow waiting on a caching_ctl that we already hold a reference to. 2. Change the call in btrfs_cache_block_group() of btrfs_wait_space_cache_v1_finished() to btrfs_caching_ctl_wait_done(), which makes us wait regardless of the space_cache option. 3. Delete the now unused btrfs_wait_space_cache_v1_finished() and space_cache_v1_done(). 4. Change btrfs_cache_block_group()'s `int load_cache_only` parameter to `bool wait` to more accurately describe its new meaning. 5. Change a few callers which had a separate call to btrfs_wait_block_group_cache_done() to use wait = true instead. 6. Make btrfs_wait_block_group_cache_done() static now that it's not used outside of block-group.c anymore. Fixes: d0c2f4fa555e ("btrfs: make concurrent fsyncs wait less when waiting for a transaction commit") CC: stable@vger.kernel.org # 5.12+ Reviewed-by: Filipe Manana Signed-off-by: Omar Sandoval Signed-off-by: David Sterba commit 3ee3d984102bc4e0ae4c3cbd67c80c0d61514100 Merge: 072e51356cd5a bdbf0617bbc36 Author: Linus Torvalds Date: Tue Aug 23 13:13:36 2022 -0700 Merge tag 'linux-kselftest-fixes-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "Fixes to vm and sgx test builds" * tag 'linux-kselftest-fixes-6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/vm: fix inability to build any vm tests selftests/sgx: Ignore OpenSSL 3.0 deprecated functions warning commit 18bbc3213383a82b05383827f4b1b882e3f0a5a5 Author: Florian Westphal Date: Sat Aug 20 17:54:06 2022 +0200 netfilter: nft_tproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a crash (null dereference) when using tproxy from e.g. output. Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") Reported-by: Shell Chen Signed-off-by: Florian Westphal commit 2a91980012abc54841da530a6de90f74a41c9e34 Merge: 13e575de5fd7a be919239fbcab Author: Mark Brown Date: Tue Aug 23 19:36:36 2022 +0100 ASoC: nau8xxx: Implement hw constraint for rates Merge series from Takashi Iwai : This is a series of patches to address the issues on nau8xxx codecs I've stumbled upon while dealing with a bug report for Steam Deck. Most of them are to implement the missing hw constraint for rate restrictions while one patch is to fix the semaphore unbalance in nau8824 driver. commit 13e575de5fd7a78d7a5bc5df394c5d553f6a17b1 Merge: 4ee6fc271b59e 2cf520ffbcbd5 Author: Mark Brown Date: Tue Aug 23 19:36:34 2022 +0100 ASoC: SOF: Kconfig: Fix the dependency for client modules Merge series from Peter Ujfalusi : There is still a chance to end up with a client driver selected as built in while the core SOF is as module. Fix this by making the client drivers depend on SND_SOC_SOF. commit 763f4fb76e24959c370cdaa889b2492ba6175580 Author: Jing-Ting Wu Date: Tue Aug 23 13:41:46 2022 +0800 cgroup: Fix race condition at rebind_subsystems() Root cause: The rebind_subsystems() is no lock held when move css object from A list to B list,then let B's head be treated as css node at list_for_each_entry_rcu(). Solution: Add grace period before invalidating the removed rstat_css_node. Reported-by: Jing-Ting Wu Suggested-by: Michal Koutný Signed-off-by: Jing-Ting Wu Tested-by: Jing-Ting Wu Link: https://lore.kernel.org/linux-arm-kernel/d8f0bc5e2fb6ed259f9334c83279b4c011283c41.camel@mediatek.com/T/ Acked-by: Mukesh Ojha Fixes: a7df69b81aac ("cgroup: rstat: support cgroup1") Cc: stable@vger.kernel.org # v5.13+ Signed-off-by: Tejun Heo commit 6ca7076fbfaeccce173aeab832d76b9e49e1034b Author: Lukasz Luba Date: Tue Aug 16 13:01:57 2022 +0100 cpufreq: check only freq_table in __resolve_freq() There is no need to check if the cpufreq driver implements callback cpufreq_driver::target_index. The logic in the __resolve_freq uses the frequency table available in the policy. It doesn't matter if the driver provides 'target_index' or 'target' callback. It just has to populate the 'policy->freq_table'. Thus, check only frequency table during the frequency resolving call. Acked-by: Viresh Kumar Signed-off-by: Lukasz Luba Signed-off-by: Rafael J. Wysocki commit ea902bcc1943f7539200ec464de3f54335588774 Author: Tony Luck Date: Tue Aug 23 10:48:19 2022 -0700 x86/cpu: Add new Raptor Lake CPU model number Note1: Model 0xB7 already claimed the "no suffix" #define for a regular client part, so add (yet another) suffix "S" to distinguish this new part from the earlier one. Note2: the RAPTORLAKE* and ALDERLAKE* processors are very similar from a software enabling point of view. There are no known features that have model-specific enabling and also differ between the two. In other words, every single place that list *one* or more RAPTORLAKE* or ALDERLAKE* processors should list all of them. Note3: This is being merged before there is an in-tree user. Merging this provides an "anchor" so that the different folks can update their subsystems (like perf) in parallel to use this define and test it. [ dhansen: add a note about why this has no in-tree users yet ] Signed-off-by: Tony Luck Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/20220823174819.223941-1-tony.luck@intel.com commit 7931e28098a4c1a2a6802510b0cbe57546d2049d Author: Lee, Chun-Yi Date: Mon Aug 8 21:21:58 2022 +0800 thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR In some case, the GDDV returns a package with a buffer which has zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10). Then the data_vault_read() got NULL point dereference problem when accessing the 0x10 value in data_vault. [ 71.024560] BUG: kernel NULL pointer dereference, address: 0000000000000010 This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or NULL value in data_vault. Signed-off-by: "Lee, Chun-Yi" Signed-off-by: Rafael J. Wysocki commit 80b9ebd3e478cd41526cbf84f80c3e0eb885d1d3 Author: Jarrah Gosbell Date: Tue Aug 23 10:00:37 2022 -0700 Input: goodix - add compatible string for GT1158 Add compatible string for GT1158 missing from the previous patch. Fixes: 425fe4709c76 ("Input: goodix - add support for GT1158") Signed-off-by: Jarrah Gosbell Link: https://lore.kernel.org/r/20220813043821.9981-1-kernel@undef.tools Signed-off-by: Dmitry Torokhov commit 4ee6fc271b59e805301371ea3862f558a23d9c7b Author: Bard Liao Date: Mon Aug 22 21:02:11 2022 +0200 ASoC: SOF: ipc4-topology: fix alh_group_ida max value group_id is from 0 ~ ALH_MULTI_GTW_COUNT - 1, not 0 ~ ALH_MULTI_GTW_COUNT. Fixes: a150345aa7584 ("ASoC: SOF: ipc4-topology: add SoundWire/ALH aggregation support") Reported-by: kernel test robot Reported-by: Dan Carpenter Reviewed-by: Rander Wang Signed-off-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220822190211.170537-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 5c5c2baad2b55cc0a4b190266889959642298f79 Author: Nathan Chancellor Date: Tue Aug 9 18:08:09 2022 -0700 ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion A recent change in clang strengthened its -Wbitfield-constant-conversion to warn when 1 is assigned to a 1-bit signed integer bitfield, as it can only be 0 or -1, not 1: sound/soc/atmel/mchp-spdiftx.c:505:20: error: implicit truncation from 'int' to bit-field changes value from 1 to -1 [-Werror,-Wbitfield-constant-conversion] dev->gclk_enabled = 1; ^ ~ 1 error generated. The actual value of the field is never checked, just that it is not zero, so there is not a real bug here. However, it is simple enough to silence the warning by making the bitfield unsigned, which matches the mchp-spdifrx driver. Fixes: 06ca24e98e6b ("ASoC: mchp-spdiftx: add driver for S/PDIF TX Controller") Link: https://github.com/ClangBuiltLinux/linux/issues/1686 Link: https://github.com/llvm/llvm-project/commit/82afc9b169a67e8b8a1862fb9c41a2cd974d6691 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20220810010809.2024482-1-nathan@kernel.org Signed-off-by: Mark Brown commit cf97769c761abfeac8931b35fe0e1a8d5fabc9d8 Author: Florian Westphal Date: Fri Aug 19 00:42:31 2022 +0200 netfilter: conntrack: work around exceeded receive window When a TCP sends more bytes than allowed by the receive window, all future packets can be marked as invalid. This can clog up the conntrack table because of 5-day default timeout. Sequence of packets: 01 initiator > responder: [S], seq 171, win 5840, options [mss 1330,sackOK,TS val 63 ecr 0,nop,wscale 1] 02 responder > initiator: [S.], seq 33211, ack 172, win 65535, options [mss 1460,sackOK,TS val 010 ecr 63,nop,wscale 8] 03 initiator > responder: [.], ack 33212, win 2920, options [nop,nop,TS val 068 ecr 010], length 0 04 initiator > responder: [P.], seq 172:240, ack 33212, win 2920, options [nop,nop,TS val 279 ecr 010], length 68 Window is 5840 starting from 33212 -> 39052. 05 responder > initiator: [.], ack 240, win 256, options [nop,nop,TS val 872 ecr 279], length 0 06 responder > initiator: [.], seq 33212:34530, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 This is fine, conntrack will flag the connection as having outstanding data (UNACKED), which lowers the conntrack timeout to 300s. 07 responder > initiator: [.], seq 34530:35848, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 08 responder > initiator: [.], seq 35848:37166, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 09 responder > initiator: [.], seq 37166:38484, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 10 responder > initiator: [.], seq 38484:39802, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 1318 Packet 10 is already sending more than permitted, but conntrack doesn't validate this (only seq is tested vs. maxend, not 'seq+len'). 38484 is acceptable, but only up to 39052, so this packet should not have been sent (or only 568 bytes, not 1318). At this point, connection is still in '300s' mode. Next packet however will get flagged: 11 responder > initiator: [P.], seq 39802:40128, ack 240, win 256, options [nop,nop,TS val 892 ecr 279], length 326 nf_ct_proto_6: SEQ is over the upper bound (over the window of the receiver) .. LEN=378 .. SEQ=39802 ACK=240 ACK PSH .. Now, a couple of replies/acks comes in: 12 initiator > responder: [.], ack 34530, win 4368, [.. irrelevant acks removed ] 16 initiator > responder: [.], ack 39802, win 8712, options [nop,nop,TS val 296201291 ecr 2982371892], length 0 This ack is significant -- this acks the last packet send by the responder that conntrack considered valid. This means that ack == td_end. This will withdraw the 'unacked data' flag, the connection moves back to the 5-day timeout of established conntracks. 17 initiator > responder: ack 40128, win 10030, ... This packet is also flagged as invalid. Because conntrack only updates state based on packets that are considered valid, packet 11 'did not exist' and that gets us: nf_ct_proto_6: ACK is over upper bound 39803 (ACKed data not seen yet) .. SEQ=240 ACK=40128 WINDOW=10030 RES=0x00 ACK URG Because this received and processed by the endpoints, the conntrack entry remains in a bad state, no packets will ever be considered valid again: 30 responder > initiator: [F.], seq 40432, ack 2045, win 391, .. 31 initiator > responder: [.], ack 40433, win 11348, .. 32 initiator > responder: [F.], seq 2045, ack 40433, win 11348 .. ... all trigger 'ACK is over bound' test and we end up with non-early-evictable 5-day default timeout. NB: This patch triggers a bunch of checkpatch warnings because of silly indent. I will resend the cleanup series linked below to reduce the indent level once this change has propagated to net-next. I could route the cleanup via nf but that causes extra backport work for stable maintainers. Link: https://lore.kernel.org/netfilter-devel/20220720175228.17880-1-fw@strlen.de/T/#mb1d7147d36294573cc4f81d00f9f8dadfdd06cd8 Signed-off-by: Florian Westphal commit 7997eff82828304b780dc0a39707e1946d6f1ebf Author: Florian Westphal Date: Sat Aug 20 17:38:37 2022 +0200 netfilter: ebtables: reject blobs that don't provide all entry points Harshit Mogalapalli says: In ebt_do_table() function dereferencing 'private->hook_entry[hook]' can lead to NULL pointer dereference. [..] Kernel panic: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [..] RIP: 0010:ebt_do_table+0x1dc/0x1ce0 Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 5c 16 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6c df 08 48 8d 7d 2c 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 88 [..] Call Trace: nf_hook_slow+0xb1/0x170 __br_forward+0x289/0x730 maybe_deliver+0x24b/0x380 br_flood+0xc6/0x390 br_dev_xmit+0xa2e/0x12c0 For some reason ebtables rejects blobs that provide entry points that are not supported by the table, but what it should instead reject is the opposite: blobs that DO NOT provide an entry point supported by the table. t->valid_hooks is the bitmask of hooks (input, forward ...) that will see packets. Providing an entry point that is not support is harmless (never called/used), but the inverse isn't: it results in a crash because the ebtables traverser doesn't expect a NULL blob for a location its receiving packets for. Instead of fixing all the individual checks, do what iptables is doing and reject all blobs that differ from the expected hooks. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Harshit Mogalapalli Reported-by: syzkaller Signed-off-by: Florian Westphal commit 36527b9d882362567ceb4eea8666813280f30e6f Author: Riwen Lu Date: Tue Aug 23 15:43:42 2022 +0800 ACPI: processor: Remove freq Qos request for all CPUs The freq Qos request would be removed repeatedly if the cpufreq policy relates to more than one CPU. Then, it would cause the "called for unknown object" warning. Remove the freq Qos request for each CPU relates to the cpufreq policy, instead of removing repeatedly for the last CPU of it. Fixes: a1bb46c36ce3 ("ACPI: processor: Add QoS requests for all CPUs") Reported-by: Jeremy Linton Tested-by: Jeremy Linton Signed-off-by: Riwen Lu Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit 6b04ce966a738ecdd9294c9593e48513c0dc90aa Author: Karol Herbst Date: Fri Aug 19 22:09:28 2022 +0200 nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf It is a bit unlcear to us why that's helping, but it does and unbreaks suspend/resume on a lot of GPUs without any known drawbacks. Cc: stable@vger.kernel.org # v5.15+ Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/156 Signed-off-by: Karol Herbst Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20220819200928.401416-1-kherbst@redhat.com commit c6e50787889c8d55db65c769dccee98c7fcd1732 Author: Srinivas Kandagatla Date: Sun Aug 14 13:38:00 2022 +0100 soundwire: qcom: remove duplicate reset control get Looks like adding clock gate flag patch forgot to remove the old code that gets reset control. This causes below crash on platforms that do not need reset. [ 15.653501] reset_control_reset+0x124/0x170 [ 15.653508] qcom_swrm_init+0x50/0x1a0 [ 15.653514] qcom_swrm_probe+0x320/0x668 [ 15.653519] platform_probe+0x68/0xe0 [ 15.653529] really_probe+0xbc/0x2a8 [ 15.653535] __driver_probe_device+0x7c/0xe8 [ 15.653541] driver_probe_device+0x40/0x110 [ 15.653547] __device_attach_driver+0x98/0xd0 [ 15.653553] bus_for_each_drv+0x68/0xd0 [ 15.653559] __device_attach+0xf4/0x188 [ 15.653565] device_initial_probe+0x14/0x20 Fix this by removing old code. Reported-by: Amit Pundir Fixes: 1fd0d85affe4 ("soundwire: qcom: Add flag for software clock gating check") Signed-off-by: Srinivas Kandagatla Tested-by: Amit Pundir Link: https://lore.kernel.org/r/20220814123800.31200-1-srinivas.kandagatla@linaro.org Signed-off-by: Vinod Koul commit a9c3eda7eada94e8cf29cb102aa80e1370d8fa2e Author: Kanchan Joshi Date: Tue Aug 23 20:40:22 2022 +0530 io_uring: fix submission-failure handling for uring-cmd If ->uring_cmd returned an error value different from -EAGAIN or -EIOCBQUEUED, it gets overridden with IOU_OK. This invites trouble as caller (io_uring core code) handles IOU_OK differently than other error codes. Fix this by returning the actual error code. Signed-off-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 22dec134dbfa825b963f8a1807ad19b943e46a56 Author: Takashi Iwai Date: Tue Aug 23 09:27:16 2022 +0200 ALSA: seq: oss: Fix data-race for max_midi_devs access ALSA OSS sequencer refers to a global variable max_midi_devs at creating a new port, storing it to its own field. Meanwhile this variable may be changed by other sequencer events at snd_seq_oss_midi_check_exit_port() in parallel, which may cause a data race. OTOH, this data race itself is almost harmless, as the access to the MIDI device is done via get_mdev() and it's protected with a refcount, hence its presence is guaranteed. Though, it's sill better to address the data-race from the code sanity POV, and this patch adds the proper spinlock for the protection. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB2493pZRXs863w58QWnUTtv3HHfg85aYhLn5HJHCwxqtHQg@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 855a28f9c96c80e6cbd2d986a857235e34868064 Author: Vladimir Oltean Date: Fri Aug 19 20:39:25 2022 +0300 net: dsa: don't dereference NULL extack in dsa_slave_changeupper() When a driver returns -EOPNOTSUPP in dsa_port_bridge_join() but failed to provide a reason for it, DSA attempts to set the extack to say that software fallback will kick in. The problem is, when we use brctl and the legacy bridge ioctls, the extack will be NULL, and DSA dereferences it in the process of setting it. Sergei Antonov proves this using the following stack trace: Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at dsa_slave_changeupper+0x5c/0x158 dsa_slave_changeupper from raw_notifier_call_chain+0x38/0x6c raw_notifier_call_chain from __netdev_upper_dev_link+0x198/0x3b4 __netdev_upper_dev_link from netdev_master_upper_dev_link+0x50/0x78 netdev_master_upper_dev_link from br_add_if+0x430/0x7f4 br_add_if from br_ioctl_stub+0x170/0x530 br_ioctl_stub from br_ioctl_call+0x54/0x7c br_ioctl_call from dev_ifsioc+0x4e0/0x6bc dev_ifsioc from dev_ioctl+0x2f8/0x758 dev_ioctl from sock_ioctl+0x5f0/0x674 sock_ioctl from sys_ioctl+0x518/0xe40 sys_ioctl from ret_fast_syscall+0x0/0x1c Fix the problem by only overriding the extack if non-NULL. Fixes: 1c6e8088d9a7 ("net: dsa: allow port_bridge_join() to override extack message") Link: https://lore.kernel.org/netdev/CABikg9wx7vB5eRDAYtvAm7fprJ09Ta27a4ZazC=NX5K4wn6pWA@mail.gmail.com/ Reported-by: Sergei Antonov Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Tested-by: Sergei Antonov Link: https://lore.kernel.org/r/20220819173925.3581871-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4b2e3a17e9f279325712b79fb01d1493f9e3e005 Author: Maciej Żenczykowski Date: Sun Aug 21 06:08:08 2022 -0700 net: ipvtap - add __init/__exit annotations to module init/exit funcs Looks to have been left out in an oversight. Cc: Mahesh Bandewar Cc: Sainath Grandhi Fixes: 235a9d89da97 ('ipvtap: IP-VLAN based tap driver') Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20220821130808.12143-1-zenczykowski@gmail.com Signed-off-by: Paolo Abeni commit 47abea041f897d64dbd5777f0cf7745148f85d75 Author: Jens Axboe Date: Tue Aug 23 07:26:08 2022 -0600 io_uring: fix off-by-one in sync cancelation file check The passed in index should be validated against the number of registered files we have, it needs to be smaller than the index value to avoid going one beyond the end. Fixes: 78a861b94959 ("io_uring: add sync cancelation API through io_uring_register()") Reported-by: Luo Likang Signed-off-by: Jens Axboe commit e1d0c6d05afdcff01ace698edb3b8808db1dc066 Author: Ammar Faizi Date: Tue Aug 23 18:45:49 2022 +0700 io_uring: uapi: Add `extern "C"` in io_uring.h for liburing Make it easy for liburing to integrate uapi header with the kernel. Previously, when this header changes, the liburing side can't directly copy this header file due to some small differences. Sync them. Link: https://lore.kernel.org/io-uring/f1feef16-6ea2-0653-238f-4aaee35060b6@kernel.dk Cc: Bart Van Assche Cc: Dylan Yudaken Cc: Facebook Kernel Team Signed-off-by: Ammar Faizi Signed-off-by: Jens Axboe commit c2fa700c5f7667800b6cfedcb9994eb5eb69e6cc Author: Ammar Faizi Date: Tue Aug 23 18:45:48 2022 +0700 MAINTAINERS: Add `include/linux/io_uring_types.h` File include/linux/io_uring_types.h doesn't have a maintainer, add it to the io_uring section. Signed-off-by: Ammar Faizi Signed-off-by: Jens Axboe commit 2cf520ffbcbd55c0f2b4276065444d7526d9d197 Author: Peter Ujfalusi Date: Tue Aug 23 15:15:54 2022 +0300 ASoC: SOF: Kconfig: Make IPC_MESSAGE_INJECTOR depend on SND_SOC_SOF Make sure that the IPC_MESSAGE_INJECTOR client can not be built in when SND_SOC_SOF is built as module. Fixes: cac0b0887e530 ("ASoC: SOF: Convert the generic IPC message injector into SOF client") Reported-by: kernel test robot Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220823121554.4255-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3942499fba11de048c3ac1390b808e9e6ae88de5 Author: Peter Ujfalusi Date: Tue Aug 23 15:15:53 2022 +0300 ASoC: SOF: Kconfig: Make IPC_FLOOD_TEST depend on SND_SOC_SOF Make sure that the IPC_FLOOD client can not be built in when SND_SOC_SOF is built as module. Fixes: 6e9548cdb30e5 ("ASoC: SOF: Convert the generic IPC flood test into SOF client") Reported-by: kernel test robot Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220823121554.4255-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 388f9f0a7ff84b7890a24499a3a1fea0cad21373 Author: Frank Wunderlich Date: Sun Aug 21 14:19:29 2022 +0200 arm64: dts: rockchip: fix upper usb port on BPI-R2-Pro - extcon is no more needed in 5.19 - so drop it commit 51a9b2c03dd3 ("phy: rockchip-inno-usb2: Handle ID IRQ") - dr_mode was changed from host to otg in rk356x.dtsi commit bc405bb3eeee ("arm64: dts: rockchip: enable otg/drd operation of usb_host0_xhci in rk356x") change it back on board level as id-pin on r2pro is not connected Signed-off-by: Frank Wunderlich Link: https://lore.kernel.org/r/20220821121929.244112-1-linux@fw-web.de Signed-off-by: Heiko Stuebner commit 4a00c43818dcc19be97250d4c3c4a1e2f1ed4f9d Author: Jagan Teki Date: Mon Aug 22 16:05:24 2022 +0530 arm64: dts: rockchip: Fix typo in lisense text for PX30.Core Fix the Amarula Solutions typo mistake in lisense text added in Engicam PX30.Core SoM dtsi. Fixes: d92a7c331f53c ("arm64: dts: rockchip: Add Engicam PX30.Core SOM") Signed-off-by: Jagan Teki Link: https://lore.kernel.org/r/20220822103524.266731-1-jagan@amarulasolutions.com Signed-off-by: Heiko Stuebner commit e5467359a725de90b6b8d0dd865500f6373828ca Author: Brian Norris Date: Mon Aug 22 16:45:04 2022 -0700 arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob The Gru-Bob board does not have a pull-up resistor on its WLAN_HOST_WAKE# pin, but Kevin does. The production/vendor kernel specified the pin configuration correctly as a pull-up, but this didn't get ported correctly to upstream. This means Bob's WLAN_HOST_WAKE# pin is floating, causing inconsistent wakeup behavior. Note that bt_host_wake_l has a similar dynamic, but apparently the upstream choice was to redundantly configure both internal and external pull-up on Kevin (see the "Kevin has an external pull up" comment in rk3399-gru.dtsi). This doesn't cause any functional problem, although it's perhaps wasteful. Fixes: 8559bbeeb849 ("arm64: dts: rockchip: add Google Bob") Signed-off-by: Brian Norris Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/20220822164453.1.I75c57b48b0873766ec993bdfb7bc1e63da5a1637@changeid Signed-off-by: Heiko Stuebner commit 1ea90b2d293fd8b1f3377c9ed08364ff6f2a8562 Author: Nicolas Frattaroli Date: Thu Jul 21 06:43:06 2022 +0200 arm64: dts: rockchip: Lower sd speed on quartz64-b The previously stated speed of sdr-104 is too high for the hardware to reliably communicate with some fast SD cards. Lower this to sd-uhs-sdr50 to fix this. Fixes: dcc8c66bef79 ("arm64: dts: rockchip: add Pine64 Quartz64-B device tree") Signed-off-by: Nicolas Frattaroli Tested-by: Peter Geis Link: https://lore.kernel.org/r/20220721044307.48641-1-frattaroli.nicolas@gmail.com Signed-off-by: Heiko Stuebner commit 1faa6f8274e2b08a38c0cca74113dfb26c6ad7b7 Author: Shengjiu Wang Date: Tue Aug 23 17:35:08 2022 +0800 ASoC: fsl_mqs: Fix supported clock DAI format The MQS works as codec DAI, not cpu DAI. It is clock consumer, not clock privider. Fixes: 3b14c15a333b ("ASoC: fsl: Update to use set_fmt_new callback") Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1661247308-2650-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit be919239fbcab19290bfd6802c7ad1dc946c515b Author: Takashi Iwai Date: Tue Aug 23 10:10:00 2022 +0200 ASoC: nau8540: Implement hw constraint for rates nau8540 driver restricts the sample rate with over sampling rate, but currently it barely bails out at hw_params with -EINVAL error (with a kernel message); this doesn't help for user-space to recognize which rate can be actually used. This patch introduces the proper hw constraint for adjusting the available range of the sample rate depending on the OSR setup, as well as some code cleanup, for improving the communication with user-space. Now applications can know the valid rate beforehand and reduces the rate appropriately without errors. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823081000.2965-6-tiwai@suse.de Signed-off-by: Mark Brown commit bed41de0f679c516de45cfeb2c40c412bc5e0c0b Author: Takashi Iwai Date: Tue Aug 23 10:09:59 2022 +0200 ASoC: nau8825: Implement hw constraint for rates nau8825 driver restricts the sample rate with over sampling rate, but currently it barely bails out at hw_params with -EINVAL error (with a kernel message); this doesn't help for user-space to recognize which rate can be actually used. This patch introduces the proper hw constraint for adjusting the available range of the sample rate depending on the OSR setup, as well as some code cleanup, for improving the communication with user-space. Now applications can know the valid rate beforehand and reduces the rate appropriately without errors. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823081000.2965-5-tiwai@suse.de Signed-off-by: Mark Brown commit 92283c86260d8712b55f97eada13b3c8b2f469b2 Author: Takashi Iwai Date: Tue Aug 23 10:09:58 2022 +0200 ASoC: nau8824: Implement hw constraint for rates nau8824 driver restricts the sample rate with over sampling rate, but currently it barely bails out at hw_params with -EINVAL error (with a kernel message); this doesn't help for user-space to recognize which rate can be actually used. This patch introduces the proper hw constraint for adjusting the available range of the sample rate depending on the OSR setup, as well as some code cleanup, for improving the communication with user-space. Now applications can know the valid rate beforehand and reduces the rate appropriately without errors. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823081000.2965-4-tiwai@suse.de Signed-off-by: Mark Brown commit 5628560e90395d3812800a8e44a01c32ffa429ec Author: Takashi Iwai Date: Tue Aug 23 10:09:57 2022 +0200 ASoC: nau8824: Fix semaphore unbalance at error paths The semaphore of nau8824 wasn't properly unlocked at some error handling code paths, hence this may result in the unbalance (and potential lock-up). Fix them to handle the semaphore up properly. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823081000.2965-3-tiwai@suse.de Signed-off-by: Mark Brown commit cf5071876baf995f8f98e86ef06f85a58feda63c Author: Takashi Iwai Date: Tue Aug 23 10:09:56 2022 +0200 ASoC: nau8821: Implement hw constraint for rates nau8821 driver restricts the sample rate with over sampling rate, but currently it barely bails out at hw_params with -EINVAL error (with a kernel message); this doesn't help for user-space to recognize which rate can be actually used. This patch introduces the proper hw constraint for adjusting the available range of the sample rate depending on the OSR setup, as well as some code cleanup, for improving the communication with user-space. Now applications can know the valid rate beforehand and reduces the rate appropriately without errors. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823081000.2965-2-tiwai@suse.de Signed-off-by: Mark Brown commit 40d30cf680cb735eed479a2fee127a7bc7fa3d4e Author: Cristian Marussi Date: Thu Aug 18 14:23:09 2022 +0100 firmware: arm_scmi: Harmonize SCMI tracing message format After the recently added new scmi_msg_dump traces, the general format of the various other SCMI traces are not consistent. As an example the full traces of a simple PERF_LEVEL_SET: | cpufreq-set-276 scmi_xfer_begin: transfer_id=145 msg_id=7 protocol_id=19 seq=145 poll=0 | cpufreq-set-276 scmi_msg_dump: pt=13 t=CMND msg_id=07 seq=0091 s=0 pyld=000000008066ab13 | cpufreq-set-276 scmi_xfer_response_wait: transfer_id=145 msg_id=7 protocol_id=19 seq=145 tmo_ms=5000 poll=0 | -0 scmi_msg_dump: pt=13 t=RESP msg_id=07 seq=0091 s=0 pyld= | -0 scmi_rx_done: transfer_id=145 msg_id=7 protocol_id=19 seq=145 msg_type=0 | cpufreq-set-276 scmi_xfer_end: transfer_id=145 msg_id=7 protocol_id=19 seq=145 status=0 ... where the same information is being reported using different names (protocol_id= vs pt=) and even worst different bases, which is hard to read and to parse. So let us unify them, using the same naming and ordering of the fields (wherever possible) and moving all the protocol related fields to base-16 while keeping in base-10 timeouts, res_id and values, so that the new traces would be like: | cpufreq-set-274 scmi_xfer_begin: pt=13 msg_id=07 seq=0092 transfer_id=92 poll=0 | cpufreq-set-274 scmi_msg_dump: pt=13 t=CMND msg_id=07 seq=0092 s=0 pyld=000000008066ab13 | cpufreq-set-274 scmi_xfer_response_wait: pt=13 msg_id=07 seq=0092 transfer_id=92 tmo_ms=5000 poll=0 | cat-256 scmi_msg_dump: pt=13 t=RESP msg_id=07 seq=0092 s=0 pyld= | cat-256 scmi_rx_done: pt=13 msg_id=07 seq=0092 transfer_id=92 msg_type=0 | cpufreq-set-274 scmi_xfer_end: pt=13 msg_id=07 seq=0092 transfer_id=92 s=0 Link: https://lore.kernel.org/r/20220818132309.584042-2-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit dea796fcab0a219830831c070b8dc367d7e0f708 Author: Cristian Marussi Date: Wed Aug 17 18:27:31 2022 +0100 firmware: arm_scmi: Add SCMI PM driver remove routine Currently, when removing the SCMI PM driver not all the resources registered with genpd subsystem are properly de-registered. As a side effect of this after a driver unload/load cycle you get a splat with a few warnings like this: | debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present! | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present! Add a proper scmi_pm_domain_remove callback to the driver in order to take care of all the needed cleanups not handled by devres framework. Link: https://lore.kernel.org/r/20220817172731.1185305-7-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit b75c83d9b961fd3abf7310f8d36d5e6e9f573efb Author: Cristian Marussi Date: Wed Aug 17 18:27:30 2022 +0100 firmware: arm_scmi: Fix the asynchronous reset requests SCMI Reset protocol specification allows the asynchronous reset request only when an autonomous reset action is specified. Reset requests based on explicit assert/deassert of signals should not be served asynchronously. Current implementation will instead issue an asynchronous request in any case, as long as the reset domain had advertised to support asynchronous resets. Avoid requesting the asynchronous resets when the reset action is not of the autonomous type, even if the target reset domain does, in general, support the asynchronous requests. Link: https://lore.kernel.org/r/20220817172731.1185305-6-cristian.marussi@arm.com Fixes: 95a15d80aa0d ("firmware: arm_scmi: Add RESET protocol in SCMI v2.0") Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit e9076ffbcaed5da6c182b144ef9f6e24554af268 Author: Cristian Marussi Date: Wed Aug 17 18:27:29 2022 +0100 firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses. Link: https://lore.kernel.org/r/20220817172731.1185305-5-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit a4f124908617553ea3929a17293cea4960c92ba3 Author: Saravana Kannan Date: Fri Aug 19 15:16:14 2022 -0700 Revert "iommu/of: Delete usage of driver_deferred_probe_check_state()" This reverts commit b09796d528bbf06e3e10a4a8f78038719da7ebc6. An issue was reported[1] on the original commit. I'll need to address that before I can delete the use of driver_deferred_probe_check_state(). So, bring it back for now. [1] - https://lore.kernel.org/lkml/4799738.LvFx2qVVIh@steina-w/ Fixes: b09796d528bb ("iommu/of: Delete usage of driver_deferred_probe_check_state()") Reported-by: Jean-Philippe Brucker Tested-by: Jean-Philippe Brucker Tested-by: Alexander Stein Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220819221616.2107893-5-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit e20813dcdc05aa295ef586b518142d0fab4c5692 Author: Saravana Kannan Date: Fri Aug 19 15:16:13 2022 -0700 Revert "PM: domains: Delete usage of driver_deferred_probe_check_state()" This reverts commit 5a46079a96451cfb15e4f5f01f73f7ba24ef851a. Quite a few issues have been reported [1][2][3][4][5][6] on the original commit. While about half of them have been fixed, I'll need to fix the rest before driver_deferred_probe_check_state() can be deleted. So, revert the deletion for now. [1] - https://lore.kernel.org/all/DU0PR04MB941735271F45C716342D0410886B9@DU0PR04MB9417.eurprd04.prod.outlook.com/ [2] - https://lore.kernel.org/all/CM6REZS9Z8AC.2KCR9N3EFLNQR@otso/ [3] - https://lore.kernel.org/all/CAD=FV=XYVwaXZxqUKAuM5c7NiVjFz5C6m6gAHSJ7rBXBF94_Tg@mail.gmail.com/ [4] - https://lore.kernel.org/all/Yvpd2pwUJGp7R+YE@euler/ [5] - https://lore.kernel.org/lkml/20220601070707.3946847-2-saravanak@google.com/ [6] - https://lore.kernel.org/all/CA+G9fYt_cc5SiNv1Vbse=HYY_+uc+9OYPZuJ-x59bROSaLN6fw@mail.gmail.com/ Fixes: 5a46079a9645 ("PM: domains: Delete usage of driver_deferred_probe_check_state()") Reported-by: Peng Fan Reported-by: Luca Weiss Reported-by: Doug Anderson Reported-by: Colin Foster Reported-by: Tony Lindgren Reported-by: Alexander Stein Reported-by: Naresh Kamboju Tested-by: Tony Lindgren Tested-by: Peng Fan Tested-by: Douglas Anderson Tested-by: Alexander Stein Reviewed-by: Tony Lindgren Acked-by: Ulf Hansson Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220819221616.2107893-4-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit cffaf9721f755b46370e7be0592dc41168c95019 Author: Saravana Kannan Date: Fri Aug 19 15:16:12 2022 -0700 Revert "net: mdio: Delete usage of driver_deferred_probe_check_state()" This reverts commit f8217275b57aa48d98cc42051c2aac34152718d6. There are a few more issues to fix that have been reported in the thread for the original series [1]. We'll need to fix those before this will work. So, revert it for now. [1] - https://lore.kernel.org/lkml/CAMuHMdWo_wRwV-i_iyTxVnEsf3Th9GBAG+wxUQMQGnw1t2ijTg@mail.gmail.com/ Fixes: f8217275b57a ("net: mdio: Delete usage of driver_deferred_probe_check_state()") Reported-by: Geert Uytterhoeven Tested-by: Alexander Stein Reviewed-by: Tony Lindgren Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220819221616.2107893-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 13a8e0f6b01b14b2e28ba144e112c883f03a3db2 Author: Saravana Kannan Date: Fri Aug 19 15:16:11 2022 -0700 Revert "driver core: Delete driver_deferred_probe_check_state()" This reverts commit 9cbffc7a59561be950ecc675d19a3d2b45202b2b. There are a few more issues to fix that have been reported in the thread for the original series [1]. We'll need to fix those before this will work. So, revert it for now. [1] - https://lore.kernel.org/lkml/20220601070707.3946847-1-saravanak@google.com/ Fixes: 9cbffc7a5956 ("driver core: Delete driver_deferred_probe_check_state()") Tested-by: Tony Lindgren Tested-by: Peng Fan Tested-by: Douglas Anderson Tested-by: Alexander Stein Reviewed-by: Tony Lindgren Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20220819221616.2107893-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 714f3cbd70a4db9f9b7fe5b8a032896ed33fb824 Author: Mark Brown Date: Wed Aug 17 19:23:24 2022 +0100 arm64/sme: Don't flush SVE register state when handling SME traps Currently as part of handling a SME access trap we flush the SVE register state. This is not needed and would corrupt register state if the task has access to the SVE registers already. For non-streaming mode accesses the required flushing will be done in the SVE access trap. For streaming mode SVE register accesses the architecture guarantees that the register state will be flushed when streaming mode is entered or exited so there is no need for us to do so. Simply remove the register initialisation. Fixes: 8bd7f91c03d8 ("arm64/sme: Implement traps and syscall handling for SME") Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-5-broonie@kernel.org Signed-off-by: Will Deacon commit 826a4fdd2ada9e5923c58bdd168f31a42e958ffc Author: Mark Brown Date: Wed Aug 17 19:23:23 2022 +0100 arm64/sme: Don't flush SVE register state when allocating SME storage Currently when taking a SME access trap we allocate storage for the SVE register state in order to be able to handle storage of streaming mode SVE. Due to the original usage in a purely SVE context the SVE register state allocation this also flushes the register state for SVE if storage was already allocated but in the SME context this is not desirable. For a SME access trap to be taken the task must not be in streaming mode so either there already is SVE register state present for regular SVE mode which would be corrupted or the task does not have TIF_SVE and the flush is redundant. Fix this by adding a flag to sve_alloc() indicating if we are in a SVE context and need to flush the state. Freshly allocated storage is always zeroed either way. Fixes: 8bd7f91c03d8 ("arm64/sme: Implement traps and syscall handling for SME") Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-4-broonie@kernel.org Signed-off-by: Will Deacon commit ea64baacbc36a0d552aec0d87107182f40211131 Author: Mark Brown Date: Wed Aug 17 19:23:22 2022 +0100 arm64/signal: Flush FPSIMD register state when disabling streaming mode When handling a signal delivered to a context with streaming mode enabled we will disable streaming mode for the signal handler, when doing so we should also flush the saved FPSIMD register state like exiting streaming mode in the hardware would do so that if that state is reloaded we get the same behaviour. Without this we will reload whatever the last FPSIMD state that was saved for the task was. Fixes: 40a8e87bb328 ("arm64/sme: Disable ZA and streaming mode when handling signals") Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-3-broonie@kernel.org Signed-off-by: Will Deacon commit 7ddcaf78e93c9282b4d92184f511b4d5bee75355 Author: Mark Brown Date: Wed Aug 17 19:23:21 2022 +0100 arm64/signal: Raise limit on stack frames The signal code has a limit of 64K on the size of a stack frame that it will generate, if this limit is exceeded then a process will be killed if it receives a signal. Unfortunately with the advent of SME this limit is too small - the maximum possible size of the ZA register alone is 64K. This is not an issue for practical systems at present but is easily seen using virtual platforms. Raise the limit to 256K, this is substantially more than could be used by any current architecture extension. Signed-off-by: Mark Brown Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-2-broonie@kernel.org Signed-off-by: Will Deacon commit 53d2d84a1f6d68e036adab71df8e0f37cd2724f6 Author: Mark Brown Date: Thu Aug 18 22:36:13 2022 +0100 arm64/cache: Fix cache_type_cwg() for register generation Ard noticed that since we converted CTR_EL0 to automatic generation we have been seeing errors on some systems handling the value of cache_type_cwg() such as CPU features: No Cache Writeback Granule information, assuming 128 This is because the manual definition of CTR_EL0_CWG_MASK was done without a shift while our convention is to define the mask after shifting. This means that the user in cache_type_cwg() was broken as it was written for the manually written shift then mask. Fix this by converting to use SYS_FIELD_GET(). The only other field where the _MASK for this register is used is IminLine which is at offset 0 so unaffected. Fixes: 9a3634d02301 ("arm64/sysreg: Convert CTR_EL0 to automatic generation") Reported-by: Ard Biesheuvel Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220818213613.733091-4-broonie@kernel.org Signed-off-by: Will Deacon commit a10edea4efbba4e8756f493781e953dd3592f24a Author: Mark Brown Date: Thu Aug 18 22:36:12 2022 +0100 arm64/sysreg: Guard SYS_FIELD_ macros for asm The SYS_FIELD_ macros are not safe for assembly contexts, move them inside the guarded section. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220818213613.733091-3-broonie@kernel.org Signed-off-by: Will Deacon commit 02e483f8d414cc4f467389843d61b63bbbbcd892 Author: Mark Brown Date: Thu Aug 18 22:36:11 2022 +0100 arm64/sysreg: Directly include bitfield.h The SYS_FIELD_ macros in sysreg.h use definitions from bitfield.h but there is no direct inclusion of it, add one to ensure that sysreg.h is directly usable. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220818213613.733091-2-broonie@kernel.org Signed-off-by: Will Deacon commit e75d18cecbb3805895d8ed64da4f78575ec96043 Author: Sudeep Holla Date: Mon Aug 8 09:46:40 2022 +0100 arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon commit e89d120c4b720e232cc6a94f0fcbd59c15d41489 Author: Ionela Voinescu Date: Fri Aug 19 11:30:50 2022 +0100 arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly The AMU counter AMEVCNTR01 (constant counter) should increment at the same rate as the system counter. On affected Cortex-A510 cores, AMEVCNTR01 increments incorrectly giving a significantly higher output value. This results in inaccurate task scheduler utilization tracking and incorrect feedback on CPU frequency. Work around this problem by returning 0 when reading the affected counter in key locations that results in disabling all users of this counter from using it either for frequency invariance or as FFH reference counter. This effect is the same to firmware disabling affected counters. Details on how the two features are affected by this erratum: - AMU counters will not be used for frequency invariance for affected CPUs and CPUs in the same cpufreq policy. AMUs can still be used for frequency invariance for unaffected CPUs in the system. Although unlikely, if no alternative method can be found to support frequency invariance for affected CPUs (cpufreq based or solution based on platform counters) frequency invariance will be disabled. Please check the chapter on frequency invariance at Documentation/scheduler/sched-capacity.rst for details of its effect. - Given that FFH can be used to fetch either the core or constant counter values, restrictions are lifted regarding any of these counters returning a valid (!0) value. Therefore FFH is considered supported if there is a least one CPU that support AMUs, independent of any counters being disabled or affected by this erratum. Clarifying comments are now added to the cpc_ffh_supported(), cpu_read_constcnt() and cpu_read_corecnt() functions. The above is achieved through adding a new erratum: ARM64_ERRATUM_2457168. Signed-off-by: Ionela Voinescu Reviewed-by: Catalin Marinas Cc: Catalin Marinas Cc: Will Deacon Cc: James Morse Link: https://lore.kernel.org/r/20220819103050.24211-1-ionela.voinescu@arm.com Signed-off-by: Will Deacon commit 2e8cff0a0eee87b27f0cf87ad8310eb41b5886ab Author: Mark Rutland Date: Wed Aug 17 16:40:22 2022 +0100 arm64: fix rodata=full On arm64, "rodata=full" has been suppored (but not documented) since commit: c55191e96caa9d78 ("arm64: mm: apply r/o permissions of VM areas to its linear alias as well") As it's necessary to determine the rodata configuration early during boot, arm64 has an early_param() handler for this, whereas init/main.c has a __setup() handler which is run later. Unfortunately, this split meant that since commit: f9a40b0890658330 ("init/main.c: return 1 from handled __setup() functions") ... passing "rodata=full" would result in a spurious warning from the __setup() handler (though RO permissions would be configured appropriately). Further, "rodata=full" has been broken since commit: 0d6ea3ac94ca77c5 ("lib/kstrtox.c: add "false"/"true" support to kstrtobool()") ... which caused strtobool() to parse "full" as false (in addition to many other values not documented for the "rodata=" kernel parameter. This patch fixes this breakage by: * Moving the core parameter parser to an __early_param(), such that it is available early. * Adding an (optional) arch hook which arm64 can use to parse "full". * Updating the documentation to mention that "full" is valid for arm64. * Having the core parameter parser handle "on" and "off" explicitly, such that any undocumented values (e.g. typos such as "ful") are reported as errors rather than being silently accepted. Note that __setup() and early_param() have opposite conventions for their return values, where __setup() uses 1 to indicate a parameter was handled and early_param() uses 0 to indicate a parameter was handled. Fixes: f9a40b089065 ("init/main.c: return 1 from handled __setup() functions") Fixes: 0d6ea3ac94ca ("lib/kstrtox.c: add "false"/"true" support to kstrtobool()") Signed-off-by: Mark Rutland Cc: Andy Shevchenko Cc: Ard Biesheuvel Cc: Catalin Marinas Cc: Jagdish Gediya Cc: Matthew Wilcox Cc: Randy Dunlap Cc: Will Deacon Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220817154022.3974645-1-mark.rutland@arm.com Signed-off-by: Will Deacon commit 729a916599eaf13df66ae5404f5489f38518ea8c Author: Kuan-Ying Lee Date: Thu Jul 21 11:05:31 2022 +0800 arm64: Fix comment typo Replace wrong 'FIQ EL1h' comment with 'FIQ EL1t'. Signed-off-by: Kuan-Ying Lee Link: https://lore.kernel.org/r/20220721030531.21234-1-Kuan-Ying.Lee@mediatek.com Signed-off-by: Will Deacon commit 0b52f76351bf87f35b62195fca874b6055125bc6 Author: Martin Liška Date: Thu Aug 18 22:31:57 2022 +0200 docs/arm64: elf_hwcaps: unify newlines in HWCAP lists Unify horizontal spacing (remove extra newlines) which are sensitive to visual presentation by Sphinx. Fixes: 5e64b862c482 ("arm64/sme: Basic enumeration support") Signed-off-by: Martin Liska Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/84e3d6cc-75cf-d6f3-9bb8-be02075aaf6d@suse.cz Signed-off-by: Will Deacon commit a582123d6f4c6a0ae850864974eb7afd01fffab7 Merge: db7e5c10351e3 0096fc879358a Author: Greg Kroah-Hartman Date: Tue Aug 23 10:42:19 2022 +0200 Merge tag 'iio-fixes-for-6.0a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: "1st set of IIO fixes for 6.0-rc1 adi,ad7292 - Prevent duplicate disable of regulator in error path. bosch,bmg160 - Correct dt-binding to allow for 2 interrupt pins. capella,cm3605 - Fix missing error cleanup due to premature return. capella,cm32181 - Fix missing static on local symbol. microchip,mcp33911 - Correctly handle sign bit. - Fix mismatch between driver and DT binding, including fallback to old driver behavior. - Use correct formula for voltage calculation." * tag 'iio-fixes-for-6.0a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: light: cm32181: make cm32181_pm_ops static iio: ad7292: Prevent regulator double disable dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins iio: adc: mcp3911: use correct formula for AD conversion iio: adc: mcp3911: correct "microchip,device-addr" property iio: light: cm3605: Fix an error handling path in cm3605_probe() iio: adc: mcp3911: make use of the sign bit commit ba0803050d610d5072666be727bca5e03e55b242 Author: David Howells Date: Tue Aug 23 02:10:56 2022 -0500 smb3: missing inode locks in punch hole smb3 fallocate punch hole was not grabbing the inode or filemap_invalidate locks so could have race with pagemap reinstantiating the page. Cc: stable@vger.kernel.org Signed-off-by: David Howells Signed-off-by: Steve French commit b5a990209d72615e3cac2b3b0d8ddd445c020cf5 Author: Jilin Yuan Date: Fri Jul 8 23:15:38 2022 +0800 net/ieee802154: fix repeated words in comments Delete the redundant word 'was'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220708151538.51483-1-yuanjilin@cdjrlc.com Signed-off-by: Stefan Schmidt commit afe7116f6d3b888778ed6d95e3cf724767b9aedf Author: Lin Ma Date: Mon Aug 8 11:42:24 2022 +0800 ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronization. This patch takes the second option. Fixes: 58e9683d1475 ("net: ieee802154: adf7242: Fix OCL calibration runs") Signed-off-by: Lin Ma Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20220808034224.12642-1-linma@zju.edu.cn Signed-off-by: Stefan Schmidt commit 5f73aa2cf8bef4a39baa1591c3144ede4788826e Author: Takashi Iwai Date: Tue Aug 23 08:54:55 2022 +0200 Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") introduced a regression that caused NULL dereference at reading the power supply sysfs. It's a stale sysfs entry that should have been removed but remains with NULL ops. The commit changed the error handling to skip the entries after a NULL con->wq, and this leaves the power device unreleased. For addressing the regression, the straight revert is applied here. Further code improvements can be done from the scratch again. Link: https://bugzilla.suse.com/show_bug.cgi?id=1202386 Link: https://lore.kernel.org/r/87r11cmbx0.wl-tiwai@suse.de Fixes: 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") Cc: Acked-by: Heikki Krogerus Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220823065455.32579-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman commit e41a88f38d87f730647bb14df9211d32241d1176 Author: Johan Hovold Date: Mon Aug 22 12:05:50 2022 +0200 usb: dwc3: qcom: suppress unused-variable warning The dwc3_qcom_read_usb2_speed() helper is now only called when the controller is acting as host, but the compiler will warn that the hcd variable is unused in gadget-only W=1 builds. Fixes: c06795f114a6 ("usb: dwc3: qcom: fix gadget-only builds") Reported-by: kernel test robot Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220822100550.3039-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit c919c164fc87bcca8e80b3b9224492fa5b6455ba Author: David Howells Date: Tue Aug 23 01:01:36 2022 -0500 smb3: missing inode locks in zero range smb3 fallocate zero range was not grabbing the inode or filemap_invalidate locks so could have race with pagemap reinstantiating the page. Cc: stable@vger.kernel.org Signed-off-by: David Howells Signed-off-by: Steve French commit 4f3e509996a877dca1ddffc2abdbb5857727bfc4 Author: Lukas Bulwahn Date: Mon Aug 22 21:44:50 2022 -0700 MAINTAINERS: add include/dt-bindings/input to INPUT DRIVERS Maintainers of the directory Documentation/devicetree/bindings/input are also the maintainers of the corresponding directory include/dt-bindings/input. Add the file entry for include/dt-bindings/input to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220613115654.28117-1-lukas.bulwahn@gmail.com Signed-off-by: Dmitry Torokhov commit 785538bfdd682c8e962341d585f9b88262a0475e Author: Bart Van Assche Date: Tue Aug 16 10:26:38 2022 -0700 scsi: sd: Revert "Rework asynchronous resume support" Although commit 88f1669019bd ("scsi: sd: Rework asynchronous resume support") eliminates a delay for some ATA disks after resume, it causes resume of ATA disks to fail on other setups. See also: * "Resume process hangs for 5-6 seconds starting sometime in 5.16" (https://bugzilla.kernel.org/show_bug.cgi?id=215880). * Geert's regression report (https://lore.kernel.org/linux-scsi/alpine.DEB.2.22.394.2207191125130.1006766@ramsan.of.borg/). This is what I understand about this issue: * During resume, ata_port_pm_resume() starts the SCSI error handler. This changes the SCSI host state into SHOST_RECOVERY and causes scsi_queue_rq() to return BLK_STS_RESOURCE. * sd_resume() calls sd_start_stop_device() for ATA devices. That function in turn calls sd_submit_start() which tries to submit a START STOP UNIT command. That command can only be submitted after the SCSI error handler has changed the SCSI host state back to SHOST_RUNNING. * The SCSI error handler runs on its own thread and calls schedule_work(&(ap->scsi_rescan_task)). That causes ata_scsi_dev_rescan() to be called from the context of a kernel workqueue. That call hangs in blk_mq_get_tag(). I'm not sure why - maybe because all available tags have been allocated by sd_submit_start() calls (this is a guess). Link: https://lore.kernel.org/r/20220816172638.538734-1-bvanassche@acm.org Fixes: 88f1669019bd ("scsi: sd: Rework asynchronous resume support") Cc: Damien Le Moal Cc: Hannes Reinecke Cc: Geert Uytterhoeven Cc: gzhqyz@gmail.com Reported-by: Geert Uytterhoeven Reported-by: gzhqyz@gmail.com Reported-and-tested-by: Vlastimil Babka Tested-by: John Garry Tested-by: Hans de Goede Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 35f73cca1cecda0c1f8bb7d8be4ce5cd2d46ae8c Author: Stefan Wahren Date: Sat Jun 25 10:36:43 2022 +0200 clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate The function raspberrypi_fw_get_rate (e.g. used for the recalc_rate hook) can fail to get the clock rate from the firmware. In this case we cannot return a signed error value, which would be casted to unsigned long. Fix this by returning 0 instead. Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20220625083643.4012-1-stefan.wahren@i2se.com Fixes: 4e85e535e6cc ("clk: bcm283x: add driver interfacing with Raspberry Pi's firmware") Acked-by: Florian Fainelli Signed-off-by: Stephen Boyd commit 9b1ac04698a4bfec146322502cdcd9904c1777fa Author: Kajol Jain Date: Thu Aug 4 13:18:52 2022 +0530 powerpc/papr_scm: Fix nvdimm event mappings Commit 4c08d4bbc089 ("powerpc/papr_scm: Add perf interface support") added performance monitoring support for papr-scm nvdimm devices via perf interface. Commit also added an array in papr_scm_priv structure called "nvdimm_events_map", which got filled based on the result of H_SCM_PERFORMANCE_STATS hcall. Currently there is an assumption that the order of events in the stats buffer, returned by the hypervisor is same. And order also happens to matches with the events specified in nvdimm driver code. But this assumption is not documented in Power Architecture Platform Requirements (PAPR) document. Although the order of events happens to be same on current generation od system, but it might not be true in future generation systems. Fix the issue, by adding a static mapping for nvdimm events to corresponding stat-id, and removing the dynamic map from papr_scm_priv structure. Also remove the function papr_scm_pmu_check_events from papr_scm.c file, as we no longer need to copy stat-ids dynamically. Fixes: 4c08d4bbc089 ("powerpc/papr_scm: Add perf interface support") Reported-by: Aneesh Kumar K.V Signed-off-by: Kajol Jain Reviewed-by: Vaibhav Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220804074852.55157-1-kjain@linux.ibm.com commit 5003e52c311a2135d737ae906577c639fbaafe54 Merge: 0ee7828dfc56e f2e44dffa97f2 Author: Jakub Kicinski Date: Mon Aug 22 18:30:27 2022 -0700 Merge branch 'bonding-802-3ad-fix-no-transmission-of-lacpdus' Jonathan Toppins says: ==================== bonding: 802.3ad: fix no transmission of LACPDUs Configuring a bond in a specific order can leave the bond in a state where it never transmits LACPDUs. The first patch adds some kselftest infrastructure and the reproducer that demonstrates the problem. The second patch fixes the issue. The new third patch makes ad_ticks_per_sec a static const and removes the passing of this variable via the stack. ==================== Link: https://lore.kernel.org/r/cover.1660919940.git.jtoppins@redhat.com Signed-off-by: Jakub Kicinski commit f2e44dffa97f2e1c222a959ea5b6e604548b891b Author: Jonathan Toppins Date: Fri Aug 19 11:15:14 2022 -0400 bonding: 3ad: make ad_ticks_per_sec a const The value is only ever set once in bond_3ad_initialize and only ever read otherwise. There seems to be no reason to set the variable via bond_3ad_initialize when setting the global variable will do. Change ad_ticks_per_sec to a const to enforce its read-only usage. Signed-off-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit d745b5062ad2b5da90a5e728d7ca884fc07315fd Author: Jonathan Toppins Date: Fri Aug 19 11:15:13 2022 -0400 bonding: 802.3ad: fix no transmission of LACPDUs This is caused by the global variable ad_ticks_per_sec being zero as demonstrated by the reproducer script discussed below. This causes all timer values in __ad_timer_to_ticks to be zero, resulting in the periodic timer to never fire. To reproduce: Run the script in `tools/testing/selftests/drivers/net/bonding/bond-break-lacpdu-tx.sh` which puts bonding into a state where it never transmits LACPDUs. line 44: ip link add fbond type bond mode 4 miimon 200 \ xmit_hash_policy 1 ad_actor_sys_prio 65535 lacp_rate fast setting bond param: ad_actor_sys_prio given: params.ad_actor_system = 0 call stack: bond_option_ad_actor_sys_prio() -> bond_3ad_update_ad_actor_settings() -> set ad.system.sys_priority = bond->params.ad_actor_sys_prio -> ad.system.sys_mac_addr = bond->dev->dev_addr; because params.ad_actor_system == 0 results: ad.system.sys_mac_addr = bond->dev->dev_addr line 48: ip link set fbond address 52:54:00:3B:7C:A6 setting bond MAC addr call stack: bond->dev->dev_addr = new_mac line 52: ip link set fbond type bond ad_actor_sys_prio 65535 setting bond param: ad_actor_sys_prio given: params.ad_actor_system = 0 call stack: bond_option_ad_actor_sys_prio() -> bond_3ad_update_ad_actor_settings() -> set ad.system.sys_priority = bond->params.ad_actor_sys_prio -> ad.system.sys_mac_addr = bond->dev->dev_addr; because params.ad_actor_system == 0 results: ad.system.sys_mac_addr = bond->dev->dev_addr line 60: ip link set veth1-bond down master fbond given: params.ad_actor_system = 0 params.mode = BOND_MODE_8023AD ad.system.sys_mac_addr == bond->dev->dev_addr call stack: bond_enslave -> bond_3ad_initialize(); because first slave -> if ad.system.sys_mac_addr != bond->dev->dev_addr return results: Nothing is run in bond_3ad_initialize() because dev_addr equals sys_mac_addr leaving the global ad_ticks_per_sec zero as it is never initialized anywhere else. The if check around the contents of bond_3ad_initialize() is no longer needed due to commit 5ee14e6d336f ("bonding: 3ad: apply ad_actor settings changes immediately") which sets ad.system.sys_mac_addr if any one of the bonding parameters whos set function calls bond_3ad_update_ad_actor_settings(). This is because if ad.system.sys_mac_addr is zero it will be set to the current bond mac address, this causes the if check to never be true. Fixes: 5ee14e6d336f ("bonding: 3ad: apply ad_actor settings changes immediately") Signed-off-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit c078290a2b7618473a7d0a05334cc91fe0ac2949 Author: Jonathan Toppins Date: Fri Aug 19 11:15:12 2022 -0400 selftests: include bonding tests into the kselftest infra This creates a test collection in drivers/net/bonding for bonding specific kernel selftests. The first test is a reproducer that provisions a bond and given the specific order in how the ip-link(8) commands are issued the bond never transmits an LACPDU frame on any of its slaves. Signed-off-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit 0ee7828dfc56e97d71e51e6374dc7b4eb2b6e081 Author: Sergei Antonov Date: Fri Aug 19 14:05:19 2022 +0300 net: moxa: get rid of asymmetry in DMA mapping/unmapping Since priv->rx_mapping[i] is maped in moxart_mac_open(), we should unmap it from moxart_mac_stop(). Fixes 2 warnings. 1. During error unwinding in moxart_mac_probe(): "goto init_fail;", then moxart_mac_free_memory() calls dma_unmap_single() with priv->rx_mapping[i] pointers zeroed. WARNING: CPU: 0 PID: 1 at kernel/dma/debug.c:963 check_unmap+0x704/0x980 DMA-API: moxart-ethernet 92000000.mac: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=1600 bytes] CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0+ #60 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0xbc/0x1f0 __warn from warn_slowpath_fmt+0x94/0xc8 warn_slowpath_fmt from check_unmap+0x704/0x980 check_unmap from debug_dma_unmap_page+0x8c/0x9c debug_dma_unmap_page from moxart_mac_free_memory+0x3c/0xa8 moxart_mac_free_memory from moxart_mac_probe+0x190/0x218 moxart_mac_probe from platform_probe+0x48/0x88 platform_probe from really_probe+0xc0/0x2e4 2. After commands: ip link set dev eth0 down ip link set dev eth0 up WARNING: CPU: 0 PID: 55 at kernel/dma/debug.c:570 add_dma_entry+0x204/0x2ec DMA-API: moxart-ethernet 92000000.mac: cacheline tracking EEXIST, overlapping mappings aren't supported CPU: 0 PID: 55 Comm: ip Not tainted 5.19.0+ #57 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0xbc/0x1f0 __warn from warn_slowpath_fmt+0x94/0xc8 warn_slowpath_fmt from add_dma_entry+0x204/0x2ec add_dma_entry from dma_map_page_attrs+0x110/0x328 dma_map_page_attrs from moxart_mac_open+0x134/0x320 moxart_mac_open from __dev_open+0x11c/0x1ec __dev_open from __dev_change_flags+0x194/0x22c __dev_change_flags from dev_change_flags+0x14/0x44 dev_change_flags from devinet_ioctl+0x6d4/0x93c devinet_ioctl from inet_ioctl+0x1ac/0x25c v1 -> v2: Extraneous change removed. Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") Signed-off-by: Sergei Antonov Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220819110519.1230877-1-saproj@gmail.com Signed-off-by: Jakub Kicinski commit 6dbe852c379ff032a70a6b13a91914918c82cb07 Author: Xiaolei Wang Date: Fri Aug 19 16:24:51 2022 +0800 net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume() For some MAC drivers, they set the mac_managed_pm to true in its ->ndo_open() callback. So before the mac_managed_pm is set to true, we still want to leverage the mdio_bus_phy_suspend()/resume() for the phy device suspend and resume. In this case, the phy device is in PHY_READY, and we shouldn't warn about this. It also seems that the check of mac_managed_pm in WARN_ON is redundant since we already check this in the entry of mdio_bus_phy_resume(), so drop it. Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") Signed-off-by: Xiaolei Wang Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220819082451.1992102-1-xiaolei.wang@windriver.com Signed-off-by: Jakub Kicinski commit b8d4380365c515d8e0351f2f46d371738dd19be1 Author: Alex Elder Date: Thu Aug 18 08:42:05 2022 -0500 net: ipa: don't assume SMEM is page-aligned In ipa_smem_init(), a Qualcomm SMEM region is allocated (if needed) and then its virtual address is fetched using qcom_smem_get(). The physical address associated with that region is also fetched. The physical address is adjusted so that it is page-aligned, and an attempt is made to update the size of the region to compensate for any non-zero adjustment. But that adjustment isn't done properly. The physical address is aligned twice, and as a result the size is never actually adjusted. Fix this by *not* aligning the "addr" local variable, and instead making the "phys" local variable be the adjusted "addr" value. Fixes: a0036bb413d5b ("net: ipa: define SMEM memory region for IPA") Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20220818134206.567618-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 5fbb08eb7f945c7e8896ea39f03143ce66dfa4c7 Author: Vladimir Oltean Date: Thu Aug 18 17:32:50 2022 +0300 net: dsa: microchip: keep compatibility with device tree blobs with no phy-mode DSA has multiple ways of specifying a MAC connection to an internal PHY. One requires a DT description like this: port@0 { reg = <0>; phy-handle = <&internal_phy>; phy-mode = "internal"; }; (which is IMO the recommended approach, as it is the clearest description) but it is also possible to leave the specification as just: port@0 { reg = <0>; } and if the driver implements ds->ops->phy_read and ds->ops->phy_write, the DSA framework "knows" it should create a ds->slave_mii_bus, and it should connect to a non-OF-based internal PHY on this MDIO bus, at an MDIO address equal to the port address. There is also an intermediary way of describing things: port@0 { reg = <0>; phy-handle = <&internal_phy>; }; In case 2, DSA calls phylink_connect_phy() and in case 3, it calls phylink_of_phy_connect(). In both cases, phylink_create() has been called with a phy_interface_t of PHY_INTERFACE_MODE_NA, and in both cases, PHY_INTERFACE_MODE_NA is translated into phy->interface. It is important to note that phy_device_create() initializes dev->interface = PHY_INTERFACE_MODE_GMII, and so, when we use phylink_create(PHY_INTERFACE_MODE_NA), no one will override this, and we will end up with a PHY_INTERFACE_MODE_GMII interface inherited from the PHY. All this means that in order to maintain compatibility with device tree blobs where the phy-mode property is missing, we need to allow the "gmii" phy-mode and treat it as "internal". Fixes: 2c709e0bdad4 ("net: dsa: microchip: ksz8795: add phylink support") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216320 Reported-by: Craig McQueen Signed-off-by: Vladimir Oltean Reviewed-by: Alvin Šipraga Tested-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20220818143250.2797111-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 99077ad668ddd9b4823cc8ce3f3c7a3fc56f6fd9 Author: Peter Robinson Date: Mon Aug 22 16:33:18 2022 -0700 Input: rk805-pwrkey - fix module autoloading Add the module alias so the rk805-pwrkey driver will autoload when built as a module. Fixes: 5a35b85c2d92 ("Input: add power key driver for Rockchip RK805 PMIC") Signed-off-by: Peter Robinson Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20220612225437.3628788-1-pbrobinson@gmail.com Signed-off-by: Dmitry Torokhov commit 1d9e325793db26a5f816cdc54346eeaed2af31a3 Merge: 072e51356cd5a 9c80e79906b4c Author: Andrew Morton Date: Mon Aug 22 16:53:21 2022 -0700 Merge branch 'mm-hotfixes-stable' commit 4b592061f7b3971c70e8b72fc42aaead47c24701 Author: Chen-Yu Tsai Date: Mon Aug 22 16:14:24 2022 +0800 clk: core: Fix runtime PM sequence in clk_core_unprepare() In the original commit 9a34b45397e5 ("clk: Add support for runtime PM"), the commit message mentioned that pm_runtime_put_sync() would be done at the end of clk_core_unprepare(). This mirrors the operations in clk_core_prepare() in the opposite order. However, the actual code that was added wasn't in the order the commit message described. Move clk_pm_runtime_put() to the end of clk_core_unprepare() so that it is in the correct order. Fixes: 9a34b45397e5 ("clk: Add support for runtime PM") Signed-off-by: Chen-Yu Tsai Reviewed-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/r/20220822081424.1310926-3-wenst@chromium.org Signed-off-by: Stephen Boyd commit 35b0fac808b95eea1212f8860baf6ad25b88b087 Author: Chen-Yu Tsai Date: Mon Aug 22 16:14:23 2022 +0800 clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops In the previous commits that added CLK_OPS_PARENT_ENABLE, support for this flag was only added to rate change operations (rate setting and reparent) and disabling unused subtree. It was not added to the clock gate related operations. Any hardware driver that needs it for these operations will either see bogus results, or worse, hang. This has been seen on MT8192 and MT8195, where the imp_ii2_* clk drivers set this, but dumping debugfs clk_summary would cause it to hang. Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enable (part 2)") Fixes: a4b3518d146f ("clk: core: support clocks which requires parents enable (part 1)") Signed-off-by: Chen-Yu Tsai Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/r/20220822081424.1310926-2-wenst@chromium.org Signed-off-by: Stephen Boyd commit ad982c3be4e60c7d39c03f782733503cbd88fd2a Author: Gaosheng Cui Date: Mon Aug 22 10:29:05 2022 +0800 audit: fix potential double free on error path from fsnotify_add_inode_mark Audit_alloc_mark() assign pathname to audit_mark->path, on error path from fsnotify_add_inode_mark(), fsnotify_put_mark will free memory of audit_mark->path, but the caller of audit_alloc_mark will free the pathname again, so there will be double free problem. Fix this by resetting audit_mark->path to NULL pointer on error path from fsnotify_add_inode_mark(). Cc: stable@vger.kernel.org Fixes: 7b1293234084d ("fsnotify: Add group pointer in fsnotify_init_mark()") Signed-off-by: Gaosheng Cui Reviewed-by: Jan Kara Signed-off-by: Paul Moore commit 35419025cb1ee40f8b4c10ab7dbe567ef70b8da4 Author: Dan Carpenter Date: Thu Aug 4 17:39:31 2022 +0300 net/mlx5: Unlock on error in mlx5_sriov_enable() Unlock before returning if mlx5_device_enable_sriov() fails. Fixes: 84a433a40d0e ("net/mlx5: Lock mlx5 devlink reload callbacks") Signed-off-by: Dan Carpenter Signed-off-by: Saeed Mahameed commit 21234e3a84c70f27ea106411bdd5ef7af17508a6 Author: Dan Carpenter Date: Thu Aug 4 17:43:21 2022 +0300 net/mlx5e: Fix use after free in mlx5e_fs_init() Call mlx5e_fs_vlan_free(fs) before kvfree(fs). Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") Signed-off-by: Dan Carpenter Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 6514210b6d0dc36352fda86b71f80f9a9ed4f677 Author: Dan Carpenter Date: Thu Aug 4 17:44:07 2022 +0300 net/mlx5e: kTLS, Use _safe() iterator in mlx5e_tls_priv_tx_list_cleanup() Use the list_for_each_entry_safe() macro to prevent dereferencing "obj" after it has been freed. Fixes: c4dfe704f53f ("net/mlx5e: kTLS, Recycle objects of device-offloaded TLS TX connections") Signed-off-by: Dan Carpenter Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit b868c8fe37bd15def1a8dd0b1f30fca9087e499a Author: Dan Carpenter Date: Fri Jul 15 11:27:03 2022 +0300 net/mlx5: unlock on error path in esw_vfs_changed_event_handler() Unlock before returning on this error path. Fixes: f1bc646c9a06 ("net/mlx5: Use devl_ API in mlx5_esw_offloads_devlink_port_register") Signed-off-by: Dan Carpenter Signed-off-by: Saeed Mahameed commit 550f96432e6f6770efdaee0e65239d61431062a1 Author: Maor Dickman Date: Thu Aug 4 15:28:42 2022 +0300 net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off The cited commit reintroduced the ability to set hw-tc-offload in switchdev mode by reusing NIC mode calls without modifying it to support both modes, this can cause an illegal memory access when trying to turn hw-tc-offload off. Fix this by using the right TC_FLAG when checking if tc rules are installed while disabling hw-tc-offload. Fixes: d3cbd4254df8 ("net/mlx5e: Add ndo_set_feature for uplink representor") Signed-off-by: Maor Dickman Signed-off-by: Saeed Mahameed commit f7a4e867f48c2e03ab6a237c06ab923d80aeeeb1 Author: Roi Dayan Date: Mon Aug 1 18:02:49 2022 +0300 net/mlx5e: TC, Add missing policer validation There is a missing policer validation when offloading police action with tc action api. Add it. Fixes: 7d1a5ce46e47 ("net/mlx5e: TC, Support tc action api for police") Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 7b3707fc79044871ab8f3d5fa5e9603155bb5577 Author: Aya Levin Date: Wed Jun 8 18:38:37 2022 +0300 net/mlx5e: Fix wrong application of the LRO state Driver caches packet merge type in mlx5e_params instance which must be in perfect sync with the netdev_feature's bit. Prior to this patch, in certain conditions (*) LRO state was set in mlx5e_params, while netdev_feature's bit was off. Causing the LRO to be applied on the RQs (HW level). (*) This can happen only on profile init (mlx5e_build_nic_params()), when RQ expect non-linear SKB and PCI is fast enough in comparison to link width. Solution: remove setting of packet merge type from mlx5e_build_nic_params() as netdev features are not updated. Fixes: 619a8f2a42f1 ("net/mlx5e: Use linear SKB in Striding RQ") Signed-off-by: Aya Levin Reviewed-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit d59b73a66e5e0682442b6d7b4965364e57078b80 Author: Moshe Shemesh Date: Wed Aug 3 10:49:23 2022 +0300 net/mlx5: Avoid false positive lockdep warning by adding lock_class_key Add a lock_class_key per mlx5 device to avoid a false positive "possible circular locking dependency" warning by lockdep, on flows which lock more than one mlx5 device, such as adding SF. kernel log: ====================================================== WARNING: possible circular locking dependency detected 5.19.0-rc8+ #2 Not tainted ------------------------------------------------------ kworker/u20:0/8 is trying to acquire lock: ffff88812dfe0d98 (&dev->intf_state_mutex){+.+.}-{3:3}, at: mlx5_init_one+0x2e/0x490 [mlx5_core] but task is already holding lock: ffff888101aa7898 (&(¬ifier->n_head)->rwsem){++++}-{3:3}, at: blocking_notifier_call_chain+0x5a/0x130 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&(¬ifier->n_head)->rwsem){++++}-{3:3}: down_write+0x90/0x150 blocking_notifier_chain_register+0x53/0xa0 mlx5_sf_table_init+0x369/0x4a0 [mlx5_core] mlx5_init_one+0x261/0x490 [mlx5_core] probe_one+0x430/0x680 [mlx5_core] local_pci_probe+0xd6/0x170 work_for_cpu_fn+0x4e/0xa0 process_one_work+0x7c2/0x1340 worker_thread+0x6f6/0xec0 kthread+0x28f/0x330 ret_from_fork+0x1f/0x30 -> #0 (&dev->intf_state_mutex){+.+.}-{3:3}: __lock_acquire+0x2fc7/0x6720 lock_acquire+0x1c1/0x550 __mutex_lock+0x12c/0x14b0 mlx5_init_one+0x2e/0x490 [mlx5_core] mlx5_sf_dev_probe+0x29c/0x370 [mlx5_core] auxiliary_bus_probe+0x9d/0xe0 really_probe+0x1e0/0xaa0 __driver_probe_device+0x219/0x480 driver_probe_device+0x49/0x130 __device_attach_driver+0x1b8/0x280 bus_for_each_drv+0x123/0x1a0 __device_attach+0x1a3/0x460 bus_probe_device+0x1a2/0x260 device_add+0x9b1/0x1b40 __auxiliary_device_add+0x88/0xc0 mlx5_sf_dev_state_change_handler+0x67e/0x9d0 [mlx5_core] blocking_notifier_call_chain+0xd5/0x130 mlx5_vhca_state_work_handler+0x2b0/0x3f0 [mlx5_core] process_one_work+0x7c2/0x1340 worker_thread+0x59d/0xec0 kthread+0x28f/0x330 ret_from_fork+0x1f/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&(¬ifier->n_head)->rwsem); lock(&dev->intf_state_mutex); lock(&(¬ifier->n_head)->rwsem); lock(&dev->intf_state_mutex); *** DEADLOCK *** 4 locks held by kworker/u20:0/8: #0: ffff888150612938 ((wq_completion)mlx5_events){+.+.}-{0:0}, at: process_one_work+0x6e2/0x1340 #1: ffff888100cafdb8 ((work_completion)(&work->work)#3){+.+.}-{0:0}, at: process_one_work+0x70f/0x1340 #2: ffff888101aa7898 (&(¬ifier->n_head)->rwsem){++++}-{3:3}, at: blocking_notifier_call_chain+0x5a/0x130 #3: ffff88813682d0e8 (&dev->mutex){....}-{3:3}, at:__device_attach+0x76/0x460 stack backtrace: CPU: 6 PID: 8 Comm: kworker/u20:0 Not tainted 5.19.0-rc8+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_events mlx5_vhca_state_work_handler [mlx5_core] Call Trace: dump_stack_lvl+0x57/0x7d check_noncircular+0x278/0x300 ? print_circular_bug+0x460/0x460 ? lock_chain_count+0x20/0x20 ? register_lock_class+0x1880/0x1880 __lock_acquire+0x2fc7/0x6720 ? register_lock_class+0x1880/0x1880 ? register_lock_class+0x1880/0x1880 lock_acquire+0x1c1/0x550 ? mlx5_init_one+0x2e/0x490 [mlx5_core] ? lockdep_hardirqs_on_prepare+0x400/0x400 __mutex_lock+0x12c/0x14b0 ? mlx5_init_one+0x2e/0x490 [mlx5_core] ? mlx5_init_one+0x2e/0x490 [mlx5_core] ? _raw_read_unlock+0x1f/0x30 ? mutex_lock_io_nested+0x1320/0x1320 ? __ioremap_caller.constprop.0+0x306/0x490 ? mlx5_sf_dev_probe+0x269/0x370 [mlx5_core] ? iounmap+0x160/0x160 mlx5_init_one+0x2e/0x490 [mlx5_core] mlx5_sf_dev_probe+0x29c/0x370 [mlx5_core] ? mlx5_sf_dev_remove+0x130/0x130 [mlx5_core] auxiliary_bus_probe+0x9d/0xe0 really_probe+0x1e0/0xaa0 __driver_probe_device+0x219/0x480 ? auxiliary_match_id+0xe9/0x140 driver_probe_device+0x49/0x130 __device_attach_driver+0x1b8/0x280 ? driver_allows_async_probing+0x140/0x140 bus_for_each_drv+0x123/0x1a0 ? bus_for_each_dev+0x1a0/0x1a0 ? lockdep_hardirqs_on_prepare+0x286/0x400 ? trace_hardirqs_on+0x2d/0x100 __device_attach+0x1a3/0x460 ? device_driver_attach+0x1e0/0x1e0 ? kobject_uevent_env+0x22d/0xf10 bus_probe_device+0x1a2/0x260 device_add+0x9b1/0x1b40 ? dev_set_name+0xab/0xe0 ? __fw_devlink_link_to_suppliers+0x260/0x260 ? memset+0x20/0x40 ? lockdep_init_map_type+0x21a/0x7d0 __auxiliary_device_add+0x88/0xc0 ? auxiliary_device_init+0x86/0xa0 mlx5_sf_dev_state_change_handler+0x67e/0x9d0 [mlx5_core] blocking_notifier_call_chain+0xd5/0x130 mlx5_vhca_state_work_handler+0x2b0/0x3f0 [mlx5_core] ? mlx5_vhca_event_arm+0x100/0x100 [mlx5_core] ? lock_downgrade+0x6e0/0x6e0 ? lockdep_hardirqs_on_prepare+0x286/0x400 process_one_work+0x7c2/0x1340 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? pwq_dec_nr_in_flight+0x230/0x230 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x59d/0xec0 ? process_one_work+0x1340/0x1340 kthread+0x28f/0x330 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Fixes: 6a3273217469 ("net/mlx5: SF, Port function state change support") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 090f3e4f4089ab8041ed7d632c7851c2a42fcc10 Author: Roy Novich Date: Wed Mar 30 17:59:27 2022 +0300 net/mlx5: Fix cmd error logging for manage pages cmd When the driver unloads, give/reclaim_pages may fail as PF driver in teardown flow, current code will lead to the following kernel log print 'failed reclaiming pages: err 0'. Fix it to get same behavior as before the cited commits, by calling mlx5_cmd_check before handling error state. mlx5_cmd_check will verify if the returned error is an actual error needed to be handled by the driver or not and will return an appropriate value. Fixes: 8d564292a166 ("net/mlx5: Remove redundant error on reclaim pages") Fixes: 4dac2f10ada0 ("net/mlx5: Remove redundant notify fail on give pages") Signed-off-by: Roy Novich Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 8e93f29422ffe968d7161f91acdf0d47f5323727 Author: Vlad Buslov Date: Thu Aug 11 13:46:36 2022 +0200 net/mlx5: Disable irq when locking lag_lock The lag_lock is taken from both process and softirq contexts which results lockdep warning[0] about potential deadlock. However, just disabling softirqs by using *_bh spinlock API is not enough since it will cause warning in some contexts where the lock is obtained with hard irqs disabled. To fix the issue save current irq state, disable them before obtaining the lock an re-enable irqs from saved state after releasing it. [0]: [Sun Aug 7 13:12:29 2022] ================================ [Sun Aug 7 13:12:29 2022] WARNING: inconsistent lock state [Sun Aug 7 13:12:29 2022] 5.19.0_for_upstream_debug_2022_08_04_16_06 #1 Not tainted [Sun Aug 7 13:12:29 2022] -------------------------------- [Sun Aug 7 13:12:29 2022] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [Sun Aug 7 13:12:29 2022] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes: [Sun Aug 7 13:12:29 2022] ffffffffa06dc0d8 (lag_lock){+.?.}-{2:2}, at: mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] [Sun Aug 7 13:12:29 2022] {SOFTIRQ-ON-W} state was registered at: [Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550 [Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40 [Sun Aug 7 13:12:29 2022] mlx5_lag_add_netdev+0x13b/0x480 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5e_nic_enable+0x114/0x470 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5e_attach_netdev+0x30e/0x6a0 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5e_resume+0x105/0x160 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5e_probe+0xac3/0x14f0 [mlx5_core] [Sun Aug 7 13:12:29 2022] auxiliary_bus_probe+0x9d/0xe0 [Sun Aug 7 13:12:29 2022] really_probe+0x1e0/0xaa0 [Sun Aug 7 13:12:29 2022] __driver_probe_device+0x219/0x480 [Sun Aug 7 13:12:29 2022] driver_probe_device+0x49/0x130 [Sun Aug 7 13:12:29 2022] __driver_attach+0x1e4/0x4d0 [Sun Aug 7 13:12:29 2022] bus_for_each_dev+0x11e/0x1a0 [Sun Aug 7 13:12:29 2022] bus_add_driver+0x3f4/0x5a0 [Sun Aug 7 13:12:29 2022] driver_register+0x20f/0x390 [Sun Aug 7 13:12:29 2022] __auxiliary_driver_register+0x14e/0x260 [Sun Aug 7 13:12:29 2022] mlx5e_init+0x38/0x90 [mlx5_core] [Sun Aug 7 13:12:29 2022] vhost_iotlb_itree_augment_rotate+0xcb/0x180 [vhost_iotlb] [Sun Aug 7 13:12:29 2022] do_one_initcall+0xc4/0x400 [Sun Aug 7 13:12:29 2022] do_init_module+0x18a/0x620 [Sun Aug 7 13:12:29 2022] load_module+0x563a/0x7040 [Sun Aug 7 13:12:29 2022] __do_sys_finit_module+0x122/0x1d0 [Sun Aug 7 13:12:29 2022] do_syscall_64+0x3d/0x90 [Sun Aug 7 13:12:29 2022] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [Sun Aug 7 13:12:29 2022] irq event stamp: 3596508 [Sun Aug 7 13:12:29 2022] hardirqs last enabled at (3596508): [] __local_bh_enable_ip+0xa2/0x100 [Sun Aug 7 13:12:29 2022] hardirqs last disabled at (3596507): [] __local_bh_enable_ip+0xba/0x100 [Sun Aug 7 13:12:29 2022] softirqs last enabled at (3596488): [] irq_exit_rcu+0x11a/0x170 [Sun Aug 7 13:12:29 2022] softirqs last disabled at (3596495): [] irq_exit_rcu+0x11a/0x170 [Sun Aug 7 13:12:29 2022] other info that might help us debug this: [Sun Aug 7 13:12:29 2022] Possible unsafe locking scenario: [Sun Aug 7 13:12:29 2022] CPU0 [Sun Aug 7 13:12:29 2022] ---- [Sun Aug 7 13:12:29 2022] lock(lag_lock); [Sun Aug 7 13:12:29 2022] [Sun Aug 7 13:12:29 2022] lock(lag_lock); [Sun Aug 7 13:12:29 2022] *** DEADLOCK *** [Sun Aug 7 13:12:29 2022] 4 locks held by swapper/0/0: [Sun Aug 7 13:12:29 2022] #0: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: mlx5e_napi_poll+0x43/0x20a0 [mlx5_core] [Sun Aug 7 13:12:29 2022] #1: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_list_internal+0x2d7/0xd60 [Sun Aug 7 13:12:29 2022] #2: ffff888144a18b58 (&br->hash_lock){+.-.}-{2:2}, at: br_fdb_update+0x301/0x570 [Sun Aug 7 13:12:29 2022] #3: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: atomic_notifier_call_chain+0x5/0x1d0 [Sun Aug 7 13:12:29 2022] stack backtrace: [Sun Aug 7 13:12:29 2022] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0_for_upstream_debug_2022_08_04_16_06 #1 [Sun Aug 7 13:12:29 2022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [Sun Aug 7 13:12:29 2022] Call Trace: [Sun Aug 7 13:12:29 2022] [Sun Aug 7 13:12:29 2022] dump_stack_lvl+0x57/0x7d [Sun Aug 7 13:12:29 2022] mark_lock.part.0.cold+0x5f/0x92 [Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? unwind_next_frame+0x1c4/0x1b50 [Sun Aug 7 13:12:29 2022] ? secondary_startup_64_no_verify+0xcd/0xdb [Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? stack_access_ok+0x1d0/0x1d0 [Sun Aug 7 13:12:29 2022] ? start_kernel+0x3a7/0x3c5 [Sun Aug 7 13:12:29 2022] __lock_acquire+0x1260/0x6720 [Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 [Sun Aug 7 13:12:29 2022] ? mark_lock.part.0+0xed/0x3060 [Sun Aug 7 13:12:29 2022] ? stack_trace_save+0x91/0xc0 [Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550 [Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x400/0x400 [Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 [Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40 [Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] [Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_rep_vport_num_vhca_id_get+0x1a0/0x600 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_update_work+0x90/0x90 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550 [Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_switchdev_event+0x185/0x8f0 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_port_obj_attr_set+0x3e0/0x3e0 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 [Sun Aug 7 13:12:29 2022] atomic_notifier_call_chain+0xd7/0x1d0 [Sun Aug 7 13:12:29 2022] br_switchdev_fdb_notify+0xea/0x100 [Sun Aug 7 13:12:29 2022] ? br_switchdev_set_port_flag+0x310/0x310 [Sun Aug 7 13:12:29 2022] fdb_notify+0x11b/0x150 [Sun Aug 7 13:12:29 2022] br_fdb_update+0x34c/0x570 [Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? br_fdb_add_local+0x50/0x50 [Sun Aug 7 13:12:29 2022] ? br_allowed_ingress+0x5f/0x1070 [Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 [Sun Aug 7 13:12:29 2022] br_handle_frame_finish+0x786/0x18e0 [Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 [Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 [Sun Aug 7 13:12:29 2022] ? sctp_inet_bind_verify+0x4d/0x190 [Sun Aug 7 13:12:29 2022] ? xlog_unpack_data+0x2e0/0x310 [Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 [Sun Aug 7 13:12:29 2022] br_nf_hook_thresh+0x227/0x380 [br_netfilter] [Sun Aug 7 13:12:29 2022] ? setup_pre_routing+0x460/0x460 [br_netfilter] [Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing_ipv6+0x48b/0x69c [br_netfilter] [Sun Aug 7 13:12:29 2022] br_nf_pre_routing_finish_ipv6+0x5c2/0xbf0 [br_netfilter] [Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 [Sun Aug 7 13:12:29 2022] br_nf_pre_routing_ipv6+0x4c6/0x69c [br_netfilter] [Sun Aug 7 13:12:29 2022] ? br_validate_ipv6+0x9e0/0x9e0 [br_netfilter] [Sun Aug 7 13:12:29 2022] ? br_nf_forward_arp+0xb70/0xb70 [br_netfilter] [Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing+0xacf/0x1160 [br_netfilter] [Sun Aug 7 13:12:29 2022] br_handle_frame+0x8a9/0x1270 [Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0 [Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 [Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 [Sun Aug 7 13:12:29 2022] ? bond_handle_frame+0xf9/0xac0 [bonding] [Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0 [Sun Aug 7 13:12:29 2022] __netif_receive_skb_core+0x7c0/0x2c70 [Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 [Sun Aug 7 13:12:29 2022] ? generic_xdp_tx+0x5b0/0x5b0 [Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 [Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 [Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 [Sun Aug 7 13:12:29 2022] __netif_receive_skb_list_core+0x2d7/0x8a0 [Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550 [Sun Aug 7 13:12:29 2022] ? process_backlog+0x960/0x960 [Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x129/0x400 [Sun Aug 7 13:12:29 2022] ? kvm_clock_get_cycles+0x14/0x20 [Sun Aug 7 13:12:29 2022] netif_receive_skb_list_internal+0x5f4/0xd60 [Sun Aug 7 13:12:29 2022] ? do_xdp_generic+0x150/0x150 [Sun Aug 7 13:12:29 2022] ? mlx5e_poll_rx_cq+0xf6b/0x2960 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? mlx5e_poll_ico_cq+0x3d/0x1590 [mlx5_core] [Sun Aug 7 13:12:29 2022] napi_complete_done+0x188/0x710 [Sun Aug 7 13:12:29 2022] mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] [Sun Aug 7 13:12:29 2022] ? __queue_work+0x53c/0xeb0 [Sun Aug 7 13:12:29 2022] __napi_poll+0x9f/0x540 [Sun Aug 7 13:12:29 2022] net_rx_action+0x420/0xb70 [Sun Aug 7 13:12:29 2022] ? napi_threaded_poll+0x470/0x470 [Sun Aug 7 13:12:29 2022] ? __common_interrupt+0x79/0x1a0 [Sun Aug 7 13:12:29 2022] __do_softirq+0x271/0x92c [Sun Aug 7 13:12:29 2022] irq_exit_rcu+0x11a/0x170 [Sun Aug 7 13:12:29 2022] common_interrupt+0x7d/0xa0 [Sun Aug 7 13:12:29 2022] [Sun Aug 7 13:12:29 2022] [Sun Aug 7 13:12:29 2022] asm_common_interrupt+0x22/0x40 [Sun Aug 7 13:12:29 2022] RIP: 0010:default_idle+0x42/0x60 [Sun Aug 7 13:12:29 2022] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 6b f1 22 02 85 c0 7e 07 0f 00 2d 80 3b 4a 00 fb f4 48 c7 c7 e0 07 7e 85 e8 21 bd 40 fe eb de 66 66 2e 0f 1f 84 00 [Sun Aug 7 13:12:29 2022] RSP: 0018:ffffffff84407e18 EFLAGS: 00000242 [Sun Aug 7 13:12:29 2022] RAX: 0000000000000001 RBX: ffffffff84ec4a68 RCX: 1ffffffff0afc0fc [Sun Aug 7 13:12:29 2022] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835b1fac [Sun Aug 7 13:12:29 2022] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2c44ac3 [Sun Aug 7 13:12:29 2022] R10: ffffed109a588958 R11: 00000000ffffffff R12: 0000000000000000 [Sun Aug 7 13:12:29 2022] R13: ffffffff84efac20 R14: 0000000000000000 R15: dffffc0000000000 [Sun Aug 7 13:12:29 2022] ? default_idle_call+0xcc/0x460 [Sun Aug 7 13:12:29 2022] default_idle_call+0xec/0x460 [Sun Aug 7 13:12:29 2022] do_idle+0x394/0x450 [Sun Aug 7 13:12:29 2022] ? arch_cpu_idle_exit+0x40/0x40 [Sun Aug 7 13:12:29 2022] cpu_startup_entry+0x19/0x20 [Sun Aug 7 13:12:29 2022] rest_init+0x156/0x250 [Sun Aug 7 13:12:29 2022] arch_call_rest_init+0xf/0x15 [Sun Aug 7 13:12:29 2022] start_kernel+0x3a7/0x3c5 [Sun Aug 7 13:12:29 2022] secondary_startup_64_no_verify+0xcd/0xdb [Sun Aug 7 13:12:29 2022] Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG") Signed-off-by: Vlad Buslov Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit 942fca7e762be39204e5926e91a288a343a97c72 Author: Eli Cohen Date: Sun Aug 7 08:25:28 2022 +0300 net/mlx5: Eswitch, Fix forwarding decision to uplink Make sure to modify the rule for uplink forwarding only for the case where destination vport number is MLX5_VPORT_UPLINK. Fixes: 94db33177819 ("net/mlx5: Support multiport eswitch mode") Signed-off-by: Eli Cohen Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit a6e675a66175869b7d87c0e1dd0ddf93e04f8098 Author: Eli Cohen Date: Tue Aug 2 19:45:36 2022 +0300 net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY Only set MLX5_LAG_FLAG_NDEVS_READY if both netdevices are registered. Doing so guarantees that both ldev->pf[MLX5_LAG_P0].dev and ldev->pf[MLX5_LAG_P1].dev have valid pointers when MLX5_LAG_FLAG_NDEVS_READY is set. The core issue is asymmetry in setting MLX5_LAG_FLAG_NDEVS_READY and clearing it. Setting it is done wrongly when both ldev->pf[MLX5_LAG_P0].dev and ldev->pf[MLX5_LAG_P1].dev are set; clearing it is done right when either of ldev->pf[i].netdev is cleared. Consider the following scenario: 1. PF0 loads and sets ldev->pf[MLX5_LAG_P0].dev to a valid pointer 2. PF1 loads and sets both ldev->pf[MLX5_LAG_P1].dev and ldev->pf[MLX5_LAG_P1].netdev with valid pointers. This results in MLX5_LAG_FLAG_NDEVS_READY is set. 3. PF0 is unloaded before setting dev->pf[MLX5_LAG_P0].netdev. MLX5_LAG_FLAG_NDEVS_READY remains set. Further execution of mlx5_do_bond() will result in null pointer dereference when calling mlx5_lag_is_multipath() This patch fixes the following call trace actually encountered: [ 1293.475195] BUG: kernel NULL pointer dereference, address: 00000000000009a8 [ 1293.478756] #PF: supervisor read access in kernel mode [ 1293.481320] #PF: error_code(0x0000) - not-present page [ 1293.483686] PGD 0 P4D 0 [ 1293.484434] Oops: 0000 [#1] SMP PTI [ 1293.485377] CPU: 1 PID: 23690 Comm: kworker/u16:2 Not tainted 5.18.0-rc5_for_upstream_min_debug_2022_05_05_10_13 #1 [ 1293.488039] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 1293.490836] Workqueue: mlx5_lag mlx5_do_bond_work [mlx5_core] [ 1293.492448] RIP: 0010:mlx5_lag_is_multipath+0x5/0x50 [mlx5_core] [ 1293.494044] Code: e8 70 40 ff e0 48 8b 14 24 48 83 05 5c 1a 1b 00 01 e9 19 ff ff ff 48 83 05 47 1a 1b 00 01 eb d7 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 87 a8 09 00 00 48 85 c0 74 26 48 83 05 a7 1b 1b 00 01 41 b8 [ 1293.498673] RSP: 0018:ffff88811b2fbe40 EFLAGS: 00010202 [ 1293.500152] RAX: ffff88818a94e1c0 RBX: ffff888165eca6c0 RCX: 0000000000000000 [ 1293.501841] RDX: 0000000000000001 RSI: ffff88818a94e1c0 RDI: 0000000000000000 [ 1293.503585] RBP: 0000000000000000 R08: ffff888119886740 R09: ffff888165eca73c [ 1293.505286] R10: 0000000000000018 R11: 0000000000000018 R12: ffff88818a94e1c0 [ 1293.506979] R13: ffff888112729800 R14: 0000000000000000 R15: ffff888112729858 [ 1293.508753] FS: 0000000000000000(0000) GS:ffff88852cc40000(0000) knlGS:0000000000000000 [ 1293.510782] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1293.512265] CR2: 00000000000009a8 CR3: 00000001032d4002 CR4: 0000000000370ea0 [ 1293.514001] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1293.515806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 8a66e4585979 ("net/mlx5: Change ownership model for lag") Signed-off-by: Eli Cohen Reviewed-by: Maor Dickman Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit f37044fd759b6bc40b6398a978e0b1acdf717372 Author: Vlad Buslov Date: Fri Jul 15 21:41:48 2022 +0200 net/mlx5e: Properly disable vlan strip on non-UL reps When querying mlx5 non-uplink representors capabilities with ethtool rx-vlan-offload is marked as "off [fixed]". However, it is actually always enabled because mlx5e_params->vlan_strip_disable is 0 by default when initializing struct mlx5e_params instance. Fix the issue by explicitly setting the vlan_strip_disable to 'true' for non-uplink representors. Fixes: cb67b832921c ("net/mlx5e: Introduce SRIOV VF representors") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 072e51356cd5a4a1c12c1020bc054c99b98333df Merge: d3cd67d671eea ed06fce0b034b Author: Linus Torvalds Date: Mon Aug 22 11:40:01 2022 -0700 Merge tag 'nfs-for-5.20-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: "Stable fixes: - NFS: Fix another fsync() issue after a server reboot Bugfixes: - NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT - NFS: Fix missing unlock in nfs_unlink() - Add sanity checking of the file type used by __nfs42_ssc_open - Fix a case where we're failing to set task->tk_rpc_status Cleanups: - Remove the NFS_CONTEXT_RESEND_WRITES flag that got obsoleted by the fsync() fix" * tag 'nfs-for-5.20-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: SUNRPC: RPC level errors should set task->tk_rpc_status NFSv4.2 fix problems with __nfs42_ssc_open NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT NFS: Cleanup to remove unused flag NFS_CONTEXT_RESEND_WRITES NFS: Remove a bogus flag setting in pnfs_write_done_resend_to_mds NFS: Fix another fsync() issue after a server reboot NFS: Fix missing unlock in nfs_unlink() commit d3cd67d671eea1f0d3860996863bd95e1e0b1c76 Merge: b20ee4813f3fe 0c3bc7899e6df Author: Linus Torvalds Date: Mon Aug 22 11:33:02 2022 -0700 Merge tag 'fs.idmapped.fixes.v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull idmapping fixes from Christian Brauner: - Since Seth joined as co-maintainer for idmapped mounts we decided to use a shared git tree. Konstantin suggested we use vfs/idmapping.git on kernel.org under the vfs/ namespace. So this updates the tree in the maintainers file. - Ensure that POSIX ACLs checking, getting, and setting works correctly for filesystems mountable with a filesystem idmapping that want to support idmapped mounts. Since no filesystems mountable with an fs_idmapping do yet support idmapped mounts there is no problem. But this could change in the future, so add a check to refuse to create idmapped mounts when the mounter is not privileged over the mount's idmapping. - Check that caller is privileged over the idmapping that will be attached to a mount. Currently no FS_USERNS_MOUNT filesystems support idmapped mounts, thus this is not a problem as only CAP_SYS_ADMIN in init_user_ns is allowed to set up idmapped mounts. But this could change in the future, so add a check to refuse to create idmapped mounts when the mounter is not privileged over the mount's idmapping. - Fix POSIX ACLs for ntfs3. While looking at our current POSIX ACL handling in the context of some overlayfs work I went through a range of other filesystems checking how they handle them currently and encountered a few bugs in ntfs3. I've sent this some time ago and the fixes haven't been picked up even though the pull request for other ntfs3 fixes got sent after. This should really be fixed as right now POSIX ACLs are broken in certain circumstances for ntfs3. * tag 'fs.idmapped.fixes.v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: ntfs: fix acl handling fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts MAINTAINERS: update idmapping tree acl: handle idmapped mounts for idmapped filesystems commit b20ee4813f3fe79f5ee227c576a55c2df5d59078 Merge: cfd2b5c1106fa 932c29a10d5d0 Author: Linus Torvalds Date: Mon Aug 22 10:40:09 2022 -0700 Merge tag 'filelock-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking fix from Jeff Layton: "Just a single patch for a bugfix in the flock() codepath, introduced by a patch that went in recently" * tag 'filelock-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: Fix dropped call to ->fl_release_private() commit 76f89c954788763db575fb512a40bd483864f1e9 Author: Cristian Marussi Date: Wed Aug 17 18:27:28 2022 +0100 firmware: arm_scmi: Harden accesses to the sensor domains Accessing sensor domains descriptors by the index upon the SCMI drivers requests through the SCMI sensor operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses. Link: https://lore.kernel.org/r/20220817172731.1185305-4-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 1ecb7d27b1af6705e9a4e94415b4d8cc8cf2fbfb Author: Cristian Marussi Date: Wed Aug 17 18:27:27 2022 +0100 firmware: arm_scmi: Improve checks in the info_get operations SCMI protocols abstract and expose a number of protocol specific resources like clocks, sensors and so on. Information about such specific domain resources are generally exposed via an `info_get` protocol operation. Improve the sanity check on these operations where needed. Link: https://lore.kernel.org/r/20220817172731.1185305-3-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit 2e42b1652df00daf7000011ec9917f2eda534190 Author: Cristian Marussi Date: Wed Aug 17 18:27:26 2022 +0100 firmware: arm_scmi: Fix missing kernel-doc in optee Add the missing structure field `rx_len` description. Link: https://lore.kernel.org/r/20220817172731.1185305-2-cristian.marussi@arm.com Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla commit cfd2b5c1106fa20254d9f24970232cdf24860005 Author: Yang Jihong Date: Mon Aug 22 17:25:57 2022 +0800 perf tools: Fix compile error for x86 Commit a0a12c3ed057 ("asm goto: eradicate CC_HAS_ASM_GOTO") eradicates CC_HAS_ASM_GOTO, and in the process also causes the perf tool on x86 to use asm_volatile_goto when compiling __GEN_RMWcc. However, asm_volatile_goto is not declared in the perf tool headers, which causes a compilation error: In file included from tools/arch/x86/include/asm/atomic.h:7, from tools/include/asm/atomic.h:6, from tools/include/linux/atomic.h:5, from tools/include/linux/refcount.h:41, from tools/lib/perf/include/internal/cpumap.h:5, from tools/perf/util/cpumap.h:7, from tools/perf/util/env.h:7, from tools/perf/util/header.h:12, from pmu-events/pmu-events.c:9: tools/arch/x86/include/asm/atomic.h: In function ‘atomic_dec_and_test’: tools/arch/x86/include/asm/rmwcc.h:7:2: error: implicit declaration of function ‘asm_volatile_goto’ [-Werror=implicit-function-declaration] asm_volatile_goto (fullop "; j" cc " %l[cc_label]" \ ^~~~~~~~~~~~~~~~~ Define asm_volatile_goto in compiler_types.h if not declared, like the main kernel header files do. Fixes: a0a12c3ed057 ("asm goto: eradicate CC_HAS_ASM_GOTO") Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Tested-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 79d3d1d12e6f22c904195f9356069859e2595f00 Author: Josef Bacik Date: Fri Aug 19 11:53:39 2022 -0400 btrfs: don't allow large NOWAIT direct reads Dylan and Jens reported a problem where they had an io_uring test that was returning short reads, and bisected it to ee5b46a353af ("btrfs: increase direct io read size limit to 256 sectors"). The root cause is their test was doing larger reads via io_uring with NOWAIT and async. This was triggering a page fault during the direct read, however the first page was able to work just fine and thus we submitted a 4k read for a larger iocb. Btrfs allows for partial IO's in this case specifically because we don't allow page faults, and thus we'll attempt to do any io that we can, submit what we could, come back and fault in the rest of the range and try to do the remaining IO. However for !is_sync_kiocb() we'll call ->ki_complete() as soon as the partial dio is done, which is incorrect. In the sync case we can exit the iomap code, submit more io's, and return with the amount of IO we were able to complete successfully. We were always doing short reads in this case, but for NOWAIT we were getting saved by the fact that we were limiting direct reads to sectorsize, and if we were larger than that we would return EAGAIN. Fix the regression by simply returning EAGAIN in the NOWAIT case with larger reads, that way io_uring can retry and get the larger IO and have the fault logic handle everything properly. This still leaves the AIO short read case, but that existed before this change. The way to properly fix this would be to handle partial iocb completions, but that's a lot of work, for now deal with the regression in the most straightforward way possible. Reported-by: Dylan Yudaken Fixes: ee5b46a353af ("btrfs: increase direct io read size limit to 256 sectors") Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 4a445b7b6178d88956192c0202463063f52e8667 Author: Qu Wenruo Date: Sat Aug 13 16:06:53 2022 +0800 btrfs: don't merge pages into bio if their page offset is not contiguous [BUG] Zygo reported on latest development branch, he could hit ASSERT()/BUG_ON() caused crash when doing RAID5 recovery (intentionally corrupt one disk, and let btrfs to recover the data during read/scrub). And The following minimal reproducer can cause extent state leakage at rmmod time: mkfs.btrfs -f -d raid5 -m raid5 $dev1 $dev2 $dev3 -b 1G > /dev/null mount $dev1 $mnt fsstress -w -d $mnt -n 25 -s 1660807876 sync fssum -A -f -w /tmp/fssum.saved $mnt umount $mnt # Wipe the dev1 but keeps its super block xfs_io -c "pwrite -S 0x0 1m 1023m" $dev1 mount $dev1 $mnt fssum -r /tmp/fssum.saved $mnt > /dev/null umount $mnt rmmod btrfs This will lead to the following extent states leakage: BTRFS: state leak: start 499712 end 503807 state 5 in tree 1 refs 1 BTRFS: state leak: start 495616 end 499711 state 5 in tree 1 refs 1 BTRFS: state leak: start 491520 end 495615 state 5 in tree 1 refs 1 BTRFS: state leak: start 487424 end 491519 state 5 in tree 1 refs 1 BTRFS: state leak: start 483328 end 487423 state 5 in tree 1 refs 1 BTRFS: state leak: start 479232 end 483327 state 5 in tree 1 refs 1 BTRFS: state leak: start 475136 end 479231 state 5 in tree 1 refs 1 BTRFS: state leak: start 471040 end 475135 state 5 in tree 1 refs 1 [CAUSE] Since commit 7aa51232e204 ("btrfs: pass a btrfs_bio to btrfs_repair_one_sector"), we always use btrfs_bio->file_offset to determine the file offset of a page. But that usage assume that, one bio has all its page having a continuous page offsets. Unfortunately that's not true, btrfs only requires the logical bytenr contiguous when assembling its bios. From above script, we have one bio looks like this: fssum-27671 submit_one_bio: bio logical=217739264 len=36864 fssum-27671 submit_one_bio: r/i=5/261 page_offset=466944 <<< fssum-27671 submit_one_bio: r/i=5/261 page_offset=724992 <<< fssum-27671 submit_one_bio: r/i=5/261 page_offset=729088 fssum-27671 submit_one_bio: r/i=5/261 page_offset=733184 fssum-27671 submit_one_bio: r/i=5/261 page_offset=737280 fssum-27671 submit_one_bio: r/i=5/261 page_offset=741376 fssum-27671 submit_one_bio: r/i=5/261 page_offset=745472 fssum-27671 submit_one_bio: r/i=5/261 page_offset=749568 fssum-27671 submit_one_bio: r/i=5/261 page_offset=753664 Note that the 1st and the 2nd page has non-contiguous page offsets. This means, at repair time, we will have completely wrong file offset passed in: kworker/u32:2-19927 btrfs_repair_one_sector: r/i=5/261 page_off=729088 file_off=475136 bio_offset=8192 Since the file offset is incorrect, we latter incorrectly set the extent states, and no way to really release them. Thus later it causes the leakage. In fact, this can be even worse, since the file offset is incorrect, we can hit cases like the incorrect file offset belongs to a HOLE, and later cause btrfs_num_copies() to trigger error, finally hit BUG_ON()/ASSERT() later. [FIX] Add an extra condition in btrfs_bio_add_page() for uncompressed IO. Now we will have more strict requirement for bio pages: - They should all have the same mapping (the mapping check is already implied by the call chain) - Their logical bytenr should be adjacent This is the same as the old condition. - Their page_offset() (file offset) should be adjacent This is the new check. This would result a slightly increased amount of bios from btrfs (needs holes and inside the same stripe boundary to trigger). But this would greatly reduce the confusion, as it's pretty common to assume a btrfs bio would only contain continuous page cache. Later we may need extra cleanups, as we no longer needs to handle gaps between page offsets in endio functions. Currently this should be the minimal patch to fix commit 7aa51232e204 ("btrfs: pass a btrfs_bio to btrfs_repair_one_sector"). Reported-by: Zygo Blaxell Fixes: 7aa51232e204 ("btrfs: pass a btrfs_bio to btrfs_repair_one_sector") Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e6e3dec6c3c288d556b991a85d5d8e3ee71e9046 Author: Filipe Manana Date: Mon Aug 8 12:18:37 2022 +0100 btrfs: update generation of hole file extent item when merging holes When punching a hole into a file range that is adjacent with a hole and we are not using the no-holes feature, we expand the range of the adjacent file extent item that represents a hole, to save metadata space. However we don't update the generation of hole file extent item, which means a full fsync will not log that file extent item if the fsync happens in a later transaction (since commit 7f30c07288bb9e ("btrfs: stop copying old file extents when doing a full fsync")). For example, if we do this: $ mkfs.btrfs -f -O ^no-holes /dev/sdb $ mount /dev/sdb /mnt $ xfs_io -f -c "pwrite -S 0xab 2M 2M" /mnt/foobar $ sync We end up with 2 file extent items in our file: 1) One that represents the hole for the file range [0, 2M), with a generation of 7; 2) Another one that represents an extent covering the range [2M, 4M). After that if we do the following: $ xfs_io -c "fpunch 2M 2M" /mnt/foobar We end up with a single file extent item in the file, which represents a hole for the range [0, 4M) and with a generation of 7 - because we end dropping the data extent for range [2M, 4M) and then update the file extent item that represented the hole at [0, 2M), by increasing length from 2M to 4M. Then doing a full fsync and power failing: $ xfs_io -c "fsync" /mnt/foobar will result in the full fsync not logging the file extent item that represents the hole for the range [0, 4M), because its generation is 7, which is lower than the generation of the current transaction (8). As a consequence, after mounting again the filesystem (after log replay), the region [2M, 4M) does not have a hole, it still points to the previous data extent. So fix this by always updating the generation of existing file extent items representing holes when we merge/expand them. This solves the problem and it's the same approach as when we merge prealloc extents that got written (at btrfs_mark_extent_written()). Setting the generation to the current transaction's generation is also what we do when merging the new hole extent map with the previous one or the next one. A test case for fstests, covering both cases of hole file extent item merging (to the left and to the right), will be sent soon. Fixes: 7f30c07288bb9e ("btrfs: stop copying old file extents when doing a full fsync") CC: stable@vger.kernel.org # 5.18+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 9ea0106a7a3d8116860712e3f17cd52ce99f6707 Author: Zixuan Fu Date: Mon Aug 15 23:16:06 2022 +0800 btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() In btrfs_get_dev_args_from_path(), btrfs_get_bdev_and_sb() can fail if the path is invalid. In this case, btrfs_get_dev_args_from_path() returns directly without freeing args->uuid and args->fsid allocated before, which causes memory leak. To fix these possible leaks, when btrfs_get_bdev_and_sb() fails, btrfs_put_dev_args_from_path() is called to clean up the memory. Reported-by: TOTE Robot Fixes: faa775c41d655 ("btrfs: add a btrfs_get_dev_args_from_path helper") CC: stable@vger.kernel.org # 5.16 Reviewed-by: Boris Burkov Signed-off-by: Zixuan Fu Reviewed-by: David Sterba Signed-off-by: David Sterba commit b51111271b0352aa596c5ae8faf06939e91b3b68 Author: Goldwyn Rodrigues Date: Tue Aug 16 16:42:56 2022 -0500 btrfs: check if root is readonly while setting security xattr For a filesystem which has btrfs read-only property set to true, all write operations including xattr should be denied. However, security xattr can still be changed even if btrfs ro property is true. This happens because xattr_permission() does not have any restrictions on security.*, system.* and in some cases trusted.* from VFS and the decision is left to the underlying filesystem. See comments in xattr_permission() for more details. This patch checks if the root is read-only before performing the set xattr operation. Testcase: DEV=/dev/vdb MNT=/mnt mkfs.btrfs -f $DEV mount $DEV $MNT echo "file one" > $MNT/f1 setfattr -n "security.one" -v 2 $MNT/f1 btrfs property set /mnt ro true setfattr -n "security.one" -v 1 $MNT/f1 umount $MNT CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Goldwyn Rodrigues Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9ead7e74bfd6dd54db12ef133b8604add72511de Author: Maciej Fijalkowski Date: Thu Aug 11 20:21:49 2022 +0200 ice: xsk: use Rx ring's XDP ring when picking NAPI context Ice driver allocates per cpu XDP queues so that redirect path can safely use smp_processor_id() as an index to the array. At the same time though, XDP rings are used to pick NAPI context to call napi_schedule() or set NAPIF_STATE_MISSED. When user reduces queue count, say to 8, and num_possible_cpus() of underlying platform is 44, then this means queue vectors with correlated NAPI contexts will carry several XDP queues. This in turn can result in a broken behavior where NAPI context of interest will never be scheduled and AF_XDP socket will not process any traffic. To fix this, let us change the way how XDP rings are assigned to Rx rings and use this information later on when setting ice_tx_ring::xsk_pool pointer. For each Rx ring, grab the associated queue vector and walk through Tx ring's linked list. Once we stumble upon XDP ring in it, assign this ring to ice_rx_ring::xdp_ring. Previous [0] approach of fixing this issue was for txonly scenario because of the described grouping of XDP rings across queue vectors. So, relying on Rx ring meant that NAPI context could be scheduled with a queue vector without XDP ring with associated XSK pool. [0]: https://lore.kernel.org/netdev/20220707161128.54215-1-maciej.fijalkowski@intel.com/ Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Fixes: 22bf877e528f ("ice: introduce XDP_TX fallback path") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 5a42f112d367bb4700a8a41f5c12724fde6bfbb9 Author: Maciej Fijalkowski Date: Thu Aug 11 20:21:48 2022 +0200 ice: xsk: prohibit usage of non-balanced queue id Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z Above refers to a case where user would like to attach XSK socket in txonly mode at a queue id that does not have a corresponding Rx queue. At this moment ice's XSK logic is tightly bound to act on a "queue pair", e.g. both Tx and Rx queues at a given queue id are disabled/enabled and both of them will get XSK pool assigned, which is broken for the presented queue configuration. This results in the splat included at the bottom, which is basically an OOB access to Rx ring array. To fix this, allow using the ids only in scope of "combined" queues reported by ethtool. However, logic should be rewritten to allow such configurations later on, which would end up as a complete rewrite of the control path, so let us go with this temporary fix. [420160.558008] BUG: kernel NULL pointer dereference, address: 0000000000000082 [420160.566359] #PF: supervisor read access in kernel mode [420160.572657] #PF: error_code(0x0000) - not-present page [420160.579002] PGD 0 P4D 0 [420160.582756] Oops: 0000 [#1] PREEMPT SMP NOPTI [420160.588396] CPU: 10 PID: 21232 Comm: xdpsock Tainted: G OE 5.19.0-rc7+ #10 [420160.597893] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [420160.609894] RIP: 0010:ice_xsk_pool_setup+0x44/0x7d0 [ice] [420160.616968] Code: f3 48 83 ec 40 48 8b 4f 20 48 8b 3f 65 48 8b 04 25 28 00 00 00 48 89 44 24 38 31 c0 48 8d 04 ed 00 00 00 00 48 01 c1 48 8b 11 <0f> b7 92 82 00 00 00 48 85 d2 0f 84 2d 75 00 00 48 8d 72 ff 48 85 [420160.639421] RSP: 0018:ffffc9002d2afd48 EFLAGS: 00010282 [420160.646650] RAX: 0000000000000050 RBX: ffff88811d8bdd00 RCX: ffff888112c14ff8 [420160.655893] RDX: 0000000000000000 RSI: ffff88811d8bdd00 RDI: ffff888109861000 [420160.665166] RBP: 000000000000000a R08: 000000000000000a R09: 0000000000000000 [420160.674493] R10: 000000000000889f R11: 0000000000000000 R12: 000000000000000a [420160.683833] R13: 000000000000000a R14: 0000000000000000 R15: ffff888117611828 [420160.693211] FS: 00007fa869fc1f80(0000) GS:ffff8897e0880000(0000) knlGS:0000000000000000 [420160.703645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [420160.711783] CR2: 0000000000000082 CR3: 00000001d076c001 CR4: 00000000007706e0 [420160.721399] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [420160.731045] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [420160.740707] PKRU: 55555554 [420160.745960] Call Trace: [420160.750962] [420160.755597] ? kmalloc_large_node+0x79/0x90 [420160.762703] ? __kmalloc_node+0x3f5/0x4b0 [420160.769341] xp_assign_dev+0xfd/0x210 [420160.775661] ? shmem_file_read_iter+0x29a/0x420 [420160.782896] xsk_bind+0x152/0x490 [420160.788943] __sys_bind+0xd0/0x100 [420160.795097] ? exit_to_user_mode_prepare+0x20/0x120 [420160.802801] __x64_sys_bind+0x16/0x20 [420160.809298] do_syscall_64+0x38/0x90 [420160.815741] entry_SYSCALL_64_after_hwframe+0x63/0xcd [420160.823731] RIP: 0033:0x7fa86a0dd2fb [420160.830264] Code: c3 66 0f 1f 44 00 00 48 8b 15 69 8b 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 8b 0c 00 f7 d8 64 89 01 48 [420160.855410] RSP: 002b:00007ffc1146f618 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [420160.866366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa86a0dd2fb [420160.876957] RDX: 0000000000000010 RSI: 00007ffc1146f680 RDI: 0000000000000003 [420160.887604] RBP: 000055d7113a0520 R08: 00007fa868fb8000 R09: 0000000080000000 [420160.898293] R10: 0000000000008001 R11: 0000000000000246 R12: 000055d7113a04e0 [420160.909038] R13: 000055d7113a0320 R14: 000000000000000a R15: 0000000000000000 [420160.919817] [420160.925659] Modules linked in: ice(OE) af_packet binfmt_misc nls_iso8859_1 ipmi_ssif intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp mei_me coretemp ioatdma mei ipmi_si wmi ipmi_msghandler acpi_pad acpi_power_meter ip_tables x_tables autofs4 ixgbe i40e crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd ahci mdio dca libahci lpc_ich [last unloaded: ice] [420160.977576] CR2: 0000000000000082 [420160.985037] ---[ end trace 0000000000000000 ]--- [420161.097724] RIP: 0010:ice_xsk_pool_setup+0x44/0x7d0 [ice] [420161.107341] Code: f3 48 83 ec 40 48 8b 4f 20 48 8b 3f 65 48 8b 04 25 28 00 00 00 48 89 44 24 38 31 c0 48 8d 04 ed 00 00 00 00 48 01 c1 48 8b 11 <0f> b7 92 82 00 00 00 48 85 d2 0f 84 2d 75 00 00 48 8d 72 ff 48 85 [420161.134741] RSP: 0018:ffffc9002d2afd48 EFLAGS: 00010282 [420161.144274] RAX: 0000000000000050 RBX: ffff88811d8bdd00 RCX: ffff888112c14ff8 [420161.155690] RDX: 0000000000000000 RSI: ffff88811d8bdd00 RDI: ffff888109861000 [420161.168088] RBP: 000000000000000a R08: 000000000000000a R09: 0000000000000000 [420161.179295] R10: 000000000000889f R11: 0000000000000000 R12: 000000000000000a [420161.190420] R13: 000000000000000a R14: 0000000000000000 R15: ffff888117611828 [420161.201505] FS: 00007fa869fc1f80(0000) GS:ffff8897e0880000(0000) knlGS:0000000000000000 [420161.213628] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [420161.223413] CR2: 0000000000000082 CR3: 00000001d076c001 CR4: 00000000007706e0 [420161.234653] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [420161.245893] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [420161.257052] PKRU: 55555554 Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit 8d1e09cfbd4da67d68a03e86818db5340c05abb8 Merge: a8c67e27d9e3e 93a3c0d4e8bfb Author: Greg Kroah-Hartman Date: Mon Aug 22 17:40:44 2022 +0200 Merge tag 'thunderbolt-for-v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: "thunderbolt: Fixes for v6.0-rc3 This includes two fixes: one that corrects the buffer usage in tb_async_error() and another one that limits the xHCI connect operations to Thunderbolt 3 routers. Both have been in linux-next with no reported issues." * tag 'thunderbolt-for-v6.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Check router generation before connecting xHCI thunderbolt: Use the actual buffer in tb_async_error() commit 220e979bd906015b74eb485e16464ee5abbd3c9b Merge: 1c23f9e627a7b b75ef35bb5779 Author: Rodrigo Vivi Date: Mon Aug 22 10:31:23 2022 -0400 Merge tag 'gvt-fixes-2022-08-22' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2022-08-22 - CometLake regression fix in mmio table rework (Alex) - misc kernel doc and typo fixes Signed-off-by: Rodrigo Vivi From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20220822031215.GJ1089@zhen-hp.sh.intel.com commit f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6 Author: Duoming Zhou Date: Thu Aug 18 17:06:21 2022 +0800 nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below: (thread 1) | (thread 2) | pn532_uart_send_frame pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...) ... | (wait a time) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532->... //USE This patch adds del_timer_sync() in pn532_uart_remove() in order to prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc() is well synchronized, it sets nfc_dev->shutting_down to true and there are no syscalls could restart the cmd_timeout timer. Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller commit 123d6455771ec577ce65f8d1bda548fb0eb7ef21 Author: Wang Jingjin Date: Mon Aug 1 16:47:45 2022 +0800 ftrace: Fix build warning for ops_references_rec() not used The change that made IPMODIFY and DIRECT ops work together needed access to the ops_references_ip() function, which it pulled out of the module only code. But now if both CONFIG_MODULES and CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not set, we get the below warning: ‘ops_references_rec’ defined but not used. Since ops_references_rec() only calls ops_references_ip() replace the usage of ops_references_rec() with ops_references_ip() and encompass the function with an #ifdef of DIRECT_CALLS || MODULES being defined. Link: https://lkml.kernel.org/r/20220801084745.1187987-1-wangjingjin1@huawei.com Fixes: 53cd885bc5c3 ("ftrace: Allow IPMODIFY and DIRECT ops on the same function") Signed-off-by: Wang Jingjin Signed-off-by: Steven Rostedt (Google) commit 6e10001c6e666f7e07e3cfd806d8fa11c4151d00 Merge: 3c53cd65dece4 b75d612014447 Author: David S. Miller Date: Mon Aug 22 14:29:00 2022 +0100 Merge branch 'r8152-fixes' Hayes Wang says: ==================== r8152: fix flow control settings These patches fix the settings of RX FIFO about flow control. ==================== Signed-off-by: David S. Miller commit b75d612014447e04abdf0e37ffb8f2fd8b0b49d6 Author: Hayes Wang Date: Thu Aug 18 16:06:20 2022 +0800 r8152: fix the RX FIFO settings when suspending The RX FIFO would be changed when suspending, so the related settings have to be modified, too. Otherwise, the flow control would work abnormally. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216333 Reported-by: Mark Blakeney Fixes: cdf0b86b250f ("r8152: fix a WOL issue") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 6dc4df12d741c0fe8f885778a43039e0619b9cd9 Author: Hayes Wang Date: Thu Aug 18 16:06:19 2022 +0800 r8152: fix the units of some registers for RTL8156A The units of PLA_RX_FIFO_FULL and PLA_RX_FIFO_EMPTY are 16 bytes. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 3c53cd65dece47dd1f9d3a809f32e59d1d87b2b8 Author: Bernard Pidoux Date: Thu Aug 18 02:02:13 2022 +0200 rose: check NULL rose_loopback_neigh->loopback Commit 3b3fd068c56e3fbea30090859216a368398e39bf added NULL check for `rose_loopback_neigh->dev` in rose_loopback_timer() but omitted to check rose_loopback_neigh->loopback. It thus prevents *all* rose connect. The reason is that a special rose_neigh loopback has a NULL device. /proc/net/rose_neigh illustrates it via rose_neigh_show() function : [...] seq_printf(seq, "%05d %-9s %-4s %3d %3d %3s %3s %3lu %3lu", rose_neigh->number, (rose_neigh->loopback) ? "RSLOOP-0" : ax2asc(buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name : "???", rose_neigh->count, /proc/net/rose_neigh displays special rose_loopback_neigh->loopback as callsign RSLOOP-0: addr callsign dev count use mode restart t0 tf digipeaters 00001 RSLOOP-0 ??? 1 2 DCE yes 0 0 By checking rose_loopback_neigh->loopback, rose_rx_call_request() is called even in case rose_loopback_neigh->dev is NULL. This repairs rose connections. Verification with rose client application FPAC: FPAC-Node v 4.1.3 (built Aug 5 2022) for LINUX (help = h) F6BVP-4 (Commands = ?) : u Users - AX.25 Level 2 sessions : Port Callsign Callsign AX.25 state ROSE state NetRom status axudp F6BVP-5 -> F6BVP-9 Connected Connected --------- Fixes: 3b3fd068c56e ("rose: Fix Null pointer dereference in rose_send_frame()") Signed-off-by: Bernard Pidoux Suggested-by: Francois Romieu Cc: Thomas DL9SAU Osterried Signed-off-by: David S. Miller commit 9ee5b6d53b8c99d13a47227e3b7052a1365556c9 Author: Niravkumar L Rabara Date: Sat Aug 13 12:26:16 2022 +0800 spi: cadence-quadspi: Disable irqs during indirect reads On architecture where reading the SRAM is slower than the pace at controller fills it, with interrupt enabled while reading from SRAM FIFO causes unwanted interrupt storm to CPU. The inner "bytes to read" loop never exits and waits for the completion so it is enough to only enable the watermark interrupt when we are out of bytes to read, which only happens when we start the transfer (waiting for the FIFO to fill up initially) if the SRAM is slow. So only using read watermark interrupt, as the current implementation doesn't utilize the SRAM full and indirect complete read interrupt. And disable all the read interrupts while reading from SRAM. Signed-off-by: Niravkumar L Rabara Link: https://lore.kernel.org/r/20220813042616.1372110-1-niravkumar.l.rabara@intel.com Signed-off-by: Mark Brown commit c32f1ebfd26bece77141257864ed7b4720da1557 Author: Andrew Halaney Date: Fri Aug 19 14:43:36 2022 -0500 regulator: core: Clean up on enable failure If regulator_enable() fails, enable_count is incremented still. A consumer, assuming no matching regulator_disable() is necessary on failure, will then get this error message upon regulator_put() since enable_count is non-zero: [ 1.277418] WARNING: CPU: 3 PID: 1 at drivers/regulator/core.c:2304 _regulator_put.part.0+0x168/0x170 The consumer could try to fix this in their driver by cleaning up on error from regulator_enable() (i.e. call regulator_disable()), but that results in the following since regulator_enable() failed and didn't increment user_count: [ 1.258112] unbalanced disables for vreg_l17c [ 1.262606] WARNING: CPU: 4 PID: 1 at drivers/regulator/core.c:2899 _regulator_disable+0xd4/0x190 Fix this by decrementing enable_count upon failure to enable. With this in place, just the reason for failure to enable is printed as expected and developers can focus on the root cause of their issue instead of thinking their usage of the regulator consumer api is incorrect. For example, in my case: [ 1.240426] vreg_l17c: invalid input voltage found Fixes: 5451781dadf8 ("regulator: core: Only count load for enabled consumers") Signed-off-by: Andrew Halaney Reviewed-by: Douglas Anderson Reviewed-by: Brian Masney Link: https://lore.kernel.org/r/20220819194336.382740-1-ahalaney@redhat.com Signed-off-by: Mark Brown commit 221ab1f0bf46236cf1a3fef5298ff5894acfb0c5 Author: Jiaxin Yu Date: Sat Aug 20 15:19:25 2022 +0800 ASoC: mediatek: mt8186: fix DMIC record noise When the first DMIC recording is power down, mtkaif_dmic will be reset. This will cause configuration error in the second DMIC recording. So do not reset mtkaif_dmic except in "MTKAIF_DMIC Switch" kcontrol. Signed-off-by: Jiaxin Yu Link: https://lore.kernel.org/r/20220820071925.13557-1-jiaxin.yu@mediatek.com Signed-off-by: Mark Brown commit a8d302a0b77057568350fe0123e639d02dba0745 Author: Takashi Iwai Date: Sun Aug 21 17:59:11 2022 +0200 ALSA: memalloc: Revive x86-specific WC page allocations again We dropped the x86-specific hack for WC-page allocations with a hope that the standard dma_alloc_wc() works nowadays. Alas, it doesn't, and we need to take back some workaround again, but in a different form, as the previous one was broken for some platforms. This patch re-introduces the x86-specific WC-page allocations, but it uses rather the manual page allocations instead of dma_alloc_coherent(). The use of dma_alloc_coherent() was also a potential problem in the recent addition of the fallback allocation for noncontig pages, and this patch eliminates both at once. Fixes: 9882d63bea14 ("ALSA: memalloc: Drop x86-specific hack for WC allocations") Cc: BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216363 Link: https://lore.kernel.org/r/20220821155911.10715-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 63f1560930e4e1c4f6279b8ae715c9841fe1a6d3 Author: Adrian Hunter Date: Mon Aug 15 10:33:21 2022 +0300 mmc: core: Fix inconsistent sd3_bus_mode at UHS-I SD voltage switch failure If re-initialization results is a different signal voltage, because the voltage switch failed previously, but not this time (or vice versa), then sd3_bus_mode will be inconsistent with the card because the SD_SWITCH command is done only upon first initialization. Fix by always reading SD_SWITCH information during re-initialization, which also means it does not need to be re-read later for the 1.8V fixup workaround. Note, brief testing showed SD_SWITCH took about 1.8ms to 2ms which added about 1% to 1.5% to the re-initialization time, so it's not particularly significant. Reported-by: Seunghui Lee Signed-off-by: Adrian Hunter Reviewed-by: Seunghui Lee Tested-by: Seunghui Lee Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220815073321.63382-3-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 15c56208c79c340686869c31595c209d1431c5e8 Author: Adrian Hunter Date: Mon Aug 15 10:33:20 2022 +0300 mmc: core: Fix UHS-I SD 1.8V workaround branch When introduced, upon success, the 1.8V fixup workaround in mmc_sd_init_card() would branch to practically the end of the function, to a label named "done". Unfortunately, perhaps due to the label name, over time new code has been added that really should have come after "done" not before it. Let's fix the problem by moving the label to the correct place and rename it "cont". Fixes: 045d705dc1fb ("mmc: core: Enable the MMC host software queue for the SD card") Signed-off-by: Adrian Hunter Reviewed-by: Seunghui Lee Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220815073321.63382-2-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 0c3bc7899e6dfb52df1c46118a5a670ae619645f Author: Christian Brauner Date: Wed Jul 20 14:32:52 2022 +0200 ntfs: fix acl handling While looking at our current POSIX ACL handling in the context of some overlayfs work I went through a range of other filesystems checking how they handle them currently and encountered ntfs3. The posic_acl_{from,to}_xattr() helpers always need to operate on the filesystem idmapping. Since ntfs3 can only be mounted in the initial user namespace the relevant idmapping is init_user_ns. The posix_acl_{from,to}_xattr() helpers are concerned with translating between the kernel internal struct posix_acl{_entry} and the uapi struct posix_acl_xattr_{header,entry} and the kernel internal data structure is cached filesystem wide. Additional idmappings such as the caller's idmapping or the mount's idmapping are handled higher up in the VFS. Individual filesystems usually do not need to concern themselves with these. The posix_acl_valid() helper is concerned with checking whether the values in the kernel internal struct posix_acl can be represented in the filesystem's idmapping. IOW, if they can be written to disk. So this helper too needs to take the filesystem's idmapping. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Cc: Konstantin Komarov Cc: ntfs3@lists.linux.dev Signed-off-by: Christian Brauner (Microsoft) commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 Author: Helge Deller Date: Sun Aug 21 14:49:58 2022 +0200 parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x machine is detected. Signed-off-by: Helge Deller commit d46c742f827fa2326ab1f4faa1cccadb56912341 Author: Li Qiong Date: Fri Aug 19 12:15:10 2022 +0800 parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() As the possible failure of the kmalloc(), it should be better to fix this error path, check and return '-ENOMEM' error code. Signed-off-by: Li Qiong Signed-off-by: Helge Deller commit 4cb2643667c26fc976a4941b92f3770da9ec06a0 Author: Wolfram Sang Date: Thu Aug 18 23:00:55 2022 +0200 parisc: led: Move from strlcpy with unused retval to strscpy Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Helge Deller commit db4538ad4db280a2114e9d507d47c9f1a9f2cfd8 Author: Jason Wang Date: Thu Aug 11 21:59:53 2022 +0800 parisc: ccio-dma: Fix typo in comment The double `was' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Signed-off-by: Helge Deller commit b4b18f47f4f9682fbf5827682645da7c8dde8f80 Author: Helge Deller Date: Sun Aug 21 08:12:19 2022 +0200 Revert "parisc: Show error if wrong 32/64-bit compiler is being used" This reverts commit b160628e9ebcdc85d0db9d7f423c26b3c7c179d0. There is no need any longer to have this sanity check, because the previous commit ("parisc: Make CONFIG_64BIT available for ARCH=parisc64 only") prevents that CONFIG_64BIT is set if ARCH==parisc. Signed-off-by: Helge Deller commit 3dcfb729b5f4a0c9b50742865cd5e6c4dbcc80dc Author: Helge Deller Date: Fri Aug 19 19:30:50 2022 +0200 parisc: Make CONFIG_64BIT available for ARCH=parisc64 only With this patch the ARCH= parameter decides if the CONFIG_64BIT option will be set or not. This means, the ARCH= parameter will give: ARCH=parisc -> 32-bit kernel ARCH=parisc64 -> 64-bit kernel This simplifies the usage of the other config options like randconfig, allmodconfig and allyesconfig a lot and produces the output which is expected for parisc64 (64-bit) vs. parisc (32-bit). Suggested-by: Masahiro Yamada Signed-off-by: Helge Deller Tested-by: Randy Dunlap Reviewed-by: Randy Dunlap Cc: # 5.15+ commit 48ec73395887694f13c9452b4dcfb43710451757 Author: Molly Sophia Date: Sun Aug 7 20:26:45 2022 +0800 pinctrl: qcom: sc8180x: Fix wrong pin numbers The pin numbers for UFS_RESET and SDC2_* are not consistent in the pinctrl driver for sc8180x. So fix it. Signed-off-by: Molly Sophia Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver") Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220807122645.13830-3-mollysophia379@gmail.com Signed-off-by: Linus Walleij commit 6124cec530c7d8faab96d340ab2df5161e5d1c8a Author: Molly Sophia Date: Sun Aug 7 20:26:44 2022 +0800 pinctrl: qcom: sc8180x: Fix gpio_wakeirq_map Currently in the wakeirq_map, gpio36 and gpio37 have the same wakeirq number, resulting in gpio37 being unable to trigger interrupts. It looks like that this is a typo in the wakeirq map. So fix it. Signed-off-by: Molly Sophia Fixes: 97423113ec4b ("pinctrl: qcom: Add sc8180x TLMM driver") Tested-by: Bjorn Andersson Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220807122645.13830-2-mollysophia379@gmail.com Signed-off-by: Linus Walleij commit b75ef35bb57791a5d675699ed4a40c870d1da12f Author: Alex Williamson Date: Wed Aug 10 15:55:48 2022 -0600 drm/i915/gvt: Fix Comet Lake Prior to the commit below the GAMT_CHKN_BIT_REG address was setup for devices matching (D_KBL | D_CFL), where intel_gvt_get_device_type() returns D_CFL for either Coffee Lake or Comet Lake. Include the missed platform.` Link: https://lore.kernel.org/all/20220808142711.02d16782.alex.williamson@redhat.com Fixes: e0f74ed4634d ("i915/gvt: Separate the MMIO tracking table from GVT-g") Signed-off-by: Alex Williamson Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/166016852965.780835.10366587502693016900.stgit@omen Reviewed-by: Zhenyu Wang commit 233f56745be446b289edac2ba8184c09365c005e Author: Colin Ian King Date: Tue Aug 16 13:02:47 2022 +0800 drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" There is a spelling mistake in a gvt_vgpu_err error message. Fix it. Fixes: 695fbc08d80f ("drm/i915/gvt: replace the gvt_err with gvt_vgpu_err") Signed-off-by: Colin Ian King Signed-off-by: Zhi Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220315202449.2952845-1-colin.i.king@gmail.com Reviewed-by: Zhi Wang Signed-off-by: Zhenyu Wang commit 8f143b9f3849828870bb2a7f28288095ad9a329d Author: Marcel Ziswiler Date: Fri Aug 12 23:39:05 2022 +0200 arm64: dts: freescale: verdin-imx8mp: fix atmel_mxt_ts reset polarity Fix reset GPIO polarity in-line with the following commit feedaacdadfc ("Input: atmel_mxt_ts - fix up inverted RESET handler"). Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus") Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo commit 90974f655922219c0a0cdce7ae8de7f30c549cb5 Author: Marcel Ziswiler Date: Fri Aug 12 23:39:04 2022 +0200 arm64: dts: freescale: verdin-imx8mm: fix atmel_mxt_ts reset polarity Fix reset GPIO polarity in-line with the following commit feedaacdadfc ("Input: atmel_mxt_ts - fix up inverted RESET handler"). Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Marcel Ziswiler Signed-off-by: Shawn Guo commit 17fe7251d3c7504e85acf0d4ec2eb54e11cbc386 Author: Marek Vasut Date: Fri Aug 12 23:07:40 2022 +0200 arm64: dts: imx8mp: Fix I2C5 GPIO assignment on i.MX8M Plus DHCOM Fix copy-paste error of the I2C5 bus recovery GPIO assignment, the I2C5 GPIOs are on gpio3 instead of gpio5. Fixes: 8d6712695bc8e ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 7f4dbc3f26e5cb1f056faaaf14277f48c4682fff Author: Tim Harvey Date: Fri Aug 12 10:20:54 2022 -0700 arm64: dts: imx8mm-venice-gw7901: fix port/phy validation Since commit 65ac79e18120 ("net: dsa: microchip: add the phylink get_caps") the phy-mode must be set otherwise the switch driver will assume "NA" mode and invalidate the port. Fixes: 65ac79e18120 ("net: dsa: microchip: add the phylink get_caps") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 2fa24aa721ebb3a83dd2093814ba9a5dcdaa3183 Author: Philippe Schenker Date: Thu Aug 11 16:07:38 2022 +0200 arm64: dts: verdin-imx8mm: add otg2 pd to usbphy The Verdin iMX8M Mini System on Module does not have USB-ID signal connected on Verdin USB_2 (usbotg2). On Verdin Development board this is no problem, as we have connected a USB-Hub that is always connected. However, if Verdin USB_2 is desired to be used as a single USB-Host port the chipidea driver does not detect if a USB device is plugged into this port, due to runtime pm shutting down the PHY. Add the power-domain &pgc_otg2 to &usbphynop2 in order to detect plugging events and enumerate the usb device. Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Philippe Schenker Signed-off-by: Shawn Guo commit 1c23f9e627a7b412978b4e852793c5e3c3efc555 Author: Linus Torvalds Date: Sun Aug 21 17:32:54 2022 -0700 Linux 6.0-rc2 commit 4daa6a81c07c54f989e70d682fa0bff568c14df0 Merge: 4f61f842d199a 57646d6769f13 Author: Linus Torvalds Date: Sun Aug 21 15:09:55 2022 -0700 Merge tag 'irq-urgent-2022-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Misc irqchip fixes: LoongArch driver fixes and a Hyper-V IOMMU fix" * tag 'irq-urgent-2022-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/loongson-liointc: Fix an error handling path in liointc_init() irqchip/loongarch: Fix irq_domain_alloc_fwnode() abuse irqchip/loongson-pch-pic: Move find_pch_pic() into CONFIG_ACPI irqchip/loongson-eiointc: Fix a build warning irqchip/loongson-eiointc: Fix irq affinity setting iommu/hyper-v: Use helper instead of directly accessing affinity commit 4f61f842d199a695bb0c310945f7f320c1730abc Merge: 7fb312d2256da 8924779df820c Author: Linus Torvalds Date: Sun Aug 21 15:01:51 2022 -0700 Merge tag 'perf-urgent-2022-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 kprobes fix from Ingo Molnar: "Fix a kprobes bug in JNG/JNLE emulation when a kprobe is installed at such instructions, possibly resulting in incorrect execution (the wrong branch taken)" * tag 'perf-urgent-2022-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kprobes: Fix JNG/JNLE emulation commit 7fb312d2256da63e6e4c6e92d279a90fe44bcabd Merge: e3f259d33c0eb b2380577d4fe1 Author: Linus Torvalds Date: Sun Aug 21 14:49:42 2022 -0700 Merge tag 'trace-v6.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Various fixes for tracing: - Fix a return value of traceprobe_parse_event_name() - Fix NULL pointer dereference from failed ftrace enabling - Fix NULL pointer dereference when asking for registers from eprobes - Make eprobes consistent with kprobes/uprobes, filters and histograms" * tag 'trace-v6.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Have filter accept "common_cpu" to be consistent tracing/probes: Have kprobes and uprobes use $COMM too tracing/eprobes: Have event probes be consistent with kprobes and uprobes tracing/eprobes: Fix reading of string fields tracing/eprobes: Do not hardcode $comm as a string tracing/eprobes: Do not allow eprobes to use $stack, or % for regs ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead tracing/perf: Fix double put of trace event when init fails tracing: React to error return from traceprobe_parse_event_name() commit b2380577d4fe1c0ef3fa50417f1e441c016e4cbe Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:22 2022 -0400 tracing: Have filter accept "common_cpu" to be consistent Make filtering consistent with histograms. As "cpu" can be a field of an event, allow for "common_cpu" to keep it from being confused with the "cpu" field of the event. Link: https://lkml.kernel.org/r/20220820134401.513062765@goodmis.org Link: https://lore.kernel.org/all/20220820220920.e42fa32b70505b1904f0a0ad@kernel.org/ Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 1e3bac71c5053 ("tracing/histogram: Rename "cpu" to "common_cpu"") Suggested-by: Masami Hiramatsu (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit ab8384442ee512fc0fc72deeb036110843d0e7ff Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:21 2022 -0400 tracing/probes: Have kprobes and uprobes use $COMM too Both $comm and $COMM can be used to get current->comm in eprobes and the filtering and histogram logic. Make kprobes and uprobes consistent in this regard and allow both $comm and $COMM as well. Currently kprobes and uprobes only handle $comm, which is inconsistent with the other utilities, and can be confusing to users. Link: https://lkml.kernel.org/r/20220820134401.317014913@goodmis.org Link: https://lore.kernel.org/all/20220820220442.776e1ddaf8836e82edb34d01@kernel.org/ Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") Suggested-by: Masami Hiramatsu (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 6a832ec3d680b3a4f4fad5752672827d71bae501 Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:20 2022 -0400 tracing/eprobes: Have event probes be consistent with kprobes and uprobes Currently, if a symbol "@" is attempted to be used with an event probe (eprobes), it will cause a NULL pointer dereference crash. Both kprobes and uprobes can reference data other than the main registers. Such as immediate address, symbols and the current task name. Have eprobes do the same thing. For "comm", if "comm" is used and the event being attached to does not have the "comm" field, then make it the "$comm" that kprobes has. This is consistent to the way histograms and filters work. Link: https://lkml.kernel.org/r/20220820134401.136924220@goodmis.org Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Masami Hiramatsu Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Steven Rostedt (Google) commit f04dec93466a0481763f3b56cdadf8076e28bfbf Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:19 2022 -0400 tracing/eprobes: Fix reading of string fields Currently when an event probe (eprobe) hooks to a string field, it does not display it as a string, but instead as a number. This makes the field rather useless. Handle the different kinds of strings, dynamic, static, relational/dynamic etc. Now when a string field is used, the ":string" type can be used to display it: echo "e:sw sched/sched_switch comm=$next_comm:string" > dynamic_events Link: https://lkml.kernel.org/r/20220820134400.959640191@goodmis.org Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 02333de90e5945e2fe7fc75b15b4eb9aee187f0a Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:18 2022 -0400 tracing/eprobes: Do not hardcode $comm as a string The variable $comm is hard coded as a string, which is true for both kprobes and uprobes, but for event probes (eprobes) it is a field name. In most cases the "comm" field would be a string, but there's no guarantee of that fact. Do not assume that comm is a string. Not to mention, it currently forces comm fields to fault, as string processing for event probes is currently broken. Link: https://lkml.kernel.org/r/20220820134400.756152112@goodmis.org Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Masami Hiramatsu Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Steven Rostedt (Google) commit 2673c60ee67e71f2ebe34386e62d348f71edee47 Author: Steven Rostedt (Google) Date: Sat Aug 20 09:43:17 2022 -0400 tracing/eprobes: Do not allow eprobes to use $stack, or % for regs While playing with event probes (eprobes), I tried to see what would happen if I attempted to retrieve the instruction pointer (%rip) knowing that event probes do not use pt_regs. The result was: BUG: kernel NULL pointer dereference, address: 0000000000000024 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1847 Comm: trace-cmd Not tainted 5.19.0-rc5-test+ #309 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016 RIP: 0010:get_event_field.isra.0+0x0/0x50 Code: ff 48 c7 c7 c0 8f 74 a1 e8 3d 8b f5 ff e8 88 09 f6 ff 4c 89 e7 e8 50 6a 13 00 48 89 ef 5b 5d 41 5c 41 5d e9 42 6a 13 00 66 90 <48> 63 47 24 8b 57 2c 48 01 c6 8b 47 28 83 f8 02 74 0e 83 f8 04 74 RSP: 0018:ffff916c394bbaf0 EFLAGS: 00010086 RAX: ffff916c854041d8 RBX: ffff916c8d9fbf50 RCX: ffff916c255d2000 RDX: 0000000000000000 RSI: ffff916c255d2008 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff916c3a2a0c08 R09: ffff916c394bbda8 R10: 0000000000000000 R11: 0000000000000000 R12: ffff916c854041d8 R13: ffff916c854041b0 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff916c9ea40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000024 CR3: 000000011b60a002 CR4: 00000000001706e0 Call Trace: get_eprobe_size+0xb4/0x640 ? __mod_node_page_state+0x72/0xc0 __eprobe_trace_func+0x59/0x1a0 ? __mod_lruvec_page_state+0xaa/0x1b0 ? page_remove_file_rmap+0x14/0x230 ? page_remove_rmap+0xda/0x170 event_triggers_call+0x52/0xe0 trace_event_buffer_commit+0x18f/0x240 trace_event_raw_event_sched_wakeup_template+0x7a/0xb0 try_to_wake_up+0x260/0x4c0 __wake_up_common+0x80/0x180 __wake_up_common_lock+0x7c/0xc0 do_notify_parent+0x1c9/0x2a0 exit_notify+0x1a9/0x220 do_exit+0x2ba/0x450 do_group_exit+0x2d/0x90 __x64_sys_exit_group+0x14/0x20 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Obviously this is not the desired result. Move the testing for TPARG_FL_TPOINT which is only used for event probes to the top of the "$" variable check, as all the other variables are not used for event probes. Also add a check in the register parsing "%" to fail if an event probe is used. Link: https://lkml.kernel.org/r/20220820134400.564426983@goodmis.org Cc: stable@vger.kernel.org Cc: Ingo Molnar Cc: Andrew Morton Cc: Tzvetomir Stoyanov Cc: Tom Zanussi Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit c3b0f72e805f0801f05fa2aa52011c4bfc694c44 Author: Yang Jihong Date: Thu Aug 18 11:26:59 2022 +0800 ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list. Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com Suggested-by: Steven Rostedt Signed-off-by: Yang Jihong Signed-off-by: Steven Rostedt (Google) commit 7249921d94ff64f67b733eca0b68853a62032b3d Author: Steven Rostedt (Google) Date: Tue Aug 16 19:28:17 2022 -0400 tracing/perf: Fix double put of trace event when init fails If in perf_trace_event_init(), the perf_trace_event_open() fails, then it will call perf_trace_event_unreg() which will not only unregister the perf trace event, but will also call the put() function of the tp_event. The problem here is that the trace_event_try_get_ref() is called by the caller of perf_trace_event_init() and if perf_trace_event_init() returns a failure, it will then call trace_event_put(). But since the perf_trace_event_unreg() already called the trace_event_put() function, it triggers a WARN_ON(). WARNING: CPU: 1 PID: 30309 at kernel/trace/trace_dynevent.c:46 trace_event_dyn_put_ref+0x15/0x20 If perf_trace_event_reg() does not call the trace_event_try_get_ref() then the perf_trace_event_unreg() should not be calling trace_event_put(). This breaks symmetry and causes bugs like these. Pull out the trace_event_put() from perf_trace_event_unreg() and call it in the locations that perf_trace_event_unreg() is called. This not only fixes this bug, but also brings back the proper symmetry of the reg/unreg vs get/put logic. Link: https://lore.kernel.org/all/cover.1660347763.git.kjlx@templeofstupid.com/ Link: https://lkml.kernel.org/r/20220816192817.43d5e17f@gandalf.local.home Cc: stable@vger.kernel.org Fixes: 1d18538e6a092 ("tracing: Have dynamic events have a ref counter") Reported-by: Krister Johansen Reviewed-by: Krister Johansen Tested-by: Krister Johansen Acked-by: Jiri Olsa Signed-off-by: Steven Rostedt (Google) commit d8a64313c171464aedd6289378a51c8f0f524acb Author: Lukas Bulwahn Date: Thu Aug 11 09:17:34 2022 +0200 tracing: React to error return from traceprobe_parse_event_name() The function traceprobe_parse_event_name() may set the first two function arguments to a non-null value and still return -EINVAL to indicate an unsuccessful completion of the function. Hence, it is not sufficient to just check the result of the two function arguments for being not null, but the return value also needs to be checked. Commit 95c104c378dc ("tracing: Auto generate event name when creating a group of events") changed the error-return-value checking of the second traceprobe_parse_event_name() invocation in __trace_eprobe_create() and removed checking the return value to jump to the error handling case. Reinstate using the return value in the error-return-value checking. Link: https://lkml.kernel.org/r/20220811071734.20700-1-lukas.bulwahn@gmail.com Fixes: 95c104c378dc ("tracing: Auto generate event name when creating a group of events") Acked-by: Linyu Yuan Signed-off-by: Lukas Bulwahn Signed-off-by: Steven Rostedt (Google) commit e3f259d33c0ebae1b6e4922c7cdb50e864c81928 Merge: 367bcbc5b5ffc d98bdd3a5b504 Author: Linus Torvalds Date: Sun Aug 21 11:18:33 2022 -0700 Merge tag 'i2c-for-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A revert to fix a regression introduced this merge window and a fix for proper error handling in the remove path of the iMX driver" * tag 'i2c-for-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx: Make sure to unregister adapter on remove() Revert "i2c: scmi: Replace open coded device_get_match_data()" commit 0096fc879358ad6b82ee7e790c07b118c515c980 Author: sunliming Date: Mon Aug 15 09:29:30 2022 +0800 iio: light: cm32181: make cm32181_pm_ops static This symbol is not used outside of cm32181.c, so marks it static. Fixes the following sparse warnings: >> drivers/iio/light/cm32181.c:508:1: sparse: sparse: symbol 'cm32181_pm_ops' was not declared. Should it be static? Reported-by: kernel test robot Signed-off-by: sunliming Link: https://lore.kernel.org/r/20220815012930.150078-1-sunliming@kylinos.cn Signed-off-by: Jonathan Cameron commit 22b4277641c6823ec03d5b1cd82628e5e53e75b7 Author: Matti Vaittinen Date: Fri Aug 19 11:51:07 2022 +0300 iio: ad7292: Prevent regulator double disable The ad7292 tries to add an devm_action for disabling a regulator at device detach using devm_add_action_or_reset(). The devm_add_action_or_reset() does call the release function should adding action fail. The driver inspects the value returned by devm_add_action_or_reset() and manually calls regulator_disable() if adding the action has failed. This leads to double disable and messes the enable count for regulator. Do not manually call disable if devm_add_action_or_reset() fails. Fixes: 506d2e317a0a ("iio: adc: Add driver support for AD7292") Signed-off-by: Matti Vaittinen Tested-by: Marcelo Schmitt Link: https://lore.kernel.org/r/Yv9O+9sxU7gAv3vM@fedora Cc: Signed-off-by: Jonathan Cameron commit 767470209cedbe2cc72ba38d77c9f096d2c7694c Author: Krzysztof Kozlowski Date: Fri Aug 5 09:55:03 2022 +0200 dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins BMG160 has two interrupt pins to which interrupts can be freely mapped. Correct the schema to express such case and fix warnings like: qcom/msm8916-alcatel-idol347.dtb: gyroscope@68: interrupts: [[97, 1], [98, 1]] is too long However the basic issue still persists - the interrupts should come in a defined order. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220805075503.16983-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit 9e2238e3ae40d371a1130226e0e740aa1601efa6 Author: Marcus Folkesson Date: Fri Jul 22 15:07:20 2022 +0200 iio: adc: mcp3911: use correct formula for AD conversion The ADC conversion is actually not rail-to-rail but with a factor 1.5. Make use of this factor when calculating actual voltage. Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911") Signed-off-by: Marcus Folkesson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220722130726.7627-4-marcus.folkesson@gmail.com Cc: Signed-off-by: Jonathan Cameron commit cfbd76d5c9c449739bb74288d982bccf9ff822f4 Author: Marcus Folkesson Date: Fri Jul 22 15:07:19 2022 +0200 iio: adc: mcp3911: correct "microchip,device-addr" property Go for the right property name that is documented in the bindings. Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911") Signed-off-by: Marcus Folkesson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220722130726.7627-3-marcus.folkesson@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 367bcbc5b5ffc7164fb6ce1547e84dbf21795562 Merge: a0a12c3ed057a 13609a8b3ac6b Author: Linus Torvalds Date: Sun Aug 21 10:21:16 2022 -0700 Merge tag '6.0-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: - memory leak fix - two small cleanups - trivial strlcpy removal - update missing entry for cifs headers in MAINTAINERS file * tag '6.0-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: move from strlcpy with unused retval to strscpy cifs: Fix memory leak on the deferred close cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() cifs: remove unused server parameter from calc_smb_size() cifs: missing directory in MAINTAINERS file commit a0a12c3ed057af57552bf6c0aeaca6835693df04 Author: Nick Desaulniers Date: Fri Aug 19 12:06:40 2022 -0700 asm goto: eradicate CC_HAS_ASM_GOTO GCC has supported asm goto since 4.5, and Clang has since version 9.0.0. The minimum supported versions of these tools for the build according to Documentation/process/changes.rst are 5.1 and 11.0.0 respectively. Remove the feature detection script, Kconfig option, and clean up some fallback code that is no longer supported. The removed script was also testing for a GCC specific bug that was fixed in the 4.7 release. Also remove workarounds for bpftrace using clang older than 9.0.0, since other BPF backend fixes are required at this point. Link: https://lore.kernel.org/lkml/CAK7LNATSr=BXKfkdW8f-H5VT_w=xBpT2ZQcZ7rm6JfkdE+QnmA@mail.gmail.com/ Link: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48637 Acked-by: Borislav Petkov Suggested-by: Masahiro Yamada Suggested-by: Alexei Starovoitov Signed-off-by: Nick Desaulniers Reviewed-by: Ingo Molnar Reviewed-by: Nathan Chancellor Reviewed-by: Alexandre Belloni Signed-off-by: Linus Torvalds commit df88005bd81b80c944d185554e264a4b0f993c37 Author: Marek Vasut Date: Fri Aug 12 19:08:02 2022 +0200 soc: imx: gpcv2: Assert reset before ungating clock In case the power domain clock are ungated before the reset is asserted, the system might freeze completely. This is likely due to a device is an undefined state being attached to bus, which sporadically leads to a bus hang. Assert the reset before the clock are enabled to assure the device is in defined state before being attached to bus. Fixes: fe58c887fb8ca ("soc: imx: gpcv2: add support for optional resets") Signed-off-by: Marek Vasut Reviewed-by: Fabio Estevam Reviewed-by: Lucas Stach Signed-off-by: Shawn Guo commit e7406f864e765c564c5cf384464faff66114f97d Author: Vladimir Oltean Date: Tue Aug 2 16:50:06 2022 +0300 arm64: dts: ls1028a-qds-65bb: don't use in-band autoneg for 2500base-x The Lynx PCS integrated with ENETC port 0 does not support in-band autoneg for the 2500base-x SERDES protocol, and prints errors from its phylink methods. Furthermore, the AQR112 card used for these boards does not expect in-band autoneg either. So delete the extraneous property. Fixes: e426d63e752b ("arm64: dts: ls1028a-qds: add overlays for various serdes protocols") Signed-off-by: Vladimir Oltean Signed-off-by: Shawn Guo commit af7d78c957017f8b3a0986769f6f18e57f9362ea Author: Marco Felsch Date: Tue Jul 26 15:05:22 2022 +0200 ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible Drop the "winbond,w25q16dw" compatible since it causes to set the MODALIAS to w25q16dw which is not specified within spi-nor id table. Fix this by use the common "jedec,spi-nor" compatible. Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit 204f67d86f55dd4fa757ed04757d7273f71a169c Author: Marco Felsch Date: Tue Jul 26 15:05:21 2022 +0200 ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node The regulator node 'regulator-3p3v-s0' was dupplicated. Remove it to clean the DTS. Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit 83c75e1bc2b83b3f0c718833bde677ebfa736283 Author: David Jander Date: Tue Jul 26 14:32:22 2022 +0200 ARM: dts: imx6qdl-vicut1.dtsi: Fix node name backlight_led This naming error slipped through, so now that a new backlight node has been added with correct spelling, fix this one also. Fixes: 98efa526a0c4 ("ARM: dts: imx6qdl-vicut1/vicutgo: Add backlight_led node") Signed-off-by: David Jander Signed-off-by: Shawn Guo commit fc2e426b1161761561624ebd43ce8c8d2fa058da Author: Chen Zhongjin Date: Fri Aug 19 16:43:34 2022 +0800 x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry When meeting ftrace trampolines in ORC unwinding, unwinder uses address of ftrace_{regs_}call address to find the ORC entry, which gets next frame at sp+176. If there is an IRQ hitting at sub $0xa8,%rsp, the next frame should be sp+8 instead of 176. It makes unwinder skip correct frame and throw warnings such as "wrong direction" or "can't access registers", etc, depending on the content of the incorrect frame address. By adding the base address ftrace_{regs_}caller with the offset *ip - ops->trampoline*, we can get the correct address to find the ORC entry. Also change "caller" to "tramp_addr" to make variable name conform to its content. [ mingo: Clarified the changelog a bit. ] Fixes: 6be7fa3c74d1 ("ftrace, orc, x86: Handle ftrace dynamically allocated trampolines") Signed-off-by: Chen Zhongjin Signed-off-by: Ingo Molnar Reviewed-by: Steven Rostedt (Google) Cc: Link: https://lore.kernel.org/r/20220819084334.244016-1-chenzhongjin@huawei.com commit 56c310de0b4b3aca1c4fdd9c1093fc48372a7335 Author: Jack Wang Date: Thu Aug 18 12:53:55 2022 +0200 RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may change the number of entries and the lengths of each entry. Code that touches dma_address is iterating over the 'dma mapped SGL' and must use dma_nents which returned from ib_dma_map_sg(). We should use the return count from ib_dma_map_sg for futher usage. Fixes: 9cb837480424e ("RDMA/rtrs: server: main functionality") Link: https://lore.kernel.org/r/20220818105355.110344-4-haris.iqbal@ionos.com Signed-off-by: Jack Wang Reviewed-by: Aleksei Marov Signed-off-by: Leon Romanovsky commit b66905e04dc714825aa6cffb950e281b46bbeafe Author: Jack Wang Date: Thu Aug 18 12:53:54 2022 +0200 RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg When iommu is enabled, we hit warnings like this: WARNING: at rtrs/rtrs.c:178 rtrs_iu_post_rdma_write_imm+0x9b/0x110 rtrs warn on one sge entry length is 0, which is unexpected. The problem is ib_dma_map_sg augments the SGL into a 'dma mapped SGL'. This process may change the number of entries and the lengths of each entry. Code that touches dma_address is iterating over the 'dma mapped SGL' and must use dma_nents which returned from ib_dma_map_sg(). So pass the count return from ib_dma_map_sg. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Link: https://lore.kernel.org/r/20220818105355.110344-3-haris.iqbal@ionos.com Signed-off-by: Jack Wang Reviewed-by: Aleksei Marov Signed-off-by: Leon Romanovsky commit 8eaac789128a84e79c193e662959469e824423ee Author: Alexander Stein Date: Mon Jul 25 16:17:39 2022 +0200 arm64: dts: imx8mq-tqma8mq: Remove superfluous interrupt-names This property was never needed, remove it. This also silences dtbs_check warnings. Fixes: b186b8b6e770 ("arm64: dts: freescale: add initial device tree for TQMa8Mx with i.MX8M") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit d98bdd3a5b50446d8e010be5b04ce81c4eabf728 Author: Uwe Kleine-König Date: Wed Jul 20 17:09:33 2022 +0200 i2c: imx: Make sure to unregister adapter on remove() If for whatever reasons pm_runtime_resume_and_get() fails and .remove() is exited early, the i2c adapter stays around and the irq still calls its handler, while the driver data and the register mapping go away. So if later the i2c adapter is accessed or the irq triggers this results in havoc accessing freed memory and unmapped registers. So unregister the software resources even if resume failed, and only skip the hardware access in that case. Fixes: 588eb93ea49f ("i2c: imx: add runtime pm support to improve the performance") Signed-off-by: Uwe Kleine-König Acked-by: Oleksij Rempel Signed-off-by: Wolfram Sang commit 3df71d7064cbb19a3ac0e5dc25ece2bbf3a4d9af Author: Wolfram Sang Date: Thu Aug 18 22:31:13 2022 +0200 Revert "i2c: scmi: Replace open coded device_get_match_data()" This reverts commit 9ae551ded5ba55f96a83cd0811f7ef8c2f329d0c. We got a regression report, so ensure this machine boots again. We will come back with a better version hopefully. Reported-by: Josef Johansson Link: https://lore.kernel.org/r/4d2d5b04-0b6c-1cb1-a63f-dc06dfe1b5da@oderland.se Signed-off-by: Wolfram Sang commit c7afab4ac7bd5137e20711fba5ba34ee67b72710 Author: Marek Vasut Date: Sat Jul 23 23:24:39 2022 +0200 arm64: dts: imx8mp: Adjust ECSPI1 pinmux on i.MX8M Plus DHCOM The ECSPI1 is on I2C1/I2C2 pins of the SoC, update the pinmux accordingly. Fixes: 8d6712695bc8e ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") Signed-off-by: Marek Vasut Cc: Fabio Estevam Cc: NXP Linux Team Cc: Peng Fan Cc: Shawn Guo To: linux-arm-kernel@lists.infradead.org Signed-off-by: Shawn Guo commit 706dd9d30d3bda4e31d423af004c22d48e89fbc9 Author: Peng Fan Date: Sat Jul 23 18:50:05 2022 +0800 arm64: dts: imx8mp-venice-gw74xx: fix sai2 pin settings The pad settings are missed, add them Fixes: 7899eb6cb15d ("arm64: dts: imx: Add i.MX8M Plus Gateworks gw7400 dts support") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 7ae1f5508d9a33fd58ed3059bd2d569961e3b8bd Author: Helge Deller Date: Sat Aug 20 17:59:17 2022 +0200 parisc: Fix exception handler for fldw and fstw instructions The exception handler is broken for unaligned memory acceses with fldw and fstw instructions, because it trashes or uses randomly some other floating point register than the one specified in the instruction word on loads and stores. The instruction "fldw 0(addr),%fr22L" (and the other fldw/fstw instructions) encode the target register (%fr22) in the rightmost 5 bits of the instruction word. The 7th rightmost bit of the instruction word defines if the left or right half of %fr22 should be used. While processing unaligned address accesses, the FR3() define is used to extract the offset into the local floating-point register set. But the calculation in FR3() was buggy, so that for example instead of %fr22, register %fr12 [((22 * 2) & 0x1f) = 12] was used. This bug has been since forever in the parisc kernel and I wonder why it wasn't detected earlier. Interestingly I noticed this bug just because the libime debian package failed to build on *native* hardware, while it successfully built in qemu. This patch corrects the bitshift and masking calculation in FR3(). Signed-off-by: Helge Deller Cc: commit 9c80e79906b4ca440d09e7f116609262bb747909 Author: Kuniyuki Iwashima Date: Fri Aug 12 19:05:09 2022 -0700 kprobes: don't call disarm_kprobe() for disabled kprobes The assumption in __disable_kprobe() is wrong, and it could try to disarm an already disarmed kprobe and fire the WARN_ONCE() below. [0] We can easily reproduce this issue. 1. Write 0 to /sys/kernel/debug/kprobes/enabled. # echo 0 > /sys/kernel/debug/kprobes/enabled 2. Run execsnoop. At this time, one kprobe is disabled. # /usr/share/bcc/tools/execsnoop & [1] 2460 PCOMM PID PPID RET ARGS # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k __x64_sys_execve+0x0 [DISABLED][FTRACE] 3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes kprobes_all_disarmed to false but does not arm the disabled kprobe. # echo 1 > /sys/kernel/debug/kprobes/enabled # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k __x64_sys_execve+0x0 [DISABLED][FTRACE] 4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace(). # fg /usr/share/bcc/tools/execsnoop ^C Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses some cleanups and leaves the aggregated kprobe in the hash table. Then, __unregister_trace_kprobe() initialises tk->rp.kp.list and creates an infinite loop like this. aggregated kprobe.list -> kprobe.list -. ^ | '.__.' In this situation, these commands fall into the infinite loop and result in RCU stall or soft lockup. cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the infinite loop with RCU. /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex, and __get_valid_kprobe() is stuck in the loop. To avoid the issue, make sure we don't call disarm_kprobe() for disabled kprobes. [0] Failed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2) WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Modules linked in: ena CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28 Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94 RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40 R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000 FS: 00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __disable_kprobe (kernel/kprobes.c:1716) disable_kprobe (kernel/kprobes.c:2392) __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340) disable_trace_kprobe (kernel/trace/trace_kprobe.c:429) perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168) perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295) _free_event (kernel/events/core.c:4971) perf_event_release_kernel (kernel/events/core.c:5176) perf_release (kernel/events/core.c:5186) __fput (fs/file_table.c:321) task_work_run (./include/linux/sched.h:2056 (discriminator 1) kernel/task_work.c:179 (discriminator 1)) exit_to_user_mode_prepare (./include/linux/resume_user_mode.h:49 kernel/entry/common.c:169 kernel/entry/common.c:201) syscall_exit_to_user_mode (./arch/x86/include/asm/jump_label.h:55 ./arch/x86/include/asm/nospec-branch.h:384 ./arch/x86/include/asm/entry-common.h:94 kernel/entry/common.c:133 kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:87) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7fe7ff210654 Code: 15 79 89 20 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb be 0f 1f 00 8b 05 9a cd 20 00 48 63 ff 85 c0 75 11 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 3a f3 c3 48 83 ec 18 48 89 7c 24 08 e8 34 fc RSP: 002b:00007ffdbd1d3538 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00007fe7ff210654 RDX: 0000000000000000 RSI: 0000000000002401 RDI: 0000000000000008 RBP: 0000000000000000 R08: 94ae31d6fda838a4 R0900007fe8001c9d30 R10: 00007ffdbd1d34b0 R11: 0000000000000246 R12: 00007ffdbd1d3600 R13: 0000000000000000 R14: fffffffffffffffc R15: 00007ffdbd1d3560 Link: https://lkml.kernel.org/r/20220813020509.90805-1-kuniyu@amazon.com Fixes: 69d54b916d83 ("kprobes: makes kprobes/enabled works correctly for optimized kprobes.") Signed-off-by: Kuniyuki Iwashima Reported-by: Ayushman Dutta Cc: "Naveen N. Rao" Cc: Anil S Keshavamurthy Cc: "David S. Miller" Cc: Masami Hiramatsu Cc: Wang Nan Cc: Kuniyuki Iwashima Cc: Kuniyuki Iwashima Cc: Ayushman Dutta Cc: Signed-off-by: Andrew Morton commit 76d36dea02691a8ffa8cd7368eecbf727b8a1c0c Author: Hugh Dickins Date: Wed Aug 10 22:06:33 2022 -0700 mm/shmem: shmem_replace_page() remember NR_SHMEM Elsewhere, NR_SHMEM is updated at the same time as shmem NR_FILE_PAGES; but shmem_replace_page() was forgetting to do that - so NR_SHMEM stats could grow too big or too small, in those unusual cases when it's used. Link: https://lkml.kernel.org/r/cec7c09d-5874-e160-ada6-6e10ee48784@google.com Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox (Oracle) Cc: "Darrick J. Wong" Cc: Radoslaw Burny Cc: "Theodore Ts'o" Signed-off-by: Andrew Morton commit 15f242bb65b89d5f1ff990668a586fdf1307b2c8 Author: Hugh Dickins Date: Wed Aug 10 21:55:36 2022 -0700 mm/shmem: tmpfs fallocate use file_modified() 5.18 fixed the btrfs and ext4 fallocates to use file_modified(), as xfs was already doing, to drop privileges: and fstests generic/{683,684,688} expect this. There's no need to argue over keep-size allocation (which could just update ctime): fix shmem_fallocate() to behave the same way. Link: https://lkml.kernel.org/r/39c5e62-4896-7795-c0a0-f79c50d4909@google.com Signed-off-by: Hugh Dickins Acked-by: Christian Brauner (Microsoft) Cc: "Darrick J. Wong" Cc: Matthew Wilcox (Oracle) Cc: Radoslaw Burny Cc: "Theodore Ts'o" Signed-off-by: Andrew Morton commit cb241339b9d020c758a6647c69f8e42538c5cf88 Author: Hugh Dickins Date: Wed Aug 10 21:51:09 2022 -0700 mm/shmem: fix chattr fsflags support in tmpfs ext[234] have always allowed unimplemented chattr flags to be set, but other filesystems have tended to be stricter. Follow the stricter approach for tmpfs: I don't want to have to explain why csu attributes don't actually work, and we won't need to update the chattr(1) manpage; and it's never wrong to start off strict, relaxing later if persuaded. Allow only a (append only) i (immutable) A (no atime) and d (no dump). Although lsattr showed 'A' inherited, the NOATIME behavior was not being inherited: because nothing sync'ed FS_NOATIME_FL to S_NOATIME. Add shmem_set_inode_flags() to sync the flags, using inode_set_flags() to avoid that instant of lost immutablility during fileattr_set(). But that change switched generic/079 from passing to failing: because FS_IMMUTABLE_FL and FS_APPEND_FL had been unconventionally included in the INHERITED fsflags: remove them and generic/079 is back to passing. Link: https://lkml.kernel.org/r/2961dcb0-ddf3-b9f0-3268-12a4ff996856@google.com Fixes: e408e695f5f1 ("mm/shmem: support FS_IOC_[SG]ETFLAGS in tmpfs") Signed-off-by: Hugh Dickins Cc: "Theodore Ts'o" Cc: Radoslaw Burny Cc: "Darrick J. Wong" Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1d8d14641fd94a01b20a4abbf2749fd8eddcf57b Author: David Hildenbrand Date: Thu Aug 11 12:34:35 2022 +0200 mm/hugetlb: support write-faults in shared mappings If we ever get a write-fault on a write-protected page in a shared mapping, we'd be in trouble (again). Instead, we can simply map the page writable. And in fact, there is even a way right now to trigger that code via uffd-wp ever since we stared to support it for shmem in 5.19: -------------------------------------------------------------------------- #include #include #include #include #include #include #include #include #include #include #define HUGETLB_SIZE (2 * 1024 * 1024u) static char *map; int uffd; static int temp_setup_uffd(void) { struct uffdio_api uffdio_api; struct uffdio_register uffdio_register; struct uffdio_writeprotect uffd_writeprotect; struct uffdio_range uffd_range; uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY); if (uffd < 0) { fprintf(stderr, "syscall() failed: %d\n", errno); return -errno; } uffdio_api.api = UFFD_API; uffdio_api.features = UFFD_FEATURE_PAGEFAULT_FLAG_WP; if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) { fprintf(stderr, "UFFDIO_API failed: %d\n", errno); return -errno; } if (!(uffdio_api.features & UFFD_FEATURE_PAGEFAULT_FLAG_WP)) { fprintf(stderr, "UFFD_FEATURE_WRITEPROTECT missing\n"); return -ENOSYS; } /* Register UFFD-WP */ uffdio_register.range.start = (unsigned long) map; uffdio_register.range.len = HUGETLB_SIZE; uffdio_register.mode = UFFDIO_REGISTER_MODE_WP; if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) { fprintf(stderr, "UFFDIO_REGISTER failed: %d\n", errno); return -errno; } /* Writeprotect a single page. */ uffd_writeprotect.range.start = (unsigned long) map; uffd_writeprotect.range.len = HUGETLB_SIZE; uffd_writeprotect.mode = UFFDIO_WRITEPROTECT_MODE_WP; if (ioctl(uffd, UFFDIO_WRITEPROTECT, &uffd_writeprotect)) { fprintf(stderr, "UFFDIO_WRITEPROTECT failed: %d\n", errno); return -errno; } /* Unregister UFFD-WP without prior writeunprotection. */ uffd_range.start = (unsigned long) map; uffd_range.len = HUGETLB_SIZE; if (ioctl(uffd, UFFDIO_UNREGISTER, &uffd_range)) { fprintf(stderr, "UFFDIO_UNREGISTER failed: %d\n", errno); return -errno; } return 0; } int main(int argc, char **argv) { int fd; fd = open("/dev/hugepages/tmp", O_RDWR | O_CREAT); if (!fd) { fprintf(stderr, "open() failed\n"); return -errno; } if (ftruncate(fd, HUGETLB_SIZE)) { fprintf(stderr, "ftruncate() failed\n"); return -errno; } map = mmap(NULL, HUGETLB_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); if (map == MAP_FAILED) { fprintf(stderr, "mmap() failed\n"); return -errno; } *map = 0; if (temp_setup_uffd()) return 1; *map = 0; return 0; } -------------------------------------------------------------------------- Above test fails with SIGBUS when there is only a single free hugetlb page. # echo 1 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages # ./test Bus error (core dumped) And worse, with sufficient free hugetlb pages it will map an anonymous page into a shared mapping, for example, messing up accounting during unmap and breaking MAP_SHARED semantics: # echo 2 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages # ./test # cat /proc/meminfo | grep HugePages_ HugePages_Total: 2 HugePages_Free: 1 HugePages_Rsvd: 18446744073709551615 HugePages_Surp: 0 Reason is that uffd-wp doesn't clear the uffd-wp PTE bit when unregistering and consequently keeps the PTE writeprotected. Reason for this is to avoid the additional overhead when unregistering. Note that this is the case also for !hugetlb and that we will end up with writable PTEs that still have the uffd-wp PTE bit set once we return from hugetlb_wp(). I'm not touching the uffd-wp PTE bit for now, because it seems to be a generic thing -- wp_page_reuse() also doesn't clear it. VM_MAYSHARE handling in hugetlb_fault() for FAULT_FLAG_WRITE indicates that MAP_SHARED handling was at least envisioned, but could never have worked as expected. While at it, make sure that we never end up in hugetlb_wp() on write faults without VM_WRITE, because we don't support maybe_mkwrite() semantics as commonly used in the !hugetlb case -- for example, in wp_page_reuse(). Note that there is no need to do any kind of reservation in hugetlb_fault() in this case ... because we already have a hugetlb page mapped R/O that we will simply map writable and we are not dealing with COW/unsharing. Link: https://lkml.kernel.org/r/20220811103435.188481-3-david@redhat.com Fixes: b1f9e876862d ("mm/uffd: enable write protection for shmem & hugetlbfs") Signed-off-by: David Hildenbrand Reviewed-by: Mike Kravetz Cc: Bjorn Helgaas Cc: Cyrill Gorcunov Cc: Hugh Dickins Cc: Jamie Liu Cc: Kirill A. Shutemov Cc: Muchun Song Cc: Naoya Horiguchi Cc: Pavel Emelyanov Cc: Peter Feiner Cc: Peter Xu Cc: [5.19] Signed-off-by: Andrew Morton commit f96f7a40874d7c746680c0b9f57cef2262ae551f Author: David Hildenbrand Date: Thu Aug 11 12:34:34 2022 +0200 mm/hugetlb: fix hugetlb not supporting softdirty tracking Patch series "mm/hugetlb: fix write-fault handling for shared mappings", v2. I observed that hugetlb does not support/expect write-faults in shared mappings that would have to map the R/O-mapped page writable -- and I found two case where we could currently get such faults and would erroneously map an anon page into a shared mapping. Reproducers part of the patches. I propose to backport both fixes to stable trees. The first fix needs a small adjustment. This patch (of 2): Staring at hugetlb_wp(), one might wonder where all the logic for shared mappings is when stumbling over a write-protected page in a shared mapping. In fact, there is none, and so far we thought we could get away with that because e.g., mprotect() should always do the right thing and map all pages directly writable. Looks like we were wrong: -------------------------------------------------------------------------- #include #include #include #include #include #include #include #define HUGETLB_SIZE (2 * 1024 * 1024u) static void clear_softdirty(void) { int fd = open("/proc/self/clear_refs", O_WRONLY); const char *ctrl = "4"; int ret; if (fd < 0) { fprintf(stderr, "open(clear_refs) failed\n"); exit(1); } ret = write(fd, ctrl, strlen(ctrl)); if (ret != strlen(ctrl)) { fprintf(stderr, "write(clear_refs) failed\n"); exit(1); } close(fd); } int main(int argc, char **argv) { char *map; int fd; fd = open("/dev/hugepages/tmp", O_RDWR | O_CREAT); if (!fd) { fprintf(stderr, "open() failed\n"); return -errno; } if (ftruncate(fd, HUGETLB_SIZE)) { fprintf(stderr, "ftruncate() failed\n"); return -errno; } map = mmap(NULL, HUGETLB_SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); if (map == MAP_FAILED) { fprintf(stderr, "mmap() failed\n"); return -errno; } *map = 0; if (mprotect(map, HUGETLB_SIZE, PROT_READ)) { fprintf(stderr, "mmprotect() failed\n"); return -errno; } clear_softdirty(); if (mprotect(map, HUGETLB_SIZE, PROT_READ|PROT_WRITE)) { fprintf(stderr, "mmprotect() failed\n"); return -errno; } *map = 0; return 0; } -------------------------------------------------------------------------- Above test fails with SIGBUS when there is only a single free hugetlb page. # echo 1 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages # ./test Bus error (core dumped) And worse, with sufficient free hugetlb pages it will map an anonymous page into a shared mapping, for example, messing up accounting during unmap and breaking MAP_SHARED semantics: # echo 2 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages # ./test # cat /proc/meminfo | grep HugePages_ HugePages_Total: 2 HugePages_Free: 1 HugePages_Rsvd: 18446744073709551615 HugePages_Surp: 0 Reason in this particular case is that vma_wants_writenotify() will return "true", removing VM_SHARED in vma_set_page_prot() to map pages write-protected. Let's teach vma_wants_writenotify() that hugetlb does not support softdirty tracking. Link: https://lkml.kernel.org/r/20220811103435.188481-1-david@redhat.com Link: https://lkml.kernel.org/r/20220811103435.188481-2-david@redhat.com Fixes: 64e455079e1b ("mm: softdirty: enable write notifications on VMAs after VM_SOFTDIRTY cleared") Signed-off-by: David Hildenbrand Reviewed-by: Mike Kravetz Cc: Peter Feiner Cc: Kirill A. Shutemov Cc: Cyrill Gorcunov Cc: Pavel Emelyanov Cc: Jamie Liu Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: Bjorn Helgaas Cc: Muchun Song Cc: Peter Xu Cc: [3.18+] Signed-off-by: Andrew Morton commit f369b07c861435bd812a9d14493f71b34132ed6f Author: Peter Xu Date: Thu Aug 11 16:13:40 2022 -0400 mm/uffd: reset write protection when unregister with wp-mode The motivation of this patch comes from a recent report and patchfix from David Hildenbrand on hugetlb shared handling of wr-protected page [1]. With the reproducer provided in commit message of [1], one can leverage the uffd-wp lazy-reset of ptes to trigger a hugetlb issue which can affect not only the attacker process, but also the whole system. The lazy-reset mechanism of uffd-wp was used to make unregister faster, meanwhile it has an assumption that any leftover pgtable entries should only affect the process on its own, so not only the user should be aware of anything it does, but also it should not affect outside of the process. But it seems that this is not true, and it can also be utilized to make some exploit easier. So far there's no clue showing that the lazy-reset is important to any userfaultfd users because normally the unregister will only happen once for a specific range of memory of the lifecycle of the process. Considering all above, what this patch proposes is to do explicit pte resets when unregister an uffd region with wr-protect mode enabled. It should be the same as calling ioctl(UFFDIO_WRITEPROTECT, wp=false) right before ioctl(UFFDIO_UNREGISTER) for the user. So potentially it'll make the unregister slower. From that pov it's a very slight abi change, but hopefully nothing should break with this change either. Regarding to the change itself - core of uffd write [un]protect operation is moved into a separate function (uffd_wp_range()) and it is reused in the unregister code path. Note that the new function will not check for anything, e.g. ranges or memory types, because they should have been checked during the previous UFFDIO_REGISTER or it should have failed already. It also doesn't check mmap_changing because we're with mmap write lock held anyway. I added a Fixes upon introducing of uffd-wp shmem+hugetlbfs because that's the only issue reported so far and that's the commit David's reproducer will start working (v5.19+). But the whole idea actually applies to not only file memories but also anonymous. It's just that we don't need to fix anonymous prior to v5.19- because there's no known way to exploit. IOW, this patch can also fix the issue reported in [1] as the patch 2 does. [1] https://lore.kernel.org/all/20220811103435.188481-3-david@redhat.com/ Link: https://lkml.kernel.org/r/20220811201340.39342-1-peterx@redhat.com Fixes: b1f9e876862d ("mm/uffd: enable write protection for shmem & hugetlbfs") Signed-off-by: Peter Xu Cc: David Hildenbrand Cc: Mike Rapoport Cc: Mike Kravetz Cc: Andrea Arcangeli Cc: Nadav Amit Cc: Axel Rasmussen Cc: Signed-off-by: Andrew Morton commit efd4149342db2df41b1bbe68972ead853b30e444 Author: Peter Xu Date: Fri Aug 5 12:00:03 2022 -0400 mm/smaps: don't access young/dirty bit if pte unpresent These bits should only be valid when the ptes are present. Introducing two booleans for it and set it to false when !pte_present() for both pte and pmd accountings. The bug is found during code reading and no real world issue reported, but logically such an error can cause incorrect readings for either smaps or smaps_rollup output on quite a few fields. For example, it could cause over-estimate on values like Shared_Dirty, Private_Dirty, Referenced. Or it could also cause under-estimate on values like LazyFree, Shared_Clean, Private_Clean. Link: https://lkml.kernel.org/r/20220805160003.58929-1-peterx@redhat.com Fixes: b1d4d9e0cbd0 ("proc/smaps: carefully handle migration entries") Fixes: c94b6923fa0a ("/proc/PID/smaps: Add PMD migration entry parsing") Signed-off-by: Peter Xu Reviewed-by: Vlastimil Babka Reviewed-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Konstantin Khlebnikov Cc: Huang Ying Signed-off-by: Andrew Morton commit a39c5d3ce03dd890ab6a9be44b21177cec32da55 Author: Hao Lee Date: Sun Aug 7 15:44:42 2022 +0000 mm: add DEVICE_ZONE to FOR_ALL_ZONES FOR_ALL_ZONES should be consistent with enum zone_type. Otherwise, __count_zid_vm_events have the potential to add count to wrong item when zid is ZONE_DEVICE. Link: https://lkml.kernel.org/r/20220807154442.GA18167@haolee.io Signed-off-by: Hao Lee Cc: David Hildenbrand Cc: Johannes Weiner Signed-off-by: Andrew Morton commit a8faed3a02eeb75857a3b5d660fa80fe79db77a3 Author: Randy Dunlap Date: Sun Aug 7 15:09:34 2022 -0700 kernel/sys_ni: add compat entry for fadvise64_64 When CONFIG_ADVISE_SYSCALLS is not set/enabled and CONFIG_COMPAT is set/enabled, the riscv compat_syscall_table references 'compat_sys_fadvise64_64', which is not defined: riscv64-linux-ld: arch/riscv/kernel/compat_syscall_table.o:(.rodata+0x6f8): undefined reference to `compat_sys_fadvise64_64' Add 'fadvise64_64' to kernel/sys_ni.c as a conditional COMPAT function so that when CONFIG_ADVISE_SYSCALLS is not set, there is a fallback function available. Link: https://lkml.kernel.org/r/20220807220934.5689-1-rdunlap@infradead.org Fixes: d3ac21cacc24 ("mm: Support compiling out madvise and fadvise") Signed-off-by: Randy Dunlap Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Cc: Josh Triplett Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Signed-off-by: Andrew Morton commit 5535be3099717646781ce1540cf725965d680e7b Author: David Hildenbrand Date: Tue Aug 9 22:56:40 2022 +0200 mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know that FOLL_FORCE can be possibly dangerous, especially if there are races that can be exploited by user space. Right now, it would be sufficient to have some code that sets a PTE of a R/O-mapped shared page dirty, in order for it to erroneously become writable by FOLL_FORCE. The implications of setting a write-protected PTE dirty might not be immediately obvious to everyone. And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map a shmem page R/O while marking the pte dirty. This can be used by unprivileged user space to modify tmpfs/shmem file content even if the user does not have write permissions to the file, and to bypass memfd write sealing -- Dirty COW restricted to tmpfs/shmem (CVE-2022-2590). To fix such security issues for good, the insight is that we really only need that fancy retry logic (FOLL_COW) for COW mappings that are not writable (!VM_WRITE). And in a COW mapping, we really only broke COW if we have an exclusive anonymous page mapped. If we have something else mapped, or the mapped anonymous page might be shared (!PageAnonExclusive), we have to trigger a write fault to break COW. If we don't find an exclusive anonymous page when we retry, we have to trigger COW breaking once again because something intervened. Let's move away from this mandatory-retry + dirty handling and rely on our PageAnonExclusive() flag for making a similar decision, to use the same COW logic as in other kernel parts here as well. In case we stumble over a PTE in a COW mapping that does not map an exclusive anonymous page, COW was not properly broken and we have to trigger a fake write-fault to break COW. Just like we do in can_change_pte_writable() added via commit 64fe24a3e05e ("mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection") and commit 76aefad628aa ("mm/mprotect: fix soft-dirty check in can_change_pte_writable()"), take care of softdirty and uffd-wp manually. For example, a write() via /proc/self/mem to a uffd-wp-protected range has to fail instead of silently granting write access and bypassing the userspace fault handler. Note that FOLL_FORCE is not only used for debug access, but also triggered by applications without debug intentions, for example, when pinning pages via RDMA. This fixes CVE-2022-2590. Note that only x86_64 and aarch64 are affected, because only those support CONFIG_HAVE_ARCH_USERFAULTFD_MINOR. Fortunately, FOLL_COW is no longer required to handle FOLL_FORCE. So let's just get rid of it. Thanks to Nadav Amit for pointing out that the pte_dirty() check in FOLL_FORCE code is problematic and might be exploitable. Note 1: We don't check for the PTE being dirty because it doesn't matter for making a "was COWed" decision anymore, and whoever modifies the page has to set the page dirty either way. Note 2: Kernels before extended uffd-wp support and before PageAnonExclusive (< 5.19) can simply revert the problematic commit instead and be safe regarding UFFDIO_CONTINUE. A backport to v5.19 requires minor adjustments due to lack of vma_soft_dirty_enabled(). Link: https://lkml.kernel.org/r/20220809205640.70916-1-david@redhat.com Fixes: 9ae0f87d009c ("mm/shmem: unconditionally set pte dirty in mfill_atomic_install_pte") Signed-off-by: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Axel Rasmussen Cc: Nadav Amit Cc: Peter Xu Cc: Hugh Dickins Cc: Andrea Arcangeli Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: John Hubbard Cc: Jason Gunthorpe Cc: David Laight Cc: [5.16] Signed-off-by: Andrew Morton commit 37887783b3fef877bf34b8992c9199864da4afcb Author: Jiri Slaby Date: Wed Aug 10 09:06:09 2022 +0200 Revert "zram: remove double compression logic" This reverts commit e7be8d1dd983156b ("zram: remove double compression logic") as it causes zram failures. It does not revert cleanly, PTR_ERR handling was introduced in the meantime. This is handled by appropriate IS_ERR. When under memory pressure, zs_malloc() can fail. Before the above commit, the allocation was retried with direct reclaim enabled (GFP_NOIO). After the commit, it is not -- only __GFP_KSWAPD_RECLAIM is tried. So when the failure occurs under memory pressure, the overlaying filesystem such as ext2 (mounted by ext4 module in this case) can emit failures, making the (file)system unusable: EXT4-fs warning (device zram0): ext4_end_bio:343: I/O error 10 writing to inode 16386 starting block 159744) Buffer I/O error on device zram0, logical block 159744 With direct reclaim, memory is really reclaimed and allocation succeeds, eventually. In the worst case, the oom killer is invoked, which is proper outcome if user sets up zram too large (in comparison to available RAM). This very diff doesn't apply to 5.19 (stable) cleanly (see PTR_ERR note above). Use revert of e7be8d1dd983 directly. Link: https://bugzilla.suse.com/show_bug.cgi?id=1202203 Link: https://lkml.kernel.org/r/20220810070609.14402-1-jslaby@suse.cz Fixes: e7be8d1dd983 ("zram: remove double compression logic") Signed-off-by: Jiri Slaby Reviewed-by: Sergey Senozhatsky Cc: Minchan Kim Cc: Nitin Gupta Cc: Alexey Romanov Cc: Dmitry Rokosov Cc: Lukas Czerner Cc: [5.19] Signed-off-by: Andrew Morton commit d10a72de54c2d2990721923e025ea505fa4f5b02 Author: Dan Carpenter Date: Wed Aug 10 12:18:08 2022 +0300 get_maintainer: add Alan to .get_maintainer.ignore Alan asked to be added to the .get_maintainer.ignore list. Link: https://lkml.kernel.org/r/YvN30KhO9aD5Sza9@kili Signed-off-by: Dan Carpenter Cc: Alan Cox Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton commit 15b3f48a4339e3c16acf18624e2b7f60bc5e9a2c Merge: 16b3d851c0146 4be72c1b9f298 Author: Linus Torvalds Date: Sat Aug 20 14:55:38 2022 -0700 Merge tag 'kbuild-fixes-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix module versioning broken on some architectures - Make dummy-tools enable CONFIG_PPC_LONG_DOUBLE_128 - Remove -Wformat-zero-length, which has no warning instance - Fix the order between drivers and libs in modules.order - Fix false-positive warnings in clang-analyzer * tag 'kbuild-fixes-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: scripts/clang-tools: Remove DeprecatedOrUnsafeBufferHandling check kbuild: fix the modules order between drivers and libs scripts/Makefile.extrawarn: Do not disable clang's -Wformat-zero-length kbuild: dummy-tools: pretend we understand __LONG_DOUBLE_128__ modpost: fix module versioning when a symbol lacks valid CRC commit 16b3d851c0146123507fe864fdd97411ded51147 Merge: cc1807b9158a9 f52679b78877f Author: Linus Torvalds Date: Sat Aug 20 14:46:05 2022 -0700 Merge tag 'perf-tools-fixes-for-v6.0-2022-08-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix alignment for cpu map masks in event encoding. - Support reading PERF_FORMAT_LOST, perf tool counterpart for a feature that was added in this merge window. - Sync perf tools copies of kernel headers: socket, msr-index, fscrypt, cpufeatures, i915_drm, kvm, vhost, perf_event. * tag 'perf-tools-fixes-for-v6.0-2022-08-19' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf tools: Support reading PERF_FORMAT_LOST libperf: Add a test case for read formats libperf: Handle read format in perf_evsel__read() tools headers UAPI: Sync linux/perf_event.h with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources tools headers UAPI: Sync KVM's vmx.h header with the kernel sources tools include UAPI: Sync linux/vhost.h with the kernel sources tools headers kvm s390: Sync headers with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers UAPI: Sync drm/i915_drm.h with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools headers UAPI: Sync linux/fscrypt.h with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources perf cpumap: Fix alignment for masks in event encoding perf cpumap: Compute mask size in constant time perf cpumap: Synthetic events and const/static perf cpumap: Const map for max() commit cc1807b9158a909ffe829a5e222be756c57c9a90 Merge: 32dd68f110586 0fef40be5d1f8 Author: Linus Torvalds Date: Sat Aug 20 11:29:01 2022 -0700 Merge tag 's390-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Fix a KVM crash on z12 and older machines caused by a wrong assumption that Query AP Configuration Information is always available. - Lower severity of excessive Hypervisor filesystem error messages when booting under KVM. * tag 's390-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ap: fix crash on older machines based on QCI info missing s390/hypfs: avoid error message under KVM commit 32dd68f11058652a37152aed12bf552455914b40 Merge: f31c32efd57c8 f889a2e89ea5b Author: Linus Torvalds Date: Sat Aug 20 11:20:37 2022 -0700 Merge tag 'powerpc-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix atomic sleep warnings at boot due to get_phb_number() taking a mutex with a spinlock held on some machines. - Add missing PMU selftests to .gitignores. Thanks to Guenter Roeck and Russell Currey. * tag 'powerpc-6.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: selftests/powerpc: Add missing PMU selftests to .gitignores powerpc/pci: Fix get_phb_number() locking commit f31c32efd57c860f2b237a08327840f8444362f3 Merge: b9bce6e5533a0 b16de8b9e7d1a Author: Linus Torvalds Date: Sat Aug 20 10:49:02 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "A few minor fixes: - Fix buffer management in SRP to correct a regression with the login authentication feature from v5.17 - Don't iterate over non-present ports in mlx5 - Fix an error introduced by the foritify work in cxgb4 - Two bug fixes for the recently merged ERDMA driver - Unbreak RDMA dmabuf support, a regresion from v5.19" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA: Handle the return code from dma_resv_wait_timeout() properly RDMA/erdma: Correct the max_qp and max_cq capacities of the device RDMA/erdma: Using the key in FMR WR instead of MR structure RDMA/cxgb4: fix accept failure due to increased cpl_t5_pass_accept_rpl size RDMA/mlx5: Use the proper number of ports IB/iser: Fix login with authentication commit 4be72c1b9f298b4ad42391322eaddef64b282716 Author: Guru Das Srinagesh Date: Thu Aug 4 10:46:14 2022 -0700 scripts/clang-tools: Remove DeprecatedOrUnsafeBufferHandling check This `clang-analyzer` check flags the use of memset(), suggesting a more secure version of the API, such as memset_s(), which does not exist in the kernel: warning: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] Signed-off-by: Guru Das Srinagesh Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 113147510b48e764e624e3d0e6707a1e48bc05a9 Author: Masahiro Yamada Date: Sun Aug 14 08:09:28 2022 +0900 kbuild: fix the modules order between drivers and libs Commit b2c885549122 ("kbuild: update modules.order only when contained modules are updated") accidentally changed the modules order. Prior to that commit, the modules order was determined based on vmlinux-dirs, which lists core-y/m, drivers-y/m, libs-y/m, in this order. Now, subdir-modorder lists them in a different order: core-y/m, libs-y/m, drivers-y/m. Presumably, there was no practical issue because the modules in drivers and libs are orthogonal, but there is no reason to have this distortion. Get back to the original order. Fixes: b2c885549122 ("kbuild: update modules.order only when contained modules are updated") Signed-off-by: Masahiro Yamada commit 370655bc183b1824ba623e621b58e8c2616c839c Author: Nathan Chancellor Date: Wed Aug 10 16:01:33 2022 -0700 scripts/Makefile.extrawarn: Do not disable clang's -Wformat-zero-length There are no instances of this warning in the tree across several difference architectures and configurations. This was added by commit 26ea6bb1fef0 ("kbuild, LLVMLinux: Supress warnings unless W=1-3") back in 2014, where it might have been necessary, but there are no instances of it now so stop disabling it to increase warning coverage for clang. Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 0df499eaf3c1a43ebb0a84ac854262e3fa731bcf Author: Jiri Slaby Date: Wed Aug 10 11:26:03 2022 +0200 kbuild: dummy-tools: pretend we understand __LONG_DOUBLE_128__ There is a test in powerpc's Kconfig which checks __LONG_DOUBLE_128__ and sets CONFIG_PPC_LONG_DOUBLE_128 if it is understood by the compiler. We currently don't handle it, so this results in PPC_LONG_DOUBLE_128 not being in super-config generated by dummy-tools. So take this into account in the gcc script and preprocess __LONG_DOUBLE_128__ as "1". Signed-off-by: Jiri Slaby Signed-off-by: Masahiro Yamada commit 5b8a9a8fd1f0c3d55d407cf759d54ca68798d9ad Author: Masahiro Yamada Date: Tue Aug 9 23:11:17 2022 +0900 modpost: fix module versioning when a symbol lacks valid CRC Since commit 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS"), module versioning is broken on some architectures. Loading a module fails with "disagrees about version of symbol module_layout". On such architectures (e.g. ARCH=sparc build with sparc64_defconfig), modpost shows a warning, like follows: WARNING: modpost: EXPORT symbol "_mcount" [vmlinux] version generation failed, symbol will not be versioned. Is "_mcount" prototyped in ? Previously, it was a harmless warning (CRC check was just skipped), but now wrong CRCs are used for comparison because invalid CRCs are just skipped. $ sparc64-linux-gnu-nm -n vmlinux [snip] 0000000000c2cea0 r __ksymtab__kstrtol 0000000000c2ceb8 r __ksymtab__kstrtoul 0000000000c2ced0 r __ksymtab__local_bh_enable 0000000000c2cee8 r __ksymtab__mcount 0000000000c2cf00 r __ksymtab__printk 0000000000c2cf18 r __ksymtab__raw_read_lock 0000000000c2cf30 r __ksymtab__raw_read_lock_bh [snip] 0000000000c53b34 D __crc__kstrtol 0000000000c53b38 D __crc__kstrtoul 0000000000c53b3c D __crc__local_bh_enable 0000000000c53b40 D __crc__printk 0000000000c53b44 D __crc__raw_read_lock 0000000000c53b48 D __crc__raw_read_lock_bh Please notice __crc__mcount is missing here. When the module subsystem looks up a CRC that comes after, it results in reading out a wrong address. For example, when __crc__printk is needed, the module subsystem reads 0xc53b44 instead of 0xc53b40. All CRC entries must be output for correct index accessing. Invalid CRCs will be unused, but are needed to keep the one-to-one mapping between __ksymtab_* and __crc_*. The best is to fix all modpost warnings, but several warnings are still remaining on less popular architectures. Fixes: 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS") Reported-by: matoro Signed-off-by: Masahiro Yamada Tested-by: matoro commit b9bce6e5533a08e0223d629541b4f39ffea48333 Merge: beaf139709542 d3b38596875db Author: Linus Torvalds Date: Sat Aug 20 10:17:05 2022 -0700 Merge tag 'block-6.0-2022-08-19' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few fixes that should go into this release: - Small series of patches for ublk (ZiyangZhang) - Remove dead function (Yu) - Fix for running a block queue in case of resource starvation (Yufen)" * tag 'block-6.0-2022-08-19' of git://git.kernel.dk/linux-block: blk-mq: run queue no matter whether the request is the last request blk-mq: remove unused function blk_mq_queue_stopped() ublk_drv: do not add a re-issued request aborted previously to ioucmd's task_work ublk_drv: update comment for __ublk_fail_req() ublk_drv: check ubq_daemon_is_dying() in __ublk_rq_task_work() ublk_drv: update iod->addr for UBLK_IO_NEED_GET_DATA commit beaf139709542d4ee7d22c2312b97c35587eb9db Merge: 044610f8e4155 3f743e9bbb8fe Author: Linus Torvalds Date: Sat Aug 20 09:49:22 2022 -0700 Merge tag 'io_uring-6.0-2022-08-19' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: "A few fixes for regressions in this cycle: - Two instances of using the wrong "has async data" helper (Pavel) - Fixup zero-copy address import (Pavel) - Bump zero-copy notification slot limit (Pavel)" * tag 'io_uring-6.0-2022-08-19' of git://git.kernel.dk/linux-block: io_uring/net: use right helpers for async_data io_uring/notif: raise limit on notification slots io_uring/net: improve zc addr import error handling io_uring/net: use right helpers for async recycle commit 044610f8e4155ec0374f7c8307b725b7d01d750c Merge: 4d099c3329fe2 a357f7b4583eb Author: Linus Torvalds Date: Sat Aug 20 09:43:45 2022 -0700 Merge tag 'ata-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fixes from Damien Le Moal: - Add a missing command name definition for ata_get_cmd_name(), from me. - A fix to address a performance regression due to the default max_sectors queue limit for ATA devices connected to AHCI adapters being too small, from John. * tag 'ata-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata: Set __ATA_BASE_SHT max_sectors ata: libata-eh: Add missing command name commit 4d099c3329fe276a5b3939c9f7c8b2ea1f12af0d Merge: 50cd95ac46548 a0753ef66c34c Author: Linus Torvalds Date: Sat Aug 20 09:39:00 2022 -0700 Merge tag 'mmc-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - meson-gx: Fix error handling in ->probe() - mtk-sd: Fix a command problem when using cqe off/disable - pxamci: Fix error handling in ->probe() - sdhci-of-dwcmshc: Fix broken support for the BlueField-3 variant * tag 'mmc-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC mmc: meson-gx: Fix an error handling path in meson_mmc_probe() mmc: mtk-sd: Clear interrupts when cqe off/disable mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() commit a357f7b4583ebf81d19c95aef57497ae81c5f63c Author: John Garry Date: Wed Aug 17 23:20:08 2022 +0800 ata: libata: Set __ATA_BASE_SHT max_sectors Commit 0568e6122574 ("ata: libata-scsi: cap ata_device->max_sectors according to shost->max_sectors") inadvertently capped the max_sectors value for some SATA disks to a value which is lower than we would want. For a device which supports LBA48, we would previously have request queue max_sectors_kb and max_hw_sectors_kb values of 1280 and 32767 respectively. For AHCI controllers, the value chosen for shost max sectors comes from the minimum of the SCSI host default max sectors in SCSI_DEFAULT_MAX_SECTORS (1024) and the shost DMA device mapping limit. This means that we would now set the max_sectors_kb and max_hw_sectors_kb values for a disk which supports LBA48 at 512, ignoring DMA mapping limit. As report by Oliver at [0], this caused a performance regression. Fix by picking a large enough max sectors value for ATA host controllers such that we don't needlessly reduce max_sectors_kb for LBA48 disks. [0] https://lore.kernel.org/linux-ide/YvsGbidf3na5FpGb@xsang-OptiPlex-9020/T/#m22d9fc5ad15af66066dd9fecf3d50f1b1ef11da3 Fixes: 0568e6122574 ("ata: libata-scsi: cap ata_device->max_sectors according to shost->max_sectors") Reported-by: Oliver Sang Signed-off-by: John Garry Signed-off-by: Damien Le Moal commit b1cb8a71f1eaec4eb77051590f7f561f25b15e32 Author: Shigeru Yoshida Date: Sat Aug 20 12:25:16 2022 +0900 batman-adv: Fix hang up with small MTU hard-interface The system hangs up when batman-adv soft-interface is created on hard-interface with small MTU. For example, the following commands create batman-adv soft-interface on dummy interface with zero MTU: # ip link add name dummy0 type dummy # ip link set mtu 0 dev dummy0 # ip link set up dev dummy0 # ip link add name bat0 type batadv # ip link set dev dummy0 master bat0 These commands cause the system hang up with the following messages: [ 90.578925][ T6689] batman_adv: bat0: Adding interface: dummy0 [ 90.580884][ T6689] batman_adv: bat0: The MTU of interface dummy0 is too small (0) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.586264][ T6689] batman_adv: bat0: Interface activated: dummy0 [ 90.590061][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.595517][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 90.598499][ T6689] batman_adv: bat0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) This patch fixes this issue by returning error when enabling hard-interface with small MTU size. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Shigeru Yoshida Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit d92e600f860ba98eac576a976c275106af575c82 Merge: 568035b01cfb1 8c596324232d2 Author: Rafael J. Wysocki Date: Sat Aug 20 13:49:17 2022 +0200 Merge tag 'thermal-v6.0-rc2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal control fixes for 6.0-rc3 from Daniel Lezcano: "- Fix missing required property for thermal zone description (Daniel Lezcano) - Add missing export symbol for thermal_zone_device_register_with_trips() (Daniel Lezcano)" * tag 'thermal-v6.0-rc2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: dt-bindings: thermal: Fix missing required property thermal/core: Add missing EXPORT_SYMBOL_GPL commit fac8e558da9485e13a0ae0488aa0b8a8c307cd34 Author: Mike Christie Date: Thu Aug 11 20:12:06 2022 -0500 scsi: core: Fix passthrough retry counter handling Passthrough users will set the scsi_cmnd->allowed value and were expecting up to $allowed retries. The problem is that before: commit 6aded12b10e0 ("scsi: core: Remove struct scsi_request") we used to set the retries on the scsi_request then copy them over to scsi_cmnd->allowed in scsi_setup_scsi_cmnd. With that patch we now set scsi_cmnd->allowed to 0 in scsi_prepare_cmd and overwrite what the passthrough user set. This moves the allowed initialization to after the blk_rq_is_passthrough() check so it's only done for the non-passthrough path where the ULD init_command will normally set an allowed value it prefers. Link: https://lore.kernel.org/r/20220812011206.9157-1-michael.christie@oracle.com Fixes: 6aded12b10e0 ("scsi: core: Remove struct scsi_request") Reviewed-by: Christoph Hellwig Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen commit 8f2c96420c6ec3dcb18c8be923e24c6feaa5ccf6 Author: Bart Van Assche Date: Thu Aug 11 16:43:49 2022 -0700 scsi: ufs: core: Reduce the power mode change timeout The current power mode change timeout (180 s) is so large that it can cause a watchdog timer to fire. Reduce the power mode change timeout to 10 seconds. Link: https://lore.kernel.org/r/20220811234401.1957911-1-bvanassche@acm.org Reviewed-by: Stanley Chu Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit ed06fce0b034b2e25bd93430f5c4cbb28036cc1a Author: Trond Myklebust Date: Wed Aug 3 14:55:03 2022 -0400 SUNRPC: RPC level errors should set task->tk_rpc_status Fix up a case in call_encode() where we're failing to set task->tk_rpc_status when an RPC level error occurred. Fixes: 9c5948c24869 ("SUNRPC: task should be exit if encode return EKEYEXPIRED more times") Signed-off-by: Trond Myklebust commit fcfc8be1e9cf2f12b50dce8b579b3ae54443a014 Author: Olga Kornievskaia Date: Thu Aug 18 15:07:05 2022 -0400 NFSv4.2 fix problems with __nfs42_ssc_open A destination server while doing a COPY shouldn't accept using the passed in filehandle if its not a regular filehandle. If alloc_file_pseudo() has failed, we need to decrement a reference on the newly created inode, otherwise it leaks. Reported-by: Al Viro Fixes: ec4b092508982 ("NFS: inter ssc open") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit f16857e62bac60786104c020ad7c86e2163b2c5b Author: NeilBrown Date: Fri Aug 19 09:55:59 2022 +1000 NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT nfs_unlink() calls d_delete() twice if it receives ENOENT from the server - once in nfs_dentry_handle_enoent() from nfs_safe_remove and once in nfs_dentry_remove_handle_error(). nfs_rmddir() also calls it twice - the nfs_dentry_handle_enoent() call is direct and inside a region locked with ->rmdir_sem It is safe to call d_delete() twice if the refcount > 1 as the dentry is simply unhashed. If the refcount is 1, the first call sets d_inode to NULL and the second call crashes. This patch guards the d_delete() call from nfs_dentry_handle_enoent() leaving the one under ->remdir_sem in case that is important. In mainline it would be safe to remove the d_delete() call. However in older kernels to which this might be backported, that would change the behaviour of nfs_unlink(). nfs_unlink() used to unhash the dentry which resulted in nfs_dentry_handle_enoent() not calling d_delete(). So in older kernels we need the d_delete() in nfs_dentry_remove_handle_error() when called from nfs_unlink() but not when called from nfs_rmdir(). To make the code work correctly for old and new kernels, and from both nfs_unlink() and nfs_rmdir(), we protect the d_delete() call with simple_positive(). This ensures it is never called in a circumstance where it could crash. Fixes: 3c59366c207e ("NFS: don't unhash dentry during unlink/rename") Fixes: 9019fb391de0 ("NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()") Signed-off-by: NeilBrown Tested-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit bdbf0617bbc3641af158d1aeffeebb1505f76263 Author: Axel Rasmussen Date: Fri Aug 19 12:19:28 2022 -0700 selftests/vm: fix inability to build any vm tests When we stopped using KSFT_KHDR_INSTALL, a side effect is we also changed the value of `top_srcdir`. This can be seen by looking at the code removed by commit 49de12ba06ef ("selftests: drop KSFT_KHDR_INSTALL make target"). (Note though that this commit didn't break this, technically the one before it did since that's the one that stopped KSFT_KHDR_INSTALL from being used, even though the code was still there.) Previously lib.mk reconfigured `top_srcdir` when KSFT_KHDR_INSTALL was being used. Now, that's no longer the case. As a result, the path to gup_test.h in vm/Makefile was wrong, and since it's a dependency of all of the vm binaries none of them could be built. Instead, we'd get an "error" like: make[1]: *** No rule to make target '/[...]/tools/testing/selftests/vm/compaction_test', needed by 'all'. Stop. So, modify lib.mk so it once again sets top_srcdir to the root of the kernel tree. Fixes: f2745dc0ba3d ("selftests: stop using KSFT_KHDR_INSTALL") Signed-off-by: Axel Rasmussen Signed-off-by: Shuah Khan commit e82c649e851c9c25367fb7a2a6cf3479187de467 Author: Sabrina Dubroca Date: Wed Aug 17 14:54:36 2022 +0200 Revert "net: macsec: update SCI upon MAC address change." This reverts commit 6fc498bc82929ee23aa2f35a828c6178dfd3f823. Commit 6fc498bc8292 states: SCI should be updated, because it contains MAC in its first 6 octets. That's not entirely correct. The SCI can be based on the MAC address, but doesn't have to be. We can also use any 64-bit number as the SCI. When the SCI based on the MAC address, it uses a 16-bit "port number" provided by userspace, which commit 6fc498bc8292 overwrites with 1. In addition, changing the SCI after macsec has been setup can just confuse the receiver. If we configure the RXSC on the peer based on the original SCI, we should keep the same SCI on TX. When the macsec device is being managed by a userspace key negotiation daemon such as wpa_supplicant, commit 6fc498bc8292 would also overwrite the SCI defined by userspace. Fixes: 6fc498bc8292 ("net: macsec: update SCI upon MAC address change.") Signed-off-by: Sabrina Dubroca Link: https://lore.kernel.org/r/9b1a9d28327e7eb54550a92eebda45d25e54dd0d.1660667033.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 9dbdfd4a9f3416c84d22623e6b5bfe1966e336b7 Author: Sean Anderson Date: Thu Aug 18 12:40:29 2022 -0400 net: dpaa: Fix <1G ethernet on LS1046ARDB As discussed in commit 73a21fa817f0 ("dpaa_eth: support all modes with rate adapting PHYs"), we must add a workaround for Aquantia phys with in-tree support in order to keep 1G support working. Update this workaround for the AQR113C phy found on revision C LS1046ARDB boards. Fixes: 12cf1b89a668 ("net: phy: Add support for AQR113C EPHY") Signed-off-by: Sean Anderson Acked-by: Camelia Groza Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220818164029.2063293-1-sean.anderson@seco.com Signed-off-by: Jakub Kicinski commit 27883605cf97f3c500962fa02f241598fe11744b Merge: 568035b01cfb1 d957e7ffb2c72 Author: Martin K. Petersen Date: Fri Aug 19 17:28:54 2022 -0400 Merge branch '5.20/scsi-queue' into 6.0/scsi-fixes Include commits that weren't submitted during the 6.0 merge window. Signed-off-by: Martin K. Petersen commit 26f2da0d2f823dc7180b0505d46318f64d1e0a7a Author: Tony Lindgren Date: Tue Jun 21 12:11:18 2022 +0300 clk: ti: Fix missing of_node_get() ti_find_clock_provider() For ti_find_clock_provider() we want to return the np with refcount incremented. However we are missing of_node_get() for the clock-output-names case that causes refcount warnings. Fixes: 51f661ef9a10 ("clk: ti: Add ti_find_clock_provider() to use clock-output-names") Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220621091118.33930-1-tony@atomide.com Signed-off-by: Stephen Boyd commit f461950fdc374a3ada5a63c669d997de4600dffe Author: Zhenneng Li Date: Thu Aug 11 15:25:40 2022 +0800 drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Function in > the D3hot state. All other received Requests must be handled as Unsupported Requests, > and all received Completions may optionally be handled as Unexpected Completions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc = [] ra = [] ps = 0000 Tainted: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 = 0000000000000000 t0 = fff08800e0008010 t1 = 0000000000010000 t2 = 0000000000008010 t3 = fff00007e3c00000 t4 = fff00007e3c00258 t5 = 000000000000ffff t6 = 0000000000000001 t7 = fff00007ef078000 s0 = fff00007e3c016e8 s1 = fff00007e3c00000 s2 = fff00007e3c00018 s3 = fff00007e3c00000 s4 = fff00007fff59d80 s5 = 0000000000000000 s6 = fff00007ef07bd98 a0 = fff00007e3c00000 a1 = fff00007e3c016e8 a2 = 0000000000000008 a3 = 0000000000000001 a4 = 8f5c28f5c28f5c29 a5 = ffffffff810f4338 t8 = 0000000000000275 t9 = ffffffff809b66f8 t10 = ff6769c5d964b800 t11= 000000000000b886 pv = ffffffff811bea20 at = 0000000000000000 gp = ffffffff81d89690 sp = 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [] si_dma_is_lockup+0x34/0xd0 [] radeon_fence_check_lockup+0xd0/0x290 [] process_one_work+0x280/0x550 [] worker_thread+0x70/0x7c0 [] worker_thread+0x130/0x7c0 [] kthread+0x200/0x210 [] worker_thread+0x0/0x7c0 [] kthread+0x14c/0x210 [] ret_from_kernel_thread+0x18/0x20 [] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian König Signed-off-by: Zhenneng Li Signed-off-by: Alex Deucher commit 2035590f3d40f227eac453d0c36b5eae85c1cf08 Author: Maíra Canal Date: Thu Aug 18 10:27:30 2022 -0300 drm/amd/display: Include missing header The file amdgpu_dm_plane.c missed the header amdgpu_dm_plane.h, which resulted on the following warning: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1046:5: warning: no previous prototype for 'fill_dc_scaling_info' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1222:6: warning: no previous prototype for 'handle_cursor_update' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:152:6: warning: no previous prototype for 'modifier_has_dcc' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1576:5: warning: no previous prototype for 'amdgpu_dm_plane_init' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:157:10: warning: no previous prototype for 'modifier_gfx9_swizzle_mode' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:752:5: warning: no previous prototype for 'fill_plane_buffer_attributes' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:83:31: warning: no previous prototype for 'amd_get_format_info' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:88:6: warning: no previous prototype for 'fill_blending_from_plane_state' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:992:5: warning: no previous prototype for 'dm_plane_helper_check_state' [-Wmissing-prototypes] Therefore, include the missing header on the file and turn global functions that are not used outside of the file into static functions. Fixes: 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes") Reported-by: kernel test robot Signed-off-by: Maíra Canal Signed-off-by: Alex Deucher commit 06671734881af2bcf7f453661b5f8616e32bb3fc Author: shaoyunl Date: Thu Aug 18 14:13:52 2022 -0400 drm/amdgpu: Remove the additional kfd pre reset call for sriov The additional call is caused by merge conflict Reviewed-by: Felix Kuehling Signed-off-by: shaoyunl Signed-off-by: Alex Deucher commit c351938350ab9b5e978dede2c321da43de7eb70c Author: Candice Li Date: Thu Aug 18 10:47:09 2022 +0800 drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. No need to set up rb when no gfx rings. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f5994da72ba124a3d0463672fdfbec073e3bb72f Author: YiPeng Chai Date: Fri Aug 12 14:34:35 2022 +0800 drm/amdgpu: fix hive reference leak when adding xgmi device Only amdgpu_get_xgmi_hive but no amdgpu_put_xgmi_hive which will leak the hive reference. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 9d705d7741ae70764f3d6d87e67fad3b5c30ffd0 Author: YiPeng Chai Date: Fri Aug 12 13:38:34 2022 +0800 drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini V1: The amdgpu_xgmi_remove_device function will send unload command to psp through psp ring to terminate xgmi, but psp ring has been destroyed in psp_hw_fini. V2: 1. Change the commit title. 2. Restore amdgpu_xgmi_remove_device to its original calling location. Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 43ef9db423bdce1df504d4d10e25092d427f04e3 Author: Tim Huang Date: Mon Aug 15 14:04:49 2022 +0800 drm/amdgpu: enable GFXOFF allow control for GC IP v11.0.1 Enable GFXOFF allow control when set the GFX power gating. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 50cd95ac46548429e5bba7ca75cc97d11a697947 Merge: e45c890140c8c 3a608cfee97e9 Author: Linus Torvalds Date: Fri Aug 19 14:02:24 2022 -0700 Merge tag 'execve-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve fix from Kees Cook: - Replace remaining kmap() uses with kmap_local_page() (Fabio M. De Francesco) * tag 'execve-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: exec: Replace kmap{,_atomic}() with kmap_local_page() commit e45c890140c8c2c9f3dd475c14bdf084c4cd2296 Merge: 8fd00059cc13c 012e8d2034f1b Author: Linus Torvalds Date: Fri Aug 19 13:56:14 2022 -0700 Merge tag 'hardening-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Also undef LATENT_ENTROPY_PLUGIN for per-file disabling (Andrew Donnellan) - Return EFAULT on copy_from_user() failures in LoadPin (Kees Cook) * tag 'hardening-v6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file LoadPin: Return EFAULT on copy_from_user() failures commit 8fd00059cc13c7f170451e9318a9a5e772b88e17 Merge: ca052cfd6ee5d 96264230a6817 Author: Linus Torvalds Date: Fri Aug 19 13:49:07 2022 -0700 Merge tag 'riscv-for-linus-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix to make the ISA extension static keys writable after init. This manifests at least as a crash when loading modules (including KVM). - A fixup for a build warning related to a poorly formed comment in our perf driver. * tag 'riscv-for-linus-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: perf: riscv legacy: fix kerneldoc comment warning riscv: Ensure isa-ext static keys are writable commit 65fac0d54f374625b43a9d6ad1f2c212bd41f518 Author: Yu Kuai Date: Tue Jul 26 20:22:24 2022 +0800 blk-mq: fix io hung due to missing commit_rqs Currently, in virtio_scsi, if 'bd->last' is not set to true while dispatching request, such io will stay in driver's queue, and driver will wait for block layer to dispatch more rqs. However, if block layer failed to dispatch more rq, it should trigger commit_rqs to inform driver. There is a problem in blk_mq_try_issue_list_directly() that commit_rqs won't be called: // assume that queue_depth is set to 1, list contains two rq blk_mq_try_issue_list_directly blk_mq_request_issue_directly // dispatch first rq // last is false __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // succeed to get first budget __blk_mq_issue_directly scsi_queue_rq cmd->flags |= SCMD_LAST virtscsi_queuecommand kick = (sc->flags & SCMD_LAST) != 0 // kick is false, first rq won't issue to disk queued++ blk_mq_request_issue_directly // dispatch second rq __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // failed to get second budget ret == BLK_STS_RESOURCE blk_mq_request_bypass_insert // errors is still 0 if (!list_empty(list) || errors && ...) // won't pass, commit_rqs won't be called In this situation, first rq relied on second rq to dispatch, while second rq relied on first rq to complete, thus they will both hung. Fix the problem by also treat 'BLK_STS_*RESOURCE' as 'errors' since it means that request is not queued successfully. Same problem exists in blk_mq_dispatch_rq_list(), 'BLK_STS_*RESOURCE' can't be treated as 'errors' here, fix the problem by calling commit_rqs if queue_rq return 'BLK_STS_*RESOURCE'. Fixes: d666ba98f849 ("blk-mq: add mq_ops->commit_rqs()") Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220726122224.1790882-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit ca052cfd6ee5d3358f2929439e0c7f0424bedc9e Merge: 42c54d5491ed7 959d6c4ae238b Author: Linus Torvalds Date: Fri Aug 19 13:40:11 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix unexpected sign extension of KVM_ARM_DEVICE_ID_MASK - Tidy-up handling of AArch32 on asymmetric systems x86: - Fix 'missing ENDBR' BUG for fastop functions Generic: - Some cleanup and static analyzer patches - More fixes to KVM_CREATE_VM unwind paths" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Drop unnecessary initialization of "ops" in kvm_ioctl_create_device() KVM: Drop unnecessary initialization of "npages" in hva_to_pfn_slow() x86/kvm: Fix "missing ENDBR" BUG for fastop functions x86/kvm: Simplify FOP_SETCC() x86/ibt, objtool: Add IBT_NOSEAL() KVM: Rename mmu_notifier_* to mmu_invalidate_* KVM: Rename KVM_PRIVATE_MEM_SLOTS to KVM_INTERNAL_MEM_SLOTS KVM: MIPS: remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS KVM: Move coalesced MMIO initialization (back) into kvm_create_vm() KVM: Unconditionally get a ref to /dev/kvm module when creating a VM KVM: Properly unwind VM creation if creating debugfs fails KVM: arm64: Reject 32bit user PSTATE on asymmetric systems KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems KVM: arm64: Fix compile error due to sign extension commit 42c54d5491ed7b9fe89a499224494277a33b23df Merge: a3a78b6332ba8 899b7f69f244e Author: Linus Torvalds Date: Fri Aug 19 13:33:48 2022 -0700 Merge tag 'for-6.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few short fixes and a lockdep warning fix (needs moving some code): - tree-log replay fixes: - fix error handling when looking up extent refs - fix warning when setting inode number of links - relocation fixes: - reset block group read-only status when relocation fails - unset control structure if transaction fails when starting to process a block group - add lockdep annotations to fix a warning during relocation where blocks temporarily belong to another tree and can lead to reversed dependencies - tree-checker verifies that extent items don't overlap" * tag 'for-6.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: tree-checker: check for overlapping extent items btrfs: fix warning during log replay when bumping inode link count btrfs: fix lost error handling when looking up extended ref on log replay btrfs: fix lockdep splat with reloc root extent buffers btrfs: move lockdep class helpers to locking.c btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() btrfs: reset RO counter on block group if we fail to relocate commit a3a78b6332ba8e1949541150efcc8051ceeb2762 Merge: 963a70bee5880 17661ecf6a64e Author: Linus Torvalds Date: Fri Aug 19 13:26:52 2022 -0700 Merge tag '5.20-rc2-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: - important sparse file fix - allocation size fix - fix incorrect rc on bad share - share config fix * tag '5.20-rc2-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: don't remove dos attribute xattr on O_TRUNC open ksmbd: remove unnecessary generic_fillattr in smb2_open ksmbd: request update to stale share config ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured commit f52679b78877f17e95a317e18a4c9c46cc3d845a Author: Namhyung Kim Date: Thu Aug 18 17:36:44 2022 -0700 perf tools: Support reading PERF_FORMAT_LOST The recent kernel added lost count can be read from either read(2) or ring buffer data with PERF_SAMPLE_READ. As it's a variable length data we need to access it according to the format info. But for perf tools use cases, PERF_FORMAT_ID is always set. So we can only check PERF_FORMAT_LOST bit to determine the data format. Add sample_read_value_size() and next_sample_read_value() helpers to make it a bit easier to access. Use them in all places where it reads the struct sample_read_value. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Ingo Molnar Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220819003644.508916-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 6d395a513556e61dc22c6abdf9b419deb46f1908 Author: Namhyung Kim Date: Thu Aug 18 17:36:43 2022 -0700 libperf: Add a test case for read formats It checks a various combination of the read format settings and verify it return the value in a proper position. The test uses task-clock software events to guarantee it's always active and sets enabled/running time. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Ingo Molnar Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220819003644.508916-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 89e3106fa25fb1b626a7123dba870159d453e785 Author: Namhyung Kim Date: Thu Aug 18 17:36:42 2022 -0700 libperf: Handle read format in perf_evsel__read() The perf_counts_values should be increased to read the new lost data. Also adjust values after read according the read format. This supports PERF_FORMAT_GROUP which has a different data format but it's only available for leader events. Currently it doesn't have an API to read sibling (member) events in the group. But users may read the sibling event directly. Also reading from mmap would be disabled when the read format has ID or LOST bit as it's not exposed via mmap. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Ingo Molnar Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220819003644.508916-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 65ba872a6971c11ceb342c3330f059289c0e6bdb Author: Namhyung Kim Date: Thu Aug 18 17:36:41 2022 -0700 tools headers UAPI: Sync linux/perf_event.h with the kernel sources To pick the trivial change in: 119a784c81270eb8 ("perf/core: Add a new read format to get a number of lost samples") Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Ian Rogers Cc: Ingo Molnar Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220819003644.508916-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e5bc0deae57615324ca843827873b39a34acc82e Author: Arnaldo Carvalho de Melo Date: Fri Sep 10 11:46:54 2021 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: 43bb9e000ea4c621 ("KVM: x86: Tweak name of MONITOR/MWAIT #UD quirk to make it #UD specific") 94dfc73e7cf4a31d ("treewide: uapi: Replace zero-length arrays with flexible-array members") bfbcc81bb82cbbad ("KVM: x86: Add a quirk for KVM's "MONITOR/MWAIT are NOPs!" behavior") b172862241b48499 ("KVM: x86: PIT: Preserve state of speaker port data bit") ed2351174e38ad4f ("KVM: x86: Extend KVM_{G,S}ET_VCPU_EVENTS to support pending triple fault") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Cc: Chenyi Qiang Cc: Sean Christopherson Cc: Gustavo A. R. Silva Cc: Paolo Bonzini Cc: Paul Durrant Link: https://lore.kernel.org/lkml/Yv6OMPKYqYSbUxwZ@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit eea085d11449bc6514dca9850cdd3a996ec1217e Author: Arnaldo Carvalho de Melo Date: Tue Mar 2 17:20:08 2021 -0300 tools headers UAPI: Sync KVM's vmx.h header with the kernel sources To pick the changes in: 2f4073e08f4cc5a4 ("KVM: VMX: Enable Notify VM exit") That makes 'perf kvm-stat' aware of this new NOTIFY exit reason, thus addressing the following perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/vmx.h' differs from latest version at 'arch/x86/include/uapi/asm/vmx.h' diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Tao Xu Link: http://lore.kernel.org/lkml/Yv6LavXMZ+njijpq@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 898d24034605d2a0b16f6ca349d2e74124b5e043 Author: Arnaldo Carvalho de Melo Date: Tue Apr 14 09:12:55 2020 -0300 tools include UAPI: Sync linux/vhost.h with the kernel sources To get the changes in: f345a0143b4dd1cf ("vhost-vdpa: uAPI to suspend the device") Silencing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/vhost.h' differs from latest version at 'include/uapi/linux/vhost.h' diff -u tools/include/uapi/linux/vhost.h include/uapi/linux/vhost.h To pick up these changes and support them: $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > before $ cp include/uapi/linux/vhost.h tools/include/uapi/linux/vhost.h $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > after $ diff -u before after --- before 2022-08-18 09:46:12.355958316 -0300 +++ after 2022-08-18 09:46:19.701182822 -0300 @@ -29,6 +29,7 @@ [0x75] = "VDPA_SET_VRING_ENABLE", [0x77] = "VDPA_SET_CONFIG_CALL", [0x7C] = "VDPA_SET_GROUP_ASID", + [0x7D] = "VDPA_SUSPEND", }; = { [0x00] = "GET_FEATURES", $ For instance, see how those 'cmd' ioctl arguments get translated, now VDPA_SUSPEND will be as well: # perf trace -a -e ioctl --max-events=10 0.000 ( 0.011 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 21.353 ( 0.014 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 25.766 ( 0.014 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 25.845 ( 0.034 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 25.916 ( 0.011 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 25.941 ( 0.025 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ATOMIC, arg: 0x7ffe4a22c840) = 0 32.915 ( 0.009 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_RMFB, arg: 0x7ffe4a22cf9c) = 0 42.522 ( 0.013 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 42.579 ( 0.031 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 42.644 ( 0.010 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 # Cc: Adrian Hunter Cc: Eugenio Pérez Cc: Ian Rogers Cc: Jiri Olsa Cc: Michael S. Tsirkin Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/Yv6Kb4OESuNJuH6X@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 25f308951703be599f82c44229b6f74c4ad86ed4 Author: Arnaldo Carvalho de Melo Date: Wed Aug 12 08:52:32 2020 -0300 tools headers kvm s390: Sync headers with the kernel sources To pick the changes in: f5ecfee944934757 ("KVM: s390: resetting the Topology-Change-Report") None of them trigger any changes in tooling, this time this is just to silence these perf build warnings: Warning: Kernel ABI header at 'tools/arch/s390/include/uapi/asm/kvm.h' differs from latest version at 'arch/s390/include/uapi/asm/kvm.h' diff -u tools/arch/s390/include/uapi/asm/kvm.h arch/s390/include/uapi/asm/kvm.h Cc: Janosch Frank Cc: Pierre Morel Link: http://lore.kernel.org/lkml/YvzwMXzaIzOU4WAY@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit bf465ca8090a1aa4f88d87e003302158c772c3de Author: Arnaldo Carvalho de Melo Date: Sun May 9 09:39:02 2021 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: 8a061562e2f2b32b ("RISC-V: KVM: Add extensible CSR emulation framework") f5ecfee944934757 ("KVM: s390: resetting the Topology-Change-Report") 450a563924ae9437 ("KVM: stats: Fix value for KVM_STATS_UNIT_MAX for boolean stats") 1b870fa5573e260b ("kvm: stats: tell userspace which values are boolean") db1c875e0539518e ("KVM: s390: add KVM_S390_ZPCI_OP to manage guest zPCI devices") 94dfc73e7cf4a31d ("treewide: uapi: Replace zero-length arrays with flexible-array members") 084cc29f8bbb034c ("KVM: x86/MMU: Allow NX huge pages to be disabled on a per-vm basis") 2f4073e08f4cc5a4 ("KVM: VMX: Enable Notify VM exit") ed2351174e38ad4f ("KVM: x86: Extend KVM_{G,S}ET_VCPU_EVENTS to support pending triple fault") e9bf3acb23f0a6e1 ("KVM: s390: Add KVM_CAP_S390_PROTECTED_DUMP") 8aba09588d2af37c ("KVM: s390: Add CPU dump functionality") 0460eb35b443f73f ("KVM: s390: Add configuration dump functionality") fe9a93e07ba4f29d ("KVM: s390: pv: Add query dump information") 35d02493dba1ae63 ("KVM: s390: pv: Add query interface") c24a950ec7d60c4d ("KVM, SEV: Add KVM_EXIT_SHUTDOWN metadata for SEV-ES") ffbb61d09fc56c85 ("KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl.") 661a20fab7d156cf ("KVM: x86/xen: Advertise and document KVM_XEN_HVM_CONFIG_EVTCHN_SEND") fde0451be8fb3208 ("KVM: x86/xen: Support per-vCPU event channel upcall via local APIC") 28d1629f751c4a5f ("KVM: x86/xen: Kernel acceleration for XENVER_version") 536395260582be74 ("KVM: x86/xen: handle PV timers oneshot mode") 942c2490c23f2800 ("KVM: x86/xen: Add KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID") 2fd6df2f2b47d430 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") 35025735a79eaa89 ("KVM: x86/xen: Support direct injection of event channel events") That just rebuilds perf, as these patches add just an ioctl that is S390 specific and may clash with other arches, so are so far being excluded in the harvester script: $ tools/perf/trace/beauty/kvm_ioctl.sh > before $ cp include/uapi/linux/kvm.h tools/include/uapi/linux/kvm.h $ tools/perf/trace/beauty/kvm_ioctl.sh > after $ diff -u before after $ grep 390 tools/perf/trace/beauty/kvm_ioctl.sh egrep -v " ((ARM|PPC|S390)_|[GS]ET_(DEBUGREGS|PIT2|XSAVE|TSC_KHZ)|CREATE_SPAPR_TCE_64)" | \ $ This is also by now used by tools/testing/selftests/kvm/, a simple test build succeeded. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Anup Patel Cc: Ben Gardon Cc: Chenyi Qiang Cc: Christian Borntraeger Cc: David Woodhouse Cc: Gustavo A. R. Silva Cc: Janosch Frank Cc: João Martins Cc: Matthew Rosato Cc: Oliver Upton Cc: Paolo Bonzini Cc: Peter Gonda Cc: Pierre Morel Cc: Tao Xu Link: https://lore.kernel.org/lkml/YvzuryClcn%2FvA0Gn@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 54cd4cde7c1edb869603073167cabab0b760fff6 Author: Arnaldo Carvalho de Melo Date: Sat Nov 13 11:08:31 2021 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources To pick up the changes in: a913bde810fc464d ("drm/i915: Update i915 uapi documentation") 525e93f6317a08a0 ("drm/i915/uapi: add NEEDS_CPU_ACCESS hint") 141f733bb3abb000 ("drm/i915/uapi: expose the avail tracking") 3f4309cbdc849637 ("drm/i915/uapi: add probed_cpu_visible_size") a50794f26f52c66c ("uapi/drm/i915: Document memory residency and Flat-CCS capability of obj") That don't add any new ioctl, so no changes in tooling. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Matthew Auld Cc: Matt Roper Cc: Namhyung Kim Cc: Niranjana Vishwanathapura Cc: Ramalingam C Link: http://lore.kernel.org/lkml/Yvzrp9RFIeEkb5fI@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 62ed93d1996b3aaeadda59b25ac5b70be59b8a61 Author: Arnaldo Carvalho de Melo Date: Thu Jul 1 13:39:15 2021 -0300 tools headers cpufeatures: Sync with the kernel sources To pick the changes from: 2b1299322016731d ("x86/speculation: Add RSB VM Exit protections") 28a99e95f55c6185 ("x86/amd: Use IBPB for firmware calls") 4ad3278df6fe2b08 ("x86/speculation: Disable RRSBA behavior") 26aae8ccbc197223 ("x86/cpu/amd: Enumerate BTC_NO") 9756bba28470722d ("x86/speculation: Fill RSB on vmexit for IBRS") 3ebc170068885b6f ("x86/bugs: Add retbleed=ibpb") 2dbb887e875b1de3 ("x86/entry: Add kernel IBRS implementation") 6b80b59b35557065 ("x86/bugs: Report AMD retbleed vulnerability") a149180fbcf336e9 ("x86: Add magic AMD return-thunk") 15e67227c49a5783 ("x86: Undo return-thunk damage") a883d624aed463c8 ("x86/cpufeatures: Move RETPOLINE flags to word 11") aae99a7c9ab371b2 ("x86/cpufeatures: Introduce x2AVIC CPUID bit") 6f33a9daff9f0790 ("x86: Fix comment for X86_FEATURE_ZEN") 51802186158c74a0 ("x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: Alexandre Chartre Cc: Andrew Cooper Cc: Borislav Petkov Cc: Daniel Sneddon Cc: Dave Hansen Cc: Ian Rogers Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Pawan Gupta Cc: Peter Zijlstra Cc: Suravee Suthikulpanit Cc: Wyes Karny Link: https://lore.kernel.org/lkml/Yvznmu5oHv0ZDN2w@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fabe0c61d842637b722344bcd49bfb1b76e2cc68 Author: Arnaldo Carvalho de Melo Date: Thu Dec 17 14:58:51 2020 -0300 tools headers UAPI: Sync linux/fscrypt.h with the kernel sources To pick the changes from: 6b2a51ff03bf0c54 ("fscrypt: Add HCTR2 support for filename encryption") That don't result in any changes in tooling, just causes this to be rebuilt: CC /tmp/build/perf-urgent/trace/beauty/sync_file_range.o LD /tmp/build/perf-urgent/trace/beauty/perf-in.o addressing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fscrypt.h' differs from latest version at 'include/uapi/linux/fscrypt.h' diff -u tools/include/uapi/linux/fscrypt.h include/uapi/linux/fscrypt.h Cc: Adrian Hunter Cc: Herbert Xu Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Huckleberry Link: https://lore.kernel.org/lkml/Yvzl8C7O1b+hf9GS@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7f7f86a7bdd694bfb214479afb6a1f7266bb4d22 Author: Arnaldo Carvalho de Melo Date: Fri Aug 7 08:45:47 2020 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes in: 2b1299322016731d ("x86/speculation: Add RSB VM Exit protections") 4af184ee8b2c0a69 ("tools/power turbostat: dump secondary Turbo-Ratio-Limit") 4ad3278df6fe2b08 ("x86/speculation: Disable RRSBA behavior") d7caac991feeef1b ("x86/cpu/amd: Add Spectral Chicken") 6ad0ad2bf8a67e27 ("x86/bugs: Report Intel retbleed vulnerability") c59a1f106f5cd484 ("KVM: x86/pmu: Add IA32_PEBS_ENABLE MSR emulation for extended PEBS") 465932db25f36648 ("x86/cpu: Add new VMX feature, Tertiary VM-Execution control") 027bbb884be006b0 ("KVM: x86/speculation: Disable Fill buffer clear within guests") 51802186158c74a0 ("x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug") Addressing these tools/perf build warnings: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2022-08-17 09:05:13.938246475 -0300 +++ after 2022-08-17 09:05:22.221455851 -0300 @@ -161,6 +161,7 @@ [0x0000048f] = "IA32_VMX_TRUE_EXIT_CTLS", [0x00000490] = "IA32_VMX_TRUE_ENTRY_CTLS", [0x00000491] = "IA32_VMX_VMFUNC", + [0x00000492] = "IA32_VMX_PROCBASED_CTLS3", [0x000004c1] = "IA32_PMC0", [0x000004d0] = "IA32_MCG_EXT_CTL", [0x00000560] = "IA32_RTIT_OUTPUT_BASE", @@ -212,6 +213,7 @@ [0x0000064D] = "PLATFORM_ENERGY_STATUS", [0x0000064e] = "PPERF", [0x0000064f] = "PERF_LIMIT_REASONS", + [0x00000650] = "SECONDARY_TURBO_RATIO_LIMIT", [0x00000658] = "PKG_WEIGHTED_CORE_C0_RES", [0x00000659] = "PKG_ANY_CORE_C0_RES", [0x0000065A] = "PKG_ANY_GFXE_C0_RES", $ Now one can trace systemwide asking to see backtraces to where those MSRs are being read/written, see this example with a previous update: # perf trace -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" ^C# If we use -v (verbose mode) we can see what it does behind the scenes: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" Using CPUID AuthenticAMD-25-21-0 0x6a0 0x6a8 New filter for msr:read_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) 0x6a0 0x6a8 New filter for msr:write_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) mmap size 528384B ^C# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Cc: Adrian Hunter Cc: Daniel Sneddon Cc: Ian Rogers Cc: Jiri Olsa Cc: Len Brown Cc: Like Xu Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Pawan Gupta Cc: Peter Zijlstra Cc: Robert Hoo Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/lkml/YvzbT24m2o5U%2F7+q@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit cf1258ac37afe80dbf277add5f1464477b46c9f0 Author: Arnaldo Carvalho de Melo Date: Sat Jun 19 10:09:08 2021 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: 7fa875b8e53c288d ("net: copy from user before calling __copy_msghdr") ebe73a284f4de8c5 ("net: Allow custom iter handler in msghdr") 7c701d92b2b5e517 ("skbuff: carry external ubuf_info in msghdr") c04245328dd7e915 ("net: make __sys_accept4_file() static") That don't result in any changes in the tables generated from that header. This silences this perf build warning: Warning: Kernel ABI header at 'tools/perf/trace/beauty/include/linux/socket.h' differs from latest version at 'include/linux/socket.h' diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Cc: David Ahern Cc: David S. Miller Cc: Dylan Yudaken Cc: Jakub Kicinski Cc: Jens Axboe Cc: Pavel Begunkov Cc: Yajun Deng Link: https://lore.kernel.org/lkml/YvzYs+F+Xzq8Hvvp@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b2f10cd4e805eb647773df273eb1a6ff9e6ea45d Author: Ian Rogers Date: Tue Jun 14 07:33:51 2022 -0700 perf cpumap: Fix alignment for masks in event encoding A mask encoding of a cpu map is laid out as: u16 nr u16 long_size unsigned long mask[]; However, the mask may be 8-byte aligned meaning there is a 4-byte pad after long_size. This means 32-bit and 64-bit builds see the mask as being at different offsets. On top of this the structure is in the byte data[] encoded as: u16 type char data[] This means the mask's struct isn't the required 4 or 8 byte aligned, but is offset by 2. Consequently the long reads and writes are causing undefined behavior as the alignment is broken. Fix the mask struct by creating explicit 32 and 64-bit variants, use a union to avoid data[] and casts; the struct must be packed so the layout matches the existing perf.data layout. Taking an address of a member of a packed struct breaks alignment so pass the packed perf_record_cpu_map_data to functions, so they can access variables with the right alignment. As the 64-bit version has 4 bytes of padding, optimizing writing to only write the 32-bit version. Committer notes: Disable warnings about 'packed' that break the build in some arches like riscv64, but just around that specific struct. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Athira Jajeev Cc: Colin Ian King Cc: Dave Marchevsky Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Kees Kook Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Song Liu Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220614143353.1559597-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3e5e56c60a14776e2a49837b55b03bc193fd91f7 Author: Conor Dooley Date: Sun Aug 14 15:12:36 2022 +0100 riscv: kvm: move extern sbi_ext declarations to a header Sparse complains about missing statics in the declarations of several variables: arch/riscv/kvm/vcpu_sbi_replace.c:38:37: warning: symbol 'vcpu_sbi_ext_time' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_replace.c:73:37: warning: symbol 'vcpu_sbi_ext_ipi' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_replace.c:126:37: warning: symbol 'vcpu_sbi_ext_rfence' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_replace.c:170:37: warning: symbol 'vcpu_sbi_ext_srst' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_base.c:69:37: warning: symbol 'vcpu_sbi_ext_base' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_base.c:90:37: warning: symbol 'vcpu_sbi_ext_experimental' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_base.c:96:37: warning: symbol 'vcpu_sbi_ext_vendor' was not declared. Should it be static? arch/riscv/kvm/vcpu_sbi_hsm.c:115:37: warning: symbol 'vcpu_sbi_ext_hsm' was not declared. Should it be static? These variables are however used in vcpu_sbi.c where they are declared as extern. Move them to kvm_vcpu_sbi.h which is handily already included by the three other files. Fixes: a046c2d8578c ("RISC-V: KVM: Reorganize SBI code by moving SBI v0.1 to its own file") Fixes: 5f862df5585c ("RISC-V: KVM: Add v0.1 replacement SBI extensions defined in v0.2") Fixes: 3e1d86569c21 ("RISC-V: KVM: Add SBI HSM extension in KVM") Reviewed-by: Palmer Dabbelt Signed-off-by: Conor Dooley Signed-off-by: Anup Patel commit fd0cd59f322b1919bfc68cd245d51906f7f1ba2a Author: Conor Dooley Date: Sun Aug 14 15:12:35 2022 +0100 riscv: kvm: vcpu_timer: fix unused variable warnings In two places, csr is set but never used: arch/riscv/kvm/vcpu_timer.c:302:23: warning: variable 'csr' set but not used [-Wunused-but-set-variable] struct kvm_vcpu_csr *csr; ^ arch/riscv/kvm/vcpu_timer.c:327:23: warning: variable 'csr' set but not used [-Wunused-but-set-variable] struct kvm_vcpu_csr *csr; ^ Remove the variable. Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") Reviewed-by: Palmer Dabbelt Signed-off-by: Conor Dooley Signed-off-by: Anup Patel commit cde643ff75bc20c538dfae787ca3b587bab16b50 Author: Kan Liang Date: Thu Aug 18 11:44:29 2022 -0700 perf/x86/intel: Fix pebs event constraints for ADL According to the latest event list, the LOAD_LATENCY PEBS event only works on the GP counter 0 and 1 for ADL and RPL. Update the pebs event constraints table. Fixes: f83d2f91d259 ("perf/x86/intel: Add Alder Lake Hybrid support") Reported-by: Ammy Yi Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220818184429.2355857-1-kan.liang@linux.intel.com commit d4bdb0bebc5ba3299d74f123c782d99cd4e25c49 Author: Stephane Eranian Date: Wed Aug 17 22:46:13 2022 -0700 perf/x86/intel/ds: Fix precise store latency handling With the existing code in store_latency_data(), the memory operation (mem_op) returned to the user is always OP_LOAD where in fact, it should be OP_STORE. This comes from the fact that the function is simply grabbing the information from a data source map which covers only load accesses. Intel 12th gen CPU offers precise store sampling that captures both the data source and latency. Therefore it can use the data source mapping table but must override the memory operation to reflect stores instead of loads. Fixes: 61b985e3e775 ("perf/x86/intel: Add perf core PMU support for Sapphire Rapids") Signed-off-by: Stephane Eranian Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20220818054613.1548130-1-eranian@google.com commit 7d3598868aaee05eb738d1c3115616b867e7530a Author: Peter Zijlstra Date: Tue Aug 16 19:40:57 2022 +0800 perf/x86/core: Set pebs_capable and PMU_FL_PEBS_ALL for the Baseline The SDM explicitly states that PEBS Baseline implies Extended PEBS. For cpu model forward compatibility (e.g. on ICX, SPR, ADL), it's safe to stop doing FMS table thing such as setting pebs_capable and PMU_FL_PEBS_ALL since it's already set in the intel_ds_init(). The Goldmont Plus is the only platform which supports extended PEBS but doesn't have Baseline. Keep the status quo. Reported-by: Like Xu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lkml.kernel.org/r/20220816114057.51307-1-likexu@tencent.com commit 32ba156df1b1c8804a4e5be5339616945eafea22 Author: Kan Liang Date: Tue Aug 16 05:56:11 2022 -0700 perf/x86/lbr: Enable the branch type for the Arch LBR by default On the platform with Arch LBR, the HW raw branch type encoding may leak to the perf tool when the SAVE_TYPE option is not set. In the intel_pmu_store_lbr(), the HW raw branch type is stored in lbr_entries[].type. If the SAVE_TYPE option is set, the lbr_entries[].type will be converted into the generic PERF_BR_* type in the intel_pmu_lbr_filter() and exposed to the user tools. But if the SAVE_TYPE option is NOT set by the user, the current perf kernel doesn't clear the field. The HW raw branch type leaks. There are two solutions to fix the issue for the Arch LBR. One is to clear the field if the SAVE_TYPE option is NOT set. The other solution is to unconditionally convert the branch type and expose the generic type to the user tools. The latter is implemented here, because - The branch type is valuable information. I don't see a case where you would not benefit from the branch type. (Stephane Eranian) - Not having the branch type DOES NOT save any space in the branch record (Stephane Eranian) - The Arch LBR HW can retrieve the common branch types from the LBR_INFO. It doesn't require the high overhead SW disassemble. Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR") Reported-by: Stephane Eranian Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220816125612.2042397-1-kan.liang@linux.intel.com commit 963a70bee5880640d0fd83ed29dc1e7ec0d2bd4a Merge: adb67b373a68b 90d74fdbd8059 Author: Linus Torvalds Date: Fri Aug 19 09:46:11 2022 -0700 Merge tag 'sound-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The only significant core change is ASoC DPCM fix for asymmetric setup; other remaining changes are device-specific fixes, including the hardening of string manipulations. One change in platform/x86 is the patch I forgot to apply from a series for CS35L41 codec" * tag 'sound-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits) ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU ALSA: info: Fix llseek return value when using callback ALSA: hda/cs8409: Support new Dolphin Variants platform/x86: serial-multi-instantiate: Add CLSA0101 Laptop ALSA: hda/realtek: Add quirk for Lenovo Yoga7 14IAL7 ALSA: hda: cs35l41: Clarify support for CSC3551 without _DSD Properties ALSA: hda/realtek: Add quirks for ASUS Zenbooks using CS35L41 ASoC: codec: tlv320aic32x4: fix mono playback via I2S ASoC: rt5640: Fix the JD voltage dropping issue ASoC: tas2770: Fix handling of mute/unmute ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Allow mono streams ASoC: tas2770: Set correct FSYNC polarity ASoC: Intel: fix sof_es8336 probe ASoC: DPCM: Don't pick up BE without substream ASoC: SOF: ipc3-topology: Fix clang -Wformat warning ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() ASoC: SOF: debug: Fix potential buffer overflow by snprintf() ASoC: Intel: avs: Fix potential buffer overflow by snprintf() ... commit adb67b373a68b6ca4ea9225e248d726f0f5f0f8d Merge: a4ee891b7e918 b1fb6b87ed55c Author: Linus Torvalds Date: Fri Aug 19 09:39:32 2022 -0700 Merge tag 'drm-fixes-2022-08-19' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular weekly fixes. The nouveau patch just enables modesetting on GA103 hw which is like other ampere cards that are already supported. amdgpu has 2 weeks of fixes, as Alex was away, so a bit larger than usual, otherwise some i915 and misc other fixes. ttm: - NULL ptr dereference i915: - disable pci resize on 32-bit systems - don't leak the ccs state - TLB invalidation fixes nouveau: - GA103 enablement - off-by-one fix amdgpu: - Revert some DML stack changes - Rounding fixes in KFD allocations - atombios vram info table parsing fix - DCN 3.1.4 fixes - Clockgating fixes for various new IPs - SMU 13.0.4 fixes - DCN 3.1.4 FP fixes - TMDS fixes for YCbCr420 4k modes - DCN 3.2.x fixes - USB 4 fixes - SMU 13.0 fixes - SMU driver unload memory leak fixes - Display orientation fix - Regression fix for generic fbdev conversion - SDMA 6.x fixes - SR-IOV fixes - IH 6.x fixes - Use after free fix in bo list handling - Revert pipe1 support - XGMI hive reset fix amdkfd: - Fix potential crach in kfd_create_indirect_link_prop() imx: - warning fix meson: - refcounting fix lvds-codec: - error check fix sun4i: - underflow fix - dt-binding fix" * tag 'drm-fixes-2022-08-19' of git://anongit.freedesktop.org/drm/drm: (109 commits) Revert "drm/amd/amdgpu: add pipe1 hardware support" drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex drm/amdgpu: Fix interrupt handling on ih_soft ring drm/amdgpu: Add secure display TA load for Renoir drm/amd/display: Include scaling factor for SubVP command drm/amdgpu/vcn: Return void from the stop_dbg_mode drm/amdgpu: remove useless condition in amdgpu_job_stop_all_jobs_on_sched() drm/amdgpu: Add decode_iv_ts helper for ih_v6 block drm/amd/display: add chip revision to DCN32 drm/amd/display: avoid doing vm_init multiple time drm/amd/display: Use pitch when calculating size to cache in MALL drm/amd/display: Don't set DSC for phantom pipes drm/amd/display: Update clock table policy for DCN314 drm/amd/display: Modify header inclusion pattern drm/amd/display: Fix plug/unplug external monitor will hang while playback MPO video drm/amd/display: Add debug parameter to retain default clock table drm/amdgpu: Increase tlb flush timeout for sriov drm/amd/display: do not compare integers of different widths drm/amd/display: Add reserved dc_log_type. drm/amd/display: Fix pixel clock programming ... commit a4ee891b7e918e5a005b43171f16ad5f8b3bc7d1 Merge: 88e0a74902f89 61b123ffcedac Author: Linus Torvalds Date: Fri Aug 19 09:22:31 2022 -0700 Merge tag 'bitmap-6.0-rc2' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: "cpumask: UP optimisation fixes follow-up As an older version of the UP optimisation fixes was merged, not all review feedback has been implemented. This implements the feedback received on the merged version [1], and the respin [2], for changes related to and lib/cpumask.c" Link: https://lore.kernel.org/lkml/cover.1656777646.git.sander@svanheule.net/ [1] Link: https://lore.kernel.org/lkml/cover.1659077534.git.sander@svanheule.net/ [2] It spent for more than a week with no issues. * tag 'bitmap-6.0-rc2' of https://github.com/norov/linux: lib/cpumask: drop always-true preprocessor guard lib/cpumask: add inline cpumask_next_wrap() for UP cpumask: align signatures of UP implementations commit 13609a8b3ac6b0af38127a2b97fe62c0d06a8282 Author: Wolfram Sang Date: Thu Aug 18 23:01:41 2022 +0200 cifs: move from strlcpy with unused retval to strscpy Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Steve French commit ca08d0eac020d48a3141dbec0a3cf64fbdb17cde Author: Zhang Xiaoxu Date: Thu Aug 18 21:50:44 2022 +0800 cifs: Fix memory leak on the deferred close xfstests on smb21 report kmemleak as below: unreferenced object 0xffff8881767d6200 (size 64): comm "xfs_io", pid 1284, jiffies 4294777434 (age 20.789s) hex dump (first 32 bytes): 80 5a d0 11 81 88 ff ff 78 8a aa 63 81 88 ff ff .Z......x..c.... 00 71 99 76 81 88 ff ff 00 00 00 00 00 00 00 00 .q.v............ backtrace: [<00000000ad04e6ea>] cifs_close+0x92/0x2c0 [<0000000028b93c82>] __fput+0xff/0x3f0 [<00000000d8116851>] task_work_run+0x85/0xc0 [<0000000027e14f9e>] do_exit+0x5e5/0x1240 [<00000000fb492b95>] do_group_exit+0x58/0xe0 [<00000000129a32d9>] __x64_sys_exit_group+0x28/0x30 [<00000000e3f7d8e9>] do_syscall_64+0x35/0x80 [<00000000102e8a0b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 When cancel the deferred close work, we should also cleanup the struct cifs_deferred_close. Fixes: 9e992755be8f2 ("cifs: Call close synchronously during unlink/rename/lease break.") Fixes: e3fc065682ebb ("cifs: Deferred close performance improvements") Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Zhang Xiaoxu Signed-off-by: Steve French commit 28526478ccae88680645405f4e849d9ed4fbce7f Author: Ian Rogers Date: Tue Jun 14 07:33:50 2022 -0700 perf cpumap: Compute mask size in constant time perf_cpu_map__max() computes the cpumap's maximum value, no need to iterate over all values. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Athira Jajeev Cc: Colin Ian King Cc: Dave Marchevsky Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Kees Kook Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Song Liu Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220614143353.1559597-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 35ae6f09d8fd02add781e452a6d2ba6ea3a5482e Author: Ian Rogers Date: Tue Jun 14 07:33:49 2022 -0700 perf cpumap: Synthetic events and const/static Make the cpumap arguments const to make it clearer they are in rather than out arguments. Make two functions static and remove external declarations. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Athira Jajeev Cc: Colin Ian King Cc: Dave Marchevsky Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Kees Kook Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Song Liu Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220614143353.1559597-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e989bc3d0f3f93aab7c5018affc3f87b74716b37 Author: Ian Rogers Date: Tue Jun 14 07:33:48 2022 -0700 perf cpumap: Const map for max() Allows max() to be used with 'const struct perf_cpu_maps *'. Signed-off-by: Ian Rogers Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexey Bayduraev Cc: Athira Jajeev Cc: Colin Ian King Cc: Dave Marchevsky Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Kees Kook Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Riccardo Mancini Cc: Song Liu Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220614143353.1559597-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 88e0a74902f894fbbc55ad3ad2cb23b4bfba555c Author: Aaron Lu Date: Fri Aug 19 10:30:01 2022 +0800 x86/mm: Use proper mask when setting PUD mapping Commit c164fbb40c43f("x86/mm: thread pgprot_t through init_memory_mapping()") mistakenly used __pgprot() which doesn't respect __default_kernel_pte_mask when setting PUD mapping. Fix it by only setting the one bit we actually need (PSE) and leaving the other bits (that have been properly masked) alone. Fixes: c164fbb40c43 ("x86/mm: thread pgprot_t through init_memory_mapping()") Signed-off-by: Aaron Lu Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 04d4ca41809052f6088860fe150dac679e6453d0 Author: Akira Yokosawa Date: Fri Aug 19 07:34:40 2022 +0900 docs/ja_JP/SubmittingPatches: Remove reference to submitting-drivers.rst Reflect changes made in commit 9db370de2780 ("docs: process: remove outdated submitting-drivers.rst") Reported-by: Mauro Carvalho Chehab Signed-off-by: Akira Yokosawa Fixes: 9db370de2780 ("docs: process: remove outdated submitting-drivers.rst") Cc: Tsugikazu Shibata Link: https://lore.kernel.org/r/20220818223440.13530-1-akiyks@gmail.com Signed-off-by: Jonathan Corbet commit 3f4e432fb9c6357b4b9bce1def67d61a215029eb Author: Bartosz Golaszewski Date: Mon Aug 15 11:19:29 2022 +0200 gpio: pxa: use devres for the clock struct The clock is never released after probe(). Use devres to not leak resources. Reported-by: Hulk Robot Reported-by: Yuan Can Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij commit 636c3982d296a560aabcc5e462c3a6408389ffd2 Author: Lukas Bulwahn Date: Tue Aug 16 09:39:52 2022 +0200 MAINTAINERS: rectify entry for XILINX GPIO DRIVER Commit ba96b2e7974b ("dt-bindings: gpio: gpio-xilinx: Convert Xilinx axi gpio binding to YAML") converts gpio-xilinx.txt to xlnx,gpio-xilinx.yaml, but missed to adjust its reference in MAINTAINERS. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in XILINX GPIO DRIVER. Signed-off-by: Lukas Bulwahn Signed-off-by: Bartosz Golaszewski commit ea2aa97ca37a9044ade001aef71dbc06318e8d44 Author: Jeffy Chen Date: Fri Aug 19 15:28:34 2022 +0800 drm/gem: Fix GEM handle release errors Currently we are assuming a one to one mapping between dmabuf and GEM handle when releasing GEM handles. But that is not always true, since we would create extra handles for the GEM obj in cases like gem_open() and getfb{,2}(). A similar issue was reported at: https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ Another problem is that the imported dmabuf might not always have gem_obj->dma_buf set, which would cause leaks in drm_gem_remove_prime_handles(). Let's fix these for now by using handle to find the exact map to remove. Signed-off-by: Jeffy Chen Reviewed-by: Christian König Signed-off-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20220819072834.17888-1-jeffy.chen@rock-chips.com commit 372d07084593dc7a399bf9bee815711b1fb1bcf2 Author: David Matlack Date: Fri Jul 22 23:48:38 2022 +0000 KVM: selftests: Fix ambiguous mov in KVM_ASM_SAFE() Change the mov in KVM_ASM_SAFE() that zeroes @vector to a movb to make it unambiguous. This fixes a build failure with Clang since, unlike the GNU assembler, the LLVM integrated assembler rejects ambiguous X86 instructions that don't have suffixes: In file included from x86_64/hyperv_features.c:13: include/x86_64/processor.h:825:9: error: ambiguous instructions require an explicit suffix (could be 'movb', 'movw', 'movl', or 'movq') return kvm_asm_safe("wrmsr", "a"(val & -1u), "d"(val >> 32), "c"(msr)); ^ include/x86_64/processor.h:802:15: note: expanded from macro 'kvm_asm_safe' asm volatile(KVM_ASM_SAFE(insn) \ ^ include/x86_64/processor.h:788:16: note: expanded from macro 'KVM_ASM_SAFE' "1: " insn "\n\t" \ ^ :5:2: note: instantiated into assembly here mov $0, 15(%rsp) ^ It seems like this change could introduce undesirable behavior in the future, e.g. if someone used a type larger than a u8 for @vector, since KVM_ASM_SAFE() will only zero the bottom byte. I tried changing the type of @vector to an int to see what would happen. GCC failed to compile due to a size mismatch between `movb` and `%eax`. Clang succeeded in compiling, but the generated code looked correct, so perhaps it will not be an issue. That being said it seems like there could be a better solution to this issue that does not assume @vector is a u8. Fixes: 3b23054cd3f5 ("KVM: selftests: Add x86-64 support for exception fixup") Signed-off-by: David Matlack Reviewed-by: Sean Christopherson Message-Id: <20220722234838.2160385-3-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 67ef8664cc5b113f6c49b01d2a0e4cbc589623dd Author: David Matlack Date: Fri Jul 22 23:48:37 2022 +0000 KVM: selftests: Fix KVM_EXCEPTION_MAGIC build with Clang Change KVM_EXCEPTION_MAGIC to use the all-caps "ULL", rather than lower case. This fixes a build failure with Clang: In file included from x86_64/hyperv_features.c:13: include/x86_64/processor.h:825:9: error: unexpected token in argument list return kvm_asm_safe("wrmsr", "a"(val & -1u), "d"(val >> 32), "c"(msr)); ^ include/x86_64/processor.h:802:15: note: expanded from macro 'kvm_asm_safe' asm volatile(KVM_ASM_SAFE(insn) \ ^ include/x86_64/processor.h:785:2: note: expanded from macro 'KVM_ASM_SAFE' "mov $" __stringify(KVM_EXCEPTION_MAGIC) ", %%r9\n\t" \ ^ :1:18: note: instantiated into assembly here mov $0xabacadabaull, %r9 ^ Fixes: 3b23054cd3f5 ("KVM: selftests: Add x86-64 support for exception fixup") Signed-off-by: David Matlack Reviewed-by: Sean Christopherson Message-Id: <20220722234838.2160385-2-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 020dac4187968535f089f83f376a72beb3451311 Author: Jim Mattson Date: Wed Aug 10 14:30:50 2022 -0700 KVM: VMX: Heed the 'msr' argument in msr_write_intercepted() Regardless of the 'msr' argument passed to the VMX version of msr_write_intercepted(), the function always checks to see if a specific MSR (IA32_SPEC_CTRL) is intercepted for write. This behavior seems unintentional and unexpected. Modify the function so that it checks to see if the provided 'msr' index is intercepted for write. Fixes: 67f4b9969c30 ("KVM: nVMX: Handle dynamic MSR intercept toggling") Cc: Sean Christopherson Signed-off-by: Jim Mattson Reviewed-by: Sean Christopherson Message-Id: <20220810213050.2655000-1-jmattson@google.com> Signed-off-by: Paolo Bonzini commit b64d740ea7ddc929d97b28de4c0665f7d5db9e2a Author: Junaid Shahid Date: Wed Aug 10 15:49:39 2022 -0700 kvm: x86: mmu: Always flush TLBs when enabling dirty logging When A/D bits are not available, KVM uses a software access tracking mechanism, which involves making the SPTEs inaccessible. However, the clear_young() MMU notifier does not flush TLBs. So it is possible that there may still be stale, potentially writable, TLB entries. This is usually fine, but can be problematic when enabling dirty logging, because it currently only does a TLB flush if any SPTEs were modified. But if all SPTEs are in access-tracked state, then there won't be a TLB flush, which means that the guest could still possibly write to memory and not have it reflected in the dirty bitmap. So just unconditionally flush the TLBs when enabling dirty logging. As an alternative, KVM could explicitly check the MMU-Writable bit when write-protecting SPTEs to decide if a flush is needed (instead of checking the Writable bit), but given that a flush almost always happens anyway, so just making it unconditional seems simpler. Signed-off-by: Junaid Shahid Message-Id: <20220810224939.2611160-1-junaids@google.com> Signed-off-by: Paolo Bonzini commit 1441ca1494d74a2c9d6c9bd8dd633d9ebff1daba Author: Junaid Shahid Date: Fri Jul 22 19:43:16 2022 -0700 kvm: x86: mmu: Drop the need_remote_flush() function This is only used by kvm_mmu_pte_write(), which no longer actually creates the new SPTE and instead just clears the old SPTE. So we just need to check if the old SPTE was shadow-present instead of calling need_remote_flush(). Hence we can drop this function. It was incomplete anyway as it didn't take access-tracking into account. This patch should not result in any functional change. Signed-off-by: Junaid Shahid Reviewed-by: David Matlack Reviewed-by: Sean Christopherson Message-Id: <20220723024316.2725328-1-junaids@google.com> Signed-off-by: Paolo Bonzini commit 332924973725e8cdcc783c175f68cf7e162cb9e5 Author: Peter Zijlstra Date: Fri Aug 19 13:01:35 2022 +0200 x86/nospec: Fix i386 RSB stuffing Turns out that i386 doesn't unconditionally have LFENCE, as such the loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such chips. Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence") Reported-by: Ben Hutchings Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-ass.net commit 4e3aa9238277597c6c7624f302d81a7b568b6f2d Author: Peter Zijlstra Date: Tue Aug 16 14:28:36 2022 +0200 x86/nospec: Unwreck the RSB stuffing Commit 2b1299322016 ("x86/speculation: Add RSB VM Exit protections") made a right mess of the RSB stuffing, rewrite the whole thing to not suck. Thanks to Andrew for the enlightening comment about Post-Barrier RSB things so we can make this code less magical. Cc: stable@vger.kernel.org Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/YvuNdDWoUZSBjYcm@worktop.programming.kicks-ass.net commit 959d6c4ae238b28a163b1b3741fae05391227ad9 Merge: eceb6e1d53004 b10d86fb8e46c Author: Paolo Bonzini Date: Fri Aug 19 05:43:53 2022 -0400 Merge tag 'kvmarm-fixes-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.0, take #1 - Fix unexpected sign extension of KVM_ARM_DEVICE_ID_MASK - Tidy-up handling of AArch32 on asymmetric systems commit a8c67e27d9e3ed33afadbdf86bbd58e26e0c4357 Author: Chunfeng Yun Date: Fri Aug 19 16:10:27 2022 +0800 dt-bindings: usb: mtu3: add compatible for mt8188 Add a new compatible for mt8188 Acked-by: Krzysztof Kozlowski Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20220819081027.32382-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a Author: Thierry GUIBERT Date: Fri Aug 19 10:17:02 2022 +0200 USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver enabling the AT serial port. The Vendor Id is 0x0C26 The Product ID is 0x0020 Output of lsusb : Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio Couldn't open device, some information will be missing Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 2 Communications bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0c26 Prolific Technology Inc. idProduct 0x0020 bcdDevice 0.00 iManufacturer 1 ICOM Inc. iProduct 2 ICOM Radio iSerial 3 *obfuscated* bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0030 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 0mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 1 AT-commands (v.25ter) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 12 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Signed-off-by: Thierry GUIBERT Cc: stable Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croix-rouge.fr Signed-off-by: Greg Kroah-Hartman commit f511aef2ebe5377d4c263842f2e0c0b8e274e8e5 Author: Jing Leng Date: Wed Jul 20 18:48:15 2022 -0700 usb: gadget: f_uac2: fix superspeed transfer On page 362 of the USB3.2 specification ( https://usb.org/sites/default/files/usb_32_20210125.zip), The 'SuperSpeed Endpoint Companion Descriptor' shall only be returned by Enhanced SuperSpeed devices that are operating at Gen X speed. Each endpoint described in an interface is followed by a 'SuperSpeed Endpoint Companion Descriptor'. If users use SuperSpeed UDC, host can't recognize the device if endpoint doesn't have 'SuperSpeed Endpoint Companion Descriptor' followed. Currently in the uac2 driver code: 1. ss_epout_desc_comp follows ss_epout_desc; 2. ss_epin_fback_desc_comp follows ss_epin_fback_desc; 3. ss_epin_desc_comp follows ss_epin_desc; 4. Only ss_ep_int_desc endpoint doesn't have 'SuperSpeed Endpoint Companion Descriptor' followed, so we should add it. Fixes: eaf6cbe09920 ("usb: gadget: f_uac2: add volume and mute support") Cc: stable Signed-off-by: Jing Leng Signed-off-by: Jack Pham Link: https://lore.kernel.org/r/20220721014815.14453-1-quic_jackp@quicinc.com Signed-off-by: Greg Kroah-Hartman commit db7e5c10351e3dd58e6bef237c8fa74282e5d59e Author: Greg Kroah-Hartman Date: Fri Aug 19 10:55:54 2022 +0200 Revert "binder_alloc: Add missing mmap_lock calls when using the VMA" This reverts commit d6f35446d0769a98e9d761593d267cdd24f09ecd. It is coming in through Andrew's tree instead, and for some reason we have different versions. I trust the version from Andrew more as the original offending commit came through his tree. Fixes: d6f35446d076 ("binder_alloc: Add missing mmap_lock calls when using the VMA") Cc: stable Cc: Ondrej Mosnacek Cc: Ondrej Mosnacek Cc: Carlos Llamas Cc: Liam R. Howlett Reported-by: Stephen Rothwell Link: https://lore.kernel.org/r/20220819184027.7b3fda3e@canb.auug.org.au Signed-off-by: Greg Kroah-Hartman commit 6c939e28b192075e1d3b9b267100a3dd9d6a7cf7 Author: Kuldeep Singh Date: Sat Mar 12 17:08:52 2022 +0530 ARM: dts: versatile: Update spi clock-names property Now that spi pl022 binding only accept "sspclk" as clock name, versatile platform with "SSPCLK" clock name start raising dtbs_check warnings. Make necessary changes to update this property in order to make it compliant with binding. clock-names:0: 'sspclk' was expected Signed-off-by: Kuldeep Singh Link: https://lore.kernel.org/r/20220312113853.63446-4-singh.kuldeep87k@gmail.com Signed-off-by: Linus Walleij commit 1aa156f2a82a91f7844ada7e576b716e64bec618 Author: Kuldeep Singh Date: Sat Mar 12 17:08:51 2022 +0530 ARM: dts: realview: Update spi clock-names property Now that spi pl022 binding only accept "sspclk" as clock name, realview platforms with "SSPCLK" clock name start raising dtbs_check warnings. Make necessary changes to update this property in order to make it compliant with binding. clock-names:0: 'sspclk' was expected Signed-off-by: Kuldeep Singh Link: https://lore.kernel.org/r/20220312113853.63446-3-singh.kuldeep87k@gmail.com Signed-off-by: Linus Walleij commit ba35187559a05cad93dfbb7fbc65edf066ae511b Author: Kuldeep Singh Date: Sat Mar 12 17:08:50 2022 +0530 ARM: dts: integratorap: Update spi node properties As per spi pl022 binding, SPI clock name is "sspclk" and not "spiclk". Fix it. Also update ssp node name to enable spi bindings check. Signed-off-by: Kuldeep Singh Link: https://lore.kernel.org/r/20220312113853.63446-2-singh.kuldeep87k@gmail.com Signed-off-by: Linus Walleij commit 6020f480004a80cdad4ae5ee180a231c4f65595b Author: Chunfeng Yun Date: Fri Aug 19 16:05:56 2022 +0800 usb: xhci-mtk: fix bandwidth release issue This happens when @udev->reset_resume is set to true, when usb resume, the flow as below: - hub_resume - usb_disable_interface - usb_disable_endpoint - usb_hcd_disable_endpoint - xhci_endpoint_disable // it set @ep->hcpriv to NULL Then when reset usb device, it will drop allocated endpoints, the flow as below: - usb_reset_and_verify_device - usb_hcd_alloc_bandwidth - xhci_mtk_drop_ep but @ep->hcpriv is already set to NULL, the bandwidth will be not released anymore. Due to the added endponts are stored in hash table, we can drop the check of @ep->hcpriv. Fixes: 4ce186665e7c ("usb: xhci-mtk: Do not use xhci's virt_dev in drop_endpoint") Cc: stable Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20220819080556.32215-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 8b13ea05117ffad4727b0971ed09122d5c91c4dc Author: Chunfeng Yun Date: Fri Aug 19 16:05:55 2022 +0800 usb: xhci-mtk: relax TT periodic bandwidth allocation Currently uses the worst case byte budgets on FS/LS bus bandwidth, for example, for an isochronos IN endpoint with 192 bytes budget, it will consume the whole 5 uframes(188 * 5) while the actual FS bus budget should be just 192 bytes. It cause that many usb audio headsets with 3 interfaces (audio input, audio output, and HID) cannot be configured. To improve it, changes to use "approximate" best case budget for FS/LS bandwidth management. For the same endpoint from the above example, the approximate best case budget is now reduced to (188 * 2) bytes. Signed-off-by: Chunfeng Yun Cc: stable Link: https://lore.kernel.org/r/20220819080556.32215-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman commit eceb6e1d530046f964b0e371d4fad02a5b6b42d1 Author: Li kunyu Date: Fri Aug 19 10:15:35 2022 +0800 KVM: Drop unnecessary initialization of "ops" in kvm_ioctl_create_device() The variable is initialized but it is only used after its assignment. Reviewed-by: Sean Christopherson Signed-off-by: Li kunyu Message-Id: <20220819021535.483702-1-kunyu@nfschina.com> Signed-off-by: Paolo Bonzini commit 2824913976a851f049bc8ab929b5c8d3b6ee269b Author: Li kunyu Date: Fri Aug 19 10:28:04 2022 +0800 KVM: Drop unnecessary initialization of "npages" in hva_to_pfn_slow() The variable is initialized but it is only used after its assignment. Reviewed-by: Sean Christopherson Signed-off-by: Li kunyu Message-Id: <20220819022804.483914-1-kunyu@nfschina.com> Signed-off-by: Paolo Bonzini commit 3d9606b0e0f3aed4dfb61d0853ebf432fead7bba Author: Josh Poimboeuf Date: Thu Aug 18 08:53:43 2022 -0700 x86/kvm: Fix "missing ENDBR" BUG for fastop functions The following BUG was reported: traps: Missing ENDBR: andw_ax_dx+0x0/0x10 [kvm] ------------[ cut here ]------------ kernel BUG at arch/x86/kernel/traps.c:253! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI asm_exc_control_protection+0x2b/0x30 RIP: 0010:andw_ax_dx+0x0/0x10 [kvm] Code: c3 cc cc cc cc 0f 1f 44 00 00 66 0f 1f 00 48 19 d0 c3 cc cc cc cc 0f 1f 40 00 f3 0f 1e fa 20 d0 c3 cc cc cc cc 0f 1f 44 00 00 <66> 0f 1f 00 66 21 d0 c3 cc cc cc cc 0f 1f 40 00 66 0f 1f 00 21 d0 ? andb_al_dl+0x10/0x10 [kvm] ? fastop+0x5d/0xa0 [kvm] x86_emulate_insn+0x822/0x1060 [kvm] x86_emulate_instruction+0x46f/0x750 [kvm] complete_emulated_mmio+0x216/0x2c0 [kvm] kvm_arch_vcpu_ioctl_run+0x604/0x650 [kvm] kvm_vcpu_ioctl+0x2f4/0x6b0 [kvm] ? wake_up_q+0xa0/0xa0 The BUG occurred because the ENDBR in the andw_ax_dx() fastop function had been incorrectly "sealed" (converted to a NOP) by apply_ibt_endbr(). Objtool marked it to be sealed because KVM has no compile-time references to the function. Instead KVM calculates its address at runtime. Prevent objtool from annotating fastop functions as sealable by creating throwaway dummy compile-time references to the functions. Fixes: 6649fa876da4 ("x86/ibt,kvm: Add ENDBR to fastops") Reported-by: Pengfei Xu Debugged-by: Peter Zijlstra Signed-off-by: Josh Poimboeuf Message-Id: <0d4116f90e9d0c1b754bb90c585e6f0415a1c508.1660837839.git.jpoimboe@kernel.org> Signed-off-by: Paolo Bonzini commit 22472d12606c1dd3e92312f7329734e489b371ff Author: Josh Poimboeuf Date: Thu Aug 18 08:53:42 2022 -0700 x86/kvm: Simplify FOP_SETCC() SETCC_ALIGN and FOP_ALIGN are both 16. Remove the special casing for FOP_SETCC() and just make it a normal fastop. Signed-off-by: Josh Poimboeuf Message-Id: <7c13d94d1a775156f7e36eed30509b274a229140.1660837839.git.jpoimboe@kernel.org> Signed-off-by: Paolo Bonzini commit e27e5bea956ce4d3eb15112de5fa5a3b77c2f488 Author: Josh Poimboeuf Date: Thu Aug 18 14:39:27 2022 -0700 x86/ibt, objtool: Add IBT_NOSEAL() Add a macro which prevents a function from getting sealed if there are no compile-time references to it. Signed-off-by: Josh Poimboeuf Message-Id: <20220818213927.e44fmxkoq4yj6ybn@treble> Signed-off-by: Paolo Bonzini commit 20ec3ebd707c77fb9b11b37193449193d4649f33 Author: Chao Peng Date: Tue Aug 16 20:53:22 2022 +0800 KVM: Rename mmu_notifier_* to mmu_invalidate_* The motivation of this renaming is to make these variables and related helper functions less mmu_notifier bound and can also be used for non mmu_notifier based page invalidation. mmu_invalidate_* was chosen to better describe the purpose of 'invalidating' a page that those variables are used for. - mmu_notifier_seq/range_start/range_end are renamed to mmu_invalidate_seq/range_start/range_end. - mmu_notifier_retry{_hva} helper functions are renamed to mmu_invalidate_retry{_hva}. - mmu_notifier_count is renamed to mmu_invalidate_in_progress to avoid confusion with mn_active_invalidate_count. - While here, also update kvm_inc/dec_notifier_count() to kvm_mmu_invalidate_begin/end() to match the change for mmu_notifier_count. No functional change intended. Signed-off-by: Chao Peng Message-Id: <20220816125322.1110439-3-chao.p.peng@linux.intel.com> Signed-off-by: Paolo Bonzini commit bdd1c37a315bc50ab14066c4852bc8dcf070451e Author: Chao Peng Date: Tue Aug 16 20:53:21 2022 +0800 KVM: Rename KVM_PRIVATE_MEM_SLOTS to KVM_INTERNAL_MEM_SLOTS KVM_INTERNAL_MEM_SLOTS better reflects the fact those slots are KVM internally used (invisible to userspace) and avoids confusion to future private slots that can have different meaning. Signed-off-by: Chao Peng Message-Id: <20220816125322.1110439-2-chao.p.peng@linux.intel.com> Signed-off-by: Paolo Bonzini commit b075450868dbc0950f0942617f222eeb989cad10 Author: Paolo Bonzini Date: Fri Aug 19 04:04:28 2022 -0400 KVM: MIPS: remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS KVM_PRIVATE_MEM_SLOTS defaults to zero, so it is not necessary to define it in MIPS's asm/kvm_host.h. Signed-off-by: Paolo Bonzini commit c2b823970192882fe033d0d9f919003747d3e26f Author: Sean Christopherson Date: Tue Aug 16 05:39:37 2022 +0000 KVM: Move coalesced MMIO initialization (back) into kvm_create_vm() Invoke kvm_coalesced_mmio_init() from kvm_create_vm() now that allocating and initializing coalesced MMIO objects is separate from registering any associated devices. Moving coalesced MMIO cleans up the last oddity where KVM does VM creation/initialization after kvm_create_vm(), and more importantly after kvm_arch_post_init_vm() is called and the VM is added to the global vm_list, i.e. after the VM is fully created as far as KVM is concerned. Originally, kvm_coalesced_mmio_init() was called by kvm_create_vm(), but the original implementation was completely devoid of error handling. Commit 6ce5a090a9a0 ("KVM: coalesced_mmio: fix kvm_coalesced_mmio_init()'s error handling" fixed the various bugs, and in doing so rightly moved the call to after kvm_create_vm() because kvm_coalesced_mmio_init() also registered the coalesced MMIO device. Commit 2b3c246a682c ("KVM: Make coalesced mmio use a device per zone") cleaned up that mess by having each zone register a separate device, i.e. moved device registration to its logical home in kvm_vm_ioctl_register_coalesced_mmio(). As a result, kvm_coalesced_mmio_init() is now a "pure" initialization helper and can be safely called from kvm_create_vm(). Opportunstically drop the #ifdef, KVM provides stubs for kvm_coalesced_mmio_{init,free}() when CONFIG_KVM_MMIO=n (s390). Signed-off-by: Sean Christopherson Message-Id: <20220816053937.2477106-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 405294f29faee5de8c10cb9d4a90e229c2835279 Author: Sean Christopherson Date: Tue Aug 16 05:39:36 2022 +0000 KVM: Unconditionally get a ref to /dev/kvm module when creating a VM Unconditionally get a reference to the /dev/kvm module when creating a VM instead of using try_get_module(), which will fail if the module is in the process of being forcefully unloaded. The error handling when try_get_module() fails doesn't properly unwind all that has been done, e.g. doesn't call kvm_arch_pre_destroy_vm() and doesn't remove the VM from the global list. Not removing VMs from the global list tends to be fatal, e.g. leads to use-after-free explosions. The obvious alternative would be to add proper unwinding, but the justification for using try_get_module(), "rmmod --wait", is completely bogus as support for "rmmod --wait", i.e. delete_module() without O_NONBLOCK, was removed by commit 3f2b9c9cdf38 ("module: remove rmmod --wait option.") nearly a decade ago. It's still possible for try_get_module() to fail due to the module dying (more like being killed), as the module will be tagged MODULE_STATE_GOING by "rmmod --force", i.e. delete_module(..., O_TRUNC), but playing nice with forced unloading is an exercise in futility and gives a falsea sense of security. Using try_get_module() only prevents acquiring _new_ references, it doesn't magically put the references held by other VMs, and forced unloading doesn't wait, i.e. "rmmod --force" on KVM is all but guaranteed to cause spectacular fireworks; the window where KVM will fail try_get_module() is tiny compared to the window where KVM is building and running the VM with an elevated module refcount. Addressing KVM's inability to play nice with "rmmod --force" is firmly out-of-scope. Forcefully unloading any module taints kernel (for obvious reasons) _and_ requires the kernel to be built with CONFIG_MODULE_FORCE_UNLOAD=y, which is off by default and comes with the amusing disclaimer that it's "mainly for kernel developers and desperate users". In other words, KVM is free to scoff at bug reports due to using "rmmod --force" while VMs may be running. Fixes: 5f6de5cbebee ("KVM: Prevent module exit until all VMs are freed") Cc: stable@vger.kernel.org Cc: David Matlack Signed-off-by: Sean Christopherson Message-Id: <20220816053937.2477106-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4ba4f41942745f1906c06868a4acc6c926463f53 Author: Sean Christopherson Date: Tue Aug 16 05:39:35 2022 +0000 KVM: Properly unwind VM creation if creating debugfs fails Properly unwind VM creation if kvm_create_vm_debugfs() fails. A recent change to invoke kvm_create_vm_debug() in kvm_create_vm() was led astray by buggy try_get_module() handling adding by commit 5f6de5cbebee ("KVM: Prevent module exit until all VMs are freed"). The debugfs error path effectively inherits the bad error path of try_module_get(), e.g. KVM leaves the to-be-free VM on vm_list even though KVM appears to do the right thing by calling module_put() and falling through. Opportunistically hoist kvm_create_vm_debugfs() above the call to kvm_arch_post_init_vm() so that the "post-init" arch hook is actually invoked after the VM is initialized (ignoring kvm_coalesced_mmio_init() for the moment). x86 is the only non-nop implementation of the post-init hook, and it doesn't allocate/initialize any objects that are reachable via debugfs code (spawns a kthread worker for the NX huge page mitigation). Leave the buggy try_get_module() alone for now, it will be fixed in a separate commit. Fixes: b74ed7a68ec1 ("KVM: Actually create debugfs in kvm_create_vm()") Reported-by: syzbot+744e173caec2e1627ee0@syzkaller.appspotmail.com Cc: Oliver Upton Signed-off-by: Sean Christopherson Reviewed-by: Oliver Upton Message-Id: <20220816053937.2477106-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4c2d0b039c5cc0112206a5b22431b577cb1c57ad Merge: 90b6b686c1e02 f4693b81ea380 Author: Linus Torvalds Date: Thu Aug 18 19:37:15 2022 -0700 Merge tag 'net-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Current release - regressions: - tcp: fix cleanup and leaks in tcp_read_skb() (the new way BPF socket maps get data out of the TCP stack) - tls: rx: react to strparser initialization errors - netfilter: nf_tables: fix scheduling-while-atomic splat - net: fix suspicious RCU usage in bpf_sk_reuseport_detach() Current release - new code bugs: - mlxsw: ptp: fix a couple of races, static checker warnings and error handling Previous releases - regressions: - netfilter: - nf_tables: fix possible module reference underflow in error path - make conntrack helpers deal with BIG TCP (skbs > 64kB) - nfnetlink: re-enable conntrack expectation events - net: fix potential refcount leak in ndisc_router_discovery() Previous releases - always broken: - sched: cls_route: disallow handle of 0 - neigh: fix possible local DoS due to net iface start/stop loop - rtnetlink: fix module refcount leak in rtnetlink_rcv_msg - sched: fix adding qlen to qcpu->backlog in gnet_stats_add_queue_cpu - virtio_net: fix endian-ness for RSS - dsa: mv88e6060: prevent crash on an unused port - fec: fix timer capture timing in `fec_ptp_enable_pps()` - ocelot: stats: fix races, integer wrapping and reading incorrect registers (the change of register definitions here accounts for bulk of the changed LoC in this PR)" * tag 'net-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits) net: moxa: MAC address reading, generating, validity checking tcp: handle pure FIN case correctly tcp: refactor tcp_read_skb() a bit tcp: fix tcp_cleanup_rbuf() for tcp_read_skb() tcp: fix sock skb accounting in tcp_read_skb() igb: Add lock to avoid data race dt-bindings: Fix incorrect "the the" corrections net: genl: fix error path memory leak in policy dumping stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_xdp_run net/mlx5e: Allocate flow steering storage during uplink initialization net: mscc: ocelot: report ndo_get_stats64 from the wraparound-resistant ocelot->stats net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset net: mscc: ocelot: make struct ocelot_stat_layout array indexable net: mscc: ocelot: fix race between ndo_get_stats64 and ocelot_check_stats_work net: mscc: ocelot: turn stats_lock into a spinlock net: mscc: ocelot: fix address of SYS_COUNT_TX_AGING counter net: mscc: ocelot: fix incorrect ndo_get_stats64 packet counters net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it ... commit 90b6b686c1e0273ce6d1724fab9b9651a276217e Merge: 0de277d44e5b2 f1227dc7d0411 Author: Linus Torvalds Date: Thu Aug 18 19:24:57 2022 -0700 Merge tag 'linux-kselftest-next-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fix from Shuah Khan: - fix landlock test build regression * tag 'linux-kselftest-next-6.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/landlock: fix broken include of linux/landlock.h commit 0de277d44e5b2c4dc823baf0236864ebb0658191 Merge: 573ae4f13f630 20aec89aac776 Author: Linus Torvalds Date: Thu Aug 18 19:18:28 2022 -0700 Merge tag 'trace-rtla-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull rtla tool fixes from Steven Rostedt: "Fixes for the Real-Time Linux Analysis tooling: - Fix tracer name in comments and prints - Fix setting up symlinks - Allow extra flags to be set in build - Consolidate and show all necessary libraries not found in build error" * tag 'trace-rtla-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: rtla: Consolidate and show all necessary libraries that failed for building tools/rtla: Build with EXTRA_{C,LD}FLAGS tools/rtla: Fix command symlinks rtla: Fix tracer name commit b1fb6b87ed55ced458b322ea10cf0d0ab151e01b Merge: 2ae6ab9d82cdd 085292c3d7801 Author: Dave Airlie Date: Fri Aug 19 09:45:21 2022 +1000 Merge tag 'amd-drm-fixes-6.0-2022-08-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.0-2022-08-17: amdgpu: - Revert some DML stack changes - Rounding fixes in KFD allocations - atombios vram info table parsing fix - DCN 3.1.4 fixes - Clockgating fixes for various new IPs - SMU 13.0.4 fixes - DCN 3.1.4 FP fixes - TMDS fixes for YCbCr420 4k modes - DCN 3.2.x fixes - USB 4 fixes - SMU 13.0 fixes - SMU driver unload memory leak fixes - Display orientation fix - Regression fix for generic fbdev conversion - SDMA 6.x fixes - SR-IOV fixes - IH 6.x fixes - Use after free fix in bo list handling - Revert pipe1 support - XGMI hive reset fix amdkfd: - Fix potential crach in kfd_create_indirect_link_prop() Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220818025206.6463-1-alexander.deucher@amd.com commit d951b20b9def73dcc39a5379831525d0d2a537e9 Author: Conor Dooley Date: Sun Aug 14 15:12:38 2022 +0100 riscv: traps: add missing prototype Sparse complains: arch/riscv/kernel/traps.c:213:6: warning: symbol 'shadow_stack' was not declared. Should it be static? The variable is used in entry.S, so declare shadow_stack there alongside SHADOW_OVERFLOW_STACK_SIZE. Fixes: 31da94c25aea ("riscv: add VMAP_STACK overflow detection") Signed-off-by: Conor Dooley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220814141237.493457-5-mail@conchuod.ie Signed-off-by: Palmer Dabbelt commit b5c3aca86d2698c4850b6ee8b341938025d2780c Author: Conor Dooley Date: Sun Aug 14 15:12:37 2022 +0100 riscv: signal: fix missing prototype warning Fix the warning: arch/riscv/kernel/signal.c:316:27: warning: no previous prototype for function 'do_notify_resume' [-Wmissing-prototypes] asmlinkage __visible void do_notify_resume(struct pt_regs *regs, All other functions in the file are static & none of the existing headers stood out as an obvious location. Create signal.h to hold the declaration. Fixes: e2c0cdfba7f6 ("RISC-V: User-facing API") Signed-off-by: Conor Dooley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220814141237.493457-4-mail@conchuod.ie Signed-off-by: Palmer Dabbelt commit 7d6620f107bae6ed687ff07668e8e8f855487aa9 Author: Pu Lehui Date: Sat Aug 13 21:40:30 2022 +0800 bpf, cgroup: Fix kernel BUG in purge_effective_progs Syzkaller reported a triggered kernel BUG as follows: ------------[ cut here ]------------ kernel BUG at kernel/bpf/cgroup.c:925! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 194 Comm: detach Not tainted 5.19.0-14184-g69dac8e431af #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__cgroup_bpf_detach+0x1f2/0x2a0 Code: 00 e8 92 60 30 00 84 c0 75 d8 4c 89 e0 31 f6 85 f6 74 19 42 f6 84 28 48 05 00 00 02 75 0e 48 8b 80 c0 00 00 00 48 85 c0 75 e5 <0f> 0b 48 8b 0c5 RSP: 0018:ffffc9000055bdb0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888100ec0800 RCX: ffffc900000f1000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888100ec4578 RBP: 0000000000000000 R08: ffff888100ec0800 R09: 0000000000000040 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100ec4000 R13: 000000000000000d R14: ffffc90000199000 R15: ffff888100effb00 FS: 00007f68213d2b80(0000) GS:ffff88813bc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f74a0e5850 CR3: 0000000102836000 CR4: 00000000000006e0 Call Trace: cgroup_bpf_prog_detach+0xcc/0x100 __sys_bpf+0x2273/0x2a00 __x64_sys_bpf+0x17/0x20 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f68214dbcb9 Code: 08 44 89 e0 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff8 RSP: 002b:00007ffeb487db68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f68214dbcb9 RDX: 0000000000000090 RSI: 00007ffeb487db70 RDI: 0000000000000009 RBP: 0000000000000003 R08: 0000000000000012 R09: 0000000b00000003 R10: 00007ffeb487db70 R11: 0000000000000246 R12: 00007ffeb487dc20 R13: 0000000000000004 R14: 0000000000000001 R15: 000055f74a1011b0 Modules linked in: ---[ end trace 0000000000000000 ]--- Repetition steps: For the following cgroup tree, root | cg1 | cg2 1. attach prog2 to cg2, and then attach prog1 to cg1, both bpf progs attach type is NONE or OVERRIDE. 2. write 1 to /proc/thread-self/fail-nth for failslab. 3. detach prog1 for cg1, and then kernel BUG occur. Failslab injection will cause kmalloc fail and fall back to purge_effective_progs. The problem is that cg2 have attached another prog, so when go through cg2 layer, iteration will add pos to 1, and subsequent operations will be skipped by the following condition, and cg will meet NULL in the end. `if (pos && !(cg->bpf.flags[atype] & BPF_F_ALLOW_MULTI))` The NULL cg means no link or prog match, this is as expected, and it's not a bug. So here just skip the no match situation. Fixes: 4c46091ee985 ("bpf: Fix KASAN use-after-free Read in compute_effective_progs") Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220813134030.1972696-1-pulehui@huawei.com commit 96264230a6817bcd4a7ae0fc30c60bfb46499f68 Author: Conor Dooley Date: Fri Aug 12 15:35:32 2022 +0100 perf: riscv legacy: fix kerneldoc comment warning Fix the warning: drivers/perf/riscv_pmu_legacy.c:76: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Fixes: 9b3e150e310e ("RISC-V: Add a simple platform driver for RISC-V legacy perf") Signed-off-by: Conor Dooley Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220812143532.1962623-1-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit c1e5c2f0cb8a22ec2e14af92afc7006491bebabb Author: Pablo Sun Date: Thu Aug 4 11:48:03 2022 +0800 usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles Fix incorrect pin assignment values when connecting to a monitor with Type-C receptacle instead of a plug. According to specification, an UFP_D receptacle's pin assignment should came from the UFP_D pin assignments field (bit 23:16), while an UFP_D plug's assignments are described in the DFP_D pin assignments (bit 15:8) during Mode Discovery. For example the LG 27 UL850-W is a monitor with Type-C receptacle. The monitor responds to MODE DISCOVERY command with following DisplayPort Capability flag: dp->alt->vdo=0x140045 The existing logic only take cares of UPF_D plug case, and would take the bit 15:8 for this 0x140045 case. This results in an non-existing pin assignment 0x0 in dp_altmode_configure. To fix this problem a new set of macros are introduced to take plug/receptacle differences into consideration. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable@vger.kernel.org Co-developed-by: Pablo Sun Co-developed-by: Macpaul Lin Reviewed-by: Guillaume Ranquet Reviewed-by: Heikki Krogerus Signed-off-by: Pablo Sun Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20220804034803.19486-1-macpaul.lin@mediatek.com Signed-off-by: Greg Kroah-Hartman commit 7ec9fce4b31604f8415136a4c07f7dc8ad431aec Author: Eyal Birger Date: Thu Aug 18 10:41:18 2022 +0300 ip_tunnel: Respect tunnel key's "flow_flags" in IP tunnels Commit 451ef36bd229 ("ip_tunnels: Add new flow flags field to ip_tunnel_key") added a "flow_flags" member to struct ip_tunnel_key which was later used by the commit in the fixes tag to avoid dropping packets with sources that aren't locally configured when set in bpf_set_tunnel_key(). VXLAN and GENEVE were made to respect this flag, ip tunnels like IPIP and GRE were not. This commit fixes this omission by making ip_tunnel_init_flow() receive the flow flags from the tunnel key in the relevant collect_md paths. Fixes: b8fff748521c ("bpf: Set flow flag to allow any source IP in bpf_tunnel_key") Signed-off-by: Eyal Birger Signed-off-by: Daniel Borkmann Reviewed-by: Paul Chaignon Link: https://lore.kernel.org/bpf/20220818074118.726639-1-eyal.birger@gmail.com commit 1bcafc0498038a5a2ce5a9b888c39f1c32242cec Author: Matthias Kaehlcke Date: Fri Aug 5 11:19:31 2022 -0700 usb: misc: onboard_usb_hub: Drop reset delay in onboard_hub_power_off() onboard_hub_power_off() currently has a delay after asserting the reset of the hub. There is already a delay in onboard_hub_power_on() before de-asserting the reset, which ensures that the reset is asserted for the required time, so the delay in _power_off() is not needed. Skip the reset GPIO check before calling gpiod_set_value_cansleep(), the function returns early when the GPIO descriptor is NULL. Reviewed-By: Alexander Stein Reviewed-by: Douglas Anderson Signed-off-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20220805111836.1.Id5a4dc0a2c046236116693aa55672295513a0f2a@changeid Signed-off-by: Greg Kroah-Hartman commit 040f2dbd2010c43f33ad27249e6dac48456f4d99 Author: Wesley Cheng Date: Wed Jul 27 19:06:47 2022 -0700 usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop Relocate the pullups_connected check until after it is ensured that there are no runtime PM transitions. If another context triggered the DWC3 core's runtime resume, it may have already enabled the Run/Stop. Do not re-run the entire pullup sequence again, as it may issue a core soft reset while Run/Stop is already set. This patch depends on commit 69e131d1ac4e ("usb: dwc3: gadget: Prevent repeat pullup()") Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") Cc: stable Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20220728020647.9377-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit bad0d1d726ace2db9e0f39c62b173bc7cc43dd6a Author: Heikki Krogerus Date: Mon Aug 15 15:33:34 2022 +0300 usb: dwc3: pci: Add support for Intel Raptor Lake This adds the necessary PCI device ID for the controller inside the Intel Raptor Lake CPU block. The controllers that are part of the PCH (chipset) have separate device IDs. Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20220815123334.87526-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1b1b672cc1d4fb3065dac79efb8901bd6244ef69 Author: Utkarsh Patel Date: Tue Aug 16 13:16:24 2022 +0300 usb: typec: intel_pmc_mux: Add new ACPI ID for Meteor Lake IOM device This adds the necessary ACPI ID for Intel Meteor Lake IOM devices. The callback function is_memory() is modified so that it also checks if the resource descriptor passed to it is a memory type "Address Space Resource Descriptor". On Intel Meteor Lake the ACPI memory resource is not described using the "32-bit Memory Range Descriptor" because the memory is outside of the 32-bit address space. The memory resource is described using the "Address Space Resource Descriptor" instead. Intel Meteor Lake is the first platform to describe the memory resource for this device with Address Space Resource Descriptor, but it most likely will not be the last. Therefore the change to the is_memory() callback function is made generic. Signed-off-by: Utkarsh Patel Cc: stable@vger.kernel.org [ heikki: Rewrote the commit message. ] Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20220816101629.69054-2-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f4693b81ea3802d2c28c868e1639e580d0da2d1f Author: Sergei Antonov Date: Thu Aug 18 12:23:17 2022 +0300 net: moxa: MAC address reading, generating, validity checking This device does not remember its MAC address, so add a possibility to get it from the platform. If it fails, generate a random address. This will provide a MAC address early during boot without user space being involved. Also remove extra calls to is_valid_ether_addr(). Made after suggestions by Andrew Lunn: 1) Use eth_hw_addr_random() to assign a random MAC address during probe. 2) Remove is_valid_ether_addr() from moxart_mac_open() 3) Add a call to platform_get_ethdev_address() during probe 4) Remove is_valid_ether_addr() from moxart_set_mac_address(). The core does this v1 -> v2: Handle EPROBE_DEFER returned from platform_get_ethdev_address(). Move MAC reading code to the beginning of the probe function. Signed-off-by: Sergei Antonov Suggested-by: Andrew Lunn CC: Yang Yingliang CC: Pavel Skripkin CC: Guobin Huang CC: Yang Wei CC: Christophe JAILLET Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220818092317.529557-1-saproj@gmail.com Signed-off-by: Jakub Kicinski commit 267ef48e06ca3fa3a2e6381e7b20475265c2dfce Merge: 6faee3d4ee8be 2e23acd99efac Author: Jakub Kicinski Date: Thu Aug 18 11:04:58 2022 -0700 Merge branch 'tcp-some-bug-fixes-for-tcp_read_skb' Cong Wang says: ==================== tcp: some bug fixes for tcp_read_skb() This patchset contains 3 bug fixes and 1 minor refactor patch for tcp_read_skb(). V1 only had the first patch, as Eric prefers to fix all of them together, I have to group them together. ==================== Link: https://lore.kernel.org/r/20220817195445.151609-1-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski commit 2e23acd99efacfd2a63cb9725afbc65e4e964fb7 Author: Cong Wang Date: Wed Aug 17 12:54:45 2022 -0700 tcp: handle pure FIN case correctly When skb->len==0, the recv_actor() returns 0 too, but we also use 0 for error conditions. This patch amends this by propagating the errors to tcp_read_skb() so that we can distinguish skb->len==0 case from error cases. Fixes: 04919bed948d ("tcp: Introduce tcp_read_skb()") Reported-by: Eric Dumazet Cc: John Fastabend Cc: Jakub Sitnicki Signed-off-by: Cong Wang Signed-off-by: Jakub Kicinski commit a8688821f3854f37fe0198b8945f9cfc051ab2cf Author: Cong Wang Date: Wed Aug 17 12:54:44 2022 -0700 tcp: refactor tcp_read_skb() a bit As tcp_read_skb() only reads one skb at a time, the while loop is unnecessary, we can turn it into an if. This also simplifies the code logic. Cc: Eric Dumazet Cc: John Fastabend Cc: Jakub Sitnicki Signed-off-by: Cong Wang Signed-off-by: Jakub Kicinski commit c457985aaa92e1fda2ce837cabf90bf687b92dcb Author: Cong Wang Date: Wed Aug 17 12:54:43 2022 -0700 tcp: fix tcp_cleanup_rbuf() for tcp_read_skb() tcp_cleanup_rbuf() retrieves the skb from sk_receive_queue, it assumes the skb is not yet dequeued. This is no longer true for tcp_read_skb() case where we dequeue the skb first. Fix this by introducing a helper __tcp_cleanup_rbuf() which does not require any skb and calling it in tcp_read_skb(). Fixes: 04919bed948d ("tcp: Introduce tcp_read_skb()") Cc: Eric Dumazet Cc: John Fastabend Cc: Jakub Sitnicki Signed-off-by: Cong Wang Signed-off-by: Jakub Kicinski commit e9c6e79760265f019cde39d3f2c443dfbc1395b0 Author: Cong Wang Date: Wed Aug 17 12:54:42 2022 -0700 tcp: fix sock skb accounting in tcp_read_skb() Before commit 965b57b469a5 ("net: Introduce a new proto_ops ->read_skb()"), skb was not dequeued from receive queue hence when we close TCP socket skb can be just flushed synchronously. After this commit, we have to uncharge skb immediately after being dequeued, otherwise it is still charged in the original sock. And we still need to retain skb->sk, as eBPF programs may extract sock information from skb->sk. Therefore, we have to call skb_set_owner_sk_safe() here. Fixes: 965b57b469a5 ("net: Introduce a new proto_ops ->read_skb()") Reported-and-tested-by: syzbot+a0e6f8738b58f7654417@syzkaller.appspotmail.com Tested-by: Stanislav Fomichev Cc: Eric Dumazet Cc: John Fastabend Cc: Jakub Sitnicki Signed-off-by: Cong Wang Signed-off-by: Jakub Kicinski commit 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 Author: Lin Ma Date: Wed Aug 17 11:49:21 2022 -0700 igb: Add lock to avoid data race The commit c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()") places the unregister_netdev() call after the igb_disable_sriov() call to avoid functionality issue. However, it introduces several race conditions when detaching a device. For example, when .remove() is called, the below interleaving leads to use-after-free. (FREE from device detaching) | (USE from netdev core) igb_remove | igb_ndo_get_vf_config igb_disable_sriov | vf >= adapter->vfs_allocated_count? kfree(adapter->vf_data) | adapter->vfs_allocated_count = 0 | | memcpy(... adapter->vf_data[vf] Moreover, the igb_disable_sriov() also suffers from data race with the requests from VF driver. (FREE from device detaching) | (USE from requests) igb_remove | igb_msix_other igb_disable_sriov | igb_msg_task kfree(adapter->vf_data) | vf < adapter->vfs_allocated_count adapter->vfs_allocated_count = 0 | To this end, this commit first eliminates the data races from netdev core by using rtnl_lock (similar to commit 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink")). And then adds a spinlock to eliminate races from driver requests. (similar to commit 1e53834ce541 ("ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero") Fixes: c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()") Signed-off-by: Lin Ma Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220817184921.735244-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 138d186252ef707fbc5b1dc9d32435083f339271 Merge: 8aa48ade7db47 664d4646184ed Author: Jakub Kicinski Date: Thu Aug 18 11:02:11 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-08-17 (ice) This series contains updates to ice driver only. Grzegorz prevents modifications to VLAN 0 when setting VLAN promiscuous as it will already be set. He also ignores -EEXIST error when attempting to set promiscuous and ensures promiscuous mode is properly cleared from the hardware when being removed. Benjamin ignores additional -EEXIST errors when setting promiscuous mode since the existing mode is the desired mode. Sylwester fixes VFs to allow sending of tagged traffic when no VLAN filters exist. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix VF not able to send tagged traffic with no VLAN filters ice: Ignore error message when setting same promiscuous mode ice: Fix clearing of promisc mode with bridge over bond ice: Ignore EEXIST when setting promisc mode ice: Fix double VLAN error when entering promisc mode ==================== Link: https://lore.kernel.org/r/20220817171329.65285-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8aa48ade7db4738bcc57447dccbf21db6618f64e Author: Geert Uytterhoeven Date: Wed Aug 17 18:54:51 2022 +0200 dt-bindings: Fix incorrect "the the" corrections Lots of double occurrences of "the" were replaced by single occurrences, but some of them should become "to the" instead. Fixes: 12e5bde18d7f6ca4 ("dt-bindings: Fix typo in comment") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/c5743c0a1a24b3a8893797b52fed88b99e56b04b.1660755148.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit aece382251f8fa660d8f621a7f50b0ea0f390178 Author: Konrad Dybcio Date: Sat Jul 16 21:32:54 2022 +0200 dt-bindings: usb: qcom,dwc3: Add SM6375 compatible Add a compatible for DWC3 found on SM6375. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220716193257.456023-4-konrad.dybcio@somainline.org Signed-off-by: Greg Kroah-Hartman commit ac6928f83f8da73eee254606b45eacc6b743518a Author: Johan Hovold Date: Thu Aug 4 17:10:01 2022 +0200 usb: dwc3: qcom: clean up suspend callbacks Clean up the suspend callbacks by separating the error and success paths to improve readability. Also drop a related redundant initialisation. Reviewed-by: Matthias Kaehlcke Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-10-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit e3fafbd8e36530eb015a1bb31273bcf7f7035422 Author: Johan Hovold Date: Thu Aug 4 17:10:00 2022 +0200 usb: dwc3: qcom: fix wakeup implementation It is the Qualcomm glue wakeup interrupts that may be able to wake the system from suspend and this can now be described in the devicetree. Move the wakeup-source property handling over from the core driver and instead propagate the capability setting to the core device during probe. This is needed as there is currently no way for the core driver to query the wakeup setting of the glue device, but it is the core driver that manages the PHY power state during suspend. Also don't leave the PHYs enabled when system wakeup has been disabled through sysfs. Fixes: 649f5c842ba3 ("usb: dwc3: core: Host wake up support from system suspend") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-9-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 416b61893860d45484d4717599c828411cee9c7f Author: Johan Hovold Date: Thu Aug 4 17:09:59 2022 +0200 dt-bindings: usb: qcom,dwc3: add wakeup-source property Add a wakeup-source property to the binding to describe whether the wakeup interrupts can wake the system from suspend. Acked-by: Rob Herring Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-8-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit c5f14abeb52b0177b940fd734133d383da3521d8 Author: Johan Hovold Date: Thu Aug 4 17:09:58 2022 +0200 usb: dwc3: qcom: fix peripheral and OTG suspend A recent commit implementing wakeup support in host mode instead broke suspend for peripheral and OTG mode. The hack that was added in the suspend path to determine the speed of any device connected to the USB2 bus not only accesses internal driver data for a child device, but also dereferences a NULL pointer or accesses freed data when the controller is not acting as host. There's no quick fix to the layering violation, but since reverting would leave us with broken suspend in host mode with wakeup triggering immediately, let's keep the hack for now. Fix the immediate issues by only checking the host bus speed and enabling wakeup interrupts when acting as host. Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Reported-by: kernel test robot Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-7-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6498a96c8c9ce8ae4078e586a607851491e29a33 Author: Johan Hovold Date: Thu Aug 4 17:09:57 2022 +0200 usb: dwc3: qcom: fix runtime PM wakeup A device must enable wakeups during runtime suspend regardless of whether it is capable and allowed to wake the system up from system suspend. Fixes: 2664deb09306 ("usb: dwc3: qcom: Honor wakeup enabled/disabled state") Tested-by: Matthias Kaehlcke Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-6-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit a872ab303d5ddd4c965f9cd868677781a33ce35a Author: Johan Hovold Date: Thu Aug 4 17:09:56 2022 +0200 usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup The Qualcomm dwc3 runtime-PM implementation checks the xhci platform-device pointer in the wakeup-interrupt handler to determine whether the controller is in host mode and if so triggers a resume. After a role switch in OTG mode the xhci platform-device would have been freed and the next wakeup from runtime suspend would access the freed memory. Note that role switching is executed from a freezable workqueue, which guarantees that the pointer is stable during suspend. Also note that runtime PM has been broken since commit 2664deb09306 ("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which incidentally also prevents this issue from being triggered. Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Cc: stable@vger.kernel.org # 4.18 Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit c06795f114a6c4a423b11c9d9bbeb77ecbfbaa8b Author: Johan Hovold Date: Thu Aug 4 17:09:55 2022 +0200 usb: dwc3: qcom: fix gadget-only builds A recent change added a dependency to the USB host stack and broke gadget-only builds of the driver. Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Reported-by: Randy Dunlap Reviewed-by: Randy Dunlap Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 762e744922b566b47d15b195646440ca64257e91 Author: Johan Hovold Date: Thu Aug 4 17:09:54 2022 +0200 Revert "usb: dwc3: qcom: Keep power domain on to retain controller status" This reverts commit d9be8d5c5b032e5383ff5c404ff4155e9c705429. Generic power-domain flags must be set before the power-domain is initialised and must specifically not be modified by drivers for devices that happen to be in the domain. To make sure that USB power-domains are left enabled during system suspend when a device in the domain is in the wakeup path, the GENPD_FLAG_ACTIVE_WAKEUP flag should instead be set for the domain unconditionally when it is registered. Note that this also avoids keeping power-domains on during suspend when wakeup has not been enabled (e.g. through sysfs). For the runtime PM case, making sure that the PHYs are not suspended and that they are in the same domain as the controller prevents the domain from being suspended. If there are cases where this is not possible or desirable, the genpd implementation may need to be extended. Fixes: d9be8d5c5b03 ("usb: dwc3: qcom: Keep power domain on to retain controller status") Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit d2ac7bef95c9ead307801ccb6cb6dfbeb14247bf Author: Johan Hovold Date: Thu Aug 4 17:09:53 2022 +0200 usb: dwc3: fix PHY disable sequence Generic PHYs must be powered-off before they can be tore down. Similarly, suspending legacy PHYs after having powered them off makes no sense. Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded dwc3_probe() error-path sequences that got this wrong. Note that this makes dwc3_core_exit() match the dwc3_core_init() error path with respect to powering off the PHYs. Fixes: 03c1fd622f72 ("usb: dwc3: core: add phy cleanup for probe error handling") Fixes: c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths") Cc: stable@vger.kernel.org # 4.8 Reviewed-by: Andrew Halaney Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit cee7db1b0239468b22c295cf04a8c40c34ecd35a Author: Akira Yokosawa Date: Mon Aug 8 17:53:57 2022 +0900 docs: kerneldoc-preamble: Test xeCJK.sty before loading On distros whose texlive packaging is fine-grained, texlive-xecjk can be installed/removed independently of other texlive packages. Conditionally loading xeCJK depending only on the existence of the "Noto Sans CJK SC" font might end up in xelatex error of "xeCJK.sty not found!". Improve the situation by testing existence of xeCJK.sty before loading it. This is useful on RHEL 9 and its clone distros where texlive-xecjk doesn't work at the moment due to a missing dependency [1]. "make pdfdocs" for non-CJK contents should work after removing texlive-xecjk. Link: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2086254 Fixes: 398f7abdcb7e ("docs: pdfdocs: Pull LaTeX preamble part out of conf.py") Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Akira Yokosawa Acked-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/c24c2a87-70b2-5342-bcc9-de467940466e@gmail.com Signed-off-by: Jonathan Corbet commit c6a43fb3487f7e040170e60cdb9b030c669e9cf5 Author: Neil Armstrong Date: Tue Aug 16 11:56:17 2022 +0200 MAINTAINERS: Update email of Neil Armstrong My professional e-mail will change and the BayLibre one will bounce after mid-september of 2022. This updates the MAINTAINERS file, the YAML bindings and adds an entry in the .mailmap file. Signed-off-by: Neil Armstrong Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220816095617.948678-1-narmstrong@baylibre.com commit 249801360db3dec4f73768c502192020bfddeacc Author: Jakub Kicinski Date: Tue Aug 16 09:19:39 2022 -0700 net: genl: fix error path memory leak in policy dumping If construction of the array of policies fails when recording non-first policy we need to unwind. netlink_policy_dump_add_policy() itself also needs fixing as it currently gives up on error without recording the allocated pointer in the pstate pointer. Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping") Link: https://lore.kernel.org/r/20220816161939.577583-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5c23d6b717e4e956376f3852b90f58e262946b50 Author: Christophe JAILLET Date: Tue Aug 16 16:23:57 2022 +0200 stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() Commit 09f012e64e4b ("stmmac: intel: Fix clock handling on error and remove paths") removed this clk_disable_unprepare() This was partly revert by commit ac322f86b56c ("net: stmmac: Fix clock handling on remove path") which removed this clk_disable_unprepare() because: " While unloading the dwmac-intel driver, clk_disable_unprepare() is being called twice in stmmac_dvr_remove() and intel_eth_pci_remove(). This causes kernel panic on the second call. " However later on, commit 5ec55823438e8 ("net: stmmac: add clocks management for gmac driver") has updated stmmac_dvr_remove() which do not call clk_disable_unprepare() anymore. So this call should now be called from intel_eth_pci_remove(). Fixes: 5ec55823438e8 ("net: stmmac: add clocks management for gmac driver") Signed-off-by: Christophe JAILLET Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/d7c8c1dadf40df3a7c9e643f76ffadd0ccc1ad1b.1660659689.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 573ae4f13f630d6660008f1974c0a8a29c30e18a Author: Jens Wiklander Date: Thu Aug 18 13:08:59 2022 +0200 tee: add overflow check in register_shm_helper() With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region. This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Modules linked in: CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pc : internal_get_user_pages_fast+0x474/0xa80 Call trace: internal_get_user_pages_fast+0x474/0xa80 pin_user_pages_fast+0x24/0x4c register_shm_helper+0x194/0x330 tee_shm_register_user_buf+0x78/0x120 tee_ioctl+0xd0/0x11a0 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114 Fix this by adding an an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early. Fixes: 033ddf12bcf5 ("tee: add register user memory") Cc: stable@vger.kernel.org Reported-by: Nimish Mishra Reported-by: Anirban Chakraborty Reported-by: Debdeep Mukhopadhyay Suggested-by: Jerome Forissier Signed-off-by: Jens Wiklander Signed-off-by: Linus Torvalds commit 57646d6769f13f9484ffc6869c493e25a6568073 Merge: 568035b01cfb1 a9084d888fbaa Author: Thomas Gleixner Date: Thu Aug 18 17:37:22 2022 +0200 Merge tag 'irqchip-fixes-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - A bunch of small fixes for the recently merged LoongArch drivers - A leftover from the non-SMP IRQ affinity rework affecting the Hyper-V IOMMU code Link: https://lore.kernel.org/r/20220812125910.2227338-1-maz@kernel.org commit 2aa48857ad52236a9564c71183d6cc8893becd41 Author: Witold Lipieta Date: Tue Aug 9 13:29:11 2022 +0200 usb-storage: Add ignore-residue quirk for NXP PN7462AU This is USB mass storage primary boot loader for code download on NXP PN7462AU. Without the quirk it is impossible to write whole memory at once as device restarts during the write due to bogus residue values reported. Acked-by: Alan Stern Cc: stable Signed-off-by: Witold Lipieta Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thaumatec.com Signed-off-by: Greg Kroah-Hartman commit 258e483a4d5e97a6a8caa74381ddc1f395ac1c71 Author: Maxime Ripard Date: Wed Jun 29 14:34:37 2022 +0200 drm/vc4: hdmi: Rework power up The current code tries to handle the case where CONFIG_PM isn't selected by first calling our runtime_resume implementation and then properly report the power state to the runtime_pm core. This allows to have a functionning device even if pm_runtime_get_* functions are nops. However, the device power state if CONFIG_PM is enabled is RPM_SUSPENDED, and thus our vc4_hdmi_write() and vc4_hdmi_read() calls in the runtime_pm hooks will now report a warning since the device might not be properly powered. Even more so, we need CONFIG_PM enabled since the previous RaspberryPi have a power domain that needs to be powered up for the HDMI controller to be usable. The previous patch has created a dependency on CONFIG_PM, now we can just assume it's there and only call pm_runtime_resume_and_get() to make sure our device is powered in bind. Link: https://lore.kernel.org/r/20220629123510.1915022-39-maxime@cerno.tech Acked-by: Thomas Zimmermann Tested-by: Stefan Wahren Signed-off-by: Maxime Ripard (cherry picked from commit 53565c28e6af2cef6bbf438c34250135e3564459) Signed-off-by: Maxime Ripard commit 72e2329e7c9bbe15e7a813670497ec9c6f919af3 Author: Maxime Ripard Date: Wed Jun 29 14:34:36 2022 +0200 drm/vc4: hdmi: Depends on CONFIG_PM We already depend on runtime PM to get the power domains and clocks for most of the devices supported by the vc4 driver, so let's just select it to make sure it's there. Link: https://lore.kernel.org/r/20220629123510.1915022-38-maxime@cerno.tech Acked-by: Thomas Zimmermann Tested-by: Stefan Wahren Signed-off-by: Maxime Ripard (cherry picked from commit f1bc386b319e93e56453ae27e9e83817bb1f6f95) Signed-off-by: Maxime Ripard commit f2d38edc5e3375e56b4a30d5b66cefd385a2b38c Author: Badhri Jagan Sridharan Date: Wed Aug 17 14:54:10 2022 -0700 usb: typec: tcpm: Return ENOTSUPP for power supply prop writes When the port does not support USB PD, prevent transition to PD only states when power supply property is written. In this case, TCPM transitions to SNK_NEGOTIATE_CAPABILITIES which should not be the case given that the port is not pd_capable. [ 84.308251] state change SNK_READY -> SNK_NEGOTIATE_CAPABILITIES [rev3 NONE_AMS] [ 84.308335] Setting usb_comm capable false [ 84.323367] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:5000 ret:0 [ 84.323376] state change SNK_NEGOTIATE_CAPABILITIES -> SNK_WAIT_CAPABILITIES [rev3 NONE_AMS] Fixes: e9e6e164ed8f6 ("usb: typec: tcpm: Support non-PD mode") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Signed-off-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20220817215410.1807477-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit b5a5b9d5f28d23b84f06b45c61dcad95b07d41bc Author: Mauro Carvalho Chehab Date: Thu Aug 18 15:38:58 2022 +0200 serial: document start_rx member at struct uart_ops Fix this doc build warning: ./include/linux/serial_core.h:397: warning: Function parameter or member 'start_rx' not described in 'uart_ops' Signed-off-by: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/5d07ae2eec8fbad87e623160f9926b178bef2744.1660829433.git.mchehab@kernel.org Signed-off-by: Greg Kroah-Hartman commit a3f2fd22743fc56dd5e3896a3fbddd276df1577f Author: Arnd Bergmann Date: Thu Aug 18 15:57:20 2022 +0200 musb: fix USB_MUSB_TUSB6010 dependency Turning on NOP_USB_XCEIV as builtin broke the TUSB6010 driver because of an older issue with the depencency. It is not necessary to forbid NOP_USB_XCEIV=y in combination with USB_MUSB_HDRC=m, but only the reverse, which causes the link failure from the original Kconfig change. Use the correct dependency to still allow NOP_USB_XCEIV=n or NOP_USB_XCEIV=y but forbid NOP_USB_XCEIV=m when USB_MUSB_HDRC=m to fix the multi_v7_defconfig for tusb. Fixes: ab37a7a890c1 ("ARM: multi_v7_defconfig: Make NOP_USB_XCEIV driver built-in") Fixes: c0442479652b ("usb: musb: Fix randconfig build issues for Kconfig options") Cc: stable Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20220818135737.3143895-10-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit d6f35446d0769a98e9d761593d267cdd24f09ecd Author: Liam Howlett Date: Wed Aug 10 16:02:25 2022 +0000 binder_alloc: Add missing mmap_lock calls when using the VMA Take the mmap_read_lock() when using the VMA in binder_alloc_print_pages() and when checking for a VMA in binder_alloc_new_buf_locked(). It is worth noting binder_alloc_new_buf_locked() drops the VMA read lock after it verifies a VMA exists, but may be taken again deeper in the call stack, if necessary. Fixes: a43cfc87caaf (android: binder: stop saving a pointer to the VMA) Cc: stable Reported-by: Ondrej Mosnacek Reported-by: syzbot+a7b60a176ec13cafb793@syzkaller.appspotmail.com Tested-by: Ondrej Mosnacek Acked-by: Carlos Llamas Signed-off-by: Liam R. Howlett Link: https://lore.kernel.org/r/20220810160209.1630707-1-Liam.Howlett@oracle.com Signed-off-by: Greg Kroah-Hartman commit a0e44c64b6061dda7e00b7c458e4523e2331b739 Author: Carlos Llamas Date: Mon Aug 1 18:25:11 2022 +0000 binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Acked-by: Christian Brauner (Microsoft) Signed-off-by: Carlos Llamas Cc: stable # 4.14+ Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit f5723cfc01932c7a8d5c78dbf7e067e537c91439 Author: Cristian Ciocaltea Date: Thu Aug 18 13:48:51 2022 +0300 regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which could cause undefined behaviour, e.g. data corruption. Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/padding as set in the regmap configuration. Fixes: f231ff38b7b2 ("regmap: spi: Set regmap max raw r/w from max_transfer_size") Signed-off-by: Cristian Ciocaltea Reviewed-by: Lucas Tanure Link: https://lore.kernel.org/r/20220818104851.429479-1-cristian.ciocaltea@collabora.com Signed-off-by: Mark Brown commit ecdb10df7e0d83bfd12fb8f71e28ea4753e3716a Author: Yang Yingliang Date: Thu Aug 18 16:17:51 2022 +0800 ASoC: SOF: ipc4-topology: fix wrong use of sizeof in sof_ipc4_widget_setup_comp_src() It should be size of the struct sof_ipc4_src, not data pointer pass to sof_update_ipc_object(). Fixes: b85f4fc40d56 ("ASoC: SOF: add ipc4 SRC module support") Signed-off-by: Yang Yingliang Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20220818081751.2407066-1-yangyingliang@huawei.com Signed-off-by: Mark Brown commit d3b38596875dbc709b4e721a5873f4663d8a9ea2 Author: Yufen Yu Date: Wed Aug 3 10:33:55 2022 +0800 blk-mq: run queue no matter whether the request is the last request We do test on a virtio scsi device (/dev/sda) and the default mq scheduler is 'none'. We found a IO hung as following: blk_finish_plug blk_mq_plug_issue_direct scsi_mq_get_budget //get budget_token fail and sdev->restarts=1 scsi_end_request scsi_run_queue_async //sdev->restart=0 and run queue blk_mq_request_bypass_insert //add request to hctx->dispatch list //continue to dispath plug list blk_mq_dispatch_plug_list blk_mq_try_issue_list_directly //success issue all requests from plug list After .get_budget fail, scsi_mq_get_budget will increase 'restarts'. Normally, it will run hw queue when io complete and set 'restarts' as 0. But if we run queue before adding request to the dispatch list and blk_mq_dispatch_plug_list also success issue all requests, then on one will run queue, and the request will be stall in the dispatch list and cannot complete forever. It is wrong to use last request of plug list to decide if run queue is needed since all the remained requests in plug list may be from other hctxs. To fix the bug, pass run_queue as true always to blk_mq_request_bypass_insert(). Fix-suggested-by: Ming Lei Signed-off-by: Yufen Yu Reviewed-by: Ming Lei Fixes: dc5fc361d891 ("block: attempt direct issue of plug list") Link: https://lore.kernel.org/r/20220803023355.3687360-1-yuyufen@huaweicloud.com Signed-off-by: Jens Axboe commit a8239f0342bae5a51acca967ba95b9a8ad56dd62 Author: Yu Kuai Date: Thu Aug 18 14:35:55 2022 +0800 blk-mq: remove unused function blk_mq_queue_stopped() blk_mq_queue_stopped() doesn't have any caller, which was found by code coverage test, thus remove it. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20220818063555.3741222-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 7df548840c496b0141fb2404b889c346380c2b22 Author: Pawan Gupta Date: Wed Aug 3 14:41:32 2022 -0700 x86/bugs: Add "unknown" reporting for MMIO Stale Data Older Intel CPUs that are not in the affected processor list for MMIO Stale Data vulnerabilities currently report "Not affected" in sysfs, which may not be correct. Vulnerability status for these older CPUs is unknown. Add known-not-affected CPUs to the whitelist. Report "unknown" mitigation status for CPUs that are not in blacklist, whitelist and also don't enumerate MSR ARCH_CAPABILITIES bits that reflect hardware immunity to MMIO Stale Data vulnerabilities. Mitigation is not deployed when the status is unknown. [ bp: Massage, fixup. ] Fixes: 8d50cdf8b834 ("x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data") Suggested-by: Andrew Cooper Suggested-by: Tony Luck Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/a932c154772f2121794a5f2eded1a11013114711.1657846269.git.pawan.kumar.gupta@linux.intel.com commit 3f743e9bbb8fe20f4c477e4bf6341c4187a4a264 Author: Pavel Begunkov Date: Thu Aug 18 12:38:34 2022 +0100 io_uring/net: use right helpers for async_data There is another spot where we check ->async_data directly instead of using req_has_async_data(), which is the way to do it, fix it up. Fixes: 43e0bbbd0b0e3 ("io_uring: add netmsg cache") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/42f33b9a81dd6ae65dda92f0372b0ff82d548517.1660822636.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 93a3c0d4e8bfbb15145e5dd7da68a3de4b904aba Author: Mika Westerberg Date: Tue Jun 14 18:53:59 2022 +0300 thunderbolt: Check router generation before connecting xHCI Only Thunderbolt 3 routers need the xHCI connection flow. This also ensures the router actually has both lane adapters (1 and 3). While there move declaration of the boolean variables inside the block where they are being used. Fixes: 30a4eca69b76 ("thunderbolt: Add internal xHCI connect flows for Thunderbolt 3 devices") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit eb100b8fa8e8b59eb3e5fc7a5fd4a1e3c5950f64 Author: Mika Westerberg Date: Fri Apr 29 17:10:17 2022 +0300 thunderbolt: Use the actual buffer in tb_async_error() The received notification packet is held in pkg->buffer and not in pkg itself. Fix this by using the correct buffer. Fixes: 81a54b5e1986 ("thunderbolt: Let the connection manager handle all notifications") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit 41191cf6bf565f4139046d7be68ec30c290af92d Author: Stefan Roesch Date: Tue Aug 16 08:31:58 2022 -0700 fs: __file_remove_privs(): restore call to inode_has_no_xattr() This restores the call to inode_has_no_xattr() in the function __file_remove_privs(). In case the dentry_meeds_remove_privs() returned 0, the function inode_has_no_xattr() was not called. Signed-off-by: Stefan Roesch Fixes: faf99b563558 ("fs: add __remove_file_privs() with flags parameter") Reviewed-by: Christian Brauner (Microsoft) Link: https://lore.kernel.org/r/20220816153158.1925040-1-shr@fb.com Signed-off-by: Christian Brauner (Microsoft) commit a617ccc01608c3f422c65da1b6c7a31057f46f62 Author: Lorenzo Bianconi Date: Tue Aug 16 16:16:15 2022 +0200 net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_xdp_run Fix possible NULL pointer dereference in mtk_xdp_run() if the ebpf program returns XDP_TX and xdp_convert_buff_to_frame routine fails returning NULL. Fixes: 5886d26fd25bb ("net: ethernet: mtk_eth_soc: add xmit XDP support") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/627a07d759020356b64473e09f0855960e02db28.1660659112.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit d515f38c1e6dac42db145a778bd87a241f89590c Author: Leon Romanovsky Date: Tue Aug 16 11:47:23 2022 +0300 net/mlx5e: Allocate flow steering storage during uplink initialization IPsec code relies on valid priv->fs pointer that is the case in NIC flow, but not correct in uplink. Before commit that mentioned in the Fixes line, that pointer was valid in all flows as it was allocated together with priv struct. In addition, the cleanup representors routine called to that not-initialized priv->fs pointer and its internals which caused NULL deference. So, move FS allocation to be as early as possible. Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/ae46fa5bed3c67f937bfdfc0370101278f5422f1.1660639564.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit 5b6a07297bdca1701dc983bf084d6c0b2569ff18 Merge: 211987f3ac734 e780e3193e889 Author: Jakub Kicinski Date: Wed Aug 17 21:58:48 2022 -0700 Merge branch 'fixes-for-ocelot-driver-statistics' Vladimir Oltean says: ==================== Fixes for Ocelot driver statistics This series contains bug fixes for the ocelot drivers (both switchdev and DSA). Some concern the counters exposed to ethtool -S, and others to the counters exposed to ifconfig. I'm aware that the changes are fairly large, but I wanted to prioritize on a proper approach to addressing the issues rather than a quick hack. Some of the noticed problems: - bad register offsets for some counters - unhandled concurrency leading to corrupted counters - unhandled 32-bit wraparound of ifconfig counters The issues on the ocelot switchdev driver were noticed through code inspection, I do not have the hardware to test. This patch set necessarily converts ocelot->stats_lock from a mutex to a spinlock. I know this affects Colin Foster's development with the SPI controlled VSC7512. I have other changes prepared for net-next that convert this back into a mutex (along with other changes in this area). ==================== Link: https://lore.kernel.org/r/20220816135352.1431497-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e780e3193e889fd8358b862f7cd18ec5a4901caf Author: Vladimir Oltean Date: Tue Aug 16 16:53:52 2022 +0300 net: mscc: ocelot: report ndo_get_stats64 from the wraparound-resistant ocelot->stats Rather than reading the stats64 counters directly from the 32-bit hardware, it's better to rely on the output produced by the periodic ocelot_port_update_stats(). It would be even better to call ocelot_port_update_stats() right from ocelot_get_stats64() to make sure we report the current values rather than the ones from 2 seconds ago. But we need to export ocelot_port_update_stats() from the switch lib towards the switchdev driver for that, and future work will largely undo that. There are more ocelot-based drivers waiting to be introduced, an example of which is the SPI-controlled VSC7512. In that driver's case, it will be impossible to call ocelot_port_update_stats() from ndo_get_stats64 context, since the latter is atomic, and reading the stats over SPI is sleepable. So the compromise taken here, which will also hold going forward, is to report 64-bit counters to stats64, which are not 100% up to date. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit d4c367650704de091d4c1f6bb379c0a5c389c73a Author: Vladimir Oltean Date: Tue Aug 16 16:53:51 2022 +0300 net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset With so many counter addresses recently discovered as being wrong, it is desirable to at least have a central database of information, rather than two: one through the SYS_COUNT_* registers (used for ndo_get_stats64), and the other through the offset field of struct ocelot_stat_layout elements (used for ethtool -S). The strategy will be to keep the SYS_COUNT_* definitions as the single source of truth, but for that we need to expand our current definitions to cover all registers. Then we need to convert the ocelot region creation logic, and stats worker, to the read semantics imposed by going through SYS_COUNT_* absolute register addresses, rather than offsets of 32-bit words relative to SYS_COUNT_RX_OCTETS (which should have been SYS_CNT, by the way). Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 9190460084ddd0e9235f55eab0fdd5456b5f2fd5 Author: Vladimir Oltean Date: Tue Aug 16 16:53:50 2022 +0300 net: mscc: ocelot: make struct ocelot_stat_layout array indexable The ocelot counters are 32-bit and require periodic reading, every 2 seconds, by ocelot_port_update_stats(), so that wraparounds are detected. Currently, the counters reported by ocelot_get_stats64() come from the 32-bit hardware counters directly, rather than from the 64-bit accumulated ocelot->stats, and this is a problem for their integrity. The strategy is to make ocelot_get_stats64() able to cherry-pick individual stats from ocelot->stats the way in which it currently reads them out from SYS_COUNT_* registers. But currently it can't, because ocelot->stats is an opaque u64 array that's used only to feed data into ethtool -S. To solve that problem, we need to make ocelot->stats indexable, and associate each element with an element of struct ocelot_stat_layout used by ethtool -S. This makes ocelot_stat_layout a fat (and possibly sparse) array, so we need to change the way in which we access it. We no longer need OCELOT_STAT_END as a sentinel, because we know the array's size (OCELOT_NUM_STATS). We just need to skip the array elements that were left unpopulated for the switch revision (ocelot, felix, seville). Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 18d8e67df184081bc6ce6220a2dd965cfd3d7e6b Author: Vladimir Oltean Date: Tue Aug 16 16:53:49 2022 +0300 net: mscc: ocelot: fix race between ndo_get_stats64 and ocelot_check_stats_work The 2 methods can run concurrently, and one will change the window of counters (SYS_STAT_CFG_STAT_VIEW) that the other sees. The fix is similar to what commit 7fbf6795d127 ("net: mscc: ocelot: fix mutex lock error during ethtool stats read") has done for ethtool -S. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 22d842e3efe56402c33b5e6e303bb71ce9bf9334 Author: Vladimir Oltean Date: Tue Aug 16 16:53:48 2022 +0300 net: mscc: ocelot: turn stats_lock into a spinlock ocelot_get_stats64() currently runs unlocked and therefore may collide with ocelot_port_update_stats() which indirectly accesses the same counters. However, ocelot_get_stats64() runs in atomic context, and we cannot simply take the sleepable ocelot->stats_lock mutex. We need to convert it to an atomic spinlock first. Do that as a preparatory change. Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 173ca86618d751bd183456c9cdbb69952ba283c8 Author: Vladimir Oltean Date: Tue Aug 16 16:53:47 2022 +0300 net: mscc: ocelot: fix address of SYS_COUNT_TX_AGING counter This register, used as part of stats->tx_dropped in ocelot_get_stats64(), has a wrong address. At the address currently given, there is actually the c_tx_green_prio_6 counter. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 5152de7b79ab0be150f5966481b0c8f996192531 Author: Vladimir Oltean Date: Tue Aug 16 16:53:46 2022 +0300 net: mscc: ocelot: fix incorrect ndo_get_stats64 packet counters Reading stats using the SYS_COUNT_* register definitions is only used by ocelot_get_stats64() from the ocelot switchdev driver, however, currently the bucket definitions are incorrect. Separately, on both RX and TX, we have the following problems: - a 256-1023 bucket which actually tracks the 256-511 packets - the 1024-1526 bucket actually tracks the 512-1023 packets - the 1527-max bucket actually tracks the 1024-1526 packets => nobody tracks the packets from the real 1527-max bucket Additionally, the RX_PAUSE, RX_CONTROL, RX_LONGS and RX_CLASSIFIED_DROPS all track the wrong thing. However this doesn't seem to have any consequence, since ocelot_get_stats64() doesn't use these. Even though this problem only manifests itself for the switchdev driver, we cannot split the fix for ocelot and for DSA, since it requires fixing the bucket definitions from enum ocelot_reg, which makes us necessarily adapt the structures from felix and seville as well. Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch") Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 40d21c4565bce064c73a03b79a157a3493c518b9 Author: Vladimir Oltean Date: Tue Aug 16 16:53:45 2022 +0300 net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters What the driver actually reports as 256-511 is in fact 512-1023, and the TX packets in the 256-511 bucket are not reported. Fix that. Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 211987f3ac734000ea1548784b2a4539a974fbc8 Author: Vladimir Oltean Date: Tue Aug 16 23:14:45 2022 +0300 net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it ds->ops->port_stp_state_set() is, like most DSA methods, optional, and if absent, the port is supposed to remain in the forwarding state (as standalone). Such is the case with the mv88e6060 driver, which does not offload the bridge layer. DSA warns that the STP state can't be changed to FORWARDING as part of dsa_port_enable_rt(), when in fact it should not. The error message is also not up to modern standards, so take the opportunity to make it more descriptive. Fixes: fd3645413197 ("net: dsa: change scope of STP state setter") Reported-by: Sergei Antonov Signed-off-by: Vladimir Oltean Reviewed-by: Sergei Antonov Link: https://lore.kernel.org/r/20220816201445.1809483-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit fd8e899cdb5ecaf8e8ee73854a99e10807eef1de Author: Rustam Subkhankulov Date: Wed Aug 17 03:38:45 2022 +0300 net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() If an error occurs in dsa_devlink_region_create(), then 'priv->regions' array will be accessed by negative index '-1'. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rustam Subkhankulov Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region") Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru Signed-off-by: Jakub Kicinski commit 400d0ad63b190895e29f43bc75b1260111d3fd34 Author: Enzo Matsumiya Date: Wed Aug 17 16:08:34 2022 -0300 cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() SMB2_ioctl() is always called with is_fsctl = true, so doesn't make any sense to have it at all. Thus, always set SMB2_0_IOCTL_IS_FSCTL flag on the request. Also, as per MS-SMB2 3.3.5.15 "Receiving an SMB2 IOCTL Request", servers must fail the request if the request flags is zero anyway. Signed-off-by: Enzo Matsumiya Reviewed-by: Tom Talpey Signed-off-by: Steve French commit bec13ba9cef01cd37084d57608e7fa3d5a0b96d7 Merge: fc4aaf9fb3c99 c8550b9077d27 Author: Jakub Kicinski Date: Wed Aug 17 20:17:44 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: conntrack and nf_tables bug fixes The following patchset contains netfilter fixes for net. Broken since 5.19: A few ancient connection tracking helpers assume TCP packets cannot exceed 64kb in size, but this isn't the case anymore with 5.19 when BIG TCP got merged, from myself. Regressions since 5.19: 1. 'conntrack -E expect' won't display anything because nfnetlink failed to enable events for expectations, only for normal conntrack events. 2. partially revert change that added resched calls to a function that can be in atomic context. Both broken and fixed up by myself. Broken for several releases (up to original merge of nf_tables): Several fixes for nf_tables control plane, from Pablo. This fixes up resource leaks in error paths and adds more sanity checks for mutually exclusive attributes/flags. Kconfig: NF_CONNTRACK_PROCFS is very old and doesn't provide all info provided via ctnetlink, so it should not default to y. From Geert Uytterhoeven. Selftests: rework nft_flowtable.sh: it frequently indicated failure; the way it tried to detect an offload failure did not work reliably. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: testing: selftests: nft_flowtable.sh: rework test to detect offload failure testing: selftests: nft_flowtable.sh: use random netns names netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nfnetlink: re-enable conntrack expectation events netfilter: nf_tables: fix scheduling-while-atomic splat netfilter: nf_ct_irc: cap packet search space to 4k netfilter: nf_ct_ftp: prefer skb_linearize netfilter: nf_ct_h323: cap packet size at 64k netfilter: nf_ct_sane: remove pseudo skb linearization netfilter: nf_tables: possible module reference underflow in error path netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag netfilter: nf_tables: use READ_ONCE and WRITE_ONCE for shared generation id access ==================== Link: https://lore.kernel.org/r/20220817140015.25843-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit fc4aaf9fb3c99bcb326d52f9d320ed5680bd1cee Author: David Howells Date: Tue Aug 16 10:34:40 2022 +0100 net: Fix suspicious RCU usage in bpf_sk_reuseport_detach() bpf_sk_reuseport_detach() calls __rcu_dereference_sk_user_data_with_flags() to obtain the value of sk->sk_user_data, but that function is only usable if the RCU read lock is held, and neither that function nor any of its callers hold it. Fix this by adding a new helper, __locked_read_sk_user_data_with_flags() that checks to see if sk->sk_callback_lock() is held and use that here instead. Alternatively, making __rcu_dereference_sk_user_data_with_flags() use rcu_dereference_checked() might suffice. Without this, the following warning can be occasionally observed: ============================= WARNING: suspicious RCU usage 6.0.0-rc1-build2+ #563 Not tainted ----------------------------- include/net/sock.h:592 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 5 locks held by locktest/29873: #0: ffff88812734b550 (&sb->s_type->i_mutex_key#9){+.+.}-{3:3}, at: __sock_release+0x77/0x121 #1: ffff88812f5621b0 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_close+0x1c/0x70 #2: ffff88810312f5c8 (&h->lhash2[i].lock){+.+.}-{2:2}, at: inet_unhash+0x76/0x1c0 #3: ffffffff83768bb8 (reuseport_lock){+...}-{2:2}, at: reuseport_detach_sock+0x18/0xdd #4: ffff88812f562438 (clock-AF_INET){++..}-{2:2}, at: bpf_sk_reuseport_detach+0x24/0xa4 stack backtrace: CPU: 1 PID: 29873 Comm: locktest Not tainted 6.0.0-rc1-build2+ #563 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: dump_stack_lvl+0x4c/0x5f bpf_sk_reuseport_detach+0x6d/0xa4 reuseport_detach_sock+0x75/0xdd inet_unhash+0xa5/0x1c0 tcp_set_state+0x169/0x20f ? lockdep_sock_is_held+0x3a/0x3a ? __lock_release.isra.0+0x13e/0x220 ? reacquire_held_locks+0x1bb/0x1bb ? hlock_class+0x31/0x96 ? mark_lock+0x9e/0x1af __tcp_close+0x50/0x4b6 tcp_close+0x28/0x70 inet_release+0x8e/0xa7 __sock_release+0x95/0x121 sock_close+0x14/0x17 __fput+0x20f/0x36a task_work_run+0xa3/0xcc exit_to_user_mode_prepare+0x9c/0x14d syscall_exit_to_user_mode+0x18/0x44 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: cf8c1e967224 ("net: refactor bpf_sk_reuseport_detach()") Signed-off-by: David Howells cc: Hawkins Jiawei Link: https://lore.kernel.org/r/166064248071.3502205.10036394558814861778.stgit@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 68ed14496b032b0c9ef21b38ee45c6c8f3a18ff1 Author: Enzo Matsumiya Date: Wed Aug 17 14:14:02 2022 -0300 cifs: remove unused server parameter from calc_smb_size() This parameter is unused by the called function Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 2ae6ab9d82cdd0f7381639ee31e31de45519df4c Merge: 8ae4be56dd0c2 82a1356a933d8 Author: Dave Airlie Date: Thu Aug 18 08:51:04 2022 +1000 Merge tag 'drm-misc-fixes-2022-08-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes One patch for imx/dcss to get rid of a warning message, one off-by-one fix and GA103 support for nouveau, a refcounting fix for meson, a NULL pointer dereference fix for ttm, a error check fix for lvds-codec, a dt-binding schema fix and an underflow fix for sun4i Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20220816094401.wtadc7ddr6lzq6aj@houat commit 8ae4be56dd0c2b851e7edc0f1d5cd441f88481c0 Merge: 568035b01cfb1 9d50bff40e3e3 Author: Dave Airlie Date: Thu Aug 18 08:45:45 2022 +1000 Merge tag 'drm-intel-next-fixes-2022-08-11' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - disable pci resize on 32-bit systems (Nirmoy) - don't leak the ccs state (Matt) - TLB invalidation fixes (Chris) [now with all fixes of fixes] Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/YvVumNCga+90fYN0@intel.com commit 14b20b784f59bdd95f6f1cfb112c9818bcec4d84 Author: YiFei Zhu Date: Tue Aug 16 20:55:16 2022 +0000 bpf: Restrict bpf_sys_bpf to CAP_PERFMON The verifier cannot perform sufficient validation of any pointers passed into bpf_attr and treats them as integers rather than pointers. The helper will then read from arbitrary pointers passed into it. Restrict the helper to CAP_PERFMON since the security model in BPF of arbitrary kernel read is CAP_BPF + CAP_PERFMON. Fixes: af2ac3e13e45 ("bpf: Prepare bpf syscall to be used from kernel and user space.") Signed-off-by: YiFei Zhu Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20220816205517.682470-1-zhuyifei@google.com commit 3b06a2755758937add738545ba4a544fc5a1c56d Merge: ae2a823643d71 d4073595d0c61 Author: Linus Torvalds Date: Wed Aug 17 14:51:22 2022 -0700 Merge tag 'ntfs3_for_6.0' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: - implement FALLOC_FL_INSERT_RANGE - fix some logic errors - fixed xfstests (tested on x86_64): generic/064 generic/213 generic/300 generic/361 generic/449 generic/485 - some dead code removed or refactored * tag 'ntfs3_for_6.0' of https://github.com/Paragon-Software-Group/linux-ntfs3: (39 commits) fs/ntfs3: uninitialized variable in ntfs_set_acl_ex() fs/ntfs3: Remove unused function wnd_bits fs/ntfs3: Make ni_ins_new_attr return error fs/ntfs3: Create MFT zone only if length is large enough fs/ntfs3: Refactoring attr_insert_range to restore after errors fs/ntfs3: Refactoring attr_punch_hole to restore after errors fs/ntfs3: Refactoring attr_set_size to restore after errors fs/ntfs3: New function ntfs_bad_inode fs/ntfs3: Make MFT zone less fragmented fs/ntfs3: Check possible errors in run_pack in advance fs/ntfs3: Added comments to frecord functions fs/ntfs3: Fill duplicate info in ni_add_name fs/ntfs3: Make static function attr_load_runs fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free fs/ntfs3: Remove unused mi_mark_free fs/ntfs3: Fix very fragmented case in attr_punch_hole fs/ntfs3: Fix work with fragmented xattr fs/ntfs3: Make ntfs_fallocate return -ENOSPC instead of -EFBIG fs/ntfs3: extend ni_insert_nonresident to return inserted ATTR_LIST_ENTRY fs/ntfs3: Check reserved size for maximum allowed ... commit 3024d95a4c521c278a7504ee9e80c57c3a9750e0 Author: Daniel Borkmann Date: Wed Aug 17 23:32:09 2022 +0200 bpf: Partially revert flexible-array member replacement Partially revert 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") given it breaks BPF UAPI. For example, BPF CI run reveals build breakage under LLVM: [...] CLNG-BPF [test_maps] map_ptr_kern.o CLNG-BPF [test_maps] btf__core_reloc_arrays___diff_arr_val_sz.o CLNG-BPF [test_maps] test_bpf_cookie.o progs/map_ptr_kern.c:314:26: error: field 'trie_key' with variable sized type 'struct bpf_lpm_trie_key' not at the end of a struct or class is a GNU extension [-Werror,-Wgnu-variable-sized-type-not-at-end] struct bpf_lpm_trie_key trie_key; ^ CLNG-BPF [test_maps] btf__core_reloc_type_based___diff.o 1 error generated. make: *** [Makefile:521: /tmp/runner/work/bpf/bpf/tools/testing/selftests/bpf/map_ptr_kern.o] Error 1 make: *** Waiting for unfinished jobs.... [...] Typical usage of the bpf_lpm_trie_key is that the struct gets embedded into a user defined key for the LPM BPF map, from the selftest example: struct bpf_lpm_trie_key { <-- UAPI exported struct __u32 prefixlen; __u8 data[]; }; struct lpm_key { <-- BPF program defined struct struct bpf_lpm_trie_key trie_key; __u32 data; }; Undo this for BPF until a different solution can be found. It's the only flexible- array member case in the UAPI header. This was discovered in BPF CI after Dave reported that the include/uapi/linux/bpf.h header was out of sync with tools/include/uapi/linux/bpf.h after 94dfc73e7cf4. And the subsequent sync attempt failed CI. Fixes: 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") Reported-by: Dave Marchevsky Signed-off-by: Daniel Borkmann Cc: Gustavo A. R. Silva Link: https://lore.kernel.org/bpf/22aebc88-da67-f086-e620-dd4a16e2bc69@iogearbox.net commit ae2a823643d71f40751259266f7c2e7d90909662 Author: Linus Torvalds Date: Thu Aug 11 15:29:46 2022 -0700 dcache: move the DCACHE_OP_COMPARE case out of the __d_lookup_rcu loop __d_lookup_rcu() is one of the hottest functions in the kernel on certain loads, and it is complicated by filesystems that might want to have their own name compare function. We can improve code generation by moving the test of DCACHE_OP_COMPARE outside the loop, which makes the loop itself much simpler, at the cost of some code duplication. But both cases end up being simpler, and the "native" direct case-sensitive compare particularly so. Cc: Al Viro Signed-off-by: Linus Torvalds commit 583585e48d965338e73e1eb383768d16e0922d73 Author: Liu Jian Date: Tue Aug 9 17:49:15 2022 +0800 skmsg: Fix wrong last sg check in sk_msg_recvmsg() Fix one kernel NULL pointer dereference as below: [ 224.462334] Call Trace: [ 224.462394] __tcp_bpf_recvmsg+0xd3/0x380 [ 224.462441] ? sock_has_perm+0x78/0xa0 [ 224.462463] tcp_bpf_recvmsg+0x12e/0x220 [ 224.462494] inet_recvmsg+0x5b/0xd0 [ 224.462534] __sys_recvfrom+0xc8/0x130 [ 224.462574] ? syscall_trace_enter+0x1df/0x2e0 [ 224.462606] ? __do_page_fault+0x2de/0x500 [ 224.462635] __x64_sys_recvfrom+0x24/0x30 [ 224.462660] do_syscall_64+0x5d/0x1d0 [ 224.462709] entry_SYSCALL_64_after_hwframe+0x65/0xca In commit 9974d37ea75f ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()"), we change last sg check to sg_is_last(), but in sockmap redirection case (without stream_parser/stream_verdict/ skb_verdict), we did not mark the end of the scatterlist. Check the sk_msg_alloc, sk_msg_page_add, and bpf_msg_push_data functions, they all do not mark the end of sg. They are expected to use sg.end for end judgment. So the judgment of '(i != msg_rx->sg.end)' is added back here. Fixes: 9974d37ea75f ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()") Signed-off-by: Liu Jian Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20220809094915.150391-1-liujian56@huawei.com commit 36c0d935015766bf20d621c18313f17691bda5e3 Author: Arun Ramadoss Date: Tue Aug 16 16:25:16 2022 +0530 net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry In the ksz9477_fdb_dump function it reads the ALU control register and exit from the timeout loop if there is valid entry or search is complete. After exiting the loop, it reads the alu entry and report to the user space irrespective of entry is valid. It works till the valid entry. If the loop exited when search is complete, it reads the alu table. The table returns all ones and it is reported to user space. So bridge fdb show gives ff:ff:ff:ff:ff:ff as last entry for every port. To fix it, after exiting the loop the entry is reported only if it is valid one. Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") Signed-off-by: Arun Ramadoss Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220816105516.18350-1-arun.ramadoss@microchip.com Signed-off-by: Jakub Kicinski commit 932c29a10d5d0bba63b9f505a8ec1e3ce8c02542 Author: David Howells Date: Wed Aug 17 19:41:27 2022 +0100 locks: Fix dropped call to ->fl_release_private() Prior to commit 4149be7bda7e, sys_flock() would allocate the file_lock struct it was going to use to pass parameters, call ->flock() and then call locks_free_lock() to get rid of it - which had the side effect of calling locks_release_private() and thus ->fl_release_private(). With commit 4149be7bda7e, however, this is no longer the case: the struct is now allocated on the stack, and locks_free_lock() is no longer called - and thus any remaining private data doesn't get cleaned up either. This causes afs flock to cause oops. Kasan catches this as a UAF by the list_del_init() in afs_fl_release_private() for the file_lock record produced by afs_fl_copy_lock() as the original record didn't get delisted. It can be reproduced using the generic/504 xfstest. Fix this by reinstating the locks_release_private() call in sys_flock(). I'm not sure if this would affect any other filesystems. If not, then the release could be done in afs_flock() instead. Changes ======= ver #2) - Don't need to call ->fl_release_private() after calling the security hook, only after calling ->flock(). Fixes: 4149be7bda7e ("fs/lock: Don't allocate file_lock in flock_make_lock().") cc: Chuck Lever cc: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/166075758809.3532462.13307935588777587536.stgit@warthog.procyon.org.uk/ # v1 Acked-by: Kuniyuki Iwashima Signed-off-by: David Howells Signed-off-by: Jeff Layton commit 34fc9cc3aebe8b9e27d3bc821543dd482dc686ca Author: Heinrich Schuchardt Date: Wed Aug 17 15:25:21 2022 +0200 riscv: dts: microchip: correct L2 cache interrupts The "PolarFire SoC MSS Technical Reference Manual" documents the following PLIC interrupts: 1 - L2 Cache Controller Signals when a metadata correction event occurs 2 - L2 Cache Controller Signals when an uncorrectable metadata event occurs 3 - L2 Cache Controller Signals when a data correction event occurs 4 - L2 Cache Controller Signals when an uncorrectable data event occurs This differs from the SiFive FU540 which only has three L2 cache related interrupts. The sequence in the device tree is defined by an enum: enum {         DIR_CORR = 0,         DATA_CORR,         DATA_UNCORR,         DIR_UNCORR, }; So the correct sequence of the L2 cache interrupts is interrupts = <1>, <3>, <4>, <2>; [Conor] This manifests as an unusable system if the l2-cache driver is enabled, as the wrong interrupt gets cleared & the handler prints errors to the console ad infinitum. Fixes: 0fa6107eca41 ("RISC-V: Initial DTS for Microchip ICICLE board") CC: stable@vger.kernel.org # 5.15: e35b07a7df9b: riscv: dts: microchip: mpfs: Group tuples in interrupt properties Signed-off-by: Heinrich Schuchardt Signed-off-by: Conor Dooley commit 4f7e7236435ca0abe005c674ebd6892c6e83aeb3 Author: Tejun Heo Date: Mon Aug 15 13:27:38 2022 -1000 cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock Bringing up a CPU may involve creating and destroying tasks which requires read-locking threadgroup_rwsem, so threadgroup_rwsem nests inside cpus_read_lock(). However, cpuset's ->attach(), which may be called with thredagroup_rwsem write-locked, also wants to disable CPU hotplug and acquires cpus_read_lock(), leading to a deadlock. Fix it by guaranteeing that ->attach() is always called with CPU hotplug disabled and removing cpus_read_lock() call from cpuset_attach(). Signed-off-by: Tejun Heo Reviewed-and-tested-by: Imran Khan Reported-and-tested-by: Xuewen Yan Fixes: 05c7b7a92cc8 ("cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug") Cc: stable@vger.kernel.org # v5.17+ commit 664d4646184ed986f8195df684cc4660563fb02a Author: Sylwester Dziedziuch Date: Wed Aug 3 10:42:46 2022 +0200 ice: Fix VF not able to send tagged traffic with no VLAN filters VF was not able to send tagged traffic when it didn't have any VLAN interfaces and VLAN anti-spoofing was enabled. Fix this by allowing VFs with no VLAN filters to send tagged traffic. After VF adds a VLAN interface it will be able to send tagged traffic matching VLAN filters only. Testing hints: 1. Spawn VF 2. Send tagged packet from a VF 3. The packet should be sent out and not dropped 4. Add a VLAN interface on VF 5. Send tagged packet on that VLAN interface 6. Packet should be sent out and not dropped 7. Send tagged packet with id different than VLAN interface 8. Packet should be dropped Fixes: daf4dd16438b ("ice: Refactor spoofcheck configuration functions") Signed-off-by: Sylwester Dziedziuch Signed-off-by: Mateusz Palczewski Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 79956b83ed4281c35561c39254558092d96a9ed1 Author: Benjamin Mikailenko Date: Fri Aug 12 15:25:50 2022 +0200 ice: Ignore error message when setting same promiscuous mode Commit 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") introduced new checks when setting/clearing promiscuous mode. But if the requested promiscuous mode setting already exists, an -EEXIST error message would be printed. This is incorrect because promiscuous mode is either on/off and shouldn't print an error when the requested configuration is already set. This can happen when removing a bridge with two bonded interfaces and promiscuous most isn't fully cleared from VLAN VSI in hardware. Fix this by ignoring cases where requested promiscuous mode exists. Fixes: 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") Signed-off-by: Benjamin Mikailenko Signed-off-by: Grzegorz Siwik Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit abddafd4585cc825d454da3cf308ad1226f6c554 Author: Grzegorz Siwik Date: Fri Aug 12 15:25:49 2022 +0200 ice: Fix clearing of promisc mode with bridge over bond When at least two interfaces are bonded and a bridge is enabled on the bond, an error can occur when the bridge is removed and re-added. The reason for the error is because promiscuous mode was not fully cleared from the VLAN VSI in the hardware. With this change, promiscuous mode is properly removed when the bridge disconnects from bonding. [ 1033.676359] bond1: link status definitely down for interface enp95s0f0, disabling it [ 1033.676366] bond1: making interface enp175s0f0 the new active one [ 1033.676369] device enp95s0f0 left promiscuous mode [ 1033.676522] device enp175s0f0 entered promiscuous mode [ 1033.676901] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 [ 1041.795662] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 [ 1041.944826] bond1: link status definitely down for interface enp175s0f0, disabling it [ 1041.944874] device enp175s0f0 left promiscuous mode [ 1041.944918] bond1: now running without any active interface! Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations") Co-developed-by: Jesse Brandeburg Signed-off-by: Jesse Brandeburg Signed-off-by: Grzegorz Siwik Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ Tested-by: Jaroslav Pulchart Tested-by: Igor Raits Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 11e551a2efa4481bd4f616ab75374a2710b480e9 Author: Grzegorz Siwik Date: Fri Aug 12 15:25:48 2022 +0200 ice: Ignore EEXIST when setting promisc mode Ignore EEXIST error when setting promiscuous mode. This fix is needed because the driver could set promiscuous mode when it still has not cleared properly. Promiscuous mode could be set only once, so setting it second time will be rejected. Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode") Signed-off-by: Grzegorz Siwik Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ Tested-by: Jaroslav Pulchart Tested-by: Igor Raits Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit ffa9ed86522f1c08d4face4e0a4ebf366037bf19 Author: Grzegorz Siwik Date: Fri Aug 12 15:25:47 2022 +0200 ice: Fix double VLAN error when entering promisc mode Avoid enabling or disabling VLAN 0 when trying to set promiscuous VLAN mode if double VLAN mode is enabled. This fix is needed because the driver tries to add the VLAN 0 filter twice (once for inner and once for outer) when double VLAN mode is enabled. The filter program is rejected by the firmware when double VLAN is enabled, because the promiscuous filter only needs to be set once. This issue was missed in the initial implementation of double VLAN mode. Fixes: 5eda8afd6bcc ("ice: Add support for PF/VF promiscuous mode") Signed-off-by: Grzegorz Siwik Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ Tested-by: Jaroslav Pulchart Tested-by: Igor Raits Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 90d74fdbd8059bf041ac797092c9b1d461555280 Author: Christoffer Sandberg Date: Wed Aug 17 15:51:44 2022 +0200 ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU Fixes headset microphone detection on Clevo NS50PU and NS70PU. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Cc: Link: https://lore.kernel.org/r/20220817135144.34103-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 274a2eebf80c60246f9edd6ef8e9a095ad121264 Merge: 3cc40a443a04d 5c669c4a4c6aa Author: Linus Torvalds Date: Wed Aug 17 08:58:54 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Most notably this drops the commits that trip up google cloud (turns out, any legacy device). Plus a kerneldoc patch" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio: kerneldocs fixes and enhancements virtio: Revert "virtio: find_vqs() add arg sizes" virtio_vdpa: Revert "virtio_vdpa: support the arg sizes of find_vqs()" virtio_pci: Revert "virtio_pci: support the arg sizes of find_vqs()" virtio-mmio: Revert "virtio_mmio: support the arg sizes of find_vqs()" virtio: Revert "virtio: add helper virtio_find_vqs_ctx_size()" virtio_net: Revert "virtio_net: set the default max ring size by find_vqs()" commit ed3590561f5d3343a1717396307d0942eda472ed Author: Vincent Whitchurch Date: Tue Aug 16 16:44:14 2022 +0200 hwmon: (pmbus) Fix vout margin caching The code currently uses a zero margin to mean not cached, but this results in the cache being bypassed if the (low) margin is set to zero, leading to lots of unnecessary SMBus transactions in that case. Use a negative value instead. Fixes: 07fb76273db89d93 ("hwmon: (pmbus) Introduce and use cached vout margins") Signed-off-by: Vincent Whitchurch Link: https://lore.kernel.org/r/20220816144414.2358974-1-vincent.whitchurch@axis.com Signed-off-by: Guenter Roeck commit 09e52d17b72d3a4bf6951a90ccd8c97fae04e5cf Author: Christophe JAILLET Date: Wed Aug 17 15:04:00 2022 +0200 hwmon: (pmbus) Use dev_err_probe() to filter -EPROBE_DEFER error messages devm_regulator_register() can return -EPROBE_DEFER, so better use dev_err_probe() instead of dev_err(), it is less verbose in such a case. It is also more informative, which can't hurt. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/3adf1cea6e32e54c0f71f4604b4e98d992beaa71.1660741419.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck commit 899b7f69f244e539ea5df1b4d756046337de44a5 Author: Josef Bacik Date: Wed Aug 3 14:28:47 2022 -0400 btrfs: tree-checker: check for overlapping extent items We're seeing a weird problem in production where we have overlapping extent items in the extent tree. It's unclear where these are coming from, and in debugging we realized there's no check in the tree checker for this sort of problem. Add a check to the tree-checker to make sure that the extents do not overlap each other. Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 769030e11847c5412270c0726ff21d3a1f0a3131 Author: Filipe Manana Date: Mon Aug 1 14:57:52 2022 +0100 btrfs: fix warning during log replay when bumping inode link count During log replay, at add_link(), we may increment the link count of another inode that has a reference that conflicts with a new reference for the inode currently being processed. During log replay, at add_link(), we may drop (unlink) a reference from some inode in the subvolume tree if that reference conflicts with a new reference found in the log for the inode we are currently processing. After the unlink, If the link count has decreased from 1 to 0, then we increment the link count to prevent the inode from being deleted if it's evicted by an iput() call, because we may have references to add to that inode later on (and we will fixup its link count later during log replay). However incrementing the link count from 0 to 1 triggers a warning: $ cat fs/inode.c (...) void inc_nlink(struct inode *inode) { if (unlikely(inode->i_nlink == 0)) { WARN_ON(!(inode->i_state & I_LINKABLE)); atomic_long_dec(&inode->i_sb->s_remove_count); } (...) The I_LINKABLE flag is only set when creating an O_TMPFILE file, so it's never set during log replay. Most of the time, the warning isn't triggered even if we dropped the last reference of the conflicting inode, and this is because: 1) The conflicting inode was previously marked for fixup, through a call to link_to_fixup_dir(), which increments the inode's link count; 2) And the last iput() on the inode has not triggered eviction of the inode, nor was eviction triggered after the iput(). So at add_link(), even if we unlink the last reference of the inode, its link count ends up being 1 and not 0. So this means that if eviction is triggered after link_to_fixup_dir() is called, at add_link() we will read the inode back from the subvolume tree and have it with a correct link count, matching the number of references it has on the subvolume tree. So if when we are at add_link() the inode has exactly one reference only, its link count is 1, and after the unlink its link count becomes 0. So fix this by using set_nlink() instead of inc_nlink(), as the former accepts a transition from 0 to 1 and it's what we use in other similar contexts (like at link_to_fixup_dir(). Also make add_inode_ref() use set_nlink() instead of inc_nlink() to bump the link count from 0 to 1. The warning is actually harmless, but it may scare users. Josef also ran into it recently. CC: stable@vger.kernel.org # 5.1+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7a6b75b79902e47f46328b57733f2604774fa2d9 Author: Filipe Manana Date: Mon Aug 1 14:57:51 2022 +0100 btrfs: fix lost error handling when looking up extended ref on log replay During log replay, when processing inode references, if we get an error when looking up for an extended reference at __add_inode_ref(), we ignore it and proceed, returning success (0) if no other error happens after the lookup. This is obviously wrong because in case an extended reference exists and it encodes some name not in the log, we need to unlink it, otherwise the filesystem state will not match the state it had after the last fsync. So just make __add_inode_ref() return an error it gets from the extended reference lookup. Fixes: f186373fef005c ("btrfs: extended inode refs") CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b40130b23ca4a08c5785d5a3559805916bddba3c Author: Josef Bacik Date: Tue Jul 26 16:24:04 2022 -0400 btrfs: fix lockdep splat with reloc root extent buffers We have been hitting the following lockdep splat with btrfs/187 recently WARNING: possible circular locking dependency detected 5.19.0-rc8+ #775 Not tainted ------------------------------------------------------ btrfs/752500 is trying to acquire lock: ffff97e1875a97b8 (btrfs-treloc-02#2){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110 but task is already holding lock: ffff97e1875a9278 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (btrfs-tree-01/1){+.+.}-{3:3}: down_write_nested+0x41/0x80 __btrfs_tree_lock+0x24/0x110 btrfs_init_new_buffer+0x7d/0x2c0 btrfs_alloc_tree_block+0x120/0x3b0 __btrfs_cow_block+0x136/0x600 btrfs_cow_block+0x10b/0x230 btrfs_search_slot+0x53b/0xb70 btrfs_lookup_inode+0x2a/0xa0 __btrfs_update_delayed_inode+0x5f/0x280 btrfs_async_run_delayed_root+0x24c/0x290 btrfs_work_helper+0xf2/0x3e0 process_one_work+0x271/0x590 worker_thread+0x52/0x3b0 kthread+0xf0/0x120 ret_from_fork+0x1f/0x30 -> #1 (btrfs-tree-01){++++}-{3:3}: down_write_nested+0x41/0x80 __btrfs_tree_lock+0x24/0x110 btrfs_search_slot+0x3c3/0xb70 do_relocation+0x10c/0x6b0 relocate_tree_blocks+0x317/0x6d0 relocate_block_group+0x1f1/0x560 btrfs_relocate_block_group+0x23e/0x400 btrfs_relocate_chunk+0x4c/0x140 btrfs_balance+0x755/0xe40 btrfs_ioctl+0x1ea2/0x2c90 __x64_sys_ioctl+0x88/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #0 (btrfs-treloc-02#2){+.+.}-{3:3}: __lock_acquire+0x1122/0x1e10 lock_acquire+0xc2/0x2d0 down_write_nested+0x41/0x80 __btrfs_tree_lock+0x24/0x110 btrfs_lock_root_node+0x31/0x50 btrfs_search_slot+0x1cb/0xb70 replace_path+0x541/0x9f0 merge_reloc_root+0x1d6/0x610 merge_reloc_roots+0xe2/0x260 relocate_block_group+0x2c8/0x560 btrfs_relocate_block_group+0x23e/0x400 btrfs_relocate_chunk+0x4c/0x140 btrfs_balance+0x755/0xe40 btrfs_ioctl+0x1ea2/0x2c90 __x64_sys_ioctl+0x88/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd other info that might help us debug this: Chain exists of: btrfs-treloc-02#2 --> btrfs-tree-01 --> btrfs-tree-01/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(btrfs-tree-01/1); lock(btrfs-tree-01); lock(btrfs-tree-01/1); lock(btrfs-treloc-02#2); *** DEADLOCK *** 7 locks held by btrfs/752500: #0: ffff97e292fdf460 (sb_writers#12){.+.+}-{0:0}, at: btrfs_ioctl+0x208/0x2c90 #1: ffff97e284c02050 (&fs_info->reclaim_bgs_lock){+.+.}-{3:3}, at: btrfs_balance+0x55f/0xe40 #2: ffff97e284c00878 (&fs_info->cleaner_mutex){+.+.}-{3:3}, at: btrfs_relocate_block_group+0x236/0x400 #3: ffff97e292fdf650 (sb_internal#2){.+.+}-{0:0}, at: merge_reloc_root+0xef/0x610 #4: ffff97e284c02378 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x1a8/0x5a0 #5: ffff97e284c023a0 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x1a8/0x5a0 #6: ffff97e1875a9278 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110 stack backtrace: CPU: 1 PID: 752500 Comm: btrfs Not tainted 5.19.0-rc8+ #775 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Call Trace: dump_stack_lvl+0x56/0x73 check_noncircular+0xd6/0x100 ? lock_is_held_type+0xe2/0x140 __lock_acquire+0x1122/0x1e10 lock_acquire+0xc2/0x2d0 ? __btrfs_tree_lock+0x24/0x110 down_write_nested+0x41/0x80 ? __btrfs_tree_lock+0x24/0x110 __btrfs_tree_lock+0x24/0x110 btrfs_lock_root_node+0x31/0x50 btrfs_search_slot+0x1cb/0xb70 ? lock_release+0x137/0x2d0 ? _raw_spin_unlock+0x29/0x50 ? release_extent_buffer+0x128/0x180 replace_path+0x541/0x9f0 merge_reloc_root+0x1d6/0x610 merge_reloc_roots+0xe2/0x260 relocate_block_group+0x2c8/0x560 btrfs_relocate_block_group+0x23e/0x400 btrfs_relocate_chunk+0x4c/0x140 btrfs_balance+0x755/0xe40 btrfs_ioctl+0x1ea2/0x2c90 ? lock_is_held_type+0xe2/0x140 ? lock_is_held_type+0xe2/0x140 ? __x64_sys_ioctl+0x88/0xc0 __x64_sys_ioctl+0x88/0xc0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd This isn't necessarily new, it's just tricky to hit in practice. There are two competing things going on here. With relocation we create a snapshot of every fs tree with a reloc tree. Any extent buffers that get initialized here are initialized with the reloc root lockdep key. However since it is a snapshot, any blocks that are currently in cache that originally belonged to the fs tree will have the normal tree lockdep key set. This creates the lock dependency of reloc tree -> normal tree for the extent buffer locking during the first phase of the relocation as we walk down the reloc root to relocate blocks. However this is problematic because the final phase of the relocation is merging the reloc root into the original fs root. This involves searching down to any keys that exist in the original fs root and then swapping the relocated block and the original fs root block. We have to search down to the fs root first, and then go search the reloc root for the block we need to replace. This creates the dependency of normal tree -> reloc tree which is why lockdep complains. Additionally even if we were to fix this particular mismatch with a different nesting for the merge case, we're still slotting in a block that has a owner of the reloc root objectid into a normal tree, so that block will have its lockdep key set to the tree reloc root, and create a lockdep splat later on when we wander into that block from the fs root. Unfortunately the only solution here is to make sure we do not set the lockdep key to the reloc tree lockdep key normally, and then reset any blocks we wander into from the reloc root when we're doing the merged. This solves the problem of having mixed tree reloc keys intermixed with normal tree keys, and then allows us to make sure in the merge case we maintain the lock order of normal tree -> reloc tree We handle this by setting a bit on the reloc root when we do the search for the block we want to relocate, and any block we search into or COW at that point gets set to the reloc tree key. This works correctly because we only ever COW down to the parent node, so we aren't resetting the key for the block we're linking into the fs root. With this patch we no longer have the lockdep splat in btrfs/187. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0a27a0474d146eb79e09ec88bf0d4229f4cfc1b8 Author: Josef Bacik Date: Tue Jul 26 16:24:03 2022 -0400 btrfs: move lockdep class helpers to locking.c These definitions exist in disk-io.c, which is not related to the locking. Move this over to locking.h/c where it makes more sense. Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 85f02d6c856b9f3a0acf5219de6e32f58b9778eb Author: Zixuan Fu Date: Thu Jul 21 15:48:29 2022 +0800 btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... Reported-by: TOTE Robot CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Sweet Tea Dorminy Reviewed-by: Nikolay Borisov Signed-off-by: Zixuan Fu Signed-off-by: David Sterba commit ff5900092227ade3e31fe25f97faf406cde902e6 Author: Lukas Bulwahn Date: Thu Jul 21 12:04:33 2022 +0200 arm64: adjust KASLR relocation after ARCH_RANDOM removal Commit aacd149b6238 ("arm64: head: avoid relocating the kernel twice for KASLR") adds the new file arch/arm64/kernel/pi/kaslr_early.c with a small code part guarded by '#ifdef CONFIG_ARCH_RANDOM'. Concurrently, commit 9592eef7c16e ("random: remove CONFIG_ARCH_RANDOM") removes the config CONFIG_ARCH_RANDOM and turns all '#ifdef CONFIG_ARCH_RANDOM' code parts into unconditional code parts, which is generally safe to do. Remove a needless ifdef guard after the ARCH_RANDOM removal. Signed-off-by: Lukas Bulwahn Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220721100433.18286-1-lukas.bulwahn@gmail.com Signed-off-by: Will Deacon commit 5e1e087457c94ad7fafbe1cf6f774c6999ee29d4 Author: Zenghui Yu Date: Tue Aug 9 12:38:48 2022 +0800 arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 Since commit 51f559d66527 ("arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs"), we failed to detect erratum 1286807 on Cortex-A76 because its entry in arm64_repeat_tlbi_list[] was accidently corrupted by this commit. Fix this issue by creating a separate entry for Kryo4xx Gold. Fixes: 51f559d66527 ("arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs") Cc: Shreyas K K Signed-off-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20220809043848.969-1-yuzenghui@huawei.com Signed-off-by: Will Deacon commit 9be080edcca330be4af06b19916c35227891e8bc Author: Amadeusz Sławiński Date: Wed Aug 17 14:49:24 2022 +0200 ALSA: info: Fix llseek return value when using callback When using callback there was a flow of ret = -EINVAL if (callback) { offset = callback(); goto out; } ... offset = some other value in case of no callback; ret = offset; out: return ret; which causes the snd_info_entry_llseek() to return -EINVAL when there is callback handler. Fix this by setting "ret" directly to callback return value before jumping to "out". Fixes: 73029e0ff18d ("ALSA: info - Implement common llseek for binary mode") Signed-off-by: Amadeusz Sławiński Cc: Link: https://lore.kernel.org/r/20220817124924.3974577-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Takashi Iwai commit c8550b9077d271b9b4fbe5a9a260eb021f371c4f Author: Florian Westphal Date: Tue Aug 16 14:15:22 2022 +0200 testing: selftests: nft_flowtable.sh: rework test to detect offload failure This test fails on current kernel releases because the flotwable path now calls dst_check from packet path and will then remove the offload. Test script has two purposes: 1. check that file (random content) can be sent to other netns (and vv) 2. check that the flow is offloaded (rather than handled by classic forwarding path). Since dst_check is in place, 2) fails because the nftables ruleset in router namespace 1 intentionally blocks traffic under the assumption that packets are not passed via classic path at all. Rework this: Instead of blocking traffic, create two named counters, one for original and one for reverse direction. The first three test cases are handled by classic forwarding path (path mtu discovery is disabled and packets exceed MTU). But all other tests enable PMTUD, so the originator and responder are expected to lower packet size and flowtable is expected to do the packet forwarding. For those tests, check that the packet counters (which are only incremented for packets that are passed up to classic forward path) are significantly lower than the file size transferred. I've tested that the counter-checks fail as expected when the 'flow add' statement is removed from the ruleset. Signed-off-by: Florian Westphal commit c6e14bb9f50df7126ca64405ae807d8bc7b39f9a Author: Srinivas Kandagatla Date: Tue Aug 16 17:52:29 2022 +0100 ASoC: qcom: sm8250: add missing module owner Add missing module owner to able to build and load this driver as module. Fixes: aa2e2785545a ("ASoC: qcom: sm8250: add sound card qrb5165-rb5 support") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20220816165229.7971-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 1ff954f9ab054675b9eb02dd14add8f7aa376d71 Author: Stefan Binding Date: Tue Aug 16 16:19:01 2022 +0100 ALSA: hda/cs8409: Support new Dolphin Variants Add 4 new Dolphin Systems, same configuration as older systems. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20220816151901.1398007-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit b10d86fb8e46cc812171728bcd326df2f34e9ed5 Author: Oliver Upton Date: Tue Aug 16 19:25:54 2022 +0000 KVM: arm64: Reject 32bit user PSTATE on asymmetric systems KVM does not support AArch32 EL0 on asymmetric systems. To that end, prevent userspace from configuring a vCPU in such a state through setting PSTATE. It is already ABI that KVM rejects such a write on a system where AArch32 EL0 is unsupported. Though the kernel's definition of a 32bit system changed in commit 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support"), KVM's did not. Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220816192554.1455559-3-oliver.upton@linux.dev commit f3c6efc72f3b20ec23566e768979802f0a398f04 Author: Oliver Upton Date: Tue Aug 16 19:25:53 2022 +0000 KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems KVM does not support AArch32 on asymmetric systems. To that end, enforce AArch64-only behavior on PMCR_EL1.LC when on an asymmetric system. Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220816192554.1455559-2-oliver.upton@linux.dev commit bf1ac16edf6770a92bc75cf2373f1f9feea398a4 Author: Seth Forshee Date: Tue Aug 16 11:47:52 2022 -0500 fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts Idmapped mounts should not allow a user to map file ownsership into a range of ids which is not under the control of that user. However, we currently don't check whether the mounter is privileged wrt to the target user namespace. Currently no FS_USERNS_MOUNT filesystems support idmapped mounts, thus this is not a problem as only CAP_SYS_ADMIN in init_user_ns is allowed to set up idmapped mounts. But this could change in the future, so add a check to refuse to create idmapped mounts when the mounter does not have CAP_SYS_ADMIN in the target user namespace. Fixes: bd303368b776 ("fs: support mapped mounts of mapped filesystems") Signed-off-by: Seth Forshee Reviewed-by: Christian Brauner (Microsoft) Link: https://lore.kernel.org/r/20220816164752.2595240-1-sforshee@digitalocean.com Signed-off-by: Christian Brauner (Microsoft) commit ed16d19c5f1d02908caf85c52a787de2eeeced2f Merge: 849f16bbfb686 57c942bc3bef0 Author: David S. Miller Date: Wed Aug 17 10:25:29 2022 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue ==================== Intel Wired LAN Driver Updates 2022-08-16) This series contains updates to i40e driver only. Przemyslaw fixes issue with checksum offload on VXLAN tunnels. Alan disables VSI for Tx timeout when all recovery methods have failed. ==================== Signed-off-by: David S. Miller commit 849f16bbfb686cf75e67c536d196027fa8bfc803 Author: Jakub Kicinski Date: Mon Aug 15 17:23:58 2022 -0700 tls: rx: react to strparser initialization errors Even though the normal strparser's init function has a return value we got away with ignoring errors until now, as it only validates the parameters and we were passing correct parameters. tls_strp can fail to init on memory allocation errors, which syzbot duly induced and reported. Reported-by: syzbot+abd45eb849b05194b1b6@syzkaller.appspotmail.com Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit ddc84c90538e1fdb0721cd41c313944c38449a34 Author: Christian Brauner Date: Tue Aug 16 13:35:14 2022 +0200 MAINTAINERS: update idmapping tree Since Seth joined as a maintainer in ba40a57ff08b ("Add Seth Forshee as co-maintainer for idmapped mounts") it was best to get a shared git tree instead of using our personal repositories. So we requested and Konstantin suggested and gave us a new "idmapping" repository under the pre-existing but mainly unused vfs namespace. Just makes it easier for Seth to send fixes in case I'm out or someone else ever takes over. Cc: Seth Forshee Signed-off-by: Christian Brauner (Microsoft) Link: https://lore.kernel.org/r/20220816113514.43304-2-brauner@kernel.org commit abfcf55d8b07a990589301bc64d82a5d26680956 Author: Christian Brauner Date: Tue Aug 16 13:35:13 2022 +0200 acl: handle idmapped mounts for idmapped filesystems Ensure that POSIX ACLs checking, getting, and setting works correctly for filesystems mountable with a filesystem idmapping ("fs_idmapping") that want to support idmapped mounts ("mnt_idmapping"). Note that no filesystems mountable with an fs_idmapping do yet support idmapped mounts. This is required infrastructure work to unblock this. As we explained in detail in [1] the fs_idmapping is irrelevant for getxattr() and setxattr() when mapping the ACL_{GROUP,USER} {g,u}ids stored in the uapi struct posix_acl_xattr_entry in posix_acl_fix_xattr_{from,to}_user(). But for acl_permission_check() and posix_acl_{g,s}etxattr_idmapped_mnt() the fs_idmapping matters. acl_permission_check(): During lookup POSIX ACLs are retrieved directly via i_op->get_acl() and are returned via the kernel internal struct posix_acl which contains e_{g,u}id members of type k{g,u}id_t that already take the fs_idmapping into acccount. For example, a POSIX ACL stored with u4 on the backing store is mapped to k10000004 in the fs_idmapping. The mnt_idmapping remaps the POSIX ACL to k20000004. In order to do that the fs_idmapping needs to be taken into account but that doesn't happen yet (Again, this is a counterfactual currently as fuse doesn't support idmapped mounts currently. It's just used as a convenient example.): fs_idmapping: u0:k10000000:r65536 mnt_idmapping: u0:v20000000:r65536 ACL_USER: k10000004 acl_permission_check() -> check_acl() -> get_acl() -> i_op->get_acl() == fuse_get_acl() -> posix_acl_from_xattr(u0:k10000000:r65536 /* fs_idmapping */, ...) { k10000004 = make_kuid(u0:k10000000:r65536 /* fs_idmapping */, u4 /* ACL_USER */); } -> posix_acl_permission() { -1 = make_vfsuid(u0:v20000000:r65536 /* mnt_idmapping */, &init_user_ns, k10000004); vfsuid_eq_kuid(-1, k10000004 /* caller_fsuid */) } In order to correctly map from the fs_idmapping into mnt_idmapping we require the relevant fs_idmaping to be passed: acl_permission_check() -> check_acl() -> get_acl() -> i_op->get_acl() == fuse_get_acl() -> posix_acl_from_xattr(u0:k10000000:r65536 /* fs_idmapping */, ...) { k10000004 = make_kuid(u0:k10000000:r65536 /* fs_idmapping */, u4 /* ACL_USER */); } -> posix_acl_permission() { v20000004 = make_vfsuid(u0:v20000000:r65536 /* mnt_idmapping */, u0:k10000000:r65536 /* fs_idmapping */, k10000004); vfsuid_eq_kuid(v20000004, k10000004 /* caller_fsuid */) } The initial_idmapping is only correct for the current situation because all filesystems that currently support idmapped mounts do not support being mounted with an fs_idmapping. Note that ovl_get_acl() is used to retrieve the POSIX ACLs from the relevant lower layer and the lower layer's mnt_idmapping needs to be taken into account and so does the fs_idmapping. See 0c5fd887d2bb ("acl: move idmapped mount fixup into vfs_{g,s}etxattr()") for more details. For posix_acl_{g,s}etxattr_idmapped_mnt() it is not as obvious why the fs_idmapping matters as it is for acl_permission_check(). Especially because it doesn't matter for posix_acl_fix_xattr_{from,to}_user() (See [1] for more context.). Because posix_acl_{g,s}etxattr_idmapped_mnt() operate on the uapi struct posix_acl_xattr_entry which contains {g,u}id_t values and thus give the impression that the fs_idmapping is irrelevant as at this point appropriate {g,u}id_t values have seemlingly been generated. As we've stated multiple times this assumption is wrong and in fact the uapi struct posix_acl_xattr_entry is taking idmappings into account depending at what place it is operated on. posix_acl_getxattr_idmapped_mnt() When posix_acl_getxattr_idmapped_mnt() is called the values stored in the uapi struct posix_acl_xattr_entry are mapped according to the fs_idmapping. This happened when they were read from the backing store and then translated from struct posix_acl into the uapi struct posix_acl_xattr_entry during posix_acl_to_xattr(). In other words, the fs_idmapping matters as the values stored as {g,u}id_t in the uapi struct posix_acl_xattr_entry have been generated by it. So we need to take the fs_idmapping into account during make_vfsuid() in posix_acl_getxattr_idmapped_mnt(). posix_acl_setxattr_idmapped_mnt() When posix_acl_setxattr_idmapped_mnt() is called the values stored as {g,u}id_t in uapi struct posix_acl_xattr_entry are intended to be the values that ultimately get turned back into a k{g,u}id_t in posix_acl_from_xattr() (which turns the uapi struct posix_acl_xattr_entry into the kernel internal struct posix_acl). In other words, the fs_idmapping matters as the values stored as {g,u}id_t in the uapi struct posix_acl_xattr_entry are intended to be the values that will be undone in the fs_idmapping when writing to the backing store. So we need to take the fs_idmapping into account during from_vfsuid() in posix_acl_setxattr_idmapped_mnt(). Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1] Fixes: 0c5fd887d2bb ("acl: move idmapped mount fixup into vfs_{g,s}etxattr()") Cc: Seth Forshee Signed-off-by: Christian Brauner (Microsoft) Reviewed-by: Seth Forshee Link: https://lore.kernel.org/r/20220816113514.43304-1-brauner@kernel.org commit e9f130e0775b5a2dad0a33440347d373ff69e631 Author: Andrejs Cainikovs Date: Fri Jul 8 14:42:05 2022 +0200 arm64: dts: imx8mm-verdin: use level interrupt for mcp251xfd Switch to level interrupt for mcp251xfd. This will make sure no interrupts are lost. Signed-off-by: Andrejs Cainikovs Reported-by: Marc Kleine-Budde Acked-by: Marc Kleine-Budde Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Shawn Guo commit be1e3dfecf7d2fbcb4a45b113da637983878246c Author: Andrejs Cainikovs Date: Fri Jul 8 14:42:04 2022 +0200 arm64: dts: imx8mm-verdin: update CAN clock to 40MHz Update SPI CAN controller clock to match current hardware design. Signed-off-by: Andrejs Cainikovs Acked-by: Marcel Ziswiler Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Shawn Guo commit 17ecd4a4db4783392edd4944f5e8268205083f70 Author: Nikolay Aleksandrov Date: Tue Aug 16 18:30:50 2022 +0300 xfrm: policy: fix metadata dst->dev xmit null pointer dereference When we try to transmit an skb with metadata_dst attached (i.e. dst->dev == NULL) through xfrm interface we can hit a null pointer dereference[1] in xfrmi_xmit2() -> xfrm_lookup_with_ifid() due to the check for a loopback skb device when there's no policy which dereferences dst->dev unconditionally. Not having dst->dev can be interepreted as it not being a loopback device, so just add a check for a null dst_orig->dev. With this fix xfrm interface's Tx error counters go up as usual. [1] net-next calltrace captured via netconsole: BUG: kernel NULL pointer dereference, address: 00000000000000c0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 7231 Comm: ping Kdump: loaded Not tainted 5.19.0+ #24 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:xfrm_lookup_with_ifid+0x5eb/0xa60 Code: 8d 74 24 38 e8 26 a4 37 00 48 89 c1 e9 12 fc ff ff 49 63 ed 41 83 fd be 0f 85 be 01 00 00 41 be ff ff ff ff 45 31 ed 48 8b 03 80 c0 00 00 00 08 75 0f 41 80 bc 24 19 0d 00 00 01 0f 84 1e 02 RSP: 0018:ffffb0db82c679f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffd0db7fcad430 RCX: ffffb0db82c67a10 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb0db82c67a80 RBP: ffffb0db82c67a80 R08: ffffb0db82c67a14 R09: 0000000000000000 R10: 0000000000000000 R11: ffff8fa449667dc8 R12: ffffffff966db880 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 FS: 00007ff35c83f000(0000) GS:ffff8fa478480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000c0 CR3: 000000001ebb7000 CR4: 0000000000350ee0 Call Trace: xfrmi_xmit+0xde/0x460 ? tcf_bpf_act+0x13d/0x2a0 dev_hard_start_xmit+0x72/0x1e0 __dev_queue_xmit+0x251/0xd30 ip_finish_output2+0x140/0x550 ip_push_pending_frames+0x56/0x80 raw_sendmsg+0x663/0x10a0 ? try_charge_memcg+0x3fd/0x7a0 ? __mod_memcg_lruvec_state+0x93/0x110 ? sock_sendmsg+0x30/0x40 sock_sendmsg+0x30/0x40 __sys_sendto+0xeb/0x130 ? handle_mm_fault+0xae/0x280 ? do_user_addr_fault+0x1e7/0x680 ? kvm_read_and_reset_apf_flags+0x3b/0x50 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7ff35cac1366 Code: eb 0b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 c3 90 55 48 83 ec 30 44 89 4c 24 2c 4c 89 RSP: 002b:00007fff738e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fff738e57b0 RCX: 00007ff35cac1366 RDX: 0000000000000040 RSI: 0000557164e4b450 RDI: 0000000000000003 RBP: 0000557164e4b450 R08: 00007fff738e7a2c R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 R13: 00007fff738e5770 R14: 00007fff738e4030 R15: 0000001d00000001 Modules linked in: netconsole veth br_netfilter bridge bonding virtio_net [last unloaded: netconsole] CR2: 00000000000000c0 CC: Steffen Klassert CC: Daniel Borkmann Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") Signed-off-by: Nikolay Aleksandrov Signed-off-by: Steffen Klassert commit b64b46fbaa1da626324f304bcb5fe0662f28b6ce Author: Marco Felsch Date: Fri Jul 8 11:08:53 2022 +0200 Revert "soc: imx: imx8m-blk-ctrl: set power device name" This reverts commit 8239d67f59cf522dd4f7135392a2f9a3a25f9cff. This change confuses the sysfs cleanup path since the rename is done after the device registration. Fixes: 8239d67f59cf ("soc: imx: imx8m-blk-ctrl: set power device name") Signed-off-by: Marco Felsch Reviewed-by: Lucas Stach Signed-off-by: Shawn Guo commit 88392a0dd0ab263edb4ca416ebdecabd8289158a Author: Lucas Tanure Date: Wed Jul 27 10:59:24 2022 +0100 platform/x86: serial-multi-instantiate: Add CLSA0101 Laptop The device CLSA0101 has two instances of CS35L41 connected by I2C. Signed-off-by: Lucas Tanure Link: https://lore.kernel.org/r/20220727095924.80884-5-tanureal@opensource.cirrus.com Link: https://lore.kernel.org/r/20220816194639.13870-1-cam@neo-zeon.de Signed-off-by: Takashi Iwai commit b71b7bfeac38c7a21c423ddafb29aa6258949df8 Author: Florian Westphal Date: Tue Aug 16 14:15:21 2022 +0200 testing: selftests: nft_flowtable.sh: use random netns names "ns1" is a too generic name, use a random suffix to avoid errors when such a netns exists. Also allows to run multiple instances of the script in parallel. Signed-off-by: Florian Westphal commit aa5762c34213aba7a72dc58e70601370805fa794 Author: Geert Uytterhoeven Date: Mon Aug 15 12:39:20 2022 +0200 netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y NF_CONNTRACK_PROCFS was marked obsolete in commit 54b07dca68557b09 ("netfilter: provide config option to disable ancient procfs parts") in v3.3. Signed-off-by: Geert Uytterhoeven Signed-off-by: Florian Westphal commit cf36ae3e5802716617b9e4d902a31048240396b0 Merge: 82a1356a933d8 568035b01cfb1 Author: Thomas Zimmermann Date: Wed Aug 17 08:40:32 2022 +0200 Merge drm/drm-fixes into drm-misc-fixes Backmerging for v6.0-rc1. Signed-off-by: Thomas Zimmermann commit de64b6b6fb6f369840d171b7c5a9baf31b8b2630 Author: Zhengchao Shao Date: Mon Aug 15 11:08:48 2022 +0800 net: sched: fix misuse of qcpu->backlog in gnet_stats_add_queue_cpu In the gnet_stats_add_queue_cpu function, the qstats->qlen statistics are incorrectly set to qcpu->backlog. Fixes: 448e163f8b9b ("gen_stats: Add gnet_stats_add_queue()") Signed-off-by: Zhengchao Shao Link: https://lore.kernel.org/r/20220815030848.276746-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit eb6354e116305afbfde196be5120bfa8669fdc6a Author: Andrew Jones Date: Tue Aug 16 18:30:58 2022 +0200 riscv: Ensure isa-ext static keys are writable riscv_isa_ext_keys[] is an array of static keys used in the unified ISA extension framework. The keys added to this array may be used anywhere, including in modules. Ensure the keys remain writable by placing them in the data section. The need to change riscv_isa_ext_keys[]'s section was found when the kvm module started failing to load. Commit 8eb060e10185 ("arch/riscv: add Zihintpause support") adds a static branch check for a newly added isa-ext key to cpu_relax(), which kvm uses. Fixes: c360cbec3511 ("riscv: introduce unified static key mechanism for ISA extensions") Signed-off-by: Andrew Jones Cc: stable@vger.kernel.org Reported-by: Ron Economos Reported-by: Anup Patel Reported-by: Conor Dooley Tested-by: Atish Patra Link: https://lore.kernel.org/r/20220816163058.3004536-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 085292c3d78015412b752ee1ca4c7725fd2bf2fc Author: Michel Dänzer Date: Tue Aug 16 10:44:10 2022 +0200 Revert "drm/amd/amdgpu: add pipe1 hardware support" This reverts commit 4c7631800e6bf0eced08dd7b4f793fcd972f597d. Triggered GFX hangs with GNOME Wayland on Navi 21. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2117 Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher commit bbca24d0a3c11193bafb9e174f89f52a379006e3 Author: Maíra Canal Date: Mon Aug 15 08:39:31 2022 -0300 drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex If amdgpu_cs_vm_handling returns r != 0, then it will unlock the bo_list_mutex inside the function amdgpu_cs_vm_handling and again on amdgpu_cs_parser_fini. This problem results in the following use-after-free problem: [ 220.280990] ------------[ cut here ]------------ [ 220.281000] refcount_t: underflow; use-after-free. [ 220.281019] WARNING: CPU: 1 PID: 3746 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 220.281029] ------------[ cut here ]------------ [ 220.281415] CPU: 1 PID: 3746 Comm: chrome:cs0 Tainted: G W L ------- --- 5.20.0-0.rc0.20220812git7ebfc85e2cd7.10.fc38.x86_64 #1 [ 220.281421] Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 4403 04/27/2022 [ 220.281426] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 220.281431] Code: 01 01 e8 79 4a 6f 00 0f 0b e9 42 47 a5 00 80 3d de 7e be 01 00 75 85 48 c7 c7 f8 98 8e 98 c6 05 ce 7e be 01 01 e8 56 4a 6f 00 <0f> 0b e9 1f 47 a5 00 80 3d b9 7e be 01 00 0f 85 5e ff ff ff 48 c7 [ 220.281437] RSP: 0018:ffffb4b0d18d7a80 EFLAGS: 00010282 [ 220.281443] RAX: 0000000000000026 RBX: 0000000000000003 RCX: 0000000000000000 [ 220.281448] RDX: 0000000000000001 RSI: ffffffff988d06dc RDI: 00000000ffffffff [ 220.281452] RBP: 00000000ffffffff R08: 0000000000000000 R09: ffffb4b0d18d7930 [ 220.281457] R10: 0000000000000003 R11: ffffa0672e2fffe8 R12: ffffa058ca360400 [ 220.281461] R13: ffffa05846c50a18 R14: 00000000fffffe00 R15: 0000000000000003 [ 220.281465] FS: 00007f82683e06c0(0000) GS:ffffa066e2e00000(0000) knlGS:0000000000000000 [ 220.281470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 220.281475] CR2: 00003590005cc000 CR3: 00000001fca46000 CR4: 0000000000350ee0 [ 220.281480] Call Trace: [ 220.281485] [ 220.281490] amdgpu_cs_ioctl+0x4e2/0x2070 [amdgpu] [ 220.281806] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu] [ 220.282028] drm_ioctl_kernel+0xa4/0x150 [ 220.282043] drm_ioctl+0x21f/0x420 [ 220.282053] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu] [ 220.282275] ? lock_release+0x14f/0x460 [ 220.282282] ? _raw_spin_unlock_irqrestore+0x30/0x60 [ 220.282290] ? _raw_spin_unlock_irqrestore+0x30/0x60 [ 220.282297] ? lockdep_hardirqs_on+0x7d/0x100 [ 220.282305] ? _raw_spin_unlock_irqrestore+0x40/0x60 [ 220.282317] amdgpu_drm_ioctl+0x4a/0x80 [amdgpu] [ 220.282534] __x64_sys_ioctl+0x90/0xd0 [ 220.282545] do_syscall_64+0x5b/0x80 [ 220.282551] ? futex_wake+0x6c/0x150 [ 220.282568] ? lock_is_held_type+0xe8/0x140 [ 220.282580] ? do_syscall_64+0x67/0x80 [ 220.282585] ? lockdep_hardirqs_on+0x7d/0x100 [ 220.282592] ? do_syscall_64+0x67/0x80 [ 220.282597] ? do_syscall_64+0x67/0x80 [ 220.282602] ? lockdep_hardirqs_on+0x7d/0x100 [ 220.282609] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 220.282616] RIP: 0033:0x7f8282a4f8bf [ 220.282639] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 220.282644] RSP: 002b:00007f82683df410 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 220.282651] RAX: ffffffffffffffda RBX: 00007f82683df588 RCX: 00007f8282a4f8bf [ 220.282655] RDX: 00007f82683df4d0 RSI: 00000000c0186444 RDI: 0000000000000018 [ 220.282659] RBP: 00007f82683df4d0 R08: 00007f82683df5e0 R09: 00007f82683df4b0 [ 220.282663] R10: 00001d04000a0600 R11: 0000000000000246 R12: 00000000c0186444 [ 220.282667] R13: 0000000000000018 R14: 00007f82683df588 R15: 0000000000000003 [ 220.282689] [ 220.282693] irq event stamp: 6232311 [ 220.282697] hardirqs last enabled at (6232319): [] __up_console_sem+0x5e/0x70 [ 220.282704] hardirqs last disabled at (6232326): [] __up_console_sem+0x43/0x70 [ 220.282709] softirqs last enabled at (6232072): [] __irq_exit_rcu+0xf9/0x170 [ 220.282716] softirqs last disabled at (6232061): [] __irq_exit_rcu+0xf9/0x170 [ 220.282722] ---[ end trace 0000000000000000 ]--- Therefore, remove the mutex_unlock from the amdgpu_cs_vm_handling function, so that amdgpu_cs_submit and amdgpu_cs_parser_fini can handle the unlock. Fixes: 90af0ca047f3 ("drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2") Reported-by: Mikhail Gavrilov Reviewed-by: Christian König Reviewed-by: Melissa Wen Signed-off-by: Maíra Canal Signed-off-by: Alex Deucher commit de8341ee3ce7316883e836a2c4e9bf01ab651e0f Author: Mukul Joshi Date: Fri Aug 12 15:23:51 2022 -0400 drm/amdgpu: Fix interrupt handling on ih_soft ring There are no backing hardware registers for ih_soft ring. As a result, don't try to access hardware registers for read and write pointers when processing interrupts on the IH soft ring. Signed-off-by: Mukul Joshi Acked-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit e42dfa66d59240afbdd8d4b47b87486db39504aa Author: Shane Xiao Date: Mon Aug 15 16:32:15 2022 +0800 drm/amdgpu: Add secure display TA load for Renoir Add secure display TA load for Renoir Signed-off-by: Shane Xiao Reviewed-by: Aaron Liu Signed-off-by: Alex Deucher commit fbe43dcd1aad7dbcee1cffdbe6c3e1d62c85f76a Author: Alvin Lee Date: Thu Aug 4 14:42:47 2022 -0400 drm/amd/display: Include scaling factor for SubVP command [Description] For SubVP scaling cases, we must include the scaling info as part of the cmd. This is required when converting OTG line to HUBP line for the MALL_START_LINE programming. Reviewed-by: Jun Lei Acked-by: Brian Chang Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 385bf5a856c196d5997ce4111a23df7e1b679c17 Author: Khalid Masum Date: Tue Aug 16 00:34:25 2022 +0600 drm/amdgpu/vcn: Return void from the stop_dbg_mode There is no point in returning an int here. It only returns 0 which the caller never uses. Therefore return void and remove the unnecessary assignment. Addresses-Coverity: 1504988 ("Unused value") Fixes: 8da1170a16e4 ("drm/amdgpu: add VCN4 ip block support") Reviewed-by: Ruijing Dong Suggested-by: Ruijing Dong Suggested-by: Greg Kroah-Hartman Signed-off-by: Khalid Masum Signed-off-by: Alex Deucher commit bf7f7efbe051a59e9d0710cd26ea05f7ebc411a2 Author: Andrey Strachuk Date: Tue Jul 19 13:39:54 2022 +0300 drm/amdgpu: remove useless condition in amdgpu_job_stop_all_jobs_on_sched() Local variable 'rq' is initialized by an address of field of drm_sched_job, so it does not make sense to compare 'rq' with NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Andrey Grodzovsky Signed-off-by: Andrey Strachuk Fixes: 7c6e68c777f1 ("drm/amdgpu: Avoid HW GPU reset for RAS.") Signed-off-by: Alex Deucher commit 1af9add1f1512b10d9ce44ec7137612bc81ff069 Author: Harish Kasiviswanathan Date: Fri Aug 5 18:04:08 2022 -0400 drm/amdgpu: Add decode_iv_ts helper for ih_v6 block Was missing. Add it. Signed-off-by: Harish Kasiviswanathan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ca01eba4e5b6b50144a62d7704763c41b68a0de9 Author: Samson Tam Date: Mon Jul 25 14:04:26 2022 -0400 drm/amd/display: add chip revision to DCN32 [Why & How] Add GC_11_0_3_A0 as a chip revision to the DCN32 family Reviewed-by: Rodrigo Siqueira Acked-by: Brian Chang Signed-off-by: Samson Tam Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5544a7b5a07480192eb5fd3536462faed2c21528 Author: Charlene Liu Date: Fri Aug 5 12:59:47 2022 -0400 drm/amd/display: avoid doing vm_init multiple time [why] this is to ensure that driver will not reprogram hvm_prefetch_req again if it is done. Reviewed-by: Martin Leung Acked-by: Brian Chang Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c65c71ae85095f94aae32d86aa78811318bf6a90 Author: Alvin Lee Date: Sat Aug 6 12:00:26 2022 -0400 drm/amd/display: Use pitch when calculating size to cache in MALL [Description] Use pitch when calculating size to cache in MALL Reviewed-by: Samson Tam Acked-by: Brian Chang Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 31ec699ac5d8d17c4f696888708bb6b2567dfcd4 Author: Alvin Lee Date: Fri Aug 5 16:18:31 2022 -0400 drm/amd/display: Don't set DSC for phantom pipes [Description] Don't set DSC bit for phantom pipes, not required since phantom pipe don't have any actual output Reviewed-by: Jun Lei Acked-by: Brian Chang Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 19f7b8334484d6b610c8eb527c3f56cb42bc8bf1 Author: Nicholas Kazlauskas Date: Fri Aug 5 12:02:10 2022 -0400 drm/amd/display: Update clock table policy for DCN314 [Why & How] Depending on how the clock table is constructed from PMFW we can run into issues where we don't think we have enough bandwidth available due to FCLK too low - eg. when the FCLK table contains invalid entries or a single entry. We should always pick up the maximum clocks for each state as a final state in this case to prevent validation from failing if the table is malformed. We should also contain sensible defaults in the case where values are invalid. Redfine the clock table structures by adding a 314 prefix to make debugging these issues easier by avoiding symbol name clashes. Overall this policy more closely aligns to how we did things for 315, but because of how the voltage rail is setup we should favor keeping DCFCLK low rather than DISPCLK or DPPCLK - so use the max for those in every entry. Reviewed-by: Daniel Miess Acked-by: Brian Chang Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dd49c07f3ab67e8d7ae7b8231b88a746c668b4e8 Author: Chaitanya Dhere Date: Wed Jul 27 15:48:30 2022 -0400 drm/amd/display: Modify header inclusion pattern [Why] Recent backport from opensource broke the Nightly tool build that tests DC and DML for bugs and regressions. This was because the backport had a header inclusion that was not consistent with the AMD style of including headers was allowed to be merged back in DML code that caused tool compilation failures. [How] Modify the way in which the header file in included so that it is consistent with AMD style of including headers. This then automatically fixes the tool compilation process and also helps maintain the code quality and consistency. Reviewed-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Brian Chang Signed-off-by: Chaitanya Dhere Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e98459c06e3d45c2229b097f7b8cdd412357fa2f Author: Tom Chung Date: Wed Aug 3 15:15:17 2022 +0800 drm/amd/display: Fix plug/unplug external monitor will hang while playback MPO video [Why] Pipes for MPO primary and overlay will be power down and power up during plug/unplug external monitor while MPO video playback. But the pipes were the same after plug/unplug and should not need to be power down and power up or it will make page flip interrupt disabled and cause hang issue. [How] Add pipe split change condition that not only check the top pipe pointer but also check the index of top pipe if both top pipes are available. Reviewed-by: Sun peng Li Acked-by: Brian Chang Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d83a348b172dd7f9f10f049b3fd7e44cf4d2ed8a Author: Daniel Miess Date: Tue Aug 2 16:53:47 2022 -0400 drm/amd/display: Add debug parameter to retain default clock table [Why] Need a way to retain default clock table to aid the investigation into why 8k@30 display not lighting up on dcn314 [How] Use flag to prevent execution of bw_params helper function and function for updating bw_bounding_box Reviewed-by: Nicholas Kazlauskas Reviewed-by: Jun Lei Acked-by: Brian Chang Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 373008bfc9cdb0f050258947fa5a095f0657e1bc Author: Dusica Milinkovic Date: Wed Aug 10 09:43:15 2022 +0200 drm/amdgpu: Increase tlb flush timeout for sriov [Why] During multi-vf executing benchmark (Luxmark) observed kiq error timeout. It happenes because all of VFs do the tlb invalidation at the same time. Although each VF has the invalidate register set, from hardware side the invalidate requests are queue to execute. [How] In case of 12 VF increase timeout on 12*100ms Signed-off-by: Dusica Milinkovic Acked-by: Shaoyun Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit c7dafdfa90f708b6e4630abf824ba388a3947400 Author: Josip Pavic Date: Fri Jul 29 11:08:09 2022 -0400 drm/amd/display: do not compare integers of different widths [Why & How] Increase width of some variables to avoid comparing integers of different widths. Reviewed-by: Alvin Lee Acked-by: Brian Chang Signed-off-by: Josip Pavic Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5c1943820156e9a120faba320a72578578a69ab8 Author: Ian Chen Date: Tue Aug 2 15:13:37 2022 +0800 drm/amd/display: Add reserved dc_log_type. Reviewed-by: Anthony Koo Acked-by: Brian Chang Signed-off-by: Ian Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 04fb918bf421b299feaee1006e82921d7d381f18 Author: Ilya Bakoulin Date: Tue Jul 26 16:19:38 2022 -0400 drm/amd/display: Fix pixel clock programming [Why] Some pixel clock values could cause HDMI TMDS SSCPs to be misaligned between different HDMI lanes when using YCbCr420 10-bit pixel format. BIOS functions for transmitter/encoder control take pixel clock in kHz increments, whereas the function for setting the pixel clock is in 100Hz increments. Setting pixel clock to a value that is not on a kHz boundary will cause the issue. [How] Round pixel clock down to nearest kHz in 10/12-bpc cases. Reviewed-by: Aric Cyr Acked-by: Brian Chang Signed-off-by: Ilya Bakoulin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 84435d1d912140958213beda37c708ec3072b5e1 Author: Aric Cyr Date: Mon Aug 1 20:17:54 2022 -0400 drm/amd/display: 3.2.198 This version brings along following fixes: -Fix edp panel missing event -Set ARGB16161616 pixel format to 26 -Fix dcn32 interger issue -Clear optc underflow bit after ODM clock off -Fix issue with stereo3D -Fix DML2 lightup issue -Correct DTBCLK for dcn314 -Revert for a regression -Fix clocks and bugs in DML2 -Enable SubVP by defalut on DCN32 & DCN321 -Corret boundary condition for engin ID on DCN303 -Fix FRL encoder override registry key -Fix VPG for dcn314 HPO -Fix Linux compile-time warning -Add new prefetch modes in DML for DCN32 Acked-by: Brian Chang Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e0df49b3045180fdd23dc27193344a767cf68fe1 Author: Ethan Wellenreiter Date: Fri Jul 29 13:45:51 2022 -0400 drm/amd/display: reverted limiting vscsdp_for_colorimetry and ARGB16161616 pixel format addition [WHY] Limiting vscsdp_for_colorimetry for YCbCr420/BT2020 resulted in red/green point failures in HDR10 DTN tests. The re-implementation of ARGB16161616 was to fix this however it did not actually fix this issue but a side effect of the issue. [HOW] Change ARGB16161616 pixel format to 26. Reviewed-by: Martin Leung Acked-by: Brian Chang Signed-off-by: Ethan Wellenreiter Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5a0918b4cb90a90fc8d8bfd9b0f81efe6651951f Author: Tim Huang Date: Fri Aug 12 11:37:37 2022 +0800 drm/amd/pm: Enable GFXOFF feature for SMU IP v13.0.4 The driver needs to set EnableGfxImu message parameter to tell the PMFW to set the flag that enables the GFXOFF feature. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit fa0bbd3be91dd46f4e56e5cf1fb6e8c2837c649c Author: Tim Huang Date: Fri Jul 29 15:22:44 2022 +0800 drm/amdgpu: enable IH Clock Gating for OSS IP v6.0.1 Enable AMD_CG_SUPPORT_IH_CG support. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 7d50b92d588d1e7bdcf38f523200b7b113b46c14 Author: Dan Carpenter Date: Fri Aug 12 09:20:58 2022 +0300 drm/amdkfd: potential crash in kfd_create_indirect_link_prop() This code has two bugs. If kfd_topology_device_by_proximity_domain() failed on the first iteration through the loop then "cpu_link" is uninitialized and should not be dereferenced. The second bug is that we cannot dereference a list iterator when it points to the list head. In other words, if we exit the list_for_each_entry() loop exits without hitting a break then "cpu_link" is not a valid pointer and should not be dereferenced. Fix both of these problems by setting "cpu_link" to NULL when it is invalid and non-NULL when it is valid. That makes it easier to test for valid vs invalid. Fixes: 0f28cca87e9a ("drm/amdkfd: Extend KFD device topology to surface peer-to-peer links") Signed-off-by: Dan Carpenter Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit e48e6a131d34de54ce6852149e4c97c2208f45cc Author: Yifan Zhang Date: Wed Aug 10 22:09:36 2022 +0800 drm/amdkfd: reserve 2 queues for sdma 6.0.1 in bitmap There is only one engine in sdma 6.0.1, the total number of reserved queues should be 2, reflect this number in bitmap as well. Signed-off-by: Yifan Zhang Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 8e78c7c4fe29f7ab8f87634c5f4dedc66107e66b Author: Tim Huang Date: Fri Jul 29 15:21:08 2022 +0800 drm/amdgpu: enable ATHUB IP v3.0.1 Clock Gating Enable AMD_CG_SUPPORT_ATHUB_MGCG and AMD_CG_SUPPORT_ATHUB_LS support. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 7e4a77de08f655e159e6355bdfbea73be71fab88 Author: Tim Huang Date: Fri Jul 29 15:18:10 2022 +0800 drm/amdgpu: enable HDP IP v5.2.1 Clock Gating Enable AMD_CG_SUPPORT_HDP_MGCG and AMD_CG_SUPPORT_HDP_LS support. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit adcd15dc47dadfb176a14fa74af5b0cb0f659f2d Author: Tim Huang Date: Fri Jul 29 15:13:03 2022 +0800 drm/amdgpu: enable MMHUB IP v3.0.1 Clock Gating Enable AMD_CG_SUPPORT_MC_MGCG and AMD_CG_SUPPORT_MC_LS support. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cede849e9e2755084798236735d045298f9d9979 Author: Tim Huang Date: Tue Aug 9 16:26:05 2022 +0800 drm/amdgpu: add ATHUB IP v3.0.1 Clock Gating support Add ATHUB IP v3.0.1 in athub_v3_0_set_clockgating. The regATHUB_MISC_CNTL has different offset for ATHUB IP v3.0.1, so need to add IP version checking to use the right REG offset. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 73c49a624a8db1ec38b138741203d9d7c76eedd7 Author: Tim Huang Date: Tue Aug 9 18:59:49 2022 +0800 drm/amdgpu: add HDP IP v5.2.1 Clock Gating support Add set/get_clockgating for HDP IP v5.2.1. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8172cebac588c3c5e238d02be30914fbbc5b1234 Author: Tim Huang Date: Tue Aug 9 17:46:39 2022 +0800 drm/amdgpu: add MMHUB IP v3.0.1 Clock Gating support Add set/get_clockgating for MMHUB IP v3.0.1. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit c8007d362c0150aef34323702e7fa996fa0cfd8d Author: Tim Huang Date: Tue Aug 9 14:42:46 2022 +0800 drm/amd/pm: update the smu driver interface version for SMU IP v13.0.4 The pmfw has changed the driver interface version, so keep same with the fw. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit c02895577b834a6148f6d9d0006a6f196511cc79 Author: Felix Kuehling Date: Mon Aug 8 17:00:38 2022 -0400 drm/amdkfd: Fix mm reference in SVM eviction worker Use the mm reference from the fence. This allows removing the svm_bo->svms pointer, which was problematic because we cannot assume that the struct kfd_process containing the svms is still allocated without holding a refcount on the process. Use mmget_not_zero to ensure the mm is still valid, and drop the svm_bo reference if it isn't. Signed-off-by: Felix Kuehling Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit ea8793f214ce1e4db205390c0241955f7ff6f383 Author: Kenneth Feng Date: Thu Aug 11 16:38:52 2022 +0800 drm/amd/pm: add mode1 support on smu_v13_0_7 add mode1 support since it's missing on smu_v13_0_7 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit b4ddb27d1dc7349fc882dbb7702bd2628fe27af6 Author: Kenneth Feng Date: Thu Aug 11 09:48:00 2022 +0800 drm/amd/amdgpu: add ih cg and hdp sd on smu_v13_0_7 add ih cg and hdp sd on smu_v13_0_7 Signed-off-by: Kenneth Feng Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4bac1c846eff8042dd59ddecd0a43f3b9de5fd23 Author: Evan Quan Date: Wed Aug 10 11:11:16 2022 +0800 drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics Without these, potential memory leak may be induced. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 0a2d922a5618377cdf8fa476351362733ef55342 Author: Evan Quan Date: Wed Aug 10 11:08:31 2022 +0800 drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid To avoid any potential memory leak. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1b586595df6d04c27088ef348b8202204ce26d45 Author: Evan Quan Date: Wed Aug 3 16:13:56 2022 +0800 drm/amdgpu: disable 3DCGCG/CGLS temporarily due to stability issue Some stability issues were reported with these features. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 012e8d2034f1bda8863435cd589636e618d6a659 Author: Andrew Donnellan Date: Tue Aug 16 15:17:20 2022 +1000 gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file Commit 36d4b36b6959 ("lib/nodemask: inline next_node_in() and node_random()") refactored some code by moving node_random() from lib/nodemask.c to include/linux/nodemask.h, thus requiring nodemask.h to include random.h, which conditionally defines add_latent_entropy() depending on whether the macro LATENT_ENTROPY_PLUGIN is defined. This broke the build on powerpc, where nodemask.h is indirectly included in arch/powerpc/kernel/prom_init.c, part of the early boot machinery that is excluded from the latent entropy plugin using DISABLE_LATENT_ENTROPY_PLUGIN. It turns out that while we add a gcc flag to disable the actual plugin, we don't undefine LATENT_ENTROPY_PLUGIN. This leads to the following: CC arch/powerpc/kernel/prom_init.o In file included from ./include/linux/nodemask.h:97, from ./include/linux/mmzone.h:17, from ./include/linux/gfp.h:7, from ./include/linux/xarray.h:15, from ./include/linux/radix-tree.h:21, from ./include/linux/idr.h:15, from ./include/linux/kernfs.h:12, from ./include/linux/sysfs.h:16, from ./include/linux/kobject.h:20, from ./include/linux/pci.h:35, from arch/powerpc/kernel/prom_init.c:24: ./include/linux/random.h: In function 'add_latent_entropy': ./include/linux/random.h:25:46: error: 'latent_entropy' undeclared (first use in this function); did you mean 'add_latent_entropy'? 25 | add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); | ^~~~~~~~~~~~~~ | add_latent_entropy ./include/linux/random.h:25:46: note: each undeclared identifier is reported only once for each function it appears in make[2]: *** [scripts/Makefile.build:249: arch/powerpc/kernel/prom_init.o] Fehler 1 make[1]: *** [scripts/Makefile.build:465: arch/powerpc/kernel] Fehler 2 make: *** [Makefile:1855: arch/powerpc] Error 2 Change the DISABLE_LATENT_ENTROPY_PLUGIN flags to undefine LATENT_ENTROPY_PLUGIN for files where the plugin is disabled. Cc: Yury Norov Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216367 Link: https://lore.kernel.org/linuxppc-dev/alpine.DEB.2.22.394.2208152006320.289321@ramsan.of.borg/ Reported-by: Erhard Furtner Signed-off-by: Andrew Donnellan Reviewed-by: Yury Norov Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220816051720.44108-1-ajd@linux.ibm.com commit 6a3981af3fd97fec57f2c5eeca213cbf5216a3c0 Author: Kees Cook Date: Tue Aug 16 12:14:54 2022 -0700 LoadPin: Return EFAULT on copy_from_user() failures The copy_from_user() function returns the number of bytes remaining to be copied on a failure. Such failures should return -EFAULT to high levels. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 3f805f8cc23b ("LoadPin: Enable loading from trusted dm-verity devices") Cc: Matthias Kaehlcke Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.org Signed-off-by: Kees Cook commit 3a608cfee97e99b3fff9ffe62246a098042e725d Author: Fabio M. De Francesco Date: Wed Aug 3 20:28:56 2022 +0200 exec: Replace kmap{,_atomic}() with kmap_local_page() The use of kmap() and kmap_atomic() are being deprecated in favor of kmap_local_page(). There are two main problems with kmap(): (1) It comes with an overhead as mapping space is restricted and protected by a global lock for synchronization and (2) it also requires global TLB invalidation when the kmap’s pool wraps and it might block when the mapping space is fully utilized until a slot becomes available. With kmap_local_page() the mappings are per thread, CPU local, can take page faults, and can be called from any context (including interrupts). It is faster than kmap() in kernels with HIGHMEM enabled. Furthermore, the tasks can be preempted and, when they are scheduled to run again, the kernel virtual addresses are restored and are still valid. Since the use of kmap_local_page() in exec.c is safe, it should be preferred everywhere in exec.c. As said, since kmap_local_page() can be also called from atomic context, and since remove_arg_zero() doesn't (and shouldn't ever) rely on an implicit preempt_disable(), this function can also safely replace kmap_atomic(). Therefore, replace kmap() and kmap_atomic() with kmap_local_page() in fs/exec.c. Tested with xfstests on a QEMU/KVM x86_32 VM, 6GB RAM, booting a kernel with HIGHMEM64GB enabled. Cc: Eric W. Biederman Suggested-by: Ira Weiny Reviewed-by: Ira Weiny Signed-off-by: Fabio M. De Francesco Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220803182856.28246-1-fmdefrancesco@gmail.com commit 3cc40a443a04d52b0c95255dce264068b01e9bfe Merge: 339800d50b411 fd0c153daad13 Author: Linus Torvalds Date: Tue Aug 16 11:42:11 2022 -0700 Merge tag 'nios2_fixes_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 fixes from Dinh Nguyen: - Security fixes from Al Viro * tag 'nios2_fixes_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: add force_successful_syscall_return() nios2: restarts apply only to the first sigframe we build... nios2: fix syscall restart checks nios2: traced syscall does need to check the syscall number nios2: don't leave NULLs in sys_call_table[] nios2: page fault et.al. are *not* restartable syscalls... commit 339800d50b411d617fb3298d478921e6626032e7 Merge: 15df6486ae56f 2fd92c7b8fe2c Author: Linus Torvalds Date: Tue Aug 16 11:40:15 2022 -0700 Merge tag 'spi-fix-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few fixes that came in since my pull request, the Meson fix is a little large since it's fixing all possible cases of the problem that was observed with the driver and clock API trying to share configuration by integrating the device clocking fully with the clock API rather than spot fixing the one instance that was observed" * tag 'spi-fix-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: Drop Pratyush Yadav spi: meson-spicc: add local pow2 clock ops to preserve rate between messages MAINTAINERS: rectify entry for ARM/HPE GXP ARCHITECTURE spi: spi.c: Add missing __percpu annotations in users of spi_statistics commit 15df6486ae56f259650159340a495406f427b2ea Merge: c4e34dd99f2e3 d511e8a7e850d Author: Linus Torvalds Date: Tue Aug 16 11:36:38 2022 -0700 Merge tag 'regulator-fix-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small fixes that came in since my pull request, nothing major here" * tag 'regulator-fix-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Fix missing error return from regulator_bulk_get() regulator: pca9450: Remove restrictions for regulator-name commit c4e34dd99f2e3fdfc63584078ce0fed20f4e7386 Author: Linus Torvalds Date: Sun Aug 14 14:16:13 2022 -0700 x86: simplify load_unaligned_zeropad() implementation The exception for the "unaligned access at the end of the page, next page not mapped" never happens, but the fixup code ends up causing trouble for compilers to optimize well. clang in particular ends up seeing it being in the middle of a loop, and tries desperately to optimize the exception fixup code that is never really reached. The simple solution is to just move all the fixups into the exception handler itself, which moves it all out of the hot case code, and means that the compiler never sees it or needs to worry about it. Acked-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit 2f945a792f67815abca26fa8a5e863ccf3fa1181 Author: Sergey Shtylyov Date: Sat Aug 13 23:34:16 2022 +0300 of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") Signed-off-by: Sergey Shtylyov Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru commit c0feea594e058223973db94c1c32a830c9807c86 Author: Tetsuo Handa Date: Fri Jul 29 13:30:23 2022 +0900 workqueue: don't skip lockdep work dependency in cancel_work_sync() Like Hillf Danton mentioned syzbot should have been able to catch cancel_work_sync() in work context by checking lockdep_map in __flush_work() for both flush and cancel. in [1], being unable to report an obvious deadlock scenario shown below is broken. From locking dependency perspective, sync version of cancel request should behave as if flush request, for it waits for completion of work if that work has already started execution. ---------- #include #include static DEFINE_MUTEX(mutex); static void work_fn(struct work_struct *work) { schedule_timeout_uninterruptible(HZ / 5); mutex_lock(&mutex); mutex_unlock(&mutex); } static DECLARE_WORK(work, work_fn); static int __init test_init(void) { schedule_work(&work); schedule_timeout_uninterruptible(HZ / 10); mutex_lock(&mutex); cancel_work_sync(&work); mutex_unlock(&mutex); return -EINVAL; } module_init(test_init); MODULE_LICENSE("GPL"); ---------- The check this patch restores was added by commit 0976dfc1d0cd80a4 ("workqueue: Catch more locking problems with flush_work()"). Then, lockdep's crossrelease feature was added by commit b09be676e0ff25bd ("locking/lockdep: Implement the 'crossrelease' feature"). As a result, this check was once removed by commit fd1a5b04dfb899f8 ("workqueue: Remove now redundant lock acquisitions wrt. workqueue flushes"). But lockdep's crossrelease feature was removed by commit e966eaeeb623f099 ("locking/lockdep: Remove the cross-release locking checks"). At this point, this check should have been restored. Then, commit d6e89786bed977f3 ("workqueue: skip lockdep wq dependency in cancel_work_sync()") introduced a boolean flag in order to distinguish flush_work() and cancel_work_sync(), for checking "struct workqueue_struct" dependency when called from cancel_work_sync() was causing false positives. Then, commit 87915adc3f0acdf0 ("workqueue: re-add lockdep dependencies for flushing") tried to restore "struct work_struct" dependency check, but by error checked this boolean flag. Like an example shown above indicates, "struct work_struct" dependency needs to be checked for both flush_work() and cancel_work_sync(). Link: https://lkml.kernel.org/r/20220504044800.4966-1-hdanton@sina.com [1] Reported-by: Hillf Danton Suggested-by: Lai Jiangshan Fixes: 87915adc3f0acdf0 ("workqueue: re-add lockdep dependencies for flushing") Cc: Johannes Berg Signed-off-by: Tetsuo Handa Signed-off-by: Tejun Heo commit 415d832497098030241605c52ea83d4e2cfa7879 Author: Hector Martin Date: Tue Aug 16 16:03:11 2022 +0900 locking/atomic: Make test_and_*_bit() ordered on failure These operations are documented as always ordered in include/asm-generic/bitops/instrumented-atomic.h, and producer-consumer type use cases where one side needs to ensure a flag is left pending after some shared data was updated rely on this ordering, even in the failure case. This is the case with the workqueue code, which currently suffers from a reproducible ordering violation on Apple M1 platforms (which are notoriously out-of-order) that ends up causing the TTY layer to fail to deliver data to userspace properly under the right conditions. This change fixes that bug. Change the documentation to restrict the "no order on failure" story to the _lock() variant (for which it makes sense), and remove the early-exit from the generic implementation, which is what causes the missing barrier semantics in that case. Without this, the remaining atomic op is fully ordered (including on ARM64 LSE, as of recent versions of the architecture spec). Suggested-by: Linus Torvalds Cc: stable@vger.kernel.org Fixes: e986a0d6cb36 ("locking/atomics, asm-generic/bitops/atomic.h: Rewrite using atomic_*() APIs") Fixes: 61e02392d3c7 ("locking/atomic/bitops: Document and clarify ordering semantics for failed test_and_{}_bit()") Signed-off-by: Hector Martin Acked-by: Will Deacon Reviewed-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit 57c942bc3bef0970f0b21f8e0998e76a900ea80d Author: Alan Brady Date: Tue Aug 2 10:19:17 2022 +0200 i40e: Fix to stop tx_timeout recovery if GLOBR fails When a tx_timeout fires, the PF attempts to recover by incrementally resetting. First we try a PFR, then CORER and finally a GLOBR. If the GLOBR fails, then we keep hitting the tx_timeout and incrementing the recovery level and issuing dmesgs, which is both annoying to the user and accomplishes nothing. If the GLOBR fails, then we're pretty much totally hosed, and there's not much else we can do to recover, so this makes it such that we just kill the VSI and stop hitting the tx_timeout in such a case. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Alan Brady Signed-off-by: Mateusz Palczewski Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 2c6482091f01ba104cf8ee549aa5c717e80d43ea Author: Przemyslaw Patynowski Date: Wed Jul 27 11:19:40 2022 +0200 i40e: Fix tunnel checksum offload with fragmented traffic Fix checksum offload on VXLAN tunnels. In case, when mpls protocol is not used, set l4 header to transport header of skb. This fixes case, when user tries to offload checksums of VXLAN tunneled traffic. Steps for reproduction (requires link partner with tunnels): ip l s enp130s0f0 up ip a f enp130s0f0 ip a a 10.10.110.2/24 dev enp130s0f0 ip l s enp130s0f0 mtu 1600 ip link add vxlan12_sut type vxlan id 12 group 238.168.100.100 dev \ enp130s0f0 dstport 4789 ip l s vxlan12_sut up ip a a 20.10.110.2/24 dev vxlan12_sut iperf3 -c 20.10.110.1 #should connect Without this patch, TX descriptor was using wrong data, due to l4 header pointing wrong address. NIC would then drop those packets internally, due to incorrect TX descriptor data, which increased GLV_TEPC register. Fixes: b4fb2d33514a ("i40e: Add support for MPLS + TSO") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Mateusz Palczewski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit b16de8b9e7d1aae169d059c3a0dd9a881a3c0d1d Author: Jason Gunthorpe Date: Tue Aug 16 11:03:20 2022 -0300 RDMA: Handle the return code from dma_resv_wait_timeout() properly ib_umem_dmabuf_map_pages() returns 0 on success and -ERRNO on failure. dma_resv_wait_timeout() uses a different scheme: * Returns -ERESTARTSYS if interrupted, 0 if the wait timed out, or * greater than zero on success. This results in ib_umem_dmabuf_map_pages() being non-functional as a positive return will be understood to be an error by drivers. Fixes: f30bceab16d1 ("RDMA: use dma_resv_wait() instead of extracting the fence") Cc: stable@kernel.org Link: https://lore.kernel.org/r/0-v1-d8f4e1fa84c8+17-rdma_dmabuf_fix_jgg@nvidia.com Tested-by: Maor Gottlieb Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 6cd8351c4ede5b3335c7eb13d009c3456e90b6df Author: Cheng Xu Date: Wed Aug 10 09:43:19 2022 +0800 RDMA/erdma: Correct the max_qp and max_cq capacities of the device QP0 in HW is used for CMDQ, and the rest is for RDMA QPs. So the actual max_qp capacity reported to core should be max_qp (reported by HW) - 1. So does max_cq. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Link: https://lore.kernel.org/all/20220810014320.88026-1-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Leon Romanovsky commit e01f5c8d6af231b3b09e23c1fe8a4057cdcc4e42 Author: Larry Finger Date: Sun Aug 14 12:50:27 2022 -0500 staging: r8188eu: Add Rosewill USB-N150 Nano to device tables This device is reported as using the RTL8188EUS chip. It has the improbable USB ID of 0bda:ffef, which normally would belong to Realtek, but this ID works for the reporter. Signed-off-by: Larry Finger Cc: stable Link: https://lore.kernel.org/r/20220814175027.2689-1-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 1374901b850c8f2ff1ee0e62ffafbc4030572fc6 Author: Cheng Xu Date: Wed Aug 10 09:43:20 2022 +0800 RDMA/erdma: Using the key in FMR WR instead of MR structure RDMA driver should get the MR key from FMR WR, not the MR structure passed in. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Link: https://lore.kernel.org/r/20220810014320.88026-2-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Leon Romanovsky commit b2fa9e13bbf101c662c4cd974608242a0db98cfc Author: Grzegorz Szymaszek Date: Tue Aug 2 19:18:44 2022 +0200 staging: r8188eu: add firmware dependency The old rtl8188eu module, removed in commit 55dfa29b43d2 ("staging: rtl8188eu: remove rtl8188eu driver from staging dir") (Linux kernel v5.15-rc1), required (through a MODULE_FIRMWARE call()) the rtlwifi/rtl8188eufw.bin firmware file, which the new r8188eu driver no longer requires. I have tested a few RTL8188EUS-based Wi-Fi cards and, while supported by both drivers, they do not work when using the new one and the firmware wasn't manually loaded. According to Larry Finger, the module maintainer, all such cards need the firmware and the driver should depend on it (see the linked mails). Add a proper MODULE_FIRMWARE() call, like it was done in the old driver. Thanks to Greg Kroah-Hartman and Larry Finger for quick responses to my questions. Cc: stable Link: https://answers.launchpad.net/ubuntu/+source/linux-meta-hwe-5.15/+question/702611 Link: https://lore.kernel.org/lkml/YukkBu3TNODO3or9@nx64de-df6d00/ Signed-off-by: Grzegorz Szymaszek Link: https://lore.kernel.org/r/YulcdKfhA8dPQ78s@nx64de-df6d00 Acked-by: Phillip Potter Acked-by: Larry Finger Signed-off-by: Greg Kroah-Hartman commit 70cfdd0365acf550350d8949096c0b34a96b6b48 Author: Takashi Iwai Date: Tue Aug 16 15:21:32 2022 +0200 ALSA: hda/realtek: Add quirk for Lenovo Yoga7 14IAL7 Lenovo Yoga7 14IAL7 requires the same quirk as Lenovo Yoga9 14IAP7 for fixing the bass speaker problems. Reported-by: Pascal Gross Cc: Link: https://lore.kernel.org/r/N9_CjBz--3-2@tutanota.com Link: https://lore.kernel.org/r/20220816132132.15520-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit ef0162298abf46b881e4a4d0c604d1a066228647 Author: Potnuri Bharat Teja Date: Wed Aug 10 00:11:18 2022 +0530 RDMA/cxgb4: fix accept failure due to increased cpl_t5_pass_accept_rpl size Commit 'c2ed5611afd7' has increased the cpl_t5_pass_accept_rpl{} structure size by 8B to avoid roundup. cpl_t5_pass_accept_rpl{} is a HW specific structure and increasing its size will lead to unwanted adapter errors. Current commit reverts the cpl_t5_pass_accept_rpl{} back to its original and allocates zeroed skb buffer there by avoiding the memset for iss field. Reorder code to minimize chip type checks. Fixes: c2ed5611afd7 ("iw_cxgb4: Use memset_startat() for cpl_t5_pass_accept_rpl") Link: https://lore.kernel.org/r/20220809184118.2029-1-rahul.lakkireddy@chelsio.com Signed-off-by: Potnuri Bharat Teja Signed-off-by: Rahul Lakkireddy Reviewed-by: Kees Cook Signed-off-by: Leon Romanovsky commit 4b83c3caf289b80acecc539c79f10a6937cc42dd Author: Mark Bloch Date: Mon Aug 8 10:48:06 2022 +0300 RDMA/mlx5: Use the proper number of ports The cited commit allowed the driver to operate over HCAs that have 4 physical ports. Use the number of ports of the RDMA device in the for loop instead of using the struct size. Fixes: 4cd14d44b11d ("net/mlx5: Support devices with more than 2 ports") Link: https://lore.kernel.org/r/a54a56c2ede16044a29d119209b35189c662ac72.1659944855.git.leonro@nvidia.com Signed-off-by: Mark Bloch Signed-off-by: Leon Romanovsky commit 4d4c4bff4f8ed79d95e0592aed6c6144d558a236 Author: Stefan Binding Date: Mon Aug 15 17:29:06 2022 +0100 ALSA: hda: cs35l41: Clarify support for CSC3551 without _DSD Properties For devices which use HID CSC3551, correct ACPI _DSD properties are required to be able support those systems. Add error message to clarify this. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20220815162906.463108-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 25a3b959577953b3a441bb88e66ca8eaee46cc61 Merge: 461122b999bda b4b5f29a076e5 Author: Takashi Iwai Date: Tue Aug 16 15:07:55 2022 +0200 Merge tag 'asoc-fix-v6.0-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.0 A relatively large batch of fixes that came in since my pull request, none of them too major and mostly device specific apart from a series of security/robustness improvements from Takashi. commit d6d142cb7f79bec6051c5ecf744b7a5309c5a0ee Author: Sergey Gorenko Date: Fri Aug 5 09:01:35 2022 +0300 IB/iser: Fix login with authentication The iSER Initiator uses two types of receive buffers: - one big login buffer posted by iser_post_recvl(); - several small message buffers posted by iser_post_recvm(). The login buffer is used at the login phase and full feature phase in the discovery session. It may take a few requests and responses to complete the login phase. The message buffers are only used in the normal operational session at the full feature phase. After the commit referred in the fixes line, the login operation fails if the authentication is enabled. That happens because the Initiator posts a small receive buffer after the first response from Target. So, the next send operation fails because Target's second response does not fit into the small receive buffer. This commit adds additional checks to prevent posting small receive buffers until the full feature phase. Fixes: 39b169ea0d36 ("IB/iser: Fix RNR errors") Link: https://lore.kernel.org/r/20220805060135.18493-1-sergeygo@nvidia.com Signed-off-by: Sergey Gorenko Reviewed-by: Max Gurtovoy Signed-off-by: Leon Romanovsky commit e6190dd0031d335c22586d34ef898301ed20f230 Author: ZiyangZhang Date: Mon Aug 15 10:36:33 2022 +0800 ublk_drv: do not add a re-issued request aborted previously to ioucmd's task_work In ublk_queue_rq(), Assume current request is a re-issued request aborted previously in monitor_work because the ubq_daemon(ioucmd's task) is PF_EXITING. For this request, we cannot call io_uring_cmd_complete_in_task() anymore because at that moment io_uring context may be freed in case that no inflight ioucmd exists. Otherwise, we may cause null-deref in ctx->fallback_work. Add a check on UBLK_IO_FLAG_ABORTED to prevent the above situation. This check is safe and makes sense. Note: monitor_work sets UBLK_IO_FLAG_ABORTED and ends this request (releasing the tag). Then the request is restarted(allocating the tag) and we are here. Since releasing/allocating a tag implies smp_mb(), finding UBLK_IO_FLAG_ABORTED guarantees that here is a re-issued request aborted previously. Suggested-by: Ming Lei Signed-off-by: ZiyangZhang Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220815023633.259825-4-ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit bb24174754afc5a7d185ca5406dcfbc608cdf157 Author: ZiyangZhang Date: Mon Aug 15 10:36:32 2022 +0800 ublk_drv: update comment for __ublk_fail_req() Since __ublk_rq_task_work always fails requests immediately during exiting, __ublk_fail_req() is only called from abort context during exiting. So lock is unnecessary. Signed-off-by: ZiyangZhang Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220815023633.259825-3-ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit 966120b51a245c9ff5857c5b169310c248e0ae87 Author: ZiyangZhang Date: Mon Aug 15 10:36:31 2022 +0800 ublk_drv: check ubq_daemon_is_dying() in __ublk_rq_task_work() Replace direct check on PF_EXITING in __ublk_rq_task_work() by the existing wrapper. Also inline ubq_daemon_is_dying(). Reviewed-by: Ming Lei Signed-off-by: ZiyangZhang Link: https://lore.kernel.org/r/20220815023633.259825-2-ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit dcdfa3471f9c28ee716c687d85701353e2e86fde Author: Pieterjan Camerlynck Date: Sat Aug 13 10:33:52 2022 +0200 ASoC: fsl_sai: fix incorrect mclk number in error message In commit c3ecef21c3f26 ("ASoC: fsl_sai: add sai master mode support") the loop was changed to start iterating from 1 instead of 0. The error message however was not updated, reporting the wrong clock to the user. Signed-off-by: Pieterjan Camerlynck Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20220813083353.8959-1-pieterjan.camerlynck@gmail.com Signed-off-by: Mark Brown commit 5b9f0c4df1c1152403c738373fb063e9ffdac0a1 Author: Juergen Gross Date: Tue Aug 16 09:11:37 2022 +0200 x86/entry: Fix entry_INT80_compat for Xen PV guests Commit c89191ce67ef ("x86/entry: Convert SWAPGS to swapgs and remove the definition of SWAPGS") missed one use case of SWAPGS in entry_INT80_compat(). Removing of the SWAPGS macro led to asm just using "swapgs", as it is accepting instructions in capital letters, too. This in turn leads to splats in Xen PV guests like: [ 36.145223] general protection fault, maybe for address 0x2d: 0000 [#1] PREEMPT SMP NOPTI [ 36.145794] CPU: 2 PID: 1847 Comm: ld-linux.so.2 Not tainted 5.19.1-1-default #1 \ openSUSE Tumbleweed f3b44bfb672cdb9f235aff53b57724eba8b9411b [ 36.146608] Hardware name: HP ProLiant ML350p Gen8, BIOS P72 11/14/2013 [ 36.148126] RIP: e030:entry_INT80_compat+0x3/0xa3 Fix that by open coding this single instance of the SWAPGS macro. Fixes: c89191ce67ef ("x86/entry: Convert SWAPGS to swapgs and remove the definition of SWAPGS") Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov Reviewed-by: Jan Beulich Cc: # 5.19 Link: https://lore.kernel.org/r/20220816071137.4893-1-jgross@suse.com commit 5c669c4a4c6aa0489848093c93b8029f5c5c75ec Author: Ricardo Cañuelo Date: Wed Aug 10 11:40:03 2022 +0200 virtio: kerneldocs fixes and enhancements Fix variable names in some kerneldocs, naming in others. Add kerneldocs for struct vring_desc and vring_interrupt. Signed-off-by: Ricardo Cañuelo Message-Id: <20220810094004.1250-2-ricardo.canuelo@collabora.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Cornelia Huck commit 9993a4f989c7ca5e227329b2878f65d05c9fc20f Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:58 2022 -0400 virtio: Revert "virtio: find_vqs() add arg sizes" This reverts commit a10fba0377145fccefea4dc4dd5915b7ed87e546: the proposed API isn't supported on all transports but no effort was made to address this. It might not be hard to fix if we want to: maybe just rename size to size_hint and make sure legacy transports ignore the hint. But it's not sure what the benefit is in any case, so let's drop it. Fixes: a10fba037714 ("virtio: find_vqs() add arg sizes") Signed-off-by: Michael S. Tsirkin Message-Id: <20220816053602.173815-8-mst@redhat.com> commit 9e82eb574c5d90a175ae830916af8b8a1ccc31e7 Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:45 2022 -0400 virtio_vdpa: Revert "virtio_vdpa: support the arg sizes of find_vqs()" This reverts commit 99e8927d8a4da8eb8a8a5904dc13a3156be8e7c0: proposed API isn't supported on all transports but no effort was made to address this. It might not be hard to fix if we want to: maybe just rename size to size_hint and make sure legacy transports ignore the hint. But it's not sure what the benefit is in any case, so let's drop it. Fixes: 99e8927d8a4d ("virtio_vdpa: support the arg sizes of find_vqs()") Signed-off-by: Michael S. Tsirkin Message-Id: <20220816053602.173815-6-mst@redhat.com> commit 13aa8c6c37bd54eaf16f89e2e07019796fb9e681 Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:40 2022 -0400 virtio_pci: Revert "virtio_pci: support the arg sizes of find_vqs()" This reverts commit cdb44806fca2d0ad29ca644cbf1505433902ee0c: the legacy path is wrong and in fact can not support the proposed API since for a legacy device we never communicate the vq size to the hypervisor. Reported-by: Andres Freund Fixes: cdb44806fca2 ("virtio_pci: support the arg sizes of find_vqs()") Signed-off-by: Michael S. Tsirkin Message-Id: <20220816053602.173815-5-mst@redhat.com> commit c62f61b58f6e41cab9c07557213b61d71e6b221c Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:35 2022 -0400 virtio-mmio: Revert "virtio_mmio: support the arg sizes of find_vqs()" This reverts commit fbed86abba6e0472d98079790e58060e4332608a. The API is now unused, let's not carry dead code around. Fixes: fbed86abba6e ("virtio_mmio: support the arg sizes of find_vqs()") Signed-off-by: Michael S. Tsirkin Message-Id: <20220816053602.173815-4-mst@redhat.com> commit 484b9fa4886bd9377969aad5e9ea17efda4ecda6 Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:31 2022 -0400 virtio: Revert "virtio: add helper virtio_find_vqs_ctx_size()" This reverts commit fe3dc04e31aa51f91dc7f741a5f76cc4817eb5b4: the API is now unused and in fact can't be implemented on top of a legacy device. Fixes: fe3dc04e31aa ("virtio: add helper virtio_find_vqs_ctx_size()") Cc: "Xuan Zhuo" Signed-off-by: Michael S. Tsirkin Message-Id: <20220816053602.173815-3-mst@redhat.com> commit 2e9ca760c289e1f992eb2cd053e217db7934ab0a Author: Michael S. Tsirkin Date: Tue Aug 16 01:36:27 2022 -0400 virtio_net: Revert "virtio_net: set the default max ring size by find_vqs()" This reverts commit 762faee5a2678559d3dc09d95f8f2c54cd0466a7. This has been reported to trip up guests on GCP (Google Cloud). The reason is that virtio_find_vqs_ctx_size is broken on legacy devices. We can in theory fix virtio_find_vqs_ctx_size but in fact the patch itself has several other issues: - It treats unknown speed as < 10G - It leaves userspace no way to find out the ring size set by hypervisor - It tests speed when link is down - It ignores the virtio spec advice: Both \field{speed} and \field{duplex} can change, thus the driver is expected to re-read these values after receiving a configuration change notification. - It is not clear the performance impact has been tested properly Revert the patch for now. Reported-by: Andres Freund Link: https://lore.kernel.org/r/20220814212610.GA3690074%40roeck-us.net Link: https://lore.kernel.org/r/20220815070203.plwjx7b3cyugpdt7%40awork3.anarazel.de Link: https://lore.kernel.org/r/3df6bb82-1951-455d-a768-e9e1513eb667%40www.fastmail.com Link: https://lore.kernel.org/r/FCDC5DDE-3CDD-4B8A-916F-CA7D87B547CE%40anarazel.de Fixes: 762faee5a267 ("virtio_net: set the default max ring size by find_vqs()") Cc: Xuan Zhuo Cc: Jason Wang Signed-off-by: Michael S. Tsirkin Tested-by: Andres Freund Tested-by: Guenter Roeck Message-Id: <20220816053602.173815-2-mst@redhat.com> commit d36cb843e456324d6e725f1d8b440c4645a52d0d Author: Christophe JAILLET Date: Mon Aug 15 14:44:37 2022 +0200 OPP: Fix an un-initialized variable usage smatch complains that 'ret' may be returned un-initialized. Explicitly return 0 if we reach the end of the function (should 'opp_table->clk_count' be 0). Fixes: 8174a3a613af ("OPP: Provide a simple implementation to configure multiple clocks") Signed-off-by: Christophe JAILLET Signed-off-by: Viresh Kumar commit 5993000dc6b31b927403cee65fbc5f9f070fa3e4 Author: Pavel Begunkov Date: Mon Aug 15 13:42:02 2022 +0100 io_uring/notif: raise limit on notification slots 1024 notification slots is rather an arbitrary value, raise it up, everything is accounted to memcg. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/eb78a0a5f2fa5941f8e845cdae5fb399bf7ba0be.1660566179.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 86dc8f23bb1b68262ca5db890ec7177b2d074640 Author: Pavel Begunkov Date: Mon Aug 15 13:42:01 2022 +0100 io_uring/net: improve zc addr import error handling We may account memory to a memcg of a request that didn't even got to the network layer. It's not a bug as it'll be routinely cleaned up on flush, but it might be confusing for the userspace. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b8aae61f4c3ddc4da97c1da876bb73871f352d50.1660566179.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 063604265f967e90901996a1b173fe6df582d350 Author: Pavel Begunkov Date: Mon Aug 15 13:42:00 2022 +0100 io_uring/net: use right helpers for async recycle We have a helper that checks for whether a request contains anything in ->async_data or not, namely req_has_async_data(). It's better to use it as it might have some extra considerations. Fixes: 43e0bbbd0b0e3 ("io_uring: add netmsg cache") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b7414da4e7c3c32c31fc02dfd1355af4ccf4ca5f.1660566179.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ae806c7805571a9813e41bf6763dd08d0706f4ed Merge: 5b22f62724a0a cbe9e51126305 Author: Jakub Kicinski Date: Mon Aug 15 20:14:39 2022 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-08-12 (iavf) This series contains updates to iavf driver only. Przemyslaw frees memory for admin queues in initialization error paths, prevents freeing of vf_res which is causing null pointer dereference, and adjusts calls in error path of reset to avoid iavf_close() which could cause deadlock. Ivan Vecera avoids deadlock that can occur when driver if part of failover. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: Fix deadlock in initialization iavf: Fix reset error handling iavf: Fix NULL pointer dereference in iavf_get_link_ksettings iavf: Fix adminq error handling ==================== Link: https://lore.kernel.org/r/20220812172309.853230-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5b22f62724a0a09e00d301abf5b57b0c12be8a16 Author: Zhengchao Shao Date: Mon Aug 15 10:46:29 2022 +0800 net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg When bulk delete command is received in the rtnetlink_rcv_msg function, if bulk delete is not supported, module_put is not called to release the reference counting. As a result, module reference count is leaked. Fixes: a6cec0bcd342 ("net: rtnetlink: add bulk delete support flag") Signed-off-by: Zhengchao Shao Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20220815024629.240367-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit 3a12df22a8f68954a4ba48435c06b3d1791c87c4 Author: Sergei Antonov Date: Fri Aug 12 20:13:39 2022 +0300 net: moxa: pass pdev instead of ndev to DMA functions dma_map_single() calls fail in moxart_mac_setup_desc_ring() and moxart_mac_start_xmit() which leads to an incessant output of this: [ 16.043925] moxart-ethernet 92000000.mac eth0: DMA mapping error [ 16.050957] moxart-ethernet 92000000.mac eth0: DMA mapping error [ 16.058229] moxart-ethernet 92000000.mac eth0: DMA mapping error Passing pdev to DMA is a common approach among net drivers. Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") Signed-off-by: Sergei Antonov Suggested-by: Andrew Lunn Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220812171339.2271788-1-saproj@gmail.com Signed-off-by: Jakub Kicinski commit 17661ecf6a64eb11ae7f1108fe88686388b2acd5 Author: Namjae Jeon Date: Sun Aug 14 22:40:25 2022 +0900 ksmbd: don't remove dos attribute xattr on O_TRUNC open When smb client open file in ksmbd share with O_TRUNC, dos attribute xattr is removed as well as data in file. This cause the FSCTL_SET_SPARSE request from the client fails because ksmbd can't update the dos attribute after setting ATTR_SPARSE_FILE. And this patch fix xfstests generic/469 test also. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit c90b31eaf9e77269d3803ed9223a2e0168b519ac Author: Hyunchul Lee Date: Fri Aug 12 11:11:32 2022 +0900 ksmbd: remove unnecessary generic_fillattr in smb2_open Remove unnecessary generic_fillattr to fix wrong AllocationSize of SMB2_CREATE response, And Move the call of ksmbd_vfs_getattr above the place where stat is needed because of truncate. This patch fixes wrong AllocationSize of SMB2_CREATE response. Because ext4 updates inode->i_blocks only when disk space is allocated, generic_fillattr does not set stat.blocks properly for delayed allocation. But ext4 returns the blocks that include the delayed allocation blocks when getattr is called. The issue can be reproduced with commands below: touch ${FILENAME} xfs_io -c "pwrite -S 0xAB 0 40k" ${FILENAME} xfs_io -c "stat" ${FILENAME} 40KB are written, but the count of blocks is 8. Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5f4d1fd5b5d3506759b5d9cf20bb5fb5b8bdcab1 Author: Kristen Carlson Accardi Date: Fri Aug 12 11:07:13 2022 -0700 selftests/sgx: Ignore OpenSSL 3.0 deprecated functions warning OpenSSL 3.0 deprecates some of the functions used in the SGX selftests, causing build errors on new distros. For now ignore the warnings until support for the functions is no longer available and mark FIXME so that it can be clear this should be removed at some point. Signed-off-by: Kristen Carlson Accardi Reviewed-by: Jarkko Sakkinen Signed-off-by: Shuah Khan commit d7ae5818c3fa3007dee13f9d99832e7f26b8bc44 Author: Hao Jia Date: Sat Aug 6 20:05:10 2022 +0800 sched/psi: Remove redundant cgroup_psi() when !CONFIG_CGROUPS cgroup_psi() is only called under CONFIG_CGROUPS. We don't need cgroup_psi() when !CONFIG_CGROUPS, so we can remove it in this case. Signed-off-by: Hao Jia Reviewed-by: Ingo Molnar Acked-by: Johannes Weiner Signed-off-by: Tejun Heo commit 76b079ef4cc954fc2c2e0333a01855b0b2b6bdee Author: Hao Jia Date: Sat Aug 6 20:05:09 2022 +0800 sched/psi: Remove unused parameter nbytes of psi_trigger_create() psi_trigger_create()'s 'nbytes' parameter is not used, so we can remove it. Signed-off-by: Hao Jia Reviewed-by: Ingo Molnar Acked-by: Johannes Weiner Signed-off-by: Tejun Heo commit 2b97cf76289a4fcae66d7959b0d74a87207d7068 Author: Hao Jia Date: Sat Aug 6 20:05:08 2022 +0800 sched/psi: Zero the memory of struct psi_group After commit 5f69a6577bc3 ("psi: dont alloc memory for psi by default"), the memory used by struct psi_group is no longer allocated and zeroed in cgroup_create(). Since the memory of struct psi_group is not zeroed, the data in this memory is random, which will lead to inaccurate psi statistics when creating a new cgroup. So we use kzlloc() to allocate and zero the struct psi_group and remove the redundant zeroing in group_init(). Steps to reproduce: 1. Use cgroup v2 and enable CONFIG_PSI 2. Create a new cgroup, and query psi statistics mkdir /sys/fs/cgroup/test cat /sys/fs/cgroup/test/cpu.pressure some avg10=0.00 avg60=0.00 avg300=47927752200.00 total=12884901 full avg10=561815124.00 avg60=125835394188.00 avg300=1077090462000.00 total=10273561772 cat /sys/fs/cgroup/test/io.pressure some avg10=1040093132823.95 avg60=1203770351379.21 avg300=3862252669559.46 total=4294967296 full avg10=921884564601.39 avg60=0.00 avg300=1984507298.35 total=442381631 cat /sys/fs/cgroup/test/memory.pressure some avg10=232476085778.11 avg60=0.00 avg300=0.00 total=0 full avg10=0.00 avg60=0.00 avg300=2585658472280.57 total=12884901 Fixes: commit 5f69a6577bc3 ("psi: dont alloc memory for psi by default") Signed-off-by: Hao Jia Reviewed-by: Ingo Molnar Acked-by: Johannes Weiner Signed-off-by: Tejun Heo commit 160905549e663019e26395ed9d66c24ee2cf5187 Author: Christophe JAILLET Date: Sun Aug 7 08:37:43 2022 +0200 iio: light: cm3605: Fix an error handling path in cm3605_probe() The commit in Fixes also introduced a new error handling path which should goto the existing error handling path. Otherwise some resources leak. Fixes: 0d31d91e6145 ("iio: light: cm3605: Make use of the helper function dev_err_probe()") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/0e186de2c125b3e17476ebf9c54eae4a5d66f994.1659854238.git.christophe.jaillet@wanadoo.fr Cc: Signed-off-by: Jonathan Cameron commit 8f89e33bf040bbef66386c426198622180233178 Author: Marcus Folkesson Date: Fri Jul 22 15:07:18 2022 +0200 iio: adc: mcp3911: make use of the sign bit The device supports negative values as well. Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911") Signed-off-by: Marcus Folkesson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220722130726.7627-2-marcus.folkesson@gmail.com Signed-off-by: Jonathan Cameron commit d3122bf9aa4c974f5e2c0112f799757b3a2779da Author: Damien Le Moal Date: Fri Aug 12 02:29:53 2022 +0900 ata: libata-eh: Add missing command name Add the missing command name for ATA_CMD_NCQ_NON_DATA to ata_get_cmd_name(). Fixes: 661ce1f0c4a6 ("libata/libsas: Define ATA_CMD_NCQ_NON_DATA") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit 41a55567b9e31cb852670684404654ec4fd0d8d6 Author: David Gow Date: Wed Jul 13 08:52:20 2022 +0800 module: kunit: Load .kunit_test_suites section when CONFIG_KUNIT=m The new KUnit module handling has KUnit test suites listed in a .kunit_test_suites section of each module. This should be loaded when the module is, but at the moment this only happens if KUnit is built-in. Also load this when KUnit is enabled as a module: it'll not be usable unless KUnit is loaded, but such modules are likely to depend on KUnit anyway, so it's unlikely to ever be loaded needlessly. Fixes: 3d6e44623841 ("kunit: unify module and builtin suite definitions") Signed-off-by: David Gow Reviewed-by: Brendan Higgins Tested-by: Geert Uytterhoeven Signed-off-by: Shuah Khan commit d52788b3da2750ebc617891cf260b8f8912f522b Author: David Gow Date: Fri Jul 15 12:03:54 2022 +0800 mmc: sdhci-of-aspeed: test: Fix dependencies when KUNIT=m While the sdhci-of-aspeed KUnit tests do work when builtin, and do work when KUnit itself is being built as a module, the two together break. This is because the KUnit tests (understandably) depend on KUnit, so a built-in test cannot build if KUnit is a module. Fix this by adding a dependency on (MMC_SDHCI_OF_ASPEED=m || KUNIT=y), which only excludes this one problematic configuration. This was reported on a nasty openrisc-randconfig run by the kernel test robot, though for some reason (compiler optimisations removing the test code?) I wasn't able to reproduce it locally on x86: https://lore.kernel.org/linux-mm/202207140122.fzhlf60k-lkp@intel.com/T/ Fixes: 291cd54e5b05 ("mmc: sdhci-of-aspeed: test: Use kunit_test_suite() macro") Reported-by: kernel test robot Signed-off-by: David Gow Acked-by: Andrew Jeffery Acked-by: Ulf Hansson Acked-by: Brendan Higgins Signed-off-by: Shuah Khan commit 8c596324232d22e19f8df59ba03410b9b5b0f3d7 Author: Daniel Lezcano Date: Tue Aug 9 10:56:28 2022 +0200 dt-bindings: thermal: Fix missing required property When the thermal zone description was converted to yaml schema, the required 'trips' property was forgotten. The initial text bindings was describing: " [ ... ] * Thermal zone nodes The thermal zone node is the node containing all the required info for describing a thermal zone, including its cooling device bindings. The thermal zone node must contain, apart from its own properties, one sub-node containing trip nodes and one sub-node containing all the zone cooling maps. Required properties: - polling-delay: The maximum number of milliseconds to wait between polls Type: unsigned when checking this thermal zone. Size: one cell - polling-delay-passive: The maximum number of milliseconds to wait Type: unsigned between polls when performing passive cooling. Size: one cell - thermal-sensors: A list of thermal sensor phandles and sensor specifier Type: list of used while monitoring the thermal zone. phandles + sensor specifier - trips: A sub-node which is a container of only trip point nodes Type: sub-node required to describe the thermal zone. Optional property: - cooling-maps: A sub-node which is a container of only cooling device Type: sub-node map nodes, used to describe the relation between trips and cooling devices. [ ... ] " Now the schema describes: " [ ... ] required: - polling-delay - polling-delay-passive - thermal-sensors [ ... ] " Add the missing 'trips' property in the required properties. Fixed: 1202a442a31fd ("dt-bindings: thermal: Add yaml bindings for thermal zones") Signed-off-by: Daniel Lezcano Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220809085629.509116-3-daniel.lezcano@linaro.org commit a921be53b46c393d8d594a62a44f418c97e5504b Author: Daniel Lezcano Date: Wed Aug 10 12:07:31 2022 +0200 thermal/core: Add missing EXPORT_SYMBOL_GPL The function thermal_zone_device_register_with_trips() is not exported for modules. Add the missing EXPORT_SYMBOL_GPL(). Fixes: fae11de507f0e ("thermal/core: Add thermal_trip in thermal_zone") Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220810100731.749317-1-daniel.lezcano@linaro.org commit 1c11289b34ab67ed080bbe0f1855c4938362d9cf Author: Iwona Winiarska Date: Tue Jul 5 12:15:01 2022 +0200 peci: cpu: Fix use-after-free in adev_release() When auxiliary_device_add() returns an error, auxiliary_device_uninit() is called, which causes refcount for device to be decremented and .release callback will be triggered. Because adev_release() re-calls auxiliary_device_uninit(), it will cause use-after-free: [ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15 [ 1269.464007] refcount_t: underflow; use-after-free. Reported-by: Jianglei Nie Signed-off-by: Iwona Winiarska Link: https://lore.kernel.org/r/20220705101501.298395-1-iwona.winiarska@intel.com commit e79b548b7202bb3accdfe64f113129a4340bc2f9 Author: Lv Ruyi Date: Wed Apr 13 01:04:25 2022 +0000 peci: aspeed: fix error check return value of platform_get_irq() platform_get_irq() return negative value on failure, so null check of priv->irq is incorrect. Fix it by comparing whether it is less than zero. Fixes: a85e4c52086c ("peci: Add peci-aspeed controller driver") Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Link: https://lore.kernel.org/r/20220413010425.2534887-1-lv.ruyi@zte.com.cn Reviewed-by: Iwona Winiarska Signed-off-by: Iwona Winiarska commit 61b123ffcedac72a1ac6a96d1da87d25efddcbda Author: Sander Vanheule Date: Tue Aug 9 19:36:35 2022 +0200 lib/cpumask: drop always-true preprocessor guard Since lib/cpumask.o is only built for CONFIG_SMP=y, NR_CPUS will always be greater than 1 at compile time. This makes checking for that condition unnecesarry, so it can be dropped. Signed-off-by: Sander Vanheule Signed-off-by: Yury Norov commit 2248ccd80124e61c2c84a22b22409bab452e1f0c Author: Sander Vanheule Date: Tue Aug 9 19:36:34 2022 +0200 lib/cpumask: add inline cpumask_next_wrap() for UP In the uniprocessor case, cpumask_next_wrap() can be simplified, as the number of valid argument combinations is limited: - 'start' can only be 0 - 'n' can only be -1 or 0 The only valid CPU that can then be returned, if any, will be the first one set in the provided 'mask'. For NR_CPUS == 1, include/linux/cpumask.h now provides an inline definition of cpumask_next_wrap(), which will conflict with the one provided by lib/cpumask.c. Make building of lib/cpumask.o again depend on CONFIG_SMP=y (i.e. NR_CPUS > 1) to avoid the re-definition. Suggested-by: Yury Norov Signed-off-by: Sander Vanheule Signed-off-by: Yury Norov commit be599244865cb788abe2c6f59ccb05d7240448e4 Author: Sander Vanheule Date: Tue Aug 9 19:36:33 2022 +0200 cpumask: align signatures of UP implementations Between the generic version, and their uniprocessor optimised implementations, the return types of cpumask_any_and_distribute() and cpumask_any_distribute() are not identical. Change the UP versions to 'unsigned int', to match the generic versions. Suggested-by: Yury Norov Signed-off-by: Sander Vanheule Signed-off-by: Yury Norov commit a0753ef66c34c1739580219dca664eda648164b7 Author: Liming Sun Date: Tue Aug 9 13:37:42 2022 -0400 mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC The commit 08f3dff799d4 (mmc: sdhci-of-dwcmshc: add rockchip platform support") introduces the use of_device_get_match_data() to check for some chips. Unfortunately, it also breaks the BlueField-3 FW, which uses ACPI. To fix the problem, let's add the ACPI match data and the corresponding quirks to re-enable the support for the BlueField-3 SoC. Reviewed-by: David Woods Signed-off-by: Liming Sun Acked-by: Adrian Hunter Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220809173742.178440-1-limings@nvidia.com [Ulf: Clarified the commit message a bit] Signed-off-by: Ulf Hansson commit f1227dc7d0411ee9a9faaa1e80cfd9d6e5d6d63e Author: Guillaume Tucker Date: Wed Aug 3 22:13:54 2022 +0200 selftests/landlock: fix broken include of linux/landlock.h Revert part of the earlier changes to fix the kselftest build when using a sub-directory from the top of the tree as this broke the landlock test build as a side-effect when building with "make -C tools/testing/selftests/landlock". Reported-by: Mickaël Salaün Fixes: a917dd94b832 ("selftests/landlock: drop deprecated headers dependency") Fixes: f2745dc0ba3d ("selftests: stop using KSFT_KHDR_INSTALL") Signed-off-by: Guillaume Tucker Signed-off-by: Shuah Khan commit 174974d8463b77c2b4065e98513adb204e64de7d Author: Rob Clark Date: Sun Aug 7 09:09:01 2022 -0700 drm/msm/rd: Fix FIFO-full deadlock If the previous thing cat'ing $debugfs/rd left the FIFO full, then subsequent open could deadlock in rd_write() (because open is blocked, not giving a chance for read() to consume any data in the FIFO). Also it is generally a good idea to clear out old data from the FIFO. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/496706/ Link: https://lore.kernel.org/r/20220807160901.2353471-2-robdclark@gmail.com commit 02b9f2636209beb843ca501d47f7fddc8792b2d7 Author: Bjorn Andersson Date: Fri Jul 8 09:26:32 2022 -0700 drm/msm/gpu: Drop qos request if devm_devfreq_add_device() fails In the event that devm_devfreq_add_device() fails the device's qos freq list is left referencing df->idle_freq and df->boost_freq. Attempting to initialize devfreq again after a probe deferral will then cause invalid memory accesses in dev_pm_qos_add_request(). Fix this by dropping the requests in the error path. Fixes: 7c0ffcd40b16 ("drm/msm/gpu: Respect PM QoS constraints") Signed-off-by: Bjorn Andersson Reviewed-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/493001/ Link: https://lore.kernel.org/r/20220708162632.3529864-1-bjorn.andersson@linaro.org Signed-off-by: Rob Clark commit 1b6345d4160ecd3d04bd8cd75df90c67811e8cc9 Author: Pablo Neira Ayuso Date: Mon Aug 15 17:55:07 2022 +0200 netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified Since f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields"), it possible to combine intervals and concatenations. Later on, ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag") provides the NFT_SET_CONCAT flag for userspace to report that the set stores a concatenation. Make sure NFT_SET_CONCAT is set on if field_count is specified for consistency. Otherwise, if NFT_SET_CONCAT is specified with no field_count, bail out with EINVAL. Fixes: ef516e8625dd ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag") Signed-off-by: Pablo Neira Ayuso commit f75fccbdc84fd9066e42c394c870bb6a3af57adc Author: William Zhang Date: Mon Aug 1 12:47:54 2022 -0700 ARM: dts: bcmbca: bcm6878: cosmetic change Add new line between dts node. Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194754.29492-2-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit 925fbca46d4b128cf5530ead5422bb697232c1a5 Author: William Zhang Date: Mon Aug 1 12:47:53 2022 -0700 ARM: dts: bcmbca: bcm6878: fix timer node cpu mask flag The cpu mask flag value should match the number of cpu cores in the chip. Correct the value to two cpus for BCM6878 dual core SoC. Fixes: 6bcad714e173 ("ARM: dts: Add DTS files for bcmbca SoC BCM6878") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194754.29492-1-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit 12bbc223bde4b0a3f2624965f9998b23aa84633c Author: William Zhang Date: Mon Aug 1 12:46:47 2022 -0700 ARM: dts: bcmbca: bcm6846: fix interrupt controller node Add the missing gic registers and interrupts property to the gic node. Fixes: de1a99ac0b64 ("ARM: dts: Add DTS files for bcmbca SoC BCM6846") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194647.29437-3-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit b7e204600ebe1b13b4b010f492b5a881387832d4 Author: William Zhang Date: Mon Aug 1 12:46:46 2022 -0700 ARM: dts: bcmbca: bcm6846: clean up psci node Remove unnecessary cpu_on and cpu_off properties from psci node as they are only needed for psci version prior to 0.2. Fixes: de1a99ac0b64 ("ARM: dts: Add DTS files for bcmbca SoC BCM6846") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194647.29437-2-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit 57d81a9797079065ddfcfcd42b3f94831a9668df Author: William Zhang Date: Mon Aug 1 12:46:45 2022 -0700 ARM: dts: bcmbca: bcm6846: fix timer node cpu mask flag The cpu mask flag value should match the number of cpu cores in the chip. Correct the value to two cpus for BCM6846 dual core SoC. Fixes: de1a99ac0b64 ("ARM: dts: Add DTS files for bcmbca SoC BCM6846") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194647.29437-1-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit e636e56a378d73bc4666d410e5d4450ace61e0ab Author: William Zhang Date: Mon Aug 1 12:44:48 2022 -0700 ARM: dts: bcmbca: bcm63178: cosmetic change Add new line between dts node. Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194448.29363-4-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit ed93a068f3b3ac22423edfaf8509eaafedf3efc0 Author: William Zhang Date: Mon Aug 1 12:44:47 2022 -0700 ARM: dts: bcmbca: bcm63178: fix interrupt controller node Add the missing gic registers and interrupts property to the gic node. Fixes: fc85b7e64acb ("ARM: dts: add dts files for bcmbca soc 63178") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194448.29363-3-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit 9a6bd12f52bf38773d7b1f0d3c321ae42447ab57 Author: William Zhang Date: Mon Aug 1 12:44:46 2022 -0700 ARM: dts: bcmbca: bcm63178: clean up psci node Remove unnecessary cpu_on and cpu_off properties from psci node as they are only needed for psci version prior to 0.2. Fixes: fc85b7e64acb ("ARM: dts: add dts files for bcmbca soc 63178") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194448.29363-2-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit d1475cdec17b30049c0dd69094c4ebf6e018e7c1 Author: William Zhang Date: Mon Aug 1 12:44:45 2022 -0700 ARM: dts: bcmbca: bcm63178: fix timer node cpu mask flag The cpu mask flag value should match the number of cpu cores in the chip. Correct the value to three cpus for BCM63178 triple core SoC. Fixes: fc85b7e64acb ("ARM: dts: add dts files for bcmbca soc 63178") Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20220801194448.29363-1-william.zhang@broadcom.com Signed-off-by: Florian Fainelli commit fd0c153daad135d0ec1a53c5dbe6936a724d6ae1 Author: Al Viro Date: Mon Aug 8 16:09:45 2022 +0100 nios2: add force_successful_syscall_return() If we use the ancient SysV syscall ABI, we'd better have tell the kernel how to claim that a negative return value is a success. Use ->orig_r2 for that - it's inaccessible via ptrace, so it's a fair game for changes and it's normally[*] non-negative on return from syscall. Set to -1; syscall is not going to be restart-worthy by definition, so we won't interfere with that use either. [*] the only exception is rt_sigreturn(), where we skip the entire messing with r1/r2 anyway. Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit 411a76b7219555c55867466c82d70ce928d6c9e1 Author: Al Viro Date: Mon Aug 8 16:09:16 2022 +0100 nios2: restarts apply only to the first sigframe we build... Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit 2d631bd58fe0ea3e3350212e23c9aba1fb606514 Author: Al Viro Date: Mon Aug 8 16:08:48 2022 +0100 nios2: fix syscall restart checks sys_foo() returns -512 (aka -ERESTARTSYS) => do_signal() sees 512 in r2 and 1 in r1. sys_foo() returns 512 => do_signal() sees 512 in r2 and 0 in r1. The former is restart-worthy; the latter obviously isn't. Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit 25ba820ef36bdbaf9884adeac69b6e1821a7df76 Author: Al Viro Date: Mon Aug 8 16:07:21 2022 +0100 nios2: traced syscall does need to check the syscall number all checks done before letting the tracer modify the register state are worthless... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit 45ec746c65097c25e77d24eae8fee0def5b6cc5d Author: Al Viro Date: Mon Aug 8 16:06:46 2022 +0100 nios2: don't leave NULLs in sys_call_table[] fill the gaps in there with sys_ni_syscall, as everyone does... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit 8535c239ac674f7ead0f2652932d35c52c4123b2 Author: Al Viro Date: Mon Aug 8 16:06:04 2022 +0100 nios2: page fault et.al. are *not* restartable syscalls... make sure that ->orig_r2 is negative for everything except the syscalls. Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen commit f15f39fabed2248311607445ddfa6dba63abebb9 Author: Jason Wang Date: Thu Aug 11 21:34:33 2022 +0800 tools: hv: Remove an extraneous "the" There are two "the" in the text. Remove one. Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20220811133433.10175-1-wangborong@cdjrlc.com Signed-off-by: Wei Liu commit f1f63cbb705dc38826369496c6fc12c1b8db1324 Author: Christophe JAILLET Date: Sun Jul 31 22:01:55 2022 +0200 drm/hyperv: Fix an error handling path in hyperv_vmbus_probe() hyperv_setup_vram() calls vmbus_allocate_mmio(). This must be undone in the error handling path of the probe, as already done in the remove function. Fixes: a0ab5abced55 ("drm/hyperv : Removing the restruction of VRAM allocation with PCI bar size") Signed-off-by: Christophe JAILLET Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/7dfa372af3e35fbb1d6f157183dfef2e4512d3be.1659297696.git.christophe.jaillet@wanadoo.fr Signed-off-by: Wei Liu commit fc0ae524b5fd2938c94d56da3f749f11eb3273d5 Author: Pablo Neira Ayuso Date: Sat Aug 13 15:22:05 2022 +0200 netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END These flags are mutually exclusive, report EINVAL in this case. Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") Signed-off-by: Pablo Neira Ayuso commit 88cccd908d51397f9754f89a937cd13fa59dee37 Author: Pablo Neira Ayuso Date: Fri Aug 12 16:21:28 2022 +0200 netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags If the NFT_SET_CONCAT|NFT_SET_INTERVAL flags are set on, then the netlink attribute NFTA_SET_ELEM_KEY_END must be specified. Otherwise, NFTA_SET_ELEM_KEY_END should not be present. For catch-all element, NFTA_SET_ELEM_KEY_END should not be present. The NFT_SET_ELEM_INTERVAL_END is never used with this set flags combination. Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute") Signed-off-by: Pablo Neira Ayuso commit 58ca14ed98c87cfe0d1408cc65a9745d9e9b7a56 Author: Magnus Karlsson Date: Fri Aug 12 13:32:59 2022 +0200 xsk: Fix corrupted packets for XDP_SHARED_UMEM Fix an issue in XDP_SHARED_UMEM mode together with aligned mode where packets are corrupted for the second and any further sockets bound to the same umem. In other words, this does not affect the first socket bound to the umem. The culprit for this bug is that the initialization of the DMA addresses for the pre-populated xsk buffer pool entries was not performed for any socket but the first one bound to the umem. Only the linear array of DMA addresses was populated. Fix this by populating the DMA addresses in the xsk buffer pool for every socket bound to the same umem. Fixes: 94033cd8e73b8 ("xsk: Optimize for aligned case") Reported-by: Alasdair McWilliam Reported-by: Intrusion Shield Team Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Tested-by: Alasdair McWilliam Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/xdp-newbies/6205E10C-292E-4995-9D10-409649354226@outlook.com/ Link: https://lore.kernel.org/bpf/20220812113259.531-1-magnus.karlsson@gmail.com commit 0fef40be5d1f8e7af3d61e8827a63c5862cd99f7 Author: Harald Freudenberger Date: Fri Jul 15 12:23:48 2022 +0200 s390/ap: fix crash on older machines based on QCI info missing On older z series machines (z12 and older) there is no QCI info available. The AP code took care of this and the AP bus scan then switched to simple probing via TAPQ. With commit 283915850a44 ("s390/ap: notify drivers on config changed and scan complete callbacks") some code was introduced which silently assumed that the QCI info is always available. However, with KVM simulating an older machine (z12) the result was a kernel crash. Funnily the same crash does not happen on LPAR - maybe because NULL is a valid pointer and reading some data from address 0 also works fine. This fix now improves the code to be aware that the QCI instruction may not be available on older machines and thus the two pointers to QCI info structs may simple be NULL. However, on a machine not providing the QCI info the two callbacks to the zcrypt device drivers on_config_changed() and on_scan_complete() provide parameters which are pointers to a QCI info struct. These both callbacks are NOT served if there is no QCI info available. The only consumer of these callbacks is the vfio device driver. This driver only supports CEX4 and higher. All physical machines which are able to provide CEX4 cards have QCI support available. So there is no sense in for example fill the QCI info struct by hand with looping over cards and queues and TAPQ each APQN. Signed-off-by: Harald Freudenberger Signed-off-by: Tony Krowiak Cc: stable@vger.kernel.org Fixes: 283915850a44 ("s390/ap: notify drivers on config changed and scan complete callbacks") Signed-off-by: Alexander Gordeev commit 7b6670b03641ac308aaa6fa2e6f964ac993b5ea3 Author: Juergen Gross Date: Mon Jun 20 11:45:34 2022 +0200 s390/hypfs: avoid error message under KVM When booting under KVM the following error messages are issued: hypfs.7f5705: The hardware system does not support hypfs hypfs.7a79f0: Initialization of hypfs failed with rc=-61 Demote the severity of first message from "error" to "info" and issue the second message only in other error cases. Signed-off-by: Juergen Gross Acked-by: Heiko Carstens Acked-by: Christian Borntraeger Link: https://lore.kernel.org/r/20220620094534.18967-1-jgross@suse.com [arch/s390/hypfs/hypfs_diag.c changed description] Signed-off-by: Alexander Gordeev commit 461122b999bda2ebef2086a35d8990f9ccac5ab8 Author: Stefan Binding Date: Mon Aug 15 15:19:53 2022 +0100 ALSA: hda/realtek: Add quirks for ASUS Zenbooks using CS35L41 These Asus Zenbook laptop use Realtek HDA codec combined with 2xCS35L41 Amplifiers using SPI. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20220815141953.25197-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit ea75deef1a738d25502cfbb2caa564270b271525 Author: Richard Fitzgerald Date: Mon Aug 15 13:31:38 2022 +0100 ASoC: cs42l42: Only report button state if there was a button interrupt Only report a button state change if the interrupt status shows that there was a button event. Previously the code would always drop into the button reporting at the end of interrupt handling if the jack was present. If neither of the button report interrupts were pending it would report all buttons released. This could then lead to a button being reported as released while it is still pressed. Fixes: c5b8ee0879bc ("ASoC: cs42l42: Report jack and button detection") Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20220815123138.3810249-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit b3e1cf31154136da855f3cb6117c17eb0b6bcfb4 Author: Christophe JAILLET Date: Sun Aug 7 08:56:38 2022 +0200 mmc: meson-gx: Fix an error handling path in meson_mmc_probe() The commit in Fixes has introduced a new error handling which should goto the existing error handling path. Otherwise some resources leak. Fixes: 19c6beaa064c ("mmc: meson-gx: add device reset") Signed-off-by: Christophe JAILLET Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/be4b863bacf323521ba3a02efdc4fca9cdedd1a6.1659855351.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit cc5d1692600613e72f32af60e27330fe0c79f4fe Author: Wenbin Mei Date: Thu Jul 28 16:00:48 2022 +0800 mmc: mtk-sd: Clear interrupts when cqe off/disable Currently we don't clear MSDC interrupts when cqe off/disable, which led to the data complete interrupt will be reserved for the next command. If the next command with data transfer after cqe off/disable, we process the CMD ready interrupt and trigger DMA start for data, but the data complete interrupt is already exists, then SW assume that the data transfer is complete, SW will trigger DMA stop, but the data may not be transmitted yet or is transmitting, so we may encounter the following error: mtk-msdc 11230000.mmc: CMD bus busy detected. Signed-off-by: Wenbin Mei Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220728080048.21336-1-wenbin.mei@mediatek.com Signed-off-by: Ulf Hansson commit b886f54c300d31c109d2e4336b22922b64e7ba7d Author: Christophe JAILLET Date: Tue Jul 26 21:15:51 2022 +0200 mmc: pxamci: Fix another error handling path in pxamci_probe() The commit in Fixes: has introduced an new error handling without branching to the existing error handling path. Update it now and release some resources if pxamci_init_ocr() fails. Fixes: 61951fd6cb49 ("mmc: pxamci: let mmc core handle regulators") Signed-off-by: Christophe JAILLET Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/07a2dcebf8ede69b484103de8f9df043f158cffd.1658862932.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 422ab8fe15e30066d4c8e236b747c77069bfca45 Author: Jassi Brar Date: Mon Aug 1 09:10:05 2022 -0500 arm64: dts: juno: Add missing MHU secure-irq The MHU secure interrupt exists physically but is missing in the DT node. Specify the interrupt in DT node to fix a warning on Arm Juno board: mhu@2b1f0000: interrupts: [[0, 36, 4], [0, 35, 4]] is too short Link: https://lore.kernel.org/r/20220801141005.599258-1-jassisinghbrar@gmail.com Signed-off-by: Jassi Brar Signed-off-by: Sudeep Holla commit 2a9eb57e20e6bbd62774691648dc4abde66220cd Author: Rob Herring Date: Thu Jul 21 15:29:52 2022 -0600 arm64: dts: arm: juno: Remove legacy Coresight 'slave-mode' property The 'slave-mode' property is not valid under 'in-ports' as it was the legacy way to find input ports. Warnings are generated from the Coresight schema: arch/arm64/boot/dts/arm/juno-r1.dtb: funnel@20150000: in-ports:port@0:endpoint: Unevaluated properties are not allowed ('slave-mode' was unexpected) From schema: Documentation/devicetree/bindings/arm/arm,coresight-dynamic-funnel.yaml Link: https://lore.kernel.org/r/20220721212952.1984382-1-robh@kernel.org Reviewed-by: Suzuki K Poulose Signed-off-by: Rob Herring Signed-off-by: Sudeep Holla commit 98d7c5e5792b8ce3e1352196dac7f404bb1b46ec Author: Christophe JAILLET Date: Tue Jul 26 21:15:43 2022 +0200 mmc: pxamci: Fix an error handling path in pxamci_probe() The commit in Fixes: has moved some code around without updating gotos to the error handling path. Update it now and release some resources if pxamci_of_init() fails. Fixes: fa3a5115469c ("mmc: pxamci: call mmc_of_parse()") Signed-off-by: Christophe JAILLET Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/6d75855ad4e2470e9ed99e0df21bc30f0c925a29.1658862932.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit 6b2caaafc5df5f9d8a41679c3ec1bdad3b8fbe14 Author: Maximilian Luz Date: Wed Aug 10 16:41:17 2022 +0200 platform/surface: aggregator_registry: Add HID devices for sensors and UCSI client to SP8 Add software nodes for the HID sensor collection and the UCM UCSI HID client to the Surface Pro 8. In contrast to the type-cover devices, these devices are directly attached to the SAM controller, without any hub. This enables support for HID-based sensors, including the ones used for automatic screen rotation, on the Surface Pro 8. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20220810144117.493710-4-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 06964552928f6e111c2c29a8352ece8345e9cb18 Author: Maximilian Luz Date: Wed Aug 10 16:41:16 2022 +0200 platform/surface: aggregator_registry: Rename HID device nodes based on new findings On Windows, the HID devices with target ID 1 are grouped as "Surface Hot Plug - SAM". Rename their device nodes in the registry to reflect that and update the comments accordingly. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20220810144117.493710-3-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6d6ea95abc66596ceff131080e86db3bbec77064 Author: Maximilian Luz Date: Wed Aug 10 16:41:15 2022 +0200 platform/surface: aggregator_registry: Rename HID device nodes based on their function Rename HID device nodes based on their function. In particular, these are nodes for firmware updates via the CFU mechanism (component firmware update), HID based sensors, and a USB-C UCSI client. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20220810144117.493710-2-luzmaximilian@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 84b8e403435c8fb94b872309673764a447961e00 Author: Maximilian Luz Date: Wed Aug 10 16:01:33 2022 +0200 platform/surface: aggregator_registry: Add support for Surface Laptop Go 2 The Surface Laptop Go 2 seems to have the same SAM client devices as the Surface Laptop Go 1, so re-use its node group. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20220810140133.99087-1-luzmaximilian@gmail.com Signed-off-by: Hans de Goede commit 2986c51540ed50ac654ffb5a772e546c02628c91 Author: Hans de Goede Date: Wed Aug 10 16:19:34 2022 +0200 platform/x86: x86-android-tablets: Fix broken touchscreen on Chuwi Hi8 with Windows BIOS The x86-android-tablets handling for the Chuwi Hi8 is only necessary with the Android BIOS and it is causing problems with the Windows BIOS version. Specifically when trying to register the already present touchscreen x86_acpi_irq_helper_get() calls acpi_unregister_gsi(), this breaks the working of the touchscreen and also leads to an oops: [ 14.248946] ------------[ cut here ]------------ [ 14.248954] remove_proc_entry: removing non-empty directory 'irq/75', leaking at least 'MSSL0001:00' [ 14.248983] WARNING: CPU: 3 PID: 440 at fs/proc/generic.c:718 remove_proc_entry ... [ 14.249293] unregister_irq_proc+0xe0/0x100 [ 14.249305] free_desc+0x29/0x70 [ 14.249312] irq_free_descs+0x4b/0x80 [ 14.249320] mp_unmap_irq+0x5c/0x60 [ 14.249329] acpi_unregister_gsi_ioapic+0x2a/0x40 [ 14.249338] x86_acpi_irq_helper_get+0x4b/0x190 [x86_android_tablets] [ 14.249355] x86_android_tablet_init+0x178/0xe34 [x86_android_tablets] Add an init callback for the Chuwi Hi8, which detects when the Windows BIOS is in use and exits with -ENODEV in that case, fixing this. Fixes: 84c2dcdd475f ("platform/x86: x86-android-tablets: Add an init() callback to struct x86_dev_info") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220810141934.140771-1-hdegoede@redhat.com commit 0a90ed8d0cfa29735a221eba14d9cb6c735d35b6 Author: Andy Shevchenko Date: Mon Aug 1 14:37:31 2022 +0300 platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask On Intel hardware the SLP_TYPx bitfield occupies bits 10-12 as per ACPI specification (see Table 4.13 "PM1 Control Registers Fixed Hardware Feature Control Bits" for the details). Fix the mask and other related definitions accordingly. Fixes: 93e5eadd1f6e ("x86/platform: New Intel Atom SOC power management controller driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220801113734.36131-1-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit f889a2e89ea5b4db5cf09765ee5e310be43c7b6f Author: Russell Currey Date: Fri Aug 12 17:16:32 2022 +1000 selftests/powerpc: Add missing PMU selftests to .gitignores Some recently added selftests don't have their binaries in .gitignores, so add them. I also alphabetically sorted sampling_tests/.gitignore while I was in there. Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220812071632.56095-1-ruscur@russell.cc commit 5061e34c67446f73842391f9b3275e1be5491871 Merge: 02799571714dc e01885c31bef7 Author: David S. Miller Date: Mon Aug 15 11:49:58 2022 +0100 Merge branch 'mlxsw-fixes' Petr Machata says: ==================== mlxsw: Fixes for PTP support This set fixes several issues in mlxsw PTP code. - Patch #1 fixes compilation warnings. - Patch #2 adjusts the order of operation during cleanup, thereby closing the window after PTP state was already cleaned in the ASIC for the given port, but before the port is removed, when the user could still in theory make changes to the configuration. - Patch #3 protects the PTP configuration with a custom mutex, instead of relying on RTNL, which is not held in all access paths. - Patch #4 forbids enablement of PTP only in RX or only in TX. The driver implicitly assumed this would be the case, but neglected to sanitize the configuration. ==================== Signed-off-by: David S. Miller commit e01885c31bef7c2c5fcb79dc192039f25e300ded Author: Amit Cohen Date: Fri Aug 12 17:32:03 2022 +0200 mlxsw: spectrum_ptp: Forbid PTP enablement only in RX or in TX Currently mlxsw driver configures one global PTP configuration for all ports. The reason is that the switch behaves like a transparent clock between CPU port and front-panel ports. When time stamp is enabled in any port, the hardware is configured to update the correction field. The fact that the configuration of CPU port affects all the ports, makes the correction field update to be global for all ports. Otherwise, user will see odd values in the correction field, as the switch will update the correction field in the CPU port, but not in all the front-panel ports. The CPU port is relevant in both RX and TX, so to avoid problematic configuration, forbid PTP enablement only in one direction, i.e., only in RX or TX. Without the change: $ hwstamp_ctl -i swp1 -r 12 -t 0 current settings: tx_type 0 rx_filter 0 new settings: tx_type 0 rx_filter 2 $ echo $? 0 With the change: $ hwstamp_ctl -i swp1 -r 12 -t 0 current settings: tx_type 1 rx_filter 2 SIOCSHWTSTAMP failed: Invalid argument Fixes: 08ef8bc825d96 ("mlxsw: spectrum_ptp: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit d72fdef21f07540c6cbb8043cc93decd2a5d35dd Author: Amit Cohen Date: Fri Aug 12 17:32:02 2022 +0200 mlxsw: spectrum_ptp: Protect PTP configuration with a mutex Currently the functions mlxsw_sp2_ptp_{configure, deconfigure}_port() assume that they are called when RTNL is locked and they warn otherwise. The deconfigure function can be called when port is removed, for example as part of device reload, then there is no locked RTNL and the function warns [1]. To avoid such case, do not assume that RTNL protects this code, add a dedicated mutex instead. The mutex protects 'ptp_state->config' which stores the existing global configuration in hardware. Use this mutex also to protect the code which configures the hardware. Then, there will be only one configuration in any time, which will be updated in 'ptp_state' and a race will be avoided. [1]: RTNL: assertion failed at drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c (1600) WARNING: CPU: 1 PID: 1583493 at drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c:1600 mlxsw_sp2_ptp_hwtstamp_set+0x2d3/0x300 [mlxsw_spectrum] [...] CPU: 1 PID: 1583493 Comm: devlink Not tainted5.19.0-rc8-custom-127022-gb371dffda095 #789 Hardware name: Mellanox Technologies Ltd.MSN3420/VMOD0005, BIOS 5.11 01/06/2019 RIP: 0010:mlxsw_sp2_ptp_hwtstamp_set+0x2d3/0x300[mlxsw_spectrum] [...] Call Trace: mlxsw_sp_port_remove+0x7e/0x190 [mlxsw_spectrum] mlxsw_sp_fini+0xd1/0x270 [mlxsw_spectrum] mlxsw_core_bus_device_unregister+0x55/0x280 [mlxsw_core] mlxsw_devlink_core_bus_device_reload_down+0x1c/0x30[mlxsw_core] devlink_reload+0x1ee/0x230 devlink_nl_cmd_reload+0x4de/0x580 genl_family_rcv_msg_doit+0xdc/0x140 genl_rcv_msg+0xd7/0x1d0 netlink_rcv_skb+0x49/0xf0 genl_rcv+0x1f/0x30 netlink_unicast+0x22f/0x350 netlink_sendmsg+0x208/0x440 __sys_sendto+0xf0/0x140 __x64_sys_sendto+0x1b/0x20 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 08ef8bc825d96 ("mlxsw: spectrum_ptp: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") Reported-by: Ido Schimmel Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit a159e986ad26d3f35c0157ac92760ba5e44e6785 Author: Amit Cohen Date: Fri Aug 12 17:32:01 2022 +0200 mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice Currently as part of removing port, PTP API is called to clear the existing configuration and set the 'rx_filter' and 'tx_type' to zero. The clearing is done before unregistering the netdevice, which means that there is a window of time in which the user can reconfigure PTP in the port, and this configuration will not be cleared. Reorder the operations, clear PTP configuration after unregistering the netdevice. Fixes: 8748642751ede ("mlxsw: spectrum: PTP: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls") Signed-off-by: Amit Cohen Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 12e091389b29cddf26279fdf182b13b3a1583d0d Author: Amit Cohen Date: Fri Aug 12 17:32:00 2022 +0200 mlxsw: spectrum_ptp: Fix compilation warnings In case that 'CONFIG_PTP_1588_CLOCK' is not enabled in the config file, there are implementations for the functions mlxsw_{sp,sp2}_ptp_txhdr_construct() as part of 'spectrum_ptp.h'. In this case, they should be defined as 'static' as they are not supposed to be used out of this file. Make the functions 'static', otherwise the following warnings are returned: "warning: no previous prototype for 'mlxsw_sp_ptp_txhdr_construct'" "warning: no previous prototype for 'mlxsw_sp2_ptp_txhdr_construct'" In addition, make the functions 'inline' for case that 'spectrum_ptp.h' will be included anywhere else and the functions would probably not be used, so compilation warnings about unused static will be returned. Fixes: 24157bc69f45 ("mlxsw: Send PTP packets as data packets to overcome a limitation") Reported-by: kernel test robot Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 02799571714dc5dd6948824b9d080b44a295f695 Author: Jamal Hadi Salim Date: Sun Aug 14 11:27:58 2022 +0000 net_sched: cls_route: disallow handle of 0 Follows up on: https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/ handle of 0 implies from/to of universe realm which is not very sensible. Lets see what this patch will do: $sudo tc qdisc add dev $DEV root handle 1:0 prio //lets manufacture a way to insert handle of 0 $sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \ route to 0 from 0 classid 1:10 action ok //gets rejected... Error: handle of 0 is not valid. We have an error talking to the kernel, -1 //lets create a legit entry.. sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \ classid 1:10 action ok //what did the kernel insert? $sudo tc filter ls dev $DEV parent 1:0 filter protocol ip pref 100 route chain 0 filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 //Lets try to replace that legit entry with a handle of 0 $ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \ handle 0x000a8000 route to 0 from 0 classid 1:10 action drop Error: Replacing with handle of 0 is invalid. We have an error talking to the kernel, -1 And last, lets run Cascardo's POC: $ ./poc 0 0 -22 -22 -22 Signed-off-by: Jamal Hadi Salim Acked-by: Stephen Hemminger Signed-off-by: David S. Miller commit 7396ba87f1edf549284869451665c7c4e74ecd4f Author: Xin Xiong Date: Sat Aug 13 20:49:08 2022 +0800 net: fix potential refcount leak in ndisc_router_discovery() The issue happens on specific paths in the function. After both the object `rt` and `neigh` are grabbed successfully, when `lifetime` is nonzero but the metric needs change, the function just deletes the route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh` again if above conditions hold. The function simply overwrite `neigh` if succeeds or returns if fails, without decreasing the reference count of previous `neigh`. This may result in memory leaks. Fix it by decrementing the reference count of `neigh` in place. Fixes: 6b2e04bc240f ("net: allow user to set metric on default route learned via Router Advertisement") Signed-off-by: Xin Xiong Signed-off-by: Xin Tan Signed-off-by: David S. Miller commit 27b8d4d7a0cf442b7a0351fecc33b714f4208324 Merge: 0ff4eb3d5ebbf cf90b74341eec Author: David S. Miller Date: Mon Aug 15 11:30:10 2022 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net -queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-08-11 (ice) This series contains updates to ice driver only. Benjamin corrects a misplaced parenthesis for a WARN_ON check. Michal removes WARN_ON from a check as its recoverable and not warranting of a call trace. ==================== Signed-off-by: David S. Miller commit 0ff4eb3d5ebbf72a7fc355e6001a0a6740662bf9 Author: Alexander Mikhalitsyn Date: Thu Aug 11 18:20:12 2022 +0300 neighbour: make proxy_queue.qlen limit per-device Right now we have a neigh_param PROXY_QLEN which specifies maximum length of neigh_table->proxy_queue. But in fact, this limitation doesn't work well because check condition looks like: tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN) The problem is that p (struct neigh_parms) is a per-device thing, but tbl (struct neigh_table) is a system-wide global thing. It seems reasonable to make proxy_queue limit per-device based. v2: - nothing changed in this patch v3: - rebase to net tree Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Daniel Borkmann Cc: David Ahern Cc: Yajun Deng Cc: Roopa Prabhu Cc: Christian Brauner Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Alexey Kuznetsov Cc: Alexander Mikhalitsyn Cc: Konstantin Khorenko Cc: kernel@openvz.org Cc: devel@openvz.org Suggested-by: Denis V. Lunev Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Denis V. Lunev Signed-off-by: David S. Miller commit 66ba215cb51323e4e55e38fd5f250e0fae0cbc94 Author: Denis V. Lunev Date: Thu Aug 11 18:20:11 2022 +0300 neigh: fix possible DoS due to net iface start/stop loop Normal processing of ARP request (usually this is Ethernet broadcast packet) coming to the host is looking like the following: * the packet comes to arp_process() call and is passed through routing procedure * the request is put into the queue using pneigh_enqueue() if corresponding ARP record is not local (common case for container records on the host) * the request is processed by timer (within 80 jiffies by default) and ARP reply is sent from the same arp_process() using NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED condition (flag is set inside pneigh_enqueue()) And here the problem comes. Linux kernel calls pneigh_queue_purge() which destroys the whole queue of ARP requests on ANY network interface start/stop event through __neigh_ifdown(). This is actually not a problem within the original world as network interface start/stop was accessible to the host 'root' only, which could do more destructive things. But the world is changed and there are Linux containers available. Here container 'root' has an access to this API and could be considered as untrusted user in the hosting (container's) world. Thus there is an attack vector to other containers on node when container's root will endlessly start/stop interfaces. We have observed similar situation on a real production node when docker container was doing such activity and thus other containers on the node become not accessible. The patch proposed doing very simple thing. It drops only packets from the same namespace in the pneigh_queue_purge() where network interface state change is detected. This is enough to prevent the problem for the whole node preserving original semantics of the code. v2: - do del_timer_sync() if queue is empty after pneigh_queue_purge() v3: - rebase to net tree Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Daniel Borkmann Cc: David Ahern Cc: Yajun Deng Cc: Roopa Prabhu Cc: Christian Brauner Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Alexey Kuznetsov Cc: Alexander Mikhalitsyn Cc: Konstantin Khorenko Cc: kernel@openvz.org Cc: devel@openvz.org Investigated-by: Alexander Mikhalitsyn Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller commit 68a838b84effb7b57ba7d50b1863fc6ae35a54ce Author: Maxim Kochetkov Date: Thu Aug 11 12:48:40 2022 +0300 net: qrtr: start MHI channel after endpoit creation MHI channel may generates event/interrupt right after enabling. It may leads to 2 race conditions issues. 1) Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check: if (!qdev || mhi_res->transaction_status) return; Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at this moment. In this situation qrtr-ns will be unable to enumerate services in device. --------------------------------------------------------------- 2) Such event may come at the moment after dev_set_drvdata() and before qrtr_endpoint_register(). In this case kernel will panic with accessing wrong pointer at qcom_mhi_qrtr_dl_callback(): rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr, mhi_res->bytes_xferd); Because endpoint is not created yet. -------------------------------------------------------------- So move mhi_prepare_for_transfer_autoqueue after endpoint creation to fix it. Fixes: a2e2cc0dbb11 ("net: qrtr: Start MHI channels during init") Signed-off-by: Maxim Kochetkov Reviewed-by: Hemant Kumar Reviewed-by: Manivannan Sadhasivam Reviewed-by: Loic Poulain Signed-off-by: David S. Miller commit 72cbc8f04fe2fa93443c0fcccb7ad91dfea3d9ce Author: Jan Beulich Date: Thu Apr 28 16:50:29 2022 +0200 x86/PAT: Have pat_enabled() properly reflect state when running on Xen After commit ID in the Fixes: tag, pat_enabled() returns false (because of PAT initialization being suppressed in the absence of MTRRs being announced to be available). This has become a problem: the i915 driver now fails to initialize when running PV on Xen (i915_gem_object_pin_map() is where I located the induced failure), and its error handling is flaky enough to (at least sometimes) result in a hung system. Yet even beyond that problem the keying of the use of WC mappings to pat_enabled() (see arch_can_pci_mmap_wc()) means that in particular graphics frame buffer accesses would have been quite a bit less optimal than possible. Arrange for the function to return true in such environments, without undermining the rest of PAT MSR management logic considering PAT to be disabled: specifically, no writes to the PAT MSR should occur. For the new boolean to live in .init.data, init_cache_modes() also needs moving to .init.text (where it could/should have lived already before). [ bp: This is the "small fix" variant for stable. It'll get replaced with a proper PAT and MTRR detection split upstream but that is too involved for a stable backport. - additional touchups to commit msg. Use cpu_feature_enabled(). ] Fixes: bdd8b6c98239 ("drm/i915: replace X86_FEATURE_PAT with pat_enabled()") Signed-off-by: Jan Beulich Signed-off-by: Borislav Petkov Acked-by: Ingo Molnar Cc: Cc: Juergen Gross Cc: Lucas De Marchi Link: https://lore.kernel.org/r/9385fa60-fa5d-f559-a137-6608408f88b0@suse.com commit 82a1356a933d8443139f8886f11b63c974a09a67 Author: Samuel Holland Date: Thu Aug 11 22:16:23 2022 -0500 drm/sun4i: dsi: Prevent underflow when computing packet sizes Currently, the packet overhead is subtracted using unsigned arithmetic. With a short sync pulse, this could underflow and wrap around to near the maximal u16 value. Fix this by using signed subtraction. The call to max() will correctly handle any negative numbers that are produced. Apply the same fix to the other timings, even though those subtractions are less likely to underflow. Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support") Signed-off-by: Samuel Holland Reviewed-by: Jernej Skrabec Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org commit 2a29f80e155a9cf40ca8b6648bcdc8422db4c4e4 Author: Samuel Holland Date: Fri Aug 12 02:37:02 2022 -0500 dt-bindings: display: sun4i: Add D1 TCONs to conditionals When adding the D1 TCON bindings, I missed the conditional blocks that restrict the binding for TCON LCD vs TCON TV hardware. Add the D1 TCON variants to the appropriate blocks for DE2 TCON LCDs and TCON TVs. Fixes: ae5a5d26c15c ("dt-bindings: display: Add D1 display engine compatibles") Signed-off-by: Samuel Holland Acked-by: Krzysztof Kozlowski Signed-off-by: Maxime Ripard Link: https://lore.kernel.org/r/20220812073702.57618-1-samuel@sholland.org commit 8d48562a2729742f767b0fdd994d6b2a56a49c63 Author: Michael Ellerman Date: Mon Aug 15 16:55:23 2022 +1000 powerpc/pci: Fix get_phb_number() locking The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP warning on some systems: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1: #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0x64/0x220 Preemption disabled at: [<00000000>] 0x0 CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 Call Trace: [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 [d101de50] [c140852c] discover_phbs+0x30/0x4c [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c [d101df10] [c00086e0] kernel_init+0x34/0x160 [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64 This is because pcibios_alloc_controller() holds hose_spinlock but of_alias_get_id() takes of_mutex which can sleep. The hose_spinlock protects the phb_bitmap, and also the hose_list, but it doesn't need to be held while get_phb_number() calls the OF routines, because those are only looking up information in the device tree. So fix it by having get_phb_number() take the hose_spinlock itself, only where required, and then dropping the lock before returning. pcibios_alloc_controller() then needs to take the lock again before the list_add() but that's safe, the order of the list is not important. Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias") Reported-by: Guenter Roeck Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220815065550.1303620-1-mpe@ellerman.id.au commit 5dd8ce24667a70bb9f7808f5eec0354bd37290c6 Author: Steve French Date: Sat Aug 13 17:22:11 2022 -0500 cifs: missing directory in MAINTAINERS file The include/uapi/linux/cifs directory (not just fs/cifs and fs/smbfs_common) should be included in cifs entry in the MAINTAINERS file. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 0f761f5768b842fe483141bc59db5b4d66bcaf07 Author: Jiapeng Chong Date: Thu Jun 2 15:35:19 2022 +0800 drm/i915/gvt: Fix kernel-doc Fix the following W=1 kernel warnings: drivers/gpu/drm/i915/gvt/aperture_gm.c:308: warning: expecting prototype for inte_gvt_free_vgpu_resource(). Prototype was for intel_vgpu_free_resource() instead. drivers/gpu/drm/i915/gvt/aperture_gm.c:344: warning: expecting prototype for intel_alloc_vgpu_resource(). Prototype was for intel_vgpu_alloc_resource() instead. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220602073519.22363-1-jiapeng.chong@linux.alibaba.com Acked-by: Zhenyu Wang commit dca452041552a5a5a6aab3ebda32565fad003eb4 Author: Jiapeng Chong Date: Tue May 24 16:37:32 2022 +0800 drm/i915/gvt: Fix kernel-doc Fix the following W=1 kernel warnings: drivers/gpu/drm/i915/gvt/mmio_context.c:560: warning: expecting prototype for intel_gvt_switch_render_mmio(). Prototype was for intel_gvt_switch_mmio() instead. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220524083733.67148-1-jiapeng.chong@linux.alibaba.com Acked-by: Zhenyu Wang commit e16c2b8250262bc0bc531299e2c30641cee14221 Author: Jiapeng Chong Date: Tue May 24 16:37:33 2022 +0800 drm/i915/gvt: Fix kernel-doc Fix the following W=1 kernel warnings: drivers/gpu/drm/i915/gvt/handlers.c:3066: warning: expecting prototype for intel_t_default_mmio_write(). Prototype was for intel_vgpu_default_mmio_write() instead. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220524083733.67148-2-jiapeng.chong@linux.alibaba.com Acked-by: Zhenyu Wang commit 0e66978ebeb44f96ff4d26b2a83dc88a2bf887a6 Author: Julia Lawall Date: Sat May 21 13:10:59 2022 +0200 drm/i915/gvt: fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220521111145.81697-49-Julia.Lawall@inria.fr Acked-by: Zhenyu Wang commit 46f7ac3d7892e808c9ba01c39da6bb85cda26ecd Author: Robin Murphy Date: Wed Aug 3 15:58:57 2022 +0100 spi: bitbang: Fix lsb-first Rx Shifting the recieved bit by "bits" inserts it at the top of the *currently remaining* Tx data, so we end up accumulating the whole transfer into bit 0 of the output word. Oops. For the algorithm to work as intended, we need to remember where the top of the *original* word was, and shift Rx to there. Fixes: 1847e3046c52 ("spi: gpio: Implement LSB First bitbang support") Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/28324d8622da80461cce35a82859b003d6f6c4b0.1659538737.git.robin.murphy@arm.com Signed-off-by: Mark Brown commit 4d39265b930fb42eb396c3153a3f4afdee9f5c17 Merge: 568035b01cfb1 b4b5f29a076e5 Author: Mark Brown Date: Mon Aug 15 00:33:32 2022 +0100 Merge remote-tracking branch 'asoc/for-5.20' into asoc-6.0 commit 568035b01cfb107af8d2e4bd2fb9aea22cf5b868 Author: Linus Torvalds Date: Sun Aug 14 15:50:18 2022 -0700 Linux 6.0-rc1 commit 9f162193d6e48eb4ff51c2ea3612f1daebca1b7e Author: Yury Norov Date: Thu Aug 11 22:34:25 2022 -0700 radix-tree: replace gfp.h inclusion with gfp_types.h Radix tree header includes gfp.h for __GFP_BITS_SHIFT only. Now we have gfp_types.h for this. Fixes powerpc allmodconfig build: In file included from include/linux/nodemask.h:97, from include/linux/mmzone.h:17, from include/linux/gfp.h:7, from include/linux/radix-tree.h:12, from include/linux/idr.h:15, from include/linux/kernfs.h:12, from include/linux/sysfs.h:16, from include/linux/kobject.h:20, from include/linux/pci.h:35, from arch/powerpc/kernel/prom_init.c:24: include/linux/random.h: In function 'add_latent_entropy': >> include/linux/random.h:25:46: error: 'latent_entropy' undeclared (first use in this function); did you mean 'add_latent_entropy'? 25 | add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); | ^~~~~~~~~~~~~~ | add_latent_entropy include/linux/random.h:25:46: note: each undeclared identifier is reported only once for each function it appears in Reported-by: kernel test robot CC: Andy Shevchenko CC: Andrew Morton CC: Jason A. Donenfeld Signed-off-by: Yury Norov Signed-off-by: Linus Torvalds commit 74cbb480d0efa61efa09e5ebd081a32e1d355bba Merge: 5d6a0f4da9275 3f61631d47f11 Author: Linus Torvalds Date: Sun Aug 14 13:03:53 2022 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs lseek fix from Al Viro: "Fix proc_reg_llseek() breakage. Always had been possible if somebody left NULL ->proc_lseek, became a practical issue now" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: take care to handle NULL ->proc_lseek() commit 3f61631d47f115b83c935d0039f95cb68b0c8ab7 Author: Al Viro Date: Sun Aug 14 15:16:18 2022 -0400 take care to handle NULL ->proc_lseek() Easily done now, just by clearing FMODE_LSEEK in ->f_mode during proc_reg_open() for such entries. Fixes: 868941b14441 "fs: remove no_llseek" Signed-off-by: Al Viro commit 5d6a0f4da9275f6c212de33777778673ba91241a Merge: 96f86ff08332d 5ad3134dcf520 Author: Linus Torvalds Date: Sun Aug 14 09:28:54 2022 -0700 Merge tag 'for-linus-6.0-rc1b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull more xen updates from Juergen Gross: - fix the handling of the "persistent grants" feature negotiation between Xen blkfront and Xen blkback drivers - a cleanup of xen.config and adding xen.config to Xen section in MAINTAINERS - support HVMOP_set_evtchn_upcall_vector, which is more compliant to "normal" interrupt handling than the global callback used up to now - further small cleanups * tag 'for-linus-6.0-rc1b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: MAINTAINERS: add xen config fragments to XEN HYPERVISOR sections xen: remove XEN_SCRUB_PAGES in xen.config xen/pciback: Fix comment typo xen/xenbus: fix return type in xenbus_file_read() xen-blkfront: Apply 'feature_persistent' parameter when connect xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkback: fix persistent grants negotiation x86/xen: Add support for HVMOP_set_evtchn_upcall_vector commit 96f86ff08332d88defd35c330fc6dae219b9e264 Merge: d785610f052d7 7391db6459388 Author: Linus Torvalds Date: Sun Aug 14 09:22:11 2022 -0700 Merge tag 'perf-tools-fixes-for-v6.0-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull more perf tool updates from Arnaldo Carvalho de Melo: - 'perf c2c' now supports ARM64, adjust its output to cope with differences with what is in x86_64. Now go find false sharing on ARM64 (at least Neoverse) as well! - Refactor the JSON processing, making the output more compact and thus reducing the size of the resulting perf binary - Improvements for 'perf offcpu' profiling, including tracking child processes - Update Intel JSON metrics and events files for broadwellde, broadwellx, cascadelakex, haswellx, icelakex, ivytown, jaketown, knightslanding, sapphirerapids, skylakex and snowridgex - Add 'perf stat' JSON output and a 'perf test' entry for it - Ignore memfd and anonymous mmap events if jitdump present - Refactor 'perf test' shell tests allowing subdirs - Fix an error handling path in 'parse_perf_probe_command()' - Fixes for the guest Intel PT tracing patchkit in the 1st batch of this merge window - Print debuginfod queries if -v option is used, to explain delays in processing when debuginfo servers are enabled to fetch DSOs with richer symbol tables - Improve error message for 'perf record -p not_existing_pid' - Fix openssl and libbpf feature detection - Add PMU pai_crypto event description for IBM z16 on 'perf list' - Fix typos and duplicated words on comments in various places * tag 'perf-tools-fixes-for-v6.0-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (81 commits) perf test: Refactor shell tests allowing subdirs perf vendor events: Update events for snowridgex perf vendor events: Update events and metrics for skylakex perf vendor events: Update metrics for sapphirerapids perf vendor events: Update events for knightslanding perf vendor events: Update metrics for jaketown perf vendor events: Update metrics for ivytown perf vendor events: Update events and metrics for icelakex perf vendor events: Update events and metrics for haswellx perf vendor events: Update events and metrics for cascadelakex perf vendor events: Update events and metrics for broadwellx perf vendor events: Update metrics for broadwellde perf jevents: Fold strings optimization perf jevents: Compress the pmu_events_table perf metrics: Copy entire pmu_event in find metric perf pmu-events: Hide the pmu_events perf pmu-events: Don't assume pmu_event is an array perf pmu-events: Move test events/metrics to JSON perf test: Use full metric resolution perf pmu-events: Hide pmu_events_map ... commit d785610f052d7456497cdec2a2406f6d4b16569f Merge: aea23e7c464bf 83ee9f23763a4 Author: Linus Torvalds Date: Sun Aug 14 08:48:13 2022 -0700 Merge tag 'powerpc-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Ensure we never emit lwarx with EH=1 on 32-bit, because some 32-bit CPUs trap on it rather than ignoring it as they should. - Fix ftrace when building with clang, which was broken by some refactoring. - A couple of other minor fixes. Thanks to Christophe Leroy, Naveen N. Rao, Nick Desaulniers, Ondrej Mosnacek, Pali Rohár, Russell Currey, and Segher Boessenkool. * tag 'powerpc-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/kexec: Fix build failure from uninitialised variable powerpc/ppc-opcode: Fix PPC_RAW_TW() powerpc64/ftrace: Fix ftrace for clang builds powerpc: Make eh value more explicit when using lwarx powerpc: Don't hide eh field of lwarx behind a macro powerpc: Fix eh field when calling lwarx on PPC32 commit 8924779df820c53875abaeb10c648e9cb75b46d4 Author: Nadav Amit Date: Sat Aug 13 15:59:43 2022 -0700 x86/kprobes: Fix JNG/JNLE emulation When kprobes emulates JNG/JNLE instructions on x86 it uses the wrong condition. For JNG (opcode: 0F 8E), according to Intel SDM, the jump is performed if (ZF == 1 or SF != OF). However the kernel emulation currently uses 'and' instead of 'or'. As a result, setting a kprobe on JNG/JNLE might cause the kernel to behave incorrectly whenever the kprobe is hit. Fix by changing the 'and' to 'or'. Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Signed-off-by: Nadav Amit Signed-off-by: Ingo Molnar Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220813225943.143767-1-namit@vmware.com commit aea23e7c464bfdec04b52cf61edb62030e9e0d0a Merge: 332019e23a51d ed5fce76b5ea4 Author: Linus Torvalds Date: Sat Aug 13 17:35:58 2022 -0700 Merge tag 'pull-work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull /proc/mounts fix from Al Viro: "Fix for /proc/mounts escaping - escape the '#' character too" * tag 'pull-work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: vfs: escape hash as well commit 332019e23a51db1aa46fec695a9a763445fbe09f Merge: 8549a26308f94 7eb59a98701d3 Author: Linus Torvalds Date: Sat Aug 13 17:31:18 2022 -0700 Merge tag '5.20-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull more cifs updates from Steve French: - two fixes for stable, one for a lock length miscalculation, and another fixes a lease break timeout bug - improvement to handle leases, allows the close timeout to be configured more safely - five restructuring/cleanup patches * tag '5.20-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: Do not access tcon->cfids->cfid directly from is_path_accessible cifs: Add constructor/destructors for tcon->cfid SMB3: fix lease break timeout when multiple deferred close handles for the same file. smb3: allow deferred close timeout to be configurable cifs: Do not use tcon->cfid directly, use the cfid we get from open_cached_dir cifs: Move cached-dir functions into a separate file cifs: Remove {cifs,nfs}_fscache_release_page() cifs: fix lock length calculation commit 8549a26308f945bddb39391643eb102da026f0ef Author: David Howells Date: Wed Aug 10 18:52:47 2022 +0100 afs: Enable multipage folio support Enable multipage folio support for the afs filesystem. Support has already been implemented in netfslib, fscache and cachefiles and in most of afs, but I've waited for Matthew Wilcox's latest folio changes. Note that it does require a change to afs_write_begin() to return the correct subpage. This is a "temporary" change as we're working on getting rid of the need for ->write_begin() and ->write_end() completely, at least as far as network filesystems are concerned - but it doesn't prevent afs from making use of the capability. Signed-off-by: David Howells Acked-by: Matthew Wilcox (Oracle) Tested-by: kafs-testing@auristor.com Cc: Marc Dionne Cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/lkml/2274528.1645833226@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit f6eb0fed6a3957c0b93e3a00c1ffaad84d4ffc31 Merge: c5f1e32e32315 e362359ace6f8 Author: Linus Torvalds Date: Sat Aug 13 14:38:22 2022 -0700 Merge tag 'timers-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: "Misc timer fixes: - fix a potential use-after-free bug in posix timers - correct a prototype - address a build warning" * tag 'timers-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Cleanup CPU timers before freeing them during exec time: Correct the prototype of ns_to_kernel_old_timeval and ns_to_timespec64 posix-timers: Make do_clock_gettime() static commit c5f1e32e323157c71eacc6fe087db8d586ff6cb5 Merge: 04734361953b8 e6cfcdda8cbe8 Author: Linus Torvalds Date: Sat Aug 13 14:24:12 2022 -0700 Merge tag 'x86-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Fix the 'IBPB mitigated RETBleed' mode of operation on AMD CPUs (not turned on by default), which also need STIBP enabled (if available) to be '100% safe' on even the shortest speculation windows" * tag 'x86-urgent-2022-08-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Enable STIBP for IBPB mitigated RETBleed commit 04734361953b8cc30d5552c1abe907ccfc8bc0fa Merge: a976835fdb312 fe99b819487db Author: Linus Torvalds Date: Sat Aug 13 14:06:08 2022 -0700 Merge tag 'i2c-for-5.20-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: - two driver fixes for issues introduced this cycle - one trivial driver improvement regarding ACPI - more DTS conversion and additions - documentation updates - subsystem-wide move from strlcpy to strscpy * tag 'i2c-for-5.20-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: docs: i2c: i2c-sysfs: fix hyperlinks docs: i2c: i2c-sysfs: improve wording docs: i2c: instantiating-devices: add syntax coloring to dts and C blocks docs: i2c: smbus-protocol: improve DataLow/DataHigh definition docs: i2c: i2c-protocol: remove unused legend items docs: i2c: i2c-protocol,smbus-protocol: remove nonsense words docs: i2c: i2c-protocol: update introductory paragraph i2c: move core from strlcpy to strscpy i2c: move drivers from strlcpy to strscpy i2c: kempld: Support ACPI I2C device declaration i2c: mediatek: add i2c compatible for MT8188 dt-bindings: i2c: update bindings for mt8188 soc i2c: microchip-corei2c: fix erroneous late ack send dt-bindings: i2c: qcom,i2c-cci: convert to dtschema i2c: qcom-geni: Fix GPI DMA buffer sync-back commit a976835fdb312590ee5c085567a4e2b06da7ac33 Merge: 9872e4a8734c6 e4fe2a2fc423c Author: Linus Torvalds Date: Sat Aug 13 14:00:45 2022 -0700 Merge tag 'ntb-5.20' of https://github.com/jonmason/ntb Pull NTB updates from Jon Mason: "Non-Transparent Bridge updates. Fix of heap data and clang warnings, support for a new Intel NTB device, and NTB EndPoint Function (EPF) support and the various fixes for that" * tag 'ntb-5.20' of https://github.com/jonmason/ntb: MAINTAINERS: add PCI Endpoint NTB drivers to NTB files NTB: EPF: Tidy up some bounds checks NTB: EPF: Fix error code in epf_ntb_bind() PCI: endpoint: pci-epf-vntb: reduce several globals to statics PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init() PCI: endpoint: Fix Kconfig dependency NTB: EPF: set pointer addr to null using NULL rather than 0 Documentation: PCI: extend subheading underline for "lspci output" section Documentation: PCI: Use code-block block for scratchpad registers diagram Documentation: PCI: Add specification for the PCI vNTB function device PCI: endpoint: Support NTB transfer between RC and EP NTB: epf: Allow more flexibility in the memory BAR map method PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address ntb: intel: add GNR support for Intel PCIe gen5 NTB NTB: ntb_tool: uninitialized heap data in tool_fn_write() ntb: idt: fix clang -Wformat warnings commit 9872e4a8734c68b78e8782e4f7f49e22cd6e9463 Merge: e140f731f9807 031d166f968ef Author: Linus Torvalds Date: Sat Aug 13 13:50:11 2022 -0700 Merge tag 'xfs-5.20-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull more xfs updates from Darrick Wong: "There's not a lot this time around, just the usual bug fixes and corrections for missing error returns. - Return error codes from block device flushes to userspace - Fix a deadlock between reclaim and mount time quotacheck - Fix an unnecessary ENOSPC return when doing COW on a filesystem with severe free space fragmentation - Fix a miscalculation in the transaction reservation computations for file removal operations" * tag 'xfs-5.20-merge-8' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix inode reservation space for removing transaction xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork xfs: fix intermittent hang during quotacheck xfs: check return codes when flushing block devices commit e140f731f9807035e967c401198171f316744696 Merge: abe7a481aac9c c6380f9924270 Author: Linus Torvalds Date: Sat Aug 13 13:41:48 2022 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Mostly small bug fixes and trivial updates. The major new core update is a change to the way device, target and host reference counting is done to try to make it more robust (this change has soaked for a while to try to winkle out any bugs)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pm8001: Fix typo 'the the' in comment scsi: megaraid_sas: Remove redundant variable cmd_type scsi: FlashPoint: Remove redundant variable bm_int_st scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: core: Call blk_mq_free_tag_set() earlier scsi: core: Simplify LLD module reference counting scsi: core: Make sure that hosts outlive targets scsi: core: Make sure that targets outlive devices scsi: ufs: ufs-pci: Correct check for RESET DSM scsi: target: core: De-RCU of se_lun and se_lun acl scsi: target: core: Fix race during ACL removal scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: ufs: core: Increase the maximum data buffer size scsi: lpfc: Check the return value of alloc_workqueue() commit abe7a481aac9c277798661f846222f8ad7a6aed5 Merge: 1da8cf961bb13 aa0c680c3aa96 Author: Linus Torvalds Date: Sat Aug 13 13:37:36 2022 -0700 Merge tag 'block-6.0-2022-08-12' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request - print nvme connect Linux error codes properly (Amit Engel) - fix the fc_appid_store return value (Christoph Hellwig) - fix a typo in an error message (Christophe JAILLET) - add another non-unique identifier quirk (Dennis P. Kliem) - check if the queue is allocated before stopping it in nvme-tcp (Maurizio Lombardi) - restart admin queue if the caller needs to restart queue in nvme-fc (Ming Lei) - use kmemdup instead of kmalloc + memcpy in nvme-auth (Zhang Xiaoxu) - __alloc_disk_node() error handling fix (Rafael) * tag 'block-6.0-2022-08-12' of git://git.kernel.dk/linux-block: block: Do not call blk_put_queue() if gendisk allocation fails nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S70 nvme-tcp: check if the queue is allocated before stopping it nvme-fabrics: Fix a typo in an error message nvme-fabrics: parse nvme connect Linux error codes nvmet-auth: use kmemdup instead of kmalloc + memcpy nvme-fc: fix the fc_appid_store return value nvme-fc: restart admin queue if the caller needs to restart queue commit 1da8cf961bb13f4c3ea11373696b5ac986a47cde Merge: 69dac8e431af2 9c71d39aa0f40 Author: Linus Torvalds Date: Sat Aug 13 13:28:54 2022 -0700 Merge tag 'io_uring-6.0-2022-08-13' of git://git.kernel.dk/linux-block Pull io_uring fixes from Jens Axboe: - Regression fix for this merge window, fixing a wrong order of arguments for io_req_set_res() for passthru (Dylan) - Fix for the audit code leaking context memory (Peilin) - Ensure that provided buffers are memcg accounted (Pavel) - Correctly handle short zero-copy sends (Pavel) - Sparse warning fixes for the recvmsg multishot command (Dylan) - Error handling fix for passthru (Anuj) - Remove randomization of struct kiocb fields, to avoid it growing in size if re-arranged in such a fashion that it grows more holes or padding (Keith, Linus) - Small series improving type safety of the sqe fields (Stefan) * tag 'io_uring-6.0-2022-08-13' of git://git.kernel.dk/linux-block: io_uring: add missing BUILD_BUG_ON() checks for new io_uring_sqe fields io_uring: make io_kiocb_to_cmd() typesafe fs: don't randomize struct kiocb fields io_uring: consistently make use of io_notif_to_data() io_uring: fix error handling for io_uring_cmd io_uring: fix io_recvmsg_prep_multishot sparse warnings io_uring/net: send retry for zerocopy io_uring: mem-account pbuf buckets audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker() io_uring: pass correct parameters to io_req_set_res commit 7391db6459388d47d657aad633cb55fc04a8d4fb Author: Carsten Haitzler Date: Fri Aug 12 13:16:28 2022 +0100 perf test: Refactor shell tests allowing subdirs This is a prelude to adding more tests to shell tests and in order to support putting those tests into subdirectories, I need to change the test code that scans/finds and runs them. To support subdirs I have to recurse so it's time to refactor the code to allow this and centralize the shell script finding into one location and only one single scan that builds a list of all the found tests in memory instead of it being duplicated in 3 places. This code also optimizes things like knowing the max width of desciption strings (as we can do that while we scan instead of a whole new pass of opening files). It also more cleanly filters scripts to see only *.sh files thus skipping random other files in directories like *~ backup files, other random junk/data files that may appear and the scripts must be executable to make the cut (this ensures the script lib dir is not seen as scripts to run). This avoids perf test running previous older versions of test scripts that are editor backup files as well as skipping perf.data files that may appear and so on. Reviewed-by: Leo Yan Signed-off-by: Carsten Haitzler Tested-by: Leo Yan Cc: Mathieu Poirier Cc: Mike Leach Cc: Suzuki Poulouse Cc: coresight@lists.linaro.org Link: https://lore.kernel.org/r/20220812121641.336465-2-carsten.haitzler@foss.arm.com Signed-off-by: Arnaldo Carvalho de Melo commit aa0d6e9cc23e996b484725d0a31906809862d678 Author: Zhengjun Xing Date: Fri Aug 12 16:52:39 2022 +0800 perf vendor events: Update events for snowridgex Update the events to v1.20, update events for snowridgex by the latest event converter tools. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the snowridgex files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-12-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ce87616d0dff3a9b80158bb9a9f6c20c1a88b378 Author: Zhengjun Xing Date: Fri Aug 12 16:52:38 2022 +0800 perf vendor events: Update events and metrics for skylakex Update the events to v1.28, the metrics are based on TMA 4.4 full, update events and metrics for skylakex by the latest event converter tools. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the skylakex files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-11-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 74d8ca6d85a31c537a7934683bfda617ee95a452 Author: Zhengjun Xing Date: Fri Aug 12 16:52:37 2022 +0800 perf vendor events: Update metrics for sapphirerapids The metrics are based on TMA 4.4 full, add new metrics “UNCORE_FREQ” for sapphirerapids. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the sapphirerapids files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-10-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 107630e6a57544dae5357834244ebbffd0ba4c92 Author: Zhengjun Xing Date: Fri Aug 12 16:52:36 2022 +0800 perf vendor events: Update events for knightslanding Update the events to v9, update events for knightslanding by the latest event converter tools. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the knightslanding files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-9-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b823ee183dc4224f29a8b5e172b647256da24c0e Author: Zhengjun Xing Date: Fri Aug 12 16:52:35 2022 +0800 perf vendor events: Update metrics for jaketown The metrics are based on TMA 4.4 full, add new metrics “UNCORE_FREQ” for jaketown. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the jaketown files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-8-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit cb73eeb95a2c293fa011e3151d9d57e249122a18 Author: Zhengjun Xing Date: Fri Aug 12 16:52:34 2022 +0800 perf vendor events: Update metrics for ivytown The metrics are based on TMA 4.4 full, add new metrics “UNCORE_FREQ” for ivytown. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the ivytown files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-7-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b8d4fbfb04e1041905d8c0afaa545508eba9cb40 Author: Zhengjun Xing Date: Fri Aug 12 16:52:33 2022 +0800 perf vendor events: Update events and metrics for icelakex Update the events to v1.15, the metrics are based on TMA 4.4 full, update events and metrics for icelakex by the latest event converter tools. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the icelakex files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-6-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 575c3640a4aa475c8620a9120b6df340731fc9a0 Author: Zhengjun Xing Date: Fri Aug 12 16:52:32 2022 +0800 perf vendor events: Update events and metrics for haswellx Update the events to v25, the metrics are based on TMA 4.4 full, update events and metrics for haswellx by the latest event converter tools. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the haswellx files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-5-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit c6e9c0441801c3093d5e86c04db1880a3e273152 Author: Zhengjun Xing Date: Fri Aug 12 16:52:31 2022 +0800 perf vendor events: Update events and metrics for cascadelakex Update to v16, the metrics are based on TMA 4.4 full, update events and add new metrics “UNCORE_FREQ” for cascadelakex. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the cascadelakex files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-4-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e349fa6cc824450f1aa0c4acbfefaa3c9a0cae9b Author: Zhengjun Xing Date: Fri Aug 12 16:52:30 2022 +0800 perf vendor events: Update events and metrics for broadwellx Update to v19, the metrics are based on TMA 4.4 full, update events and add new metrics “UNCORE_FREQ” for broadwellx. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the broadwellx files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-3-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit bf79e18fdf65b451acf00457910879115cc51b1c Author: Zhengjun Xing Date: Fri Aug 12 16:52:29 2022 +0800 perf vendor events: Update metrics for broadwellde The metrics are based on TMA 4.4 full, add new metrics “UNCORE_FREQ” for broadwellde. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the broadwellde files into perf. Signed-off-by: Xing Zhengjun Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220812085239.3089231-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d0313e629f2690edfd269896b398048275227db0 Author: Ian Rogers Date: Fri Aug 12 16:09:49 2022 -0700 perf jevents: Fold strings optimization If a shorter string ends a longer string then the shorter string may reuse the longer string at an offset. For example, on x86 the event arith.cycles_div_busy and cycles_div_busy can be folded, even though they have difference names the strings are identical after 6 characters. cycles_div_busy can reuse the arith.cycles_div_busy string at an offset of 6. In pmu-events.c this looks like the following where the 'also:' lists folded strings: /* offset=177541 */ "arith.cycles_div_busy\000\000pipeline\000Cycles the divider is busy\000\000\000event=0x14,period=2000000,umask=0x1\000\000\000\000\000\000\000\000\000" /* also: cycles_div_busy\000\000pipeline\000Cycles the divider is busy\000\000\000event=0x14,period=2000000,umask=0x1\000\000\000\000\000\000\000\000\000 */ As jevents.py combines multiple strings for an event into a larger string, the amount of folding is minimal as all parts of the event must align. Other organizations can benefit more from folding, but lose space by say recording more offsets. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-15-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9118259c1dc275e0f7b90da0d3cbaadc4e1ca3fe Author: Ian Rogers Date: Fri Aug 12 16:09:48 2022 -0700 perf jevents: Compress the pmu_events_table The pmu_events array requires 15 pointers per entry which in position independent code need relocating. Change the array to be an array of offsets within a big C string. Only the offset of the first variable is required, subsequent variables are stored in order after the \0 terminator (requiring a byte per variable rather than 4 bytes per offset). The file size savings are: no jevents - the same 19,788,464bytes x86 jevents - ~16.7% file size saving 23,744,288bytes vs 28,502,632bytes all jevents - ~19.5% file size saving 24,469,056bytes vs 30,379,920bytes default build options plus NO_LIBBFD=1. For example, the x86 build savings come from .rela.dyn and .data.rel.ro becoming smaller by 3,157,032bytes and 3,042,016bytes respectively. .rodata increases by 1,432,448bytes, giving an overall 4,766,600bytes saving. To make metric strings more shareable, the topic is changed from say 'skx metrics' to just 'metrics'. To try to help with the memory layout the pmu_events are ordered as used by perf qsort comparator functions. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-14-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d3abd7b8bd8af16703e81410de3e35bf4de3a9ce Author: Ian Rogers Date: Fri Aug 12 16:09:47 2022 -0700 perf metrics: Copy entire pmu_event in find metric The pmu_event passed to the pmu_events_table_for_each_event is invalid after the loop. Copy the entire struct in metricgroup__find_metric. Reduce the scope of this function to static. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-13-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1ba3752aec30c04bfb7c82b44332ff98294ec0b8 Author: Ian Rogers Date: Fri Aug 12 16:09:46 2022 -0700 perf pmu-events: Hide the pmu_events Hide that the pmu_event structs are an array with a new wrapper struct. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-12-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 660842e468dcefb5d1d4fb40ed3abe4d1388dff7 Author: Ian Rogers Date: Fri Aug 12 16:09:45 2022 -0700 perf pmu-events: Don't assume pmu_event is an array The current code assumes that a struct pmu_event can be iterated over forward until a NULL pmu_event is encountered. This makes it difficult to refactor pmu_event. Add a loop function taking a callback function that's passed the struct pmu_event. This way the pmu_event is only needed for one element and not an entire array. Switch existing code iterating over the pmu_event arrays to use the new loop function pmu_events_table_for_each_event. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-11-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7ae5c03a27934bee9daaeede1b0b1d4bada61ffd Author: Ian Rogers Date: Fri Aug 12 16:09:44 2022 -0700 perf pmu-events: Move test events/metrics to JSON Move arrays of pmu_events into the JSON code so that it may be regenerated and modified by the jevents.py script. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-10-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 64234c141bc8fb76c3166d39143f2bf66ffe9a22 Author: Ian Rogers Date: Fri Aug 12 16:09:43 2022 -0700 perf test: Use full metric resolution The simple metric resolution doesn't handle recursion properly, switch to use the full resolution as with the parse-metric tests which also increases coverage. Don't set the values for the metric backward as failures to generate a result are ignored. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 29be2fe0c157ee5c8c5d9571f42dc1f0f5d8f67b Author: Ian Rogers Date: Fri Aug 12 16:09:42 2022 -0700 perf pmu-events: Hide pmu_events_map Move usage of the table to pmu-events.c so it may be hidden. By abstracting the table the implementation can later be changed. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit eeac7730418563152b0e3172bce9bac4ff6d6bc4 Author: Ian Rogers Date: Fri Aug 12 16:09:41 2022 -0700 perf pmu-events: Avoid passing pmu_events_map Preparation for hiding pmu_events_map as an implementation detail. While the map is passed, the table of events is all that is normally wanted. While modifying the function's types, rename pmu_events_map__find to pmu_events_table__find to match later encapsulation. Similarly rename pmu_add_cpu_aliases_map to pmu_add_cpu_aliases_table. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2519db2a9dc4f7ca5c1ad8309c51262e5b8ef89f Author: Ian Rogers Date: Fri Aug 12 16:09:40 2022 -0700 perf pmu-events: Hide pmu_sys_event_tables Move usage of the table to pmu-events.c so it may be hidden. By abstracting the table the implementation can later be changed. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 7b2f844c43cef59740095dfa1f6366f3dfb318dc Author: Ian Rogers Date: Fri Aug 12 16:09:39 2022 -0700 perf jevents: Sort JSON files entries Sort the JSON files entries on conversion to C. The sort order tries to replicated cmp_sevent from pmu.c so that the input there is already sorted except for sysfs events. Specifically, the sort order is given by the tuple: (not j.desc is None, fix_none(j.topic), fix_none(j.name), fix_none(j.pmu), fix_none(j.metric_name)) which is putting events with descriptions and topics before those without, then sorting by name, then pmu and finally metric_name Add the topic to JsonEvent on reading to simplify. Remove an unnecessary lambda in the JSON reading. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ee2ce6fdc8021979346f71056938c60335a7570c Author: Ian Rogers Date: Fri Aug 12 16:09:38 2022 -0700 perf jevents: Provide path to JSON file on error If a JSONDecoderError or similar is raised then it is useful to know the path. Print this and then raise the exception agan. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit f793ae185e27645ad83942ef6fffd901b8169941 Author: Ian Rogers Date: Fri Aug 12 16:09:37 2022 -0700 perf jevents: Remove the type/version variables pmu_events_map has a type variable that is always initialized to "core" and a version variable that is never read. Remove these from the API as it is straightforward to add them back when necessary. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 099b157c08e8e8faa622d4bb70826ae179248fd4 Author: Ian Rogers Date: Fri Aug 12 16:09:36 2022 -0700 perf jevent: Add an 'all' architecture argument When 'all' is passed as the architecture generate a mapping table for all architectures. This simplifies testing. To identify the table for an architecture add an arch variable to the pmu_events_map. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220812230949.683239-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5f6277a0c15e1ea54b6fd3d78c9fff7bfe42556c Author: Trond Myklebust Date: Sat Aug 13 08:51:45 2022 -0400 NFS: Cleanup to remove unused flag NFS_CONTEXT_RESEND_WRITES Signed-off-by: Trond Myklebust commit edf79efcc9d0cf38fcc1efe688fd697b9bb0ddc4 Author: Trond Myklebust Date: Sat Aug 13 08:46:35 2022 -0400 NFS: Remove a bogus flag setting in pnfs_write_done_resend_to_mds Since pnfs_write_done_resend_to_mds() does not actually call end_page_writeback() on the pages that are being redirected to the metadata server, callers of fsync() do not see the I/O as complete until the writeback to the MDS finishes. We therefore do not need to set NFS_CONTEXT_RESEND_WRITES, since there is nothing to redrive. Signed-off-by: Trond Myklebust commit 67f4b5dc49913abcdb5cc736e73674e2f352f81d Author: Trond Myklebust Date: Sat Aug 13 08:22:25 2022 -0400 NFS: Fix another fsync() issue after a server reboot Currently, when the writeback code detects a server reboot, it redirties any pages that were not committed to disk, and it sets the flag NFS_CONTEXT_RESEND_WRITES in the nfs_open_context of the file descriptor that dirtied the file. While this allows the file descriptor in question to redrive its own writes, it violates the fsync() requirement that we should be synchronising all writes to disk. While the problem is infrequent, we do see corner cases where an untimely server reboot causes the fsync() call to abandon its attempt to sync data to disk and causing data corruption issues due to missed error conditions or similar. In order to tighted up the client's ability to deal with this situation without introducing livelocks, add a counter that records the number of times pages are redirtied due to a server reboot-like condition, and use that in fsync() to redrive the sync to disk. Fixes: 2197e9b06c22 ("NFS: Fix up fsync() when the server rebooted") Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust commit 2067231a9e2cbbcae0a4aca6ac36ff2dd6a7b701 Author: Sun Ke Date: Fri Aug 12 09:14:40 2022 +0800 NFS: Fix missing unlock in nfs_unlink() Add the missing unlock before goto. Fixes: 3c59366c207e ("NFS: don't unhash dentry during unlink/rename") Signed-off-by: Sun Ke Signed-off-by: Trond Myklebust commit 92cb6e2e5dbaea02c2fa317f3543c8918db25e89 Author: ZiyangZhang Date: Wed Aug 10 13:52:12 2022 +0800 ublk_drv: update iod->addr for UBLK_IO_NEED_GET_DATA If ublksrv sends UBLK_IO_NEED_GET_DATA with new allocated io buffer, we have to update iod->addr in task_work before calling io_uring_cmd_done(). Then usersapce target can handle (write)io request with the new io buffer reading from updated iod. Without this change, userspace target may touch a wrong io buffer! Signed-off-by: ZiyangZhang Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20220810055212.66417-1-ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit 777885673122b78b2abd2f1e428730961a786ff2 Author: Hongbin Wang Date: Thu Aug 11 23:38:33 2022 -0400 ip6_tunnel: Fix the type of functions Functions ip6_tnl_change, ip6_tnl_update and ip6_tnl0_update do always return 0, change the type of functions to void. Signed-off-by: Hongbin Wang Signed-off-by: David S. Miller commit 69dac8e431af26173ca0a1ebc87054e01c585bcc Merge: 6c833c0581f1c 5cef38dd03f33 Author: Linus Torvalds Date: Fri Aug 12 18:39:43 2022 -0700 Merge tag 'riscv-for-linus-5.20-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: "There's still a handful of new features in here, but there are a lot of fixes/cleanups as well: - Support for the Zicbom extension for explicit cache-block management, along with the necessary bits to make the non-standard cache management ops on the Allwinner D1 function - Support for the Zihintpause extension, which codifies a go-slow instruction used for cpu_relax() - Support for the Sstc extension for supervisor-mode timer/counter management - Many device tree fixes and cleanups, including a large set for the Canaan device trees - A handful of fixes and cleanups for the PMU driver" * tag 'riscv-for-linus-5.20-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (43 commits) dt-bindings: gpio: sifive: add gpio-line-names wireguard: selftests: set CONFIG_NONPORTABLE on riscv32 RISC-V: KVM: Support sstc extension RISC-V: Improve SBI definitions RISC-V: Move counter info definition to sbi header file RISC-V: Fix SBI PMU calls for RV32 RISC-V: Update user page mapping only once during start RISC-V: Fix counter restart during overflow for RV32 RISC-V: Prefer sstc extension if available RISC-V: Enable sstc extension parsing from DT RISC-V: Add SSTC extension CSR details riscv:uprobe fix SR_SPIE set/clear handling dt-bindings: riscv: fix SiFive l2-cache's cache-sets riscv: ensure cpu_ops_sbi is declared RISC-V: cpu_ops_spinwait.c should include head.h RISC-V: Declare cpu_ops_spinwait in riscv: dts: starfive: correct number of external interrupts riscv: dts: sifive unmatched: Add PWM controlled LEDs riscv/purgatory: Omit use of bin2c riscv/purgatory: hard-code obj-y in Makefile ... commit 6c833c0581f1c15db2e0344da19360cba75a3351 Merge: 3d076fec5a0c3 8f426582e0e0c Author: Linus Torvalds Date: Fri Aug 12 18:23:52 2022 -0700 Merge tag 'devicetree-fixes-for-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix schema warnings in qcom,ipq6018-pinctrl and sdhci-msm - Convert Qualcomm SPMI PMIC to DT schema - Make secure interrupt optional for arm,mhu - Fix google,cros-ec-typec binding allowed properties - Update a bunch of bouncing email addresses * tag 'devicetree-fixes-for-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: chrome: google,cros-ec-typec: restrict allowed properties dt-bindings: Drop Dan Murphy and Ricardo Rivera-Matos dt-bindings: Drop Robert Jones dt-bindings: Drop Beniamin Bia and Stefan Popa dt-bindings: iio: Drop Bogdan Pricop dt-bindings: iio: Drop Joachim Eastwood dt-bindings: mailbox: arm,mhu: Make secure interrupt optional dt-bindings: pinctrl: qcom,ipq6018: Fix example 'gpio-ranges' size dt-bindings: Drop DT_MK_SCHEMA_FLAGS conditional selecting schema files dt-bindings: mfd: convert to yaml Qualcomm SPMI PMIC dt-bindings: mmc: sdhci-msm: Fix 'operating-points-v2 was unexpected' issue dt-bindings: display: simple-framebuffer: Drop Bartlomiej Zolnierkiewicz commit 3d076fec5a0c3e66e1d8cb16015ea9a59b66ae1b Merge: 4a9350597aff5 03c4cd6f89e07 Author: Linus Torvalds Date: Fri Aug 12 18:17:42 2022 -0700 Merge tag 'rtc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "New drivers: - Microchip PolarFire - Nuvoton NCT3018Y - TI K3 RTC Subsystem: - Replace flush_scheduled_work() with flush_work() - Remove deprecated ida_simple_get()/ida_simple_remove() calls Drivers: - use simple i2c probe where possible - sun6i: add R329 support - zynqmp: add calibration support - vr41xx: remove unused driver" * tag 'rtc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (31 commits) rtc: spear: set range max rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: zynqmp: initialize fract_tick rtc: Add NCT3018Y real time clock driver dt-bindings: rtc: nuvoton: add NCT3018Y Real Time Clock dt-bindings: rtc: nxp,pcf85063: Convert to DT schema dt-bindings: rtc: microcrystal,rv3032: Add missing type to 'trickle-voltage-millivolt' rtc: rx8025: fix 12/24 hour mode detection on RX-8035 rtc: cros-ec: Only warn once in .remove() about notifier_chain problems rtc: vr41xx: remove driver rtc: mpfs: remove 'pending' variable from mpfs_rtc_wakeup_irq_handler() rtc: rv8803: fix missing unlock on error in rv8803_set_time() rtc: zynqmp: Add calibration set and get support rtc: zynqmp: Updated calibration value dt-bindings: rtc: zynqmp: Add clock information rtc: sun6i: add support for R329 RTC rtc: Directly use ida_alloc()/free() rtc: Introduce ti-k3-rtc dt-bindings: rtc: Add TI K3 RTC description dt-bindings: rtc: qcom-pm8xxx-rtc: Update the maintainers section ... commit 246bbf2f977ea36aaf41f5d24370fef433250728 Author: Sergei Antonov Date: Thu Aug 11 10:09:39 2022 +0300 net: dsa: mv88e6060: prevent crash on an unused port If the port isn't a CPU port nor a user port, 'cpu_dp' is a null pointer and a crash happened on dereferencing it in mv88e6060_setup_port(): [ 9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014 ... [ 9.942216] mv88e6060_setup from dsa_register_switch+0x814/0xe84 [ 9.948616] dsa_register_switch from mdio_probe+0x2c/0x54 [ 9.954433] mdio_probe from really_probe.part.0+0x98/0x2a0 [ 9.960375] really_probe.part.0 from driver_probe_device+0x30/0x10c [ 9.967029] driver_probe_device from __device_attach_driver+0xb8/0x13c [ 9.973946] __device_attach_driver from bus_for_each_drv+0x90/0xe0 [ 9.980509] bus_for_each_drv from __device_attach+0x110/0x184 [ 9.986632] __device_attach from bus_probe_device+0x8c/0x94 [ 9.992577] bus_probe_device from deferred_probe_work_func+0x78/0xa8 [ 9.999311] deferred_probe_work_func from process_one_work+0x290/0x73c [ 10.006292] process_one_work from worker_thread+0x30/0x4b8 [ 10.012155] worker_thread from kthread+0xd4/0x10c [ 10.017238] kthread from ret_from_fork+0x14/0x3c Fixes: 0abfd494deef ("net: dsa: use dedicated CPU port") CC: Vivien Didelot CC: Florian Fainelli Signed-off-by: Sergei Antonov Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220811070939.1717146-1-saproj@gmail.com Signed-off-by: Jakub Kicinski commit 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 Author: Csókás Bence Date: Thu Aug 11 12:13:49 2022 +0200 fec: Fix timer capture timing in `fec_ptp_enable_pps()` Code reimplements functionality already in `fec_ptp_read()`, but misses check for FEC_QUIRK_BUG_CAPTURE. Replace with function call. Fixes: 28b5f058cf1d ("net: fec: ptp: fix convergence issue to support LinuxPTP stack") Signed-off-by: Csókás Bence Link: https://lore.kernel.org/r/20220811101348.13755-1-csokas.bence@prolan.hu Signed-off-by: Jakub Kicinski commit 9c71d39aa0f40d4e6bfe14958045a42c722bd327 Author: Stefan Metzmacher Date: Thu Aug 11 09:11:16 2022 +0200 io_uring: add missing BUILD_BUG_ON() checks for new io_uring_sqe fields Signed-off-by: Stefan Metzmacher Link: https://lore.kernel.org/r/ffcaf8dc4778db4af673822df60dbda6efdd3065.1660201408.git.metze@samba.org Signed-off-by: Jens Axboe commit f2ccb5aed7bce1d8b3ed5b3385759a5509663028 Author: Stefan Metzmacher Date: Thu Aug 11 09:11:15 2022 +0200 io_uring: make io_kiocb_to_cmd() typesafe We need to make sure (at build time) that struct io_cmd_data is not casted to a structure that's larger. Signed-off-by: Stefan Metzmacher Link: https://lore.kernel.org/r/c024cdf25ae19fc0319d4180e2298bade8ed17b8.1660201408.git.metze@samba.org Signed-off-by: Jens Axboe commit addebd9ac9ca0ef8b3764907bf8018e48caffc64 Author: Keith Busch Date: Fri Aug 12 15:56:33 2022 -0700 fs: don't randomize struct kiocb fields This is a size sensitive structure and randomizing can introduce extra padding that breaks io_uring's fixed size expectations. There are few fields here as it is, half of which need a fixed order to optimally pack, so the randomization isn't providing much. Suggested-by: Linus Torvalds Signed-off-by: Keith Busch Link: https://lore.kernel.org/io-uring/b6f508ca-b1b2-5f40-7998-e4cff1cf7212@kernel.dk/ Signed-off-by: Jens Axboe commit 7eb59a98701d3113671b513593bb489cc76f58d2 Author: Ronnie Sahlberg Date: Thu Aug 11 19:51:18 2022 -0500 cifs: Do not access tcon->cfids->cfid directly from is_path_accessible cfids will soon keep a list of cached fids so we should not access this directly from outside of cached_dir.c Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit e4fe2a2fc423cb51bfd36c14f95f3ca1d279ca92 Author: Jon Mason Date: Fri Aug 12 15:42:05 2022 -0400 MAINTAINERS: add PCI Endpoint NTB drivers to NTB files The PCI Endpoint NTB drivers are under the NTB umbrella. Add an entry there to allow for notification of changes for it. Signed-off-by: Jon Mason Acked-by: Bjorn Helgaas commit 8d33834f9fb06b5349b145e6499aca976deed3d8 Author: Yang Li Date: Thu Aug 4 08:52:13 2022 +0800 perf stat: Remove duplicated include in builtin-stat.c util/topdown.h is included twice in builtin-stat.c, remove one of them. Reported-by: Abaci Robot Signed-off-by: Yang Li Tested-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1818 Link: https://lore.kernel.org/r/20220804005213.71990-1-yang.lee@linux.alibaba.com Signed-off-by: Arnaldo Carvalho de Melo commit 0029e8ace159216d668f9ae6d3892cfebde848c6 Author: shaomin Deng Date: Sun Aug 7 12:02:39 2022 -0400 perf scripting python: Delete repeated word in comments Delete the repeated word "into" in comments. Signed-off-by: shaomin Deng Cc: Alexander Shishkin Cc: Mark Rutland Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220807160239.474-1-dengshaomin@cdjrlc.com Signed-off-by: Arnaldo Carvalho de Melo commit 987f5cbd2f3f3300c3f681130b5c67661efa53a5 Author: shaomin Deng Date: Sun Aug 7 11:55:49 2022 -0400 perf tools: Fix double word in comments Delete the repeated word "to" in comments. Signed-off-by: shaomin Deng Cc: Mark Rutland Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220807155549.30953-1-dengshaomin@cdjrlc.com Signed-off-by: Arnaldo Carvalho de Melo commit 632f5c224e95ce6846724a0720f7e7ef704fb858 Author: shaomin Deng Date: Sun Aug 7 04:46:29 2022 -0400 perf trace: Fix double word in comments Delete repeated word "and" in comments. Signed-off-by: shaomin Deng Cc: Mark Rutland Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220807084629.23121-1-dengshaomin@cdjrlc.com Signed-off-by: Arnaldo Carvalho de Melo commit ae4e4a0ba30aa3978ac17a919b2ff7b073faa2f3 Author: shaomin Deng Date: Sun Aug 7 04:06:42 2022 -0400 perf script: Delete repeated word "from" Delete the repeated word "from" in code. Signed-off-by: shaomin Deng Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220807080642.13004-1-dengshaomin@cdjrlc.com Signed-off-by: Arnaldo Carvalho de Melo commit f3c96bec7c6344ab30d6f01b97e3eba0b2fe4fd9 Author: shaomin Deng Date: Sun Aug 7 03:47:53 2022 -0400 perf test: Fix double word in comments Delete the redundant word "then" in comments. Signed-off-by: shaomin Deng Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/20220807074753.7857-1-dengshaomin@cdjrlc.com Signed-off-by: Arnaldo Carvalho de Melo commit 8f426582e0e0c9bbd58e170e1b209334eb5df79e Author: Krzysztof Kozlowski Date: Thu Aug 11 09:22:45 2022 +0300 dt-bindings: chrome: google,cros-ec-typec: restrict allowed properties Describe exactly what properties are allowed in Google Chrome OS EC Type C port, so the schema can properly validate the DTS. Existing DTS defines always connectors with unit addresses, not a sole "connector" child. Signed-off-by: Krzysztof Kozlowski Acked-by: Prashant Malani Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220811062245.4316-1-krzysztof.kozlowski@linaro.org commit 07d1caa4c2ccd28ade90f16d1967015214db40b7 Author: Krzysztof Kozlowski Date: Tue Aug 9 19:27:52 2022 +0300 dt-bindings: Drop Dan Murphy and Ricardo Rivera-Matos Emails to Dan Murphy and Ricardo Rivera-Matos bounce ("550 Invalid recipient"). Andrew Davis agreed to take over the bindings. Signed-off-by: Krzysztof Kozlowski Acked-by: Mark Brown Acked-by: Andrew Davis Acked-by: Jonathan Cameron Acked-by: Sebastian Reichel Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220809162752.10186-6-krzysztof.kozlowski@linaro.org commit 3156c50fdaab41ec4f6e03c1e603703b9985bf48 Author: Krzysztof Kozlowski Date: Tue Aug 9 19:27:51 2022 +0300 dt-bindings: Drop Robert Jones Emails to Robert Jones bounce ("550 5.2.1 The email account that you tried to reach is disabled"). Signed-off-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Acked-by: Lee Jones Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220809162752.10186-5-krzysztof.kozlowski@linaro.org commit 2e645db3bca713f964b1064177b4b9b4b06289cd Author: Krzysztof Kozlowski Date: Tue Aug 9 19:27:50 2022 +0300 dt-bindings: Drop Beniamin Bia and Stefan Popa Emails to Beniamin Bia and Stefan Popa bounce ("550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup"). Signed-off-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220809162752.10186-4-krzysztof.kozlowski@linaro.org commit 691b0d55199927d429d1d951eb90b0c4dd45a7f4 Author: Krzysztof Kozlowski Date: Tue Aug 9 19:27:49 2022 +0300 dt-bindings: iio: Drop Bogdan Pricop Emails to Bogdan Pricop bounce ("550 5.4.1 Recipient address rejected: Access denied. AS(201806281)"). Signed-off-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220809162752.10186-3-krzysztof.kozlowski@linaro.org commit dc72768ebf84b87fd26ad97dd3422c3783157a4a Author: Krzysztof Kozlowski Date: Tue Aug 9 19:27:48 2022 +0300 dt-bindings: iio: Drop Joachim Eastwood Emails to Joachim Eastwood bounce ("552 5.2.2 The email account that you tried to reach is over quota and inactive."). Signed-off-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220809162752.10186-2-krzysztof.kozlowski@linaro.org commit 4a9350597aff50bbd0f4b80ccf49d2e02d1111f5 Merge: 7a53e17accce9 636aa8807b578 Author: Linus Torvalds Date: Fri Aug 12 09:55:32 2022 -0700 Merge tag 'sound-fix-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Includes a few usual updates for HD- and USB-audio and a trivial cleanup patch" * tag 'sound-fix-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: Fix crash due to jack poll in suspend ALSA: hda/cirrus - support for iMac 12,1 model ALSA: usb-audio: make read-only array marker static const ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ALSA: scarlett2: Add Focusrite Clarett+ 8Pre support ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: ice1712: remove redundant assignment to new ALSA: hda/realtek: Add quirk for another Asus K42JZ model commit 7a53e17accce9d310d2e522dfc701d8da7ccfa65 Merge: 999324f58c412 93e530d2a1c4c Author: Linus Torvalds Date: Fri Aug 12 09:50:34 2022 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - A huge patchset supporting vq resize using the new vq reset capability - Features, fixes, and cleanups all over the place * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (88 commits) vdpa/mlx5: Fix possible uninitialized return value vdpa_sim_blk: add support for discard and write-zeroes vdpa_sim_blk: add support for VIRTIO_BLK_T_FLUSH vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests vdpa_sim_blk: check if sector is 0 for commands other than read or write vdpa_sim: Implement suspend vdpa op vhost-vdpa: uAPI to suspend the device vhost-vdpa: introduce SUSPEND backend feature bit vdpa: Add suspend operation virtio-blk: Avoid use-after-free on suspend/resume virtio_vdpa: support the arg sizes of find_vqs() vhost-vdpa: Call ida_simple_remove() when failed vDPA: fix 'cast to restricted le16' warnings in vdpa.c vDPA: !FEATURES_OK should not block querying device config space vDPA/ifcvf: support userspace to query features and MQ of a management device vDPA/ifcvf: get_config_size should return a value no greater than dev implementation vhost scsi: Allow user to control num virtqueues vhost-scsi: Fix max number of virtqueues vdpa/mlx5: Support different address spaces for control and data vdpa/mlx5: Implement susupend virtqueue callback ... commit 999324f58c41262f5b64d04b7ac54e8f79b019fd Merge: f7cdaeeab8caf 715355922212a Author: Linus Torvalds Date: Fri Aug 12 09:44:23 2022 -0700 Merge tag 'loongarch-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Optimise getcpu() with vDSO - PCI enablement on top of pci & irqchip changes - Stack unwinder and stack trace support - Some bug fixes and build error fixes - Update the default config file * tag 'loongarch-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: docs/zh_CN/LoongArch: Add I14 description docs/LoongArch: Add I14 description LoongArch: Update Loongson-3 default config file LoongArch: Add USER_STACKTRACE support LoongArch: Add STACKTRACE support LoongArch: Add prologue unwinder support LoongArch: Add guess unwinder support LoongArch: Add vDSO syscall __vdso_getcpu() LoongArch: Add PCI controller support LoongArch: Parse MADT to get multi-processor information LoongArch: Jump to the link address before enable PG LoongArch: Requires __force attributes for any casts LoongArch: Fix unsigned comparison with less than zero LoongArch: Adjust arch/loongarch/Kconfig LoongArch: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK commit f7cdaeeab8caf8e42fc176cdb272944e036ad998 Merge: d16b418fac3de c9d8468158adc Author: Linus Torvalds Date: Fri Aug 12 09:37:33 2022 -0700 Merge tag 'for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "No core patches, only driver updates: - pwr-mlxbf: new reset driver for Mellanox BlueField - at91-reset: SAMA7G5 support - ab8500: continue refurbishing - misc minor fixes" * tag 'for-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (29 commits) power: supply: olpc_battery: Hold the reference returned by of_find_compatible_node power: supply: ab8500: add missing destroy_workqueue in ab8500_charger_bind power: supply: ab8500: Remove flush_scheduled_work() call. power: supply: ab8500_fg: drop duplicated 'is' in comment power: supply: ab8500: Drop external charger leftovers power: supply: ab8500: Add MAINTAINERS entry dt-bindings: power: reset: qcom,pshold: convert to dtschema power: supply: Fix typo in power_supply_check_supplies power: reset: pwr-mlxbf: change rst_pwr_hid and low_pwr_hid from global to local variables power: reset: pwr-mlxbf: add missing include power: reset: at91-reset: add support for SAMA7G5 power: reset: at91-reset: add reset_controller_dev support power: reset: at91-reset: add at91_reset_data power: reset: at91-reset: document structures and enums dt-bindings: reset: add sama7g5 definitions dt-bindings: reset: atmel,at91sam9260-reset: add sama7g5 bindings dt-bindings: reset: convert Atmel/Microchip reset controller to YAML power: reset: pwr-mlxbf: add BlueField SoC power control driver power: supply: ab8500: Exit maintenance if too low voltage power: supply: ab8500: Respect charge_restart_voltage_uv ... commit d16b418fac3de0d2ac854b3a9a1a59a0ebf2a0e9 Merge: f75f5d58099ff 0f3e72b5c8cfa Author: Linus Torvalds Date: Fri Aug 12 09:34:45 2022 -0700 Merge tag 'vfio-v6.0-rc1pt2' of https://github.com/awilliam/linux-vfio Pull another VFIO update from Alex Williamson: - Rename vfio source file to more easily allow additional source files in the upcoming development cycles (Jason Gunthorpe) * tag 'vfio-v6.0-rc1pt2' of https://github.com/awilliam/linux-vfio: vfio: Move vfio.c to vfio_main.c commit 27e23836ce22a3e5d89712ef832ab72e47ce9f43 Author: Daniel Müller Date: Wed Aug 10 20:07:10 2022 +0000 selftests/bpf: Add lru_bug to s390x deny list The lru_bug BPF selftest is failing execution on s390x machines. The failure is due to program attachment failing in turn, similar to a bunch of other tests. Those other tests have already been deny-listed and with this change we do the same for the lru_bug test, adding it to the corresponding file. Fixes: de7b9927105b ("selftests/bpf: Add test for prealloc_lru_pop bug") Signed-off-by: Daniel Müller Acked-by: Mykola Lysenko Link: https://lore.kernel.org/r/20220810200710.1300299-1-deso@posteo.net Signed-off-by: Alexei Starovoitov commit f75f5d58099ffe0a70ae96dfeb837b5c46399da3 Author: Yury Norov Date: Thu Aug 11 22:55:05 2022 -0700 lib: remove lib/nodemask.c Commit 36d4b36b6959 ("lib/nodemask: inline next_node_in() and node_random()") removed the lib/nodemask.c file, but the remove didn't happen when the patch was applied. Reported-by: "Aneesh Kumar K.V" Signed-off-by: Yury Norov Signed-off-by: Linus Torvalds commit 5cef38dd03f33ef206eb792df0fb3b200d762546 Author: Atul Khare Date: Wed Aug 3 16:55:40 2022 +0100 dt-bindings: gpio: sifive: add gpio-line-names Fix device tree schema validation messages like 'gpio-line-names' does not match any of the regexes: 'pinctrl-[0-9]+' From schema: ... sifive,gpio.yaml'. The bindings were missing the gpio-line-names element, which was causing the dt-schema checker to trip-up. Acked-by: Rob Herring Signed-off-by: Atul Khare Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220803155539.800766-1-mail@conchuod.ie Signed-off-by: Palmer Dabbelt commit cbe9e51126305832cf407ee6bb556ce831488ffe Author: Ivan Vecera Date: Mon Aug 8 19:58:45 2022 +0200 iavf: Fix deadlock in initialization Fix deadlock that occurs when iavf interface is a part of failover configuration. 1. Mutex crit_lock is taken at the beginning of iavf_watchdog_task() 2. Function iavf_init_config_adapter() is called when adapter state is __IAVF_INIT_CONFIG_ADAPTER 3. iavf_init_config_adapter() calls register_netdevice() that emits NETDEV_REGISTER event 4. Notifier function failover_event() then calls net_failover_slave_register() that calls dev_open() 5. dev_open() calls iavf_open() that tries to take crit_lock in end-less loop Stack trace: ... [ 790.251876] usleep_range_state+0x5b/0x80 [ 790.252547] iavf_open+0x37/0x1d0 [iavf] [ 790.253139] __dev_open+0xcd/0x160 [ 790.253699] dev_open+0x47/0x90 [ 790.254323] net_failover_slave_register+0x122/0x220 [net_failover] [ 790.255213] failover_slave_register.part.7+0xd2/0x180 [failover] [ 790.256050] failover_event+0x122/0x1ab [failover] [ 790.256821] notifier_call_chain+0x47/0x70 [ 790.257510] register_netdevice+0x20f/0x550 [ 790.258263] iavf_watchdog_task+0x7c8/0xea0 [iavf] [ 790.259009] process_one_work+0x1a7/0x360 [ 790.259705] worker_thread+0x30/0x390 To fix the situation we should check the current adapter state after first unsuccessful mutex_trylock() and return with -EBUSY if it is __IAVF_INIT_CONFIG_ADAPTER. Fixes: 226d528512cf ("iavf: fix locking of critical sections") Signed-off-by: Ivan Vecera Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen commit 31071173771e079f7bc08dacd61e0db913262fbf Author: Przemyslaw Patynowski Date: Tue Jul 19 11:16:54 2022 +0200 iavf: Fix reset error handling Do not call iavf_close in iavf_reset_task error handling. Doing so can lead to double call of napi_disable, which can lead to deadlock there. Removing VF would lead to iavf_remove task being stuck, because it requires crit_lock, which is held by iavf_close. Call iavf_disable_vf if reset fail, so that driver will clean up remaining invalid resources. During rapid VF resets, HW can fail to setup VF mailbox. Wrong error handling can lead to iavf_remove being stuck with: [ 5218.999087] iavf 0000:82:01.0: Failed to init adminq: -53 ... [ 5267.189211] INFO: task repro.sh:11219 blocked for more than 30 seconds. [ 5267.189520] Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 5267.189764] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 5267.190062] task:repro.sh state:D stack: 0 pid:11219 ppid: 8162 flags:0x00000000 [ 5267.190347] Call Trace: [ 5267.190647] [ 5267.190927] __schedule+0x460/0x9f0 [ 5267.191264] schedule+0x44/0xb0 [ 5267.191563] schedule_preempt_disabled+0x14/0x20 [ 5267.191890] __mutex_lock.isra.12+0x6e3/0xac0 [ 5267.192237] ? iavf_remove+0xf9/0x6c0 [iavf] [ 5267.192565] iavf_remove+0x12a/0x6c0 [iavf] [ 5267.192911] ? _raw_spin_unlock_irqrestore+0x1e/0x40 [ 5267.193285] pci_device_remove+0x36/0xb0 [ 5267.193619] device_release_driver_internal+0xc1/0x150 [ 5267.193974] pci_stop_bus_device+0x69/0x90 [ 5267.194361] pci_stop_and_remove_bus_device+0xe/0x20 [ 5267.194735] pci_iov_remove_virtfn+0xba/0x120 [ 5267.195130] sriov_disable+0x2f/0xe0 [ 5267.195506] ice_free_vfs+0x7d/0x2f0 [ice] [ 5267.196056] ? pci_get_device+0x4f/0x70 [ 5267.196496] ice_sriov_configure+0x78/0x1a0 [ice] [ 5267.196995] sriov_numvfs_store+0xfe/0x140 [ 5267.197466] kernfs_fop_write_iter+0x12e/0x1c0 [ 5267.197918] new_sync_write+0x10c/0x190 [ 5267.198404] vfs_write+0x24e/0x2d0 [ 5267.198886] ksys_write+0x5c/0xd0 [ 5267.199367] do_syscall_64+0x3a/0x80 [ 5267.199827] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 5267.200317] RIP: 0033:0x7f5b381205c8 [ 5267.200814] RSP: 002b:00007fff8c7e8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 5267.201981] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5b381205c8 [ 5267.202620] RDX: 0000000000000002 RSI: 00005569420ee900 RDI: 0000000000000001 [ 5267.203426] RBP: 00005569420ee900 R08: 000000000000000a R09: 00007f5b38180820 [ 5267.204327] R10: 000000000000000a R11: 0000000000000246 R12: 00007f5b383c06e0 [ 5267.205193] R13: 0000000000000002 R14: 00007f5b383bb880 R15: 0000000000000002 [ 5267.206041] [ 5267.206970] Kernel panic - not syncing: hung_task: blocked tasks [ 5267.207809] CPU: 48 PID: 551 Comm: khungtaskd Kdump: loaded Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 5267.208726] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.11.0 11/02/2019 [ 5267.209623] Call Trace: [ 5267.210569] [ 5267.211480] dump_stack_lvl+0x33/0x42 [ 5267.212472] panic+0x107/0x294 [ 5267.213467] watchdog.cold.8+0xc/0xbb [ 5267.214413] ? proc_dohung_task_timeout_secs+0x30/0x30 [ 5267.215511] kthread+0xf4/0x120 [ 5267.216459] ? kthread_complete_and_exit+0x20/0x20 [ 5267.217505] ret_from_fork+0x22/0x30 [ 5267.218459] Fixes: f0db78928783 ("i40evf: use netdev variable in reset task") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 541a1af451b0cb3779e915d48d08efb17915207b Author: Przemyslaw Patynowski Date: Tue Jul 19 11:16:53 2022 +0200 iavf: Fix NULL pointer dereference in iavf_get_link_ksettings Fix possible NULL pointer dereference, due to freeing of adapter->vf_res in iavf_init_get_resources. Previous commit introduced a regression, where receiving IAVF_ERR_ADMIN_QUEUE_NO_WORK from iavf_get_vf_config would free adapter->vf_res. However, netdev is still registered, so ethtool_ops can be called. Calling iavf_get_link_ksettings with no vf_res, will result with: [ 9385.242676] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 9385.242683] #PF: supervisor read access in kernel mode [ 9385.242686] #PF: error_code(0x0000) - not-present page [ 9385.242690] PGD 0 P4D 0 [ 9385.242696] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [ 9385.242701] CPU: 6 PID: 3217 Comm: pmdalinux Kdump: loaded Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 9385.242708] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.11.0 11/02/2019 [ 9385.242710] RIP: 0010:iavf_get_link_ksettings+0x29/0xd0 [iavf] [ 9385.242745] Code: 00 0f 1f 44 00 00 b8 01 ef ff ff 48 c7 46 30 00 00 00 00 48 c7 46 38 00 00 00 00 c6 46 0b 00 66 89 46 08 48 8b 87 68 0e 00 00 40 08 80 75 50 8b 87 5c 0e 00 00 83 f8 08 74 7a 76 1d 83 f8 20 [ 9385.242749] RSP: 0018:ffffc0560ec7fbd0 EFLAGS: 00010246 [ 9385.242755] RAX: 0000000000000000 RBX: ffffc0560ec7fc08 RCX: 0000000000000000 [ 9385.242759] RDX: ffffffffc0ad4550 RSI: ffffc0560ec7fc08 RDI: ffffa0fc66674000 [ 9385.242762] RBP: 00007ffd1fb2bf50 R08: b6a2d54b892363ee R09: ffffa101dc14fb00 [ 9385.242765] R10: 0000000000000000 R11: 0000000000000004 R12: ffffa0fc66674000 [ 9385.242768] R13: 0000000000000000 R14: ffffa0fc66674000 R15: 00000000ffffffa1 [ 9385.242771] FS: 00007f93711a2980(0000) GS:ffffa0fad72c0000(0000) knlGS:0000000000000000 [ 9385.242775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9385.242778] CR2: 0000000000000008 CR3: 0000000a8e61c003 CR4: 00000000003706e0 [ 9385.242781] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 9385.242784] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 9385.242787] Call Trace: [ 9385.242791] [ 9385.242793] ethtool_get_settings+0x71/0x1a0 [ 9385.242814] __dev_ethtool+0x426/0x2f40 [ 9385.242823] ? slab_post_alloc_hook+0x4f/0x280 [ 9385.242836] ? kmem_cache_alloc_trace+0x15d/0x2f0 [ 9385.242841] ? dev_ethtool+0x59/0x170 [ 9385.242848] dev_ethtool+0xa7/0x170 [ 9385.242856] dev_ioctl+0xc3/0x520 [ 9385.242866] sock_do_ioctl+0xa0/0xe0 [ 9385.242877] sock_ioctl+0x22f/0x320 [ 9385.242885] __x64_sys_ioctl+0x84/0xc0 [ 9385.242896] do_syscall_64+0x3a/0x80 [ 9385.242904] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 9385.242918] RIP: 0033:0x7f93702396db [ 9385.242923] Code: 73 01 c3 48 8b 0d ad 57 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 57 38 00 f7 d8 64 89 01 48 [ 9385.242927] RSP: 002b:00007ffd1fb2bf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 9385.242932] RAX: ffffffffffffffda RBX: 000055671b1d2fe0 RCX: 00007f93702396db [ 9385.242935] RDX: 00007ffd1fb2bf20 RSI: 0000000000008946 RDI: 0000000000000007 [ 9385.242937] RBP: 00007ffd1fb2bf20 R08: 0000000000000003 R09: 0030763066307330 [ 9385.242940] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd1fb2bf80 [ 9385.242942] R13: 0000000000000007 R14: 0000556719f6de90 R15: 00007ffd1fb2c1b0 [ 9385.242948] [ 9385.242949] Modules linked in: iavf(E) xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nft_compat nf_nat_tftp nft_objref nf_conntrack_tftp bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink vfat fat irdma ib_uverbs ib_core intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTCO_vendor_support ice irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl i40e pcspkr intel_cstate joydev mei_me intel_uncore mxm_wmi mei ipmi_ssif lpc_ich ipmi_si acpi_power_meter xfs libcrc32c mgag200 i2c_algo_bit drm_shmem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft crc64 syscopyarea sg sysfillrect sysimgblt fb_sys_fops drm ixgbe ahci libahci libata crc32c_intel mdio dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse [ 9385.243065] [last unloaded: iavf] Dereference happens in if (ADV_LINK_SUPPORT(adapter)) statement Fixes: 209f2f9c7181 ("iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 negotiation") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 419831617ed349992c84344dbd9e627f9e68f842 Author: Przemyslaw Patynowski Date: Tue Jul 19 11:16:52 2022 +0200 iavf: Fix adminq error handling iavf_alloc_asq_bufs/iavf_alloc_arq_bufs allocates with dma_alloc_coherent memory for VF mailbox. Free DMA regions for both ASQ and ARQ in case error happens during configuration of ASQ/ARQ registers. Without this change it is possible to see when unloading interface: 74626.583369: dma_debug_device_change: device driver has pending DMA allocations while released from device [count=32] One of leaked entries details: [device address=0x0000000b27ff9000] [size=4096 bytes] [mapped with DMA_BIDIRECTIONAL] [mapped as coherent] Fixes: d358aa9a7a2d ("i40evf: init code and hardware support") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 9019b4f6d9bd88524ecd95420cf9cd4aaed7a125 Author: Jason A. Donenfeld Date: Tue Aug 9 16:57:57 2022 +0200 wireguard: selftests: set CONFIG_NONPORTABLE on riscv32 When the CONFIG_PORTABLE/CONFIG_NONPORTABLE switches were added, various configs were updated, but the wireguard config was forgotten about. This leads to unbootable test kernels, causing CI fails. Add CONFIG_NONPORTABLE=y to the wireguard test suite configuration for riscv32. Fixes: 44c1e84a38a0 ("RISC-V: Add CONFIG_{NON,}PORTABLE") Signed-off-by: Jason A. Donenfeld Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220809145757.83673-1-Jason@zx2c4.com Signed-off-by: Palmer Dabbelt commit 8f5cb44b1bae8520c0705ce348b30ffb1fdda43a Author: Atish Patra Date: Fri Jul 22 09:50:47 2022 -0700 RISC-V: KVM: Support sstc extension Sstc extension allows the guest to program the vstimecmp CSR directly instead of making an SBI call to the hypervisor to program the next event. The timer interrupt is also directly injected to the guest by the hardware in this case. To maintain backward compatibility, the hypervisors also update the vstimecmp in an SBI set_time call if the hardware supports it. Thus, the older kernels in guest also take advantage of the sstc extension. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Acked-by: Anup Patel Link: https://lore.kernel.org/all/CAAhSdy2mb6wyqy0NAn9BcTWKMYEc0Z4zU3s3j7oNqBz6eDQ9sg@mail.gmail.com/ Signed-off-by: Palmer Dabbelt commit 5a2f3dc31811e93be15522d9eb13ed61460b76c8 Author: Pablo Neira Ayuso Date: Fri Aug 12 16:19:23 2022 +0200 netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag If the NFTA_SET_ELEM_OBJREF netlink attribute is present and NFT_SET_OBJECT flag is set on, report EINVAL. Move existing sanity check earlier to validate that NFT_SET_OBJECT requires NFTA_SET_ELEM_OBJREF. Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements") Signed-off-by: Pablo Neira Ayuso commit 9801002f76c63327cae6e90097d3d0afb1e1b562 Merge: 7ab52f75a9cf7 f829ee7595b5e Author: Palmer Dabbelt Date: Thu Aug 11 15:04:02 2022 -0700 perf: riscv_pmu{,_sbi}: Miscallenous improvement & fixes A series of mostly-independent fixes and cleanups for the RISC-V PMU drivers. Link: https://lore.kernel.org/lkml/CAAhSdy23vE8+HxU5Jxy2rBMjy3rBTrJt_4sriuROac_sEESSVw@mail.gmail.com/T/#m9de15aef1b65ae6155fa33ea1239578ef463c2a2 * palmer/riscv-pmu: RISC-V: Improve SBI definitions RISC-V: Move counter info definition to sbi header file RISC-V: Fix SBI PMU calls for RV32 RISC-V: Update user page mapping only once during start RISC-V: Fix counter restart during overflow for RV32 commit 1bf7d836e57ba4943e33e163e730cd77ab837572 Author: Martin Liška Date: Fri Aug 12 13:40:49 2022 +0200 perf record: Improve error message of -p not_existing_pid When one uses -p $not_existing_pid, the output of --help is printed: $ perf record -p 123456789 2>&1 | head -n3 Usage: perf record [] [] or: perf record [] -- [] Let's change it something similar what perf top -p $not_existing_pid prints: $ ./perf top -p 123456789 --stdio Error: Couldn't create thread/CPU maps: No such process Newly suggested error message: $ ./perf record -p 123456789 Couldn't create thread/CPU maps: No such process Signed-off-by: Martin Liška Tested-by: Arnaldo Carvalho de Melo Link: http://lore.kernel.org/lkml/8e00eda1-4de0-2c44-ce67-d4df48ac1f7c@suse.cz Signed-off-by: Arnaldo Carvalho de Melo commit a072a7a0263ddc723305dfd975f931bcea4e4f5b Author: Martin Liška Date: Fri Aug 12 13:43:53 2022 +0200 perf build-id: Print debuginfod queries if -v option is used When ending a 'perf record' session, the querying of a debuginfod server can take quite some time. Inform a user about it when -v options is used. Signed-off-by: Martin Liška Link: http://lore.kernel.org/lkml/325871cf-b71f-6237-8793-82182272ece8@suse.cz Signed-off-by: Arnaldo Carvalho de Melo commit 34575ded6874a9d228c1166243149c347a4012de Author: Martin Liška Date: Fri Aug 12 13:42:56 2022 +0200 perf build-id: Fix coding style, replace 8 spaces by tabs Use tabs instead of 8 spaces for the indentation. Signed-off-by: Martin Liška Link: http://lore.kernel.org/lkml/2983e2e0-6850-ad59-79d8-efe83b22cffe@suse.cz Signed-off-by: Arnaldo Carvalho de Melo commit a9084d888fbaaed65ded56f11d052cf8b04519a5 Author: Christophe JAILLET Date: Mon Aug 1 21:28:07 2022 +0200 irqchip/loongson-liointc: Fix an error handling path in liointc_init() All errors lead to the error handling path, except the one dealing with "reg-names" in DT. Fix it and release some resources before returning if this test fails. Fixes: 0858ed035a85 ("irqchip/loongson-liointc: Add ACPI init support") Signed-off-by: Christophe JAILLET [maz: fix commit message] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/1a6d74ab70712279023aa7bdbd31bd3aec103bc0.1659382063.git.christophe.jaillet@wanadoo.fr commit aa0c680c3aa96a5f9f160d90dd95402ad578e2b0 Author: Rafael Mendonca Date: Thu Aug 11 20:23:37 2022 -0300 block: Do not call blk_put_queue() if gendisk allocation fails Commit 6f8191fdf41d ("block: simplify disk shutdown") removed the call to blk_get_queue() during gendisk allocation but missed to remove the corresponding cleanup code blk_put_queue() for it. Thus, if the gendisk allocation fails, the request_queue refcount gets decremented and reaches 0, causing blk_mq_release() to be called with a hctx still alive. That triggers a WARNING report, as found by syzkaller: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 23016 at block/blk-mq.c:3881 blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881 [...] stripped RIP: 0010:blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881 [...] stripped Call Trace: blk_release_queue+0x153/0x270 block/blk-sysfs.c:780 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 __alloc_disk_node+0x4f7/0x610 block/genhd.c:1388 __blk_mq_alloc_disk+0x13b/0x1f0 block/blk-mq.c:3961 loop_add+0x3e2/0xaf0 drivers/block/loop.c:1978 loop_control_ioctl+0x133/0x620 drivers/block/loop.c:2150 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] stripped Fixes: 6f8191fdf41d ("block: simplify disk shutdown") Reported-by: syzbot+31c9594f6e43b9289b25@syzkaller.appspotmail.com Suggested-by: Hillf Danton Signed-off-by: Rafael Mendonca Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220811232338.254673-1-rafaelmendsr@gmail.com Signed-off-by: Jens Axboe commit 40b4ac880e21d917da7f3752332fa57564a4c202 Author: Li Qiong Date: Fri Aug 12 11:09:54 2022 +0800 net: lan966x: fix checking for return value of platform_get_irq_byname() The platform_get_irq_byname() returns non-zero IRQ number or negative error number. "if (irq)" always true, chang it to "if (irq > 0)" Signed-off-by: Li Qiong Signed-off-by: David S. Miller commit 75d8620d46f00fcece574dd70ea36acfdfcf171b Author: Jason Wang Date: Thu Aug 11 19:57:01 2022 +0800 net: cxgb3: Fix comment typo The double `the' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 0619d0fa6cedb32f0835e23ca774085128ccb2b8 Author: Jason Wang Date: Thu Aug 11 19:56:20 2022 +0800 bnx2x: Fix comment typo The double `the' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 9221b2898a5877f7e15442ccee7a4e59c6f03f0d Author: Jason Wang Date: Thu Aug 11 19:52:59 2022 +0800 net: ipa: Fix comment typo The double `is' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Reviewed-by: Alex Elder Signed-off-by: David S. Miller commit 95bb633048fab742230eb2cdf20b8e2676240a54 Author: Michael S. Tsirkin Date: Thu Aug 11 08:51:58 2022 -0400 virtio_net: fix endian-ness for RSS Using native endian-ness for device supplied fields is wrong on BE platforms. Sparse warns about this. Fixes: 91f41f01d219 ("drivers/net/virtio_net: Added RSS hash report.") Cc: "Andrew Melnychenko" Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 5ad3134dcf5201c4d51c981e52557939256b02c7 Author: Lukas Bulwahn Date: Wed Aug 10 07:07:12 2022 +0200 MAINTAINERS: add xen config fragments to XEN HYPERVISOR sections Make changes to the xen config fragments reach the XEN HYPERVISOR maintainers and mailing list. Signed-off-by: Lukas Bulwahn Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220810050712.9539-5-lukas.bulwahn@gmail.com Signed-off-by: Juergen Gross commit aa6d1e5b502866a4364dfeb2cdecf7c258c400ee Author: Lukas Bulwahn Date: Wed Aug 10 07:07:10 2022 +0200 xen: remove XEN_SCRUB_PAGES in xen.config Commit 197ecb3802c0 ("xen/balloon: add runtime control for scrubbing ballooned out pages") changed config XEN_SCRUB_PAGES to config XEN_SCRUB_PAGES_DEFAULT. As xen.config sets 'XEN_BALLOON=y' and XEN_SCRUB_PAGES_DEFAULT defaults to yes, there is no further need to set this config in the xen.config file. Remove setting XEN_SCRUB_PAGES in xen.config, which is without effect since the commit above anyway. Signed-off-by: Lukas Bulwahn Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220810050712.9539-3-lukas.bulwahn@gmail.com Signed-off-by: Juergen Gross commit bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 Author: Xin Xiong Date: Wed Aug 10 23:29:13 2022 +0800 net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() The issue happens on some error handling paths. When the function fails to grab the object `xprt`, it simply returns 0, forgetting to decrease the reference count of another object `xps`, which is increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount leaks. Also, the function forgets to check whether `xps` is valid before using it, which may result in NULL-dereferencing issues. Fix it by adding proper error handling code when either `xprt` or `xps` is NULL. Fixes: 5b7eb78486cd ("SUNRPC: take a xprt offline using sysfs") Signed-off-by: Xin Xiong Signed-off-by: Xin Tan Signed-off-by: David S. Miller commit 86d2155e48f6ce1aacbd01667176e5b915ae275c Author: Jilin Yuan Date: Wed Aug 10 21:59:01 2022 +0800 skfp/h: fix repeated words in comments Delete the redundant word 'the'. Signed-off-by: Jilin Yuan Signed-off-by: David S. Miller commit ced3c74271bfedfb8e517c01b4dd7b9aad7020b0 Author: Jason Wang Date: Thu Aug 11 20:09:18 2022 +0800 xen/pciback: Fix comment typo The double `the' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220811120918.17961-1-wangborong@cdjrlc.com Signed-off-by: Juergen Gross commit 32ad11127b95236dfc52375f3707853194a7f4b4 Author: Dan Carpenter Date: Thu Aug 4 10:11:33 2022 +0300 xen/xenbus: fix return type in xenbus_file_read() This code tries to store -EFAULT in an unsigned int. The xenbus_file_read() function returns type ssize_t so the negative value is returned as a positive value to the user. This change forces another change to the min() macro. Originally, the min() macro used "unsigned" type which checkpatch complains about. Also unsigned type would break if "len" were not capped at MAX_RW_COUNT. Use size_t for the min(). (No effect on runtime for the min_t() change). Fixes: 2fb3683e7b16 ("xen: Add xenbus device driver") Signed-off-by: Dan Carpenter Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/YutxJUaUYRG/VLVc@kili Signed-off-by: Juergen Gross commit 402c43ea6b34a1b371ffeed9adf907402569eaf5 Author: SeongJae Park Date: Fri Jul 15 22:51:08 2022 +0000 xen-blkfront: Apply 'feature_persistent' parameter when connect In some use cases[1], the backend is created while the frontend doesn't support the persistent grants feature, but later the frontend can be changed to support the feature and reconnect. In the past, 'blkback' enabled the persistent grants feature since it unconditionally checked if frontend supports the persistent grants feature for every connect ('connect_ring()') and decided whether it should use persistent grans or not. However, commit aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") has mistakenly changed the behavior. It made the frontend feature support check to not be repeated once it shown the 'feature_persistent' as 'false', or the frontend doesn't support persistent grants. Similar behavioral change has made on 'blkfront' by commit 74a852479c68 ("xen-blkfront: add a parameter for disabling of persistent grants"). This commit changes the behavior of the parameter to make effect for every connect, so that the previous behavior of 'blkfront' can be restored. [1] https://lore.kernel.org/xen-devel/CAJwUmVB6H3iTs-C+U=v-pwJB7-_ZRHPxHzKRJZ22xEPW7z8a=g@mail.gmail.com/ Fixes: 74a852479c68 ("xen-blkfront: add a parameter for disabling of persistent grants") Cc: # 5.10.x Signed-off-by: SeongJae Park Reviewed-by: Maximilian Heyne Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220715225108.193398-4-sj@kernel.org Signed-off-by: Juergen Gross commit e94c6101e151b019b8babc518ac2a6ada644a5a1 Author: Maximilian Heyne Date: Fri Jul 15 22:51:07 2022 +0000 xen-blkback: Apply 'feature_persistent' parameter when connect In some use cases[1], the backend is created while the frontend doesn't support the persistent grants feature, but later the frontend can be changed to support the feature and reconnect. In the past, 'blkback' enabled the persistent grants feature since it unconditionally checked if frontend supports the persistent grants feature for every connect ('connect_ring()') and decided whether it should use persistent grans or not. However, commit aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") has mistakenly changed the behavior. It made the frontend feature support check to not be repeated once it shown the 'feature_persistent' as 'false', or the frontend doesn't support persistent grants. This commit changes the behavior of the parameter to make effect for every connect, so that the previous workflow can work again as expected. [1] https://lore.kernel.org/xen-devel/CAJwUmVB6H3iTs-C+U=v-pwJB7-_ZRHPxHzKRJZ22xEPW7z8a=g@mail.gmail.com/ Reported-by: Andrii Chepurnyi Fixes: aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") Cc: # 5.10.x Signed-off-by: Maximilian Heyne Signed-off-by: SeongJae Park Reviewed-by: Maximilian Heyne Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220715225108.193398-3-sj@kernel.org Signed-off-by: Juergen Gross commit fc9be616bb8f3ed9cf560308f86904f5c06be205 Author: SeongJae Park Date: Fri Jul 15 22:51:06 2022 +0000 xen-blkback: fix persistent grants negotiation Persistent grants feature can be used only when both backend and the frontend supports the feature. The feature was always supported by 'blkback', but commit aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") has introduced a parameter for disabling it runtime. To avoid the parameter be updated while being used by 'blkback', the commit caches the parameter into 'vbd->feature_gnt_persistent' in 'xen_vbd_create()', and then check if the guest also supports the feature and finally updates the field in 'connect_ring()'. However, 'connect_ring()' could be called before 'xen_vbd_create()', so later execution of 'xen_vbd_create()' can wrongly overwrite 'true' to 'vbd->feature_gnt_persistent'. As a result, 'blkback' could try to use 'persistent grants' feature even if the guest doesn't support the feature. This commit fixes the issue by moving the parameter value caching to 'xen_blkif_alloc()', which allocates the 'blkif'. Because the struct embeds 'vbd' object, which will be used by 'connect_ring()' later, this should be called before 'connect_ring()' and therefore this should be the right and safe place to do the caching. Fixes: aac8a70db24b ("xen-blkback: add a parameter for disabling of persistent grants") Cc: # 5.10.x Signed-off-by: Maximilian Heyne Signed-off-by: SeongJae Park Reviewed-by: Maximilian Heyne Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220715225108.193398-2-sj@kernel.org Signed-off-by: Juergen Gross commit 9f414eb409daf4f778f011cf8266d36896bb930b Author: Mikulas Patocka Date: Wed Aug 10 09:00:42 2022 -0400 rds: add missing barrier to release_refill The functions clear_bit and set_bit do not imply a memory barrier, thus it may be possible that the waitqueue_active function (which does not take any locks) is moved before clear_bit and it could miss a wakeup event. Fix this bug by adding a memory barrier after clear_bit. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: David S. Miller commit b1c3497e604ddccea5af4071831ed0e4680fb35e Author: Jane Malalane Date: Fri Jul 29 08:04:16 2022 +0100 x86/xen: Add support for HVMOP_set_evtchn_upcall_vector Implement support for the HVMOP_set_evtchn_upcall_vector hypercall in order to set the per-vCPU event channel vector callback on Linux and use it in preference of HVM_PARAM_CALLBACK_IRQ. If the per-VCPU vector setup is successful on BSP, use this method for the APs. If not, fallback to the global vector-type callback. Also register callback_irq at per-vCPU event channel setup to trick toolstack to think the domain is enlightened. Suggested-by: "Roger Pau Monné" Signed-off-by: Jane Malalane Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20220729070416.23306-1-jane.malalane@citrix.com Signed-off-by: Juergen Gross commit 715355922212a3be8bfe5a94b5707a045ac6bf00 Author: Tiezhu Yang Date: Wed Aug 10 15:41:15 2022 +0800 docs/zh_CN/LoongArch: Add I14 description I14 is also a kind of immediate operand in instruction, like I8/I12/I16/ I21/I26, add it in the Chinese documentation. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 6e068820de9c912ebc6147f8149be130b0dabc39 Author: Tiezhu Yang Date: Wed Aug 10 15:41:14 2022 +0800 docs/LoongArch: Add I14 description I14 is also a kind of immediate operand in instruction, like I8/I12/I16/ I21/I26, add it in the English documentation. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 27b161a4c41139f3a686533a5fde4abba05273d4 Author: Huacai Chen Date: Wed Aug 10 14:22:39 2022 +0800 LoongArch: Update Loongson-3 default config file 1, Add NVME related options; 2, Add compressed firmware support; 3, Add virtio drivers in order to run in qemu. Signed-off-by: Huacai Chen commit 4d7bf939df08218e682f7a42952eee3bad4dceb7 Author: Qing Zhang Date: Sat Aug 6 16:10:05 2022 +0800 LoongArch: Add USER_STACKTRACE support To get the best stacktrace output, you can compile your userspace programs with frame pointers (at least glibc + the app you are tracing). 1, export "CC = gcc -fno-omit-frame-pointer"; 2, compile your programs with "CC"; 3, use uprobe to get stacktrace output. ... echo 'p:malloc /usr/lib64/libc.so.6:0x0a4704 size=%r4:u64' > uprobe_events echo 'p:free /usr/lib64/libc.so.6:0x0a4d50 ptr=%r4:x64' >> uprobe_events echo 'comm == "demo"' > ./events/uprobes/malloc/filter echo 'comm == "demo"' > ./events/uprobes/free/filter echo 1 > ./options/userstacktrace echo 1 > ./options/sym-userobj ... Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 93a4fa622eb061f75f87f0cf9609ab4e69c67d01 Author: Qing Zhang Date: Sat Aug 6 16:10:04 2022 +0800 LoongArch: Add STACKTRACE support 1. Use common arch_stack_walk() infrastructure to avoid duplicated code and avoid taking care of the stack storage and filtering. 2. Add sched_ra (means sched return address) and sched_cfa (means sched call frame address) to thread_info, and store them in switch_to(). 3. Add __get_wchan() implementation. Now we can print the process stack and wait channel by cat /proc/*/stack and /proc/*/wchan. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 49aef111e2dae176a7708b532118f33f24289248 Author: Qing Zhang Date: Sat Aug 6 16:10:03 2022 +0800 LoongArch: Add prologue unwinder support It unwind the stack frame based on prologue code analyze. CONFIG_KALLSYMS is needed, at least the address and length of each function. Three stages when we do unwind, 1) unwind_start(), the prapare of unwinding, fill unwind_state. 2) unwind_done(), judge whether the unwind process is finished or not. 3) unwind_next_frame(), unwind the next frame. Dividing unwinder helps to add new unwinders in the future, e.g.: unwinder_frame, unwinder_orc, .etc. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 49232773d8233ed70c4998851bc84e465fc1c788 Author: Qing Zhang Date: Sat Aug 6 16:10:02 2022 +0800 LoongArch: Add guess unwinder support Name "guess unwinder" comes from x86, it scans the stack and reports every kernel text address it finds. Unwinders can be used by dump_stack() and other stacktrace functions. Three stages when we do unwind, 1) unwind_start(), the prapare of unwinding, fill unwind_state. 2) unwind_done(), judge whether the unwind process is finished or not. 3) unwind_next_frame(), unwind the next frame. Add get_stack_info() to get stack info. At present we have irq stack and task stack. The next_sp is the key info between two types of stacks. Dividing unwinder helps to add new unwinders in the future. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit dce6098b22d58e5b646b1c67174c53f5a6a05605 Author: Huacai Chen Date: Sat Aug 6 15:19:33 2022 +0800 LoongArch: Add vDSO syscall __vdso_getcpu() We test 20 million times of getcpu(), the real syscall version take 25 seconds, while the vsyscall version take only 2.4 seconds. Signed-off-by: Rui Wang Signed-off-by: Huacai Chen commit 57fc7323a8e7c2e7c1d5795ab63cb3ffea3cfdfb Author: Huacai Chen Date: Sat Aug 6 15:19:33 2022 +0800 LoongArch: Add PCI controller support Loongson64 based systems are PC-like systems which use PCI/PCIe as its I/O bus, This patch adds the PCI host controller support for LoongArch. Reviewed-by: WANG Xuerui Signed-off-by: Jianmin Lv Signed-off-by: Huacai Chen commit e9e7ff16d7f098f6fa9394e9d2b191c01ba0d5f6 Author: Huacai Chen Date: Tue Jul 19 10:53:13 2022 +0800 LoongArch: Parse MADT to get multi-processor information Parse MADT to get multi-processor information, in order to fix the boot problem and cpu-hotplug problem for SMP platform. Signed-off-by: Huacai Chen commit ab2579d79529b8ed34f26a374a352f12ce24d5df Author: Huacai Chen Date: Thu Aug 11 20:52:12 2022 +0800 LoongArch: Jump to the link address before enable PG The kernel entry points of both boot CPU (i.e., kernel_entry) and non- boot CPUs (i.e., smpboot_entry) may be physical address from BootLoader (in DA mode or identity-mapping PG mode). So we should jump to the link address before PG enabled (because DA is disabled at the same time) and just after DMW configured. Specifically: With some older firmwares, non-boot CPUs started with PG enabled, but this need firmware cooperation in the form of a temporary page table, which is deemed unnecessary. OTOH, latest firmware versions configure the non-boot CPUs to start in DA mode, so kernel-side changes are needed. Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit 5e8be07ca8f7f49d49c6d5d44f69caaa2fa4b660 Author: Qing Zhang Date: Sat Aug 6 15:19:32 2022 +0800 LoongArch: Requires __force attributes for any casts This fix a warning when "make C=2": arch/loongarch/kernel/ptrace.c: note: in included file (through include/linux/uaccess.h, include/linux/sched/task.h, include/linux/sched/signal.h, include/linux/ptrace.h, include/linux/audit.h): ./arch/loongarch/include/asm/uaccess.h:232:32: warning: incorrect type in argument 2 (different address spaces) ./arch/loongarch/include/asm/uaccess.h:232:32: expected void const *from ./arch/loongarch/include/asm/uaccess.h:232:32: got void const [noderef] __user *from Reported-by: kernel test robot Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit aafcac81b0e3f0d7383a78c6249e90e166ac8e6d Author: Yang Li Date: Sat Aug 6 15:19:33 2022 +0800 LoongArch: Fix unsigned comparison with less than zero The return value from the call to get_timer_irq() is int, which can be a negative error code. However, the return value is being assigned to an unsigned int variable 'irq', so making 'irq' an int. Eliminate the following coccicheck warning: ./arch/loongarch/kernel/time.c:146:5-8: WARNING: Unsigned expression compared with zero: irq < 0 Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Huacai Chen commit f30d1f495cc117c0264d71a4d636ee72dd8acb16 Author: Huacai Chen Date: Sat Aug 6 15:19:32 2022 +0800 LoongArch: Adjust arch/loongarch/Kconfig 1, ACPI, EFI and SMP are mandatories for LoongArch, select them unconditionally to avoid various build errors for 'make randconfig'. 2, Move the MMU_GATHER_MERGE_VMAS selection to the correct place. Reported-by: kernel test robot Signed-off-by: Huacai Chen commit 28e112afa44ad0814120d41c68fa72372a2cd2c2 Author: Huacai Chen Date: Tue Jul 12 12:25:57 2022 +0800 LoongArch: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.084034] Hardware name: Loongson Loongson-3A5000-7A1000-1w-V0.1-CRB/Loongson-LS3A5000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit c3adefb5baf377868f45de78eb9f72f87eb498b0 Merge: 7ce2aa6d7fe12 e3a7c2947b9e0 Author: Linus Torvalds Date: Thu Aug 11 19:46:48 2022 -0700 Merge tag 'for-6.0/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - A few fixes for the DM verity and bufio changes in this merge window - A smatch warning fix for DM writecache locking in writecache_map * tag 'for-6.0/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm bufio: fix some cases where the code sleeps with spinlock held dm writecache: fix smatch warning about invalid return from writecache_map dm verity: fix verity_parse_opt_args parsing dm verity: fix DM_VERITY_OPTS_MAX value yet again dm bufio: simplify DM_BUFIO_CLIENT_NO_SLEEP locking commit d957e7ffb2c72410bcc1a514153a46719255a5da Author: Saurabh Sengar Date: Thu Aug 4 08:55:34 2022 -0700 scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need to make forward progress under memory pressure. Marking this workqueue as WQ_MEM_RECLAIM may cause deadlock while flushing a non-WQ_MEM_RECLAIM workqueue. In the current state it causes the following warning: [ 14.506347] ------------[ cut here ]------------ [ 14.506354] workqueue: WQ_MEM_RECLAIM storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM events_freezable_power_:disk_events_workfn [ 14.506360] WARNING: CPU: 0 PID: 8 at <-snip->kernel/workqueue.c:2623 check_flush_dependency+0xb5/0x130 [ 14.506390] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu [ 14.506391] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 14.506393] Workqueue: storvsc_error_wq_0 storvsc_remove_lun [ 14.506395] RIP: 0010:check_flush_dependency+0xb5/0x130 <-snip-> [ 14.506408] Call Trace: [ 14.506412] __flush_work+0xf1/0x1c0 [ 14.506414] __cancel_work_timer+0x12f/0x1b0 [ 14.506417] ? kernfs_put+0xf0/0x190 [ 14.506418] cancel_delayed_work_sync+0x13/0x20 [ 14.506420] disk_block_events+0x78/0x80 [ 14.506421] del_gendisk+0x3d/0x2f0 [ 14.506423] sr_remove+0x28/0x70 [ 14.506427] device_release_driver_internal+0xef/0x1c0 [ 14.506428] device_release_driver+0x12/0x20 [ 14.506429] bus_remove_device+0xe1/0x150 [ 14.506431] device_del+0x167/0x380 [ 14.506432] __scsi_remove_device+0x11d/0x150 [ 14.506433] scsi_remove_device+0x26/0x40 [ 14.506434] storvsc_remove_lun+0x40/0x60 [ 14.506436] process_one_work+0x209/0x400 [ 14.506437] worker_thread+0x34/0x400 [ 14.506439] kthread+0x121/0x140 [ 14.506440] ? process_one_work+0x400/0x400 [ 14.506441] ? kthread_park+0x90/0x90 [ 14.506443] ret_from_fork+0x35/0x40 [ 14.506445] ---[ end trace 2d9633159fdc6ee7 ]--- Link: https://lore.kernel.org/r/1659628534-17539-1-git-send-email-ssengar@linux.microsoft.com Fixes: 436ad9413353 ("scsi: storvsc: Allow only one remove lun work item to be issued per lun") Reviewed-by: Michael Kelley Signed-off-by: Saurabh Sengar Signed-off-by: Martin K. Petersen commit 37dd4ab1ff8cb843c69835dcaf7bc719a2bf2e0c Author: Alim Akhtar Date: Thu Aug 11 21:40:53 2022 +0530 scsi: ufs: host: ufs-exynos: Make fsd_ufs_drvs static struct fsd_ufs_drvs is not used outside this file, so make it static. This fixes sparse warning: drivers/ufs/host/ufs-exynos.c:1721:28: sparse: sparse: symbol 'fsd_ufs_drvs' was not declared. Should it be static? Link: https://lore.kernel.org/r/20220811161053.54081-1-alim.akhtar@samsung.com Fixes: 216f74e8059a ("scsi: ufs: host: ufs-exynos: Add support for FSD UFS HCI") Reported-by: kernel test robot Reviewed-by: Bart Van Assche Signed-off-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit 7dd6f4af9482c319fa829583799e63e38967177d Author: Guixin Liu Date: Tue Aug 2 15:19:00 2022 +0800 scsi: megaraid_sas: Remove unnecessary kfree() When alloc ctrl mem fails, the reply_map will subsequently be freed in megasas_free_ctrl_mem(). No need to free it in megasas_alloc_ctrl_mem(). Link: https://lore.kernel.org/r/1659424740-46918-1-git-send-email-kanie@linux.alibaba.com Acked-by: Sumit Saxena Signed-off-by: Guixin Liu Signed-off-by: Martin K. Petersen commit 7ce2aa6d7fe121e243e1c8a8093911fecdf1c88e Merge: 7ebfc85e2cd7b 36fa1cb56ac51 Author: Linus Torvalds Date: Thu Aug 11 19:12:15 2022 -0700 Merge tag 'drm-next-2022-08-12-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Not much to squeeze into rc1, just two small fixes, one for core gem and one for shmem-helpers: gem: - Annotate WW context in error paths shmem-helper: - Add missing vunmap in error paths" * tag 'drm-next-2022-08-12-1' of git://anongit.freedesktop.org/drm/drm: drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/shmem-helper: Add missing vunmap on error commit 8c499e49240bd93628368c3588975cfb94169b8b Author: Guixin Liu Date: Tue Aug 2 15:18:49 2022 +0800 scsi: megaraid_sas: Fix double kfree() When allocating log_to_span fails, kfree(instance->ctrl_context) is called twice. Remove redundant call. Link: https://lore.kernel.org/r/1659424729-46502-1-git-send-email-kanie@linux.alibaba.com Acked-by: Sumit Saxena Signed-off-by: Guixin Liu Signed-off-by: Martin K. Petersen commit 6d17a112e9a63ff6a5edffd1676b99e0ffbcd269 Author: Kiwoong Kim Date: Tue Aug 2 10:42:31 2022 +0900 scsi: ufs: core: Enable link lost interrupt Link lost is treated as fatal error with commit c99b9b230149 ("scsi: ufs: Treat link loss as fatal error"), but the event isn't registered as interrupt source. Enable it. Link: https://lore.kernel.org/r/1659404551-160958-1-git-send-email-kwmad.kim@samsung.com Fixes: c99b9b230149 ("scsi: ufs: Treat link loss as fatal error") Reviewed-by: Bart Van Assche Signed-off-by: Kiwoong Kim Signed-off-by: Martin K. Petersen commit 54249306e2776774ccb827969e62d34570f991db Author: Brian Bunker Date: Fri Jul 29 14:41:10 2022 -0700 scsi: core: Allow the ALUA transitioning state enough time The error path for the SCSI check condition of not ready, target in ALUA state transition, will result in the failure of that path after the retries are exhausted. In most cases that is well ahead of the transition timeout established in the SCSI ALUA device handler. Instead, reprep the command and re-add it to the queue after a 1 second delay. This will allow the handler to take care of the timeout and only fail the path if the target has exceeded the transition expiry timeout (default 60 seconds). If the expiry timeout is exceeded, the handler will change the path state from transitioning to standby leading to a path failure eliminating the potential of this re-prep to continue endlessly. In most cases the target will exit the transitioning state well before the expiry timeout but after the retries are exhausted as mentioned. Additionally remove the scsi_io_completion_reprep() function which provides little value. Link: https://lore.kernel.org/r/20220729214110.58576-1-brian@purestorage.com Reviewed-by: Martin Wilck Acked-by: Krishna Kant Acked-by: Seamus Connor Signed-off-by: Brian Bunker Signed-off-by: Martin K. Petersen commit 53661ded2460b414644532de6b99bd87f71987e9 Author: Tony Battersby Date: Thu Jul 7 15:08:01 2022 -0400 scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX This partially reverts commit d2b292c3f6fd ("scsi: qla2xxx: Enable ATIO interrupt handshake for ISP27XX") For some workloads where the host sends a batch of commands and then pauses, ATIO interrupt coalesce can cause some incoming ATIO entries to be ignored for extended periods of time, resulting in slow performance, timeouts, and aborted commands. Disable interrupt coalesce and re-enable the dedicated ATIO MSI-X interrupt. Link: https://lore.kernel.org/r/97dcf365-89ff-014d-a3e5-1404c6af511c@cybernetics.com Reviewed-by: Himanshu Madhani Reviewed-by: Nilesh Javali Signed-off-by: Tony Battersby Signed-off-by: Martin K. Petersen commit a63ec83c462b5b1439f71ace751e8985dfb3fcab Author: Ronnie Sahlberg Date: Thu Aug 11 19:04:29 2022 -0500 cifs: Add constructor/destructors for tcon->cfid and move the structure definitions into cached_dir.h Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 9e31678fb403eae0f4fe37c6374be098835c73cd Author: Bharath SM Date: Thu Aug 11 19:46:11 2022 +0000 SMB3: fix lease break timeout when multiple deferred close handles for the same file. Solution is to send lease break ack immediately even in case of deferred close handles to avoid lease break request timing out and let deferred closed handle gets closed as scheduled. Later patches could optimize cases where we then close some of these handles sooner for the cases where lease break is to 'none' Cc: stable@kernel.org Signed-off-by: Bharath SM Signed-off-by: Steve French commit 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 Author: Steve French Date: Thu Aug 11 00:53:00 2022 -0500 smb3: allow deferred close timeout to be configurable Deferred close can be a very useful feature for allowing caching data for read, and for minimizing the number of reopens needed for a file that is repeatedly opened and close but there are workloads where its default (1 second, similar to actimeo/acregmax) is much too small. Allow the user to configure the amount of time we can defer sending the final smb3 close when we have a handle lease on the file (rather than forcing it to depend on value of actimeo which is often unrelated, and less safe). Adds new mount parameter "closetimeo=" which is the maximum number of seconds we can wait before sending an SMB3 close when we have a handle lease for it. Default value also is set to slightly larger at 5 seconds (although some other clients use larger default this should still help). Suggested-by: Bharath SM Reviewed-by: Bharath SM Reviewed-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit dcb45fd7f501f86481473bde14fa0a9069ad5cdc Author: Ronnie Sahlberg Date: Tue Aug 9 12:11:49 2022 +1000 cifs: Do not use tcon->cfid directly, use the cfid we get from open_cached_dir They are the same right now but tcon-> will later point to a different type of struct containing a list of cfids. Signed-off-by: Ronnie Sahlberg Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 425fe4709c76e35f93f4c0e50240f0b61b2a2e54 Author: Ondrej Jirman Date: Thu Aug 11 16:16:54 2022 -0700 Input: goodix - add support for GT1158 This controller is used by PinePhone and PinePhone Pro. Support for the PinePhone Pro will be added in a later patch set. Signed-off-by: Ondrej Jirman Signed-off-by: Jarrah Gosbell Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20220809091200.290492-1-kernel@undef.tools Signed-off-by: Dmitry Torokhov commit b142af334de60f669f36461036360867babcc912 Author: Jarrah Gosbell Date: Thu Aug 11 16:16:28 2022 -0700 dt-bindings: input: touchscreen: add compatible string for Goodix GT1158 Goodix GT1158 is a touchscreen chip from Goodix used in the PinePhone and PinePhone Pro. Patches to correct these devices dts files will be sent in a later patch series. This driver was modified to support the GT1158 in the patch linked below. Add its compatible string to the device tree binding. Suggested-by: Ondrej Jirman Signed-off-by: Jarrah Gosbell Link: https://lore.kernel.org/r/20220809101633.352315-1-kernel@undef.tools Signed-off-by: Dmitry Torokhov commit a1653a75987749ba6dba94fa2e62f0f36b387d1a Author: Douglas Anderson Date: Thu Aug 4 07:38:49 2022 -0700 drm/msm/dsi: Fix number of regulators for SDM660 1 regulator is listed but the number 2 is specified. This presumably means we try to get a regulator with no name. Fix it. Fixes: 462f7017a691 ("drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660") Signed-off-by: Douglas Anderson Reviewed-by: Dmitry Baryshkov Reviewed-by: Marijn Suijten Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/496323/ Link: https://lore.kernel.org/r/20220804073608.v4.2.I94b3c3e412b7c208061349f05659e126483171b1@changeid Signed-off-by: Abhinav Kumar commit 1e00d6ac8a3422765bae37aeac2002dfd3c0bda6 Author: Douglas Anderson Date: Thu Aug 4 07:38:48 2022 -0700 drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg 3 regulators are listed but the number 2 is specified. Fix it. Fixes: 3a3ff88a0fc1 ("drm/msm/dsi: Add 8x96 info in dsi_cfg") Signed-off-by: Douglas Anderson Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/496318/ Link: https://lore.kernel.org/r/20220804073608.v4.1.I1056ee3f77f71287f333279efe4c85f88d403f65@changeid Signed-off-by: Abhinav Kumar commit 032d57960176ac01cc5adff5bcc5eb51317f8781 Author: Kuogee Hsieh Date: Thu Aug 11 15:57:50 2022 -0700 drm/msm/dp: delete DP_RECOVERED_CLOCK_OUT_EN to fix tps4 Data Symbols scrambled is required for tps4 at link training 2. Therefore SCRAMBLING_DISABLE bit should not be set for tps4 to work. RECOVERED_CLOCK_OUT_EN is for enable simple EYE test for jitter measurement with minimal equipment for embedded applications purpose and is not required to be set during normal operation. Current implementation always have RECOVERED_CLOCK_OUT_EN bit set which cause SCRAMBLING_DISABLE bit wrongly set at tps4 which prevent tps4 from working. This patch delete setting RECOVERED_CLOCK_OUT_EN to fix SCRAMBLING_DISABLE be wrongly set at tps4. Changes in v2: -- fix Fixes tag Changes in v3: -- revise commit text Changes in v4: -- fix commit text newline Changes in v5: -- fix commit text line over 75 chars Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Signed-off-by: Kuogee Hsieh Reviewed-by: Abhinav Kumar Reviewed-by: Stephen Boyd Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/497194/ Link: https://lore.kernel.org/r/1660258670-4200-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Abhinav Kumar commit e754dd7e8be86e1adc9d4d13fb1105b848c11752 Author: Leo Yan Date: Thu Aug 11 14:24:51 2022 +0800 perf c2c: Update documentation for new display option 'peer' Since the new display option 'peer' is introduced, this patch is to update the documentation to reflect it. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-16-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit ead42a0f9b93c3447a24be08a9e80941e99b8a50 Author: Leo Yan Date: Thu Aug 11 14:24:50 2022 +0800 perf c2c: Use 'peer' as default display for Arm64 Since Arm64 arch doesn't support HITMs flags, this patch changes to use 'peer' as default display if user doesn't specify any type; for other arches, it still uses 'tot' as default display type if user doesn't specify it. This patch changes to call perf_session__new() in an earlier place, so session environment can be initialized ahead and arch info can be used for setting display type. Suggested-by: Ali Saidi Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-15-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit f37c5d914e39bdaf86505d6f1c1973418b44a6c6 Author: Leo Yan Date: Thu Aug 11 14:24:49 2022 +0800 perf c2c: Sort on peer snooping for load operations This patch adds a new option 'peer' so can sort on the cache hit for peer snooping. For displaying with option 'peer', the "Shared Data Cache Line Table" and "Shared Cache Line Distribution Pareto" both sort with the metrics "tot_peer". As result, we can get the 'peer' display: # perf c2c report -d peer --coalesce tid,pid,iaddr,dso -N --stdio ================================================= Shared Data Cache Line Table ================================================= # # ----------- Cacheline ---------- Peer ------- Load Peer ------- Total Total Total --------- Stores -------- ----- Core Load Hit ----- - LLC Load Hit -- - RMT Load Hit -- --- Load Dram ---- # Index Address Node PA cnt Snoop Total Local Remote records Loads Stores L1Hit L1Miss N/A FB L1 L2 LclHit LclHitm RmtHit RmtHitm Lcl Rmt # ..... .................. .... ...... ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ........ ....... ........ ....... ........ ........ # 0 0xaaaac17d6000 N/A 0 100.00% 99 99 0 18851 18851 0 0 0 0 0 18752 0 99 0 0 0 0 0 ================================================= Shared Cache Line Distribution Pareto ================================================= # # -- Peer Snoop -- ------- Store Refs ------ --------- Data address --------- ---------- cycles ---------- Total cpu Shared # Num Rmt Lcl L1 Hit L1 Miss N/A Offset Node PA cnt Pid Tid Code address rmt peer lcl peer load records cnt Symbol Object Source:Line Node{cpus %peers %stores} # ..... ....... ....... ....... ....... ....... .................. .... ...... ....... ................. .................. ........ ........ ........ ....... ........ ...................... ................ ............... .... # ---------------------------------------------------------------------- 0 0 99 0 0 0 0xaaaac17d6000 ---------------------------------------------------------------------- 0.00% 3.03% 0.00% 0.00% 0.00% 0x20 N/A 0 3603 3603:memstress 0xaaaac17c25ac 0 376 41 9314 2 [.] 0x00000000000025ac memstress memstress[25ac] 0{ 2 100.0% n/a} 0.00% 3.03% 0.00% 0.00% 0.00% 0x20 N/A 0 3603 3606:memstress 0xaaaac17c25ac 0 375 44 9155 1 [.] 0x00000000000025ac memstress memstress[25ac] 0{ 1 100.0% n/a} 0.00% 48.48% 0.00% 0.00% 0.00% 0x29 N/A 0 3603 3606:memstress 0xaaaac17c3e88 0 180 170 65 1 [.] 0x0000000000003e88 memstress memstress[3e88] 0{ 1 100.0% n/a} 0.00% 45.45% 0.00% 0.00% 0.00% 0x29 N/A 0 3603 3603:memstress 0xaaaac17c3e88 0 180 175 70 2 [.] 0x0000000000003e88 memstress memstress[3e88] 0{ 2 100.0% n/a} Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-14-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit faa30dfab5bc6c033994366b24bd805b1cced4ee Author: Leo Yan Date: Thu Aug 11 14:24:48 2022 +0800 perf c2c: Refactor display string The display type is shown by combination the display string array and a suffix string "HITMs", which is not friendly to extend display for other sorting type (e.g. extension for peer operations). This patch moves the suffix string "HITMs" into display string array for HITM types, so it can allow us to not necessarily to output string "HITMs" for new incoming display type. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-13-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 7c10b65a42d7bcbc6d3082fa2db257cce8a58c08 Author: Leo Yan Date: Thu Aug 11 14:24:47 2022 +0800 perf c2c: Refactor node header The node header array contains 3 items, each item is used for one of the 3 flavors for node accessing info. To extend sorting on other snooping type and not always stick to HITMs, the second header string "Node{cpus %hitms %stores}" should be adjusted (e.g. it's changed as "Node{cpus %peer %stores}"). For this reason, this patch changes the node header array to three flat variables and uses switch-case in function setup_nodes_header(), thus it is easier for altering the header string. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-12-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 2be0bc7529f8b5fb63f441167bd8875d71902b17 Author: Leo Yan Date: Thu Aug 11 14:24:46 2022 +0800 perf c2c: Rename dimension from 'percent_hitm' to 'percent_costly_snoop' Use more general naming for the main sort dimension, this can allow us not to sort only on HITM snoop type, so it can be extended to support other costly snooping operations. So rename the dimension to the prefix 'percent_costly_". Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-11-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit c82ccc3a3d57d7f40083c7c560b726b7b919206f Author: Leo Yan Date: Thu Aug 11 14:24:45 2022 +0800 perf c2c: Use explicit names for display macros Perf c2c tool has an assumption that it heavily depends on HITM snoop type to detect cache false sharing, unfortunately, HITM is not supported on some architectures. Essentially, perf c2c tool wants to find some very costly snooping operations for false cache sharing, this means it's not necessarily to stick using HITM tags and we can explore other snooping types (e.g. SNOOPX_PEER). For this reason, this patch renames HITM related display macros with suffix '_HITM', so it can be distinct if later add more display types for on other snooping type. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-10-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 682352e59bf197a3e56e6c236683ab3a96a6952b Author: Leo Yan Date: Thu Aug 11 14:24:44 2022 +0800 perf c2c: Add mean dimensions for peer operations This patch adds two dimensions for the mean value of peer operations. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-9-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 9082282fce7215868b3702da77f7eb9339310e7a Author: Leo Yan Date: Thu Aug 11 14:24:43 2022 +0800 perf c2c: Add dimensions of peer metrics for cache line view This patch adds dimensions of peer ops, which will be used for Shared cache line distribution pareto. It adds the percentage dimensions for local and remote peer operations, and the dimensions for accounting operation numbers which is used for stdio mode. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-8-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 63e74ab5e4e35da7ec4d62b5209c8f654447ba87 Author: Leo Yan Date: Thu Aug 11 14:24:42 2022 +0800 perf c2c: Add dimensions for peer load operations This patch adds three dimensions for peer load operations of 'lcl_peer', 'rmt_peer' and 'tot_peer'. These three dimensions will be used in the shared data cache line table. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-7-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 3ef1fc17b31b7f701e8392efe8032333a2a5e6a5 Author: Leo Yan Date: Thu Aug 11 14:24:41 2022 +0800 perf c2c: Output statistics for peer snooping This patch outputs statistics for peer snooping for whole trace events and global shared cache line. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-6-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit e843dec53ac87d6faab1c144dad9a097997a0e83 Author: Leo Yan Date: Thu Aug 11 14:24:40 2022 +0800 perf mem: Add statistics for peer snooping Since the flag PERF_MEM_SNOOPX_PEER is added to support cache snooping from peer cache line, it can come from a peer core, a peer cluster, or a remote NUMA node. This patch adds statistics for the flag PERF_MEM_SNOOPX_PEER. Note, we take PERF_MEM_SNOOPX_PEER as an affiliated info, it needs to cooperate with cache level statistics. Therefore, we account the load operations for both the cache level's metrics (e.g. ld_l2hit, ld_llchit, etc.) and peer related metrics when flag PERF_MEM_SNOOPX_PEER is set. So three new metrics are introduced: 'lcl_peer' is for local cache access, the metric 'rmt_peer' is for remote access (includes remote DRAM and any caches in remote node), and the metric 'tot_peer' is accounting the sum value of 'lcl_peer' and 'rmt_peer'. Reviewed-by: Ali Saidi Signed-off-by: Leo Yan Tested-by: Ali Saidi Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-5-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 4e6430cbb1a9f1dc0a698f93026b6178da437798 Author: Ali Saidi Date: Thu Aug 11 14:24:39 2022 +0800 perf arm-spe: Use SPE data source for neoverse cores When synthesizing data from SPE, augment the type with source information for Arm Neoverse cores. The field is IMPLDEF but the Neoverse cores all use the same encoding. I can't find encoding information for any other SPE implementations to unify their choices with Arm's thus that is left for future work. This change populates the mem_lvl_num for Neoverse cores as well as the deprecated mem_lvl namespace. Reviewed-by: German Gomez Reviewed-by: Leo Yan Signed-off-by: Ali Saidi Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: Gustavo A. R. Silva Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-4-leo.yan@linaro.org Signed-off-by: Leo Yan Signed-off-by: Arnaldo Carvalho de Melo commit f78d6250db1a4bd81b9f998a93ea24eb8d4c1908 Author: Leo Yan Date: Thu Aug 11 14:24:38 2022 +0800 perf mem: Print snoop peer flag Since PERF_MEM_SNOOPX_PEER flag is a new snoop type, print this flag if it is set. Before: memstress 3603 [020] 122.463754: 1 l1d-miss: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 l1d-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 llc-miss: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 llc-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 tlb-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 memory: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP N/A|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) After: memstress 3603 [020] 122.463754: 1 l1d-miss: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 l1d-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 llc-miss: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 llc-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 tlb-access: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) memstress 3603 [020] 122.463754: 1 memory: 8688000842 |OP LOAD|LVL L3 or L3 hit|SNP Peer|TLB Walker hit|LCK No|BLK N/A aaaac17c3e88 [unknown] (/home/ubuntu/memstress) Reviewed-by: Ali Saidi Reviewed-by: Kajol Jain Signed-off-by: Leo Yan Tested-by: Ali Saidi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-3-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 2e21bcf0514a3623b41962bf424dec061c02ebc6 Author: Ali Saidi Date: Thu Aug 11 14:24:37 2022 +0800 perf tools: Sync addition of PERF_MEM_SNOOPX_PEER Add a flag to the 'perf mem' data struct to signal that a request caused a cache-to-cache transfer of a line from a peer of the requestor and wasn't sourced from a lower cache level. The line being moved from one peer cache to another has latency and performance implications. On Arm64 Neoverse systems the data source can indicate a cache-to-cache transfer but not if the line is dirty or clean, so instead of overloading HITM define a new flag that indicates this type of transfer. Committer notes: This really is not syncing with the kernel since the patch to the kernel wasn't merged. But we're going ahead of this as it seems trivial and is just a matter of the perf kernel maintainers to give their ack or for us to find another way of expressing this in the perf records synthesized in userspace from the ARM64 hardware traces. Reviewed-by: Leo Yan Signed-off-by: Ali Saidi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Gustavo A. R. Silva Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kajol Jain Cc: Like Xu Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Timothy Hayes Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220811062451.435810-2-leo.yan@linaro.org Signed-off-by: Leo Yan Signed-off-by: Arnaldo Carvalho de Melo commit 4a88c4ec3c2c6743cc4424b51e66a0c034afe507 Author: Leo Yan Date: Thu Aug 11 19:06:38 2022 -0300 perf arm64: Add missing -I for tools/arch/arm64/include/ to find asm/sysreg.h when building arm_spe.h This cures a current problem where tools/perf/util/arm-spe.c isn't finding a ARM64 specific asm header, so lets add it for now to make progress. Adding a .o specific rule seems clunky, lets try and find if this is really the right solution. Signed-off-by: Leo Yan Reported-by: Suzuki K Poulose Tested-by: Arnaldo Carvalho de Melo Cc: Catalin Marinas Cc: Anshuman Khandual Cc: Will Deacon Cc: James Morse Link: https://lore.kernel.org/lkml/20220811124825.GA868014@leoy-huanghe.lan Signed-off-by: Arnaldo Carvalho de Melo commit f829ee7595b5e9a9e5e1cc802224391c61072b38 Author: Atish Patra Date: Mon Jul 11 10:46:32 2022 -0700 RISC-V: Improve SBI definitions Fixed few typos and bit fields not aligned with the spec. Define other related macros that will be useful in the future. Signed-off-by: Atish Patra Link: https://lore.kernel.org/r/20220711174632.4186047-6-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit 63ba67ebdfd403ef53aa0fefde3a42e505516e8c Author: Atish Patra Date: Mon Jul 11 10:46:31 2022 -0700 RISC-V: Move counter info definition to sbi header file Counter info encoding format is defined by the SBI specificaiton. KVM implementation of SBI PMU extension will also leverage this definition. Move the definition to common sbi header file from the sbi pmu driver. Signed-off-by: Atish Patra Link: https://lore.kernel.org/r/20220711174632.4186047-5-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit 0209b5830bea42dd3ce33ab0397231e67ec3b751 Author: Atish Patra Date: Mon Jul 11 10:46:30 2022 -0700 RISC-V: Fix SBI PMU calls for RV32 Some of the SBI PMU calls does not pass 64bit arguments correctly and not under RV32 compile time flags. Currently, this doesn't create any incorrect results as RV64 ignores any value in the additional register and qemu doesn't support raw events. Fix those SBI calls in order to set correct values for RV32. Fixes: e9991434596f ("RISC-V: Add perf platform driver based on SBI PMU extension") Signed-off-by: Atish Patra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220711174632.4186047-4-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit 133a6d1fe7d7ad8393af025c4dde379c0616661f Author: Atish Patra Date: Mon Jul 11 10:46:29 2022 -0700 RISC-V: Update user page mapping only once during start Currently, riscv_pmu_event_set_period updates the userpage mapping. However, the caller of riscv_pmu_event_set_period should update the userpage mapping because the counter can not be updated/started from set_period function in counter overflow path. Invoke the perf_event_update_userpage at the caller so that it doesn't get invoked twice during counter start path. Fixes: f5bfa23f576f ("RISC-V: Add a perf core library for pmu drivers") Reviewed-by: Anup Patel Signed-off-by: Atish Patra Reviewed-by: Guo Ren Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220711174632.4186047-3-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit acc1b919f47926b089be21b8aaa29ec91fef0aa2 Author: Atish Patra Date: Mon Jul 11 10:46:28 2022 -0700 RISC-V: Fix counter restart during overflow for RV32 Pass the upper half of the initial value of the counter correctly for RV32. Fixes: 4905ec2fb7e6 ("RISC-V: Add sscofpmf extension support") Signed-off-by: Atish Patra Reviewed-by: Guo Ren Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220711174632.4186047-2-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit 53e76d35f797b2975ad9b2934e668e59abba1f10 Author: Adrian Hunter Date: Thu Aug 11 20:04:11 2022 +0300 perf tools: Tidy guest option documentation Move common guest options into include files. Use attribute substitution to customize an example, using "[verse]" to define the block instead of a "literal" block which does not permit substitution. Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220811170411.84154-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d9ca43c06fb76d2829675b764093c7094ab636f0 Author: Adrian Hunter Date: Thu Aug 11 20:04:10 2022 +0300 perf inject: Fix missing guestmount option documentation The 'perf inject' documentation is missing the guestmount option. Add it. Fixes: 97406a7e4fa6e5ca ("perf inject: Add support for injecting guest sideband events") Signed-off-by: Adrian Hunter Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220811170411.84154-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 696d0a4cb8009af7bb3b45dc4d94679a7c9a2318 Author: Adrian Hunter Date: Thu Aug 11 20:04:09 2022 +0300 perf script: Fix missing guest option documentation The 'perf script' documentation is missing several options relating to guests. Add them. Fixes: 15a108af1a18b597 ("perf script: Allow specifying the files to process guest samples") Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220811170411.84154-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7ab52f75a9cf7fed7ba85802b986825dd72df641 Merge: 3dbe5829408bc 9f7a8ff6391fd Author: Palmer Dabbelt Date: Thu Aug 11 14:41:52 2022 -0700 RISC-V: Add Sstc extension support This series implements Sstc extension support which was ratified recently. Before the Sstc extension, an SBI call is necessary to generate timer interrupts as only M-mode have access to the timecompare registers. Thus, there is significant latency to generate timer interrupts at kernel. For virtualized enviornments, its even worse as the KVM handles the SBI call and uses a software timer to emulate the timecomapre register. Sstc extension solves both these problems by defining a stimecmp/vstimecmp at supervisor (host/guest) level. It allows kernel to program a timer and recieve interrupt without supervisor execution enviornment (M-mode/HS mode) intervention. * palmer/riscv-sstc: RISC-V: Prefer sstc extension if available RISC-V: Enable sstc extension parsing from DT RISC-V: Add SSTC extension CSR details commit 9f7a8ff6391fd5363363b8e5c8b1462a07922368 Author: Atish Patra Date: Fri Jul 22 09:50:46 2022 -0700 RISC-V: Prefer sstc extension if available RISC-V ISA has sstc extension which allows updating the next clock event via a CSR (stimecmp) instead of an SBI call. This should happen dynamically if sstc extension is available. Otherwise, it will fallback to SBI call to maintain backward compatibility. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220722165047.519994-4-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit 464b0187ff94fcc629fe7cd350e16a3b9e80ed9e Author: Atish Patra Date: Fri Jul 22 09:50:45 2022 -0700 RISC-V: Enable sstc extension parsing from DT The ISA extension framework now allows parsing any multi-letter ISA extension. Enable that for sstc extension. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Link: https://lore.kernel.org/r/20220722165047.519994-3-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit bf952a290f7a9d818204b9b68e861655f8b15a65 Author: Atish Patra Date: Fri Jul 22 09:50:44 2022 -0700 RISC-V: Add SSTC extension CSR details This patch just introduces the required CSR fields related to the SSTC extension. Reviewed-by: Anup Patel Signed-off-by: Atish Patra Link: https://lore.kernel.org/r/20220722165047.519994-2-atishp@rivosinc.com Signed-off-by: Palmer Dabbelt commit fe99b819487dba848cddd3d4bf4beb8e653d7e9c Author: Luca Ceresoli Date: Mon Aug 8 16:17:08 2022 +0200 docs: i2c: i2c-sysfs: fix hyperlinks dts files cannot be linked conveniently, thus replace them with literal formatting. The links to other rst pages are broken, fix them using the proper syntax. Fixes: 31df7195b100 ("Documentation: i2c: Add doc for I2C sysfs") Signed-off-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 55bdfb8b55ae4bff4864d61a250abe0af86adc69 Author: Luca Ceresoli Date: Mon Aug 8 16:17:07 2022 +0200 docs: i2c: i2c-sysfs: improve wording Improve wording in a couple sentences. Signed-off-by: Luca Ceresoli [wsa: improved a little more] Signed-off-by: Wolfram Sang commit 3dbe5829408bc1586f75b4667ef60e5aab0209c7 Author: Yipeng Zou Date: Thu Jul 21 14:58:20 2022 +0800 riscv:uprobe fix SR_SPIE set/clear handling In riscv the process of uprobe going to clear spie before exec the origin insn,and set spie after that.But When access the page which origin insn has been placed a page fault may happen and irq was disabled in arch_uprobe_pre_xol function,It cause a WARN as follows. There is no need to clear/set spie in arch_uprobe_pre/post/abort_xol. We can just remove it. [ 31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488 [ 31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work [ 31.684929] preempt_count: 0, expected: 0 [ 31.685969] CPU: 2 PID: 76 Comm: work Tainted: G [ 31.686542] Hardware name: riscv-virtio,qemu (DT) [ 31.686797] Call Trace: [ 31.687053] [] dump_backtrace+0x30/0x38 [ 31.687699] [] show_stack+0x40/0x4c [ 31.688141] [] dump_stack_lvl+0x44/0x5c [ 31.688396] [] dump_stack+0x18/0x20 [ 31.688653] [] __might_resched+0x114/0x122 [ 31.688948] [] __might_sleep+0x50/0x7a [ 31.689435] [] down_read+0x30/0x130 [ 31.689728] [] do_page_fault+0x166/x446 [ 31.689997] [] ret_from_exception+0x0/0xc Fixes: 74784081aac8 ("riscv: Add uprobes supported") Signed-off-by: Yipeng Zou Reviewed-by: Guo Ren Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220721065820.245755-1-zouyipeng@huawei.com Signed-off-by: Palmer Dabbelt commit 43310e279d7b40c84bd41b30f2fa53d9bc05b268 Author: Luca Ceresoli Date: Mon Aug 8 16:17:04 2022 +0200 docs: i2c: instantiating-devices: add syntax coloring to dts and C blocks These blocks can be nicely coloured via Sphinx. Signed-off-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 6c12ec2772fa01516fde5685644b129c6f236ce2 Author: Luca Ceresoli Date: Mon Aug 8 16:17:03 2022 +0200 docs: i2c: smbus-protocol: improve DataLow/DataHigh definition Use a more professional wording. Signed-off-by: Luca Ceresoli Reviewed-by: Bagas Sanjaya Signed-off-by: Wolfram Sang commit 0721ceee2fa7e64c1bc83b2d7aa4b8f284bc7aa0 Author: Luca Ceresoli Date: Mon Aug 8 16:17:02 2022 +0200 docs: i2c: i2c-protocol: remove unused legend items "Comm", "Count", "DataLow", "DataHigh" are not used in this section. Signed-off-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 24d129d4f2bd01a085eb18ac7abb5612796209d8 Author: Luca Ceresoli Date: Mon Aug 8 16:17:01 2022 +0200 docs: i2c: i2c-protocol,smbus-protocol: remove nonsense words "as usual" does not mean much here, especially as these are introductory sections and 10-bit addressing hasn't been introduced yet. Signed-off-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 9bbebdf77890358304c7b55a02228cf00deec4cb Author: Luca Ceresoli Date: Mon Aug 8 16:17:00 2022 +0200 docs: i2c: i2c-protocol: update introductory paragraph This sentence dates back to the pre-git era and it does not look very professional... As there is no clear definition of "finished", and given this page is already a pretty good overview, not to mention it is not the kernel responsibility to document the protocol in detail, let's update the text accordingly. Signed-off-by: Luca Ceresoli Signed-off-by: Wolfram Sang commit 0b0221d9cd330e3d9c4cb0a257b92af2a6ca2ed0 Author: Wolfram Sang Date: Thu Aug 11 14:08:08 2022 +0200 i2c: move core from strlcpy to strscpy Follow the advice of the below link and prefer 'strscpy'. Conversion is easy because no code used the return value. It has been done with a simple sed invocation. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit ea1558ce149d286eaf2c0800a93b7efa2adda094 Author: Wolfram Sang Date: Thu Aug 11 09:10:30 2022 +0200 i2c: move drivers from strlcpy to strscpy Follow the advice of the below link and prefer 'strscpy'. Conversion is easy because no driver used the return value and has been done with a simple sed invocation. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 663bb7b9795fcd8b039b5a43990857580f4b816c Author: Chris Pringle Date: Thu Aug 11 09:21:41 2022 +0100 i2c: kempld: Support ACPI I2C device declaration Adds an ACPI companion to the KEMPLD I2C driver so that it correctly detects any I2C devices nested under the KEMPLD's ACPI node (SBRG.CPLD). This allows I2C devices attached to the KEMPLD I2C adapter to be declared and instantiated via ACPI. Signed-off-by: Chris Pringle Signed-off-by: Wolfram Sang commit 1b48006ed477827848a2b14d70c764fb280c595d Author: Kewei Xu Date: Sat Aug 6 18:02:49 2022 +0800 i2c: mediatek: add i2c compatible for MT8188 Add i2c compatible for MT8188 and added mt_i2c_regs_v3[], since MT8188 i2c OFFSET_SLAVE_ADDR register changed from 0x04 to 0x94. Signed-off-by: Kewei Xu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Qii Wang Signed-off-by: Wolfram Sang commit 3a8b54298cbee5d56a710f70863226b0ed84aa27 Author: Kewei Xu Date: Sat Aug 6 18:02:48 2022 +0800 dt-bindings: i2c: update bindings for mt8188 soc Add a DT binding documentation for the mt8188 soc. Signed-off-by: Kewei Xu Reviewed-by: Matthias Brugger Acked-by: Rob Herring Reviewed-by: Qii Wang Signed-off-by: Wolfram Sang commit b60cf8e59e61133b6c9514ff8d8c8d7049d040ef Author: Conor Dooley Date: Wed Aug 3 19:54:00 2022 +0100 dt-bindings: riscv: fix SiFive l2-cache's cache-sets Fix device tree schema validation error messages for the SiFive Unmatched: ' cache-sets:0:0: 1024 was expected'. The existing bindings allow for just 1024 cache-sets but the fu740 on Unmatched the has 2048 cache-sets. The ISA itself permits any arbitrary power of two, however this is not supported by dt-schema. The RTL for the IP, to which the number of cache-sets is a tunable parameter, has been released publicly so speculatively adding a small number of "reasonable" values seems unwise also. Instead, as the binding only supports two distinct controllers: add 2048 and explicitly lock it to the fu740's l2 cache while limiting 1024 to the l2 cache on the fu540. Fixes: af951c3a113b ("dt-bindings: riscv: Update l2 cache DT documentation to add support for SiFive FU740") Reported-by: Atul Khare Signed-off-by: Conor Dooley Reviewed-by: Krzysztof Kozlowski Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220803185359.942928-1-mail@conchuod.ie Signed-off-by: Palmer Dabbelt commit ade1d0307b2fb3d9192398e9b638b1bb6ed36028 Author: Namhyung Kim Date: Thu Aug 11 11:54:56 2022 -0700 perf offcpu: Update offcpu test for child process Record off-cpu data with perf bench sched messaging workload and count the number of offcpu-time events. Also update the test script not to run next tests if failed already and revise the error messages. $ sudo ./perf test offcpu -v 88: perf record offcpu profiling tests : --- start --- test child forked, pid 344780 Checking off-cpu privilege Basic off-cpu test Basic off-cpu test [Success] Child task off-cpu test Child task off-cpu test [Success] test child finished with 0 ---- end ---- perf record offcpu profiling tests: Ok Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220811185456.194721-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d23477637ac6d29f946461a2fa5eb616cfa5d3f0 Author: Namhyung Kim Date: Thu Aug 11 11:54:55 2022 -0700 perf offcpu: Track child processes When -p option used or a workload is given, it needs to handle child processes. The perf_event can inherit those task events automatically. We can add a new BPF program in task_newtask tracepoint to track child processes. Before: $ sudo perf record --off-cpu -- perf bench sched messaging $ sudo perf report --stat | grep -A1 offcpu offcpu-time stats: SAMPLE events: 1 After: $ sudo perf record -a --off-cpu -- perf bench sched messaging $ sudo perf report --stat | grep -A1 offcpu offcpu-time stats: SAMPLE events: 856 Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220811185456.194721-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d6f415ca33e132d14743c36ad4e2b63dc8ad0b18 Author: Namhyung Kim Date: Thu Aug 11 11:54:54 2022 -0700 perf offcpu: Parse process id separately The current target code uses thread id for tracking tasks because perf_events need to be opened for each task. But we can use tgid in BPF maps and check it easily. Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220811185456.194721-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 07fc958b0cfcd8e44f0de13625a551dd16b97eb4 Author: Namhyung Kim Date: Thu Aug 11 11:54:53 2022 -0700 perf offcpu: Check process id for the given workload Current task filter checks task->pid which is different for each thread. But we want to profile all the threads in the process. So let's compare process id (or thread-group id: tgid) instead. Before: $ sudo perf record --off-cpu -- perf bench sched messaging -t $ sudo perf report --stat | grep -A1 offcpu offcpu-time stats: SAMPLE events: 2 After: $ sudo perf record --off-cpu -- perf bench sched messaging -t $ sudo perf report --stat | grep -A1 offcpu offcpu-time stats: SAMPLE events: 850 Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Hao Luo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Milian Wolff Cc: Peter Zijlstra Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220811185456.194721-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 87df2b5cbc84554df49ccfd9170103729d5a0ab4 Author: Conor Dooley Date: Thu Jul 14 09:02:36 2022 +0100 riscv: ensure cpu_ops_sbi is declared Sparse complains that cpu_ops_sbi is used undeclared: arch/riscv/kernel/cpu_ops_sbi.c:17:29: warning: symbol 'cpu_ops_sbi' was not declared. Should it be static? Fix the warning by adding cpu_ops_sbi to cpu_ops_sbi.h & including that where used. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20220714080235.3853374-1-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 7ebfc85e2cd7b08f518b526173e9a33b56b3913b Merge: e091ba5cf8271 c2e75634cbe36 Author: Linus Torvalds Date: Thu Aug 11 13:45:37 2022 -0700 Merge tag 'net-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth, bpf, can and netfilter. A little larger than usual but it's all fixes, no late features. It's large partially because of timing, and partially because of follow ups to stuff that got merged a week or so before the merge window and wasn't as widely tested. Maybe the Bluetooth fixes are a little alarming so we'll address that, but the rest seems okay and not scary. Notably we're including a fix for the netfilter Kconfig [1], your WiFi warning [2] and a bluetooth fix which should unblock syzbot [3]. Current release - regressions: - Bluetooth: - don't try to cancel uninitialized works [3] - L2CAP: fix use-after-free caused by l2cap_chan_put - tls: rx: fix device offload after recent rework - devlink: fix UAF on failed reload and leftover locks in mlxsw Current release - new code bugs: - netfilter: - flowtable: fix incorrect Kconfig dependencies [1] - nf_tables: fix crash when nf_trace is enabled - bpf: - use proper target btf when exporting attach_btf_obj_id - arm64: fixes for bpf trampoline support - Bluetooth: - ISO: unlock on error path in iso_sock_setsockopt() - ISO: fix info leak in iso_sock_getsockopt() - ISO: fix iso_sock_getsockopt for BT_DEFER_SETUP - ISO: fix memory corruption on iso_pinfo.base - ISO: fix not using the correct QoS - hci_conn: fix updating ISO QoS PHY - phy: dp83867: fix get nvmem cell fail Previous releases - regressions: - wifi: cfg80211: fix validating BSS pointers in __cfg80211_connect_result [2] - atm: bring back zatm uAPI after ATM had been removed - properly fix old bug making bonding ARP monitor mode not being able to work with software devices with lockless Tx - tap: fix null-deref on skb->dev in dev_parse_header_protocol - revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" it helps some devices and breaks others - netfilter: - nf_tables: many fixes rejecting cross-object linking which may lead to UAFs - nf_tables: fix null deref due to zeroed list head - nf_tables: validate variable length element extension - bgmac: fix a BUG triggered by wrong bytes_compl - bcmgenet: indicate MAC is in charge of PHY PM Previous releases - always broken: - bpf: - fix bad pointer deref in bpf_sys_bpf() injected via test infra - disallow non-builtin bpf programs calling the prog_run command - don't reinit map value in prealloc_lru_pop - fix UAFs during the read of map iterator fd - fix invalidity check for values in sk local storage map - reject sleepable program for non-resched map iterator - mptcp: - move subflow cleanup in mptcp_destroy_common() - do not queue data on closed subflows - virtio_net: fix memory leak inside XDP_TX with mergeable - vsock: fix memory leak when multiple threads try to connect() - rework sk_user_data sharing to prevent psock leaks - geneve: fix TOS inheriting for ipv4 - tunnels & drivers: do not use RT_TOS for IPv6 flowlabel - phy: c45 baset1: do not skip aneg configuration if clock role is not specified - rose: avoid overflow when /proc displays timer information - x25: fix call timeouts in blocking connects - can: mcp251x: fix race condition on receive interrupt - can: j1939: - replace user-reachable WARN_ON_ONCE() with netdev_warn_once() - fix memory leak of skbs in j1939_session_destroy() Misc: - docs: bpf: clarify that many things are not uAPI - seg6: initialize induction variable to first valid array index (to silence clang vs objtool warning) - can: ems_usb: fix clang 14's -Wunaligned-access warning" * tag 'net-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (117 commits) net: atm: bring back zatm uAPI dpaa2-eth: trace the allocated address instead of page struct net: add missing kdoc for struct genl_multicast_group::flags nfp: fix use-after-free in area_cache_get() MAINTAINERS: use my korg address for mt7601u mlxsw: minimal: Fix deadlock in ports creation bonding: fix reference count leak in balance-alb mode net: usb: qmi_wwan: Add support for Cinterion MV32 bpf: Shut up kern_sys_bpf warning. net/tls: Use RCU API to access tls_ctx->netdev tls: rx: device: don't try to copy too much on detach tls: rx: device: bound the frag walk net_sched: cls_route: remove from list when handle is 0 selftests: forwarding: Fix failing tests with old libnet net: refactor bpf_sk_reuseport_detach() net: fix refcount bug in sk_psock_get (2) selftests/bpf: Ensure sleepable program is rejected by hash map iter selftests/bpf: Add write tests for sk local storage map iterator selftests/bpf: Add tests for reading a dangling map iter fd bpf: Only allow sleepable program for resched-able iterator ... commit e091ba5cf82714c8691d978781696cd1fc2dec70 Merge: 8745889a7fd04 da2679f26bd6a Author: Linus Torvalds Date: Thu Aug 11 13:26:09 2022 -0700 Merge tag 'acpi-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These fix up direct references to the fwnode field in struct device and extend ACPI device properties support. Specifics: - Replace direct references to the fwnode field in struct device with dev_fwnode() and device_match_fwnode() (Andy Shevchenko) - Make the ACPI code handling device properties support properties with buffer values (Sakari Ailus)" * tag 'acpi-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: property: Fix error handling in acpi_init_properties() ACPI: VIOT: Do not dereference fwnode in struct device ACPI: property: Read buffer properties as integers ACPI: property: Add support for parsing buffer property UUID ACPI: property: Unify integer value reading functions ACPI: property: Switch node property referencing from ifs to a switch ACPI: property: Move property ref argument parsing into a new function ACPI: property: Use acpi_object_type consistently in property ref parsing ACPI: property: Tie data nodes to acpi handles ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool commit e4aa991c05aedc3ead92d1352af86db74090dc3c Author: Ben Dooks Date: Wed Jul 13 22:53:06 2022 +0100 RISC-V: cpu_ops_spinwait.c should include head.h Running sparse shows cpu_ops_spinwait.c is missing two definitions found in head.h, so include it to stop the following warnings: arch/riscv/kernel/cpu_ops_spinwait.c:15:6: warning: symbol '__cpu_spinwait_stack_pointer' was not declared. Should it be static? arch/riscv/kernel/cpu_ops_spinwait.c:16:6: warning: symbol '__cpu_spinwait_task_pointer' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20220713215306.94675-1-ben.dooks@sifive.com Fixes: c78f94f35cf6 ("RISC-V: Use __cpu_up_stack/task_pointer only for spinwait method") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 8745889a7fd04d14f461f6536c45f70cbaf3ee02 Merge: 786da5da5671c 478af190cb6c5 Author: Linus Torvalds Date: Thu Aug 11 13:11:49 2022 -0700 Merge tag 'iomap-6.0-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull more iomap updates from Darrick Wong: "In the past 10 days or so I've not heard any ZOMG STOP style complaints about removing ->writepage support from gfs2 or zonefs, so here's the pull request removing them (and the underlying fs iomap support) from the kernel: - Remove iomap_writepage and all callers, since the mm apparently never called the zonefs or gfs2 writepage functions" * tag 'iomap-6.0-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: remove iomap_writepage zonefs: remove ->writepage gfs2: remove ->writepage gfs2: stop using generic_writepages in gfs2_ail1_start_one commit da6d2128e56a50a0d497c8e41ca1d33d88bcc0aa Author: Ben Dooks Date: Thu Jul 14 08:18:11 2022 +0100 RISC-V: Declare cpu_ops_spinwait in The cpu_ops_spinwait is used in a couple of places in arch/riscv and is causing a sparse warning due to no declaration. Add this to with the others to fix the following: arch/riscv/kernel/cpu_ops_spinwait.c:16:29: warning: symbol 'cpu_ops_spinwait' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20220714071811.187491-1-ben.dooks@sifive.com [Palmer: Drop the extern from cpu_ops.c] Fixes: 2ffc48fc7071 ("RISC-V: Move spinwait booting method to its own config") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 36fa1cb56ac5189c78dacbbb14d452d0c44b86c0 Merge: 5493ee1919eae 2939deac1fa22 Author: Dave Airlie Date: Fri Aug 12 05:57:05 2022 +1000 Merge tag 'drm-misc-next-fixes-2022-08-10' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: * gem: Annotate WW context in error paths * shmem-helper: Add missing vunmap in error paths Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/YvOLPpufsvOJHiNY@linux-uq9g commit 786da5da5671c2d4cf812fe1ccc980bdde30c69e Merge: e18a90427c4ef a8af0d682ae0c Author: Linus Torvalds Date: Thu Aug 11 12:41:07 2022 -0700 Merge tag 'ceph-for-5.20-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "We have a good pile of various fixes and cleanups from Xiubo, Jeff, Luis and others, almost exclusively in the filesystem. Several patches touch files outside of our normal purview to set the stage for bringing in Jeff's long awaited ceph+fscrypt series in the near future. All of them have appropriate acks and sat in linux-next for a while" * tag 'ceph-for-5.20-rc1' of https://github.com/ceph/ceph-client: (27 commits) libceph: clean up ceph_osdc_start_request prototype libceph: fix ceph_pagelist_reserve() comment typo ceph: remove useless check for the folio ceph: don't truncate file in atomic_open ceph: make f_bsize always equal to f_frsize ceph: flush the dirty caps immediatelly when quota is approaching libceph: print fsid and epoch with osd id libceph: check pointer before assigned to "c->rules[]" ceph: don't get the inline data for new creating files ceph: update the auth cap when the async create req is forwarded ceph: make change_auth_cap_ses a global symbol ceph: fix incorrect old_size length in ceph_mds_request_args ceph: switch back to testing for NULL folio->private in ceph_dirty_folio ceph: call netfs_subreq_terminated with was_async == false ceph: convert to generic_file_llseek ceph: fix the incorrect comment for the ceph_mds_caps struct ceph: don't leak snap_rwsem in handle_cap_grant ceph: prevent a client from exceeding the MDS maximum xattr size ceph: choose auth MDS for getxattr with the Xs caps ceph: add session already open notify support ... commit e18a90427c4ef26e9208a8710b7d10eaf02bed48 Merge: 2ae08b36c06ea 19a7cc817a380 Author: Linus Torvalds Date: Thu Aug 11 12:10:08 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more kvm updates from Paolo Bonzini: - Xen timer fixes - Documentation formatting fixes - Make rseq selftest compatible with glibc-2.35 - Fix handling of illegal LEA reg, reg - Cleanup creation of debugfs entries - Fix steal time cache handling bug - Fixes for MMIO caching - Optimize computation of number of LBRs - Fix uninitialized field in guest_maxphyaddr < host_maxphyaddr path * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (26 commits) KVM: x86/MMU: properly format KVM_CAP_VM_DISABLE_NX_HUGE_PAGES capability table Documentation: KVM: extend KVM_CAP_VM_DISABLE_NX_HUGE_PAGES heading underline KVM: VMX: Adjust number of LBR records for PERF_CAPABILITIES at refresh KVM: VMX: Use proper type-safe functions for vCPU => LBRs helpers KVM: x86: Refresh PMU after writes to MSR_IA32_PERF_CAPABILITIES KVM: selftests: Test all possible "invalid" PERF_CAPABILITIES.LBR_FMT vals KVM: selftests: Use getcpu() instead of sched_getcpu() in rseq_test KVM: selftests: Make rseq compatible with glibc-2.35 KVM: Actually create debugfs in kvm_create_vm() KVM: Pass the name of the VM fd to kvm_create_vm_debugfs() KVM: Get an fd before creating the VM KVM: Shove vcpu stats_id init into kvm_vcpu_init() KVM: Shove vm stats_id init into kvm_create_vm() KVM: x86/mmu: Add sanity check that MMIO SPTE mask doesn't overlap gen KVM: x86/mmu: rename trace function name for asynchronous page fault KVM: x86/xen: Stop Xen timer before changing IRQ KVM: x86/xen: Initialize Xen timer only once KVM: SVM: Disable SEV-ES support if MMIO caching is disable KVM: x86/mmu: Fully re-evaluate MMIO caching when SPTE masks change KVM: x86: Tag kvm_mmu_x86_module_init() with __init ... commit a208acf0eac857dc8cdaddd63a4e18ed03f91786 Author: Mark Kettenis Date: Thu Jul 7 20:55:28 2022 +0200 riscv: dts: starfive: correct number of external interrupts The PLIC integrated on the Vic_U7_Core integrated on the StarFive JH7100 SoC actually supports 133 external interrupts. 127 of these are exposed to the outside world; the remainder are used by other devices that are part of the core-complex such as the L2 cache controller. But all 133 interrupts are external interrupts as far as the PLIC is concerned. Fix the property so that the driver can manage these additional interrupts, which is important since the interrupts for the L2 cache controller are enabled by default. Fixes: ec85362fb121 ("RISC-V: Add initial StarFive JH7100 device tree") Signed-off-by: Mark Kettenis Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220707185529.19509-1-kettenis@openbsd.org Signed-off-by: Palmer Dabbelt commit 2cfe9bbec56ea579135cdd92409fff371841904f Author: Emil Renner Berthing Date: Tue Jul 5 23:01:43 2022 +0200 riscv: dts: sifive unmatched: Add PWM controlled LEDs This adds the two PWM controlled LEDs to the HiFive Unmatched device tree. D12 is just a regular green diode, but D2 is an RGB diode with 3 PWM inputs controlling the three different colours. Signed-off-by: Emil Renner Berthing Reviewed-by: Geert Uytterhoeven Acked-by: Pavel Machek Tested-by: Ron Economos Link: https://lore.kernel.org/r/20220705210143.315151-5-emil.renner.berthing@canonical.com Signed-off-by: Palmer Dabbelt commit 2fd92c7b8fe2cfc634613dc093d0f507c7389ea8 Author: Krzysztof Kozlowski Date: Thu Aug 11 09:38:26 2022 +0300 spi: dt-bindings: Drop Pratyush Yadav Emails to Pratyush Yadav bounce ("550 Invalid recipient"). Generic SPI properties should be maintained by subsystem maintainer (Mark). Add recent contributor Vaishnav Achath to the Cadence SPI bindings. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220811063826.7620-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 09992025dacd258c823f50e82db09d7ef06cdac4 Author: Neil Armstrong Date: Thu Aug 11 15:44:45 2022 +0200 spi: meson-spicc: add local pow2 clock ops to preserve rate between messages At the end of a message, the HW gets a reset in meson_spicc_unprepare_transfer(), this resets the SPICC_CONREG register and notably the value set by the Common Clock Framework. This is problematic because: - the register value CCF can be different from the corresponding CCF cached rate - CCF is allowed to change the clock rate whenever the HW state This introduces: - local pow2 clock ops checking the HW state before allowing a clock operation - separation of legacy pow2 clock patch and new enhanced clock path - SPICC_CONREG datarate value is now value kepts across messages It has been checked that: - SPICC_CONREG datarate value is kept across messages - CCF is only allowed to change the SPICC_CONREG datarate value when busy - SPICC_CONREG datarate value is correct for each transfer This didn't appear before commit 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support") because we recalculated and wrote the rate for each xfer. Fixes: 3e0cf4d3fc29 ("spi: meson-spicc: add a linear clock divider support") Reported-by: Da Xue Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20220811134445.678446-1-narmstrong@baylibre.com Signed-off-by: Mark Brown commit c2e75634cbe368065f140dd30bf8b1a0355158fd Author: Jakub Kicinski Date: Wed Aug 10 09:45:47 2022 -0700 net: atm: bring back zatm uAPI Jiri reports that linux-atm does not build without this header. Bring it back. It's completely dead code but we can't break the build for user space :( Reported-by: Jiri Slaby Fixes: 052e1f01bfae ("net: atm: remove support for ZeitNet ZN122x ATM devices") Link: https://lore.kernel.org/all/8576aef3-37e4-8bae-bab5-08f82a78efd3@kernel.org/ Link: https://lore.kernel.org/r/20220810164547.484378-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e34f49348f8b7a53205b6f77707a3a6a40cf420b Author: Chen Lin Date: Thu Aug 11 23:16:51 2022 +0800 dpaa2-eth: trace the allocated address instead of page struct We should trace the allocated address instead of page struct. Fixes: 27c874867c4e ("dpaa2-eth: Use a single page per Rx buffer") Signed-off-by: Chen Lin Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20220811151651.3327-1-chen45464546@163.com Signed-off-by: Jakub Kicinski commit da2679f26bd6ae20b06d49e53eedc2880cf5e65e Merge: b0f2fe5a38389 46981fa78490e Author: Rafael J. Wysocki Date: Thu Aug 11 19:21:03 2022 +0200 Merge branch 'acpi-properties' Merge changes adding support for device properties with buffer values to the ACPI device properties handling code. * acpi-properties: ACPI: property: Fix error handling in acpi_init_properties() ACPI: property: Read buffer properties as integers ACPI: property: Add support for parsing buffer property UUID ACPI: property: Unify integer value reading functions ACPI: property: Switch node property referencing from ifs to a switch ACPI: property: Move property ref argument parsing into a new function ACPI: property: Use acpi_object_type consistently in property ref parsing ACPI: property: Tie data nodes to acpi handles ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool commit da2634e89caa40d7546b0566ab80ff31567861c9 Author: Stefan Metzmacher Date: Thu Aug 11 09:11:14 2022 +0200 io_uring: consistently make use of io_notif_to_data() This makes the assignment typesafe. It prepares changing io_kiocb_to_cmd() in the next commit. Signed-off-by: Stefan Metzmacher Link: https://lore.kernel.org/r/8da6e9d12cf95ad4bc73274406d12bca7aabf72e.1660201408.git.metze@samba.org Signed-off-by: Jens Axboe commit 3ed159c984079baedff740505d609badb8538e0d Author: Anuj Gupta Date: Thu Aug 11 14:44:59 2022 +0530 io_uring: fix error handling for io_uring_cmd Commit 97b388d70b53 ("io_uring: handle completions in the core") moved the error handling from handler to core. But for io_uring_cmd handler we end up completing more than once (both in handler and in core) leading to use_after_free. Change io_uring_cmd handler to avoid calling io_uring_cmd_done in case of error. Fixes: 97b388d70b53 ("io_uring: handle completions in the core") Signed-off-by: Anuj Gupta Signed-off-by: Kanchan Joshi Link: https://lore.kernel.org/r/20220811091459.6929-1-anuj20.g@samsung.com [axboe: fix ret vs req typo] Signed-off-by: Jens Axboe commit 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c Author: Pablo Neira Ayuso Date: Tue Aug 9 17:23:53 2022 +0200 netfilter: nf_tables: really skip inactive sets when allocating name While looping to build the bitmap of used anonymous set names, check the current set in the iteration, instead of the one that is being created. Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets") Signed-off-by: Pablo Neira Ayuso commit d8357e3bf8f7aabd98bf4dc2709ee877b741cefc Author: Masahiro Yamada Date: Sun Jun 26 07:34:37 2022 +0900 riscv/purgatory: Omit use of bin2c The .incbin assembler directive is much faster than bin2c + $(CC). Do similar refactoring as in commit 4c0f032d4963 ("s390/purgatory: Omit use of bin2c"). Please note the .quad directive matches to size_t in C (both 8 byte) because the purgatory is compiled only for the 64-bit kernel. (KEXEC_FILE depends on 64BIT). Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220625223438.835408-2-masahiroy@kernel.org Signed-off-by: Palmer Dabbelt commit 788177e76589e6441d43691f1a075feec2e25962 Author: Masahiro Yamada Date: Sun Jun 26 07:34:36 2022 +0900 riscv/purgatory: hard-code obj-y in Makefile The purgatory/ directory is entirely guarded in arch/riscv/Kbuild. CONFIG_ARCH_HAS_KEXEC_PURGATORY is bool type. $(CONFIG_ARCH_HAS_KEXEC_PURGATORY) is always 'y' when Kbuild visits this Makefile for building. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20220625223438.835408-1-masahiroy@kernel.org Signed-off-by: Palmer Dabbelt commit 5c221f0af68cfa9edcffd26ba6dbbc4b7ddb1700 Author: Jakub Kicinski Date: Tue Aug 9 16:20:12 2022 -0700 net: add missing kdoc for struct genl_multicast_group::flags Multicast group flags were added in commit 4d54cc32112d ("mptcp: avoid lock_fast usage in accept path"), but it missed adding the kdoc. Mention which flags go into that field, and do the same for op structs. Link: https://lore.kernel.org/r/20220809232012.403730-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2ae08b36c06ea8df73a79f6b80ff7964e006e9e3 Merge: 21f9c8a13bb2a 8bb5e7f4dcd9b Author: Linus Torvalds Date: Thu Aug 11 09:23:08 2022 -0700 Merge tag 'input-for-v5.20-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - changes to input core to properly queue synthetic events (such as autorepeat) and to release multitouch contacts when an input device is inhibited or suspended - reworked quirk handling in i8042 driver that consolidates multiple DMI tables into one and adds several quirks for TUXEDO line of laptops - update to mt6779 keypad to better reflect organization of the hardware - changes to mtk-pmic-keys driver preparing it to handle more variants - facelift of adp5588-keys driver - improvements to iqs7222 driver - adjustments to various DT binding documents for input devices - other assorted driver fixes. * tag 'input-for-v5.20-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (54 commits) Input: adc-joystick - fix ordering in adc_joystick_probe() dt-bindings: input: ariel-pwrbutton: use spi-peripheral-props.yaml Input: deactivate MT slots when inhibiting or suspending devices Input: properly queue synthetic events dt-bindings: input: iqs7222: Use central 'linux,code' definition Input: i8042 - add dritek quirk for Acer Aspire One AO532 dt-bindings: input: gpio-keys: accept also interrupt-extended dt-bindings: input: gpio-keys: reference input.yaml and document properties dt-bindings: input: gpio-keys: enforce node names to match all properties dt-bindings: input: Convert adc-keys to DT schema dt-bindings: input: Centralize 'linux,input-type' definition dt-bindings: input: Use common 'linux,keycodes' definition dt-bindings: input: Centralize 'linux,code' definition dt-bindings: input: Increase maximum keycode value to 0x2ff Input: mt6779-keypad - implement row/column selection Input: mt6779-keypad - match hardware matrix organization Input: i8042 - add additional TUXEDO devices to i8042 quirk tables Input: goodix - switch use of acpi_gpio_get_*_resource() APIs Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - add debug output for quirks ... commit 0b2f3212b551a87fe936701fa0813032861a3308 Author: Florian Westphal Date: Fri Aug 5 10:59:57 2022 +0200 netfilter: nfnetlink: re-enable conntrack expectation events To avoid allocation of the conntrack extension area when possible, the default behaviour was changed to only allocate the event extension if a userspace program is subscribed to a notification group. Problem is that while 'conntrack -E' does enable the event allocation behind the scenes, 'conntrack -E expect' does not: no expectation events are delivered unless user sets "net.netfilter.nf_conntrack_events" back to 1 (always on). Fix the autodetection to also consider EXP type group. We need to track the 6 event groups (3+3, new/update/destroy for events and for expectations each) independently, else we'd disable events again if an expectation group becomes empty while there is still an active event group. Fixes: 2794cdb0b97b ("netfilter: nfnetlink: allow to detect if ctnetlink listeners exist") Reported-by: Yi Chen Signed-off-by: Florian Westphal commit da06cc5bb600bc671715076b5bdd9088c674dd01 Merge: 76ad33e1b95f3 f9293ad46d8ba Author: Palmer Dabbelt Date: Thu Aug 11 09:04:01 2022 -0700 RISC-V: fixups to work with crash tool A handful of fixes to our kexec/crash kernel support that allow crash tool to function. Link: https://lore.kernel.org/r/mhng-f5fdaa37-e99a-4214-a297-ec81f0fed0c1@palmer-mbp2014 * commit 'f9293ad46d8ba9909187a37b7215324420ad4596': RISC-V: Add modules to virtual kernel memory layout dump RISC-V: Fixup schedule out issue in machine_crash_shutdown() RISC-V: Fixup get incorrect user mode PC for kernel mode regs RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context commit 02e1a114fdb71e59ee6770294166c30d437bf86a Author: Jialiang Wang Date: Wed Aug 10 15:30:57 2022 +0800 nfp: fix use-after-free in area_cache_get() area_cache_get() is used to distribute cache->area and set cache->id, and if cache->id is not 0 and cache->area->kref refcount is 0, it will release the cache->area by nfp_cpp_area_release(). area_cache_get() set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire(). But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is is already set but the refcount is not increased as expected. At this time, calling the nfp_cpp_area_release() will cause use-after-free. To avoid the use-after-free, set cache->id after area_init() and nfp_cpp_area_acquire() complete successfully. Note: This vulnerability is triggerable by providing emulated device equipped with specified configuration. BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1 Call Trace: nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884) Allocated by task 1: nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303) nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802) nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230) nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215) nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744) Freed by task 1: kfree (mm/slub.c:4562) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873) nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973) nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48) Signed-off-by: Jialiang Wang Reviewed-by: Yinjun Zhang Acked-by: Simon Horman Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com Signed-off-by: Jakub Kicinski commit cef8e3261b4c8003f8a28276f8c74d7d0223e289 Author: Jakub Kicinski Date: Tue Aug 9 16:38:43 2022 -0700 MAINTAINERS: use my korg address for mt7601u Change my address for mt7601u to the main one. Link: https://lore.kernel.org/r/20220809233843.408004-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4f98cb0408b06c4cbad8018dc7c2b4accd9d3020 Author: Vadim Pasternak Date: Thu Aug 11 11:57:36 2022 +0200 mlxsw: minimal: Fix deadlock in ports creation Drop devl_lock() / devl_unlock() from ports creation and removal flows since the devlink instance lock is now taken by mlxsw_core. Fixes: 72a4c8c94efa ("mlxsw: convert driver to use unlocked devlink API during init/fini") Signed-off-by: Vadim Pasternak Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/f4afce5ab0318617f3866b85274be52542d59b32.1660211614.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f9293ad46d8ba9909187a37b7215324420ad4596 Author: Xianting Tian Date: Thu Aug 11 15:41:48 2022 +0800 RISC-V: Add modules to virtual kernel memory layout dump Modules always live before the kernel, MODULES_END is fixed but MODULES_VADDR isn't fixed, it depends on the kernel size. Let's add it to virtual kernel memory layout dump. As MODULES is only defined for CONFIG_64BIT, so we dump it when CONFIG_64BIT=y. eg, MODULES_VADDR - MODULES_END 0xffffffff01133000 - 0xffffffff80000000 Reviewed-by: Guo Ren Reviewed-by: Heiko Stuebner Signed-off-by: Xianting Tian Link: https://lore.kernel.org/r/20220811074150.3020189-5-xianting.tian@linux.alibaba.com Cc: stable@vger.kernel.org Fixes: 2bfc6cd81bd1 ("riscv: Move kernel mapping outside of linear mapping") Signed-off-by: Palmer Dabbelt commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 Author: Florian Westphal Date: Thu Aug 11 13:30:39 2022 +0200 netfilter: nf_tables: fix scheduling-while-atomic splat nf_tables_check_loops() can be called from rhashtable list walk so cond_resched() cannot be used here. Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 76ad33e1b95f3db7a2fb6c3141dc82a8d05f80dc Author: Krzysztof Kozlowski Date: Thu Jun 23 13:29:05 2022 +0200 riscv: traps_misaligned: do not duplicate stringify Use existing stringify macro from the kernel headers. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20220623112905.253157-1-krzysztof.kozlowski@linaro.org Signed-off-by: Palmer Dabbelt commit ad943893d5f1d0aeea892bf7b781cf8062b36d58 Author: Xianting Tian Date: Thu Aug 11 15:41:47 2022 +0800 RISC-V: Fixup schedule out issue in machine_crash_shutdown() Current task of executing crash kexec will be schedule out when panic is triggered by RCU Stall, as it needs to wait rcu completion. It lead to inability to enter the crash system. The implementation of machine_crash_shutdown() is non-standard for RISC-V according to other Arch's implementation(eg, x86, arm64), we need to send IPI to stop secondary harts. [224521.877268] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [224521.883471] rcu: 0-...0: (3 GPs behind) idle=cfa/0/0x1 softirq=3968793/3968793 fqs=2495 [224521.891742] (detected by 2, t=5255 jiffies, g=60855593, q=328) [224521.897754] Task dump for CPU 0: [224521.901074] task:swapper/0 state:R running task stack: 0 pid: 0 ppid: 0 flags:0x00000008 [224521.911090] Call Trace: [224521.913638] [] __schedule+0x208/0x5ea [224521.918957] Kernel panic - not syncing: RCU Stall [224521.923773] bad: scheduling from the idle thread! [224521.928571] CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Tainted: G O 5.10.113-yocto-standard #1 [224521.938658] Call Trace: [224521.941200] [] walk_stackframe+0x0/0xaa [224521.946689] [] show_stack+0x32/0x3e [224521.951830] [] dump_stack_lvl+0x7e/0xa2 [224521.957317] [] dump_stack+0x14/0x1c [224521.962459] [] dequeue_task_idle+0x2c/0x40 [224521.968207] [] __schedule+0x41e/0x5ea [224521.973520] [] schedule+0x34/0xe4 [224521.978487] [] schedule_timeout+0xc6/0x170 [224521.984234] [] wait_for_completion+0x98/0xf2 [224521.990157] [] __wait_rcu_gp+0x148/0x14a [224521.995733] [] synchronize_rcu+0x5c/0x66 [224522.001307] [] rcu_sync_enter+0x54/0xe6 [224522.006795] [] percpu_down_write+0x32/0x11c [224522.012629] [] _cpu_down+0x92/0x21a [224522.017771] [] smp_shutdown_nonboot_cpus+0x90/0x118 [224522.024299] [] machine_crash_shutdown+0x30/0x4a [224522.030483] [] __crash_kexec+0x62/0xa6 [224522.035884] [] panic+0xfa/0x2b6 [224522.040678] [] rcu_sched_clock_irq+0xc26/0xcb8 [224522.046774] [] update_process_times+0x62/0x8a [224522.052785] [] tick_sched_timer+0x9e/0x102 [224522.058533] [] __hrtimer_run_queues+0x16a/0x318 [224522.064716] [] hrtimer_interrupt+0xd4/0x228 [224522.070551] [] riscv_timer_interrupt+0x3c/0x48 [224522.076646] [] handle_percpu_devid_irq+0xb0/0x24c [224522.083004] [] __handle_domain_irq+0xa8/0x122 [224522.089014] [] riscv_intc_irq+0x38/0x60 [224522.094501] [] ret_from_exception+0x0/0xc [224522.100161] [] rcu_eqs_enter.constprop.0+0x8c/0xb8 With the patch, it can enter crash system when RCU Stall occur. Fixes: e53d28180d4d ("RISC-V: Add kdump support") Signed-off-by: Xianting Tian Link: https://lore.kernel.org/r/20220811074150.3020189-4-xianting.tian@linux.alibaba.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 59c026c359c30f116fef6ee958e24d04983efbb0 Author: Xianting Tian Date: Thu Aug 11 15:41:46 2022 +0800 RISC-V: Fixup get incorrect user mode PC for kernel mode regs When use 'echo c > /proc/sysrq-trigger' to trigger kdump, riscv_crash_save_regs() will be called to save regs for vmcore, we found "epc" value 00ffffffa5537400 is not a valid kernel virtual address, but is a user virtual address. Other regs(eg, ra, sp, gp...) are correct kernel virtual address. Actually 0x00ffffffb0dd9400 is the user mode PC of 'PID: 113 Comm: sh', which is saved in the task's stack. [ 21.201701] CPU: 0 PID: 113 Comm: sh Kdump: loaded Not tainted 5.18.9 #45 [ 21.201979] Hardware name: riscv-virtio,qemu (DT) [ 21.202160] epc : 00ffffffa5537400 ra : ffffffff80088640 sp : ff20000010333b90 [ 21.202435] gp : ffffffff810dde38 tp : ff6000000226c200 t0 : ffffffff8032be7c [ 21.202707] t1 : 0720072007200720 t2 : 30203a7375746174 s0 : ff20000010333cf0 [ 21.202973] s1 : 0000000000000000 a0 : ff20000010333b98 a1 : 0000000000000001 [ 21.203243] a2 : 0000000000000010 a3 : 0000000000000000 a4 : 28c8f0aeffea4e00 [ 21.203519] a5 : 28c8f0aeffea4e00 a6 : 0000000000000009 a7 : ffffffff8035c9b8 [ 21.203794] s2 : ffffffff810df0a8 s3 : ffffffff810df718 s4 : ff20000010333b98 [ 21.204062] s5 : 0000000000000000 s6 : 0000000000000007 s7 : ffffffff80c4a468 [ 21.204331] s8 : 00ffffffef451410 s9 : 0000000000000007 s10: 00aaaaaac0510700 [ 21.204606] s11: 0000000000000001 t3 : ff60000001218f00 t4 : ff60000001218f00 [ 21.204876] t5 : ff60000001218000 t6 : ff200000103338b8 [ 21.205079] status: 0000000200000020 badaddr: 0000000000000000 cause: 0000000000000008 With the incorrect PC, the backtrace showed by crash tool as below, the first stack frame is abnormal, crash> bt PID: 113 TASK: ff60000002269600 CPU: 0 COMMAND: "sh" #0 [ff2000001039bb90] __efistub_.Ldebug_info0 at 00ffffffa5537400 <-- Abnormal #1 [ff2000001039bcf0] panic at ffffffff806578ba #2 [ff2000001039bd50] sysrq_reset_seq_param_set at ffffffff8038c030 #3 [ff2000001039bda0] __handle_sysrq at ffffffff8038c5f8 #4 [ff2000001039be00] write_sysrq_trigger at ffffffff8038cad8 #5 [ff2000001039be20] proc_reg_write at ffffffff801b7edc #6 [ff2000001039be40] vfs_write at ffffffff80152ba6 #7 [ff2000001039be80] ksys_write at ffffffff80152ece #8 [ff2000001039bed0] sys_write at ffffffff80152f46 With the patch, we can get current kernel mode PC, the output as below, [ 17.607658] CPU: 0 PID: 113 Comm: sh Kdump: loaded Not tainted 5.18.9 #42 [ 17.607937] Hardware name: riscv-virtio,qemu (DT) [ 17.608150] epc : ffffffff800078f8 ra : ffffffff8008862c sp : ff20000010333b90 [ 17.608441] gp : ffffffff810dde38 tp : ff6000000226c200 t0 : ffffffff8032be68 [ 17.608741] t1 : 0720072007200720 t2 : 666666666666663c s0 : ff20000010333cf0 [ 17.609025] s1 : 0000000000000000 a0 : ff20000010333b98 a1 : 0000000000000001 [ 17.609320] a2 : 0000000000000010 a3 : 0000000000000000 a4 : 0000000000000000 [ 17.609601] a5 : ff60000001c78000 a6 : 000000000000003c a7 : ffffffff8035c9a4 [ 17.609894] s2 : ffffffff810df0a8 s3 : ffffffff810df718 s4 : ff20000010333b98 [ 17.610186] s5 : 0000000000000000 s6 : 0000000000000007 s7 : ffffffff80c4a468 [ 17.610469] s8 : 00ffffffca281410 s9 : 0000000000000007 s10: 00aaaaaab5bb6700 [ 17.610755] s11: 0000000000000001 t3 : ff60000001218f00 t4 : ff60000001218f00 [ 17.611041] t5 : ff60000001218000 t6 : ff20000010333988 [ 17.611255] status: 0000000200000020 badaddr: 0000000000000000 cause: 0000000000000008 With the correct PC, the backtrace showed by crash tool as below, crash> bt PID: 113 TASK: ff6000000226c200 CPU: 0 COMMAND: "sh" #0 [ff20000010333b90] riscv_crash_save_regs at ffffffff800078f8 <--- Normal #1 [ff20000010333cf0] panic at ffffffff806578c6 #2 [ff20000010333d50] sysrq_reset_seq_param_set at ffffffff8038c03c #3 [ff20000010333da0] __handle_sysrq at ffffffff8038c604 #4 [ff20000010333e00] write_sysrq_trigger at ffffffff8038cae4 #5 [ff20000010333e20] proc_reg_write at ffffffff801b7ee8 #6 [ff20000010333e40] vfs_write at ffffffff80152bb2 #7 [ff20000010333e80] ksys_write at ffffffff80152eda #8 [ff20000010333ed0] sys_write at ffffffff80152f52 Fixes: e53d28180d4d ("RISC-V: Add kdump support") Co-developed-by: Guo Ren Signed-off-by: Xianting Tian Link: https://lore.kernel.org/r/20220811074150.3020189-3-xianting.tian@linux.alibaba.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 357628e68f5c08ad578a718dc62a0031e06dbe91 Author: Xianting Tian Date: Thu Aug 11 15:41:45 2022 +0800 RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context Use __smp_processor_id() to avoid check the preemption context when CONFIG_DEBUG_PREEMPT enabled, as we will enter crash kernel and no return. Without the patch, [ 103.781044] sysrq: Trigger a crash [ 103.784625] Kernel panic - not syncing: sysrq triggered crash [ 103.837634] CPU1: off [ 103.889668] CPU2: off [ 103.933479] CPU3: off [ 103.939424] Starting crashdump kernel... [ 103.943442] BUG: using smp_processor_id() in preemptible [00000000] code: sh/346 [ 103.950884] caller is debug_smp_processor_id+0x1c/0x26 [ 103.956051] CPU: 0 PID: 346 Comm: sh Kdump: loaded Not tainted 5.10.113-00002-gce03f03bf4ec-dirty #149 [ 103.965355] Call Trace: [ 103.967805] [] walk_stackframe+0x0/0xa2 [ 103.973206] [] show_stack+0x32/0x3e [ 103.978258] [] dump_stack_lvl+0x72/0x8e [ 103.983655] [] dump_stack+0x14/0x1c [ 103.988705] [] check_preemption_disabled+0x9e/0xaa [ 103.995057] [] debug_smp_processor_id+0x1c/0x26 [ 104.001150] [] machine_kexec+0x22/0xd0 [ 104.006463] [] __crash_kexec+0x6a/0xa4 [ 104.011774] [] panic+0xfc/0x2b0 [ 104.016480] [] sysrq_reset_seq_param_set+0x0/0x70 [ 104.022745] [] __handle_sysrq+0x8c/0x154 [ 104.028229] [] write_sysrq_trigger+0x5a/0x6a [ 104.034061] [] proc_reg_write+0x58/0xd4 [ 104.039459] [] vfs_write+0x7e/0x254 [ 104.044509] [] ksys_write+0x58/0xbe [ 104.049558] [] sys_write+0xe/0x16 [ 104.054434] [] ret_from_syscall+0x0/0x2 [ 104.067863] Will call new kernel at ecc00000 from hart id 0 [ 104.074939] FDT image at fc5ee000 [ 104.079523] Bye... With the patch we can got clear output, [ 67.740553] sysrq: Trigger a crash [ 67.744166] Kernel panic - not syncing: sysrq triggered crash [ 67.809123] CPU1: off [ 67.865210] CPU2: off [ 67.909075] CPU3: off [ 67.919123] Starting crashdump kernel... [ 67.924900] Will call new kernel at ecc00000 from hart id 0 [ 67.932045] FDT image at fc5ee000 [ 67.935560] Bye... Fixes: 0e105f1d0037 ("riscv: use hart id instead of cpu id on machine_kexec") Reviewed-by: Guo Ren Reviewed-by: Heiko Stuebner Reviewed-by: Atish Patra Signed-off-by: Xianting Tian Link: https://lore.kernel.org/r/20220811074150.3020189-2-xianting.tian@linux.alibaba.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit cf90b74341eecc32ceef0c136954a1668e43b1e7 Author: Michal Jaron Date: Mon Jul 25 10:32:43 2022 +0200 ice: Fix call trace with null VSI during VF reset During stress test with attaching and detaching VF from KVM and simultaneously changing VFs spoofcheck and trust there was a call trace in ice_reset_vf that VF's VSI is null. [145237.352797] WARNING: CPU: 46 PID: 840629 at drivers/net/ethernet/intel/ice/ice_vf_lib.c:508 ice_reset_vf+0x3d6/0x410 [ice] [145237.352851] Modules linked in: ice(E) vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio iavf dm_mod xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink tun bridge stp llc sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTC O_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl ipmi_si intel_cstate ipmi_devintf joydev intel_uncore m ei_me ipmi_msghandler i2c_i801 pcspkr mei lpc_ich ioatdma i2c_smbus acpi_pad acpi_power_meter ip_tables xfs libcrc32c i2c_algo_bit drm_sh mem_helper drm_kms_helper sd_mod t10_pi crc64_rocksoft syscopyarea crc64 sysfillrect sg sysimgblt fb_sys_fops drm i40e ixgbe ahci libahci libata crc32c_intel mdio dca wmi fuse [last unloaded: ice] [145237.352917] CPU: 46 PID: 840629 Comm: kworker/46:2 Tainted: G S W I E 5.19.0-rc6+ #24 [145237.352921] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 [145237.352923] Workqueue: ice ice_service_task [ice] [145237.352948] RIP: 0010:ice_reset_vf+0x3d6/0x410 [ice] [145237.352984] Code: 30 ec f3 cc e9 28 fd ff ff 0f b7 4b 50 48 c7 c2 48 19 9c c0 4c 89 ee 48 c7 c7 30 fe 9e c0 e8 d1 21 9d cc 31 c0 e9 a 9 fe ff ff <0f> 0b b8 ea ff ff ff e9 c1 fc ff ff 0f 0b b8 fb ff ff ff e9 91 fe [145237.352987] RSP: 0018:ffffb453e257fdb8 EFLAGS: 00010246 [145237.352990] RAX: ffff8bd0040181c0 RBX: ffff8be68db8f800 RCX: 0000000000000000 [145237.352991] RDX: 000000000000ffff RSI: 0000000000000000 RDI: ffff8be68db8f800 [145237.352993] RBP: ffff8bd0040181c0 R08: 0000000000001000 R09: ffff8bcfd520e000 [145237.352995] R10: 0000000000000000 R11: 00008417b5ab0bc0 R12: 0000000000000005 [145237.352996] R13: ffff8bcee061c0d0 R14: ffff8bd004019640 R15: 0000000000000000 [145237.352998] FS: 0000000000000000(0000) GS:ffff8be5dfb00000(0000) knlGS:0000000000000000 [145237.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [145237.353002] CR2: 00007fd81f651d68 CR3: 0000001a0fe10001 CR4: 00000000001726e0 [145237.353003] Call Trace: [145237.353008] [145237.353011] ice_process_vflr_event+0x8d/0xb0 [ice] [145237.353049] ice_service_task+0x79f/0xef0 [ice] [145237.353074] process_one_work+0x1c8/0x390 [145237.353081] ? process_one_work+0x390/0x390 [145237.353084] worker_thread+0x30/0x360 [145237.353087] ? process_one_work+0x390/0x390 [145237.353090] kthread+0xe8/0x110 [145237.353094] ? kthread_complete_and_exit+0x20/0x20 [145237.353097] ret_from_fork+0x22/0x30 [145237.353103] Remove WARN_ON() from check if VSI is null in ice_reset_vf. Add "VF is already removed\n" in dev_dbg(). This WARN_ON() is unnecessary and causes call trace, despite that call trace, driver still works. There is no need for this warn because this piece of code is responsible for disabling VF's Tx/Rx queues when VF is disabled, but when VF is already removed there is no need to do reset or disable queues. Fixes: efe41860008e ("ice: Fix memory corruption in VF driver") Signed-off-by: Michal Jaron Signed-off-by: Jedrzej Jagielski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 Author: Jay Vosburgh Date: Wed Aug 10 22:06:53 2022 -0700 bonding: fix reference count leak in balance-alb mode Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh Reviewed-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski commit 21f9c8a13bb2a0c24d9c6b86bc0896542a28c197 Author: Linus Torvalds Date: Thu Aug 11 08:40:01 2022 -0700 Revert "Makefile.extrawarn: re-enable -Wformat for clang" This reverts commit 258fafcd0683d9ccfa524129d489948ab3ddc24c. The clang -Wformat warning is terminally broken, and the clang people can't seem to get their act together. This test program causes a warning with clang: #include int main(int argc, char **argv) { printf("%hhu\n", 'a'); } resulting in t.c:5:19: warning: format specifies type 'unsigned char' but the argument has type 'int' [-Wformat] printf("%hhu\n", 'a'); ~~~~ ^~~ %d and apparently clang people consider that a feature, because they don't want to face the reality of how either C character constants, C arithmetic, and C varargs functions work. The rest of the world just shakes their head at that kind of incompetence, and turns off -Wformat for clang again. And no, the "you should use a pointless cast to shut this up" is not a valid answer. That warning should not exist in the first place, or at least be optinal with some "-Wformat-me-harder" kind of option. [ Admittedly, there's also very little reason to *ever* use '%hh[ud]' in C, but what little reason there is is entirely about 'I want to see only the low 8 bits of the argument'. So I would suggest nobody ever use that format in the first place, but if they do, the clang behavious is simply always wrong. Because '%hhu' takes an 'int'. It's that simple. ] Reported-by: Sudip Mukherjee (Codethink) Cc: Nick Desaulniers Signed-off-by: Linus Torvalds commit 05b98fd2da6bdf241d3b9ba40582d60a84a89d70 Author: Ronnie Sahlberg Date: Wed Aug 10 22:00:08 2022 -0500 cifs: Move cached-dir functions into a separate file Also rename crfid to cfid to have consistent naming for this variable. This commit does not change any logic. Signed-off-by: Ronnie Sahlberg Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7fe05e125d5f730bd2d0fc53985bee77b6c762f0 Author: Benjamin Mikailenko Date: Fri Jul 15 18:27:07 2022 -0400 ice: Fix VSI rebuild WARN_ON check for VF In commit b03d519d3460 ("ice: store VF pointer instead of VF ID") WARN_ON checks were added to validate the vsi->vf pointer and catch programming errors. However, one check to vsi->vf was missed. This caused a call trace when resetting VFs. Fix ice_vsi_rebuild by encompassing VF pointer in WARN_ON check. Fixes: b03d519d3460 ("ice: store VF pointer instead of VF ID") Signed-off-by: Benjamin Mikailenko Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit e3a7c2947b9e01b9cedd3f67849c0ae95f0fadfa Author: Mikulas Patocka Date: Wed Aug 10 16:16:34 2022 -0400 dm bufio: fix some cases where the code sleeps with spinlock held Commit b32d45824aa7 ("dm bufio: Add DM_BUFIO_CLIENT_NO_SLEEP flag") added a "NO_SLEEP" mode, it replaces a mutex with a spinlock, and it is only usable when the device is in read-only mode (because the write path may be sleeping while holding the dm_bufio_client lock). However, there are still two points where the code could sleep even in read-only mode. One is in __get_unclaimed_buffer -> __make_buffer_clean. The other is in __try_evict_buffer -> __make_buffer_clean. These functions will call __make_buffer_clean which sleeps if the buffer is being read. Fix these cases so that if c->no_sleep is set __make_buffer_clean will not be called and the buffer will be skipped instead. Fixes: b32d45824aa7 ("dm bufio: Add DM_BUFIO_CLIENT_NO_SLEEP flag") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 8eb060e10185cfc97ef0200d197ec246ba0f9f8c Author: Dao Lu Date: Mon Jun 20 13:15:25 2022 -0700 arch/riscv: add Zihintpause support Implement support for the ZiHintPause extension. The PAUSE instruction is a HINT that indicates the current hart’s rate of instruction retirement should be temporarily reduced or paused. Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Dao Lu [Palmer: Some minor merge conflicts.] Link: https://lore.kernel.org/all/20220620201530.3929352-1-daolu@rivosinc.com/ Link: https://lore.kernel.org/all/20220811053356.17375-1-palmer@rivosinc.com/ Signed-off-by: Palmer Dabbelt commit ae7107baa5bde3cea62778fd4515865fe50181f4 Author: Slark Xiao Date: Wed Aug 10 09:45:21 2022 +0800 net: usb: qmi_wwan: Add support for Cinterion MV32 There are 2 models for MV32 serials. MV32-W-A is designed based on Qualcomm SDX62 chip, and MV32-W-B is designed based on Qualcomm SDX65 chip. So we use 2 different PID to separate it. Test evidence as below: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00f3 Rev=05.04 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00F3 USB Mobile Broadband S: SerialNumber=d7b4be8d C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=00f4 Rev=05.04 S: Manufacturer=Cinterion S: Product=Cinterion PID 0x00F4 USB Mobile Broadband S: SerialNumber=d095087d C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option Signed-off-by: Slark Xiao Acked-by: Bjørn Mork Link: https://lore.kernel.org/r/20220810014521.9383-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 976bf59c69cd2e2c17f0ab20a14c0e700cba0f15 Author: Florian Westphal Date: Tue Aug 9 15:16:35 2022 +0200 netfilter: nf_ct_irc: cap packet search space to 4k This uses a pseudo-linearization scheme with a 64k global buffer, but BIG TCP arrival means IPv6 TCP stack can generate skbs that exceed this size. In practice, IRC commands are not expected to exceed 512 bytes, plus this is interactive protocol, so we should not see large packets in practice. Given most IRC connections nowadays use TLS so this helper could also be removed in the near future. Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c783a29c7e5934eabac2b760571489ad83bf4fd1 Author: Florian Westphal Date: Tue Aug 9 15:16:34 2022 +0200 netfilter: nf_ct_ftp: prefer skb_linearize This uses a pseudo-linearization scheme with a 64k global buffer, but BIG TCP arrival means IPv6 TCP stack can generate skbs that exceed this size. Use skb_linearize. It should be possible to rewrite this to properly deal with segmented skbs (i.e., only do small chunk-wise accesses), but this is going to be a lot more intrusive than this because every helper function needs to get the sk_buff instead of a pointer to a raw data buffer. In practice, provided we're really looking at FTP control channel packets, there should never be a case where we deal with huge packets. Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit f3e124c36f70d5ffcdd4e8bdbe7bb28a98a715c0 Author: Florian Westphal Date: Tue Aug 9 15:16:33 2022 +0200 netfilter: nf_ct_h323: cap packet size at 64k With BIG TCP, packets generated by tcp stack may exceed 64kb. Cap datalen at 64kb. The internal message format uses 16bit fields, so no embedded message can exceed 64k size. Multiple h323 messages in a single superpacket may now result in a message to get treated as incomplete/truncated, but thats better than scribbling past h323_buffer. Another alternative suitable for net tree would be a switch to skb_linearize(). Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 84ba28901629cd3aa3b24d359bc4da3ac24c2329 Merge: 94ce3b64c62d4 4e4588f1c4d2e Author: Jakub Kicinski Date: Thu Aug 11 07:50:28 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull in bpf to silence a false positive warning. * git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Shut up kern_sys_bpf warning. Link: https://lore.kernel.org/r/CAADnVQK589CZN1Q9w8huJqkEyEed+ZMTWqcpA1Rm2CjN3a4XoQ@mail.gmail.com/ Signed-off-by: Jakub Kicinski commit a664375da76c6da8f83dc7997e43c568e1eb9a6a Author: Florian Westphal Date: Tue Aug 9 15:16:32 2022 +0200 netfilter: nf_ct_sane: remove pseudo skb linearization For historical reason this code performs pseudo linearization of skbs via skb_header_pointer and a global 64k buffer. With arrival of BIG TCP, packets generated by TCP stack can exceed 64kb. Rewrite this to only extract the needed header data. This also allows to get rid of the locking. Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit cd83cd55878409299f4614c5138d24dffacc39bd Merge: fa9db655d0e11 f37527a09dac3 Author: Jens Axboe Date: Thu Aug 11 08:37:48 2022 -0600 Merge tag 'nvme-6.0-2022-08-11' of git://git.infradead.org/nvme into block-6.0 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.0 - print nvme connect Linux error codes properly (Amit Engel) - fix the fc_appid_store return value (Christoph Hellwig) - fix a typo in an error message (Christophe JAILLET) - add another non-unique identifier quirk (Dennis P. Kliem) - check if the queue is allocated before stopping it in nvme-tcp (Maurizio Lombardi) - restart admin queue if the caller needs to restart queue in nvme-fc (Ming Lei) - use kmemdup instead of kmalloc + memcpy in nvme-auth (Zhang Xiaoxu)" * tag 'nvme-6.0-2022-08-11' of git://git.infradead.org/nvme: nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S70 nvme-tcp: check if the queue is allocated before stopping it nvme-fabrics: Fix a typo in an error message nvme-fabrics: parse nvme connect Linux error codes nvmet-auth: use kmemdup instead of kmalloc + memcpy nvme-fc: fix the fc_appid_store return value nvme-fc: restart admin queue if the caller needs to restart queue commit 93e530d2a1c4c0fcce45e01ae6c5c6287a08d3e3 Author: Eli Cohen Date: Thu Aug 11 16:40:10 2022 +0300 vdpa/mlx5: Fix possible uninitialized return value Initialize err local variable to return -EAGAIN if the asid cannot be found thus avoiding returning uninitialized value. Fixes: 8fcd20c30704 ("vdpa/mlx5: Support different address spaces for control and data") Reported-by: Dan Carpenter Signed-off-by: Eli Cohen Message-Id: <20220811134010.952291-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 6de9eb21cd36151281c7f3e72fc9df18f5c6c083 Merge: 3d7cb6b04c3f3 e8bba72b396ce 930c6074d7dd5 933c5a4f87d92 Author: Huacai Chen Date: Thu Aug 11 21:06:14 2022 +0800 Merge 'irq/loongarch', 'pci/ctrl/loongson' and 'pci/header-cleanup-immutable' LoongArch architecture changes for 5.20 depend on the irqchip and pci changes to work, so merge them to create a base. commit dde61c48303afae6d5db50fc2c9f7199413945e5 Author: Conor Dooley Date: Fri Aug 5 08:43:46 2022 +0100 i2c: microchip-corei2c: fix erroneous late ack send A late ack is currently being sent at the end of a transfer due to incorrect logic in mchp_corei2c_empty_rx(). Currently the Assert Ack bit is being written to the controller's control reg after the last byte has been received, causing it to sent another byte with the ack. Instead, the AA flag should be written to the control register when the penultimate byte is read so it is sent out for the last byte. Reported-by: Andreas Buerkler Fixes: 64a6f1c4987e ("i2c: add support for microchip fpga i2c controllers") Tested-by: Lewis Hanly Signed-off-by: Conor Dooley [wsa: fixed typos in commit message] Signed-off-by: Wolfram Sang commit 0a0b80a44c7d111a0404d91847db57be8b667a15 Author: Krzysztof Kozlowski Date: Tue Aug 2 17:39:47 2022 +0200 dt-bindings: i2c: qcom,i2c-cci: convert to dtschema Convert the Qualcomm Camera Control Interface (CCI) I2C controller to DT schema. The original bindings were not complete, so this includes changes: 1. Add address/size-cells. 2. Describe the clocks per variant. 3. Use more descriptive example based on sdm845. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Wolfram Sang commit 8689b80b22dbf1f5e993233370fe57f08731b14d Author: Robin Reckmann Date: Sun Aug 7 23:04:54 2022 +0900 i2c: qcom-geni: Fix GPI DMA buffer sync-back Fix i2c transfers using GPI DMA mode for all message types that do not set the I2C_M_DMA_SAFE flag (e.g. SMBus "read byte"). In this case a bounce buffer is returned by i2c_get_dma_safe_msg_buf(), and it has to synced back to the message after the transfer is done. Add missing assignment of dma buffer in geni_i2c_gpi(). Set xferred in i2c_put_dma_safe_msg_buf() to true in case of no error to ensure the sync-back of this dma buffer to the message. Fixes: d8703554f4de ("i2c: qcom-geni: Add support for GPI DMA") Signed-off-by: Robin Reckmann Tested-by: Luca Weiss Tested-by: Caleb Connolly Reviewed-by: Konrad Dybcio Signed-off-by: Wolfram Sang commit f37527a09dac324c74bb341c841096395a2f2566 Author: Dennis P. Kliem Date: Thu Aug 11 12:56:57 2022 +0200 nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG GAMMIX S70 ADATA XPG GAMMIX S70 reports bogus eui64 values that appear to be the same across all drives. Quirk them out so they are not marked as "non globally unique" duplicates. Signed-off-by: Dennis P. Kliem Signed-off-by: Christoph Hellwig commit 4a44a5eda245453ed7bd14239c596262cb53b665 Author: Stefano Garzarella Date: Thu Aug 11 10:36:32 2022 +0200 vdpa_sim_blk: add support for discard and write-zeroes Expose VIRTIO_BLK_F_DISCARD and VIRTIO_BLK_F_WRITE_ZEROES features to the drivers and handle VIRTIO_BLK_T_DISCARD and VIRTIO_BLK_T_WRITE_ZEROES requests checking ranges and flags. The simulator behaves like a ramdisk, so for VIRTIO_BLK_F_DISCARD does nothing, while for VIRTIO_BLK_T_WRITE_ZEROES sets to 0 the specified region. Signed-off-by: Stefano Garzarella Message-Id: <20220811083632.77525-5-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 518083d2f5b2e7c91549ac1723923e8ae3d679ca Author: Stefano Garzarella Date: Thu Aug 11 10:36:31 2022 +0200 vdpa_sim_blk: add support for VIRTIO_BLK_T_FLUSH The simulator behaves like a ramdisk, so we don't have to do anything when a VIRTIO_BLK_T_FLUSH request is received, but it could be useful to test driver behavior. Let's expose the VIRTIO_BLK_F_FLUSH feature to inform the driver that we support the flush command. Signed-off-by: Stefano Garzarella Message-Id: <20220811083632.77525-4-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit ac926e1b468e03818e31568f6e520390b945b038 Author: Stefano Garzarella Date: Thu Aug 11 10:36:30 2022 +0200 vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests Next patches will add handling of other requests, where will be useful to reuse vdpasim_blk_check_range(). So let's make it more generic by adding the `max_sectors` parameter, since different requests allow different numbers of maximum sectors. Let's also print the messages directly in vdpasim_blk_check_range() to avoid duplicate prints. Signed-off-by: Stefano Garzarella Message-Id: <20220811083632.77525-3-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit b91cf6e95b4f987d0d26def0c9cca3168d7752cb Author: Stefano Garzarella Date: Thu Aug 11 10:36:29 2022 +0200 vdpa_sim_blk: check if sector is 0 for commands other than read or write VIRTIO spec states: "The sector number indicates the offset (multiplied by 512) where the read or write is to occur. This field is unused and set to 0 for commands other than read or write." Signed-off-by: Stefano Garzarella Message-Id: <20220811083632.77525-2-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 0c89e2a3a9d0815b6eb769ed22157bd9996cbb58 Author: Eugenio Pérez Date: Wed Aug 10 19:15:12 2022 +0200 vdpa_sim: Implement suspend vdpa op Implement suspend operation for vdpa_sim devices, so vhost-vdpa will offer that backend feature and userspace can effectively suspend the device. This is a must before get virtqueue indexes (base) for live migration, since the device could modify them after userland gets them. There are individual ways to perform that action for some devices (VHOST_NET_SET_BACKEND, VHOST_VSOCK_SET_RUNNING, ...) but there was no way to perform it for any vhost device (and, in particular, vhost-vdpa). Reviewed-by: Stefano Garzarella Signed-off-by: Eugenio Pérez Message-Id: <20220810171512.2343333-5-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin commit f345a0143b4dd1cfc850009c6979a3801b86a06f Author: Eugenio Pérez Date: Wed Aug 10 19:15:11 2022 +0200 vhost-vdpa: uAPI to suspend the device The ioctl adds support for suspending the device from userspace. This is a must before getting virtqueue indexes (base) for live migration, since the device could modify them after userland gets them. There are individual ways to perform that action for some devices (VHOST_NET_SET_BACKEND, VHOST_VSOCK_SET_RUNNING, ...) but there was no way to perform it for any vhost device (and, in particular, vhost-vdpa). After a successful return of the ioctl call the device must not process more virtqueue descriptors. The device can answer to read or writes of config fields as if it were not suspended. In particular, writing to "queue_enable" with a value of 1 will not make the device start processing buffers of the virtqueue. Signed-off-by: Eugenio Pérez Message-Id: <20220810171512.2343333-4-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin commit 0723f1df5c3ec8a1112d150dab98e149361ef488 Author: Eugenio Pérez Date: Wed Aug 10 19:15:10 2022 +0200 vhost-vdpa: introduce SUSPEND backend feature bit Userland knows if it can suspend the device or not by checking this feature bit. It's only offered if the vdpa driver backend implements the suspend() operation callback, and to offer it or userland to ack it if the backend does not offer that callback is an error. Signed-off-by: Eugenio Pérez Message-Id: <20220810171512.2343333-3-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin commit 848ecea184e1253758423b37cbfc1ed732ccf5b4 Author: Eugenio Pérez Date: Wed Aug 10 19:15:09 2022 +0200 vdpa: Add suspend operation This operation is optional: It it's not implemented, backend feature bit will not be exposed. Signed-off-by: Eugenio Pérez Message-Id: <20220810171512.2343333-2-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin commit 8d12ec10292877751ee4463b11a63bd850bc09b5 Author: Shigeru Yoshida Date: Thu Aug 11 01:09:48 2022 +0900 virtio-blk: Avoid use-after-free on suspend/resume hctx->user_data is set to vq in virtblk_init_hctx(). However, vq is freed on suspend and reallocated on resume. So, hctx->user_data is invalid after resume, and it will cause use-after-free accessing which will result in the kernel crash something like below: [ 22.428391] Call Trace: [ 22.428899] [ 22.429339] virtqueue_add_split+0x3eb/0x620 [ 22.430035] ? __blk_mq_alloc_requests+0x17f/0x2d0 [ 22.430789] ? kvm_clock_get_cycles+0x14/0x30 [ 22.431496] virtqueue_add_sgs+0xad/0xd0 [ 22.432108] virtblk_add_req+0xe8/0x150 [ 22.432692] virtio_queue_rqs+0xeb/0x210 [ 22.433330] blk_mq_flush_plug_list+0x1b8/0x280 [ 22.434059] __blk_flush_plug+0xe1/0x140 [ 22.434853] blk_finish_plug+0x20/0x40 [ 22.435512] read_pages+0x20a/0x2e0 [ 22.436063] ? folio_add_lru+0x62/0xa0 [ 22.436652] page_cache_ra_unbounded+0x112/0x160 [ 22.437365] filemap_get_pages+0xe1/0x5b0 [ 22.437964] ? context_to_sid+0x70/0x100 [ 22.438580] ? sidtab_context_to_sid+0x32/0x400 [ 22.439979] filemap_read+0xcd/0x3d0 [ 22.440917] xfs_file_buffered_read+0x4a/0xc0 [ 22.441984] xfs_file_read_iter+0x65/0xd0 [ 22.442970] __kernel_read+0x160/0x2e0 [ 22.443921] bprm_execve+0x21b/0x640 [ 22.444809] do_execveat_common.isra.0+0x1a8/0x220 [ 22.446008] __x64_sys_execve+0x2d/0x40 [ 22.446920] do_syscall_64+0x37/0x90 [ 22.447773] entry_SYSCALL_64_after_hwframe+0x63/0xcd This patch fixes this issue by getting vq from vblk, and removes virtblk_init_hctx(). Fixes: 4e0400525691 ("virtio-blk: support polling I/O") Cc: "Suwan Kim" Signed-off-by: Shigeru Yoshida Message-Id: <20220810160948.959781-1-syoshida@redhat.com> Signed-off-by: Michael S. Tsirkin commit 99e8927d8a4da8eb8a8a5904dc13a3156be8e7c0 Author: Bo Liu Date: Wed Aug 10 04:51:51 2022 -0400 virtio_vdpa: support the arg sizes of find_vqs() Virtio vdpa support the new parameter sizes of find_vqs(). Signed-off-by: Bo Liu Message-Id: <20220810085151.7251-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin commit ebe6a354fa7e0a7d5b581da31ad031b19d8693f9 Author: Bo Liu Date: Fri Aug 5 05:12:54 2022 -0400 vhost-vdpa: Call ida_simple_remove() when failed In function vhost_vdpa_probe(), when code execution fails, we should call ida_simple_remove() to free ida. Signed-off-by: Bo Liu Message-Id: <20220805091254.20026-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin commit 79e0034cb3485e64622ec0aabf8a6f4f8143f47b Author: Zhu Lingshan Date: Fri Jul 22 19:53:09 2022 +0800 vDPA: fix 'cast to restricted le16' warnings in vdpa.c This commit fixes spars warnings: cast to restricted __le16 in function vdpa_dev_net_config_fill() and vdpa_fill_stats_rec() Signed-off-by: Zhu Lingshan Reviewed-by: Parav Pandit Message-Id: <20220722115309.82746-7-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit a34bed37fc9d3da319bb75dfbf02a7d3e95e12de Author: Zhu Lingshan Date: Fri Jul 22 19:53:07 2022 +0800 vDPA: !FEATURES_OK should not block querying device config space Users may want to query the config space of a vDPA device, to choose a appropriate one for a certain guest. This means the users need to read the config space before FEATURES_OK, and the existence of config space contents does not depend on FEATURES_OK. The spec says: The device MUST allow reading of any device-specific configuration field before FEATURES_OK is set by the driver. This includes fields which are conditional on feature bits, as long as those feature bits are offered by the device. Signed-off-by: Zhu Lingshan Message-Id: <20220722115309.82746-5-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 378b2e956820ff5c082d05f42828badcfbabb614 Author: Zhu Lingshan Date: Fri Jul 22 19:53:05 2022 +0800 vDPA/ifcvf: support userspace to query features and MQ of a management device Adapting to current netlink interfaces, this commit allows userspace to query feature bits and MQ capability of a management device. Currently both the vDPA device and the management device are the VF itself, thus this ifcvf should initialize the virtio capabilities in probe() before setting up the struct vdpa_mgmt_dev. Signed-off-by: Zhu Lingshan Message-Id: <20220722115309.82746-3-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 0d6e5e8d1686ce5d055c5ecaa76e5f51609ce9da Author: Zhu Lingshan Date: Fri Jul 22 19:53:04 2022 +0800 vDPA/ifcvf: get_config_size should return a value no greater than dev implementation Drivers must not access a BAR outside the capability length, and for a virtio device, ifcvf driver should not report any non-standard capability contents to the upper layers. Function ifcvf_get_config_size() is introduced here to return a safe value of the device config capability size. Signed-off-by: Zhu Lingshan Message-Id: <20220722115309.82746-2-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit f49c2226af8444563897e25bf293ea29e377995a Author: Mike Christie Date: Thu Jul 7 22:05:25 2022 -0500 vhost scsi: Allow user to control num virtqueues We are currently hard coded to always create 128 IO virtqueues, so this adds a modparam to control it. For large systems where we are ok with using memory for virtqueues it allows us to add up to 1024. This limit was just selected becuase that's qemu's limit. Signed-off-by: Mike Christie Message-Id: <20220708030525.5065-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 5a4b0420b28fed7e8df81ac7e3b53834142053dd Author: Mike Christie Date: Thu Jul 7 22:05:24 2022 -0500 vhost-scsi: Fix max number of virtqueues Qemu takes it's num_queues limit then adds the fixed queues (control and event) to the total it will request from the kernel. So when a user requests 128 (or qemu does it's num_queues calculation based on vCPUS and other system limits), we hit errors due to userspace trying to setup 130 queues when vhost-scsi has a hard coded limit of 128. This has vhost-scsi adjust it's max so we can do a total of 130 virtqueues (128 IO and 2 fixed). For the case where the user has 128 vCPUs the guest OS can then nicely map each IO virtqueue to a vCPU and not have the odd case where 2 vCPUs share a virtqueue. Signed-off-by: Mike Christie Message-Id: <20220708030525.5065-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 8fcd20c307042b0bb4fd3aee7fc23c94080306ad Author: Eli Cohen Date: Thu Jul 14 14:39:27 2022 +0300 vdpa/mlx5: Support different address spaces for control and data Partition virtqueues to two different address spaces: one for control virtqueue which is implemented in software, and one for data virtqueues. Based-on: <20220526124338.36247-1-eperezma@redhat.com> Signed-off-by: Eli Cohen Message-Id: <20220714113927.85729-3-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit cae15c2ed8e6e058bd5e32de292ab7982640161e Author: Eli Cohen Date: Thu Jul 14 14:39:26 2022 +0300 vdpa/mlx5: Implement susupend virtqueue callback Implement the suspend callback allowing to suspend the virtqueues so they stop processing descriptors. This is required to allow to query a consistent state of the virtqueue while live migration is taking place. Signed-off-by: Eli Cohen Message-Id: <20220714113927.85729-2-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit ad146355bfad627bd0717ece73997c6c93b1b82e Author: Xie Yongji Date: Wed Aug 3 12:55:23 2022 +0800 vduse: Support querying information of IOVA regions This introduces a new ioctl: VDUSE_IOTLB_GET_INFO to support querying some information of IOVA regions. Now it can be used to query whether the IOVA region supports userspace memory registration. Signed-off-by: Xie Yongji Message-Id: <20220803045523.23851-6-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 79a463be9e0051997508d52cf411ed5e91d657f6 Author: Xie Yongji Date: Wed Aug 3 12:55:22 2022 +0800 vduse: Support registering userspace memory for IOVA regions Introduce two ioctls: VDUSE_IOTLB_REG_UMEM and VDUSE_IOTLB_DEREG_UMEM to support registering and de-registering userspace memory for IOVA regions. Now it only supports registering userspace memory for bounce buffer region in virtio-vdpa case. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20220803045523.23851-5-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 6c77ed22880d3e8ae91b1d2cce26dbd6c69f38b7 Author: Xie Yongji Date: Wed Aug 3 12:55:21 2022 +0800 vduse: Support using userspace pages as bounce buffer Introduce two APIs: vduse_domain_add_user_bounce_pages() and vduse_domain_remove_user_bounce_pages() to support adding and removing userspace pages for bounce buffers. During adding and removing, the DMA data would be copied from the kernel bounce pages to the userspace bounce pages and back. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20220803045523.23851-4-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 82eb46f94ae5faa87ace248d950292c87384a097 Author: Xie Yongji Date: Wed Aug 3 12:55:20 2022 +0800 vduse: Use memcpy_{to,from}_page() in do_bounce() kmap_atomic() is being deprecated in favor of kmap_local_page(). The use of kmap_atomic() in do_bounce() is all thread local therefore kmap_local_page() is a sufficient replacement. Convert to kmap_local_page() but, instead of open coding it, use the helpers memcpy_to_page() and memcpy_from_page(). Signed-off-by: Xie Yongji Acked-by: Jason Wang Reviewed-by: Muchun Song Message-Id: <20220803045523.23851-3-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit c32ee693125aa19a021dad32abbd49f5c6f70031 Author: Xie Yongji Date: Wed Aug 3 12:55:19 2022 +0800 vduse: Remove unnecessary spin lock protection Now we use domain->iotlb_lock to protect two different variables: domain->bounce_maps->bounce_page and domain->iotlb. But for domain->bounce_maps->bounce_page, we actually don't need any synchronization between vduse_domain_get_bounce_page() and vduse_domain_free_bounce_pages() since vduse_domain_get_bounce_page() will only be called in page fault handler and vduse_domain_free_bounce_pages() will be called during file release. So let's remove the unnecessary spin lock protection in vduse_domain_get_bounce_page(). Then the usage of domain->iotlb_lock could be more clear: the lock will be only used to protect the domain->iotlb. Signed-off-by: Xie Yongji Acked-by: Jason Wang Message-Id: <20220803045523.23851-2-xieyongji@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 699b045a8e43bd1063db4795be685bfd659649dc Author: Alvaro Karsz Date: Mon Jul 18 12:11:02 2022 +0300 net: virtio_net: notifications coalescing support New VirtIO network feature: VIRTIO_NET_F_NOTF_COAL. Control a Virtio network device notifications coalescing parameters using the control virtqueue. A device that supports this fetature can receive VIRTIO_NET_CTRL_NOTF_COAL control commands. - VIRTIO_NET_CTRL_NOTF_COAL_TX_SET: Ask the network device to change the following parameters: - tx_usecs: Maximum number of usecs to delay a TX notification. - tx_max_packets: Maximum number of packets to send before a TX notification. - VIRTIO_NET_CTRL_NOTF_COAL_RX_SET: Ask the network device to change the following parameters: - rx_usecs: Maximum number of usecs to delay a RX notification. - rx_max_packets: Maximum number of packets to receive before a RX notification. VirtIO spec. patch: https://lists.oasis-open.org/archives/virtio-comment/202206/msg00100.html Signed-off-by: Alvaro Karsz Message-Id: <20220718091102.498774-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Jakub Kicinski Acked-by: Jason Wang commit 95bf9798779af166b1d6d184d794834214a1a261 Author: Bo Liu Date: Wed Jul 6 23:17:51 2022 -0400 virtio: Check dev_set_name() return value It's possible that dev_set_name() returns -ENOMEM, catch and handle this. Signed-off-by: Bo Liu Message-Id: <20220707031751.4802-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit d650f830f38b19039958f3f4504ceeb2b5922da7 Author: Stefano Garzarella Date: Tue Jul 5 09:22:49 2022 +0200 tools/virtio: fix build Fix the build caused by the following changes: - phys_addr_t is now defined in tools/include/linux/types.h - dev_warn_once() is used in drivers/virtio/virtio_ring.c - linux/uio.h included by vringh.h use INT_MAX defined in limits.h Signed-off-by: Stefano Garzarella Message-Id: <20220705072249.7867-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Signed-off-by: Peng Fan Acked-by: Jason Wang commit 994cea53183c211f218d5dbe14ab634f5762f068 Author: Colin Ian King Date: Mon Jul 4 20:04:56 2022 +0100 vDPA/ifcvf: remove duplicated assignment to pointer cfg The assignment to pointer cfg is duplicated, the second assignment is redundant and can be removed. Signed-off-by: Colin Ian King Message-Id: <20220704190456.593464-1-colin.i.king@gmail.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6e33fa094f1f5a96140cc2439b17f4f3ef9e4a9d Author: Zhang Jiaming Date: Mon Jul 4 10:41:04 2022 +0800 vdpa: ifcvf: Fix spelling mistake in comments There is a typo(does't) in comments. It maybe 'doesn't' instead of 'does't'. Signed-off-by: Zhang Jiaming Message-Id: <20220704024104.15535-1-jiaming@nfschina.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 71aa95a69c765bd0ec1c6d9d6263e6fefa1f5072 Author: Xu Qiang Date: Mon Jul 4 02:14:05 2022 +0000 vdpa/mlx5: Use eth_broadcast_addr() to assign broadcast address Using eth_broadcast_addr() to assign broadcast address instead of memset(). Reported-by: Hulk Robot Signed-off-by: Xu Qiang Message-Id: <20220704021405.64545-1-xuqiang36@huawei.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 67f8f10c0bd78c4a0f0e983e050ab90da015323b Author: Stefano Garzarella Date: Tue Jun 21 17:12:08 2022 +0200 vdpa_sim: use max_iotlb_entries as a limit in vhost_iotlb_init Commit bda324fd037a ("vdpasim: control virtqueue support") changed the allocation of iotlbs calling vhost_iotlb_init() for each address space, instead of vhost_iotlb_alloc(). With this change we forgot to use the limit we had introduced with the `max_iotlb_entries` module parameter. Fixes: bda324fd037a ("vdpasim: control virtqueue support") Cc: gautam.dawar@xilinx.com Signed-off-by: Stefano Garzarella Message-Id: <20220621151208.189959-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez commit 19cd4a5471b8eaa4bd161b0fdb4567f2fc88d809 Author: Stefano Garzarella Date: Tue Jun 21 17:13:23 2022 +0200 vdpa_sim_blk: set number of address spaces and virtqueue groups Commit bda324fd037a ("vdpasim: control virtqueue support") added two new fields (nas, ngroups) to vdpasim_dev_attr, but we forgot to initialize them for vdpa_sim_blk. When creating a new vdpa_sim_blk device this causes the kernel to panic in this way:    $ vdpa dev add mgmtdev vdpasim_blk name blk0    BUG: kernel NULL pointer dereference, address: 0000000000000030    ...    RIP: 0010:vhost_iotlb_add_range_ctx+0x41/0x220 [vhost_iotlb]    ...    Call Trace:         vhost_iotlb_add_range+0x11/0x800 [vhost_iotlb]     vdpasim_map_range+0x91/0xd0 [vdpa_sim]     vdpasim_alloc_coherent+0x56/0x90 [vdpa_sim]     ... This happens because vdpasim->iommu[0] is not initialized when dev_attr.nas is 0. Let's fix this issue by initializing both (nas, ngroups) to 1 for vdpa_sim_blk. Fixes: bda324fd037a ("vdpasim: control virtqueue support") Cc: gautam.dawar@xilinx.com Signed-off-by: Stefano Garzarella Message-Id: <20220621151323.190431-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez commit 8472019eec2ccff60144d8585367b2856a59416e Author: Stefano Garzarella Date: Thu Jun 30 17:32:21 2022 +0200 vdpa_sim_blk: call vringh_complete_iotlb() also in the error path Call vringh_complete_iotlb() even when we encounter a serious error that prevents us from writing the status in the "in" header (e.g. the header length is incorrect, etc.). The guest is misbehaving, so maybe the ring is in a bad state, but let's avoid making things worse. Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20220630153221.83371-4-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 9c4df0900f376f28e8e5cca640a10a0085f16b66 Author: Stefano Garzarella Date: Thu Jun 30 17:32:20 2022 +0200 vdpa_sim_blk: limit the number of request handled per batch Limit the number of requests (4 per queue as for vdpa_sim_net) handled in a batch to prevent the worker from using the CPU for too long. Suggested-by: Eugenio Pérez Signed-off-by: Stefano Garzarella Message-Id: <20220630153221.83371-3-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 42a84c09eff355d895723866b1a5ff48f093112a Author: Stefano Garzarella Date: Thu Jun 30 17:32:19 2022 +0200 vdpa_sim_blk: use dev_dbg() to print errors Use dev_dbg() instead of dev_err()/dev_warn() to avoid flooding the host with prints, when the guest driver is misbehaving. In this way, prints can be dynamically enabled when the vDPA block simulator is used to validate a driver. Suggested-by: Jason Wang Acked-by: Jason Wang Signed-off-by: Stefano Garzarella Message-Id: <20220630153221.83371-2-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit a335b33f4f354c5b77a79d505708f6d2f486ceab Author: Xuan Zhuo Date: Mon Aug 1 14:39:02 2022 +0800 virtio_net: support set_ringparam Support set_ringparam based on virtio queue reset. Users can use ethtool -G eth0 to modify the ring size of virtio-net. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-43-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit ebcce492636506443e4361db6587e6acd1a624f9 Author: Xuan Zhuo Date: Mon Aug 1 14:39:01 2022 +0800 virtio_net: support tx queue resize This patch implements the resize function of the tx queues. Based on this function, it is possible to modify the ring num of the queue. Inludes fixup: virtio_net: fix for stuck when change tx ring size with dev down When dev is set to DOWN state, napi has been disabled, if we modify the ring size at this time, we should not call napi_disable() again, which will cause stuck. And all operations are under the protection of rtnl_lock, so there is no need to consider concurrency issues. Message-Id: <20220801063902.129329-42-xuanzhuo@linux.alibaba.com> Acked-by: Jason Wang Message-Id: <20220811080258.79398-3-xuanzhuo@linux.alibaba.com> Reported-by: Kangjie Xu Signed-off-by: Xuan Zhuo Signed-off-by: Michael S. Tsirkin commit 6a4763e268030362340bc3286560d44be15a7421 Author: Xuan Zhuo Date: Mon Aug 1 14:39:00 2022 +0800 virtio_net: support rx queue resize This patch implements the resize function of the rx queues. Based on this function, it is possible to modify the ring num of the queue. Includes fixup: virtio_net: fix for stuck when change rx ring size with dev down When dev is set to DOWN state, napi has been disabled, if we modify the ring size at this time, we should not call napi_disable() again, which will cause stuck. And all operations are under the protection of rtnl_lock, so there is no need to consider concurrency issues. Message-Id: <20220801063902.129329-41-xuanzhuo@linux.alibaba.com> Acked-by: Jason Wang Message-Id: <20220811080258.79398-2-xuanzhuo@linux.alibaba.com> Reported-by: Kangjie Xu Signed-off-by: Xuan Zhuo Signed-off-by: Michael S. Tsirkin commit 6e345f8c7cd029ad3aaece15ad4425ac26e4eb63 Author: Xuan Zhuo Date: Mon Aug 1 14:38:59 2022 +0800 virtio_net: split free_unused_bufs() This patch separates two functions for freeing sq buf and rq buf from free_unused_bufs(). When supporting the enable/disable tx/rq queue in the future, it is necessary to support separate recovery of a sq buf or a rq buf. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-40-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 8597b5ddcbba840ab852e1083f1a8dd1c6d41d1b Author: Xuan Zhuo Date: Mon Aug 1 14:38:58 2022 +0800 virtio_net: get ringparam by virtqueue_get_vring_max_size() Use virtqueue_get_vring_max_size() in virtnet_get_ringparam() to set tx,rx_max_pending. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-39-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 762faee5a2678559d3dc09d95f8f2c54cd0466a7 Author: Xuan Zhuo Date: Mon Aug 1 14:38:57 2022 +0800 virtio_net: set the default max ring size by find_vqs() Use virtio_find_vqs_ctx_size() to specify the maximum ring size of tx, rx at the same time. | rx/tx ring size ------------------------------------------- speed == UNKNOWN or < 10G| 1024 speed < 40G | 4096 speed >= 40G | 8192 Call virtnet_update_settings() once before calling init_vqs() to update speed. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-38-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit fe3dc04e31aa51f91dc7f741a5f76cc4817eb5b4 Author: Xuan Zhuo Date: Mon Aug 1 14:38:56 2022 +0800 virtio: add helper virtio_find_vqs_ctx_size() Introduce helper virtio_find_vqs_ctx_size() to call find_vqs and specify the maximum size of each vq ring. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-37-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit fbed86abba6e0472d98079790e58060e4332608a Author: Xuan Zhuo Date: Mon Aug 1 14:38:55 2022 +0800 virtio_mmio: support the arg sizes of find_vqs() Virtio MMIO support the new parameter sizes of find_vqs(). Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-36-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit cdb44806fca2d0ad29ca644cbf1505433902ee0c Author: Xuan Zhuo Date: Mon Aug 1 14:38:54 2022 +0800 virtio_pci: support the arg sizes of find_vqs() Virtio PCI supports new parameter sizes of find_vqs(). Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-35-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit a10fba0377145fccefea4dc4dd5915b7ed87e546 Author: Xuan Zhuo Date: Mon Aug 1 14:38:53 2022 +0800 virtio: find_vqs() add arg sizes find_vqs() adds a new parameter sizes to specify the size of each vq vring. NULL as sizes means that all queues in find_vqs() use the maximum size. A value in the array is 0, which means that the corresponding queue uses the maximum size. In the split scenario, the meaning of size is the largest size, because it may be limited by memory, the virtio core will try a smaller size. And the size is power of 2. Signed-off-by: Xuan Zhuo Acked-by: Hans de Goede Reviewed-by: Mathieu Poirier Acked-by: Jason Wang Message-Id: <20220801063902.129329-34-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 04ca0b0b16f11faf74fa92468dab51b8372586cd Author: Xuan Zhuo Date: Mon Aug 1 14:38:52 2022 +0800 virtio_pci: support VIRTIO_F_RING_RESET This patch implements virtio pci support for QUEUE RESET. Performing reset on a queue is divided into these steps: 1. notify the device to reset the queue 2. recycle the buffer submitted 3. reset the vring (may re-alloc) 4. mmap vring to device, and enable the queue This patch implements virtio_reset_vq(), virtio_enable_resetq() in the pci scenario. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-33-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 56bdc06139404b3b06ed75ec99b93445d7e0b8c3 Author: Xuan Zhuo Date: Mon Aug 1 14:38:51 2022 +0800 virtio_pci: extract the logic of active vq for modern pci Introduce vp_active_vq() to configure vring to backend after vq attach vring. And configure vq vector if necessary. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-32-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 0b50cece0b7857732d2055f2c77f8730c10f9196 Author: Xuan Zhuo Date: Mon Aug 1 14:38:50 2022 +0800 virtio_pci: introduce helper to get/set queue reset Introduce new helpers to implement queue reset and get queue reset status. https://github.com/oasis-tcs/virtio-spec/issues/124 https://github.com/oasis-tcs/virtio-spec/issues/139 Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-31-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 0cdd450e70510c9e13af8099e9f6c1467e6a0b91 Author: Xuan Zhuo Date: Mon Aug 1 14:38:49 2022 +0800 virtio_pci: struct virtio_pci_common_cfg add queue_reset Add queue_reset in virtio_pci_modern_common_cfg. https://github.com/oasis-tcs/virtio-spec/issues/124 https://github.com/oasis-tcs/virtio-spec/issues/139 Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-30-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 4913e85441b40386c4bb093f188b955d8165f1b7 Author: Xuan Zhuo Date: Mon Aug 1 14:38:48 2022 +0800 virtio_ring: struct virtqueue introduce reset Introduce a new member reset to the structure virtqueue to determine whether the current vq is in the reset state. Subsequent patches will use it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-29-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit d94587b5bb5c4bba32fbc2bd92c86cc6de25167f Author: Xuan Zhuo Date: Mon Aug 1 14:38:47 2022 +0800 virtio: queue_reset: add VIRTIO_F_RING_RESET Added VIRTIO_F_RING_RESET, it came from here https://github.com/oasis-tcs/virtio-spec/issues/124 https://github.com/oasis-tcs/virtio-spec/issues/139 This feature indicates that the driver can reset a queue individually. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-28-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 3251063155032729b8793ac3957136ae25c0bafa Author: Xuan Zhuo Date: Mon Aug 1 14:38:46 2022 +0800 virtio: allow to unbreak/break virtqueue individually This patch allows the new introduced __virtqueue_break()/__virtqueue_unbreak() to break/unbreak the virtqueue. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-27-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit ea024594b1dc5b6719c1400ae154690f5c203996 Author: Xuan Zhuo Date: Mon Aug 1 14:38:45 2022 +0800 virtio_pci: struct virtio_pci_common_cfg add queue_notify_data Add queue_notify_data in struct virtio_pci_common_cfg, which comes from here https://github.com/oasis-tcs/virtio-spec/issues/89 In order not to affect the API, add a dedicated structure struct virtio_pci_modern_common_cfg to virtio_pci_modern.h. Since I want to add queue_reset after queue_notify_data, I submitted this patch first. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-26-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit c790e8e1817f1a17c05e64f1c4f16f231b8529d5 Author: Xuan Zhuo Date: Mon Aug 1 14:38:44 2022 +0800 virtio_ring: introduce virtqueue_resize() Introduce virtqueue_resize() to implement the resize of vring. Based on these, the driver can dynamically adjust the size of the vring. For example: ethtool -G. virtqueue_resize() implements resize based on the vq reset function. In case of failure to allocate a new vring, it will give up resize and use the original vring. During this process, if the re-enable reset vq fails, the vq can no longer be used. Although the probability of this situation is not high. The parameter recycle is used to recycle the buffer that is no longer used. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-25-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 947f9fcf674f8f3f09e01dfb5d8e564650875878 Author: Xuan Zhuo Date: Mon Aug 1 14:38:43 2022 +0800 virtio_ring: packed: introduce virtqueue_resize_packed() virtio ring packed supports resize. Only after the new vring is successfully allocated based on the new num, we will release the old vring. In any case, an error is returned, indicating that the vring still points to the old vring. In the case of an error, re-initialize(by virtqueue_reinit_packed()) the virtqueue to ensure that the vring can be used. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-24-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 56775e141b18790f70e05537f3a1417565e766ac Author: Xuan Zhuo Date: Mon Aug 1 14:38:42 2022 +0800 virtio_ring: packed: introduce virtqueue_reinit_packed() Introduce a function to initialize vq without allocating new ring, desc_state, desc_extra. Subsequent patches will call this function after reset vq to reinitialize vq. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-23-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 51d649f14aae0986c62cf798b262f99b49836e88 Author: Xuan Zhuo Date: Mon Aug 1 14:38:41 2022 +0800 virtio_ring: packed: extract the logic of attach vring Separate the logic of attach vring, the subsequent patch will call it separately. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-22-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 1a107c87ebcf04ede1b86e5de192df34b6e50bd7 Author: Xuan Zhuo Date: Mon Aug 1 14:38:40 2022 +0800 virtio_ring: packed: extract the logic of vring init Separate the logic of initializing vring, and subsequent patches will call it separately. This function completes the variable initialization of packed vring. It together with the logic of atatch constitutes the initialization of vring. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-21-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit ef3167cfd5f28bc86d68e82fc52d07ed03dff2f7 Author: Xuan Zhuo Date: Mon Aug 1 14:38:39 2022 +0800 virtio_ring: packed: extract the logic of alloc state and extra Separate the logic for alloc desc_state and desc_extra, which will be called separately by subsequent patches. Use struct vring_packed to pass desc_state, desc_extra. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-20-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 6b60b9c008e56e43cdda6ae618f7f58679a8901a Author: Xuan Zhuo Date: Mon Aug 1 14:38:38 2022 +0800 virtio_ring: packed: extract the logic of alloc queue Separate the logic of packed to create vring queue. This feature is required for subsequent virtuqueue reset vring. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-19-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 6356f8bb01ddf4a6d9f2da16f7c0e3c093c7f548 Author: Xuan Zhuo Date: Mon Aug 1 14:38:37 2022 +0800 virtio_ring: packed: introduce vring_free_packed Free the structure struct vring_vritqueue_packed. Subsequent patches require it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-18-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 6fea20e5611fc5c8264f04a878a98c06b6209eed Author: Xuan Zhuo Date: Mon Aug 1 14:38:36 2022 +0800 virtio_ring: split: introduce virtqueue_resize_split() virtio ring split supports resize. Only after the new vring is successfully allocated based on the new num, we will release the old vring. In any case, an error is returned, indicating that the vring still points to the old vring. In the case of an error, re-initialize(virtqueue_reinit_split()) the virtqueue to ensure that the vring can be used. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-17-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit af36b16f6c1e51975a3815eb21c21c47f3114393 Author: Xuan Zhuo Date: Mon Aug 1 14:38:35 2022 +0800 virtio_ring: split: reserve vring_align, may_reduce_num In vring_alloc_queue_split() save vring_align, may_reduce_num to structure vring_virtqueue_split. Used to create a new vring when implementing resize. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-16-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit e5175b419a1394e77ff418dd9bfaf15555dfe594 Author: Xuan Zhuo Date: Mon Aug 1 14:38:34 2022 +0800 virtio_ring: split: introduce virtqueue_reinit_split() Introduce a function to initialize vq without allocating new ring, desc_state, desc_extra. Subsequent patches will call this function after reset vq to reinitialize vq. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-15-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit e1d6a423ea1867a3a84f12a99981f036acb8f354 Author: Xuan Zhuo Date: Mon Aug 1 14:38:33 2022 +0800 virtio_ring: split: extract the logic of attach vring Separate the logic of attach vring, subsequent patches will call it separately. virtqueue_vring_init_split() completes the initialization of other variables of vring split. We can directly use vq->split = *vring_split to complete attach. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-14-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 198fa7be96e52bc89c9e8a7e1c3b9e059ff203a0 Author: Xuan Zhuo Date: Mon Aug 1 14:38:32 2022 +0800 virtio_ring: split: extract the logic of vring init Separate the logic of initializing vring, and subsequent patches will call it separately. This function completes the variable initialization of split vring. It together with the logic of atatch constitutes the initialization of vring. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-13-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit a2b36c8d7ddbaff801bcaa4592522cd3b7b08112 Author: Xuan Zhuo Date: Mon Aug 1 14:38:31 2022 +0800 virtio_ring: split: extract the logic of alloc state and extra Separate the logic of creating desc_state, desc_extra, and subsequent patches will call it independently. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-12-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit c2d87fe68d13f45f42861e25dcda21b132dbf554 Author: Xuan Zhuo Date: Mon Aug 1 14:38:30 2022 +0800 virtio_ring: split: extract the logic of alloc queue Separate the logic of split to create vring queue. This feature is required for subsequent virtuqueue reset vring. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-11-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 89f05d94a33abec2d38f644065ca5cff5f50c4d7 Author: Xuan Zhuo Date: Mon Aug 1 14:38:29 2022 +0800 virtio_ring: split: introduce vring_free_split() Free the structure struct vring_vritqueue_split. Subsequent patches require it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-10-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit cd4c812acb8390a3cfa0a178b777979f9cdd3eeb Author: Xuan Zhuo Date: Mon Aug 1 14:38:28 2022 +0800 virtio_ring: split: __vring_new_virtqueue() accept struct vring_virtqueue_split __vring_new_virtqueue() instead accepts struct vring_virtqueue_split. The purpose of this is to pass more information into __vring_new_virtqueue() to make the code simpler and the structure cleaner. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-9-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 07d9629d49584b6f79faa6158cd7aef7e6919703 Author: Xuan Zhuo Date: Mon Aug 1 14:38:27 2022 +0800 virtio_ring: split: stop __vring_new_virtqueue as export symbol There is currently only one place to reference __vring_new_virtqueue() directly from the outside of virtio core. And here vring_new_virtqueue() can be used instead. Subsequent patches will modify __vring_new_virtqueue, so stop it as an export symbol for now. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-8-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 3a897128d3193459a87551e54a7f0a71edb65153 Author: Xuan Zhuo Date: Mon Aug 1 14:38:26 2022 +0800 virtio_ring: introduce virtqueue_init() Separate the logic of virtqueue initialization. These variables should be reset during reset. This logic can be called independently when implementing resize/reset later. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-7-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit d76136e434973691d8928cec1b3f93d38e30fe6e Author: Xuan Zhuo Date: Mon Aug 1 14:38:25 2022 +0800 virtio_ring: split vring_virtqueue Separate the two inline structures(split and packed) from the structure vring_virtqueue. In this way, we can use these two structures later to pass parameters and retain temporary variables. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-6-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 3ea19e3265d8d140bdd2905e7c40216368cac589 Author: Xuan Zhuo Date: Mon Aug 1 14:38:24 2022 +0800 virtio_ring: extract the logic of freeing vring Introduce vring_free() to free the vring of vq. Subsequent patches will use vring_free() alone. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-5-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit a62eecb3a9c086fa7b47c5cc74ab8ca4e655a682 Author: Xuan Zhuo Date: Mon Aug 1 14:38:23 2022 +0800 virtio_ring: update the document of the virtqueue_detach_unused_buf for queue reset Added documentation for virtqueue_detach_unused_buf, allowing it to be called on queue reset. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-4-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 3086e9fc9173166774652a488467e4176ee1c81b Author: Xuan Zhuo Date: Mon Aug 1 14:38:22 2022 +0800 virtio: struct virtio_config_ops add callbacks for queue_reset reset can be divided into the following four steps (example): 1. transport: notify the device to reset the queue 2. vring: recycle the buffer submitted 3. vring: reset/resize the vring (may re-alloc) 4. transport: mmap vring to device, and enable the queue In order to support queue reset, add two callbacks in struct virtio_config_ops to implement steps 1 and 4. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-3-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit da802961832f9852886304290135457519815497 Author: Xuan Zhuo Date: Mon Aug 1 14:38:21 2022 +0800 virtio: record the maximum queue num supported by the device. virtio-net can display the maximum (supported by hardware) ring size in ethtool -g eth0. When the subsequent patch implements vring reset, it can judge whether the ring size passed by the driver is legal based on this. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220801063902.129329-2-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 0b6fd46ec5f5720b76cbb01300ed9f7b7c6365c4 Author: David Hildenbrand Date: Fri Jun 10 11:47:37 2022 +0200 drivers/virtio: Clarify CONFIG_VIRTIO_MEM for unsupported architectures Let's make it clearer that simply unlocking CONFIG_VIRTIO_MEM on an architecture is most probably not sufficient to have it working as expected. Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Gavin Shan Signed-off-by: David Hildenbrand Message-Id: <20220610094737.65254-1-david@redhat.com> Signed-off-by: Michael S. Tsirkin commit 02213273f72a43bad3a8e9c18595a2c74ee487e8 Author: Minghao Xue Date: Fri Jun 10 16:58:27 2022 +0800 virtio_mmio: add support to set IRQ of a virtio device as wakeup source According to virtio_mmio wakeup flag in device trees, set its IRQ as wakeup source in virtqueue initialization. Signed-off-by: Minghao Xue Message-Id: <1654851507-13891-3-git-send-email-quic_mingxue@quicinc.com> Signed-off-by: Michael S. Tsirkin commit 51ded7cdf26deea7dd875047c2f005b81e80bdf4 Author: Minghao Xue Date: Fri Jun 10 16:58:26 2022 +0800 dt-bindings: virtio: mmio: add optional wakeup-source property Some systems want to set the interrupt of virtio_mmio device as a wakeup source. On such systems, we'll use the existence of the "wakeup-source" property as a signal of requirement. Signed-off-by: Minghao Xue Reviewed-by: Krzysztof Kozlowski Message-Id: <1654851507-13891-2-git-send-email-quic_mingxue@quicinc.com> Signed-off-by: Michael S. Tsirkin commit 366958a7fd7b541cba478e2866ef08f34e20471b Author: Robin Murphy Date: Wed Jun 8 12:48:26 2022 +0100 vdpa: Use device_iommu_capable() Use the new interface to check the capability for our device specifically. Signed-off-by: Robin Murphy Message-Id: <548e316fa282ce513fabb991a4c4d92258062eb5.1654688822.git.robin.murphy@arm.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit ebe797f25f68f28581f46a9cb9c1997ac15c39a0 Author: Michael S. Tsirkin Date: Thu Jun 30 15:10:57 2022 -0400 virtio: VIRTIO_HARDEN_NOTIFICATION is broken This option doesn't really work and breaks too many drivers. Not yet sure what's the right thing to do, for now let's make sure randconfig isn't broken by this. Fixes: c346dae4f3fb ("virtio: disable notification hardening by default") Cc: "Jason Wang" Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 5d66322b2b23507e9907a68e9c504181ffccd62f Author: Jason Wang Date: Tue Jun 28 16:34:30 2022 +0800 virtio_pmem: set device ready in probe() The NVDIMM region could be available before the virtio_device_ready() that is called by virtio_dev_probe(). This means the driver tries to use device before DRIVER_OK which violates the spec, fixing this by set device ready before the nvdimm_pmem_region_create(). Note that this means the virtio_pmem_host_ack() could be triggered before the creation of the nd region, this is safe since the pmem_lock has been initialized and whether or not any available buffer is added before is validated by virtio_pmem_host_ack(). Fixes 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") Acked-by: Pankaj Gupta Signed-off-by: Jason Wang Message-Id: <20220628083430.61856-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 020e1aede7ee31d8b0e24a46ee364c7bb0939f02 Author: Jason Wang Date: Tue Jun 28 16:34:29 2022 +0800 virtio_pmem: initialize provider_data through nd_region_desc We used to initialize the provider_data manually after nvdimm_pemm_region_create(). This seems to be racy if the flush is issued before the initialization of provider_data[1]. Fixing this by initializing the provider_data through nd_region_desc to make sure the provider_data is ready after the pmem is created. [1]: [ 80.152281] nd_pmem namespace0.0: unable to guarantee persistence of writes [ 92.393956] BUG: kernel NULL pointer dereference, address: 0000000000000318 [ 92.394551] #PF: supervisor read access in kernel mode [ 92.394955] #PF: error_code(0x0000) - not-present page [ 92.395365] PGD 0 P4D 0 [ 92.395566] Oops: 0000 [#1] PREEMPT SMP PTI [ 92.395867] CPU: 2 PID: 506 Comm: mkfs.ext4 Not tainted 5.19.0-rc1+ #453 [ 92.396365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 92.397178] RIP: 0010:virtio_pmem_flush+0x2f/0x1f0 [ 92.397521] Code: 55 41 54 55 53 48 81 ec a0 00 00 00 65 48 8b 04 25 28 00 00 00 48 89 84 24 98 00 00 00 31 c0 48 8b 87 78 03 00 00 48 89 04 24 <48> 8b 98 18 03 00 00 e8 85 bf 6b 00 ba 58 00 00 00 be c0 0c 00 00 [ 92.398982] RSP: 0018:ffff9a7380aefc88 EFLAGS: 00010246 [ 92.399349] RAX: 0000000000000000 RBX: ffff8e77c3f86f00 RCX: 0000000000000000 [ 92.399833] RDX: ffffffffad4ea720 RSI: ffff8e77c41e39c0 RDI: ffff8e77c41c5c00 [ 92.400388] RBP: ffff8e77c41e39c0 R08: ffff8e77c19f0600 R09: 0000000000000000 [ 92.400874] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8e77c0814e28 [ 92.401364] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8e77c41e39c0 [ 92.401849] FS: 00007f3cd75b2780(0000) GS:ffff8e7937d00000(0000) knlGS:0000000000000000 [ 92.402423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.402821] CR2: 0000000000000318 CR3: 0000000103c80002 CR4: 0000000000370ee0 [ 92.403307] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 92.403793] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 92.404278] Call Trace: [ 92.404481] [ 92.404654] ? mempool_alloc+0x5d/0x160 [ 92.404939] ? terminate_walk+0x5f/0xf0 [ 92.405226] ? bio_alloc_bioset+0xbb/0x3f0 [ 92.405525] async_pmem_flush+0x17/0x80 [ 92.405806] nvdimm_flush+0x11/0x30 [ 92.406067] pmem_submit_bio+0x1e9/0x200 [ 92.406354] __submit_bio+0x80/0x120 [ 92.406621] submit_bio_noacct_nocheck+0xdc/0x2a0 [ 92.406958] submit_bio_wait+0x4e/0x80 [ 92.407234] blkdev_issue_flush+0x31/0x50 [ 92.407526] ? punt_bios_to_rescuer+0x230/0x230 [ 92.407852] blkdev_fsync+0x1e/0x30 [ 92.408112] do_fsync+0x33/0x70 [ 92.408354] __x64_sys_fsync+0xb/0x10 [ 92.408625] do_syscall_64+0x43/0x90 [ 92.408895] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 92.409257] RIP: 0033:0x7f3cd76c6c44 Fixes 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") Acked-by: Pankaj Gupta Reviewed-by: Dan Williams Signed-off-by: Jason Wang Message-Id: <20220628083430.61856-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 309bba39c945ac8ab8083ac05cd6cfe5822968e0 Author: Stefano Garzarella Date: Fri Jun 24 09:56:56 2022 +0200 vringh: iterate on iotlb_translate to handle large translations iotlb_translate() can return -ENOBUFS if the bio_vec is not big enough to contain all the ranges for translation. This can happen for example if the VMM maps a large bounce buffer, without using hugepages, that requires more than 16 ranges to translate the addresses. To handle this case, let's extend iotlb_translate() to also return the number of bytes successfully translated. In copy_from_iotlb()/copy_to_iotlb() loops by calling iotlb_translate() several times until we complete the translation. Signed-off-by: Stefano Garzarella Message-Id: <20220624075656.13997-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin commit 96ef18a24b87bef7c3d2dad72cf4c3013a9f7f35 Author: Xuan Zhuo Date: Fri Jun 24 10:55:45 2022 +0800 virtio_ring: remove the arg vq of vring_alloc_desc_extra() The parameter vq of vring_alloc_desc_extra() is useless. This patch removes this parameter. Subsequent patches will call this function to avoid passing useless arguments. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Message-Id: <20220624025621.128843-6-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit c2a052a4a949df53f50a5024843432d2234cb824 Author: Xuan Zhuo Date: Fri Jun 24 10:55:41 2022 +0800 remoteproc: rename len of rpoc_vring to num Rename the member len in the structure rpoc_vring to num. And remove 'in bytes' from the comment of it. This is misleading. Because this actually refers to the size of the virtio vring to be created. The unit is not bytes. Signed-off-by: Xuan Zhuo Message-Id: <20220624025621.128843-2-xuanzhuo@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 4e4588f1c4d2e67c993208f0550ef3fae33abce4 Author: Alexei Starovoitov Date: Wed Aug 10 23:52:28 2022 -0700 bpf: Shut up kern_sys_bpf warning. Shut up this warning: kernel/bpf/syscall.c:5089:5: warning: no previous prototype for function 'kern_sys_bpf' [-Wmissing-prototypes] int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size) Reported-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov commit 19a7cc817a380f7a412d7d76e145e9e2bc47e52f Author: Bagas Sanjaya Date: Mon Jun 27 16:51:51 2022 +0700 KVM: x86/MMU: properly format KVM_CAP_VM_DISABLE_NX_HUGE_PAGES capability table There is unexpected warning on KVM_CAP_VM_DISABLE_NX_HUGE_PAGES capability table, which cause the table to be rendered as paragraph text instead. The warning is due to missing colon at capability name and returns keyword, as well as improper alignment on multi-line returns field. Fix the warning by adding missing colons and aligning the field. Link: https://lore.kernel.org/lkml/20220627181937.3be67263@canb.auug.org.au/ Fixes: 084cc29f8bbb03 ("KVM: x86/MMU: Allow NX huge pages to be disabled on a per-vm basis") Reported-by: Stephen Rothwell Cc: Paolo Bonzini Cc: Jonathan Corbet Cc: David Matlack Cc: Ben Gardon Cc: Peter Xu Cc: kvm@vger.kernel.org Cc: linux-next@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Message-Id: <20220627095151.19339-3-bagasdotme@gmail.com> Signed-off-by: Paolo Bonzini commit b4aed4d85ff82848eab4637ee06f532852721bba Author: Bagas Sanjaya Date: Mon Jun 27 16:51:50 2022 +0700 Documentation: KVM: extend KVM_CAP_VM_DISABLE_NX_HUGE_PAGES heading underline Extend heading underline for KVM_CAP_VM_DISABLE_NX_HUGE_PAGE to match the heading text length. Link: https://lore.kernel.org/lkml/20220627181937.3be67263@canb.auug.org.au/ Fixes: 084cc29f8bbb03 ("KVM: x86/MMU: Allow NX huge pages to be disabled on a per-vm basis") Reported-by: Stephen Rothwell Cc: Paolo Bonzini Cc: Jonathan Corbet Cc: David Matlack Cc: Ben Gardon Cc: Peter Xu Cc: kvm@vger.kernel.org Cc: linux-next@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Message-Id: <20220627095151.19339-2-bagasdotme@gmail.com> Signed-off-by: Paolo Bonzini commit 4963d74f8a6cc0eafd71d9ffc13e3a11ff1dd160 Author: Atte Heikkilä Date: Tue Aug 9 01:02:14 2022 +0300 ksmbd: request update to stale share config ksmbd_share_config_get() retrieves the cached share config as long as there is at least one connection to the share. This is an issue when the user space utilities are used to update share configs. In that case there is a need to inform ksmbd that it should not use the cached share config for a new connection to the share. With these changes the tree connection flag KSMBD_TREE_CONN_FLAG_UPDATE indicates this. When this flag is set, ksmbd removes the share config from the shares hash table meaning that ksmbd_share_config_get() ends up requesting a share config from user space. Signed-off-by: Atte Heikkilä Acked-by: Namjae Jeon Signed-off-by: Steve French commit fe54833dc8d97ef387e86f7c80537d51c503ca75 Author: Namjae Jeon Date: Mon Aug 8 21:56:48 2022 +0900 ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured If share is not configured in smb.conf, smb2 tree connect should return STATUS_BAD_NETWORK_NAME instead of STATUS_BAD_NETWORK_PATH. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 94ce3b64c62d4b628cf85cd0d9a370aca8f7e43a Author: Maxim Mikityanskiy Date: Wed Aug 10 11:16:02 2022 +0300 net/tls: Use RCU API to access tls_ctx->netdev Currently, tls_device_down synchronizes with tls_device_resync_rx using RCU, however, the pointer to netdev is stored using WRITE_ONCE and loaded using READ_ONCE. Although such approach is technically correct (rcu_dereference is essentially a READ_ONCE, and rcu_assign_pointer uses WRITE_ONCE to store NULL), using special RCU helpers for pointers is more valid, as it includes additional checks and might change the implementation transparently to the callers. Mark the netdev pointer as __rcu and use the correct RCU helpers to access it. For non-concurrent access pass the right conditions that guarantee safe access (locks taken, refcount value). Also use the correct helper in mlx5e, where even READ_ONCE was missing. The transition to RCU exposes existing issues, fixed by this commit: 1. bond_tls_device_xmit could read netdev twice, and it could become NULL the second time, after the NULL check passed. 2. Drivers shouldn't stop processing the last packet if tls_device_down just set netdev to NULL, before tls_dev_del was called. This prevents a possible packet drop when transitioning to the fallback software mode. Fixes: 89df6a810470 ("net/bonding: Implement TLS TX device offload") Fixes: c55dcdd435aa ("net/tls: Fix use-after-free after the TLS device goes down and up") Signed-off-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20220810081602.1435800-1-maximmi@nvidia.com Signed-off-by: Jakub Kicinski commit d800a7b3577bfb783481b02865d8775a760212a7 Author: Jakub Kicinski Date: Tue Aug 9 10:55:44 2022 -0700 tls: rx: device: don't try to copy too much on detach Another device offload bug, we use the length of the output skb as an indication of how much data to copy. But that skb is sized to offset + record length, and we start from offset. So we end up double-counting the offset which leads to skb_copy_bits() returning -EFAULT. Reported-by: Tariq Toukan Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Ran Rozenstein Link: https://lore.kernel.org/r/20220809175544.354343-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 86b259f6f8880237899fbf4f940303b3987dffa9 Author: Jakub Kicinski Date: Tue Aug 9 10:55:43 2022 -0700 tls: rx: device: bound the frag walk We can't do skb_walk_frags() on the input skbs, because the input skbs is really just a pointer to the tcp read queue. We need to bound the "is decrypted" check by the amount of data in the message. Note that the walk in tls_device_reencrypt() is after a CoW so the skb there is safe to walk. Actually in the current implementation it can't have frags at all, but whatever, maybe one day it will. Reported-by: Tariq Toukan Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Ran Rozenstein Link: https://lore.kernel.org/r/20220809175544.354343-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9ad36309e2719a884f946678e0296be10f0bb4c1 Author: Thadeu Lima de Souza Cascardo Date: Tue Aug 9 14:05:18 2022 -0300 net_sched: cls_route: remove from list when handle is 0 When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed. The test was there since before commit 1109c00547fc ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0. Remove the old filter from the list independently from its handle value. This fixes CVE-2022-2588, also reported as ZDI-CAN-17440. Reported-by: Zhenpeng Lin Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Kamal Mostafa Cc: Acked-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/20220809170518.164662-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski commit 636aa8807b5780b76609b40cd3d3e1b5a225471c Author: Mohan Kumar Date: Thu Aug 11 10:57:04 2022 +0530 ALSA: hda: Fix crash due to jack poll in suspend With jackpoll_in_suspend flag set, there is a possibility that jack poll worker thread will run even after system suspend was completed. Any register access after system pm callback flow will result in kernel crash as still jack poll worker thread tries to access registers. To fix the crash issue during system flow, cancel the jack poll worker thread during system pm prepare callback and cancel the worker thread at start of runtime suspend callback and re-schedule at last to avoid any unwarranted access of register by worker thread during suspend flow. Signed-off-by: Mohan Kumar Fixes: b33115bd05af ("ALSA: hda: Jack detection poll in suspend state") Link: https://lore.kernel.org/r/20220811052704.2944-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai commit 74bba640d69914cf832b87f6bbb700e5ba430672 Author: Allen Ballway Date: Wed Aug 10 15:27:22 2022 +0000 ALSA: hda/cirrus - support for iMac 12,1 model The 12,1 model requires the same configuration as the 12,2 model to enable headphones but has a different codec SSID. Adds 12,1 SSID for matching quirk. [ re-sorted in SSID order by tiwai ] Signed-off-by: Allen Ballway Cc: Link: https://lore.kernel.org/r/20220810152701.1.I902c2e591bbf8de9acb649d1322fa1f291849266@changeid Signed-off-by: Takashi Iwai commit 8bcfb4ae4d970b9a9724ddfbac26c387934e0e94 Author: Ido Schimmel Date: Tue Aug 9 14:33:20 2022 +0300 selftests: forwarding: Fix failing tests with old libnet The custom multipath hash tests use mausezahn in order to test how changes in various packet fields affect the packet distribution across the available nexthops. The tool uses the libnet library for various low-level packet construction and injection. The library started using the "SO_BINDTODEVICE" socket option for IPv6 sockets in version 1.1.6 and for IPv4 sockets in version 1.2. When the option is not set, packets are not routed according to the table associated with the VRF master device and tests fail. Fix this by prefixing the command with "ip vrf exec", which will cause the route lookup to occur in the VRF routing table. This makes the tests pass regardless of the libnet library version. Fixes: 511e8db54036 ("selftests: forwarding: Add test for custom multipath hash") Fixes: 185b0c190bb6 ("selftests: forwarding: Add test for custom multipath hash with IPv4 GRE") Fixes: b7715acba4d3 ("selftests: forwarding: Add test for custom multipath hash with IPv6 GRE") Reported-by: Ivan Vecera Tested-by: Ivan Vecera Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Link: https://lore.kernel.org/r/20220809113320.751413-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit fbe8870f72e8e71bb57b883d29c600aaaca6cd20 Merge: dd48f3832d041 e7c677bdd03d5 Author: Jakub Kicinski Date: Wed Aug 10 21:48:14 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== bpf 2022-08-10 We've added 23 non-merge commits during the last 7 day(s) which contain a total of 19 files changed, 424 insertions(+), 35 deletions(-). The main changes are: 1) Several fixes for BPF map iterator such as UAFs along with selftests, from Hou Tao. 2) Fix BPF syscall program's {copy,strncpy}_from_bpfptr() to not fault, from Jinghao Jia. 3) Reject BPF syscall programs calling BPF_PROG_RUN, from Alexei Starovoitov and YiFei Zhu. 4) Fix attach_btf_obj_id info to pick proper target BTF, from Stanislav Fomichev. 5) BPF design Q/A doc update to clarify what is not stable ABI, from Paul E. McKenney. 6) Fix BPF map's prealloc_lru_pop to not reinitialize, from Kumar Kartikeya Dwivedi. 7) Fix bpf_trampoline_put to avoid leaking ftrace hash, from Jiri Olsa. 8) Fix arm64 JIT to address sparse errors around BPF trampoline, from Xu Kuohai. 9) Fix arm64 JIT to use kvcalloc instead of kcalloc for internal program address offset buffer, from Aijun Sun. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (23 commits) selftests/bpf: Ensure sleepable program is rejected by hash map iter selftests/bpf: Add write tests for sk local storage map iterator selftests/bpf: Add tests for reading a dangling map iter fd bpf: Only allow sleepable program for resched-able iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Disallow bpf programs call prog_run command. bpf, arm64: Fix bpf trampoline instruction endianness selftests/bpf: Add test for prealloc_lru_pop bug bpf: Don't reinit map value in prealloc_lru_pop bpf: Allow calling bpf_prog_test kfuncs in tracing programs bpf, arm64: Allocate program buffer using kvcalloc instead of kcalloc selftests/bpf: Excercise bpf_obj_get_info_by_fd for bpf2bpf bpf: Use proper target btf when exporting attach_btf_obj_id mptcp, btf: Add struct mptcp_sock definition when CONFIG_MPTCP is disabled bpf: Cleanup ftrace hash in bpf_trampoline_put BPF: Fix potential bad pointer dereference in bpf_sys_bpf() ... ==================== Link: https://lore.kernel.org/r/20220810190624.10748-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit dd48f3832d041b7dbe54f26df21ace91a5889701 Merge: f329a0ebeaba4 cf8c1e967224c Author: Jakub Kicinski Date: Wed Aug 10 21:48:08 2022 -0700 Merge branch 'net-enhancements-to-sk_user_data-field' Hawkins Jiawei says: ==================== net: enhancements to sk_user_data field This patchset fixes refcount bug by adding SK_USER_DATA_PSOCK flag bit in sk_user_data field. The bug cause following info: WARNING: CPU: 1 PID: 3605 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 Modules linked in: CPU: 1 PID: 3605 Comm: syz-executor208 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0 __refcount_add_not_zero include/linux/refcount.h:163 [inline] __refcount_inc_not_zero include/linux/refcount.h:227 [inline] refcount_inc_not_zero include/linux/refcount.h:245 [inline] sk_psock_get+0x3bc/0x410 include/linux/skmsg.h:439 tls_data_ready+0x6d/0x1b0 net/tls/tls_sw.c:2091 tcp_data_ready+0x106/0x520 net/ipv4/tcp_input.c:4983 tcp_data_queue+0x25f2/0x4c90 net/ipv4/tcp_input.c:5057 tcp_rcv_state_process+0x1774/0x4e80 net/ipv4/tcp_input.c:6659 tcp_v4_do_rcv+0x339/0x980 net/ipv4/tcp_ipv4.c:1682 sk_backlog_rcv include/net/sock.h:1061 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2849 release_sock+0x54/0x1b0 net/core/sock.c:3404 inet_shutdown+0x1e0/0x430 net/ipv4/af_inet.c:909 __sys_shutdown_sock net/socket.c:2331 [inline] __sys_shutdown_sock net/socket.c:2325 [inline] __sys_shutdown+0xf1/0x1b0 net/socket.c:2343 __do_sys_shutdown net/socket.c:2351 [inline] __se_sys_shutdown net/socket.c:2349 [inline] __x64_sys_shutdown+0x50/0x70 net/socket.c:2349 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 To improve code maintainability, this patchset refactors sk_user_data flags code to be more generic. ==================== Link: https://lore.kernel.org/r/cover.1659676823.git.yin31149@gmail.com Signed-off-by: Jakub Kicinski commit cf8c1e967224c931119d3447f2213d1f645a1a2a Author: Hawkins Jiawei Date: Fri Aug 5 15:48:36 2022 +0800 net: refactor bpf_sk_reuseport_detach() Refactor sk_user_data dereference using more generic function __rcu_dereference_sk_user_data_with_flags(), which improve its maintainability Suggested-by: Jakub Kicinski Signed-off-by: Hawkins Jiawei Reviewed-by: Jakub Sitnicki Signed-off-by: Jakub Kicinski commit 2a0133723f9ebeb751cfce19f74ec07e108bef1f Author: Hawkins Jiawei Date: Fri Aug 5 15:48:34 2022 +0800 net: fix refcount bug in sk_psock_get (2) Syzkaller reports refcount bug as follows: ------------[ cut here ]------------ refcount_t: saturated; leaking memory. WARNING: CPU: 1 PID: 3605 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 Modules linked in: CPU: 1 PID: 3605 Comm: syz-executor208 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0 __refcount_add_not_zero include/linux/refcount.h:163 [inline] __refcount_inc_not_zero include/linux/refcount.h:227 [inline] refcount_inc_not_zero include/linux/refcount.h:245 [inline] sk_psock_get+0x3bc/0x410 include/linux/skmsg.h:439 tls_data_ready+0x6d/0x1b0 net/tls/tls_sw.c:2091 tcp_data_ready+0x106/0x520 net/ipv4/tcp_input.c:4983 tcp_data_queue+0x25f2/0x4c90 net/ipv4/tcp_input.c:5057 tcp_rcv_state_process+0x1774/0x4e80 net/ipv4/tcp_input.c:6659 tcp_v4_do_rcv+0x339/0x980 net/ipv4/tcp_ipv4.c:1682 sk_backlog_rcv include/net/sock.h:1061 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2849 release_sock+0x54/0x1b0 net/core/sock.c:3404 inet_shutdown+0x1e0/0x430 net/ipv4/af_inet.c:909 __sys_shutdown_sock net/socket.c:2331 [inline] __sys_shutdown_sock net/socket.c:2325 [inline] __sys_shutdown+0xf1/0x1b0 net/socket.c:2343 __do_sys_shutdown net/socket.c:2351 [inline] __se_sys_shutdown net/socket.c:2349 [inline] __x64_sys_shutdown+0x50/0x70 net/socket.c:2349 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 During SMC fallback process in connect syscall, kernel will replaces TCP with SMC. In order to forward wakeup smc socket waitqueue after fallback, kernel will sets clcsk->sk_user_data to origin smc socket in smc_fback_replace_callbacks(). Later, in shutdown syscall, kernel will calls sk_psock_get(), which treats the clcsk->sk_user_data as psock type, triggering the refcnt warning. So, the root cause is that smc and psock, both will use sk_user_data field. So they will mismatch this field easily. This patch solves it by using another bit(defined as SK_USER_DATA_PSOCK) in PTRMASK, to mark whether sk_user_data points to a psock object or not. This patch depends on a PTRMASK introduced in commit f1ff5ce2cd5e ("net, sk_msg: Clear sk_user_data pointer on clone if tagged"). For there will possibly be more flags in the sk_user_data field, this patch also refactor sk_user_data flags code to be more generic to improve its maintainability. Reported-and-tested-by: syzbot+5f26f85569bd179c18ce@syzkaller.appspotmail.com Suggested-by: Jakub Kicinski Acked-by: Wen Gu Signed-off-by: Hawkins Jiawei Reviewed-by: Jakub Sitnicki Signed-off-by: Jakub Kicinski commit 3aefb2ee5bdd4a8976298415a5a017bf9844bfd5 Merge: 8f2f74b4b6e67 d20ec7529236a Author: Palmer Dabbelt Date: Wed Aug 10 18:23:51 2022 -0700 riscv: implement Zicbom-based CMO instructions + the t-head variant This series is based on the alternatives changes done in my svpbmt series and thus also depends on Atish's isa-extension parsing series. It implements using the cache-management instructions from the Zicbom- extension to handle cache flush, etc actions on platforms needing them. SoCs using cpu cores from T-Head like the Allwinne D1 implement a different set of cache instructions. But while they are different, instructions they provide the same functionality, so a variant can easly hook into the existing alternatives mechanism on those. [Palmer: Some minor fixups, including a RISCV_ISA_ZICBOM dependency on MMU that's probably not strictly necessary. The Zicbom support will trip up sparse for users that have new toolchains, I just sent a patch.] Link: https://lore.kernel.org/all/20220706231536.2041855-1-heiko@sntech.de/ Link: https://lore.kernel.org/linux-sparse/20220811033138.20676-1-palmer@rivosinc.com/T/#u * palmer/riscv-zicbom: riscv: implement cache-management errata for T-Head SoCs riscv: Add support for non-coherent devices using zicbom extension dt-bindings: riscv: document cbom-block-size of: also handle dma-noncoherent in of_dma_is_coherent() commit cd04345598b7c191d41574bc9da3fe435dc65605 Author: David Howells Date: Mon Aug 8 15:33:51 2022 +0100 cifs: Remove {cifs,nfs}_fscache_release_page() Remove {cifs,nfs}_fscache_release_page() from fs/cifs/fscache.h. This functionality got built directly into cifs_release_folio() and will hopefully be replaced with netfs_release_folio() at some point. The "nfs_" version is a copy and paste error and should've been altered to read "cifs_". That can also be removed. Reported-by: Matthew Wilcox Signed-off-by: David Howells Reviewed-by: Jeff Layton cc: Steve French cc: linux-cifs@vger.kernel.org cc: samba-technical@lists.samba.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit ffcf9c5700e49c0aee42dcba9a12ba21338e8136 Author: Nick Desaulniers Date: Wed Aug 10 15:24:41 2022 -0700 x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form: ld: warning: arch/x86/boot/pmjump.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/boot/compressed/vmlinux has a LOAD segment with RWX permissions Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack. LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check. While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments. Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06f73@kernel.dk/ Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 Link: https://github.com/llvm/llvm-project/issues/57009 Reported-and-tested-by: Jens Axboe Suggested-by: Fangrui Song Signed-off-by: Nick Desaulniers Signed-off-by: Linus Torvalds commit 0d362be5b14200b77ecc2127936a5ff82fbffe41 Author: Nick Desaulniers Date: Wed Aug 10 15:24:40 2022 -0700 Makefile: link with -z noexecstack --no-warn-rwx-segments Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form: ld: warning: vmlinux: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: vmlinux has a LOAD segment with RWX permissions Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack. LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check. While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments. Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06f73@kernel.dk/ Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 Link: https://github.com/llvm/llvm-project/issues/57009 Reported-and-tested-by: Jens Axboe Suggested-by: Fangrui Song Signed-off-by: Nick Desaulniers Signed-off-by: Linus Torvalds commit 1d3551ced64e1a4f4869446a92713c235f20b0ca Author: Linus Torvalds Date: Wed Aug 10 17:59:11 2022 -0700 crypto: blake2b: effectively disable frame size warning It turns out that gcc-12.1 has some nasty problems with register allocation on a 32-bit x86 build for the 64-bit values used in the generic blake2b implementation, where the pattern of 64-bit rotates and xor operations ends up making gcc generate horrible code. As a result it ends up with a ridiculously large stack frame for all the spills it generates, resulting in the following build problem: crypto/blake2b_generic.c: In function ‘blake2b_compress_one_generic’: crypto/blake2b_generic.c:109:1: error: the frame size of 2640 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] on the same test-case, clang ends up generating a stack frame that is just 296 bytes (and older gcc versions generate a slightly bigger one at 428 bytes - still nowhere near that almost 3kB monster stack frame of gcc-12.1). The issue is fixed both in mainline and the GCC 12 release branch [1], but current release compilers end up failing the i386 allmodconfig build due to this issue. Disable the warning for now by simply raising the frame size for this one file, just to keep this issue from having people turn off WERROR. Link: https://lore.kernel.org/all/CAHk-=wjxqgeG2op+=W9sqgsWqCYnavC+SRfVyopu9-31S6xw+Q@mail.gmail.com/ Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105930 [1] Signed-off-by: Linus Torvalds commit 031d166f968efba6e4f091ff75d0bb5206bb3918 Author: hexiaole Date: Tue Aug 9 13:23:46 2022 -0700 xfs: fix inode reservation space for removing transaction In 'fs/xfs/libxfs/xfs_trans_resv.c', the comment for transaction of removing a directory entry writes: /* fs/xfs/libxfs/xfs_trans_resv.c begin */ /* * For removing a directory entry we can modify: * the parent directory inode: inode size * the removed inode: inode size ... xfs_calc_remove_reservation( struct xfs_mount *mp) { return XFS_DQUOT_LOGRES(mp) + xfs_calc_iunlink_add_reservation(mp) + max((xfs_calc_inode_res(mp, 1) + ... /* fs/xfs/libxfs/xfs_trans_resv.c end */ There has 2 inode size of space to be reserverd, but the actual code for inode reservation space writes. There only count for 1 inode size to be reserved in 'xfs_calc_inode_res(mp, 1)', rather than 2. Signed-off-by: hexiaole Reviewed-by: Darrick J. Wong [djwong: remove redundant code citations] Signed-off-by: Darrick J. Wong commit 2bba782002c5dab6ca8d608b778b386fb912adff Author: Marek Vasut Date: Mon Aug 1 14:54:19 2022 +0200 drm/bridge: lvds-codec: Fix error checking of drm_of_lvds_get_data_mapping() The drm_of_lvds_get_data_mapping() returns either negative value on error or MEDIA_BUS_FMT_* otherwise. The check for 'ret' would also catch the positive case of MEDIA_BUS_FMT_* and lead to probe failure every time 'data-mapping' DT property is specified. Fixes: 7c4dd0a266527 ("drm: of: Add drm_of_lvds_get_data_mapping") Signed-off-by: Marek Vasut Cc: Laurent Pinchart Cc: Sam Ravnborg To: dri-devel@lists.freedesktop.org Reviewed-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220801125419.167562-1-marex@denx.de commit 773891ffd4d628d05c4e22f34541e4779ee7a076 Author: Paulo Alcantara Date: Mon Aug 8 13:41:18 2022 -0300 cifs: fix lock length calculation The lock length was wrongly set to 0 when fl_end == OFFSET_MAX, thus failing to lock the whole file when l_start=0 and l_len=0. This fixes test 2 from cthon04. Before patch: $ ./cthon04/lock/tlocklfs -t 2 /mnt Creating parent/child synchronization pipes. Test #1 - Test regions of an unlocked file. Parent: 1.1 - F_TEST [ 0, 1] PASSED. Parent: 1.2 - F_TEST [ 0, ENDING] PASSED. Parent: 1.3 - F_TEST [ 0,7fffffffffffffff] PASSED. Parent: 1.4 - F_TEST [ 1, 1] PASSED. Parent: 1.5 - F_TEST [ 1, ENDING] PASSED. Parent: 1.6 - F_TEST [ 1,7fffffffffffffff] PASSED. Parent: 1.7 - F_TEST [7fffffffffffffff, 1] PASSED. Parent: 1.8 - F_TEST [7fffffffffffffff, ENDING] PASSED. Parent: 1.9 - F_TEST [7fffffffffffffff,7fffffffffffffff] PASSED. Test #2 - Try to lock the whole file. Parent: 2.0 - F_TLOCK [ 0, ENDING] PASSED. Child: 2.1 - F_TEST [ 0, 1] FAILED! Child: **** Expected EACCES, returned success... Child: **** Probably implementation error. ** CHILD pass 1 results: 0/0 pass, 0/0 warn, 1/1 fail (pass/total). Parent: Child died ** PARENT pass 1 results: 10/10 pass, 0/0 warn, 0/0 fail (pass/total). After patch: $ ./cthon04/lock/tlocklfs -t 2 /mnt Creating parent/child synchronization pipes. Test #2 - Try to lock the whole file. Parent: 2.0 - F_TLOCK [ 0, ENDING] PASSED. Child: 2.1 - F_TEST [ 0, 1] PASSED. Child: 2.2 - F_TEST [ 0, ENDING] PASSED. Child: 2.3 - F_TEST [ 0,7fffffffffffffff] PASSED. Child: 2.4 - F_TEST [ 1, 1] PASSED. Child: 2.5 - F_TEST [ 1, ENDING] PASSED. Child: 2.6 - F_TEST [ 1,7fffffffffffffff] PASSED. Child: 2.7 - F_TEST [7fffffffffffffff, 1] PASSED. Child: 2.8 - F_TEST [7fffffffffffffff, ENDING] PASSED. Child: 2.9 - F_TEST [7fffffffffffffff,7fffffffffffffff] PASSED. Parent: 2.10 - F_ULOCK [ 0, ENDING] PASSED. ** PARENT pass 1 results: 2/2 pass, 0/0 warn, 0/0 fail (pass/total). ** CHILD pass 1 results: 9/9 pass, 0/0 warn, 0/0 fail (pass/total). Fixes: d80c69846ddf ("cifs: fix signed integer overflow when fl_end is OFFSET_MAX") Reported-by: Xiaoli Feng Cc: Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 8f2f74b4b6e67a84948abf1a52cb6a11fe76b5d9 Merge: c08b4848f596f 0ed048137fd98 Author: Palmer Dabbelt Date: Wed Aug 10 14:33:45 2022 -0700 RISC-V: Canaan devicetree fixes This series should rid us of dtbs_check errors for the RISC-V Canaan k210 based boards. To make keeping it that way a little easier, I changed the Canaan devicetree Makefile so that it would build all of the devicetrees in the directory if SOC_CANAAN. Link: https://lore.kernel.org/all/mhng-85044754-c361-40bc-a6a2-7082f35930bb@palmer-ri-x1c9/ * remotes/palmer/riscv-canaan_dt_schema: riscv: dts: canaan: build all devicetress if SOC_CANAAN riscv: dts: canaan: add specific compatible for kd233's LCD riscv: dts: canaan: fix bus {ranges,reg} warnings riscv: dts: canaan: remove spi-max-frequency from controllers riscv: dts: canaan: use custom compatible for k210 i2s riscv: dts: canaan: fix kd233 display spi frequency riscv: dts: canaan: fix mmc node names riscv: dts: canaan: fix the k210's timer nodes riscv: dts: canaan: fix the k210's memory node dt-bindings: memory-controllers: add canaan k210 sram controller dt-bindings: display: ili9341: document canaan kd233's lcd dt-bindings: display: convert ilitek,ili9341.txt to dt-schema commit 2ac2920cd8d9334e24bfd30d518010f99077a947 Author: Rob Herring Date: Thu Jul 28 13:08:10 2022 -0600 dt-bindings: mailbox: arm,mhu: Make secure interrupt optional The secure interrupt is only useful to secure world, therefore for NS users it shouldn't be required. Make it optional. This fixes a warning on Arm Juno board: mhu@2b1f0000: interrupts: [[0, 36, 4], [0, 35, 4]] is too short Signed-off-by: Rob Herring Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20220728190810.1290857-1-robh@kernel.org commit 487ceef03895285f44ab26f6cf0c19b21b73d40d Author: Rob Herring Date: Tue Aug 9 15:45:56 2022 -0600 dt-bindings: pinctrl: qcom,ipq6018: Fix example 'gpio-ranges' size 'gpio-ranges' entries have a fixed size of 1 phandle plus arg 3 cells. The qcom,ipq6018-pinctrl example is a cell short: Documentation/devicetree/bindings/pinctrl/qcom,ipq6018-pinctrl.example.dtb: pinctrl@1000000: gpio-ranges:0: [1, 0, 80] is too short From schema: /usr/local/lib/python3.10/dist-packages/dtschema/schemas/gpio/gpio.yaml Signed-off-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220809214556.2489822-1-robh@kernel.org commit c08b4848f596fd95543197463b5162bd7bab2442 Author: Chen Lifu Date: Wed Jun 15 09:47:14 2022 +0800 riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit Since commit 5d8544e2d007 ("RISC-V: Generic library routines and assembly") and commit ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code"), if __clear_user and __copy_user return from an fixup branch, CSR_STATUS SR_SUM bit will be set, it is a vulnerability, so that S-mode memory accesses to pages that are accessible by U-mode will success. Disable S-mode access to U-mode memory should clear SR_SUM bit. Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") Fixes: ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code") Signed-off-by: Chen Lifu Reviewed-by: Ben Dooks Link: https://lore.kernel.org/r/20220615014714.1650349-1-chenlifu@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit aeb6e6ac18c73ec287b3b1e2c913520699358c13 Merge: f41445645ab5d 3fa5cbdc44de1 Author: Linus Torvalds Date: Wed Aug 10 14:04:32 2022 -0700 Merge tag 'nfs-for-5.20-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Stable fixes: - pNFS/flexfiles: Fix infinite looping when the RDMA connection errors out Bugfixes: - NFS: fix port value parsing - SUNRPC: Reinitialise the backchannel request buffers before reuse - SUNRPC: fix expiry of auth creds - NFSv4: Fix races in the legacy idmapper upcall - NFS: O_DIRECT fixes from Jeff Layton - NFSv4.1: Fix OP_SEQUENCE error handling - SUNRPC: Fix an RPC/RDMA performance regression - NFS: Fix case insensitive renames - NFSv4/pnfs: Fix a use-after-free bug in open - NFSv4.1: RECLAIM_COMPLETE must handle EACCES Features: - NFSv4.1: session trunking enhancements - NFSv4.2: READ_PLUS performance optimisations - NFS: relax the rules for rsize/wsize mount options - NFS: don't unhash dentry during unlink/rename - SUNRPC: Fail faster on bad verifier - NFS/SUNRPC: Various tracing improvements" * tag 'nfs-for-5.20-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (46 commits) NFS: Improve readpage/writepage tracing NFS: Improve O_DIRECT tracing NFS: Improve write error tracing NFS: don't unhash dentry during unlink/rename NFSv4/pnfs: Fix a use-after-free bug in open NFS: nfs_async_write_reschedule_io must not recurse into the writeback code SUNRPC: Don't reuse bvec on retransmission of the request SUNRPC: Reinitialise the backchannel request buffers before reuse NFSv4.1: RECLAIM_COMPLETE must handle EACCES NFSv4.1 probe offline transports for trunking on session creation SUNRPC create a function that probes only offline transports SUNRPC export xprt_iter_rewind function SUNRPC restructure rpc_clnt_setup_test_and_add_xprt NFSv4.1 remove xprt from xprt_switch if session trunking test fails SUNRPC create an rpc function that allows xprt removal from rpc_clnt SUNRPC enable back offline transports in trunking discovery SUNRPC create an iterator to list only OFFLINE xprts NFSv4.1 offline trunkable transports on DESTROY_SESSION SUNRPC add function to offline remove trunkable transports SUNRPC expose functions for offline remote xprt functionality ... commit 3cbd673846772153a0aa85471aef5788f1a53dcd Author: Conor Dooley Date: Wed Aug 10 15:02:44 2022 +0100 MAINTAINERS: add the Polarfire SoC's i2c driver Add the newly added i2c controller driver to the existing entry for PolarFire SoC. Signed-off-by: Conor Dooley Acked-by: Wolfram Sang Link: https://lore.kernel.org/r/20220810140243.2685416-3-conor.dooley@microchip.com' Signed-off-by: Arnd Bergmann commit fd7cb3e4684f0c044a627dc33adb9f97c69f033f Author: Conor Dooley Date: Wed Aug 10 15:02:43 2022 +0100 MAINTAINERS: add PolarFire SoC dt bindings So far when I added bindings for the platform I never added them to our MAINTAINERS entry. No time like the present to improve the coverage. Suggested-by: Mark Brown Signed-off-by: Conor Dooley Acked-by: Marc Kleine-Budde # for can Acked-by: Uwe Kleine-König CC: Mark Brown CC: Wolfram Sang CC: Thierry Reding CC: Uwe Kleine-König CC: Jassi Brar CC: Linus Walleij CC: Bartosz Golaszewski CC: Greg Kroah-Hartman CC: Arnd Bergmann CC: Olof Johansson CC: Michael Turquette CC: Stephen Boyd Link: https://lore.kernel.org/r/20220810140243.2685416-2-conor.dooley@microchip.com' Signed-off-by: Arnd Bergmann commit ad2feebd71ff80532dff75756d1103f056358614 Author: Sebin Sebastian Date: Sat Jul 30 09:16:58 2022 +0530 drm/amdgpu: double free error and freeing uninitialized null pointer Fix a double free and an uninitialized pointer read error. Both tmp and new are pointing at same address and both are freed which leads to double free. Adding a check to verify if new and tmp are free in the error_free label fixes the double free issue. new is not initialized to null which also leads to a free on an uninitialized pointer. Reviewed-by: André Almeida Suggested by: S. Amaranath Signed-off-by: Sebin Sebastian Signed-off-by: Alex Deucher commit a6250bdb6c4677ee77d699b338e077b900f94c0c Author: Alex Deucher Date: Tue Aug 9 11:44:05 2022 -0400 drm/amdgpu: Only disable prefer_shadow on hawaii We changed it for all asics due to a hibernation regression on hawaii, but the workaround breaks suspend on a polaris12. Just disable it for hawaii. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216119 Fixes: 3a4b1cc28fbd ("drm/amdgpu/display: disable prefer_shadow for generic fb helpers") Reviewed-and-tested-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit acc96ae0d12783e9781428b17e34fd662a904f0a Author: Melissa Wen Date: Thu Aug 4 15:13:49 2022 -0100 drm/amd/display: set panel orientation before drm_dev_register To set the panel orientation property with quirk, we need the mode size provided by EDID. This info is available after EDID is read by dc_link_detect() and updated by amdgpu_dm_update_connector_after_detect(). The detection happens at driver load in amdgpu_dm_initialize_drm_device() and, therefore, we can get modes and set panel orientation before drm_dev_register() to avoid DRM warns on creating the connector property after device registration: [ 2.563969] ------------[ cut here ]------------ [ 2.563971] WARNING: CPU: 6 PID: 325 at drivers/gpu/drm/drm_mode_object.c:45 drm_mode_object_add+0x72/0x80 [drm] [ 2.563997] Modules linked in: btusb btrtl btbcm btintel btmtk bluetooth rfkill ecdh_generic ecc usbhid crc16 amdgpu(+) drm_ttm_helper ttm agpgart gpu_sched i2c_algo_bit drm_display_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm serio_raw sdhci_pci atkbd libps2 cqhci vivaldi_fmap ccp sdhci i8042 crct10dif_pclmul crc32_pclmul hid_multitouch ghash_clmulni_intel aesni_intel crypto_simd cryptd wdat_wdt mmc_core cec xhci_pci sp5100_tco rng_core xhci_pci_renesas serio 8250_dw i2c_hid_acpi i2c_hid btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_mirror dm_region_hash dm_log dm_mod pkcs8_key_parser crypto_user [ 2.564032] CPU: 6 PID: 325 Comm: systemd-udevd Not tainted 5.18.0-amd-staging-drm-next+ #67 [ 2.564034] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0105 03/21/2022 [ 2.564036] RIP: 0010:drm_mode_object_add+0x72/0x80 [drm] [ 2.564053] Code: f0 89 c3 85 c0 78 07 89 45 00 44 89 65 04 4c 89 ef e8 e2 99 04 f1 31 c0 85 db 0f 4e c3 5b 5d 41 5c 41 5d c3 80 7f 50 00 74 ac <0f> 0b eb a8 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 4c [ 2.564055] RSP: 0018:ffffb2e880413860 EFLAGS: 00010202 [ 2.564056] RAX: ffffffffc0ba1440 RBX: ffff99508a860010 RCX: 0000000000000001 [ 2.564057] RDX: 00000000b0b0b0b0 RSI: ffff99508c050110 RDI: ffff99508a860010 [ 2.564058] RBP: ffff99508c050110 R08: 0000000000000020 R09: ffff99508c292c20 [ 2.564059] R10: 0000000000000000 R11: ffff99508c0507d8 R12: 00000000b0b0b0b0 [ 2.564060] R13: 0000000000000004 R14: ffffffffc068a4b6 R15: ffffffffc068a47f [ 2.564061] FS: 00007fc69b5f1a40(0000) GS:ffff9953aff80000(0000) knlGS:0000000000000000 [ 2.564063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.564063] CR2: 00007f9506804000 CR3: 0000000107f92000 CR4: 0000000000350ee0 [ 2.564065] Call Trace: [ 2.564068] [ 2.564070] drm_property_create+0xc9/0x170 [drm] [ 2.564088] drm_property_create_enum+0x1f/0x70 [drm] [ 2.564105] drm_connector_set_panel_orientation_with_quirk+0x96/0xc0 [drm] [ 2.564123] get_modes+0x4fb/0x530 [amdgpu] [ 2.564378] drm_helper_probe_single_connector_modes+0x1ad/0x850 [drm_kms_helper] [ 2.564390] drm_client_modeset_probe+0x229/0x1400 [drm] [ 2.564411] ? xas_store+0x52/0x5e0 [ 2.564416] ? kmem_cache_alloc_trace+0x177/0x2c0 [ 2.564420] __drm_fb_helper_initial_config_and_unlock+0x44/0x4e0 [drm_kms_helper] [ 2.564430] drm_fbdev_client_hotplug+0x173/0x210 [drm_kms_helper] [ 2.564438] drm_fbdev_generic_setup+0xa5/0x166 [drm_kms_helper] [ 2.564446] amdgpu_pci_probe+0x35e/0x370 [amdgpu] [ 2.564621] local_pci_probe+0x45/0x80 [ 2.564625] ? pci_match_device+0xd7/0x130 [ 2.564627] pci_device_probe+0xbf/0x220 [ 2.564629] ? sysfs_do_create_link_sd+0x69/0xd0 [ 2.564633] really_probe+0x19c/0x380 [ 2.564637] __driver_probe_device+0xfe/0x180 [ 2.564639] driver_probe_device+0x1e/0x90 [ 2.564641] __driver_attach+0xc0/0x1c0 [ 2.564643] ? __device_attach_driver+0xe0/0xe0 [ 2.564644] ? __device_attach_driver+0xe0/0xe0 [ 2.564646] bus_for_each_dev+0x78/0xc0 [ 2.564648] bus_add_driver+0x149/0x1e0 [ 2.564650] driver_register+0x8f/0xe0 [ 2.564652] ? 0xffffffffc1023000 [ 2.564654] do_one_initcall+0x44/0x200 [ 2.564657] ? kmem_cache_alloc_trace+0x177/0x2c0 [ 2.564659] do_init_module+0x4c/0x250 [ 2.564663] __do_sys_init_module+0x12e/0x1b0 [ 2.564666] do_syscall_64+0x3b/0x90 [ 2.564670] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2.564673] RIP: 0033:0x7fc69bff232e [ 2.564674] Code: 48 8b 0d 45 0b 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 12 0b 0c 00 f7 d8 64 89 01 48 [ 2.564676] RSP: 002b:00007ffe872ba3e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af [ 2.564677] RAX: ffffffffffffffda RBX: 000055873f797820 RCX: 00007fc69bff232e [ 2.564678] RDX: 000055873f7bf390 RSI: 0000000001155e81 RDI: 00007fc699e4d010 [ 2.564679] RBP: 00007fc699e4d010 R08: 000055873f7bfe20 R09: 0000000001155e90 [ 2.564680] R10: 000000055873f7bf R11: 0000000000000246 R12: 000055873f7bf390 [ 2.564681] R13: 000000000000000d R14: 000055873f7c4cb0 R15: 000055873f797820 [ 2.564683] [ 2.564683] ---[ end trace 0000000000000000 ]--- [ 2.564696] ------------[ cut here ]------------ [ 2.564696] WARNING: CPU: 6 PID: 325 at drivers/gpu/drm/drm_mode_object.c:242 drm_object_attach_property+0x52/0x80 [drm] [ 2.564717] Modules linked in: btusb btrtl btbcm btintel btmtk bluetooth rfkill ecdh_generic ecc usbhid crc16 amdgpu(+) drm_ttm_helper ttm agpgart gpu_sched i2c_algo_bit drm_display_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm serio_raw sdhci_pci atkbd libps2 cqhci vivaldi_fmap ccp sdhci i8042 crct10dif_pclmul crc32_pclmul hid_multitouch ghash_clmulni_intel aesni_intel crypto_simd cryptd wdat_wdt mmc_core cec xhci_pci sp5100_tco rng_core xhci_pci_renesas serio 8250_dw i2c_hid_acpi i2c_hid btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_mirror dm_region_hash dm_log dm_mod pkcs8_key_parser crypto_user [ 2.564738] CPU: 6 PID: 325 Comm: systemd-udevd Tainted: G W 5.18.0-amd-staging-drm-next+ #67 [ 2.564740] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0105 03/21/2022 [ 2.564741] RIP: 0010:drm_object_attach_property+0x52/0x80 [drm] [ 2.564759] Code: 2d 83 f8 18 74 33 48 89 74 c1 08 48 8b 4f 08 48 89 94 c1 c8 00 00 00 48 8b 47 08 83 00 01 c3 4d 85 d2 75 dd 83 7f 58 01 75 d7 <0f> 0b eb d3 41 80 78 50 00 74 cc 0f 0b eb c8 44 89 ce 48 c7 c7 28 [ 2.564760] RSP: 0018:ffffb2e8804138d8 EFLAGS: 00010246 [ 2.564761] RAX: 0000000000000010 RBX: ffff99508c1a2000 RCX: ffff99508c1a2180 [ 2.564762] RDX: 0000000000000003 RSI: ffff99508c050100 RDI: ffff99508c1a2040 [ 2.564763] RBP: 00000000ffffffff R08: ffff99508a860010 R09: 00000000c0c0c0c0 [ 2.564763] R10: 0000000000000000 R11: 0000000000000020 R12: ffff99508a860010 [ 2.564764] R13: ffff995088733008 R14: ffff99508c1a2000 R15: ffffffffc068a47f [ 2.564765] FS: 00007fc69b5f1a40(0000) GS:ffff9953aff80000(0000) knlGS:0000000000000000 [ 2.564766] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.564767] CR2: 00007f9506804000 CR3: 0000000107f92000 CR4: 0000000000350ee0 [ 2.564768] Call Trace: [ 2.564769] [ 2.564770] drm_connector_set_panel_orientation_with_quirk+0x4a/0xc0 [drm] [ 2.564789] get_modes+0x4fb/0x530 [amdgpu] [ 2.565024] drm_helper_probe_single_connector_modes+0x1ad/0x850 [drm_kms_helper] [ 2.565036] drm_client_modeset_probe+0x229/0x1400 [drm] [ 2.565056] ? xas_store+0x52/0x5e0 [ 2.565060] ? kmem_cache_alloc_trace+0x177/0x2c0 [ 2.565062] __drm_fb_helper_initial_config_and_unlock+0x44/0x4e0 [drm_kms_helper] [ 2.565072] drm_fbdev_client_hotplug+0x173/0x210 [drm_kms_helper] [ 2.565080] drm_fbdev_generic_setup+0xa5/0x166 [drm_kms_helper] [ 2.565088] amdgpu_pci_probe+0x35e/0x370 [amdgpu] [ 2.565261] local_pci_probe+0x45/0x80 [ 2.565263] ? pci_match_device+0xd7/0x130 [ 2.565265] pci_device_probe+0xbf/0x220 [ 2.565267] ? sysfs_do_create_link_sd+0x69/0xd0 [ 2.565268] really_probe+0x19c/0x380 [ 2.565270] __driver_probe_device+0xfe/0x180 [ 2.565272] driver_probe_device+0x1e/0x90 [ 2.565274] __driver_attach+0xc0/0x1c0 [ 2.565276] ? __device_attach_driver+0xe0/0xe0 [ 2.565278] ? __device_attach_driver+0xe0/0xe0 [ 2.565279] bus_for_each_dev+0x78/0xc0 [ 2.565281] bus_add_driver+0x149/0x1e0 [ 2.565283] driver_register+0x8f/0xe0 [ 2.565285] ? 0xffffffffc1023000 [ 2.565286] do_one_initcall+0x44/0x200 [ 2.565288] ? kmem_cache_alloc_trace+0x177/0x2c0 [ 2.565290] do_init_module+0x4c/0x250 [ 2.565291] __do_sys_init_module+0x12e/0x1b0 [ 2.565294] do_syscall_64+0x3b/0x90 [ 2.565296] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2.565297] RIP: 0033:0x7fc69bff232e [ 2.565298] Code: 48 8b 0d 45 0b 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 12 0b 0c 00 f7 d8 64 89 01 48 [ 2.565299] RSP: 002b:00007ffe872ba3e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af [ 2.565301] RAX: ffffffffffffffda RBX: 000055873f797820 RCX: 00007fc69bff232e [ 2.565302] RDX: 000055873f7bf390 RSI: 0000000001155e81 RDI: 00007fc699e4d010 [ 2.565303] RBP: 00007fc699e4d010 R08: 000055873f7bfe20 R09: 0000000001155e90 [ 2.565303] R10: 000000055873f7bf R11: 0000000000000246 R12: 000055873f7bf390 [ 2.565304] R13: 000000000000000d R14: 000055873f7c4cb0 R15: 000055873f797820 [ 2.565306] [ 2.565307] ---[ end trace 0000000000000000 ]--- -- v2: - call amdgpu_dm_connector_get_modes() instead of ddc_get_modes() (Harry) Fixes: d77de7880e0e0 ("amd/display: enable panel orientation quirks") Acked-by: Hans de Goede Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit 541d54e40f1672dea6514ad64d54d61ed952648e Author: Zhen Ni Date: Wed Aug 3 17:19:59 2022 +0800 drm/amd/pm: Fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in smu_v13_0_5_init_smc_tables(), but not freed in smu_v13_0_5_fini_smc_tables(). This may cause memory leaks, fix it. Reviewed-by: Evan Quan Signed-off-by: Zhen Ni Signed-off-by: Alex Deucher commit 5afb76522a0af0513b6dc01f84128a73206b051b Author: Zhen Ni Date: Wed Aug 3 17:19:58 2022 +0800 drm/amd/pm: Fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in smu_v13_0_4_init_smc_tables(), but not freed in smu_v13_0_4_fini_smc_tables(). This may cause memory leaks, fix it. Reviewed-by: Evan Quan Signed-off-by: Zhen Ni Signed-off-by: Alex Deucher commit dc0a096bcc1d659ae93f836099c6b0312d2ccaaf Author: Tim Huang Date: Fri Jul 29 15:25:57 2022 +0800 drm/amdgpu: add GFX Power Gating support for GC IP v11.0.1 Add AMD_PG_SUPPORT_GFX_PG support. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cb9c7ab1b3ddc2702379dd9639df0c2230453c2e Author: Tim Huang Date: Fri Jul 29 18:37:27 2022 +0800 drm/amdgpu: enable GFX Power Gating for GC IP v11.0.1 Enable GFX Power Gating control for GC IP v11.0.1. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit bea9a56afbc4b5a41ea579b8b0dc5e189b439504 Author: Felix Kuehling Date: Thu Aug 4 18:19:38 2022 -0400 drm/amdkfd: Handle restart of kfd_ioctl_wait_events When kfd_ioctl_wait_events needs to restart due to a signal, we need to update the timeout to account for the time already elapsed. We also need to undo auto_reset of events that have signaled already, so that the restarted ioctl will be able to count those signals again. This fixes infinite hangs when kfd_ioctl_wait_events is interrupted by a signal. Signed-off-by: Felix Kuehling Reviewed-and-tested-by: Xiaogang Chen Signed-off-by: Alex Deucher commit c4c10a68e82b8a03df234ee744acabcc648df270 Author: Rajneesh Bhardwaj Date: Wed Apr 20 09:37:56 2022 -0400 drm/amdgpu: Avoid direct cast to amdgpu_ttm_tt For typesafety, use container_of() instead of implicit cast from struct ttm_tt to struct amdgpu_ttm_tt. Reviewed-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Alex Deucher commit 4e64b529c5b04e7944b41de554ee686ecab00744 Author: Kenneth Feng Date: Tue Aug 9 10:13:54 2022 +0800 drm/amd/pm: skip pptable override for smu_v13_0_7 skip pptable override for smu_v13_0_7 secure boards only. Signed-off-by: Kenneth Feng Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit b7ffeb4a1b5bce1a7495636d21f1704bd7ff01d3 Author: Evan Quan Date: Thu Jul 28 17:44:44 2022 +0800 drm/amd/pm: add 3715 softpptable support for SMU13.0.0 Add support for 3715 softpptable. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 352e683b72e79dbd46cbde528eb91e228e88267a Author: Joseph Greathouse Date: Thu Aug 4 09:54:57 2022 -0500 drm/amdgpu: Enable translate_further to extend UTCL2 reach Enable translate_further on Arcturus and Aldebaran server chips in order to increase the UTCL2 reach from 8 GiB to 64 GiB, which is more in line with the amount of framebuffer DRAM in the devices. Signed-off-by: Joseph Greathouse Acked-by: Felix Kuehling Acked-by: Kent Russell Acked-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8da536d5e114ad1da6028c7505f048ded2e421c6 Author: Aric Cyr Date: Mon Jul 25 01:54:00 2022 -0400 drm/amd/display: 3.2.197 This version brings along following fixes: - Move fpu file to dml folder - Fix CAB allocation for multiple displays - Add a variable to update FCLK - Fix TMDS 4K@60Hz YCbCr420 corruption issue - Fix MPC tree infinite loop in some case - Fix HDMI VSIF V3 blank screen issue - Add some documentation to the code - Allow alternate prefetch modes in DML for DCN32 - Fix VPG instancing for dcn314 HPO - Check correct bounds for stream encoder instances for DCN303 - Enable SubVP by default on DCN32 & DCN321 - Fix DTBCLK not correct for dcn314 - Fix Compile-time warning - Fix the stereo mode hang issue - Fix display light up issue Acked-by: Tom Chung Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9f5171ce733a694bd0211952687704c7a5bf32b9 Author: Alvin Lee Date: Thu Jul 21 10:23:41 2022 -0400 drm/amd/display: Add 16 lines margin for SubVP [Description] SUBVP_START_LINE must be aligned to 2 swaths, so add 16 lines of margin so the start line can be adjusted by up to 16 lines for alignment purposes in FW. Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 30456ffa65469d1d2e5e1da05017e6728d24c11c Author: Meenakshikumar Somasundaram Date: Mon Jul 11 18:37:41 2022 -0400 drm/amd/display: Fix TDR eDP and USB4 display light up issue [Why] After TDR recovery, eDP and USB4 display does not light up. Because dmub outbox notifications are not enabled after dmub reload and link encoder assignments for the streams are not cleared before dc state reset. [How] - Dmub outbox notification is enabled after tdr recovery by issuing inbox command to dmub. - Link encoders for the streams are unassigned before dc state reset. Reviewed-by: Jimmy Kizito Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: Meenakshikumar Somasundaram Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b2a93490201300a749ad261b5c5d05cb50179c44 Author: Fudong Wang Date: Wed Jul 27 12:01:29 2022 +0800 drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off. Reviewed-by: Alvin Lee Acked-by: Tom Chung Signed-off-by: Fudong Wang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f0068dd0effd5972046b69b23f99c43251e82d0e Author: Alvin Lee Date: Thu Jul 28 10:02:25 2022 -0400 drm/amd/display: Don't try to enter MALL SS if stereo3d [Description] MALL not supported with stereo3D according to DCN doc. Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 84ef99c728079dfd21d6bc70b4c3e4af20602b3c Author: Alvin Lee Date: Thu Jul 28 09:51:05 2022 -0400 drm/amd/display: For stereo keep "FLIP_ANY_FRAME" [Description] Observed in stereomode that programming FLIP_LEFT_EYE can cause hangs. Keep FLIP_ANY_FRAME in stereo mode so the surface flip can take place before left or right eye Reviewed-by: Martin Leung Acked-by: Tom Chung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 764a1e6e0272f377f145fc84b547d61e12724233 Author: Alvin Lee Date: Tue Jul 26 19:00:23 2022 -0400 drm/amd/display: Revert "attempt to fix the logic in commit_planes_for_stream()" [Description] Reverts commit "attempt to fix the logic in commit_planes_for_stream()" since it caused a regression. Reviewed-by: Martin Leung Acked-by: Tom Chung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2051160546826cf312f15bde534038582b90f844 Author: Duncan Ma Date: Wed Jul 27 15:44:43 2022 -0400 drm/amd/display: Correct DTBCLK for dcn314 [Why] DTBCLK clocks reset after clocks are initialized and bounding box values are also incorrect. [How] Use dcn31 init clock function programming sequence and correct bounding box values for dcn314 Reviewed-by: Nicholas Kazlauskas Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: Duncan Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f173c7405224002fc32b64cf1679c4d888c493eb Author: Aurabindo Pillai Date: Tue Jul 26 14:12:29 2022 -0400 drm/amd/display: Enable SubVP by default on DCN32 & DCN321 [Why&How] Set the debug options to enable SubVP feature Reviewed-by: Alvin Lee Acked-by: Tom Chung Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 89b008222c2bf21e50219725caed31590edfd9d1 Author: Aurabindo Pillai Date: Tue Jul 26 13:13:27 2022 -0400 drm/amd/display: Check correct bounds for stream encoder instances for DCN303 [Why & How] eng_id for DCN303 cannot be more than 1, since we have only two instances of stream encoders. Check the correct boundary condition for engine ID for DCN303 prevent the potential out of bounds access. Fixes: cd6d421e3d1a ("drm/amd/display: Initial DC support for Beige Goby") Reported-by: Dan Carpenter Cc: stable@vger.kernel.org Reviewed-by: Chris Park Reviewed-by: Rodrigo Siqueira Acked-by: Tom Chung Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6396679a1f2db0c63721b841f1a5617d6282a4b1 Author: Duncan Ma Date: Mon Jul 25 15:26:39 2022 -0400 drm/amd/display: Fix VPG instancing for dcn314 HPO [Why] An issue during VPG indexing offset generation causing to use the incorrect VPG. HW team placed VPG instances 5 at end of list, making it VPG 9 in register headers. [How] Correct VPG instance for HPO encoders. Reviewed-by: Charlene Liu Acked-by: Tom Chung Signed-off-by: Duncan Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dd07556324ece81f0d2be756508903d53e331e9e Author: David Galiffi Date: Fri Jul 22 16:03:13 2022 -0400 drm/amd/display: Fix Compile-time Warning Fixed bracketing around condition statement. Reviewed-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: David Galiffi Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 86678d46272021c88638881c63d427dd10d665d6 Author: David Galiffi Date: Wed Jul 20 17:54:05 2022 -0400 drm/amd/display: Allow alternate prefetch modes in DML for DCN32 [Why] Driver is restricting voltage levels if system cannot switch in vblank. [How] Change allow_for_pstate_or_stutter_in_vblank_final from dm_prefetch_support_uclk_fclk_and_stutter to dm_prefetch_support_uclk_fclk_and_stutter_if_possible. Add support for a new registry property, DalDMLDisallowAlternatePrefetchModes, for easier debugging. Reviewed-by: Alvin Lee Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: David Galiffi Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0591183699fceeafb4c4141072d47775de83ecfb Author: Leo Ma Date: Fri Jul 22 13:42:58 2022 -0400 drm/amd/display: Fix HDMI VSIF V3 incorrect issue [Why] Reported from customer the checksum in AMD VSIF V3 is incorrect and causing blank screen issue. [How] Fix the packet length issue on AMD HDMI VSIF V3. Reviewed-by: Anthony Koo Acked-by: Tom Chung Signed-off-by: Leo Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 615fc50207fa27453ba7f5fa1abd60a01a498136 Author: Josip Pavic Date: Thu Jul 21 15:33:00 2022 -0400 drm/amd/display: Avoid MPC infinite loop [Why] In some cases MPC tree bottom pipe ends up point to itself. This causes iterating from top to bottom to hang the system in an infinite loop. [How] When looping to next MPC bottom pipe, check that the pointer is not same as current to avoid infinite loop. Reviewed-by: Jun Lei Acked-by: Tom Chung Signed-off-by: Josip Pavic Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9c580e8f6cd6524d4e2c3490c440110526f7ddd6 Author: Chiawen Huang Date: Thu Jul 21 21:57:05 2022 +0800 drm/amd/display: Device flash garbage before get in OS [Why] Enabling stream with tg lock makes config settings pending causing the garbage until tg unlock. [How] Keep the original lock mechanism The driver doesn't lock tg if plane_state is null. Reviewed-by: Anthony Koo Acked-by: Tom Chung Signed-off-by: Chiawen Huang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9bd110ab06e93fd01938dedd8b6015940418f0fb Author: Daniel Miess Date: Tue Jul 19 11:43:28 2022 -0400 drm/amd/display: Fix TMDS 4K@60Hz YCbCr420 corruption issue [Why] DIG_FIFO_OUTPUT_PIXEL_MODE not being set for dcn314 resulting in incorrect timing for YCbCr4:2:0 [How] Copy the implementation of set_pixels_per_cycle from dcn32 over to dcn314 Reviewed-by: Nicholas Kazlauskas Acked-by: Tom Chung Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0cd34ce82b0a9ce503d35a51bff47ba3b6715557 Author: Alvin Lee Date: Wed Jul 20 13:16:59 2022 -0400 drm/amd/display: Add a variable to update FCLK latency [Description] Add a variable to update FCLK latency Reviewed-by: Martin Leung Acked-by: Tom Chung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2de09ce41f484cbcc65e518905dae73da67ad35c Author: Aurabindo Pillai Date: Fri Jul 15 14:59:26 2022 -0400 drm/amd/display: fix CAB allocation for multiple displays [Why & How] When multiple displays are used, the underlying framebuffers could be two separate framebuffers, or a single large framebuffer. Fix the calculation logic for CAB to account for large framebuffer. Current logic assumes that any FB that the plane points to are independent. When a single FB is used on the system, this does 2 times allocation. Add a check to prevent duplicate allocation by checking if the base addresses are the same, and then ensuring that the if we allocate using the pitch, whole of the other fbs will be accounted for in the first allocation. Reviewed-by: Alvin Lee Acked-by: Tom Chung Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0af167f92838f34e594e49a6c8cbaca45548e030 Author: Rodrigo Siqueira Date: Tue Jul 19 17:02:56 2022 -0400 drm/amd/display: Drop FPU flags from Makefile At this point, we isolate the FPU code associated with DCN314 under the DML folder. This commit drops the FPU flags from the Makefile. Reviewed-by: Nicholas Kazlauskas Acked-by: Tom Chung Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 67c79599eea167dd5e08314b8c26f2dfa717753a Author: Rodrigo Siqueira Date: Tue Jul 19 16:57:23 2022 -0400 drm/amd/display: Move populate dml pipes from DCN314 to dml The function responsible for populating DML pipes has some FPU operations, and for this reason, it must be moved to the dml folder. This commit moves such function from resource to the fpu file under the dml folder. Reviewed-by: Nicholas Kazlauskas Acked-by: Tom Chung Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4c3861f587400db00801810eb8034c7b480e21dd Author: Rodrigo Siqueira Date: Tue Jul 19 16:28:50 2022 -0400 drm/amd/display: Create FPU files for DCN314 DCN314 has multiple references to FPU operations inside the resource files, and we need to move those codes to the DML folder. This commit creates the dcn314_fpu files and moves the bounding box operation to this file. Reviewed-by: Nicholas Kazlauskas Acked-by: Tom Chung Signed-off-by: Rodrigo Siqueira Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 89390c4982b77c159e3b8a0be4a04552ef0971a0 Author: Daniel Miess Date: Tue Jul 19 14:07:41 2022 -0400 drm/amd/display: Use pixels per container logic for DCN314 DCCG dividers [Why] DP DSC YCbCr422 not working because dcn314_calculate_dccg_k1_k2_values does not account for two pixels per container [How] Replace the contents of dcn314_calculate_dccg_k1_k2_values with the code from the function dcn32_calculate_dccg_k1_k2_values Reviewed-by: Charlene Liu Acked-by: Tom Chung Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1ff77beac87682c22f99e5cf32614909c65b4a36 Author: Tim Huang Date: Fri Aug 5 15:31:37 2022 +0800 drm/amdgpu/pm: remove EnableGfxOff message for SMU IP v13.0.4 The EnableGfxOff message is dropped from the new PMFW ppsmc interface. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 64234eabb8f38ac2bf77dd23140887d81acaabe2 Author: Tim Huang Date: Fri Aug 5 15:16:16 2022 +0800 drm/amdgpu/pm: update smu driver interface header for SMU IP v13.0.4 Update the SmuMetrics_t defination and SMU driver interface version. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit fb1a140b7bd19c474a41fb2df8a845e8eba328fa Author: Tim Huang Date: Fri Jul 29 15:37:06 2022 +0800 drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.1 Enable GFX CG gate/ungate control. Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 8df436d5ccdf7f441becb8e8156c8ca9c4276e8c Author: Tim Huang Date: Fri Jul 29 15:05:58 2022 +0800 drm/amdgpu: add GFX Clock Gating support for GC IP v11.0.1 Add below GFX Clock Gating supports: 1. GFX Coarse Grain Clock Gating(CGCG) 2. GFX Coarse grain light sleep/deep sleep(CGLS) 3. GFX Medium Grain Clock Gating(MGCG) 4. GFX Fine Grain Clock Gating(FGCG) 5. Repeater Fine Grain Clock Gating 6. Perfmon Clock Gating Signed-off-by: Tim Huang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 08ebadfcd8c8c1cc7a14a7581db8331147b85fbb Author: Yifan Zhang Date: Thu Aug 4 16:44:56 2022 +0800 drm/amd/display: change family id name for DCN314 GC version is 11.0.1 rather than 11.0.2 Signed-off-by: Yifan Zhang Reviewed-by: Roman Li Signed-off-by: Alex Deucher commit 616699d77b3813c24bf46090e722da227bd56cbf Author: Ma Jun Date: Mon Aug 1 09:52:47 2022 +0800 drm/amdgpu: Remove redundant reference of header file Remove redundant reference of header file dev_printk.h Signed-off-by: Ma Jun Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit 6348aafa8d24c156124f76b5a1507079c3213112 Author: Sean Christopherson Date: Wed Jul 27 23:34:24 2022 +0000 KVM: VMX: Adjust number of LBR records for PERF_CAPABILITIES at refresh Now that the PMU is refreshed when MSR_IA32_PERF_CAPABILITIES is written by host userspace, zero out the number of LBR records for a vCPU during PMU refresh if PMU_CAP_LBR_FMT is not set in PERF_CAPABILITIES instead of handling the check at run-time. guest_cpuid_has() is expensive due to the linear search of guest CPUID entries, intel_pmu_lbr_is_enabled() is checked on every VM-Enter, _and_ simply enumerating the same "Model" as the host causes KVM to set the number of LBR records to a non-zero value. Signed-off-by: Sean Christopherson Message-Id: <20220727233424.2968356-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 7de8e5b6b139a3a94aca24e8d8d35b77dc33e0ac Author: Sean Christopherson Date: Wed Jul 27 23:34:23 2022 +0000 KVM: VMX: Use proper type-safe functions for vCPU => LBRs helpers Turn vcpu_to_lbr_desc() and vcpu_to_lbr_records() into functions in order to provide type safety, to document exactly what they return, and to allow consuming the helpers in vmx.h. Move the definitions as necessary (the macros "reference" to_vmx() before its definition). No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220727233424.2968356-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 17a024a8b981243fa1d17cf0084de43cc5f9b603 Author: Sean Christopherson Date: Wed Jul 27 23:34:22 2022 +0000 KVM: x86: Refresh PMU after writes to MSR_IA32_PERF_CAPABILITIES Refresh the PMU if userspace modifies MSR_IA32_PERF_CAPABILITIES. KVM consumes the vCPU's PERF_CAPABILITIES when enumerating PEBS support, but relies on CPUID updates to refresh the PMU. I.e. KVM will do the wrong thing if userspace stuffs PERF_CAPABILITIES _after_ setting guest CPUID. Opportunistically fix a curly-brace indentation. Fixes: c59a1f106f5c ("KVM: x86/pmu: Add IA32_PEBS_ENABLE MSR emulation for extended PEBS") Cc: Like Xu Signed-off-by: Sean Christopherson Message-Id: <20220727233424.2968356-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 9d27d46160737fc0da7c6b7b9b44ec5135322d2c Author: Sean Christopherson Date: Thu Aug 4 12:18:15 2022 -0700 KVM: selftests: Test all possible "invalid" PERF_CAPABILITIES.LBR_FMT vals Test all possible input values to verify that KVM rejects all values except the exact host value. Due to the LBR format affecting the core functionality of LBRs, KVM can't emulate "other" formats, so even though there are a variety of legal values, KVM should reject anything but an exact host match. Suggested-by: Like Xu Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 0fcc102923dee97bf33bd199d5b26a6735e16097 Author: Gavin Shan Date: Wed Aug 10 18:41:14 2022 +0800 KVM: selftests: Use getcpu() instead of sched_getcpu() in rseq_test sched_getcpu() is glibc dependent and it can simply return the CPU ID from the registered rseq information, as Florian Weimer pointed. In this case, it's pointless to compare the return value from sched_getcpu() and that fetched from the registered rseq information. Fix the issue by replacing sched_getcpu() with getcpu(), as Florian suggested. The comments are modified accordingly by replacing "sched_getcpu()" with "getcpu()". Reported-by: Yihuang Yu Suggested-by: Florian Weimer Suggested-by: Mathieu Desnoyers Suggested-by: Sean Christopherson Signed-off-by: Gavin Shan Message-Id: <20220810104114.6838-3-gshan@redhat.com> Signed-off-by: Paolo Bonzini commit 66d42ac73fc680dbd7a1402f8b44967426522d0f Author: Gavin Shan Date: Wed Aug 10 18:41:13 2022 +0800 KVM: selftests: Make rseq compatible with glibc-2.35 The rseq information is registered by TLS, starting from glibc-2.35. In this case, the test always fails due to syscall(__NR_rseq). For example, on RHEL9.1 where upstream glibc-2.35 features are enabled on downstream glibc-2.34, the test fails like below. # ./rseq_test ==== Test Assertion Failure ==== rseq_test.c:60: !r pid=112043 tid=112043 errno=22 - Invalid argument 1 0x0000000000401973: main at rseq_test.c:226 2 0x0000ffff84b6c79b: ?? ??:0 3 0x0000ffff84b6c86b: ?? ??:0 4 0x0000000000401b6f: _start at ??:? rseq failed, errno = 22 (Invalid argument) # rpm -aq | grep glibc-2 glibc-2.34-39.el9.aarch64 Fix the issue by using "../rseq/rseq.c" to fetch the rseq information, registred by TLS if it exists. Otherwise, we're going to register our own rseq information as before. Reported-by: Yihuang Yu Suggested-by: Florian Weimer Suggested-by: Mathieu Desnoyers Suggested-by: Paolo Bonzini Signed-off-by: Gavin Shan Message-Id: <20220810104114.6838-2-gshan@redhat.com> Signed-off-by: Paolo Bonzini commit b74ed7a68ec183403763571a54ca3dcc24cf19eb Author: Oliver Upton Date: Wed Jul 20 09:22:51 2022 +0000 KVM: Actually create debugfs in kvm_create_vm() Doing debugfs creation after vm creation leaves things in a quasi-initialized state for a while. This is further complicated by the fact that we tear down debugfs from kvm_destroy_vm(). Align debugfs and stats init/destroy with the vm init/destroy pattern to avoid any headaches. Note the fix for a benign mistake in error handling for calls to kvm_arch_create_vm_debugfs() rolled in. Since all implementations of the function return 0 unconditionally it isn't actually a bug at the moment. Lastly, tear down debugfs/stats data in the kvm_create_vm_debugfs() error path. Previously it was safe to assume that kvm_destroy_vm() would take out the garbage, that is no longer the case. Signed-off-by: Oliver Upton Message-Id: <20220720092259.3491733-6-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 59f82aad5940ffd0fedfe07ff755168722193d56 Author: Oliver Upton Date: Wed Jul 20 09:22:50 2022 +0000 KVM: Pass the name of the VM fd to kvm_create_vm_debugfs() At the time the VM fd is used in kvm_create_vm_debugfs(), the fd has been allocated but not yet installed. It is only really useful as an identifier in strings for the VM (such as debugfs). Treat it exactly as such by passing the string name of the fd to kvm_create_vm_debugfs(), futureproofing against possible misuse of the VM fd. Suggested-by: Sean Christopherson Signed-off-by: Oliver Upton Message-Id: <20220720092259.3491733-5-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 20020f4cf2f92115c34b7bbaea02fcc810709a7e Author: Oliver Upton Date: Wed Jul 20 09:22:49 2022 +0000 KVM: Get an fd before creating the VM Allocate a VM's fd at the very beginning of kvm_dev_ioctl_create_vm() so that KVM can use the fd value to generate strigns, e.g. for debugfs, when creating and initializing the VM. Signed-off-by: Oliver Upton Message-Id: <20220720092259.3491733-4-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 58fc116645c53db117c8e6c7b549b228e24a6c73 Author: Oliver Upton Date: Wed Jul 20 09:22:48 2022 +0000 KVM: Shove vcpu stats_id init into kvm_vcpu_init() Initialize stats_id alongside other kvm_vcpu fields to make it more difficult to unintentionally access stats_id before it's set. No functional change intended. Signed-off-by: Oliver Upton Message-Id: <20220720092259.3491733-3-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit f2759c08d8f4d584e88d129e7392260fb4079ec2 Author: Oliver Upton Date: Wed Jul 20 09:22:47 2022 +0000 KVM: Shove vm stats_id init into kvm_create_vm() Initialize stats_id alongside other struct kvm fields to make it more difficult to unintentionally access stats_id before it's set. While at it, move the format string to the first line of the call and fix the indentation of the second line. No functional change intended. Signed-off-by: Oliver Upton Message-Id: <20220720092259.3491733-2-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 8bad4606acc91523f54fe4f254fd9f187cd21204 Author: Sean Christopherson Date: Fri Aug 5 19:41:33 2022 +0000 KVM: x86/mmu: Add sanity check that MMIO SPTE mask doesn't overlap gen Add compile-time and init-time sanity checks to ensure that the MMIO SPTE mask doesn't overlap the MMIO SPTE generation or the MMU-present bit. The generation currently avoids using bit 63, but that's as much coincidence as it is strictly necessarly. That will change in the future, as TDX support will require setting bit 63 (SUPPRESS_VE) in the mask. Explicitly carve out the bits that are allowed in the mask so that any future shuffling of SPTE bits doesn't silently break MMIO caching (KVM has broken MMIO caching more than once due to overlapping the generation with other things). Suggested-by: Kai Huang Signed-off-by: Sean Christopherson Reviewed-by: Kai Huang Message-Id: <20220805194133.86299-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1685c0f32554a7f35962061d17155c58454f1cd2 Author: Mingwei Zhang Date: Sun Aug 7 05:21:41 2022 +0000 KVM: x86/mmu: rename trace function name for asynchronous page fault Rename the tracepoint function from trace_kvm_async_pf_doublefault() to trace_kvm_async_pf_repeated_fault() to make it clear, since double fault has nothing to do with this trace function. Asynchronous Page Fault (APF) is an artifact generated by KVM when it cannot find a physical page to satisfy an EPT violation. KVM uses APF to tell the guest OS to do something else such as scheduling other guest processes to make forward progress. However, when another guest process also touches a previously APFed page, KVM halts the vCPU instead of generating a repeated APF to avoid wasting cycles. Double fault (#DF) clearly has a different meaning and a different consequence when triggered. #DF requires two nested contributory exceptions instead of two page faults faulting at the same address. A prevous bug on APF indicates that it may trigger a double fault in the guest [1] and clearly this trace function has nothing to do with it. So rename this function should be a valid choice. No functional change intended. [1] https://www.spinics.net/lists/kvm/msg214957.html Signed-off-by: Mingwei Zhang Message-Id: <20220807052141.69186-1-mizhang@google.com> Signed-off-by: Paolo Bonzini commit c036899136355758dcd88878145036ab4d9c1f26 Author: Coleman Dietsch Date: Mon Aug 8 14:06:07 2022 -0500 KVM: x86/xen: Stop Xen timer before changing IRQ Stop Xen timer (if it's running) prior to changing the IRQ vector and potentially (re)starting the timer. Changing the IRQ vector while the timer is still running can result in KVM injecting a garbage event, e.g. vm_xen_inject_timer_irqs() could see a non-zero xen.timer_pending from a previous timer but inject the new xen.timer_virq. Fixes: 536395260582 ("KVM: x86/xen: handle PV timers oneshot mode") Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=8234a9dfd3aafbf092cc5a7cd9842e3ebc45fc42 Reported-by: syzbot+e54f930ed78eb0f85281@syzkaller.appspotmail.com Signed-off-by: Coleman Dietsch Reviewed-by: Sean Christopherson Acked-by: David Woodhouse Message-Id: <20220808190607.323899-3-dietschc@csp.edu> Signed-off-by: Paolo Bonzini commit af735db31285fa699384c649be72a9f32ecbb665 Author: Coleman Dietsch Date: Mon Aug 8 14:06:06 2022 -0500 KVM: x86/xen: Initialize Xen timer only once Add a check for existing xen timers before initializing a new one. Currently kvm_xen_init_timer() is called on every KVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG crash when vcpu->arch.xen.timer is already set. ODEBUG: init active (active state 0) object type: hrtimer hint: xen_timer_callbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Call Trace: __debug_object_init debug_hrtimer_init debug_init hrtimer_init kvm_xen_init_timer kvm_xen_vcpu_set_attr kvm_arch_vcpu_ioctl kvm_vcpu_ioctl vfs_ioctl Fixes: 536395260582 ("KVM: x86/xen: handle PV timers oneshot mode") Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=8234a9dfd3aafbf092cc5a7cd9842e3ebc45fc42 Reported-by: syzbot+e54f930ed78eb0f85281@syzkaller.appspotmail.com Signed-off-by: Coleman Dietsch Reviewed-by: Sean Christopherson Message-Id: <20220808190607.323899-2-dietschc@csp.edu> Signed-off-by: Paolo Bonzini commit 0c29397ac1fdd64ae59941a477511a05e61a4754 Author: Sean Christopherson Date: Wed Aug 3 22:49:57 2022 +0000 KVM: SVM: Disable SEV-ES support if MMIO caching is disable Disable SEV-ES if MMIO caching is disabled as SEV-ES relies on MMIO SPTEs generating #NPF(RSVD), which are reflected by the CPU into the guest as a #VC. With SEV-ES, the untrusted host, a.k.a. KVM, doesn't have access to the guest instruction stream or register state and so can't directly emulate in response to a #NPF on an emulated MMIO GPA. Disabling MMIO caching means guest accesses to emulated MMIO ranges cause #NPF(!PRESENT), and those flavors of #NPF cause automatic VM-Exits, not #VC. Adjust KVM's MMIO masks to account for the C-bit location prior to doing SEV(-ES) setup, and document that dependency between adjusting the MMIO SPTE mask and SEV(-ES) setup. Fixes: b09763da4dd8 ("KVM: x86/mmu: Add module param to disable MMIO caching (for testing)") Reported-by: Michael Roth Tested-by: Michael Roth Cc: Tom Lendacky Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220803224957.1285926-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c3e0c8c2e8b17bae30d5978bc2decdd4098f0f99 Author: Sean Christopherson Date: Wed Aug 3 22:49:56 2022 +0000 KVM: x86/mmu: Fully re-evaluate MMIO caching when SPTE masks change Fully re-evaluate whether or not MMIO caching can be enabled when SPTE masks change; simply clearing enable_mmio_caching when a configuration isn't compatible with caching fails to handle the scenario where the masks are updated, e.g. by VMX for EPT or by SVM to account for the C-bit location, and toggle compatibility from false=>true. Snapshot the original module param so that re-evaluating MMIO caching preserves userspace's desire to allow caching. Use a snapshot approach so that enable_mmio_caching still reflects KVM's actual behavior. Fixes: 8b9e74bfbf8c ("KVM: x86/mmu: Use enable_mmio_caching to track if MMIO caching is enabled") Reported-by: Michael Roth Cc: Tom Lendacky Cc: stable@vger.kernel.org Tested-by: Michael Roth Signed-off-by: Sean Christopherson Reviewed-by: Kai Huang Message-Id: <20220803224957.1285926-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 982bae43f11c37b51d2f1961bb25ef7cac3746fa Author: Sean Christopherson Date: Wed Aug 3 22:49:55 2022 +0000 KVM: x86: Tag kvm_mmu_x86_module_init() with __init Mark kvm_mmu_x86_module_init() with __init, the entire reason it exists is to initialize variables when kvm.ko is loaded, i.e. it must never be called after module initialization. Fixes: 1d0e84806047 ("KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded") Cc: stable@vger.kernel.org Reviewed-by: Kai Huang Tested-by: Michael Roth Signed-off-by: Sean Christopherson Message-Id: <20220803224957.1285926-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4ac5b4237793a6db791999edd53f0396c04053cd Author: Michal Luczaj Date: Fri Jul 29 15:48:01 2022 +0200 KVM: x86: emulator: Fix illegal LEA handling The emulator mishandles LEA with register source operand. Even though such LEA is illegal, it can be encoded and fed to CPU. In which case real hardware throws #UD. The emulator, instead, returns address of x86_emulate_ctxt._regs. This info leak hurts host's kASLR. Tell the decoder that illegal LEA is not to be emulated. Signed-off-by: Michal Luczaj Message-Id: <20220729134801.1120-1-mhal@rbox.co> Signed-off-by: Paolo Bonzini commit 2bc685e63332957f906446d281162f93b5d523fa Author: Yu Zhang Date: Mon Jul 18 15:47:56 2022 +0800 KVM: X86: avoid uninitialized 'fault.async_page_fault' from fixed-up #PF kvm_fixup_and_inject_pf_error() was introduced to fixup the error code( e.g., to add RSVD flag) and inject the #PF to the guest, when guest MAXPHYADDR is smaller than the host one. When it comes to nested, L0 is expected to intercept and fix up the #PF and then inject to L2 directly if - L2.MAXPHYADDR < L0.MAXPHYADDR and - L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the same MAXPHYADDR value && L1 is using EPT for L2), instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK and PFEC_MATCH both set to 0 in vmcs02, the interception and injection may happen on all L2 #PFs. However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error() may cause the fault.async_page_fault being NOT zeroed, and later the #PF being treated as a nested async page fault, and then being injected to L1. Instead of zeroing 'fault' at the beginning of this function, we mannually set the value of 'fault.async_page_fault', because false is the value we really expect. Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178 Reported-by: Yang Lixiao Signed-off-by: Yu Zhang Reviewed-by: Sean Christopherson Message-Id: <20220718074756.53788-1-yu.c.zhang@linux.intel.com> Signed-off-by: Paolo Bonzini commit 70c8327c11c6d4080d4a774f531c6a6521592568 Author: Sean Christopherson Date: Thu Aug 4 23:50:28 2022 +0000 KVM: x86: Bug the VM if an accelerated x2APIC trap occurs on a "bad" reg Bug the VM if retrieving the x2APIC MSR/register while processing an accelerated vAPIC trap VM-Exit fails. In theory it's impossible for the lookup to fail as hardware has already validated the register, but bugs happen, and not checking the result of kvm_lapic_msr_read() would result in consuming the uninitialized "val" if a KVM or hardware bug occurs. Fixes: 1bd9dfec9fd4 ("KVM: x86: Do not block APIC write for non ICR registers") Reported-by: Dan Carpenter Cc: Suravee Suthikulpanit Signed-off-by: Sean Christopherson Message-Id: <20220804235028.1766253-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c3c28d24d910a746b02f496d190e0e8c6560224b Author: Paolo Bonzini Date: Thu Aug 4 15:28:32 2022 +0200 KVM: x86: do not report preemption if the steal time cache is stale Commit 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status", 2021-11-11) open coded the previous call to kvm_map_gfn, but in doing so it dropped the comparison between the cached guest physical address and the one in the MSR. This cause an incorrect cache hit if the guest modifies the steal time address while the memslots remain the same. This can happen with kexec, in which case the preempted bit is written at the address used by the old kernel instead of the old one. Cc: David Woodhouse Cc: stable@vger.kernel.org Fixes: 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status") Signed-off-by: Paolo Bonzini commit 901d3765fa804ce42812f1d5b1f3de2dfbb26723 Author: Paolo Bonzini Date: Thu Aug 4 15:28:32 2022 +0200 KVM: x86: revalidate steal time cache if MSR value changes Commit 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status", 2021-11-11) open coded the previous call to kvm_map_gfn, but in doing so it dropped the comparison between the cached guest physical address and the one in the MSR. This cause an incorrect cache hit if the guest modifies the steal time address while the memslots remain the same. This can happen with kexec, in which case the steal time data is written at the address used by the old kernel instead of the old one. While at it, rename the variable from gfn to gpa since it is a plain physical address and not a right-shifted one. Reported-by: Dave Young Reported-by: Xiaoying Yan Analyzed-by: Dr. David Alan Gilbert Cc: David Woodhouse Cc: stable@vger.kernel.org Fixes: 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status") Signed-off-by: Paolo Bonzini commit baea2ce53f8c7448b4b8dadb563eb0df1bfdfb33 Author: Paolo Bonzini Date: Wed Aug 10 14:55:27 2022 -0400 selftests: kvm: fix compilation Commit 49de12ba06ef ("selftests: drop KSFT_KHDR_INSTALL make target") dropped from tools/testing/selftests/lib.mk the code related to KSFT_KHDR_INSTALL, but in doing so it also dropped the definition of the ARCH variable. The ARCH variable is used in several subdirectories, but kvm/ is the only one of these that was using KSFT_KHDR_INSTALL. As a result, kvm selftests cannot be built anymore: In file included from include/x86_64/vmx.h:12, from x86_64/vmx_pmu_caps_test.c:18: include/x86_64/processor.h:15:10: fatal error: asm/msr-index.h: No such file or directory 15 | #include | ^~~~~~~~~~~~~~~~~ In file included from ../../../../tools/include/asm/atomic.h:6, from ../../../../tools/include/linux/atomic.h:5, from rseq_test.c:15: ../../../../tools/include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/cmpxchg.h: No such file or directory 11 | #include | ^~~~~~~~~~~~~~~ Fix it by including the definition that was present in lib.mk. Fixes: 49de12ba06ef ("selftests: drop KSFT_KHDR_INSTALL make target") Cc: Guillaume Tucker Cc: Anders Roxell Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Signed-off-by: Paolo Bonzini commit 0a83bb35d8a6ff3d18c2772afe616780c23293a6 Author: Lijo Lazar Date: Wed Aug 3 16:54:24 2022 +0530 drm/amdgpu: Avoid another list of reset devices A list of devices to be reset is already created in amdgpu_device_gpu_recover function. Creating another list with the same nodes is incorrect and not supported in list_head. Instead, pass the device list as part of reset context. Fixes: 9e08564727fc (drm/amdgpu: Refactor mode2 reset logic for v13.0.2) Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b2f6c73561fbccee404b441a5c2d0b4fefaae817 Author: Magali Lemes Date: Fri Jul 29 22:07:02 2022 -0300 drm/amd/display: include missing headers Add missing headers to solve the following warnings from sparse: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:656:17: warning: symbol 'ddr4_wm_table_gs' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:693:17: warning: symbol 'lpddr4_wm_table_gs' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:730:17: warning: symbol 'lpddr4_wm_table_with_disabled_ppt' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:767:17: warning: symbol 'ddr4_wm_table_rn' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:804:17: warning: symbol 'ddr4_1R_wm_table_rn' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn20/dcn20_fpu.c:841:17: warning: symbol 'lpddr4_wm_table_rn' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn301/dcn301_fpu.c:217:17: warning: symbol 'ddr4_wm_table' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn301/dcn301_fpu.c:254:17: warning: symbol 'lpddr5_wm_table' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/dcn31_fpu.c:53:30: warning: symbol 'dcn3_1_ip' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/dcn31_fpu.c:197:30: warning: symbol 'dcn3_15_ip' was not declared. Should it be static? drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn31/dcn31_fpu.c:293:30: warning: symbol 'dcn3_16_ip' was not declared. Should it be static? Fixes: 1a3408259bfd ("drm/amd/display: move FPU code on dcn21 clk_mgr") Fixes: 5085e0361f5a ("drm/amd/display: move FPU code from dcn301 clk mgr to DML folder") Fixes: 26f4712aedbd ("drm/amd/display: move FPU related code from dcn31 to dml/dcn31 folder") Fixes: fa896297b31b ("drm/amd/display: move FPU related code from dcn315 to dml/dcn31 folder") Fixes: 3f8951cc123f ("drm/amd/display: move FPU related code from dcn316 to dml/dcn31 folder") Signed-off-by: Magali Lemes Reviewed-by: Rodrigo Siqueira Reviewed-by: Maíra Canal Reviewed-by: Melissa Wen Signed-off-by: Alex Deucher commit 4a0a2cf4c03ba49a4c2596c49c7daa719917d509 Author: Likun Gao Date: Wed Aug 3 12:16:35 2022 +0800 drm/amdgpu: change vram width algorithm for vram_info v3_0 Update the vram width algorithm for vram_info v3_0 to align with the changes of latest IFWI. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.19.x commit 1ac354beecfd58e769fb5373d6b2ac87bce9e1e4 Author: Daniel Phillips Date: Thu Jul 28 20:05:08 2022 -0700 drm/amdgpu: Pessimistic availability based on rounded up allocations Separately accumulate a statistic of rounded up allocations to use to report availability, with a view to increasing the likelihood a buffer object can be successfully allocated at exactly the size reported by the availability API. Signed-off-by: Daniel Phillips Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit aec208eecfb833b05597bbc28696fb1ab62f732c Author: Daniel Phillips Date: Mon Jul 25 08:48:00 2022 -0700 drm/amdgpu: Remove rounding from vram allocation path Rounding up allocations in the allocation path caused test regressions, so now just round in the availability path. Signed-off-by: Daniel Phillips Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit f59966779deac642541c3f7d772a3bf5972727ed Author: Magali Lemes Date: Fri Jul 29 22:07:00 2022 -0300 drm/amd/display: remove header from source file Since "rn_clk_mgr.h" needs ‘struct clk_mgr_internal’ which is declared in "clk_mgr_internal.h", include "clk_mgr_internal.h" in "rn_clk_mgr.h" instead of in its source file. Because of the change above, change the order of '#include "rn_clk_mgr.h"', so that the necessary structs are visible to dcn20_clk_mgr.h. Signed-off-by: Magali Lemes Reviewed-by: Rodrigo Siqueira Reviewed-by: Maíra Canal Reviewed-by: Melissa Wen Signed-off-by: Alex Deucher commit c83b9d60299317a2c15550dd506c864cd01a3e5e Author: Magali Lemes Date: Fri Jul 29 22:06:58 2022 -0300 drm/amd/display: make variables static As "dcn3_1_soc", "dcn3_15_soc", and "dcn3_16_soc" are not used outside of their corresponding "dcn3*_fpu.c", make them static and remove their extern declaration. Fixes: 26f4712aedbd ("drm/amd/display: move FPU related code from dcn31 to dml/dcn31 folder") Fixes: fa896297b31b ("drm/amd/display: move FPU related code from dcn315 to dml/dcn31 folder") Fixes: 3f8951cc123f ("drm/amd/display: move FPU related code from dcn316 to dml/dcn31 folder") Signed-off-by: Magali Lemes Reviewed-by: Rodrigo Siqueira Reviewed-by: Maíra Canal Reviewed-by: Melissa Wen Signed-off-by: Alex Deucher commit 41ead3e0cdc03d64b7da2dcb1fd70ebb7164228b Author: Magali Lemes Date: Tue Aug 2 09:04:06 2022 -0300 drm/amd/display: remove DML Makefile duplicate lines There are two identical CFLAGS entries for "display_mode_vba_20.o", so remove one of them. Also, as there's already an entry for "display_mode_lib.o" CFLAGS, regardless of CONFIG_DRM_AMD_DC_DCN being defined or not, remove the one entry between CONFIG_DRM_AMD_DC_DCN ifdef guards. Signed-off-by: Magali Lemes Reviewed-by: André Almeida Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 5822b8acb869caac72c3ddf149d463177aa28fd4 Author: Rodrigo Siqueira Date: Wed Jul 27 17:55:45 2022 -0400 Revert "drm/amd/display: reduce stack for dml32_CalculateSwathAndDETConfiguration" This reverts commit bac4b41d917a1d999308bb1e779f8c3b39c19f67. This commit was a part of a patchset responsible for reducing the stack size. However, after some other changes, this commit becomes unnecessary, so we are reverting it here. Cc: Aurabindo Pillai Reported-by: Stephen Rothwell Reviewed-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 968d40986f004b463f057fce612996556b753c9e Author: Rodrigo Siqueira Date: Wed Jul 27 17:55:33 2022 -0400 Revert "drm/amd/display: reduce stack for dml32_CalculateVMRowAndSwath" This reverts commit c3b3f9ba25e6cbe59673505fbc5fff6c4cda0ef7. This commit was a part of a patchset responsible for reducing the stack size. However, after some other changes, this commit becomes unnecessary, so we are reverting it here. Cc: Aurabindo Pillai Reported-by: Stephen Rothwell Reviewed-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 0ee7cc803ae52b60f268fdf2eba79b9fc1162747 Author: Rodrigo Siqueira Date: Wed Jul 27 17:55:21 2022 -0400 Revert "drm/amd/display: reduce stack for dml32_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport" This reverts commit 3c3abac60117cfd09460980d9a14c253b37f7b00. This commit was a part of a patchset responsible for reducing the stack size. However, after some other changes, this commit becomes unnecessary, so we are reverting it here. Cc: Aurabindo Pillai Reported-by: Stephen Rothwell Reviewed-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit efcc970605a4e365151db247361bb013f5c84922 Author: Rodrigo Siqueira Date: Wed Jul 27 17:55:10 2022 -0400 Revert "drm/amd/display: reduce stack for dml32_CalculatePrefetchSchedule" This reverts commit 86e4863e67a9bd1e257f162f3d740ebb61206c91. This commit was a part of a patchset responsible for reducing the stack size. However, after some other changes, this commit becomes unnecessary, so we are reverting it here. Cc: Aurabindo Pillai Reported-by: Stephen Rothwell Reviewed-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 37bc31f0e7da4fbad4664e64d906ae7b9009e550 Author: Aurabindo Pillai Date: Fri Jul 29 13:36:31 2022 -0400 drm/amd/display: Add a missing register field for HPO DP stream encoder [Why&How] Add the missing definition to set the register field HBLANK_MINIMUM_SYMBOL_WIDTH Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f41445645ab5d172e6090d00c332c335d8dba337 Merge: b196f3d101fec f4e6960f4f16b Author: Linus Torvalds Date: Wed Aug 10 11:30:16 2022 -0700 Merge tag 'hwmon-fixes-for-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix two regressions in nct6775 and lm90 drivers" * tag 'hwmon-fixes-for-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (nct6775) Fix platform driver suspend regression hwmon: (lm90) Fix error return value from detect function commit b196f3d101fecbd25ca5ccf0d3ef65a272bc2b43 Merge: b1701d5e29eb0 56e07c0c9e4a4 Author: Linus Torvalds Date: Wed Aug 10 11:28:14 2022 -0700 Merge tag 'rpmsg-v5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg fixes from Bjorn Andersson: "This fixes schema validation warnings in the Devicetree bindings for SMD and SMD RPM" * tag 'rpmsg-v5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: dt-bindings: soc: qcom: smd-rpm: extend example dt-bindings: soc: qcom: smd: reference SMD edge schema commit b1701d5e29eb0a102aa3393319b3e4eb1a19c6ea Merge: c235698355fa9 a9e9c93966afd Author: Linus Torvalds Date: Wed Aug 10 11:18:00 2022 -0700 Merge tag 'mm-stable-2022-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull remaining MM updates from Andrew Morton: "Three patch series - two that perform cleanups and one feature: - hugetlb_vmemmap cleanups from Muchun Song - hardware poisoning support for 1GB hugepages, from Naoya Horiguchi - highmem documentation fixups from Fabio De Francesco" * tag 'mm-stable-2022-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (23 commits) Documentation/mm: add details about kmap_local_page() and preemption highmem: delete a sentence from kmap_local_page() kdocs Documentation/mm: rrefer kmap_local_page() and avoid kmap() Documentation/mm: avoid invalid use of addresses from kmap_local_page() Documentation/mm: don't kmap*() pages which can't come from HIGHMEM highmem: specify that kmap_local_page() is callable from interrupts highmem: remove unneeded spaces in kmap_local_page() kdocs mm, hwpoison: enable memory error handling on 1GB hugepage mm, hwpoison: skip raw hwpoison page in freeing 1GB hugepage mm, hwpoison: make __page_handle_poison returns int mm, hwpoison: set PG_hwpoison for busy hugetlb pages mm, hwpoison: make unpoison aware of raw error info in hwpoisoned hugepage mm, hwpoison, hugetlb: support saving mechanism of raw error pages mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry mm/hugetlb: check gigantic_page_runtime_supported() in return_unused_surplus_pages() mm: hugetlb_vmemmap: use PTRS_PER_PTE instead of PMD_SIZE / PAGE_SIZE mm: hugetlb_vmemmap: move code comments to vmemmap_dedup.rst mm: hugetlb_vmemmap: improve hugetlb_vmemmap code readability mm: hugetlb_vmemmap: replace early_param() with core_param() mm: hugetlb_vmemmap: move vmemmap code related to HugeTLB to hugetlb_vmemmap.c ... commit c235698355fa94df7073b51befda7d4be00a0e23 Merge: 5e2e7383b57fa 1cd8a2537eb07 Author: Linus Torvalds Date: Wed Aug 10 11:07:26 2022 -0700 Merge tag 'cxl-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl updates from Dan Williams: "Compute Express Link (CXL) updates for 6.0: - Introduce a 'struct cxl_region' object with support for provisioning and assembling persistent memory regions. - Introduce alloc_free_mem_region() to accompany the existing request_free_mem_region() as a method to allocate physical memory capacity out of an existing resource. - Export insert_resource_expand_to_fit() for the CXL subsystem to late-publish CXL platform windows in iomem_resource. - Add a polled mode PCI DOE (Data Object Exchange) driver service and use it in cxl_pci to retrieve the CDAT (Coherent Device Attribute Table)" * tag 'cxl-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (74 commits) cxl/hdm: Fix skip allocations vs multiple pmem allocations cxl/region: Disallow region granularity != window granularity cxl/region: Fix x1 interleave to greater than x1 interleave routing cxl/region: Move HPA setup to cxl_region_attach() cxl/region: Fix decoder interleave programming Documentation: cxl: remove dangling kernel-doc reference cxl/region: describe targets and nr_targets members of cxl_region_params cxl/regions: add padding for cxl_rr_ep_add nested lists cxl/region: Fix IS_ERR() vs NULL check cxl/region: Fix region reference target accounting cxl/region: Fix region commit uninitialized variable warning cxl/region: Fix port setup uninitialized variable warnings cxl/region: Stop initializing interleave granularity cxl/hdm: Fix DPA reservation vs cxl_endpoint_decoder lifetime cxl/acpi: Minimize granularity for x1 interleaves cxl/region: Delete 'region' attribute from root decoders cxl/acpi: Autoload driver for 'cxl_acpi' test devices cxl/region: decrement ->nr_targets on error in cxl_region_attach() cxl/region: prevent underflow in ways_to_cxl() cxl/region: uninitialized variable in alloc_hpa() ... commit 5e2e7383b57fa03ec2b00c82bb7f49a4a707c1f7 Merge: 00aa9d0bbfec9 5b045200b53a9 Author: Linus Torvalds Date: Wed Aug 10 11:01:44 2022 -0700 Merge tag 'pinctrl-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Outside the pinctrl driver and DT bindings we hit some Arm DT files, patched by the maintainers. Other than that it is business as usual. Core changes: - Add PINCTRL_PINGROUP() helper macro (and use it in the AMD driver). New drivers: - Intel Meteor Lake support. - Reneasas RZ/V2M and r8a779g0 (R-Car V4H). - AXP209 variants AXP221, AXP223 and AXP809. - Qualcomm MSM8909, PM8226, PMP8074 and SM6375. - Allwinner D1. Improvements: - Proper pin multiplexing in the AMD driver. - Mediatek MT8192 can use generic drive strength and pin bias, then fixes on top plus some I2C pin group fixes. - Have the Allwinner Sunplus SP7021 use the generic DT schema and make interrupts optional. - Handle Qualcomm SC7280 ADSP. - Handle Qualcomm MSM8916 CAMSS GP clock muxing. - High impedance bias on ZynqMP. - Serialize StarFive access to MMIO. - Immutable gpiochip for BCM2835, Ingenic, Qualcomm SPMI GPIO" * tag 'pinctrl-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (117 commits) dt-bindings: pinctrl: qcom,pmic-gpio: add PM8226 constraints pinctrl: qcom: Make PINCTRL_SM8450 depend on PINCTRL_MSM pinctrl: qcom: sm8250: Fix PDC map pinctrl: amd: Fix an unused variable dt-bindings: pinctrl: mt8186: Add and use drive-strength-microamp dt-bindings: pinctrl: mt8186: Add gpio-line-names property ARM: dts: imxrt1170-pinfunc: Add pinctrl binding header pinctrl: amd: Use unicode for debugfs output pinctrl: amd: Fix newline declaration in debugfs output pinctrl: at91: Fix typo 'the the' in comment dt-bindings: pinctrl: st,stm32: Correct 'resets' property name pinctrl: mvebu: Missing a blank line after declarations. pinctrl: qcom: Add SM6375 TLMM driver dt-bindings: pinctrl: Add DT schema for SM6375 TLMM dt-bindings: pinctrl: mt8195: Use drive-strength-microamp in examples Revert "pinctrl: qcom: spmi-gpio: make the irqchip immutable" pinctrl: imx93: Add MODULE_DEVICE_TABLE() pinctrl: sunxi: Add driver for Allwinner D1 pinctrl: sunxi: Make some layout parameters dynamic pinctrl: sunxi: Refactor register/offset calculation ... commit 00aa9d0bbfec91dcf191dd7899a65ab28b6cc76d Merge: 0af5cb349a2c9 c269fca7b37a0 Author: Linus Torvalds Date: Wed Aug 10 10:53:22 2022 -0700 Merge tag 'apparmor-pr-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull AppArmor updates from John Johansen: "This is mostly cleanups and bug fixes with the one bigger change being Mathew Wilcox's patch to use XArrays instead of the IDR from the thread around the locking weirdness. Features: - Convert secid mapping to XArrays instead of IDR - Add a kernel label to use on kernel objects - Extend policydb permission set by making use of the xbits - Make export of raw binary profile to userspace optional - Enable tuning of policy paranoid load for embedded systems - Don't create raw_sha1 symlink if sha1 hashing is disabled - Allow labels to carry debug flags Cleanups: - Update MAINTAINERS file - Use struct_size() helper in kmalloc() - Move ptrace mediation to more logical task.{h,c} - Resolve uninitialized symbol warnings - Remove redundant ret variable - Mark alloc_unconfined() as static - Update help description of policy hash for introspection - Remove some casts which are no-longer required Bug Fixes: - Fix aa_label_asxprint return check - Fix reference count leak in aa_pivotroot() - Fix memleak in aa_simple_write_to_buffer() - Fix kernel doc comments - Fix absroot causing audited secids to begin with = - Fix quiet_denied for file rules - Fix failed mount permission check error message - Disable showing the mode as part of a secid to secctx - Fix setting unconfined mode on a loaded profile - Fix overlapping attachment computation - Fix undefined reference to `zlib_deflate_workspacesize'" * tag 'apparmor-pr-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (34 commits) apparmor: Update MAINTAINERS file with new email address apparmor: correct config reference to intended one apparmor: move ptrace mediation to more logical task.{h,c} apparmor: extend policydb permission set by making use of the xbits apparmor: allow label to carry debug flags apparmor: fix overlapping attachment computation apparmor: fix setting unconfined mode on a loaded profile apparmor: Fix some kernel-doc comments apparmor: Mark alloc_unconfined() as static apparmor: disable showing the mode as part of a secid to secctx apparmor: Convert secid mapping to XArrays instead of IDR apparmor: add a kernel label to use on kernel objects apparmor: test: Remove some casts which are no-longer required apparmor: Fix memleak in aa_simple_write_to_buffer() apparmor: fix reference count leak in aa_pivotroot() apparmor: Fix some kernel-doc comments apparmor: Fix undefined reference to `zlib_deflate_workspacesize' apparmor: fix aa_label_asxprint return check apparmor: Fix some kernel-doc comments apparmor: Fix some kernel-doc comments ... commit 0af5cb349a2c97fbabb3cede96efcde9d54b7940 Merge: d4252071b97d2 672fb6740cbfd Author: Linus Torvalds Date: Wed Aug 10 10:40:41 2022 -0700 Merge tag 'kbuild-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Remove the support for -O3 (CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3) - Fix error of rpm-pkg cross-builds - Support riscv for checkstack tool - Re-enable -Wformwat warnings for Clang - Clean up modpost, Makefiles, and misc scripts * tag 'kbuild-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (30 commits) modpost: remove .symbol_white_list field entirely modpost: remove unneeded .symbol_white_list initializers modpost: add PATTERNS() helper macro modpost: shorten warning messages in report_sec_mismatch() Revert "Kbuild, lto, workaround: Don't warn for initcall_reference in modpost" modpost: use more reliable way to get fromsec in section_rel(a)() modpost: add array range check to sec_name() modpost: refactor get_secindex() kbuild: set EXIT trap before creating temporary directory modpost: remove unused Elf_Sword macro Makefile.extrawarn: re-enable -Wformat for clang kbuild: add dtbs_prepare target kconfig: Qt5: tell the user which packages are required modpost: use sym_get_data() to get module device_table data modpost: drop executable ELF support checkstack: add riscv support for scripts/checkstack.pl kconfig: shorten the temporary directory name for cc-option scripts: headers_install.sh: Update config leak ignore entries kbuild: error out if $(INSTALL_MOD_PATH) contains % or : kbuild: error out if $(KBUILD_EXTMOD) contains % or : ... commit 806731a9465b42aaf887cbaf8bfee7eccc9417de Author: Adrian Hunter Date: Tue Aug 9 11:07:02 2022 +0300 perf tools: Do not pass NULL to parse_events() Many cases do not use the extra error information provided by parse_events and instead pass NULL as the struct parse_events_error pointer. Add a wrapper for those cases so that the pointer is never NULL. Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220809080702.6921-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1da1d60774014137d776d0400fdf2f1779d8d4d5 Author: Adrian Hunter Date: Tue Aug 9 11:07:01 2022 +0300 perf tests: Fix Track with sched_switch test for hybrid case If cpu_core PMU event fails to parse, try also cpu_atom PMU event when parsing cycles event. Fixes: 43eb05d066795bdf ("perf tests: Support 'Track with sched_switch' test for hybrid") Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220809080702.6921-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 2e828582b81f5bc76a4fe8e7812df259ab208302 Author: Adrian Hunter Date: Tue Aug 9 11:07:00 2022 +0300 perf parse-events: Fix segfault when event parser gets an error parse_events() is often called with parse_events_error set to NULL. Make parse_events_error__handle() not segfault in that case. A subsequent patch changes to avoid passing NULL in the first place. Fixes: 43eb05d066795bdf ("perf tests: Support 'Track with sched_switch' test for hybrid") Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jin Yao Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220809080702.6921-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e7c677bdd03d54e9a1bafcaf1faf5c573a506bba Merge: 86f44fcec22ce c5c0981fd81d3 Author: Alexei Starovoitov Date: Wed Aug 10 10:12:48 2022 -0700 Merge branch 'fixes for bpf map iterator' Hou Tao says: ==================== From: Hou Tao Hi, The patchset constitues three fixes for bpf map iterator: (1) patch 1~4: fix user-after-free during reading map iterator fd It is possible when both the corresponding link fd and map fd are closed bfore reading the iterator fd. I had squashed these four patches into one, but it was not friendly for stable backport, so I break these fixes into four single patches in the end. Patch 7 is its testing patch. (2) patch 5: fix invalidity check for values in sk local storage map Patch 8 adds two tests for it. (3) patch 6: reject sleepable program for non-resched map iterator Patch 9 add a test for it. Please check the individual patches for more details. And comments are always welcome. Regards, Tao Changes since v2: * patch 1~6: update commit messages (from Yonghong & Martin) * patch 7: add more detailed comments (from Yonghong) * patch 8: use NULL directly instead of (void *)0 v1: https://lore.kernel.org/bpf/20220806074019.2756957-1-houtao@huaweicloud.com ==================== Signed-off-by: Alexei Starovoitov commit c5c0981fd81d35233d625631f13000544c108c53 Author: Hou Tao Date: Wed Aug 10 16:05:38 2022 +0800 selftests/bpf: Ensure sleepable program is rejected by hash map iter Add a test to ensure sleepable program is rejected by hash map iterator. Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-10-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 939a1a946d755c1565e18694e278e9ba7ba19ccc Author: Hou Tao Date: Wed Aug 10 16:05:37 2022 +0800 selftests/bpf: Add write tests for sk local storage map iterator Add test to validate the overwrite of sock local storage map value in map iterator and another one to ensure out-of-bound value writing is rejected. Signed-off-by: Hou Tao Acked-by: Yonghong Song Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20220810080538.1845898-9-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 5836d81e4b039429f409007ba7e0235391537397 Author: Hou Tao Date: Wed Aug 10 16:05:36 2022 +0800 selftests/bpf: Add tests for reading a dangling map iter fd After closing both related link fd and map fd, reading the map iterator fd to ensure it is OK to do so. Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-8-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit d247049f4fd088e4e40294819a932a6057b3632c Author: Hou Tao Date: Wed Aug 10 16:05:35 2022 +0800 bpf: Only allow sleepable program for resched-able iterator When a sleepable program is attached to a hash map iterator, might_fault() will report "BUG: sleeping function called from invalid context..." if CONFIG_DEBUG_ATOMIC_SLEEP is enabled. The reason is that rcu_read_lock() is held in bpf_hash_map_seq_next() and won't be released until all elements are traversed or bpf_hash_map_seq_stop() is called. Fixing it by reusing BPF_ITER_RESCHED to indicate that only non-sleepable program is allowed for iterator without BPF_ITER_RESCHED. We can revise bpf_iter_link_attach() later if there are other conditions which may cause rcu_read_lock() or spin_lock() issues. Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-7-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 52bd05eb7c88e1ad8541a48873188ccebca9da26 Author: Hou Tao Date: Wed Aug 10 16:05:34 2022 +0800 bpf: Check the validity of max_rdwr_access for sock local storage map iterator The value of sock local storage map is writable in map iterator, so check max_rdwr_access instead of max_rdonly_access. Fixes: 5ce6e77c7edf ("bpf: Implement bpf iterator for sock local storage map") Signed-off-by: Hou Tao Acked-by: Yonghong Song Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20220810080538.1845898-6-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit f0d2b2716d71778d0b0c8eaa433c073287d69d93 Author: Hou Tao Date: Wed Aug 10 16:05:33 2022 +0800 bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator sock_map_iter_attach_target() acquires a map uref, and the uref may be released before or in the middle of iterating map elements. For example, the uref could be released in sock_map_iter_detach_target() as part of bpf_link_release(), or could be released in bpf_map_put_with_uref() as part of bpf_map_release(). Fixing it by acquiring an extra map uref in .init_seq_private and releasing it in .fini_seq_private. Fixes: 0365351524d7 ("net: Allow iterating sockmap and sockhash") Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-5-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 3c5f6e698b5c538bbb23cd453b22e1e4922cffd8 Author: Hou Tao Date: Wed Aug 10 16:05:32 2022 +0800 bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf_iter_attach_map() acquires a map uref, and the uref may be released before or in the middle of iterating map elements. For example, the uref could be released in bpf_iter_detach_map() as part of bpf_link_release(), or could be released in bpf_map_put_with_uref() as part of bpf_map_release(). So acquiring an extra map uref in bpf_iter_init_sk_storage_map() and releasing it in bpf_iter_fini_sk_storage_map(). Fixes: 5ce6e77c7edf ("bpf: Implement bpf iterator for sock local storage map") Signed-off-by: Hou Tao Acked-by: Yonghong Song Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20220810080538.1845898-4-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit ef1e93d2eeb58a1f08c37b22a2314b94bc045f15 Author: Hou Tao Date: Wed Aug 10 16:05:31 2022 +0800 bpf: Acquire map uref in .init_seq_private for hash map iterator bpf_iter_attach_map() acquires a map uref, and the uref may be released before or in the middle of iterating map elements. For example, the uref could be released in bpf_iter_detach_map() as part of bpf_link_release(), or could be released in bpf_map_put_with_uref() as part of bpf_map_release(). So acquiring an extra map uref in bpf_iter_init_hash_map() and releasing it in bpf_iter_fini_hash_map(). Fixes: d6c4503cc296 ("bpf: Implement bpf iterator for hash maps") Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-3-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit f76fa6b338055054f80c72b29c97fb95c1becadc Author: Hou Tao Date: Wed Aug 10 16:05:30 2022 +0800 bpf: Acquire map uref in .init_seq_private for array map iterator bpf_iter_attach_map() acquires a map uref, and the uref may be released before or in the middle of iterating map elements. For example, the uref could be released in bpf_iter_detach_map() as part of bpf_link_release(), or could be released in bpf_map_put_with_uref() as part of bpf_map_release(). Alternative fix is acquiring an extra bpf_link reference just like a pinned map iterator does, but it introduces unnecessary dependency on bpf_link instead of bpf_map. So choose another fix: acquiring an extra map uref in .init_seq_private for array map iterator. Fixes: d3cc2ab546ad ("bpf: Implement bpf iterator for array maps") Signed-off-by: Hou Tao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220810080538.1845898-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 86f44fcec22ce2979507742bc53db8400e454f46 Author: Alexei Starovoitov Date: Mon Aug 8 20:58:09 2022 -0700 bpf: Disallow bpf programs call prog_run command. The verifier cannot perform sufficient validation of bpf_attr->test.ctx_in pointer, therefore bpf programs should not be allowed to call BPF_PROG_RUN command from within the program. To fix this issue split bpf_sys_bpf() bpf helper into normal kern_sys_bpf() kernel function that can only be used by the kernel light skeleton directly. Reported-by: YiFei Zhu Fixes: b1d18a7574d0 ("bpf: Extend sys_bpf commands for bpf_syscall programs.") Signed-off-by: Alexei Starovoitov commit d4073595d0c61463ec3a87411b19e2a90f76d3f8 Author: Dan Carpenter Date: Mon Aug 8 11:34:41 2022 +0300 fs/ntfs3: uninitialized variable in ntfs_set_acl_ex() The goto out calls kfree(value) on an uninitialized pointer. Just return directly as the other error paths do. Fixes: 460bbf2990b3 ("fs/ntfs3: Do not change mode if ntfs_set_ea failed") Signed-off-by: Dan Carpenter Signed-off-by: Konstantin Komarov commit 96964352e21962f5e51ecad87527ae9b6fec9670 Author: Jiapeng Chong Date: Thu Jul 21 11:18:41 2022 +0800 fs/ntfs3: Remove unused function wnd_bits Since the function wnd_bits is defined but not called in any file, it is a useless function, and we delete it in view of the brevity of the code. Remove some warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. fs/ntfs3/bitmap.c:54:19: warning: unused function 'wnd_bits' [-Wunused-function]. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Konstantin Komarov commit 20aec89aac7761e3c096004f5c819aacc86fc542 Author: Steven Rostedt (Google) Date: Wed Aug 10 11:39:18 2022 -0400 rtla: Consolidate and show all necessary libraries that failed for building When building rtla tools, if the necessary libraries are not installed (libtraceevent and libtracefs), show the ones that are missing in one consolidated output, and also show how to install them (at least for Fedora). Link: https://lore.kernel.org/all/CAHk-=wh+e1qcCnEYJ3JRDVLNCYbJ=0u+Ts5bOYZnY3mX_k-hFA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20220810113918.5d19ce59@gandalf.local.home Suggested-by: Linus Torvalds Signed-off-by: Steven Rostedt (Google) commit 1a7b22ab15ebf643e10e54ae5387afee06e39ad0 Author: Ben Hutchings Date: Sat Jul 16 15:48:34 2022 +0200 tools/rtla: Build with EXTRA_{C,LD}FLAGS To allow for distributions and other builders to apply hardening policy and other customisation, append EXTRA_CFLAGS and EXTRA_LDFLAGS to the corresponding variables. Link: https://lore.kernel.org/linux-trace-devel/YtLBshz0nMQ7530H@decadent.org.uk Signed-off-by: Ben Hutchings Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit ff5a55dcdb343e3db9b9fb08795b78544b032773 Author: Ben Hutchings Date: Sat Jul 16 15:47:08 2022 +0200 tools/rtla: Fix command symlinks "ln -s" stores the next argument directly as the symlink target, so it needs to be a relative path. In this case, just "rtla". Link: https://lore.kernel.org/linux-trace-devel/YtLBXMI6Ui4HLIF1@decadent.org.uk Fixes: 0605bf009f18 ("rtla: Add osnoise tool") Fixes: a828cd18bc4a ("rtla: Add timerlat tool and timelart top mode") Signed-off-by: Ben Hutchings Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit f1432cd24c240cedf78c0d026631e3b10052c8e1 Author: Alexandre Vicenzi Date: Mon Aug 8 20:03:43 2022 +0200 rtla: Fix tracer name The correct tracer name is timerlat and not timelat. Link: https://lore.kernel.org/linux-trace-devel/20220808180343.22262-1-alexandre.vicenzi@suse.com Signed-off-by: Alexandre Vicenzi Signed-off-by: Steven Rostedt (Google) commit dcc2ed3912ae32fd6646264d1aa296ea3d2aa07c Author: Rob Herring Date: Wed Jul 27 15:10:59 2022 -0600 dt-bindings: Drop DT_MK_SCHEMA_FLAGS conditional selecting schema files Since commit ef8795f3f1ce ("dt-bindings: kbuild: Use DTB files for validation"), dt-mk-schema always needs a complete list of schemas, so the conditional using DT_MK_SCHEMA_FLAGS should be removed. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220727211100.3249417-1-robh@kernel.org commit c485c35ff6783ccd12c160fcac6a0e504e83e0bf Author: Pablo Neira Ayuso Date: Tue Aug 9 17:23:52 2022 +0200 netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but module refcount has not been bumped yet, therefore nft_expr_destroy() leads to module reference underflow. Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support") Signed-off-by: Pablo Neira Ayuso commit 4963674c2e71fc062f8f089f0f58ffbb5533060b Author: Pablo Neira Ayuso Date: Tue Aug 9 13:39:18 2022 +0200 netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag These are mutually exclusive, actually NFTA_SET_ELEM_KEY_END replaces the flag notation. Fixes: 7b225d0b5c6d ("netfilter: nf_tables: add NFTA_SET_ELEM_KEY_END attribute") Signed-off-by: Pablo Neira Ayuso commit 3400278328285a8c2f121904496aff5e7b610a01 Author: Pablo Neira Ayuso Date: Tue Aug 9 13:22:01 2022 +0200 netfilter: nf_tables: use READ_ONCE and WRITE_ONCE for shared generation id access The generation ID is bumped from the commit path while holding the mutex, however, netlink dump operations rely on RCU. This patch also adds missing cb->base_eq initialization in nf_tables_dump_set(). Fixes: 38e029f14a97 ("netfilter: nf_tables: set NLM_F_DUMP_INTR if netlink dumping is stale") Signed-off-by: Pablo Neira Ayuso commit aada476655461a9ab491d8298a415430cdd10278 Author: Xu Kuohai Date: Mon Aug 8 00:07:35 2022 -0400 bpf, arm64: Fix bpf trampoline instruction endianness The sparse tool complains as follows: arch/arm64/net/bpf_jit_comp.c:1684:16: warning: incorrect type in assignment (different base types) arch/arm64/net/bpf_jit_comp.c:1684:16: expected unsigned int [usertype] *branch arch/arm64/net/bpf_jit_comp.c:1684:16: got restricted __le32 [usertype] * arch/arm64/net/bpf_jit_comp.c:1700:52: error: subtraction of different types can't work (different base types) arch/arm64/net/bpf_jit_comp.c:1734:29: warning: incorrect type in assignment (different base types) arch/arm64/net/bpf_jit_comp.c:1734:29: expected unsigned int [usertype] * arch/arm64/net/bpf_jit_comp.c:1734:29: got restricted __le32 [usertype] * arch/arm64/net/bpf_jit_comp.c:1918:52: error: subtraction of different types can't work (different base types) This is because the variable branch in function invoke_bpf_prog and the variable branches in function prepare_trampoline are defined as type u32 *, which conflicts with ctx->image's type __le32 *, so sparse complains when assignment or arithmetic operation are performed on these two variables and ctx->image. Since arm64 instructions are always little-endian, change the type of these two variables to __le32 * and call cpu_to_le32() to convert instruction to little-endian before writing it to memory. This is also in line with emit() which internally does cpu_to_le32(), too. Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") Reported-by: kernel test robot Signed-off-by: Xu Kuohai Signed-off-by: Daniel Borkmann Reviewed-by: Jean-Philippe Brucker Link: https://lore.kernel.org/bpf/20220808040735.1232002-1-xukuohai@huawei.com commit 2bff487f9a9085c9c877b55579b153691f0e5245 Author: Maurizio Lombardi Date: Mon Aug 1 10:09:00 2022 +0200 nvme-tcp: check if the queue is allocated before stopping it When an error is detected and the host reconnects, the nvme_tcp_error_recovery_work() function is called and starts tearing down the io queues and de-allocating them; If at the same time the "nvme" process deletes the controller via sysfs, the nvme_tcp_delete_ctrl() gets called and waits until the nvme_tcp_error_recovery_work() finishes its job; then starts tearing down the io queues, but at this point they have already been freed and the mutexes are destroyed. Calling mutex_lock() against a destroyed mutex triggers a warning: [ 1299.025575] nvme nvme1: Reconnecting in 10 seconds... [ 1299.636449] nvme nvme1: Removing ctrl: NQN "blktests-subsystem-1" [ 1299.645262] ------------[ cut here ]------------ [ 1299.649949] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 1299.649971] WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579 __mutex_lock+0x2d0/0x7dc [ 1299.717934] CPU: 4 PID: 104150 Comm: nvme [ 1299.828075] Call trace: [ 1299.830526] __mutex_lock+0x2d0/0x7dc [ 1299.834203] mutex_lock_nested+0x64/0xd4 [ 1299.838139] nvme_tcp_stop_queue+0x54/0xe0 [nvme_tcp] [ 1299.843211] nvme_tcp_teardown_io_queues.part.0+0x90/0x280 [nvme_tcp] [ 1299.849672] nvme_tcp_delete_ctrl+0x6c/0xf0 [nvme_tcp] [ 1299.854831] nvme_do_delete_ctrl+0x108/0x120 [nvme_core] [ 1299.860181] nvme_sysfs_delete+0xec/0xf0 [nvme_core] [ 1299.865179] dev_attr_store+0x40/0x70 Fix the warning by checking if the queues are allocated in the nvme_tcp_stop_queue(). If they are not, it makes no sense to try to stop them. Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit c50cd03dbebd1d5d34a2eb361f315b0bd833d6c1 Author: Christophe JAILLET Date: Sat Aug 6 22:15:01 2022 +0200 nvme-fabrics: Fix a typo in an error message A 'c' is missing. s/fabris/fabrics/ Signed-off-by: Christophe JAILLET Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit ec9e96b5230148294c7abcaf3a4c592d3720b62d Author: Amit Engel Date: Mon Aug 1 21:40:39 2022 +0300 nvme-fabrics: parse nvme connect Linux error codes This fixes the assumption that errval is an unsigned nvme error Signed-off-by: Amit Engel Signed-off-by: Christoph Hellwig commit 14446f9abd609791064d222ccf3c7b3af1772358 Author: Zhang Xiaoxu Date: Tue Jul 26 10:56:32 2022 +0800 nvmet-auth: use kmemdup instead of kmalloc + memcpy For code neat purpose, we can use kmemdup to replace kmalloc + memcpy. Signed-off-by: Zhang Xiaoxu Signed-off-by: Christoph Hellwig commit 9317d0014499182c77a03cd095e83bcfb0f53750 Author: Christoph Hellwig Date: Sat Aug 6 10:29:55 2022 +0200 nvme-fc: fix the fc_appid_store return value "nvme-fc: fold t fc_update_appid into fc_appid_store" accidentally changed the userspace interface for the appid attribute, because the code that decrements "count" to remove a trailing '\n' in the parsing results in the decremented value being incorrectly be returned from the sysfs write. Fix this by keeping an orig_count variable for the full length of the write. Fixes: c814153c83a8 ("nvme-fc: fold t fc_update_appid into fc_appid_store") Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Ewan D. Milne Reviewed-by: James Smart Tested-by: Muneendra Kumar M commit 6fb271f1bc4ebc59bac0ff835c2e5197eac4b075 Author: Ming Lei Date: Thu Jul 21 08:33:58 2022 +0800 nvme-fc: restart admin queue if the caller needs to restart queue Without restarting admin queue in __nvme_fc_abort_outstanding_ios(), it leaves controller not capable of handling admin pt request, and causes io hang. Fixes it by restarting admin queue if the caller of __nvme_fc_abort_outstanding_ios requires to restart queue. Signed-off-by: Ming Lei Reviewed-by: Sagi Grimberg Reviewed-by: James Smart Tested-by: Ewan D. Milne Signed-off-by: Christoph Hellwig commit d511e8a7e850db567cd7f633288aa96a19508e5b Author: Douglas Anderson Date: Tue Aug 9 14:27:45 2022 -0700 regulator: core: Fix missing error return from regulator_bulk_get() In commit 6eabfc018e8d ("regulator: core: Allow specifying an initial load w/ the bulk API") I changed the error handling but had a subtle that caused us to always return no error even if there was an error. Fix it. Fixes: 6eabfc018e8d ("regulator: core: Allow specifying an initial load w/ the bulk API") Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20220809142738.1.I91625242f137c707bb345c51c80c5ecee02eeff3@changeid Signed-off-by: Mark Brown commit b4b5f29a076e52181f63e45a2ad1bc88593072e3 Author: Philipp Zabel Date: Wed Aug 10 12:41:56 2022 +0200 ASoC: codec: tlv320aic32x4: fix mono playback via I2S The two commits referenced below break mono playback via I2S DAI because they set BCLK to half the required speed. For PCM transport over I2S, the number of transmitted channels is always 2, even for mono playback. Fixes: dcd79364bff3 ("ASoC: codec: tlv3204: Enable 24 bit audio support") Fixes: 40b37136287b ("ASoC: tlv320aic32x4: Fix bdiv clock rate derivation") Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220810104156.665452-1-p.zabel@pengutronix.de Signed-off-by: Mark Brown commit b39c9e1b101d2992de9981673919ae55a088792c Author: Adrian Hunter Date: Tue Aug 9 16:07:58 2022 +0300 perf machine: Fix missing free of machine->kallsyms_filename Add missing free of machine->kallsyms_filename to machine__exit(). Fixes: a5367ecb5353fbf2 ("perf tools: Automatically use guest kcore_dir if present") Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220809130758.12800-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 0c39f147145e5ebb2a867a1b50afdbfee0ae66c8 Author: Adrian Hunter Date: Tue Aug 9 15:32:58 2022 +0300 perf script: Fix reference to perf insert instead of perf inject Amend "perf insert" to "perf inject". Fixes: e28fb159f1163e76 ("perf script: Add machine_pid and vcpu") Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220809123258.9086-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 628881ee06cb41a3c2c4e4e3f04ff3dc6779cd12 Author: Yang Jihong Date: Mon Aug 8 17:24:08 2022 +0800 perf sched latency: Fix subcommand matching error perf sched latency use strncmp to match subcommands which matching does not meet expectation. Before: # perf sched lat1234 >/dev/null # echo $? 0 # Solution: Use strstarts to match subcommand. After: # perf sched lat1234 Usage: perf sched [] {record|latency|map|replay|script|timehist} -D, --dump-raw-trace dump raw trace in ASCII -f, --force don't complain, do it -i, --input input file name -v, --verbose be more verbose (show symbol address, etc) # echo $? 129 # # perf sched lat >/dev/null # echo $? 0 # Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220808092408.107399-3-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit d2f30b793e59d7c95822ef9b46d2416efddef583 Author: Yang Jihong Date: Mon Aug 8 17:24:07 2022 +0800 perf kvm: Fix subcommand matching error Currently the 'diff', 'top', 'buildid-list' and 'stat' perf commands use strncmp() to match subcommands. As a result, matching does not meet expectation. For example: # perf kvm diff1234 # Event 'cycles' # # Baseline Delta Abs Shared Object Symbol # ........ ......... ............. ...... # # Event 'dummy:HG' # # Baseline Delta Abs Shared Object Symbol # ........ ......... ............. ...... # # echo $? 0 # Invalid information should be returned, but success is actually returned. Solution: Use strstarts() to match subcommands. After: # perf kvm diff1234 Usage: perf kvm [] {top|record|report|diff|buildid-list|stat} -i, --input Input file name -o, --output Output file name -v, --verbose be more verbose (show counter open errors, etc) --guest Collect guest os data --guest-code Guest code can be found in hypervisor process --guestkallsyms file saving guest os /proc/kallsyms --guestmodules file saving guest os /proc/modules --guestmount guest mount directory under which every guest os instance has a subdir --guestvmlinux file saving guest os vmlinux --host Collect host os data # echo $? 129 # Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220808092408.107399-2-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 4bf6dcaa93bcd083a13c278a91418fe10e6d23a0 Author: Christophe JAILLET Date: Sat Aug 6 16:51:26 2022 +0200 perf probe: Fix an error handling path in 'parse_perf_probe_command()' If a memory allocation fail, we should branch to the error handling path in order to free some resources allocated a few lines above. Fixes: 15354d54698648e2 ("perf probe: Generate event name with line number") Signed-off-by: Christophe JAILLET Acked-by: Masami Hiramatsu Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: kernel-janitors@vger.kernel.org Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/b71bcb01fa0c7b9778647235c3ab490f699ba278.1659797452.git.christophe.jaillet@wanadoo.fr Signed-off-by: Arnaldo Carvalho de Melo commit 46f7bd5e1b5732acb9b95037afd052a4d2eebb1a Author: Brian Robbins Date: Fri Aug 5 15:06:45 2022 -0700 perf inject jit: Ignore memfd and anonymous mmap events if jitdump present Some processes store jitted code in memfd mappings to avoid having rwx mappings. These processes map the code with a writeable mapping and a read-execute mapping. They write the code using the writeable mapping and then unmap the writeable mapping. All subsequent execution is through the read-execute mapping. perf inject --jit ignores //anon* mappings for each process where a jitdump is present because it expects to inject mmap events for each jitted code range, and said jitted code ranges will overlap with the //anon* mappings. Ignore /memfd: and [anon:* mappings so that jitted code contained in /memfd: and [anon:* mappings is treated the same way as jitted code contained in //anon* mappings. Signed-off-by: Brian Robbins Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220805220645.95855-1-brianrob@linux.microsoft.com Signed-off-by: Arnaldo Carvalho de Melo commit e0b23af82d6f454c0bad6fb48d378e0099069b44 Author: Thomas Richter Date: Thu Aug 4 09:52:21 2022 +0200 perf list: Add PMU pai_crypto event description for IBM z16 Add the event description for the IBM z16 pai_crypto PMU released with commit 1bf54f32f525 ("s390/pai: Add support for cryptography counters") The document SA22-7832-13 "z/Architecture Principles of Operation", published May, 2022, contains the description of the Processor Activity Instrumentation Facility and the cryptography counter set., See Pages 5-110 to 5-113. Patch reworked to fit for the converted jevents processing. Committer notes: Couldn't find 1bf54f32f525 ("s390/pai: Add support for cryptography counters") in torvalds/master, in what tree is that cset? Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Cc: Heiko Carstens Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20220804075221.1132849-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit b48ddbbb99986de85878a34c23ecebac22a59b79 Author: Ian Rogers Date: Thu Aug 4 18:38:56 2022 -0700 perf vendor events: Remove bad jaketown uncore events The event converter scripts at: https://github.com/intel/event-converter-for-linux-perf passes Filter values from data on 01.org that is bogus in a perf command line and can cause perf to infinitely recurse in parse events. Remove such events or filters using the updated patch: https://github.com/intel/event-converter-for-linux-perf/pull/15/commits/afd779df99ee41aac646eae1ae5ae651cda3394d Fixes: 376d8b581b7639c9 ("perf vendor events: Update Intel jaketown") Reviewed-by: Kan Liang Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Caleb Biggers Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220805013856.1842878-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 22de36ff2cf16f1ebaa93fc6eb483c65cc79c856 Author: Ian Rogers Date: Thu Aug 4 18:38:55 2022 -0700 perf vendor events: Remove bad ivytown uncore events The event converter scripts at: https://github.com/intel/event-converter-for-linux-perf passes Filter values from data on 01.org that is bogus in a perf command line and can cause perf to infinitely recurse in parse events. Remove such events or filters using the updated patch: https://github.com/intel/event-converter-for-linux-perf/pull/15/commits/afd779df99ee41aac646eae1ae5ae651cda3394d Fixes: 6220136831e34615 ("perf vendor events: Update Intel ivytown") Reviewed-by: Kan Liang Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Caleb Biggers Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220805013856.1842878-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 2c98bacfd7a7d6d8b7ff3ce24264cb142306e591 Author: Ian Rogers Date: Thu Aug 4 18:38:54 2022 -0700 perf vendor events: Remove bad broadwellde uncore events The event converter scripts at: https://github.com/intel/event-converter-for-linux-perf passes Filter values from data on 01.org that is bogus in a perf command line and can cause perf to infinitely recurse in parse events. Remove such events or filters using the updated patch: https://github.com/intel/event-converter-for-linux-perf/pull/15/commits/afd779df99ee41aac646eae1ae5ae651cda3394d Fixes: ef908a192512bf45 ("perf vendor events: Update Intel broadwellde") Reviewed-by: Kan Liang Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Andi Kleen Cc: Caleb Biggers Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220805013856.1842878-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit b4f0466082fc073507bd1a52f560b718f4b26a5a Author: Ian Rogers Date: Thu Aug 4 15:18:02 2022 -0700 perf jevents: Add JEVENTS_ARCH make option Allow the architecture built into pmu-events.c to be set on the make command line with JEVENTS_ARCH. Reviewed-by: John Garry Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20220804221816.1802790-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 46acb311c6c6b47b2b1e43fb13a09beb70f870eb Author: Ian Rogers Date: Thu Aug 4 15:18:01 2022 -0700 perf jevents: Simplify generation of C-string Previous implementation wanted variable order and '(null)' string output to match the C implementation. The '(null)' string output was a quirk/bug and so there is no need to carry it forward. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20220804221816.1802790-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e1e19d0545563f6684a68adc1995c6307105b19f Author: Ian Rogers Date: Thu Aug 4 15:18:00 2022 -0700 perf jevents: Clean up pytype warnings Improve type hints to clean up pytype warnings. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Will Deacon Cc: Xing Zhengjun Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20220804221816.1802790-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5b245985a6de5ac18b5088c37068816d413fb8ed Author: Roberto Sassu Date: Tue Jul 19 19:05:55 2022 +0200 tools build: Switch to new openssl API for test-libcrypto Switch to new EVP API for detecting libcrypto, as Fedora 36 returns an error when it encounters the deprecated function MD5_Init() and the others. The error would be interpreted as missing libcrypto, while in reality it is not. Fixes: 6e8ccb4f624a73c5 ("tools/bpf: properly account for libbfd variations") Signed-off-by: Roberto Sassu Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: bpf@vger.kernel.org Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: llvm@lists.linux.dev Cc: Martin KaFai Lau Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nick Terrell Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stanislav Fomichev Link: https://lore.kernel.org/r/20220719170555.2576993-4-roberto.sassu@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 73f8ec5992d17a5431b7a2d123097981dbaa4769 Author: Arnaldo Carvalho de Melo Date: Tue Aug 9 16:23:53 2022 -0300 Revert "perf build: Suppress openssl v3 deprecation warnings in libcrypto feature test" This reverts commit 10fef869a58e37ec649b61eddab545f2da57a79b. Because a proper fix was submitted. Signed-off-by: Arnaldo Carvalho de Melo commit dd6775f986144a9e0563dab70ef0398768227113 Author: Roberto Sassu Date: Tue Jul 19 19:05:54 2022 +0200 perf build: Remove FEATURE_CHECK_LDFLAGS-disassembler-{four-args,init-styled} setting As the building mechanism is now able to retry detection with different combinations of linking flags, setting FEATURE_CHECK_LDFLAGS-disassembler-four-args and FEATURE_CHECK_LDFLAGS-disassembler-init-styled is not necessary anymore, so remove it. Committer notes: Use the same technique to find the set of bfd-related libraries to link as in: 3308ffc5016e6136 ("tools, build: Retry detection of bfd-related features") Signed-off-by: Roberto Sassu Cc: Alexei Starovoitov Cc: Andres Freund Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nick Terrell Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stanislav Fomichev Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20220719170555.2576993-3-roberto.sassu@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 13e6f53a7692ac239241e6bc5c82c58c18c4f1ab Author: Roberto Sassu Date: Tue Jul 19 19:05:53 2022 +0200 bpftool: Complete libbfd feature detection Commit 6e8ccb4f624a7 ("tools/bpf: properly account for libbfd variations") sets the linking flags depending on which flavor of the libbfd feature was detected. However, the flavors except libbfd cannot be detected, as they are not in the feature list. Complete the list of features to detect by adding libbfd-liberty and libbfd-liberty-z. Committer notes: Adjust conflict with with: 1e1613f64cc8a09d ("tools bpftool: Don't display disassembler-four-args feature test") 600b7b26c07a070d ("tools bpftool: Fix compilation error with new binutils") Fixes: 6e8ccb4f624a73c5 ("tools/bpf: properly account for libbfd variations") Signed-off-by: Roberto Sassu Cc: Alexei Starovoitov Cc: Andres Freund Cc: Andrii Nakryiko Cc: bpf@vger.kernel.org Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: llvm@lists.linux.dev Cc: Martin KaFai Lau Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nick Terrell Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stanislav Fomichev Link: https://lore.kernel.org/r/20220719170555.2576993-2-roberto.sassu@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 629b98e2b1c6efcfa44ce144fce744819f0258f5 Author: Roberto Sassu Date: Tue Jul 19 19:05:52 2022 +0200 tools, build: Retry detection of bfd-related features While separate features have been defined to determine which linking flags are required to use libbfd depending on the distribution (libbfd, libbfd-liberty and libbfd-liberty-z), the same has not been done for other features requiring linking to libbfd. For example, disassembler-four-args requires linking to libbfd too, but it should use the right linking flags. If not all the required ones are specified, e.g. -liberty, detection will always fail even if the feature is available. Instead of creating new features, similarly to libbfd, simply retry detection with the different set of flags until detection succeeds (or fails, if the libraries are missing). In this way, feature detection is transparent for the users of this building mechanism (e.g. perf), and those users don't have for example to set an appropriate value for the FEATURE_CHECK_LDFLAGS-disassembler-four-args variable. The number of retries and features for which the retry mechanism is implemented is low enough to make the increase in the complexity of Makefile negligible. Tested with perf and bpftool on Ubuntu 20.04.4 LTS, Fedora 36 and openSUSE Tumbleweed. Committer notes: Do the retry for disassembler-init-styled as well. Signed-off-by: Roberto Sassu Cc: Alexei Starovoitov Cc: Andres Freund Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nick Terrell Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stanislav Fomichev Cc: bpf@vger.kernel.org Cc: llvm@lists.linux.dev Link: https://lore.kernel.org/r/20220719170555.2576993-1-roberto.sassu@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 0c343af2a2f82844d03e5e30dc09a331421cd0c3 Author: Claire Jensen Date: Fri Aug 5 13:01:05 2022 -0700 perf test: JSON format checking Add field checking tests for perf stat JSON output. Sanity checks the expected number of fields are present, that the expected keys are present and they have the correct values. Committer notes: Had to fix this: - $(INSTALL) tests/shell/lib/*.sh '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/shell/lib' \ + $(INSTALL) tests/shell/lib/*.sh '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/shell/lib'; \ Committer testing: [root@quaco ~]# perf test json 90: perf stat JSON output linter : Ok [root@quaco ~]# set -o vi [root@quaco ~]# perf test -v json 90: perf stat JSON output linter : --- start --- test child forked, pid 560794 Checking json output: no args [Success] Checking json output: system wide [Success] Checking json output: system wide Checking json output: system wide no aggregation [Success] Checking json output: interval [Success] Checking json output: event [Success] Checking json output: per core [Success] Checking json output: per thread [Success] Checking json output: per die [Success] Checking json output: per node [Success] Checking json output: per socket [Success] test child finished with 0 ---- end ---- perf stat JSON output linter: Ok [root@quaco ~]# Signed-off-by: Claire Jensen Acked-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alyssa Ross Cc: Claire Jensen Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Like Xu Cc: Mark Rutland Cc: Peter Zijlstra Cc: Sandipan Das Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220805200105.2020995-3-irogers@google.com Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit df936cadfb58ba93601ac351ab6fc2e2650cf591 Author: Claire Jensen Date: Fri Aug 5 13:01:04 2022 -0700 perf stat: Add JSON output option CSV output is tricky to format and column layout changes are susceptible to breaking parsers. New JSON-formatted output has variable names to identify fields that are consistent and informative, making the output parseable. CSV output example: 1.20,msec,task-clock:u,1204272,100.00,0.697,CPUs utilized 0,,context-switches:u,1204272,100.00,0.000,/sec 0,,cpu-migrations:u,1204272,100.00,0.000,/sec 70,,page-faults:u,1204272,100.00,58.126,K/sec JSON output example: {"counter-value" : "3805.723968", "unit" : "msec", "event" : "cpu-clock", "event-runtime" : 3805731510100.00, "pcnt-running" : 100.00, "metric-value" : 4.007571, "metric-unit" : "CPUs utilized"} {"counter-value" : "6166.000000", "unit" : "", "event" : "context-switches", "event-runtime" : 3805723045100.00, "pcnt-running" : 100.00, "metric-value" : 1.620191, "metric-unit" : "K/sec"} {"counter-value" : "466.000000", "unit" : "", "event" : "cpu-migrations", "event-runtime" : 3805727613100.00, "pcnt-running" : 100.00, "metric-value" : 122.447136, "metric-unit" : "/sec"} {"counter-value" : "208.000000", "unit" : "", "event" : "page-faults", "event-runtime" : 3805726799100.00, "pcnt-running" : 100.00, "metric-value" : 54.654516, "metric-unit" : "/sec"} Also added documentation for JSON option. There is some tidy up of CSV code including a potential memory over run in the os.nfields set up. To facilitate this an AGGR_MAX value is added. Committer notes: Fixed up using PRIu64 to format u64 values, not %lu. Committer testing: ⬢[acme@toolbox perf]$ perf stat -j sleep 1 {"counter-value" : "0.731750", "unit" : "msec", "event" : "task-clock:u", "event-runtime" : 731750, "pcnt-running" : 100.00, "metric-value" : 0.000731, "metric-unit" : "CPUs utilized"} {"counter-value" : "0.000000", "unit" : "", "event" : "context-switches:u", "event-runtime" : 731750, "pcnt-running" : 100.00, "metric-value" : 0.000000, "metric-unit" : "/sec"} {"counter-value" : "0.000000", "unit" : "", "event" : "cpu-migrations:u", "event-runtime" : 731750, "pcnt-running" : 100.00, "metric-value" : 0.000000, "metric-unit" : "/sec"} {"counter-value" : "75.000000", "unit" : "", "event" : "page-faults:u", "event-runtime" : 731750, "pcnt-running" : 100.00, "metric-value" : 102.494021, "metric-unit" : "K/sec"} {"counter-value" : "578765.000000", "unit" : "", "event" : "cycles:u", "event-runtime" : 379366, "pcnt-running" : 49.00, "metric-value" : 0.790933, "metric-unit" : "GHz"} {"counter-value" : "1298.000000", "unit" : "", "event" : "stalled-cycles-frontend:u", "event-runtime" : 768020, "pcnt-running" : 100.00, "metric-value" : 0.224271, "metric-unit" : "frontend cycles idle"} {"counter-value" : "21984.000000", "unit" : "", "event" : "stalled-cycles-backend:u", "event-runtime" : 768020, "pcnt-running" : 100.00, "metric-value" : 3.798433, "metric-unit" : "backend cycles idle"} {"counter-value" : "468197.000000", "unit" : "", "event" : "instructions:u", "event-runtime" : 768020, "pcnt-running" : 100.00, "metric-value" : 0.808959, "metric-unit" : "insn per cycle"} {"metric-value" : 0.046955, "metric-unit" : "stalled cycles per insn"} {"counter-value" : "103335.000000", "unit" : "", "event" : "branches:u", "event-runtime" : 768020, "pcnt-running" : 100.00, "metric-value" : 141.216262, "metric-unit" : "M/sec"} {"counter-value" : "2381.000000", "unit" : "", "event" : "branch-misses:u", "event-runtime" : 388654, "pcnt-running" : 50.00, "metric-value" : 2.304156, "metric-unit" : "of all branches"} ⬢[acme@toolbox perf]$ Signed-off-by: Claire Jensen Acked-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alyssa Ross Cc: Claire Jensen Cc: Florian Fischer Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Like Xu Cc: Mark Rutland Cc: Peter Zijlstra Cc: Sandipan Das Cc: Stephane Eranian Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20220805200105.2020995-2-irogers@google.com Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit f4e6960f4f16b1ca5da16cec7612ecc86402ac05 Author: Zev Weiss Date: Tue Aug 9 22:26:46 2022 -0700 hwmon: (nct6775) Fix platform driver suspend regression Commit c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") introduced a slight change in nct6775_suspend() in order to avoid an otherwise-needless symbol export for nct6775_update_device(), replacing a call to that function with a simple dev_get_drvdata() instead. As it turns out, there is no guarantee that nct6775_update_device() is ever called prior to suspend. If this happens, the resume function ends up writing bad data into the various chip registers, which results in a crash shortly after resume. To fix the problem, just add the symbol export and return to using nct6775_update_device() as was employed previously. Reported-by: Zoltán Kővágó Tested-by: Zoltán Kővágó Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") Cc: stable@kernel.org Signed-off-by: Zev Weiss Link: https://lore.kernel.org/r/20220810052646.13825-1-zev@bewilderbeest.net [groeck: Updated description] Signed-off-by: Guenter Roeck commit f329a0ebeaba4ffe91d431e0ac1ca7f9165872a4 Author: Jakub Kicinski Date: Tue Aug 9 16:27:40 2022 -0700 genetlink: correct uAPI defines Commit 50a896cf2d6f ("genetlink: properly support per-op policy dumping") seems to have copy'n'pasted things a little incorrectly. The #define CTRL_ATTR_MCAST_GRP_MAX should have stayed right after the previous enum. The new CTRL_ATTR_POLICY_* needs its own define for MAX and that max should not contain the superfluous _DUMP in the name. We probably can't do anything about the CTRL_ATTR_POLICY_DUMP_MAX any more, there's likely code which uses it. For consistency (*cough* codegen *cough*) let's add the correctly name define nonetheless. Signed-off-by: Jakub Kicinski Reviewed-by: Johannes Berg Signed-off-by: David S. Miller commit 6b4db2e528f650c7fb712961aac36455468d5902 Author: Ido Schimmel Date: Tue Aug 9 14:35:06 2022 +0300 devlink: Fix use-after-free after a failed reload After a failed devlink reload, devlink parameters are still registered, which means user space can set and get their values. In the case of the mlxsw "acl_region_rehash_interval" parameter, these operations will trigger a use-after-free [1]. Fix this by rejecting set and get operations while in the failed state. Return the "-EOPNOTSUPP" error code which does not abort the parameters dump, but instead causes it to skip over the problematic parameter. Another possible fix is to perform these checks in the mlxsw parameter callbacks, but other drivers might be affected by the same problem and I am not aware of scenarios where these stricter checks will cause a regression. [1] mlxsw_spectrum3 0000:00:10.0: Port 125: Failed to register netdev mlxsw_spectrum3 0000:00:10.0: Failed to create ports ================================================================== BUG: KASAN: use-after-free in mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get+0xbd/0xd0 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:904 Read of size 4 at addr ffff8880099dcfd8 by task kworker/u4:4/777 CPU: 1 PID: 777 Comm: kworker/u4:4 Not tainted 5.19.0-rc7-custom-126601-gfe26f28c586d #1 Hardware name: QEMU MSN4700, BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x92/0xbd lib/dump_stack.c:106 print_address_description mm/kasan/report.c:313 [inline] print_report.cold+0x5e/0x5cf mm/kasan/report.c:429 kasan_report+0xb9/0xf0 mm/kasan/report.c:491 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:306 mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get+0xbd/0xd0 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:904 mlxsw_sp_acl_region_rehash_intrvl_get+0x49/0x60 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c:1106 mlxsw_sp_params_acl_region_rehash_intrvl_get+0x33/0x80 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3854 devlink_param_get net/core/devlink.c:4981 [inline] devlink_nl_param_fill+0x238/0x12d0 net/core/devlink.c:5089 devlink_param_notify+0xe5/0x230 net/core/devlink.c:5168 devlink_ns_change_notify net/core/devlink.c:4417 [inline] devlink_ns_change_notify net/core/devlink.c:4396 [inline] devlink_reload+0x15f/0x700 net/core/devlink.c:4507 devlink_pernet_pre_exit+0x112/0x1d0 net/core/devlink.c:12272 ops_pre_exit_list net/core/net_namespace.c:152 [inline] cleanup_net+0x494/0xc00 net/core/net_namespace.c:582 process_one_work+0x9fc/0x1710 kernel/workqueue.c:2289 worker_thread+0x675/0x10b0 kernel/workqueue.c:2436 kthread+0x30c/0x3d0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 The buggy address belongs to the physical page: page:ffffea0000267700 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99dc flags: 0x100000000000000(node=0|zone=1) raw: 0100000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099dce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880099dcf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8880099dcf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880099dd000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880099dd080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Fixes: 98bbf70c1c41 ("mlxsw: spectrum: add "acl_region_rehash_interval" devlink param") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e Author: Sun Shouxin Date: Mon Aug 8 23:21:03 2022 -0700 net:bonding:support balance-alb interface with vlan to bridge In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi Signed-off-by: Sun Shouxin Signed-off-by: David S. Miller commit 91ec9bd57f3524ff3d86bfb7c9ee5a315019733c Author: Clayton Yager Date: Mon Aug 8 15:38:23 2022 -0700 macsec: Fix traffic counters/statistics OutOctetsProtected, OutOctetsEncrypted, InOctetsValidated, and InOctetsDecrypted were incrementing by the total number of octets in frames instead of by the number of octets of User Data in frames. The Controlled Port statistics ifOutOctets and ifInOctets were incrementing by the total number of octets instead of the number of octets of the MSDUs plus octets of the destination and source MAC addresses. The Controlled Port statistics ifInDiscards and ifInErrors were not incrementing each time the counters they aggregate were. The Controlled Port statistic ifInErrors was not included in the output of macsec_get_stats64 so the value was not present in ip commands output. The ReceiveSA counters InPktsNotValid, InPktsNotUsingSA, and InPktsUnusedSA were not incrementing. Signed-off-by: Clayton Yager Signed-off-by: David S. Miller commit 50ee138ff26681718042ade4523b489e11816bbf Merge: afb176d458700 1e5907bcb3a3b Author: Mark Brown Date: Wed Aug 10 13:41:56 2022 +0100 TAS2770 fixes Merge series from Martin Povišer : The first two fixes should be straightforward. The latter two clean up what looks to me like a mess in the setting of power levels. However we settle it, we should then do the same changes to TAS2764, which has the same template (and maybe there are other drivers). commit 6b2394bad503bfada6f677ad2574b2ef8178b1bf Author: Colin Ian King Date: Tue Aug 9 19:15:44 2022 +0100 ALSA: usb-audio: make read-only array marker static const Don't populate the read-only array marker on the stack but instead make it static const. Also makes the object code a little smaller. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20220809181544.3046429-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai commit a3e7b29e30854ed67be0d17687e744ad0c769c4b Author: Peilin Ye Date: Mon Aug 8 11:05:25 2022 -0700 vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Imagine two non-blocking vsock_connect() requests on the same socket. The first request schedules @connect_work, and after it times out, vsock_connect_timeout() sets *sock* state back to TCP_CLOSE, but keeps *socket* state as SS_CONNECTING. Later, the second request returns -EALREADY, meaning the socket "already has a pending connection in progress", even though the first request has already timed out. As suggested by Stefano, fix it by setting *socket* state back to SS_UNCONNECTED, so that the second request will return -ETIMEDOUT. Suggested-by: Stefano Garzarella Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reviewed-by: Stefano Garzarella Signed-off-by: Peilin Ye Signed-off-by: David S. Miller commit 7e97cfed9929eaabc41829c395eb0d1350fccb9d Author: Peilin Ye Date: Mon Aug 8 11:04:47 2022 -0700 vsock: Fix memory leak in vsock_connect() An O_NONBLOCK vsock_connect() request may try to reschedule @connect_work. Imagine the following sequence of vsock_connect() requests: 1. The 1st, non-blocking request schedules @connect_work, which will expire after 200 jiffies. Socket state is now SS_CONNECTING; 2. Later, the 2nd, blocking request gets interrupted by a signal after a few jiffies while waiting for the connection to be established. Socket state is back to SS_UNCONNECTED, but @connect_work is still pending, and will expire after 100 jiffies. 3. Now, the 3rd, non-blocking request tries to schedule @connect_work again. Since @connect_work is already scheduled, schedule_delayed_work() silently returns. sock_hold() is called twice, but sock_put() will only be called once in vsock_connect_timeout(), causing a memory leak reported by syzbot: BUG: memory leak unreferenced object 0xffff88810ea56a40 (size 1232): comm "syz-executor756", pid 3604, jiffies 4294947681 (age 12.350s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 28 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 (..@............ backtrace: [] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:1930 [] sk_alloc+0x32/0x2e0 net/core/sock.c:1989 [] __vsock_create.constprop.0+0x38/0x320 net/vmw_vsock/af_vsock.c:734 [] vsock_create+0xc1/0x2d0 net/vmw_vsock/af_vsock.c:2203 [] __sock_create+0x1ab/0x2b0 net/socket.c:1468 [] sock_create net/socket.c:1519 [inline] [] __sys_socket+0x6f/0x140 net/socket.c:1561 [] __do_sys_socket net/socket.c:1570 [inline] [] __se_sys_socket net/socket.c:1568 [inline] [] __x64_sys_socket+0x1a/0x20 net/socket.c:1568 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x44/0xae <...> Use mod_delayed_work() instead: if @connect_work is already scheduled, reschedule it, and undo sock_hold() to keep the reference count balanced. Reported-and-tested-by: syzbot+b03f55bf128f9a38f064@syzkaller.appspotmail.com Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Co-developed-by: Stefano Garzarella Signed-off-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Peilin Ye Signed-off-by: David S. Miller commit ae3b1da95413614f96ffa23d200929c6f809c807 Author: Yang Yingliang Date: Wed Aug 10 09:34:35 2022 +0800 KVM: arm64: Fix compile error due to sign extension Use GENMASK() to generate the masks of device type and device id, fixing compilation errors due to the sign extension when using older versions of GCC (such as is 7.5): In function ‘kvm_vm_ioctl_set_device_addr.isra.38’, inlined from ‘kvm_arch_vm_ioctl’ at arch/arm64/kvm/arm.c:1454:10: ././include/linux/compiler_types.h:354:38: error: call to ‘__compiletime_assert_599’ \ declared with attribute error: FIELD_GET: mask is not constant _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) Fixes: 9f968c9266aa ("KVM: arm64: vgic-v2: Add helper for legacy dist/cpuif base address setting") Signed-off-by: Yang Yingliang [maz: tidy up commit message] Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220810013435.1525363-1-yangyingliang@huawei.com commit 6fd2c17fb6e02a8c0ab51df1cfec82ce96b8e83d Author: Jose Alonso Date: Mon Aug 8 08:35:04 2022 -0300 Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" This reverts commit 36a15e1cb134c0395261ba1940762703f778438c. The usage of FLAG_SEND_ZLP causes problems to other firmware/hardware versions that have no issues. The FLAG_SEND_ZLP is not safe to use in this context. See: https://patchwork.ozlabs.org/project/netdev/patch/1270599787.8900.8.camel@Linuxdev4-laptop/#118378 The original problem needs another way to solve. Fixes: 36a15e1cb134 ("net: usb: ax88179_178a needs FLAG_SEND_ZLP") Cc: stable@vger.kernel.org Reported-by: Ronald Wahl Link: https://bugzilla.kernel.org/show_bug.cgi?id=216327 Link: https://bugs.archlinux.org/task/75491 Signed-off-by: Jose Alonso Signed-off-by: David S. Miller commit 2cd0e8dba7a529a7706d1e81209f98a6351f8ad0 Author: Topi Miettinen Date: Sat Aug 6 13:12:53 2022 +0300 netlabel: fix typo in comment 'IPv4 and IPv4' should be 'IPv4 and IPv6'. Signed-off-by: Topi Miettinen Acked-by: Paul Moore Signed-off-by: David S. Miller commit e7f164955f07c394ad0a8a57c24a0c8088630051 Merge: 996237d9ba4d0 d80d60b0db6ff Author: David S. Miller Date: Wed Aug 10 09:19:50 2022 +0100 Merge tag 'linux-can-fixes-for-6.0-20220810' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== this is a pull request of 4 patches for net/master, with the whitespace issue fixed. Fedor Pchelkin contributes 2 fixes for the j1939 CAN protocol. A patch by me for the ems_usb driver fixes an unaligned access warning. Sebastian Würl's patch for the mcp251x driver fixes a race condition in the receive interrupt. ==================== Signed-off-by: David S. Miller commit 7aeef1548ac026c8bcb9ec223b672f81da340011 Author: Guenter Roeck Date: Mon Aug 8 02:48:21 2022 -0700 hwmon: (lm90) Fix error return value from detect function lm90_detect_nuvoton() is supposed to return NULL if it can not detect a chip, or a pointer to the chip name if it does. Under some circumstances it returns an error pointer instead. Some versions of gcc interpret an ERR_PTR as region of size 0 and generate an error message. In function ‘__fortify_strlen’, inlined from ‘strlcpy’ at ./include/linux/fortify-string.h:159:10, inlined from ‘lm90_detect’ at drivers/hwmon/lm90.c:2550:2: ./include/linux/fortify-string.h:50:33: error: ‘__builtin_strlen’ reading 1 or more bytes from a region of size 0 50 | #define __underlying_strlen __builtin_strlen | ^ ./include/linux/fortify-string.h:141:24: note: in expansion of macro ‘__underlying_strlen’ 141 | return __underlying_strlen(p); | ^~~~~~~~~~~~~~~~~~~ Returning NULL instead of ERR_PTR() fixes the problem. Fixes: c7cebce984a2 ("hwmon: (lm90) Rework detect function") Reported-by: Ingo Molnar Cc: Linus Torvalds Cc: Kees Cook Tested-by: Ingo Molnar Reviewed-by: Kees Cook Signed-off-by: Guenter Roeck commit 83ee9f23763a432a4077bf20624ee35de87bce99 Author: Russell Currey Date: Wed Aug 10 15:43:31 2022 +1000 powerpc/kexec: Fix build failure from uninitialised variable clang 14 won't build because ret is uninitialised and can be returned if both prop and fdtprop are NULL. Drop the ret variable and return an error in that failure case. Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window") Suggested-by: Christophe Leroy Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220810054331.373761-1-ruscur@russell.cc commit 59bab33a4f57f886c5f8a4d1f2bed728ec185d16 Author: Christophe Leroy Date: Wed Aug 3 13:47:33 2022 +0200 powerpc/ppc-opcode: Fix PPC_RAW_TW() PPC_RAW_TW() is erroneously defined with base code 0x7f000008 instead of 0x7c000008. That's invisible because its only user is PPC_RAW_TRAP() which is 0x7fe00008, but fix it anyway to avoid any risk of future bug. Fixes: d00d762daf12 ("powerpc/ppc-opcode: Define and use PPC_RAW_TRAP() and PPC_RAW_TW()") Reported-by: Naveen N. Rao Signed-off-by: Christophe Leroy Reviewed-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/eca9251f1e1f82c4c46ec6380ddb28356ab3fdfe.1659527244.git.christophe.leroy@csgroup.eu commit cb928ac192128c842f4c1cfc8b6780b95719d65f Author: Naveen N. Rao Date: Tue Aug 9 15:29:07 2022 +0530 powerpc64/ftrace: Fix ftrace for clang builds Clang doesn't support -mprofile-kernel ABI, so guard the checks against CONFIG_DYNAMIC_FTRACE_WITH_REGS, rather than the elf ABI version. Fixes: 23b44fc248f4 ("powerpc/ftrace: Make __ftrace_make_{nop/call}() common to PPC32 and PPC64") Cc: stable@vger.kernel.org # v5.19+ Reported-by: Nick Desaulniers Reported-by: Ondrej Mosnacek Signed-off-by: Naveen N. Rao Tested-by: Ondrej Mosnacek Acked-by: Nick Desaulniers Signed-off-by: Michael Ellerman Link: https://github.com/llvm/llvm-project/issues/57031 Link: https://github.com/ClangBuiltLinux/linux/issues/1682 Link: https://lore.kernel.org/r/20220809095907.418764-1-naveen.n.rao@linux.vnet.ibm.com commit 5cccf7a5215d12027e55e247907817631b413c28 Author: Christophe Leroy Date: Tue Aug 2 11:02:38 2022 +0200 powerpc: Make eh value more explicit when using lwarx Just like the first patch of this series, define a local 'eh' in order to make the code clearer. And IS_ENABLED() returns either 1 or 0 so no need to do IS_ENABLED(CONFIG_PPC64) ? 1 : 0. Signed-off-by: Christophe Leroy [mpe: Use symbolic names, use 'n' constraint per Segher] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/629befaa2d05e2922346e58a383886510d6af55a.1659430931.git.christophe.leroy@csgroup.eu commit eb5a33ea31190c189ca4a59de4687b0877662c06 Author: Christophe Leroy Date: Tue Aug 2 11:02:37 2022 +0200 powerpc: Don't hide eh field of lwarx behind a macro The eh field must remain 0 for PPC32 and is only used by PPC64. Don't hide that behind a macro, just leave the responsibility to the user. At the time being, the only users of PPC_RAW_L{WDQ}ARX are setting the eh field to 0, so the special handling of __PPC_EH is useless. Just take the value given by the caller. Same for DEFINE_TESTOP(), don't do special handling in that macro, ensure the caller hands over the proper eh value. Signed-off-by: Christophe Leroy [mpe: Use 'n' constraint per Segher] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/8b9c8a1a14f9143552a85fcbf96698224a8c2469.1659430931.git.christophe.leroy@csgroup.eu commit 18db466a9a306406dab3b134014d9f6ed642471c Author: Christophe Leroy Date: Tue Aug 2 11:02:36 2022 +0200 powerpc: Fix eh field when calling lwarx on PPC32 Commit 9401f4e46cf6 ("powerpc: Use lwarx/ldarx directly instead of PPC_LWARX/LDARX macros") properly handled the eh field of lwarx in asm/bitops.h but failed to clear it for PPC32 in asm/simple_spinlock.h So, do as in arch_atomic_try_cmpxchg_lock(), set it to 1 if PPC64 but set it to 0 if PPC32. For that use IS_ENABLED(CONFIG_PPC64) which returns 1 when CONFIG_PPC64 is set and 0 otherwise. Fixes: 9401f4e46cf6 ("powerpc: Use lwarx/ldarx directly instead of PPC_LWARX/LDARX macros") Cc: stable@vger.kernel.org # v5.15+ Reported-by: Pali Rohár Signed-off-by: Christophe Leroy Tested-by: Pali Rohár Reviewed-by: Segher Boessenkool [mpe: Use symbolic names, use 'n' constraint per Segher] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/a1176e19e627dd6a1b8d24c6c457a8ab874b7d12.1659430931.git.christophe.leroy@csgroup.eu commit 996237d9ba4d092469fbfca18995656c32834ac7 Merge: b4ab94d6adaa5 ab7e2e0dfa5d3 Author: Jakub Kicinski Date: Tue Aug 9 22:19:23 2022 -0700 Merge branch 'do-not-use-rt_tos-for-ipv6-flowlabel' Matthias May says: ==================== Do not use RT_TOS for IPv6 flowlabel According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. ==================== Link: https://lore.kernel.org/r/20220805191906.9323-1-matthias.may@westermo.com Signed-off-by: Jakub Kicinski commit ab7e2e0dfa5d37540ab1dc5376e9a2cb9188925d Author: Matthias May Date: Fri Aug 5 21:19:06 2022 +0200 ipv6: do not use RT_TOS for IPv6 flowlabel According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") Acked-by: Guillaume Nault Signed-off-by: Matthias May Signed-off-by: Jakub Kicinski commit bcb0da7fffee9464073998b267ce5543da2356d2 Author: Matthias May Date: Fri Aug 5 21:19:05 2022 +0200 mlx5: do not use RT_TOS for IPv6 flowlabel According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. Fixes: ce99f6b97fcd ("net/mlx5e: Support SRIOV TC encapsulation offloads for IPv6 tunnels") Acked-by: Guillaume Nault Signed-off-by: Matthias May Signed-off-by: Jakub Kicinski commit e488d4f5d6e4cd1e728ba4ddbdcd7ef5f4d13a21 Author: Matthias May Date: Fri Aug 5 21:19:04 2022 +0200 vxlan: do not use RT_TOS for IPv6 flowlabel According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. Fixes: 1400615d64cf ("vxlan: allow setting ipv6 traffic class") Acked-by: Guillaume Nault Signed-off-by: Matthias May Signed-off-by: Jakub Kicinski commit ca2bb69514a8bc7f83914122f0d596371352416c Author: Matthias May Date: Fri Aug 5 21:19:03 2022 +0200 geneve: do not use RT_TOS for IPv6 flowlabel According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. Fixes: 3a56f86f1be6 ("geneve: handle ipv6 priority like ipv4 tos") Acked-by: Guillaume Nault Signed-off-by: Matthias May Signed-off-by: Jakub Kicinski commit b4ab94d6adaa5cf842b68bd28f4b50bc774496bd Author: Matthias May Date: Fri Aug 5 21:00:06 2022 +0200 geneve: fix TOS inheriting for ipv4 The current code retrieves the TOS field after the lookup on the ipv4 routing table. The routing process currently only allows routing based on the original 3 TOS bits, and not on the full 6 DSCP bits. As a result the retrieved TOS is cut to the 3 bits. However for inheriting purposes the full 6 bits should be used. Extract the full 6 bits before the route lookup and use that instead of the cut off 3 TOS bits. Fixes: e305ac6cf5a1 ("geneve: Add support to collect tunnel metadata.") Signed-off-by: Matthias May Acked-by: Guillaume Nault Link: https://lore.kernel.org/r/20220805190006.8078-1-matthias.may@westermo.com Signed-off-by: Jakub Kicinski commit 2ba5e47fb75fbb8fab45f5c1bc8d5c33d8834bd3 Author: Chia-Lin Kao (AceLan) Date: Mon Aug 8 16:18:45 2022 +0800 net: atlantic: fix aq_vec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue: events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [ 97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [ 97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] v2. fixed "warning: variable 'aq_vec' set but not used" v3. simplified a for loop Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Chia-Lin Kao (AceLan) Acked-by: Sudarsana Reddy Kalluru Link: https://lore.kernel.org/r/20220808081845.42005-1-acelan.kao@canonical.com Signed-off-by: Jakub Kicinski commit 84b709d31063bacaabaaad1c5d85143150edd695 Author: Christophe JAILLET Date: Sat Aug 6 18:02:36 2022 +0200 ax88796: Fix some typo in a comment s/by caused/be caused/ s/ax88786/ax88796/ Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/7db4b622d2c3e5af58c1d1f32b81836f4af71f18.1659801746.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 690bf6439528208ae20525df5dcbb031cc9d300a Merge: bc3c8fe3c79bc 580077855a407 Author: Jakub Kicinski Date: Tue Aug 9 21:27:00 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Harden set element field checks to avoid out-of-bound memory access, this patch also fixes the type of issue described in 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data") in a broader way. 2) Patches to restrict the chain, set, and rule id lookup in the transaction to the corresponding top-level table, patches from Thadeu Lima de Souza Cascardo. 3) Fix incorrect comment in ip6t_LOG.h 4) nft_data_init() performs upfront validation of the expected data. struct nft_data_desc is used to describe the expected data to be received from userspace. The .size field represents the maximum size that can be stored, for bound checks. Then, .len is an input/output field which stores the expected length as input (this is optional, to restrict the checks), as output it stores the real length received from userspace (if it was not specified as input). This patch comes in response to 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data") to address this type of issue in a more generic way by avoid opencoded data validation. Next patch requires this as a dependency. 5) Disallow jump to implicit chain from set element, this configuration is invalid. Only allow jump to chain via immediate expression is supported at this stage. 6) Fix possible null-pointer derefence in the error path of table updates, if memory allocation of the transaction fails. From Florian Westphal. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix null deref due to zeroed list head netfilter: nf_tables: disallow jump to implicit chain from set element netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: ip6t_LOG: Fix a typo in a comment netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: validate variable length element extension ==================== Link: https://lore.kernel.org/r/20220809220532.130240-1-pablo@netfilter.org/ Signed-off-by: Jakub Kicinski commit 46c8229c4317ba8576a206d285a34783390ba6ab Merge: 19f68ed6dc90c de7b9927105bd Author: Alexei Starovoitov Date: Tue Aug 9 18:46:12 2022 -0700 Merge branch 'Don't reinit map value in prealloc_lru_pop' Kumar Kartikeya Dwivedi says: ==================== Fix for a bug in prealloc_lru_pop spotted while reading the code, then a test + example that checks whether it is fixed. Changelog: ---------- v2 -> v3: v2: https://lore.kernel.org/bpf/20220809140615.21231-1-memxor@gmail.com * Switch test to use kptr instead of kptr_ref to stabilize test runs * Fix missing lru_bug__destroy (Yonghong) * Collect Acks v1 -> v2: v1: https://lore.kernel.org/bpf/20220806014603.1771-1-memxor@gmail.com * Expand commit log to include summary of the discussion with Yonghong * Make lru_bug selftest serial to not mess up refcount for map_kptr test ==================== Signed-off-by: Alexei Starovoitov commit de7b9927105bd2afe940c6ad22de6938edd8b1c1 Author: Kumar Kartikeya Dwivedi Date: Tue Aug 9 23:30:33 2022 +0200 selftests/bpf: Add test for prealloc_lru_pop bug Add a regression test to check against invalid check_and_init_map_value call inside prealloc_lru_pop. The kptr should not be reset to NULL once we set it after deleting the map element. Hence, we trigger a program that updates the element causing its reuse, and checks whether the unref kptr is reset or not. If it is, prealloc_lru_pop does an incorrect check_and_init_map_value call and the test fails. Acked-by: Yonghong Song Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20220809213033.24147-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 275c30bcee66a27d1aa97a215d607ad6d49804cb Author: Kumar Kartikeya Dwivedi Date: Tue Aug 9 23:30:32 2022 +0200 bpf: Don't reinit map value in prealloc_lru_pop The LRU map that is preallocated may have its elements reused while another program holds a pointer to it from bpf_map_lookup_elem. Hence, only check_and_free_fields is appropriate when the element is being deleted, as it ensures proper synchronization against concurrent access of the map value. After that, we cannot call check_and_init_map_value again as it may rewrite bpf_spin_lock, bpf_timer, and kptr fields while they can be concurrently accessed from a BPF program. This is safe to do as when the map entry is deleted, concurrent access is protected against by check_and_free_fields, i.e. an existing timer would be freed, and any existing kptr will be released by it. The program can create further timers and kptrs after check_and_free_fields, but they will eventually be released once the preallocated items are freed on map destruction, even if the item is never reused again. Hence, the deleted item sitting in the free list can still have resources attached to it, and they would never leak. With spin_lock, we never touch the field at all on delete or update, as we may end up modifying the state of the lock. Since the verifier ensures that a bpf_spin_lock call is always paired with bpf_spin_unlock call, the program will eventually release the lock so that on reuse the new user of the value can take the lock. Essentially, for the preallocated case, we must assume that the map value may always be in use by the program, even when it is sitting in the freelist, and handle things accordingly, i.e. use proper synchronization inside check_and_free_fields, and never reinitialize the special fields when it is reused on update. Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Acked-by: Yonghong Song Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20220809213033.24147-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 1f0752628e76bb3a02109dbd980381f27060ba92 Author: Kumar Kartikeya Dwivedi Date: Tue Aug 9 23:30:31 2022 +0200 bpf: Allow calling bpf_prog_test kfuncs in tracing programs In addition to TC hook, enable these in tracing programs so that they can be used in selftests. Acked-by: Yonghong Song Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20220809213033.24147-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 3f5117be95843950f31862be05e947b77a3cd77c Author: David Heidelberg Date: Sun Jun 26 21:16:30 2022 +0200 dt-bindings: mfd: convert to yaml Qualcomm SPMI PMIC Convert Qualcomm SPMI PMIC binding to yaml format. Additional changes: - filled many missing compatibles Co-developed-by: Caleb Connolly Signed-off-by: David Heidelberg Reviewed-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220626191630.176835-1-david@ixit.cz commit b7f362d6413ebd0167ac5a9f09ad5dca5490ac1a Author: Mikulas Patocka Date: Mon Aug 8 10:50:10 2022 -0400 dm writecache: fix smatch warning about invalid return from writecache_map There's a smatch warning "inconsistent returns '&wc->lock'" in dm-writecache. The reason for the warning is that writecache_map() doesn't drop the lock on the impossible path. Fix this warning by adding wc_unlock() after the BUG statement (so that it will be compiled-away anyway). Fixes: df699cc16ea5e ("dm writecache: report invalid return from writecache_map helpers") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit f876df9f12cda68e68995b33b36491d78fd3ecce Author: Mike Snitzer Date: Tue Aug 9 18:07:28 2022 -0400 dm verity: fix verity_parse_opt_args parsing Commit df326e7a0699 ("dm verity: allow optional args to alter primary args handling") introduced a bug where verity_parse_opt_args() wouldn't properly shift past an optional argument's additional params (by ignoring them). Fix this by avoiding returning with error if an unknown argument is encountered when @only_modifier_opts=true is passed to verity_parse_opt_args(). In practice this regressed the cryptsetup testsuite's FEC testing because unknown optional arguments were encountered, wherey short-circuiting ever testing FEC mode. With this fix all of the cryptsetup testsuite's verity FEC tests pass. Fixes: df326e7a0699 ("dm verity: allow optional args to alter primary args handling") Reported-by: Milan Broz > Signed-off-by: Mike Snitzer commit 8c22816dbc8733ea761c3b74ec62d9463e242c56 Author: Mike Snitzer Date: Tue Aug 9 17:33:12 2022 -0400 dm verity: fix DM_VERITY_OPTS_MAX value yet again Must account for the possibility that "try_verify_in_tasklet" is used. This is the same issue that was fixed with commit 160f99db94322 -- it is far too easy to miss that additional a new argument(s) require bumping DM_VERITY_OPTS_MAX accordingly. Fixes: 5721d4e5a9cd ("dm verity: Add optional "try_verify_in_tasklet" feature") Signed-off-by: Mike Snitzer commit b33b6fdca3f0380c101e2adae5644777d6530fe5 Author: Mike Snitzer Date: Fri Aug 5 22:58:33 2022 -0400 dm bufio: simplify DM_BUFIO_CLIENT_NO_SLEEP locking Historically none of the bufio code runs in interrupt context but with the use of DM_BUFIO_CLIENT_NO_SLEEP a bufio client can, see: commit 5721d4e5a9cd ("dm verity: Add optional "try_verify_in_tasklet" feature") That said, the new tasklet usecase still doesn't require interrupts be disabled by bufio (let alone conditionally restore them). Yet with PREEMPT_RT, and falling back from tasklet to workqueue, care must be taken to properly synchronize between softirq and process context, otherwise ABBA deadlock may occur. While it is unnecessary to disable bottom-half preemption within a tasklet, we must consistently do so in process context to ensure locking is in the proper order. Fix these issues by switching from spin_lock_irq{save,restore} to using spin_{lock,unlock}_bh instead. Also remove the 'spinlock_flags' member in dm_bufio_client struct (that can be used unsafely if bufio must recurse on behalf of some caller, e.g. block layer's submit_bio). Fixes: 5721d4e5a9cd ("dm verity: Add optional "try_verify_in_tasklet" feature") Reported-by: Jens Axboe Signed-off-by: Mike Snitzer commit d4252071b97d2027d246f6a82cbee4d52f618b47 Author: Mikulas Patocka Date: Tue Aug 9 14:32:13 2022 -0400 add barriers to buffer_uptodate and set_buffer_uptodate Let's have a look at this piece of code in __bread_slow: get_bh(bh); bh->b_end_io = end_buffer_read_sync; submit_bh(REQ_OP_READ, 0, bh); wait_on_buffer(bh); if (buffer_uptodate(bh)) return bh; Neither wait_on_buffer nor buffer_uptodate contain any memory barrier. Consequently, if someone calls sb_bread and then reads the buffer data, the read of buffer data may be executed before wait_on_buffer(bh) on architectures with weak memory ordering and it may return invalid data. Fix this bug by adding a memory barrier to set_buffer_uptodate and an acquire barrier to buffer_uptodate (in a similar way as folio_test_uptodate and folio_mark_uptodate). Signed-off-by: Mikulas Patocka Reviewed-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit e394ff83bbca1c72427b1feb5c6b9d4dad832f01 Merge: 15205c2829ca2 6930bcbfb6ced Author: Linus Torvalds Date: Tue Aug 9 14:56:49 2022 -0700 Merge tag 'nfsd-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Work on 'courteous server', which was introduced in 5.19, continues apace. This release introduces a more flexible limit on the number of NFSv4 clients that NFSD allows, now that NFSv4 clients can remain in courtesy state long after the lease expiration timeout. The client limit is adjusted based on the physical memory size of the server. The NFSD filecache is a cache of files held open by NFSv4 clients or recently touched by NFSv2 or NFSv3 clients. This cache had some significant scalability constraints that have been relieved in this release. Thanks to all who contributed to this work. A data corruption bug found during the most recent NFS bake-a-thon that involves NFSv3 and NFSv4 clients writing the same file has been addressed in this release. This release includes several improvements in CPU scalability for NFSv4 operations. In addition, Neil Brown provided patches that simplify locking during file lookup, creation, rename, and removal that enables subsequent work on making these operations more scalable. We expect to see that work materialize in the next release. There are also numerous single-patch fixes, clean-ups, and the usual improvements in observability" * tag 'nfsd-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (78 commits) lockd: detect and reject lock arguments that overflow NFSD: discard fh_locked flag and fh_lock/fh_unlock NFSD: use (un)lock_inode instead of fh_(un)lock for file operations NFSD: use explicit lock/unlock for directory ops NFSD: reduce locking in nfsd_lookup() NFSD: only call fh_unlock() once in nfsd_link() NFSD: always drop directory lock in nfsd_unlink() NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before returning. NFSD: add posix ACLs to struct nfsd_attrs NFSD: add security label to struct nfsd_attrs NFSD: set attributes when creating symlinks NFSD: introduce struct nfsd_attrs NFSD: verify the opened dentry after setting a delegation NFSD: drop fh argument from alloc_init_deleg NFSD: Move copy offload callback arguments into a separate structure NFSD: Add nfsd4_send_cb_offload() NFSD: Remove kmalloc from nfsd4_do_async_copy() NFSD: Refactor nfsd4_do_copy() NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2) NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2) ... commit b8c0aa9b16bb2f4d5966b87fbf1f36f3280e1f60 Author: Dan Carpenter Date: Mon Aug 1 13:17:32 2022 +0300 NTB: EPF: Tidy up some bounds checks This sscanf() is reading from the filename which was set by the kernel so it should be trust worthy. Although the data is likely trust worthy there is some bounds checking but unfortunately, it is not complete or consistent. Additionally, the Smatch static checker marks everything that comes from sscanf() as tainted and so Smatch complains that this code can lead to an out of bounds issue. Let's clean things up and make Smatch happy. The first problem is that there is no bounds checking in the _show() functions. The _store() and _show() functions are very similar so make the bounds checking the same in both. The second issue is that if "win_no" is zero it leads to an array underflow so add an if (win_no <= 0) check for that. Signed-off-by: Dan Carpenter Acked-by: Souptick Joarder (HPE) Signed-off-by: Jon Mason commit 3305f43cb6a8f1653c31463597d37216d03717c1 Author: Dan Carpenter Date: Mon Aug 1 13:15:25 2022 +0300 NTB: EPF: Fix error code in epf_ntb_bind() Return an error code if pci_register_driver() fails. Don't return success. Fixes: da51fd247424 ("NTB: EPF: support NTB transfer between PCI RC and EP connection") Signed-off-by: Dan Carpenter Acked-by: Souptick Joarder (HPE) Signed-off-by: Jon Mason commit ae9f38adac261e4ca83559c7df21b18dd66aa986 Author: Tom Rix Date: Mon Jul 4 09:25:59 2022 -0400 PCI: endpoint: pci-epf-vntb: reduce several globals to statics sparse reports drivers/pci/endpoint/functions/pci-epf-vntb.c:975:5: warning: symbol 'pci_read' was not declared. Should it be static? drivers/pci/endpoint/functions/pci-epf-vntb.c:984:5: warning: symbol 'pci_write' was not declared. Should it be static? drivers/pci/endpoint/functions/pci-epf-vntb.c:989:16: warning: symbol 'vpci_ops' was not declared. Should it be static? These functions and variables are only used in pci-epf-vntb.c, so their storage class specifiers should be static. Fixes: ff32fac00d97 ("NTB: EPF: support NTB transfer between PCI RC and EP connection") Signed-off-by: Tom Rix Acked-by: Frank Li Signed-off-by: Jon Mason commit 8e4bfbe644a6b804a72fd4575d89507a6e1d9476 Author: Yang Yingliang Date: Sat Jun 25 10:15:16 2022 +0800 PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init() In error case of epf_ntb_mw_bar_init(), memory window BARs should be cleared, so add 'num_mws' parameter in epf_ntb_mw_bar_clear() and calling it in error path to clear the BARs. Also add missing error code when pci_epc_mem_alloc_addr() fails. Fixes: ff32fac00d97 ("NTB: EPF: support NTB transfer between PCI RC and EP connection") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Jon Mason commit 556a2c7dca337954040ffdf0c544aa8bbb75583b Author: Ren Zhijie Date: Fri Jun 24 09:19:11 2022 +0800 PCI: endpoint: Fix Kconfig dependency If CONFIG_NTB is not set and CONFIG_PCI_EPF_VNTB is y. make ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu-, will be failed, like this: drivers/pci/endpoint/functions/pci-epf-vntb.o: In function `epf_ntb_cmd_handler': pci-epf-vntb.c:(.text+0x95e): undefined reference to `ntb_db_event' pci-epf-vntb.c:(.text+0xa1f): undefined reference to `ntb_link_event' pci-epf-vntb.c:(.text+0xa42): undefined reference to `ntb_link_event' drivers/pci/endpoint/functions/pci-epf-vntb.o: In function `pci_vntb_probe': pci-epf-vntb.c:(.text+0x1250): undefined reference to `ntb_register_device' The functions ntb_*() are defined in drivers/ntb/core.c, which need CONFIG_NTB setting y to be build-in. To fix this build error, add depends on NTB. Reported-by: Hulk Robot Fixes: ff32fac00d97("NTB: EPF: support NTB transfer between PCI RC and EP connection") Signed-off-by: Ren Zhijie Acked-by: Frank Li Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Reported-by: Randy Dunlap Signed-off-by: Jon Mason commit 7b14a5e96128ec467ea9ced36a32f28ee7892e1f Author: Colin Ian King Date: Thu Jun 23 17:57:09 2022 +0100 NTB: EPF: set pointer addr to null using NULL rather than 0 The pointer addr is being set to null using 0. Use NULL instead. Cleans up sparse warning: warning: Using plain integer as NULL pointer Signed-off-by: Colin Ian King Signed-off-by: Jon Mason commit 9458c27a67e37a574938e9637afe393c3c2a50af Author: Bagas Sanjaya Date: Wed Jun 22 16:53:45 2022 +0700 Documentation: PCI: extend subheading underline for "lspci output" section The underline syntax for "lspci output..." section is off-by-one less than the section heading's length, hence triggers the warning: Documentation/PCI/endpoint/pci-vntb-howto.rst:131: WARNING: Title underline too short. Extend the underline by one to match the heading length. Link: https://lore.kernel.org/linux-next/20220621200235.211b2e32@canb.auug.org.au/ Fixes: 0c4b285d9636cc ("Documentation: PCI: Add specification for the PCI vNTB function device") Reported-by: Stephen Rothwell Cc: Kishon Vijay Abraham I Cc: Lorenzo Pieralisi Cc: "Krzysztof Wilczyński" Cc: Bjorn Helgaas Cc: Jonathan Corbet Cc: Frank Li Cc: linux-pci@vger.kernel.org Cc: linux-next@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Signed-off-by: Jon Mason commit e9ac6e335dc72cd1296d06e20a7c8bbff8ca19d3 Author: Bagas Sanjaya Date: Wed Jun 22 16:53:44 2022 +0700 Documentation: PCI: Use code-block block for scratchpad registers diagram The diagram in "Scratchpad Registers" isn't formatted inside code block, hence triggers indentation warning: Documentation/PCI/endpoint/pci-vntb-function.rst:82: WARNING: Unexpected indentation. Fix the warning by using code-block directive to format the diagram inside code block, as in other diagrams in Documentation/. While at it, unindent the preceeding text. Link: https://lore.kernel.org/linux-next/20220621200235.211b2e32@canb.auug.org.au/ Fixes: 0c4b285d9636cc ("Documentation: PCI: Add specification for the PCI vNTB function device") Reported-by: Stephen Rothwell Cc: Kishon Vijay Abraham I Cc: Lorenzo Pieralisi Cc: "Krzysztof Wilczyński" Cc: Bjorn Helgaas Cc: Jonathan Corbet Cc: Frank Li Cc: linux-pci@vger.kernel.org Cc: linux-next@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Signed-off-by: Jon Mason commit 4ac8c8e52cd915c7efbd60f1eab4afe855f2e7c4 Author: Frank Li Date: Tue Feb 22 10:23:55 2022 -0600 Documentation: PCI: Add specification for the PCI vNTB function device Add specification for the PCI vNTB function device. The endpoint function driver and the host PCI driver should be created based on this specification. Signed-off-by: Frank Li Signed-off-by: Jon Mason commit e35f56bb03304abc92c928b641af41ca372966bb Author: Frank Li Date: Tue Feb 22 10:23:54 2022 -0600 PCI: endpoint: Support NTB transfer between RC and EP Add NTB function driver and virtual PCI Bus and Virtual NTB driver to implement communication between PCIe Root Port and PCIe EP devices ┌────────────┐ ┌─────────────────────────────────────┐ │ │ │ │ ├────────────┤ │ ┌──────────────┤ │ NTB │ │ │ NTB │ │ NetDev │ │ │ NetDev │ ├────────────┤ │ ├──────────────┤ │ NTB │ │ │ NTB │ │ Transfer │ │ │ Transfer │ ├────────────┤ │ ├──────────────┤ │ │ │ │ │ │ PCI NTB │ │ │ │ │ EPF │ │ │ │ │ Driver │ │ │ PCI Virtual │ │ │ ├───────────────┐ │ NTB Driver │ │ │ │ PCI EP NTB │◄────►│ │ │ │ │ FN Driver │ │ │ ├────────────┤ ├───────────────┤ ├──────────────┤ │ │ │ │ │ │ │ PCI Bus │ ◄─────► │ PCI EP Bus │ │ Virtual PCI │ │ │ PCI │ │ │ Bus │ └────────────┘ └───────────────┴──────┴──────────────┘ PCIe Root Port PCI EP This driver includes 3 parts: 1 PCI EP NTB function driver 2 Virtual PCI bus 3 PCI virtual NTB driver, which is loaded only by above virtual PCI bus Signed-off-by: Frank Li Signed-off-by: Jon Mason commit e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 Author: Frank Li Date: Tue Feb 22 10:23:53 2022 -0600 NTB: epf: Allow more flexibility in the memory BAR map method Support the below BAR configuration methods for epf NTB. BAR 0: config and scratchpad BAR 2: doorbell BAR 4: memory map windows Set difference BAR number information into struct ntb_epf_data. So difference VID/PID can choose different BAR configurations. There are difference BAR map method between epf NTB and epf vNTB Endpoint function. Signed-off-by: Frank Li Signed-off-by: Jon Mason commit 4284c88fff0efc4e418abb53d78e02dc4f099d6c Author: Frank Li Date: Tue Feb 22 10:23:52 2022 -0600 PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address ntb_mw_set_trans() will set memory map window after endpoint function driver bind. The inbound map address need be updated dynamically when using NTB by PCIe Root Port and PCIe Endpoint connection. Checking if iatu already assigned to the BAR, if yes, using assigned iatu number to update inbound address map and skip set BAR's register. Signed-off-by: Frank Li Signed-off-by: Jon Mason commit 56e07c0c9e4a4b59a47a848b021a42cf203c982c Author: Krzysztof Kozlowski Date: Sat Jul 23 10:23:58 2022 +0200 dt-bindings: soc: qcom: smd-rpm: extend example Replace existing limited example with proper code for Qualcomm Resource Power Manager (RPM) over SMD based on MSM8916. This also fixes the example's indentation. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220723082358.39544-2-krzysztof.kozlowski@linaro.org commit 568f83ffe69ba38cc10f36417d6cbb6eee4dc802 Author: Krzysztof Kozlowski Date: Sat Jul 23 10:23:57 2022 +0200 dt-bindings: soc: qcom: smd: reference SMD edge schema The child node of smd is an SMD edge representing remote subsystem. Bring back missing reference from previously sent patch (disappeared when applying). Link: https://lore.kernel.org/r/20220517070113.18023-9-krzysztof.kozlowski@linaro.org Fixes: 385fad1303af ("dt-bindings: remoteproc: qcom,smd-edge: define re-usable schema for smd-edge") Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220723082358.39544-1-krzysztof.kozlowski@linaro.org commit 331753ff3292d5ef987ad6106f737853c3a187ba Author: Bhupesh Sharma Date: Tue Jul 26 01:57:09 2022 +0530 dt-bindings: mmc: sdhci-msm: Fix 'operating-points-v2 was unexpected' issue As Rob reported in [1], there is one more issue present in the 'sdhci-msm' dt-binding which shows up when a fix for 'unevaluatedProperties' handling is applied: Documentation/devicetree/bindings/mmc/sdhci-msm.example.dtb: mmc@8804000: Unevaluated properties are not allowed ('operating-points-v2' was unexpected) Fix the same. [1]. https://lore.kernel.org/lkml/20220514220116.1008254-1-bhupesh.sharma@linaro.org/ Cc: Bjorn Andersson Cc: Rob Herring Cc: Ulf Hansson Signed-off-by: Bhupesh Sharma Acked-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220725202709.2861789-1-bhupesh.sharma@linaro.org commit 0d22bbc2d557515bd51629408cada0fca681343a Author: Krzysztof Kozlowski Date: Mon Aug 8 13:15:26 2022 +0300 dt-bindings: display: simple-framebuffer: Drop Bartlomiej Zolnierkiewicz Bartlomiej's Samsung email address is not working since around last year and there was no follow up patch take over of the drivers, so drop the email from maintainers. Cc: Bartlomiej Zolnierkiewicz Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220808101526.46556-3-krzysztof.kozlowski@linaro.org commit d80d60b0db6ff3dd2e29247cc2a5166d7e9ae37e Author: Sebastian Würl Date: Thu Aug 4 10:14:11 2022 +0200 can: mcp251x: Fix race condition on receive interrupt The mcp251x driver uses both receiving mailboxes of the CAN controller chips. For retrieving the CAN frames from the controller via SPI, it checks once per interrupt which mailboxes have been filled and will retrieve the messages accordingly. This introduces a race condition, as another CAN frame can enter mailbox 1 while mailbox 0 is emptied. If now another CAN frame enters mailbox 0 until the interrupt handler is called next, mailbox 0 is emptied before mailbox 1, leading to out-of-order CAN frames in the network device. This is fixed by checking the interrupt flags once again after freeing mailbox 0, to correctly also empty mailbox 1 before leaving the handler. For reproducing the bug I created the following setup: - Two CAN devices, one Raspberry Pi with MCP2515, the other can be any. - Setup CAN to 1 MHz - Spam bursts of 5 CAN-messages with increasing CAN-ids - Continue sending the bursts while sleeping a second between the bursts - Check on the RPi whether the received messages have increasing CAN-ids - Without this patch, every burst of messages will contain a flipped pair v3: https://lore.kernel.org/all/20220804075914.67569-1-sebastian.wuerl@ororatech.com v2: https://lore.kernel.org/all/20220804064803.63157-1-sebastian.wuerl@ororatech.com v1: https://lore.kernel.org/all/20220803153300.58732-1-sebastian.wuerl@ororatech.com Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.") Signed-off-by: Sebastian Würl Link: https://lore.kernel.org/all/20220804081411.68567-1-sebastian.wuerl@ororatech.com [mkl: reduce scope of intf1, eflag1] Signed-off-by: Marc Kleine-Budde commit bc3c8fe3c79bcdae4d90e3726054fac5cca8ac32 Author: Florian Westphal Date: Sun Aug 7 13:53:04 2022 +0200 plip: avoid rcu debug splat WARNING: suspicious RCU usage 5.2.0-rc2-00605-g2638eb8b50cfc #1 Not tainted drivers/net/plip/plip.c:1110 suspicious rcu_dereference_check() usage! plip_open is called with RTNL held, switch to the correct helper. Fixes: 2638eb8b50cf ("net: ipv4: provide __rcu annotation for ifa_list") Reported-by: kernel test robot Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20220807115304.13257-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 1b7680c6c1f6de9904f1d9b05c952f0c64a03350 Author: Sandor Bodo-Merle Date: Mon Aug 8 19:39:39 2022 +0200 net: bgmac: Fix a BUG triggered by wrong bytes_compl On one of our machines we got: kernel BUG at lib/dynamic_queue_limits.c:27! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM CPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G W O 4.14.275-rt132 #1 Hardware name: BRCM XGS iProc task: ee3415c0 task.stack: ee32a000 PC is at dql_completed+0x168/0x178 LR is at bgmac_poll+0x18c/0x6d8 pc : [] lr : [] psr: 800a0313 sp : ee32be14 ip : 000005ea fp : 00000bd4 r10: ee558500 r9 : c0116298 r8 : 00000002 r7 : 00000000 r6 : ef128810 r5 : 01993267 r4 : 01993851 r3 : ee558000 r2 : 000070e1 r1 : 00000bd4 r0 : ee52c180 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 12c5387d Table: 8e88c04a DAC: 00000051 Process irq/41-bgmac (pid: 1166, stack limit = 0xee32a210) Stack: (0xee32be14 to 0xee32c000) be00: ee558520 ee52c100 ef128810 be20: 00000000 00000002 c0116298 c04b5a18 00000000 c0a0c8c4 c0951780 00000040 be40: c0701780 ee558500 ee55d520 ef05b340 ef6f9780 ee558520 00000001 00000040 be60: ffffe000 c0a56878 ef6fa040 c0952040 0000012c c0528744 ef6f97b0 fffcfb6a be80: c0a04104 2eda8000 c0a0c4ec c0a0d368 ee32bf44 c0153534 ee32be98 ee32be98 bea0: ee32bea0 ee32bea0 ee32bea8 ee32bea8 00000000 c01462e4 ffffe000 ef6f22a8 bec0: ffffe000 00000008 ee32bee4 c0147430 ffffe000 c094a2a8 00000003 ffffe000 bee0: c0a54528 00208040 0000000c c0a0c8c4 c0a65980 c0124d3c 00000008 ee558520 bf00: c094a23c c0a02080 00000000 c07a9910 ef136970 ef136970 ee30a440 ef136900 bf20: ee30a440 00000001 ef136900 ee30a440 c016d990 00000000 c0108db0 c012500c bf40: ef136900 c016da14 ee30a464 ffffe000 00000001 c016dd14 00000000 c016db28 bf60: ffffe000 ee21a080 ee30a400 00000000 ee32a000 ee30a440 c016dbfc ee25fd70 bf80: ee21a09c c013edcc ee32a000 ee30a400 c013ec7c 00000000 00000000 00000000 bfa0: 00000000 00000000 00000000 c0108470 00000000 00000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [] (dql_completed) from [] (bgmac_poll+0x18c/0x6d8) [] (bgmac_poll) from [] (net_rx_action+0x1c4/0x494) [] (net_rx_action) from [] (do_current_softirqs+0x1ec/0x43c) [] (do_current_softirqs) from [] (__local_bh_enable+0x80/0x98) [] (__local_bh_enable) from [] (irq_forced_thread_fn+0x84/0x98) [] (irq_forced_thread_fn) from [] (irq_thread+0x118/0x1c0) [] (irq_thread) from [] (kthread+0x150/0x158) [] (kthread) from [] (ret_from_fork+0x14/0x24) Code: a83f15e0 0200001a 0630a0e1 c3ffffea (f201f0e7) The issue seems similar to commit 90b3b339364c ("net: hisilicon: Fix a BUG trigered by wrong bytes_compl") and potentially introduced by commit b38c83dd0866 ("bgmac: simplify tx ring index handling"). If there is an RX interrupt between setting ring->end and netdev_sent_queue() we can hit the BUG_ON as bgmac_dma_tx_free() can miscalculate the queue size while called from bgmac_poll(). The machine which triggered the BUG runs a v4.14 RT kernel - but the issue seems present in mainline too. Fixes: b38c83dd0866 ("bgmac: simplify tx ring index handling") Signed-off-by: Sandor Bodo-Merle Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20220808173939.193804-1-sbodomerle@gmail.com Signed-off-by: Jakub Kicinski commit 4c46bb49460ee14c69629e813640d8b929e88941 Author: Vladimir Oltean Date: Mon Aug 8 15:51:27 2022 +0300 net: dsa: felix: suppress non-changes to the tagging protocol The way in which dsa_tree_change_tag_proto() works is that when dsa_tree_notify() fails, it doesn't know whether the operation failed mid way in a multi-switch tree, or it failed for a single-switch tree. So even though drivers need to fail cleanly in ds->ops->change_tag_protocol(), DSA will still call dsa_tree_notify() again, to restore the old tag protocol for potential switches in the tree where the change did succeeed (before failing for others). This means for the felix driver that if we report an error in felix_change_tag_protocol(), we'll get another call where proto_ops == old_proto_ops. If we proceed to act upon that, we may do unexpected things. For example, we will call dsa_tag_8021q_register() twice in a row, without any dsa_tag_8021q_unregister() in between. Then we will actually call dsa_tag_8021q_unregister() via old_proto_ops->teardown, which (if it manages to run at all, after walking through corrupted data structures) will leave the ports inoperational anyway. The bug can be readily reproduced if we force an error while in tag_8021q mode; this crashes the kernel. echo ocelot-8021q > /sys/class/net/eno2/dsa/tagging echo edsa > /sys/class/net/eno2/dsa/tagging # -EPROTONOSUPPORT Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 Call trace: vcap_entry_get+0x24/0x124 ocelot_vcap_filter_del+0x198/0x270 felix_tag_8021q_vlan_del+0xd4/0x21c dsa_switch_tag_8021q_vlan_del+0x168/0x2cc dsa_switch_event+0x68/0x1170 dsa_tree_notify+0x14/0x34 dsa_port_tag_8021q_vlan_del+0x84/0x110 dsa_tag_8021q_unregister+0x15c/0x1c0 felix_tag_8021q_teardown+0x16c/0x180 felix_change_tag_protocol+0x1bc/0x230 dsa_switch_event+0x14c/0x1170 dsa_tree_change_tag_proto+0x118/0x1c0 Fixes: 7a29d220f4c0 ("net: dsa: felix: reimplement tagging protocol change with function pointers") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20220808125127.3344094-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7ba0fa7f32f32f01e49197d4d714ff9aea508502 Merge: b8c3bf0ed2edf f01272ee3856e Author: Jakub Kicinski Date: Tue Aug 9 11:51:00 2022 -0700 Merge tag 'wireless-2022-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.0 First set of fixes for v6.0. Small one this time, fix a cfg80211 warning seen with brcmfmac and remove an unncessary inline keyword from wilc1000. * tag 'wireless-2022-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: wilc1000: fix spurious inline in wilc_handle_disconnect() wifi: cfg80211: Fix validating BSS pointers in __cfg80211_connect_result ==================== Link: https://lore.kernel.org/r/20220809164756.B1DAEC433D6@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 580077855a40741cf511766129702d97ff02f4d9 Author: Florian Westphal Date: Tue Aug 9 18:34:02 2022 +0200 netfilter: nf_tables: fix null deref due to zeroed list head In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a null dereference: BUG: KASAN: null-ptr-deref in nft_trans_destroy+0x26/0x59 Call Trace: nft_trans_destroy+0x26/0x59 nf_tables_newtable+0x4bc/0x9bc [..] Its sane to assume that nft_trans_destroy() can be called on the transaction object returned by nft_trans_alloc(), so make sure the list head is initialised. Fixes: 55dd6f93076b ("netfilter: nf_tables: use new transaction infrastructure to handle table") Reported-by: mingi cho Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit f323ef3a0d49e147365284bc1f02212e617b7f09 Author: Pablo Neira Ayuso Date: Mon Aug 8 19:30:07 2022 +0200 netfilter: nf_tables: disallow jump to implicit chain from set element Extend struct nft_data_desc to add a flag field that specifies nft_data_init() is being called for set element data. Use it to disallow jump to implicit chain from set element, only jump to chain via immediate expression is allowed. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso commit 341b6941608762d8235f3fd1e45e4d7114ed8c2c Author: Pablo Neira Ayuso Date: Mon Aug 8 19:30:06 2022 +0200 netfilter: nf_tables: upfront validation of data via nft_data_init() Instead of parsing the data and then validate that type and length are correct, pass a description of the expected data so it can be validated upfront before parsing it to bail out earlier. This patch adds a new .size field to specify the maximum size of the data area. The .len field is optional and it is used as an input/output field, it provides the specific length of the expected data in the input path. If then .len field is not specified, then obtained length from the netlink attribute is stored. This is required by cmp, bitwise, range and immediate, which provide no netlink attribute that describes the data length. The immediate expression uses the destination register type to infer the expected data type. Relying on opencoded validation of the expected data might lead to subtle bugs as described in 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data"). Signed-off-by: Pablo Neira Ayuso commit 3fa5cbdc44de190f2c5605ba7db015ae0d26f668 Author: Trond Myklebust Date: Tue Aug 9 13:59:09 2022 -0400 NFS: Improve readpage/writepage tracing Switch formatting to better match that used by other NFS tracepoints. Signed-off-by: Trond Myklebust commit b313eb91521872284c0e395773fc6e9827fb1446 Author: Trond Myklebust Date: Tue Aug 9 13:46:41 2022 -0400 NFS: Improve O_DIRECT tracing Switch the formatting to match the other NFS tracepoints. Signed-off-by: Trond Myklebust commit af887e437bb298752b2edc5834048b8151b8aea0 Author: Trond Myklebust Date: Tue Aug 9 12:50:28 2022 -0400 NFS: Improve write error tracing Don't leak request pointers, but use the "device:inode" labelling that is used by all the other trace points. Furthermore, replace use of page indexes with an offset, again in order to align behaviour with other NFS trace points. Signed-off-by: Trond Myklebust commit e362359ace6f87c201531872486ff295df306d13 Author: Thadeu Lima de Souza Cascardo Date: Tue Aug 9 14:07:51 2022 -0300 posix-cpu-timers: Cleanup CPU timers before freeing them during exec Commit 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") started looking up tasks by PID when deleting a CPU timer. When a non-leader thread calls execve, it will switch PIDs with the leader process. Then, as it calls exit_itimers, posix_cpu_timer_del cannot find the task because the timer still points out to the old PID. That means that armed timers won't be disarmed, that is, they won't be removed from the timerqueue_list. exit_itimers will still release their memory, and when that list is later processed, it leads to a use-after-free. Clean up the timers from the de-threaded task before freeing them. This prevents a reported use-after-free. Fixes: 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Cc: Link: https://lore.kernel.org/r/20220809170751.164716-1-cascardo@canonical.com commit 46dae32fe625a75f549c3a70edc77b778197bb05 Author: Youngmin Nam Date: Tue Jul 12 18:47:15 2022 +0900 time: Correct the prototype of ns_to_kernel_old_timeval and ns_to_timespec64 In ns_to_kernel_old_timeval() definition, the function argument is defined with const identifier in kernel/time/time.c, but the prototype in include/linux/time32.h looks different. - The function is defined in kernel/time/time.c as below: struct __kernel_old_timeval ns_to_kernel_old_timeval(const s64 nsec) - The function is decalared in include/linux/time32.h as below: extern struct __kernel_old_timeval ns_to_kernel_old_timeval(s64 nsec); Because the variable of arithmethic types isn't modified in the calling scope, there's no need to mark arguments as const, which was already mentioned during review (Link[1) of the original patch. Likewise remove the "const" keyword in both definition and declaration of ns_to_timespec64() as requested by Arnd (Link[2]). Fixes: a84d1169164b ("y2038: Introduce struct __kernel_old_timeval") Signed-off-by: Youngmin Nam Signed-off-by: Thomas Gleixner Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/all/20220712094715.2918823-1-youngmin.nam@samsung.com Link[1]: https://lore.kernel.org/all/20180310081123.thin6wphgk7tongy@gmail.com/ Link[2]: https://lore.kernel.org/all/CAK8P3a3nknJgEDESGdJH91jMj6R_xydFqWASd8r5BbesdvMBgA@mail.gmail.com/ commit 134941683b89d05b5e5c28c817c95049ba409d01 Author: Christophe JAILLET Date: Sat Aug 6 17:39:20 2022 +0200 netfilter: ip6t_LOG: Fix a typo in a comment s/_IPT_LOG_H/_IP6T_LOG_H/ While at it add some surrounding space to ease reading. Signed-off-by: Christophe JAILLET Signed-off-by: Pablo Neira Ayuso commit 36d5b2913219ac853908b0f1c664345e04313856 Author: Thadeu Lima de Souza Cascardo Date: Tue Aug 9 14:01:48 2022 -0300 netfilter: nf_tables: do not allow RULE_ID to refer to another chain When doing lookups for rules on the same batch by using its ID, a rule from a different chain can be used. If a rule is added to a chain but tries to be positioned next to a rule from a different chain, it will be linked to chain2, but the use counter on chain1 would be the one to be incremented. When looking for rules by ID, use the chain that was used for the lookup by name. The chain used in the context copied to the transaction needs to match that same chain. That way, struct nft_rule does not need to get enlarged with another member. Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute") Fixes: 75dd48e2e420 ("netfilter: nf_tables: Support RULE_ID reference in new rule") Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Signed-off-by: Pablo Neira Ayuso commit 95f466d22364a33d183509629d0879885b4f547e Author: Thadeu Lima de Souza Cascardo Date: Tue Aug 9 14:01:47 2022 -0300 netfilter: nf_tables: do not allow CHAIN_ID to refer to another table When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain in a different table, it will be linked to the chain in table2, but would have expressions referring to objects in table1. Then, when table1 is removed, the rule will not be removed as its linked to a chain in table2. When expressions in the rule are processed or removed, that will lead to a use-after-free. When looking for chains by ID, use the table that was used for the lookup by name, and only return chains belonging to that same table. Fixes: 837830a4b439 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute") Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Signed-off-by: Pablo Neira Ayuso commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 Author: Thadeu Lima de Souza Cascardo Date: Tue Aug 9 14:01:46 2022 -0300 netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Signed-off-by: Pablo Neira Ayuso commit 34aae2c2fb1e3d88a5aeee16715cb6bf0336cdce Author: Pablo Neira Ayuso Date: Tue Aug 9 11:25:43 2022 +0200 netfilter: nf_tables: validate variable length element extension Update template to validate variable length extensions. This patch adds a new .ext_len[id] field to the template to store the expected extension length. This is used to sanity check the initialization of the variable length extension. Use PTR_ERR() in nft_set_elem_init() to report errors since, after this update, there are two reason why this might fail, either because of ENOMEM or insufficient room in the extension field (EINVAL). Kernels up until 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data") allowed to copy more data to the extension than was allocated. This ext_len field allows to validate if the destination has the correct size as additional check. Signed-off-by: Pablo Neira Ayuso commit 46981fa78490e16589559cec8c762e5527d665d2 Author: Sakari Ailus Date: Tue Aug 9 00:12:13 2022 +0300 ACPI: property: Fix error handling in acpi_init_properties() buf.pointer, memory for storing _DSD data and nodes, was released if either parsing properties or, as recently added, attaching data node tags failed. Alas, properties were still left pointing to this memory if parsing properties were successful but attaching data node tags failed. Fix this by separating error handling for the two, and leaving properties intact if data nodes cannot be tagged for a reason or another. Reported-by: kernel test robot Fixes: 1d52f10917a7 ("ACPI: property: Tie data nodes to acpi handles") Signed-off-by: Sakari Ailus [ rjw: Drop unrelated white space change ] Signed-off-by: Rafael J. Wysocki commit 15205c2829ca2cbb5ece5ceaafe1171a8470e62b Merge: 4b22e20741950 1a1e3aca9d495 Author: Linus Torvalds Date: Tue Aug 9 10:11:56 2022 -0700 Merge tag 'fscache-fixes-20220809' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache updates from David Howells: - Fix a cookie access ref leak if a cookie is invalidated a second time before the first invalidation is actually processed. - Add a tracepoint to log cookie lookup failure * tag 'fscache-fixes-20220809' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: add tracepoint when failing cookie fscache: don't leak cookie access refs if invalidation is in progress or failed commit 4b22e2074195097c9d6bdc688288d12b7b236bae Merge: 426b4ca2d6a5a 2757a4dc18499 Author: Linus Torvalds Date: Tue Aug 9 10:08:08 2022 -0700 Merge tag 'afs-fixes-20220802' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: "Fix AFS refcount handling. The first patch converts afs to use refcount_t for its refcounts and the second patch fixes afs_put_call() and afs_put_server() to save the values they're going to log in the tracepoint before decrementing the refcount" * tag 'afs-fixes-20220802' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix access after dec in put functions afs: Use refcount_t rather than atomic_t commit 426b4ca2d6a5ab51f6b6175d06e4f8ddea434cdf Merge: b8dcef877ab5f 5fadbd992996e Author: Linus Torvalds Date: Tue Aug 9 09:52:28 2022 -0700 Merge tag 'fs.setgid.v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull setgid updates from Christian Brauner: "This contains the work to move setgid stripping out of individual filesystems and into the VFS itself. Creating files that have both the S_IXGRP and S_ISGID bit raised in directories that themselves have the S_ISGID bit set requires additional privileges to avoid security issues. When a filesystem creates a new inode it needs to take care that the caller is either in the group of the newly created inode or they have CAP_FSETID in their current user namespace and are privileged over the parent directory of the new inode. If any of these two conditions is true then the S_ISGID bit can be raised for an S_IXGRP file and if not it needs to be stripped. However, there are several key issues with the current implementation: - S_ISGID stripping logic is entangled with umask stripping. For example, if the umask removes the S_IXGRP bit from the file about to be created then the S_ISGID bit will be kept. The inode_init_owner() helper is responsible for S_ISGID stripping and is called before posix_acl_create(). So we can end up with two different orderings: 1. FS without POSIX ACL support First strip umask then strip S_ISGID in inode_init_owner(). In other words, if a filesystem doesn't support or enable POSIX ACLs then umask stripping is done directly in the vfs before calling into the filesystem: 2. FS with POSIX ACL support First strip S_ISGID in inode_init_owner() then strip umask in posix_acl_create(). In other words, if the filesystem does support POSIX ACLs then unmask stripping may be done in the filesystem itself when calling posix_acl_create(). Note that technically filesystems are free to impose their own ordering between posix_acl_create() and inode_init_owner() meaning that there's additional ordering issues that influence S_ISGID inheritance. (Note that the commit message of commit 1639a49ccdce ("fs: move S_ISGID stripping into the vfs_*() helpers") gets the ordering between inode_init_owner() and posix_acl_create() the wrong way around. I realized this too late.) - Filesystems that don't rely on inode_init_owner() don't get S_ISGID stripping logic. While that may be intentional (e.g. network filesystems might just defer setgid stripping to a server) it is often just a security issue. Note that mandating the use of inode_init_owner() was proposed as an alternative solution but that wouldn't fix the ordering issues and there are examples such as afs where the use of inode_init_owner() isn't possible. In any case, we should also try the cleaner and generalized solution first before resorting to this approach. - We still have S_ISGID inheritance bugs years after the initial round of S_ISGID inheritance fixes: e014f37db1a2 ("xfs: use setattr_copy to set vfs inode attributes") 01ea173e103e ("xfs: fix up non-directory creation in SGID directories") fd84bfdddd16 ("ceph: fix up non-directory creation in SGID directories") All of this led us to conclude that the current state is too messy. While we won't be able to make it completely clean as posix_acl_create() is still a filesystem specific call we can improve the S_SIGD stripping situation quite a bit by hoisting it out of inode_init_owner() and into the respective vfs creation operations. The obvious advantage is that we don't need to rely on individual filesystems getting S_ISGID stripping right and instead can standardize the ordering between S_ISGID and umask stripping directly in the VFS. A few short implementation notes: - The stripping logic needs to happen in vfs_*() helpers for the sake of stacking filesystems such as overlayfs that rely on these helpers taking care of S_ISGID stripping. - Security hooks have never seen the mode as it is ultimately seen by the filesystem because of the ordering issue we mentioned. Nothing is changed for them. We simply continue to strip the umask before passing the mode down to the security hooks. - The following filesystems use inode_init_owner() and thus relied on S_ISGID stripping: spufs, 9p, bfs, btrfs, ext2, ext4, f2fs, hfsplus, hugetlbfs, jfs, minix, nilfs2, ntfs3, ocfs2, omfs, overlayfs, ramfs, reiserfs, sysv, ubifs, udf, ufs, xfs, zonefs, bpf, tmpfs. We've audited all callchains as best as we could. More details can be found in the commit message to 1639a49ccdce ("fs: move S_ISGID stripping into the vfs_*() helpers")" * tag 'fs.setgid.v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: ceph: rely on vfs for setgid stripping fs: move S_ISGID stripping into the vfs_*() helpers fs: Add missing umask strip in vfs_tmpfile fs: add mode_strip_sgid() helper commit b8dcef877ab5f2637fccd3efb6fe169c8211961a Merge: 15886321a426c 04d9490986d1e Author: Linus Torvalds Date: Tue Aug 9 09:48:30 2022 -0700 Merge tag 'memblock-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - An optimization in memblock_add_range() to reduce array traversals - Improvements to the memblock test suite * tag 'memblock-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock test: Modify the obsolete description in README memblock tests: fix compilation errors memblock tests: change build options to run-time options memblock tests: remove completed TODO items memblock tests: set memblock_debug to enable memblock_dbg() messages memblock tests: add verbose output to memblock tests memblock tests: Makefile: add arguments to control verbosity memblock: avoid some repeat when add new range commit 2939deac1fa220bc82b89235f146df1d9b52e876 Author: Dmitry Osipenko Date: Thu Jun 30 23:04:04 2022 +0300 drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error Use ww_acquire_fini() in the error code paths. Otherwise lockdep thinks that lock is held when lock's memory is freed after the drm_gem_lock_reservations() error. The ww_acquire_context needs to be annotated as "released", which fixes the noisy "WARNING: held lock freed!" splat of VirtIO-GPU driver with CONFIG_DEBUG_MUTEXES=y and enabled lockdep. Cc: stable@vger.kernel.org Fixes: 7edc3e3b975b5 ("drm: Add helpers for locking an array of BO reservations.") Reviewed-by: Thomas Hellström Reviewed-by: Christian König Signed-off-by: Dmitry Osipenko Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220630200405.1883897-2-dmitry.osipenko@collabora.com commit 15886321a426c7f4f1a0ff788f5b48e49230c0f3 Merge: 5318b987fe9f3 472e68df4a5ea Author: Linus Torvalds Date: Tue Aug 9 09:39:25 2022 -0700 Merge tag 'm68knommu-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu fixes from Greg Ungerer: - spelling in comment - compilation when flexcan driver enabled - sparse warning * tag 'm68knommu-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: Fix syntax errors in comments m68k: coldfire: make symbol m523x_clk_lookup static m68k: coldfire/device.c: protect FLEXCAN blocks commit 5318b987fe9f3430adb0f5d81d07052fd996835b Merge: eb555cb5b794f ba6e31af2be96 Author: Linus Torvalds Date: Tue Aug 9 09:29:07 2022 -0700 Merge tag 'x86_bugs_pbrsb' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 eIBRS fixes from Borislav Petkov: "More from the CPU vulnerability nightmares front: Intel eIBRS machines do not sufficiently mitigate against RET mispredictions when doing a VM Exit therefore an additional RSB, one-entry stuffing is needed" * tag 'x86_bugs_pbrsb' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Add LFENCE to RSB fill sequence x86/speculation: Add RSB VM Exit protections commit df4aaf015775221dde8a51ee09edb919981f091e Author: Dmitry Osipenko Date: Thu Jun 30 23:00:57 2022 +0300 drm/shmem-helper: Add missing vunmap on error The vmapping of dma-buf may succeed, but DRM SHMEM rejects the IOMEM mapping, and thus, drm_gem_shmem_vmap_locked() should unvmap the IOMEM before erroring out. Cc: stable@vger.kernel.org Fixes: 49a3f51dfeee ("drm/gem: Use struct dma_buf_map in GEM vmap ops and convert GEM backends") Signed-off-by: Dmitry Osipenko Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220630200058.1883506-2-dmitry.osipenko@collabora.com commit a914fc529f59dcd9f59633157cf7ee70822ebcac Author: Dave Jiang Date: Tue Aug 2 14:10:13 2022 -0700 ntb: intel: add GNR support for Intel PCIe gen5 NTB Add Intel Granite Rapids NTB PCI device ID and related enabling. Expectation is same hardware interface as Saphire Rapids Xeon platforms. Signed-off-by: Dave Jiang Acked-by: Allen Hubbe Signed-off-by: Jon Mason commit 45e1058b77feade4e36402828bfe3e0d3363177b Author: Dan Carpenter Date: Wed Jul 20 21:28:18 2022 +0300 NTB: ntb_tool: uninitialized heap data in tool_fn_write() The call to: ret = simple_write_to_buffer(buf, size, offp, ubuf, size); will return success if it is able to write even one byte to "buf". The value of "*offp" controls which byte. This could result in reading uninitialized data when we do the sscanf() on the next line. This code is not really desigined to handle partial writes where *offp is non-zero and the "buf" is preserved and re-used between writes. Just ban partial writes and replace the simple_write_to_buffer() with copy_from_user(). Fixes: 578b881ba9c4 ("NTB: Add tool test client") Signed-off-by: Dan Carpenter Signed-off-by: Jon Mason commit a44252d5c3bbd76efa7b65819712f0e2b1de54c0 Author: Justin Stitt Date: Mon Jul 11 16:01:48 2022 -0700 ntb: idt: fix clang -Wformat warnings When building with Clang we encounter these warnings: | drivers/ntb/hw/idt/ntb_hw_idt.c:2409:28: error: format specifies type | 'unsigned char' but the argument has type 'int' [-Werror,-Wformat] | "\t%hhu-%hhu.\t", idx + cnt - 1); - | drivers/ntb/hw/idt/ntb_hw_idt.c:2438:29: error: format specifies type | 'unsigned char' but the argument has type 'int' [-Werror,-Wformat] | "\t%hhu-%hhu.\t", idx + cnt - 1); - | drivers/ntb/hw/idt/ntb_hw_idt.c:2484:15: error: format specifies type | 'unsigned char' but the argument has type 'int' [-Werror,-Wformat], src); For the first two warnings the format specifier used is `%hhu` which describes a u8. Both `idx` and `cnt` are u8 as well. However, the expression as a whole is promoted to an int as you cannot get smaller-than-int from addition. Therefore, to fix the warning, use the promoted-to-type's format specifier -- in this case `%d`. example: `` uint8_t a = 4, b = 7; int size = sizeof(a + b - 1); printf("%d\n", size); // output: 4 ``` For the last warning, src is of type `int` while the format specifier describes a u8. The fix here is just to use the proper specifier `%d`. See more: (https://wiki.sei.cmu.edu/confluence/display/c/INT02-C.+Understand+integer+conversion+rules) "Integer types smaller than int are promoted when an operation is performed on them. If all values of the original type can be represented as an int, the value of the smaller type is converted to an int; otherwise, it is converted to an unsigned int." Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Justin Stitt Acked-by: Serge Semin Signed-off-by: Jon Mason commit 30267718fe2d4dbea49015b022f6f1fe16ca31ab Author: Bedant Patnaik Date: Tue Aug 9 19:54:55 2022 +0530 ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED Board ID 8786 seems to be another variant of the Omen 15 that needs ALC285_FIXUP_HP_MUTE_LED for working mute LED. Signed-off-by: Bedant Patnaik Cc: Link: https://lore.kernel.org/r/20220809142455.6473-1-bedant.patnaik@gmail.com Signed-off-by: Takashi Iwai commit 1a1e3aca9d4957e282945cdc2b58e7c560b8e0d2 Author: Jeff Layton Date: Fri Aug 5 06:43:48 2022 -0400 fscache: add tracepoint when failing cookie Signed-off-by: Jeff Layton Signed-off-by: David Howells commit fb24771faf72a2fd62b3b6287af3c610c3ec9cf1 Author: Jeff Layton Date: Fri Aug 5 06:42:45 2022 -0400 fscache: don't leak cookie access refs if invalidation is in progress or failed It's possible for a request to invalidate a fscache_cookie will come in while we're already processing an invalidation. If that happens we currently take an extra access reference that will leak. Only call __fscache_begin_cookie_access if the FSCACHE_COOKIE_DO_INVALIDATE bit was previously clear. Also, ensure that we attempt to clear the bit when the cookie is "FAILED" and put the reference to avoid an access leak. Fixes: 85e4ea1049c7 ("fscache: Fix invalidation/lookup race") Suggested-by: David Howells Signed-off-by: Jeff Layton Signed-off-by: David Howells commit 6bc2906253e723d1ab1acc652b55b83e286bfec2 Author: Takashi Iwai Date: Tue Aug 9 09:32:59 2022 +0200 ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ASUS ROG Zenith II has two USB interfaces, one for the front headphone and another for the rest I/O. Currently we provided the mixer mapping for the latter but with an incomplete form. This patch corrects and provides more comprehensive mixer mapping, as well as providing the proper device names for both the front headphone and main audio. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211005 Fixes: 2a48218f8e23 ("ALSA: usb-audio: Add mixer workaround for TRX40 and co") Link: https://lore.kernel.org/r/20220809073259.18849-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit cf4b7387c0a842d64bdd7c353e6d3298174a7740 Author: Arunpravin Paneer Selvam Date: Tue Aug 9 02:56:23 2022 -0700 drm/ttm: Fix dummy res NULL ptr deref bug Check the bo->resource value before accessing the resource mem_type. v2: Fix commit description unwrapped warning [ 40.191227][ T184] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 40.192995][ T184] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 40.194411][ T184] CPU: 1 PID: 184 Comm: systemd-udevd Not tainted 5.19.0-rc4-00721-gb297c22b7070 #1 [ 40.196063][ T184] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 [ 40.199605][ T184] RIP: 0010:ttm_bo_validate+0x1b3/0x240 [ttm] [ 40.200754][ T184] Code: e8 72 c5 ff ff 83 f8 b8 74 d4 85 c0 75 54 49 8b 9e 58 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 3c 03 7e 44 8b 53 10 31 c0 85 d2 0f 85 58 [ 40.203685][ T184] RSP: 0018:ffffc900006df0c8 EFLAGS: 00010202 [ 40.204630][ T184] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1102f4bb71b [ 40.205864][ T184] RDX: 0000000000000002 RSI: ffffc900006df208 RDI: 0000000000000010 [ 40.207102][ T184] RBP: 1ffff920000dbe1a R08: ffffc900006df208 R09: 0000000000000000 [ 40.208394][ T184] R10: ffff88817a5f0000 R11: 0000000000000001 R12: ffffc900006df110 [ 40.209692][ T184] R13: ffffc900006df0f0 R14: ffff88817a5db800 R15: ffffc900006df208 [ 40.210862][ T184] FS: 00007f6b1d16e8c0(0000) GS:ffff88839d700000(0000) knlGS:0000000000000000 [ 40.212250][ T184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.213275][ T184] CR2: 000055a1001d4ff0 CR3: 00000001700f4000 CR4: 00000000000006e0 [ 40.214469][ T184] Call Trace: [ 40.214974][ T184] [ 40.215438][ T184] ? ttm_bo_bounce_temp_buffer+0x140/0x140 [ttm] [ 40.216572][ T184] ? mutex_spin_on_owner+0x240/0x240 [ 40.217456][ T184] ? drm_vma_offset_add+0xaa/0x100 [drm] [ 40.218457][ T184] ttm_bo_init_reserved+0x3d6/0x540 [ttm] [ 40.219410][ T184] ? shmem_get_inode+0x744/0x980 [ 40.220231][ T184] ttm_bo_init_validate+0xb1/0x200 [ttm] [ 40.221172][ T184] ? bo_driver_evict_flags+0x340/0x340 [drm_vram_helper] [ 40.222530][ T184] ? ttm_bo_init_reserved+0x540/0x540 [ttm] [ 40.223643][ T184] ? __do_sys_finit_module+0x11a/0x1c0 [ 40.224654][ T184] ? __shmem_file_setup+0x102/0x280 [ 40.234764][ T184] drm_gem_vram_create+0x305/0x480 [drm_vram_helper] [ 40.235766][ T184] ? bo_driver_evict_flags+0x340/0x340 [drm_vram_helper] [ 40.236846][ T184] ? __kasan_slab_free+0x108/0x180 [ 40.237650][ T184] drm_gem_vram_fill_create_dumb+0x134/0x340 [drm_vram_helper] [ 40.238864][ T184] ? local_pci_probe+0xdf/0x180 [ 40.239674][ T184] ? drmm_vram_helper_init+0x400/0x400 [drm_vram_helper] [ 40.240826][ T184] drm_client_framebuffer_create+0x19c/0x400 [drm] [ 40.241955][ T184] ? drm_client_buffer_delete+0x200/0x200 [drm] [ 40.243001][ T184] ? drm_client_pick_crtcs+0x554/0xb80 [drm] [ 40.244030][ T184] drm_fb_helper_generic_probe+0x23f/0x940 [drm_kms_helper] [ 40.245226][ T184] ? __cond_resched+0x1c/0xc0 [ 40.245987][ T184] ? drm_fb_helper_memory_range_to_clip+0x180/0x180 [drm_kms_helper] [ 40.247316][ T184] ? mutex_unlock+0x80/0x100 [ 40.248005][ T184] ? __mutex_unlock_slowpath+0x2c0/0x2c0 [ 40.249083][ T184] drm_fb_helper_single_fb_probe+0x907/0xf00 [drm_kms_helper] [ 40.250314][ T184] ? drm_fb_helper_check_var+0x1180/0x1180 [drm_kms_helper] [ 40.251540][ T184] ? __cond_resched+0x1c/0xc0 [ 40.252321][ T184] ? mutex_lock+0x9f/0x100 [ 40.253062][ T184] __drm_fb_helper_initial_config_and_unlock+0xb9/0x2c0 [drm_kms_helper] [ 40.254394][ T184] drm_fbdev_client_hotplug+0x56f/0x840 [drm_kms_helper] [ 40.255477][ T184] drm_fbdev_generic_setup+0x165/0x3c0 [drm_kms_helper] [ 40.256607][ T184] bochs_pci_probe+0x6b7/0x900 [bochs] [ 40.257515][ T184] ? _raw_spin_lock_irqsave+0x87/0x100 [ 40.258312][ T184] ? bochs_hw_init+0x480/0x480 [bochs] [ 40.259244][ T184] ? bochs_hw_init+0x480/0x480 [bochs] [ 40.260186][ T184] local_pci_probe+0xdf/0x180 [ 40.260928][ T184] pci_call_probe+0x15f/0x500 [ 40.265798][ T184] ? _raw_spin_lock+0x81/0x100 [ 40.266508][ T184] ? pci_pm_suspend_noirq+0x980/0x980 [ 40.267322][ T184] ? pci_assign_irq+0x81/0x280 [ 40.268096][ T184] ? pci_match_device+0x351/0x6c0 [ 40.268883][ T184] ? kernfs_put+0x18/0x40 [ 40.269611][ T184] pci_device_probe+0xee/0x240 [ 40.270352][ T184] really_probe+0x435/0xa80 [ 40.271021][ T184] __driver_probe_device+0x2ab/0x480 [ 40.271828][ T184] driver_probe_device+0x49/0x140 [ 40.272627][ T184] __driver_attach+0x1bd/0x4c0 [ 40.273372][ T184] ? __device_attach_driver+0x240/0x240 [ 40.274273][ T184] bus_for_each_dev+0x11e/0x1c0 [ 40.275080][ T184] ? subsys_dev_iter_exit+0x40/0x40 [ 40.275951][ T184] ? klist_add_tail+0x132/0x280 [ 40.276767][ T184] bus_add_driver+0x39b/0x580 [ 40.277574][ T184] driver_register+0x20f/0x3c0 [ 40.278281][ T184] ? 0xffffffffc04a2000 [ 40.278894][ T184] do_one_initcall+0x8a/0x300 [ 40.279642][ T184] ? trace_event_raw_event_initcall_level+0x1c0/0x1c0 [ 40.280707][ T184] ? kasan_unpoison+0x23/0x80 [ 40.281479][ T184] ? kasan_unpoison+0x23/0x80 [ 40.282197][ T184] do_init_module+0x190/0x640 [ 40.282926][ T184] load_module+0x221b/0x2780 [ 40.283611][ T184] ? layout_and_allocate+0x5c0/0x5c0 [ 40.284401][ T184] ? kernel_read_file+0x286/0x6c0 [ 40.285216][ T184] ? __x64_sys_fspick+0x2c0/0x2c0 [ 40.286043][ T184] ? mmap_region+0x4e7/0x1300 [ 40.286832][ T184] ? __do_sys_finit_module+0x11a/0x1c0 [ 40.287743][ T184] __do_sys_finit_module+0x11a/0x1c0 [ 40.288636][ T184] ? __ia32_sys_init_module+0xc0/0xc0 [ 40.289557][ T184] ? __seccomp_filter+0x15e/0xc80 [ 40.290341][ T184] ? vm_mmap_pgoff+0x185/0x240 [ 40.291060][ T184] do_syscall_64+0x3b/0xc0 [ 40.291763][ T184] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 40.292678][ T184] RIP: 0033:0x7f6b1d6279b9 [ 40.293438][ T184] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48 [ 40.296302][ T184] RSP: 002b:00007ffe7f51b798 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 40.297633][ T184] RAX: ffffffffffffffda RBX: 00005642dcca2880 RCX: 00007f6b1d6279b9 [ 40.298890][ T184] RDX: 0000000000000000 RSI: 00007f6b1d7b2e2d RDI: 0000000000000016 [ 40.300199][ T184] RBP: 0000000000020000 R08: 0000000000000000 R09: 00005642dccd5530 [ 40.301547][ T184] R10: 0000000000000016 R11: 0000000000000246 R12: 00007f6b1d7b2e2d [ 40.302698][ T184] R13: 0000000000000000 R14: 00005642dcca4230 R15: 00005642dcca2880 Signed-off-by: Arunpravin Paneer Selvam Reported-by: kernel test robot Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20220726162205.2778-1-Arunpravin.PaneerSelvam@amd.com Link: https://patchwork.freedesktop.org/patch/msgid/20220809095623.3569-1-Arunpravin.PaneerSelvam@amd.com Signed-off-by: Christian König CC: stable@vger.kernel.org commit f71c70df416f4d49a9cf11d6132f6aaba0e2f65c Author: Christian Colglazier Date: Tue Aug 9 14:02:41 2022 +0930 ALSA: scarlett2: Add Focusrite Clarett+ 8Pre support The Focusrite Clarett+ 8Pre uses the same protocol as the Scarlett Gen 2 and Gen 3 product range. This patch adds support for the Clarett+ 8Pre by adding appropriate entries to the scarlett2 driver. The Clarett+ 2Pre and 4Pre, and the Clarett USB product line presumably use the same protocol as well, so support for them can easily be added if someone can test. Signed-off-by: Christian Colglazier Signed-off-by: Geoffrey D. Bennett Link: https://lore.kernel.org/r/20220809043241.GA2749152@m.b4.vu Signed-off-by: Takashi Iwai commit a4cb6e62ea4d36e53fb3c0f18ea4503d7b76674f Author: Marc Kleine-Budde Date: Mon Aug 1 22:47:16 2022 +0200 can: ems_usb: fix clang's -Wunaligned-access warning clang emits a -Wunaligned-access warning on struct __packed ems_cpc_msg. The reason is that the anonymous union msg (not declared as packed) is being packed right after some non naturally aligned variables (3*8 bits + 2*32) inside a packed struct: | struct __packed ems_cpc_msg { | u8 type; /* type of message */ | u8 length; /* length of data within union 'msg' */ | u8 msgid; /* confirmation handle */ | __le32 ts_sec; /* timestamp in seconds */ | __le32 ts_nsec; /* timestamp in nano seconds */ | /* ^ not naturally aligned */ | | union { | /* ^ not declared as packed */ | u8 generic[64]; | struct cpc_can_msg can_msg; | struct cpc_can_params can_params; | struct cpc_confirm confirmation; | struct cpc_overrun overrun; | struct cpc_can_error error; | struct cpc_can_err_counter err_counter; | u8 can_state; | } msg; | }; Starting from LLVM 14, having an unpacked struct nested in a packed struct triggers a warning. c.f. [1]. Fix the warning by marking the anonymous union as packed. [1] https://github.com/llvm/llvm-project/issues/55520 Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Link: https://lore.kernel.org/all/20220802094021.959858-1-mkl@pengutronix.de Cc: Gerhard Uttenthaler Cc: Sebastian Haas Signed-off-by: Marc Kleine-Budde commit 8c21c54a53ab21842f5050fa090f26b03c0313d6 Author: Fedor Pchelkin Date: Fri Aug 5 18:02:16 2022 +0300 can: j1939: j1939_session_destroy(): fix memory leak of skbs We need to drop skb references taken in j1939_session_skb_queue() when destroying a session in j1939_session_destroy(). Otherwise those skbs would be lost. Link to Syzkaller info and repro: https://forge.ispras.ru/issues/11743. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. V1: https://lore.kernel.org/all/20220708175949.539064-1-pchelkin@ispras.ru Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Suggested-by: Oleksij Rempel Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Acked-by: Oleksij Rempel Link: https://lore.kernel.org/all/20220805150216.66313-1-pchelkin@ispras.ru Signed-off-by: Marc Kleine-Budde commit 8ef49f7f8244424adcf4a546dba4cbbeb0b09c09 Author: Fedor Pchelkin Date: Fri Jul 29 17:36:55 2022 +0300 can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() We should warn user-space that it is doing something wrong when trying to activate sessions with identical parameters but WARN_ON_ONCE macro can not be used here as it serves a different purpose. So it would be good to replace it with netdev_warn_once() message. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Acked-by: Oleksij Rempel Link: https://lore.kernel.org/all/20220729143655.1108297-1-pchelkin@ispras.ru [mkl: fix indention] Signed-off-by: Marc Kleine-Budde commit 7e4fd7a1a6fdf23d069eeb0ae0e8e46b9fb40723 Author: Marc Zyngier Date: Mon Aug 8 11:50:20 2022 +0100 irqchip/loongarch: Fix irq_domain_alloc_fwnode() abuse The recently merged LoongArch drivers paper over the lack of topology information by creating a bunch of fwnodes for the irqchips. So far, so good. However, irq_domain_alloc_fwnode() is supposed to take a PA, and not a kernel VA blindly cast as a PA, potentially disclosing kernel VAs to userspace. In some other cases, even NULL is used as the PA, which is entertaining. Fix this by using the actual PA of the block when available, and switch to a named fwnode in the other cases. Signed-off-by: Marc Zyngier Reviewed-by: Jianmin Lv Link: https://lore.kernel.org/r/20220808105020.2689757-1-maz@kernel.org commit b8c3bf0ed2edf2deaedba5f0bf0bb54c76dee71d Merge: 7a07a29e4f671 1d1ab5d39be75 Author: Jakub Kicinski Date: Mon Aug 8 20:59:07 2022 -0700 Merge tag 'for-net-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fixes various issues related to ISO channel/socket support - Fixes issues when building with C=1 - Fix cancel uninitilized work which blocks syzbot to run * tag 'for-net-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: ISO: Fix not using the correct QoS Bluetooth: don't try to cancel uninitialized works at mgmt_index_removed() Bluetooth: ISO: Fix iso_sock_getsockopt for BT_DEFER_SETUP Bluetooth: MGMT: Fixes build warnings with C=1 Bluetooth: hci_event: Fix build warning with C=1 Bluetooth: ISO: Fix memory corruption Bluetooth: Fix null pointer deref on unexpected status event Bluetooth: ISO: Fix info leak in iso_sock_getsockopt() Bluetooth: hci_conn: Fix updating ISO QoS PHY Bluetooth: ISO: unlock on error path in iso_sock_setsockopt() Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression ==================== Link: https://lore.kernel.org/r/20220809001224.412807-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 7a07a29e4f6713b224f3bcde5f835e777301bdb8 Author: Alexandra Winter Date: Fri Aug 5 17:57:14 2022 +0200 s390/qeth: cache link_info for ethtool Since commit e6e771b3d897 ("s390/qeth: detach netdevice while card is offline") there was a timing window during recovery, that qeth_query_card_info could be sent to the card, even before it was ready for it, leading to a failing card recovery. There is evidence that this window was hit, as not all callers of get_link_ksettings() check for netif_device_present. Use cached values in qeth_get_link_ksettings(), instead of calling qeth_query_card_info() and falling back to default values in case it fails. Link info is already updated when the card goes online, e.g. after STARTLAN (physical link up). Set the link info to default values, when the card goes offline or at STOPLAN (physical link down). A follow-on patch will improve values reported for link down. Fixes: e6e771b3d897 ("s390/qeth: detach netdevice while card is offline") Signed-off-by: Alexandra Winter Reviewed-by: Thorsten Winkler Link: https://lore.kernel.org/r/20220805155714.59609-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 546b9d3f406a14cfbb12bfbf9fe1b302f1d860b5 Author: Nikita Shubin Date: Fri Aug 5 11:48:43 2022 +0300 net: phy: dp83867: fix get nvmem cell fail If CONFIG_NVMEM is not set of_nvmem_cell_get, of_nvmem_device_get functions will return ERR_PTR(-EOPNOTSUPP) and "failed to get nvmem cell io_impedance_ctrl" error would be reported despite "io_impedance_ctrl" is completely missing in Device Tree and we should use default values. Check -EOPNOTSUPP togather with -ENOENT to avoid this situation. Fixes: 5c2d0a6a0701 ("net: phy: dp83867: implement support for io_impedance_ctrl nvmem cell") Signed-off-by: Nikita Shubin Acked-by: Rasmus Villemoes Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220805084843.24542-1-nikita.shubin@maquefel.me Signed-off-by: Jakub Kicinski commit 3702e4041cfda50bc697363d29511ce8f6b24795 Author: Oleksij Rempel Date: Fri Aug 5 09:31:59 2022 +0200 net: phy: c45 baset1: do not skip aneg configuration if clock role is not specified In case master/slave clock role is not specified (which is default), the aneg registers will not be written. The visible impact of this is missing pause advertisement. So, rework genphy_c45_baset1_an_config_aneg() to be able to write advertisement registers even if clock role is unknown. Fixes: 3da8ffd8545f ("net: phy: Add 10BASE-T1L support in phy-c45") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220805073159.908643-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 3f4093e2bf4673f218c0bf17d8362337c400e77b Author: Duoming Zhou Date: Fri Aug 5 15:00:08 2022 +0800 atm: idt77252: fix use-after-free bugs caused by tst_timer There are use-after-free bugs caused by tst_timer. The root cause is that there are no functions to stop tst_timer in idt77252_exit(). One of the possible race conditions is shown below: (thread 1) | (thread 2) | idt77252_init_one | init_card | fill_tst | mod_timer(&card->tst_timer, ...) idt77252_exit | (wait a time) | tst_timer | | ... kfree(card) // FREE | | card->soft_tst[e] // USE The idt77252_dev is deallocated in idt77252_exit() and used in timer handler. This patch adds del_timer_sync() in idt77252_exit() in order that the timer handler could be stopped before the idt77252_dev is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit 7e4babffa6f340a74c820d44d44d16511e666424 Author: Vladimir Oltean Date: Thu Aug 4 23:28:17 2022 +0300 net: dsa: felix: fix min gate len calculation for tc when its first gate is closed min_gate_len[tc] is supposed to track the shortest interval of continuously open gates for a traffic class. For example, in the following case: TC 76543210 t0 00000001b 200000 ns t1 00000010b 200000 ns min_gate_len[0] and min_gate_len[1] should be 200000, while min_gate_len[2-7] should be 0. However what happens is that min_gate_len[0] is 200000, but min_gate_len[1] ends up being 0 (despite gate_len[1] being 200000 at the point where the logic detects the gate close event for TC 1). The problem is that the code considers a "gate close" event whenever it sees that there is a 0 for that TC (essentially it's level rather than edge triggered). By doing that, any time a gate is seen as closed without having been open prior, gate_len, which is 0, will be written into min_gate_len. Once min_gate_len becomes 0, it's impossible for it to track anything higher than that (the length of actually open intervals). To fix this, we make the writing to min_gate_len[tc] be edge-triggered, which avoids writes for gates that are closed in consecutive intervals. However what this does is it makes us need to special-case the permanently closed gates at the end. Fixes: 55a515b1f5a9 ("net: dsa: felix: drop oversized frames with tc-taprio instead of hanging the port") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220804202817.1677572-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 944e594cfa84ec552831489c244e02589d826b11 Author: Martin Schiller Date: Fri Aug 5 08:18:10 2022 +0200 net/x25: fix call timeouts in blocking connects When a userspace application starts a blocking connect(), a CALL REQUEST is sent, the t21 timer is started and the connect is waiting in x25_wait_for_connection_establishment(). If then for some reason the t21 timer expires before any reaction on the assigned logical channel (e.g. CALL ACCEPT, CLEAR REQUEST), there is sent a CLEAR REQUEST and timer t23 is started waiting for a CLEAR confirmation. If we now receive a CLEAR CONFIRMATION from the peer, x25_disconnect() is called in x25_state2_machine() with reason "0", which means "normal" call clearing. This is ok, but the parameter "reason" is used as sk->sk_err in x25_disconnect() and sock_error(sk) is evaluated in x25_wait_for_connection_establishment() to check if the call is still pending. As "0" is not rated as an error, the connect will stuck here forever. To fix this situation, also check if the sk->sk_state changed form TCP_SYN_SENT to TCP_CLOSE in the meantime, which is also done by x25_disconnect(). Signed-off-by: Martin Schiller Link: https://lore.kernel.org/r/20220805061810.10824-1-ms@dev.tdt.de Signed-off-by: Jakub Kicinski commit 8eb6fcc9a7cb4337ba985a397d892af5c0ddb0e7 Merge: f574f7f839fc1 b3bb8628bf644 Author: Jakub Kicinski Date: Mon Aug 8 20:44:42 2022 -0700 Merge branch 'tsnep-two-fixes-for-the-driver' Gerhard Engleder says: ==================== tsnep: Two fixes for the driver Two simple bugfixes for tsnep driver. ==================== Link: https://lore.kernel.org/r/20220804183935.73763-1-gerhard@engleder-embedded.com Signed-off-by: Jakub Kicinski commit b3bb8628bf64440065976c71e4ab09186c393597 Author: Gerhard Engleder Date: Thu Aug 4 20:39:35 2022 +0200 tsnep: Fix tsnep_tx_unmap() error path usage If tsnep_tx_map() fails, then tsnep_tx_unmap() shall start at the write index like tsnep_tx_map(). This is different to the normal operation. Thus, add an additional parameter to tsnep_tx_unmap() to enable start at different positions for successful TX and failed TX. Fixes: 403f69bbdbad ("tsnep: Add TSN endpoint Ethernet MAC driver") Signed-off-by: Gerhard Engleder Signed-off-by: Jakub Kicinski commit 73afd7816c551c8da1c8f41462110a46a317eefb Author: Gerhard Engleder Date: Thu Aug 4 20:39:34 2022 +0200 tsnep: Fix unused warning for 'tsnep_of_match' Kernel test robot found the following warning: drivers/net/ethernet/engleder/tsnep_main.c:1254:34: warning: 'tsnep_of_match' defined but not used [-Wunused-const-variable=] of_match_ptr() compiles into NULL if CONFIG_OF is disabled. tsnep_of_match exists always so use of of_match_ptr() is useless. Fix warning by dropping of_match_ptr(). Reported-by: kernel test robot Signed-off-by: Gerhard Engleder Signed-off-by: Jakub Kicinski commit eb555cb5b794f4e12a9897f3d46d5a72104cd4a7 Merge: f30adc0d332fd 8f0541186e9ad Author: Linus Torvalds Date: Mon Aug 8 20:15:13 2022 -0700 Merge tag '5.20-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd updates from Steve French: - fixes for memory access bugs (out of bounds access, oops, leak) - multichannel fixes - session disconnect performance improvement, and session register improvement - cleanup * tag '5.20-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix heap-based overflow in set_ntacl_dacl() ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ksmbd: prevent out of bound read for SMB2_WRITE ksmbd: fix use-after-free bug in smb2_tree_disconect ksmbd: fix memory leak in smb2_handle_negotiate ksmbd: fix racy issue while destroying session on multichannel ksmbd: use wait_event instead of schedule_timeout() ksmbd: fix kernel oops from idr_remove() ksmbd: add channel rwlock ksmbd: replace sessions list in connection with xarray MAINTAINERS: ksmbd: add entry for documentation ksmbd: remove unused ksmbd_share_configs_cleanup function commit f30adc0d332fdfe5315cb98bd6a7ff0d5cf2aa38 Merge: 5d5d353bed32d c03f05f183cd1 Author: Linus Torvalds Date: Mon Aug 8 20:04:35 2022 -0700 Merge tag 'pull-work.iov_iter-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull more iov_iter updates from Al Viro: - more new_sync_{read,write}() speedups - ITER_UBUF introduction - ITER_PIPE cleanups - unification of iov_iter_get_pages/iov_iter_get_pages_alloc and switching them to advancing semantics - making ITER_PIPE take high-order pages without splitting them - handling copy_page_from_iter() for high-order pages properly * tag 'pull-work.iov_iter-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (32 commits) fix copy_page_from_iter() for compound destinations hugetlbfs: copy_page_to_iter() can deal with compound pages copy_page_to_iter(): don't split high-order page in case of ITER_PIPE expand those iov_iter_advance()... pipe_get_pages(): switch to append_pipe() get rid of non-advancing variants ceph: switch the last caller of iov_iter_get_pages_alloc() 9p: convert to advancing variant of iov_iter_get_pages_alloc() af_alg_make_sg(): switch to advancing variant of iov_iter_get_pages() iter_to_pipe(): switch to advancing variant of iov_iter_get_pages() block: convert to advancing variants of iov_iter_get_pages{,_alloc}() iov_iter: advancing variants of iov_iter_get_pages{,_alloc}() iov_iter: saner helper for page array allocation fold __pipe_get_pages() into pipe_get_pages() ITER_XARRAY: don't open-code DIV_ROUND_UP() unify the rest of iov_iter_get_pages()/iov_iter_get_pages_alloc() guts unify xarray_get_pages() and xarray_get_pages_alloc() unify pipe_get_pages() and pipe_get_pages_alloc() iov_iter_get_pages(): sanity-check arguments iov_iter_get_pages_alloc(): lift freeing pages array on failure exits into wrapper ... commit c03f05f183cd15f4259684ab658fbc3d23797d99 Author: Al Viro Date: Fri Jul 29 12:54:53 2022 -0400 fix copy_page_from_iter() for compound destinations had been broken for ITER_BVEC et.al. since ever (OK, v3.17 when ITER_BVEC had first appeared)... Signed-off-by: Al Viro commit c7d57ab1632d29e256e3ae68f925751142330d88 Author: Al Viro Date: Thu Jun 23 17:24:09 2022 -0400 hugetlbfs: copy_page_to_iter() can deal with compound pages ... since April 2021 Signed-off-by: Al Viro commit f0f6b614f83dbae99d283b7b12ab5dd2e04df979 Author: Al Viro Date: Thu Jun 23 17:21:37 2022 -0400 copy_page_to_iter(): don't split high-order page in case of ITER_PIPE ... just shove it into one pipe_buffer. Signed-off-by: Al Viro commit 310d9d5a5009a93377200b98daa2d84aa2bd8160 Author: Al Viro Date: Sat Jun 11 04:04:33 2022 -0400 expand those iov_iter_advance()... Signed-off-by: Al Viro commit 746de1f86fcd33464acac047f111eea877f2f7a0 Author: Al Viro Date: Tue Jun 14 16:38:53 2022 -0400 pipe_get_pages(): switch to append_pipe() now that we are advancing the iterator, there's no need to treat the first page separately - just call append_pipe() in a loop. Signed-off-by: Al Viro commit eba2d3d798295dc43cae8fade102f9d083a2a741 Author: Al Viro Date: Fri Jun 10 13:05:12 2022 -0400 get rid of non-advancing variants mechanical change; will be further massaged in subsequent commits Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit b53589927d73e28c62d3cd92ed4e1a0ea3c830ca Author: Al Viro Date: Fri Jun 10 11:43:27 2022 -0400 ceph: switch the last caller of iov_iter_get_pages_alloc() here nothing even looks at the iov_iter after the call, so we couldn't care less whether it advances or not. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 7f02464739da05a51cadb997a00a301f734e9c87 Author: Al Viro Date: Fri Jun 10 11:42:02 2022 -0400 9p: convert to advancing variant of iov_iter_get_pages_alloc() that one is somewhat clumsier than usual and needs serious testing. Signed-off-by: Al Viro commit dc5801f60b269a73fcce789856c99d1845f75827 Author: Al Viro Date: Thu Jun 9 11:14:04 2022 -0400 af_alg_make_sg(): switch to advancing variant of iov_iter_get_pages() ... and adjust the callers Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 7d690c157c58d22de9ad71ef5c4e1f43cd8ad0e7 Author: Al Viro Date: Thu Jun 9 11:07:52 2022 -0400 iter_to_pipe(): switch to advancing variant of iov_iter_get_pages() ... and untangle the cleanup on failure to add into pipe. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 480cb846c27bda4e14d98a45a9f50c250f38f266 Author: Al Viro Date: Thu Jun 9 10:37:57 2022 -0400 block: convert to advancing variants of iov_iter_get_pages{,_alloc}() ... doing revert if we end up not using some pages Signed-off-by: Al Viro commit 1ef255e257173f4bc44317ef2076e7e0de688fdf Author: Al Viro Date: Thu Jun 9 10:28:36 2022 -0400 iov_iter: advancing variants of iov_iter_get_pages{,_alloc}() Most of the users immediately follow successful iov_iter_get_pages() with advancing by the amount it had returned. Provide inline wrappers doing that, convert trivial open-coded uses of those. BTW, iov_iter_get_pages() never returns more than it had been asked to; such checks in cifs ought to be removed someday... Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 3cf42da327f26eb4461864dd64812345b37f4fd9 Author: Al Viro Date: Fri Jun 17 14:45:41 2022 -0400 iov_iter: saner helper for page array allocation All call sites of get_pages_array() are essenitally identical now. Replace with common helper... Returns number of slots available in resulting array or 0 on OOM; it's up to the caller to make sure it doesn't ask to zero-entry array (i.e. neither maxpages nor size are allowed to be zero). Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 8520008417c581c4c22e39597f92b9814ae34c31 Author: Al Viro Date: Fri Jun 17 14:30:39 2022 -0400 fold __pipe_get_pages() into pipe_get_pages() ... and don't mangle maxsize there - turn the loop into counting one instead. Easier to see that we won't run out of array that way. Note that special treatment of the partial buffer in that thing is an artifact of the non-advancing semantics of iov_iter_get_pages() - if not for that, it would be append_pipe(), same as the body of the loop that follows it. IOW, once we make iov_iter_get_pages() advancing, the whole thing will turn into calculate how many pages do we want allocate an array (if needed) call append_pipe() that many times. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 0aa4fc32f54028f6fbb35bf71df4b0d86ff1662b Author: Al Viro Date: Fri Jun 10 20:30:35 2022 -0400 ITER_XARRAY: don't open-code DIV_ROUND_UP() Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 451c0ba9475ebdce36249c5c769efa5d580d1d83 Author: Al Viro Date: Fri Jun 17 13:54:15 2022 -0400 unify the rest of iov_iter_get_pages()/iov_iter_get_pages_alloc() guts same as for pipes and xarrays; after that iov_iter_get_pages() becomes a wrapper for __iov_iter_get_pages_alloc(). Signed-off-by: Al Viro commit 68fe506f3731ecf7881de9512cc5f4c14fd13f3a Author: Al Viro Date: Fri Jun 17 13:48:03 2022 -0400 unify xarray_get_pages() and xarray_get_pages_alloc() same as for pipes Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit acbdeb8320b0a470bef1b6c0105d8c2bbc4c4ba0 Author: Al Viro Date: Fri Jun 17 13:35:35 2022 -0400 unify pipe_get_pages() and pipe_get_pages_alloc() The differences between those two are * pipe_get_pages() gets a non-NULL struct page ** value pointing to preallocated array + array size. * pipe_get_pages_alloc() gets an address of struct page ** variable that contains NULL, allocates the array and (on success) stores its address in that variable. Not hard to combine - always pass struct page ***, have the previous pipe_get_pages_alloc() caller pass ~0U as cap for array size. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit c81ce28df500b04444ef97dc82a7b0299ce717e8 Author: Al Viro Date: Fri Jun 17 15:15:14 2022 -0400 iov_iter_get_pages(): sanity-check arguments zero maxpages is bogus, but best treated as "just return 0"; NULL pages, OTOH, should be treated as a hard bug. get rid of now completely useless checks in xarray_get_pages{,_alloc}(). Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 91329559eb07c9b12c7ce80e893ad39579c40aa2 Author: Al Viro Date: Fri Jun 10 20:38:20 2022 -0400 iov_iter_get_pages_alloc(): lift freeing pages array on failure exits into wrapper Incidentally, ITER_XARRAY did *not* free the sucker in case when iter_xarray_populate_pages() returned 0... Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 12d426ab64a1c75f1b2ee5c33e933a4c16004049 Author: Al Viro Date: Wed Jun 15 09:44:38 2022 -0400 ITER_PIPE: fold data_start() and pipe_space_for_user() together All their callers are next to each other; all of them want the total amount of pages and, possibly, the offset in the partial final buffer. Combine into a new helper (pipe_npages()), fix the bogosity in pipe_space_for_user(), while we are at it. Signed-off-by: Al Viro commit 10f525a8cd7a525e9fc73288bb35428c9cad5e63 Author: Al Viro Date: Wed Jun 15 02:02:51 2022 -0400 ITER_PIPE: cache the type of last buffer We often need to find whether the last buffer is anon or not, and currently it's rather clumsy: check if ->iov_offset is non-zero (i.e. that pipe is not empty) if so, get the corresponding pipe_buffer and check its ->ops if it's &default_pipe_buf_ops, we have an anon buffer. Let's replace the use of ->iov_offset (which is nowhere near similar to its role for other flavours) with signed field (->last_offset), with the following rules: empty, no buffers occupied: 0 anon, with bytes up to N-1 filled: N zero-copy, with bytes up to N-1 filled: -N That way abs(i->last_offset) is equal to what used to be in i->iov_offset and empty vs. anon vs. zero-copy can be distinguished by the sign of i->last_offset. Checks for "should we extend the last buffer or should we start a new one?" become easier to follow that way. Note that most of the operations can only be done in a sane state - i.e. when the pipe has nothing past the current position of iterator. About the only thing that could be done outside of that state is iov_iter_advance(), which transitions to the sane state by truncating the pipe. There are only two cases where we leave the sane state: 1) iov_iter_get_pages()/iov_iter_get_pages_alloc(). Will be dealt with later, when we make get_pages advancing - the callers are actually happier that way. 2) iov_iter copied, then something is put into the copy. Since they share the underlying pipe, the original gets behind. When we decide that we are done with the copy (original is not usable until then) we advance the original. direct_io used to be done that way; nowadays it operates on the original and we do iov_iter_revert() to discard the excessive data. At the moment there's nothing in the kernel that could do that to ITER_PIPE iterators, so this reason for insane state is theoretical right now. Signed-off-by: Al Viro commit 92acdc4f37207c556baee0ea28ce0823d22b9812 Author: Al Viro Date: Sun Jun 12 17:54:35 2022 -0400 ITER_PIPE: clean iov_iter_revert() Fold pipe_truncate() into it, clean up. We can release buffers in the same loop where we walk backwards to the iterator beginning looking for the place where the new position will be. Signed-off-by: Al Viro commit 2c855de93314e9573f31044976ffd89cb70a2dbd Author: Al Viro Date: Wed Jun 15 16:03:25 2022 -0400 ITER_PIPE: clean pipe_advance() up instead of setting ->iov_offset for new position and calling pipe_truncate() to adjust ->len of the last buffer and discard everything after it, adjust ->len at the same time we set ->iov_offset and use pipe_discard_from() to deal with buffers past that. Signed-off-by: Al Viro commit ca591967543ab1af7e6e68bd505ef7869d3f2175 Author: Al Viro Date: Thu Jun 16 14:26:23 2022 -0400 ITER_PIPE: lose iter_head argument of __pipe_get_pages() it's only used to get to the partial buffer we can add to, and that's always the last one, i.e. pipe->head - 1. Signed-off-by: Al Viro commit e3b42964f84c028f352c11269661d47f6ca4ab2e Author: Al Viro Date: Sat Jun 11 02:52:03 2022 -0400 ITER_PIPE: fold push_pipe() into __pipe_get_pages() Expand the only remaining call of push_pipe() (in __pipe_get_pages()), combine it with the page-collecting loop there. Note that the only reason it's not a loop doing append_pipe() is that append_pipe() is advancing, while iov_iter_get_pages() is not. As soon as it switches to saner semantics, this thing will switch to using append_pipe(). Signed-off-by: Al Viro commit 8fad7767edcfd3f93e0d9985cb2dc1db270b8719 Author: Al Viro Date: Tue Jun 14 13:53:53 2022 -0400 ITER_PIPE: allocate buffers as we go in copy-to-pipe primitives New helper: append_pipe(). Extends the last buffer if possible, allocates a new one otherwise. Returns page and offset in it on success, NULL on failure. iov_iter is advanced past the data we've got. Use that instead of push_pipe() in copy-to-pipe primitives; they get simpler that way. Handling of short copy (in "mc" one) is done simply by iov_iter_revert() - iov_iter is in consistent state after that one, so we can use that. [Fix for braino caught by Liu Xinpeng folded in] [another braino fix, this time in copy_pipe_to_iter() and pipe_zero(); caught by testcase from Hugh Dickins] Signed-off-by: Al Viro commit 47b7fcae419dc940e3fb8e58088a5b80ad813bbf Author: Al Viro Date: Mon Jun 13 14:30:15 2022 -0400 ITER_PIPE: helpers for adding pipe buffers There are only two kinds of pipe_buffer in the area used by ITER_PIPE. 1) anonymous - copy_to_iter() et.al. end up creating those and copying data there. They have zero ->offset, and their ->ops points to default_pipe_page_ops. 2) zero-copy ones - those come from copy_page_to_iter(), and page comes from caller. ->offset is also caller-supplied - it might be non-zero. ->ops points to page_cache_pipe_buf_ops. Move creation and insertion of those into helpers - push_anon(pipe, size) and push_page(pipe, page, offset, size) resp., separating them from the "could we avoid creating a new buffer by merging with the current head?" logics. Acked-by: Jeff Layton Signed-off-by: Al Viro commit 2dcedb2a549a4d7430538213b1b28ef7271bc0aa Author: Al Viro Date: Tue Jun 14 10:24:37 2022 -0400 ITER_PIPE: helper for getting pipe buffer by index pipe_buffer instances of a pipe are organized as a ring buffer, with power-of-2 size. Indices are kept *not* reduced modulo ring size, so the buffer refered to by index N is pipe->bufs[N & (pipe->ring_size - 1)]. Ring size can change over the lifetime of a pipe, but not while the pipe is locked. So for any iov_iter primitives it's a constant. Original conversion of pipes to this layout went overboard trying to microoptimize that - calculating pipe->ring_size - 1, storing it in a local variable and using through the function. In some cases it might be warranted, but most of the times it only obfuscates what's going on in there. Introduce a helper (pipe_buf(pipe, N)) that would encapsulate that and use it in the obvious cases. More will follow... Reviewed-by: Jeff Layton Reviewed-by: Christian Brauner (Microsoft) Signed-off-by: Al Viro commit 0d9649341363047be60a9ec7378d8985bdd0abba Author: Al Viro Date: Sun Jun 12 16:07:49 2022 -0400 splice: stop abusing iov_iter_advance() to flush a pipe Use pipe_discard_from() explicitly in generic_file_read_iter(); don't bother with rather non-obvious use of iov_iter_advance() in there. Reviewed-by: Jeff Layton Reviewed-by: Christian Brauner (Microsoft) Signed-off-by: Al Viro commit 3e20a751aff0e099cff496511fef8cdf655b3360 Author: Al Viro Date: Sun May 22 16:55:40 2022 -0400 switch new_sync_{read,write}() to ITER_UBUF Reviewed-by: Christian Brauner (Microsoft) Signed-off-by: Al Viro commit fcb14cb1bdacec5b4374fe161e83fb8208164a85 Author: Al Viro Date: Sun May 22 14:59:25 2022 -0400 new iov_iter flavour - ITER_UBUF Equivalent of single-segment iovec. Initialized by iov_iter_ubuf(), checked for by iter_is_ubuf(), otherwise behaves like ITER_IOVEC ones. We are going to expose the things like ->write_iter() et.al. to those in subsequent commits. New predicate (user_backed_iter()) that is true for ITER_IOVEC and ITER_UBUF; places like direct-IO handling should use that for checking that pages we modify after getting them from iov_iter_get_pages() would need to be dirtied. DO NOT assume that replacing iter_is_iovec() with user_backed_iter() will solve all problems - there's code that uses iter_is_iovec() to decide how to poke around in iov_iter guts and for that the predicate replacement obviously won't suffice. Signed-off-by: Al Viro commit a9e9c93966afdaae74a6a7533552391646b93f2c Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:44 2022 +0200 Documentation/mm: add details about kmap_local_page() and preemption What happens if a thread is preempted after mapping pages with kmap_local_page() was questioned recently.[1] Commit f3ba3c710ac5 ("mm/highmem: Provide kmap_local*") from Thomas Gleixner explains clearly that on context switch, the maps of an outgoing task are removed and the map of the incoming task are restored and that kmap_local_page() can be invoked from both preemptible and atomic contexts.[2] Therefore, for the purpose to make it clearer that users can call kmap_local_page() from contexts that allow preemption, rework a couple of sentences and add further information in highmem.rst. [1] https://lore.kernel.org/lkml/5303077.Sb9uPGUboI@opensuse/ [2] https://lore.kernel.org/all/20201118204007.468533059@linutronix.de/ Link: https://lkml.kernel.org/r/20220728154844.10874-8-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 72f1c55adf70fd08ceac6b67455238db2014894a Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:43 2022 +0200 highmem: delete a sentence from kmap_local_page() kdocs kmap_local_page() should always be preferred in place of kmap() and kmap_atomic(). "Only use when really necessary." is not consistent with the Documentation/mm/highmem.rst and these kdocs it embeds. Therefore, delete the above-mentioned sentence from kdocs. Link: https://lkml.kernel.org/r/20220728154844.10874-7-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Reviewed-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 84b86f6054c42776c0d6482ab9a9071b247159fa Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:42 2022 +0200 Documentation/mm: rrefer kmap_local_page() and avoid kmap() The reasoning for converting kmap() to kmap_local_page() was questioned recently.[1] There are two main problems with kmap(): (1) It comes with an overhead as mapping space is restricted and protected by a global lock for synchronization and (2) kmap() also requires global TLB invalidation when its pool wraps and it might block when the mapping space is fully utilized until a slot becomes available. Warn users to avoid the use of kmap() and instead use kmap_local_page(), by designing their code to map pages in the same context the mapping will be used. [1] https://lore.kernel.org/lkml/1891319.taCxCBeP46@opensuse/ Link: https://lkml.kernel.org/r/20220728154844.10874-6-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6b3afe2eeec27a148b83235484149f42b22ef793 Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:41 2022 +0200 Documentation/mm: avoid invalid use of addresses from kmap_local_page() Users of kmap_local_page() must be absolutely sure to not hand kernel virtual address obtained calling kmap_local_page() on highmem pages to other contexts because those pointers are thread local, therefore, they are no longer valid across different contexts. Extend the documentation of kmap_local_page() to warn users about the above-mentioned potential invalid use of pointers returned by kmap_local_page(). Link: https://lkml.kernel.org/r/20220728154844.10874-5-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 516ea046ec5558882b4a8e5f6b0c9b4c957db279 Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:40 2022 +0200 Documentation/mm: don't kmap*() pages which can't come from HIGHMEM There is no need to kmap*() pages which are guaranteed to come from ZONE_NORMAL (or lower). Linux has currently several call sites of kmap{,_atomic,_local_page}() on pages which are clearly known which can't come from ZONE_HIGHMEM. Therefore, add a paragraph to highmem.rst, to explain better that a plain page_address() may be used for getting the address of pages which cannot come from ZONE_HIGHMEM, although it is always safe to use kmap_local_page() / kunmap_local() also on those pages. Link: https://lkml.kernel.org/r/20220728154844.10874-4-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 383bbef283920411379c5c93829102ff7859fea5 Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:39 2022 +0200 highmem: specify that kmap_local_page() is callable from interrupts In a recent thread about converting kmap() to kmap_local_page(), the safety of calling kmap_local_page() was questioned.[1] "any context" should probably be enough detail for users who want to know whether or not kmap_local_page() can be called from interrupts. However, Linux still has kmap_atomic() which might make users think they must use the latter in interrupts. Add "including interrupts" for better clarity. [1] https://lore.kernel.org/lkml/3187836.aeNJFYEL58@opensuse/ Link: https://lkml.kernel.org/r/20220728154844.10874-3-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Jonathan Corbet Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 729337bc20876af348b363b3e35fb19be71ba793 Author: Fabio M. De Francesco Date: Thu Jul 28 17:48:38 2022 +0200 highmem: remove unneeded spaces in kmap_local_page() kdocs Patch series "highmem: Extend kmap_local_page() documentation", v2. The Highmem interface is evolving and the current documentation does not reflect the intended uses of each of the calls. Furthermore, after a recent series of reworks, the differences of the calls can still be confusing and may lead to the expanded use of calls which are deprecated. This series is the second round of changes towards an enhanced documentation of the Highmem's interface; at this stage the patches are only focused to kmap_local_page(). In addition it also contains some minor clean ups. This patch (of 7): In the kdocs of kmap_local_page(), the description of @page starts after several unnecessary spaces. Therefore, remove those spaces. Link: https://lkml.kernel.org/r/20220728154844.10874-1-fmdefrancesco@gmail.com Link: https://lkml.kernel.org/r/20220728154844.10874-2-fmdefrancesco@gmail.com Signed-off-by: Fabio M. De Francesco Suggested-by: Ira Weiny Reviewed-by: Ira Weiny Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Will Deacon Cc: Peter Collingbourne Cc: Vlastimil Babka Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 6f4614886baa59b6ae014093300482c1da4d3c93 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:20 2022 +0900 mm, hwpoison: enable memory error handling on 1GB hugepage Now error handling code is prepared, so remove the blocking code and enable memory error handling on 1GB hugepage. Link: https://lkml.kernel.org/r/20220714042420.1847125-9-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: kernel test robot Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit ceaf8fbea79a854373b9fc03c9fde98eb8712725 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:19 2022 +0900 mm, hwpoison: skip raw hwpoison page in freeing 1GB hugepage Currently if memory_failure() (modified to remove blocking code with subsequent patch) is called on a page in some 1GB hugepage, memory error handling fails and the raw error page gets into leaked state. The impact is small in production systems (just leaked single 4kB page), but this limits the testability because unpoison doesn't work for it. We can no longer create 1GB hugepage on the 1GB physical address range with such leaked pages, that's not useful when testing on small systems. When a hwpoison page in a 1GB hugepage is handled, it's caught by the PageHWPoison check in free_pages_prepare() because the 1GB hugepage is broken down into raw error pages before coming to this point: if (unlikely(PageHWPoison(page)) && !order) { ... return false; } Then, the page is not sent to buddy and the page refcount is left 0. Originally this check is supposed to work when the error page is freed from page_handle_poison() (that is called from soft-offline), but now we are opening another path to call it, so the callers of __page_handle_poison() need to handle the case by considering the return value 0 as success. Then page refcount for hwpoison is properly incremented so unpoison works. Link: https://lkml.kernel.org/r/20220714042420.1847125-8-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: kernel test robot Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit 7453bf621cfaf01a61f0e9180390ac6abc414894 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:18 2022 +0900 mm, hwpoison: make __page_handle_poison returns int __page_handle_poison() returns bool that shows whether take_page_off_buddy() has passed or not now. But we will want to distinguish another case of "dissolve has passed but taking off failed" by its return value. So change the type of the return value. No functional change. Link: https://lkml.kernel.org/r/20220714042420.1847125-7-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: kernel test robot Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit 38f6d29397ccb9c191c4c91103e8123f518fdc10 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:17 2022 +0900 mm, hwpoison: set PG_hwpoison for busy hugetlb pages If memory_failure() fails to grab page refcount on a hugetlb page because it's busy, it returns without setting PG_hwpoison on it. This not only loses a chance of error containment, but breaks the rule that action_result() should be called only when memory_failure() do any of handling work (even if that's just setting PG_hwpoison). This inconsistency could harm code maintainability. So set PG_hwpoison and call hugetlb_set_page_hwpoison() for such a case. Link: https://lkml.kernel.org/r/20220714042420.1847125-6-naoya.horiguchi@linux.dev Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: kernel test robot Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit ac5fcde0a96a18773f06b7c00c5ea081bbdc64b3 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:16 2022 +0900 mm, hwpoison: make unpoison aware of raw error info in hwpoisoned hugepage Raw error info list needs to be removed when hwpoisoned hugetlb is unpoisoned. And unpoison handler needs to know how many errors there are in the target hugepage. So add them. HPageVmemmapOptimized(hpage) and HPageRawHwpUnreliable(hpage)) sometimes can't be unpoisoned, so skip them. Link: https://lkml.kernel.org/r/20220714042420.1847125-5-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reported-by: kernel test robot Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit 161df60e9e89651c9aa3ae0edc9aae3a8a2d21e7 Author: Naoya Horiguchi Date: Thu Jul 14 13:24:15 2022 +0900 mm, hwpoison, hugetlb: support saving mechanism of raw error pages When handling memory error on a hugetlb page, the error handler tries to dissolve and turn it into 4kB pages. If it's successfully dissolved, PageHWPoison flag is moved to the raw error page, so that's all right. However, dissolve sometimes fails, then the error page is left as hwpoisoned hugepage. It's useful if we can retry to dissolve it to save healthy pages, but that's not possible now because the information about where the raw error pages is lost. Use the private field of a few tail pages to keep that information. The code path of shrinking hugepage pool uses this info to try delayed dissolve. In order to remember multiple errors in a hugepage, a singly-linked list originated from SUBPAGE_INDEX_HWPOISON-th tail page is constructed. Only simple operations (adding an entry or clearing all) are required and the list is assumed not to be very long, so this simple data structure should be enough. If we failed to save raw error info, the hwpoison hugepage has errors on unknown subpage, then this new saving mechanism does not work any more, so disable saving new raw error info and freeing hwpoison hugepages. Link: https://lkml.kernel.org/r/20220714042420.1847125-4-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reported-by: kernel test robot Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: Liu Shixin Cc: Mike Kravetz Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit 3a194f3f8ad01bce00bd7174aaba1563bcc827eb Author: Naoya Horiguchi Date: Thu Jul 14 13:24:14 2022 +0900 mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry follow_pud_mask() does not support non-present pud entry now. As long as I tested on x86_64 server, follow_pud_mask() still simply returns no_page_table() for non-present_pud_entry() due to pud_bad(), so no severe user-visible effect should happen. But generally we should call follow_huge_pud() for non-present pud entry for 1GB hugetlb page. Update pud_huge() and follow_huge_pud() to handle non-present pud entries. The changes are similar to previous works for pud entries commit e66f17ff7177 ("mm/hugetlb: take page table lock in follow_huge_pmd()") and commit cbef8478bee5 ("mm/hugetlb: pmd_huge() returns true for non-present hugepage"). Link: https://lkml.kernel.org/r/20220714042420.1847125-3-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: kernel test robot Cc: Liu Shixin Cc: Muchun Song Cc: Oscar Salvador Cc: Yang Shi Signed-off-by: Andrew Morton commit c0531714d6e3fd720b7dacc2de2d0503a995bcdc Author: Naoya Horiguchi Date: Thu Jul 14 13:24:13 2022 +0900 mm/hugetlb: check gigantic_page_runtime_supported() in return_unused_surplus_pages() Patch series "mm, hwpoison: enable 1GB hugepage support", v7. This patch (of 8): I found a weird state of 1GB hugepage pool, caused by the following procedure: - run a process reserving all free 1GB hugepages, - shrink free 1GB hugepage pool to zero (i.e. writing 0 to /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages), then - kill the reserving process. , then all the hugepages are free *and* surplus at the same time. $ cat /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages 3 $ cat /sys/kernel/mm/hugepages/hugepages-1048576kB/free_hugepages 3 $ cat /sys/kernel/mm/hugepages/hugepages-1048576kB/resv_hugepages 0 $ cat /sys/kernel/mm/hugepages/hugepages-1048576kB/surplus_hugepages 3 This state is resolved by reserving and allocating the pages then freeing them again, so this seems not to result in serious problem. But it's a little surprising (shrinking pool suddenly fails). This behavior is caused by hstate_is_gigantic() check in return_unused_surplus_pages(). This was introduced so long ago in 2008 by commit aa888a74977a ("hugetlb: support larger than MAX_ORDER"), and at that time the gigantic pages were not supposed to be allocated/freed at run-time. Now kernel can support runtime allocation/free, so let's check gigantic_page_runtime_supported() together. Link: https://lkml.kernel.org/r/20220714042420.1847125-1-naoya.horiguchi@linux.dev Link: https://lkml.kernel.org/r/20220714042420.1847125-2-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: David Hildenbrand Cc: Mike Kravetz Cc: Liu Shixin Cc: Yang Shi Cc: Oscar Salvador Cc: Muchun Song Cc: kernel test robot Signed-off-by: Andrew Morton commit e38f055d6d9a060dbf3f69fbac5b3b04a1566a56 Author: Muchun Song Date: Tue Jun 28 17:22:35 2022 +0800 mm: hugetlb_vmemmap: use PTRS_PER_PTE instead of PMD_SIZE / PAGE_SIZE There is already a macro PTRS_PER_PTE to represent the number of page table entries, just use it. Link: https://lkml.kernel.org/r/20220628092235.91270-9-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Oscar Salvador Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 838691a1c0ec44739db558834e6954d62577d6b8 Author: Muchun Song Date: Tue Jun 28 17:22:34 2022 +0800 mm: hugetlb_vmemmap: move code comments to vmemmap_dedup.rst All the comments which explains how HVO works are moved to vmemmap_dedup.rst since commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") except some comments above page_fixed_fake_head(). This commit moves those comments to vmemmap_dedup.rst and improve vmemmap_dedup.rst as well. Link: https://lkml.kernel.org/r/20220628092235.91270-8-songmuchun@bytedance.com Signed-off-by: Muchun Song Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Mike Kravetz Cc: Oscar Salvador Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 6213834c10de954470b7195cf0cdbda858edf0ee Author: Muchun Song Date: Tue Jun 28 17:22:33 2022 +0800 mm: hugetlb_vmemmap: improve hugetlb_vmemmap code readability There is a discussion about the name of hugetlb_vmemmap_alloc/free in thread [1]. The suggestion suggested by David is rename "alloc/free" to "optimize/restore" to make functionalities clearer to users, "optimize" means the function will optimize vmemmap pages, while "restore" means restoring its vmemmap pages discared before. This commit does this. Another discussion is the confusion RESERVE_VMEMMAP_NR isn't used explicitly for vmemmap_addr but implicitly for vmemmap_end in hugetlb_vmemmap_alloc/free. David suggested we can compute what hugetlb_vmemmap_init() does now at runtime. We do not need to worry for the overhead of computing at runtime since the calculation is simple enough and those functions are not in a hot path. This commit has the following improvements: 1) The function suffixed name ("optimize/restore") is more expressive. 2) The logic becomes less weird in hugetlb_vmemmap_optimize/restore(). 3) The hugetlb_vmemmap_init() does not need to be exported anymore. 4) A ->optimize_vmemmap_pages field in struct hstate is killed. 5) There is only one place where checks is_power_of_2(sizeof(struct page)) instead of two places. 6) Add more comments for hugetlb_vmemmap_optimize/restore(). 7) For external users, hugetlb_optimize_vmemmap_pages() is used for detecting if the HugeTLB's vmemmap pages is optimizable originally. In this commit, it is killed and we introduce a new helper hugetlb_vmemmap_optimizable() to replace it. The name is more expressive. Link: https://lore.kernel.org/all/20220404074652.68024-2-songmuchun@bytedance.com/ [1] Link: https://lkml.kernel.org/r/20220628092235.91270-7-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Oscar Salvador Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 30152245c63b59f835193b37212991bc24669645 Author: Muchun Song Date: Tue Jun 28 17:22:32 2022 +0800 mm: hugetlb_vmemmap: replace early_param() with core_param() After the following commit: 78f39084b41d ("mm: hugetlb_vmemmap: add hugetlb_optimize_vmemmap sysctl") There is no order requirement between the parameter of "hugetlb_free_vmemmap" and "hugepages" since we have removed the check of whether HVO is enabled from hugetlb_vmemmap_init(). Therefore we can safely replace early_param() with core_param() to simplify the code. Link: https://lkml.kernel.org/r/20220628092235.91270-6-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Oscar Salvador Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 998a2997885f73e5cc732ac6d661dfa6e0f50654 Author: Muchun Song Date: Tue Jun 28 17:22:31 2022 +0800 mm: hugetlb_vmemmap: move vmemmap code related to HugeTLB to hugetlb_vmemmap.c When I first introduced vmemmap manipulation functions related to HugeTLB, I thought those functions may be reused by other modules (e.g. using similar approach to optimize vmemmap pages, unfortunately, the DAX used the same approach but does not use those functions). After two years, we didn't see any other users. So move those functions to hugetlb_vmemmap.c. Code movement without any functional change. Link: https://lkml.kernel.org/r/20220628092235.91270-5-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit dff033818a06e7d0bf79271e34bda11c2d9d98d0 Author: Muchun Song Date: Tue Jun 28 17:22:30 2022 +0800 mm: hugetlb_vmemmap: introduce the name HVO It it inconvenient to mention the feature of optimizing vmemmap pages associated with HugeTLB pages when communicating with others since there is no specific or abbreviated name for it when it is first introduced. Let us give it a name HVO (HugeTLB Vmemmap Optimization) from now. This commit also updates the document about "hugetlb_free_vmemmap" by the way discussed in thread [1]. Link: https://lore.kernel.org/all/21aae898-d54d-cc4b-a11f-1bb7fddcfffa@redhat.com/ [1] Link: https://lkml.kernel.org/r/20220628092235.91270-4-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit cf5472e561133888df81d2e48f7da9ebd3299459 Author: Muchun Song Date: Tue Jun 28 17:22:29 2022 +0800 mm: hugetlb_vmemmap: optimize vmemmap_optimize_mode handling We hold an another reference to hugetlb_optimize_vmemmap_key when making vmemmap_optimize_mode on, because we use static_key to tell memory_hotplug that memory_hotplug.memmap_on_memory should be overridden. However, this rule has gone when we have introduced PageVmemmapSelfHosted. Therefore, we could simplify vmemmap_optimize_mode handling by not holding an another reference to hugetlb_optimize_vmemmap_key. This also means that we not incur the extra page_fixed_fake_head checks if there are no vmemmap optinmized hugetlb pages after this change. Link: https://lkml.kernel.org/r/20220628092235.91270-3-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador Reviewed-by: Mike Kravetz Cc: Anshuman Khandual Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Will Deacon Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 2da1c30929a28c3c6b01d9c16c4216037be95597 Author: Muchun Song Date: Tue Jun 28 17:22:28 2022 +0800 mm: hugetlb_vmemmap: delete hugetlb_optimize_vmemmap_enabled() Patch series "Simplify hugetlb vmemmap and improve its readability", v2. This series aims to simplify hugetlb vmemmap and improve its readability. This patch (of 8): The name hugetlb_optimize_vmemmap_enabled() a bit confusing as it tests two conditions (enabled and pages in use). Instead of coming up to an appropriate name, we could just delete it. There is already a discussion about deleting it in thread [1]. There is only one user of hugetlb_optimize_vmemmap_enabled() outside of hugetlb_vmemmap, that is flush_dcache_page() in arch/arm64/mm/flush.c. However, it does not need to call hugetlb_optimize_vmemmap_enabled() in flush_dcache_page() since HugeTLB pages are always fully mapped and only head page will be set PG_dcache_clean meaning only head page's flag may need to be cleared (see commit cf5a501d985b). So it is easy to remove hugetlb_optimize_vmemmap_enabled(). Link: https://lore.kernel.org/all/c77c61c8-8a5a-87e8-db89-d04d8aaab4cc@oracle.com/ [1] Link: https://lkml.kernel.org/r/20220628092235.91270-2-songmuchun@bytedance.com Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador Reviewed-by: Mike Kravetz Reviewed-by: Catalin Marinas Cc: Will Deacon Cc: Anshuman Khandual Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Xiongchun Duan Signed-off-by: Andrew Morton commit 1d1ab5d39be7590bb2400418877bff43da9e75ec Author: Luiz Augusto von Dentz Date: Fri Aug 5 14:02:21 2022 -0700 Bluetooth: ISO: Fix not using the correct QoS This fixes using wrong QoS settings when attempting to send frames while acting as peripheral since the QoS settings in use are stored in hconn->iso_qos not in sk->qos, this is actually properly handled on getsockopt(BT_ISO_QOS) but not on iso_send_frame. Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz commit 3f2893d3c142986aa935821460cb3adb77044722 Author: Tetsuo Handa Date: Fri Aug 5 16:12:18 2022 +0900 Bluetooth: don't try to cancel uninitialized works at mgmt_index_removed() syzbot is reporting attempt to cancel uninitialized work at mgmt_index_removed() [1], for calling cancel_delayed_work_sync() without INIT_DELAYED_WORK() is not permitted. INIT_DELAYED_WORK() is called from mgmt_init_hdev() via chan->hdev_init() from hci_mgmt_cmd(), but cancel_delayed_work_sync() is unconditionally called from mgmt_index_removed(). Call cancel_delayed_work_sync() only if HCI_MGMT flag was set, for mgmt_init_hdev() sets HCI_MGMT flag when calling INIT_DELAYED_WORK(). Link: https://syzkaller.appspot.com/bug?extid=b8ddd338a8838e581b1c [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Fixes: 0ef08313cefdd60d ("Bluetooth: Convert delayed discov_off to hci_sync") Signed-off-by: Luiz Augusto von Dentz commit 9dfe1727b21927c6dd8d703e3a9618b505eb6224 Author: Luiz Augusto von Dentz Date: Wed Aug 3 10:17:17 2022 -0700 Bluetooth: ISO: Fix iso_sock_getsockopt for BT_DEFER_SETUP BT_DEFER_SETUP shall be considered valid for all states except for BT_CONNECTED as it is also used when initiated a connection rather then only for BT_BOUND and BT_LISTEN. Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz commit 0c7937587d8b0337466c993dc9c7645767f57bfd Author: Luiz Augusto von Dentz Date: Wed Aug 3 14:51:16 2022 -0700 Bluetooth: MGMT: Fixes build warnings with C=1 This fixes the following warning when building with make C=1: net/bluetooth/mgmt.c:3821:29: warning: restricted __le16 degrades to integer net/bluetooth/mgmt.c:4625:9: warning: cast to restricted __le32 Fixes: 600a87490ff98 ("Bluetooth: Implementation of MGMT_OP_SET_BLOCKED_KEYS.") Fixes: 4c54bf2b093bb ("Bluetooth: Add get/set device flags mgmt op") Signed-off-by: Luiz Augusto von Dentz commit 889f0346d47a0285093a3b665d1455c084636d9f Author: Luiz Augusto von Dentz Date: Wed Aug 3 14:44:13 2022 -0700 Bluetooth: hci_event: Fix build warning with C=1 This fixes the following warning when build with make C=1: net/bluetooth/hci_event.c:337:15: warning: restricted __le16 degrades to integer Fixes: a93661203641e ("Bluetooth: Process result of HCI Delete Stored Link Key command") Signed-off-by: Luiz Augusto von Dentz commit b4443423278263d229dbeee12d09e657b78d64ab Author: Luiz Augusto von Dentz Date: Fri Jul 29 11:03:27 2022 -0700 Bluetooth: ISO: Fix memory corruption The following memory corruption can happen since iso_pinfo.base size did not account for its headers (4 bytes): net/bluetooth/eir.c 76 memcpy(&eir[eir_len], data, data_len); ^^^^^^^ ^^^^^^^^ 77 eir_len += data_len; 78 79 return eir_len; 80 } The "eir" buffer has 252 bytes and data_len is 252 but we do a memcpy() to &eir[4] so this can corrupt 4 bytes beyond the end of the buffer. Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Luiz Augusto von Dentz Reported-by: Dan Carpenter commit ce78e557ff8819f2d10e8d6bae79404bfbbd6809 Author: Soenke Huster Date: Fri Jul 22 13:53:07 2022 +0200 Bluetooth: Fix null pointer deref on unexpected status event __hci_cmd_sync returns NULL if the controller responds with a status event. This is unexpected for the commands sent here, but on occurrence leads to null pointer dereferences and thus must be handled. Signed-off-by: Soenke Huster Signed-off-by: Luiz Augusto von Dentz commit 0eee4995f40573f65ed67cea4d20fcf389d353de Author: Luiz Augusto von Dentz Date: Thu Jul 28 16:50:48 2022 -0700 Bluetooth: ISO: Fix info leak in iso_sock_getsockopt() The C standard rules for when struct holes are zeroed out are slightly weird. The existing assignments might initialize everything, but GCC is allowed to (and does sometimes) leave the struct holes uninitialized, so instead of using yet another variable and copy the QoS settings just use a pointer to the stored QoS settings. Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type") Reported-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz commit 10b9adb556508a299dc283b7c746b811f6918987 Author: Luiz Augusto von Dentz Date: Thu Jul 28 13:56:36 2022 -0700 Bluetooth: hci_conn: Fix updating ISO QoS PHY BT_ISO_QOS has different semantics when it comes to QoS PHY as it uses 0x00 to disable a direction but that value is invalid over HCI and sockets using DEFER_SETUP to connect may attempt to use hci_bind_cis multiple times in order to detect if the parameters have changed, so to fix the code will now just mirror the PHY for the parameters of HCI_OP_LE_SET_CIG_PARAMS and will not update the PHY of the socket leaving it disabled. Fixes: 26afbd826ee32 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Luiz Augusto von Dentz commit 164dac9755ac297b0c07505ad3db9e7d69b80499 Author: Dan Carpenter Date: Wed Jul 27 15:08:56 2022 +0300 Bluetooth: ISO: unlock on error path in iso_sock_setsockopt() Call release_sock(sk); before returning on this error path. Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz commit 332f1795ca202489c665a75e62e18ff6284de077 Author: Luiz Augusto von Dentz Date: Mon Aug 1 13:52:07 2022 -0700 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning: net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm() error: we previously assumed 'c' could be null (see line 1996) Fixes: d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put") Reported-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz commit 03c4cd6f89e074a51e289eb9129ac646f0f2bd29 Author: Zeng Jingxiang Date: Thu Jul 28 18:01:01 2022 +0800 rtc: spear: set range max In the commit f395e1d3b28d7c2c67b73bd467c4fb79523e1c65 ("rtc: spear: set range"), the value of RTC_TIMESTAMP_END_9999 was incorrectly set to range_min. 390 config->rtc->range_min = RTC_TIMESTAMP_BEGIN_0000; 391 config->rtc->range_max = RTC_TIMESTAMP_END_9999; Fixes: f395e1d3b28d ("rtc: spear: set range") Signed-off-by: Zeng Jingxiang Acked-by: Viresh Kumar Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220728100101.1906801-1-zengjx95@gmail.com commit 5d5d353bed32dc3ea52e2619e0d1c60b17133b91 Merge: c72687614b362 8447d0e75099e Author: Linus Torvalds Date: Mon Aug 8 15:16:29 2022 -0700 Merge tag 'rproc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "This introduces support for the remoteproc on Mediatek MT8188, and enables caches for MT8186 SCP. It adds support for PRU cores found on the TI K3 AM62x SoCs. It moves the recovery work after a firmware crash to an unbound workqueue, to allow recovery to happen in parallel. A new DMA API is introduced to release dma_mem for a device. It adds support a panic handler for the Qualcomm modem remoteproc, with the goal of having caches flushed in memory dumps for post-mortem debugging and it introduces a mechanism to wait for the modem firmware on SM8450 to decrypt part of its memory for post-mortem debugging. Qualcomm sysmon is restricted to only inform remote processors about peers that are actually running, to avoid a race where Linux tries to notify a recovering remote processor about its peers new state. A mechanism for waiting for the sysmon connection to be established is also introduced, to avoid out-of-sync updates for rapidly restarting remote processors. A number of Devicetree binding cleanups and conversions to YAML are introduced, to facilitate Devicetree validation. Lastly it introduces a number of smaller fixes and cleanups in the core and a few different drivers" * tag 'rproc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (42 commits) remoteproc: qcom_q6v5_pas: Do not fail if regulators are not found drivers/remoteproc: fix repeated words in comments remoteproc: Directly use ida_alloc()/free() remoteproc: Use unbounded workqueue for recovery work remoteproc: using pm_runtime_resume_and_get instead of pm_runtime_get_sync remoteproc: qcom_q6v5_pas: Deal silently with optional px and cx regulators remoteproc: sysmon: Send sysmon state only for running rprocs remoteproc: sysmon: Wait for SSCTL service to come up remoteproc: qcom: q6v5: Set q6 state to offline on receiving wdog irq remoteproc: qcom: pas: Check if coredump is enabled remoteproc: qcom: pas: Mark devices as wakeup capable remoteproc: qcom: pas: Mark va as io memory remoteproc: qcom: pas: Add decrypt shutdown support for modem remoteproc: qcom: q6v5-mss: add powerdomains to MSM8996 config remoteproc: qcom_q6v5: Introduce panic handler for MSS remoteproc: qcom_q6v5_mss: Update MBA log info remoteproc: qcom: correct kerneldoc remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use remoteproc: qcom: using pm_runtime_resume_and_get to simplify the code remoteproc: mediatek: Support MT8188 SCP ... commit c72687614b3627b3ea55d8d169e31cac70f56f3e Merge: e6cc0b56e2be8 7113ac825371c Author: Linus Torvalds Date: Mon Aug 8 15:14:43 2022 -0700 Merge tag 'rpmsg-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "This contains fixes and cleanups in the rpmsg core, Qualcomm SMD and GLINK drivers, a circular lock dependency in the Mediatek driver and a possible race condition in the rpmsg_char driver is resolved" * tag 'rpmsg-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: convert sysfs snprintf to sysfs_emit rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge rpmsg: qcom: correct kerneldoc rpmsg: qcom: glink: remove unused name rpmsg: qcom: glink: replace strncpy() with strscpy_pad() rpmsg: Strcpy is not safe, use strscpy_pad() instead rpmsg: Fix possible refcount leak in rpmsg_register_device_override() rpmsg: Fix parameter naming for announce_create/destroy ops rpmsg: mtk_rpmsg: Fix circular locking dependency rpmsg: char: Add mutex protection for rpmsg_eptdev_open() commit e6cc0b56e2be8746824915d3f7130899b98a1242 Merge: 507f811f205c1 2d27e52841092 Author: Linus Torvalds Date: Mon Aug 8 15:04:04 2022 -0700 Merge tag 'linux-watchdog-5.20-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add RTL9310 support - sp805_wdt: add arm cmsdk apb wdt support - Remove #ifdef guards for PM related functions for several watchdog device drivers - pm8916_wdt reboot improvements - Several other fixes and improvements * tag 'linux-watchdog-5.20-rc1' of git://www.linux-watchdog.org/linux-watchdog: (24 commits) watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() watchdog: dw_wdt: Fix comment typo watchdog: Fix comment typo dt-bindings: watchdog: Add fsl,scu-wdt yaml file watchdog:Fix typo in comment watchdog: pm8916_wdt: Handle watchdog enabled by bootloader watchdog: pm8916_wdt: Report reboot reason watchdog: pm8916_wdt: Avoid read of write-only PET register watchdog: wdat_wdt: Remove #ifdef guards for PM related functions watchdog: tegra_wdt: Remove #ifdef guards for PM related functions watchdog: st_lpc_wdt: Remove #ifdef guards for PM related functions watchdog: sama5d4_wdt: Remove #ifdef guards for PM related functions watchdog: s3c2410_wdt: Remove #ifdef guards for PM related functions watchdog: mtk_wdt: Remove #ifdef guards for PM related functions watchdog: dw_wdt: Remove #ifdef guards for PM related functions watchdog: bcm7038_wdt: Remove #ifdef guards for PM related functions watchdog: realtek-otto: add RTL9310 support dt-bindings: watchdog: realtek,otto-wdt: add RTL9310 watchdog: sp805_wdt: add arm cmsdk apb wdt support watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource ... commit 507f811f205c17fd6f64e8d34d4bf91cd01b07a2 Merge: 033c88d58b66a c3f834df191ac Author: Linus Torvalds Date: Mon Aug 8 14:29:00 2022 -0700 Merge tag 'pm-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are ARM cpufreq updates and operating performance points (OPP) updates plus one cpuidle update adding a new trace point. Specifics: - Fix return error code in mtk_cpu_dvfs_info_init (Yang Yingliang). - Minor cleanups and support for new boards for Qcom cpufreq drivers (Bryan O'Donoghue, Konrad Dybcio, Pierre Gondois, and Yicong Yang). - Fix sparse warnings for Tegra cpufreq driver (Viresh Kumar). - Make dev_pm_opp_set_regulators() accept NULL terminated list (Viresh Kumar). - Add dev_pm_opp_set_config() and friends and migrate other users and helpers to using them (Viresh Kumar). - Add support for multiple clocks for a device (Viresh Kumar and Krzysztof Kozlowski). - Configure resources before adding OPP table for Venus (Stanimir Varbanov). - Keep reference count up for opp->np and opp_table->np while they are still in use (Liang He). - Minor OPP cleanups (Viresh Kumar and Yang Li). - Add a trace event for cpuidle to track missed (too deep or too shallow) wakeups (Kajetan Puchalski)" * tag 'pm-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (55 commits) cpuidle: Add cpu_idle_miss trace event venus: pm_helpers: Fix warning in OPP during probe OPP: Don't drop opp->np reference while it is still in use OPP: Don't drop opp_table->np reference while it is still in use cpufreq: tegra194: Staticize struct tegra_cpufreq_soc instances dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM6375 compatible dt-bindings: opp: Add msm8939 to the compatible list dt-bindings: opp: Add missing compat devices dt-bindings: opp: opp-v2-kryo-cpu: Fix example binding checks cpufreq: Change order of online() CB and policy->cpus modification cpufreq: qcom-hw: Remove deprecated irq_set_affinity_hint() call cpufreq: qcom-hw: Disable LMH irq when disabling policy cpufreq: qcom-hw: Reset cancel_throttle when policy is re-enabled cpufreq: qcom-cpufreq-hw: use HZ_PER_KHZ macro in units.h cpufreq: mediatek: fix error return code in mtk_cpu_dvfs_info_init() OPP: Remove dev{m}_pm_opp_of_add_table_noclk() PM / devfreq: tegra30: Register config_clks helper OPP: Allow config_clks helper for single clk case OPP: Provide a simple implementation to configure multiple clocks OPP: Assert clk_count == 1 for single clk helpers ... commit 033c88d58b66a5bf61a9a4f0029c4fb771f0555e Merge: d5af75f77c52c 7f0169cde0ced Author: Linus Torvalds Date: Mon Aug 8 14:23:37 2022 -0700 Merge tag 'thermal-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "These fix an error code path issue leading to a NULL pointer dereference, drop Kconfig dependencies that are not needed any more after recent changes, add CPU IDs for new chips to a driver and fix up the tmon utility. Specifics: - Fix NULL pointer dereference in the thermal sysfs interface that results from an error code path mishandling (Rafael Wysocki). - Drop COMPILE_TEST dependency that's not needed any more from two thermal Kconfig entries (Jean Delvare). - Make the Intel TCC cooling driver support Alder Lake-N and Raptor Lake-P (Sumeet Pawnikar). - Fix possible path truncations in the tmon utility (Florian Fainelli)" * tag 'thermal-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: tools/thermal: Fix possible path truncations thermal: Drop obsolete dependency on COMPILE_TEST thermal: sysfs: Fix cooling_device_stats_setup() error code path thermal: intel: Add TCC cooling support for Alder Lake-N and Raptor Lake-P commit d5af75f77c52c6193fdf34bdb780cb615edadd76 Merge: e74acdf55da66 374a723c7448b Author: Linus Torvalds Date: Mon Aug 8 14:17:46 2022 -0700 Merge tag 'sysctl-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "There isn't much for 6.0 for sysctl stuff, most of the stuff went through the networking subsystem (Kuniyuki Iwashima's trove of fixes using READ_ONCE/WRITE_ONCE helpers) as most of the issues there have been identified on networking side. So it is good we don't have much updates as we would have ended up with tons of conflicts. I rebased my delta just now to your tree so to avoid conflicts with that stuff. This merge request is just minor fluff cleanups then. Perhaps for 6.1 kernel/sysctl.c will get more love than this release" * tag 'sysctl-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: kernel/sysctl.c: Remove trailing white space kernel/sysctl.c: Clean up indentation, replace spaces with tab. sysctl: Merge adjacent CONFIG_TREE_RCU blocks commit e74acdf55da6649dd30be5b621a93b71cbe7f3f9 Merge: c8a684e2e1103 554694ba120b8 Author: Linus Torvalds Date: Mon Aug 8 14:12:19 2022 -0700 Merge tag 'modules-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module updates from Luis Chamberlain: "For the 6.0 merge window the modules code shifts to cleanup and minor fixes effort. This becomes much easier to do and review now due to the code split to its own directory from effort on the last kernel release. I expect to see more of this with time and as we expand on test coverage in the future. The cleanups and fixes come from usual suspects such as Christophe Leroy and Aaron Tomlin but there are also some other contributors. One particular minor fix worth mentioning is from Helge Deller, where he spotted a *forever* incorrect natural alignment on both ELF section header tables: * .altinstructions * __bug_table sections A lot of back and forth went on in trying to determine the ill effects of this misalignment being present for years and it has been determined there should be no real ill effects unless you have a buggy exception handler. Helge actually hit one of these buggy exception handlers on parisc which is how he ended up spotting this issue. When implemented correctly these paths with incorrect misalignment would just mean a performance penalty, but given that we are dealing with alternatives on modules and with the __bug_table (where info regardign BUG()/WARN() file/line information associated with it is stored) this really shouldn't be a big deal. The only other change with mentioning is the kmap() with kmap_local_page() and my only concern with that was on what is done after preemption, but the virtual addresses are restored after preemption. This is only used on module decompression. This all has sit on linux-next for a while except the kmap stuff which has been there for 3 weeks" * tag 'modules-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: Replace kmap() with kmap_local_page() module: Show the last unloaded module's taint flag(s) module: Use strscpy() for last_unloaded_module module: Modify module_flags() to accept show_state argument module: Move module's Kconfig items in kernel/module/ MAINTAINERS: Update file list for module maintainers module: Use vzalloc() instead of vmalloc()/memset(0) modules: Ensure natural alignment for .altinstructions and __bug_table sections module: Increase readability of module_kallsyms_lookup_name() module: Fix ERRORs reported by checkpatch.pl module: Add support for default value for module async_probe commit 0f3e72b5c8cfa0b57dc4fc7703a0a42dbc200ba9 Author: Jason Gunthorpe Date: Sun Jul 31 15:54:56 2022 +0300 vfio: Move vfio.c to vfio_main.c If a source file has the same name as a module then kbuild only supports a single source file in the module. Rename vfio.c to vfio_main.c so that we can have more that one .c file in vfio.ko. Signed-off-by: Jason Gunthorpe Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20220731125503.142683-5-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 3c59366c207e4c6c6569524af606baf017a55c61 Author: NeilBrown Date: Mon Aug 1 10:33:34 2022 +1000 NFS: don't unhash dentry during unlink/rename NFS unlink() (and rename over existing target) must determine if the file is open, and must perform a "silly rename" instead of an unlink (or before rename) if it is. Otherwise the client might hold a file open which has been removed on the server. Consequently if it determines that the file isn't open, it must block any subsequent opens until the unlink/rename has been completed on the server. This is currently achieved by unhashing the dentry. This forces any open attempt to the slow-path for lookup which will block on i_rwsem on the directory until the unlink/rename completes. A future patch will change the VFS to only get a shared lock on i_rwsem for unlink, so this will no longer work. Instead we introduce an explicit interlock. A special value is stored in dentry->d_fsdata while the unlink/rename is running and ->d_revalidate blocks while that value is present. When ->d_revalidate unblocks, the dentry will be invalid. This closes the race without requiring exclusion on i_rwsem. d_fsdata is already used in two different ways. 1/ an IS_ROOT directory dentry might have a "devname" stored in d_fsdata. Such a dentry doesn't have a name and so cannot be the target of unlink or rename. For safety we check if an old devname is still stored, and remove it if it is. 2/ a dentry with DCACHE_NFSFS_RENAMED set will have a 'struct nfs_unlinkdata' stored in d_fsdata. While this is set maydelete() will fail, so an unlink or rename will never proceed on such a dentry. Neither of these can be in effect when a dentry is the target of unlink or rename. So we can expect d_fsdata to be NULL, and store a special value ((void*)1) which is given the name NFS_FSDATA_BLOCKED to indicate that any lookup will be blocked. The d_count() is incremented under d_lock() when a lookup finds the dentry, so we check d_count() is low, and set NFS_FSDATA_BLOCKED under the same lock to avoid any races. Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust commit afb176d45870048eea540991b082208270824037 Author: Oder Chiou Date: Mon Aug 8 13:28:36 2022 +0800 ASoC: rt5640: Fix the JD voltage dropping issue The patch fixes the JD voltage dropping issue in the HDA JD using. Signed-off-by: Oder Chiou Reported-by: Mohan Kumar D Link: https://lore.kernel.org/r/20220808052836.25791-1-oder_chiou@realtek.com Signed-off-by: Mark Brown commit 1e5907bcb3a3b569be0a03ebe668bba2ed320a50 Author: Martin Povišer Date: Mon Aug 8 16:12:46 2022 +0200 ASoC: tas2770: Fix handling of mute/unmute Because the PWR_CTRL field is modeled as the power state of the DAC widget, and at the same time it is used to implement mute/unmute, we need some additional book-keeping to have the right end result no matter the sequence of calls. Without this fix, one can mute an ongoing stream by toggling a speaker pin control. Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220808141246.5749-5-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 482c23fbc7e9bf5a7a74defd0735d5346215db58 Author: Martin Povišer Date: Mon Aug 8 16:12:45 2022 +0200 ASoC: tas2770: Drop conflicting set_bias_level power setting The driver is setting the PWR_CTRL field in both the set_bias_level callback and on DAPM events of the DAC widget (and also in the mute_stream method). Drop the set_bias_level callback altogether as the power setting it does is in conflict with the other code paths. Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220808141246.5749-4-povik+lin@cutebit.org Signed-off-by: Mark Brown commit bf54d97a835dfe62d4d29e245e170c63d0089be7 Author: Martin Povišer Date: Mon Aug 8 16:12:44 2022 +0200 ASoC: tas2770: Allow mono streams The part is a mono speaker amp, but it can do downmix and switch between left and right channel, so the right channel range is 1 to 2. Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220808141246.5749-3-povik+lin@cutebit.org Signed-off-by: Mark Brown commit e9ac31f0a5d0e246b046c20348954519f91a297f Author: Martin Povišer Date: Mon Aug 8 16:12:43 2022 +0200 ASoC: tas2770: Set correct FSYNC polarity Fix setting of FSYNC polarity for DAI formats other than I2S. Also add support for polarity inversion. Fixes: 1a476abc723e ("tas2770: add tas2770 smart PA kernel driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20220808141246.5749-2-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 9d50bff40e3e366886ec37299fc317edf84be0c9 Author: Mauro Carvalho Chehab Date: Thu Aug 4 09:37:22 2022 +0200 drm/i915: pass a pointer for tlb seqno at vma_invalidate_tlb() WRITE_ONCE() should happen at the original var, not on a local copy of it. Cc: stable@vger.kernel.org Fixes: 59eda6ce824e ("drm/i915/gt: Batch TLB invalidations") Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Andi Shyti Signed-off-by: Rodrigo Vivi [added cc-stable while merging it] Link: https://patchwork.freedesktop.org/patch/msgid/f9550e6bacea10131ff40dd8981b69eb9251cdcd.1659598090.git.mchehab@kernel.org (cherry picked from commit 3d037d99e61a1e7a3ae3d214146d88db349dd19f) Signed-off-by: Rodrigo Vivi commit c8a684e2e110376c58f0bfa30fb3855d1e319670 Merge: 607ca0f742b7d 38ba0bb291aac Author: Linus Torvalds Date: Mon Aug 8 11:36:21 2022 -0700 Merge tag 'leds-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds Pull LED updates from Pavel Machek: "A new driver for bcm63138, is31fl319x updates, fixups for multicolor. The clevo-mail driver got disabled, it needs an API fix" * tag 'leds-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds: (23 commits) leds: is31fl319x: use simple i2c probe function leds: is31fl319x: Fix devm vs. non-devm ordering leds: is31fl319x: Make use of dev_err_probe() leds: is31fl319x: Make use of device properties leds: is31fl319x: Cleanup formatting and dev_dbg calls leds: is31fl319x: Add support for is31fl319{0,1,3} chips leds: is31fl319x: Move chipset-specific values in chipdef struct leds: is31fl319x: Use non-wildcard names for vars, structs and defines leds: is31fl319x: Add missing si-en compatibles dt-bindings: leds: pwm-multicolor: document max-brigthness leds: turris-omnia: convert to use dev_groups leds: leds-bcm63138: get rid of LED_OFF leds: add help info about BCM63138 module name dt-bindings: leds: leds-bcm63138: unify full stops in descriptions dt-bindings: leds: lp50xx: fix LED children names dt-bindings: leds: class-multicolor: reference class directly in multi-led node leds: bcm63138: add support for BCM63138 controller dt-bindings: leds: add Broadcom's BCM63138 controller leds: clevo-mail: Mark as broken pending interface fix leds: pwm-multicolor: Support active-low LEDs ... commit 6492fed7d8c95f53b0b804ef541324d924d95d41 Author: Rafael J. Wysocki Date: Mon Aug 8 20:23:59 2022 +0200 rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 The ACPI_FADT_LOW_POWER_S0 flag merely means that it is better to use low-power S0 idle on the given platform than S3 (provided that the latter is supported) and it doesn't preclude using either of them (which of them will be used depends on the choices made by user space). For this reason, there is no benefit from checking that flag in use_acpi_alarm_quirks(). First off, it cannot be a bug to do S3 with use_acpi_alarm set, because S3 can be used on systems with ACPI_FADT_LOW_POWER_S0 and it must work if really supported, so the ACPI_FADT_LOW_POWER_S0 check is not needed to protect the S3-capable systems from failing. Second, suspend-to-idle can be carried out on a system with ACPI_FADT_LOW_POWER_S0 unset and it is expected to work, so if setting use_acpi_alarm is needed to handle that case correctly, it should be set regardless of the ACPI_FADT_LOW_POWER_S0 value. Accordingly, drop the ACPI_FADT_LOW_POWER_S0 check from use_acpi_alarm_quirks(). Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/12054246.O9o76ZdvQC@kreacher commit c9a1dd673f28da9624776e75b78ae04125544852 Author: Alexandre Belloni Date: Wed Jul 27 12:00:18 2022 +0200 rtc: zynqmp: initialize fract_tick fract_tick is used uninitialized when fract_offset is 0 Reported-by: kernel test robot Signed-off-by: Alexandre Belloni Reviewed-by: Nathan Chancellor Reviewed-by: Michal Simek Link: https://lore.kernel.org/r/20220727100018.3301470-1-alexandre.belloni@bootlin.com commit 607ca0f742b7d990b6efb3c3e7a52830f7e96419 Merge: 1daf117f1d6b5 0fec518018cc5 Author: Linus Torvalds Date: Mon Aug 8 11:31:40 2022 -0700 Merge tag 'tty-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the big set of tty and serial driver changes for 6.0-rc1. It was delayed from last week as I wanted to make sure the last commit here got some good testing in linux-next and elsewhere as it seemed to show up only late in testing for some reason. Nothing major here, just lots of cleanups from Jiri and Ilpo to make the tty core cleaner (Jiri) and the rs485 code simpler to use (Ilpo). Also included in here is the obligatory n_gsm updates from Daniel Starke and lots of tiny driver updates and minor fixes and tweaks for other smaller serial drivers. All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (186 commits) tty: serial: qcom-geni-serial: Fix %lu -> %u in print statements tty: amiserial: Fix comment typo tty: serial: document uart_get_console() tty: serial: serial_core, reformat kernel-doc for functions Documentation: serial: link uart_ops properly Documentation: serial: move GPIO kernel-doc to the functions Documentation: serial: dedup kernel-doc for uart functions Documentation: serial: move uart_ops documentation to the struct dt-bindings: serial: snps-dw-apb-uart: Document Rockchip RV1126 serial: mvebu-uart: uart2 error bits clearing tty: serial: fsl_lpuart: correct the count of break characters serial: stm32: make info structs static to avoid sparse warnings serial: fsl_lpuart: zero out parity bit in CS7 mode tty: serial: qcom-geni-serial: Fix get_clk_div_rate() which otherwise could return a sub-optimal clock rate. serial: 8250_bcm2835aux: Add missing clk_disable_unprepare() tty: vt: initialize unicode screen buffer serial: remove VR41XX serial driver serial: 8250: lpc18xx: Remove redundant sanity check for RS485 flags serial: 8250_dwlib: remove redundant sanity check for RS485 flags dt_bindings: rs485: Correct delay values ... commit 1daf117f1d6b5056e27353fa289ef1bbcb619e8d Merge: 2bd5d41e0e9d8 01fc4b9a6ed8e Author: Linus Torvalds Date: Mon Aug 8 11:18:31 2022 -0700 Merge tag 'f2fs-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this cycle, we mainly fixed some corner cases that manipulate a per-file compression flag inappropriately. And, we found f2fs counted valid blocks in a section incorrectly when zone capacity is set, and thus, fixed it with additional sysfs entry to check it easily. Lastly, this series includes several patches with respect to the new atomic write support such as a couple of bug fixes and re-adding atomic_write_abort support that we removed by mistake in the previous release. Enhancements: - add sysfs entries to understand atomic write operations and zone capacity - introduce memory mode to get a hint for low-memory devices - adjust the waiting time of foreground GC - decompress clusters under softirq to avoid non-deterministic latency - do not skip updating inode when retrying to flush node page - enforce single zone capacity Bug fixes: - set the compression/no-compression flags correctly - revive F2FS_IOC_ABORT_VOLATILE_WRITE - check inline_data during compressed inode conversion - understand zone capacity when calculating valid block count As usual, the series includes several minor clean-ups and sanity checks" * tag 'f2fs-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (29 commits) f2fs: use onstack pages instead of pvec f2fs: intorduce f2fs_all_cluster_page_ready f2fs: clean up f2fs_abort_atomic_write() f2fs: handle decompress only post processing in softirq f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED f2fs: do not set compression bit if kernel doesn't support f2fs: remove device type check for direct IO f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE f2fs: fix to do sanity check on segment type in build_sit_entries() f2fs: obsolete unused MAX_DISCARD_BLOCKS f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time f2fs: introduce sysfs atomic write statistics f2fs: don't bother wait_ms by foreground gc f2fs: invalidate meta pages only for post_read required inode f2fs: allow compression of files without blocks f2fs: fix to check inline_data during compressed inode conversion f2fs: Delete f2fs_copy_page() and replace with memcpy_page() f2fs: fix to invalidate META_MAPPING before DIO write ... commit 2bd5d41e0e9d8e423a0bd446ee174584c8a495fe Merge: 65512eb0e9e63 247861c325c2e Author: Linus Torvalds Date: Mon Aug 8 11:10:02 2022 -0700 Merge tag 'fuse-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Fix an issue with reusing the bdi in case of block based filesystems - Allow root (in init namespace) to access fuse filesystems in user namespaces if expicitly enabled with a module param - Misc fixes * tag 'fuse-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: retire block-device-based superblock on force unmount vfs: function to prevent re-use of block-device-based superblocks virtio_fs: Modify format for virtio_fs_direct_access virtiofs: delete unused parameter for virtio_fs_cleanup_vqs fuse: Add module param for CAP_SYS_ADMIN access bypassing allow_other fuse: Remove the control interface for virtio-fs fuse: ioctl: translate ENOSYS fuse: limit nsec fuse: avoid unnecessary spinlock bump fuse: fix deadlock between atomic O_TRUNC and page invalidation fuse: write inode in fuse_release() commit 2826d447fbd60e6a05e53d5f918bceb8c04e315c Author: Chris Wilson Date: Tue Jul 26 16:48:44 2022 +0200 drm/i915/gem: Remove shared locking on freeing objects The obj->base.resv may be shared across many objects, some of which may still be live and locked, preventing objects from being freed indefintely. We could individualise the lock during the free, or rely on a freed object having no contention and being able to immediately free the pages it owns. References: https://gitlab.freedesktop.org/drm/intel/-/issues/6469 Fixes: be7612fd6665 ("drm/i915: Require object lock when freeing pages during destruction") Fixes: 6cb12fbda1c2 ("drm/i915: Use trylock instead of blocking lock for __i915_gem_free_objects.") Cc: # v5.17+ Signed-off-by: Chris Wilson Tested-by: Nirmoy Das Acked-by: Nirmoy Das Signed-off-by: Nirmoy Das Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220726144844.18429-1-nirmoy.das@intel.com (cherry picked from commit 7dd5c56531eb03696acdb17774721de5ef481c0b) Signed-off-by: Rodrigo Vivi commit 59eda6ce824e95b98c45628fe6c0adb9130c6df2 Author: Chris Wilson Date: Wed Jul 27 14:29:55 2022 +0200 drm/i915/gt: Batch TLB invalidations Invalidate TLB in batches, in order to reduce performance regressions. Currently, every caller performs a full barrier around a TLB invalidation, ignoring all other invalidations that may have already removed their PTEs from the cache. As this is a synchronous operation and can be quite slow, we cause multiple threads to contend on the TLB invalidate mutex blocking userspace. We only need to invalidate the TLB once after replacing our PTE to ensure that there is no possible continued access to the physical address before releasing our pages. By tracking a seqno for each full TLB invalidate we can quickly determine if one has been performed since rewriting the PTE, and only if necessary trigger one for ourselves. That helps to reduce the performance regression introduced by TLB invalidate logic. [mchehab: rebased to not require moving the code to a separate file] Cc: stable@vger.kernel.org Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") Suggested-by: Tvrtko Ursulin Signed-off-by: Chris Wilson Cc: Fei Yang Signed-off-by: Mauro Carvalho Chehab Acked-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/4e97ef5deb6739cadaaf40aa45620547e9c4ec06.1658924372.git.mchehab@kernel.org (cherry picked from commit 5d36acb7198b0e5eb88e6b701f9ad7b9448f8df9) Signed-off-by: Rodrigo Vivi commit 65512eb0e9e6308ca08110c88a9619a9e5a19aa9 Merge: f72fb74b8218f 4f1196288dfb6 Author: Linus Torvalds Date: Mon Aug 8 11:03:11 2022 -0700 Merge tag 'ovl-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs update from Miklos Szeredi: "Just a small update" * tag 'ovl-update-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: fix spelling mistakes ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() ovl: improve ovl_get_acl() if POSIX ACL support is off ovl: fix some kernel-doc comments ovl: warn if trusted xattr creation fails commit f72fb74b8218f9aebfcc691b7e9bb641920dbc13 Merge: e2ebff9c57fe4 df13a34776354 Author: Linus Torvalds Date: Mon Aug 8 10:57:09 2022 -0700 Merge tag 'exfat-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - fix the error code of rename syscall - cleanup and suppress the superfluous error messages - remove duplicate directory entry update - add exfat git tree in MAINTAINERS * tag 'exfat-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: MAINTAINERS: Add Namjae's exfat git tree exfat: Drop superfluous new line for error messages exfat: Downgrade ENAMETOOLONG error message to debug messages exfat: Expand exfat_err() and co directly to pr_*() macro exfat: Define NLS_NAME_* as bit flags explicitly exfat: Return ENAMETOOLONG consistently for oversized paths exfat: remove duplicate write inode for extending dir/file exfat: remove duplicate write inode for truncating file exfat: reuse __exfat_write_inode() to update directory entry commit e2ebff9c57fe4eb104ce4768f6ebcccf76bef849 Author: David Howells Date: Mon Aug 8 09:52:35 2022 +0100 vfs: Check the truncate maximum size in inode_newsize_ok() If something manages to set the maximum file size to MAX_OFFSET+1, this can cause the xfs and ext4 filesystems at least to become corrupt. Ordinarily, the kernel protects against userspace trying this by checking the value early in the truncate() and ftruncate() system calls calls - but there are at least two places that this check is bypassed: (1) Cachefiles will round up the EOF of the backing file to DIO block size so as to allow DIO on the final block - but this might push the offset negative. It then calls notify_change(), but this inadvertently bypasses the checking. This can be triggered if someone puts an 8EiB-1 file on a server for someone else to try and access by, say, nfs. (2) ksmbd doesn't check the value it is given in set_end_of_file_info() and then calls vfs_truncate() directly - which also bypasses the check. In both cases, it is potentially possible for a network filesystem to cause a disk filesystem to be corrupted: cachefiles in the client's cache filesystem; ksmbd in the server's filesystem. nfsd is okay as it checks the value, but we can then remove this check too. Fix this by adding a check to inode_newsize_ok(), as called from setattr_prepare(), thereby catching the issue as filesystems set up to perform the truncate with minimal opportunity for bypassing the new check. Fixes: 1f08c925e7a3 ("cachefiles: Implement backing file wrangling") Fixes: f44158485826 ("cifsd: add file operations") Signed-off-by: David Howells Reported-by: Jeff Layton Tested-by: Jeff Layton Reviewed-by: Namjae Jeon Cc: stable@kernel.org Acked-by: Alexander Viro cc: Steve French cc: Hyunchul Lee cc: Chuck Lever cc: Dave Wysochanski Signed-off-by: Linus Torvalds commit 7f0169cde0ced2e2b7bdf3dcedcf8c71efc6afc0 Merge: 312c1a44da370 8df4ef3eaa62b 6c58cf40e3a1d Author: Rafael J. Wysocki Date: Mon Aug 8 19:39:09 2022 +0200 Merge branches 'thermal-core' and 'thermal-tools' Merge additional changes in the thermal core and thermal tools updates for 5.20-rc1: - Fix NULL poiter dereference in the thermal sysfs interface that results from an error code path mishandling (Rafael Wysocki). - Drop COMPILE_TEST dependency that's not needed any more from two thermal Kconfig entries (Jean Delvare). - Fix possible path truncations in the tmon utility (Florian Fainelli). * thermal-core: thermal: Drop obsolete dependency on COMPILE_TEST thermal: sysfs: Fix cooling_device_stats_setup() error code path * thermal-tools: tools/thermal: Fix possible path truncations commit c3f834df191ac2e5e58c215b9110e7e19553100f Merge: c4f5a40bf000d 7912c9c6a6e8e Author: Rafael J. Wysocki Date: Mon Aug 8 19:35:33 2022 +0200 Merge branch 'pm-cpufreq' Merge ARM cpufreq updates for 5.20-rc1. * pm-cpufreq: cpufreq: tegra194: Staticize struct tegra_cpufreq_soc instances dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM6375 compatible dt-bindings: opp: Add msm8939 to the compatible list dt-bindings: opp: Add missing compat devices dt-bindings: opp: opp-v2-kryo-cpu: Fix example binding checks cpufreq: Change order of online() CB and policy->cpus modification cpufreq: qcom-hw: Remove deprecated irq_set_affinity_hint() call cpufreq: qcom-hw: Disable LMH irq when disabling policy cpufreq: qcom-hw: Reset cancel_throttle when policy is re-enabled cpufreq: qcom-cpufreq-hw: use HZ_PER_KHZ macro in units.h cpufreq: mediatek: fix error return code in mtk_cpu_dvfs_info_init() commit c4f5a40bf000defdd6d04ef65e680183718fc3af Merge: 6ab4b1990097b f6e0b468dab97 Author: Rafael J. Wysocki Date: Mon Aug 8 19:32:33 2022 +0200 Merge branch 'pm-opp' Merge operating performance points (OPP) updates for 5.20-rc1. * pm-opp: (43 commits) venus: pm_helpers: Fix warning in OPP during probe OPP: Don't drop opp->np reference while it is still in use OPP: Don't drop opp_table->np reference while it is still in use OPP: Remove dev{m}_pm_opp_of_add_table_noclk() PM / devfreq: tegra30: Register config_clks helper OPP: Allow config_clks helper for single clk case OPP: Provide a simple implementation to configure multiple clocks OPP: Assert clk_count == 1 for single clk helpers OPP: Add key specific assert() method to key finding helpers OPP: Compare bandwidths for all paths in _opp_compare_key() OPP: Allow multiple clocks for a device dt-bindings: opp: accept array of frequencies OPP: Make dev_pm_opp_set_opp() independent of frequency OPP: Reuse _opp_compare_key() in _opp_add_static_v2() OPP: Remove rate_not_available parameter to _opp_add() OPP: Use consistent names for OPP table instances OPP: Use generic key finding helpers for bandwidth key OPP: Use generic key finding helpers for level key OPP: Add generic key finding helpers and use them for freq APIs OPP: Remove dev_pm_opp_find_freq_ceil_by_volt() ... commit b0f2fe5a38389790a97334c5df1c5dec52c5d627 Author: Andy Shevchenko Date: Tue Aug 2 22:35:03 2022 +0300 ACPI: VIOT: Do not dereference fwnode in struct device In order to make the underneath API easier to change in the future, prevent users from dereferencing fwnode from struct device. Instead, use the specific dev_fwnode() and device_match_fwnode() APIs for that. Signed-off-by: Andy Shevchenko Reviewed-by: Eric Auger Signed-off-by: Rafael J. Wysocki commit 3466f49dd0dd9d30fe1e916b49fca1f4f99a3b66 Merge: 92ceebf920aa9 cdab30b445185 Author: Linus Torvalds Date: Mon Aug 8 10:27:51 2022 -0700 Merge tag 'hwlock-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock updates from Bjorn Andersson: "This removes the need for representing the Qualcomm SFPB mutex using an intermediate syscon node and it clean up the pm_runtime_get_sync() usage in the OMAP hwspinlock driver" * tag 'hwlock-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: qcom: Add support for mmio usage to sfpb-mutex hwspinlock: using pm_runtime_resume_and_get instead of pm_runtime_get_sync commit 92ceebf920aa9f103b89d102f98fc59c6b990cc0 Merge: df7a456e7d1d7 8a8dc2b9596e6 Author: Linus Torvalds Date: Mon Aug 8 10:19:40 2022 -0700 Merge tag 'mailbox-v5.20' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - mtk: - use rx_callback instead of cmdq_task_cb - qcom: - add syscon const - add SM6375 compatible - imx: - enable RST channel - clear pending irqs * tag 'mailbox-v5.20' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: imx: clear pending interrupts dt-bindings: mailbox: qcom-ipcc: Add SM6375 compatible mailbox: imx: support RST channel dt-bindings: mailbox: imx-mu: add RST channel dt-bindings: mailbox: qcom,apcs-kpss-global: Add syscon const for relevant entries mailbox: mtk-cmdq: Remove proprietary cmdq_task_cb commit e5a95c83ed1492c0f442b448b20c90c8faaf702b Author: Chris Wilson Date: Wed Jul 27 14:29:54 2022 +0200 drm/i915/gt: Skip TLB invalidations once wedged Skip all further TLB invalidations once the device is wedged and had been reset, as, on such cases, it can no longer process instructions on the GPU and the user no longer has access to the TLB's in each engine. So, an attempt to do a TLB cache invalidation will produce a timeout. That helps to reduce the performance regression introduced by TLB invalidate logic. Cc: stable@vger.kernel.org Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") Signed-off-by: Chris Wilson Cc: Fei Yang Cc: Tvrtko Ursulin Reviewed-by: Andi Shyti Acked-by: Thomas Hellström Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/5aa86564b9ec5fe7fe605c1dd7de76855401ed73.1658924372.git.mchehab@kernel.org (cherry picked from commit be0366f168033374a93e4c43fdaa1a90ab905184) Signed-off-by: Rodrigo Vivi commit 180abeb2c5032704787151135b6a38c6b71295a6 Author: Chris Wilson Date: Wed Jul 27 14:29:53 2022 +0200 drm/i915/gt: Invalidate TLB of the OA unit at TLB invalidations Ensure that the TLB of the OA unit is also invalidated on gen12 HW, as just invalidating the TLB of an engine is not enough. Cc: stable@vger.kernel.org Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") Signed-off-by: Chris Wilson Cc: Fei Yang Reviewed-by: Andi Shyti Acked-by: Tvrtko Ursulin Acked-by: Thomas Hellström Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/59724d9f5cf1e93b1620d01b8332ac991555283d.1658924372.git.mchehab@kernel.org (cherry picked from commit dfc83de118ff7930acc9a4c8dfdba7c153aa44d6) Signed-off-by: Rodrigo Vivi commit db100e28fdf026a1fc10657c5170bb1e65663805 Author: Chris Wilson Date: Wed Jul 27 14:29:51 2022 +0200 drm/i915/gt: Ignore TLB invalidations on idle engines Check if the device is powered down prior to any engine activity, as, on such cases, all the TLBs were already invalidated, so an explicit TLB invalidation is not needed, thus reducing the performance regression impact due to it. This becomes more significant with GuC, as it can only do so when the connection to the GuC is awake. Cc: stable@vger.kernel.org Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") Signed-off-by: Chris Wilson Cc: Fei Yang Reviewed-by: Andi Shyti Acked-by: Thomas Hellström Acked-by: Tvrtko Ursulin Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/278a57a672edac75683f0818b292e95da583a5fe.1658924372.git.mchehab@kernel.org (cherry picked from commit 4bedceaed1ae1172cfe72d3ff752b3a1d32fe4d9) Signed-off-by: Rodrigo Vivi commit 232d150fa15606e96c0e01e5c7a2d4e03f621787 Author: Matthew Auld Date: Wed Jul 27 17:43:46 2022 +0100 drm/i915/ttm: don't leak the ccs state The kernel only manages the ccs state with lmem-only objects, however the kernel should still take care not to leak the CCS state from the previous user. Fixes: 48760ffe923a ("drm/i915/gt: Clear compress metadata for Flat-ccs objects") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Ramalingam C Reviewed-by: Ramalingam C Link: https://patchwork.freedesktop.org/patch/msgid/20220727164346.282407-1-matthew.auld@intel.com (cherry picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec) Signed-off-by: Rodrigo Vivi commit 9cae5b3189eb9cd12a9c3f6e8afda2d81958640b Author: Nirmoy Das Date: Wed Jul 27 19:33:06 2022 +0200 drm/i915: disable pci resize on 32-bit machine PCI bar resize only works with 64 bit BAR so disable this on 32-bit machine and resolve below compilation error: drivers/gpu/drm/i915/gt/intel_region_lmem.c:94:23: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] root_res->start > 0x100000000ull) Fixes: a91d1a17cd341 ("drm/i915: Add support for LMEM PCIe resizable bar") Reported-by: Linux Kernel Functional Testing Tested-by: Linux Kernel Functional Testing Acked-by: Matthew Auld Signed-off-by: Nirmoy Das Reviewed-by: Andi Shyti Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220727173306.16247-1-nirmoy.das@intel.com (cherry picked from commit f5dfbfc0ae00c2c2c0518da9e1f9a8cca50ae544) Signed-off-by: Rodrigo Vivi commit e6cfcdda8cbe81eaf821c897369a65fec987b404 Author: Kim Phillips Date: Mon Aug 8 09:32:33 2022 -0500 x86/bugs: Enable STIBP for IBPB mitigated RETBleed AMD's "Technical Guidance for Mitigating Branch Type Confusion, Rev. 1.0 2022-07-12" whitepaper, under section 6.1.2 "IBPB On Privileged Mode Entry / SMT Safety" says: Similar to the Jmp2Ret mitigation, if the code on the sibling thread cannot be trusted, software should set STIBP to 1 or disable SMT to ensure SMT safety when using this mitigation. So, like already being done for retbleed=unret, and now also for retbleed=ibpb, force STIBP on machines that have it, and report its SMT vulnerability status accordingly. [ bp: Remove the "we" and remove "[AMD]" applicability parameter which doesn't work here. ] Fixes: 3ebc17006888 ("x86/bugs: Add retbleed=ibpb") Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov Cc: stable@vger.kernel.org # 5.10, 5.15, 5.19 Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 Link: https://lore.kernel.org/r/20220804192201.439596-1-kim.phillips@amd.com commit df7a456e7d1d7511b2c373dc1099cecfea093858 Merge: cab9de71694de d180e0a1be6ce Author: Linus Torvalds Date: Mon Aug 8 10:05:19 2022 -0700 Merge tag 'hyperv-next-signed-20220807' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: "A few miscellaneous patches. There is no large patch series for this merge window" * tag 'hyperv-next-signed-20220807' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: Create debugfs file with hyper-v balloon usage information drm/hyperv : Removing the restruction of VRAM allocation with PCI bar size PCI: hv: Take a const cpumask in hv_compose_msi_req_get_cpu() Drivers: hv: vm_bus: Handle vmbus rescind calls after vmbus is suspended commit cab9de71694de738323e30c2d1a1eb51a03f6265 Merge: 4e23eeebb2e57 f01701cec8cbb Author: Linus Torvalds Date: Mon Aug 8 09:42:04 2022 -0700 Merge tag 'coccinelle-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccinelle semantic patch updates from Julia Lawall: - Update the semantic patches in the kernel that contain a URL for Coccinelle with a URL that is currently valid (from myself). - Add a semantic patch checking for unnecessary NULL tests on dev_{put, hold} functions (from Ziyang Xuan, followed bt a modification from myself). - Drop a semantic patch that replaces 0/1 by booleans, as this change was considered to be not worthwhile by some maintainers (from Steve Rostedt). - Extend an existing semantic patch with more checks for useless tests on variables addresses (from Jérémy Lefaure). * tag 'coccinelle-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: update Coccinelle URL coccinelle: free: add version constraint scripts/coccinelle/free: add NULL test before dev_{put, hold} functions coccinelle: Remove script that checks replacing 0/1 with false/true in functions returning bool coccinelle: Extend address test from ifaddr semantic patch to test expressions commit 374a723c7448bbea22846884ba336ed83b085aab Author: Fanjun Kong Date: Mon May 16 17:07:53 2022 +0800 kernel/sysctl.c: Remove trailing white space This patch removes the trailing white space in kernel/sysysctl.c Signed-off-by: Fanjun Kong Reviewed-by: Muchun Song [mcgrof: fix commit message subject] Signed-off-by: Luis Chamberlain commit 5bfd5d3e2ec883a3db3414a42d94d23961a790ed Author: Fanjun Kong Date: Sun May 22 13:29:33 2022 +0800 kernel/sysctl.c: Clean up indentation, replace spaces with tab. This patch fixes two coding style issues: 1. Clean up indentation, replace spaces with tab 2. Add space after ',' Signed-off-by: Fanjun Kong Signed-off-by: Luis Chamberlain commit 7251ceb51af972603552fcea2db316ed2b9d95ba Author: Geert Uytterhoeven Date: Tue May 17 17:07:31 2022 +0200 sysctl: Merge adjacent CONFIG_TREE_RCU blocks There are two adjacent sysctl entries protected by the same CONFIG_TREE_RCU config symbol. Merge them into a single block to improve readability. Use the more common "#ifdef" form while at it. Signed-off-by: Geert Uytterhoeven Reviewed-by: Paul E. McKenney Signed-off-by: Luis Chamberlain commit 8447d0e75099eb54eea9306c2d43ecfc956d09ed Author: Manivannan Sadhasivam Date: Mon Aug 1 11:09:39 2022 +0530 remoteproc: qcom_q6v5_pas: Do not fail if regulators are not found devm_regulator_get_optional() API will return -ENODEV if the regulator was not found. For the optional supplies CX, PX we should not fail in that case but rather continue. So let's catch that error and continue silently if those regulators are not found. The commit 3f52d118f992 ("remoteproc: qcom_q6v5_pas: Deal silently with optional px and cx regulators") was supposed to do the same but it missed the fact that devm_regulator_get_optional() API returns -ENODEV when the regulator was not found. Cc: Abel Vesa Fixes: 3f52d118f992 ("remoteproc: qcom_q6v5_pas: Deal silently with optional px and cx regulators") Reported-by: Steev Klimaszewski Reviewed-by: Abel Vesa Reviewed-by: Johan Hovold Tested-by: Steev Klimaszewski Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220801053939.12556-1-manivannan.sadhasivam@linaro.org commit 19f68ed6dc90c93daf7e54d3350ea67fead7cbbf Author: Aijun Sun Date: Thu Aug 4 10:54:42 2022 +0800 bpf, arm64: Allocate program buffer using kvcalloc instead of kcalloc It is not necessary to allocate contiguous physical memory for BPF program buffer using kcalloc. When the BPF program is large more than memory page size, kcalloc allocates multiple memory pages from buddy system. If the device can not provide sufficient memory, for example in low-end android devices [0], memory allocation for BPF program is likely to fail. Test cases in lib/test_bpf.c all pass on ARM64 QEMU. [0] AndroidTestSuit: page allocation failure: order:4, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=foreground,mems_allowed=0 Call trace: dump_stack+0xa4/0x114 warn_alloc+0xf8/0x14c __alloc_pages_slowpath+0xac8/0xb14 __alloc_pages_nodemask+0x194/0x3d0 kmalloc_order_trace+0x44/0x1e8 __kmalloc+0x29c/0x66c bpf_int_jit_compile+0x17c/0x568 bpf_prog_select_runtime+0x4c/0x1b0 bpf_prepare_filter+0x5fc/0x6bc bpf_prog_create_from_user+0x118/0x1c0 seccomp_set_mode_filter+0x1c4/0x7cc __do_sys_prctl+0x380/0x1424 __arm64_sys_prctl+0x20/0x2c el0_svc_common+0xc8/0x22c el0_svc_handler+0x1c/0x28 el0_svc+0x8/0x100 Signed-off-by: Aijun Sun Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220804025442.22524-1-aijun.sun@unisoc.com commit ffd5cfca5388e9d7c8386343763df41315ac1dd2 Author: Stanislav Fomichev Date: Thu Aug 4 13:11:40 2022 -0700 selftests/bpf: Excercise bpf_obj_get_info_by_fd for bpf2bpf Apparently, no existing selftest covers it. Add a new one where we load cgroup/bind4 program and attach fentry to it. Calling bpf_obj_get_info_by_fd on the fentry program should return non-zero btf_id/btf_obj_id instead of crashing the kernel. Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20220804201140.1340684-2-sdf@google.com commit 6644aabbd8973a9f8008cabfd054a36b69a3a3f5 Author: Stanislav Fomichev Date: Thu Aug 4 13:11:39 2022 -0700 bpf: Use proper target btf when exporting attach_btf_obj_id When attaching to program, the program itself might not be attached to anything (and, hence, might not have attach_btf), so we can't unconditionally use 'prog->aux->dst_prog->aux->attach_btf'. Instead, use bpf_prog_get_target_btf to pick proper target BTF: * when attached to dst_prog, use dst_prog->aux->btf * when attached to kernel btf, use prog->aux->attach_btf Fixes: b79c9fc9551b ("bpf: implement BPF_PROG_QUERY for BPF_LSM_CGROUP") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Acked-by: Hao Luo Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20220804201140.1340684-1-sdf@google.com commit f1d41f7720c89705c20e4335a807b1c518c2e7be Author: Jiri Olsa Date: Tue Aug 2 18:33:24 2022 +0200 mptcp, btf: Add struct mptcp_sock definition when CONFIG_MPTCP is disabled The btf_sock_ids array needs struct mptcp_sock BTF ID for the bpf_skc_to_mptcp_sock helper. When CONFIG_MPTCP is disabled, the 'struct mptcp_sock' is not defined and resolve_btfids will complain with: [...] BTFIDS vmlinux WARN: resolve_btfids: unresolved symbol mptcp_sock [...] Add an empty definition for struct mptcp_sock when CONFIG_MPTCP is disabled. Fixes: 3bc253c2e652 ("bpf: Add bpf_skc_to_mptcp_sock_proto") Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Reviewed-by: Mat Martineau Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20220802163324.1873044-1-jolsa@kernel.org commit fda7409a8fcfa457814f8186f2861a9f00008e75 Author: Huacai Chen Date: Mon Aug 8 17:32:05 2022 +0800 irqchip/loongson-pch-pic: Move find_pch_pic() into CONFIG_ACPI MIPS doesn't declare find_pch_pic(), which makes a build warning: >> drivers/irqchip/irq-loongson-pch-pic.c:51:5: warning: no previous prototype for function 'find_pch_pic' [-Wmissing-prototypes] int find_pch_pic(u32 gsi) ^ drivers/irqchip/irq-loongson-pch-pic.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit int find_pch_pic(u32 gsi) ^ static 1 warning generated. Move find_pch_pic() into CONFIG_ACPI which only used by LoongArch to fix the warning. BTW, remove the duplicated declaration of find_pch_pic() in irq.h. Reported-by: kernel test robot Signed-off-by: Huacai Chen Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220808093205.3658485-1-chenhuacai@loongson.cn commit f574f7f839fc1753467b52417591cf2668825a92 Author: Gao Feng Date: Thu Aug 4 23:04:21 2022 +0800 net: bpf: Use the protocol's set_rcvlowat behavior if there is one The commit d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") add one new (struct proto_ops)->set_rcvlowat method so that a protocol can override the default setsockopt(SO_RCVLOWAT) behavior. The prior bpf codes don't check and invoke the protos's set_rcvlowat, now correct it. Signed-off-by: Gao Feng Signed-off-by: David S. Miller commit 7a542bee27c6a57e45c33cbbdc963325fd6493af Author: Xuan Zhuo Date: Thu Aug 4 14:32:48 2022 +0800 virtio_net: fix memory leak inside XPD_TX with mergeable When we call xdp_convert_buff_to_frame() to get xdpf, if it returns NULL, we should check if xdp_page was allocated by xdp_linearize_page(). If it is newly allocated, it should be freed here alone. Just like any other "goto err_xdp". Fixes: 44fa2dbd4759 ("xdp: transition into using xdp_frame for ndo_xdp_xmit") Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Signed-off-by: David S. Miller commit f83bb2592482fe94c6eea07a8121763c80f36ce5 Author: Meng Tang Date: Mon Aug 8 15:34:06 2022 +0800 ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model There is another LENOVO 20149 (Type1Sku0) Notebook model with CX20590, the device PCI SSID is 17aa:3977, which headphones are not responding, that requires the quirk CXT_PINCFG_LENOVO_NOTEBOOK. Add the corresponding entry to the quirk table. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220808073406.19460-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit f01272ee3856e62e8a0f8211e8edf1876a6f5e38 Author: Kalle Valo Date: Mon Aug 1 14:04:40 2022 +0300 wifi: wilc1000: fix spurious inline in wilc_handle_disconnect() Sparse warns: drivers/net/wireless/microchip/wilc1000/hif.h:218:35: error: marked inline, but without a definition Remove the inline, it's not needed. Reported-by: Jakub Kicinski Signed-off-by: Kalle Valo Acked-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220801110440.13144-1-kvalo@kernel.org commit baa56dfe2cdad12edb2625b2d454e205943c3402 Author: Veerendranath Jakkam Date: Fri Aug 5 19:22:59 2022 +0530 wifi: cfg80211: Fix validating BSS pointers in __cfg80211_connect_result Driver's SME is allowed to fill either BSSID or BSS pointers in struct cfg80211_connect_resp_params when indicating connect response but a check in __cfg80211_connect_result() is giving unnecessary warning when driver's SME fills only BSSID pointer and not BSS pointer in struct cfg80211_connect_resp_params. In case of mac80211 with auth/assoc path, it is always expected to fill BSS pointers in struct cfg80211_connect_resp_params when calling __cfg80211_connect_result() since cfg80211 must have hold BSS pointers in cfg80211_mlme_assoc(). So, skip the check for the drivers which support cfg80211 connect callback, for example with brcmfmac is one such driver which had the warning: WARNING: CPU: 5 PID: 514 at net/wireless/sme.c:786 __cfg80211_connect_result+0x2fc/0x5c0 [cfg80211] Reported-by: Linus Torvalds Fixes: efbabc116500 ("cfg80211: Indicate MLO connection info in connect and roam callbacks") Signed-off-by: Veerendranath Jakkam [kvalo@kernel.org: add more info to the commit log] Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220805135259.4126630-1-quic_vjakkam@quicinc.com commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 Author: Liang He Date: Tue Jul 26 09:07:22 2022 +0800 drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() In this function, there are two refcount leak bugs: (1) when breaking out of for_each_endpoint_of_node(), we need call the of_node_put() for the 'ep'; (2) we should call of_node_put() for the reference returned by of_graph_get_remote_port() when it is not used anymore. Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Signed-off-by: Liang He Acked-by: Martin Blumenstingl Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com commit 4e23eeebb2e57f5a28b36221aa776b5a1122dde5 Merge: 3bc1bc0b59d04 36d4b36b69590 Author: Linus Torvalds Date: Sun Aug 7 17:52:35 2022 -0700 Merge tag 'bitmap-6.0-rc1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - fix the duplicated comments on bitmap_to_arr64() (Qu Wenruo) - optimize out non-atomic bitops on compile-time constants (Alexander Lobakin) - cleanup bitmap-related headers (Yury Norov) - x86/olpc: fix 'logical not is only applied to the left hand side' (Alexander Lobakin) - lib/nodemask: inline wrappers around bitmap (Yury Norov) * tag 'bitmap-6.0-rc1' of https://github.com/norov/linux: (26 commits) lib/nodemask: inline next_node_in() and node_random() powerpc: drop dependency on in archrandom.h x86/olpc: fix 'logical not is only applied to the left hand side' lib/cpumask: move some one-line wrappers to header file headers/deps: mm: align MANITAINERS and Docs with new gfp.h structure headers/deps: mm: Split out of headers/deps: mm: Optimize header dependencies lib/cpumask: move trivial wrappers around find_bit to the header lib/cpumask: change return types to unsigned where appropriate cpumask: change return types to bool where appropriate lib/bitmap: change type of bitmap_weight to unsigned long lib/bitmap: change return types to bool where appropriate arm: align find_bit declarations with generic kernel iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) lib/test_bitmap: test the tail after bitmap_to_arr64() lib/bitmap: fix off-by-one in bitmap_to_arr64() lib: test_bitmap: add compile-time optimization/evaluations assertions bitmap: don't assume compiler evaluates small mem*() builtins calls net/ice: fix initializing the bitmap in the switch code bitops: let optimize out non-atomic bitops on compile-time constants ... commit f01701cec8cbb94df209e9705b97abd01c151ba1 Author: Julia Lawall Date: Sun Aug 7 18:19:54 2022 +0200 update Coccinelle URL Signed-off-by: Julia Lawall commit 18c06cf868bc4e37b9766a91be02453c38f89745 Author: Julia Lawall Date: Sat Jul 16 15:28:10 2022 +0200 coccinelle: free: add version constraint The various functions contain a NULL check starting in v5.15. Signed-off-by: Julia Lawall commit 3bc1bc0b59d04e997db25b84babf459ca1cd80b7 Merge: eb5699ba31558 0d168a58fca34 Author: Linus Torvalds Date: Sun Aug 7 10:50:59 2022 -0700 Merge tag '5.20-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: "Mostly cleanup, including smb1 refactoring: - multichannel perf improvement - move additional SMB1 code to not be compiled in when legacy support is disabled. - bug fixes, including one important one for memory leak - various cleanup patches We are still working on and testing some deferred close improvements including an important lease break fix for case when multiple deferred closes are still open, and also some additional perf improvements - those are not included here" * tag '5.20-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: alloc_mid function should be marked as static cifs: remove "cifs_" prefix from init/destroy mids functions cifs: remove useless DeleteMidQEntry() cifs: when insecure legacy is disabled shrink amount of SMB1 code cifs: trivial style fixup cifs: fix wrong unlock before return from cifs_tree_connect() cifs: avoid use of global locks for high contention data cifs: remove remaining build warnings cifs: list_for_each() -> list_for_each_entry() cifs: update MAINTAINERS file with reviewers smb2: small refactor in smb2_check_message() cifs: Fix memory leak when using fscache cifs: remove minor build warning cifs: remove some camelCase and also some static build warnings cifs: remove unnecessary (void*) conversions. cifs: remove unnecessary type castings cifs: remove redundant initialization to variable mnt_sign_enabled smb3: check xattr value length earlier commit eb5699ba31558bdb2cee6ebde3d0a68091e47dce Merge: b5a8466d37d30 b99695580bfc1 Author: Linus Torvalds Date: Sun Aug 7 10:03:24 2022 -0700 Merge tag 'mm-nonmm-stable-2022-08-06-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc updates from Andrew Morton: "Updates to various subsystems which I help look after. lib, ocfs2, fatfs, autofs, squashfs, procfs, etc. A relatively small amount of material this time" * tag 'mm-nonmm-stable-2022-08-06-2' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (72 commits) scripts/gdb: ensure the absolute path is generated on initial source MAINTAINERS: kunit: add David Gow as a maintainer of KUnit mailmap: add linux.dev alias for Brendan Higgins mailmap: update Kirill's email profile: setup_profiling_timer() is moslty not implemented ocfs2: fix a typo in a comment ocfs2: use the bitmap API to simplify code ocfs2: remove some useless functions lib/mpi: fix typo 'the the' in comment proc: add some (hopefully) insightful comments bdi: remove enum wb_congested_state kernel/hung_task: fix address space of proc_dohung_task_timeout_secs lib/lzo/lzo1x_compress.c: replace ternary operator with min() and min_t() squashfs: support reading fragments in readahead call squashfs: implement readahead squashfs: always build "file direct" version of page actor Revert "squashfs: provide backing_dev_info in order to disable read-ahead" fs/ocfs2: Fix spelling typo in comment ia64: old_rr4 added under CONFIG_HUGETLB_PAGE proc: fix test for "vsyscall=xonly" boot option ... commit b5a8466d37d30cfcc8015789f4a3f0c44b6c7bc6 Merge: 1612c382ffbdf 6ba592fa014f2 Author: Linus Torvalds Date: Sun Aug 7 09:53:58 2022 -0700 Merge tag 'for-5.20/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "The two major changes in this patchset corrects VGA modes, color handling and various other smaller fixes in the Atari framebuffer (by Geert Uytterhoeven), and devm_* conversion, platform data fixes and header cleanups in the imxfb driver (by Uwe Kleine-König). Other small patches clean up code in sa1100fb, cirrusfb and omapfb, fix a refcount leak in amba-clcd (by Liang He), and adds parameter checks to arkfb, i740fb, vt8623fb and s3fb (by Zheyu Ma)" * tag 'for-5.20/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (27 commits) video: fbdev: s3fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: i740fb: Check the argument of i740_calc_vclk() video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() video: fbdev: imxfb: fix return value check in imxfb_probe() video: fbdev: sis: fix typos in SiS_GetModeID() video: fbdev: imxfb: Convert request_mem_region + ioremap to devm_ioremap_resource video: fbdev: imxfb: Fold into only user video: fbdev: imxfb: Drop unused symbols from header video: fbdev: imxfb: Drop platform data support video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: omapfb: Unexport omap*_update_window_async() video: fbdev: atari: Remove backward bug-compatibility video: fbdev: atari: Remove unused definitions and variables video: fbdev: atari: Fix VGA modes video: fbdev: atari: Fix TT High video mode vertical refresh video: fbdev: atari: Remove unneeded casts to void * video: fbdev: atari: Remove unneeded casts from void * video: fbdev: atari: Fix ext_setcolreg() ... commit 1612c382ffbdf1f673caec76502b1c00e6d35363 Merge: cac03ac368fab de979c83574ab Author: Linus Torvalds Date: Sat Aug 6 17:45:37 2022 -0700 Merge tag 'x86-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - build fix for old(er) binutils - build fix for new GCC - kexec boot environment fix * tag 'x86-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y x86/numa: Use cpumask_available instead of hardcoded NULL check x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero commit cac03ac368fabff0122853de2422d4e17a32de08 Merge: 592d8362bc252 751d4cbc43879 Author: Linus Torvalds Date: Sat Aug 6 17:34:06 2022 -0700 Merge tag 'sched-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Various fixes: a deadline scheduler fix, a migration fix, a Sparse fix and a comment fix" * tag 'sched-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Do not requeue task on CPU excluded from cpus_mask sched/rt: Fix Sparse warnings due to undefined rt.c declarations exit: Fix typo in comment: s/sub-theads/sub-threads sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed commit 592d8362bc2526bbb08cf7d258661691e957b5ea Merge: 24cb958695724 99643bab36b64 Author: Linus Torvalds Date: Sat Aug 6 17:28:12 2022 -0700 Merge tag 'perf-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Misc fixes to kprobes and the faddr2line script, plus a cleanup" * tag 'perf-urgent-2022-08-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix ';;' typo scripts/faddr2line: Add CONFIG_DEBUG_INFO check scripts/faddr2line: Fix vmlinux detection on arm64 x86/kprobes: Update kcb status flag after singlestepping kprobes: Forbid probing on trampoline and BPF code areas commit 24cb958695724ffb4488ef4f65892c0767bcd2f2 Merge: d77771c926671 953503751a426 Author: Linus Torvalds Date: Sat Aug 6 17:05:21 2022 -0700 Merge tag 's390-5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Rework copy_oldmem_page() callback to take an iov_iter. This includes a few prerequisite updates and fixes to the oldmem reading code. - Rework cpufeature implementation to allow for various CPU feature indications, which is not only limited to hardware capabilities, but also allows CPU facilities. - Use the cpufeature rework to autoload Ultravisor module when CPU facility 158 is available. - Add ELF note type for encrypted CPU state of a protected virtual CPU. The zgetdump tool from s390-tools package will decrypt the CPU state using a Customer Communication Key and overwrite respective notes to make the data accessible for crash and other debugging tools. - Use vzalloc() instead of vmalloc() + memset() in ChaCha20 crypto test. - Fix incorrect recovery of kretprobe modified return address in stacktrace. - Switch the NMI handler to use generic irqentry_nmi_enter() and irqentry_nmi_exit() helper functions. - Rework the cryptographic Adjunct Processors (AP) pass-through design to support dynamic changes to the AP matrix of a running guest as well as to implement more of the AP architecture. - Minor boot code cleanups. - Grammar and typo fixes to hmcdrv and tape drivers. * tag 's390-5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (46 commits) Revert "s390/smp: enforce lowcore protection on CPU restart" Revert "s390/smp: rework absolute lowcore access" Revert "s390/smp,ptdump: add absolute lowcore markers" s390/unwind: fix fgraph return address recovery s390/nmi: use irqentry_nmi_enter()/irqentry_nmi_exit() s390: add ELF note type for encrypted CPU state of a PV VCPU s390/smp,ptdump: add absolute lowcore markers s390/smp: rework absolute lowcore access s390/setup: rearrange absolute lowcore initialization s390/boot: cleanup adjust_to_uv_max() function s390/smp: enforce lowcore protection on CPU restart s390/tape: fix comment typo s390/hmcdrv: fix Kconfig "its" grammar s390/docs: fix warnings for vfio_ap driver doc s390/docs: fix warnings for vfio_ap driver lock usage doc s390/crash: support multi-segment iterators s390/crash: use static swap buffer for copy_to_user_real() s390/crash: move copy_to_user_real() to crash_dump.c s390/zcore: fix race when reading from hardware system area s390/crash: fix incorrect number of bytes to copy to user space ... commit d77771c926671e0362af3fe792391be66072b242 Merge: cae4199f9319f 74de14fe05dd6 Author: Linus Torvalds Date: Sat Aug 6 16:47:19 2022 -0700 Merge tag 'mips_6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - added support for Netgear WNR3500L v2 - removed support for VR41xx SoC and platforms based on it - cleanups and fixes * tag 'mips_6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (25 commits) MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Revert "MIPS: octeon: Remove vestiges of CONFIG_CAVIUM_RESERVE32" MIPS: Introduce CAVIUM_RESERVE32 Kconfig option MIPS: msi-octeon: eliminate kernel-doc warnings MIPS: Fix comment typo MIPS: BMIPS: Utilize cfe_die() for invalid DTB MIPS: CFE: Add cfe_die() MIPS: Fixed __debug_virt_addr_valid() MIPS: BCM47XX: Add support for Netgear WNR3500L v2 MIPS: Remove VR41xx support MIPS: dts: align gpio-key node names with dtschema MIPS: dts: correct gpio-keys names and properties MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK MIPS: Make phys_to_virt utilize __va() MIPS: vdso: Utilize __pa() for gic_pfn MIPS: mm: Use the bitmap API to allocate bitmaps MIPS: math-emu: Use the bitmap API to allocate bitmaps MIPS: Loongson64: Fix section mismatch warning mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start MIPS: mscc: ocelot: enable FDMA usage ... commit cae4199f9319f42534ee2e2e4aadf183b9bb7f73 Merge: 4d1044fcb996e 4cfa6ff24a974 Author: Linus Torvalds Date: Sat Aug 6 16:38:17 2022 -0700 Merge tag 'powerpc-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Add support for syscall stack randomization - Add support for atomic operations to the 32 & 64-bit BPF JIT - Full support for KASAN on 64-bit Book3E - Add a watchdog driver for the new PowerVM hypervisor watchdog - Add a number of new selftests for the Power10 PMU support - Add a driver for the PowerVM Platform KeyStore - Increase the NMI watchdog timeout during live partition migration, to avoid timeouts due to increased memory access latency - Add support for using the 'linux,pci-domain' device tree property for PCI domain assignment - Many other small features and fixes Thanks to Alexey Kardashevskiy, Andy Shevchenko, Arnd Bergmann, Athira Rajeev, Bagas Sanjaya, Christophe Leroy, Erhard Furtner, Fabiano Rosas, Greg Kroah-Hartman, Greg Kurz, Haowen Bai, Hari Bathini, Jason A. Donenfeld, Jason Wang, Jiang Jian, Joel Stanley, Juerg Haefliger, Kajol Jain, Kees Cook, Laurent Dufour, Madhavan Srinivasan, Masahiro Yamada, Maxime Bizon, Miaoqian Lin, Murilo Opsfelder Araújo, Nathan Lynch, Naveen N. Rao, Nayna Jain, Nicholas Piggin, Ning Qiang, Pali Rohár, Petr Mladek, Rashmica Gupta, Sachin Sant, Scott Cheloha, Segher Boessenkool, Stephen Rothwell, Uwe Kleine-König, Wolfram Sang, Xiu Jianfeng, and Zhouyi Zhou. * tag 'powerpc-6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (191 commits) powerpc/64e: Fix kexec build error EDAC/ppc_4xx: Include required of_irq header directly powerpc/pci: Fix PHB numbering when using opal-phbid powerpc/64: Init jump labels before parse_early_param() selftests/powerpc: Avoid GCC 12 uninitialised variable warning powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/perf: Include caps feature for power10 DD1 version powerpc: add support for syscall stack randomization powerpc: Move system_call_exception() to syscall.c powerpc/powernv: rename remaining rng powernv_ functions to pnv_ powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 powerpc/powernv: Avoid crashing if rng is NULL selftests/powerpc: Fix matrix multiply assist test powerpc/signal: Update comment for clarity powerpc: make facility_unavailable_exception 64s powerpc/platforms/83xx/suspend: Remove write-only global variable powerpc/platforms/83xx/suspend: Prevent unloading the driver powerpc/platforms/83xx/suspend: Reorder to get rid of a forward declaration ... commit 4d1044fcb996e8de9b9ab392f4a767890e45202d Merge: ea0c39260d0c1 ba6cfef057e1c Author: Linus Torvalds Date: Sat Aug 6 15:04:48 2022 -0700 Merge tag 'riscv-for-linus-5.20-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Enabling the FPU is now a static_key - Improvements to the Svpbmt support - CPU topology bindings for a handful of systems - Support for systems with 64-bit hart IDs - Many settings have been enabled in the defconfig, including both support for the StarFive systems and many of the Docker requirements There are also a handful of cleanups and improvements, as usual. * tag 'riscv-for-linus-5.20-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits) riscv: enable Docker requirements in defconfig riscv: convert the t-head pbmt errata to use the __nops macro riscv: introduce nops and __nops macros for NOP sequences RISC-V: Add fast call path of crash_kexec() riscv: mmap with PROT_WRITE but no PROT_READ is invalid riscv/efi_stub: Add 64bit boot-hartid support on RV64 riscv: cpu: Add 64bit hartid support on RV64 riscv: smp: Add 64bit hartid support on RV64 riscv: spinwait: Fix hartid variable type riscv: cpu_ops_sbi: Add 64bit hartid support on RV64 riscv: dts: sifive: "fix" pmic watchdog node name riscv: dts: canaan: Add k210 topology information riscv: dts: sifive: Add fu740 topology information riscv: dts: sifive: Add fu540 topology information riscv: dts: starfive: Add JH7100 CPU topology RISC-V: Add CONFIG_{NON,}PORTABLE riscv: config: enable SOC_STARFIVE in defconfig riscv: dts: microchip: Add mpfs' topology information riscv: Kconfig.socs: Add comments riscv: Kconfig.erratas: Add comments ... commit ea0c39260d0c1d8e11d89c9d42ca48e172d1c868 Merge: c42b729ef6bfc aa7aeee169480 Author: Linus Torvalds Date: Sat Aug 6 14:48:54 2022 -0700 Merge tag '9p-for-5.20' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: - a couple of fixes - add a tracepoint for fid refcounting - some cleanup/followup on fid lookup - some cleanup around req refcounting * tag '9p-for-5.20' of https://github.com/martinetd/linux: net/9p: Initialize the iounit field during fid creation net: 9p: fix refcount leak in p9_read_work() error handling 9p: roll p9_tag_remove into p9_req_put 9p: Add client parameter to p9_req_put() 9p: Drop kref usage 9p: Fix some kernel-doc comments 9p fid refcount: cleanup p9_fid_put calls 9p fid refcount: add a 9p_fid_ref tracepoint 9p fid refcount: add p9_fid_get/put wrappers 9p: Fix minor typo in code comment 9p: Remove unnecessary variable for old fids while walking from d_parent 9p: Make the path walk logic more clear about when cloning is required 9p: Track the root fid with its own variable during lookups commit c42b729ef6bfc72fed56f81f589a39298b9d12c8 Merge: af3e9579ecfbe 446279168e030 Author: Linus Torvalds Date: Sat Aug 6 14:44:49 2022 -0700 Merge tag 'gfs2-v5.19-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Instantiate glocks ouside of the glock state engine, in the contect of the process taking the glock. This moves unnecessary complexity out of the core glock code. Clean up the instantiate logic to be more sensible. - In gfs2_glock_async_wait(), cancel pending locking request upon failure. Make sure all glocks are left in a consistent state. - Various other minor cleanups and fixes. * tag 'gfs2-v5.19-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: List traversal in do_promote is safe gfs2: do_promote glock holder stealing fix gfs2: Use better variable name gfs2: Make go_instantiate take a glock gfs2: Add new go_held glock operation gfs2: Revert 'Fix "truncate in progress" hang' gfs2: Instantiate glocks ouside of glock state engine gfs2: Fix up gfs2_glock_async_wait gfs2: Minor gfs2_glock_nq_m cleanup gfs2: Fix spelling mistake in comment gfs2: Rewrap overlong comment in do_promote gfs2: Remove redundant NULL check before kfree commit af3e9579ecfbe1796334bb25a2f0a6437983673a Author: Linus Torvalds Date: Sat Aug 6 13:24:56 2022 -0700 Revert "iommu/dma: Add config for PCI SAC address trick" This reverts commit 4bf7fda4dce22214c70c49960b1b6438e6260b67. It turns out that it was hopelessly naive to think that this would work, considering that we've always done this. The first machine I actually tested this on broke at bootup, getting to Reached target cryptsetup.target - Local Encrypted Volumes. and then hanging. It's unclear what actually fails, since there's a lot else going on around that time (eg amdgpu probing also happens around that same time, but it could be some other random init thing that didn't complete earlier and just caused the boot to hang at that point). The expectations that we should default to some unsafe and untested mode seems entirely unfounded, and the belief that this wouldn't affect modern systems is clearly entirely false. The machine in question is about two years old, so it's not exactly shiny, but it's also not some dusty old museum piece PDP-11 in a closet. Cc: Robin Murphy Cc: Christoph Hellwig Cc: John Garry Cc: Joerg Roedel Signed-off-by: Linus Torvalds commit c269fca7b37a08b7eec6f6b79a0abf1d0a245acb Author: John Johansen Date: Sat Aug 6 12:07:07 2022 -0700 apparmor: Update MAINTAINERS file with new email address Add the apparmor.net email address that the project is transitioning emails to. Signed-off-by: John Johansen commit 20cf903a0c407cef19300e5c85a03c82593bde36 Merge: c993e07be023a 12907efde6ad9 Author: Linus Torvalds Date: Sat Aug 6 11:09:55 2022 -0700 Merge tag 'for-6.0/dm-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull more device mapper updates from Mike Snitzer: - Add flags argument to dm_bufio_client_create and introduce DM_BUFIO_CLIENT_NO_SLEEP flag to have dm-bufio use spinlock rather than mutex for its locking. - Add optional "try_verify_in_tasklet" feature to DM verity target. This feature gives users the option to improve IO latency by using a tasklet to verify, using hashes in bufio's cache, rather than wait to schedule a work item via workqueue. But if there is a bufio cache miss, or an error, then the tasklet will fallback to using workqueue. - Incremental changes to both dm-bufio and the DM verity target to use jump_label to minimize cost of branching associated with the niche "try_verify_in_tasklet" feature. DM-bufio in particular is used by quite a few other DM targets so it doesn't make sense to incur additional bufio cost in those targets purely for the benefit of this niche verity feature if the feature isn't ever used. - Optimize verity_verify_io, which is used by both workqueue and tasklet based verification, if FEC is not configured or tasklet based verification isn't used. - Remove DM verity target's verify_wq's use of the WQ_CPU_INTENSIVE flag since it uses WQ_UNBOUND. Also, use the WQ_HIGHPRI flag if "try_verify_in_tasklet" is specified. * tag 'for-6.0/dm-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm verity: have verify_wq use WQ_HIGHPRI if "try_verify_in_tasklet" dm verity: remove WQ_CPU_INTENSIVE flag since using WQ_UNBOUND dm verity: only copy bvec_iter in verity_verify_io if in_tasklet dm verity: optimize verity_verify_io if FEC not configured dm verity: conditionally enable branching for "try_verify_in_tasklet" dm bufio: conditionally enable branching for DM_BUFIO_CLIENT_NO_SLEEP dm verity: allow optional args to alter primary args handling dm verity: Add optional "try_verify_in_tasklet" feature dm bufio: Add DM_BUFIO_CLIENT_NO_SLEEP flag dm bufio: Add flags argument to dm_bufio_client_create commit c993e07be023acdeec8e84e2e0743c52adb5fc94 Merge: 1d239c1eb873c 5c850d31880e0 Author: Linus Torvalds Date: Sat Aug 6 10:56:45 2022 -0700 Merge tag 'dma-mapping-5.20-2022-08-06' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - convert arm32 to the common dma-direct code (Arnd Bergmann, Robin Murphy, Christoph Hellwig) - restructure the PCIe peer to peer mapping support (Logan Gunthorpe) - allow the IOMMU code to communicate an optional DMA mapping length and use that in scsi and libata (John Garry) - split the global swiotlb lock (Tianyu Lan) - various fixes and cleanup (Chao Gao, Dan Carpenter, Dongli Zhang, Lukas Bulwahn, Robin Murphy) * tag 'dma-mapping-5.20-2022-08-06' of git://git.infradead.org/users/hch/dma-mapping: (45 commits) swiotlb: fix passing local variable to debugfs_create_ulong() dma-mapping: reformat comment to suppress htmldoc warning PCI/P2PDMA: Remove pci_p2pdma_[un]map_sg() RDMA/rw: drop pci_p2pdma_[un]map_sg() RDMA/core: introduce ib_dma_pci_p2p_dma_supported() nvme-pci: convert to using dma_map_sgtable() nvme-pci: check DMA ops when indicating support for PCI P2PDMA iommu/dma: support PCI P2PDMA pages in dma-iommu map_sg iommu: Explicitly skip bus address marked segments in __iommu_map_sg() dma-mapping: add flags to dma_map_ops to indicate PCI P2PDMA support dma-direct: support PCI P2PDMA pages in dma-direct map_sg dma-mapping: allow EREMOTEIO return code for P2PDMA transfers PCI/P2PDMA: Introduce helpers for dma_map_sg implementations PCI/P2PDMA: Attempt to set map_type if it has not been set lib/scatterlist: add flag for indicating P2PDMA segments in an SGL swiotlb: clean up some coding style and minor issues dma-mapping: update comment after dmabounce removal scsi: sd: Add a comment about limiting max_sectors to shost optimal limit ata: libata-scsi: cap ata_device->max_sectors according to shost->max_sectors scsi: scsi_transport_sas: cap shost opt_sectors according to DMA optimal limit ... commit 1d239c1eb873c7d6c6cbc80d68330c939fd86136 Merge: 75b9fcb530edc c10100a416c16 Author: Linus Torvalds Date: Sat Aug 6 10:42:38 2022 -0700 Merge tag 'iommu-updates-v5.20-or-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - The most intrusive patch is small and changes the default allocation policy for DMA addresses. Before the change the allocator tried its best to find an address in the first 4GB. But that lead to performance problems when that space gets exhaused, and since most devices are capable of 64-bit DMA these days, we changed it to search in the full DMA-mask range from the beginning. This change has the potential to uncover bugs elsewhere, in the kernel or the hardware. There is a Kconfig option and a command line option to restore the old behavior, but none of them is enabled by default. - Add Robin Murphy as reviewer of IOMMU code and maintainer for the dma-iommu and iova code - Chaning IOVA magazine size from 1032 to 1024 bytes to save memory - Some core code cleanups and dead-code removal - Support for ACPI IORT RMR node - Support for multiple PCI domains in the AMD-Vi driver - ARM SMMU changes from Will Deacon: - Add even more Qualcomm device-tree compatible strings - Support dumping of IMP DEF Qualcomm registers on TLB sync timeout - Fix reference count leak on device tree node in Qualcomm driver - Intel VT-d driver updates from Lu Baolu: - Make intel-iommu.h private - Optimize the use of two locks - Extend the driver to support large-scale platforms - Cleanup some dead code - MediaTek IOMMU refactoring and support for TTBR up to 35bit - Basic support for Exynos SysMMU v7 - VirtIO IOMMU driver gets a map/unmap_pages() implementation - Other smaller cleanups and fixes * tag 'iommu-updates-v5.20-or-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (116 commits) iommu/amd: Fix compile warning in init code iommu/amd: Add support for AVIC when SNP is enabled iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement ACPI/IORT: Fix build error implicit-function-declaration drivers: iommu: fix clang -wformat warning iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop iommu/arm-smmu-qcom: Add SM6375 SMMU compatible dt-bindings: arm-smmu: Add compatible for Qualcomm SM6375 MAINTAINERS: Add Robin Murphy as IOMMU SUBSYTEM reviewer iommu/amd: Do not support IOMMUv2 APIs when SNP is enabled iommu/amd: Do not support IOMMU_DOMAIN_IDENTITY after SNP is enabled iommu/amd: Set translation valid bit only when IO page tables are in use iommu/amd: Introduce function to check and enable SNP iommu/amd: Globally detect SNP support iommu/amd: Process all IVHDs before enabling IOMMU features iommu/amd: Introduce global variable for storing common EFR and EFR2 iommu/amd: Introduce Support for Extended Feature 2 Register iommu/amd: Change macro for IOMMU control register bit shift to decimal value iommu/exynos: Enable default VM instance on SysMMU v7 iommu/exynos: Add SysMMU v7 register set ... commit 75b9fcb530edc9731bd539353ec7ddb6c8366a25 Merge: 613b2a82f2e06 fe201f6fa4cf9 Author: Linus Torvalds Date: Sat Aug 6 10:33:34 2022 -0700 Merge tag 'backlight-next-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Core Framework: - Change maintainer email address Fix-ups: - Obtain OCP level from Device Tree; rt4831-backlight - DT fix-ups/conversions; richtek,rt4831-backlight - Remove unused code / functionatlity; platform_lcd - Switch to atomic PWM API; lp855x_bl * tag 'backlight-next-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: MAINTAINERS: Use Lee Jones' kernel.org address for Backlight submissions backlight: lp855x: Switch to atomic PWM API dt-bindings: backlight: Update Lee Jones' email address Revert "drivers/video/backlight/platform_lcd.c: add support for device tree based probe" backlight: rt4831: Apply ocp level from devicetree dt-bindings: backlight: rt4831: Add the new ocp level property commit 613b2a82f2e06fc5f75c2921e9908adfa7cb9024 Merge: 668c3c237f5dd ae4ccaed3a063 Author: Linus Torvalds Date: Sat Aug 6 10:25:16 2022 -0700 Merge tag 'mfd-next-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Framework: - Change maintainer email address - Use acpi_dev_for_each_child() helper to walk the ACPI list New Device Support: - BCM2711 RPiVid ASB in Broadcom BCM2835 - MT8195 dual-core RISC-V MCU in Chrome OS Embedded Controller - Regulator, RTC and Keys in MediaTek MT6357 PMIC - GPIO in X-Powers AXP20x PMIC - MT6331 and MT6332 in MediaTek MT6357 PMIC - Intel Meteor Lake-P PCI in Intel LPSS PCI New Functionality: - Add support for non-ACPI platforms; lpc_ich Fix-ups: - Use platform data instead of hard-coded values; bcm2835-pm - Make use of BIT/GENMASK macros; intel_soc_pmic_bxtwc - Use dev_err_probe() helper; intel_soc_pmic_chtwc, intel_soc_pmic_bxtwc - Use provided generic APIs / helpers; lpc_ich - Clean-up .remove() return values; asic3, t7l66xb, tc6387xb, tc6393xb - Use correct formatting specifiers; syscon - Replace sprintf() with sysfs_emit(); intel_soc_pmic_bxtwc - Automatically detect and fill USB endpoint pointers; dln2 - Use more appropriate dev/platform/spi resources APIs; intel_soc_pmic_bxtwc - Make use of pm_sleep_ptr(); intel_soc_pmic_chtwc, intel_soc_pmic_bxtwc - Improve error handling; intel_soc_pmic_bxtwc - Use core driver API to create groups; intel_soc_pmic_bxtwc - Kconfig fix-ups; MFD_SUN6I_PRCM - Admin: whitespace/email addresses/etc; max77714, db8500-prcmu, ipaq-micro, intel_soc_pmic_bxtwc - Remove duplicate/unused code/functionality; lpc_ich, twl-core, qcom-pm8008, intel_soc_pmic_bxtwc - DT fix-ups / conversions; da9063, ti,j721e-system-controller, st,stm32-timers, mt6397, qcom,tcsr, mps,mp2629, qcom-pm8xxx, fsl,imx8qxp-csr Bug Fixes: - Fix of_node reference leak; max77620" * tag 'mfd-next-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (49 commits) dt-bindings: mfd: stm32-timers: Move fixed string node names under 'properties' dt-bindings: mfd: st,stm32-timers: Correct 'resets' property name dt-bindings: mfd: syscon: Update Lee Jones' email address MAINTAINERS: Use Lee Jones' kernel.org address for Syscon submissions MAINTAINERS: Use Lee Jones' kernel.org address for MFD submissions mfd: sun6i-prcm: Update Kconfig description mfd: intel_soc_pmic_bxtwc: Fix spelling in the comment mfd: intel_soc_pmic_bxtwc: Drop unneeded casting mfd: intel_soc_pmic_bxtwc: Use sysfs_emit() instead of sprintf() mfd: intel_soc_pmic_bxtwc: Use bits.h macros for all masks mfd: intel_soc_pmic_bxtwc: Drop redundant ACPI_PTR() mfd: intel_soc_pmic_bxtwc: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr() etc mfd: intel_soc_pmic_bxtwc: Extend use of temporary variable for struct device mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() mfd: intel_soc_pmic_bxtwc: Convert to use platform_get/set_drvdata() mfd: intel_soc_pmic_bxtwc: Create sysfs attributes using core driver's facility mfd: intel_soc_pmic_bxtwc: Don't shadow error codes in show()/store() mfd: intel-lpss: Add Intel Meteor Lake-P PCI IDs mfd: mt6397: Add basic support for MT6331+MT6332 PMIC mfd: axp20x: Add AXP221/AXP223/AXP809 GPIO cells ... commit 668c3c237f5ddc2889879b08f26d2374231f3287 Merge: f20c95b46b8fa 24df5428ef9d1 Author: Linus Torvalds Date: Sat Aug 6 10:19:51 2022 -0700 Merge tag 'sound-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "As the diffstat shows, we've had lots of developments in a wide range at this time; the majority of changes are about ASoC, including subsystem-wide cleanups, continued SOF / Intel updates and a bunch of new drivers (as usual), while there have been some significant (but almost invisible) improvements in ALSA core side, too. Below are some highlights: Core: - Faster lookups of control elements with Xarray; normal user won't notice, but on the devices with tons of control elements, it can be visibly faster - Support for input validation for controls; this will harden for badly written drivers in general with a slight overhead - Deferred async signal handling for working around the potential deadlocks - Cleanup / refactoring raw MIDI locking code ASoC: - Restructing of the set_fmt() callbacks for making things clearer in situations like CODEC to CODEC links - Clean up and modernizing the DAI naming scheme setups - Merge of more of the Intel AVS driver stack, including some board integrations - New version 4 mechanism for communication with SOF DSPs - Suppoort for dynamically selecting the PLL to use at runtime on i.MX platforms - Improvements for CODEC to CODEC support in the generic cards - Support for AMD Jadeite and various machines, AMD RPL, Intel MetorLake DSPs, Mediatek MT8186 DSPs and MT6366, nVidia Tegra MDDRC, OPE and PEQ, NXP TFA9890, Qualcomm SDM845, WCD9335 and WAS883x, and Texas Instruments TAS2780 HD- and USB-audio: - Continued improvement for CS35L41 (sub)codec support - More quirks for various devices (HP, Lenovo, Dell, Clevo)" * tag 'sound-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (778 commits) ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx ALSA: line6: Replace sprintf() with sysfs_emit() ALSA: hda: Replace sprintf() with sysfs_emit() ALSA: pcm: Replace sprintf() with sysfs_emit() ALSA: core: Replace scnprintf() with sysfs_emit() ALSA: control-led: Replace sprintf() with sysfs_emit() ALSA: aoa: Replace sprintf() with sysfs_emit() ALSA: ac97: Replace sprintf() with sysfs_emit() ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for Lenovo Yoga9 14IAP7 ALSA: control: Use deferred fasync helper ALSA: pcm: Use deferred fasync helper ALSA: timer: Use deferred fasync helper ALSA: core: Add async signal helpers ASoC: q6asm: use kcalloc() instead of kzalloc() ACPI: scan: Add CLSA0101 Laptop Support ALSA: hda: cs35l41: Support CLSA0101 ALSA: hda: cs35l41: Use the CS35L41 HDA internal define ASoC: dt-bindings: use spi-peripheral-props.yaml ASoC: codecs: va-macro: use fsgen as clock ... commit f20c95b46b8fa3ad34b3ea2e134337f88591468b Merge: 48a577dc1b09c 863ed94c589fc Author: Linus Torvalds Date: Sat Aug 6 09:43:02 2022 -0700 Merge tag 'tpmdd-next-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "Mostly TPM and also few keyring fixes" * tag 'tpmdd-next-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Add check for Failure mode for TPM2 modules tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH tpm: fix platform_no_drv_owner.cocci warning KEYS: asymmetric: enforce SM2 signature use pkey algo pkcs7: support EC-RDSA/streebog in SignerInfo pkcs7: parser support SM2 and SM3 algorithms combination sign-file: Fix confusing error messages X.509: Support parsing certificate using SM2 algorithm tpm: Add tpm_tis_i2c backend for tpm_tis_core tpm: Add tpm_tis_verify_crc to the tpm_tis_phy_ops protocol layer dt-bindings: trivial-devices: Add Infineon SLB9673 TPM tpm: Add upgrade/reduced mode support for TPM1.2 modules commit 48a577dc1b09c1d35f2b8b37e7fa9a7169d50f5d Merge: 033a94412b606 bb8bc52e75785 Author: Linus Torvalds Date: Sat Aug 6 09:36:08 2022 -0700 Merge tag 'perf-tools-for-v6.0-2022-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools updates from Arnaldo Carvalho de Melo: - Introduce 'perf lock contention' subtool, using new lock contention tracepoints and using BPF for in kernel aggregation and then userspace processing using the perf tooling infrastructure for resolving symbols, target specification, etc. Since the new lock contention tracepoints don't provide lock names, get up to 8 stack traces and display the first non-lock function symbol name as a caller: $ perf lock report -F acquired,contended,avg_wait,wait_total Name acquired contended avg wait total wait update_blocked_a... 40 40 3.61 us 144.45 us kernfs_fop_open+... 5 5 3.64 us 18.18 us _nohz_idle_balance 3 3 2.65 us 7.95 us tick_do_update_j... 1 1 6.04 us 6.04 us ep_scan_ready_list 1 1 3.93 us 3.93 us Supports the usual 'perf record' + 'perf report' workflow as well as a BCC/bpftrace like mode where you start the tool and then press control+C to get results: $ sudo perf lock contention -b ^C contended total wait max wait avg wait type caller 42 192.67 us 13.64 us 4.59 us spinlock queue_work_on+0x20 23 85.54 us 10.28 us 3.72 us spinlock worker_thread+0x14a 6 13.92 us 6.51 us 2.32 us mutex kernfs_iop_permission+0x30 3 11.59 us 10.04 us 3.86 us mutex kernfs_dop_revalidate+0x3c 1 7.52 us 7.52 us 7.52 us spinlock kthread+0x115 1 7.24 us 7.24 us 7.24 us rwlock:W sys_epoll_wait+0x148 2 7.08 us 3.99 us 3.54 us spinlock delayed_work_timer_fn+0x1b 1 6.41 us 6.41 us 6.41 us spinlock idle_balance+0xa06 2 2.50 us 1.83 us 1.25 us mutex kernfs_iop_lookup+0x2f 1 1.71 us 1.71 us 1.71 us mutex kernfs_iop_getattr+0x2c ... - Add new 'perf kwork' tool to trace time properties of kernel work (such as softirq, and workqueue), uses eBPF skeletons to collect info in kernel space, aggregating data that then gets processed by the userspace tool, e.g.: # perf kwork report Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | ---------------------------------------------------------------------------------------------------- nvme0q5:130 | 004 | 1.101 ms | 49 | 0.051 ms | 26035.056403 s | 26035.056455 s | amdgpu:162 | 002 | 0.176 ms | 9 | 0.046 ms | 26035.268020 s | 26035.268066 s | nvme0q24:149 | 023 | 0.161 ms | 55 | 0.009 ms | 26035.655280 s | 26035.655288 s | nvme0q20:145 | 019 | 0.090 ms | 33 | 0.014 ms | 26035.939018 s | 26035.939032 s | nvme0q31:156 | 030 | 0.075 ms | 21 | 0.010 ms | 26035.052237 s | 26035.052247 s | nvme0q8:133 | 007 | 0.062 ms | 12 | 0.021 ms | 26035.416840 s | 26035.416861 s | nvme0q6:131 | 005 | 0.054 ms | 22 | 0.010 ms | 26035.199919 s | 26035.199929 s | nvme0q19:144 | 018 | 0.052 ms | 14 | 0.010 ms | 26035.110615 s | 26035.110625 s | nvme0q7:132 | 006 | 0.049 ms | 13 | 0.007 ms | 26035.125180 s | 26035.125187 s | nvme0q18:143 | 017 | 0.033 ms | 14 | 0.007 ms | 26035.169698 s | 26035.169705 s | nvme0q17:142 | 016 | 0.013 ms | 1 | 0.013 ms | 26035.565147 s | 26035.565160 s | enp5s0-rx-0:164 | 006 | 0.004 ms | 4 | 0.002 ms | 26035.928882 s | 26035.928884 s | enp5s0-tx-0:166 | 008 | 0.003 ms | 3 | 0.002 ms | 26035.870923 s | 26035.870925 s | -------------------------------------------------------------------------------------------------------- See commit log messages for more examples with extra options to limit the events time window, etc. - Add support for new AMD IBS (Instruction Based Sampling) features: With the DataSrc extensions, the source of data can be decoded among: - Local L3 or other L1/L2 in CCX. - A peer cache in a near CCX. - Data returned from DRAM. - A peer cache in a far CCX. - DRAM address map with "long latency" bit set. - Data returned from MMIO/Config/PCI/APIC. - Extension Memory (S-Link, GenZ, etc - identified by the CS target and/or address map at DF's choice). - Peer Agent Memory. - Support hardware tracing with Intel PT on guest machines, combining the traces with the ones in the host machine. - Add a "-m" option to 'perf buildid-list' to show kernel and modules build-ids, to display all of the information needed to do external symbolization of kernel stack traces, such as those collected by bpf_get_stackid(). - Add arch TSC frequency information to perf.data file headers. - Handle changes in the binutils disassembler function signatures in perf, bpftool and bpf_jit_disasm (Acked by the bpftool maintainer). - Fix building the perf perl binding with the newest gcc in distros such as fedora rawhide, where some new warnings were breaking the build as perf uses -Werror. - Add 'perf test' entry for branch stack sampling. - Add ARM SPE system wide 'perf test' entry. - Add user space counter reading tests to 'perf test'. - Build with python3 by default, if available. - Add python converter script for the vendor JSON event files. - Update vendor JSON files for most Intel cores. - Add vendor JSON File for Intel meteorlake. - Add Arm Cortex-A78C and X1C JSON vendor event files. - Add workaround to symbol address reading from ELF files without phdr, falling back to the previoous equation. - Convert legacy map definition to BTF-defined in the perf BPF script test. - Rework prologue generation code to stop using libbpf deprecated APIs. - Add default hybrid events for 'perf stat' on x86. - Add topdown metrics in the default 'perf stat' on the hybrid machines (big/little cores). - Prefer sampled CPU when exporting JSON in 'perf data convert' - Fix ('perf stat CSV output linter') and ("Check branch stack sampling") 'perf test' entries on s390. * tag 'perf-tools-for-v6.0-2022-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (169 commits) perf stat: Refactor __run_perf_stat() common code perf lock: Print the number of lost entries for BPF perf lock: Add --map-nr-entries option perf lock: Introduce struct lock_contention perf scripting python: Do not build fail on deprecation warnings genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO perf build: Suppress openssl v3 deprecation warnings in libcrypto feature test perf parse-events: Break out tracepoint and printing perf parse-events: Don't #define YY_EXTRA_TYPE tools bpftool: Don't display disassembler-four-args feature test tools bpftool: Fix compilation error with new binutils tools bpf_jit_disasm: Don't display disassembler-four-args feature test tools bpf_jit_disasm: Fix compilation error with new binutils tools perf: Fix compilation error with new binutils tools include: add dis-asm-compat.h to handle version differences tools build: Don't display disassembler-four-args feature test tools build: Add feature test for init_disassemble_info API changes perf test: Add ARM SPE system wide test perf tools: Rework prologue generation code perf bpf: Convert legacy map definition to BTF-defined ... commit 033a94412b6065a21c2ede2f37867e747a84563f Merge: a9cf69d0e7f20 55eb9a6c8bf3e Author: Linus Torvalds Date: Sat Aug 6 09:19:42 2022 -0700 Merge tag 'livepatching-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek: - Make a selftest more reliable * tag 'livepatching-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: selftests/livepatch: better synchronize test_klp_callbacks_busy commit a9cf69d0e7f2051cca1c08ed9b34fe79da951ee9 Merge: 6614a3c3164a5 099fd2c202075 Author: Linus Torvalds Date: Sat Aug 6 08:59:35 2022 -0700 Merge tag 'vfio-v6.0-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Cleanup use of extern in function prototypes (Alex Williamson) - Simplify bus_type usage and convert to device IOMMU interfaces (Robin Murphy) - Check missed return value and fix comment typos (Bo Liu) - Split migration ops from device ops and fix races in mlx5 migration support (Yishai Hadas) - Fix missed return value check in noiommu support (Liam Ni) - Hardening to clear buffer pointer to avoid use-after-free (Schspa Shi) - Remove requirement that only the same mm can unmap a previously mapped range (Li Zhe) - Adjust semaphore release vs device open counter (Yi Liu) - Remove unused arg from SPAPR support code (Deming Wang) - Rework vfio-ccw driver to better fit new mdev framework (Eric Farman, Michael Kawano) - Replace DMA unmap notifier with callbacks (Jason Gunthorpe) - Clarify SPAPR support comment relative to iommu_ops (Alexey Kardashevskiy) - Revise page pinning API towards compatibility with future iommufd support (Nicolin Chen) - Resolve issues in vfio-ccw, including use of DMA unmap callback (Eric Farman) * tag 'vfio-v6.0-rc1' of https://github.com/awilliam/linux-vfio: (40 commits) vfio/pci: fix the wrong word vfio/ccw: Check return code from subchannel quiesce vfio/ccw: Remove FSM Close from remove handlers vfio/ccw: Add length to DMA_UNMAP checks vfio: Replace phys_pfn with pages for vfio_pin_pages() vfio/ccw: Add kmap_local_page() for memcpy vfio: Rename user_iova of vfio_dma_rw() vfio/ccw: Change pa_pfn list to pa_iova list vfio/ap: Change saved_pfn to saved_iova vfio: Pass in starting IOVA to vfio_pin/unpin_pages API vfio/ccw: Only pass in contiguous pages vfio/ap: Pass in physical address of ind to ap_aqic() drm/i915/gvt: Replace roundup with DIV_ROUND_UP vfio: Make vfio_unpin_pages() return void vfio/spapr_tce: Fix the comment vfio: Replace the iommu notifier with a device list vfio: Replace the DMA unmapping notifier with a callback vfio/ccw: Move FSM open/close to MDEV open/close vfio/ccw: Refactor vfio_ccw_mdev_reset vfio/ccw: Create a CLOSE FSM event ... commit 221f9d9cdf429df8c3843b4291f4f412fde11543 Author: Jiri Slaby Date: Tue Jul 19 10:56:20 2022 +0200 posix-timers: Make do_clock_gettime() static do_clock_gettime() is used only in posix-stubs.c, so make it static. It avoids a compiler warning too: time/posix-stubs.c:73:5: warning: no previous prototype for ‘do_clock_gettime’ [-Wmissing-prototypes] Signed-off-by: Jiri Slaby Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220719085620.30567-1-jslaby@suse.cz commit 953503751a426413ea8aee2299ae3ee971b70d9b Author: Alexander Gordeev Date: Sat Aug 6 09:29:46 2022 +0200 Revert "s390/smp: enforce lowcore protection on CPU restart" This reverts commit 6f5c672d17f583b081e283927f5040f726c54598. This breaks normal crash dump when CPU0 is offline. Signed-off-by: Alexander Gordeev commit 5e441f61f509617a3f57fcb156b7aa2870cc8752 Author: Alexander Gordeev Date: Sat Aug 6 09:24:07 2022 +0200 Revert "s390/smp: rework absolute lowcore access" This reverts commit 7d06fed77b7d8fc9f6cc41b4e3f2823d32532ad8. This introduced vmem_mutex locking from vmem_map_4k_page() function called from smp_reinit_ipl_cpu() with interrupts disabled. While it is a pre-SMP early initcall no other CPUs running in parallel nor other code taking vmem_mutex on this boot stage - it still needs to be fixed. Signed-off-by: Alexander Gordeev commit 3fb39cb7c5145a10e1a0221c057e92fb8855efbb Author: Alexander Gordeev Date: Sat Aug 6 09:13:28 2022 +0200 Revert "s390/smp,ptdump: add absolute lowcore markers" This reverts commit e409b7f19172a3c154de62de4baf32a2c25a375a. Commit 7d06fed77b7d ("s390/smp: rework absolute lowcore access") introduced mutex lock with interrupts disabled. This commit is a follow-up that needs to be reverted as well. Signed-off-by: Alexander Gordeev commit ac0dbed9ba4c38ed9b5fd3a43ee4bc1f48901a34 Author: Nick Desaulniers Date: Tue Aug 2 09:12:03 2022 -0700 net: seg6: initialize induction variable to first valid array index Fixes the following warnings observed when building CONFIG_IPV6_SEG6_LWTUNNEL=y with clang: net/ipv6/seg6_local.o: warning: objtool: seg6_local_fill_encap() falls through to next function seg6_local_get_encap_size() net/ipv6/seg6_local.o: warning: objtool: seg6_local_cmp_encap() falls through to next function input_action_end() LLVM can fully unroll loops in seg6_local_get_encap_size() and seg6_local_cmp_encap(). One issue in those loops is that the induction variable is initialized to 0. The loop iterates over members of seg6_action_params, a global array of struct seg6_action_param calling their put() function pointer members. seg6_action_param uses an array initializer to initialize SEG6_LOCAL_SRH and later elements, which is the third enumeration of an anonymous union. The guard `if (attrs & SEG6_F_ATTR(i))` may prevent this from being called at runtime, but it would still be UB for `seg6_action_params[0]->put` to be called; the unrolled loop will make the initial iterations unreachable, which LLVM will later rotate to fallthrough to the next function. Make this more obvious that this cannot happen to the compiler by initializing the loop induction variable to the minimum valid index that seg6_action_params is initialized to. Reported-by: Thomas Gleixner Signed-off-by: Nick Desaulniers Link: https://lore.kernel.org/r/20220802161203.622293-1-ndesaulniers@google.com Signed-off-by: Jakub Kicinski commit bc3410f250219660a7be032c01c954a53b2c26ab Author: Florian Fainelli Date: Thu Aug 4 10:36:04 2022 -0700 net: bcmgenet: Indicate MAC is in charge of PHY PM Avoid the PHY library call unnecessarily into the suspend/resume functions by setting phydev->mac_managed_pm to true. The GENET driver essentially does exactly what mdio_bus_phy_resume() does by calling phy_init_hw() plus phy_resume(). Fixes: fba863b81604 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220804173605.1266574-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit 049d5d9890e9f4ba6d384ba5cfc5e8698be1ae9e Author: Jakub Kicinski Date: Thu Aug 4 11:26:41 2022 -0700 eth: fix the help in Wangxun's Kconfig The text was copy&pasted from Intel, adjust it to say Wangxun. Reported-by: Ingo Saitz Fixes: 3ce7547e5b71 ("net: txgbe: Add build support for txgbe") Link: https://lore.kernel.org/r/20220804182641.1442000-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit df1c941468fca014ad092f76672966bb412c2848 Author: Francois Romieu Date: Tue Aug 2 17:07:42 2022 +0200 net: avoid overflow when rose /proc displays timer information. rose /proc code does not serialize timer accesses. Initial report by Bernard F6BVP Pidoux exhibits overflow amounting to 116 ticks on its HZ=250 system. Full timer access serialization would imho be overkill as rose /proc does not enforce consistency between displayed ROSE_STATE_XYZ and timer values during changes of state. The patch may also fix similar behavior in ax25 /proc, ax25 ioctl and netrom /proc as they all exhibit the same timer serialization policy. This point has not been reported though. The sole remaining use of ax25_display_timer - ax25 rtt valuation - may also perform marginally better but I have not analyzed it too deeply. Cc: Thomas DL9SAU Osterried Link: https://lore.kernel.org/all/d5e93cc7-a91f-13d3-49a1-b50c11f0f811@free.fr/ Signed-off-by: Francois Romieu Tested-by: Bernard Pidoux Link: https://lore.kernel.org/r/Yuk9vq7t7VhmnOXu@electric-eye.fr.zoreil.com Signed-off-by: Jakub Kicinski commit 13c9f4dc102f2856e80b92486c41841e25e23772 Author: Naveen Mamindlapalli Date: Tue Aug 2 19:58:13 2022 +0530 octeontx2-pf: Fix NIX_AF_TL3_TL2X_LINKX_CFG register configuration For packets scheduled to RPM and LBK, NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] selects the TL3 or TL2 scheduling level as the one used for link/channel selection and backpressure. For each scheduling queue at the selected level: Setting NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG[ENA] = 1 allows the TL3/TL2 queue to schedule packets to a specified RPM or LBK link and channel. There is an issue in the code where NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] is set to TL3 where as the NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG is configured for TL2 queue in some cases. As a result packets will not transmit on that link/channel. This patch fixes the issue by configuring the NIX_AF_TL3_TL2(0..255)_LINK(0..12)_CFG register depending on the NIX_AF_PSE_CHANNEL_LEVEL[BP_LEVEL] value. Fixes: caa2da34fd25a ("octeontx2-pf: Initialize and config queues") Signed-off-by: Naveen Mamindlapalli Signed-off-by: Sunil Kovvuri Goutham Link: https://lore.kernel.org/r/20220802142813.25031-1-naveenm@marvell.com Signed-off-by: Jakub Kicinski commit 63e36289c4c6e9f4273cc780b1adab01aad6c222 Merge: 8a5dfc28af9ac c3c290276927a Author: Jakub Kicinski Date: Fri Aug 5 18:56:36 2022 -0700 Merge branch 'octeontx2-af-driver-fixes-for-npc' Subbaraya Sundeep says: ==================== Octeontx2 AF driver fixes for NPC This patchset includes AF driver fixes wrt packet parser NPC. Following are the changes: Patch 1: The parser nibble configuration must be same for TX and RX interfaces and if not fix up is applied. This fixup was applied only for default profile currently and it has been fixed to apply for all profiles. Patch 2: Firmware image may not be present all times in the kernel image and default profile is used mostly hence suppress the warning. Patch 3: This patch fixes a corner case where NIXLF is detached but without freeing its mcam entries which results in resource leak. Patch 4: SMAC is overlapped with DMAC mistakenly while installing rules based on SMAC. This patch fixes that. ==================== Link: https://lore.kernel.org/r/1659513255-28667-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit c3c290276927a3ae79342a4e17ec0500c138c63a Author: Subbaraya Sundeep Date: Wed Aug 3 13:24:15 2022 +0530 octeontx2-af: Fix key checking for source mac Given a field with its location/offset in input packet, the key checking logic verifies whether extracting the field can be supported or not based on the mkex profile loaded in hardware. This logic is wrong wrt source mac and this patch fixes that. Fixes: 9b179a960a96 ("octeontx2-af: Generate key field bit mask from KEX profile") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Jakub Kicinski commit 3f8fe40ab7730cf8eb6f8b8ff412012f7f6f8f48 Author: Subbaraya Sundeep Date: Wed Aug 3 13:24:14 2022 +0530 octeontx2-af: Fix mcam entry resource leak The teardown sequence in FLR handler returns if no NIX LF is attached to PF/VF because it indicates that graceful shutdown of resources already happened. But there is a chance of all allocated MCAM entries not being freed by PF/VF. Hence free mcam entries even in case of detached LF. Fixes: c554f9c1574e ("octeontx2-af: Teardown NPA, NIX LF upon receiving FLR") Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Jakub Kicinski commit cf2437626502b5271d19686b03dea306efe17ea0 Author: Harman Kalra Date: Wed Aug 3 13:24:13 2022 +0530 octeontx2-af: suppress external profile loading warning The packet parser profile supplied as firmware may not be present all the time and default profile is used mostly. Hence suppress firmware loading warning from kernel due to absence of firmware in kernel image. Fixes: 3a7244152f9c ("octeontx2-af: add support for custom KPU entries") Signed-off-by: Harman Kalra Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Jakub Kicinski commit dd1d1a8a6b29b6b472fd0d449b29eb806c411dd2 Author: Stanislaw Kardach Date: Wed Aug 3 13:24:12 2022 +0530 octeontx2-af: Apply tx nibble fixup always NPC_PARSE_NIBBLE for TX interface has to be equal to the RX one for some silicon revisions. Mistakenly this fixup was only applied to the default MKEX profile while it should also be applied to any loaded profile. Fixes: 1c1935c9945d ("octeontx2-af: Add NIX1 interfaces to NPC") Signed-off-by: Stanislaw Kardach Signed-off-by: Subbaraya Sundeep Signed-off-by: Sunil Goutham Signed-off-by: Jakub Kicinski commit 8a5dfc28af9acea379952df533d86bce4aa91a42 Author: Nick Child Date: Wed Aug 3 10:52:46 2022 -0500 MAINTAINERS: Update ibmveth maintainer Add Nick Child as the maintainer of the IBM Power Virtual Ethernet Device Driver, replacing Cristobal Forno. Signed-off-by: Nick Child Link: https://lore.kernel.org/r/20220803155246.39582-1-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit 07977a8a9e542888d39acc14a0738fd2fcdafbf0 Author: Yang Li Date: Thu Aug 4 08:37:22 2022 +0800 bnxt_en: Remove duplicated include bnxt_devlink.c bnxt_ethtool.h is included twice in bnxt_devlink.c, remove one of them. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=1817 Reported-by: Abaci Robot Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20220804003722.54088-1-yang.lee@linux.alibaba.com Signed-off-by: Jakub Kicinski commit f6ac85a1773832eb4959aa81f78ff8f9bcdfe9ec Merge: 2e64fe4624d19 b06ada6df9cf7 Author: Jakub Kicinski Date: Fri Aug 5 18:50:26 2022 -0700 Merge branch 'netfilter-followup-fixes-for-net' Florian Westphal says: ==================== netfilter followup fixes for net Regressions, since 5.19: Fix crash when packet tracing is enabled via 'meta nftrace set 1' rule. Also comes with a test case. Regressions, this cycle: Fix Kconfig dependency for the flowtable /proc interface, we want this to be off by default. ==================== Link: https://lore.kernel.org/r/20220804172629.29748-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit b06ada6df9cf785099c142d96cb8a337ff46adf7 Author: Pablo Neira Ayuso Date: Thu Aug 4 19:26:29 2022 +0200 netfilter: flowtable: fix incorrect Kconfig dependencies Remove default to 'y', this infrastructure is not fundamental for the flowtable operational. Add a missing dependency on CONFIG_NF_FLOW_TABLE. Reported-by: Linus Torvalds Fixes: b038177636f8 ("netfilter: nf_flow_table: count pending offload workqueue tasks") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Jakub Kicinski commit fe9e420defabd0f3b13239dd135d261fbeeb67ae Author: Florian Westphal Date: Thu Aug 4 19:26:28 2022 +0200 selftests: netfilter: add test case for nf trace infrastructure Enable/disable tracing infrastructure while packets are in-flight. This triggers KASAN splat after e34b9ed96ce3 ("netfilter: nf_tables: avoid skb access on nf_stolen"). While at it, reduce script run time as well. Signed-off-by: Florian Westphal Signed-off-by: Jakub Kicinski commit 399a14ec7993d605740de7b2cd5c0ce8407d12ed Author: Florian Westphal Date: Thu Aug 4 19:26:27 2022 +0200 netfilter: nf_tables: fix crash when nf_trace is enabled do not access info->pkt when info->trace is not 1. nft_traceinfo is not initialized, except when tracing is enabled. The 'nft_trace_enabled' static key cannot be used for this, we must always check info->trace first. Pass nft_pktinfo directly to avoid this. Fixes: e34b9ed96ce3 ("netfilter: nf_tables: avoid skb access on nf_stolen") Reported-by: Hangbin Liu Signed-off-by: Florian Westphal Signed-off-by: Jakub Kicinski commit d62113303d691bcd8d0675ae4ac63e7769afc56c Author: Chandan Babu R Date: Thu Aug 4 08:59:27 2022 -0700 xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork On a higly fragmented filesystem a Direct IO write can fail with -ENOSPC error even though the filesystem has sufficient number of free blocks. This occurs if the file offset range on which the write operation is being performed has a delalloc extent in the cow fork and this delalloc extent begins much before the Direct IO range. In such a scenario, xfs_reflink_allocate_cow() invokes xfs_bmapi_write() to allocate the blocks mapped by the delalloc extent. The extent thus allocated may not cover the beginning of file offset range on which the Direct IO write was issued. Hence xfs_reflink_allocate_cow() ends up returning -ENOSPC. The following script reliably recreates the bug described above. #!/usr/bin/bash device=/dev/loop0 shortdev=$(basename $device) mntpnt=/mnt/ file1=${mntpnt}/file1 file2=${mntpnt}/file2 fragmentedfile=${mntpnt}/fragmentedfile punchprog=/root/repos/xfstests-dev/src/punch-alternating errortag=/sys/fs/xfs/${shortdev}/errortag/bmap_alloc_minlen_extent umount $device > /dev/null 2>&1 echo "Create FS" mkfs.xfs -f -m reflink=1 $device > /dev/null 2>&1 if [[ $? != 0 ]]; then echo "mkfs failed." exit 1 fi echo "Mount FS" mount $device $mntpnt > /dev/null 2>&1 if [[ $? != 0 ]]; then echo "mount failed." exit 1 fi echo "Create source file" xfs_io -f -c "pwrite 0 32M" $file1 > /dev/null 2>&1 sync echo "Create Reflinked file" xfs_io -f -c "reflink $file1" $file2 &>/dev/null echo "Set cowextsize" xfs_io -c "cowextsize 16M" $file1 > /dev/null 2>&1 echo "Fragment FS" xfs_io -f -c "pwrite 0 64M" $fragmentedfile > /dev/null 2>&1 sync $punchprog $fragmentedfile echo "Allocate block sized extent from now onwards" echo -n 1 > $errortag echo "Create 16MiB delalloc extent in CoW fork" xfs_io -c "pwrite 0 4k" $file1 > /dev/null 2>&1 sync echo "Direct I/O write at offset 12k" xfs_io -d -c "pwrite 12k 8k" $file1 This commit fixes the bug by invoking xfs_bmapi_write() in a loop until disk blocks are allocated for atleast the starting file offset of the Direct IO write range. Fixes: 3c68d44a2b49 ("xfs: allocate direct I/O COW blocks in iomap_begin") Reported-and-Root-caused-by: Wengang Wang Signed-off-by: Chandan Babu R Reviewed-by: Darrick J. Wong [djwong: slight editing to make the locking less grody, and fix some style things] Signed-off-by: Darrick J. Wong commit f0c2d7d2abca24d19831c99edea458704fac8087 Author: Darrick J. Wong Date: Wed Aug 3 17:33:00 2022 -0700 xfs: fix intermittent hang during quotacheck Every now and then, I see the following hang during mount time quotacheck when running fstests. Turning on KASAN seems to make it happen somewhat more frequently. I've edited the backtrace for brevity. XFS (sdd): Quotacheck needed: Please wait. XFS: Assertion failed: bp->b_flags & _XBF_DELWRI_Q, file: fs/xfs/xfs_buf.c, line: 2411 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1831409 at fs/xfs/xfs_message.c:104 assfail+0x46/0x4a [xfs] CPU: 0 PID: 1831409 Comm: mount Tainted: G W 5.19.0-rc6-xfsx #rc6 09911566947b9f737b036b4af85e399e4b9aef64 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:assfail+0x46/0x4a [xfs] Code: a0 8f 41 a0 e8 45 fe ff ff 8a 1d 2c 36 10 00 80 fb 01 76 0f 0f b6 f3 48 c7 c7 c0 f0 4f a0 e8 10 f0 02 e1 80 e3 01 74 02 0f 0b <0f> 0b 5b c3 48 8d 45 10 48 89 e2 4c 89 e6 48 89 1c 24 48 89 44 24 RSP: 0018:ffffc900078c7b30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880099ac000 RCX: 000000007fffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa0418fa0 RBP: ffff8880197bc1c0 R08: 0000000000000000 R09: 000000000000000a R10: 000000000000000a R11: f000000000000000 R12: ffffc900078c7d20 R13: 00000000fffffff5 R14: ffffc900078c7d20 R15: 0000000000000000 FS: 00007f0449903800(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005610ada631f0 CR3: 0000000014dd8002 CR4: 00000000001706f0 Call Trace: xfs_buf_delwri_pushbuf+0x150/0x160 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_qm_flush_one+0xd6/0x130 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_qm_dquot_walk.isra.0+0x109/0x1e0 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_qm_quotacheck+0x319/0x490 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_qm_mount_quotas+0x65/0x2c0 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_mountfs+0x6b5/0xab0 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] xfs_fs_fill_super+0x781/0x990 [xfs 4561f5b32c9bfb874ec98d58d0719464e1f87368] get_tree_bdev+0x175/0x280 vfs_get_tree+0x1a/0x80 path_mount+0x6f5/0xaa0 __x64_sys_mount+0x103/0x140 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 I /think/ this can happen if xfs_qm_flush_one is racing with xfs_qm_dquot_isolate (i.e. dquot reclaim) when the second function has taken the dquot flush lock but xfs_qm_dqflush hasn't yet locked the dquot buffer, let alone queued it to the delwri list. In this case, flush_one will fail to get the dquot flush lock, but it can lock the incore buffer, but xfs_buf_delwri_pushbuf will then trip over this ASSERT, which checks that the buffer isn't on a delwri list. The hang results because the _delwri_submit_buffers ignores non DELWRI_Q buffers, which means that xfs_buf_iowait waits forever for an IO that has not yet been scheduled. AFAICT, a reasonable solution here is to detect a dquot buffer that is not on a DELWRI list, drop it, and return -EAGAIN to try the flush again. It's not /that/ big of a deal if quotacheck writes the dquot buffer repeatedly before we even set QUOTA_CHKD. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 7d839e325af221ff69d52e15c112cf09da91d149 Author: Darrick J. Wong Date: Thu Jul 28 13:35:31 2022 -0700 xfs: check return codes when flushing block devices If a blkdev_issue_flush fails, fsync needs to report that to upper levels. Modify xfs_file_fsync to capture the errors, while trying to flush as much data and log updates to disk as possible. If log writes cannot flush the data device, we need to shut down the log immediately because we've violated a log invariant. Modify this code to check the return value of blkdev_issue_flush as well. This behavior seems to go back to about 2.6.15 or so, which makes this fixes tag a bit misleading. Link: https://elixir.bootlin.com/linux/v2.6.15/source/fs/xfs/xfs_vnodeops.c#L1187 Fixes: b5071ada510a ("xfs: remove xfs_blkdev_issue_flush") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 6614a3c3164a5df2b54abb0b3559f51041cf705b Merge: 74cae210a335d 360614c01f81f Author: Linus Torvalds Date: Fri Aug 5 16:32:45 2022 -0700 Merge tag 'mm-stable-2022-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "Most of the MM queue. A few things are still pending. Liam's maple tree rework didn't make it. This has resulted in a few other minor patch series being held over for next time. Multi-gen LRU still isn't merged as we were waiting for mapletree to stabilize. The current plan is to merge MGLRU into -mm soon and to later reintroduce mapletree, with a view to hopefully getting both into 6.1-rc1. Summary: - The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe Lin, Yang Shi, Anshuman Khandual and Mike Rapoport - Some kmemleak fixes from Patrick Wang and Waiman Long - DAMON updates from SeongJae Park - memcg debug/visibility work from Roman Gushchin - vmalloc speedup from Uladzislau Rezki - more folio conversion work from Matthew Wilcox - enhancements for coherent device memory mapping from Alex Sierra - addition of shared pages tracking and CoW support for fsdax, from Shiyang Ruan - hugetlb optimizations from Mike Kravetz - Mel Gorman has contributed some pagealloc changes to improve latency and realtime behaviour. - mprotect soft-dirty checking has been improved by Peter Xu - Many other singleton patches all over the place" [ XFS merge from hell as per Darrick Wong in https://lore.kernel.org/all/YshKnxb4VwXycPO8@magnolia/ ] * tag 'mm-stable-2022-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (282 commits) tools/testing/selftests/vm/hmm-tests.c: fix build mm: Kconfig: fix typo mm: memory-failure: convert to pr_fmt() mm: use is_zone_movable_page() helper hugetlbfs: fix inaccurate comment in hugetlbfs_statfs() hugetlbfs: cleanup some comments in inode.c hugetlbfs: remove unneeded header file hugetlbfs: remove unneeded hugetlbfs_ops forward declaration hugetlbfs: use helper macro SZ_1{K,M} mm: cleanup is_highmem() mm/hmm: add a test for cross device private faults selftests: add soft-dirty into run_vmtests.sh selftests: soft-dirty: add test for mprotect mm/mprotect: fix soft-dirty check in can_change_pte_writable() mm: memcontrol: fix potential oom_lock recursion deadlock mm/gup.c: fix formatting in check_and_migrate_movable_page() xfs: fail dax mount if reflink is enabled on a partition mm/memcontrol.c: remove the redundant updating of stats_flush_threshold userfaultfd: don't fail on unrecognized features hugetlb_cgroup: fix wrong hugetlb cgroup numa stat ... commit 1cd8a2537eb07751d405ab7e2223f20338a90506 Author: Dan Williams Date: Fri Aug 5 15:12:27 2022 -0700 cxl/hdm: Fix skip allocations vs multiple pmem allocations Vishal notes that when attempting to define a second pmem region on a device the DPA allocation fails with a message of the form: decoder11.1: failed to reserve skipped space Recall that the skip setting is used when there is a pmem allocation in the presence of free ram DPA space. The first pmem allocation skips over the free ram and subsequent pmem allocations do not require a skip. The bug is that a skip is still attempted and the DPA reservation code flags the double skip allocation conflict. Fixes: cf880423b6a0 ("cxl/hdm: Add support for allocating DPA to an endpoint decoder") Reported-by: Vishal Verma Tested-by: Vishal Verma Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165973754730.1558392.15466392461645857658.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 4d8e4ea5bb396897111e8a740201bfd3c5926170 Author: Dan Williams Date: Fri Aug 5 13:27:51 2022 -0700 cxl/region: Disallow region granularity != window granularity The endpoint decode granularity must be <= the window granularity otherwise capacity in the endpoints is lost in the decode. Consider an attempt to have a region granularity of 512 with 4 devices within a window that maps 2 host bridges at a granularity of 256 bytes: HPA DPA Offset HB Port EP 0x0 0x0 0 0 0 0x100 0x0 1 0 2 0x200 0x100 0 0 0 0x300 0x100 1 0 2 0x400 0x200 0 1 1 0x500 0x200 1 1 3 0x600 0x300 0 1 1 0x700 0x300 1 1 3 0x800 0x400 0 0 0 0x900 0x400 1 0 2 0xA00 0x500 0 0 0 0xB00 0x500 1 0 2 Notice how endpoint0 maps HPA 0x0 and 0x200 correctly, but then at HPA 0x800 it results in DPA 0x200-0x400 on being skipped. Fix this by restricing the region granularity to be equal to the window granularity resulting in the following for a x4 region under a x2 window at a granularity of 256. HPA DPA Offset HB Port EP 0x0 0x0 0 0 0 0x100 0x0 1 0 2 0x200 0x0 0 1 1 0x300 0x0 1 1 3 0x400 0x100 0 0 0 0x500 0x100 1 0 2 0x600 0x100 0 1 1 0x700 0x100 1 1 3 Not that it ever made practical sense to support region granularity > window granularity. The window rotates host bridges causing endpoints to never see a consecutive stream of requests at the desired granularity without breaks to issue cycles to the other host bridge. Fixes: 80d10a6cee05 ("cxl/region: Add interleave geometry attributes") Cc: Jonathan Cameron Reviewed-by: Vishal Verma Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165973127171.1526540.9923273539049172976.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 298d44d04b2ba97824c3dadd1dbf7c154a2a86e2 Author: Dan Williams Date: Fri Aug 5 13:27:45 2022 -0700 cxl/region: Fix x1 interleave to greater than x1 interleave routing In cases where the decode fans out as it traverses downstream, the interleave granularity needs to increment to identify the port selector bits out of the remaining address bits. For example, recall that with an x2 parent port intereleave (IW == 1), the downstream decode for children of those ports will either see address bit IG+8 always set, or address bit IG+8 always clear. So if the child port needs to select a downstream port it can only use address bits starting at IG+9 (where IG and IW are the CXL encoded values for interleave granularity (ilog2(ig) - 8) and ways (ilog2(iw))). When the parent port interleave is x1 no such masking occurs and the child port can maintain the granularity that was routed to the parent port. Reported-by: Jonathan Cameron Reviewed-by: Vishal Verma Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165973126583.1526540.657948655360009242.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 910bc55da8285605308cb76f69a335b36780da43 Author: Dan Williams Date: Fri Aug 5 13:27:40 2022 -0700 cxl/region: Move HPA setup to cxl_region_attach() A recent bug fix added the setup of the endpoint decoder interleave geometry settings to cxl_region_attach(). Move the HPA setup there as well to keep all endpoint decoder parameter setting in a central location. For symmetry, move endpoint HPA teardown to cxl_region_detach(), and for switches move HPA setup / teardown to cxl_port_{setup,reset}_targets(). Cc: Jonathan Cameron Signed-off-by: Vishal Verma Reviewed-by: Ira Weiny Link: https://lore.kernel.org/r/165973126020.1526540.14701949254436069807.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 74cae210a335d159f2eb822e261adee905b6951a Merge: 79b7e67bb9747 7ec4cdb321738 Author: Linus Torvalds Date: Fri Aug 5 14:13:45 2022 -0700 Merge tag 'mtd/for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Richard Weinberger: "MTD core changes: - Dynamic partition support - Fix deadlock in sm_ftl - Various refcount fixes in maps, partitions and parser code - Integer overflow fixes in mtdchar - Support for Sercomm partitions NAND driver changes: - Clockrate fix for arasan - Add ATO25D1GA support - Double free fix for meson driver - Fix probe/remove methods in cafe NAND - Support unprotected spare data pages in qcom_nandc SPI NOR core changes: - move SECT_4K_PMC flag out of the core as it's a vendor specific flag - s/addr_width/addr_nbytes/g: address width means the number of IO lines used for the address, whereas in the code it is used as the number of address bytes. - do not change nor->addr_nbytes at SFDP parsing time. At the SFDP parsing time we should not change members of struct spi_nor, but instead fill members of struct spi_nor_flash_parameters which could later on be used by the callers. - track flash's internal address mode so that we can use 4B opcodes together with opcodes that don't have a 4B opcode correspondent. SPI NOR manufacturer drivers changes: - esmt: Rename "f25l32qa" flash name to "f25l32qa-2s". - micron-st: Skip FSR reading if SPI controller does not support it to allow flashes that support FSR to work even when attached to such SPI controllers. - spansion: Add s25hl-t/s25hs-t IDs and fixups" * tag 'mtd/for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (53 commits) mtd: core: check partition before dereference mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() mtd: spi-nor: spansion: Add s25hl-t/s25hs-t IDs and fixups mtd: spi-nor: spansion: Add local function to discover page size mtd: spi-nor: core: Track flash's internal address mode mtd: spi-nor: core: Return error code from set_4byte_addr_mode() mtd: spi-nor: Do not change nor->addr_nbytes at SFDP parsing time mtd: spi-nor: core: Shrink the storage size of the flash_info's addr_nbytes mtd: spi-nor: s/addr_width/addr_nbytes mtd: spi-nor: esmt: Use correct name of f25l32qa mtd: spi-nor: micron-st: Skip FSR reading if SPI controller does not support it MAINTAINERS: Use my kernel.org email mtd: rawnand: arasan: Fix clock rate in NV-DDR mtd: rawnand: arasan: Update NAND bus clock instead of system clock mtd: core: introduce of support for dynamic partitions dt-bindings: mtd: partitions: add additional example for qcom,smem-part dt-bindings: mtd: partitions: support label/name only partition mtd: spi-nor: move SECT_4K_PMC special handling mtd: dataflash: Add SPI ID table mtd: hyperbus: rpc-if: Fix RPM imbalance in probe error path ... commit 79b7e67bb9747e621ff1b646a125fbea26e08d56 Merge: 4d5398a3ec060 af3e16101cee9 Author: Linus Torvalds Date: Fri Aug 5 14:03:11 2022 -0700 Merge tag 'for-linus-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - KASAN support for x86_64 - noreboot command line option, just like qemu's -no-reboot - Various fixes and cleanups * tag 'for-linus-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: include sys/types.h for size_t um: Replace to_phys() and to_virt() with less generic function names um: Add missing apply_returns() um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups um: include linux/stddef.h for __always_inline UML: add support for KASAN under x86_64 mm: Add PAGE_ALIGN_DOWN macro um: random: Don't initialise hwrng struct with zero um: remove unused mm_copy_segments um: remove unused variable um: Remove straying parenthesis um: x86: print RIP with symbol arch: um: Fix build for statically linked UML w/ constructors x86/um: Kconfig: Fix indentation um/drivers: Kconfig: Fix indentation um: Kconfig: Fix indentation commit 4d5398a3ec060c1e3094097e52a19a4d0013c0e0 Merge: 9e2f40233670c 52e0ea900202d Author: Linus Torvalds Date: Fri Aug 5 13:59:38 2022 -0700 Merge tag 'for-linus' of github.com:openrisc/linux Pull OpenRISC updates from Stafford Horne: "In this cycle we add PCI support to OpenRISC used in our new QEMU virt platform. The main updates from me include: - Kconfig updates to support OpenRISC PCI (just config now after the PCI cleanups I did on Bjorn's branch) - A new defconfig for the qemu virt platform. - Also there is one MAINTAINERS update. As I was working on the PCI series we kept getting bounces from Richard's old email address. I added this here; I am not sure how these are usually handled when the maintainer doesn't queue it themselves" * tag 'for-linus' of github.com:openrisc/linux: openrisc: io: Define iounmap argument as volatile MAINTAINERS: Update Richard Henderson's address openrisc: Add virt defconfig openrisc: Add pci bus support commit 9e2f40233670c70c25e0681cb66d50d1e2742829 Merge: 3bd6e5854bf9b e0a5915f1cca2 Author: Linus Torvalds Date: Fri Aug 5 10:47:40 2022 -0700 Merge tag 'x86_sgx_for_v6.0-2022-08-03.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SGX updates from Dave Hansen: "A set of x86/sgx changes focused on implementing the "SGX2" features, plus a minor cleanup: - SGX2 ISA support which makes enclave memory management much more dynamic. For instance, enclaves can now change enclave page permissions on the fly. - Removal of an unused structure member" * tag 'x86_sgx_for_v6.0-2022-08-03.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (32 commits) x86/sgx: Drop 'page_index' from sgx_backing selftests/sgx: Page removal stress test selftests/sgx: Test reclaiming of untouched page selftests/sgx: Test invalid access to removed enclave page selftests/sgx: Test faulty enclave behavior selftests/sgx: Test complete changing of page type flow selftests/sgx: Introduce TCS initialization enclave operation selftests/sgx: Introduce dynamic entry point selftests/sgx: Test two different SGX2 EAUG flows selftests/sgx: Add test for TCS page permission changes selftests/sgx: Add test for EPCM permission changes Documentation/x86: Introduce enclave runtime management section x86/sgx: Free up EPC pages directly to support large page ranges x86/sgx: Support complete page removal x86/sgx: Support modifying SGX page type x86/sgx: Tighten accessible memory range after enclave initialization x86/sgx: Support adding of pages to an initialized enclave x86/sgx: Support restricting of enclave page permissions x86/sgx: Support VA page allocation without reclaiming x86/sgx: Export sgx_encl_page_alloc() ... commit 3bd6e5854bf9bb5436d6b533e206561839e3b284 Merge: fad235ed43387 6f05e014b96c8 Author: Linus Torvalds Date: Fri Aug 5 10:07:23 2022 -0700 Merge tag 'asm-generic-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "There are three independent sets of changes: - Sai Prakash Ranjan adds tracing support to the asm-generic version of the MMIO accessors, which is intended to help understand problems with device drivers and has been part of Qualcomm's vendor kernels for many years - A patch from Sebastian Siewior to rework the handling of IRQ stacks in softirqs across architectures, which is needed for enabling PREEMPT_RT - The last patch to remove the CONFIG_VIRT_TO_BUS option and some of the code behind that, after the last users of this old interface made it in through the netdev, scsi, media and staging trees" * tag 'asm-generic-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: uapi: asm-generic: fcntl: Fix typo 'the the' in comment arch/*/: remove CONFIG_VIRT_TO_BUS soc: qcom: geni: Disable MMIO tracing for GENI SE serial: qcom_geni_serial: Disable MMIO tracing for geni serial asm-generic/io: Add logging support for MMIO accessors KVM: arm64: Add a flag to disable MMIO trace for nVHE KVM lib: Add register read/write tracing support drm/meson: Fix overflow implicit truncation warnings irqchip/tegra: Fix overflow implicit truncation warnings coresight: etm4x: Use asm-generic IO memory barriers arm64: io: Use asm-generic high level MMIO accessors arch/*: Disable softirq stacks on PREEMPT_RT. commit fad235ed4338749a66ddf32971d4042b9ef47f44 Merge: 8db4a0291b09b 1630eee2d4e77 Author: Linus Torvalds Date: Fri Aug 5 10:02:33 2022 -0700 Merge tag 'arm-late-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more ARM SoC updates from Arnd Bergmann: "These updates came in after I had already tagged the branches, but they still seem appropriate for 6.0 and most of them were part of linux-next through other trees. - The reset controller tree adds one new driver for the TI TPS380x power management chip and a few minor changes in other drivers - Apple M1 now has a DT entry for the NVMe controller after the driver was merged, and has a new mailing list in the MAINTAINERS file. - Fixes for USB on the Socionext Uniphier platforms and the network controller on Intel Cyclone5" * tag 'arm-late-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: apple: t8103: Add ANS2 NVMe nodes reset: tps380x: Fix spelling mistake "Voltags" -> "Voltage" reset: tps380x: Add TPS380x device driver supprt dt-bindings: reset: Add TPS380x documentation dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G2UL USBPHY Control bindings ARM: dts: add EMAC AXI settings for Cyclone5 reset: reset-simple should depends on HAS_IOMEM Revert "reset: microchip-sparx5: allow building as a module" reset: a10sr: allow building under COMPILE_TEST reset: allow building of reset simple driver if expert config selected reset: microchip-sparx5: allow building as a module arm64: dts: apple: Re-parent ANS2 power domains MAINTAINERS: add ARM/APPLE MACHINE mailing list commit 8db4a0291b09be667ba72584e1aeb7aaf8b497bd Merge: 98586bd6dce36 e61b3125a4f03 Author: Linus Torvalds Date: Fri Aug 5 09:58:58 2022 -0700 Merge tag 'for-5.20/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "One real bugfix to change the io_pgetevents_time64() syscall to use the compat implementation when running in compat mode, otherwise the signed int32 parameters min_nr and nr will be incorrectly handled as unsigned int64 values. Other than that just small cleanups: - hardware database housekeeping and proper /proc/iomem output - add proper function exit code if probe functions fail - drop stale variables (pa_swapper_pg_lock) - drop unneccessary zero-initializations - typo fixes in comments" * tag 'for-5.20/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: Input: gscps2 - check return value of ioremap() in gscps2_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode parisc: Drop zero variable initialisations in mm/init.c parisc: Do not initialise statics to 0 parisc: Check the return value of ioremap() in lba_driver_probe() parisc: Drop pa_swapper_pg_lock spinlock parisc: Fix comment typo in fault.c parisc: Fix device names in /proc/iomem parisc: Clean up names in hardware database commit 98586bd6dce3690d8ae8d8561383d9ecc715e3c2 Merge: a1b02751d6ec2 5b7d1d575e3f1 Author: Linus Torvalds Date: Fri Aug 5 09:56:51 2022 -0700 Merge tag 'microblaze-v5.20' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze updates from Michal Simek: - Trivial comment fix - Remove HANDLE_DOMAIN_IRQ selection * tag 'microblaze-v5.20' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Fix some typos in comment arch: microblaze: Remove unused "select HANDLE_DOMAIN_IRQ" commit a1b02751d6ec21ec1b9c7c6826fc896ffde1c33d Merge: 965a9d75e3d25 96dd9a2f958be Author: Linus Torvalds Date: Fri Aug 5 09:54:36 2022 -0700 Merge tag 'printk-for-5.20-sane' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Allow reading kernel log in gdb even on 32 bits systems - More granular check of the buffer usage in printf selftest - Clang warning fix * tag 'printk-for-5.20-sane' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: lib/test_printf.c: fix clang -Wformat warnings scripts/gdb: fix 'lx-dmesg' on 32 bits arch lib/test_printf.c: split write-beyond-buffer check in two commit 6ba592fa014f21f35a8ee8da4ca7b95a018f13e8 Author: Zheyu Ma Date: Thu Aug 4 20:41:25 2022 +0800 video: fbdev: s3fb: Check the size of screen before memset_io() In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-present page [ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fb_set_par+0x1ec6/0x4040 [ 54.083806] fb_set_var+0x604/0xeb0 [ 54.083836] do_fb_ioctl+0x234/0x670 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: a268422de8bf ("fbdev driver for S3 Trio/Virge") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller commit 96b550971c65d54d64728d8ba973487878a06454 Author: Zheyu Ma Date: Thu Aug 4 20:41:24 2022 +0800 video: fbdev: arkfb: Check the size of screen before memset_io() In the function arkfb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 659.399066] BUG: unable to handle page fault for address: ffffc90003000000 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: error_code(0x0002) - not-present page [ 659.399094] RIP: 0010:memset_orig+0x33/0xb0 [ 659.399116] Call Trace: [ 659.399122] arkfb_set_par+0x143f/0x24c0 [ 659.399130] fb_set_var+0x604/0xeb0 [ 659.399161] do_fb_ioctl+0x234/0x670 [ 659.399189] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller commit ec0754c60217248fa77cc9005d66b2b55200ac06 Author: Zheyu Ma Date: Thu Aug 4 20:41:23 2022 +0800 video: fbdev: vt8623fb: Check the size of screen before memset_io() In the function vt8623fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 583.339036] BUG: unable to handle page fault for address: ffffc90005000000 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x0002) - not-present page [ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 [ 583.339110] Call Trace: [ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 [ 583.339146] fb_set_var+0x604/0xeb0 [ 583.339181] do_fb_ioctl+0x234/0x670 [ 583.339209] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: 558b7bd86c32 ("vt8623fb: new framebuffer driver for VIA VT8623") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller commit 62d468e5e10012e8b67d066ba7bac0a8afdc3cee Author: Jiri Olsa Date: Tue Aug 2 15:56:51 2022 +0200 bpf: Cleanup ftrace hash in bpf_trampoline_put We need to release possible hash from trampoline fops object before removing it, otherwise we leak it. Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)") Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20220802135651.1794015-1-jolsa@kernel.org commit 965a9d75e3d250088a269e0c903e86fe775b48c6 Merge: 29b1d469f3f68 f1a15b977ff86 Author: Linus Torvalds Date: Fri Aug 5 09:41:12 2022 -0700 Merge tag 'trace-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: - Runtime verification infrastructure This is the biggest change here. It introduces the runtime verification that is necessary for running Linux on safety critical systems. It allows for deterministic automata models to be inserted into the kernel that will attach to tracepoints, where the information on these tracepoints will move the model from state to state. If a state is encountered that does not belong to the model, it will then activate a given reactor, that could just inform the user or even panic the kernel (for which safety critical systems will detect and can recover from). - Two monitor models are also added: Wakeup In Preemptive (WIP - not to be confused with "work in progress"), and Wakeup While Not Running (WWNR). - Added __vstring() helper to the TRACE_EVENT() macro to replace several vsnprintf() usages that were all doing it wrong. - eprobes now can have their event autogenerated when the event name is left off. - The rest is various cleanups and fixes. * tag 'trace-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (50 commits) rv: Unlock on error path in rv_unregister_reactor() tracing: Use alignof__(struct {type b;}) instead of offsetof() tracing/eprobe: Show syntax error logs in error_log file scripts/tracing: Fix typo 'the the' in comment tracepoints: It is CONFIG_TRACEPOINTS not CONFIG_TRACEPOINT tracing: Use free_trace_buffer() in allocate_trace_buffers() tracing: Use a struct alignof to determine trace event field alignment rv/reactor: Add the panic reactor rv/reactor: Add the printk reactor rv/monitor: Add the wwnr monitor rv/monitor: Add the wip monitor rv/monitor: Add the wip monitor skeleton created by dot2k Documentation/rv: Add deterministic automata instrumentation documentation Documentation/rv: Add deterministic automata monitor synthesis documentation tools/rv: Add dot2k Documentation/rv: Add deterministic automaton documentation tools/rv: Add dot2c Documentation/rv: Add a basic documentation rv/include: Add instrumentation helper functions rv/include: Add deterministic automata monitor definition via C macros ... commit 446279168e030fd0ed68e2bba336bef8bb3da352 Merge: 44dab005fd429 6feaec81477af Author: Andreas Gruenbacher Date: Fri Aug 5 18:37:03 2022 +0200 Merge part of branch 'for-next.instantiate' into for-next commit 29b1d469f3f6842ee4115f0b21f018fc44176468 Merge: b2a88c212e652 dd0b15bda48f5 Author: Linus Torvalds Date: Fri Aug 5 09:35:46 2022 -0700 Merge tag 'trace-rtla-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull real time analysis tool (rtla) updates from Steven Rostedt: - Fix a double free - Define syscall numbers for RISCV - Fix Makefile when called from -C tools - Use calloc() to check for memory allocation failures * tag 'trace-rtla-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: rtla: Define syscall numbers for riscv rtla: Fix double free rtla: Fix Makefile when called from -C tools/ rtla/utils: Use calloc and check the potential memory allocation failure commit 0d168a58fca34806b575c7cba87afb11208acb54 Author: Steve French Date: Mon Aug 1 01:31:16 2022 -0500 cifs: update internal module number To 2.38 Signed-off-by: Steve French commit ea75a78c07d7f172062822b90fac8a9ac59773a3 Author: Steve French Date: Fri Aug 5 11:15:44 2022 -0500 cifs: alloc_mid function should be marked as static It is only used in transport.c. Signed-off-by: Steve French commit f5fd3f2889dc2f1df83f7d17e9579fe0d269bbb4 Author: Enzo Matsumiya Date: Fri Aug 5 11:47:39 2022 -0300 cifs: remove "cifs_" prefix from init/destroy mids functions Rename generic mid functions to same style, i.e. without "cifs_" prefix. cifs_{init,destroy}_mids() -> {init,destroy}_mids() Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 70f08f914a37a0881a7f17068e03ff5a5024822d Author: Enzo Matsumiya Date: Fri Aug 5 11:47:38 2022 -0300 cifs: remove useless DeleteMidQEntry() DeleteMidQEntry() was just a proxy for cifs_mid_q_entry_release(). - remove DeleteMidQEntry() - rename cifs_mid_q_entry_release() to release_mid() - rename kref_put() callback _cifs_mid_q_entry_release to __release_mid - rename AllocMidQEntry() to alloc_mid() - rename cifs_delete_mid() to delete_mid() Update callers to use new names. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit fb157ed226d225b6a149ed63a7831f6bdde7b911 Author: Steve French Date: Mon Aug 1 11:17:46 2022 -0500 cifs: when insecure legacy is disabled shrink amount of SMB1 code Currently much of the smb1 code is built even when CONFIG_CIFS_ALLOW_INSECURE_LEGACY is disabled. Move cifssmb.c to only be compiled when insecure legacy is disabled, and move various SMB1/CIFS helper functions to that ifdef. Some functions that were not SMB1/CIFS specific needed to be moved out of cifssmb.c This shrinks cifs.ko by more than 10% which is good - but also will help with the eventual movement of the legacy code to a distinct module. Follow on patches can shrink the number of ifdefs by code restructuring where smb1 code is wedged in functions that should be calling dialect specific helper functions instead, and also by moving some functions from file.c/dir.c/inode.c into smb1 specific c files. Reviewed-by: Ronnie Sahlberg Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 2901c8bdedca19e5efdab2ea55b465102231b315 Author: Dan Williams Date: Tue Aug 2 10:34:35 2022 -0700 cxl/region: Fix decoder interleave programming Jonathan notes: "Curiously interleave ways = 1 for the EPs which is obviously wrong" ...while testing the latest CXL development branch on QEMU. It turns out the region creation process failed to program the endpoint decoders. This was missed because the default settings of x1 at 4K intereleave still results in the region appearing to function. Jonathan caught the bug by reverse mapping the translations that need to happen for the QEMU support. Link: https://lore.kernel.org/r/62e95fdf9f6e2_30440294e4@dwillia2-xfh.jf.intel.com.notmuch Fixes: 384e624bb211 ("cxl/region: Attach endpoint decoders") Reported-by: Jonathan Cameron Link: https://lore.kernel.org/r/165951146336.967013.11160153960900111443.stgit@dwillia2-xfh.jf.intel.com Acked-by: Jonathan Cameron Signed-off-by: Dan Williams commit 8732947b75a826519ef33b92dbebaa3fa83e5e0b Author: Bagas Sanjaya Date: Thu Aug 4 14:54:48 2022 +0700 Documentation: cxl: remove dangling kernel-doc reference Sphinx reported kernel-doc failure warning, pointing to non-existent drivers/cxl/region.h (which doesn't also exist throughout repo history): WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 2.4.4 -no-doc-sections ./drivers/cxl/region.h' failed with return code 1 Above cause error message to be displayed on htmldocs output. Delete the reference. Fixes: 779dd20cfb56c5 ("cxl/region: Add region creation support") Signed-off-by: Bagas Sanjaya Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20220804075448.98241-4-bagasdotme@gmail.com Signed-off-by: Dan Williams commit 038e6eb803870113ca78fc70905a27aaa7141fd9 Author: Bagas Sanjaya Date: Thu Aug 4 14:54:47 2022 +0700 cxl/region: describe targets and nr_targets members of cxl_region_params Sphinx reported undescribed parameters in cxl_region_params struct: ./drivers/cxl/cxl.h:376: warning: Function parameter or member 'targets' not described in 'cxl_region_params' ./drivers/cxl/cxl.h:376: warning: Function parameter or member 'nr_targets' not described in 'cxl_region_params' Describe these members. Fixes: b9686e8c8e39 ("cxl/region: Enable the assignment of endpoint decoders to regions") Signed-off-by: Bagas Sanjaya Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20220804075448.98241-3-bagasdotme@gmail.com Signed-off-by: Dan Williams commit f13da0d9c3252eb922fc12495f2068fbb18c2e8f Author: Bagas Sanjaya Date: Thu Aug 4 14:54:46 2022 +0700 cxl/regions: add padding for cxl_rr_ep_add nested lists Sphinx reported indentation warnings: Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:732: WARNING: Unexpected indentation. Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:733: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/driver-api/cxl/memory-devices:457: ./drivers/cxl/core/region.c:735: WARNING: Unexpected indentation. These warnings above are due to missing blank line padding in the nested list in kernel-doc comment for cxl_rr_ep_add(). Add the paddings to fix the warnings. Fixes: 384e624bb211b4 ("cxl/region: Attach endpoint decoders") Signed-off-by: Bagas Sanjaya Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20220804075448.98241-2-bagasdotme@gmail.com Signed-off-by: Dan Williams commit 9fd2cf4d6fba8253efa62ba45f623ab7f09df12d Author: Dan Carpenter Date: Wed Aug 3 12:07:50 2022 +0300 cxl/region: Fix IS_ERR() vs NULL check The nvdimm_pmem_region_create() function returns NULL on error. It does not return error pointers. Fixes: 04ad63f086d1 ("cxl/region: Introduce cxl_pmem_region objects") Signed-off-by: Dan Carpenter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/Yuo65lq2WtfdGJ0X@kili Signed-off-by: Dan Williams commit e29a8995d63f6f861b2cc446c58cef430885f469 Author: Dan Williams Date: Mon Aug 1 12:55:30 2022 -0700 cxl/region: Fix region reference target accounting Dan reports: The error handling in cxl_port_attach_region() looks like it might have a similar bug. The cxl_rr->nr_targets++; might want a --. That function is more complicated. Indeed cxl_rr->nr_targets leaks when cxl_rr_ep_add() fails, but that flow is not clear. Fix the bug and the clarity by separating the 'new' region-reference case from the 'extend' region-reference case. This also moves the host-physical-address (HPA) validation, that the HPA of a new region being accounted to the port is greater than the HPA of all other regions associated with the port, to alloc_region_ref(). Introduce @nr_targets_inc to track when the error exit path needs to clean up cxl_rr->nr_targets. Fixes: 384e624bb211 ("cxl/region: Attach endpoint decoders") Reported-by: Dan Carpenter Reviewed-by: Ira Weiny Link: http://lore.kernel.org/r/165939482134.252363.1915691883146696327.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 69c9961387f244077101de3ce4e272717617dc87 Author: Dan Williams Date: Tue Aug 2 14:47:08 2022 -0700 cxl/region: Fix region commit uninitialized variable warning 0day robot reports: drivers/cxl/core/region.c:196 cxl_region_decode_commit() error: uninitialized symbol 'rc'. The re-checking of loop termination conditions to determine "success" makes it hard to see that @rc is initialized in all cases. Remove those to make it explicit that @rc reflects a commit error and that the rest of logic is concerned with unwinding committed decoders. This change potentially results in cxl_region_decode_reset() being called with @count == 0 where it was not called before, but cxl_region_decode_reset() treats that as a nop. Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Reported-by: kernel test robot Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Link: http://lore.kernel.org/r/165951148105.967013.14191992449932268431.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 8d428542571428fb68b5c41b092ae70d2fc2cd17 Author: Dan Williams Date: Tue Aug 2 13:27:44 2022 -0700 cxl/region: Fix port setup uninitialized variable warnings 0day robot reports: drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'eiw'. drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'peig'. drivers/cxl/core/region.c:1068 cxl_port_setup_targets() error: uninitialized symbol 'peiw'. ...which are all valid reports. Add debug statement to consume the, albeit unexpected, errors. Fixes: 27b3f8d13830 ("cxl/region: Program target lists") Reported-by: kernel test robot Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165951147487.967013.929590444907251028.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit d1f6222c4978817712e0f2825ce9e830763f0695 Author: Dylan Yudaken Date: Fri Aug 5 04:54:50 2022 -0700 io_uring: fix io_recvmsg_prep_multishot sparse warnings Fix casts missing the __user parts. This seemed to only cause errors on the alpha build, or if checked with sparse, but it was definitely an oversight. Reported-by: kernel test robot Fixes: 9bb66906f23e ("io_uring: support multishot in recvmsg") Signed-off-by: Dylan Yudaken Link: https://lore.kernel.org/r/20220805115450.3921352-1-dylany@fb.com Signed-off-by: Jens Axboe commit d5beb74f17e25a3cb331a0cd8af795e8cfc5d36c Author: Pierre-Louis Bossart Date: Fri Aug 5 15:33:32 2022 +0200 ASoC: Intel: fix sof_es8336 probe Changes to add HDMI capture support broke the machine driver probe for all other platforms. The commit listed in the Fixes tag added a board_id descriptor but didn't add the default name for the sof_essx8336 machine driver. Add the missing entry and remove the now-useless platform driver alias. Reported-by: Eugene J Markow BugLink: https://github.com/thesofproject/linux/issues/3336 Fixes: 86b1959a2ccb ("ASoC: Intel: sof_es8336: add support for HDMI_In capture") Reviewed-by: Bard Liao Signed-off-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220805133332.207932-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 5549af7f42916c0d7e78a0e423ac667e27eaac3e Merge: 754590651ccbb 94c1ceb043c1a Author: Mark Brown Date: Fri Aug 5 15:24:07 2022 +0100 ASoC: Fix theoretical buffer overflow by snprintf() Merge series from Takashi Iwai : This is a patch series to paper over the theoretical buffer overflow that might be caused by snprintf(). snprintf() is notorious for its behavior and the usage of a safer version, scnprintf(), is recommended. commit 754590651ccbbcc74a7c20907be4bb15d642bde3 Author: Takashi Iwai Date: Mon Aug 1 19:05:10 2022 +0200 ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcm_add_paths(), it doesn't check whether the picked BE actually supports for the given stream direction. Due to that, when an asymmetric BE stream is present, it picks up wrongly and this may result in a NULL dereference at a later point where the code assumes the existence of a corresponding BE substream. This patch adds the check for the presence of the substream for the target BE for avoiding the problem above. Note that we have already some fix for non-existing BE substream at commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while applying symmetry"). But the code path we've hit recently is rather happening before the previous fix. So this patch tries to fix at picking up a BE instead of parsing BE lists. Fixes: bbf7d3b1c4f4 ("ASoC: soc-pcm: align BE 'atomicity' with that of the FE") Reported-by: Alex Natalsson Cc: Pierre-Louis Bossart Cc: Péter Ujfalusi Link: https://lore.kernel.org/r/CADs9LoPZH_D+eJ9qjTxSLE5jGyhKsjMN7g2NighZ16biVxsyKw@mail.gmail.com Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220801170510.26582-1-tiwai@suse.de Signed-off-by: Mark Brown commit 666d3b612f91dab4a6616586dc99d2e43f07f52d Author: Colin Ian King Date: Fri Aug 5 13:04:39 2022 +0100 ALSA: ice1712: remove redundant assignment to new The variable new is initialized with a value but it is never read. It is being re-assigned a new value in every case path in the following switch statement. The assignment is redundant and can be removed. Cleans up clang scan build warning: sound/pci/ice1712/quartet.c:569:8: warning: Although the value stored to 'new' is used in the enclosing expression, the value is never actually read from 'new' [deadcode.DeadStores] Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20220805120439.2341600-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai commit 706864c99e0e2d301da9e749395909bc309c50a0 Author: Lukas Bulwahn Date: Thu Aug 4 18:18:23 2022 +0200 MAINTAINERS: rectify entry for ARM/HPE GXP ARCHITECTURE Commit 8cc35b86546d ("spi: dt-bindings: add documentation for hpe,gxp-spifi") adds the spi dt-binding file hpe,gxp-spifi.yaml and commit a1848b0fa251 ("MAINTAINERS: add spi support to GXP") adds a file entry hpe,gxp-spi.yaml in ARM/HPE GXP ARCHITECTURE. Note the different file name. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in ARM/HPE GXP ARCHITECTURE. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220804161823.20912-1-lukas.bulwahn@gmail.com Signed-off-by: Mark Brown commit d501cc4cfc6be1ab9aef3ff0fa3b2afc52a1af23 Author: David Jander Date: Fri Aug 5 10:44:58 2022 +0200 spi: spi.c: Add missing __percpu annotations in users of spi_statistics Fixes sparse warnings of this kind: drivers/spi/spi.c:117:16: sparse: expected struct spi_statistics * drivers/spi/spi.c:117:16: sparse: got struct spi_statistics [noderef] __percpu *[assigned] pcpu_stats Reported-by: kernel test robot Signed-off-by: David Jander Link: https://lore.kernel.org/r/20220805084458.1602277-1-david@protonic.nl Signed-off-by: Mark Brown commit b7bf23c0865faac61564425ddc96a4a79ebf19b0 Author: Justin Stitt Date: Wed Aug 3 13:44:42 2022 -0700 ASoC: SOF: ipc3-topology: Fix clang -Wformat warning When building with Clang we encounter these warnings: | sound/soc/sof/ipc3-topology.c:2343:4: error: format specifies type | 'unsigned char' but the argument has type 'int' [-Werror,-Wformat] | SOF_ABI_MAJOR, SOF_ABI_MINOR, SOF_ABI_PATCH); | ^~~~~~~~~~~~~~~^~~~~~~~~~~~~~~^~~~~~~~~~~~~ Use correct format specifier `%d` since args are of type int. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Reported-by: Nathan Chancellor Suggested-by: Nathan Chancellor Signed-off-by: Justin Stitt Reviewed-by: Nathan Chancellor Acked-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20220803204442.2996580-1-justinstitt@google.com Signed-off-by: Mark Brown commit c75ed9f54ce8d349fee557f2b471a4d637ed2a6b Author: Biju Das Date: Thu Jul 28 10:26:12 2022 +0100 ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path We usually do cleanup in reverse order of init. Currently in case of error rz_ssi_release_dma_channels() done in the reverse order. This patch improves error handling in rz_ssi_probe() error path. While at it, use "goto cleanup" style to reduce code duplication. Reported-by: Pavel Machek Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20220728092612.38858-1-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 94c1ceb043c1a002de9649bb630c8e8347645982 Author: Takashi Iwai Date: Mon Aug 1 18:54:20 2022 +0200 ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow (although it's unrealistic). This patch replaces with a safer version, scnprintf() for papering over such a potential issue. Fixes: 29c8e4398f02 ("ASoC: SOF: Intel: hda: add extended rom status dump to error log") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220801165420.25978-4-tiwai@suse.de Signed-off-by: Mark Brown commit 1eb123ce985e6cf302ac6e3f19862d132d86fa8f Author: Takashi Iwai Date: Mon Aug 1 18:54:19 2022 +0200 ASoC: SOF: debug: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow (although it's unrealistic). This patch replaces with a safer version, scnprintf() for papering over such a potential issue. Fixes: 5b10b6298921 ("ASoC: SOF: Add `memory_info` file to debugfs") Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220801165420.25978-3-tiwai@suse.de Signed-off-by: Mark Brown commit ca3b7b9dc9bc1fa552f4697b7cccfa0258a44d00 Author: Takashi Iwai Date: Mon Aug 1 18:54:18 2022 +0200 ASoC: Intel: avs: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in a buffer overflow (although it's unrealistic). This patch replaces it with a safer version, scnprintf() for papering over such a potential issue. Fixes: f1b3b320bd65 ("ASoC: Intel: avs: Generic soc component driver") Signed-off-by: Takashi Iwai Acked-by: Cezary Rojewski Link: https://lore.kernel.org/r/20220801165420.25978-2-tiwai@suse.de Signed-off-by: Mark Brown commit 01fc4b9a6ed8eacb64e5609bab7ac963e1c7e486 Author: Fengnan Chang Date: Sun Jul 31 11:33:46 2022 +0800 f2fs: use onstack pages instead of pvec Since pvec have 15 pages, it not a multiple of 4, when write compressed pages, write in 64K as a unit, it will call pagevec_lookup_range_tag agagin, sometimes this will take a lot of time. Use onstack pages instead of pvec to mitigate this problem. Signed-off-by: Fengnan Chang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4f8219f8aa175d5a46703631abaae745592efe29 Author: Fengnan Chang Date: Sun Jul 31 11:33:45 2022 +0800 f2fs: intorduce f2fs_all_cluster_page_ready When write total cluster, all pages is uptodate, there is not need to call f2fs_prepare_compress_overwrite, intorduce f2fs_all_cluster_page_ready to avoid this. Signed-off-by: Fengnan Chang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e53f8643474a32ddfcfd04e5b22613fdd2a92a52 Author: Chao Yu Date: Thu Aug 4 21:38:21 2022 +0800 f2fs: clean up f2fs_abort_atomic_write() f2fs_abort_atomic_write() has checked whether current inode is atomic_write one or not, it's redundant to check in its caller, remove it for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit bff139b49d9f70c1ac5384aac94554846aa834de Author: Daeho Jeong Date: Tue Aug 2 12:24:37 2022 -0700 f2fs: handle decompress only post processing in softirq Now decompression is being handled in workqueue and it makes read I/O latency non-deterministic, because of the non-deterministic scheduling nature of workqueues. So, I made it handled in softirq context only if possible, not in low memory devices, since this modification will maintain decompresion related memory a little longer. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 90be48bd9d29ece3965e5e8b21499b6db166e57b Author: Jaewook Kim Date: Wed Aug 3 17:53:58 2022 +0900 f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED If a file has FI_COMPRESS_RELEASED, all writes for it should not be allowed. However, as of now, in case of compress_mode=user, writes triggered by IOCTLs like F2FS_IOC_DE/COMPRESS_FILE are allowed unexpectly, which could crash that file. To fix it, let's do not allow F2FS_IOC_DE/COMPRESS_IOCTL if a file already has FI_COMPRESS_RELEASED flag. This is the reproduction process: 1. $ touch ./file 2. $ chattr +c ./file 3. $ dd if=/dev/random of=./file bs=4096 count=30 conv=notrunc 4. $ dd if=/dev/zero of=./file bs=4096 count=34 seek=30 conv=notrunc 5. $ sync 6. $ do_compress ./file ; call F2FS_IOC_COMPRESS_FILE 7. $ get_compr_blocks ./file ; call F2FS_IOC_GET_COMPRESS_BLOCKS 8. $ release ./file ; call F2FS_IOC_RELEASE_COMPRESS_BLOCKS 9. $ do_compress ./file ; call F2FS_IOC_COMPRESS_FILE again 10. $ get_compr_blocks ./file ; call F2FS_IOC_GET_COMPRESS_BLOCKS again This reproduction process is tested in 128kb cluster size. You can find compr_blocks has a negative value. Fixes: 5fdb322ff2c2b ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE") Signed-off-by: Junbeom Yeom Signed-off-by: Sungjong Seo Signed-off-by: Youngjin Gil Signed-off-by: Jaewook Kim Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 912f0d6580e743eecf908f5566cc064b63c55908 Author: Jaegeuk Kim Date: Wed Aug 3 20:33:54 2022 -0700 f2fs: do not set compression bit if kernel doesn't support If kernel doesn't have CONFIG_F2FS_FS_COMPRESSION, a file having FS_COMPR_FL via ioctl(FS_IOC_SETFLAGS) is unaccessible due to f2fs_is_compress_backend_ready(). Let's avoid it. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit dbf8e63f48af48f3f0a069fc971c9826312dbfc1 Author: Eunhee Rho Date: Mon Aug 1 13:40:02 2022 +0900 f2fs: remove device type check for direct IO To ensure serialized IOs, f2fs allows only LFS mode for zoned device. Remove redundant check for direct IO. Signed-off-by: Eunhee Rho Signed-off-by: Jaegeuk Kim commit 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 Author: Ye Bin Date: Mon Aug 1 19:26:04 2022 +0800 f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data There is issue as follows when test f2fs atomic write: F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock F2FS-fs (loop0): invalid crc_offset: 0 F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. ================================================================== BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0 Read of size 8 at addr 0000000000000028 by task rep/1990 CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266 Call Trace: dump_stack_lvl+0x6e/0x91 print_report.cold+0x49a/0x6bb kasan_report+0xa8/0x130 f2fs_get_dnode_of_data+0xac/0x16d0 f2fs_do_write_data_page+0x2a5/0x1030 move_data_page+0x3c5/0xdf0 do_garbage_collect+0x2015/0x36c0 f2fs_gc+0x554/0x1d30 f2fs_balance_fs+0x7f5/0xda0 f2fs_write_single_data_page+0xb66/0xdc0 f2fs_write_cache_pages+0x716/0x1420 f2fs_write_data_pages+0x84f/0x9a0 do_writepages+0x130/0x3a0 filemap_fdatawrite_wbc+0x87/0xa0 file_write_and_wait_range+0x157/0x1c0 f2fs_do_sync_file+0x206/0x12d0 f2fs_sync_file+0x99/0xc0 vfs_fsync_range+0x75/0x140 f2fs_file_write_iter+0xd7b/0x1850 vfs_write+0x645/0x780 ksys_write+0xf1/0x1e0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd As 3db1de0e582c commit changed atomic write way which new a cow_inode for atomic write file, and also mark cow_inode as FI_ATOMIC_FILE. When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode which is NULL. Then will trigger null-ptr-deref. To solve above issue, introduce FI_COW_FILE flag for COW inode. Fiexes: 3db1de0e582c("f2fs: change the current atomic write way") Signed-off-by: Ye Bin Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 23339e5752d01a4b5e122759b002cf896d26f6c1 Author: Daeho Jeong Date: Mon Aug 1 10:08:08 2022 -0700 f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before. However it was removed accidentally. So revive it by changing the name, since volatile write had gone. Signed-off-by: Daeho Jeong Fiexes: 7bc155fec5b3("f2fs: kill volatile write support") Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1630eee2d4e77d8c121ab955d31befacb720bb99 Merge: 0d98fbcf72f11 879bcfc4e5369 Author: Arnd Bergmann Date: Fri Aug 5 11:33:19 2022 +0200 Merge branch 'arm/fixes' into arm/late Two bugfixes that came in to update the MAINTAINERS file and fix an issue with USB on the uniphier platform. * arm/fixes: arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC MAINTAINERS: add ARM/APPLE MACHINE mailing list commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5 Author: Herbert Xu Date: Thu Aug 4 18:03:46 2022 +0800 af_key: Do not call xfrm_probe_algs in parallel When namespace support was added to xfrm/afkey, it caused the previously single-threaded call to xfrm_probe_algs to become multi-threaded. This is buggy and needs to be fixed with a mutex. Reported-by: Abhishek Shah Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert commit 2e64fe4624d19bc71212aae434c54874e5c49c5a Author: Cezar Bulinaru Date: Wed Aug 3 02:28:16 2022 -0400 selftests: add few test cases for tap driver Few test cases related to the fix for 924a9bc362a5: "net: check if protocol extracted by virtio_net_hdr_set_proto is correct" Need test for the case when a non-standard packet (GSO without NEEDS_CSUM) sent to the tap device causes a BUG check in the tap driver. Signed-off-by: Cezar Bulinaru Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit 4f61f133f354853bc394ec7d6028adb9b02dd701 Author: Cezar Bulinaru Date: Wed Aug 3 02:27:59 2022 -0400 net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Fixes a NULL pointer derefence bug triggered from tap driver. When tap_get_user calls virtio_net_hdr_to_skb the skb->dev is null (in tap.c skb->dev is set after the call to virtio_net_hdr_to_skb) virtio_net_hdr_to_skb calls dev_parse_header_protocol which needs skb->dev field to be valid. The line that trigers the bug is in dev_parse_header_protocol (dev is at offset 0x10 from skb and is stored in RAX register) if (!dev->header_ops || !dev->header_ops->parse_protocol) 22e1: mov 0x10(%rbx),%rax 22e5: mov 0x230(%rax),%rax Setting skb->dev before the call in tap.c fixes the issue. BUG: kernel NULL pointer dereference, address: 0000000000000230 RIP: 0010:virtio_net_hdr_to_skb.constprop.0+0x335/0x410 [tap] Code: c0 0f 85 b7 fd ff ff eb d4 41 39 c6 77 cf 29 c6 48 89 df 44 01 f6 e8 7a 79 83 c1 48 85 c0 0f 85 d9 fd ff ff eb b7 48 8b 43 10 <48> 8b 80 30 02 00 00 48 85 c0 74 55 48 8b 40 28 48 85 c0 74 4c 48 RSP: 0018:ffffc90005c27c38 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888298f25300 RCX: 0000000000000010 RDX: 0000000000000005 RSI: ffffc90005c27cb6 RDI: ffff888298f25300 RBP: ffffc90005c27c80 R08: 00000000ffffffea R09: 00000000000007e8 R10: ffff88858ec77458 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000014 R14: ffffc90005c27e08 R15: ffffc90005c27cb6 FS: 0000000000000000(0000) GS:ffff88858ec40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000230 CR3: 0000000281408006 CR4: 00000000003706e0 Call Trace: tap_get_user+0x3f1/0x540 [tap] tap_sendmsg+0x56/0x362 [tap] ? get_tx_bufs+0xc2/0x1e0 [vhost_net] handle_tx_copy+0x114/0x670 [vhost_net] handle_tx+0xb0/0xe0 [vhost_net] handle_tx_kick+0x15/0x20 [vhost_net] vhost_worker+0x7b/0xc0 [vhost] ? vhost_vring_call_reset+0x40/0x40 [vhost] kthread+0xfa/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Signed-off-by: Cezar Bulinaru Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller commit f882c4bef9cb914d9f7be171afb10ed26536bfa7 Author: Meng Tang Date: Fri Aug 5 15:45:34 2022 +0800 ALSA: hda/realtek: Add quirk for another Asus K42JZ model There is another Asus K42JZ model with the PCI SSID 1043:1313 that requires the quirk ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE. Add the corresponding entry to the quirk table. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220805074534.20003-1-tangmeng@uniontech.com Signed-off-by: Takashi Iwai commit 9f05f9ade27f1802d1305abd58c3e4a0d819deef Merge: 4ae97cae07e15 df9e03aec3b14 Author: David S. Miller Date: Fri Aug 5 08:51:29 2022 +0100 Merge branch 'mptcp-fixes' Mat Martineau says: ==================== mptcp: Fixes for mptcp cleanup/close and a selftest Patch 1 fixes an issue with leaking subflow sockets if there's a failure in a CGROUP_INET_SOCK_CREATE eBPF program. Patch 2 fixes a syzkaller-detected race at MPTCP socket close. Patch 3 is a fix for one mode of the mptcp_connect.sh selftest. ==================== Signed-off-by: David S. Miller commit df9e03aec3b14970df05b72d54f8ac9da3ab29e1 Author: Florian Westphal Date: Thu Aug 4 17:21:27 2022 -0700 selftests: mptcp: make sendfile selftest work When the selftest got added, sendfile() on mptcp sockets returned -EOPNOTSUPP, so running 'mptcp_connect.sh -m sendfile' failed immediately. This is no longer the case, but the script fails anyway due to timeout. Let the receiver know once the sender has sent all data, just like with '-m mmap' mode. v2: need to respect cfg_wait too, as pm_userspace.sh relied on -m sendfile to keep the connection open (Mat Martineau) Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Reported-by: Xiumei Mu Reviewed-by: Mat Martineau Signed-off-by: Florian Westphal Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit c886d70286bf3ad411eb3d689328a67f7102c6ae Author: Paolo Abeni Date: Thu Aug 4 17:21:26 2022 -0700 mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Modules linked in: uio_ivshmem(OE) uio(E) CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE 5.19.0-rc6-g2eae0556bb9d #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91 f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00 RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002 RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000 R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400 R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258 FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0 Call Trace: __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067 sk_destruct+0xbd/0xe0 net/core/sock.c:2112 __sk_free+0xef/0x3d0 net/core/sock.c:2123 sk_free+0x78/0xa0 net/core/sock.c:2134 sock_put include/net/sock.h:1927 [inline] __mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351 __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828 mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586 process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289 worker_thread+0x623/0x1070 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 The root cause of the problem is that an mptcp-level (re)transmit can race with mptcp_close() and the packet scheduler checks the subflow state before acquiring the socket lock: we can try to (re)transmit on an already closed ssk. Fix the issue checking again the subflow socket status under the subflow socket lock protection. Additionally add the missing check for the fallback-to-tcp case. Fixes: d5f49190def6 ("mptcp: allow picking different xmit subflows") Reported-by: Dipanjan Das Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit c0bf3c6aa444a5ef44acc57ef6cfa53fd4fc1c9b Author: Paolo Abeni Date: Thu Aug 4 17:21:25 2022 -0700 mptcp: move subflow cleanup in mptcp_destroy_common() If the mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in __mptcp_destroy_sock() that is not invoked in such code path. Address the issue moving the subflow sockets cleanup in the mptcp_destroy_common() helper, which is invoked in every msk cleanup path. Additionally get rid of the intermediate list_splice_init step, which is an unneeded relic from the past. The issue is present since before the reported root cause commit, but any attempt to backport the fix before that hash will require a complete rewrite. Fixes: e16163b6e2 ("mptcp: refactor shutdown and close") Reported-by: Nguyen Dinh Phi Reviewed-by: Mat Martineau Co-developed-by: Nguyen Dinh Phi Signed-off-by: Nguyen Dinh Phi Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Signed-off-by: David S. Miller commit b2a88c212e652e94f1e4b635910972ac57ba4e97 Merge: 9daee913dc8d1 5e9466a5d0604 Author: Linus Torvalds Date: Thu Aug 4 20:19:16 2022 -0700 Merge tag 'xfs-5.20-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "The biggest changes for this release are the log scalability improvements, lockless lookups for the buffer cache, and making the attr fork a permanent part of the incore inode in preparation for directory parent pointers. There's also a bunch of bug fixes that have accumulated since -rc5. I might send you a second pull request with some more bug fixes that I'm still working on. Once the merge window ends, I will hand maintainership back to Dave Chinner until the 6.1-rc1 release so that I can conduct the design review for the online fsck feature, and try to get it merged. Summary: - Improve scalability of the XFS log by removing spinlocks and global synchronization points. - Add security labels to whiteout inodes to match the other filesystems. - Clean up per-ag pointer passing to simplify call sites. - Reduce verifier overhead by precalculating more AG geometry. - Implement fast-path lockless lookups in the buffer cache to reduce spinlock hammering. - Make attr forks a permanent part of the inode structure to fix a UAF bug and because most files these days tend to have security labels and soon will have parent pointers too. - Clean up XFS_IFORK_Q usage and give it a better name. - Fix more UAF bugs in the xattr code. - SOB my tags. - Fix some typos in the timestamp range documentation. - Fix a few more memory leaks. - Code cleanups and typo fixes. - Fix an unlocked inode fork pointer access in getbmap" * tag 'xfs-5.20-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (61 commits) xfs: delete extra space and tab in blank line xfs: fix NULL pointer dereference in xfs_getbmap() xfs: Fix typo 'the the' in comment xfs: Fix comment typo xfs: don't leak memory when attr fork loading fails xfs: fix for variable set but not used warning xfs: xfs_buf cache destroy isn't RCU safe xfs: delete unnecessary NULL checks xfs: fix comment for start time value of inode with bigtime enabled xfs: fix use-after-free in xattr node block inactivation xfs: lockless buffer lookup xfs: remove a superflous hash lookup when inserting new buffers xfs: reduce the number of atomic when locking a buffer after lookup xfs: merge xfs_buf_find() and xfs_buf_get_map() xfs: break up xfs_buf_find() into individual pieces xfs: add in-memory iunlink log item xfs: add log item precommit operation xfs: combine iunlink inode update functions xfs: clean up xfs_iunlink_update_inode() xfs: double link the unlinked inode list ... commit 9daee913dc8d15eb65e0ff560803ab1c28bb480b Merge: fa9db655d0e11 d95efb14c0b81 Author: Linus Torvalds Date: Thu Aug 4 20:13:46 2022 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Add new ioctls to set and get the file system UUID in the ext4 superblock and improved the performance of the online resizing of file systems with bigalloc enabled. Fixed a lot of bugs, in particular for the inline data feature, potential races when creating and deleting inodes with shared extended attribute blocks, and the handling of directory blocks which are corrupted" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (37 commits) ext4: add ioctls to get/set the ext4 superblock uuid ext4: avoid resizing to a partial cluster size ext4: reduce computation of overhead during resize jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted ext4: block range must be validated before use in ext4_mb_clear_bb() mbcache: automatically delete entries from cache on freeing mbcache: Remove mb_cache_entry_delete() ext2: avoid deleting xattr block that is being reused ext2: unindent codeblock in ext2_xattr_set() ext2: factor our freeing of xattr block reference ext4: fix race when reusing xattr blocks ext4: unindent codeblock in ext4_xattr_block_set() ext4: remove EA inode entry from mbcache on inode eviction mbcache: add functions to delete entry if unused mbcache: don't reclaim used entries ext4: make sure ext4_append() always allocates new block ext4: check if directory block is within i_size ext4: reflect mb_optimize_scan value in options file ext4: avoid remove directory when directory is corrupted ext4: aligned '*' in comments ... commit fa9db655d0e112c108fe838809608caf759bdf5e Merge: e495274793ea6 bc792884b76f0 Author: Linus Torvalds Date: Thu Aug 4 20:00:14 2022 -0700 Merge tag 'for-5.20/block-2022-08-04' of git://git.kernel.dk/linux-block Pull block driver updates from Jens Axboe: - NVMe pull requests via Christoph: - add support for In-Band authentication (Hannes Reinecke) - handle the persistent internal error AER (Michael Kelley) - use in-capsule data for TCP I/O queue connect (Caleb Sander) - remove timeout for getting RDMA-CM established event (Israel Rukshin) - misc cleanups (Joel Granados, Sagi Grimberg, Chaitanya Kulkarni, Guixin Liu, Xiang wangx) - use command_id instead of req->tag in trace_nvme_complete_rq() (Bean Huo) - various fixes for the new authentication code (Lukas Bulwahn, Dan Carpenter, Colin Ian King, Chaitanya Kulkarni, Hannes Reinecke) - small cleanups (Liu Song, Christoph Hellwig) - restore compat_ioctl support (Nick Bowler) - make a nvmet-tcp workqueue lockdep-safe (Sagi Grimberg) - enable generic interface (/dev/ngXnY) for unknown command sets (Joel Granados, Christoph Hellwig) - don't always build constants.o (Christoph Hellwig) - print the command name of aborted commands (Christoph Hellwig) - MD pull requests via Song: - Improve raid5 lock contention, by Logan Gunthorpe. - Misc fixes to raid5, by Logan Gunthorpe. - Fix race condition with md_reap_sync_thread(), by Guoqing Jiang. - Fix potential deadlock with raid5_quiesce and raid5_get_active_stripe, by Logan Gunthorpe. - Refactoring md_alloc(), by Christoph" - Fix md disk_name lifetime problems, by Christoph Hellwig - Convert prepare_to_wait() to wait_woken() api, by Logan Gunthorpe; - Fix sectors_to_do bitmap issue, by Logan Gunthorpe. - Work on unifying the null_blk module parameters and configfs API (Vincent) - drbd bitmap IO error fix (Lars) - Set of rnbd fixes (Guoqing, Md Haris) - Remove experimental marker on bcache async device registration (Coly) - Series from cleaning up the bio splitting (Christoph) - Removal of the sx8 block driver. This hardware never really widespread, and it didn't receive a lot of attention after the initial merge of it back in 2005 (Christoph) - A few fixes for s390 dasd (Eric, Jiang) - Followup set of fixes for ublk (Ming) - Support for UBLK_IO_NEED_GET_DATA for ublk (ZiyangZhang) - Fixes for the dio dma alignment (Keith) - Misc fixes and cleanups (Ming, Yu, Dan, Christophe * tag 'for-5.20/block-2022-08-04' of git://git.kernel.dk/linux-block: (136 commits) s390/dasd: Establish DMA alignment s390/dasd: drop unexpected word 'for' in comments ublk_drv: add support for UBLK_IO_NEED_GET_DATA ublk_cmd.h: add one new ublk command: UBLK_IO_NEED_GET_DATA ublk_drv: cleanup ublksrv_ctrl_dev_info ublk_drv: add SET_PARAMS/GET_PARAMS control command ublk_drv: fix ublk device leak in case that add_disk fails ublk_drv: cancel device even though disk isn't up block: fix leaking page ref on truncated direct io block: ensure bio_iov_add_page can't fail block: ensure iov_iter advances for added pages drivers:md:fix a potential use-after-free bug md/raid5: Ensure batch_last is released before sleeping for quiesce md/raid5: Move stripe_request_ctx up md/raid5: Drop unnecessary call to r5c_check_stripe_cache_usage() md/raid5: Make is_inactive_blocked() helper md/raid5: Refactor raid5_get_active_stripe() block: pass struct queue_limits to the bio splitting helpers block: move bio_allowed_max_sectors to blk-merge.c block: move the call to get_max_io_size out of blk_bio_segment_split ... commit e495274793ea602415d050452088a496abcd9e6c Merge: 746fc76b820dc 6b822d408b58c Author: Linus Torvalds Date: Thu Aug 4 19:54:32 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This cycle we got a new RDMA driver "ERDMA" for the Alibaba cloud environment. Otherwise the changes are dominated by rxe fixes. There is another RDMA driver on the list that might get merged next cycle, 'MANA' for the Azure cloud environment. Summary: - Bug fixes and small features for irdma, hns, siw, qedr, hfi1, mlx5 - General spelling/grammer fixes - rdma cm can follow changes in neighbours for control packets - Significant amounts of rxe fixes and spec compliance changes - Use the modern NAPI API - Use the bitmap API instead of open coding - Performance improvements for rtrs - Add the ERDMA driver for Alibaba cloud - Fix a use after free bug in SRP" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (99 commits) RDMA/ib_srpt: Unify checking rdma_cm_id condition in srpt_cm_req_recv() RDMA/rxe: Fix error unwind in rxe_create_qp() RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Split qp state for requester and completer RDMA/rxe: Generate error completion for error requester QP state RDMA/rxe: Update wqe_index for each wqe error completion RDMA/srpt: Fix a use-after-free RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Duplicate port name members IB/qib: Fix repeated "in" within comments RDMA/erdma: Add driver to kernel build environment RDMA/erdma: Add the ABI definitions RDMA/erdma: Add the erdma module RDMA/erdma: Add connection management (CM) support RDMA/erdma: Add verbs implementation RDMA/erdma: Add verbs header file RDMA/erdma: Add event queue implementation RDMA/erdma: Add cmdq implementation RDMA/erdma: Add main include file RDMA/erdma: Add the hardware related definitions ... commit f1a15b977ff864513133ecb611eb28603d32c1b4 Author: Dan Carpenter Date: Thu Aug 4 17:33:48 2022 +0300 rv: Unlock on error path in rv_unregister_reactor() Unlock the "rv_interface_lock" mutex before returning. Link: https://lkml.kernel.org/r/YuvYzNfGMgV+PIhd@kili Fixes: 04acadcb4453 ("rv: Add runtime reactors interface") Signed-off-by: Dan Carpenter Signed-off-by: Steven Rostedt (Google) commit 746fc76b820dce8cbb17a1e5e70a1558db4d7406 Merge: 328141e51e6fc 8fcdc238ce1b4 Author: Linus Torvalds Date: Thu Aug 4 19:47:37 2022 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (ufs, qla2xx, target, lpfc, smartpqi, mpi3mr). The main driver change that might cause issues on down the road is the conversion of some of our oldest surviving drivers to the DMA API (should only affect m68k). The only major core change is the rework of async resume; the rest are either completely trivial or for updating deprecated APIs" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (195 commits) scsi: target: Remove XDWRITEREAD emulated support scsi: megaraid: Remove the static variable initialisation scsi: ch: Do not initialise statics to 0 scsi: ufs: core: Fix spelling mistake "Cannnot" -> "Cannot" scsi: target: iscsi: Do not require target authentication scsi: target: iscsi: Allow AuthMethod=None scsi: target: iscsi: Support base64 in CHAP scsi: target: iscsi: Add support for extended CDB AHS scsi: ufs: dt-bindings: Add SC8280XP binding scsi: target: iscsi: Fix clang -Wformat warnings scsi: ufs: core: Read device property for ref clock scsi: libsas: Resume SAS host for phy reset or enable via sysfs scsi: hisi_sas: Modify v3 HW SATA completion error processing scsi: hisi_sas: Relocate DMA unmap of SMP task scsi: hisi_sas: Remove unnecessary variable to hold DMA map elements scsi: hisi_sas: Call hisi_sas_slave_configure() from slave_configure_v3_hw() scsi: mpi3mr: Delete a stray tab scsi: mpi3mr: Unlock on error path scsi: mpi3mr: Reduce VD queue depth on detecting throttling scsi: mpi3mr: Resource Based Metering ... commit 328141e51e6fc79d21168bfd4e356dddc2ec7491 Merge: eff0cb3d91c06 527f36f5efa45 Author: Linus Torvalds Date: Thu Aug 4 19:41:09 2022 -0700 Merge tag 'mmc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Add support for the asynchronous SDIO wakeup interrupts - Skip redundant evaluation of eMMC HS400 caps when no-MMC-cap - Add support to store error stats from host drivers - Extend debugfs to show error stats from host drivers - Add single I/O read support in the recovery path for 4k sector cards MMC host: - dw_mmc-exynos: Convert corresponding DT bindings to the dtschema - dw_mmc-rockchip: Add support for the Rockchip RV1126 variant - mmc_spi: Convert corresponding DT bindings to the dtschema - mtk-sd: Extend support for interrupts/pinctrls for SDIO low-power mode - mtk-sd: Add support for SDIO wake irqs - mtk-sd: Add support for the Mediatek MT8188 variant - renesas_sdhi: Drop redundant manual tap correction for newer SoCs - renesas_sdhi: Add support for the R-Car S4-8 and generic Gen4 variants - sdhci/cqhci: Add support to capture stats from host errors - sdhci-brcmstb: Add ability to increase max clock rate for SDIO on 72116b0 - sdhci-msm: Add support for the MSM8998 and SM8450 variant - sdhci-of-at91: Fixup UHS-I mode by rewriting of MC1R - sdhci-of-dwcmshc: Add support for the Rockchip rk3588 variant - sdhci-of-dwcmshc: Enable reset support for the Rockchip variants - sdhci-pci-gli: Improve I/O read/write performance for GL9763E - sdhci-s3c: Convert corresponding DT bindings to the dtschema - tmio: Avoid glitches when resetting MEMSTICK core: - A couple of minor fixes and cleanups" * tag 'mmc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (61 commits) mmc: mediatek: add support for SDIO eint wakup IRQ mmc: core: Add support for SDIO wakeup interrupt dt-bindings: mmc: mtk-sd: extend interrupts and pinctrls properties dt-bindings: mmc: rockchip-dw-mshc: Document Rockchip RV1126 mmc: renesas_sdhi: newer SoCs don't need manual tap correction mmc: cavium-thunderx: Add of_node_put() when breaking out of loop mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: core: quirks: Add of_node_put() when breaking out of loop mmc: sdhci-brcmstb: use clk_get_rate(base_clk) in PM resume dt-bindings: mmc: sdhci-msm: Document the SM8450 compatible mmc: sdhci-msm: drop redundant of_device_id entries dt-bindings: mmc: sdhci-msm: add MSM8998 mmc: block: Add single read for 4k sector cards mmc: mxcmmc: Use mmc_card_sdio macro mmc: core: Use mmc_card_* macro and add a new for the sd_combo type dt-bindings: mmc: sdhci-msm: constrain reg-names per variants dt-bindings: mmc: sdhci-msm: fix reg-names entries dt-bindings: mmc: Add compatible for MediaTek MT8188 dt-bindings: mmc: sdhci-msm: document resets mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R ... commit eff0cb3d91c06acbb957be1134a07afa2c4978e3 Merge: 31be1d0fbd950 c4f36c3ab0650 Author: Linus Torvalds Date: Thu Aug 4 19:30:35 2022 -0700 Merge tag 'pci-v5.20-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Consolidate duplicated 'next function' scanning and extend to allow 'isolated functions' on s390, similar to existing hypervisors (Niklas Schnelle) Resource management: - Implement pci_iobar_pfn() for sparc, which allows us to remove the sparc-specific pci_mmap_page_range() and pci_mmap_resource_range(). This removes the ability to map the entire PCI I/O space using /proc/bus/pci, but we believe that's already been broken since v2.6.28 (Arnd Bergmann) - Move common PCI definitions to asm-generic/pci.h and rework others to be be more specific and more encapsulated in arches that need them (Stafford Horne) Power management: - Convert drivers to new *_PM_OPS macros to avoid need for '#ifdef CONFIG_PM_SLEEP' or '__maybe_unused' (Bjorn Helgaas) Virtualization: - Add ACS quirk for Broadcom BCM5750x multifunction NICs that isolate the functions but don't advertise an ACS capability (Pavan Chebbi) Error handling: - Clear PCI Status register during enumeration in case firmware left errors logged (Kai-Heng Feng) - When we have native control of AER, enable error reporting for all devices that support AER. Previously only a few drivers enabled this (Stefan Roese) - Keep AER error reporting enabled for switches. Previously we enabled this during enumeration but immediately disabled it (Stefan Roese) - Iterate over error counters instead of error strings to avoid printing junk in AER sysfs counters (Mohamed Khalfella) ASPM: - Remove pcie_aspm_pm_state_change() so ASPM config changes, e.g., via sysfs, are not lost across power state changes (Kai-Heng Feng) Endpoint framework: - Don't stop an EPC when unbinding an EPF from it (Shunsuke Mie) Endpoint embedded DMA controller driver: - Simplify and clean up support for the DesignWare embedded DMA (eDMA) controller (Frank Li, Serge Semin) Broadcom STB PCIe controller driver: - Avoid config space accesses when link is down because we can't recover from the CPU aborts these cause (Jim Quinlan) - Look for power regulators described under Root Ports in DT and enable them before scanning the secondary bus (Jim Quinlan) - Disable/enable regulators in suspend/resume (Jim Quinlan) Freescale i.MX6 PCIe controller driver: - Simplify and clean up clock and PHY management (Richard Zhu) - Disable/enable regulators in suspend/resume (Richard Zhu) - Set PCIE_DBI_RO_WR_EN before writing DBI registers (Richard Zhu) - Allow speeds faster than Gen2 (Richard Zhu) - Make link being down a non-fatal error so controller probe doesn't fail if there are no Endpoints connected (Richard Zhu) Loongson PCIe controller driver: - Add ACPI and MCFG support for Loongson LS7A (Huacai Chen) - Avoid config reads to non-existent LS2K/LS7A devices because a hardware defect causes machine hangs (Huacai Chen) - Work around LS7A integrated devices that report incorrect Interrupt Pin values (Jianmin Lv) Marvell Aardvark PCIe controller driver: - Add support for AER and Slot capability on emulated bridge (Pali Rohár) MediaTek PCIe controller driver: - Add Airoha EN7532 to DT binding (John Crispin) - Allow building of driver for ARCH_AIROHA (Felix Fietkau) MediaTek PCIe Gen3 controller driver: - Print decoded LTSSM state when the link doesn't come up (Jianjun Wang) NVIDIA Tegra194 PCIe controller driver: - Convert DT binding to json-schema (Vidya Sagar) - Add DT bindings and driver support for Tegra234 Root Port and Endpoint mode (Vidya Sagar) - Fix some Root Port interrupt handling issues (Vidya Sagar) - Set default Max Payload Size to 256 bytes (Vidya Sagar) - Fix Data Link Feature capability programming (Vidya Sagar) - Extend Endpoint mode support to devices beyond Controller-5 (Vidya Sagar) Qualcomm PCIe controller driver: - Rework clock, reset, PHY power-on ordering to avoid hangs and improve consistency (Robert Marko, Christian Marangi) - Move pipe_clk handling to PHY drivers (Dmitry Baryshkov) - Add IPQ60xx support (Selvam Sathappan Periakaruppan) - Allow ASPM L1 and substates for 2.7.0 (Krishna chaitanya chundru) - Add support for more than 32 MSI interrupts (Dmitry Baryshkov) Renesas R-Car PCIe controller driver: - Convert DT binding to json-schema (Herve Codina) - Add Renesas RZ/N1D (R9A06G032) to rcar-gen2 DT binding and driver (Herve Codina) Samsung Exynos PCIe controller driver: - Fix phy-exynos-pcie driver so it follows the 'phy_init() before phy_power_on()' PHY programming model (Marek Szyprowski) Synopsys DesignWare PCIe controller driver: - Simplify and clean up the DWC core extensively (Serge Semin) - Fix an issue with programming the ATU for regions that cross a 4GB boundary (Serge Semin) - Enable the CDM check if 'snps,enable-cdm-check' exists; previously we skipped it if 'num-lanes' was absent (Serge Semin) - Allocate a 32-bit DMA-able page to be MSI target instead of using a driver data structure that may not be addressable with 32-bit address (Will McVicker) - Add DWC core support for more than 32 MSI interrupts (Dmitry Baryshkov) Xilinx Versal CPM PCIe controller driver: - Add DT binding and driver support for Versal CPM5 Gen5 Root Port (Bharat Kumar Gogada)" * tag 'pci-v5.20-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (150 commits) PCI: imx6: Support more than Gen2 speed link mode PCI: imx6: Set PCIE_DBI_RO_WR_EN before writing DBI registers PCI: imx6: Reformat suspend callback to keep symmetric with resume PCI: imx6: Move the imx6_pcie_ltssm_disable() earlier PCI: imx6: Disable clocks in reverse order of enable PCI: imx6: Do not hide PHY driver callbacks and refine the error handling PCI: imx6: Reduce resume time by only starting link if it was up before suspend PCI: imx6: Mark the link down as non-fatal error PCI: imx6: Move regulator enable out of imx6_pcie_deassert_core_reset() PCI: imx6: Turn off regulator when system is in suspend mode PCI: imx6: Call host init function directly in resume PCI: imx6: Disable i.MX6QDL clock when disabling ref clocks PCI: imx6: Propagate .host_init() errors to caller PCI: imx6: Collect clock enables in imx6_pcie_clk_enable() PCI: imx6: Factor out ref clock disable to match enable PCI: imx6: Move imx6_pcie_clk_disable() earlier PCI: imx6: Move imx6_pcie_enable_ref_clk() earlier PCI: imx6: Move PHY management functions together PCI: imx6: Move imx6_pcie_grp_offset(), imx6_pcie_configure_type() earlier PCI: imx6: Convert to NOIRQ_SYSTEM_SLEEP_PM_OPS() ... commit 31be1d0fbd950395701d9fd47d8fb1f99c996f61 Merge: 36001a2fa6cc6 a1873f837f9e5 Author: Linus Torvalds Date: Thu Aug 4 18:44:38 2022 -0700 Merge tag 'dmaengine-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New support / Core: - Remove DMA_MEMCPY_SG for lack of users - Tegra 234 dmaengine support - Mediatek MT8365 dma support - Apple ADMAC driver Updates: - Yaml conversion for ST-Ericsson DMA40 binding and Freescale edma - rz-dmac updates and device_synchronize support - Bunch of typo in comments fixes in drivers - multithread support in sf-pdma driver" * tag 'dmaengine-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (50 commits) dmaengine: mediatek: mtk-hsdma: Fix typo 'the the' in comment dmaengine: axi-dmac: check cache coherency register dmaengine: sh: rz-dmac: Add device_synchronize callback dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed dmaengine: tegra: Add terminate() for Tegra234 dt-bindings: dmaengine: Add compatible for Tegra234 dmaengine: xilinx: use strscpy to replace strlcpy dmaengine: imx-sdma: Add FIFO stride support for multi FIFO script dmaengine: idxd: Correct IAX operation code names dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) dmaengine: dw-axi-dmac: ignore interrupt if no descriptor dmaengine: dw-axi-dmac: do not print NULL LLI during error dmaengine: altera-msgdma: Fixed some inconsistent function name descriptions dmaengine: imx-sdma: Add missing struct documentation dmaengine: sf-pdma: Add multithread support for a DMA channel dt-bindings: dma: dw-axi-dmac: extend the number of interrupts dmaengine: dmatest: use strscpy to replace strlcpy dmaengine: ste_dma40: fix typo in comment dmaengine: jz4780: fix typo in comment dmaengine: s3c24xx: fix typo in comment ... commit 36001a2fa6cc63d58664a2a99b90a864f9eb587a Merge: 37644cac6e829 08fc500fe3d4b Author: Linus Torvalds Date: Thu Aug 4 18:40:08 2022 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "The clk core gains a new set of APIs that allow drivers to both acquire clks and prepare and enable them at the same time. This also comes with devm support so that drivers can make a single call to get and prepare and enable the clk and have that all undone when their driver is removed. Many folks have requested this feature over the years, but we've had disagreements about how to implement it and if it was worthwhile to encourage drivers to use such an API. Now it's here, so let's see how it goes. I hope that by introducing this API we can identify drivers that would benefit from further consolidation of clk API usage, possibly by moving such logic to the bus layer and out of drivers altogether. Outside of that major API update, we have the usual collection of driver updates. A few new SoCs are supported, mostly Qualcomm and Renesas this time around. Then we have the long tail of non-critical fixes and minor feature additions to various clk drivers. And finally more clk provider migration to struct clk_parent_data, reducing boot times in the process. Summary: Core: - devm helpers for clk_get() + clk_prepare() and clk_enable() New Drivers: - Support for the camera clock controller in Qualcomm SM8450 and the display and gpu clock controllers in Qualcomm SM8350 - Add support for the Renesas RZ/Five SoC Updates: - Various fixes, new clocks and USB GDSCs are introduced for Qualcomm IPQ8074 - Fixes to Qualcomm MSM8939 for issues introduced by inheriting the MSM8916 GCC driver - Support for a new type of voteable GDSCs used by Qualcomm SC8280XP PCIe GDSCs - Qualcomm SC8280XP pipe clocks transitioned to the new phy-mux implementation - Qualcomm MSM8996 GCC, RPM clock driver and some clocks in MSM8994 GCC are migrated to use clk_parent_data - Corrected the topology for Titan (camera) GDSCs on Qualcomm SDM845 and SM8250 - Qualcomm MSM8916 gains more possible frequencies for its GP clocks. - The GCC and tsens handling on Qualcomm MSM8960 is reworked to mimic the design in IPQ8074 to allow the GCC driver to probe earlier. - The regulator based mmcx supply for Qualcomm dispcc and videocc is dropped, as the only upstream target that adapted this interface was transitioned several kernel versions ago - Qualcomm GDSCs found to be enabled at boot will now reflect in the enable count of the supply, as was done with the regulator supplies previously - Correct adc1, nic_media and edma1's parents for NXP i.MX93 - rdiv, mfd values, the return rate in recalc_rate and add more frequencies in the table for fracn-gppll on i.MX - Remove Allwinner workaround logic/compatible in fixed factor code - MediaTek clk driver cleanups - Add reset support to more MediaTek clk drivers - deduplicate Allwinner ccu_clks arrays - Allwinner H6 GPU DFS support - Adjust Allwinner Kconfig to limit choice - Fix initconst confusion on Renesas R-Car Gen4 - Add GPT/POEG (PWM) clocks and resets on Renesas RZ/G2L - Add PFC and WDT clocks and resets on Renesas RZ/V2M - Add thermal, SDHI, Z (CPU core), PCIe, and HSCIF (serial) clocks on Renesas R-Car S4-8" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (124 commits) clk: fixed-factor: Introduce *clk_hw_register_fixed_factor_parent_hw() clk: mux: Introduce devm_clk_hw_register_mux_parent_hws() clk: divider: Introduce devm_clk_hw_register_divider_parent_hw() clk: qcom: gcc-msm8994: use parent_hws for gpll0/4 clk: qcom: clk-rpm: convert to parent_data API dt-bindings: clock: fix wrong clock documentation for qcom,rpmcc clk: qcom: gcc-msm8939: Add missing USB HS system clock frequencies clk: qcom: gcc-msm8939: Add missing MDSS MDP clock frequencies clk: qcom: gcc-msm8939: Add missing CAMSS CPP clock frequencies clk: qcom: gcc-msm8939: Fix venus0_vcodec0_clk frequency definitions clk: qcom: gcc-msm8939: Add missing CAMSS CCI bus clock clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled clk: qcom: Drop mmcx gdsc supply for dispcc and videocc clk: qcom: fix build error initializer element is not constant clk: sprd: Add dt-bindings include file for UMS512 dt-bindings: clk: sprd: Add bindings for ums512 clock controller clk: sunxi-ng: sun50i: h6: Modify GPU clock configuration to support DFS dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources clk: qcom: add support for SM8350 DISPCC ... commit 37644cac6e8297d0908aef054caabb439c467c7d Merge: 5f0848190c6dd c4f0d16daa6d1 Author: Linus Torvalds Date: Thu Aug 4 18:34:05 2022 -0700 Merge tag 'gpio-updates-for-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "Here are the updates for this merge window from the GPIO subsystem. We have more lines removed than added thanks to dropping of a driver for a platform that's no longer supported. Otherwise the changes are pretty straightforward: support for some new models, various improvements to existing drivers, some tweaks to the core library code and DT bindings updates. Summary: - remove gpio-vr41xx driver as the only platform using it got dropped too - add support for suspend/resume to gpio-davinci - improvements to the GPIO character device code - add support for disabling bias for in-kernel users (up until now only user-space could set it) - drop unused devm_gpio_free() - fix a refcount issue in gpiolib OF - use device match helpers where applicable - add support for a new model to gpio-rockchip - non-functional improvements in gpio-adp5588 - improve and simplify teardown in gpio-twl4030 and gpio-ucb1400 - modernize the gpio-74xx-mmio and gpio-adnp drivers - coding style improvements in gpio-xilinx, gpio-104-idi-48 - support new model (pca9571) in gpio-pca9570 - convert the DT bindings to YAML for gpio-mvebu and update the document - don't return error codes from remove() in gpio-brcmstb - add a library for the intel 8255 PPI interface and use it in drivers - reduce using magic numbers and improve code readability in several drivers - convert DT bindings to YAML for gpio-tpic2810 - add new models to DT bindings for gpio-frl-imx - Kconfig improvements - other minor tweaks and improvements" * tag 'gpio-updates-for-v6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (52 commits) dt-bindings: gpio: fsl-imx-gpio: Add i.MXRT compatibles gpio: 74xx-mmio: Use bits instead of plain numbers for flags gpio: xilinx: add missing blank line after declarations MAINTAINERS: Update Intel 8255 GPIO driver file list gpio: gpio-mm: Implement and utilize register structures gpio: 104-idi-48: Implement and utilize register structures gpio: 104-dio-48e: Implement and utilize register structures gpio: i8255: Introduce the Intel 8255 interface library module gpio: 104-idio-16: Implement and utilize register structures gpio: ws16c48: Implement and utilize register structures gpio: remove VR41XX related gpio driver dt-bindings: gpio: add pull-disable flag gpiolib: acpi: support bias pull disable gpiolib: of: support bias pull disable gpiolib: add support for bias pull disable gpio: 74xx-mmio: use bits.h macros for all masks gpio: 74xx-mmio: Check MMIO_74XX_DIR_IN flag in mmio_74xx_dir_in() gpio: 74xx-mmio: Make use of device properties gpiolib: cdev: compile out HTE unless CONFIG_HTE selected gpiolib: cdev: consolidate edge detector configuration flags ... commit 5f0848190c6dd0f5b8a2aaf0f1d900a96d96bee0 Merge: 5bb3bf24b0aaa 3d46d78480757 Author: Linus Torvalds Date: Thu Aug 4 18:19:14 2022 -0700 Merge tag 'platform-drivers-x86-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: - Microsoft Surface: - SSAM hot unplug support - Surface Pro 8 keyboard cover support - Tablet mode switch support for Surface Pro 8 and Surface Laptop Studio - thinkpad_acpi: - AMD Automatice Mode Transitions (AMT) support - Mellanox: - Vulcan chassis COMe NVSwitch management support - XH3000 support - New generic/shared Intel P2SB (Primary to Sideband) support - Lots of small cleanups - Various small bugfixes - Various new hardware ids / quirks additions * tag 'platform-drivers-x86-v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (105 commits) platform/x86/intel/vsec: Fix wrong type for local status variables platform/x86: p2sb: Move out of X86_PLATFORM_DEVICES dependency platform/x86: pmc_atom: Fix comment typo platform/surface: gpe: Add support for 13" Intel version of Surface Laptop 4 platform/olpc: Fix uninitialized data in debugfs write platform/mellanox: mlxreg-lc: Fix error flow and extend verbosity platform/x86: pmc_atom: Match all Lex BayTrail boards with critclk_systems DMI table platform/x86: sony-laptop: Remove useless comparisons in sony_pic_read_possible_resource() tools/power/x86/intel-speed-select: Remove unneeded semicolon tools/power/x86/intel-speed-select: Fix off by one check platform/surface: tabletsw: Fix __le32 integer access Documentation/ABI: Add new attributes for mlxreg-io sysfs interfaces Documentation/ABI: mlxreg-io: Fix contact info platform/mellanox: mlxreg-io: Add locking for io operations platform/x86: mlx-platform: Add COME board revision register platform/x86: mlx-platform: Add support for new system XH3000 platform/x86: mlx-platform: Introduce support for COMe NVSwitch management module for Vulcan chassis platform/x86: mlx-platform: Add support for systems equipped with two ASICs platform/x86: mlx-platform: Add cosmetic changes for alignment platform/x86: mlx-platform: Make activation of some drivers conditional ... commit 5bb3bf24b0aaa76253c77e437b88927a32a10c4e Merge: da8d07af4b3e2 afef1e1a02236 Author: Linus Torvalds Date: Thu Aug 4 18:13:19 2022 -0700 Merge tag 'tag-chrome-platform-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "cros_ec_proto: - Leverage Kunit and add Kunit test cases - Clean-ups - Fix typo cros_ec_commands: - Fix typo - Fix compile errors cros_kbd_led_backlight: - Support OF match - Support EC PWM backend cros_ec: - Always expose the last resume result to fix sleep hang detection on ARM-based chromebooks wilco_ec: - Fix typo cros_ec_typec: - Clean-ups - Use Type-C framework utilities to manage altmode structs" * tag 'tag-chrome-platform-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (59 commits) platform/chrome: cros_kunit_util: add default value for `msg->result` platform/chrome: merge Kunit utils and test cases platform/chrome: cros_kbd_led_backlight: fix build warning platform/chrome: cros_ec_proto: add Kunit test for cros_ec_cmd() platform/chrome: cros_ec_proto: add Kunit tests for get_sensor_count platform/chrome: cros_ec_proto: add Kunit tests for check_features platform/chrome: cros_ec_proto: add Kunit tests for get_host_event platform/chrome: cros_ec_proto: add Kunit tests for get_next_event platform/chrome: cros_ec_proto: add Kunit test for cros_ec_map_error() platform/chrome: cros_ec_proto: add Kunit tests for cmd_xfer_status platform/chrome: cros_ec_proto: return -EPROTO if empty payload platform/chrome: cros_ec_proto: add Kunit test for empty payload platform/chrome: cros_ec_proto: return -EAGAIN when retries timed out platform/chrome: cros_ec_proto: change Kunit expectation when timed out platform/chrome: cros_ec_proto: separate cros_ec_wait_until_complete() platform/chrome: cros_ec_proto: separate cros_ec_xfer_command() platform/chrome: cros_ec_proto: add Kunit tests for cros_ec_send_command() platform/chrome: cros_ec_proto: add Kunit tests for cros_ec_cmd_xfer() platform/chrome: cros_ec_proto: add "cros_ec_" prefix to send_command() platform/chrome: cros_ec_typec: Register port altmodes ... commit da8d07af4b3e2e407c5dd13f08b64580931fd1a6 Merge: 8d9420ca9bd9b 7e7a24c3c6c98 Author: Linus Torvalds Date: Thu Aug 4 18:08:34 2022 -0700 Merge tag 'devicetree-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "Bindings: - Add spi-peripheral-props.yaml references to various SPI device bindings - Convert qcom,pm8916-wdt, ds1307, Qualcomm BAM DMA, is31fl319x, skyworks,aat1290, Rockchip EMAC, gpio-ir-receiver, ahci-ceva, Arm CCN PMU, rda,8810pl-intc, sil,sii9022, ps2-gpio, and arm-firmware-suite bindings to DT schema format - New bindings for Arm virtual platforms display, Qualcomm IMEM memory region, Samsung S5PV210 ChipID, EM Microelectronic EM3027 RTC, and arm,cortex-a78ae - Add vendor prefixes for asrock, bytedance, hxt, ingrasys, inventec, quanta, and densitron - Add missing MSI and IOMMU properties to host-generic-pci - Remove bindings for removed EFM32 platform - Remove old chosen.txt binding (replaced by schema) - Treewide add missing type information for properties - Treewide fixing of typos and its vs. it's in bindings. Its all good now. - Drop unnecessary quoting in power related schemas - Several LED binding updates which didn't get picked up - Move various bindings to proper directories DT core code: - Convert unittest GPIO related tests to use fwnode - Check ima-kexec-buffer against memory bounds - Print reserved-memory allocation/reservation failures as errors - Cleanup early_init_dt_reserve_memory_arch() - Simplify of_overlay_fdt_apply() tail" * tag 'devicetree-for-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (65 commits) dt-bindings: mtd: microchip,mchp48l640: use spi-peripheral-props.yaml dt-bindings: power: supply: drop quotes when not needed dt-bindings: power: reset: drop quotes when not needed dt-bindings: power: drop quotes when not needed dt-bindings: PCI: host-generic-pci: Allow IOMMU and MSI properties of/fdt: declared return type does not match actual return type devicetree/bindings: correct possessive "its" typos dt-bindings: net: convert emac_rockchip.txt to YAML dt-bindings: eeprom: microchip,93lc46b: move to eeprom directory dt-bindings: eeprom: at25: use spi-peripheral-props.yaml dt-bindings: display: use spi-peripheral-props.yaml dt-bindings: watchdog: qcom,pm8916-wdt: convert to dtschema dt-bindings: power: reset: qcom,pon: use absolute path to other schema dt-bindings: iio/dac: adi,ad5766: Add missing type to 'output-range-microvolts' dt-bindings: power: supply: charger-manager: Add missing type for 'cm-battery-stat' dt-bindings: panel: raydium,rm67191: Add missing type to 'video-mode' of/fdt: Clean up early_init_dt_reserve_memory_arch() dt-bindings: PCI: fsl,imx6q-pcie: Add missing type for 'reset-gpio-active-high' dt-bindings: rtc: Add EM Microelectronic EM3027 bindings dt-bindings: rtc: ds1307: Convert to json-schema ... commit 8d9420ca9bd9bceddcfab3d0263d6a8e073396fe Merge: c040862bfbd9c a60885b6a97b5 Author: Linus Torvalds Date: Thu Aug 4 18:04:28 2022 -0700 Merge tag 'for-linus-2022080201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - support for AMD SOCs using SFH1.1 memory access (Basavaraj Natikar) - XP-PEN Deco L support (José Expósito) - support for Elan eKTH6915 touchscreens (Douglas Anderson) - other small assorted fixes and device ID additions * tag 'for-linus-2022080201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits) HID: amd_sfh: Handle condition of "no sensors" HID: amd_sfh: Fix implicit declaration error on i386 HID: apple: Add "GANSS" to the non-Apple list HID: alps: Declare U1_UNICORN_LEGACY support HID: wacom: Force pen out of prox if no events have been received in a while HID: nintendo: Add missing array termination HID: lg-g15: Fix comment typo HID: amd_sfh: Implement SFH1.1 functionality HID: amd_sfh: Move interrupt handling to common interface HID: amd_sfh: Move amd_sfh_work to common interface HID: amd_sfh: Move global functions to static HID: amd_sfh: Add remove operation in amd_mp2_ops HID: amd_sfh: Add PM operations in amd_mp2_ops HID: amd_sfh: Add descriptor operations in amd_mp2_ops HID: amd_sfh: Move request_list variable to client data HID: amd_sfh: Move request_list struct to header file HID: amd_sfh: Move common macros and structures HID: amd_sfh: Add NULL check for hid device HID: core: remove unneeded assignment in hid_process_report() ID: intel-ish-hid: hid-client: drop unexpected word "the" in the comments ... commit e2dcac2f58f5a95ab092d1da237ffdc0da1832cf Author: Jinghao Jia Date: Fri Jul 29 20:17:13 2022 +0000 BPF: Fix potential bad pointer dereference in bpf_sys_bpf() The bpf_sys_bpf() helper function allows an eBPF program to load another eBPF program from within the kernel. In this case the argument union bpf_attr pointer (as well as the insns and license pointers inside) is a kernel address instead of a userspace address (which is the case of a usual bpf() syscall). To make the memory copying process in the syscall work in both cases, bpfptr_t was introduced to wrap around the pointer and distinguish its origin. Specifically, when copying memory contents from a bpfptr_t, a copy_from_user() is performed in case of a userspace address and a memcpy() is performed for a kernel address. This can lead to problems because the in-kernel pointer is never checked for validity. The problem happens when an eBPF syscall program tries to call bpf_sys_bpf() to load a program but provides a bad insns pointer -- say 0xdeadbeef -- in the bpf_attr union. The helper calls __sys_bpf() which would then call bpf_prog_load() to load the program. bpf_prog_load() is responsible for copying the eBPF instructions to the newly allocated memory for the program; it creates a kernel bpfptr_t for insns and invokes copy_from_bpfptr(). Internally, all bpfptr_t operations are backed by the corresponding sockptr_t operations, which performs direct memcpy() on kernel pointers for copy_from/strncpy_from operations. Therefore, the code is always happy to dereference the bad pointer to trigger a un-handle-able page fault and in turn an oops. However, this is not supposed to happen because at that point the eBPF program is already verified and should not cause a memory error. Sample KASAN trace: [ 25.685056][ T228] ================================================================== [ 25.685680][ T228] BUG: KASAN: user-memory-access in copy_from_bpfptr+0x21/0x30 [ 25.686210][ T228] Read of size 80 at addr 00000000deadbeef by task poc/228 [ 25.686732][ T228] [ 25.686893][ T228] CPU: 3 PID: 228 Comm: poc Not tainted 5.19.0-rc7 #7 [ 25.687375][ T228] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS d55cb5a 04/01/2014 [ 25.687991][ T228] Call Trace: [ 25.688223][ T228] [ 25.688429][ T228] dump_stack_lvl+0x73/0x9e [ 25.688747][ T228] print_report+0xea/0x200 [ 25.689061][ T228] ? copy_from_bpfptr+0x21/0x30 [ 25.689401][ T228] ? _printk+0x54/0x6e [ 25.689693][ T228] ? _raw_spin_lock_irqsave+0x70/0xd0 [ 25.690071][ T228] ? copy_from_bpfptr+0x21/0x30 [ 25.690412][ T228] kasan_report+0xb5/0xe0 [ 25.690716][ T228] ? copy_from_bpfptr+0x21/0x30 [ 25.691059][ T228] kasan_check_range+0x2bd/0x2e0 [ 25.691405][ T228] ? copy_from_bpfptr+0x21/0x30 [ 25.691734][ T228] memcpy+0x25/0x60 [ 25.692000][ T228] copy_from_bpfptr+0x21/0x30 [ 25.692328][ T228] bpf_prog_load+0x604/0x9e0 [ 25.692653][ T228] ? cap_capable+0xb4/0xe0 [ 25.692956][ T228] ? security_capable+0x4f/0x70 [ 25.693324][ T228] __sys_bpf+0x3af/0x580 [ 25.693635][ T228] bpf_sys_bpf+0x45/0x240 [ 25.693937][ T228] bpf_prog_f0ec79a5a3caca46_bpf_func1+0xa2/0xbd [ 25.694394][ T228] bpf_prog_run_pin_on_cpu+0x2f/0xb0 [ 25.694756][ T228] bpf_prog_test_run_syscall+0x146/0x1c0 [ 25.695144][ T228] bpf_prog_test_run+0x172/0x190 [ 25.695487][ T228] __sys_bpf+0x2c5/0x580 [ 25.695776][ T228] __x64_sys_bpf+0x3a/0x50 [ 25.696084][ T228] do_syscall_64+0x60/0x90 [ 25.696393][ T228] ? fpregs_assert_state_consistent+0x50/0x60 [ 25.696815][ T228] ? exit_to_user_mode_prepare+0x36/0xa0 [ 25.697202][ T228] ? syscall_exit_to_user_mode+0x20/0x40 [ 25.697586][ T228] ? do_syscall_64+0x6e/0x90 [ 25.697899][ T228] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 25.698312][ T228] RIP: 0033:0x7f6d543fb759 [ 25.698624][ T228] Code: 08 5b 89 e8 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 97 a6 0e 00 f7 d8 64 89 01 48 [ 25.699946][ T228] RSP: 002b:00007ffc3df78468 EFLAGS: 00000287 ORIG_RAX: 0000000000000141 [ 25.700526][ T228] RAX: ffffffffffffffda RBX: 00007ffc3df78628 RCX: 00007f6d543fb759 [ 25.701071][ T228] RDX: 0000000000000090 RSI: 00007ffc3df78478 RDI: 000000000000000a [ 25.701636][ T228] RBP: 00007ffc3df78510 R08: 0000000000000000 R09: 0000000000300000 [ 25.702191][ T228] R10: 0000000000000005 R11: 0000000000000287 R12: 0000000000000000 [ 25.702736][ T228] R13: 00007ffc3df78638 R14: 000055a1584aca68 R15: 00007f6d5456a000 [ 25.703282][ T228] [ 25.703490][ T228] ================================================================== [ 25.704050][ T228] Disabling lock debugging due to kernel taint Update copy_from_bpfptr() and strncpy_from_bpfptr() so that: - for a kernel pointer, it uses the safe copy_from_kernel_nofault() and strncpy_from_kernel_nofault() functions. - for a userspace pointer, it performs copy_from_user() and strncpy_from_user(). Fixes: af2ac3e13e45 ("bpf: Prepare bpf syscall to be used from kernel and user space.") Link: https://lore.kernel.org/bpf/20220727132905.45166-1-jinghao@linux.ibm.com/ Signed-off-by: Jinghao Jia Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20220729201713.88688-1-jinghao@linux.ibm.com Signed-off-by: Alexei Starovoitov commit c040862bfbd9c5f3cb64e1df1c623e20e38fe656 Merge: 995177a4c75ee 0847d167d0f9b Author: Linus Torvalds Date: Thu Aug 4 15:35:58 2022 -0700 Merge tag 'xtensa-20220804' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa updates from Max Filippov: - support KCOV - enable ARCH_HAS_GCOV_PROFILE_ALL - minor ISS network driver cleanups * tag 'xtensa-20220804' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: enable ARCH_HAS_GCOV_PROFILE_ALL xtensa: enable KCOV support xtensa: iss: fix handling error cases in iss_net_configure() xtensa: iss/network: provide release() callback xtensa: iss/network: drop 'devices' list commit 995177a4c75ee9b9069d5a313d90c005cf89c1b2 Merge: 7df9075e232e0 f2d3b9a46e0ed Author: Linus Torvalds Date: Thu Aug 4 15:31:09 2022 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: "Not much this time around, the 5.20-rc1 development updates for arm are: - add KASAN support for vmalloc space on arm - some sparse fixes from Ben Dooks - rework amba device handling (so device addition isn't deferred)" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9220/1: amba: Remove deferred device addition ARM: 9219/1: fix undeclared soft_restart ARM: 9218/1: dma-mapping: fix pointer/integer warning ARM: 9217/1: add definition of arch_irq_work_raise() ARM: 9203/1: kconfig: fix MODULE_PLTS for KASAN with KASAN_VMALLOC ARM: 9202/1: kasan: support CONFIG_KASAN_VMALLOC commit 7df9075e232e09d99cf23b657b6cb04c9506e618 Merge: 25e6bed5a6483 45fef4c4b9c94 Author: Linus Torvalds Date: Thu Aug 4 15:27:20 2022 -0700 Merge tag 'csky-for-linus-6.0-rc1' of https://github.com/c-sky/csky-linux Pull csky updates from Guo Ren: - Add jump-label implementation - Add qspinlock support - Enable ARCH_INLINE_READ*/WRITE*/SPIN* - Some fixups and a coding convention * tag 'csky-for-linus-6.0-rc1' of https://github.com/c-sky/csky-linux: csky: abiv1: Fixup compile error csky: cmpxchg: Coding convention for BUILD_BUG() csky: Enable ARCH_INLINE_READ*/WRITE*/SPIN* csky: Add qspinlock support csky: Add jump-label implementation csky: Move HEAD_TEXT_SECTION out of __init_begin-end csky: Correct position of _stext csky: Use the bitmap API to allocate bitmaps csky/kprobe: reclaim insn_slot on kprobe unregistration commit 25e6bed5a64836621e41bc9f9d97eb79f1bdfa1e Merge: 7447691ef994f 2fb0ec4ae5632 Author: Linus Torvalds Date: Thu Aug 4 15:20:39 2022 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 Pull AVR32 updates from Hans-Christian Noren Egtvedt: "Mostly changes to documentation and comments" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32: video:backlight: remove reference to AVR32 architecture in ltv350qv video: remove support for non-existing atmel,at32ap-lcdc in atmel_lcdfb usb:udc: remove reference to AVR32 architecture in Atmel USBA Kconfig sound:spi: remove reference to AVR32 in Atmel AT73C213 DAC driver net: remove cdns,at32ap7000-macb device tree entry misc: update maintainer email address and description for atmel-ssc mfd: remove reference to AVR32 architecture in atmel-smc.c dma:dw: remove reference to AVR32 architecture in core.c commit bc792884b76f0da2f5c9a8d720e430e2de9756f5 Author: Eric Farman Date: Thu Aug 4 23:39:26 2022 +0200 s390/dasd: Establish DMA alignment linux-next commit bf8d08532bc1 ("iomap: add support for dma aligned direct-io") changes the alignment requirement to come from the block device rather than the block size, and the default alignment requirement is 512-byte boundaries. Since DASD I/O has page alignments for IDAW/TIDAW requests, let's override this value to restore the expected behavior. Make this change for both ECKD and DIAG disciplines, as they both would fall into this category. Leave FBA alone, since it is always comprised of 512-byte blocks. Signed-off-by: Eric Farman Acked-by: Halil Pasic Reviewed-by: Stefan Haberland Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20220804213926.3361574-3-sth@linux.ibm.com Signed-off-by: Jens Axboe commit bcee43dc6d5bd6f54e5e2a5d696bf8c8f4c141dd Author: Jiang Jian Date: Thu Aug 4 23:39:25 2022 +0200 s390/dasd: drop unexpected word 'for' in comments there is an unexpected word 'for' in the comments that need to be dropped file - drivers/s390/block/dasd.c line - 1728 /* check for for attention message */ changed to: /* check for attention message */ Signed-off-by: Jiang Jian Link: https://lore.kernel.org/r/20220623102114.33249-1-jiangjian@cdjrlc.com Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20220804213926.3361574-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 7447691ef994ffd8072809a11ca9167a2d91564f Merge: 7c5c3a6177fa9 251e90e7e346a Author: Linus Torvalds Date: Thu Aug 4 15:10:55 2022 -0700 Merge tag 'for-linus-6.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - a series fine tuning virtio support for Xen guests, including removal the now again unused "platform_has()" feature. - a fix for host admin triggered reboot of Xen guests - a simple spelling fix * tag 'for-linus-6.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: don't require virtio with grants for non-PV guests kernel: remove platform_has() infrastructure virtio: replace restricted mem access flag with callback xen: Fix spelling mistake xen/manage: Use orderly_reboot() to reboot commit 7c5c3a6177fa9646884114fc7f2e970b0bc50dc9 Merge: f0a892f599c46 281106f938d3d Author: Linus Torvalds Date: Thu Aug 4 14:59:54 2022 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "Quite a large pull request due to a selftest API overhaul and some patches that had come in too late for 5.19. ARM: - Unwinder implementations for both nVHE modes (classic and protected), complete with an overflow stack - Rework of the sysreg access from userspace, with a complete rewrite of the vgic-v3 view to allign with the rest of the infrastructure - Disagregation of the vcpu flags in separate sets to better track their use model. - A fix for the GICv2-on-v3 selftest - A small set of cosmetic fixes RISC-V: - Track ISA extensions used by Guest using bitmap - Added system instruction emulation framework - Added CSR emulation framework - Added gfp_custom flag in struct kvm_mmu_memory_cache - Added G-stage ioremap() and iounmap() functions - Added support for Svpbmt inside Guest s390: - add an interface to provide a hypervisor dump for secure guests - improve selftests to use TAP interface - enable interpretive execution of zPCI instructions (for PCI passthrough) - First part of deferred teardown - CPU Topology - PV attestation - Minor fixes x86: - Permit guests to ignore single-bit ECC errors - Intel IPI virtualization - Allow getting/setting pending triple fault with KVM_GET/SET_VCPU_EVENTS - PEBS virtualization - Simplify PMU emulation by just using PERF_TYPE_RAW events - More accurate event reinjection on SVM (avoid retrying instructions) - Allow getting/setting the state of the speaker port data bit - Refuse starting the kvm-intel module if VM-Entry/VM-Exit controls are inconsistent - "Notify" VM exit (detect microarchitectural hangs) for Intel - Use try_cmpxchg64 instead of cmpxchg64 - Ignore benign host accesses to PMU MSRs when PMU is disabled - Allow disabling KVM's "MONITOR/MWAIT are NOPs!" behavior - Allow NX huge page mitigation to be disabled on a per-vm basis - Port eager page splitting to shadow MMU as well - Enable CMCI capability by default and handle injected UCNA errors - Expose pid of vcpu threads in debugfs - x2AVIC support for AMD - cleanup PIO emulation - Fixes for LLDT/LTR emulation - Don't require refcounted "struct page" to create huge SPTEs - Miscellaneous cleanups: - MCE MSR emulation - Use separate namespaces for guest PTEs and shadow PTEs bitmasks - PIO emulation - Reorganize rmap API, mostly around rmap destruction - Do not workaround very old KVM bugs for L0 that runs with nesting enabled - new selftests API for CPUID Generic: - Fix races in gfn->pfn cache refresh; do not pin pages tracked by the cache - new selftests API using struct kvm_vcpu instead of a (vm, id) tuple" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (606 commits) selftests: kvm: set rax before vmcall selftests: KVM: Add exponent check for boolean stats selftests: KVM: Provide descriptive assertions in kvm_binary_stats_test selftests: KVM: Check stat name before other fields KVM: x86/mmu: remove unused variable RISC-V: KVM: Add support for Svpbmt inside Guest/VM RISC-V: KVM: Use PAGE_KERNEL_IO in kvm_riscv_gstage_ioremap() RISC-V: KVM: Add G-stage ioremap() and iounmap() functions KVM: Add gfp_custom flag in struct kvm_mmu_memory_cache RISC-V: KVM: Add extensible CSR emulation framework RISC-V: KVM: Add extensible system instruction emulation framework RISC-V: KVM: Factor-out instruction emulation into separate sources RISC-V: KVM: move preempt_disable() call in kvm_arch_vcpu_ioctl_run RISC-V: KVM: Make kvm_riscv_guest_timer_init a void function RISC-V: KVM: Fix variable spelling mistake RISC-V: KVM: Improve ISA extension by using a bitmap KVM, x86/mmu: Fix the comment around kvm_tdp_mmu_zap_leafs() KVM: SVM: Dump Virtual Machine Save Area (VMSA) to klog KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT KVM: x86: Do not block APIC write for non ICR registers ... commit 8fcf19696a1bdbabb7774e8d063ee4af91833402 Author: Paul E. McKenney Date: Tue Aug 2 10:39:13 2022 -0700 bpf: Update bpf_design_QA.rst to clarify that BTF_ID does not ABIify a function This patch updates bpf_design_QA.rst to clarify that mentioning a function to the BTF_ID macro does not make that function become part of the Linux kernel's ABI. Suggested-by: Alexei Starovoitov Signed-off-by: Paul E. McKenney Link: https://lore.kernel.org/r/20220802173913.4170192-3-paulmck@kernel.org Signed-off-by: Alexei Starovoitov commit 62fc770d90ef5a92931deb477c384f82be122a18 Author: Paul E. McKenney Date: Tue Aug 2 10:39:12 2022 -0700 bpf: Update bpf_design_QA.rst to clarify that attaching to functions is not ABI This patch updates bpf_design_QA.rst to clarify that the ability to attach a BPF program to an arbitrary function in the kernel does not make that function become part of the Linux kernel's ABI. [ paulmck: Apply Daniel Borkmann feedback. ] Signed-off-by: Paul E. McKenney Link: https://lore.kernel.org/r/20220802173913.4170192-2-paulmck@kernel.org Signed-off-by: Alexei Starovoitov commit b9b738eeafe54d960ccb240fc1b0c5031a0d76f5 Author: Paul E. McKenney Date: Tue Aug 2 10:39:11 2022 -0700 bpf: Update bpf_design_QA.rst to clarify that kprobes is not ABI This patch updates bpf_design_QA.rst to clarify that the ability to attach a BPF program to a given point in the kernel code via kprobes does not make that attachment point be part of the Linux kernel's ABI. Signed-off-by: Paul E. McKenney Link: https://lore.kernel.org/r/20220802173913.4170192-1-paulmck@kernel.org Signed-off-by: Alexei Starovoitov commit 12907efde6ad984f2d76cc1a7dbaae132384d8a5 Author: Mike Snitzer Date: Thu Aug 4 15:55:57 2022 -0400 dm verity: have verify_wq use WQ_HIGHPRI if "try_verify_in_tasklet" Allow verify_wq to preempt softirq since verification in tasklet will fall-back to using it for error handling (or if the bufio cache doesn't have required hashes). Suggested-by: Nathan Huckleberry Signed-off-by: Mike Snitzer commit f0a892f599c46af673e47418c47c15e69a7b67f4 Author: Sudip Mukherjee Date: Thu Aug 4 19:01:46 2022 +0100 drm/amd/amdgpu: fix build failure due to implicit declaration The builds for alpha and mips allmodconfig fails with the error: drivers/gpu/drm/amd/amdgpu/psp_v13_0.c:534:23: error: implicit declaration of function 'vmalloc'; did you mean 'kvmalloc'? [-Werror=implicit-function-declaration] drivers/gpu/drm/amd/amdgpu/psp_v13_0.c:534:21: error: assignment to 'void *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion] drivers/gpu/drm/amd/amdgpu/psp_v13_0.c:545:33: error: implicit declaration of function 'vfree'; did you mean 'kvfree'? [-Werror=implicit-function-declaration] Add the header file for vmalloc and vfree. Reported-by: Sudip Mukherjee Suggested-by: Linus Torvalds Signed-off-by: Sudip Mukherjee Signed-off-by: Linus Torvalds commit c1c76700a0d6e6090ccfe1209527f14c21b6681b Merge: 723c188d5cd42 58301e1c15db8 Author: Linus Torvalds Date: Thu Aug 4 12:12:54 2022 -0700 Merge tag 'spdx-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX updates from Greg KH: "Here is the set of SPDX comment updates for 6.0-rc1. Nothing huge here, just a number of updated SPDX license tags and cleanups based on the review of a number of common patterns in GPLv2 boilerplate text. Also included in here are a few other minor updates, two USB files, and one Documentation file update to get the SPDX lines correct. All of these have been in the linux-next tree for a very long time" * tag 'spdx-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: (28 commits) Documentation: samsung-s3c24xx: Add blank line after SPDX directive x86/crypto: Remove stray comment terminator treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_406.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_398.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_391.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_385.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_319.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_318.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_298.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_292.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_179.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 2) treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_160.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_152.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_149.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_147.RULE treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_133.RULE ... commit 723c188d5cd42a07344f997b0b7e1d83b4173c8d Merge: 78acd4ca43342 87f600af59e8c Author: Linus Torvalds Date: Thu Aug 4 12:01:42 2022 -0700 Merge tag 'staging-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver patches for 6.0-rc1. Another round where we removed more lines of code than added, always a nice progression. Some of that came from the movement of the vme code back into staging, and removal of some other of the vme driver code as there are no known users and it is very obsolete and unmaintained. It can be added back easily if someone offers to maintain it. Other than that this merge has lots of little things: - huge cleanups for r8188eu driver - minor cleanups for other wifi drivers - tiny loop fixes for greybus code - other small coding style fixes All of these have been in linux-next for a while with no reported issues" * tag 'staging-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (191 commits) staging: r8188eu: fix potential uninitialised variable use in rtw_pwrctrl.c staging: r8188eu: remove initializer from ret in rtw_pwr_wakeup staging: vt6655: Convert macro vt6655_mac_clear_stck_ds to function staging: vt6655: Rename MACvClearStckDS staging: fbtft: core: set smem_len before fb_deferred_io_init call staging: r8188eu: convert rtw_pwr_wakeup to correct error code semantics staging: r8188eu: make dump_chip_info() static staging: r8188eu: remove DoReserved prototype staging: r8188eu: remove OnAtim prototype staging: r8188eu: remove SetHwReg8188EU() staging: r8188eu: make update_TSF() and correct_TSF() static staging: r8188eu: remove unused parameter from update_TSF() staging: r8188eu: remove unused parameter from correct_TSF() staging: r8188eu: remove HW_VAR_SET_OPMODE from SetHwReg8188EU() staging: pi433: remove duplicated comments staging: qlge: refine variable name staging: vt6655: Convert macro vt6655_mac_word_reg_bits_off to function staging: vt6655: Convert macro vt6655_mac_reg_bits_off to function staging: vt6655: Convert macro vt6655_mac_word_reg_bits_on to function staging: vt6655: Convert macro vt6655_mac_reg_bits_on to function ... commit 78acd4ca433425e6dd4032cfc2156c60e34931f2 Author: Nathan Chancellor Date: Wed Aug 3 09:24:22 2022 -0700 usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() Clang warns: drivers/usb/cdns3/cdns3-gadget.c:2290:11: error: variable 'priv_dev' is uninitialized when used here [-Werror,-Wuninitialized] dev_dbg(priv_dev->dev, "usbss: invalid parameters\n"); ^~~~~~~~ include/linux/dev_printk.h:155:18: note: expanded from macro 'dev_dbg' dynamic_dev_dbg(dev, dev_fmt(fmt), ##__VA_ARGS__) ^~~ include/linux/dynamic_debug.h:167:7: note: expanded from macro 'dynamic_dev_dbg' dev, fmt, ##__VA_ARGS__) ^~~ include/linux/dynamic_debug.h:152:56: note: expanded from macro '_dynamic_func_call' __dynamic_func_call(__UNIQUE_ID(ddebug), fmt, func, ##__VA_ARGS__) ^~~~~~~~~~~ include/linux/dynamic_debug.h:134:15: note: expanded from macro '__dynamic_func_call' func(&id, ##__VA_ARGS__); \ ^~~~~~~~~~~ drivers/usb/cdns3/cdns3-gadget.c:2278:31: note: initialize the variable 'priv_dev' to silence this warning struct cdns3_device *priv_dev; ^ = NULL 1 error generated. The priv_dev assignment was moved below the if statement to avoid potentially dereferencing ep before it was checked but priv_dev is used in the dev_dbg() call. To fix this, move the priv_dev and comp_desc assignments back to their original spot and hoist the ep check above those assignments with a call to pr_debug() instead of dev_dbg(). Fixes: c3ffc9c4ca44 ("usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()") Link: https://github.com/ClangBuiltLinux/linux/issues/1680 Signed-off-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 43fa47cb116daa48f731fa5c00d781200addb2ae Author: Mike Snitzer Date: Thu Aug 4 14:53:07 2022 -0400 dm verity: remove WQ_CPU_INTENSIVE flag since using WQ_UNBOUND The documentation [1] says that WQ_CPU_INTENSIVE is "meaningless" for unbound wq. So remove WQ_CPU_INTENSIVE from the verify_wq allocation. 1. https://www.kernel.org/doc/html/latest/core-api/workqueue.html#flags Suggested-by: Maksym Planeta Signed-off-by: Mike Snitzer commit 9e2e5ea3b28f81512c792f30729edb1db0c21f6a Merge: cfeafd9466891 8288c99fc263b Author: Linus Torvalds Date: Thu Aug 4 11:41:28 2022 -0700 Merge tag 'usb-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of Thunderbolt and USB changes for 6.0-rc1. Lots of little things here, nothing major, just constant development on some new hardware support and cleanups of older drivers. Highlights are: - lots of typec changes and improvements for new hardware - new gadget controller driver - thunderbolt support for new hardware - the normal set of new usb-serial device ids and cleanups - loads of dwc3 controller fixes and improvements - mtu3 driver updates - testusb fixes for longtime issues (not many people use this tool it seems.) - minor driver fixes and improvements over the USB tree - chromeos platform driver changes were added and then reverted as they depened on some typec changes, but the cross-tree merges caused problems so they will come back later through the platform tree. All of these have been in linux-next for a while now with no reported issues" * tag 'usb-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (193 commits) usb: misc: onboard_usb_hub: Remove duplicated power_on delay usb: misc: onboard_usb_hub: Add TI USB8041 hub support usb: misc: onboard_usb_hub: Add reset-gpio support USB: usbsevseg: convert sysfs snprintf to sysfs_emit dt-bindings: usb: Add binding for TI USB8041 hub controller ARM: multi_v7_defconfig: enable USB onboard HUB driver ARM: dts: stm32: add support for USB2514B onboard hub on stm32mp15xx-dkx usb: misc: onboard-hub: add support for Microchip USB2514B USB 2.0 hub dt-bindings: usb: generic-ehci: allow usb-hcd schema properties usb: typec: ucsi: stm32g0: add bootloader support usb: typec: ucsi: stm32g0: add support for stm32g0 controller dt-bindings: usb: typec: add bindings for stm32g0 controller usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() usb/chipidea: fix repeated words in comments usb: renesas-xhci: Do not print any log while fw verif success usb: typec: retimer: Add missing id check in match callback USB: xhci: Fix comment typo usb/typec/tcpm: fix repeated words in comments usb/musb: fix repeated words in comments ... commit e9307e3deb52603c4f742624fa4799c7996422d8 Author: Mike Snitzer Date: Thu Aug 4 13:37:53 2022 -0400 dm verity: only copy bvec_iter in verity_verify_io if in_tasklet Avoid extra bvec_iter copy unless it is needed to allow retrying verification, that failed from a tasklet, from a workqueue. Signed-off-by: Mike Snitzer commit cfeafd94668910334a77c9437a18212baf9f5610 Merge: 228dfe98a313f 273aaa24369cb Author: Linus Torvalds Date: Thu Aug 4 11:31:20 2022 -0700 Merge tag 'driver-core-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core / kernfs updates from Greg KH: "Here is the set of driver core and kernfs changes for 6.0-rc1. The "biggest" thing in here is some scalability improvements for kernfs for large systems. Other than that, included in here are: - arch topology and cache info changes that have been reviewed and discussed a lot. - potential error path cleanup fixes - deferred driver probe cleanups - firmware loader cleanups and tweaks - documentation updates - other small things All of these have been in the linux-next tree for a while with no reported problems" * tag 'driver-core-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (63 commits) docs: embargoed-hardware-issues: fix invalid AMD contact email firmware_loader: Replace kmap() with kmap_local_page() sysfs docs: ABI: Fix typo in comment kobject: fix Kconfig.debug "its" grammar kernfs: Fix typo 'the the' in comment docs: driver-api: firmware: add driver firmware guidelines. (v3) arch_topology: Fix cache attributes detection in the CPU hotplug path ACPI: PPTT: Leave the table mapped for the runtime usage cacheinfo: Use atomic allocation for percpu cache attributes drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist MAINTAINERS: Change mentions of mpm to olivia docs: ABI: sysfs-devices-soc: Update Lee Jones' email address docs: ABI: sysfs-class-pwm: Update Lee Jones' email address Documentation/process: Add embargoed HW contact for LLVM Revert "kernfs: Change kernfs_notify_list to llist." ACPI: Remove the unused find_acpi_cpu_cache_topology() arch_topology: Warn that topology for nested clusters is not supported arch_topology: Add support for parsing sockets in /cpu-map arch_topology: Set cluster identifier in each core/thread from /cpu-map arch_topology: Limit span of cpu_clustergroup_mask() ... commit 228dfe98a313f6b6bff5da8b2c5e650e297ebf1a Merge: 798cd57cd5f87 b5276c9244977 Author: Linus Torvalds Date: Thu Aug 4 11:05:48 2022 -0700 Merge tag 'char-misc-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver updates from Greg KH: "Here is the large set of char and misc and other driver subsystem changes for 6.0-rc1. Highlights include: - large set of IIO driver updates, additions, and cleanups - new habanalabs device support added (loads of register maps much like GPUs have) - soundwire driver updates - phy driver updates - slimbus driver updates - tiny virt driver fixes and updates - misc driver fixes and updates - interconnect driver updates - hwtracing driver updates - fpga driver updates - extcon driver updates - firmware driver updates - counter driver update - mhi driver fixes and updates - binder driver fixes and updates - speakup driver fixes All of these have been in linux-next for a while without any reported problems" * tag 'char-misc-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (634 commits) drivers: lkdtm: fix clang -Wformat warning char: remove VR41XX related char driver misc: Mark MICROCODE_MINOR unused spmi: trace: fix stack-out-of-bound access in SPMI tracing functions dt-bindings: iio: adc: Add compatible for MT8188 iio: light: isl29028: Fix the warning in isl29028_remove() iio: accel: sca3300: Extend the trigger buffer from 16 to 32 bytes iio: fix iio_format_avail_range() printing for none IIO_VAL_INT iio: adc: max1027: unlock on error path in max1027_read_single_value() iio: proximity: sx9324: add empty line in front of bullet list iio: magnetometer: hmc5843: Remove duplicate 'the' iio: magn: yas530: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() macros iio: magnetometer: ak8974: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() macros iio: light: veml6030: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() macros iio: light: vcnl4035: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() macros iio: light: vcnl4000: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() macros iio: light: tsl2591: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() iio: light: tsl2583: Use DEFINE_RUNTIME_DEV_PM_OPS and pm_ptr() iio: light: isl29028: Use DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr() iio: light: gp2ap002: Switch to DEFINE_RUNTIME_DEV_PM_OPS and pm_ptr() ... commit 0a36463f4ca287e4d4ac15580c0aae5b23619212 Author: Mike Snitzer Date: Wed Aug 3 22:43:22 2022 -0400 dm verity: optimize verity_verify_io if FEC not configured Only declare and copy bvec_iter if CONFIG_DM_VERITY_FEC is defined and FEC enabled for the verity device. Signed-off-by: Mike Snitzer commit ba2cce82ba1ba74cd83bb3fd0e47849af4f2a605 Author: Mike Snitzer Date: Mon Jul 25 16:52:17 2022 -0400 dm verity: conditionally enable branching for "try_verify_in_tasklet" Use jump_label to limit the need for branching unless the optional "try_verify_in_tasklet" feature is used. Signed-off-by: Mike Snitzer commit 3c1c875d058669b4dee68f877ec8a65ad4ae8b5b Author: Mike Snitzer Date: Mon Jul 25 18:26:48 2022 -0400 dm bufio: conditionally enable branching for DM_BUFIO_CLIENT_NO_SLEEP Use jump_label to limit the need for branching unless the optional DM_BUFIO_CLIENT_NO_SLEEP is used. Signed-off-by: Mike Snitzer commit df326e7a06990bab011afc8c17de1ab2774e4bb8 Author: Mike Snitzer Date: Tue Jul 26 11:29:50 2022 -0400 dm verity: allow optional args to alter primary args handling The previous commit ("dm verity: Add optional "try_verify_in_tasklet" feature") imposed that CRYPTO_ALG_ASYNC mask be used even if the optional "try_verify_in_tasklet" feature was not specified. This was because verity_parse_opt_args() was called after handling the primary args (due to it having data dependencies on having first parsed all primary args). Enhance verity_ctr() so that simple optional args, that don't have a data dependency on primary args parsing, can alter how the primary args are handled. In practice this means verity_parse_opt_args() gets called twice. First with the new 'only_modifier_opts' arg set to true, then again with it set to false _after_ parsing all primary args. This allows the v->use_tasklet flag to be properly set and then used when verity_ctr() parses the primary args and then calls crypto_alloc_ahash() with CRYPTO_ALG_ASYNC conditionally set. Signed-off-by: Mike Snitzer commit 5721d4e5a9cdb148f681a004ae5748890a0e2d90 Author: Nathan Huckleberry Date: Fri Jul 22 09:38:23 2022 +0000 dm verity: Add optional "try_verify_in_tasklet" feature Using tasklets for disk verification can reduce IO latency. When there are accelerated hash instructions it is often better to compute the hash immediately using a tasklet rather than deferring verification to a work-queue. This reduces time spent waiting to schedule work-queue jobs, but requires spending slightly more time in interrupt context. If the dm-bufio cache does not have the required hashes we fallback to the work-queue implementation. FEC is only possible using work-queue because code to support the FEC feature may sleep. The following shows a speed comparison of random reads on a dm-verity device. The dm-verity device uses a 1G ramdisk for data and a 1G ramdisk for hashes. One test was run using tasklets and one test was run using the existing work-queue solution. Both tests were run when the dm-bufio cache was hot. The tasklet implementation performs significantly better since there is no time spent waiting for work-queue jobs to be scheduled. READ: bw=181MiB/s (190MB/s), 181MiB/s-181MiB/s (190MB/s-190MB/s), io=512MiB (537MB), run=2827-2827msec READ: bw=23.6MiB/s (24.8MB/s), 23.6MiB/s-23.6MiB/s (24.8MB/s-24.8MB/s), io=512MiB (537MB), run=21688-21688msec Signed-off-by: Nathan Huckleberry Signed-off-by: Mike Snitzer commit 798cd57cd5f871452461746032cf6ee50b0fd69a Author: Dave Airlie Date: Thu Aug 4 15:50:20 2022 +1000 drm/amd/display: restore code for plane with no modifiers When this file was split in commit 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes") this chunk seemed to get dropped. Linus noticed on this rx580 and I've reproduced on FIJI which makes sense as these are pre-modifier GPUs. With this applied, I get gdm back. Fixes: 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes") Signed-off-by: Dave Airlie Reported-and-tested-by: Linus Torvalds Reviewed-by: Harry Wentland Signed-off-by: Linus Torvalds commit c4f36c3ab065065a87d641ca2fd5d5c4eb2bfa82 Merge: 805f91bc52269 933c5a4f87d92 Author: Bjorn Helgaas Date: Thu Aug 4 11:46:53 2022 -0500 Merge branch 'pci/header-cleanup-immutable' - Remove pci_get_legacy_ide_irq(); use ATA_PRIMARY_IRQ() and ATA_SECONDARY_IRQ() instead (Stafford Horne) - Remove isa_dma_bridge_buggy, except for x86_32, the only place it's used (Stafford Horne) - Define ARCH_GENERIC_PCI_MMAP_RESOURCE for csky (Stafford Horne) - Move common PCI definitions that arches sometimes override to asm-generic/pci.h (Stafford Horne) - Include for 'isa_dma_bridge_buggy' when needed (bisection hole here) (Randy Dunlap) * pci/header-cleanup-immutable: PCI: Stub __pci_ioport_map() for arches that don't support it at all x86/cyrix: include header linux/isa-dma.h asm-generic: Add new pci.h and use it csky: PCI: Define ARCH_GENERIC_PCI_MMAP_RESOURCE PCI: Move isa_dma_bridge_buggy out of asm/dma.h PCI: Remove pci_get_legacy_ide_irq() and asm-generic/pci.h commit 805f91bc52269597c0808de260305a60309ae92e Merge: ed89d69a15066 6943f3e3ffe53 Author: Bjorn Helgaas Date: Thu Aug 4 11:46:53 2022 -0500 Merge branch 'pci/misc' - Drop of_match_ptr() to avoid unused variables when CONFIG_OF is unset (Bjorn Helgaas) - Fix ARM pci_remap_iospace() when CONFIG_MMU unset to avoid build errors (Pali Rohár) * pci/misc: PCI/ACPI: Update link to PCI firmware specification PCI: Drop of_match_ptr() to avoid unused variables commit ed89d69a150660f3268c05ad51e715cd9e3009da Merge: 56ebef0a82264 19b7858c3357d Author: Bjorn Helgaas Date: Thu Aug 4 11:46:52 2022 -0500 Merge branch 'pci/ctrl/pm-ops' - Convert to new *_PM_OPS macros to avoid need for "#ifdef CONFIG_PM_SLEEP" or "__maybe_unused" (Bjorn Helgaas) * pci/ctrl/pm-ops: PCI: Convert to new *_PM_OPS macros commit 56ebef0a82264835fd032f1716d72beabc424189 Merge: a91c6db7f3da7 4e6217e3af8ad Author: Bjorn Helgaas Date: Thu Aug 4 11:46:52 2022 -0500 Merge branch 'pci/ctrl/xilinx-cpm' - Add DT binding and driver support for Versal CPM5 Gen5 Root Port (Bharat Kumar Gogada) * pci/ctrl/xilinx-cpm: MAINTAINERS: Add Xilinx Versal CPM Root Port maintainers PCI: xilinx-cpm: Add support for Versal CPM5 Root Port dt-bindings: PCI: xilinx-cpm: Add Versal CPM5 Root Port commit a91c6db7f3da76ffcd4e809ecb28f118e7effb91 Merge: 64451ac83fe6a 57a128acaba02 Author: Bjorn Helgaas Date: Thu Aug 4 11:46:51 2022 -0500 Merge branch 'pci/ctrl/vmd' - Use devm_kasprintf() instead of simple kasprintf() (Subramanian Mohan) - Add [8086:7D0B] and [8086:AD0B] devices to VMD driver (Francisco Munoz) * pci/ctrl/vmd: PCI: vmd: Add DID 8086:7D0B and 8086:AD0B for Intel MTL SKUs PCI: vmd: Use devm_kasprintf() instead of simple kasprintf() commit 64451ac83fe6ab4be1f4385110921df7d433ec7e Merge: 085c2d6739ce4 a54e190737181 Author: Bjorn Helgaas Date: Thu Aug 4 11:46:51 2022 -0500 Merge branch 'pci/ctrl/tegra194' - Fix tegra_pcie_config_ep() power management in error path (Miaoqian Lin) - Convert DT binding to json-schema (Vidya Sagar) - Add DT bindings and driver support for Tegra234 Root Port and Endpoint mode (Vidya Sagar) - Disable MSI for Tegra234 Root Ports so they use INTx for all events (PCIe doesn't allow mixing INTx and MSI/MSI-X) (Vidya Sagar) - Search for Vendor-Specific RAS-DEC capability instead of hard-coding offset (Vidya Sagar) - Fix unintentional APPL_INTR_STATUS_L0 value overwrite in Root Port interrupt handling (Vidya Sagar) - Clear Bandwidth Management interrupt status bit to avoid interrupt storm (Vidya Sagar) - Set default Max Payload Size to 256 bytes (Vidya Sagar) - Fix offset when clearing bit in Data Link Feature capability (Vidya Sagar) - Extend Endpoint mode support to devices beyond Controller-5 (Vidya Sagar) * pci/ctrl/tegra194: PCI: tegra194: Add Tegra234 PCIe support PCI: tegra194: Extend Endpoint mode support PCI: tegra194: Fix link up retry sequence PCI: tegra194: Clean up the exit path for Endpoint mode PCI: tegra194: Enable support for 256 Byte payload PCI: tegra194: Clear bandwidth management status PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Find RAS DES PCIe capability offset Revert "PCI: tegra194: Rename tegra_pcie_dw to tegra194_pcie" PCI: Disable MSI for Tegra234 Root Ports dt-bindings: PCI: tegra234: Add schema for tegra234 Endpoint mode dt-bindings: PCI: tegra234: Add schema for tegra234 Root Port mode dt-bindings: PCI: tegra194: Convert to json-schema PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() # Conflicts: # drivers/pci/controller/dwc/pcie-designware.h # drivers/pci/controller/dwc/pcie-tegra194.c commit 085c2d6739ce4b38984a93997765dfc4ca77ce19 Merge: 3aa321dc0afc6 aa195350cdc8e Author: Bjorn Helgaas Date: Thu Aug 4 11:41:59 2022 -0500 Merge branch 'pci/ctrl/switchtec' - Prefer ida_alloc()/free() over ida_simple_get()/remove() (Ke Liu) * pci/ctrl/switchtec: PCI: switchtec: Prefer ida_alloc()/free() over ida_simple_get()/remove() commit 3aa321dc0afc6372384bafd336439ac60fad1a90 Merge: 9195e6dd9b49b aefffba672881 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:58 2022 -0500 Merge branch 'pci/ctrl/rcar-gen2' - Convert DT binding to json-schema (Herve Codina) - Add Renesas RZ/N1D (R9A06G032) to rcar-gen2 DT binding (Herve Codina) - Add Renesas RZ/N1D compatible string ("renesas,pci-rzn1") to rcar-gen2 driver (Herve Codina) * pci/ctrl/rcar-gen2: PCI: rcar-gen2: Add RZ/N1 SOC family compatible string dt-bindings: PCI: renesas,pci-rcar-gen2: Add device tree support for R9A06G032 dt-bindings: PCI: pci-rcar-gen2: Convert bindings to json-schema commit 9195e6dd9b49b98e2bdfea94a5737142d4f49c6a Merge: 4faef10896522 5147ba8af2d70 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:58 2022 -0500 Merge branch 'pci/ctrl/qcom' - Add PHY clock source implementation (Dmitry Baryshkov) - Use new clk_regmap_phy_mux_ops for gcc-sm8450 and gcc-sc7280 PCIe pipe clocks (Dmitry Baryshkov) - Set up rev 2.1.0 PARF_PHY before enabling clocks (Christian Marangi) - Power on PHY before accessing IPQ8074 DBI registers to avoid boot hangs (Robert Marko) - Power on PHY before accessing DBI registers on all variants for consistency (Robert Marko) - Remove unnecessary pipe_clk handling since this is done in PHY drivers (Dmitry Baryshkov) - Drop manual pipe_clk_src handling (Dmitry Baryshkov) - Move GEN3_RELATED DBI definitions to common dwc header (Baruch Siach) - Define slot capabilities using generic PCI_EXP_SLTCAP_* macros (Baruch Siach) - Add IPQ60xx support (Selvam Sathappan Periakaruppan) - Fix DT description typo (Baruch Siach) - Fix DT "compatibles" typo (Johan Hovold) - Allow ASPM L1 and substates for 2.7.0 (Krishna chaitanya chundru) * pci/ctrl/qcom: PCI: qcom: Allow ASPM L1 and substates for 2.7.0 dt-bindings: PCI: qcom: Fix reset conditional dt-bindings: PCI: qcom: Fix description typo PCI: qcom: Add IPQ60xx support PCI: qcom: Define slot capabilities using PCI_EXP_SLTCAP_* PCI: dwc: Move GEN3_RELATED DBI definitions to common header PCI: qcom: Drop manual pipe_clk_src handling PCI: qcom: Remove unnecessary pipe_clk handling PCI: qcom: Power on PHY before DBI register accesses PCI: qcom: Power on PHY before IPQ8074 DBI register accesses PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks clk: qcom: gcc-sc7280: use new clk_regmap_phy_mux_ops for PCIe pipe clocks clk: qcom: gcc-sm8450: use new clk_regmap_phy_mux_ops for PCIe pipe clocks clk: qcom: regmap: add PHY clock source implementation commit 4faef1089652200be54e116a22b1d3ab725f9404 Merge: f3305ae56615d f030304fdeb87 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:57 2022 -0500 Merge branch 'pci/ctrl/microchip' - Fix refcount leak in mc_pcie_init_irq_domains() (Miaoqian Lin) * pci/ctrl/microchip: PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() commit f3305ae56615db2d9ee85bfbc2e2ef0deb887e41 Merge: 359a98325be5d 28fc842e14729 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:57 2022 -0500 Merge branch 'pci/ctrl/mediatek-gen3' - Fix refcount leak in mtk_pcie_init_irq_domains() (Miaoqian Lin) - Print decoded LTSSM state when the link doesn't come up (Jianjun Wang) * pci/ctrl/mediatek-gen3: PCI: mediatek-gen3: Print LTSSM state when PCIe link down PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() commit 359a98325be5dc9ac5e999a88df8048a60e5f7a2 Merge: b4773c53c54a3 b3b76fc86f0fb Author: Bjorn Helgaas Date: Thu Aug 4 11:41:57 2022 -0500 Merge branch 'pci/ctrl/mediatek' - Add Airoha EN7532 to DT binding (John Crispin) - Allow building of mediatek driver for ARCH_AIROHA (Felix Fietkau) * pci/ctrl/mediatek: PCI: mediatek: Allow building for ARCH_AIROHA dt-bindings: PCI: mediatek: Add Airoha EN7532 support commit b4773c53c54a3511aba30028d6df95c2e8433f09 Merge: 13506868d9f40 930c6074d7dd5 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:56 2022 -0500 Merge branch 'pci/ctrl/loongson' - Wrap ARM64-specific MCFG quirks in #ifdef so Loongson can use the file (Huacai Chen) - Use generic (not 32-bit only) config accesses for LS2K/LS7A (Huacai Chen) - Add ACPI and MCFG support for Loongson LS7A (Huacai Chen) - Avoid config reads to non-existent LS2K/LS7A devices because a hardware defect causes machine hangs (Huacai Chen) - Work around LS7A integrated devices that report incorrect Interrupt Pin values (Jianmin Lv) * pci/ctrl/loongson: PCI: loongson: Work around LS7A incorrect Interrupt Pin registers PCI: loongson: Don't access non-existent devices PCI: loongson: Add ACPI init support PCI: loongson: Use generic 8/16/32-bit config ops on LS2K/LS7A PCI/ACPI: Guard ARM64-specific mcfg_quirks commit 13506868d9f4011383fd652eb07fcc80bba1a456 Merge: 468276d4ea40f 52664090101a8 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:56 2022 -0500 Merge branch 'pci/ctrl/iproc' - Use bitmap API to allocate bitmaps instead of doing it by hand (Christophe JAILLET) * pci/ctrl/iproc: PCI: iproc: Use bitmap API to allocate bitmaps commit 468276d4ea40fa4f4c3209d52cd596eb8a2061cc Merge: 0c8b7d1273ee3 6213c6c545cb2 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:55 2022 -0500 Merge branch 'pci/ctrl/imx6' - Factor out ref clock disables to match enables (Bjorn Helgaas) - Collect clock enables in imx6_pcie_clk_enable() (Richard Zhu) - Propagate regulator and clock errors back to .host_init() caller (Richard Zhu) - Disable i.MX6QDL clock when disabling ref clocks (Richard Zhu) - Call host init function directly in resume instead of duplicating the code (Richard Zhu) - Turn off regulators when suspending (Richard Zhu) - Make link being down a non-fatal error so probe doesn't fail (Richard Zhu) - Start link in resume only if it was up before suspend to reduce resume time (Richard Zhu) - Move PHY init and power-on out of clock- and reset-related functions (Richard Zhu) - Rework suspend callback to be more symmetric with resume (Richard Zhu) - Set PCIE_DBI_RO_WR_EN before writing DBI registers (Richard Zhu) - Allow speeds faster than Gen2 (Richard Zhu) * pci/ctrl/imx6: PCI: imx6: Support more than Gen2 speed link mode PCI: imx6: Set PCIE_DBI_RO_WR_EN before writing DBI registers PCI: imx6: Reformat suspend callback to keep symmetric with resume PCI: imx6: Move the imx6_pcie_ltssm_disable() earlier PCI: imx6: Disable clocks in reverse order of enable PCI: imx6: Do not hide PHY driver callbacks and refine the error handling PCI: imx6: Reduce resume time by only starting link if it was up before suspend PCI: imx6: Mark the link down as non-fatal error PCI: imx6: Move regulator enable out of imx6_pcie_deassert_core_reset() PCI: imx6: Turn off regulator when system is in suspend mode PCI: imx6: Call host init function directly in resume PCI: imx6: Disable i.MX6QDL clock when disabling ref clocks PCI: imx6: Propagate .host_init() errors to caller PCI: imx6: Collect clock enables in imx6_pcie_clk_enable() PCI: imx6: Factor out ref clock disable to match enable PCI: imx6: Move imx6_pcie_clk_disable() earlier PCI: imx6: Move imx6_pcie_enable_ref_clk() earlier PCI: imx6: Move PHY management functions together PCI: imx6: Move imx6_pcie_grp_offset(), imx6_pcie_configure_type() earlier PCI: imx6: Convert to NOIRQ_SYSTEM_SLEEP_PM_OPS() commit 0c8b7d1273ee3e2466167999b2fc4815d3759c83 Merge: fea77e9f29782 15a232408a8a5 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:55 2022 -0500 Merge branch 'pci/ctrl/fu740' - Remove unnecessary include files (Bjorn Helgaas) * pci/ctrl/fu740: PCI: fu740: Remove unnecessary include files commit fea77e9f29782f73b72ac1bd6e669ccd82841204 Merge: 94d13317bef31 22f3571cbc84b Author: Bjorn Helgaas Date: Thu Aug 4 11:41:55 2022 -0500 Merge branch 'pci/ctrl/exynos' - Move samsung phy-exynos-pcie init all to exynos5433_pcie_phy_init() instead of splitting across phy_init() and phy_power_on() (Marek Szyprowski) - Call phy_init() before phy_power_on() for samsung phy-exynos-pcie, as required by the PHY programming model (Marek Szyprowski) * pci/ctrl/exynos: PCI: exynos: Correct generic PHY usage phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks commit 94d13317bef31a2ec149c8f245302ffdda3c54da Merge: 964db794ae3cb 8353813c88ef2 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:54 2022 -0500 Merge branch 'pci/ctrl/dwc-edma' - Remove unused struct dw_edma_chip.irq (Frank Li) - Move eDMA private data from struct dw_edma to struct dw_edma_chip (Frank Li) - Convert "struct dw_edma_region rg_region" to "void __iomem *reg_base" since only the virtual address (not physical address or size) is used (Frank Li) - Rename "*_ch_cnt" to "ll_*_cnt" to reflect actual usage (Frank Li) - Drop dma_slave_config.direction field usage (Serge Semin) - Fix eDMA Rd/Wr-channels and DMA-direction semantics (Serge Semin) - Add chip-specific DW_EDMA_CHIP_LOCAL flag to indicate that local eDMA doesn't require generating MSIs to remote (Frank Li) - Enable DMA tests for endpoints that support it (Frank Li) * pci/ctrl/dwc-edma: PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities dmaengine: dw-edma: Add support for chip-specific flags dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics dmaengine: dw-edma: Drop dma_slave_config.direction field usage dmaengine: dw-edma: Rename wr(rd)_ch_cnt to ll_wr(rd)_cnt in struct dw_edma_chip dmaengine: dw-edma: Change rg_region to reg_base in struct dw_edma_chip dmaengine: dw-edma: Detach the private data and chip info structures dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip commit 964db794ae3cb8c0de92ce465569ee128ab0d6ce Merge: 9154b00f51ea8 91a773f9986b5 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:54 2022 -0500 Merge branch 'pci/ctrl/dwc' - Stop link on host_init errors and de-initialization (Serge Semin) - Add support for unrolled iATU register space in dw_pcie_disable_atu() (Serge Semin) - Disable outbound windows only for controllers that use iATU (Serge Semin) - Set INCREASE_REGION_SIZE flag based on limit address, not on the size, since even a small size may cross a 4GB boundary (Serge Semin) - Deallocate EPC memory on dw_pcie_ep_init() errors to avoid a leak (Serge Semin) - Always enable CDM check if "snps,enable-cdm-check" exists instead of exiting early if the optional "num-lanes" was absent (Serge Semin) - Simplify detection of whether we're using unrolled iATU registers (Serge Semin) - Make dw_pcie_link_up() more generic by using dw_pcie_readl_dbi() instead of readl() (Serge Semin) - Add dw_pcie_start_link() and dw_pcie_stop_link() wrappers to factor out checks for ops being implemented (Serge Semin) - Move io_cfg_atu_shared to struct pcie_port and rename to cfg0_io_shared, since it's not used by dwc common code or dwc endpoint code (Serge Semin) - Rename struct pcie_port to dw_pcie_rp to indicate that it's DesignWare-specific (Serge Semin) - Drop unused struct dw_plat_pcie regmap pointer (Serge Semin) - Fix some coding style issues (Serge Semin) - Log link speed and width if it comes up (Serge Semin) - Save DWC IP core version in native format as read from PORT_LOGIC.PCIE_VERSION_OFF register (Serge Semin) - Read DWC IP core version from PORT_LOGIC.PCIE_VERSION_OFF (Serge Semin) - Add macros to compare Synopsys IP core versions (Serge Semin) - Drop manual DWC IP core version setup from intel-gw and tegra194 (Serge Semin) - Add dw_pcie_ops.host_deinit() callback (Serge Semin) - Drop enum dw_pcie_as_type in favor of PCIE_ATU_TYPE_MEM/IO (Serge Semin) - Drop enum dw_pcie_region_type in favor of PCIE_ATU_REGION_DIR_IB/OB (Serge Semin) - Simplify in/outbound iATU setup methods and reduce duplicated code (Serge Semin) - Detect iATU region size from hardware (Serge Semin) - Validate iATU outbound mappings against hardware constraints (Serge Semin) - Check for errors in iATU setup (Serge Semin) - Allocate a 32-bit DMA-able page to be MSI target instead of using a driver data structure that may not be addressable with 32-bit address (Will McVicker) - Use the bitmap API to allocate bitmaps instead of open-coding it (Christophe JAILLET) - Correct dw_pcie_free_msi() checking for when to remove IRQ handler and data (Dmitry Baryshkov) - Split MSI init to new dw_pcie_msi_host_init() function (Dmitry Baryshkov) - Convert struct pcie_port.msi_irq to an array so we can support more than 32 MSI interrupts (Dmitry Baryshkov) - Handle MSIs routed to multiple GIC interrupts for Qualcomm platforms with groups of 32 MSI vectors (Dmitry Baryshkov) - Add additional MSI interrupts to qcom DT (Dmitry Baryshkov) * pci/ctrl/dwc: dt-bindings: PCI: qcom: Support additional MSI vectors PCI: dwc: Handle MSIs routed to multiple GIC interrupts PCI: dwc: Convert struct pcie_port.msi_irq to an array PCI: dwc: Split MSI IRQ parsing/allocation to a separate function PCI: dwc: Correct msi_irq condition in dw_pcie_free_msi() PCI: dwc: Use the bitmap API to allocate bitmaps PCI: dwc: Fix MSI msi_msg DMA mapping PCI: dwc: Check iATU in/outbound range setup status PCI: dwc: Validate iATU outbound mappings against hardware constraints PCI: dwc: Add iATU regions size detection procedure PCI: dwc: Simplify in/outbound iATU setup methods PCI: dwc: Drop enum dw_pcie_region_type in favor of PCIE_ATU_REGION_DIR_IB/OB PCI: dwc: Drop enum dw_pcie_as_type in favor of PCIE_ATU_TYPE_MEM/IO PCI: dwc: Add dw_pcie_ops.host_deinit() callback PCI: tegra194: Drop manual DW PCIe controller version setup PCI: intel-gw: Drop manual DW PCIe controller version setup PCI: dwc: Add macros to compare Synopsys IP core versions PCI: dwc: Read DWC IP core version from register PCI: dwc: Use native DWC IP core version representation PCI: dwc: Detect iATU settings after getting "addr_space" resource PCI: dwc: Log link speed and width if it comes up PCI: dwc-plat: Drop dw_plat_pcie_of_match[] forward declaration PCI: dwc-plat: Drop unused regmap pointer PCI: dwc-plat: Simplify dw_plat_pcie_probe() return values PCI: dwc: Rename struct pcie_port to dw_pcie_rp PCI: dwc: Move io_cfg_atu_shared to struct pcie_port PCI: dwc: Add start_link/stop_link inlines PCI: dwc: Reuse local pointer to the resource data PCI: dwc: Organize local variable usage PCI: dwc: Convert dw_pcie_link_up() to use dw_pcie_readl_dbi() PCI: dwc: Simplify unrolled iATU detection PCI: dwc: Add newlines to log messages PCI: dwc: Add braces to multi-line if-else statements PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address PCI: dwc: Disable outbound windows only for controllers using iATU PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Stop link on host_init errors and de-initialization commit 9154b00f51ea83e1c168ac929f37fbe3197ca508 Merge: 95aa832bd29cd 94c6511636302 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:53 2022 -0500 Merge branch 'pci/ctrl/brcmstb' - Remove unnecessary forward declarations (Jim Quinlan) - Prevent config space access when link is down (Jim Quinlan) - Split post-link up initialization to brcm_pcie_start_link() (Jim Quinlan) - Enable child bus device regulators described under Root Ports in DT (Jim Quinlan) - Disable/enable regulators in suspend/resume (Jim Quinlan) - Rename .map_bus() functions to end with 'map_bus' as they do in other drivers (Jim Quinlan) * pci/ctrl/brcmstb: PCI: brcmstb: Rename .map_bus() functions to end with 'map_bus' PCI: brcmstb: Disable/enable regulators in suspend/resume PCI: brcmstb: Enable child bus device regulators from DT PCI: brcmstb: Split post-link up initialization to brcm_pcie_start_link() PCI: brcmstb: Prevent config space access when link is down PCI: brcmstb: Remove unnecessary forward declarations commit 95aa832bd29cda435d18acca213fa127a6b06040 Merge: d22b9e6042648 bcdb6fd4f3e9a Author: Bjorn Helgaas Date: Thu Aug 4 11:41:53 2022 -0500 Merge branch 'pci/ctrl/aardvark' - Add support for AER capability on emulated bridge (Pali Rohár) - Add support for Slot capability on emulated bridge (Pali Rohár) * pci/ctrl/aardvark: PCI: aardvark: Fix reporting Slot capabilities on emulated bridge PCI: aardvark: Add support for AER registers on emulated bridge commit d22b9e604264839173ddf1c03f91fa4b1d16fd4c Merge: bac0f4474c63c afd306a65cedb Author: Bjorn Helgaas Date: Thu Aug 4 11:41:53 2022 -0500 Merge branch 'pci/virtualization' - Add ACS quirk for Broadcom BCM5750x multifunction NICs that isolate the functions but don't advertise an ACS capability (Pavan Chebbi) * pci/virtualization: PCI: Add ACS quirk for Broadcom BCM5750x NICs commit bac0f4474c63ccd466f9b657d5a0fa102847f735 Merge: 3dc4d3333ac6e c1ef322491cb8 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:52 2022 -0500 Merge branch 'pci/resource' - Replace sparc pci_mmap_page_range() wrapper. This still leaves a sparc-specific pci_mmap_resource_range(), but it's only one interface instead of two (Arnd Bergmann) - Remove sparc-specific pci_mmap_resource_range() by implementing pci_iobar_pfn(). This removes the ability to map the entire PCI I/O space using /proc/bus/pci, but we believe that's already been broken since v2.6.28 (Arnd Bergmann) * pci/resource: sparc: Use generic pci_mmap_resource_range() PCI: Remove pci_mmap_page_range() wrapper commit 3dc4d3333ac6ed9cd3632e8ebb6a8dedeef7ae23 Merge: 5a20930f27c45 4f23bd5d09af4 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:52 2022 -0500 Merge branch 'pci/pm' - Convert documentation examples to generic power management (Bjorn Helgaas) * pci/pm: PCI/doc: Convert examples to generic power management commit 5a20930f27c4502ee595017787769ddb4465e795 Merge: dc5253117a237 5e6ae050955b5 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:52 2022 -0500 Merge branch 'pci/err' - Recognize disconnected devices so we don't bother trying to set them to "frozen" or "normal" state (Christoph Hellwig) - Clear PCI Status register during enumeration in case firmware left errors logged (Kai-Heng Feng) - Configure ECRC for every device, including hot-added ones (Stefan Roese) - Keep AER error reporting enabled for switches (Stefan Roese) - Enable error reporting for all devices that support AER (Stefan Roese) - Iterate over error counters instead of error strings to avoid printing junk in AER sysfs counters (Mohamed Khalfella) * pci/err: PCI/AER: Iterate over error counters instead of error strings PCI/AER: Enable error reporting when AER is native PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI/AER: Configure ECRC for every device PCI: Clear PCI_STATUS when setting up device PCI/ERR: Recognize disconnected devices in report_error_detected() commit dc5253117a237478f6ea03906ff7041d5db322ed Merge: 4921043182bf1 960ac36264878 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:51 2022 -0500 Merge branch 'pci/enumeration' - Split out ARI "next function" handling from the traditional one (Niklas Schnelle) - Move jailhouse "isolated function" (non-zero functions where function 0 doesn't exist) handling to pci_scan_slot() to avoid duplicating multi-function scanning in pci_scan_child_bus_extend() (Niklas Schnelle) - Extend "isolated function" probing to s390 (Niklas Schnelle). - Allow s390 zPCI zbus without a function 0 (Niklas Schnelle) * pci/enumeration: s390/pci: allow zPCI zbus without a function zero PCI: Extend isolated function probing to s390 PCI: Move jailhouse's isolated function handling to pci_scan_slot() PCI: Split out next_ari_fn() from next_fn() PCI: Clean up pci_scan_slot() commit 4921043182bf14279aa183490aa32a3068ea5549 Merge: 50f7a544879a7 1bc2b7bfba6e2 Author: Bjorn Helgaas Date: Thu Aug 4 11:41:51 2022 -0500 Merge branch 'pci/endpoint' - Don't stop an EPC when unbinding an EPF from it (Shunsuke Mie) * pci/endpoint: PCI: endpoint: Don't stop controller when unbinding endpoint function commit 50f7a544879a7c2192a68744c3cd947f53df51ab Merge: f2906aa863381 ba13d4575da5e Author: Bjorn Helgaas Date: Thu Aug 4 11:41:50 2022 -0500 Merge branch 'pci/aspm' - Remove pcie_aspm_pm_state_change(), which overwrites ASPM config on power state changes (Kai-Heng Feng) * pci/aspm: PCI/ASPM: Unexport pcie_aspm_support_enabled() PCI/ASPM: Remove pcie_aspm_pm_state_change() commit c20ee5749a3f688d9bab83a3b09b75587153ff13 Author: Karol Herbst Date: Wed Aug 3 16:27:45 2022 +0200 drm/nouveau: recognise GA103 Appears to be ok with general GA10x code. Signed-off-by: Karol Herbst Cc: # v5.15+ Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20220803142745.2679510-1-kherbst@redhat.com commit 54d91b55c7f3f9f2c86e0b6be4501433b32ddc89 Author: Timur Tabi Date: Wed May 11 11:37:16 2022 -0500 drm/nouveau: fix another off-by-one in nvbios_addr This check determines whether a given address is part of image 0 or image 1. Image 1 starts at offset image0_size, so that address should be included. Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds accesses to image") Signed-off-by: Timur Tabi Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20220511163716.3520591-1-ttabi@nvidia.com commit 8f0541186e9ad1b62accc9519cc2b7a7240272a7 Author: Namjae Jeon Date: Tue Aug 2 07:28:51 2022 +0900 ksmbd: fix heap-based overflow in set_ntacl_dacl() The testcase use SMB2_SET_INFO_HE command to set a malformed file attribute under the label `security.NTACL`. SMB2_QUERY_INFO_HE command in testcase trigger the following overflow. [ 4712.003781] ================================================================== [ 4712.003790] BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.003807] Write of size 1060 at addr ffff88801e34c068 by task kworker/0:0/4190 [ 4712.003813] CPU: 0 PID: 4190 Comm: kworker/0:0 Not tainted 5.19.0-rc5 #1 [ 4712.003850] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 4712.003867] Call Trace: [ 4712.003870] [ 4712.003873] dump_stack_lvl+0x49/0x5f [ 4712.003935] print_report.cold+0x5e/0x5cf [ 4712.003972] ? ksmbd_vfs_get_sd_xattr+0x16d/0x500 [ksmbd] [ 4712.003984] ? cmp_map_id+0x200/0x200 [ 4712.003988] ? build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004000] kasan_report+0xaa/0x120 [ 4712.004045] ? build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004056] kasan_check_range+0x100/0x1e0 [ 4712.004060] memcpy+0x3c/0x60 [ 4712.004064] build_sec_desc+0x842/0x1dd0 [ksmbd] [ 4712.004076] ? parse_sec_desc+0x580/0x580 [ksmbd] [ 4712.004088] ? ksmbd_acls_fattr+0x281/0x410 [ksmbd] [ 4712.004099] smb2_query_info+0xa8f/0x6110 [ksmbd] [ 4712.004111] ? psi_group_change+0x856/0xd70 [ 4712.004148] ? update_load_avg+0x1c3/0x1af0 [ 4712.004152] ? asym_cpu_capacity_scan+0x5d0/0x5d0 [ 4712.004157] ? xas_load+0x23/0x300 [ 4712.004162] ? smb2_query_dir+0x1530/0x1530 [ksmbd] [ 4712.004173] ? _raw_spin_lock_bh+0xe0/0xe0 [ 4712.004179] handle_ksmbd_work+0x30e/0x1020 [ksmbd] [ 4712.004192] process_one_work+0x778/0x11c0 [ 4712.004227] ? _raw_spin_lock_irq+0x8e/0xe0 [ 4712.004231] worker_thread+0x544/0x1180 [ 4712.004234] ? __cpuidle_text_end+0x4/0x4 [ 4712.004239] kthread+0x282/0x320 [ 4712.004243] ? process_one_work+0x11c0/0x11c0 [ 4712.004246] ? kthread_complete_and_exit+0x30/0x30 [ 4712.004282] ret_from_fork+0x1f/0x30 This patch add the buffer validation for security descriptor that is stored by malformed SMB2_SET_INFO_HE command. and allocate large response buffer about SMB2_O_INFO_SECURITY file info class. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17771 Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 4a933e62083ead6cd064293a7505c56165859320 Author: Pavel Begunkov Date: Thu Aug 4 15:15:30 2022 +0100 io_uring/net: send retry for zerocopy io_uring handles short sends/recvs for stream sockets when MSG_WAITALL is set, however new zerocopy send is inconsistent in this regard, which might be confusing. Handle short sends. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/b876a4838597d9bba4f3215db60d72c33c448ad0.1659622472.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit cc18cc5e82033d406f54144ad6f8092206004684 Author: Pavel Begunkov Date: Thu Aug 4 15:13:46 2022 +0100 io_uring: mem-account pbuf buckets Potentially, someone may create as many pbuf bucket as there are indexes in an xarray without any other restrictions bounding our memory usage, put memory needed for the buckets under memory accounting. Cc: Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d34c452e45793e978d26e2606211ec9070d329ea.1659622312.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f482aa98652795846cc55da98ebe331eb74f3d0b Author: Peilin Ye Date: Wed Aug 3 15:23:43 2022 -0700 audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker() Currently @audit_context is allocated twice for io_uring workers: 1. copy_process() calls audit_alloc(); 2. io_sq_thread() or io_wqe_worker() calls audit_alloc_kernel() (which is effectively audit_alloc()) and overwrites @audit_context, causing: BUG: memory leak unreferenced object 0xffff888144547400 (size 1024): <...> hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] audit_alloc+0x133/0x210 [] copy_process+0xcd3/0x2340 [] create_io_thread+0x63/0x90 [] create_io_worker+0xb4/0x230 [] io_wqe_enqueue+0x248/0x3b0 [] io_queue_iowq+0xba/0x200 [] io_queue_async+0x113/0x180 [] io_req_task_submit+0x18f/0x1a0 [] io_apoll_task_func+0xdd/0x120 [] tctx_task_work+0x11f/0x570 [] task_work_run+0x7e/0xc0 [] get_signal+0xc18/0xf10 [] arch_do_signal_or_restart+0x2b/0x730 [] exit_to_user_mode_prepare+0x5e/0x180 [] syscall_exit_to_user_mode+0x12/0x20 [] do_syscall_64+0x40/0x80 Then, 3. io_sq_thread() or io_wqe_worker() frees @audit_context using audit_free(); 4. do_exit() eventually calls audit_free() again, which is okay because audit_free() does a NULL check. As suggested by Paul Moore, fix it by deleting audit_alloc_kernel() and redundant audit_free() calls. Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") Suggested-by: Paul Moore Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Acked-by: Paul Moore Link: https://lore.kernel.org/r/20220803222343.31673-1-yepeilin.cs@gmail.com Signed-off-by: Jens Axboe commit 6930bcbfb6ceda63e298c6af6d733ecdf6bd4cde Author: Jeff Layton Date: Mon Aug 1 15:57:26 2022 -0400 lockd: detect and reject lock arguments that overflow lockd doesn't currently vet the start and length in nlm4 requests like it should, and can end up generating lock requests with arguments that overflow when passed to the filesystem. The NLM4 protocol uses unsigned 64-bit arguments for both start and length, whereas struct file_lock tracks the start and end as loff_t values. By the time we get around to calling nlm4svc_retrieve_args, we've lost the information that would allow us to determine if there was an overflow. Start tracking the actual start and len for NLM4 requests in the nlm_lock. In nlm4svc_retrieve_args, vet these values to ensure they won't cause an overflow, and return NLM4_FBIG if they do. Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=392 Reported-by: Jan Kasiak Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever Cc: # 5.14+ commit dd8dd403d7b223cc77ee89d8d09caf045e90e648 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: discard fh_locked flag and fh_lock/fh_unlock As all inode locking is now fully balanced, fh_put() does not need to call fh_unlock(). fh_lock() and fh_unlock() are no longer used, so discard them. These are the only real users of ->fh_locked, so discard that too. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit bb4d53d66e4b8c8b8e5634802262e53851a2d2db Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: use (un)lock_inode instead of fh_(un)lock for file operations When locking a file to access ACLs and xattrs etc, use explicit locking with inode_lock() instead of fh_lock(). This means that the calls to fh_fill_pre/post_attr() are also explicit which improves readability and allows us to place them only where they are needed. Only the xattr calls need pre/post information. When locking a file we don't need I_MUTEX_PARENT as the file is not a parent of anything, so we can use inode_lock() directly rather than the inode_lock_nested() call that fh_lock() uses. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit debf16f0c671cb8db154a9ebcd6014cfff683b80 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: use explicit lock/unlock for directory ops When creating or unlinking a name in a directory use explicit inode_lock_nested() instead of fh_lock(), and explicit calls to fh_fill_pre_attrs() and fh_fill_post_attrs(). This is already done for renames, with lock_rename() as the explicit locking. Also move the 'fill' calls closer to the operation that might change the attributes. This way they are avoided on some error paths. For the v2-only code in nfsproc.c, the fill calls are not replaced as they aren't needed. Making the locking explicit will simplify proposed future changes to locking for directories. It also makes it easily visible exactly where pre/post attributes are used - not all callers of fh_lock() actually need the pre/post attributes. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 19d008b46941b8c668402170522e0f7a9258409c Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: reduce locking in nfsd_lookup() nfsd_lookup() takes an exclusive lock on the parent inode, but no callers want the lock and it may not be needed at all if the result is in the dcache. Change nfsd_lookup_dentry() to not take the lock, and call lookup_one_len_locked() which takes lock only if needed. nfsd4_open() currently expects the lock to still be held, but that isn't necessary as nfsd_validate_delegated_dentry() provides required guarantees without the lock. NOTE: NFSv4 requires directory changeinfo for OPEN even when a create wasn't requested and no change happened. Now that nfsd_lookup() doesn't use fh_lock(), we need to explicitly fill the attributes when no create happens. A new fh_fill_both_attrs() is provided for that task. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit e18bcb33bc5b69bccc2b532075aa00bb49cc01c5 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: only call fh_unlock() once in nfsd_link() On non-error paths, nfsd_link() calls fh_unlock() twice. This is safe because fh_unlock() records that the unlock has been done and doesn't repeat it. However it makes the code a little confusing and interferes with changes that are planned for directory locking. So rearrange the code to ensure fh_unlock() is called exactly once if fh_lock() was called. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit b677c0c63a135a916493c064906582e9f3ed4802 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: always drop directory lock in nfsd_unlink() Some error paths in nfsd_unlink() allow it to exit without unlocking the directory. This is not a problem in practice as the directory will be locked with an fh_put(), but it is untidy and potentially confusing. This allows us to remove all the fh_unlock() calls that are immediately after nfsd_unlink() calls. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 927bfc5600cd6333c9ef9f090f19e66b7d4c8ee1 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before returning. nfsd_create() usually returns with the directory still locked. nfsd_symlink() usually returns with it unlocked. This is clumsy. Until recently nfsd_create() needed to keep the directory locked until ACLs and security label had been set. These are now set inside nfsd_create() (in nfsd_setattr()) so this need is gone. So change nfsd_create() and nfsd_symlink() to always unlock, and remove any fh_unlock() calls that follow calls to these functions. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: add posix ACLs to struct nfsd_attrs pacl and dpacl pointers are added to struct nfsd_attrs, which requires that we have an nfsd_attrs_free() function to free them. Those nfsv4 functions that can set ACLs now set up these pointers based on the passed in NFSv4 ACL. nfsd_setattr() sets the acls as appropriate. Errors are handled as with security labels. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 Author: Nathan Chancellor Date: Tue Aug 2 10:59:36 2022 -0700 MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 When CONFIG_XPA is enabled, Clang warns: arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ^ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) ^ arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ^ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) ^ 2 errors generated. _PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the build and runtime configuration, which is what the negation operators are trying to convey. To silence the warning, explicitly compare against 0 so the result of the '<<' operator is not implicitly converted to a boolean. According to its documentation, GCC enables -Wint-in-bool-context with -Wall but this warning is not visible when building the same configuration with GCC. It appears GCC only warns when compiling C++, not C, although the documentation makes no note of this: https://godbolt.org/z/x39q3brxf Reported-by: Sudip Mukherjee (Codethink) Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer commit 672fb6740cbfde34f4d367ffa3c939b608a927e1 Author: Masahiro Yamada Date: Mon Aug 1 18:39:02 2022 +0900 modpost: remove .symbol_white_list field entirely It is not so useful to have symbol whitelists in arrays. With this over-engineering, the code is difficult to follow. Let's do it more directly, and collect the relevant code to one place. Signed-off-by: Masahiro Yamada commit 1560cb0e186e83f0572a84d22e139c100060905c Author: Masahiro Yamada Date: Mon Aug 1 18:39:01 2022 +0900 modpost: remove unneeded .symbol_white_list initializers The ->symbol_white_list field is referenced in secref_whitelist(), only when 'fromsec' is data_sections. /* Check for pattern 2 */ if (match(tosec, init_exit_sections) && match(fromsec, data_sections) && match(fromsym, mismatch->symbol_white_list)) return 0; If .fromsec is not data sections, the .symbol_white_list member is not used by anyone. Signed-off-by: Masahiro Yamada commit 7452dd26a59a9dfcde3f179594f3be6c4752a9a9 Author: Masahiro Yamada Date: Mon Aug 1 18:39:00 2022 +0900 modpost: add PATTERNS() helper macro This will be useful to define a NULL-terminated array inside a function call. Currently, string arrays passed to match() are defined in separate places: static const char *const init_sections[] = { ALL_INIT_SECTIONS, NULL }; static const char *const text_sections[] = { ALL_TEXT_SECTIONS, NULL }; static const char *const optim_symbols[] = { "*.constprop.*", NULL }; ... /* Check for pattern 5 */ if (match(fromsec, text_sections) && match(tosec, init_sections) && match(fromsym, optim_symbols)) return 0; With the new helper macro, you can list the patterns directly in the function call, like this: /* Check for pattern 5 */ if (match(fromsec, PATTERNS(ALL_TEXT_SECTIONS)) && match(tosec, PATTERNS(ALL_INIT_SECTIONS)) && match(fromsym, PATTERNS("*.contprop.*"))) return 0; Signed-off-by: Masahiro Yamada commit 072dd2c8928f2ecdc52cdf5acf30479b327386c9 Author: Masahiro Yamada Date: Mon Aug 1 18:38:59 2022 +0900 modpost: shorten warning messages in report_sec_mismatch() Each section mismatch results in long warning messages. Too much. Make each warning fit in one line, and remove a lot of messy code. Signed-off-by: Masahiro Yamada commit a25efd6ef1ef4c32991a1d5a013dd41e3b8f7eff Author: Masahiro Yamada Date: Sun Jul 31 02:36:36 2022 +0900 Revert "Kbuild, lto, workaround: Don't warn for initcall_reference in modpost" This reverts commit 77ab21adae509c5540956729e2d03bc1a59bc82a. Even after 8 years later, GCC LTO has not been upstreamed. Also, it said "This is a workaround". If this is needed in the future, it should be added in a proper way. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers Acked-by: Jiri Slaby commit de979c83574abf6e78f3fa65b716515c91b2613d Author: Andrea Righi Date: Thu Jul 14 09:49:15 2022 +0200 x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y With CONFIG_PREEMPTION disabled, arch/x86/entry/thunk_$(BITS).o becomes an empty object file. With some old versions of binutils (i.e., 2.35.90.20210113-1ubuntu1) the GNU assembler doesn't generate a symbol table for empty object files and objtool fails with the following error when a valid symbol table cannot be found: arch/x86/entry/thunk_64.o: warning: objtool: missing symbol table To prevent this from happening, build thunk_$(BITS).o only if CONFIG_PREEMPTION is enabled. BugLink: https://bugs.launchpad.net/bugs/1911359 Fixes: 320100a5ffe5 ("x86/entry: Remove the TRACE_IRQS cruft") Signed-off-by: Andrea Righi Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/Ys/Ke7EWjcX+ZlXO@arighi-desktop commit 30bdc36b8c776cd4fce5de2a96ff28b37f96942f Author: Laurentiu Palcu Date: Thu Jul 21 15:09:12 2022 +0300 drm/imx/dcss: get rid of HPD warning message When DCSS + MIPI_DSI is used, and the last bridge in the chain supports HPD, we can see a "Hot plug detection already enabled" warning stack trace dump that's thrown when DCSS is initialized. The problem appeared when HPD was enabled by default in the bridge_connector initialization, which made the drm_bridge_connector_enable_hpd() call, in DCSS init path, redundant. So, let's remove that call. Fixes: 09077bc311658 ("drm/bridge_connector: enable HPD by default if supported") Signed-off-by: Laurentiu Palcu Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/20220721120912.6639-1-laurentiu.palcu@oss.nxp.com commit 751d4cbc43879229dbc124afefe240b70fd29a85 Author: Mel Gorman Date: Thu Aug 4 10:21:19 2022 +0100 sched/core: Do not requeue task on CPU excluded from cpus_mask The following warning was triggered on a large machine early in boot on a distribution kernel but the same problem should also affect mainline. WARNING: CPU: 439 PID: 10 at ../kernel/workqueue.c:2231 process_one_work+0x4d/0x440 Call Trace: rescuer_thread+0x1f6/0x360 kthread+0x156/0x180 ret_from_fork+0x22/0x30 Commit c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") optimises ttwu by queueing a task that is descheduling on the wakelist, but does not check if the task descheduling is still allowed to run on that CPU. In this warning, the problematic task is a workqueue rescue thread which checks if the rescue is for a per-cpu workqueue and running on the wrong CPU. While this is early in boot and it should be possible to create workers, the rescue thread may still used if the MAYDAY_INITIAL_TIMEOUT is reached or MAYDAY_INTERVAL and on a sufficiently large machine, the rescue thread is being used frequently. Tracing confirmed that the task should have migrated properly using the stopper thread to handle the migration. However, a parallel wakeup from udev running on another CPU that does not share CPU cache observes p->on_cpu and uses task_cpu(p), queues the task on the old CPU and triggers the warning. Check that the wakee task that is descheduling is still allowed to run on its current CPU and if not, wait for the descheduling to complete and select an allowed CPU. Fixes: c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu") Signed-off-by: Mel Gorman Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220804092119.20137-1-mgorman@techsingularity.net commit 54cfa910b443b3d90b3e00bd96cdf563a285390b Author: Huacai Chen Date: Thu Aug 4 10:54:57 2022 +0800 irqchip/loongson-eiointc: Fix a build warning Make acpi_get_vec_parent() be a static function, to avoid: drivers/irqchip/irq-loongson-eiointc.c:289:20: warning: no previous prototype for 'acpi_get_vec_parent' Reported-by: kernel test robot Signed-off-by: Huacai Chen Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220804025457.213979-1-chenhuacai@loongson.cn commit e260cfe6fb503292f183a43b51177664b222435d Author: Huacai Chen Date: Thu Aug 4 10:54:21 2022 +0800 irqchip/loongson-eiointc: Fix irq affinity setting In multi-node case, csr_any_send() should set EIOINTC_REG_ENABLE of the first core of target node, not the first core of the whole. Signed-off-by: Huacai Chen Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220804025421.211958-1-chenhuacai@loongson.cn commit b0a4ab7ca4ce993d1cc51cbc85e9f341c729a3d4 Author: Michael Kelley Date: Mon Jul 25 17:53:40 2022 -0700 iommu/hyper-v: Use helper instead of directly accessing affinity Recent changes to solve inconsistencies in handling IRQ masks #ifdef out the affinity field in irq_common_data for non-SMP configurations. The current code in hyperv_irq_remapping_alloc() gets a compiler error in that case. Fix this by using the new irq_data_update_affinity() helper, which handles the non-SMP case correctly. Signed-off-by: Michael Kelley Reported-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Randy Dunlap Acked-by: Joerg Roedel Signed-off-by: Marc Zyngier Fixes: aa0813581b8d ("genirq: Provide an IRQ affinity mask in non-SMP configs") Link: https://lore.kernel.org/r/1658796820-2261-1-git-send-email-mikelley@microsoft.com commit 99643bab36b642be10bf09cd3285c37c9e5b597f Author: Slark Xiao Date: Wed Jul 20 17:12:20 2022 +0800 perf/core: Fix ';;' typo Remove double ';;'. Signed-off-by: Slark Xiao Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220720091220.14200-1-slark_xiao@163.com commit b44f2fd87919b5ae6e1756d4c7ba2cbba22238e1 Merge: 12b68040a5e46 5493ee1919eae Author: Linus Torvalds Date: Wed Aug 3 19:52:08 2022 -0700 Merge tag 'drm-next-2022-08-03' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Highlights: - New driver for logicvc - which is a display IP core. - EDID parser rework to add new extensions - fbcon scrolling improvements - i915 has some more DG2 work but not enabled by default, but should have enough features for userspace to work now. Otherwise it's lots of work all over the place. Detailed summary: New driver: - logicvc vfio: - use aperture API core: - of: Add data-lane helpers and convert drivers - connector: Remove deprecated ida_simple_get() media: - Add various RGB666 and RGB888 format constants panel: - Add HannStar HSD101PWW - Add ETML0700Y5DHA dma-buf: - add sync-file API - set dma mask for udmabuf devices fbcon: - Improve scrolling performance - Sanitize input fbdev: - device unregistering fixes - vesa: Support COMPILE_TEST - Disable firmware-device registration when first native driver loads aperture: - fix segfault during hot-unplug - export for use with other subsystems client: - use driver validated modes dp: - aux: make probing more reliable - mst: Read extended DPCD capabilities during system resume - Support waiting for HDP signal - Port-validation fixes edid: - CEA data-block iterators - struct drm_edid introduction - implement HF-EEODB extension gem: - don't use fb format non-existing planes probe-helper: - use 640x480 as displayport fallback scheduler: - don't kill jobs in interrupt context bridge: - Add support for i.MX8qxp and i.MX8qm - lots of fixes/cleanups - Add TI-DLPC3433 - fy07024di26a30d: Optional GPIO reset - ldb: Add reg and reg-name properties to bindings, Kconfig fixes - lt9611: Fix display sensing; - tc358767: DSI/DPI refactoring and DSI-to-eDP support, DSI lane handling - tc358775: Fix clock settings - ti-sn65dsi83: Allow GPIO to sleep - adv7511: I2C fixes - anx7625: Fix error handling; DPI fixes; Implement HDP timeout via callback - fsl-ldb: Drop DE flip - ti-sn65dsi86: Convert to atomic modesetting amdgpu: - use atomic fence helpers in DM - fix VRAM address calculations - export CRTC bpc via debugfs - Initial devcoredump support - Enable high priority gfx queue on asics which support it - Adjust GART size on newer APUs for S/G display - Soft reset for GFX 11 / SDMA 6 - Add gfxoff status query for vangogh - Fix timestamps for cursor only commits - Adjust GART size on newer APUs for S/G display - fix buddy memory corruption amdkfd: - MMU notifier fixes - P2P DMA support using dma-buf - Add available memory IOCTL - HMM profiler support - Simplify GPUVM validation - Unified memory for CWSR save/restore area i915: - General driver clean-up - DG2 enabling (still under force probe) - DG2 small BAR memory support - HuC loading support - DG2 workarounds - DG2/ATS-M device IDs added - Ponte Vecchio prep work and new blitter engines - add Meteorlake support - Fix sparse warnings - DMC MMIO range checks - Audio related fixes - Runtime PM fixes - PSR fixes - Media freq factor and per-gt enhancements - DSI fixes for ICL+ - Disable DMC flip queue handlers - ADL_P voltage swing updates - Use more the VBT for panel information - Fix on Type-C ports with TBT mode - Improve fastset and allow seamless M/N changes - Accept more fixed modes with VRR/DMRRS panels - Disable connector polling for a headless SKU - ADL-S display PLL w/a - Enable THP on Icelake and beyond - Fix i915_gem_object_ggtt_pin_ww regression on old platforms - Expose per tile media freq factor in sysfs - Fix dma_resv fence handling in multi-batch execbuf - Improve on suspend / resume time with VT-d enabled - export CRTC bpc settings via debugfs msm: - gpu: a619 support - gpu: Fix for unclocked GMU register access - gpu: Devcore dump enhancements - client utilization via fdinfo support - fix fence rollover issue - gem: Lockdep false-positive warning fix - gem: Switch to pfn mappings - WB support on sc7180 - dp: dropped custom bulk clock implementation - fix link retraining on resolution change - hdmi: dropped obsolete GPIO support tegra: - context isolation for host1x engines - tegra234 soc support mediatek: - add vdosys0/1 for mt8195 - add MT8195 dp_intf driver exynos: - Fix resume function issue of exynos decon driver by calling clk_disable_unprepare() properly if clk_prepare_enable() failed. nouveau: - set of misc fixes/cleanups - display cleanups gma500: - Cleanup connector I2C handling hyperv: - Unify VRAM allocation of Gen1 and Gen2 meson: - Support YUV422 output; Refcount fixes mgag200: - Support damage clipping - Support gamma handling - Protect concurrent HW access - Fixes to connector - Store model-specific limits in device-info structure - fix PCI register init panfrost: - Valhall support r128: - Fix bit-shift overflow rockchip: - Locking fixes in error path ssd130x: - Fix built-in linkage udl: - Always advertize VGA connector ast: - Support multiple outputs - fix black screen on resume sun4i: - HDMI PHY cleanups vc4: - Add support for BCM2711 vkms: - Allocate output buffer with vmalloc() mcde: - Fix ref-count leak mxsfb/lcdif: - Support i.MX8MP LCD controller stm/ltdc: - Support dynamic Z order - Support mirroring ingenic: - Fix display at maximum resolution" * tag 'drm-next-2022-08-03' of git://anongit.freedesktop.org/drm/drm: (1480 commits) drm/amd/display: Fix a compilation failure on PowerPC caused by FPU code drm/amdgpu: enable support for psp 13.0.4 block drm/amdgpu: add files for PSP 13.0.4 drm/amdgpu: add header files for MP 13.0.4 drm/amdgpu: correct RLC_RLCS_BOOTLOAD_STATUS offset and index drm/amdgpu: send msg to IMU for the front-door loading drm/amdkfd: use time_is_before_jiffies(a + b) to replace "jiffies - a > b" drm/amdgpu: fix hive reference leak when reflecting psp topology info drm/amd/pm: enable GFX ULV feature support for SMU13.0.0 drm/amd/pm: update driver if header for SMU 13.0.0 drm/amdgpu: move mes self test after drm sched re-started drm/amdgpu: drop non-necessary call trace dump drm/amdgpu: enable VCN cg and JPEG cg/pg drm/amdgpu: vcn_4_0_2 video codec query drm/amdgpu: add VCN_4_0_2 firmware support drm/amdgpu: add VCN function in NBIO v7.7 drm/amdgpu: fix a vcn4 boot poll bug in emulation mode drm/amd/amdgpu: add memory training support for PSP_V13 drm/amdkfd: remove an unnecessary amdgpu_bo_ref drm/amd/pm: Add get_gfx_off_status interface for yellow carp ... commit 12b68040a5e468068fd7f4af1150eab8f6e96235 Merge: 80dc75932ff23 485ade76c95ac Author: Linus Torvalds Date: Wed Aug 3 19:29:28 2022 -0700 Merge tag 'media/v5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - New driver for Semi AR0521 sensor - rkisp1 CSI code was split into a separate file - sun6i has gained support for the A31 MIPI CSI-2 controller - sun8i has gained support for the A83T MIPI CSI-2 controller - vimc driver got support for virtual lens - HEVC uAPI has gained its final form and got added to public headers - hantro and cedrus got updates on H-265 support - stkwebcam was promoted from staging - atomisp staging driver got cleanups on its hmm and kmap related logic - ov5640 gained support for more modes and got some rework - imx7-media-csi staging driver got several improvements related to mc API support - uvcvideo now handles better power line control - mediatec vcodec gained support for new hardware and got some codec updates - Lots of other bug fixes, improvements and cleanups. * tag 'media/v5.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (446 commits) media: hantro: Remove dedicated control documentation hantro: Remove incorrect HEVC SPS validation media: cedrus: hevc: Add check for invalid timestamp media: sunxi: sun6i_mipi_csi2.c/sun8i_a83t_mipi_csi2.c: clarify error handling media: uvcvideo: Fix invalid pointer in uvc_ctrl_init_ctrl() media: Documentation: mc-core: Fix typo media: videodev2.h.rst.exceptions: add missing exceptions media: vimc: wrong pointer is used with PTR_ERR media: rkisp1: debug: Add dump file in debugfs for MI main path registers media: rkisp1: Make the internal CSI-2 receiver optional media: rkisp1: Add infrastructure to support ISP features media: rkisp1: Support the ISP parallel input media: dt-bindings: media: rkisp1: Add port for parallel interface media: rkisp1: Use fwnode_graph_for_each_endpoint media: rkisp1: csi: Plumb the CSI RX subdev media: rkisp1: csi: Implement a V4L2 subdev for the CSI receiver media: rkisp1: isp: Disallow multiple active sources media: rkisp1: isp: Rename rkisp1_get_remote_source() media: rkisp1: isp: Constify various local variables media: rkisp1: isp: Fix whitespace issues ... commit 80dc75932ff231b05e0adbf5054bf4c9f0fb468c Merge: f86d1fbbe7858 a11821495fd4d Author: Linus Torvalds Date: Wed Aug 3 19:23:51 2022 -0700 Merge tag 'i2c-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - new drivers: Microchip CoreI2C, Renesas RZV2M - quite some DT schema conversions and extensions - and a bunch of driver updates and improvements * tag 'i2c-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (37 commits) i2c: extend documentation about retvals of master_xfer functions i2c: mux-gpmux: Add of_node_put() when breaking out of loop dt-bindings: i2c: i2c-rk3x: Document Rockchip RV1126 i2c: qcom-geni: Use the correct return value i2c: cadence: Support PEC for SMBus block read i2c: qcom-geni: Propagate GENI_ABORT_DONE to geni_i2c_abort_xfer() i2c: brcmstb: Use dev_name() for adapter name i2c: Add Renesas RZ/V2M controller dt-bindings: i2c: Document RZ/V2M I2C controller i2c: mlxcpld: Add callback to notify probing completion i2c: scmi: Replace open coded device_get_match_data() i2c: stm32: add support for the STM32MP13 soc dt-bindings: i2c: st,stm32-i2c: add entry for stm32mp13 dt-bindings: i2c: i2c-rk3x: add rk3588 compatible i2c: add support for microchip fpga i2c controllers i2c: i801: Add support for Intel Meteor Lake-P dt-bindings: i2c: nomadik: Add power domain to binding dt-bindings: i2c: nomadik: Drop unused voltage supply from example i2c: Fix a potential use after free i2c: hisi: use HZ_PER_KHZ macro in units.h ... commit 4ae97cae07e15d41e5c0ebabba64c6eefdeb0bbe Author: Yu Xiao Date: Tue Aug 2 10:33:55 2022 +0100 nfp: ethtool: fix the display error of `ethtool -m DEVNAME` The port flag isn't set to `NFP_PORT_CHANGED` when using `ethtool -m DEVNAME` before, so the port state (e.g. interface) cannot be updated. Therefore, it caused that `ethtool -m DEVNAME` sometimes cannot read the correct information. E.g. `ethtool -m DEVNAME` cannot work when load driver before plug in optical module, as the port interface is still NONE without port update. Now update the port state before sending info to NIC to ensure that port interface is correct (latest state). Fixes: 61f7c6f44870 ("nfp: implement ethtool get module EEPROM") Reviewed-by: Louis Peens Signed-off-by: Yu Xiao Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220802093355.69065-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit 744d23c71af39c7dc77ac7c3cac87ae86a181a85 Author: Florian Fainelli Date: Mon Aug 1 16:34:03 2022 -0700 net: phy: Warn about incorrect mdio_bus_phy_resume() state Calling mdio_bus_phy_resume() with neither the PHY state machine set to PHY_HALTED nor phydev->mac_managed_pm set to true is a good indication that we can produce a race condition looking like this: CPU0 CPU1 bcmgenet_resume -> phy_resume -> phy_init_hw -> phy_start -> phy_resume phy_start_aneg() mdio_bus_phy_resume -> phy_resume -> phy_write(..., BMCR_RESET) -> usleep() -> phy_read() with the phy_resume() function triggering a PHY behavior that might have to be worked around with (see bf8bfc4336f7 ("net: phy: broadcom: Fix brcm_fet_config_init()") for instance) that ultimately leads to an error reading from the PHY. Fixes: fba863b81604 ("net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM") Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220801233403.258871-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski commit 7de196a6aa3a02f6079f5bf8796df4cb6cb5e783 Merge: f86d1fbbe7858 cba8d8f57dfb1 Author: Jakub Kicinski Date: Wed Aug 3 19:20:17 2022 -0700 Merge branch 'make-dsa-work-with-bonding-s-arp-monitor' Vladimir Oltean says: ==================== Make DSA work with bonding's ARP monitor Since commit 2b86cb829976 ("net: dsa: declare lockless TX feature for slave ports") in v5.7, DSA breaks the ARP monitoring logic from the bonding driver, fact which was pointed out by Brian Hutchinson who uses a linux-5.10.y stable kernel. Initially I got lured by other similar hacks introduced for other NETIF_F_LLTX drivers, which, inspired by the bonding documentation, update the trans_start of their TX queues by hand. However Jakub pointed out that this simply isn't a proper solution, and after coming to think more about it, I agree, and it doesn't work properly with DSA nor is it maintainable for the future changes I plan for it (multiple DSA masters in a LAG). I've tested these changes using a DSA-based setup and a veth-based setup, using the active-backup mode and ARP monitoring, with and without arp_validate. Link to v1: https://patchwork.kernel.org/project/netdevbpf/patch/20220715232641.952532-1-vladimir.oltean@nxp.com/ Link to v2: https://patchwork.kernel.org/project/netdevbpf/patch/20220727152000.3616086-1-vladimir.oltean@nxp.com/ ==================== Link: https://lore.kernel.org/r/20220731124108.2810233-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit cba8d8f57dfb1d01d961a0e50e7fddb82df57ad7 Author: Vladimir Oltean Date: Sun Jul 31 15:41:08 2022 +0300 docs: net: bonding: remove mentions of trans_start ARP monitoring no longer depends on dev->last_rx or dev_trans_start(), so delete this information. Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 08b403d5bf07d9e0d97ba12649b198eee42f826d Author: Vladimir Oltean Date: Sun Jul 31 15:41:07 2022 +0300 Revert "veth: Add updating of trans_start" This reverts commit e66e257a5d8368d9c0ba13d4630f474436533e8b. The veth driver no longer needs these hacks which are slightly detrimential to the fast path performance, because the bonding driver is keeping track of TX times of ARP and NS probes by itself, which it should. Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 4873a1b2024dce9a501b56d1039ff0752027a92e Author: Vladimir Oltean Date: Sun Jul 31 15:41:06 2022 +0300 net/sched: remove hacks added to dev_trans_start() for bonding to work Now that the bonding driver keeps track of the last TX time of ARP and NS probes, we effectively revert the following commits: 32d3e51a82d4 ("net_sched: use macvlan real dev trans_start in dev_trans_start()") 07ce76aa9bcf ("net_sched: make dev_trans_start return vlan's real dev trans_start") Note that the approach of continuing to hack at this function would not get us very far, hence the desire to take a different approach. DSA is also a virtual device that uses NETIF_F_LLTX, but there, many uppers share the same lower (DSA master, i.e. the physical host port of a switch). By making dev_trans_start() on a DSA interface return the dev_trans_start() of the master, we effectively assume that all other DSA interfaces are silent, otherwise this corrupts the validity of the probe timestamp data from the bonding driver's perspective. Furthermore, the hacks didn't take into consideration the fact that the lower interface of @dev may not have been physical either. For example, VLAN over VLAN, or DSA with 2 masters in a LAG. And even furthermore, there are NETIF_F_LLTX devices which are not stacked, like veth. The hack here would not work with those, because it would not have to provide the bonding driver something to chew at all. Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 06799a9085e12a778fe2851db550ab5911ad28fe Author: Vladimir Oltean Date: Sun Jul 31 15:41:05 2022 +0300 net: bonding: replace dev_trans_start() with the jiffies of the last ARP/NS The bonding driver piggybacks on time stamps kept by the network stack for the purpose of the netdev TX watchdog, and this is problematic because it does not work with NETIF_F_LLTX devices. It is hard to say why the driver looks at dev_trans_start() of the slave->dev, considering that this is updated even by non-ARP/NS probes sent by us, and even by traffic not sent by us at all (for example PTP on physical slave devices). ARP monitoring in active-backup mode appears to still work even if we track only the last TX time of actual ARP probes. Signed-off-by: Vladimir Oltean Acked-by: Jay Vosburgh Signed-off-by: Jakub Kicinski commit d20ec7529236a2fcdb2d856fc0bd80b409a217fc Author: Heiko Stuebner Date: Thu Jul 7 01:15:36 2022 +0200 riscv: implement cache-management errata for T-Head SoCs The T-Head C906 and C910 implement a scheme for handling cache operations different from the generic Zicbom extension. Add an errata for it next to the generic dma coherency ops. Reviewed-by: Samuel Holland Tested-by: Samuel Holland Reviewed-by: Guo Ren Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220706231536.2041855-5-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit f86d1fbbe7858884d6754534a0afbb74fc30bc26 Merge: 526942b8134cc 7c6327c77d509 Author: Linus Torvalds Date: Wed Aug 3 16:29:08 2022 -0700 Merge tag 'net-next-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking changes from Paolo Abeni: "Core: - Refactor the forward memory allocation to better cope with memory pressure with many open sockets, moving from a per socket cache to a per-CPU one - Replace rwlocks with RCU for better fairness in ping, raw sockets and IP multicast router. - Network-side support for IO uring zero-copy send. - A few skb drop reason improvements, including codegen the source file with string mapping instead of using macro magic. - Rename reference tracking helpers to a more consistent netdev_* schema. - Adapt u64_stats_t type to address load/store tearing issues. - Refine debug helper usage to reduce the log noise caused by bots. BPF: - Improve socket map performance, avoiding skb cloning on read operation. - Add support for 64 bits enum, to match types exposed by kernel. - Introduce support for sleepable uprobes program. - Introduce support for enum textual representation in libbpf. - New helpers to implement synproxy with eBPF/XDP. - Improve loop performances, inlining indirect calls when possible. - Removed all the deprecated libbpf APIs. - Implement new eBPF-based LSM flavor. - Add type match support, which allow accurate queries to the eBPF used types. - A few TCP congetsion control framework usability improvements. - Add new infrastructure to manipulate CT entries via eBPF programs. - Allow for livepatch (KLP) and BPF trampolines to attach to the same kernel function. Protocols: - Introduce per network namespace lookup tables for unix sockets, increasing scalability and reducing contention. - Preparation work for Wi-Fi 7 Multi-Link Operation (MLO) support. - Add support to forciby close TIME_WAIT TCP sockets via user-space tools. - Significant performance improvement for the TLS 1.3 receive path, both for zero-copy and not-zero-copy. - Support for changing the initial MTPCP subflow priority/backup status - Introduce virtually contingus buffers for sockets over RDMA, to cope better with memory pressure. - Extend CAN ethtool support with timestamping capabilities - Refactor CAN build infrastructure to allow building only the needed features. Driver API: - Remove devlink mutex to allow parallel commands on multiple links. - Add support for pause stats in distributed switch. - Implement devlink helpers to query and flash line cards. - New helper for phy mode to register conversion. New hardware / drivers: - Ethernet DSA driver for the rockchip mt7531 on BPI-R2 Pro. - Ethernet DSA driver for the Renesas RZ/N1 A5PSW switch. - Ethernet DSA driver for the Microchip LAN937x switch. - Ethernet PHY driver for the Aquantia AQR113C EPHY. - CAN driver for the OBD-II ELM327 interface. - CAN driver for RZ/N1 SJA1000 CAN controller. - Bluetooth: Infineon CYW55572 Wi-Fi plus Bluetooth combo device. Drivers: - Intel Ethernet NICs: - i40e: add support for vlan pruning - i40e: add support for XDP framented packets - ice: improved vlan offload support - ice: add support for PPPoE offload - Mellanox Ethernet (mlx5) - refactor packet steering offload for performance and scalability - extend support for TC offload - refactor devlink code to clean-up the locking schema - support stacked vlans for bridge offloads - use TLS objects pool to improve connection rate - Netronome Ethernet NICs (nfp): - extend support for IPv6 fields mangling offload - add support for vepa mode in HW bridge - better support for virtio data path acceleration (VDPA) - enable TSO by default - Microsoft vNIC driver (mana) - add support for XDP redirect - Others Ethernet drivers: - bonding: add per-port priority support - microchip lan743x: extend phy support - Fungible funeth: support UDP segmentation offload and XDP xmit - Solarflare EF100: add support for virtual function representors - MediaTek SoC: add XDP support - Mellanox Ethernet/IB switch (mlxsw): - dropped support for unreleased H/W (XM router). - improved stats accuracy - unified bridge model coversion improving scalability (parts 1-6) - support for PTP in Spectrum-2 asics - Broadcom PHYs - add PTP support for BCM54210E - add support for the BCM53128 internal PHY - Marvell Ethernet switches (prestera): - implement support for multicast forwarding offload - Embedded Ethernet switches: - refactor OcteonTx MAC filter for better scalability - improve TC H/W offload for the Felix driver - refactor the Microchip ksz8 and ksz9477 drivers to share the probe code (parts 1, 2), add support for phylink mac configuration - Other WiFi: - Microchip wilc1000: diable WEP support and enable WPA3 - Atheros ath10k: encapsulation offload support Old code removal: - Neterion vxge ethernet driver: this is untouched since more than 10 years" * tag 'net-next-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1890 commits) doc: sfp-phylink: Fix a broken reference wireguard: selftests: support UML wireguard: allowedips: don't corrupt stack when detecting overflow wireguard: selftests: update config fragments wireguard: ratelimiter: use hrtimer in selftest net/mlx5e: xsk: Discard unaligned XSK frames on striding RQ net: usb: ax88179_178a: Bind only to vendor-specific interface selftests: net: fix IOAM test skip return code net: usb: make USB_RTL8153_ECM non user configurable net: marvell: prestera: remove reduntant code octeontx2-pf: Reduce minimum mtu size to 60 net: devlink: Fix missing mutex_unlock() call net/tls: Remove redundant workqueue flush before destroy net: txgbe: Fix an error handling path in txgbe_probe() net: dsa: Fix spelling mistakes and cleanup code Documentation: devlink: add add devlink-selftests to the table of contents dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock net: ionic: fix error check for vlan flags in ionic_set_nic_features() net: ice: fix error NETIF_F_HW_VLAN_CTAG_FILTER check in ice_vsi_sync_fltr() nfp: flower: add support for tunnel offload without key ID ... commit 526942b8134cc34d25d27f95dfff98b8ce2f6fcd Merge: a39b5dbdd2bc5 b3b2bec9646eb Author: Linus Torvalds Date: Wed Aug 3 15:26:04 2022 -0700 Merge tag 'ata-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA updates from Damien Le Moal: - Some code refactoring for the pata_hpt37x and pata_hpt3x2n drivers, from Sergei. - Several patches to cleanup in libata-core, libata-scsi and libata-eh code: fixes arguments and variables types, change some functions declaration to static and fix for a typo in a comment. From Sergey and Xiang. - Fix a compilation warning in the pata_macio driver, from me. - A fix for the expected number of resources in the sata_mv driver fix, from Andrew. * tag 'ata-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: sata_mv: Fixes expected number of resources now IRQs are gone ata: libata-scsi: fix result type of ata_ioc32() ata: pata_macio: Fix compilation warning ata: libata-eh: fix sloppy result type of ata_internal_cmd_timeout() ata: libata-core: fix sloppy parameter type in ata_exec_internal[_sg]() ata: make ata_port::fastdrain_cnt *unsigned int* ata: libata-eh: fix sloppy result type of ata_eh_nr_in_flight() ata: libata-core: make ata_exec_internal_sg() *static* ata: make transfer mode masks *unsigned int* ata: libata-core: get rid of *else* branches in ata_id_n_sectors() ata: libata-core: fix sloppy typing in ata_id_n_sectors() ata: pata_hpt3x2n: pass base DPLL frequency to hpt3x2n_pci_clock() ata: pata_hpt37x: merge hpt374_read_freq() to hpt37x_pci_clock() ata: pata_hpt37x: factor out hpt37x_pci_clock() ata: pata_hpt37x: move claculating PCI clock from hpt37x_clock_slot() ata: libata: Fix syntax errors in comments commit a39b5dbdd2bc5ba36e6b90f2f979efcb090b0613 Merge: f18d73096c0ec 6bac30bb8ff81 Author: Linus Torvalds Date: Wed Aug 3 15:21:53 2022 -0700 Merge tag 'zonefs-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs update from Damien Le Moal: "A single change for this cycle to simplify handling of the memory page used as super block buffer during mount (from Fabio)" * tag 'zonefs-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Call page_address() on page acquired with GFP_KERNEL flag commit f18d73096c0eca1275f586cb984e6e28330447a0 Merge: 2e4f8c729db5f f8189d5d5fbf0 Author: Linus Torvalds Date: Wed Aug 3 15:16:49 2022 -0700 Merge tag 'iomap-5.20-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "The most notable change in this first batch is that we no longer schedule pages beyond i_size for writeback, preferring instead to let truncate deal with those pages. Next week, there may be a second pull request to remove iomap_writepage from the other two filesystems (gfs2/zonefs) that use iomap for buffered IO. This follows in the same vein as the recent removal of writepage from XFS, since it hasn't been triggered in a few years; it does nothing during direct reclaim; and as far as the people who examined the patchset can tell, it's moving the codebase in the right direction. However, as it was a late addition to for-next, I'm holding off on that section for another week of testing to see if anyone can come up with a solid reason for holding off in the meantime. Summary: - Skip writeback for pages that are completely beyond EOF - Minor code cleanups" * tag 'iomap-5.20-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: dax: set did_zero to true when zeroing successfully iomap: set did_zero to true when zeroing successfully iomap: skip pages past eof in iomap_do_writepage() commit 2e4f8c729db5f3c0b8ea8b1b99f1ae124152e8cc Merge: 353767e4aaeb7 5abbb7b92820c Author: Linus Torvalds Date: Wed Aug 3 15:12:40 2022 -0700 Merge tag 'affs-5.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull affs fix from David Sterba: "One update to AFFS, switching away from the kmap/kmap_atomic API" * tag 'affs-5.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: affs: use memcpy_to_page and remove replace kmap_atomic() commit 353767e4aaeb7bc818273dfacbb01dd36a9db47a Merge: ab17c0cd376f2 0b078d9db8793 Author: Linus Torvalds Date: Wed Aug 3 14:54:52 2022 -0700 Merge tag 'for-5.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "This brings some long awaited changes, the send protocol bump, otherwise lots of small improvements and fixes. The main core part is reworking bio handling, cleaning up the submission and endio and improving error handling. There are some changes outside of btrfs adding helpers or updating API, listed at the end of the changelog. Features: - sysfs: - export chunk size, in debug mode add tunable for setting its size - show zoned among features (was only in debug mode) - show commit stats (number, last/max/total duration) - send protocol updated to 2 - new commands: - ability write larger data chunks than 64K - send raw compressed extents (uses the encoded data ioctls), ie. no decompression on send side, no compression needed on receive side if supported - send 'otime' (inode creation time) among other timestamps - send file attributes (a.k.a file flags and xflags) - this is first version bump, backward compatibility on send and receive side is provided - there are still some known and wanted commands that will be implemented in the near future, another version bump will be needed, however we want to minimize that to avoid causing usability issues - print checksum type and implementation at mount time - don't print some messages at mount (mentioned as people asked about it), we want to print messages namely for new features so let's make some space for that - big metadata - this has been supported for a long time and is not a feature that's worth mentioning - skinny metadata - same reason, set by default by mkfs Performance improvements: - reduced amount of reserved metadata for delayed items - when inserted items can be batched into one leaf - when deleting batched directory index items - when deleting delayed items used for deletion - overall improved count of files/sec, decreased subvolume lock contention - metadata item access bounds checker micro-optimized, with a few percent of improved runtime for metadata-heavy operations - increase direct io limit for read to 256 sectors, improved throughput by 3x on sample workload Notable fixes: - raid56 - reduce parity writes, skip sectors of stripe when there are no data updates - restore reading from on-disk data instead of using stripe cache, this reduces chances to damage correct data due to RMW cycle - refuse to replay log with unknown incompat read-only feature bit set - zoned - fix page locking when COW fails in the middle of allocation - improved tracking of active zones, ZNS drives may limit the number and there are ENOSPC errors due to that limit and not actual lack of space - adjust maximum extent size for zone append so it does not cause late ENOSPC due to underreservation - mirror reading error messages show the mirror number - don't fallback to buffered IO for NOWAIT direct IO writes, we don't have the NOWAIT semantics for buffered io yet - send, fix sending link commands for existing file paths when there are deleted and created hardlinks for same files - repair all mirrors for profiles with more than 1 copy (raid1c34) - fix repair of compressed extents, unify where error detection and repair happen Core changes: - bio completion cleanups - don't double defer compression bios - simplify endio workqueues - add more data to btrfs_bio to avoid allocation for read requests - rework bio error handling so it's same what block layer does, the submission works and errors are consumed in endio - when asynchronous bio offload fails fall back to synchronous checksum calculation to avoid errors under writeback or memory pressure - new trace points - raid56 events - ordered extent operations - super block log_root_transid deprecated (never used) - mixed_backref and big_metadata sysfs feature files removed, they've been default for sufficiently long time, there are no known users and mixed_backref could be confused with mixed_groups Non-btrfs changes, API updates: - minor highmem API update to cover const arguments - switch all kmap/kmap_atomic to kmap_local - remove redundant flush_dcache_page() - address_space_operations::writepage callback removed - add bdev_max_segments() helper" * tag 'for-5.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (163 commits) btrfs: don't call btrfs_page_set_checked in finish_compressed_bio_read btrfs: fix repair of compressed extents btrfs: remove the start argument to check_data_csum and export btrfs: pass a btrfs_bio to btrfs_repair_one_sector btrfs: simplify the pending I/O counting in struct compressed_bio btrfs: repair all known bad mirrors btrfs: merge btrfs_dev_stat_print_on_error with its only caller btrfs: join running log transaction when logging new name btrfs: simplify error handling in btrfs_lookup_dentry btrfs: send: always use the rbtree based inode ref management infrastructure btrfs: send: fix sending link commands for existing file paths btrfs: send: introduce recorded_ref_alloc and recorded_ref_free btrfs: zoned: wait until zone is finished when allocation didn't progress btrfs: zoned: write out partially allocated region btrfs: zoned: activate necessary block group btrfs: zoned: activate metadata block group on flush_space btrfs: zoned: disable metadata overcommit for zoned btrfs: zoned: introduce space_info->active_total_bytes btrfs: zoned: finish least available block group on data bg allocation btrfs: let can_allocate_chunk return error ... commit ab17c0cd376f240bb8ead6f03be2bb4748bbc61a Merge: 97a77ab14ffac 2d82e6227ea18 Author: Linus Torvalds Date: Wed Aug 3 14:41:36 2022 -0700 Merge tag 'efi-efivars-removal-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull efivars sysfs interface removal from Ard Biesheuvel: "Remove the obsolete 'efivars' sysfs based interface to the EFI variable store, now that all users have moved to the efivarfs pseudo file system, which was created ~10 years ago to address some fundamental shortcomings in the sysfs based driver. Move the 'business logic' related to which EFI variables are important and may affect the boot flow from the efivars support layer into the efivarfs pseudo file system, so it is no longer exposed to other parts of the kernel" * tag 'efi-efivars-removal-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: vars: Move efivar caching layer into efivarfs efi: vars: Switch to new wrapper layer efi: vars: Remove deprecated 'efivars' sysfs interface commit 97a77ab14ffac749ec2419c92ec2954111c22d22 Merge: ff89dd08c0f0a e3435fff6ae03 Author: Linus Torvalds Date: Wed Aug 3 14:38:02 2022 -0700 Merge tag 'efi-next-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Enable mirrored memory for arm64 - Fix up several abuses of the efivar API - Refactor the efivar API in preparation for moving the 'business logic' part of it into efivarfs - Enable ACPI PRM on arm64 * tag 'efi-next-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (24 commits) ACPI: Move PRM config option under the main ACPI config ACPI: Enable Platform Runtime Mechanism(PRM) support on ARM64 ACPI: PRM: Change handler_addr type to void pointer efi: Simplify arch_efi_call_virt() macro drivers: fix typo in firmware/efi/memmap.c efi: vars: Drop __efivar_entry_iter() helper which is no longer used efi: vars: Use locking version to iterate over efivars linked lists efi: pstore: Omit efivars caching EFI varstore access layer efi: vars: Add thin wrapper around EFI get/set variable interface efi: vars: Don't drop lock in the middle of efivar_init() pstore: Add priv field to pstore_record for backend specific use Input: applespi - avoid efivars API and invoke EFI services directly selftests/kexec: remove broken EFI_VARS secure boot fallback check brcmfmac: Switch to appropriate helper to load EFI variable contents iwlwifi: Switch to proper EFI variable store interface media: atomisp_gmin_platform: stop abusing efivar API efi: efibc: avoid efivar API for setting variables efi: avoid efivars layer when loading SSDTs from variables efi: Correct comment on efi_memmap_alloc memblock: Disable mirror feature if kernelcore is not specified ... commit ff89dd08c0f0a3fd330c9ef9d775e880f82c291e Merge: d9b58ab789b05 f615625a44c4e Author: Linus Torvalds Date: Wed Aug 3 14:03:51 2022 -0700 Merge tag 'pull-work.9p' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull 9p iov_iter fix from Al Viro: "net/9p abuses iov_iter primitives - it attempts to copy _from_ a destination-only iov_iter when it handles Rerror arriving in reply to zero-copy request. Not hard to fix, fortunately. This is a prereq for the iov_iter_get_pages() work in the second part of iov_iter series, ended up in a separate branch" * tag 'pull-work.9p' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: 9p: handling Rerror without copy_from_iter_full() commit d9b58ab789b053b70dc475f1efda124857f10aa2 Merge: 5264406cdb66c c3497fd009ef2 Author: Linus Torvalds Date: Wed Aug 3 13:59:15 2022 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull copy_to_iter_mc fix from Al Viro: "Backportable fix for copy_to_iter_mc() - the second part of iov_iter work will pretty much overwrite this, but would be much harder to backport" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix short copy handling in copy_mc_pipe_to_iter() commit 863ed94c589fcd1984f4e3080f069d30508044bb Author: Mårten Lindahl Date: Mon Aug 1 15:57:03 2022 +0200 tpm: Add check for Failure mode for TPM2 modules In commit 0aa698787aa2 ("tpm: Add Upgrade/Reduced mode support for TPM2 modules") it was said that: "If the TPM is in Failure mode, it will successfully respond to both tpm2_do_selftest() and tpm2_startup() calls. Although, will fail to answer to tpm2_get_cc_attrs_tbl(). Use this fact to conclude that TPM is in Failure mode." But a check was never added in the commit when calling tpm2_get_cc_attrs_tbl() to conclude that the TPM is in Failure mode. This commit corrects this by adding a check. Fixes: 0aa698787aa2 ("tpm: Add Upgrade/Reduced mode support for TPM2 modules") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Mårten Lindahl Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bed4593645366ad7362a3aa7bc0d100d8d8236a8 Author: Huacai Chen Date: Mon Jul 11 09:17:38 2022 +0800 tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH If DEBUG_SECTION_MISMATCH enabled, __calc_tpm2_event_size() will not be inlined, this cause section mismatch like this: WARNING: modpost: vmlinux.o(.text.unlikely+0xe30c): Section mismatch in reference from the variable L0 to the function .init.text:early_ioremap() The function L0() references the function __init early_memremap(). This is often because L0 lacks a __init annotation or the annotation of early_ioremap is wrong. Fix it by using __always_inline instead of inline for the called-once function __calc_tpm2_event_size(). Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations") Cc: stable@vger.kernel.org # v5.3 Reported-by: WANG Xuerui Signed-off-by: Huacai Chen Signed-off-by: Jarkko Sakkinen commit ffd056fa31779756d7146fb17325fb7872c98812 Author: Yang Li Date: Fri Jul 1 17:13:22 2022 +0800 tpm: fix platform_no_drv_owner.cocci warning Eliminate the following coccicheck warning: ./drivers/char/tpm/tpm_tis_i2c.c:379:3-8: No need to set .owner here. The core will do it. Remove .owner field if calls are used which set it automatically Signed-off-by: Yang Li Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0815291a8fd66cdcf7db1445d4d99b0d16065829 Author: Tianjia Zhang Date: Tue Jun 28 11:37:20 2022 +0800 KEYS: asymmetric: enforce SM2 signature use pkey algo The signature verification of SM2 needs to add the Za value and recalculate sig->digest, which requires the detection of the pkey_algo in public_key_verify_signature(). As Eric Biggers said, the pkey_algo field in sig is attacker-controlled and should be use pkey->pkey_algo instead of sig->pkey_algo, and secondly, if sig->pkey_algo is NULL, it will also cause signature verification failure. The software_key_determine_akcipher() already forces the algorithms are matched, so the SM3 algorithm is enforced in the SM2 signature, although this has been checked, we still avoid using any algorithm information in the signature as input. Fixes: 215525639631 ("X.509: support OSCCA SM2-with-SM3 certificate verification") Reported-by: Eric Biggers Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Tianjia Zhang Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d35f42ca0778ed41c7b5243502b454b89cd699be Author: Elvira Khabirova Date: Mon Jun 27 17:21:42 2022 +0800 pkcs7: support EC-RDSA/streebog in SignerInfo Allow using EC-RDSA/streebog in pkcs7 certificates in a similar way to how it's done in the x509 parser. This is needed e.g. for loading kernel modules signed with EC-RDSA. Signed-off-by: Elvira Khabirova Reviewed-by: Vitaly Chikunov Reviewed-by: Tianjia Zhang Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 3fb8e3f532df608dd6f29940281138352f5b6369 Author: Tianjia Zhang Date: Mon Jun 27 17:21:41 2022 +0800 pkcs7: parser support SM2 and SM3 algorithms combination Support parsing the message signature of the SM2 and SM3 algorithm combination. This group of algorithms has been well supported. One of the main users is module signature verification. Signed-off-by: Tianjia Zhang Reviewed-by: Vitaly Chikunov Reviewed-by: Stefan Berger Signed-off-by: Jarkko Sakkinen commit 1a83950270684f860b15430394ea8df540d71353 Author: Tianjia Zhang Date: Mon Jun 27 17:21:07 2022 +0800 sign-file: Fix confusing error messages When an error occurs, use errx() instead of err() to display the error message, because openssl has its own error record. When an error occurs, errno will not be changed, while err() displays the errno error message. It will cause confusion. For example, when CMS_add1_signer() fails, the following message will appear: sign-file: CMS_add1_signer: Success errx() ignores errno and does not cause such issue. Signed-off-by: Tianjia Zhang Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 74ad4334b2ae4f83d8018487d625d1073fd3f02d Author: Tianjia Zhang Date: Mon Jun 27 17:19:58 2022 +0800 X.509: Support parsing certificate using SM2 algorithm The SM2-with-SM3 certificate generated by latest openssl no longer reuses the OID_id_ecPublicKey, but directly uses OID_sm2. This patch supports this type of x509 certificate parsing. Signed-off-by: Tianjia Zhang Signed-off-by: Jarkko Sakkinen commit bbc23a07b0728c820d665d0054b2e2a6d01f0a98 Author: Alexander Steffen Date: Wed Jun 8 19:31:13 2022 +0200 tpm: Add tpm_tis_i2c backend for tpm_tis_core Implement the TCG I2C Interface driver, as specified in the TCG PC Client Platform TPM Profile (PTP) specification for TPM 2.0 v1.04 revision 14, section 8, I2C Interface Definition. This driver supports Guard Times. That is, if required by the TPM, the driver has to wait by a vendor-specific time after each I2C read/write. The specific time is read from the TPM_I2C_INTERFACE_CAPABILITY register. Unfortunately, the TCG specified almost but not quite compatible register addresses. Therefore, the TIS register addresses need to be mapped to I2C ones. The locality is stripped because for now, only locality 0 is supported. Add a sanity check to I2C reads of e.g. TPM_ACCESS and TPM_STS. This is to detect communication errors and issues due to non-standard behaviour (E.g. the clock stretching quirk in the BCM2835, see 4dbfb5f4401f). In case the sanity check fails, attempt a retry. Co-developed-by: Johannes Holland Signed-off-by: Johannes Holland Co-developed-by: Amir Mizinski Signed-off-by: Amir Mizinski Signed-off-by: Alexander Steffen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f25534a68b8e1ed8266d23b464a3b512364b124d Author: Alexander Steffen Date: Wed Jun 8 19:31:12 2022 +0200 tpm: Add tpm_tis_verify_crc to the tpm_tis_phy_ops protocol layer Some TPMs, e.g. those implementing the I2C variant of TIS, can verify data transfers to/from the FIFO with a CRC. The CRC is calculated over the entirety of the FIFO register. Since the phy_ops layer is not aware when the core layer is done reading/writing the FIFO, CRC verification must be triggered from the core layer. To this end, add an optional phy_ops API call. Co-developed-by: Johannes Holland Signed-off-by: Johannes Holland Signed-off-by: Alexander Steffen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2353673d8a025a6ba3b3aa3917a3a98944e64702 Author: Alexander Steffen Date: Wed Jun 8 19:31:11 2022 +0200 dt-bindings: trivial-devices: Add Infineon SLB9673 TPM Initial device to be supported by the upcoming tpm_tis_i2c driver. More to be added later. Signed-off-by: Alexander Steffen Acked-by: Rob Herring Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 5e3a3f27cbded417e6d1ea2bb9739b572c09580e Author: Stefan Mahnke-Hartmann Date: Fri Jun 3 10:41:58 2022 +0200 tpm: Add upgrade/reduced mode support for TPM1.2 modules In case a TPM in failure mode is detected, the TPM should be accessible through a transparent communication channel for analysing purposes (e.g. TPM_GetTestResult) or a field upgrade. Since a TPM in failure mode has similar reduced functionality as in field upgrade mode, the flag TPM_CHIP_FLAG_FIRMWARE_UPGRADE is also valid. As described in TCG TPM Main Part1 Design Principles, Revision 116, chapter 9.2.1. the TPM also allows an update function in case a TPM is in failure mode. If the TPM in failure mode is detected, the function tpm1_auto_startup() sets TPM_CHIP_FLAG_FIRMWARE_UPGRADE flag, which is used later during driver initialization/deinitialization to disable functionality which makes no sense or will fail in the current TPM state. The following functionality is affected: * Do not register TPM as a hwrng * Do not get pcr allocation * Do not register sysfs entries which provide information impossible to obtain in limited mode Signed-off-by: Stefan Mahnke-Hartmann Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 5264406cdb66c7003eb3edf53c9773b1b20611b9 Merge: 200e340f2196d dd45ab9dd28c8 Author: Linus Torvalds Date: Wed Aug 3 13:50:22 2022 -0700 Merge tag 'pull-work.iov_iter-base' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs iov_iter updates from Al Viro: "Part 1 - isolated cleanups and optimizations. One of the goals is to reduce the overhead of using ->read_iter() and ->write_iter() instead of ->read()/->write(). new_sync_{read,write}() has a surprising amount of overhead, in particular inside iocb_flags(). That's the explanation for the beginning of the series is in this pile; it's not directly iov_iter-related, but it's a part of the same work..." * tag 'pull-work.iov_iter-base' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: first_iovec_segment(): just return address iov_iter: massage calling conventions for first_{iovec,bvec}_segment() iov_iter: first_{iovec,bvec}_segment() - simplify a bit iov_iter: lift dealing with maxpages out of first_{iovec,bvec}_segment() iov_iter_get_pages{,_alloc}(): cap the maxsize with MAX_RW_COUNT iov_iter_bvec_advance(): don't bother with bvec_iter copy_page_{to,from}_iter(): switch iovec variants to generic keep iocb_flags() result cached in struct file iocb: delay evaluation of IS_SYNC(...) until we want to check IOCB_DSYNC struct file: use anonymous union member for rcuhead and llist btrfs: use IOMAP_DIO_NOSYNC teach iomap_dio_rw() to suppress dsync No need of likely/unlikely on calls of check_copy_size() commit 200e340f2196d7fd427a5810d06e893b932f145a Merge: a782e86649721 50417d22d0efb Author: Linus Torvalds Date: Wed Aug 3 11:43:12 2022 -0700 Merge tag 'pull-work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs dcache updates from Al Viro: "The main part here is making parallel lookups safe for RT - making sure preemption is disabled in start_dir_add()/ end_dir_add() sections (on non-RT it's automatic, on RT it needs to to be done explicitly) and moving wakeups from __d_lookup_done() inside of such to the end of those sections. Wakeups can be safely delayed for as long as ->d_lock on in-lookup dentry is held; proving that has caught a bug in d_add_ci() that allows memory corruption when sufficiently bogus ntfs (or case-insensitive xfs) image is mounted. Easily fixed, fortunately" * tag 'pull-work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/dcache: Move wakeup out of i_seq_dir write held region. fs/dcache: Move the wakeup from __d_lookup_done() to the caller. fs/dcache: Disable preemption on i_dir_seq write side on PREEMPT_RT d_add_ci(): make sure we don't miss d_lookup_done() commit 360614c01f81f48a89d8b13f8fa69c3ae0a1f5c7 Author: Andrew Morton Date: Tue Aug 2 18:03:03 2022 -0700 tools/testing/selftests/vm/hmm-tests.c: fix build hmm-tests.c:1607:42: error: 'HMM_DMIRROR_MIGRATE' undeclared (first use in this function); did you mean 'HMM_DMIRROR_WRITE'? Fixes: f6c3e1ae0114cd0 ("mm/hmm: add a test for cross device private faults") Reported-by: kernel test robot Reviewed-by: Ralph Campbell Cc: Alistair Popple Signed-off-by: Andrew Morton commit a782e866497217f22c5d9014cbb7be8549151376 Merge: d9395512c5bd3 868941b144412 Author: Linus Torvalds Date: Wed Aug 3 11:35:20 2022 -0700 Merge tag 'pull-work.lseek' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs lseek updates from Al Viro: "Jason's lseek series. Saner handling of 'lseek should fail with ESPIPE' - this gets rid of the magical no_llseek thing and makes checks consistent. In particular, the ad-hoc "can we do splice via internal pipe" checks got saner (and somewhat more permissive, which is what Jason had been after, AFAICT)" * tag 'pull-work.lseek' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: remove no_llseek fs: check FMODE_LSEEK to control internal pipe splicing vfio: do not set FMODE_LSEEK flag dma-buf: remove useless FMODE_LSEEK flag fs: do not compare against ->llseek fs: clear or set FMODE_LSEEK based on llseek function commit 5b045200b53a9b95f87409b5c13f43adb6f1da6c Author: Krzysztof Kozlowski Date: Tue Jul 26 13:52:02 2022 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: add PM8226 constraints Document the constraints (number of GPIOs) for PM8226 variant. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220726115202.99108-1-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit d9395512c5bd326924ba0b36ee0d5d51d763a8d6 Merge: f00654007fe1c 3bd8bc8971617 Author: Linus Torvalds Date: Wed Aug 3 11:31:42 2022 -0700 Merge tag 'pull-work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs namei updates from Al Viro: "RCU pathwalk cleanups. Storing sampled ->d_seq of the next dentry in nameidata simplifies life considerably, especially if we delay fetching ->d_inode until step_into()" * tag 'pull-work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: step_into(): move fetching ->d_inode past handle_mounts() lookup_fast(): don't bother with inode follow_dotdot{,_rcu}(): don't bother with inode step_into(): lose inode argument namei: stash the sampled ->d_seq into nameidata namei: move clearing LOOKUP_RCU towards rcu_read_unlock() switch try_to_unlazy_next() to __legitimize_mnt() follow_dotdot{,_rcu}(): change calling conventions namei: get rid of pointless unlikely(read_seqcount_retry(...)) __follow_mount_rcu(): verify that mount_lock remains unchanged commit 9a206bca238177f7fa09fef6735aab7d5d3b2b19 Author: John Garry Date: Tue Jul 26 18:02:44 2022 +0800 pinctrl: qcom: Make PINCTRL_SM8450 depend on PINCTRL_MSM All the many other configs depend on config PINCTRL_MSM, yet for config PINCTRL_SM8450 we select config PINCTRL_MSM. Make config PINCTRL_SM8450 depend on PINCTRL_MSM to be consistent with the rest. Signed-off-by: John Garry Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/r/1658829764-124936-1-git-send-email-john.garry@huawei.com Signed-off-by: Linus Walleij commit 24df5428ef9d1ca1edd54eca7eb667110f2dfae3 Author: Ivan Hasenkampf Date: Wed Aug 3 18:40:01 2022 +0200 ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx Fixes speaker output on HP Spectre x360 15-eb0xxx [ re-sorted in SSID order by tiwai ] Signed-off-by: Ivan Hasenkampf Cc: Link: https://lore.kernel.org/r/20220803164001.290394-1-ivan.hasenkampf@gmail.com Signed-off-by: Takashi Iwai commit 4b759ca15a4914f96ea204ea9200ceeb01d70666 Author: Jianhua Lu Date: Wed Aug 3 09:56:45 2022 +0800 pinctrl: qcom: sm8250: Fix PDC map Fix the PDC mapping for SM8250, gpio39 is mapped to irq73(not irq37). Fixes: b41efeed507a("pinctrl: qcom: sm8250: Specify PDC map.") Signed-off-by: Jianhua Lu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20220803015645.22388-1-lujianhua000@gmail.com Signed-off-by: Linus Walleij commit df91ffe8cb75d9d80ffe821493bffdc11e65687c Author: Mario Limonciello Date: Mon Aug 1 09:49:52 2022 -0500 pinctrl: amd: Fix an unused variable `char *output_enable` is no longer used once switching to unicode output. Fixes: e8129a076a50 ("pinctrl: amd: Use unicode for debugfs output") Reported-by: kernel test robot Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20220801144952.141-1-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit f00654007fe1c154dafbdc1f5953c132e8c27c38 Merge: e087437a6fef3 cf5e7a652168f Author: Linus Torvalds Date: Wed Aug 3 10:35:43 2022 -0700 Merge tag 'folio-6.0' of git://git.infradead.org/users/willy/pagecache Pull folio updates from Matthew Wilcox: - Fix an accounting bug that made NR_FILE_DIRTY grow without limit when running xfstests - Convert more of mpage to use folios - Remove add_to_page_cache() and add_to_page_cache_locked() - Convert find_get_pages_range() to filemap_get_folios() - Improvements to the read_cache_page() family of functions - Remove a few unnecessary checks of PageError - Some straightforward filesystem conversions to use folios - Split PageMovable users out from address_space_operations into their own movable_operations - Convert aops->migratepage to aops->migrate_folio - Remove nobh support (Christoph Hellwig) * tag 'folio-6.0' of git://git.infradead.org/users/willy/pagecache: (78 commits) fs: remove the NULL get_block case in mpage_writepages fs: don't call ->writepage from __mpage_writepage fs: remove the nobh helpers jfs: stop using the nobh helper ext2: remove nobh support ntfs3: refactor ntfs_writepages mm/folio-compat: Remove migration compatibility functions fs: Remove aops->migratepage() secretmem: Convert to migrate_folio hugetlb: Convert to migrate_folio aio: Convert to migrate_folio f2fs: Convert to filemap_migrate_folio() ubifs: Convert to filemap_migrate_folio() btrfs: Convert btrfs_migratepage to migrate_folio mm/migrate: Add filemap_migrate_folio() mm/migrate: Convert migrate_page() to migrate_folio() nfs: Convert to migrate_folio btrfs: Convert btree_migratepage to migrate_folio mm/migrate: Convert expected_page_refs() to folio_expected_refs() mm/migrate: Convert buffer_migrate_page() to buffer_migrate_folio() ... commit 6c58cf40e3a1d2f47c09d3489857e9476316788a Author: Florian Fainelli Date: Mon Jul 25 10:37:54 2022 -0700 tools/thermal: Fix possible path truncations A build with -D_FORTIFY_SOURCE=2 enabled will produce the following warnings: sysfs.c:63:30: warning: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 255 [-Wformat-truncation=] snprintf(filepath, 256, "%s/%s", path, filename); ^~ Bump up the buffer to PATH_MAX which is the limit and account for all of the possible NUL and separators that could lead to exceeding the allocated buffer sizes. Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem") Signed-off-by: Florian Fainelli Signed-off-by: Rafael J. Wysocki commit 8df4ef3eaa62b25afbb30cc7707cc99ec155ed71 Author: Jean Delvare Date: Sun Jul 31 14:13:52 2022 +0200 thermal: Drop obsolete dependency on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. It is actually better to always build such drivers with OF enabled, so that the test builds are closer to how each driver will actually be built on its intended target. Building them without OF may not test much as the compiler will optimize out potentially large parts of the code. In the worst case, this could even pop false positive warnings. Dropping COMPILE_TEST here improves the quality of our testing and avoids wasting time on non-existent issues. Signed-off-by: Jean Delvare Signed-off-by: Rafael J. Wysocki commit d5a8aa5d7d80d21ab6b266f1bed4194b61746199 Author: Rafael J. Wysocki Date: Fri Jul 29 17:39:07 2022 +0200 thermal: sysfs: Fix cooling_device_stats_setup() error code path If cooling_device_stats_setup() fails to create the stats object, it must clear the last slot in cooling_device_attr_groups that was initially empty (so as to make it possible to add stats attributes to the cooling device attribute groups). Failing to do so may cause the stats attributes to be created by mistake for a device that doesn't have a stats object, because the slot in question might be populated previously during the registration of another cooling device. Fixes: 8ea229511e06 ("thermal: Add cooling device's statistics in sysfs") Reported-by: Di Shen Tested-by: Di Shen Cc: 4.17+ # 4.17+ Signed-off-by: Rafael J. Wysocki commit 312c1a44da370a367b643fae63107211104a1464 Author: Sumeet Pawnikar Date: Thu Jul 28 23:24:56 2022 +0530 thermal: intel: Add TCC cooling support for Alder Lake-N and Raptor Lake-P Add Alder Lake-N and Raptor Lake-P to the list of processor models supported by the Intel TCC cooling driver. Signed-off-by: Sumeet Pawnikar Acked-by: Zhang Rui Signed-off-by: Rafael J. Wysocki commit e087437a6fef3acc11aaa1ade84731fe1571b808 Merge: b6bb70f9ab80a 85656ec193e9c Author: Linus Torvalds Date: Wed Aug 3 10:02:28 2022 -0700 Merge tag 'xarray-6.0' of git://git.infradead.org/users/willy/xarray Pull XArray/IDR updates from Matthew Wilcox: - Add appropriate might_alloc() annotations to the XArray APIs - Document that the IDR is deprecated * tag 'xarray-6.0' of git://git.infradead.org/users/willy/xarray: IDR: Note that the IDR API is deprecated XArray: Add calls to might_alloc() commit b6bb70f9ab80a11161252bf217993d2c40ea5eb2 Merge: e2b542100719a 265792d0dede9 Author: Linus Torvalds Date: Wed Aug 3 09:45:08 2022 -0700 Merge tag 'cgroup-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Several core optimizations: - threadgroup_rwsem write locking is skipped when configuring controllers in empty subtrees. Combined with CLONE_INTO_CGROUP, this allows the common static usage pattern to not grab threadgroup_rwsem at all (glibc still doesn't seem ready for CLONE_INTO_CGROUP unfortunately). - threadgroup_rwsem used to be put into non-percpu mode by default due to latency concerns in specific use cases. There's no reason for everyone else to pay for it. Make the behavior optional. - psi no longer allocates memory when disabled. ... along with some code cleanups" * tag 'cgroup-for-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Skip subtree root in cgroup_update_dfl_csses() cgroup: remove "no" prefixed mount options cgroup: Make !percpu threadgroup_rwsem operations optional cgroup: Add "no" prefixed mount options cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree cgroup.c: remove redundant check for mixable cgroup in cgroup_migrate_vet_dst cgroup.c: add helper __cset_cgroup_from_root to cleanup duplicated codes psi: dont alloc memory for psi by default commit bb8bc52e75785af94b9ba079277547d50d018a52 Author: Adrián Herrera Arcila Date: Fri Jul 29 16:12:43 2022 +0000 perf stat: Refactor __run_perf_stat() common code This extracts common code from the branches of the forks if-then-else. enable_counters(), which was at the beginning of both branches of the conditional, is now unconditional; evlist__start_workload() is extracted to a different if, which enables making the common clocking code unconditional. Reviewed-by: Leo Yan Signed-off-by: Adrián Herrera Arcila Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Link: https://lore.kernel.org/r/20220729161244.10522-1-adrian.herrera@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 6ab4b1990097b76508bd6dffd85ffcacbedb26b2 Author: Kajetan Puchalski Date: Tue Jul 26 11:24:04 2022 +0100 cpuidle: Add cpu_idle_miss trace event Add a trace event for cpuidle to track missed (too deep or too shallow) wakeups. After each wakeup, CPUIdle already computes whether the entered state was optimal, above or below the desired one and updates the relevant counters. This patch makes it possible to trace those events in addition to just reading the counters. The patterns of types and percentages of misses across different workloads appear to be very consistent. This makes the trace event very useful for comparing the relative correctness of different CPUIdle governors for different types of workloads, or for finding the optimal governor for a given device. Signed-off-by: Kajetan Puchalski Reviewed-by: Steven Rostedt (Google) Signed-off-by: Rafael J. Wysocki commit f6e0b468dab97a9214c9713c298ed9e2dd62f97f Merge: a771ea6413c00 1d95af02f2303 Author: Rafael J. Wysocki Date: Wed Aug 3 17:49:38 2022 +0200 Merge tag 'opp-updates-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull operating performance points (OPP) updates for 5.20-rc1 from Viresh Kumar: "- Make dev_pm_opp_set_regulators() accept NULL terminated list (Viresh Kumar). - Add dev_pm_opp_set_config() and friends and migrate other users/helpers to using them (Viresh Kumar). - Add support for multiple clocks for a device (Viresh Kumar and Krzysztof Kozlowski). - Configure resources before adding OPP table for Venus (Stanimir Varbanov). - Keep reference count up for opp->np and opp_table->np while they are still in use (Liang He). - Minor cleanups (Viresh Kumar and Yang Li)." * tag 'opp-updates-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: (43 commits) venus: pm_helpers: Fix warning in OPP during probe OPP: Don't drop opp->np reference while it is still in use OPP: Don't drop opp_table->np reference while it is still in use OPP: Remove dev{m}_pm_opp_of_add_table_noclk() PM / devfreq: tegra30: Register config_clks helper OPP: Allow config_clks helper for single clk case OPP: Provide a simple implementation to configure multiple clocks OPP: Assert clk_count == 1 for single clk helpers OPP: Add key specific assert() method to key finding helpers OPP: Compare bandwidths for all paths in _opp_compare_key() OPP: Allow multiple clocks for a device dt-bindings: opp: accept array of frequencies OPP: Make dev_pm_opp_set_opp() independent of frequency OPP: Reuse _opp_compare_key() in _opp_add_static_v2() OPP: Remove rate_not_available parameter to _opp_add() OPP: Use consistent names for OPP table instances OPP: Use generic key finding helpers for bandwidth key OPP: Use generic key finding helpers for level key OPP: Add generic key finding helpers and use them for freq APIs OPP: Remove dev_pm_opp_find_freq_ceil_by_volt() ... commit 7912c9c6a6e8ebda603facfe314701c0e45440bb Merge: a771ea6413c00 33fe1cb20cf44 Author: Rafael J. Wysocki Date: Wed Aug 3 17:47:45 2022 +0200 Merge tag 'cpufreq-arm-updates-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq/ARM updates for 5.20-rc1 from Viresh Kumar: "- Fix return error code in mtk_cpu_dvfs_info_init (Yang Yingliang). - Minor cleanups and support for new boards for Qcom cpufreq drivers (Bryan O'Donoghue, Konrad Dybcio, Pierre Gondois, and Yicong Yang). - Fix sparse warnings for Tegra driver (Viresh Kumar)." * tag 'cpufreq-arm-updates-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: tegra194: Staticize struct tegra_cpufreq_soc instances dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM6375 compatible dt-bindings: opp: Add msm8939 to the compatible list dt-bindings: opp: Add missing compat devices dt-bindings: opp: opp-v2-kryo-cpu: Fix example binding checks cpufreq: Change order of online() CB and policy->cpus modification cpufreq: qcom-hw: Remove deprecated irq_set_affinity_hint() call cpufreq: qcom-hw: Disable LMH irq when disabling policy cpufreq: qcom-hw: Reset cancel_throttle when policy is re-enabled cpufreq: qcom-cpufreq-hw: use HZ_PER_KHZ macro in units.h cpufreq: mediatek: fix error return code in mtk_cpu_dvfs_info_init() commit 451e45a0e6df21e63acfd493feb5194f4697ce11 Author: Konstantin Komarov Date: Wed Jul 13 19:18:19 2022 +0300 fs/ntfs3: Make ni_ins_new_attr return error Function ni_ins_new_attr now returns ERR_PTR(err), so we check it now in other functions like ni_expand_mft_list Signed-off-by: Konstantin Komarov commit 8039edba043d1eaee74bd76e0280a49ba5e195d7 Author: Konstantin Komarov Date: Wed Jul 13 19:11:15 2022 +0300 fs/ntfs3: Create MFT zone only if length is large enough Also removed uninformative print Signed-off-by: Konstantin Komarov commit 9256ec35359f52c1e390cf419873cf519ee332b6 Author: Konstantin Komarov Date: Wed Jul 13 18:44:24 2022 +0300 fs/ntfs3: Refactoring attr_insert_range to restore after errors Added done and undo labels for restoring after errors Signed-off-by: Konstantin Komarov commit 20abc64f78346ac591344133301661b77e1c8253 Author: Konstantin Komarov Date: Wed Jul 13 18:18:48 2022 +0300 fs/ntfs3: Refactoring attr_punch_hole to restore after errors Added comments to code Added new function run_clone to make a copy of run Added done and undo labels for restoring after errors Signed-off-by: Konstantin Komarov commit 0e5b044cbf3a41b4efad7d9616342338f88b373d Author: Konstantin Komarov Date: Wed Jul 13 18:00:03 2022 +0300 fs/ntfs3: Refactoring attr_set_size to restore after errors Added comments to code Added two undo labels for restoring after errors Signed-off-by: Konstantin Komarov commit c12df45ee690112782049b8e85dff2e6cb1b3853 Author: Konstantin Komarov Date: Wed Jul 13 17:55:27 2022 +0300 fs/ntfs3: New function ntfs_bad_inode There are repetitive steps in case of bad inode This commit wraps them in function Signed-off-by: Konstantin Komarov commit 8335ebe195dcc76ece418485a9f08b9a9ad7fe23 Author: Konstantin Komarov Date: Thu Jul 7 19:25:43 2022 +0300 fs/ntfs3: Make MFT zone less fragmented Now we take free space after the MFT zone if the MFT zone shrinks. Signed-off-by: Konstantin Komarov commit e6d9398c077d8e21a2ca50efab5cbf7ff5aff728 Author: Konstantin Komarov Date: Wed Jul 6 20:17:28 2022 +0300 fs/ntfs3: Check possible errors in run_pack in advance Checking in advance speeds things up in some cases. Signed-off-by: Konstantin Komarov commit 54033c135061b52d4405facba2e49177a5716a31 Author: Konstantin Komarov Date: Wed Jul 6 20:01:11 2022 +0300 fs/ntfs3: Added comments to frecord functions Added some comments in frecord.c for more context. Also changed run_lookup to static because it's an internal function. Signed-off-by: Konstantin Komarov commit 42f66a7fdaa0d15691467fb7a808040f2d5ad0c0 Author: Konstantin Komarov Date: Fri Jul 1 15:18:29 2022 +0300 fs/ntfs3: Fill duplicate info in ni_add_name Work with names must be completed in ni_add_name Signed-off-by: Konstantin Komarov commit cf760ec0a0b4015ccf3b5e9ecb4caf6b5fb52f0b Author: Konstantin Komarov Date: Fri Jul 1 15:15:32 2022 +0300 fs/ntfs3: Make static function attr_load_runs attr_load_runs is an internal function Signed-off-by: Konstantin Komarov commit 071100ea0e6c353258f322cb2f8dde9be62d6808 Author: Konstantin Komarov Date: Thu Jun 30 19:14:43 2022 +0300 fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free This argument helps in avoiding double locking Signed-off-by: Konstantin Komarov commit 6700eabb90d50c50be21ecbb71131cd6ecf91ded Author: Konstantin Komarov Date: Thu Jun 30 18:49:24 2022 +0300 fs/ntfs3: Remove unused mi_mark_free Cleaning up dead code Fix wrong comments Signed-off-by: Konstantin Komarov commit 560f7736b94622c077344e2c541c43c63b4e90e4 Author: Konstantin Komarov Date: Thu Jun 30 18:31:26 2022 +0300 fs/ntfs3: Fix very fragmented case in attr_punch_hole In some cases we need to ni_find_attr attr_b Signed-off-by: Konstantin Komarov commit 42f86b1226a42bfc79a7125af435432ad4680a32 Author: Konstantin Komarov Date: Fri May 13 19:54:23 2022 +0300 fs/ntfs3: Fix work with fragmented xattr In some cases xattr is too fragmented, so we need to load it before writing. Signed-off-by: Konstantin Komarov commit b3e048720dee5641c522015d3f0ff0f0dc9cdc37 Author: Konstantin Komarov Date: Fri May 13 19:21:54 2022 +0300 fs/ntfs3: Make ntfs_fallocate return -ENOSPC instead of -EFBIG In some cases we need to return ENOSPC Fixes xfstest generic/213 Fixes: 114346978cf6 ("fs/ntfs3: Check new size for limits") Signed-off-by: Konstantin Komarov commit c1e0ab3789215a3dfbe95f226955e93ea4803391 Author: Konstantin Komarov Date: Fri May 13 18:25:04 2022 +0300 fs/ntfs3: extend ni_insert_nonresident to return inserted ATTR_LIST_ENTRY Fixes xfstest generic/300 Fixes: 4534a70b7056 ("fs/ntfs3: Add headers and misc files") Signed-off-by: Konstantin Komarov commit 13747aac8984e069427e5de5d68bb6cefa98551e Author: Konstantin Komarov Date: Thu May 12 19:18:11 2022 +0300 fs/ntfs3: Check reserved size for maximum allowed Also don't mask EFBIG Fixes xfstest generic/485 Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Konstantin Komarov commit 460bbf2990b3fdc597601c2cf669a3371c069242 Author: Konstantin Komarov Date: Thu May 12 19:08:40 2022 +0300 fs/ntfs3: Do not change mode if ntfs_set_ea failed ntfs_set_ea can fail with NOSPC, so we don't need to change mode in this situation. Fixes xfstest generic/449 Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Signed-off-by: Konstantin Komarov commit 8a8dc2b9596e6088522d30bc79306b834c681943 Author: Peng Fan Date: Wed Aug 3 15:53:26 2022 +0800 mailbox: imx: clear pending interrupts During MU initialization, there maybe pending GSR and RSR pending interrupt, clear them to avoid unexpected kernel dump when requesting mailbox channel Reviewed-by: Jacky Bai Reviewed-by: Ye Li Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit ff2557b7224ea9a19fb79eb4bd16d4deef57816a Author: Ming Lei Date: Wed Aug 3 20:07:57 2022 +0800 io_uring: pass correct parameters to io_req_set_res The two parameters of 'res' and 'cflags' are swapped, so fix it. Without this fix, 'ublk del' hangs forever. Cc: Pavel Begunkov Fixes: de23077eda61f ("io_uring: set completion results upfront") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220803120757.1668278-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 5419aa2a8deea06b796222d3215dac6adc270c78 Author: Masahiro Yamada Date: Sun Jul 31 02:36:35 2022 +0900 modpost: use more reliable way to get fromsec in section_rel(a)() The section name of Rel and Rela starts with ".rel" and ".rela" respectively (but, I do not know whether this is specification or convention). For example, ".rela.text" holds relocation entries applied to the ".text" section. So, the code chops the ".rel" or ".rela" prefix to get the name of the section to which the relocation applies. However, I do not like to skip 4 or 5 bytes blindly because it is potential memory overrun. The ELF specification provides a more reliable way to do this. - The sh_info field holds extra information, whose interpretation depends on the section type - If the section type is SHT_REL or SHT_RELA, the sh_info field holds the section header index of the section to which the relocation applies. Signed-off-by: Masahiro Yamada commit 125ed24a4ab0d704bab5dee5ccb2c3b05f627c78 Author: Masahiro Yamada Date: Sun Jul 31 02:36:34 2022 +0900 modpost: add array range check to sec_name() The section index is always positive, so the argument, secindex, should be unsigned. Also, inserted the array range check. If sym->st_shndx is a special section index (between SHN_LORESERVE and SHN_HIRESERVE), there is no corresponding section header. For example, if a symbol specifies an absolute value, sym->st_shndx is SHN_ABS (=0xfff1). The current users do not cause the out-of-range access of info->sechddrs[], but it is better to avoid such a pitfall. Signed-off-by: Masahiro Yamada commit 36b0f0deed4fcbe9ff31268e6c3554714e4d2387 Author: Masahiro Yamada Date: Wed Aug 3 22:50:13 2022 +0900 modpost: refactor get_secindex() SPECIAL() is only used in get_secindex(). Squash it. Make the code more readable with more comments. Signed-off-by: Masahiro Yamada commit dd29865633a5535889568b5f38f74a445c227e5d Author: Masahiro Yamada Date: Thu Jul 28 12:14:33 2022 +0900 kbuild: set EXIT trap before creating temporary directory Swap the order of 'mkdir' and 'trap' just in case the subshell is interrupted between 'mkdir' and 'trap' although the effect might be subtle. This does not intend to make the cleanup perfect. There are more cases that miss to remove the tmp directory, for example: - When interrupted, dash does not invoke the EXIT trap (bash does) - 'rm' command might be interrupted before removing the directory I am not addressing all the cases since the tmp directory is harmless after all. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 40bf722f8064f50200b8c4f8946cd625b441dda9 Author: Zheyu Ma Date: Wed Aug 3 17:24:19 2022 +0800 video: fbdev: i740fb: Check the argument of i740_calc_vclk() Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug. If the user provides an improper 'pixclock' value that makes the argumet of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a divide-by-zero bug in: drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX))); The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of i740_calc_vclk() first. Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller commit 2f1c4523f7a3aaabe7e53d3ebd378292947e95c8 Author: Zheyu Ma Date: Wed Aug 3 17:23:12 2022 +0800 video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock); we'll get a division-by-zero. The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of ark_set_pixclock() first. Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller commit ba6e31af2be96c4d0536f2152ed6f7b6c11bca47 Author: Pawan Gupta Date: Tue Aug 2 15:47:02 2022 -0700 x86/speculation: Add LFENCE to RSB fill sequence RSB fill sequence does not have any protection for miss-prediction of conditional branch at the end of the sequence. CPU can speculatively execute code immediately after the sequence, while RSB filling hasn't completed yet. #define __FILL_RETURN_BUFFER(reg, nr, sp) \ mov $(nr/2), reg; \ 771: \ ANNOTATE_INTRA_FUNCTION_CALL; \ call 772f; \ 773: /* speculation trap */ \ UNWIND_HINT_EMPTY; \ pause; \ lfence; \ jmp 773b; \ 772: \ ANNOTATE_INTRA_FUNCTION_CALL; \ call 774f; \ 775: /* speculation trap */ \ UNWIND_HINT_EMPTY; \ pause; \ lfence; \ jmp 775b; \ 774: \ add $(BITS_PER_LONG/8) * 2, sp; \ dec reg; \ jnz 771b; <----- CPU can miss-predict here. Before RSB is filled, RETs that come in program order after this macro can be executed speculatively, making them vulnerable to RSB-based attacks. Mitigate it by adding an LFENCE after the conditional branch to prevent speculation while RSB is being filled. Suggested-by: Andrew Cooper Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit a8af0d682ae0c9cf62dd0ad6afdb1480951d6a10 Author: Jeff Layton Date: Thu Jun 30 16:21:50 2022 -0400 libceph: clean up ceph_osdc_start_request prototype This function always returns 0, and ignores the nofail boolean. Drop the nofail argument, make the function void return and fix up the callers. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 7193cda917ffbf5a473cbf3d26ba6787b6b02a84 Author: Masahiro Yamada Date: Wed Jul 27 01:52:04 2022 +0900 modpost: remove unused Elf_Sword macro Commit 9ad21c3f3ecf ("kbuild: try harder to find symbol names in modpost") added Elf_Sword (in a wrong way), but did not use it at all. BTW, the current code looks weird. The fix for the 32-bit part would be: Elf64_Sword --> Elf32_Sword (inconsistet prefix, Elf32_ vs Elf64_) The fix for the 64-bit part would be: Elf64_Sxword --> Elf64_Sword (the size is different between Sword and Sxword) Note: Elf32_Sword == Elf64_Sword == int32_t Elf32_Sxword == Elf64_Sxword == int64_t Anyway, let's drop unused code instead of fixing it. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 258fafcd0683d9ccfa524129d489948ab3ddc24c Author: Justin Stitt Date: Wed Jul 20 16:23:32 2022 -0700 Makefile.extrawarn: re-enable -Wformat for clang There's been an ongoing mission to re-enable the -Wformat warning for Clang. A previous attempt at enabling the warning showed that there were many instances of this warning throughout the codebase. The sheer amount of these warnings really polluted builds and thus -Wno-format was added to _temporarily_ toggle them off. After many patches the warning has largely been eradicated for x86, x86_64, arm, and arm64 on a variety of configs. The time to enable the warning has never been better as it seems for the first time we are ahead of them and can now solve them as they appear rather than tackling from a backlog. As to the root cause of this large backlog of warnings, Clang seems to pickup on some more nuanced cases of format warnings caused by implicit integer conversion as well as default argument promotions from printf-like functions. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Suggested-by: Nick Desaulniers Signed-off-by: Justin Stitt Signed-off-by: Masahiro Yamada commit 625395c4a0f4775e0fe00f616888d2e6c1ba49db Author: Siddh Raman Pant Date: Sun Jul 31 21:39:13 2022 +0530 x86/numa: Use cpumask_available instead of hardcoded NULL check GCC-12 started triggering a new warning: arch/x86/mm/numa.c: In function ‘cpumask_of_node’: arch/x86/mm/numa.c:916:39: warning: the comparison will always evaluate as ‘false’ for the address of ‘node_to_cpumask_map’ will never be NULL [-Waddress] 916 | if (node_to_cpumask_map[node] == NULL) { | ^~ node_to_cpumask_map is of type cpumask_var_t[]. When CONFIG_CPUMASK_OFFSTACK is set, cpumask_var_t is typedef'd to a pointer for dynamic allocation, else to an array of one element. The "wicked game" can be checked on line 700 of include/linux/cpumask.h. The original code in debug_cpumask_set_cpu() and cpumask_of_node() were probably written by the original authors with CONFIG_CPUMASK_OFFSTACK=y (i.e. dynamic allocation) in mind, checking if the cpumask was available via a direct NULL check. When CONFIG_CPUMASK_OFFSTACK is not set, GCC gives the above warning while compiling the kernel. Fix that by using cpumask_available(), which does the NULL check when CONFIG_CPUMASK_OFFSTACK is set, otherwise returns true. Use it wherever such checks are made. Conditional definitions of cpumask_available() can be found along with the definition of cpumask_var_t. Check the cpumask.h reference mentioned above. Fixes: c032ef60d1aa ("cpumask: convert node_to_cpumask_map[] to cpumask_var_t") Fixes: de2d9445f162 ("x86: Unify node_to_cpumask_map handling between 32 and 64bit") Signed-off-by: Siddh Raman Pant Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220731160913.632092-1-code@siddh.me commit 2b1299322016731d56807aa49254a5ea3080b6b3 Author: Daniel Sneddon Date: Tue Aug 2 15:47:01 2022 -0700 x86/speculation: Add RSB VM Exit protections tl;dr: The Enhanced IBRS mitigation for Spectre v2 does not work as documented for RET instructions after VM exits. Mitigate it with a new one-entry RSB stuffing mechanism and a new LFENCE. == Background == Indirect Branch Restricted Speculation (IBRS) was designed to help mitigate Branch Target Injection and Speculative Store Bypass, i.e. Spectre, attacks. IBRS prevents software run in less privileged modes from affecting branch prediction in more privileged modes. IBRS requires the MSR to be written on every privilege level change. To overcome some of the performance issues of IBRS, Enhanced IBRS was introduced. eIBRS is an "always on" IBRS, in other words, just turn it on once instead of writing the MSR on every privilege level change. When eIBRS is enabled, more privileged modes should be protected from less privileged modes, including protecting VMMs from guests. == Problem == Here's a simplification of how guests are run on Linux' KVM: void run_kvm_guest(void) { // Prepare to run guest VMRESUME(); // Clean up after guest runs } The execution flow for that would look something like this to the processor: 1. Host-side: call run_kvm_guest() 2. Host-side: VMRESUME 3. Guest runs, does "CALL guest_function" 4. VM exit, host runs again 5. Host might make some "cleanup" function calls 6. Host-side: RET from run_kvm_guest() Now, when back on the host, there are a couple of possible scenarios of post-guest activity the host needs to do before executing host code: * on pre-eIBRS hardware (legacy IBRS, or nothing at all), the RSB is not touched and Linux has to do a 32-entry stuffing. * on eIBRS hardware, VM exit with IBRS enabled, or restoring the host IBRS=1 shortly after VM exit, has a documented side effect of flushing the RSB except in this PBRSB situation where the software needs to stuff the last RSB entry "by hand". IOW, with eIBRS supported, host RET instructions should no longer be influenced by guest behavior after the host retires a single CALL instruction. However, if the RET instructions are "unbalanced" with CALLs after a VM exit as is the RET in #6, it might speculatively use the address for the instruction after the CALL in #3 as an RSB prediction. This is a problem since the (untrusted) guest controls this address. Balanced CALL/RET instruction pairs such as in step #5 are not affected. == Solution == The PBRSB issue affects a wide variety of Intel processors which support eIBRS. But not all of them need mitigation. Today, X86_FEATURE_RSB_VMEXIT triggers an RSB filling sequence that mitigates PBRSB. Systems setting RSB_VMEXIT need no further mitigation - i.e., eIBRS systems which enable legacy IBRS explicitly. However, such systems (X86_FEATURE_IBRS_ENHANCED) do not set RSB_VMEXIT and most of them need a new mitigation. Therefore, introduce a new feature flag X86_FEATURE_RSB_VMEXIT_LITE which triggers a lighter-weight PBRSB mitigation versus RSB_VMEXIT. The lighter-weight mitigation performs a CALL instruction which is immediately followed by a speculative execution barrier (INT3). This steers speculative execution to the barrier -- just like a retpoline -- which ensures that speculation can never reach an unbalanced RET. Then, ensure this CALL is retired before continuing execution with an LFENCE. In other words, the window of exposure is opened at VM exit where RET behavior is troublesome. While the window is open, force RSB predictions sampling for RET targets to a dead end at the INT3. Close the window with the LFENCE. There is a subset of eIBRS systems which are not vulnerable to PBRSB. Add these systems to the cpu_vuln_whitelist[] as NO_EIBRS_PBRSB. Future systems that aren't vulnerable will set ARCH_CAP_PBRSB_NO. [ bp: Massage, incorporate review comments from Andy Cooper. ] Signed-off-by: Daniel Sneddon Co-developed-by: Pawan Gupta Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov commit 87514b2c24f294c32e9e743b095541dcf43928f7 Author: Ben Dooks Date: Thu Jul 21 15:51:55 2022 +0100 sched/rt: Fix Sparse warnings due to undefined rt.c declarations There are several symbols defined in kernel/sched/sched.h but get wrapped in CONFIG_CGROUP_SCHED, even though dummy versions get built in rt.c and therefore trigger Sparse warnings: kernel/sched/rt.c:309:6: warning: symbol 'unregister_rt_sched_group' was not declared. Should it be static? kernel/sched/rt.c:311:6: warning: symbol 'free_rt_sched_group' was not declared. Should it be static? kernel/sched/rt.c:313:5: warning: symbol 'alloc_rt_sched_group' was not declared. Should it be static? Fix this by moving them outside the CONFIG_CGROUP_SCHED block. [ mingo: Refreshed to the latest scheduler tree, tweaked changelog. ] Signed-off-by: Ben Dooks Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220721145155.358366-1-ben-linux@fluff.org commit 2fb0ec4ae5632ba288ab233849f85069d4c475a5 Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:40:16 2018 +0200 video:backlight: remove reference to AVR32 architecture in ltv350qv The AVR32 architecture does no longer exist in the Linux kernel, hence remove a reference to also non-existing Linux BSP CD from Atmel. Signed-off-by: Hans-Christian Noren Egtvedt commit 4492b0c0897055c110777ea6ece6c08c63e8a140 Author: Hans-Christian Noren Egtvedt Date: Sun Nov 5 10:43:11 2017 +0100 video: remove support for non-existing atmel,at32ap-lcdc in atmel_lcdfb The AVR32 architecture has been removed from the kernel in commit 26202873bb51fafdaa51be3e8de7aab9beb49f70, hence clean out the atmel,at32ap-lcdc parts in the atmel_lcdfb.c video driver. AVR32 architecture never supported device tree, hence this code was not used by anybody. Signed-off-by: Hans-Christian Noren Egtvedt commit 93dd2f713ad23f0e8ba0fedf94fabc215bbb8418 Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:39:09 2018 +0200 usb:udc: remove reference to AVR32 architecture in Atmel USBA Kconfig The AVR32 architecture does no longer exist in the Linux kernel, hence remove a reference to it in Kconfig help text to avoid confusion. Signed-off-by: Hans-Christian Noren Egtvedt commit 0a2fd172b4ba5628eefa88fbfb8599c76f6ac021 Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:48:57 2018 +0200 sound:spi: remove reference to AVR32 in Atmel AT73C213 DAC driver The AVR32 architecture does no longer exist in the Linux kernel, hence remove a reference to it in Kconfig help text to avoid confusion. Signed-off-by: Hans-Christian Noren Egtvedt commit 8bfdfbb258913047b5d5384ec2a6b049af1bf437 Author: Hans-Christian Noren Egtvedt Date: Sun Nov 5 11:19:53 2017 +0100 net: remove cdns,at32ap7000-macb device tree entry The AVR32 architecture has been removed from the kernel in commit 26202873bb51fafdaa51be3e8de7aab9beb49f70, hence clean out the cdns,at32ap7000-macb compatible entry in Cadence macb Ethernet driver. AVR32 architecture never supported device tree, hence this code was not used by anybody. Updated documentation to match the default entry, no users of cdns,at32ap7000-macb in the kernel tree. Signed-off-by: Hans-Christian Noren Egtvedt commit 62bf2fa70b683e287bf8005345ba7861c7be63dc Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:33:59 2018 +0200 misc: update maintainer email address and description for atmel-ssc I have changed my overall maintainer email address to the samfundet.no domain, hence update the atmel-ssc module to reflect that. Also remove the AVR32 reference, since the AVR32 architecture no longer exist in the Linux kernel. Signed-off-by: Hans-Christian Noren Egtvedt commit 53291cb23c919c5407a5054a5cfdcba79690720b Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:30:17 2018 +0200 mfd: remove reference to AVR32 architecture in atmel-smc.c The AVR32 architecture does no longer exist in the Linux kernel, hence remove a reference to it in comments to avoid confusion. Signed-off-by: Hans-Christian Noren Egtvedt commit 300a596590e4a201cdbbb42af5701d448cceab3a Author: Hans-Christian Noren Egtvedt Date: Sat Oct 20 12:30:17 2018 +0200 dma:dw: remove reference to AVR32 architecture in core.c The AVR32 architecture does no longer exist in the Linux kernel, hence remove a reference to it in comments to avoid confusion. Signed-off-by: Hans-Christian Noren Egtvedt commit dcca34754a3f5290406403b8066e3b15dda9f4bf Author: Ingo Molnar Date: Wed Aug 3 10:43:42 2022 +0200 exit: Fix typo in comment: s/sub-theads/sub-threads Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit b6e8d40d43ae4dec00c8fea2593eeea3114b8f44 Author: Waiman Long Date: Tue Aug 2 21:54:51 2022 -0400 sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed With cgroup v2, the cpuset's cpus_allowed mask can be empty indicating that the cpuset will just use the effective CPUs of its parent. So cpuset_can_attach() can call task_can_attach() with an empty mask. This can lead to cpumask_any_and() returns nr_cpu_ids causing the call to dl_bw_of() to crash due to percpu value access of an out of bound CPU value. For example: [80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0 : [80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0 : [80468.207946] Call Trace: [80468.208947] cpuset_can_attach+0xa0/0x140 [80468.209953] cgroup_migrate_execute+0x8c/0x490 [80468.210931] cgroup_update_dfl_csses+0x254/0x270 [80468.211898] cgroup_subtree_control_write+0x322/0x400 [80468.212854] kernfs_fop_write_iter+0x11c/0x1b0 [80468.213777] new_sync_write+0x11f/0x1b0 [80468.214689] vfs_write+0x1eb/0x280 [80468.215592] ksys_write+0x5f/0xe0 [80468.216463] do_syscall_64+0x5c/0x80 [80468.224287] entry_SYSCALL_64_after_hwframe+0x44/0xae Fix that by using effective_cpus instead. For cgroup v1, effective_cpus is the same as cpus_allowed. For v2, effective_cpus is the real cpumask to be used by tasks within the cpuset anyway. Also update task_can_attach()'s 2nd argument name to cs_effective_cpus to reflect the change. In addition, a check is added to task_can_attach() to guard against the possibility that cpumask_any_and() may return a value >= nr_cpu_ids. Fixes: 7f51412a415d ("sched/deadline: Fix bandwidth check/update when migrating tasks between exclusive cpusets") Signed-off-by: Waiman Long Signed-off-by: Ingo Molnar Acked-by: Juri Lelli Link: https://lore.kernel.org/r/20220803015451.2219567-1-longman@redhat.com commit fe201f6fa4cf96749b0a6b6a61b33b6a82de4e49 Author: Lee Jones Date: Mon Aug 1 16:53:51 2022 +0100 MAINTAINERS: Use Lee Jones' kernel.org address for Backlight submissions Going forward, I'll be using my kernel.org for upstream work. Signed-off-by: Lee Jones Acked-by: Daniel Thompson Signed-off-by: Lee Jones commit 7c6327c77d509e78bff76f2a4551fcfee851682e Merge: 6f63d04473f2b 8eaa1d110800f Author: Paolo Abeni Date: Wed Aug 3 08:50:42 2022 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Conflicts: net/ax25/af_ax25.c d7c4c9e075f8c ("ax25: fix incorrect dev_tracker usage") d62607c3fe459 ("net: rename reference+tracking helpers") drivers/net/netdevsim/fib.c 180a6a3ee60a ("netdevsim: fib: Fix reference count leak on route deletion failure") 012ec02ae441 ("netdevsim: convert driver to use unlocked devlink API during init/fini") Signed-off-by: Paolo Abeni commit 4cfa6ff24a9744ba484521c38bea613134fbfcb3 Author: Michael Ellerman Date: Wed Aug 3 16:29:41 2022 +1000 powerpc/64e: Fix kexec build error When building ppc64_book3e_allmodconfig the build fails with: arch/powerpc/kexec/file_load_64.c:1063:14: error: implicit declaration of function ‘firmware_has_feature’ 1063 | if (!firmware_has_feature(FW_FEATURE_LPAR)) | ^~~~~~~~~~~~~~~~~~~~ Add a direct include of asm/firmware.h to fix the error. Fixes: b1fc44eaa9ba ("pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220803063152.1249270-1-mpe@ellerman.id.au commit 0fec518018cc5ceffa706370b6e3acbbb1e3c798 Author: Douglas Anderson Date: Tue Aug 2 13:23:09 2022 -0700 tty: serial: qcom-geni-serial: Fix %lu -> %u in print statements When we multiply an unsigned int by a u32 we still end up with an unsigned int. That means we should specify "%u" not "%lu" in the format code. NOTE: this fix was chosen instead of somehow promoting the value to "unsigned long" since the max baud rate from the earlier call to uart_get_baud_rate() is 4000000 and the max sampling rate is 32. 4000000 * 32 = 0x07a12000, not even close to overflowing 32-bits. Fixes: c474c775716e ("tty: serial: qcom-geni-serial: Fix get_clk_div_rate() which otherwise could return a sub-optimal clock rate.") Reported-by: Mark Brown Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20220802132250.1.Iea061e14157a17e114dbe2eca764568a02d6b889@changeid Signed-off-by: Greg Kroah-Hartman commit 6aa811acdb76facca0b705f4e4c1d948ccb6af8b Author: Antony Antony Date: Wed Jul 27 17:41:22 2022 +0200 xfrm: clone missing x->lastused in xfrm_do_migrate x->lastused was not cloned in xfrm_do_migrate. Add it to clone during migrate. Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert commit 36d763509be326bb383b1b1852a129ff58d74e3b Author: Antony Antony Date: Wed Jul 27 17:40:53 2022 +0200 xfrm: fix XFRMA_LASTUSED comment It is a __u64, internally time64_t. Fixes: bf825f81b454 ("xfrm: introduce basic mark infrastructure") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert commit 717ada9f10f2de8c4f4d72ad045f3b67a7ced715 Author: Antony Antony Date: Wed Jul 27 17:38:35 2022 +0200 Revert "xfrm: update SA curlft.use_time" This reverts commit af734a26a1a95a9fda51f2abb0c22a7efcafd5ca. The abvoce commit is a regression according RFC 2367. A better fix would be use x->lastused. Which will be propsed later. according to RFC 2367 use_time == sadb_lifetime_usetime. "sadb_lifetime_usetime For CURRENT, the time, in seconds, when association was first used. For HARD and SOFT, the number of seconds after the first use of the association until it expires." Fixes: af734a26a1a9 ("xfrm: update SA curlft.use_time") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert commit 6f63d04473f2bc973e24ff828a28a2bd5e41bb38 Author: Christophe JAILLET Date: Sun Jul 31 07:59:00 2022 +0200 doc: sfp-phylink: Fix a broken reference The commit in Fixes: has changed a .txt file into a .yaml file. Update the documentation accordingly. While at it add some `` around some file names to improve the output. Fixes: 70991f1e6858 ("dt-bindings: net: convert sff,sfp to dtschema") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/be3c7e87ca7f027703247eccfe000b8e34805094.1659247114.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 5493ee1919eae4f49d62276cf5986b7f7c7aa8f6 Merge: 2bc7ea71a7374 64f991590ff44 Author: Dave Airlie Date: Wed Aug 3 14:00:18 2022 +1000 Merge tag 'amd-drm-next-5.20-2022-07-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-5.20-2022-07-29: amdgpu: - Misc spelling and grammar fixes - DC whitespace cleanups - ACP smatch fix - GFX 11.0 updates - PSP 13.0 updates - VCN 4.0 updates - DC FP fix for PPC64 - Misc bug fixes amdkfd: - SVM fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220729202742.6636-1-alexander.deucher@amd.com commit d95efb14c0b81b684deb32ba10cdb78b4178ae5b Author: Jeremy Bongio Date: Thu Jul 21 15:44:22 2022 -0700 ext4: add ioctls to get/set the ext4 superblock uuid This fixes a race between changing the ext4 superblock uuid and operations like mounting, resizing, changing features, etc. Reviewed-by: Theodore Ts'o Signed-off-by: Jeremy Bongio Link: https://lore.kernel.org/r/20220721224422.438351-1-bongiojp@gmail.com Signed-off-by: Theodore Ts'o commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd Author: Kiselev, Oleg Date: Wed Jul 20 04:27:48 2022 +0000 ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock. Signed-off-by: Oleg Kiselev Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com Signed-off-by: Theodore Ts'o commit 026d0d27c4882303e4b071ca6d996640cc2932c3 Author: Kiselev, Oleg Date: Wed Jul 20 04:26:22 2022 +0000 ext4: reduce computation of overhead during resize This patch avoids doing an O(n**2)-complexity walk through every flex group. Instead, it uses the already computed overhead information for the newly allocated space, and simply adds it to the previously calculated overhead stored in the superblock. This drastically reduces the time taken to resize very large bigalloc filesystems (from 3+ hours for a 64TB fs down to milliseconds). Signed-off-by: Oleg Kiselev Link: https://lore.kernel.org/r/CE4F359F-4779-45E6-B6A9-8D67FDFF5AE2@amazon.com Signed-off-by: Theodore Ts'o commit 4a734f0869f970b8a9b65062ea40b09a5da9dba8 Author: Zhihao Cheng Date: Fri Jul 15 20:51:52 2022 +0800 jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort <-- while (commit_transaction->t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_ONCE(jh->b_next_transaction, NULL) __jbd2_journal_file_buffer(jh, BJ_Reserved) J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure ! The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216251 Fixes: 470decc613ab20 ("[PATCH] jbd2: initial copy of files from jbd") Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20220715125152.4022726-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 Author: Lukas Czerner Date: Thu Jul 14 18:59:03 2022 +0200 ext4: block range must be validated before use in ext4_mb_clear_bb() Block range to free is validated in ext4_free_blocks() using ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb(). However in some situations on bigalloc file system the range might be adjusted after the validation in ext4_free_blocks() which can lead to troubles on corrupted file systems such as one found by syzkaller that resulted in the following BUG kernel BUG at fs/ext4/ext4.h:3319! PREEMPT SMP NOPTI CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:ext4_free_blocks+0x95e/0xa90 Call Trace: ? lock_timer_base+0x61/0x80 ? __es_remove_extent+0x5a/0x760 ? __mod_timer+0x256/0x380 ? ext4_ind_truncate_ensure_credits+0x90/0x220 ext4_clear_blocks+0x107/0x1b0 ext4_free_data+0x15b/0x170 ext4_ind_truncate+0x214/0x2c0 ? _raw_spin_unlock+0x15/0x30 ? ext4_discard_preallocations+0x15a/0x410 ? ext4_journal_check_start+0xe/0x90 ? __ext4_journal_start_sb+0x2f/0x110 ext4_truncate+0x1b5/0x460 ? __ext4_journal_start_sb+0x2f/0x110 ext4_evict_inode+0x2b4/0x6f0 evict+0xd0/0x1d0 ext4_enable_quotas+0x11f/0x1f0 ext4_orphan_cleanup+0x3de/0x430 ? proc_create_seq_private+0x43/0x50 ext4_fill_super+0x295f/0x3ae0 ? snprintf+0x39/0x40 ? sget_fc+0x19c/0x330 ? ext4_reconfigure+0x850/0x850 get_tree_bdev+0x16d/0x260 vfs_get_tree+0x25/0xb0 path_mount+0x431/0xa70 __x64_sys_mount+0xe2/0x120 do_syscall_64+0x5b/0x80 ? do_user_addr_fault+0x1e2/0x670 ? exc_page_fault+0x70/0x170 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace Fix it by making sure that the block range is properly validated before used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb(). Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c Reported-by: syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com Signed-off-by: Lukas Czerner Cc: Tadeusz Struk Tested-by: Tadeusz Struk Link: https://lore.kernel.org/r/20220714165903.58260-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o commit 307af6c879377c1c63e71cbdd978201f9c7ee8df Author: Jan Kara Date: Tue Jul 12 12:54:29 2022 +0200 mbcache: automatically delete entries from cache on freeing Use the fact that entries with elevated refcount are not removed from the hash and just move removal of the entry from the hash to the entry freeing time. When doing this we also change the generic code to hold one reference to the cache entry, not two of them, which makes code somewhat more obvious. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-10-jack@suse.cz Signed-off-by: Theodore Ts'o commit 75896339e43176af078509c1fce94ee6df9ca1a7 Author: Jan Kara Date: Tue Jul 12 12:54:28 2022 +0200 mbcache: Remove mb_cache_entry_delete() Nobody uses mb_cache_entry_delete() anymore. Remove it. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-9-jack@suse.cz Signed-off-by: Theodore Ts'o commit 1189d8ec5105f7628fb0e3a6988cbf0d0cbfedeb Author: Jan Kara Date: Tue Jul 12 12:54:27 2022 +0200 ext2: avoid deleting xattr block that is being reused Currently when we decide to reuse xattr block we detect the case when the last reference to xattr block is being dropped at the same time and cancel the reuse attempt. Convert ext2 to a new scheme when as soon as matching mbcache entry is found, we wait with dropping the last xattr block reference until mbcache entry reference is dropped (meaning either the xattr block reference is increased or we decided not to reuse the block). Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-8-jack@suse.cz Signed-off-by: Theodore Ts'o commit b67798d55185ba4471f70b67b3f7c2866f216499 Author: Jan Kara Date: Tue Jul 12 12:54:26 2022 +0200 ext2: unindent codeblock in ext2_xattr_set() Replace one else in ext2_xattr_set() with a goto. This makes following code changes simpler to follow. No functional changes. Signed-off-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/20220712105436.32204-7-jack@suse.cz Signed-off-by: Theodore Ts'o commit 90ae40d243d46f2268a5334fc8faa2dd67f875f5 Author: Jan Kara Date: Tue Jul 12 12:54:25 2022 +0200 ext2: factor our freeing of xattr block reference Free of xattr block reference is opencode in two places. Factor it out into a separate function and use it. Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-6-jack@suse.cz Signed-off-by: Theodore Ts'o commit 65f8b80053a1b2fd602daa6814e62d6fa90e5e9b Author: Jan Kara Date: Tue Jul 12 12:54:24 2022 +0200 ext4: fix race when reusing xattr blocks When ext4_xattr_block_set() decides to remove xattr block the following race can happen: CPU1 CPU2 ext4_xattr_block_set() ext4_xattr_release_block() new_bh = ext4_xattr_block_cache_find() lock_buffer(bh); ref = le32_to_cpu(BHDR(bh)->h_refcount); if (ref == 1) { ... mb_cache_entry_delete(); unlock_buffer(bh); ext4_free_blocks(); ... ext4_forget(..., bh, ...); jbd2_journal_revoke(..., bh); ext4_journal_get_write_access(..., new_bh, ...) do_get_write_access() jbd2_journal_cancel_revoke(..., new_bh); Later the code in ext4_xattr_block_set() finds out the block got freed and cancels reusal of the block but the revoke stays canceled and so in case of block reuse and journal replay the filesystem can get corrupted. If the race works out slightly differently, we can also hit assertions in the jbd2 code. Fix the problem by making sure that once matching mbcache entry is found, code dropping the last xattr block reference (or trying to modify xattr block in place) waits until the mbcache entry reference is dropped. This way code trying to reuse xattr block is protected from someone trying to drop the last reference to xattr block. Reported-and-tested-by: Ritesh Harjani CC: stable@vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-5-jack@suse.cz Signed-off-by: Theodore Ts'o commit fd48e9acdf26d0cbd80051de07d4a735d05d29b2 Author: Jan Kara Date: Tue Jul 12 12:54:23 2022 +0200 ext4: unindent codeblock in ext4_xattr_block_set() Remove unnecessary else (and thus indentation level) from a code block in ext4_xattr_block_set(). It will also make following code changes easier. No functional changes. CC: stable@vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 6bc0d63dad7f9f54d381925ee855b402f652fa39 Author: Jan Kara Date: Tue Jul 12 12:54:22 2022 +0200 ext4: remove EA inode entry from mbcache on inode eviction Currently we remove EA inode from mbcache as soon as its xattr refcount drops to zero. However there can be pending attempts to reuse the inode and thus refcount handling code has to handle the situation when refcount increases from zero anyway. So save some work and just keep EA inode in mbcache until it is getting evicted. At that moment we are sure following iget() of EA inode will fail anyway (or wait for eviction to finish and load things from the disk again) and so removing mbcache entry at that moment is fine and simplifies the code a bit. CC: stable@vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit 3dc96bba65f53daa217f0a8f43edad145286a8f5 Author: Jan Kara Date: Tue Jul 12 12:54:21 2022 +0200 mbcache: add functions to delete entry if unused Add function mb_cache_entry_delete_or_get() to delete mbcache entry if it is unused and also add a function to wait for entry to become unused - mb_cache_entry_wait_unused(). We do not share code between the two deleting function as one of them will go away soon. CC: stable@vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 58318914186c157477b978b1739dfe2f1b9dc0fe Author: Jan Kara Date: Tue Jul 12 12:54:20 2022 +0200 mbcache: don't reclaim used entries Do not reclaim entries that are currently used by somebody from a shrinker. Firstly, these entries are likely useful. Secondly, we will need to keep such entries to protect pending increment of xattr block refcount. CC: stable@vger.kernel.org Fixes: 82939d7999df ("ext4: convert to mbcache2") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220712105436.32204-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit b8a04fe77ef1360fbf73c80fddbdfeaa9407ed1b Author: Lukas Czerner Date: Mon Jul 4 16:27:21 2022 +0200 ext4: make sure ext4_append() always allocates new block ext4_append() must always allocate a new block, otherwise we run the risk of overwriting existing directory block corrupting the directory tree in the process resulting in all manner of problems later on. Add a sanity check to see if the logical block is already allocated and error out if it is. Cc: stable@kernel.org Signed-off-by: Lukas Czerner Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220704142721.157985-2-lczerner@redhat.com Signed-off-by: Theodore Ts'o commit 65f8ea4cd57dbd46ea13b41dc8bac03176b04233 Author: Lukas Czerner Date: Mon Jul 4 16:27:20 2022 +0200 ext4: check if directory block is within i_size Currently ext4 directory handling code implicitly assumes that the directory blocks are always within the i_size. In fact ext4_append() will attempt to allocate next directory block based solely on i_size and the i_size is then appropriately increased after a successful allocation. However, for this to work it requires i_size to be correct. If, for any reason, the directory inode i_size is corrupted in a way that the directory tree refers to a valid directory block past i_size, we could end up corrupting parts of the directory tree structure by overwriting already used directory blocks when modifying the directory. Fix it by catching the corruption early in __ext4_read_dirblock(). Addresses Red-Hat-Bugzilla: #2070205 CVE: CVE-2022-1184 Signed-off-by: Lukas Czerner Cc: stable@vger.kernel.org Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220704142721.157985-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o commit 3fa5d23e68a34dae9df2be168750dc5e03e0e40d Author: Ojaswin Mujoo Date: Mon Jul 4 11:16:03 2022 +0530 ext4: reflect mb_optimize_scan value in options file Add support to display the mb_optimize_scan value in /proc/fs/ext4//options file. The option is only displayed when the value is non default. Signed-off-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20220704054603.21462-1-ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a Author: Ye Bin Date: Wed Jun 22 17:02:23 2022 +0800 ext4: avoid remove directory when directory is corrupted Now if check directoy entry is corrupted, ext4_empty_dir may return true then directory will be removed when file system mounted with "errors=continue". In order not to make things worse just return false when directory is corrupted. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o commit c64a92992e6c1799f743999e1f1538fea0156aa4 Author: Jiang Jian Date: Tue Jun 21 14:15:31 2022 +0800 ext4: aligned '*' in comments The '*' in the comment is not aligned. Signed-off-by: Jiang Jian Link: https://lore.kernel.org/r/20220621061531.19669-1-jiangjian@cdjrlc.com Signed-off-by: Theodore Ts'o commit 442ec1e5bb7c46c72c41898e13a5744c84cadf51 Author: Bagas Sanjaya Date: Sun Jun 19 14:29:39 2022 +0700 Documentation: ext4: fix cell spacing of table heading on blockmap table Commit 3103084afcf234 ("ext4, doc: remove unnecessary escaping") removes redundant underscore escaping, however the cell spacing in heading row of blockmap table became not aligned anymore, hence triggers malformed table warning: Documentation/filesystems/ext4/blockmap.rst:3: WARNING: Malformed table. +---------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | i.i_block Offset | Where It Points | ... The warning caused the table not being loaded. Realign the heading row cell by adding missing space at the first cell to fix the warning. Fixes: 3103084afcf234 ("ext4, doc: remove unnecessary escaping") Cc: stable@kernel.org Cc: Andreas Dilger Cc: Jonathan Corbet Cc: Wang Jianjian Cc: linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20220619072938.7334-1-bagasdotme@gmail.com Signed-off-by: Theodore Ts'o commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c Author: Li Lingfeng Date: Fri Jun 17 14:25:15 2022 +0800 ext4: recover csum seed of tmp_inode after migrating to extents When migrating to extents, the checksum seed of temporary inode need to be replaced by inode's, otherwise the inode checksums will be incorrect when swapping the inodes data. However, the temporary inode can not match it's checksum to itself since it has lost it's own checksum seed. mkfs.ext4 -F /dev/sdc mount /dev/sdc /mnt/sdc xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile chattr -e /mnt/sdc/testfile chattr +e /mnt/sdc/testfile umount /dev/sdc fsck -fn /dev/sdc ======== ... Pass 1: Checking inodes, blocks, and sizes Inode 13 passes checks, but checksum does not match inode. Fix? no ... ======== The fix is simple, save the checksum seed of temporary inode, and recover it after migrating to extents. Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents") Signed-off-by: Li Lingfeng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220617062515.2113438-1-lilingfeng3@huawei.com Signed-off-by: Theodore Ts'o commit 51ae846cff568c8c29921b1b28eb2dfbcd4ac12d Author: Ye Bin Date: Fri Jun 17 09:39:35 2022 +0800 ext4: fix warning in ext4_iomap_begin as race between bmap and write We got issue as follows: ------------[ cut here ]------------ WARNING: CPU: 3 PID: 9310 at fs/ext4/inode.c:3441 ext4_iomap_begin+0x182/0x5d0 RIP: 0010:ext4_iomap_begin+0x182/0x5d0 RSP: 0018:ffff88812460fa08 EFLAGS: 00010293 RAX: ffff88811f168000 RBX: 0000000000000000 RCX: ffffffff97793c12 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: ffff88812c669160 R08: ffff88811f168000 R09: ffffed10258cd20f R10: ffff88812c669077 R11: ffffed10258cd20e R12: 0000000000000001 R13: 00000000000000a4 R14: 000000000000000c R15: ffff88812c6691ee FS: 00007fd0d6ff3740(0000) GS:ffff8883af180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd0d6dda290 CR3: 0000000104a62000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: iomap_apply+0x119/0x570 iomap_bmap+0x124/0x150 ext4_bmap+0x14f/0x250 bmap+0x55/0x80 do_vfs_ioctl+0x952/0xbd0 __x64_sys_ioctl+0xc6/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Above issue may happen as follows: bmap write bmap ext4_bmap iomap_bmap ext4_iomap_begin ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin ext4_da_write_inline_data_begin ext4_prepare_inline_data ext4_create_inline_data ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA); if (WARN_ON_ONCE(ext4_has_inline_data(inode))) ->trigger bug_on To solved above issue hold inode lock in ext4_bamp. Signed-off-by: Ye Bin Link: https://lore.kernel.org/r/20220617013935.397596-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit fd7e672ea98b95b9d4c9dae316639f03c16a749d Author: Baokun Li Date: Thu Jun 16 10:13:58 2022 +0800 ext4: correct the misjudgment in ext4_iget_extra_inode Use the EXT4_INODE_HAS_XATTR_SPACE macro to more accurately determine whether the inode have xattr space. Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit c9fd167d57133c5b748d16913c4eabc55e531c73 Author: Baokun Li Date: Thu Jun 16 10:13:57 2022 +0800 ext4: correct max_inline_xattr_value_size computing If the ext4 inode does not have xattr space, 0 is returned in the get_max_inline_xattr_value_size function. Otherwise, the function returns a negative value when the inode does not contain EXT4_STATE_XATTR. Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 Author: Baokun Li Date: Thu Jun 16 10:13:56 2022 +0800 ext4: fix use-after-free in ext4_xattr_set_entry Hulk Robot reported a issue: ================================================================== BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500 Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092 CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17 Call Trace: [...] memcpy+0x34/0x50 mm/kasan/kasan.c:303 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498 __vfs_setxattr+0x112/0x170 fs/xattr.c:149 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238 vfs_setxattr+0xed/0x270 fs/xattr.c:255 setxattr+0x235/0x330 fs/xattr.c:520 path_setxattr+0x176/0x190 fs/xattr.c:539 __do_sys_lsetxattr fs/xattr.c:561 [inline] __se_sys_lsetxattr fs/xattr.c:557 [inline] __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x459fe9 RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9 RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_xattr_set ext4_xattr_set_handle ext4_xattr_ibody_find >> s->end < s->base >> no EXT4_STATE_XATTR >> xattr_check_inode is not executed ext4_xattr_ibody_set ext4_xattr_set_entry >> size_t min_offs = s->end - s->base >> UAF in memcpy we can easily reproduce this problem with the following commands: mkfs.ext4 -F /dev/sda mount -o debug_want_extra_isize=128 /dev/sda /mnt touch /mnt/file setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file In ext4_xattr_ibody_find, we have the following assignment logic: header = IHDR(inode, raw_inode) = raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize is->s.base = IFIRST(header) = header + sizeof(struct ext4_xattr_ibody_header) is->s.end = raw_inode + s_inode_size In ext4_xattr_set_entry min_offs = s->end - s->base = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) last = s->first free = min_offs - ((void *)last - s->base) - sizeof(__u32) = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32) In the calculation formula, all values except s_inode_size and i_extra_size are fixed values. When i_extra_size is the maximum value s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8. The value overflows. As a result, the preceding issue is triggered when memcpy is executed. Therefore, when finding xattr or setting xattr, check whether there is space for storing xattr in the inode to resolve this issue. Cc: stable@kernel.org Reported-by: Hulk Robot Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 179b14152dcb6a24c3415200603aebca70ff13af Author: Baokun Li Date: Thu Jun 16 10:13:55 2022 +0800 ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/20220616021358.2504451-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 7f0d8e1d607c1a4fa9a27362a108921d82230874 Author: Eric Whitney Date: Wed Jun 15 12:05:30 2022 -0400 ext4: fix extent status tree race in writeback error recovery path A race can occur in the unlikely event ext4 is unable to allocate a physical cluster for a delayed allocation in a bigalloc file system during writeback. Failure to allocate a cluster forces error recovery that includes a call to mpage_release_unused_pages(). That function removes any corresponding delayed allocated blocks from the extent status tree. If a new delayed write is in progress on the same cluster simultaneously, resulting in the addition of an new extent containing one or more blocks in that cluster to the extent status tree, delayed block accounting can be thrown off if that delayed write then encounters a similar cluster allocation failure during future writeback. Write lock the i_data_sem in mpage_release_unused_pages() to fix this problem. Ext4's block/cluster accounting code for bigalloc relies on i_data_sem for mutual exclusion, as is found in the delayed write path, and the locking in mpage_release_unused_pages() is missing. Cc: stable@kernel.org Reported-by: Ye Bin Signed-off-by: Eric Whitney Link: https://lore.kernel.org/r/20220615160530.1928801-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o commit a89573ce4ad32f19f43ec669771726817e185be0 Author: Zhang Yi Date: Sat Jun 11 21:04:26 2022 +0800 jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() We catch an assert problem in jbd2_journal_commit_transaction() when doing fsstress and request falut injection tests. The problem is happened in a race condition between jbd2_journal_commit_transaction() and ext4_end_io_end(). Firstly, ext4_writepages() writeback dirty pages and start reserved handle, and then the journal was aborted due to some previous metadata IO error, jbd2_journal_abort() start to commit current running transaction, the committing procedure could be raced by ext4_end_io_end() and lead to subtract j_reserved_credits twice from commit_transaction->t_outstanding_credits, finally the t_outstanding_credits is mistakenly smaller than t_nr_buffers and trigger assert. kjournald2 kworker jbd2_journal_commit_transaction() write_unlock(&journal->j_state_lock); atomic_sub(j_reserved_credits, t_outstanding_credits); //sub once jbd2_journal_start_reserved() start_this_handle() //detect aborted journal jbd2_journal_free_reserved() //get running transaction read_lock(&journal->j_state_lock) __jbd2_journal_unreserve_handle() atomic_sub(j_reserved_credits, t_outstanding_credits); //sub again read_unlock(&journal->j_state_lock); journal->j_running_transaction = NULL; J_ASSERT(t_nr_buffers <= t_outstanding_credits) //bomb!!! Fix this issue by using journal->j_state_lock to protect the subtraction in jbd2_journal_commit_transaction(). Fixes: 96f1e0974575 ("jbd2: avoid long hold times of j_state_lock while committing a transaction") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220611130426.2013258-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit d1324958567da957385d8d555a8b840b3bf8e6e3 Author: Jan Kara Date: Wed Jun 8 13:23:50 2022 +0200 jbd2: unexport jbd2_log_start_commit() jbd2_log_start_commit() is not used outside of jbd2 so unexport it. Also make __jbd2_log_start_commit() static when we are at it. Signed-off-by: Jan Kara Reviewed-by: Lukas Czerner Link: https://lore.kernel.org/r/20220608112355.4397-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 68af74e92a86984ca6d5f7b19ee8f8a30a550873 Author: Jan Kara Date: Wed Jun 8 13:23:49 2022 +0200 jbd2: remove unused exports for jbd2 debugging Jbd2 exports jbd2_journal_enable_debug and __jbd2_debug() depite the first is used only in fs/jbd2/journal.c and the second only within jbd2 code. Remove the pointless exports make jbd2_journal_enable_debug static. Signed-off-by: Jan Kara Reviewed-by: Lukas Czerner Link: https://lore.kernel.org/r/20220608112355.4397-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit cb3b3bf22cf33707d684e74207908ba0ef3b6467 Author: Jan Kara Date: Wed Jun 8 13:23:48 2022 +0200 jbd2: rename jbd_debug() to jbd2_debug() The name of jbd_debug() is confusing as all functions inside jbd2 have jbd2_ prefix. Rename jbd_debug() to jbd2_debug(). No functional changes. Signed-off-by: Jan Kara Reviewed-by: Lukas Czerner Link: https://lore.kernel.org/r/20220608112355.4397-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit 4978c659e7b5c1926cdb4b556e4ca1fd2de8ad42 Author: Jan Kara Date: Wed Jun 8 13:23:47 2022 +0200 ext4: use ext4_debug() instead of jbd_debug() We use jbd_debug() in some places in ext4. It seems a bit strange to use jbd2 debugging output function for ext4 code. Also these days ext4_debug() uses dynamic printk so each debug message can be enabled / disabled on its own so the time when it made some sense to have these combined (to allow easier common selecting of messages to report) has passed. Just convert all jbd_debug() uses in ext4 to ext4_debug(). Signed-off-by: Jan Kara Reviewed-by: Lukas Czerner Link: https://lore.kernel.org/r/20220608112355.4397-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 218a69441bf7f65155b96584e354f12c28b7944a Author: hanjinke Date: Mon Jun 6 23:53:05 2022 +0800 ext4: reuse order and buddy in mb_mark_used when buddy split After each buddy split, mb_mark_used will search the proper order for the block which may consume some loop in mb_find_order_for_block. In fact, we can reuse the order and buddy generated by the buddy split. Reviewed by: lei.rao@intel.com Signed-off-by: hanjinke Link: https://lore.kernel.org/r/20220606155305.74146-1-hanjinke.666@bytedance.com Signed-off-by: Theodore Ts'o commit 827891a38accfb4e04dbcdefe710f8746c6ad16d Author: Theodore Ts'o Date: Wed Jun 29 00:00:26 2022 -0400 ext4: update the s_overhead_clusters in the backup sb's when resizing When the EXT4_IOC_RESIZE_FS ioctl is complete, update the backup superblocks. We don't do this for the old-style resize ioctls since they are quite ancient, and only used by very old versions of resize2fs --- and we don't want to update the backup superblocks every time EXT4_IOC_GROUP_ADD is called, since it might get called a lot. Signed-off-by: Theodore Ts'o Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220629040026.112371-2-tytso@mit.edu Signed-off-by: Theodore Ts'o commit de394a86658ffe4e89e5328fd4993abfe41b7435 Author: Theodore Ts'o Date: Wed Jun 29 00:00:25 2022 -0400 ext4: update s_overhead_clusters in the superblock during an on-line resize When doing an online resize, the on-disk superblock on-disk wasn't updated. This means that when the file system is unmounted and remounted, and the on-disk overhead value is non-zero, this would result in the results of statfs(2) to be incorrect. This was partially fixed by Commits 10b01ee92df5 ("ext4: fix overhead calculation to account for the reserved gdt blocks"), 85d825dbf489 ("ext4: force overhead calculation if the s_overhead_cluster makes no sense"), and eb7054212eac ("ext4: update the cached overhead value in the superblock"). However, since it was too expensive to forcibly recalculate the overhead for bigalloc file systems at every mount, this didn't fix the problem for bigalloc file systems. This commit should address the problem when resizing file systems with the bigalloc feature enabled. Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220629040026.112371-1-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 5a57bca9050d740ca37184302e23d0e7633e3ebc Author: Zhang Yi Date: Thu Jun 30 17:01:00 2022 +0800 ext4: fix reading leftover inlined symlinks Since commit 6493792d3299 ("ext4: convert symlink external data block mapping to bdev"), create new symlink with inline_data is not supported, but it missing to handle the leftover inlined symlinks, which could cause below error message and fail to read symlink. ls: cannot read symbolic link 'foo': Structure needs cleaning EXT4-fs error (device sda): ext4_map_blocks:605: inode #12: block 2021161080: comm ls: lblock 0 mapped to illegal pblock 2021161080 (length 1) Fix this regression by adding ext4_read_inline_link(), which read the inline data directly and convert it through a kmalloced buffer. Fixes: 6493792d3299 ("ext4: convert symlink external data block mapping to bdev") Cc: stable@kernel.org Reported-by: Torge Matthies Signed-off-by: Zhang Yi Tested-by: Torge Matthies Link: https://lore.kernel.org/r/20220630090100.2769490-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o commit c86019ff75c1475968c25b87fa05bf342f03a6c9 Author: ZiyangZhang Date: Thu Jul 28 20:39:16 2022 +0800 ublk_drv: add support for UBLK_IO_NEED_GET_DATA UBLK_IO_NEED_GET_DATA is one ublk IO command. It is designed for a user application who wants to allocate IO buffer and set IO buffer address only after it receives an IO request from ublksrv. This is a reasonable scenario because these users may use a RPC framework as one IO backend to handle IO requests passed from ublksrv. And a RPC framework may allocate its own buffer(or memory pool). This new feature (UBLK_F_NEED_GET_DATA) is optional for ublk users. Related userspace code has been added in ublksrv[1] as one pull request. Test cases for this feature are added in ublksrv and all the tests pass. The performance result shows that this new feature does bring additional latency because one IO is issued back to ublk_drv once again to copy data from bio vectors to user-provided data buffer. UBLK_IO_NEED_GET_DATA is suitable for bigger block size such as 512B or 1MB. [1] https://github.com/ming1/ubdsrv Signed-off-by: ZiyangZhang Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/3a21007ea1be8304246e654cebbd581ab0012623.1659011443.git.ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit 4e18403d9485a43e1b54397df258b8df7dac9a83 Author: ZiyangZhang Date: Thu Jul 28 20:39:15 2022 +0800 ublk_cmd.h: add one new ublk command: UBLK_IO_NEED_GET_DATA Add one new ublk command: UBLK_IO_NEED_GET_DATA. It is prepared for a new feature designed for a user application who wants to allocate IO buffer and set IO buffer address only after it receives an IO request from ublksrv. Reviewed-by: Ming Lei Signed-off-by: ZiyangZhang Link: https://lore.kernel.org/r/c8a64b6b51c78340da7daa9e1054608695e79619.1659011443.git.ZiyangZhang@linux.alibaba.com Signed-off-by: Jens Axboe commit 4bf9cbf3e93426e9ebe136dabd6ca392ca92cfcb Author: Ming Lei Date: Sat Jul 30 17:27:50 2022 +0800 ublk_drv: cleanup ublksrv_ctrl_dev_info Remove all block device related info from ublksrv_ctrl_dev_info, meantime reduce its size into 64 bytes because: 1) ublksrv_ctrl_dev_info becomes cleaner without including any block related info 2) generic set/get parameter command can be used to set block related setting easily and cleanly 3) generic set/get parameter command can be used for extending ublk without needing more info in ublksrv_ctrl_dev_info Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220730092750.1118167-5-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 0aa73170eba5eae638c1b96a05eba533f030b5cb Author: Ming Lei Date: Sat Jul 30 17:27:49 2022 +0800 ublk_drv: add SET_PARAMS/GET_PARAMS control command Add two commands to set/get parameters generically. One important goal of ublk is to provide generic framework for making block device by userspace flexibly. As one generic block device, there are still lots of block parameters, such as max_sectors, write_cache/fua, discard related limits, zoned parameters, ...., so this patch starts to add generic mechanism for set/get device parameters. Both generic block parameters(all kinds of queue settings) and ublk feature parameters can be covered with this way, then it becomes quite easy to extend in future. Add two parameter types are used so far: basic(covers basic queue setting and misc settings which can't be grouped easily) and discard, basic type must be set, and discard type becomes optional now This way provides mechanism to simulate any kind of generic block device from userspace easily, from both block queue setting viewpoint or ublk feature viewpoint. The style of putting all parameters together is suggested by Christoph. Suggested-by: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220730092750.1118167-4-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 93d71ec89d5fb2bc431fe7e0ff7ca819bf6dc601 Author: Ming Lei Date: Sat Jul 30 17:27:48 2022 +0800 ublk_drv: fix ublk device leak in case that add_disk fails ->free_disk is only called after disk is added successfully, so drop ublk device reference in case of add_disk() failure. Fixes: 6d9e6dfdf3b2 ("ublk: defer disk allocation") Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220730092750.1118167-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit a8ce5f52efce3b89ca82ce8798d0d061117465d2 Author: Ming Lei Date: Sat Jul 30 17:27:47 2022 +0800 ublk_drv: cancel device even though disk isn't up Each ublk queue is started before adding disk, we have to cancel queues in ublk_stop_dev() so that ubq daemon can be exited, otherwise DEL_DEV command may hang forever. Also avoid to cancel queues two times by checking if queue is ready, otherwise use-after-free on io_uring may be triggered because ublk_stop_dev is called by ublk_remove() too. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20220730092750.1118167-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit e97424fd44727b4a5ecb124a49f575fed6086999 Author: Keith Busch Date: Tue Jul 12 08:32:56 2022 -0700 block: fix leaking page ref on truncated direct io The size being added to a bio from an iov is aligned to a block size after the pages were gotten. If the new aligned size truncates the last page, its reference was being leaked. Ensure all pages that were not added to the bio have their reference released. Since this essentially requires doing the same that bio_put_pages(), and there was only one caller for that function, this patch makes the put_page() loop common for everyone. Fixes: b1a000d3b8ec5 ("block: relax direct io memory alignment") Reported-by: Al Viro Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20220712153256.2202024-3-kbusch@fb.com Signed-off-by: Jens Axboe commit 34cdb8c825f28a5c91c5336a80967533da57da74 Author: Keith Busch Date: Tue Jul 12 08:32:55 2022 -0700 block: ensure bio_iov_add_page can't fail Adding the page could fail on the bio_full() condition, which checks for either exceeding the bio's max segments or total size exceeding UINT_MAX. We already ensure the max segments can't be exceeded, so just ensure the total size won't reach the limit. This simplifies error handling and removes unnecessary repeated bio_full() checks. Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20220712153256.2202024-2-kbusch@fb.com Signed-off-by: Jens Axboe commit 325347d965e7ccf5424a05398807a6d801846612 Author: Keith Busch Date: Tue Jul 12 08:32:54 2022 -0700 block: ensure iov_iter advances for added pages There are cases where a bio may not accept additional pages, and the iov needs to advance to the last data length that was accepted. The zone append used to handle this correctly, but was inadvertently broken when the setup was made common with the normal r/w case. Fixes: 576ed9135489c ("block: use bio_add_page in bio_iov_iter_get_pages") Fixes: c58c0074c54c2 ("block/bio: remove duplicate append pages code") Signed-off-by: Keith Busch Link: https://lore.kernel.org/r/20220712153256.2202024-1-kbusch@fb.com Signed-off-by: Jens Axboe commit 104212471b1c1817b311771d817fb692af983173 Author: Wentao_Liang Date: Thu Jul 28 19:39:19 2022 +0800 drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function. Signed-off-by: Wentao_Liang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 20313b1b8cd1bda34ee136b656c39ff2ae189330 Author: Logan Gunthorpe Date: Wed Jul 27 15:06:00 2022 -0600 md/raid5: Ensure batch_last is released before sleeping for quiesce A race condition exists where if raid5_quiesce() is called in the middle of a request that has set batch_last, it will deadlock. batch_last will hold a reference to a stripe when raid5_quiesce() is called. This will cause the next raid5_get_active_stripe() call to sleep waiting for the quiesce to finish, but the raid5_quiesce() thread will wait for active_stripes to go to zero which will never happen because request thread is waiting for the quiesce to stop. Fix this by creating a special __raid5_get_active_stripe() function which takes the request context and clears the last_batch before sleeping. While we're at it, change the arguments of raid5_get_active_stripe() to bools. Fixes: 3312e6c887fe ("md/raid5: Keep a reference to last stripe_head for batch") Reported-by: David Sloan Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit df6b0e205d1fe3fe1f2e9aaee9fc396b64e1c293 Author: Logan Gunthorpe Date: Wed Jul 27 15:05:59 2022 -0600 md/raid5: Move stripe_request_ctx up Move stripe_request_ctx up. No functional changes intended. This will be necessary in the next patch to release the batch_last in the context before sleeping. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 9734fe7bd53f85206edee58e0271dbf214c2059c Author: Logan Gunthorpe Date: Wed Jul 27 15:05:58 2022 -0600 md/raid5: Drop unnecessary call to r5c_check_stripe_cache_usage() Now that raid5_get_active_stripe() has been refactored it is appearant that r5c_check_stripe_cache_usage() doesn't need to be called in the wait_for_stripe branch. r5c_check_stripe_cache_usage() will only conditionally call r5l_wake_reclaim(), but that function is called two lines later. Drop the call for cleanup. Reported-by: Martin Oliveira Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 3514da58be9c40b4e377d73a21a56e89145f2843 Author: Logan Gunthorpe Date: Wed Jul 27 15:05:57 2022 -0600 md/raid5: Make is_inactive_blocked() helper The logic to wait_for_stripe is difficult to parse being on so many lines and with confusing operator precedence. Move it to a helper function to make it easier to read. No functional changes intended. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 5165ed40a1f0a3bf03526aad96df736556fbe64f Author: Logan Gunthorpe Date: Wed Jul 27 15:05:56 2022 -0600 md/raid5: Refactor raid5_get_active_stripe() Refactor the raid5_get_active_stripe() to read more linearly in the order it's typically executed. The init_stripe() call is called if a free stripe is found and the function is exited early which removes a lot of if (sh) checks and unindents the following code. Remove the while loop in favour of the 'goto retry' pattern, which reduces indentation further. And use a 'goto wait_for_stripe' instead of an additional indent seeing it is the unusual path and this makes the code easier to read. No functional changes intended. Will make subsequent changes in patches easier to understand. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit c55ddd9082f757050183bd0e215aab3af3fc225f Author: Christoph Hellwig Date: Wed Jul 27 12:23:00 2022 -0400 block: pass struct queue_limits to the bio splitting helpers Allow using the splitting helpers on just a queue_limits instead of a full request_queue structure. This will eventually allow file systems or remapping drivers to split REQ_OP_ZONE_APPEND bios based on limits calculated as the minimum common capabilities over multiple devices. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220727162300.3089193-7-hch@lst.de Signed-off-by: Jens Axboe commit b6dc6198ebe855d70e6f68d279c4015fe5d73e7b Author: Christoph Hellwig Date: Wed Jul 27 12:22:59 2022 -0400 block: move bio_allowed_max_sectors to blk-merge.c Move this helper into the only file where it is used. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220727162300.3089193-6-hch@lst.de Signed-off-by: Jens Axboe commit a85b36375b05f70301f15cafb9030cae7c789f76 Author: Christoph Hellwig Date: Wed Jul 27 12:22:58 2022 -0400 block: move the call to get_max_io_size out of blk_bio_segment_split Prepare for reusing blk_bio_segment_split for (file system controlled) splits of REQ_OP_ZONE_APPEND bios by letting the caller control the maximum size of the bio. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220727162300.3089193-5-hch@lst.de Signed-off-by: Jens Axboe commit 46754bd056053785d7079f1d48f7f571728dcb47 Author: Christoph Hellwig Date: Wed Jul 27 12:22:57 2022 -0400 block: move ->bio_split to the gendisk Only non-passthrough requests are split by the block layer and use the ->bio_split bio_set. Move it from the request_queue to the gendisk. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220727162300.3089193-4-hch@lst.de Signed-off-by: Jens Axboe commit e2b542100719a93f8cdf6d90185410d38a57a4c1 Merge: e05d5b9c5bbea 94dfc73e7cf4a Author: Linus Torvalds Date: Tue Aug 2 19:50:47 2022 -0700 Merge tag 'flexible-array-transformations-UAPI-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull uapi flexible array update from Gustavo Silva: "A treewide patch that replaces zero-length arrays with flexible-array members in UAPI. This has been baking in linux-next for 5 weeks now. '-fstrict-flex-arrays=3' is coming and we need to land these changes to prevent issues like these in the short future: fs/minix/dir.c:337:3: warning: 'strcpy' will always overflow; destination buffer has size 0, but the source string has length 2 (including NUL byte) [-Wfortify-source] strcpy(de3->name, "."); ^ Since these are all [0] to [] changes, the risk to UAPI is nearly zero. If this breaks anything, we can use a union with a new member name" Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 * tag 'flexible-array-transformations-UAPI-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: treewide: uapi: Replace zero-length arrays with flexible-array members commit e05d5b9c5bbea80313d8f58c3a80a18839b25480 Merge: 665fe72a7d4f0 4062eba9f3d07 Author: Linus Torvalds Date: Tue Aug 2 19:44:56 2022 -0700 Merge tag 'linux-kselftest-next-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: - timers test build fixes and cleanups for new tool chains - removing khdr from kselftest framework and main Makefile - changes to test output messages to improve reports * tag 'linux-kselftest-next-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (24 commits) Makefile: replace headers_install with headers for kselftest selftests/landlock: drop deprecated headers dependency selftests: timers: clocksource-switch: adapt to kselftest framework selftests: timers: clocksource-switch: add 'runtime' command line parameter selftests: timers: clocksource-switch: add command line switch to skip sanity check selftests: timers: clocksource-switch: sort includes selftests: timers: clocksource-switch: fix passing errors from child selftests: timers: inconsistency-check: adapt to kselftest framework selftests: timers: nanosleep: adapt to kselftest framework selftests: timers: fix declarations of main() selftests: timers: valid-adjtimex: build fix for newer toolchains Makefile: add headers_install to kselftest targets selftests: drop KSFT_KHDR_INSTALL make target selftests: stop using KSFT_KHDR_INSTALL selftests: drop khdr make target selftests: drivers/dma-buf: Improve message in selftest summary selftests/kcmp: Make the test output consistent and clear selftests:timers: globals don't need initialization to 0 selftests/drivers/gpu: Add error messages to drm_mm.sh selftests/tpm2: increase timeout for kselftests ... commit 665fe72a7d4f0ad17923e0a5ff2e6cc64d57c970 Merge: aad26f55f47a3 4c392516accfe Author: Linus Torvalds Date: Tue Aug 2 19:34:45 2022 -0700 Merge tag 'linux-kselftest-kunit-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: "This consists of several fixes and an important feature to discourage running KUnit tests on production systems. Running tests on a production system could leave the system in a bad state. Summary: - Add a new taint type, TAINT_TEST to signal that a test has been run. This should discourage people from running these tests on production systems, and to make it easier to tell if tests have been run accidentally (by loading the wrong configuration, etc) - Several documentation and tool enhancements and fixes" * tag 'linux-kselftest-kunit-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (29 commits) Documentation: KUnit: Fix example with compilation error Documentation: kunit: Add CLI args for kunit_tool kcsan: test: Add a .kunitconfig to run KCSAN tests kunit: executor: Fix a memory leak on failure in kunit_filter_tests clk: explicitly disable CONFIG_UML_PCI_OVER_VIRTIO in .kunitconfig mmc: sdhci-of-aspeed: test: Use kunit_test_suite() macro nitro_enclaves: test: Use kunit_test_suite() macro thunderbolt: test: Use kunit_test_suite() macro kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites kunit: unify module and builtin suite definitions selftest: Taint kernel when test module loaded module: panic: Taint the kernel when selftest modules load Documentation: kunit: fix example run_kunit func to allow spaces in args Documentation: kunit: Cleanup run_wrapper, fix x-ref kunit: test.h: fix a kernel-doc markup kunit: tool: Enable virtio/PCI by default on UML kunit: tool: make --kunitconfig repeatable, blindly concat kunit: add coverage_uml.config to enable GCOV on UML kunit: tool: refactor internal kconfig handling, allow overriding kunit: tool: introduce --qemu_args ... commit aad26f55f47a33d6de3df65f0b18e2886059ed6d Merge: b069122256e45 339170d8d3da5 Author: Linus Torvalds Date: Tue Aug 2 19:24:24 2022 -0700 Merge tag 'docs-6.0' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "This was a moderately busy cycle for documentation, but nothing all that earth-shaking: - More Chinese translations, and an update to the Italian translations. The Japanese, Korean, and traditional Chinese translations are more-or-less unmaintained at this point, instead. - Some build-system performance improvements. - The removal of the archaic submitting-drivers.rst document, with the movement of what useful material that remained into other docs. - Improvements to sphinx-pre-install to, hopefully, give more useful suggestions. - A number of build-warning fixes Plus the usual collection of typo fixes, updates, and more" * tag 'docs-6.0' of git://git.lwn.net/linux: (92 commits) docs: efi-stub: Fix paths for x86 / arm stubs Docs/zh_CN: Update the translation of sched-stats to 5.19-rc8 Docs/zh_CN: Update the translation of pci to 5.19-rc8 Docs/zh_CN: Update the translation of pci-iov-howto to 5.19-rc8 Docs/zh_CN: Update the translation of usage to 5.19-rc8 Docs/zh_CN: Update the translation of testing-overview to 5.19-rc8 Docs/zh_CN: Update the translation of sparse to 5.19-rc8 Docs/zh_CN: Update the translation of kasan to 5.19-rc8 Docs/zh_CN: Update the translation of iio_configfs to 5.19-rc8 doc:it_IT: align Italian documentation docs: Remove spurious tag from admin-guide/mm/overcommit-accounting.rst Documentation: process: Update email client instructions for Thunderbird docs: ABI: correct QEMU fw_cfg spec path doc/zh_CN: remove submitting-driver reference from docs docs: zh_TW: align to submitting-drivers removal docs: zh_CN: align to submitting-drivers removal docs: ko_KR: howto: remove reference to removed submitting-drivers docs: ja_JP: howto: remove reference to removed submitting-drivers docs: it_IT: align to submitting-drivers removal docs: process: remove outdated submitting-drivers.rst ... commit b069122256e45216b5c49d9441f9713991a4c645 Merge: 7d9d077c783e3 4f8126f3a6654 Author: Linus Torvalds Date: Tue Aug 2 19:22:24 2022 -0700 Merge tag 'nolibc.2022.07.27a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: "This provides nolibc updates, perhaps most notably improved testing via the 'cd tools/include/nolibc; make headers' command. This should be considered a smoke test. More thorough testing is in the works" * tag 'nolibc.2022.07.27a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools/nolibc: add a help target to list supported targets tools/nolibc: make the default target build the headers tools/nolibc: fix the makefile to also work as "make -C tools ..." tools/nolibc/stdio: Add format attribute to enable printf warnings tools/nolibc/stdlib: Support overflow checking for older compiler versions commit 7d9d077c783e33995c80d8b28fea1a98161934f4 Merge: c2a24a7a036b3 34bc7b454dc31 Author: Linus Torvalds Date: Tue Aug 2 19:12:45 2022 -0700 Merge tag 'rcu.2022.07.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: - Documentation updates - Miscellaneous fixes - Callback-offload updates, perhaps most notably a new RCU_NOCB_CPU_DEFAULT_ALL Kconfig option that causes all CPUs to be offloaded at boot time, regardless of kernel boot parameters. This is useful to battery-powered systems such as ChromeOS and Android. In addition, a new RCU_NOCB_CPU_CB_BOOST kernel boot parameter prevents offloaded callbacks from interfering with real-time workloads and with energy-efficiency mechanisms - Polled grace-period updates, perhaps most notably making these APIs account for both normal and expedited grace periods - Tasks RCU updates, perhaps most notably reducing the CPU overhead of RCU tasks trace grace periods by more than a factor of two on a system with 15,000 tasks. The reduction is expected to increase with the number of tasks, so it seems reasonable to hypothesize that a system with 150,000 tasks might see a 20-fold reduction in CPU overhead - Torture-test updates - Updates that merge RCU's dyntick-idle tracking into context tracking, thus reducing the overhead of transitioning to kernel mode from either idle or nohz_full userspace execution for kernels that track context independently of RCU. This is expected to be helpful primarily for kernels built with CONFIG_NO_HZ_FULL=y * tag 'rcu.2022.07.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (98 commits) rcu: Add irqs-disabled indicator to expedited RCU CPU stall warnings rcu: Diagnose extended sync_rcu_do_polled_gp() loops rcu: Put panic_on_rcu_stall() after expedited RCU CPU stall warnings rcutorture: Test polled expedited grace-period primitives rcu: Add polled expedited grace-period primitives rcutorture: Verify that polled GP API sees synchronous grace periods rcu: Make Tiny RCU grace periods visible to polled APIs rcu: Make polled grace-period API account for expedited grace periods rcu: Switch polled grace-period APIs to ->gp_seq_polled rcu/nocb: Avoid polling when my_rdp->nocb_head_rdp list is empty rcu/nocb: Add option to opt rcuo kthreads out of RT priority rcu: Add nocb_cb_kthread check to rcu_is_callbacks_kthread() rcu/nocb: Add an option to offload all CPUs on boot rcu/nocb: Fix NOCB kthreads spawn failure with rcu_nocb_rdp_deoffload() direct call rcu/nocb: Invert rcu_state.barrier_mutex VS hotplug lock locking order rcu/nocb: Add/del rdp to iterate from rcuog itself rcu/tree: Add comment to describe GP-done condition in fqs loop rcu: Initialize first_gp_fqs at declaration in rcu_gp_fqs() rcu/kvfree: Remove useless monitor_todo flag rcu: Cleanup RCU urgency state for offline CPU ... commit c2a24a7a036b3bd3a2e6c66730dfc777cae6540a Merge: a0b09f2d6f307 af5d35b83f642 Author: Linus Torvalds Date: Tue Aug 2 17:45:14 2022 -0700 Merge tag 'v5.20-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Make proc files report fips module name and version Algorithms: - Move generic SHA1 code into lib/crypto - Implement Chinese Remainder Theorem for RSA - Remove blake2s - Add XCTR with x86/arm64 acceleration - Add POLYVAL with x86/arm64 acceleration - Add HCTR2 - Add ARIA Drivers: - Add support for new CCP/PSP device ID in ccp" * tag 'v5.20-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (89 commits) crypto: tcrypt - Remove the static variable initialisations to NULL crypto: arm64/poly1305 - fix a read out-of-bound crypto: hisilicon/zip - Use the bitmap API to allocate bitmaps crypto: hisilicon/sec - fix auth key size error crypto: ccree - Remove a useless dma_supported() call crypto: ccp - Add support for new CCP/PSP device ID crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: testmgr - some more fixes to RSA test vectors cyrpto: powerpc/aes - delete the rebundant word "block" in comments hwrng: via - Fix comment typo crypto: twofish - Fix comment typo crypto: rmd160 - fix Kconfig "its" grammar crypto: keembay-ocs-ecc - Drop if with an always false condition Documentation: qat: rewrite description Documentation: qat: Use code block for qat sysfs example crypto: lib - add module license to libsha1 crypto: lib - make the sha1 library optional crypto: lib - move lib/sha1.c into lib/crypto/ crypto: fips - make proc files report fips module name and version ... commit a0b09f2d6f30723e1008bd9ddb504e302e329f81 Merge: 569bede0cff5e 7f637be4d4602 Author: Linus Torvalds Date: Tue Aug 2 17:31:35 2022 -0700 Merge tag 'random-6.0-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator updates from Jason Donenfeld: "Though there's been a decent amount of RNG-related development during this last cycle, not all of it is coming through this tree, as this cycle saw a shift toward tackling early boot time seeding issues, which took place in other trees as well. Here's a summary of the various patches: - The CONFIG_ARCH_RANDOM .config option and the "nordrand" boot option have been removed, as they overlapped with the more widely supported and more sensible options, CONFIG_RANDOM_TRUST_CPU and "random.trust_cpu". This change allowed simplifying a bit of arch code. - x86's RDRAND boot time test has been made a bit more robust, with RDRAND disabled if it's clearly producing bogus results. This would be a tip.git commit, technically, but I took it through random.git to avoid a large merge conflict. - The RNG has long since mixed in a timestamp very early in boot, on the premise that a computer that does the same things, but does so starting at different points in wall time, could be made to still produce a different RNG state. Unfortunately, the clock isn't set early in boot on all systems, so now we mix in that timestamp when the time is actually set. - User Mode Linux now uses the host OS's getrandom() syscall to generate a bootloader RNG seed and later on treats getrandom() as the platform's RDRAND-like faculty. - The arch_get_random_{seed_,}_long() family of functions is now arch_get_random_{seed_,}_longs(), which enables certain platforms, such as s390, to exploit considerable performance advantages from requesting multiple CPU random numbers at once, while at the same time compiling down to the same code as before on platforms like x86. - A small cleanup changing a cmpxchg() into a try_cmpxchg(), from Uros. - A comment spelling fix" More info about other random number changes that come in through various architecture trees in the full commentary in the pull request: https://lore.kernel.org/all/20220731232428.2219258-1-Jason@zx2c4.com/ * tag 'random-6.0-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: correct spelling of "overwrites" random: handle archrandom with multiple longs um: seed rng using host OS rng random: use try_cmpxchg in _credit_init_bits timekeeping: contribute wall clock to rng on time change x86/rdrand: Remove "nordrand" flag in favor of "random.trust_cpu" random: remove CONFIG_ARCH_RANDOM commit 51d798cdb5c219000fe76a3ffbcaa846b689ba80 Author: Christoph Hellwig Date: Wed Jul 27 12:22:56 2022 -0400 block: change the blk_queue_bounce calling convention The double indirect bio leads to somewhat suboptimal code generation. Instead return the (original or split) bio, and make sure the request_queue arguments to the lower level helpers is passed after the bio to avoid constant reshuffling of the argument passing registers. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20220727162300.3089193-3-hch@lst.de Signed-off-by: Jens Axboe commit 5a97806f7dc069d9561d9930a2ae108700e222ab Author: Christoph Hellwig Date: Wed Jul 27 12:22:55 2022 -0400 block: change the blk_queue_split calling convention The double indirect bio leads to somewhat suboptimal code generation. Instead return the (original or split) bio, and make sure the request_queue arguments to the lower level helpers is passed after the bio to avoid constant reshuffling of the argument passing registers. Also give it and the helpers used to implement it more descriptive names. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220727162300.3089193-2-hch@lst.de Signed-off-by: Jens Axboe commit de474b550e2548f9844e872f1c0bf94460c7c84c Author: Christoph Hellwig Date: Mon Jul 25 07:40:26 2022 +0200 nvme: update MAINTAINERS for the new auth code Add the common subdirectory and match all nvme* headers in include/linux/. Reported-by: Dan Carpenter Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee Author: Sagi Grimberg Date: Sun Jul 24 11:58:43 2022 +0300 nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are sending/receiving for the socket from works on this workqueue. Also this eliminates lockdep complaints: -- [ 6174.010200] workqueue: WQ_MEM_RECLAIM nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing !WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp] [ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628 check_flush_dependency+0x110/0x14c Reported-by: Yi Zhang Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit eb867ee995bd687154adb77bf7fda05c7d16fd9d Author: Joel Granados Date: Tue Jul 12 20:33:04 2022 +0200 nvme: enable generic interface (/dev/ngXnY) for unknown command sets Extend nvme_alloc_ns() and nvme_validate_ns() for unknown command-set as well. Both are made to use a new helper (nvme_update_ns_info_cs_indep) which is similar to nvme_update_ns_info but performs fewer operations to get the generic interface up. Suggested-by: Christoph Hellwig Signed-off-by: Joel Granados Signed-off-by: Kanchan Joshi [hch: rebased on other refactoring patches] Signed-off-by: Christoph Hellwig Reviewed-by: Javier González Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 1e4ea66af1db4fde5988b6ed43341872a17e390d Author: Christoph Hellwig Date: Wed Jul 13 07:40:25 2022 +0200 nvme: factor out a nvme_ns_is_readonly helper Add a little helper to check if a namespace should be marked read-only that uses a new is_readonly flag in the nvme_ns_info structure. Signed-off-by: Christoph Hellwig Reviewed-by: Javier González Reviewed-by: Joel Granados Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 1a893c2bfef46ac447eead8ea7afe417942be237 Author: Christoph Hellwig Date: Fri Jul 22 18:24:18 2022 +0200 nvme: refactor namespace probing Change nvme_ns_scan to gather all information needed for generic namespace setup into a nvme_ns_info structure. This structure is filled from the Command Set Idependent Identify Namespace data structure if it is available or else the legacy Identify namespace structure. With that everything related to the NVM command set (and the ZNS command set derived from it) can be encapsulated in the nvme_update_ns_info_block function while keeping the rest of the namespace probing generic. The downside is that we now always issue two Identify Namespace calls for each probed namespace instead of usually just a single one previously. Signed-off-by: Christoph Hellwig Reviewed-by: Javier González Reviewed-by: Joel Granados Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 71882e7d23b84036d4b0bea896a7b457478f3df2 Author: Christoph Hellwig Date: Tue Jul 12 18:15:01 2022 +0200 nvme: generalize the nvme_multi_css check in nvme_scan_ns Check for multiple command set support early on an error out if is not supported when a !NVM command set namespace is found. This prepares for adding command set independent passthrough support. Signed-off-by: Christoph Hellwig Reviewed-by: Javier González Reviewed-by: Joel Granados Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 04c170f669f1686b8b762625ac9c5297bfd5add2 Author: Christoph Hellwig Date: Tue Jul 12 18:07:53 2022 +0200 nvme: rename nvme_validate_or_alloc_ns to nvme_scan_ns This shorter name much better fits what this function does in the scanning process. Signed-off-by: Christoph Hellwig Reviewed-by: Javier González Reviewed-by: Joel Granados Reviewed-by: Sagi Grimberg Reviewed-by: Kanchan Joshi Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit e06b425bc835ead08b9fd935bf5e47eef473e7a0 Author: Christoph Hellwig Date: Thu Jul 21 07:56:35 2022 +0200 nvme: catch -ENODEV from nvme_revalidate_zones again nvme_revalidate_zones can also return -ENODEV if e.g. zone sizes aren't constant or not a power of two. In that case we should jump to marking the gendisk hidden and only support pass through. Fixes: 602e57c9799c ("nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info") Reported-by: Joel Granados Signed-off-by: Christoph Hellwig Reviewed-by: Joel Granados Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 4cf42ec36673707acefcddbdc21da8d6a61ac5a2 Author: Lukas Bulwahn Date: Wed Jul 20 13:37:17 2022 +0200 nvmet-auth: select the intended CRYPTO_DH_RFC7919_GROUPS Commit 71ebe3842ebe ("nvmet-auth: Diffie-Hellman key exchange support") intends to select 'Support for RFC 7919 FFDHE group parameters' for using FFDHE groups for NVMe In-Band Authentication. It however selects CRYPTO_DH_GROUPS_RFC7919, instead of the intended CRYPTO_DH_RFC7919_GROUPS; notice the swapping of words here. Correct the select to the intended config option. Signed-off-by: Lukas Bulwahn Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit be2ada6d0ed094c77040dc7e2d56599dd492d961 Author: Chaitanya Kulkarni Date: Mon Jul 18 16:12:33 2022 -0700 nvmet-auth: fix return value check in auth receive nvmet_auth_challenge() return type is int and currently it uses status variable that is of type u16 in nvmet_execute_auth_receive(). Catch the return value of nvmet_auth_challenge() into int and set the NVME_SC_INTERNAL as status variable before we jump to error. Reported-by: Dan Carpenter Signed-off-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 1040415c29f065e47b6b4df9f3902602d0382d3d Author: Chaitanya Kulkarni Date: Mon Jul 18 16:12:32 2022 -0700 nvmet-auth: fix return value check in auth send nvmet_setup_auth() return type is int and currently it uses status variable that is of type u16 in nvmet_execute_auth_send(). Catch the return value of nvmet_setup_auth() into int and set the NVME_SC_INTERNAL as status variable before we jump to error. Reported-by: Dan Carpenter Signed-off-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9db056e9506ccf74405941777ae128947b81900d Author: Colin Ian King Date: Fri Jul 15 14:24:13 2022 +0100 nvmet-auth: fix a couple of spelling mistakes There are a couple of spelling mistakes in pr_warn and pr_debug messages. Fix them. Signed-off-by: Colin Ian King Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 7b1aae1aee2225ec28eb17b9e5c5d5252922f67f Author: Christoph Hellwig Date: Mon Jul 18 07:02:29 2022 +0200 nvmet: fix a format specifier in nvmet_auth_ctrl_exponential dh_keysize is a size_t, use the proper format specifier for printing it. Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Guenter Roeck Signed-off-by: Jens Axboe commit ee8cd008b7da0ee6f24167739e364f43b8a0875b Author: Christoph Hellwig Date: Mon Jul 18 07:00:12 2022 +0200 nvmet: don't check for NULL pointer before kfree in nvmet_host_release And add an empty line after the variable declaration. Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 2fec1dfc28c993fe0ff8b72754e0b60a9338486e Author: Christoph Hellwig Date: Fri Jul 15 11:54:36 2022 +0200 nvme-apple: stop casting function pointer signatures Casting function pointers breaks control flow enforcement and is generally a horrible coding style. Add two wrappers to get rid of these casts. Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Sven Peter Signed-off-by: Jens Axboe commit 2f7a7e5d85f646d8b0756bd5cd9855322bd805a7 Author: Christoph Hellwig Date: Thu Jul 21 08:23:19 2022 +0200 nvme-tcp: split nvme_tcp_alloc_tagset Split nvme_tcp_alloc_tagset into one helper for the admin tag_set and one for the I/O tag set. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit a7f7b7116c1439412db65079b8284727a4a6569b Author: Christoph Hellwig Date: Thu Jul 21 08:19:02 2022 +0200 nvme-rdma: split nvme_rdma_alloc_tagset Split nvme_rdma_alloc_tagset into one helper for the admin tag_set and one for the I/O tag set. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 2455a4b77835c2c9d1c0310d50f69e6fbc1b173f Author: Christoph Hellwig Date: Thu Jul 21 08:13:23 2022 +0200 nvme-pci: split nvme_dev_add Split nvme_dev_add into a helper to actually allocate the tag set, and one that just update the number of queues. Add a local variable for the tag_set to clean up the code a bit. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit f91b727ccf1fabe6c02dc184bb8a156f895428c8 Author: Christoph Hellwig Date: Thu Jul 21 08:07:14 2022 +0200 nvme-pci: split nvme_alloc_admin_tags Split nvme_alloc_admin_tags into a helper to actually allocate the tag set, and one that just restarts the admin queue. Add a local variable for the tag_set to clean up the code a bit. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 8614144002b58520be653c5645cabe707fb46b2a Author: Christoph Hellwig Date: Mon Jul 18 07:13:24 2022 +0200 nvme-pci: print the command name of aborted commands To allow for slightly better debugging, print the command name when aborting an command. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 33b6debd6128f28e21b916d1ec551683fd16e088 Author: Liu Song Date: Sat Jul 16 19:49:41 2022 +0800 nvme-pci: remove useless assignment in nvme_pci_setup_prps If prp_list is NULL, nvme_unmap_sg will be performed, and the assignment to first_dma is meaningless, so remove it. Signed-off-by: Liu Song Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 80e2768496a494ce3166f8358d8665d2a056bcb7 Author: Dan Carpenter Date: Mon Jul 18 14:10:45 2022 +0300 nvme-auth: uninitialized variable in nvme_auth_transform_key() A couple of the early error gotos call kfree_sensitive(transformed_key); before "transformed_key" has been initialized. Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") Signed-off-by: Dan Carpenter Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 4daf7fa07ee3c31d5b03b87f96dbf3d8151ef654 Author: Dan Carpenter Date: Mon Jul 18 14:09:32 2022 +0300 nvme-auth: fix off by one checks The > ARRAY_SIZE() checks need to be >= ARRAY_SIZE() to prevent reading one element beyond the end of the arrays. Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") Signed-off-by: Dan Carpenter Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit a25d4261582cf00dad884c194d21084836663d3d Author: Nick Bowler Date: Wed Jul 20 23:57:35 2022 -0400 nvme: define compat_ioctl again to unbreak 32-bit userspace. Commit 89b3d6e60550 ("nvme: simplify the compat ioctl handling") removed the initialization of compat_ioctl from the nvme block_device_operations structures. Presumably the expectation was that 32-bit ioctls would be directed through the regular handler but this is not the case: failing to assign .compat_ioctl actually means that the compat case is disabled entirely, and any attempt to submit nvme ioctls from 32-bit userspace fails outright with -ENOTTY. For example: % smartctl -x /dev/nvme0n1 [...] Read NVMe Identify Controller failed: NVME_IOCTL_ADMIN_CMD: Inappropriate ioctl for device The blkdev_compat_ptr_ioctl helper can be used to direct compat calls through the main ioctl handler and makes things work again. Fixes: 89b3d6e60550 ("nvme: simplify the compat ioctl handling") Signed-off-by: Nick Bowler Reviewed-by: Guixin Liu Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit eb7e2d92588cc6351286de13e3b5d70ecc768888 Author: Christoph Hellwig Date: Mon Jul 18 07:07:26 2022 +0200 nvme: don't always build constants.o The entire content of constants.c if guarded by an ifdef, so switch to just building the file conditionally instead. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Signed-off-by: Jens Axboe commit 679c54f2de672b7d79d02f8c4ad483ff6dd8ce2e Author: Bean Huo Date: Fri Jul 15 23:27:21 2022 +0200 nvme: use command_id instead of req->tag in trace_nvme_complete_rq() Use command_id instead of req->tag in trace_nvme_complete_rq(), because of commit e7006de6c238 ("nvme: code command_id with a genctr for use authentication after release"), cmd->common.command_id is set to ((genctl & 0xf)< 12 | req->tag), no longer req->tag, which makes cid in trace_nvme_complete_rq and trace_nvme_setup_cmd are not the same. Fixes: e7006de6c238 ("nvme: code command_id with a genctr for use authentication after release") Signed-off-by: Bean Huo Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit d17f744e883b2f8d13cca252d71cfe8ace346f7d Author: Mikulas Patocka Date: Tue Jul 26 04:33:12 2022 -0400 md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit e151db8ecfb019b7da31d076130a794574c89f6f Author: Mikulas Patocka Date: Sun Jul 24 14:26:12 2022 -0400 md-raid: destroy the bitmap after destroying the thread When we ran the lvm test "shell/integrity-blocksize-3.sh" on a kernel with kasan, we got failure in write_page. The reason for the failure is that md_bitmap_destroy is called before destroying the thread and the thread may be waiting in the function write_page for the bio to complete. When the thread finishes waiting, it executes "if (test_bit(BITMAP_WRITE_ERROR, &bitmap->flags))", which triggers the kasan warning. Note that the commit 48df498daf62 that caused this bug claims that it is neede for md-cluster, you should check md-cluster and possibly find another bugfix for it. BUG: KASAN: use-after-free in write_page+0x18d/0x680 [md_mod] Read of size 8 at addr ffff889162030c78 by task mdX_raid1/5539 CPU: 10 PID: 5539 Comm: mdX_raid1 Not tainted 5.19.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? write_page+0x18d/0x680 [md_mod] kasan_report+0xa8/0xe0 ? write_page+0x18d/0x680 [md_mod] kasan_check_range+0x13f/0x180 write_page+0x18d/0x680 [md_mod] ? super_sync+0x4d5/0x560 [dm_raid] ? md_bitmap_file_kick+0xa0/0xa0 [md_mod] ? rs_set_dev_and_array_sectors+0x2e0/0x2e0 [dm_raid] ? mutex_trylock+0x120/0x120 ? preempt_count_add+0x6b/0xc0 ? preempt_count_sub+0xf/0xc0 md_update_sb+0x707/0xe40 [md_mod] md_reap_sync_thread+0x1b2/0x4a0 [md_mod] md_check_recovery+0x533/0x960 [md_mod] raid1d+0xc8/0x2a20 [raid1] ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid1_end_read_request+0x2a0/0x2a0 [raid1] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Allocated by task 5522: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 md_bitmap_create+0xa8/0xe80 [md_mod] md_run+0x777/0x1300 [md_mod] raid_ctr+0x249c/0x4a30 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 5680: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x40 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0xf7/0x140 kfree+0x80/0x240 md_bitmap_free+0x1c3/0x280 [md_mod] __md_stop+0x21/0x120 [md_mod] md_stop+0x9/0x40 [md_mod] raid_dtr+0x1b/0x40 [dm_raid] dm_table_destroy+0x98/0x1e0 [dm_mod] __dm_destroy+0x199/0x360 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Fixes: 48df498daf62 ("md: move bitmap_destroy to the beginning of __md_stop") Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 34cb92c0a5a15b04e285c690b5a7dee77ddeeaf1 Author: Christoph Hellwig Date: Sat Jul 23 08:24:29 2022 +0200 md: return the allocated devices from md_alloc Two callers of md_alloc want to use the newly allocated devices, so return it instead of letting them find it cumbersomely after the allocation. Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-and-tested-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit a110876828f5de63be657c62a33c8f61ececfb33 Author: Christoph Hellwig Date: Sat Jul 23 08:24:28 2022 +0200 md: open code md_probe in autorun_devices autorun_devices should not be limited to the controls for the legacy probe on open, so just call md_alloc directly. Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-and-tested-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit c0250d16b22e6c1cf074720b386280c03eebff87 Author: Yang Li Date: Fri Jul 22 08:27:55 2022 +0800 md: remove unneeded semicolon Eliminate the following coccicheck warning: ./drivers/md/md.c:8208:2-3: Unneeded semicolon Reported-by: Abaci Robot Signed-off-by: Yang Li Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit d13bc4d84a8e91060d3797fc95c1a0202bfd1499 Author: Christoph Hellwig Date: Thu Jul 21 08:41:02 2022 +0200 remove the sx8 block driver This driver is for fairly obscure hardware, and has only seen random drive-by changes after the maintainer stopped working on it in 2005 (about a year and a half after it was introduced). It has some "interesting" block layer interactions, so let's just drop it unless anyone complains. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220721064102.1715460-1-hch@lst.de [axboe: fix date typo, it was in 2005, not 2015] Signed-off-by: Jens Axboe commit 2198c51a08349eb176cb9789bef6f7243b8699f8 Author: Stephen Rothwell Date: Thu Jul 21 13:11:32 2022 +1000 md: fix build failure for !MODULE After merging the block tree, today's linux-next build (x86_64 allmodconfig) failed like this: drivers/md/md.c:717:22: error: 'mddev_find' defined but not used [-Werror=unused-function] 717 | static struct mddev *mddev_find(dev_t unit) | ^~~~~~~~~~ cc1: all warnings being treated as errors Caused by commit 4500d5c17910 ("md: simplify md_open") Make mddev_find() available only for non-modular builds. Signed-off-by: Stephen Rothwell Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220721131132.070be166@canb.auug.org.au Signed-off-by: Jens Axboe commit a20d636bee41ea67b382207bee216e70f7206752 Author: Jackie Liu Date: Thu Jul 7 17:08:34 2022 +0800 raid5: fix duplicate checks for rdev->saved_raid_disk 'first' will always be greater than or equal to 0, it is unnecessary to repeat the 0 check, clean it up. Signed-off-by: Jackie Liu Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 5b26804bb0af5d4e4f3440b484244d478d60f16b Author: Christoph Hellwig Date: Tue Jul 19 11:18:24 2022 +0200 md: simplify md_open Now that devices are on the all_mddevs list until the gendisk is freed, there can't be any duplicates. Remove the global list lookup and just grab a reference. Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 12a6caf273240ae42842de8cc05feaa86e582d61 Author: Christoph Hellwig Date: Tue Jul 19 11:18:23 2022 +0200 md: only delete entries from all_mddevs when the disk is freed This ensures device names don't get prematurely reused. Instead add a deleted flag to skip already deleted devices in mddev_get and other places that only want to see live mddevs. Reported-by: Logan Gunthorpe Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 16648bac862fd9c6490a465533345fbeaa6466e0 Author: Christoph Hellwig Date: Tue Jul 19 11:18:22 2022 +0200 md: stop using for_each_mddev in md_exit Just do a simple list_for_each_entry_safe on all_mddevs, and only grab a reference when we drop the lock and delete the now unused for_each_mddev macro. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit f26514342255855f4ca3c0a92cb1cdea01c33004 Author: Christoph Hellwig Date: Tue Jul 19 11:18:21 2022 +0200 md: stop using for_each_mddev in md_notify_reboot Just do a simple list_for_each_entry_safe on all_mddevs, and only grab a reference when we drop the lock. Reviewed-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit b0e706a1ba84e50eaa714486e06e1d0027411658 Author: Christoph Hellwig Date: Tue Jul 19 11:18:20 2022 +0200 md: stop using for_each_mddev in md_do_sync Just do a plain list_for_each that only grabs a mddev reference in the case where the thread sleeps and restarts the list iteration. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 2652a1bd2e749ace20339996015f3cf3fbfb8672 Author: Christoph Hellwig Date: Tue Jul 19 11:18:19 2022 +0200 md: factor out the rdev overlaps check from rdev_size_store This splits the code into nicely readable chunks and also avoids the refcount inc/dec manipulations. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 33b614e33419b456bd870cacba1b56c897244f0b Author: Christoph Hellwig Date: Tue Jul 19 11:18:18 2022 +0200 md: rename md_free to md_kobj_release The md_free name is rather misleading, so pick a better one. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit e8c59ac41974438168c89e2c881119c53934f96c Author: Christoph Hellwig Date: Tue Jul 19 11:18:17 2022 +0200 md: implement ->free_disk Ensure that all private data is only freed once all accesses are done. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit c57094a6e1ed5dd2d6401f79b8e6da34dd28f959 Author: Christoph Hellwig Date: Tue Jul 19 11:18:16 2022 +0200 md: fix error handling in md_alloc Error handling in md_alloc is a mess. Untangle it to just free the mddev directly before add_disk is called and thus the gendisk is globally visible. After that clear the hold flag and let the mddev_put take care of cleaning up the mddev through the usual mechanisms. Fixes: 5e55e2f5fc95 ("[PATCH] md: convert compile time warnings into runtime warnings") Fixes: 9be68dd7ac0e ("md: add error handling support for add_disk()") Fixes: 7ad1069166c0 ("md: properly unwind when failing to add the kobject in md_alloc") Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit ca39f7502425d437cbf83d29d99b43bd61342858 Author: Christoph Hellwig Date: Tue Jul 19 11:18:15 2022 +0200 md: fix mddev->kobj lifetime Once a kobject is initialized, the containing object should not be directly freed. So delay initialization until it is added. Also remove the kobject_del call as the last put will remove the kobject as well. The explicitly delete isn't needed here, and dropping it will simplify further fixes. With this md_free now does not need to check that ->gendisk is non-NULL as it is always set by the time that kobject_init is called on mddev->kobj. Signed-off-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Reviewed-by: Hannes Reinecke Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit ee1aa06ba3258686452dab2db2a458310a83d07a Author: Logan Gunthorpe Date: Thu Jul 7 13:15:33 2022 -0600 md/raid5: Convert prepare_to_wait() to wait_woken() api raid5_get_active_stripe() can sleep in various situations and it is called by make_stripe_request() while inside the prepare_to_wait()/finish_wait() section. Nested waits like this are not supported. This was noticed while making other changes that add different sleeps to raid5_get_active_stripe() that caused a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP. No ill effects have been noticed with the code as is, but theoretically a nested and here could cause a dead lock so it should be fixed. To fix this, convert the prepare_to_wait() call to use wake_woken() which supports nested sleeps. Link: https://lwn.net/Articles/628628/ Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit b9f91d80dec9369294a8df4e4c8850a339a32576 Author: Logan Gunthorpe Date: Thu Jul 7 13:15:32 2022 -0600 md/raid5: Fix sectors_to_do bitmap overflow in raid5_make_request() For unaligned IO that have nearly maximum sectors, the number of stripes will end up being one greater than the size of the bitmap. When this happens, the last stripe in the IO will not be processed as it should be, resulting in data corruption. However, this is not normally seen when the backing block devices have 4K physical block sizes since the block layer will split the request before that happens. To fix this increase the bitmap size by one bit and ensure the full number of stripes are checked when calling find_first_bit(). Reported-by: David Sloan Fixes: 7e55c60acfbb ("md/raid5: Pivot raid5_make_request()") Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 640c46a21f89364f04445cdd43b61eb46bd49b5d Author: Coly Li Date: Tue Jul 19 12:27:24 2022 +0800 bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' The "Asynchronous device registration (EXPERIMENTAL)" Kconfig option is for 2+ years, it is used when registration takes too much time for massive amount of cached data, to avoid udev task timeout during boot time. Many users and products enable this Kconfig option for quite long time (e.g. SUSE Linux) and it works as expected and no issue reported. It is time to remove the "EXPERIMENTAL" tag from this Kconfig item. Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20220719042724.8498-2-colyli@suse.de Signed-off-by: Jens Axboe commit bc9da6dd0630efd81b5c72ff6fa0169aa029a73f Author: Yu Kuai Date: Sat Jul 23 16:24:27 2022 +0800 nbd: add missing definition of pr_fmt commit 1243172d5894 ("nbd: use pr_err to output error message") tries to define pr_fmt and use short pr_err() to output error message, however, the definition is missed. This patch also remove existing "nbd:" inside pr_err(). Fixes: 1243172d5894 ("nbd: use pr_err to output error message") Signed-off-by: Yu Kuai Reviewed-by: Josef Bacik Link: https://lore.kernel.org/r/20220723082427.3890655-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit ee452a8d984f94fa8e894f003a52e776e4572881 Author: Dan Carpenter Date: Fri Jul 15 11:12:14 2022 +0300 null_blk: fix ida error handling in null_add_dev() There needs to be some error checking if ida_simple_get() fails. Also call ida_free() if there are errors later. Fixes: 94bc02e30fb8 ("nullb: use ida to manage index") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YtEhXsr6vJeoiYhd@kili Signed-off-by: Jens Axboe commit c13cf14f44d23102f864a0d845439aa175631854 Author: Joel Granados Date: Tue Jun 28 21:10:15 2022 +0200 nvme-multipath: refactor nvme_mpath_add_disk Pass anagrpid as second argument. This is prep patch that allows reusing this function for supporting unknown command sets. Signed-off-by: Joel Granados Signed-off-by: Kanchan Joshi Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0f89f0ece50ec12fcec70f22b3a6ea9fd2051688 Author: Guixin Liu Date: Fri Jul 8 11:06:05 2022 +0800 nvme-apple: use nvme core helper to cancel requests in tagset Use nvme core helper nvme_cancel_tagset and nvme_cancel_admin_tagset instead of same logic code. Signed-off-by: Guixin Liu Reviewed-by: Sagi Grimberg Reviewed-by: Ruozhu Li Reviewed-by: Sven Peter Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 1fcfca78129325c067b1d26f8a1fa33ecc1052c8 Author: Guixin Liu Date: Fri Jul 8 11:04:37 2022 +0800 nvme-pci: use nvme core helper to cancel requests in tagset Use nvme core helper nvme_cancel_tagset and nvme_cancel_admin_tagset instead of same logic code. Signed-off-by: Guixin Liu Reviewed-by: Sagi Grimberg Reviewed-by: Ruozhu Li Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 53ee9e29377882f268a51b1aa8b06c80e7fce7a2 Author: Caleb Sander Date: Thu Jul 7 15:12:45 2022 -0600 nvme-tcp: use in-capsule data for I/O connect Currently, command data is only sent in-capsule on the for admin or I/O commands on queues that indicate support for it. Send fabrics command data in-capsule for I/O queues as well to avoid needing a separate H2CData PDU for the connect command. This is optimization. Without this change, we send the connect command capsule and data in separate PDUs (CapsuleCmd and H2CData), and must wait for the controller to respond with an R2T PDU before sending the H2CData. With the change, we send a single CapsuleCmd PDU that includes the data. This reduces the number of bytes (and likely packets) sent across the network, and simplifies the send state machine handling in the driver. Signed-off-by: Caleb Sander Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0525af711b6676156fdffc1072c49ff1d1d5bc0f Author: Israel Rukshin Date: Sun May 15 18:04:40 2022 +0300 nvme-rdma: remove timeout for getting RDMA-CM established event In case many controllers start error recovery at the same time (i.e., when port is down and up), they may never succeed to reconnect again. This is because the target can't handle all the connect requests at three seconds (the arbitrary value set today). Even if some of the connections are established, when a single queue fails to connect, all the controller's queues are destroyed as well. So, on the following reconnection attempts the number of connect requests may remain the same. To fix this, remove the timeout and wait for RDMA-CM event to abort/complete the connect request. RDMA-CM sends unreachable event when a timeout of ~90 seconds is expired. This approach is used at other RDMA-CM users like SRP and iSER at blocking mode. The commit also renames NVME_RDMA_CONNECT_TIMEOUT_MS to NVME_RDMA_CM_TIMEOUT_MS. Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Acked-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 7012eef520cb7cb12910fb799dfd4ad0ed256b77 Author: Vincent Fu Date: Fri Jul 8 17:49:49 2022 +0000 null_blk: add configfs variables for 2 options Allow setting via configfs these two options: no_sched shared_tag_bitmap Previously these could only be activated as module parameters. Still missing are: shared_tags timeout requeue init_hctx Signed-off-by: Vincent Fu Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220708174943.87787-3-vincent.fu@samsung.com [axboe: fold in nullb == NULL fix] Signed-off-by: Jens Axboe commit 058efe000b31ce9c63bca02a33b67780b0ef5b41 Author: Vincent Fu Date: Fri Jul 8 17:49:49 2022 +0000 null_blk: add module parameters for 4 options Add as module parameters these options: memory_backed discard mbps cache_size Previously these could only be set via configfs. Still missing is bad_blocks. The kernel test robot found a documentation formatting issue in v1 of this patch. Reported-by: kernel test robot Signed-off-by: Vincent Fu Link: https://lore.kernel.org/r/20220708174943.87787-2-vincent.fu@samsung.com Signed-off-by: Jens Axboe commit ce11bdf946176d48c2c0d36b56f0bf368c177298 Author: Md Haris Iqbal Date: Thu Jul 7 16:31:22 2022 +0200 block/rnbd-srv: Replace sess_dev_list with index_idr The structure rnbd_srv_session maintains a list and an xarray of rnbd_srv_dev. There is no need to keep both as one of them can serve the purpose. Since one of the places where the lookup of rnbd_srv_dev using rnbd_srv_session is IO path, an xarray would serve us better than a list traversal. Hence remove sess_dev_list from rnbd_srv_session, and replace its uses from xarray. Signed-off-by: Md Haris Iqbal Reviewed-by: Aleksei Marov Signed-off-by: Jack Wang Link: https://lore.kernel.org/r/20220707143122.460362-3-haris.iqbal@ionos.com Signed-off-by: Jens Axboe commit 4bc14f3101364877dd59085f39e068a2a7ec9f2d Author: Md Haris Iqbal Date: Thu Jul 7 16:31:21 2022 +0200 block/rnbd-srv: Set keep_id to true after mutex_trylock After setting keep_id if the mutex trylock fails, the keep_id stays set for the rest of the sess_dev lifetime. Therefore, set keep_id to true after mutex_trylock succeeds, so that a failure of trylock does'nt touch keep_id. Fixes: b168e1d85cf3 ("block/rnbd-srv: Prevent a deadlock generated by accessing sysfs in parallel") Cc: gi-oh.kim@ionos.com Signed-off-by: Md Haris Iqbal Signed-off-by: Jack Wang Link: https://lore.kernel.org/r/20220707143122.460362-2-haris.iqbal@ionos.com Signed-off-by: Jens Axboe commit 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Author: Hannes Reinecke Date: Mon Jun 27 11:52:07 2022 +0200 nvmet-auth: expire authentication sessions Each authentication step is required to be completed within the KATO interval (or two minutes if not set). So add a workqueue function to reset the transaction ID and the expected next protocol step; this will automatically the next authentication command referring to the terminated authentication. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 7a277c37d3522e9b2777d762bbbcecafae2b1f8d Author: Hannes Reinecke Date: Mon Jun 27 11:52:06 2022 +0200 nvmet-auth: Diffie-Hellman key exchange support Implement Diffie-Hellman key exchange using FFDHE groups for NVMe In-Band Authentication. This patch adds a new host configfs attribute 'dhchap_dhgroup' to select the FFDHE group to use. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit db1312dd95488b5e6ff362ff66fcf953a46b1821 Author: Hannes Reinecke Date: Mon Jun 27 11:52:05 2022 +0200 nvmet: implement basic In-Band Authentication Implement NVMe-oF In-Band authentication according to NVMe TPAR 8006. This patch adds three additional configfs entries 'dhchap_key', 'dhchap_ctrl_key', and 'dhchap_hash' to the 'host' configfs directory. The 'dhchap_key' and 'dhchap_ctrl_key' entries need to be in the ASCII format as specified in NVMe Base Specification v2.0 section 8.13.5.8 'Secret representation'. 'dhchap_hash' defaults to 'hmac(sha256)', and can be written to to switch to a different HMAC algorithm. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 6490c9ed06de4a97a1ba89f53cd6c045d5277bc4 Author: Hannes Reinecke Date: Mon Jun 27 11:52:04 2022 +0200 nvmet: parse fabrics commands on io queues Some fabrics commands can be sent via io queues, so add a new function nvmet_parse_fabrics_io_cmd() and rename the existing nvmet_parse_fabrics_cmd() to nvmet_parse_fabrics_admin_cmd(). Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit b61775d185a395f26fecdc7898e39de677a6c3dd Author: Hannes Reinecke Date: Mon Jun 27 11:52:03 2022 +0200 nvme-auth: Diffie-Hellman key exchange support Implement Diffie-Hellman key exchange using FFDHE groups for NVMe In-Band Authentication. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit f50fff73d620cd6e8f48bc58d4f1c944615a3fea Author: Hannes Reinecke Date: Mon Jun 27 11:52:02 2022 +0200 nvme: implement In-Band authentication Implement NVMe-oF In-Band authentication according to NVMe TPAR 8006. This patch adds two new fabric options 'dhchap_secret' to specify the pre-shared key (in ASCII respresentation according to NVMe 2.0 section 8.13.5.8 'Secret representation') and 'dhchap_ctrl_secret' to specify the pre-shared controller key for bi-directional authentication of both the host and the controller. Re-authentication can be triggered by writing the PSK into the new controller sysfs attribute 'dhchap_secret' or 'dhchap_ctrl_secret'. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig [axboe: fold in clang build fix] Signed-off-by: Jens Axboe commit 3bf2fde6fcc49ccc899cd2a853888823662ccd4c Author: Hannes Reinecke Date: Mon Jun 27 11:52:01 2022 +0200 nvme-fabrics: decode 'authentication required' connect error The 'connect' command might fail with NVME_SC_AUTH_REQUIRED, so we should be decoding this error, too. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Himanshu Madhani Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 88b140fec07307f825170a45562013a80842cc93 Author: Hannes Reinecke Date: Mon Jun 27 11:52:00 2022 +0200 nvme: add definitions for NVMe In-Band authentication Add new definitions for NVMe In-band authentication as defined in the NVMe Base Specification v2.0. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Himanshu Madhani Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit a116e1cdc64a743c36c40e6fa639dec991c157a3 Author: Hannes Reinecke Date: Mon Jun 27 11:51:59 2022 +0200 lib/base64: RFC4648-compliant base64 encoding Add RFC4648-compliant base64 encoding and decoding routines, based on the base64url encoding in fs/crypto/fname.c. Signed-off-by: Hannes Reinecke Reviewed-by: Himanshu Madhani Reviewed-by: Sagi Grimberg Cc: Eric Biggers Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9e2f284e149124aa9a6b963882d2b39ae1742196 Author: Hannes Reinecke Date: Mon Jun 27 11:51:58 2022 +0200 crypto: add crypto_has_kpp() Add helper function to determine if a given key-agreement protocol primitive is supported. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Himanshu Madhani Acked-by: Herbert Xu Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 85cc424381804386d991f81e08b4933ca1f04214 Author: Hannes Reinecke Date: Mon Jun 27 11:51:57 2022 +0200 crypto: add crypto_has_shash() Add helper function to determine if a given synchronous hash is supported. Signed-off-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Reviewed-by: Himanshu Madhani Acked-by: Herbert Xu Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e41f8c0222e30aadc58b84fcb33472a1505018f3 Author: Sagi Grimberg Date: Sun Jun 26 17:06:00 2022 +0300 nvme-loop: use nvme core helpers to cancel all requests in a tagset A helper now exist, no need to open-code the same functionality. Signed-off-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit b10907b8159f6524a7393339fe5671951e00eced Author: Chaitanya Kulkarni Date: Mon Jun 6 18:16:43 2022 -0700 nvme: fix qid param blk_mq_alloc_request_hctx Only caller of the __nvme_submit_sync_cmd() with qid value not equal to NVME_QID_ANY is nvmf_connect_io_queues(), where qid value is alway set to > 0. [1] __nvme_submit_sync_cmd() callers with qid parameter from :- Caller | qid parameter ------------------------------------------------------ * nvme_fc_connect_io_queues() | nvmf_connect_io_queue() | qid > 0 * nvme_rdma_start_io_queues() | nvme_rdma_start_queue() | nvmf_connect_io_queues() | qid > 0 * nvme_tcp_start_io_queues() | nvme_tcp_start_queue() | nvmf_connect_io_queues() | qid > 0 * nvme_loop_connect_io_queues() | nvmf_connect_io_queues() | qid > 0 When qid value of the function parameter __nvme_submit_sync_cmd() is > 0 from above callers, we use blk_mq_alloc_request_hctx(), where we pass last parameter as 0 if qid functional parameter value is set to 0 with conditional operators, see 1002 :- 991 int __nvme_submit_sync_cmd(struct request_queue *q, struct nvme_command *cmd, 992 union nvme_result *result, void *buffer, unsigned bufflen, 993 int qid, int at_head, blk_mq_req_flags_t flags) 994 { 995 struct request *req; 996 int ret; 997 998 if (qid == NVME_QID_ANY) 999 req = blk_mq_alloc_request(q, nvme_req_op(cmd), flags); 1000 else 1001 req = blk_mq_alloc_request_hctx(q, nvme_req_op(cmd), flags, 1002 qid ? qid - 1 : 0); 1003 But qid function parameter value of the __nvme_submit_sync_cmd() will never be 0 from above caller list see [1], and all the other callers of __nvme_submit_sync_cmd() use NVME_QID_ANY as qid value :- 1. nvme_submit_sync_cmd() 2. nvme_features() 3. nvme_sec_submit() 4. nvmf_reg_read32() 5. nvmf_reg_read64() 6. nvmf_ref_write32() 7. nvmf_connect_admin_queue() Remove the conditional operator to pass the qid as 0 in the call to blk_mq_alloc_requst_hctx(). Signed-off-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 6b46fa024a452fdbf2dc797d30b35598d934ba33 Author: Chaitanya Kulkarni Date: Mon Jun 6 18:16:42 2022 -0700 nvme: remove unused timeout parameter The function __nvme_submit_sync_cmd() has following list of callers that sets the timeout value to 0 :- Callers | Timeout value ------------------------------------------------ nvme_submit_sync_cmd() | 0 nvme_features() | 0 nvme_sec_submit() | 0 nvmf_reg_read32() | 0 nvmf_reg_read64() | 0 nvmf_reg_write32() | 0 nvmf_connect_admin_queue() | 0 nvmf_connect_io_queue() | 0 Remove the timeout function parameter from __nvme_submit_sync_cmd() and adjust the rest of code accordingly. Signed-off-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 2c61c97fb12b806e1c8eb15f04c277ad097ec95e Author: Michael Kelley Date: Wed Jun 8 11:52:21 2022 -0700 nvme: handle the persistent internal error AER In the NVM Express Revision 1.4 spec, Figure 145 describes possible values for an AER with event type "Error" (value 000b). For a Persistent Internal Error (value 03h), the host should perform a controller reset. Add support for this error using code that already exists for doing a controller reset. As part of this support, introduce two utility functions for parsing the AER type and subtype. This new support was tested in a lab environment where we can generate the persistent internal error on demand, and observe both the Linux side and NVMe controller side to see that the controller reset has been done. Signed-off-by: Michael Kelley Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit b7df575f8aac538878c1b2b3099f6d594626dfe8 Author: Xiang wangx Date: Sat Jun 4 22:32:54 2022 +0800 nvme: remove a double word in a comment Delete the redundant word 'be'. Signed-off-by: Xiang wangx Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e507210a06282a0ebaa84e8c9b4d8ad597b24a8b Author: Guoqing Jiang Date: Wed Jul 6 21:31:52 2022 +0800 rnbd-clt: make rnbd_clt_change_capacity return void No need to checking the return value, make it return void. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-9-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit ae2dfd1d8d253d7c11bbe624f0ac997db5143147 Author: Guoqing Jiang Date: Wed Jul 6 21:31:51 2022 +0800 rnbd-clt: pass sector_t type for resize capacity Let's change the parameter type to 'sector_t' then we don't need to cast it from rnbd_clt_resize_dev_store, and update rnbd_clt_resize_disk too. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-8-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit fb516fa367a3554f3b71a0b37a52716cc358ea65 Author: Guoqing Jiang Date: Wed Jul 6 21:31:50 2022 +0800 rnbd-clt: check capacity inside rnbd_clt_change_capacity Currently, process_msg_open_rsp checks if capacity changed or not before call rnbd_clt_change_capacity while the checking also make sense for rnbd_clt_resize_dev_store, let's move the checking into the function. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-7-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit 59f070de125f568fb7ba47b6555b4013e30f28fd Author: Guoqing Jiang Date: Wed Jul 6 21:31:49 2022 +0800 rnbd-clt: adjust the layout of struct rnbd_clt_dev While at it, let re-arrange the struct to remove holes. Before, pahole reports /* size: 232, cachelines: 4, members: 17 */ /* sum members: 224, holes: 2, sum holes: 8 */ /* last cacheline: 40 bytes */ After the change, the report changes to /* size: 224, cachelines: 4, members: 17 */ /* last cacheline: 32 bytes */ Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-6-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit dfc270c908e81f586c1165acbd9bc5c6d18c3fc0 Author: Guoqing Jiang Date: Wed Jul 6 21:31:48 2022 +0800 rnbd-clt: reduce the size of struct rnbd_clt_dev Previously, both map and remap trigger rnbd_clt_set_dev_attr to set some members in rnbd_clt_dev such as wc, fua and logical_block_size etc, but those members are only useful for map scenario given the setup_request_queue is only called from the path: rnbd_clt_map_device -> rnbd_client_setup_device Since rnbd_clt_map_device frees rsp after rnbd_client_setup_device, we can pass rsp to rnbd_client_setup_device and it's callees, which means queue's attributes can be set directly from relevant members of rsp instead from rnbd_clt_dev. After that, we can kill 11 members from rnbd_clt_dev, and we don't need rnbd_clt_set_dev_attr either. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-5-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit 017d76f45e81bd1b741e16c5fed6baeb80460dff Author: Guoqing Jiang Date: Wed Jul 6 21:31:47 2022 +0800 rnbd-clt: kill read_only from struct rnbd_clt_dev The member is not needed since we can call get_disk_ro to achieve the same goal. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-4-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit 52334f4a573d8a91ebe1581bac5fa8027df59221 Author: Guoqing Jiang Date: Wed Jul 6 21:31:46 2022 +0800 rnbd-clt: don't free rsp in msg_open_conf for map scenario For map scenario, rsp is freed in two places: 1. msg_open_conf frees rsp if rtrs_clt_request returns 0. 2. Otherwise, rsp is freed by the call sites of rtrs_clt_request. Now, We'd like to control full lifecycle of rsp in rnbd_clt_map_device, with that, it is feasible to pass rsp to rnbd_client_setup_device in next commit. For 1, it is possible to free rsp from the caller of send_usr_msg because of the synchronization of iu->comp.wait. And we put iu later in rnbd_clt_map_device to ensure order of release rsp and iu. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-3-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit 9ddae3bab6d7bc769c7ca94ba010f33bc3f1aa8c Author: Guoqing Jiang Date: Wed Jul 6 21:31:45 2022 +0800 rnbd-clt: open code send_msg_open in rnbd_clt_map_device Let's open code it in rnbd_clt_map_device, then we can use information from rsp to setup gendisk and request_queue in next commits. After that, we can remove some members (wc, fua and max_hw_sectors etc) from struct rnbd_clt_dev. Acked-by: Jack Wang Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220706133152.12058-2-guoqing.jiang@linux.dev Signed-off-by: Jens Axboe commit eb25ad80364bc4351ad3f96ecbe9805e8af2d8c0 Author: Christophe JAILLET Date: Sun Jul 3 18:05:43 2022 +0200 block: null_blk: Use the bitmap API to allocate bitmaps Use bitmap_zalloc()/bitmap_free() instead of hand-writing them. It is less verbose and it improves the semantic. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/7c4d3116ba843fc4a8ae557dd6176352a6cd0985.1656864320.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jens Axboe commit 9e26728b5fa9c6ffdb3f5612279bd3b2f7ea8c3c Author: Zhang Jiaming Date: Sat Jul 2 09:54:11 2022 +0800 md: Fix spelling mistake in comments There are 2 spelling mistakes in comments. Fix it. Signed-off-by: Zhang Jiaming Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 9ad1a74ff0090fb201ee87ebb00b38c8bf25b26c Author: Logan Gunthorpe Date: Thu Jun 16 13:19:45 2022 -0600 md/raid5: Increase restriction on max segments per request The block layer defaults the maximum segments to 128, which means requests tend to get split around the 512KB depending on how many pages can be merged. There's no such restriction in the raid5 code so increase the limit to USHRT_MAX so that larger requests can be sent as one. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit df1b620a3e13b682f624c2cbf73e88d825d6d386 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:44 2022 -0600 md/raid5: Improve debug prints Add a debug print for raid5_make_request() so that each request is printed and add the logical sector number to the debug print in __add_stripe_bio(). Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 7e55c60acfbb81b8f3f323e67c2ff32bbcc84215 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:43 2022 -0600 md/raid5: Pivot raid5_make_request() raid5_make_request() loops through every page in the request, finds the appropriate stripe and adds the bio for that page in the disk. This causes a great deal of contention on the hash_lock and extra work seeing each stripe must be found once for every data disk. The number of times a stripe must be found can be reduced by pivoting raid5_make_request() so that it loops through every stripe and then loops through every disk in that stripe to see if the bio must be added. This reduces the number of times the hash lock must be taken by a factor equal to the number of data disks. To accomplish this, the logical sectors that have already been added must be tracked. Tracking them is done with a bitmap: the bits for all pages are set at the start of the request and each bit is cleared once the bio is added to a stripe. Finding the next sector to be done is then just a call to find_first_bit() so that sectors that have been done can simply be skipped. One minor downside is that the maximum sectors for a request must be limited so that the bitmap can be appropriately sized on the stack. This limit is arbitrarily chosen to be 256 stripe pages which works out to 1MB if PAGE_SIZE == DEFAULT_STRIPE_SIZE. This doesn't actually restrict the maximum request further seeing the default block queue settings are used which restricts the number of segments to 128 (which results in request sizes that are approximately 512KB). Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 486f605586075a42ff2bbc35fb0376215b2fb908 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:42 2022 -0600 md/raid5: Check all disks in a stripe_head for reshape progress When testing if a previous stripe has had reshape expand past it, use the earliest or latest logical sector in all the disks for that stripe head. This will allow adding multiple disks at a time in a subesquent patch. To do this cleaner, refactor the check into a helper function called stripe_ahead_of_reshape(). Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 4ad1d9849ffa8738b5e9b3f8bda5f17d3b31dfcd Author: Logan Gunthorpe Date: Thu Jun 16 13:19:41 2022 -0600 md/raid5: Refactor add_stripe_bio() Factor out two helper functions from add_stripe_bio(): one to check for overlap (stripe_bio_overlaps()), and one to actually add the bio to the stripe (__add_stripe_bio()). The latter function will always succeed. This will be useful in the next patch so that overlap can be checked for multiple disks before adding any Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 3312e6c887fe7539f0adb5756ab9020282aaa3d4 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:40 2022 -0600 md/raid5: Keep a reference to last stripe_head for batch When batching, every stripe head has to find the previous stripe head to add to the batch list. This involves taking the hash lock which is highly contended during IO. Instead of finding the previous stripe_head each time, store a reference to the previous stripe_head in a pointer so that it doesn't require taking the contended lock another time. The reference to the previous stripe must be released before scheduling and waiting for work to get done. Otherwise, it can hold up raid5_activate_delayed() and deadlock. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Acked-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 0a2d1694de6095dadbc99a6eb803ebab381de09e Author: Logan Gunthorpe Date: Thu Jun 16 13:19:39 2022 -0600 md/raid5: Refactor for loop in raid5_make_request() into while loop The for loop with retry label can be more cleanly expressed as a while loop by moving the logical_sector increment into the success path. No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 4f35456076e1b63630f38879efb7db623906e1e8 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:38 2022 -0600 md/raid5: Move read_seqcount_begin() into make_stripe_request() Now that prepare_to_wait() isn't in the way, move read_sequcount_begin() into make_stripe_request(). No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Reviewed-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 1cdb5b417092614851a17e14eefc42e0ed7ebd1b Author: Logan Gunthorpe Date: Thu Jun 16 13:19:37 2022 -0600 md/raid5: Drop the do_prepare flag in raid5_make_request() prepare_to_wait() can be reasonably called after schedule instead of setting a flag and preparing in the next loop iteration. This means that prepare_to_wait() will be called before read_seqcount_begin(), but there shouldn't be any reason that the order matters here. On the first iteration of the loop prepare_to_wait() is already called first. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Reviewed-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit f4aec6a0973879cb25bfecc2e918c519e3dfff04 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:36 2022 -0600 md/raid5: Factor out helper from raid5_make_request() loop Factor out the inner loop of raid5_make_request() into it's own helper called make_stripe_request(). The helper returns a number of statuses: SUCCESS, RETRY, SCHEDULE_AND_RETRY and FAIL. This makes the code a bit easier to understand and allows the SCHEDULE_AND_RETRY path to be made common. A context structure is added to contain do_flush. It will be used more in subsequent patches for state that needs to be kept outside the loop. No functional changes intended. This will be cleaned up further in subsequent patches to untangle the gen_lock and do_prepare logic further. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 1baa1126e0f6d366187f740144947b6cf619b4f2 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:35 2022 -0600 md/raid5: Move common stripe get code into new find_get_stripe() helper Both uses of find_stripe() require a fairly complicated dance to increment the reference count. Move this into a common find_get_stripe() helper. No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Acked-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 8757fef675d8c34f8b2e2d8322385d5a6b403210 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:34 2022 -0600 md/raid5: Move stripe_add_to_batch_list() call out of add_stripe_bio() stripe_add_to_batch_list() is better done in the loop in make_request instead of inside add_stripe_bio(). This is clearer and allows for storing the batch_head state outside the loop in a subsequent patch. The call to add_stripe_bio() in retry_aligned_read() is for read and batching only applies to write. So it's impossible for batching to happen at that call site. No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Reviewed-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 27fb701046c39879411ff064fb2c9ca8d02d89df Author: Logan Gunthorpe Date: Thu Jun 16 13:19:33 2022 -0600 md/raid5: Refactor raid5_make_request loop Break immediately if raid5_get_active_stripe() returns NULL and deindent the rest of the loop. Annotate this check with an unlikely(). This makes the code easier to read and reduces the indentation level. No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Reviewed-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit a8bb304ca5b8c833d4874b322a6ef993bec98780 Author: Logan Gunthorpe Date: Thu Jun 16 13:19:32 2022 -0600 md/raid5: Factor out ahead_of_reshape() function There are a few uses of an ugly ternary operator in raid5_make_request() to check if a sector is a head of a reshape sector. Factor this out into a simple helper called ahead_of_reshape(). No functional changes intended. Suggested-by: Christoph Hellwig Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 6e3f50d30af847bebce072182bd735e90a294c6a Author: Logan Gunthorpe Date: Thu Jun 16 13:19:31 2022 -0600 md/raid5: Make logic blocking check consistent with logic that blocks The check in raid5_make_request differs very slightly from the logic that causes it to block lower down. This likely does not cause a bug as the check is fuzzy anyway (as reshape may move on between the first check and the subsequent check). However, make it consistent so it can be cleaned up in a subsequent patch. The condition which causes the schedule is: !(mddev->reshape_backwards ? logical_sector < conf->reshape_progress : logical_sector >= conf->reshape_progress) && (mddev->reshape_backwards ? logical_sector < conf->reshape_safe : logical_sector >= conf->reshape_safe) The condition that causes the early bailout is made to match this. Signed-off-by: Logan Gunthorpe Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 9dfbdafda3b34e262e43e786077bab8e476a89d1 Author: Guoqing Jiang Date: Tue Jun 21 11:11:29 2022 +0800 md: unlock mddev before reap sync_thread in action_store Since the bug which commit 8b48ec23cc51a ("md: don't unregister sync_thread with reconfig_mutex held") fixed is related with action_store path, other callers which reap sync_thread didn't need to be changed. Let's pull md_unregister_thread from md_reap_sync_thread, then fix previous bug with belows. 1. unlock mddev before md_reap_sync_thread in action_store. 2. save reshape_position before unlock, then restore it to ensure position not changed accidentally by others. Signed-off-by: Guoqing Jiang Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 05ce7fb946c37fc6fc8bf14073279e570f78f69e Author: Chris Webb Date: Wed Jun 1 12:03:07 2022 +0100 md: Explicitly create command-line configured devices Boot-time assembly of arrays with md= command-line arguments breaks when CONFIG_BLOCK_LEGACY_AUTOLOAD is unset. md_setup_drive() in md-autodetect.c calls blkdev_get_by_dev(), assuming this implicitly creates the block device. Fix this by attempting to md_alloc() the array first. As in the probe path, ignore any error as failure is caught by blkdev_get_by_dev() anyway. Signed-off-by: Chris Webb Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:56 2022 -0600 md: Notify sysfs sync_completed in md_reap_sync_thread() The mdadm test 07layouts randomly produces a kernel hung task deadlock. The deadlock is caused by the suspend_lo/suspend_hi files being set by the mdadm background process during reshape and not being cleared because the process hangs. (Leaving aside the issue of the fragility of freezing kernel tasks by buggy userspace processes...) When the background mdadm process hangs it, is waiting (without a timeout) on a change to the sync_completed file signalling that the reshape has completed. The process is woken up a couple times when the reshape finishes but it is woken up before MD_RECOVERY_RUNNING is cleared so sync_completed_show() reports 0 instead of "none". To fix this, notify the sysfs file in md_reap_sync_thread() after MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes it to continue and write to suspend_lo/suspend_hi to allow IO to continue. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit b368856aab02c8fcaabb809aad401b2cf96504f2 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:55 2022 -0600 md: Ensure resync is reported after it starts The 07layouts test in mdadm fails on some systems. The failure presents itself as the backup file not being removed before the next layout is grown into: mdadm: /dev/md0: cannot create backup file /tmp/md-test-backup: File exists This is because the background mdadm process, which is responsible for cleaning up this backup file gets into an infinite loop waiting for the reshape to start. mdadm checks the mdstat file if a reshape is going and, if it is not, it waits for an event on the file or times out in 5 seconds. On faster machines, the reshape may complete before the 5 seconds times out, and thus the background mdadm process loops waiting for a reshape to start that has already occurred. mdadm reads the mdstat file to start, but mdstat does not report that the reshape has begun, even though it has indeed begun. So the mdstat_wait() call (in mdadm) which polls on the mdstat file won't ever return until timing out. The reason mdstat reports the reshape has started is due to an issue in status_resync(). recovery_active is subtracted from curr_resync which will result in a value of zero for the first chunk of reshaped data, and the resulting read will report no reshape in progress. To fix this, if "resync - recovery_active" is an overloaded value, force the value to be MD_RESYNC_ACTIVE so the code reports a resync in progress. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit eac58d08d4937d2eab8f71c663d98d0759845bde Author: Logan Gunthorpe Date: Wed Jun 8 10:27:54 2022 -0600 md: Use enum for overloaded magic numbers used by mddev->curr_resync Comments in the code document special values used for mddev->curr_resync. Make this clearer by using an enum to label these values. The only functional change is a couple places use the wrong comparison operator that implied 3 is another special value. They are all fixed to imply that 3 or greater is an active resync. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 6f28c5c3128c79f628da2aee2f8128aaa3b91f22 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:53 2022 -0600 md/raid5-cache: Annotate pslot with __rcu notation radix_tree_lookup_slot() and radix_tree_replace_slot() API expect the slot returned and looked up to be marked with __rcu. Otherwise sparse warnings are generated: drivers/md/raid5-cache.c:2939:23: warning: incorrect type in assignment (different address spaces) drivers/md/raid5-cache.c:2939:23: expected void **pslot drivers/md/raid5-cache.c:2939:23: got void [noderef] __rcu ** Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit b13015af94cf405f73ff64ce0797269554020c37 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:52 2022 -0600 md/raid5-cache: Clear conf->log after finishing work A NULL pointer dereferlence on conf->log is seen randomly with the mdadm test 21raid5cache. Kasan reporst: BUG: KASAN: null-ptr-deref in r5l_reclaimable_space+0xf5/0x140 Read of size 8 at addr 0000000000000860 by task md0_reclaim/3086 Call Trace: dump_stack_lvl+0x5a/0x74 kasan_report.cold+0x5f/0x1a9 __asan_load8+0x69/0x90 r5l_reclaimable_space+0xf5/0x140 r5l_do_reclaim+0xf4/0x5e0 r5l_reclaim_thread+0x69/0x3b0 md_thread+0x1a2/0x2c0 kthread+0x177/0x1b0 ret_from_fork+0x22/0x30 This is caused by conf->log being cleared in r5l_exit_log() before stopping the reclaim thread. To fix this, clear conf->log after the reclaim_thread is unregistered and after flushing disable_writeback_work. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 7769085c8d4d7aad4e68f2f4f2077bd46449511f Author: Logan Gunthorpe Date: Wed Jun 8 10:27:51 2022 -0600 md/raid5-cache: Drop RCU usage of conf->log The only place that uses RCU to access conf->log is in r5l_log_disk_error(). This function is mostly used in the IO path and once with mddev_lock() held in raid5_change_consistency_policy(). It is known that the IO will be suspended before the log is freed and r5l_log_exit() is called with the mddev_lock() held. This should mean that conf->log can not be freed while the function is being called, so the RCU protection is not necessary. Drop the rcu_read_lock() as well as the synchronize_rcu() and rcu_assign_pointer() usage. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 78ede6a06f011b47d3c2c9dd5699b05bc3bf2dae Author: Logan Gunthorpe Date: Wed Jun 8 10:27:50 2022 -0600 md/raid5-cache: Take mddev_lock in r5c_journal_mode_show() The mddev->lock spinlock doesn't protect against the removal of conf->log in r5l_exit_log() so conf->log may be freed before it is used. To fix this, take the mddev_lock() insteaad of the mddev->lock spinlock. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit c629f345b436997e4483aff85ec93f32faf6e4e6 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:49 2022 -0600 md/raid5: suspend the array for calls to log_exit() The raid5-cache code relies on there being no IO in flight when log_exit() is called. There are two places where this is not guaranteed so add mddev_suspend() and mddev_resume() calls to these sites. The site in raid5_change_consistency_policy() is in the error path, and another similar call site already has suspend/resume calls just below it; so it should be equally safe to make that change here. There is one remaining site in raid5_remove_disk() that we call log_exit() without suspending the array. Unfortunately, as the comment stated, we cannot call mddev_suspend from raid5d. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit e0fccdafc21fb3d47644518f29329d9c130925d5 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:48 2022 -0600 md/raid5-ppl: Drop unused argument from ppl_handle_flush_request() ppl_handle_flush_request() takes an struct r5log argument but doesn't use it. It has no buisiness taking this argument as it is only used by raid5-cache and has no way to derference it anyway. Remove the argument. No functional changes intended. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit ed0c6a5fbed17baa5e6a004e021e679207a4a033 Author: Logan Gunthorpe Date: Wed Jun 8 10:27:47 2022 -0600 md/raid5-log: Drop extern decorators for function prototypes extern is not necessary and recommended against when defining prototype functions in headers. checkpatch.pl complains about these. So remove them. Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit d9544d25e239aadd3ba7f4057574bc70a1dcdf60 Author: Song Liu Date: Wed Jun 1 16:12:37 2022 -0700 MAINTAINERS: add patchwork link to linux-raid project Add link to patchwork: https://patchwork.kernel.org/project/linux-raid/list/ Signed-off-by: Song Liu Signed-off-by: Jens Axboe commit 6675700139a0f642097c1166b2f958b2e5439c57 Author: Lars Ellenberg Date: Wed Jun 22 22:49:32 2022 +0200 drbd: bm_page_async_io: fix spurious bitmap "IO error" on large volumes We usually do all our bitmap IO in units of PAGE_SIZE. With very small or oddly sized external meta data, or with PAGE_SIZE != 4k, it can happen that our last on-disk bitmap page is not fully PAGE_SIZE aligned, so we may need to adjust the size of the IO. We used to do that with min_t(unsigned int, PAGE_SIZE, last_allowed_sector - current_offset); And for just the right diff, (unsigned int)(diff) will result in 0. A bio of length 0 will correctly be rejected with an IO error (and some scary WARN_ON_ONCE()) by the scsi layer. Do the calculation properly. Signed-off-by: Lars Ellenberg Signed-off-by: Christoph Böhmwalder Link: https://lore.kernel.org/r/20220622204932.196830-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit b3b2bec9646eb1d3f43c85f6d0d2211d6f8af42b Author: Andrew Lunn Date: Sun Jul 31 22:49:06 2022 +0200 ata: sata_mv: Fixes expected number of resources now IRQs are gone The commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") stopped IRQ resources being available as platform resources. This broke the sanity check for the expected number of resources in the Marvell SATA driver which expected two resources, the IO memory and the interrupt. Change the sanity check to only expect the IO memory. Cc: Lad Prabhakar Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core") Cc: Signed-off-by: Andrew Lunn Signed-off-by: Damien Le Moal commit 4f8861945562c507248fd000fde70d9af4d225d2 Author: Jason Wang Date: Mon Jul 25 04:11:31 2022 +0800 libceph: fix ceph_pagelist_reserve() comment typo The double `without' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit c460f4e4bba2d3f8dc0b5bfa8995d6e8d2d527a1 Author: Xiubo Li Date: Tue Jul 5 10:40:23 2022 +0800 ceph: remove useless check for the folio The netfs_write_begin() won't set the folio if the return value is non-zero. Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 7cb9994754f8a36ae9e5ec4597c5c4c2d6c03832 Author: Hu Weiwen Date: Fri Jul 1 10:52:27 2022 +0800 ceph: don't truncate file in atomic_open Clear O_TRUNC from the flags sent in the MDS create request. `atomic_open' is called before permission check. We should not do any modification to the file here. The caller will do the truncation afterward. Fixes: 124e68e74099 ("ceph: file operations") Signed-off-by: Hu Weiwen Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 0c04a117d77b258febb1a69da7c0cb651d4a38cc Author: Xiubo Li Date: Fri Jun 24 16:43:49 2022 +0800 ceph: make f_bsize always equal to f_frsize The f_frsize maybe changed in the quota size is less than the defualt 4MB. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit e027ddb6d3cce80945ab86358929460f91f5cf4f Author: Xiubo Li Date: Thu Jun 23 17:17:21 2022 +0800 ceph: flush the dirty caps immediatelly when quota is approaching When the quota is approaching we need to notify it to the MDS as soon as possible, or the client could write to the directory more than expected. This will flush the dirty caps without delaying after each write, though this couldn't prevent the real size of a directory exceed the quota but could prevent it as soon as possible. Link: https://tracker.ceph.com/issues/56180 Signed-off-by: Xiubo Li Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit 842d6b019b180f5b78d71aa445ee3c724e34d462 Author: Daichi Mukai Date: Tue Jun 14 13:22:36 2022 +0200 libceph: print fsid and epoch with osd id Print fsid and epoch in libceph log messages to distinct from which each message come. [ idryomov: don't bother with gid for now, print epoch instead ] Signed-off-by: Satoru Takeuchi Signed-off-by: Daichi Mukai Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit fc54cb8d876ae7b2d1bd0cf8a4d0b96a76318a91 Author: Li Qiong Date: Tue Jun 14 15:10:59 2022 +0800 libceph: check pointer before assigned to "c->rules[]" It should be better to check pointer firstly, then assign it to c->rules[]. Refine code a little bit. Signed-off-by: Li Qiong Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 4849077604f0126514d487836e7d87c3e53a753c Author: Xiubo Li Date: Tue Jun 7 10:13:53 2022 +0800 ceph: don't get the inline data for new creating files If the 'i_inline_version' is 1, that means the file is just new created and there shouldn't have any inline data in it, we should skip retrieving the inline data from MDS. This also could help reduce possiblity of dead lock issue introduce by the inline data and Fcr caps. Gradually we will remove the inline feature from kclient after ceph's scrub too have support to unline the inline data, currently this could help reduce the teuthology test failures. This is possiblly could also fix a bug that for some old clients if they couldn't explictly uninline the inline data when writing, the inline version will keep as 1 always. We may always reading non-exist data from inline data. Signed-off-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 0006164589ecc755cd6bbc46e466e32be20fe285 Author: Xiubo Li Date: Fri Jun 10 09:53:21 2022 +0800 ceph: update the auth cap when the async create req is forwarded For async create we will always try to choose the auth MDS of frag the dentry belonged to of the parent directory to send the request and ususally this works fine, but if the MDS migrated the directory to another MDS before it could be handled the request will be forwarded. And then the auth cap will be changed. We need to update the auth cap in this case before the request is forwarded. Link: https://tracker.ceph.com/issues/55857 Signed-off-by: Xiubo Li Signed-off-by: Ilya Dryomov commit e19feff96380e7a98ed55446ae08c3c52ce6a994 Author: Xiubo Li Date: Fri Jun 10 10:12:49 2022 +0800 ceph: make change_auth_cap_ses a global symbol Signed-off-by: Xiubo Li Signed-off-by: Ilya Dryomov commit b53aca4b460ae2ece453963ef01667ee8ee78f52 Author: Xiubo Li Date: Thu Jun 9 15:21:37 2022 +0800 ceph: fix incorrect old_size length in ceph_mds_request_args The 'old_size' is a __le64 type since birth, not sure why the kclient incorrectly switched it to __le32. This change is okay won't break anything because union will always allocate more memory than the 'open' member needed. Rename 'file_replication' to 'pool' as ceph did. Though this 'open' struct may never be used in kclient in future, it's confusing when going through the ceph code. Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 020bc44a9fbf6946f42db503d11c9811f26dd9fd Author: Jeff Layton Date: Fri Jun 10 11:40:13 2022 -0400 ceph: switch back to testing for NULL folio->private in ceph_dirty_folio Willy requested that we change this back to warning on folio->private being non-NULl. He's trying to kill off the PG_private flag, and so we'd like to catch where it's non-NULL. Add a VM_WARN_ON_FOLIO (since it doesn't exist yet) and change over to using that instead of VM_BUG_ON_FOLIO along with testing the ->private pointer. [ xiubli: define VM_WARN_ON_FOLIO macro in case DEBUG_VM is disabled reported by kernel test robot ] Cc: Matthew Wilcox Signed-off-by: Jeff Layton Signed-off-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 7467b04418d929c64cbaf75fc8d54db73e2b64df Author: Jeff Layton Date: Tue Jun 7 13:06:14 2022 -0400 ceph: call netfs_subreq_terminated with was_async == false "was_async" is a bit misleadingly named. It's supposed to indicate whether it's safe to call blocking operations from the context you're calling it from, but it sounds like it's asking whether this was done via async operation. For ceph, this it's always called from kernel thread context so it should be safe to set this to false. Cc: David Howells Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit e82145033547dac360bf20e960cf9adefc50b72d Author: Jeff Layton Date: Tue Jun 7 11:05:49 2022 -0400 ceph: convert to generic_file_llseek There's no reason we need to lock the inode for write in order to handle an llseek. I suspect this should have been dropped in 2013 when we stopped doing vmtruncate in llseek. With that gone, ceph_llseek is functionally equivalent to generic_file_llseek, so just call that after getting the size. Signed-off-by: Jeff Layton Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit 1b7587d69ea7b8c350195392bfd30a0f31374ae4 Author: Xiubo Li Date: Mon Jun 6 20:15:33 2022 +0800 ceph: fix the incorrect comment for the ceph_mds_caps struct The incorrect comment is misleading. Acutally the last members in ceph_mds_caps strcut is a union for none export and export bodies. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 58dd4385577ed7969b80cdc9e2a31575aba6c712 Author: Jeff Layton Date: Fri Jun 3 16:39:57 2022 -0400 ceph: don't leak snap_rwsem in handle_cap_grant When handle_cap_grant is called on an IMPORT op, then the snap_rwsem is held and the function is expected to release it before returning. It currently fails to do that in all cases which could lead to a deadlock. Fixes: 6f05b30ea063 ("ceph: reset i_requested_max_size if file write is not wanted") Link: https://tracker.ceph.com/issues/55857 Signed-off-by: Jeff Layton Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit d93231a6bc8a452323d5fef16cca7107ce483a27 Author: Luís Henriques Date: Fri Jun 3 14:29:09 2022 +0100 ceph: prevent a client from exceeding the MDS maximum xattr size The MDS tries to enforce a limit on the total key/values in extended attributes. However, this limit is enforced only if doing a synchronous operation (MDS_OP_SETXATTR) -- if we're buffering the xattrs, the MDS doesn't have a chance to enforce these limits. This patch adds support for decoding the xattrs maximum size setting that is distributed in the mdsmap. Then, when setting an xattr, the kernel client will revert to do a synchronous operation if that maximum size is exceeded. While there, fix a dout() that would trigger a printk warning: [ 98.718078] ------------[ cut here ]------------ [ 98.719012] precision 65536 too large [ 98.719039] WARNING: CPU: 1 PID: 3755 at lib/vsprintf.c:2703 vsnprintf+0x5e3/0x600 ... Link: https://tracker.ceph.com/issues/55725 Signed-off-by: Luís Henriques Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 8266c4d7a7469c3fd45ee2b4ebc01aac311c6c48 Author: Xiubo Li Date: Fri May 27 12:39:17 2022 +0800 ceph: choose auth MDS for getxattr with the Xs caps And for the 'Xs' caps for getxattr we will also choose the auth MDS, because the MDS side code is buggy due to setxattr won't notify the replica MDSes when the values changed and the replica MDS will return the old values. Though we will fix it in MDS code, but this still makes sense for old ceph. Link: https://tracker.ceph.com/issues/55331 Signed-off-by: Xiubo Li Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 300e42a2e79e2270a00dbf9e4ddd4b101dd75a03 Author: Xiubo Li Date: Thu May 26 13:21:31 2022 +0800 ceph: add session already open notify support If the connection was accidently closed due to the socket issue or something else the clients will try to open the opened sessions, the MDSes will send the session open reply one more time if the clients support the notify feature. When the clients retry to open the sessions the s_seq will be 0 as default, we need to update it anyway. Link: https://tracker.ceph.com/issues/53911 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 4868e537fa867f82e38e37429d61d7bb8357d79b Author: Xiubo Li Date: Tue May 10 09:47:01 2022 +0800 ceph: wait for the first reply of inflight async unlink In async unlink case the kclient won't wait for the first reply from MDS and just drop all the links and unhash the dentry and then succeeds immediately. For any new create/link/rename,etc requests followed by using the same file names we must wait for the first reply of the inflight unlink request, or the MDS possibly will fail these following requests with -EEXIST if the inflight async unlink request was delayed for some reasons. And the worst case is that for the none async openc request it will successfully open the file if the CDentry hasn't been unlinked yet, but later the previous delayed async unlink request will remove the CDenty. That means the just created file is possiblly deleted later by accident. We need to wait for the inflight async unlink requests to finish when creating new files/directories by using the same file names. Link: https://tracker.ceph.com/issues/55332 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 4f48d5da81ee7004a789c8aac2d0dfb2514c37f1 Author: Xiubo Li Date: Mon May 16 11:23:19 2022 +0800 fs/dcache: export d_same_name() helper Compare dentry name with case-exact name, return true if names are same, or false. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Reviewed-by: Luis Chamberlain Signed-off-by: Ilya Dryomov commit 7c2e3d9194f78770fdfd688d0eecfe7132f83138 Author: Xiubo Li Date: Thu May 26 14:07:21 2022 +0800 ceph: remove useless CEPHFS_FEATURES_CLIENT_REQUIRED This macro was added but never be used. And check the ceph code there has another CEPHFS_FEATURES_MDS_REQUIRED but always be empty. We should clean up all this related code, which make no sense but introducing confusion. Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Reviewed-by: Luís Henriques Signed-off-by: Ilya Dryomov commit fea013e020e6ecc7be75bea0d61697b7e916b44d Author: Luís Henriques Date: Tue May 24 17:06:27 2022 +0100 ceph: use correct index when encoding client supported features Feature bits have to be encoded into the correct locations. This hasn't been an issue so far because the only hole in the feature bits was in bit 10 (CEPHFS_FEATURE_RECLAIM_CLIENT), which is located in the 2nd byte. When adding more bits that go beyond the this 2nd byte, the bug will show up. [xiubli: remove incorrect comment for CEPHFS_FEATURES_CLIENT_SUPPORTED] Fixes: 9ba1e224538a ("ceph: allocate the correct amount of extra bytes for the session features") Signed-off-by: Luís Henriques Reviewed-by: Jeff Layton Signed-off-by: Xiubo Li Signed-off-by: Ilya Dryomov commit 637fa738b590ec0e3414931d1e07c4f195eb5215 Author: Jeff Layton Date: Tue Sep 1 12:56:42 2020 -0400 fscrypt: add fscrypt_context_for_new_inode Most filesystems just call fscrypt_set_context on new inodes, which usually causes a setxattr. That's a bit late for ceph, which can send along a full set of attributes with the create request. Doing so allows it to avoid race windows that where the new inode could be seen by other clients without the crypto context attached. It also avoids the separate round trip to the server. Refactor the fscrypt code a bit to allow us to create a new crypto context, attach it to the inode, and write it to the buffer, but without calling set_context on it. ceph can later use this to marshal the context into the attributes we send along with the create request. Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Acked-by: Eric Biggers Signed-off-by: Ilya Dryomov commit d3e94fdc4ef476ca1edd468cc11badf2dbbb3c00 Author: Jeff Layton Date: Fri Jan 8 15:34:38 2021 -0500 fscrypt: export fscrypt_fname_encrypt and fscrypt_fname_encrypted_size For ceph, we want to use our own scheme for handling filenames that are are longer than NAME_MAX after encryption and Base64 encoding. This allows us to have a consistent view of the encrypted filenames for clients that don't support fscrypt and clients that do but that don't have the key. Currently, fs/crypto only supports encrypting filenames using fscrypt_setup_filename, but that also handles encoding nokey names. Ceph can't use that because it handles nokey names in a different way. Export fscrypt_fname_encrypt. Rename fscrypt_fname_encrypted_size to __fscrypt_fname_encrypted_size and add a new wrapper called fscrypt_fname_encrypted_size that takes an inode argument rather than a pointer to a fscrypt_policy union. Signed-off-by: Jeff Layton Reviewed-by: Xiubo Li Acked-by: Eric Biggers Signed-off-by: Ilya Dryomov commit 18cc912b8a2acaf32589241fbac47192ab90db14 Author: Jeff Layton Date: Thu Mar 31 16:29:00 2022 -0400 fs: change test in inode_insert5 for adding to the sb list inode_insert5 currently looks at I_CREATING to decide whether to insert the inode into the sb list. This test is a bit ambiguous, as I_CREATING state is not directly related to that list. This test is also problematic for some upcoming ceph changes to add fscrypt support. We need to be able to allocate an inode using new_inode and insert it into the hash later iff we end up using it, and doing that now means that we double add it and corrupt the list. What we really want to know in this test is whether the inode is already in its superblock list, and then add it if it isn't. Have it test for list_empty instead and ensure that we always initialize the list by doing it in inode_init_once. It's only ever removed from the list with list_del_init, so that should be sufficient. Suggested-by: Al Viro Signed-off-by: Jeff Layton Reviewed-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Ilya Dryomov commit 569bede0cff5e98c0f862d486406b79dcada8eea Merge: 043402495deb5 8da572c52a9be Author: Linus Torvalds Date: Tue Aug 2 15:24:36 2022 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt Pull fsverity update from Eric Biggers: "Just a small documentation update to mention the btrfs support" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: fs-verity: mention btrfs support commit 043402495deb5ccc3b3479dc69a03f990c41ea8d Merge: 87fe1adb66a51 88b61b1303342 Author: Linus Torvalds Date: Tue Aug 2 15:21:18 2022 -0700 Merge tag 'integrity-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Aside from the one EVM cleanup patch, all the other changes are kexec related. On different architectures different keyrings are used to verify the kexec'ed kernel image signature. Here are a number of preparatory cleanup patches and the patches themselves for making the keyrings - builtin_trusted_keyring, .machine, .secondary_trusted_keyring, and .platform - consistent across the different architectures" * tag 'integrity-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification arm64: kexec_file: use more system keyrings to verify kernel image signature kexec, KEYS: make the code in bzImage64_verify_sig generic kexec: clean up arch_kexec_kernel_verify_sig kexec: drop weak attribute from functions kexec_file: drop weak attribute from functions evm: Use IS_ENABLED to initialize .enabled commit 87fe1adb66a514fa3abbe8bdb4278a5b2f421d8b Merge: ea7099d5229c0 64b634830c919 Author: Linus Torvalds Date: Tue Aug 2 15:12:13 2022 -0700 Merge tag 'safesetid-6.0' of https://github.com/micah-morton/linux Pull SafeSetID updates from Micah Morton: "This contains one commit that touches common kernel code, one that adds functionality internal to the SafeSetID LSM code, and a few other commits that only modify the SafeSetID LSM selftest. The commit that touches common kernel code simply adds an LSM hook in the setgroups() syscall that mirrors what is done for the existing LSM hooks in the setuid() and setgid() syscalls. This commit combined with the SafeSetID-specific one allow the LSM to filter setgroups() calls according to configured rule sets in the same way that is already done for setuid() and setgid()" * tag 'safesetid-6.0' of https://github.com/micah-morton/linux: LSM: SafeSetID: add setgroups() testing to selftest LSM: SafeSetID: Add setgroups() security policy handling security: Add LSM hook to setgroups() syscall LSM: SafeSetID: add GID testing to selftest LSM: SafeSetID: selftest cleanup and prepare for GIDs LSM: SafeSetID: fix userns bug in selftest commit ea7099d5229c0fe9f9302b03a246e15e78b87011 Merge: 1b6cf909647e6 aa16fb4b9e7e1 Author: Linus Torvalds Date: Tue Aug 2 15:05:10 2022 -0700 Merge tag 'Smack-for-6.0' of https://github.com/cschaufler/smack-next Pull msack updates from Casey Schaufler: "Two minor code clean-ups for Smack. One removes a touch of dead code and the other replaces an instance of kzalloc + strncpy with kstrndup" * tag 'Smack-for-6.0' of https://github.com/cschaufler/smack-next: smack: Remove the redundant lsm_inode_alloc smack: Replace kzalloc + strncpy with kstrndup commit 1b6cf909647e64617958e6799c6e5bae413c7d0e Merge: f42e1e3e40da0 ed56f4b5173ef Author: Linus Torvalds Date: Tue Aug 2 14:58:58 2022 -0700 Merge tag 'lsm-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull LSM update from Paul Moore: "A maintainer change for the LSM layer: James has asked me to take over the day-to-day responsibilities so a single patch to update the MAINTAINER info" * tag 'lsm-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: MAINTAINERS: update the LSM maintainer info commit f42e1e3e40da02924e29987c5b721c0932d9b380 Merge: 79802ada87fae 546093206ba16 Author: Linus Torvalds Date: Tue Aug 2 14:56:25 2022 -0700 Merge tag 'audit-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "Two minor audit patches: on marks a function as static, the other removes a redundant length check" * tag 'audit-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: make is_audit_feature_set() static audit: remove redundant data_len check commit 79802ada87faeb28cfa2bd36e17591e7b8c6ba72 Merge: 6991a564f5974 ef54ccb61616d Author: Linus Torvalds Date: Tue Aug 2 14:51:47 2022 -0700 Merge tag 'selinux-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "A relatively small set of patches for SELinux this time, eight patches in total with really only one significant change. The highlights are: - Add support for proper labeling of memfd_secret anonymous inodes. This will allow LSMs that implement the anonymous inode hooks to apply security policy to memfd_secret() fds. - Various small improvements to memory management: fixed leaks, freed memory when needed, boundary checks. - Hardened the selinux_audit_data struct with __randomize_layout. - A minor documentation tweak to fix a formatting/style issue" * tag 'selinux-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: selinux_add_opt() callers free memory selinux: Add boundary check in put_entry() selinux: fix memleak in security_read_state_kernel() docs: selinux: add '=' signs to kernel boot options mm: create security context for memfd_secret inodes selinux: fix typos in comments selinux: drop unnecessary NULL check selinux: add __randomize_layout to selinux_audit_data commit 6991a564f59742a0926be7421dff370135c44a97 Merge: d7b767b5088d5 27603a606fda0 Author: Linus Torvalds Date: Tue Aug 2 14:38:59 2022 -0700 Merge tag 'hardening-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Fix Sparse warnings with randomizd kstack (GONG, Ruiqi) - Replace uintptr_t with unsigned long in usercopy (Jason A. Donenfeld) - Fix Clang -Wforward warning in LKDTM (Justin Stitt) - Fix comment to correctly refer to STRICT_DEVMEM (Lukas Bulwahn) - Introduce dm-verity binding logic to LoadPin LSM (Matthias Kaehlcke) - Clean up warnings and overflow and KASAN tests (Kees Cook) * tag 'hardening-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: dm: verity-loadpin: Drop use of dm_table_get_num_targets() kasan: test: Silence GCC 12 warnings drivers: lkdtm: fix clang -Wformat warning x86: mm: refer to the intended config STRICT_DEVMEM in a comment dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional compilation LoadPin: Enable loading from trusted dm-verity devices dm: Add verity helpers for LoadPin stack: Declare {randomize_,}kstack_offset to fix Sparse warnings lib: overflow: Do not define 64-bit tests on 32-bit MAINTAINERS: Add a general "kernel hardening" section usercopy: use unsigned long instead of uintptr_t commit d7b767b5088d57ff9b5f9a0060c9ad0f9410b1c0 Merge: 9a8ac9ee07d44 c6e8e36c6ae4b Author: Linus Torvalds Date: Tue Aug 2 14:36:19 2022 -0700 Merge tag 'execve-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Allow unsharing time namespace on vfork+exec (Andrei Vagin) - Replace usage of deprecated kmap APIs (Fabio M. De Francesco) - Fix spelling mistake (Zhang Jiaming) * tag 'execve-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: exec: Call kmap_local_page() in copy_string_kernel() exec: Fix a spelling mistake selftests/timens: add a test for vfork+exit fs/exec: allow to unshare a time namespace on vfork+exec commit 9a8ac9ee07d445d81963756f0b18af4f06692258 Merge: ddd1949f585ef 3ce4b78f73e8e Author: Linus Torvalds Date: Tue Aug 2 14:34:03 2022 -0700 Merge tag 'seccomp-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp update from Kees Cook: - Fix Clang build warning (YiFei Zhu) * tag 'seccomp-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Fix compile warning when CC=clang commit ddd1949f585ef98138754033c9b1251ca2d32951 Merge: 8374cfe647a1f 2c09d1443b9b8 Author: Linus Torvalds Date: Tue Aug 2 14:31:46 2022 -0700 Merge tag 'pstore-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Migrate to modern acomp crypto interface (Ard Biesheuvel) - Use better return type for "rcnt" (Dan Carpenter) * tag 'pstore-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/zone: cleanup "rcnt" type pstore: migrate to crypto acomp interface commit 8374cfe647a1f360be3228b949dd6d753c55c19c Merge: c013d0af81f60 9dd1cd3220eca Author: Linus Torvalds Date: Tue Aug 2 14:21:25 2022 -0700 Merge tag 'for-6.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Refactor DM core's mempool allocation so that it clearer by not being split acorss files. - Improve DM core's BLK_STS_DM_REQUEUE and BLK_STS_AGAIN handling. - Optimize DM core's more common bio splitting by eliminating the use of bio cloning with bio_split+bio_chain. Shift that cloning cost to the relatively unlikely dm_io requeue case that only occurs during error handling. Introduces dm_io_rewind() that will clone a bio that reflects the subset of the original bio that must be requeued. - Remove DM core's dm_table_get_num_targets() wrapper and audit all dm_table_get_target() callers. - Fix potential for OOM with DM writecache target by setting a default MAX_WRITEBACK_JOBS (set to 256MiB or 1/16 of total system memory, whichever is smaller). - Fix DM writecache target's stats that are reported through DM-specific table info. - Fix use-after-free crash in dm_sm_register_threshold_callback(). - Refine DM core's Persistent Reservation handling in preparation for broader work Mike Christie is doing to add compatibility with Microsoft Windows Failover Cluster. - Fix various KASAN reported bugs in the DM raid target. - Fix DM raid target crash due to md_handle_request() bio splitting that recurses to block core without properly initializing the bio's bi_dev. - Fix some code comment typos and fix some Documentation formatting. * tag 'for-6.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits) dm: fix dm-raid crash if md_handle_request() splits bio dm raid: fix address sanitizer warning in raid_resume dm raid: fix address sanitizer warning in raid_status dm: Start pr_preempt from the same starting path dm: Fix PR release handling for non All Registrants dm: Start pr_reserve from the same starting path dm: Allow dm_call_pr to be used for path searches dm: return early from dm_pr_call() if DM device is suspended dm thin: fix use-after-free crash in dm_sm_register_threshold_callback dm writecache: count number of blocks discarded, not number of discard bios dm writecache: count number of blocks written, not number of write bios dm writecache: count number of blocks read, not number of read bios dm writecache: return void from functions dm kcopyd: use __GFP_HIGHMEM when allocating pages dm writecache: set a default MAX_WRITEBACK_JOBS Documentation: dm writecache: Render status list as list Documentation: dm writecache: add blank line before optional parameters dm snapshot: fix typo in snapshot_map() comment dm raid: remove redundant "the" in parse_raid_params() comment dm cache: fix typo in 2 comment blocks ... commit 6d499a6b3d90277dbb7e408e7c70d68b507ef383 Author: Namhyung Kim Date: Tue Aug 2 12:10:04 2022 -0700 perf lock: Print the number of lost entries for BPF Like the normal 'perf lock contention' output, it'd print the number of lost entries for BPF if exists or -v option is passed. Currently it uses BROKEN_CONTENDED stat for the lost count (due to full stack maps). $ sudo perf lock con -a -b --map-nr-entries 128 sleep 5 ... === output for debug=== bad: 43, total: 14903 bad rate: 0.29 % histogram of events caused bad sequence acquire: 0 acquired: 0 contended: 43 release: 0 Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220802191004.347740-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ceb13bfc01d55388092c00796a5b76aa3dfa483a Author: Namhyung Kim Date: Tue Aug 2 12:10:03 2022 -0700 perf lock: Add --map-nr-entries option The --map-nr-entries option is to control number of max entries in the perf lock contention BPF maps. Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220802191004.347740-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 447ec4e5fa339b30537d899447e73a103edef6d8 Author: Namhyung Kim Date: Tue Aug 2 12:10:02 2022 -0700 perf lock: Introduce struct lock_contention The lock_contention struct is to carry related fields together and to minimize the change when we add new config options. Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Song Liu Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220802191004.347740-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9017462f006c4b686cb1e1e1a3a52ea8363076e6 Merge: 1995943c3f2a5 b438b3b8d6e6e Author: Jakub Kicinski Date: Tue Aug 2 13:47:52 2022 -0700 Merge branch 'wireguard-patches-for-5-20-rc1' Jason A. Donenfeld says: ==================== wireguard patches for 5.20-rc1 I had planned to send these out eventually as net.git patches, but as you emailed earlier, I figure there's no harm in just doing this now for net-next.git. Please apply the following small fixes: 1) Rather than using msleep() in order to approximate ktime_get_coarse_ boottime_ns(), instead use an hrtimer, rounded heuristically. 2) An update in selftest config fragments, from Lukas. 3) Linus noticed that a debugging WARN_ON() to detect (impossible) stack corruption would still allow the corruption to happen, making it harder to get the report about the corruption subsequently. 4) Support for User Mode Linux in the test suite. This depends on some UML patches that are slated for 5.20. Richard hasn't sent his pull in, but they're in his tree, so I assume it'll happen. ==================== Link: https://lore.kernel.org/r/20220802125613.340848-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit b438b3b8d6e6ee1359a66c508345703888e61346 Author: Jason A. Donenfeld Date: Tue Aug 2 14:56:13 2022 +0200 wireguard: selftests: support UML This shoud open up various possibilities like time travel execution, and is also just another platform to help shake out bugs. Cc: Johannes Berg Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit c31b14d86dfe7174361e8c6e5df6c2c3a4d5918c Author: Jason A. Donenfeld Date: Tue Aug 2 14:56:12 2022 +0200 wireguard: allowedips: don't corrupt stack when detecting overflow In case push_rcu() and related functions are buggy, there's a WARN_ON(len >= 128), which the selftest tries to hit by being tricky. In case it is hit, we shouldn't corrupt the kernel's stack, though; otherwise it may be hard to even receive the report that it's buggy. So conditionalize the stack write based on that WARN_ON()'s return value. Note that this never *actually* happens anyway. The WARN_ON() in the first place is bounded by IS_ENABLED(DEBUG), and isn't expected to ever actually hit. This is just a debugging sanity check. Additionally, hoist the constant 128 into a named enum, MAX_ALLOWEDIPS_BITS, so that it's clear why this value is chosen. Suggested-by: Linus Torvalds Link: https://lore.kernel.org/all/CAHk-=wjJZGA6w_DxA+k7Ejbqsq+uGK==koPai3sqdsfJqemvag@mail.gmail.com/ Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 2a8f91d2898edf84166976112837f4996c68f706 Author: Lukas Bulwahn Date: Tue Aug 2 14:56:11 2022 +0200 wireguard: selftests: update config fragments The kernel.config and debug.config fragments in wireguard selftests mention some config symbols that have been reworked: Commit c5665868183f ("mm: kmemleak: use the memory pool for early allocations") removes the config DEBUG_KMEMLEAK_EARLY_LOG_SIZE and since then, the config's feature is available without further configuration. Commit 4675ff05de2d ("kmemcheck: rip it out") removes kmemcheck and the corresponding arch config HAVE_ARCH_KMEMCHECK. There is no need for this config. Commit 3bf195ae6037 ("netfilter: nat: merge nf_nat_ipv4,6 into nat core") removes the config NF_NAT_IPV4 and since then, the config's feature is available without further configuration. Commit 41a2901e7d22 ("rcu: Remove SPARSE_RCU_POINTER Kconfig option") removes the config SPARSE_RCU_POINTER and since then, the config's feature is enabled by default. Commit dfb4357da6dd ("time: Remove CONFIG_TIMER_STATS") removes the feature and config CONFIG_TIMER_STATS without any replacement. Commit 3ca17b1f3628 ("lib/ubsan: remove null-pointer checks") removes the check and config UBSAN_NULL without any replacement. Adjust the config fragments to those changes in configs. Signed-off-by: Lukas Bulwahn Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit 151c8e499f4705010780189377f85b57400ccbf5 Author: Jason A. Donenfeld Date: Tue Aug 2 14:56:10 2022 +0200 wireguard: ratelimiter: use hrtimer in selftest Using msleep() is problematic because it's compared against ratelimiter.c's ktime_get_coarse_boottime_ns(), which means on systems with slow jiffies (such as UML's forced HZ=100), the result is inaccurate. So switch to using schedule_hrtimeout(). However, hrtimer gives us access only to the traditional posix timers, and none of the _COARSE variants. So now, rather than being too imprecise like jiffies, it's too precise. One solution would be to give it a large "range" value, but this will still fire early on a loaded system. A better solution is to align the timeout to the actual coarse timer, and then round up to the nearest tick, plus change. So add the timeout to the current coarse time, and then schedule_hrtimer() until the absolute computed time. This should hopefully reduce flakes in CI as well. Note that we keep the retry loop in case the entire function is running behind, because the test could still be scheduled out, by either the kernel or by the hypervisor's kernel, in which case restarting the test and hoping to not be scheduled out still helps. Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Suggested-by: Thomas Gleixner Signed-off-by: Jason A. Donenfeld Signed-off-by: Jakub Kicinski commit c013d0af81f60cc7dbe357c4e2a925fb6738dbfe Merge: 42df1cbf6a472 8d9fdb6011b4d Author: Linus Torvalds Date: Tue Aug 2 13:46:35 2022 -0700 Merge tag 'for-5.20/block-2022-07-29' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: - Improve the type checking of request flags (Bart) - Ensure queue mapping for a single queues always picks the right queue (Bart) - Sanitize the io priority handling (Jan) - rq-qos race fix (Jinke) - Reserved tags handling improvements (John) - Separate memory alignment from file/disk offset aligment for O_DIRECT (Keith) - Add new ublk driver, userspace block driver using io_uring for communication with the userspace backend (Ming) - Use try_cmpxchg() to cleanup the code in various spots (Uros) - Finally remove bdevname() (Christoph) - Clean up the zoned device handling (Christoph) - Clean up independent access range support (Christoph) - Clean up and improve block sysfs handling (Christoph) - Clean up and improve teardown of block devices. This turns the usual two step process into something that is simpler to implement and handle in block drivers (Christoph) - Clean up chunk size handling (Christoph) - Misc cleanups and fixes (Bart, Bo, Dan, GuoYong, Jason, Keith, Liu, Ming, Sebastian, Yang, Ying) * tag 'for-5.20/block-2022-07-29' of git://git.kernel.dk/linux-block: (178 commits) ublk_drv: fix double shift bug ublk_drv: make sure that correct flags(features) returned to userspace ublk_drv: fix error handling of ublk_add_dev ublk_drv: fix lockdep warning block: remove __blk_get_queue block: call blk_mq_exit_queue from disk_release for never added disks blk-mq: fix error handling in __blk_mq_alloc_disk ublk: defer disk allocation ublk: rewrite ublk_ctrl_get_queue_affinity to not rely on hctx->cpumask ublk: fold __ublk_create_dev into ublk_ctrl_add_dev ublk: cleanup ublk_ctrl_uring_cmd ublk: simplify ublk_ch_open and ublk_ch_release ublk: remove the empty open and release block device operations ublk: remove UBLK_IO_F_PREFLUSH ublk: add a MAINTAINERS entry block: don't allow the same type rq_qos add more than once mmc: fix disk/queue leak in case of adding disk failure ublk_drv: fix an IS_ERR() vs NULL check ublk: remove UBLK_IO_F_INTEGRITY ublk_drv: remove unneeded semicolon ... commit 42df1cbf6a4726934cc5dac12bf263aa73c49fa3 Merge: 98e247464088a 14b146b688ad9 Author: Linus Torvalds Date: Tue Aug 2 13:37:55 2022 -0700 Merge tag 'for-5.20/io_uring-zerocopy-send-2022-07-29' of git://git.kernel.dk/linux-block Pull io_uring zerocopy support from Jens Axboe: "This adds support for efficient support for zerocopy sends through io_uring. Both ipv4 and ipv6 is supported, as well as both TCP and UDP. The core network changes to support this is in a stable branch from Jakub that both io_uring and net-next has pulled in, and the io_uring changes are layered on top of that. All of the work has been done by Pavel" * tag 'for-5.20/io_uring-zerocopy-send-2022-07-29' of git://git.kernel.dk/linux-block: (34 commits) io_uring: notification completion optimisation io_uring: export req alloc from core io_uring/net: use unsigned for flags io_uring/net: make page accounting more consistent io_uring/net: checks errors of zc mem accounting io_uring/net: improve io_get_notif_slot types selftests/io_uring: test zerocopy send io_uring: enable managed frags with register buffers io_uring: add zc notification flush requests io_uring: rename IORING_OP_FILES_UPDATE io_uring: flush notifiers after sendzc io_uring: sendzc with fixed buffers io_uring: allow to pass addr into sendzc io_uring: account locked pages for non-fixed zc io_uring: wire send zc request type io_uring: add notification slot registration io_uring: add rsrc referencing for notifiers io_uring: complete notifiers in tw io_uring: cache struct io_notif io_uring: add zc notification infrastructure ... commit 98e247464088a11ce2328a214fdb87d4c06f8db6 Merge: b349b1181d24a 0dd316ba8692c Author: Linus Torvalds Date: Tue Aug 2 13:27:23 2022 -0700 Merge tag 'for-5.20/io_uring-buffered-writes-2022-07-29' of git://git.kernel.dk/linux-block Pull io_uring buffered writes support from Jens Axboe: "This contains support for buffered writes, specifically for XFS. btrfs is in progress, will be coming in the next release. io_uring does support buffered writes on any file type, but since the buffered write path just always -EAGAIN (or -EOPNOTSUPP) any attempt to do so if IOCB_NOWAIT is set, any buffered write will effectively be handled by io-wq offload. This isn't very efficient, and we even have specific code in io-wq to serialize buffered writes to the same inode to avoid further inefficiencies with thread offload. This is particularly sad since most buffered writes don't block, they simply copy data to a page and dirty it. With this pull request, we can handle buffered writes a lot more effiently. If balance_dirty_pages() needs to block, we back off on writes as indicated. This improves buffered write support by 2-3x. Jan Kara helped with the mm bits for this, and Stefan handled the fs/iomap/xfs/io_uring parts of it" * tag 'for-5.20/io_uring-buffered-writes-2022-07-29' of git://git.kernel.dk/linux-block: mm: honor FGP_NOWAIT for page cache page allocation xfs: Add async buffered write support xfs: Specify lockmode when calling xfs_ilock_for_iomap() io_uring: Add tracepoint for short writes io_uring: fix issue with io_write() not always undoing sb_start_write() io_uring: Add support for async buffered writes fs: Add async write file modification handling. fs: Split off inode_needs_update_time and __file_update_time fs: add __remove_file_privs() with flags parameter fs: add a FMODE_BUF_WASYNC flags for f_mode iomap: Return -EAGAIN from iomap_write_iter() iomap: Add async buffered write support iomap: Add flags parameter to iomap_page_create() mm: Add balance_dirty_pages_ratelimited_flags() function mm: Move updates of dirty_exceeded into one place mm: Move starting of background writeback into the main balancing loop commit b349b1181d24af1c151134a3c39725e94a5619dd Merge: efb2883060afc f6b543fd03d34 Author: Linus Torvalds Date: Tue Aug 2 13:20:44 2022 -0700 Merge tag 'for-5.20/io_uring-2022-07-29' of git://git.kernel.dk/linux-block Pull io_uring updates from Jens Axboe: - As per (valid) complaint in the last merge window, fs/io_uring.c has grown quite large these days. io_uring isn't really tied to fs either, as it supports a wide variety of functionality outside of that. Move the code to io_uring/ and split it into files that either implement a specific request type, and split some code into helpers as well. The code is organized a lot better like this, and io_uring.c is now < 4K LOC (me). - Deprecate the epoll_ctl opcode. It'll still work, just trigger a warning once if used. If we don't get any complaints on this, and I don't expect any, then we can fully remove it in a future release (me). - Improve the cancel hash locking (Hao) - kbuf cleanups (Hao) - Efficiency improvements to the task_work handling (Dylan, Pavel) - Provided buffer improvements (Dylan) - Add support for recv/recvmsg multishot support. This is similar to the accept (or poll) support for have for multishot, where a single SQE can trigger everytime data is received. For applications that expect to do more than a few receives on an instantiated socket, this greatly improves efficiency (Dylan). - Efficiency improvements for poll handling (Pavel) - Poll cancelation improvements (Pavel) - Allow specifiying a range for direct descriptor allocations (Pavel) - Cleanup the cqe32 handling (Pavel) - Move io_uring types to greatly cleanup the tracing (Pavel) - Tons of great code cleanups and improvements (Pavel) - Add a way to do sync cancelations rather than through the sqe -> cqe interface, as that's a lot easier to use for some use cases (me). - Add support to IORING_OP_MSG_RING for sending direct descriptors to a different ring. This avoids the usually problematic SCM case, as we disallow those. (me) - Make the per-command alloc cache we use for apoll generic, place limits on it, and use it for netmsg as well (me). - Various cleanups (me, Michal, Gustavo, Uros) * tag 'for-5.20/io_uring-2022-07-29' of git://git.kernel.dk/linux-block: (172 commits) io_uring: ensure REQ_F_ISREG is set async offload net: fix compat pointer in get_compat_msghdr() io_uring: Don't require reinitable percpu_ref io_uring: fix types in io_recvmsg_multishot_overflow io_uring: Use atomic_long_try_cmpxchg in __io_account_mem io_uring: support multishot in recvmsg net: copy from user before calling __get_compat_msghdr net: copy from user before calling __copy_msghdr io_uring: support 0 length iov in buffer select in compat io_uring: fix multishot ending when not polled io_uring: add netmsg cache io_uring: impose max limit on apoll cache io_uring: add abstraction around apoll cache io_uring: move apoll cache to poll.c io_uring: consolidate hash_locked io-wq handling io_uring: clear REQ_F_HASH_LOCKED on hash removal io_uring: don't race double poll setting REQ_F_ASYNC_DATA io_uring: don't miss setting REQ_F_DOUBLE_POLL io_uring: disable multishot recvmsg io_uring: only trace one of complete or overflow ... commit 1a607e102fe0f04491fb69c5a233aad139d9d1d6 Author: Konrad Dybcio Date: Sat Jul 16 21:32:56 2022 +0200 dt-bindings: mailbox: qcom-ipcc: Add SM6375 compatible Add a compatible for SM6375. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 82ab513baed5895c8b0e991557a12fd38d5f25f0 Author: Peng Fan Date: Wed Jun 15 21:00:09 2022 +0800 mailbox: imx: support RST channel i.MX generic MU supports MU-A/B reset feature. When stop/start remotecore, MU is not reset. So when Linux stop remotecore, the MU-B side BCR may contain valid configuration, because MU-B is not reset. So when linux start Mcore again and notify Mcore, Mcore is not ready to handle MU interrupt and cause issues. So need reset MU when stop Mcore. Signed-off-by: Peng Fan Signed-off-by: Jassi Brar commit 095730dd4ca5fe078fd07db5be68b3026d4ae48a Author: Peng Fan Date: Wed Jun 15 21:00:08 2022 +0800 dt-bindings: mailbox: imx-mu: add RST channel i.MX MU has a MUR bit which is to reset both the Processor B and the Processor A sides of the MU module, forcing all control and status registers to return to their default values (except the BHR bit in the ACR register and BHRM bit in BCR register), and all internal states to be cleared. Signed-off-by: Peng Fan Reviewed-by: Rob Herring Signed-off-by: Jassi Brar commit 60545466180e791827c84795e7b4828dbeb9e061 Author: Bryan O'Donoghue Date: Mon Jul 18 12:55:38 2022 +0100 dt-bindings: mailbox: qcom,apcs-kpss-global: Add syscon const for relevant entries msm8916, msm8939, msm8953, msm8994 and qcs404 already declare or should declare syscon as they have drivers that use syscon inside of the apcs-kpss block. grep apcs arch/arm64/boot/dts/qcom/* | grep syscon Add in the additional syscon in the documentation for the above mentioned parts. Reviewed-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Signed-off-by: Jassi Brar commit a41a2e2e34a907bd8979a53c58f44287630616e8 Author: Josh Poimboeuf Date: Thu Jul 21 11:01:24 2022 -0700 scripts/faddr2line: Add CONFIG_DEBUG_INFO check Otherwise without DWARF it spits out gibberish and gives no indication of what the problem is. Suggested-by: John Garry Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Tested-by: John Garry Link: https://lore.kernel.org/r/ffa7734c929445caa374bf9e68078300174f09b4.1658426357.git.jpoimboe@kernel.org commit b6a5068854cfe372da7dee3224dcf023ed5b00cb Author: Josh Poimboeuf Date: Thu Jul 21 11:01:23 2022 -0700 scripts/faddr2line: Fix vmlinux detection on arm64 Since commit dcea997beed6 ("faddr2line: Fix overlapping text section failures, the sequel"), faddr2line is completely broken on arm64. For some reason, on arm64, the vmlinux ELF object file type is ET_DYN rather than ET_EXEC. Check for both when determining whether the object is vmlinux. Modules and vmlinux.o have type ET_REL on all arches. Fixes: dcea997beed6 ("faddr2line: Fix overlapping text section failures, the sequel") Reported-by: John Garry Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Tested-by: John Garry Link: https://lore.kernel.org/r/dad1999737471b06d6188ce4cdb11329aa41682c.1658426357.git.jpoimboe@kernel.org commit d9c26e0a58b0039d1ad4340d826fe8db866e9455 Author: Chun-Kuang Hu Date: Wed Jun 8 22:40:55 2022 +0800 mailbox: mtk-cmdq: Remove proprietary cmdq_task_cb rx_callback is a standard mailbox callback mechanism and could cover the function of proprietary cmdq_task_cb, so use the standard one instead of the proprietary one. Client driver has changed to use standard rx_callback, so remove proprietary cmdq_task_cb. Signed-off-by: Chun-Kuang Hu Reviewed-by: Matthias Brugger Signed-off-by: Jassi Brar commit 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac Author: Trond Myklebust Date: Tue Aug 2 15:48:50 2022 -0400 NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call. Fixes: 6949493884fe ("NFSv4: Don't hold the layoutget locks across multiple RPC calls") Signed-off-by: Trond Myklebust commit b1a28f2eb9ea7a5a1763fe53fe699aa0feae4231 Author: Trond Myklebust Date: Mon Aug 1 14:16:51 2022 -0400 NFS: nfs_async_write_reschedule_io must not recurse into the writeback code It is not safe to call filemap_fdatawrite_range() from nfs_async_write_reschedule_io(), since we're often calling from a page reclaim context. Just let fsync() redrive the writeback for us. Signed-off-by: Trond Myklebust commit 09794a5a6c348f629b35fc1687071a1622ef4265 Author: Steven Rostedt (Google) Date: Tue Aug 2 15:44:12 2022 -0400 tracing: Use alignof__(struct {type b;}) instead of offsetof() Simplify: #define ALIGN_STRUCTFIELD(type) ((int)(offsetof(struct {char a; type b;}, b))) with #define ALIGN_STRUCTFIELD(type) __alignof__(struct {type b;}) Which works just the same. Link: https://lore.kernel.org/all/a7d202457150472588df0bd3b7334b3f@AcuMS.aculab.com/ Link: https://lkml.kernel.org/r/20220802154412.513c50e3@gandalf.local.home Suggested-by: David Laight Signed-off-by: Steven Rostedt (Google) commit efb2883060afc79638bb1eb19e2c30e7f6c5a178 Merge: c1dbe9a1c86da 3afe697b74bc6 Author: Linus Torvalds Date: Tue Aug 2 12:47:31 2022 -0700 Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: "Only updating the turbostat tool here, no kernel changes" * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: version 2022.07.28 tools/power turbostat: do not decode ACC for ICX and SPR tools/power turbostat: fix SPR PC6 limits tools/power turbostat: cleanup 'automatic_cstate_conversion_probe()' tools/power turbostat: separate SPR from ICX tools/power turbosstat: fix comment tools/power turbostat: Support RAPTORLAKE P tools/power turbostat: add support for ALDERLAKE_N tools/power turbostat: dump secondary Turbo-Ratio-Limit tools/power turbostat: simplify dump_turbo_ratio_limits() tools/power turbostat: dump CPUID.7.EDX.Hybrid tools/power turbostat: update turbostat.8 tools/power turbostat: Show uncore frequency tools/power turbostat: Fix file pointer leak tools/power turbostat: replace strncmp with single character compare tools/power turbostat: print the kernel boot commandline tools/power turbostat: Introduce support for RaptorLake commit 4ee3c4da8b1b9c225bd156a7909980e32f3b3153 Author: Arnaldo Carvalho de Melo Date: Tue Aug 2 15:40:20 2022 -0300 perf scripting python: Do not build fail on deprecation warnings First noticed with fedora:rawhide: 48 11.10 fedora:rawhide : FAIL gcc version 12.1.1 20220628 (Red Hat 12.1.1-3) (GCC) util/scripting-engines/trace-event-python.c: In function 'python_start_script': util/scripting-engines/trace-event-python.c:1899:9: error: 'PySys_SetArgv' is deprecated [-Werror=deprecated-declarations] 1899 | PySys_SetArgv(argc + 1, command_line); No time now to address this warning, so don't make it an error, in time we should either add yet more ifdefs to continue supporting older systems or just convert to whatever new infra python put in place for argv processing, sigh. Acked-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 91cea6be90e436c55cde8770a15e4dac9d3032d0 Author: Arnaldo Carvalho de Melo Date: Tue Aug 2 15:13:22 2022 -0300 genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO When genelf was introduced it tested for HAVE_LIBCRYPTO not HAVE_LIBCRYPTO_SUPPORT, which is the define the feature test for openssl defines, fix it. This also adds disables the deprecation warning, someone has to fix this to build with openssl 3.0 before the warning becomes a hard error. Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support") Reported-by: 谭梓煊 Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Nick Terrell Cc: Song Liu Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/YulpPqXSOG0Q4J1o@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 10fef869a58e37ec649b61eddab545f2da57a79b Author: Zixuan Tan Date: Sat Jun 25 23:34:38 2022 +0800 perf build: Suppress openssl v3 deprecation warnings in libcrypto feature test With OpenSSL v3 installed, the libcrypto feature check fails as it use the deprecated MD5_* API (and is compiled with -Werror). The error message is as follows. $ make tools/perf ``` Makefile.config:778: No libcrypto.h found, disables jitted code injection, please install openssl-devel or libssl-dev Auto-detecting system features: ... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... libbfd: [ on ] ... libbfd-buildid: [ on ] ... libcap: [ on ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libperl: [ on ] ... libpython: [ on ] ... libcrypto: [ OFF ] ... libunwind: [ on ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... get_cpuid: [ on ] ... bpf: [ on ] ... libaio: [ on ] ... libzstd: [ on ] ... disassembler-four-args: [ on ] ``` This is very confusing because the suggested library (on my Ubuntu 20.04 it is libssl-dev) is already installed. As the test only checks for the presence of libcrypto, this commit suppresses the deprecation warning to allow the test to pass. Signed-off-by: Zixuan Tan Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Nick Terrell Cc: Song Liu Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220625153439.513559-1-tanzixuan.me@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit 9b7c7728f4e4ba8dd75269fb111fa187faa018c6 Author: Ian Rogers Date: Fri Jul 29 13:42:17 2022 -0700 perf parse-events: Break out tracepoint and printing Move print_*_events functions out of parse-events.c into a new print-events.c. Move tracepoint code into tracepoint.c or trace-event-info.c (sole user). This reduces the dependencies of parse-events.c and makes it more amenable to being a library in the future. Remove some unnecessary definitions from parse-events.h. Fix a checkpatch.pl warning on using unsigned rather than unsigned int. Fix some line length warnings too. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220729204217.250166-3-irogers@google.com [ Add include linux/stddef.h before perf_events.h for systems where __always_inline isn't pulled in before used, such as older Alpine Linux ] Signed-off-by: Arnaldo Carvalho de Melo commit a60885b6a97b5dc9340dd9310a57b5682c2daf2d Merge: db244339fa60b 0cb1fc0988e32 Author: Jiri Kosina Date: Tue Aug 2 21:25:14 2022 +0200 Merge branch 'for-5.20/uclogic' into for-linus - XP-PEN Deco L support (José Expósito) commit db244339fa60b6cda6a2a32adb85be7e08de167e Merge: 86f6710dae396 842fec058171d Author: Jiri Kosina Date: Tue Aug 2 21:24:28 2022 +0200 Merge branch 'for-5.20/nintendo' into for-linus commit 86f6710dae39614754d8d97774a082c5abfeff80 Merge: ebf95514ec7a4 bd3cba00dcc63 Author: Jiri Kosina Date: Tue Aug 2 21:23:42 2022 +0200 Merge branch 'for-5.20/elan' into for-linus - support for Elan eKTH6915 touchscreens (Douglas Anderson) commit ebf95514ec7a4df4bbde06fd0e8b820307ab03e4 Merge: 144c71f7c816c 4df4b0fe960c9 Author: Jiri Kosina Date: Tue Aug 2 21:23:11 2022 +0200 Merge branch 'for-5.20/core' into for-linus commit 2f63e5d2e391837c70741311b5b70d2fbd15d138 Author: Masami Hiramatsu (Google) Date: Mon Aug 1 11:32:15 2022 +0900 tracing/eprobe: Show syntax error logs in error_log file Show the syntax errors for event probes in error_log file as same as other dynamic events, so that user can understand what is the problem. Link: https://lkml.kernel.org/r/165932113556.2850673.3483079297896607612.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 144c71f7c816ceb804167ed28a76bf09d70a8939 Merge: c556717541c0c 20afcc462579c Author: Jiri Kosina Date: Tue Aug 2 21:22:44 2022 +0200 Merge branch 'for-5.20/apple' into for-linus commit c556717541c0c34bff887db92057964f0ff74582 Merge: 1117d182c5d72 5d4d0f1565753 Author: Jiri Kosina Date: Tue Aug 2 21:21:46 2022 +0200 Merge branch 'for-5.20/amd-sfh' into for-linus - support for AMD SOCs using SFH1.1 memory access (Basavaraj Natikar) commit 08fc500fe3d4b1f0603fb97ad353f246a3d52d2d Merge: dfcbbd73ddb17 432b09665b5ad Author: Stephen Boyd Date: Tue Aug 2 12:20:51 2022 -0700 Merge branch 'clk-allwinner' into clk-next * clk-allwinner: clk: sunxi-ng: sun50i: h6: Modify GPU clock configuration to support DFS clk: sunxi: Do not select the PRCM MFD clk: sunxi: Limit legacy clocks to 32-bit ARM clk: sunxi-ng: Deduplicate ccu_clks arrays commit dfcbbd73ddb17a974365d474ffbfd6e8a007a994 Merge: f04ed3d9f8a54 8ba69fd242666 8c18fece15f64 f04f2870e549a 4c2fdfc4c8049 Author: Stephen Boyd Date: Tue Aug 2 12:20:33 2022 -0700 Merge branches 'clk-renesas', 'clk-spreadtrum', 'clk-imx' and 'clk-qcom' into clk-next * clk-renesas: (22 commits) clk: renesas: rcar-gen4: Fix initconst confusion for cpg_pll_config clk: renesas: r9a07g043: Add support for RZ/Five SoC dt-bindings: clock: r9a07g043-cpg: Add Renesas RZ/Five CPG Clock and Reset Definitions clk: renesas: r8a779f0: Add HSCIF clocks clk: renesas: r8a779f0: Add PCIe clocks clk: renesas: r8a779f0: Add Z0 and Z1 clock support dt-bindings: clock: renesas,rzg2l: Simplify header file references clk: renesas: rza1: Remove struct rz_cpg clk: renesas: r8a7779: Remove struct r8a7779_cpg clk: renesas: r8a7778: Remove struct r8a7778_cpg clk: renesas: sh73a0: Remove sh73a0_cpg.reg clk: renesas: r8a7740: Remove r8a7740_cpg.reg clk: renesas: r8a73a4: Remove r8a73a4_cpg.reg clk: renesas: r8a779f0: Add SDHI0 clock clk: renesas: r8a779f0: Add thermal clock clk: renesas: rzg2l: Fix reset status function clk: renesas: r9a06g032: Fix UART clkgrp bitsel clk: renesas: r9a06g032: Drop some unused fields clk: renesas: r9a09g011: Add WDT clock and reset entries clk: renesas: r9a09g011: Add PFC clock and reset entries ... * clk-spreadtrum: clk: sprd: Add dt-bindings include file for UMS512 dt-bindings: clk: sprd: Add bindings for ums512 clock controller * clk-imx: clk: imx: clk-fracn-gppll: Add more freq config for video pll clk: imx: clk-fracn-gppll: correct rdiv clk: imx: clk-fracn-gppll: Return rate in rate table properly in ->recalc_rate() clk: imx: clk-fracn-gppll: fix mfd value clk: imx93: Correct the edma1's parent clock clk: imx93: correct nic_media parent clk: imx93: use adc_root as the parent clock of adc1 * clk-qcom: (62 commits) clk: qcom: gcc-msm8994: use parent_hws for gpll0/4 clk: qcom: clk-rpm: convert to parent_data API dt-bindings: clock: fix wrong clock documentation for qcom,rpmcc clk: qcom: gcc-msm8939: Add missing USB HS system clock frequencies clk: qcom: gcc-msm8939: Add missing MDSS MDP clock frequencies clk: qcom: gcc-msm8939: Add missing CAMSS CPP clock frequencies clk: qcom: gcc-msm8939: Fix venus0_vcodec0_clk frequency definitions clk: qcom: gcc-msm8939: Add missing CAMSS CCI bus clock clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled clk: qcom: Drop mmcx gdsc supply for dispcc and videocc clk: qcom: fix build error initializer element is not constant dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources clk: qcom: add support for SM8350 DISPCC clk: qcom: add support for SM8350 GPUCC clk: qcom: add camera clock controller driver for SM8450 SoC clk: qcom: clk-alpha-pll: add Rivian EVO PLL configuration interfaces clk: qcom: clk-alpha-pll: add Lucid EVO PLL configuration interfaces clk: qcom: clk-alpha-pll: limit exported symbols to GPL licensed code clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description ... commit f04ed3d9f8a5449736081c2c9906569aa8399c9b Merge: 3d7cb6b04c3f3 6ebd5247ad2aa 3b3ec201f381d 62c0aff64c8d6 255584b138343 Author: Stephen Boyd Date: Tue Aug 2 12:19:18 2022 -0700 Merge branches 'clk-basic', 'clk-mtk', 'clk-devm-enable' and 'clk-ti-dt' into clk-next - Remove allwinner workaround logic/compatible in fixed factor code - MediaTek clk driver cleanups - Add reset support to more MediaTek clk drivers - devm helpers for clk_get() + clk_prepare() and clk_enable() * clk-basic: clk: fixed-factor: Introduce *clk_hw_register_fixed_factor_parent_hw() clk: mux: Introduce devm_clk_hw_register_mux_parent_hws() clk: divider: Introduce devm_clk_hw_register_divider_parent_hw() dt-bindings: clock: fixed-factor: Drop Allwinner A10 compatible clk: fixed: Remove Allwinner A10 special-case logic * clk-mtk: clk: mediatek: reset: Add infra_ao reset support for MT8186 dt-bindings: arm: mediatek: Add #reset-cells property for MT8186 dt-bindings: reset: mediatek: Add infra_ao reset index for MT8186 clk: mediatek: reset: Add infra_ao reset support for MT8192/MT8195 dt-bindings: reset: mediatek: Add infra_ao reset index for MT8192/MT8195 dt-bindings: arm: mediatek: Add #reset-cells property for MT8192/MT8195 clk: mediatek: reset: Add reset support for simple probe clk: mediatek: reset: Add new register reset function with device clk: mediatek: reset: Change return type for clock reset register function clk: mediatek: reset: Support inuput argument index mode clk: mediatek: reset: Support nonsequence base offsets of reset registers clk: mediatek: reset: Revise structure to control reset register clk: mediatek: reset: Merge and revise reset register function clk: mediatek: reset: Extract common drivers to update function clk: mediatek: reset: Refine and reorder functions in reset.c clk: mediatek: reset: Fix written reset bit offset clk: mediatek: reset: Add reset.h clk: mediatek: Delete MT8192 msdc gate dt-bindings: ARM: Mediatek: Remove msdc binding of MT8192 clock * clk-devm-enable: clk: Remove never used devm_clk_*unregister() clk: Fix pointer casting to prevent oops in devm_clk_release() clk: meson: axg-audio: Don't duplicate devm_clk_get_enabled() clk: Provide new devm_clk helpers for prepared and enabled clocks clk: generalize devm_clk_get() a bit clk: Improve documentation for devm_clk_get() and its optional variant * clk-ti-dt: clk: ti: Stop using legacy clkctrl names for omap4 and 5 commit 95522f0b18a059afa5aca036aa454c98beb553b5 Author: Slark Xiao Date: Fri Jul 22 18:29:07 2022 +0800 scripts/tracing: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Link: https://lkml.kernel.org/r/20220722102907.81949-1-slark_xiao@163.com Signed-off-by: Slark Xiao Signed-off-by: Steven Rostedt (Google) commit 170ab26b01d7f445c46261eff69341dab7e50a24 Author: Li zeming Date: Thu Jul 21 16:19:04 2022 +0800 tracepoints: It is CONFIG_TRACEPOINTS not CONFIG_TRACEPOINT When reading this note, CONFIG_TRACEPOINT searches my configuration file, and the result is CONFIG_TRACEPOINTS, the search results are consistent with the following macro definitions. I think it should be repaired. Link: https://lkml.kernel.org/r/20220721081904.3798-1-zeming@nfschina.com Signed-off-by: Li zeming Signed-off-by: Steven Rostedt (Google) commit 59927cbe3f30c5ed7fc5d33487ef06611394a548 Author: Zhiqiang Liu Date: Wed Jul 20 10:46:48 2022 +0800 tracing: Use free_trace_buffer() in allocate_trace_buffers() In allocate_trace_buffers(), if allocating tr->max_buffer fails, we can directly call free_trace_buffer to free tr->array_buffer. Link: https://lkml.kernel.org/r/65f0702d-07f6-08de-2a07-4c50af56a67b@huawei.com Signed-off-by: Zhiqiang Liu Signed-off-by: Steven Rostedt (Google) commit c1dbe9a1c86da098a29dcdca1a67b65e2de7ec3a Merge: a771ea6413c00 da9d01794e317 Author: Linus Torvalds Date: Tue Aug 2 11:27:53 2022 -0700 Merge tag 'thermal-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These start a rework of the handling of trip points in the thermal core, improve the cpufreq/devfreq cooling device handling, update some thermal control drivers and the tmon utility and clean up code. Specifics: - Consolidate the thermal core code by beginning to move the thermal trip structure from the thermal OF code as a generic structure to be used by the different sensors when registering a thermal zone (Daniel Lezcano). - Make per cpufreq / devfreq cooling device ops instead of using a global variable, fix comments and rework the trace information (Lukasz Luba). - Add the include/dt-bindings/thermal.h under the area covered by the thermal maintainer in the MAINTAINERS file (Lukas Bulwahn). - Improve the error output by giving the sensor identification when a thermal zone failed to initialize, the DT bindings by changing the positive logic and adding the r8a779f0 support on the rcar3 (Wolfram Sang). - Convert the QCom tsens DT binding to the dtsformat format (Krzysztof Kozlowski). - Remove the pointless get_trend() function in the QCom, Ux500 and tegra thermal drivers, along with the unused DROP_FULL and RAISE_FULL trends definitions. Simplify the code by using clamp() macros (Daniel Lezcano). - Fix ref_table memory leak at probe time on the k3_j72xx bandgap (Bryan Brattlof). - Fix array underflow in prep_lookup_table (Dan Carpenter). - Add static annotation to the k3_j72xx_bandgap_j7* data structure (Jin Xiaoyun). - Fix typos in comments detected on sun8i by Coccinelle (Julia Lawall). - Fix typos in comments on rzg2l (Biju Das). - Remove as unnecessary call to dev_err() as the error is already printed by the failing function on u8500 (Yang Li). - Register the thermal zones as hwmon sensors for the Qcom thermal sensors (Dmitry Baryshkov). - Fix 'tmon' tool compilation issue by adding phtread.h include (Markus Mayer). - Fix typo in the comments for the 'tmon' tool (Slark Xiao). - Make the thermal core use ida_alloc()/free() directly instead of ida_simple_get()/ida_simple_remove() that have been deprecated (keliu). - Drop ACPI_FADT_LOW_POWER_S0 check from the Intel PCH thermal control driver (Rafael Wysocki)" * tag 'thermal-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (39 commits) thermal/of: Initialize trip points separately thermal/of: Use thermal trips stored in the thermal zone thermal/core: Add thermal_trip in thermal_zone thermal/core: Rename 'trips' to 'num_trips' thermal/core: Move thermal_set_delay_jiffies to static thermal/core: Remove unneeded EXPORT_SYMBOLS thermal/of: Move thermal_trip structure to thermal.h thermal/of: Remove the device node pointer for thermal_trip thermal/of: Replace device node match with device node search thermal/core: Remove duplicate information when an error occurs thermal/core: Avoid calling ->get_trip_temp() unnecessarily thermal/tools/tmon: Fix typo 'the the' in comment thermal/tools/tmon: Include pthread and time headers in tmon.h thermal/ti-soc-thermal: Fix comment typo thermal/drivers/qcom/spmi-adc-tm5: Register thermal zones as hwmon sensors thermal/drivers/qcom/temp-alarm: Register thermal zones as hwmon sensors thermal/drivers/u8500: Remove unnecessary print function dev_err() thermal/drivers/rzg2l: Fix comments thermal/drivers/sun8i: Fix typo in comment thermal/drivers/k3_j72xx_bandgap: Make k3_j72xx_bandgap_j721e_data and k3_j72xx_bandgap_j7200_data static ... commit a771ea6413c00cf4af0570745f2e27084d7e2376 Merge: 8fa0db3a9b8ef aa727b7b4b67d Author: Linus Torvalds Date: Tue Aug 2 11:17:00 2022 -0700 Merge tag 'pm-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These are mostly minor improvements all over including new CPU IDs for the Intel RAPL driver, an Energy Model rework to use micro-Watt as the power unit, cpufreq fixes and cleanus, cpuidle updates, devfreq updates, documentation cleanups and a new version of the pm-graph suite of utilities. Specifics: - Make cpufreq_show_cpus() more straightforward (Viresh Kumar). - Drop unnecessary CPU hotplug locking from store() used by cpufreq sysfs attributes (Viresh Kumar). - Make the ACPI cpufreq driver support the boost control interface on Zhaoxin/Centaur processors (Tony W Wang-oc). - Print a warning message on attempts to free an active cpufreq policy which should never happen (Viresh Kumar). - Fix grammar in the Kconfig help text for the loongson2 cpufreq driver (Randy Dunlap). - Use cpumask_var_t for an on-stack CPU mask in the ondemand cpufreq governor (Zhao Liu). - Add trace points for guest_halt_poll_ns grow/shrink to the haltpoll cpuidle driver (Eiichi Tsukata). - Modify intel_idle to treat C1 and C1E as independent idle states on Sapphire Rapids (Artem Bityutskiy). - Extend support for wakeirq to callback wrappers used during system suspend and resume (Ulf Hansson). - Defer waiting for device probe before loading a hibernation image till the first actual device access to avoid possible deadlocks reported by syzbot (Tetsuo Handa). - Unify device_init_wakeup() for PM_SLEEP and !PM_SLEEP (Bjorn Helgaas). - Add Raptor Lake-P to the list of processors supported by the Intel RAPL driver (George D Sworo). - Add Alder Lake-N and Raptor Lake-P to the list of processors for which Power Limit4 is supported in the Intel RAPL driver (Sumeet Pawnikar). - Make pm_genpd_remove() check genpd_debugfs_dir against NULL before attempting to remove it (Hsin-Yi Wang). - Change the Energy Model code to represent power in micro-Watts and adjust its users accordingly (Lukasz Luba). - Add new devfreq driver for Mediatek CCI (Cache Coherent Interconnect) (Johnson Wang). - Convert the Samsung Exynos SoC Bus bindings to DT schema of exynos-bus.c (Krzysztof Kozlowski). - Address kernel-doc warnings by adding the description for unused function parameters in devfreq core (Mauro Carvalho Chehab). - Use NULL to pass a null pointer rather than zero according to the function propotype in imx-bus.c (Colin Ian King). - Print error message instead of error interger value in tegra30-devfreq.c (Dmitry Osipenko). - Add checks to prevent setting negative frequency QoS limits for CPUs (Shivnandan Kumar). - Update the pm-graph suite of utilities to the latest revision 5.9 including multiple improvements (Todd Brandt). - Drop pme_interrupt reference from the PCI power management documentation (Mario Limonciello)" * tag 'pm-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (27 commits) powercap: RAPL: Add Power Limit4 support for Alder Lake-N and Raptor Lake-P PM: QoS: Add check to make sure CPU freq is non-negative PM: hibernate: defer device probing when resuming from hibernation intel_idle: make SPR C1 and C1E be independent cpufreq: ondemand: Use cpumask_var_t for on-stack cpu mask cpufreq: loongson2: fix Kconfig "its" grammar pm-graph v5.9 cpufreq: Warn users while freeing active policy cpufreq: scmi: Support the power scale in micro-Watts in SCMI v3.1 firmware: arm_scmi: Get detailed power scale from perf Documentation: EM: Switch to micro-Watts scale PM: EM: convert power field to micro-Watts precision and align drivers PM / devfreq: tegra30: Add error message for devm_devfreq_add_device() PM / devfreq: imx-bus: use NULL to pass a null pointer rather than zero PM / devfreq: shut up kernel-doc warnings dt-bindings: interconnect: samsung,exynos-bus: convert to dtschema PM / devfreq: mediatek: Introduce MediaTek CCI devfreq driver dt-bindings: interconnect: Add MediaTek CCI dt-bindings PM: domains: Ensure genpd_debugfs_dir exists before remove PM: runtime: Extend support for wakeirq for force_suspend|resume ... commit 8fa0db3a9b8ef310eb40cf91481141ece084f584 Merge: 64ae88ff48cb5 6352f3478a95c Author: Linus Torvalds Date: Tue Aug 2 11:12:25 2022 -0700 Merge tag 'acpi-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These rework the handling of ACPI device objects to use the driver core facilities for managing child ones instead of some questionable home-grown ways without the requisite locking and reference counting, clean up the EC driver, improve suspend-to-idle handling on x86, add some systems to the ACPI backlight quirk list, fix some assorted issues, clean up code and improve documentation. Specifics: - Use facilities provided by the driver core and some additional helpers to handle the children of a given ACPI device object in multiple places instead of using the children and node list heads in struct acpi_device which is error prone (Rafael Wysocki). - Fix ACPI-related device reference counting issue in the hisi_lpc bus driver (Yang Yingliang). - Drop the children and node list heads that are not needed any more from struct acpi_device (Rafael Wysocki). - Drop driver member from struct acpi_device (Uwe Kleine-König). - Drop redundant check from acpi_device_remove() (Uwe Kleine-König). - Prepare the CPPC library for handling backwards-compatible future _CPC return package formats gracefully (Rafael Wysocki). - Clean up the ACPI EC driver after previous changes in it (Hans de Goede). - Drop leftover acpi_processor_get_limit_info() declaration (Riwen Lu). - Split out thermal initialization from ACPI PSS (Riwen Lu). - Annotate more functions in the ACPI CPU idle driver to live in the cpuidle section (Guilherme G. Piccoli). - Fix _EINJ vs "special purpose" EFI memory regions (Dan Williams). - Implement a better fix to avoid spamming the console with old error logs (Tony Luck). - Fix typo in a comment in the APEI code (Xiang wangx). - Save NVS memory during transitions into S3 on Lenovo G40-45 (Manyi Li). - Add support for upcoming AMD uPEP device ID AMDI008 to the ACPI suspend-to-idle driver for x86 platforms (Shyam Sundar S K). - Clean up checks related to the ACPI_FADT_LOW_POWER_S0 platform flag in the LPIT table driver and the suspend-to-idle driver for x86 platforms (Rafael Wysocki). - Print information messages regarding declared LPS0 idle support in the platform firmware (Rafael Wysocki). - Fix missing check in register_device_clock() in the ACPI driver for Intel SoCs (huhai). - Fix ACS setup in the VIOT table parser (Eric Auger). - Skip IRQ override on AMD Zen platforms where it's harmful (Chuanhong Guo). - Use native backlight on Dell Inspiron N4010 (Hans de Goede). - Use native backlight on some TongFang devices (Werner Sembach). - Drop X86 dependency from the ACPI backlight driver Kconfig (Riwen Lu). - Shorten the quirk list in the ACPI backlight driver by identifying Clevo by board_name only (Werner Sembach). - Remove useless NULL pointer checks from 2 ACPI PCI link management functions (Andrey Strachuk). - Fix obsolete example in the ACPI EINJ documentation (Qifu Zhang). - Update links and references to _DSD-related documents (Sudeep Holla)" * tag 'acpi-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (46 commits) ACPI/PCI: Remove useless NULL pointer checks ACPI: CPPC: Do not prevent CPPC from working in the future ACPI: PM: x86: Print messages regarding LPS0 idle support ACPI: resource: skip IRQ override on AMD Zen platforms Documentation: ACPI: EINJ: Fix obsolete example ACPI: video: Use native backlight on Dell Inspiron N4010 ACPI: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset Revert "ACPI / PM: LPIT: Register sysfs attributes based on FADT" ACPI: video: Shortening quirk list by identifying Clevo by board_name only ACPI: video: Force backlight native for some TongFang devices ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 ACPI: VIOT: Fix ACS setup ACPI: bus: Drop unused list heads from struct acpi_device hisi_lpc: Use acpi_dev_for_each_child() bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() ACPI: bus: Drop driver member of struct acpi_device ACPI: bus: Drop redundant check in acpi_device_remove() ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ACPI: LPSS: Fix missing check in register_device_clock() ACPI: APEI: Better fix to avoid spamming the console with old error logs ... commit 6b822d408b58c3c4f26dae93245c6b7d8b39e0f9 Author: Li Zhijian Date: Mon Aug 1 06:43:46 2022 +0000 RDMA/ib_srpt: Unify checking rdma_cm_id condition in srpt_cm_req_recv() Although rdma_cm_id and ib_cm_id passing to srpt_cm_req_recv() are exclusive currently, all other checking condition are using rdma_cm_id. So unify the 'if' condition to make the code more clear. Link: https://lore.kernel.org/r/1659336226-2-1-git-send-email-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Reviewed-by: Bart Van Assche Signed-off-by: Jason Gunthorpe commit 64ae88ff48cb5b3cc7b7aea97241a3e940085bf7 Merge: 530c28df03e70 cdbe34da01e32 Author: Linus Torvalds Date: Tue Aug 2 11:07:04 2022 -0700 Merge tag 'hwmon-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - Substantial rewrite of lm90 driver to support several additional chips and improve support for existing chips. - Add support of ROG ZENITH II EXTREME, Maximus XI Hero, and Strix Z690-a D4 to asus-ec-sensors driver - Add support of F71858AD to f71882fg driver - Add support of Aquacomputer Quadro to aquacomputer_d5next driver - Improved assembler code and add support for Dell G5 5590 as well as XPS 13 7390 in dell-smm driver - Add support for ASUS TUF GAMING B550-PLUS WIFI II to nct775 driver - Add support for IEEE 754 half precision to PMBus core. Also support for Analog Devices LT7182S, improve regulator support, and report various MFR register values in debugfs. - Various other minor improvements and fixes * tag 'hwmon-for-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (85 commits) hwmon: (aquacomputer_d5next) Add support for Aquacomputer Quadro fan controller hwmon: (dell-smm) Improve documentation hwmon: (nct6775) add ASUS TUF GAMING B550-PLUS WIFI II hwmon: (occ) Replace open-coded variant of %*phN specifier hwmon: (sht15) Fix wrong assumptions in device remove callback hwmon: (aquacomputer_d5next) Add support for reading the +12V voltage sensor on D5 Next hwmon: (tps23861) fix byte order in current and voltage registers hwmon: (aspeed-pwm-tacho) increase fan tach period (again) hwmon: (aquacomputer_d5next) Add D5 Next fan control support hwmon: (mcp3021) improve driver support for newer hwmon interface hwmon: (asus-ec-sensors) add definitions for ROG ZENITH II EXTREME hwmon: (aquacomputer_d5next) Move device-specific data into struct aqc_data hwmon: (asus-ec-sensors) add missing sensors for X570-I GAMING hwmon: (drivetemp) Add module alias hwmon: (asus_wmi_sensors) Save a few bytes of memory hwmon: (lm90) Use worker for alarm notifications hwmon: (asus-ec-sensors) add support for Maximus XI Hero hwmon: (dell-smm) Improve assembly code hwmon: (pmbus/ltc2978) Set voltage resolution hwmon: (pmbus) Add list_voltage to pmbus ops ... commit 32f457abb84676f54a8d3144fd7504207d348f87 Author: Ian Rogers Date: Fri Jul 29 13:42:16 2022 -0700 perf parse-events: Don't #define YY_EXTRA_TYPE Adding a #define to side-effect a local include isn't clean, for example, it inhibits header precompilation. YY_EXTRA_TYPE is defined to be void* by default, so just remove. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: https://lore.kernel.org/r/20220729204217.250166-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 530c28df03e701618949bedf445b1c3c90854ea9 Merge: 0805c6fb39f66 8933d30c5f468 Author: Linus Torvalds Date: Tue Aug 2 11:04:41 2022 -0700 Merge tag 'pwm/for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "After v5.19 had all drivers converted to the new atomic API and nobody has reported any breakage, this set of changes starts by dropping the legacy support. Some existing drivers get improvements and broader chip support and a new driver is added that emulates a PWM controller using a clock output. Other than that there's the usual bits of cleanups and minor fixes" * tag 'pwm/for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (21 commits) pwm: lpc18xx: Fix period handling pwm: lpc18xx: Convert to use dev_err_probe() pwm: twl-led: Document some limitations and link to the reference manual MAINTAINERS: Remove myself as PWM maintainer MAINTAINERS: Add include/dt-bindings/pwm to PWM SUBSYSTEM dt-bindings: pwm: mediatek: Add compatible string for MT8195 pwm: Add clock based PWM output driver dt-bindings: pwm: Document clk based PWM controller pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Simplify clk handling pwm: sifive: Enable clk only after period check in .apply() pwm: sifive: Reduce time the controller lock is held pwm: sifive: Fold pwm_sifive_enable() into its only caller pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: mediatek: Add MT8365 support dt-bindings: pwm: Add MT8365 SoC binding pwm: Drop unused forward declaration from pwm.h pwm: Reorder header file to get rid of struct pwm_capture forward declaration pwm: atmel-tcb: Fix typo in comment ... commit 0805c6fb39f66e01cb0adccfae8d9e0615c70fd7 Merge: 416e05e5b7ce6 69243df953e70 Author: Linus Torvalds Date: Tue Aug 2 10:55:04 2022 -0700 Merge tag 'spi-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The big update this time around is some excellent work from David Jander who went through the fast path and really eliminated overheads, meaning that we are seeing a huge reduction in the time spent between transfers for single threaded clients. Benchmarking has been coming out at about a halving of overhead which is clearly visible in system level usage that stresses SPI like some CAN and IIO applications, especially with small transfers. Thanks to David for taking the time to drill down into this and push the work upstream. Otherwise there's been a bunch of new device support and the usual updates. - Optimisation of the fast path, particularly around the number and types of locking operations, from David Jander. - Support for Arbel NPCM845, HP GXP, Intel Meteor Lake and Thunder Bay, MediaTek MT8188 and MT8365, Microchip FPGAs, nVidia Tegra 241 and Samsung Exynos Auto v9 and 4210" * tag 'spi-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (97 commits) MAINTAINERS: add spi support to GXP spi: dt-bindings: add documentation for hpe,gxp-spifi spi: spi-gxp: Add support for HPE GXP SoCs spi: a3700: support BE for AC5 SPI driver spi/panel: dt-bindings: drop CPHA and CPOL from common properties spi: bcm2835: enable shared interrupt support spi: dt-bindings: spi-controller: correct example indentation spi: dt-bindings: qcom,spi-geni-qcom: allow three interconnects spi: npcm-fiu: Add NPCM8XX support dt-binding: spi: Add npcm845 compatible to npcm-fiu document spi: npcm-fiu: Modify direct read dummy configuration spi: atmel: remove #ifdef CONFIG_{PM, SLEEP} spi: dt-bindings: Add compatible for MediaTek MT8188 spi: dt-bindings: mediatek,spi-mtk-nor: Update bindings for nor flash spi: dt-bindings: atmel,at91rm9200-spi: convert to json-schema spi: tegra20-slink: fix UAF in tegra_slink_remove() spi: Fix simplification of devm_spi_register_controller spi: microchip-core: switch to use dev_err_probe() spi: microchip-core: switch to use devm_spi_alloc_master() spi: microchip-core: fix UAF in mchp_corespi_remove() ... commit fd5382c5805c4bcb50fd25b7246247d3f7114733 Author: Zhu Yanjun Date: Sun Jul 31 02:36:21 2022 -0400 RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_init_req(). If an error occures before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. Move the spinlock initializations earlier before any failures. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20220731063621.298405-1-yanjun.zhu@linux.dev Reported-by: syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com Signed-off-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 416e05e5b7ce63402a2c342472799d340559f10e Merge: 2e7a95156d646 efc93392960cb Author: Linus Torvalds Date: Tue Aug 2 10:23:10 2022 -0700 Merge tag 'regulator-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This has been a fairly quiet release for the regulator API, a few new drivers and a small API update: - Support for specifying an initial load as part of requesting regulators through the bulk API - Support for Maxim MAX597x, Qualcomm PM8074, PM8909 and Realtek RT5120 devices" * tag 'regulator-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (35 commits) regulator: core: Allow drivers to define their init data as const regulator: core: Allow specifying an initial load w/ the bulk API regulator: mt6380: Fix unused array warning regulator: Add missing type for 'regulator-microvolt-offset' regulator: core: Fix off-on-delay-us for always-on/boot-on regulators regulator: of: Fix refcount leak bug in of_get_regulation_constraints() regulator: pwm: Update Lee Jones' email address regulator: max597x: Don't return uninitialized variable in .probe regulator: qcom,spmi-regulator: add PMP8074 PMIC regulator: qcom,spmi-regulator: Convert to dtschema regulator: qcom_spmi: add support for PMP8074 regulators regulator: qcom_spmi: add support for HT_P600 regulator: qcom_spmi: add support for HT_P150 regulator: max597x: Remove unused including regulator: Fix MFD_MAX597X dependency regulator: Fix parameter declaration and spelling mistake. regulator: max597x: Add support for max597x regulator regulator: scmi: Add missing of_node_get() regulator: qcom_smd: Add PM8909 RPM regulators regulator: dt-bindings: qcom,smd-rpm: Add PM8909 ... commit 2757a4dc184997c66ef1de32636f73b9f21aac14 Author: David Howells Date: Wed Jul 6 11:26:14 2022 +0100 afs: Fix access after dec in put functions Reference-putting functions should not access the object being put after decrementing the refcount unless they reduce the refcount to zero. Fix a couple of instances of this in afs by copying the information to be logged by tracepoint to local variables before doing the decrement. [Fixed a bit in afs_put_server() that I'd missed but Marc caught] Fixes: 341f741f04be ("afs: Refcount the afs_call struct") Fixes: 452181936931 ("afs: Trace afs_server usage") Fixes: 977e5f8ed0ab ("afs: Split the usage count on struct afs_server") Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/165911278430.3745403.16526310736054780645.stgit@warthog.procyon.org.uk/ # v1 commit 2e7a95156d64667a8ded606829d57c6fc92e41df Merge: 7d0d3fa7339ed 739f872e48d47 Author: Linus Torvalds Date: Tue Aug 2 10:12:25 2022 -0700 Merge tag 'regmap-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "The big thing this release is a big cleanup of the interrupt code from Aidan MacDonald, plus a few new API updates: - Rework of the interrupt code, making it much simpler and easier to extend - Support for device specific update bits operations with devices that otherwise use bitstream interfaces - Support for bit operations on fields as well as whole registers" * tag 'regmap-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: permit to set reg_update_bits with bulk implementation regmap: add WARN_ONCE when invalid mask is provided to regmap_field_init() regmap-irq: Fix bug in regmap_irq_get_irq_reg_linear() regmap: cache: Add extra parameter check in regcache_init regmap-irq: Deprecate the not_fixed_stride flag regmap-irq: Add get_irq_reg() callback regmap-irq: Fix inverted handling of unmask registers regmap-irq: Deprecate type registers and virtual registers regmap-irq: Introduce config registers for irq types regmap-irq: Refactor checks for status bulk read support regmap-irq: Remove mask_writeonly and regmap_irq_update_bits() regmap-irq: Remove inappropriate uses of regmap_irq_update_bits() regmap-irq: Remove an unnecessary restriction on type_in_mask regmap-irq: Cleanup sizeof(...) use in memory allocation regmap-irq: Remove unused type_reg_stride field regmap-irq: Convert bool bitfields to unsigned int regmap: Don't warn about cache only mode for devices with no cache regmap: provide regmap_field helpers for simple bit operations regmap: cache: Fix syntax errors in comments commit c56f9ec8b20f931014574b943590c4d830109380 Author: David Howells Date: Wed Jul 6 10:52:14 2022 +0100 afs: Use refcount_t rather than atomic_t Use refcount_t rather than atomic_t in afs to make use of the count checking facilities provided. Signed-off-by: David Howells Reviewed-by: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/165911277768.3745403.423349776836296452.stgit@warthog.procyon.org.uk/ # v1 commit 7e7a24c3c6c98abc4425abd1dbf2a71b42dfafcf Author: Krzysztof Kozlowski Date: Wed Jul 27 18:41:48 2022 +0200 dt-bindings: mtd: microchip,mchp48l640: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Reviewed-by: Heiko Schocher Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220727164148.385476-1-krzysztof.kozlowski@linaro.org commit 8bb5e7f4dcd9b9ef22a3ea25c9066a8a968f12dd Merge: 2a96271fb66c4 7c744d00990ea Author: Dmitry Torokhov Date: Tue Aug 2 10:06:12 2022 -0700 Merge branch 'next' into for-linus Prepare input updates for 5.20 (or 6.0) merge window. commit 7c744d00990ea999d27f306f6db5ccb61b1304b2 Author: Dmitry Torokhov Date: Tue Aug 2 10:00:00 2022 -0700 Input: adc-joystick - fix ordering in adc_joystick_probe() We should register the IIO buffer before we register the input device, because as soon as the device is registered input handlers may attach to it, resulting in a call to adc_joystick_open() which makes use of the said buffer. Acked-by: Artur Rojek Link: https://lore.kernel.org/r/YskFh4NHnlcryMkk@google.com Signed-off-by: Dmitry Torokhov commit 1ea78ec5ba3143120c65be5f166fa61b528c4c2c Author: Krzysztof Kozlowski Date: Tue Jul 26 13:57:48 2022 +0200 dt-bindings: power: supply: drop quotes when not needed Id and schema fields do not need quotes. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220726115748.101015-3-krzysztof.kozlowski@linaro.org commit 7ae0d493a5af9dcd929b721d31a3cfad21f5fbda Author: Krzysztof Kozlowski Date: Tue Jul 26 13:57:47 2022 +0200 dt-bindings: power: reset: drop quotes when not needed string literals do not need quotes. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220726115748.101015-2-krzysztof.kozlowski@linaro.org commit 93215d9f46015099b932b6d463242540e841f696 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:57:46 2022 +0200 dt-bindings: power: drop quotes when not needed Id and schema fields do not need quotes. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hector Martin Reviewed-by: Martin Blumenstingl Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220726115748.101015-1-krzysztof.kozlowski@linaro.org commit c9776457bd5eaad4ce4ecb17af8d8f3cc6957c0b Author: Maor Gottlieb Date: Sun Jul 31 11:29:08 2022 +0300 RDMA/mlx5: Add missing check for return value in get namespace flow Add missing check for return value when calling to mlx5_ib_ft_type_to_namespace, even though it can't really fail in this specific call. Fixes: 52438be44112 ("RDMA/mlx5: Allow inserting a steering rule to the FDB") Link: https://lore.kernel.org/r/7b9ceda217d9368a51dc47a46b769bad4af9ac92.1659256069.git.leonro@nvidia.com Reviewed-by: Itay Aveksis Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 62494ec7fbca4d58900eb62e075f2fedc85b5fb9 Author: Bob Pearson Date: Wed Jul 20 04:56:07 2022 -0400 RDMA/rxe: Split qp state for requester and completer Currently the requester can continue to process send wqes after an local qp operation error is detected because the setting of the qp state to the error state is deferred until later. This patch splits the qp state for the completer and requester into two separate states and sets qp->req.state = QP_STATE_ERROR as soon as the error is detected before another wqe can be executed. Link: https://lore.kernel.org/r/1658307368-1851-4-git-send-email-lizhijian@fujitsu.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit ae720bdb703b295fed4ded28e14dd06a534a3012 Author: Li Zhijian Date: Wed Jul 20 04:56:06 2022 -0400 RDMA/rxe: Generate error completion for error requester QP state As per IBTA specification, all subsequent WQEs while QP is in error state should be completed with a flush error. Here we check QP_STATE_ERROR after req_next_wqe() so that rxe_completer() has chance to be called where it will set CQ state to FLUSH ERROR and the completion can associate with its WQE. Link: https://lore.kernel.org/r/1658307368-1851-3-git-send-email-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit dea4266f7bf2fc76e49b2e521feccd6c1dbca8c5 Author: Li Zhijian Date: Wed Jul 20 04:56:05 2022 -0400 RDMA/rxe: Update wqe_index for each wqe error completion Previously, if user space keeps sending abnormal wqe, queue.index will keep increasing while qp->req.wqe_index doesn't. Once qp->req.wqe_index==queue.index in next round, req_next_wqe() will treat queue as empty. In such case, no new completion would be generated. Update wqe_index for each wqe completion so that req_next_wqe() can get next wqe properly. Link: https://lore.kernel.org/r/1658307368-1851-2-git-send-email-lizhijian@fujitsu.com Signed-off-by: Li Zhijian Signed-off-by: Jason Gunthorpe commit cf5e7a652168fba45410ac6f5b363fcf8677dea5 Author: Christoph Hellwig Date: Mon Jun 13 07:37:15 2022 +0200 fs: remove the NULL get_block case in mpage_writepages No one calls mpage_writepages with a NULL get_block paramter, so remove support for that case. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit f2d3e573bff9fde1566a4a1d0c7372fa5b4fd9ee Author: Christoph Hellwig Date: Mon Jun 13 07:37:14 2022 +0200 fs: don't call ->writepage from __mpage_writepage All callers of mpage_writepage use block_write_full_page as their ->writepage implementation when called from mpage_writepages (although for ntfs3 this is obsfucated a bit). Just call block_write_full_page directly instead of going through the ->writepage indirection. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit cc9cf350d100f4c336edb228cbd078003430cfe7 Author: Christoph Hellwig Date: Mon Jun 13 07:37:13 2022 +0200 fs: remove the nobh helpers All callers are gone, so remove the now dead code. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit 002cbb135678a99de6f851b4b5d3dcf88b9ab63d Author: Christoph Hellwig Date: Mon Jun 13 07:37:12 2022 +0200 jfs: stop using the nobh helper The nobh mode is an obscure feature to save lowlevel for large memory 32-bit configurations while trading for much slower performance and has been long obsolete. Switch to the regular buffer head based helpers instead. Signed-off-by: Christoph Hellwig Signed-off-by: Matthew Wilcox (Oracle) commit 0cc5b4ce7a3735ba0c64ed4c5a1f673165c4d5b2 Author: Christoph Hellwig Date: Mon Jun 13 07:37:11 2022 +0200 ext2: remove nobh support The nobh mode is an obscure feature to save lowlevel for large memory 32-bit configurations while trading for much slower performance and has been long obsolete. Remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit 9139710148744bf10c57ec6ace4f5f9532e040f4 Author: Christoph Hellwig Date: Mon Jun 13 07:37:10 2022 +0200 ntfs3: refactor ntfs_writepages Handle the resident case with an explicit generic_writepages call instead of using the obscure overload that makes mpage_writepages with a NULL get_block do the same thing. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Matthew Wilcox (Oracle) commit 9800562f2ab41656b0bdc2a41c77ab3f6dfdd6fc Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 13:29:10 2022 -0400 mm/folio-compat: Remove migration compatibility functions migrate_page_move_mapping(), migrate_page_copy() and migrate_page_states() are all now unused after converting all the filesystems from aops->migratepage() to aops->migrate_folio(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 9d0ddc0cb575fd41ff16131b06e08e1feac43b81 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 11:53:31 2022 -0400 fs: Remove aops->migratepage() With all users converted to migrate_folio(), remove this operation. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 5409548df3876a6fa9115bce237c93c3d50d6cb6 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 11:30:43 2022 -0400 secretmem: Convert to migrate_folio This is little more than changing the types over; there's no real work being done in this function. Signed-off-by: Matthew Wilcox (Oracle) commit b890ec2a2c2d962f71ba31ae291f8fd252b46258 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:47:21 2022 -0400 hugetlb: Convert to migrate_folio This involves converting migrate_huge_page_move_mapping(). We also need a folio variant of hugetlb_set_page_subpool(), but that's for a later patch. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Muchun Song Reviewed-by: Mike Kravetz commit 3648951ceb0ad20756253e84df9337e2a5aae440 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:47:21 2022 -0400 aio: Convert to migrate_folio Use a folio throughout this function. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 1d5b9bd65619088cc7d9f0546420e755a690757c Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:47:21 2022 -0400 f2fs: Convert to filemap_migrate_folio() filemap_migrate_folio() fits f2fs's needs perfectly. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Chao Yu commit e7b15bae558cc118ef8eb57d5d90295ece0caa7d Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:47:21 2022 -0400 ubifs: Convert to filemap_migrate_folio() filemap_migrate_folio() is a little more general than ubifs really needs, but it's better to share the code. Signed-off-by: Matthew Wilcox (Oracle) commit e7a60a1787fc5202860918c62d319624444998d8 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:47:21 2022 -0400 btrfs: Convert btrfs_migratepage to migrate_folio Use filemap_migrate_folio() to do the bulk of the work, and then copy the ordered flag across if needed. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Acked-by: David Sterba commit 2ec810d59602f0e08847f986ef8e16469722496f Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 12:55:08 2022 -0400 mm/migrate: Add filemap_migrate_folio() There is nothing iomap-specific about iomap_migratepage(), and it fits a pattern used by several other filesystems, so move it to mm/migrate.c, convert it to be filemap_migrate_folio() and convert the iomap filesystems to use it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong commit 541846502f4fe826cd7c16e4784695ac90736585 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:27:41 2022 -0400 mm/migrate: Convert migrate_page() to migrate_folio() Convert all callers to pass a folio. Most have the folio already available. Switch all users from aops->migratepage to aops->migrate_folio. Also turn the documentation into kerneldoc. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Acked-by: David Sterba commit 4ae84a80475144f739f77ed8bc789bc7feaa08ce Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 09:22:19 2022 -0400 nfs: Convert to migrate_folio Use a folio throughout this function. migrate_page() will be converted later. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Anna Schumaker Reviewed-by: Christoph Hellwig commit 8958b55142d4ac81e42269d1d4c9311cc2ab3423 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 09:22:19 2022 -0400 btrfs: Convert btree_migratepage to migrate_folio Use a folio throughout this function. migrate_page() will be converted later. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Acked-by: David Sterba commit 108ca8358139bec4232319debfb20bafdaf4f877 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 16:25:10 2022 -0400 mm/migrate: Convert expected_page_refs() to folio_expected_refs() Now that both callers have a folio, convert this function to take a folio & rename it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 67235182a41c1bd6b32806a1556a1d299b84212b Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 10:20:31 2022 -0400 mm/migrate: Convert buffer_migrate_page() to buffer_migrate_folio() Use a folio throughout __buffer_migrate_folio(), add kernel-doc for buffer_migrate_folio() and buffer_migrate_folio_norefs(), move their declarations to buffer.h and switch all filesystems that have wired them up. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 2be7fa10c028019f7b2fee11238987762567d41e Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 09:41:03 2022 -0400 mm/migrate: Convert writeout() to take a folio Use a folio throughout this function. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 8faa8ef5dd11abe119ad0c8ccd39f2064ca7ed0e Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 09:34:36 2022 -0400 mm/migrate: Convert fallback_migrate_page() to fallback_migrate_folio() Use a folio throughout. migrate_page() will be converted to migrate_folio() later. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 5490da4f06d182ba944706875029e98fe7f6b821 Author: Matthew Wilcox (Oracle) Date: Mon Jun 6 09:00:16 2022 -0400 fs: Add aops->migrate_folio Provide a folio-based replacement for aops->migratepage. Update the documentation to document migrate_folio instead of migratepage. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig commit 68f2736a858324c3ec852f6c2cddd9d1c777357d Author: Matthew Wilcox (Oracle) Date: Tue Jun 7 15:38:48 2022 -0400 mm: Convert all PageMovable users to movable_operations These drivers are rather uncomfortably hammered into the address_space_operations hole. They aren't filesystems and don't behave like filesystems. They just need their own movable_operations structure, which we can point to directly from page->mapping. Signed-off-by: Matthew Wilcox (Oracle) commit 81218f80a70768589ee30e14a8889336f070a339 Author: Matthew Wilcox (Oracle) Date: Tue Jun 7 15:37:50 2022 -0400 secretmem: Remove isolate_page The isolate_page operation is never called for filesystems, only for device drivers which call SetPageMovable. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: David Hildenbrand commit 37ce0b319b287666e2133ca740b73089355fe498 Author: Matthew Wilcox (Oracle) Date: Tue May 17 18:06:23 2022 -0400 ext2: Use a folio in ext2_get_page() Remove a call to read_mapping_page(). Signed-off-by: Matthew Wilcox (Oracle) commit 240159077d007527324a1e245ecd78b10a2b0d36 Author: Matthew Wilcox (Oracle) Date: Fri May 13 21:21:11 2022 -0400 gfs2: Convert gfs2_jhead_process_page() to use a folio Use folio_put_refs() to perform only one atomic operation instead of two. The other changes are straightforward conversions from page APIs to their folio equivalents. Signed-off-by: Matthew Wilcox (Oracle) commit 9bb88987bcb69243fdad03f1986de093a7702f7c Author: Matthew Wilcox (Oracle) Date: Fri Apr 29 11:12:16 2022 -0400 ocfs2: Convert ocfs2_read_folio() to use a folio Use the folio API throughout. There are a few places where we convert back to a page to call into the rest of the filesystem, so folio usage needs to be pushed down to those functions later. Signed-off-by: Matthew Wilcox (Oracle) commit 36a43502e10c362b025a18218f9b41a358b46f28 Author: Matthew Wilcox (Oracle) Date: Fri Apr 29 11:12:16 2022 -0400 freevxfs: Convert vxfs_immed_read_folio() to use a folio Reorganise the file to remove the forward declaration. Use folios throughout vxfs_immed_read_folio(). Use memcpy_to_page() instead of an open-coded kmap()/kunmap(). Remove flush_dcache_page() as this is embedded in memcpy_to_page(). Use folio_pos() instead of opencoding it. Handle multi-page folios. Signed-off-by: Matthew Wilcox (Oracle) commit 9a0a9533239f682bfacbba509bb299acb8c94918 Author: Matthew Wilcox (Oracle) Date: Fri Apr 29 11:12:16 2022 -0400 coda: Convert coda_symlink_filler() to use a folio This is a straightforward conversion from the page APIs to the folio APIs. Symlinks are not allowed to be larger than PAGE_SIZE, so there is little work to do here. Signed-off-by: Matthew Wilcox (Oracle) commit ac09d88b9fd2173ec8526ce4a3a8951b9edc1574 Author: Matthew Wilcox (Oracle) Date: Fri Apr 29 11:12:16 2022 -0400 befs: Convert befs_symlink_read_folio() to use a folio This is a straightforward conversion from the page APIs to the folio APIs. Symlinks are not allowed to be larger than PAGE_SIZE, so there is little work to do here. Signed-off-by: Matthew Wilcox (Oracle) commit 4fdc08d418f5ca68da64bbfefc03511b8c3dceea Author: Matthew Wilcox (Oracle) Date: Tue May 17 23:43:35 2022 -0400 block: Convert read_part_sector() to use a folio This relatively straightforward converion saves a call to compound_head() hidden inside put_page(). Signed-off-by: Matthew Wilcox (Oracle) commit 069fc464f1e80df06d156ef606cebc61ee00b63e Author: Matthew Wilcox (Oracle) Date: Tue May 17 23:40:45 2022 -0400 block: Use PAGE_SECTORS_SHIFT The bare use of '9' confuses some people. We also don't need this cast, since the compiler does exactly that cast for us. Signed-off-by: Matthew Wilcox (Oracle) commit 98d8ba69ff1ac168e73ac509228c4701bf6c3b87 Author: Matthew Wilcox (Oracle) Date: Tue May 17 23:38:37 2022 -0400 block: Handle partition read errors more consistently Set p->v to NULL if we try to read beyond the end of the disk, just like we do if we get an error returned from trying to read the disk. Signed-off-by: Matthew Wilcox (Oracle) commit 8b5d143c95533aa18ac3b39b82568391a7225a61 Author: Matthew Wilcox (Oracle) Date: Tue May 17 23:36:55 2022 -0400 block: Simplify read_part_sector() That rather complicated expression is just trying to find the offset of this sector within a page, and there are easier ways to express that. Signed-off-by: Matthew Wilcox (Oracle) commit cf948cbc35e80bbdde41fec0bb7f2a7c5e276ffb Author: Matthew Wilcox (Oracle) Date: Wed May 18 08:54:42 2022 -0400 cramfs: read_mapping_page() is synchronous Since commit 67f9fd91f93c, the code to wait for the read to complete has been dead. That commit wrongly stated that the read was synchronous already; this seems to have been a confusion about which ->readpage operation was being called. Instead of reintroducing an asynchronous version of read_mapping_page(), call the readahead code directly to submit all reads first before waiting for them in read_mapping_page(). Signed-off-by: Matthew Wilcox (Oracle) commit 97a3a383c4f29f16e9a8265ea188f274516e1076 Author: Matthew Wilcox (Oracle) Date: Fri May 27 11:29:24 2022 -0400 ocfs2: Use filemap_write_and_wait_range() in ocfs2_cow_sync_writeback() Remove the open-coding of filemap_fdatawait_range(). Signed-off-by: Matthew Wilcox (Oracle) commit e775dfb33d81455bb043e447c5bdca76ae60ea15 Author: Matthew Wilcox (Oracle) Date: Fri May 27 11:20:56 2022 -0400 hostfs: Handle page write errors correctly If a page can't be written back, we need to call mapping_set_error(), not clear the page's Uptodate flag. Also remove the clearing of PageError on success; that flag is used for read errors, not write errors. Signed-off-by: Matthew Wilcox (Oracle) commit 31e748e4b1df84dbb136f2e1dc542daefbe202b2 Author: Matthew Wilcox (Oracle) Date: Thu May 26 23:33:43 2022 -0400 squashfs: Return the actual error from squashfs_read_folio() Since we actually know what error happened, we can report it instead of having the generic code return -EIO for pages that were unlocked without being marked uptodate. Also remove a test of PageError since we have the return value at this point. Signed-off-by: Matthew Wilcox (Oracle) commit b7a6eb22ba10f8f6104575dbbbe8c5ad36afd9ac Author: Matthew Wilcox (Oracle) Date: Thu May 26 23:19:49 2022 -0400 buffer: Don't test folio error in block_read_full_folio() We can cache this information in a local variable instead of communicating from one part of the function to another via folio flags. Signed-off-by: Matthew Wilcox (Oracle) commit 7d0d3fa7339ed5a06d6608b7cde9f079eba62bb1 Merge: dd65b964922ed 1785ab769824b Author: Linus Torvalds Date: Tue Aug 2 08:35:17 2022 -0700 Merge tag 'arm-boardfiles-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM boardfile deprecation from Arnd Bergmann: "Over the past ten years, new machine support was based on device tree, and an initial set of about 400 boards using ATAGS with boardfile for booting were grandfathered in, with about half of them either removed or converted to DT over time. Based on the recent mailing list discussion I started, I have now turned the findings into a set of patches that marks most board files as 'depends on UNUSED_BOARD_FILES', leaving only 38 of the 196 boards. For the boards that are marked as unused, there are two final chances for potential users: The removal is scheduled to take place after the longterm stable kernel at the end of 2022, so users can stay on that version for another few years, and if anyone still has one of these machines and is planning to keep updating kernels beyond that version, they can speak up now to have their boards taken off the list again. Waiting for the LTS release also makes sure that there will be at least one longterm kernel that contains the recent multiplatform conversion along while still supporting all legacy boards. The short summary of the current status is: - The s3c24xx, cns3xxx, iop32x and mv78xx0 platforms have no known users and will be removed entirely. - The mmp and davinci platforms have DT support for the important machines and will become DT-only after this. - s3c64xx, dove, orion5x, and pxa keep some board files to allow those to be migrated over to DT more easily, but most board files are getting removed now. DT support on these platforms is partially working but requires changes to additional drivers for the other boards. - omap1, ep93xx, sa1100, footbridge and rpc have no DT support at the moment but have some boards with known users. Removing the board files that nobody uses should make it easier to try a DT conversion if anyone cares. There is no explicit timeline what happens with the boards that remain after this removal, but I expect to revisit this in the future, and with most boards gone, there will be a good time to do a treewide review of platform drivers that never gained DT support and have no remaining in-tree board files" Link: https://lore.kernel.org/linux-arm-kernel/CAK8P3a0Z9vGEQbVRBo84bSyPFM-LF+hs5w8ZA51g2Z+NsdtDQA@mail.gmail.com/ * tag 'arm-boardfiles-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: cns3xxx: add CONFIG_UNUSED_BOARD_FILES dependency ARM: iop32x: mark as unused ARM: s3c: mark most board files as unused ARM: omap1: add Kconfig dependencies for unused boards ARM: sa1100: mark most boards as unused ARM: footbridge: mark cats board for removal ARM: mmp: mark all board files for removal ARM: ep93xx: mark most board files as unused ARM: davinci: mark all ATAGS board files as unused ARM: orion: add ATAGS dependencies ARM: pxa: add Kconfig dependencies for ATAGS based boards ARM: add CONFIG_UNUSED_BOARD_FILES ARM: add ATAGS dependencies to non-DT platforms commit dd65b964922ed618a50866bd3895cf3ff646a5b9 Merge: 3a829d267e108 bccd70a73db20 Author: Linus Torvalds Date: Tue Aug 2 08:29:18 2022 -0700 Merge tag 'arm-newsoc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM new SoC support from Arnd Bergmann: "This adds initial support for two SoC families that have been under review for a while. In both cases, the origonal idea was to have a minimally functional version, but we ended up leaving out the clk drivers that are still under review and will be merged through the corresponding subsystem tree. The Nuvoton NPCM8xx is a 64-bit Baseboard Management Controller and based on the 32-bit NPCM7xx family but is now getting added to arch/arm64 as well. Sunplus SP7021, also known as Plus1, is a general-purpose System-in-Package design based on the 32-bit Cortex-A7 SoC on the main chip, plus an I/O chip and memory in the same" * tag 'arm-newsoc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) MAINTAINERS: rectify entry for ARM/NUVOTON NPCM ARCHITECTURE arm64: defconfig: Add Nuvoton NPCM family support arm64: dts: nuvoton: Add initial NPCM845 EVB device tree arm64: dts: nuvoton: Add initial NPCM8XX device tree arm64: npcm: Add support for Nuvoton NPCM8XX BMC SoC dt-bindings: arm: npcm: Add nuvoton,npcm845 GCR compatible string dt-bindings: arm: npcm: Add nuvoton,npcm845 compatible string dt-bindings: arm: npcm: Add maintainer reset: npcm: Add NPCM8XX support dt-bindings: reset: npcm: Add support for NPCM8XX reset: npcm: using syscon instead of device data ARM: dts: nuvoton: add reset syscon property dt-bindings: reset: npcm: add GCR syscon property dt-binding: clk: npcm845: Add binding for Nuvoton NPCM8XX Clock dt-bindings: watchdog: npcm: Add npcm845 compatible string dt-bindings: timer: npcm: Add npcm845 compatible string ARM: dts: Add Sunplus SP7021-Demo-V3 board device tree ARM: sp7021_defconfig: Add Sunplus SP7021 defconfig ARM: sunplus: Add initial support for Sunplus SP7021 SoC irqchip: Add Sunplus SP7021 interrupt controller driver ... commit 3a829d267e10812e3b2c2d656ba9fdc117ea6579 Merge: 3976d758e045e c95a5712beee6 Author: Linus Torvalds Date: Tue Aug 2 08:21:58 2022 -0700 Merge tag 'arm-defconfig-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Arnd Bergmann: "This branch includes the usual updates to defconfig files, enabling additional driver support for the supported platforms. There is also a global refresh for all of them that reorders the lines according to the 'savedefconfig' output, but without removing lines that are no longer part of the refresh. I went through the most common removed lines to also address them while making sure to catch renamed options and add them back under the new name. The boardfile deprecation branch is based on top of this to avoid conflicts against removing the unused boardfile configs from the generic defconfig files" * tag 'arm-defconfig-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) arm64: defconfig: Sync some configs with savedefconfig arm64: refresh defconfig file ARM: defconfig: kill remnants of CONFIG_LEDS ARM: defconfig: remove broken CONFIG_THUMB disables ARM: defconfig: address renamed CONFIG_DEBUG_INFO=y ARM: defconfig: remove stale CONFIG_ZBOOT_ROM entries ARM: defconfig: remove irda remnants ARM: refresh defconfig files arm64: defconfig: Demote Qualcomm USB PHYs to modules arm64: defconfig: Enable Qualcomm SC8280XP providers ARM: multi_v7_defconfig: Update configs for BCM63138 arm64: defconfig: enable Qualcomm Bandwidth Monitor arm64: defconfig: Enable Allwinner built in CODECs arm64: defconfig: Enable qcom interconnect drivers arm64: defconfig: Enable qcom ss & hs usb phy arm64: defconfig: enable Qualcomm LPG leds driver arm64: defconfig: Enable gpio-fan support arm64: defconfig: Enable DRM_V3D ARM: configs: Enable DRM_V3D arm64: defconfig: Enable R8A779G0 SoC ... commit 3976d758e045ed0485e0e665fb3b6692572576d7 Merge: 47b62edcd4eb7 47d8f8b78b9b4 Author: Linus Torvalds Date: Tue Aug 2 08:15:25 2022 -0700 Merge tag 'arm-dt-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM DT updates from Arnd Bergmann: "As usual, the bulk of the changes for the SoC tree are devicetree file updates, and most of these changes are for 64-bit embedded machines. As before, there are a ton of style cleanups, and additional hardware support for existing machines. Looking only at the new SoC, the notable additions are: - A whole family of Broadcom broadband SoCs, both 32-bit and 64-bit: BCM63178, BCM63158, BCM4912, BCM6858, BCM6878, BCM6846, BCM63146, BCM6856, BCM6855, BCM6756, BCM63148, and BCM6813. Each SoC comes with a corresponding reference board. - The new NXP i.MX93 SoC, the follow-up to the popular i.MX6 and i.MX8 embedded SoCs, now using Cortex-A55 cores and the Ethos-U65 NPU. - Qualcomm Snapdragon 8cx Gen3 (SC8280XP), the current high end of Arm based Laptop SoCs, and its automotive cousin, the SA8540P. The SC8280XP is used in the Lenovo Thinkpad X13s laptop that also gets added here in addition to the reference boards. - Allwinner H616, a newer version of the H6 SoC, targeted at Set-top-box applications. It comes with dts files for the Orange Pi zero2 single-board computer and the X96 Mate set-top-box - Marvell Prestera 98DX2530 (AlleyCat5), a network switch chip in the Armada SoC family based on the Cortex-A55 core. New machines based on previously supported SoCs include: - Several new machines on NXP i.MX platforms: multiple Toradex Colibri boards using the "Iris" and "Ixora" carriers, DH electronics i.MX8M Plus DHCOM and PDK2, TQ-Systems TQMa8MPQL, and phytech phyBOARD-Polis-i.MX8MM. - Google Chameleon v3 FPGA board based on Intel Arria10 and Stratix 10 Software Virtual platform, both in the SoCFPGA platform. - Two new wireless devices based on Broadcom SoCs: The Asus GT-AX6000 Router and the Cisco Meraki MR26 access point - Improved Chromebook support for both the Mediatek and Qualcomm SoC families brought added machines: Acer Chromebook 514 (MT8192), Acer Chromebook Spin 513 (MT8195) and a couple of SC7180 based machines including the Lenovo IdeaPad Chromebook Duet 3. - Xiaomi Mi Mix2s, LG G7 and LG V35 are mobile phones based on Qualcomm SDM845, while Mi 5s Plus is based on MSM8996. - Finally, there are a few development board on other chips: PCB8309 (Microchip lan966x), Radxa Rock Pi S (Rockchips RK3308) DH DRC Compact (ST STM32MP1) and Inforce IFC6560 (Qualcomm SDM660)" * tag 'arm-dt-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (829 commits) dt-bindings: soc: bcm: use absolute path to other schema dt-bindings: soc: bcm: drop quotes when not needed dt-bindings: soc: microchip: use absolute path to other schema dt-bindings: soc: microchip: drop quotes when not needed ARM: dts: lan966x: keep lan966 entries alphabetically sorted ARM: dts: lan966x: add support for pcb8309 dt-bindings: arm: at91: add lan966 pcb8309 board ARM: dts: lan966x: Enable network driver on pcb8291 ARM: dts: lan966x: Disable can0 on pcb8291 ARM: dts: lan966x: Add gpio-restart dt-bindings: arm: aspeed: add Aspeed Evaluation boards arm64: dts: qcom: Add support for Xiaomi Mi Mix2s dt-bindings: arm: qcom: Add Xiaomi Mi Mix2s bindings dt-bindings: arm: qcom: Document lg,judyln and lg,judyp devices dt-bindings: arm: qcom: add missing SM6350 board compatibles dt-bindings: arm: qcom: add missing SM6125 board compatibles dt-bindings: arm: qcom: add missing SDM845 board compatibles dt-bindings: arm: qcom: add missing SDM636 board compatibles dt-bindings: arm: qcom: add missing SDM630 board compatibles dt-bindings: arm: qcom: add missing QCS404 board compatibles ... commit 47b62edcd4eb70ccf4ecfacaf1a960eecfd3f891 Merge: e233cc59d08f9 99978d2fd90b9 Author: Linus Torvalds Date: Tue Aug 2 08:10:10 2022 -0700 Merge tag 'arm-drivers-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC drivers from Arnd Bergmann: "The SoC driver updates contain changes to improve support for additional SoC variants, as well as cleanups an minor bugfixes in a number of existing drivers. Notable updates this time include: - Support for Qualcomm MSM8909 (Snapdragon 210) in various drivers - Updates for interconnect drivers on Qualcomm Snapdragon - A new driver support for NMI interrupts on Fujitsu A64fx - A rework of Broadcom BCMBCA Kconfig dependencies - Improved support for BCM2711 (Raspberry Pi 4) power management to allow the use of the V3D GPU - Cleanups to the NXP guts driver - Arm SCMI firmware driver updates to add tracing support, and use the firmware interfaces for system power control and for power capping" * tag 'arm-drivers-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (125 commits) soc: a64fx-diag: disable modular build dt-bindings: soc: qcom: qcom,smd-rpm: add power-controller dt-bindings: soc: qcom: aoss: document qcom,sm8450-aoss-qmp dt-bindings: soc: qcom,rpmh-rsc: simplify qcom,tcs-config ARM: mach-qcom: Add support for MSM8909 dt-bindings: arm: cpus: Document "qcom,msm8909-smp" enable-method soc: qcom: spm: Add CPU data for MSM8909 dt-bindings: soc: qcom: spm: Add MSM8909 CPU compatible soc: qcom: rpmpd: Add compatible for MSM8909 dt-bindings: power: qcom-rpmpd: Add MSM8909 power domains soc: qcom: smd-rpm: Add compatible for MSM8909 dt-bindings: soc: qcom: smd-rpm: Add MSM8909 soc: qcom: icc-bwmon: Remove unnecessary print function dev_err() soc: fujitsu: Add A64FX diagnostic interrupt driver soc: qcom: socinfo: Fix the id of SA8540P SoC soc: qcom: Make QCOM_RPMPD depend on PM tty: serial: bcm63xx: bcmbca: Replace ARCH_BCM_63XX with ARCH_BCMBCA spi: bcm63xx-hsspi: bcmbca: Replace ARCH_BCM_63XX with ARCH_BCMBCA clk: bcm: bcmbca: Replace ARCH_BCM_63XX with ARCH_BCMBCA hwrng: bcm2835: bcmbca: Replace ARCH_BCM_63XX with ARCH_BCMBCA ... commit e233cc59d08f9bd389d4e8eaf71063150110b9b9 Merge: 9de1f9c8ca510 755d0ebc03f87 Author: Linus Torvalds Date: Tue Aug 2 08:02:59 2022 -0700 Merge tag 'arm-soc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The updates for arch/arm/mach-* platform code this time are mainly minor cleanups. Most notably, the DaVinci DM644x/DM646x SoC support gets removed. This was also scheduled for later removal early next year, but Linus Walleij asked for having them removed earlier to avoid problems for the GPIO subsystem" * tag 'arm-soc-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (38 commits) ARM: at91: setup outer cache .write_sec() callback if needed ARM: at91: add sam_linux_is_optee_available() function ARM: Marvell: Update PCIe fixup ARM: bcmbca: Include full family name in Kconfig ARM: bcm: NSP: Removed forced thermal selection ARM: debug: bcmbca: Replace ARCH_BCM_63XX with ARCH_BCMBCA arm: bcmbca: Add BCMBCA sub platforms arm: bcmbca: Move BCM63138 ARCH_BCM_63XX to ARCH_BCMBCA MAINTAINERS: Move BCM63138 to bcmbca arch entry ARM: shmobile: rcar-gen2: Increase refcount for new reference ARM: davinci: Delete DM646x board files ARM: davinci: Delete DM644x board files firmware: xilinx: Add TF_A_PM_REGISTER_SGI SMC call cpufreq: zynq: Fix refcount leak in zynq_get_revision ARM: OMAP2+: Kconfig: Fix indentation ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init ARM: OMAP2+: pdata-quirks: Fix refcount leak bug ARM: OMAP2+: display: Fix refcount leak bug ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: imx25: support silicon revision 1.2 ... commit 38ba0bb291aacd92d8eaa4a1aa8b63ce4286e797 Author: Andy Shevchenko Date: Tue Jul 12 12:08:37 2022 +0200 leds: is31fl319x: use simple i2c probe function The i2c probe functions here don't use the id information provided in their second argument, so the single-parameter i2c probe function ("probe_new") can be used instead. Signed-off-by: Andy Shevchenko Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit e1af5c8155867e6773474649c76e5c68940008d5 Author: Andy Shevchenko Date: Tue Jul 12 12:08:36 2022 +0200 leds: is31fl319x: Fix devm vs. non-devm ordering When non-devm resources are allocated they mustn't be followed by devm allocations, otherwise it will break the tear down ordering and might lead to crashes or other bugs during ->remove() stage. Fix this by wrapping mutex_destroy() call with devm_add_action_or_reset(). Signed-off-by: Andy Shevchenko Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit 0d77252bc4d28b6b80b4c9b56927cbf74a4d0eb1 Author: Andy Shevchenko Date: Tue Jul 12 12:08:35 2022 +0200 leds: is31fl319x: Make use of dev_err_probe() Simplify the error handling in probe function by switching from dev_err() to dev_err_probe(). Signed-off-by: Andy Shevchenko Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit 69a9b172adbde580a645767a161bb4cc9dc63d9b Author: Andy Shevchenko Date: Tue Jul 12 12:08:34 2022 +0200 leds: is31fl319x: Make use of device properties Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Add mod_devicetable.h include. Signed-off-by: Andy Shevchenko Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit 774268347938bb8e541eb9f6831e24045c353811 Author: Vincent Knecht Date: Tue Jul 12 12:08:33 2022 +0200 leds: is31fl319x: Cleanup formatting and dev_dbg calls Fix remaining non-standard place for comments. Remove remaining dev_dbg after regmap_read in is31fl3196_brightness_set. Remove __func__ in dev_dbg calls, instead adding "channel" string to describe the first displayed value. Change remaining container_of() call to be on one line, as well as a few others. Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit fa877cf1abb9ef297cfc413b78e998e4fc1394d3 Author: Vincent Knecht Date: Tue Jul 12 12:08:32 2022 +0200 leds: is31fl319x: Add support for is31fl319{0,1,3} chips Set specific chipset structs values for is31fl319{0,1,3} so that those chips can actually work. Datasheets: https://lumissil.com/assets/pdf/core/IS31FL3190_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3191_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3193_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3196_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3199_DS.pdf Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit bd34266fdec2826b852dd099b17af5df2b8c92b1 Author: Vincent Knecht Date: Tue Jul 12 12:08:31 2022 +0200 leds: is31fl319x: Move chipset-specific values in chipdef struct Allow setting chips' specifics in chipdef struct by adding fields for: - the reset register address - a pointer to a regmap_config struct - a pointer to a brightness_set function - current default, min and max values - a boolean to distinguish 319{0,1,3} and 319{6,9} chips and use those fields in places where distinction has to be made. The fields for 319{0,1,3} still point to 319{6,9} values. No functional change. Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit 8e6dde1b4495348a90e8a49147e8145d957cda52 Author: Vincent Knecht Date: Tue Jul 12 12:08:30 2022 +0200 leds: is31fl319x: Use non-wildcard names for vars, structs and defines In order to add real support for is31fl3190, is31fl3191 and is31fl3193, rename variant-dependent elements to not use 319X where needed. 3190 suffix is used for is31fl3190, is31fl3191 and is31fl3193 circuits. 3196 suffix is used for is31fl3196 and is31fl3199. Those two groups have different register maps, current settings and even a different interpretation of the software shutdown bit: https://lumissil.com/assets/pdf/core/IS31FL3190_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3191_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3193_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3196_DS.pdf https://lumissil.com/assets/pdf/core/IS31FL3199_DS.pdf Rename variables, structures and defines in preparation of the splitting. No functional nor behaviour change. Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit dc6d28f4859d1fcbd2f5505862a768f07c7a9770 Author: Vincent Knecht Date: Tue Jul 12 12:08:29 2022 +0200 leds: is31fl319x: Add missing si-en compatibles Add si-en compatibles for all chip variants. Signed-off-by: Vincent Knecht Signed-off-by: Pavel Machek commit 0d98fbcf72f11b6a6fadcec16d4c7f317bf417ae Merge: 87df0cecc2693 b3cbbb58632fa Author: Arnd Bergmann Date: Tue Aug 2 16:09:12 2022 +0200 Merge tag 'socfpga_updates_for_v5.20_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/late SoCFPGA dts updates for v5.20, part 2 - Update EMAC AXI settings for Cyclone5 * tag 'socfpga_updates_for_v5.20_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: dts: add EMAC AXI settings for Cyclone5 arm64: dts: altera: socfpga_stratix10: move clocks out of soc node arm64: dts: Add support for Stratix 10 Software Virtual Platform dt-bindings: altera: document Stratix 10 SWVP compatibles arm64: dts: altera: adjust whitespace around '=' arm64: dts: intel: socfpga_agilex: use defined GIC interrupt type for ECC dt-bindings: altera: Add Chameleon v3 board ARM: dts: socfpga: Add Google Chameleon v3 devicetree ARM: dts: socfpga: Add atsha204a node to Mercury+ AA1 dts ARM: dts: socfpga: Move sdmmc-ecc node to Arria 10 dts ARM: dts: socfpga: Change Mercury+ AA1 dts to dtsi Link: https://lore.kernel.org/r/20220728223237.3184243-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 6c955a9d9dbc0282a9aa14064fe456a10ee92fc6 Author: Takashi Iwai Date: Mon Aug 1 18:56:39 2022 +0200 ALSA: line6: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces those usages straightforwardly with a new helper, sysfs_emit(). Link: https://lore.kernel.org/r/20220801165639.26030-8-tiwai@suse.de Signed-off-by: Takashi Iwai commit 17daae7ac47aa870e7042aa7eeaff987feab92c6 Author: Takashi Iwai Date: Mon Aug 1 18:56:38 2022 +0200 ALSA: hda: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces those usages straightforwardly with new helpers, sysfs_emit() and sysfs_emit_at(). Link: https://lore.kernel.org/r/20220801165639.26030-7-tiwai@suse.de Signed-off-by: Takashi Iwai commit 01043e3e14d3e17acf563e0ce27abd73c6edde7f Author: Takashi Iwai Date: Mon Aug 1 18:56:37 2022 +0200 ALSA: pcm: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces such a sprintf() call straightforwardly with the new helper. Link: https://lore.kernel.org/r/20220801165639.26030-6-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0031812bd849cf90a4b1a0f194b776b7e3cd1f2b Author: Takashi Iwai Date: Mon Aug 1 18:56:36 2022 +0200 ALSA: core: Replace scnprintf() with sysfs_emit() sysfs_emit() is a new helper to simplify the sysfs string output. Replace the open-code with this new helper. Link: https://lore.kernel.org/r/20220801165639.26030-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit ade7956396d0e821097393bc4fe5773525f2634c Author: Takashi Iwai Date: Mon Aug 1 18:56:35 2022 +0200 ALSA: control-led: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces such sprintf() calls with sysfs_emit() while simplifying the open code in list_show(). Link: https://lore.kernel.org/r/20220801165639.26030-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0980bb1ff0f0ef0a3fb08f7596167eda2c932b45 Author: Takashi Iwai Date: Mon Aug 1 18:56:34 2022 +0200 ALSA: aoa: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces such sprintf() calls with sysfs_emit() while simplifying the open code in modalias_show(); as modalias[] is a NUL-terminated string, we can pass it straightly to a printf() argument. Link: https://lore.kernel.org/r/20220801165639.26030-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7450320ec7ab11e89e3f9b8f2c1229f3964181c1 Author: Takashi Iwai Date: Mon Aug 1 18:56:33 2022 +0200 ALSA: ac97: Replace sprintf() with sysfs_emit() For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces the open code straightforwardly with a new helper. Link: https://lore.kernel.org/r/20220801165639.26030-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 87df0cecc269317def877ed05966781e4389d122 Merge: d2fd1ddd311d9 5316d73ba81b5 Author: Arnd Bergmann Date: Tue Aug 2 15:58:45 2022 +0200 Merge tag 'asahi-soc-dt-5.20' of https://github.com/AsahiLinux/linux into arm/late Apple SoC DT updates for 5.20. This round just adds the NVMe controller nodes, since that driver is finally upstream. Includes one related power domain fixup. * tag 'asahi-soc-dt-5.20' of https://github.com/AsahiLinux/linux: arm64: dts: apple: t8103: Add ANS2 NVMe nodes arm64: dts: apple: Re-parent ANS2 power domains Link: https://lore.kernel.org/r/6de8649c-9795-54a1-fa45-8dd50355061f@marcan.st Signed-off-by: Arnd Bergmann commit d2fd1ddd311d94460b285f9dac7e8dbcccd0b8bf Merge: 3d7cb6b04c3f3 d985db8362267 Author: Arnd Bergmann Date: Tue Aug 2 15:57:46 2022 +0200 Merge tag 'reset-for-v5.20' of git://git.pengutronix.de/pza/linux into arm/late Reset controller updates for v5.20 Allow reset-simple to be selected under EXPERT and reset-a10sr to be built under COMPILE_TEST. Add Renesas RZ/G2UL USBPHY binding and a new driver for the TI TPS380x line of voltage supervisor ICs with manual reset control. A patch to make reset-microchip-sparx5 buildable as a module had to be reverted as that turned out to break MDIO on kswitch-d10. * tag 'reset-for-v5.20' of git://git.pengutronix.de/pza/linux: reset: tps380x: Fix spelling mistake "Voltags" -> "Voltage" reset: tps380x: Add TPS380x device driver supprt dt-bindings: reset: Add TPS380x documentation dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G2UL USBPHY Control bindings reset: reset-simple should depends on HAS_IOMEM Revert "reset: microchip-sparx5: allow building as a module" reset: a10sr: allow building under COMPILE_TEST reset: allow building of reset simple driver if expert config selected reset: microchip-sparx5: allow building as a module Link: https://lore.kernel.org/r/20220729133620.488379-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 879bcfc4e5369c39f3199e13a188424d4fae8aa4 Merge: fe17b91a7777d 57a2d0c1b27dd Author: Arnd Bergmann Date: Tue Aug 2 15:57:14 2022 +0200 Merge tag 'asahi-soc-maintainers-5.20' of https://github.com/AsahiLinux/linux into arm/fixes Apple SoC MAINTAINERS updates for 5.20. Just one patch adding our shiny new mailing list to the relevant section. * tag 'asahi-soc-maintainers-5.20' of https://github.com/AsahiLinux/linux: MAINTAINERS: add ARM/APPLE MACHINE mailing list Link: https://lore.kernel.org/r/308defdf-8873-63ed-dc9c-a88cd7a3cc2f@marcan.st Signed-off-by: Arnd Bergmann commit fe17b91a7777df140d0f1433991da67ba658796c Author: Kunihiko Hayashi Date: Tue Aug 2 22:36:47 2022 +0900 arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC An interrupt for USB device are shared with USB host. Set interrupt-names property to common "dwc_usb3" instead of "host" and "peripheral". Cc: stable@vger.kernel.org Fixes: d7b9beb830d7 ("arm64: dts: uniphier: Add USB3 controller nodes") Reported-by: Ryuta NAKANISHI Signed-off-by: Kunihiko Hayashi Signed-off-by: Arnd Bergmann commit 9b0dc7abb5cc43a2dbf90690c3c6011dcadc574d Author: Kunihiko Hayashi Date: Tue Aug 2 22:36:25 2022 +0900 ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC An interrupt for USB device are shared with USB host. Set interrupt-names property to common "dwc_usb3" instead of "host" and "peripheral". Cc: stable@vger.kernel.org Fixes: 45be1573ad19 ("ARM: dts: uniphier: Add USB3 controller nodes") Reported-by: Ryuta NAKANISHI Signed-off-by: Kunihiko Hayashi Signed-off-by: Arnd Bergmann commit 4f1196288dfb6fc63e28e585392f2df3b8a63388 Author: William Dean Date: Fri Jul 29 09:57:26 2022 +0800 ovl: fix spelling mistakes fix follow spelling misktakes: decendant ==> descendant indentify ==> identify underlaying ==> underlying Reported-by: Hacash Robot Signed-off-by: William Dean Signed-off-by: Miklos Szeredi commit b0de7fa706506bf0591037908376351beda8c5d6 Author: Frieder Schrempf Date: Tue Aug 2 08:43:34 2022 +0200 regulator: pca9450: Remove restrictions for regulator-name The device bindings shouldn't put any constraints on the regulator-name property specified in the generic bindings. This allows using arbitrary and descriptive names for the regulators. Suggested-by: Mark Brown Fixes: 7ae9e3a6bf3f ("dt-bindings: regulator: add pca9450 regulator yaml") Signed-off-by: Frieder Schrempf Link: https://lore.kernel.org/r/20220802064335.8481-1-frieder@fris.de Signed-off-by: Mark Brown commit c0fc96fed7ffa3e58f58b9cdb7158b5c61e026a2 Author: syed sabakareem Date: Tue Aug 2 11:55:00 2022 +0530 ASoC: amd: yc: Update DMI table entries for AMD platforms Updated DMI entries 21EM, 21EN, 21J5 and 21J6 for AMD platforms P15v Gen 3 and P14s Gen 3. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216267 Signed-off-by: syed saba kareem Reported-by: Pananchikkal Renjith Link: https://lore.kernel.org/r/20220802062503.159328-1-Syed.SabaKareem@amd.com Signed-off-by: Mark Brown commit 8eaa1d110800fac050bab44001732747a1c39894 Author: Maxim Mikityanskiy Date: Fri Jul 29 15:13:56 2022 +0300 net/mlx5e: xsk: Discard unaligned XSK frames on striding RQ Striding RQ uses MTT page mapping, where each page corresponds to an XSK frame. MTT pages have alignment requirements, and XSK frames don't have any alignment guarantees in the unaligned mode. Frames with improper alignment must be discarded, otherwise the packet data will be written at a wrong address. Fixes: 282c0c798f8e ("net/mlx5e: Allow XSK frames smaller than a page") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Reviewed-by: Saeed Mahameed Reviewed-by: Maciej Fijalkowski Link: https://lore.kernel.org/r/20220729121356.3990867-1-maximmi@nvidia.com Signed-off-by: Paolo Abeni commit bce02f71e48f7b89b9b52424ad2df4e5bc87a8ec Author: Christophe Leroy Date: Tue Aug 2 12:30:38 2022 +0200 EDAC/ppc_4xx: Include required of_irq header directly Commit 4d5c5bad5193 ("powerpc: Remove asm/prom.h from asm/mpc52xx.h and asm/pci.h") that cleans up powerpc's asm/prom.h leads to build errors in ppc4xx_edac.c due to missing header. Include required header directly to avoid the build failure. Fixes: 4d5c5bad5193 ("powerpc: Remove asm/prom.h from asm/mpc52xx.h and asm/pci.h") Reported-by: kernel test robot Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/993f5a7da371458cb819b5f3f569073c78523b01.1659436180.git.christophe.leroy@csgroup.eu commit f4b39e88b42d13366b831270306326b5c20971ca Author: Michael Ellerman Date: Tue Aug 2 20:38:32 2022 +1000 powerpc/pci: Fix PHB numbering when using opal-phbid The recent change to the PHB numbering logic has a logic error in the handling of "ibm,opal-phbid". When an "ibm,opal-phbid" property is present, &prop is written to and ret is set to zero. The following call to of_alias_get_id() is skipped because ret == 0. But then the if (ret >= 0) is true, and the body of that if statement sets prop = ret which throws away the value that was just read from "ibm,opal-phbid". Fix the logic by only doing the ret >= 0 check in the of_alias_get_id() case. Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias") Reviewed-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220802105723.1055178-1-mpe@ellerman.id.au commit ffa6482e461ff550325356ae705b79e256702ea9 Author: Chenyi Qiang Date: Tue Aug 2 11:32:06 2022 +0800 x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero It's possible that this kernel has been kexec'd from a kernel that enabled bus lock detection, or (hypothetically) BIOS/firmware has set DEBUGCTLMSR_BUS_LOCK_DETECT. Disable bus lock detection explicitly if not wanted. Fixes: ebb1064e7c2e ("x86/traps: Handle #DB for bus lock") Signed-off-by: Chenyi Qiang Signed-off-by: Ingo Molnar Reviewed-by: Tony Luck Link: https://lore.kernel.org/r/20220802033206.21333-1-chenyi.qiang@intel.com commit dec8784c9088b131a1523f582c2194cfc8107dc0 Author: Masami Hiramatsu (Google) Date: Tue Aug 2 15:04:16 2022 +0900 x86/kprobes: Update kcb status flag after singlestepping Fix kprobes to update kcb (kprobes control block) status flag to KPROBE_HIT_SSDONE even if the kp->post_handler is not set. This bug may cause a kernel panic if another INT3 user runs right after kprobes because kprobe_int3_handler() misunderstands the INT3 is kprobe's single stepping INT3. Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Reported-by: Daniel Müller Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Ingo Molnar Tested-by: Daniel Müller Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20220727210136.jjgc3lpqeq42yr3m@muellerd-fedora-PC2BDTX9 Link: https://lore.kernel.org/r/165942025658.342061.12452378391879093249.stgit@devnote2 commit 28f6c37a2910f565b4f5960df52b2eccae28c891 Author: Chen Zhongjin Date: Mon Aug 1 11:37:19 2022 +0800 kprobes: Forbid probing on trampoline and BPF code areas kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot and bpf_text_address as valid kprobe addresses - which is not ideal. These text areas are removable and changeable without any notification to kprobes, and probing on them can trigger unexpected behavior: https://lkml.org/lkml/2022/7/26/1148 Considering that jump_label and static_call text are already forbiden to probe, kernel_text_address() should be replaced with core_kernel_text() and is_module_text_address() to check other text areas which are unsafe to kprobe. [ mingo: Rewrote the changelog. ] Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area") Fixes: 74451e66d516 ("bpf: make jited programs visible in traces") Signed-off-by: Chen Zhongjin Signed-off-by: Ingo Molnar Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20220801033719.228248-1-chenzhongjin@huawei.com commit c67cc4315a8e605ec875bd3a1210a549e3562ddc Author: Hector Martin Date: Sun Jul 31 16:22:09 2022 +0900 net: usb: ax88179_178a: Bind only to vendor-specific interface The Anker PowerExpand USB-C to Gigabit Ethernet adapter uses this chipset, but exposes CDC Ethernet configurations as well as the vendor specific one. This driver tries to bind by PID:VID unconditionally and ends up picking up the CDC configuration, which is supposed to be handled by the class driver. To make things even more confusing, it sees both of the CDC class interfaces and tries to bind twice, resulting in two broken Ethernet devices. Change all the ID matches to specifically match the vendor-specific interface. By default the device comes up in CDC mode and is bound by that driver (which works fine); users may switch it to the vendor interface using sysfs to set bConfigurationValue, at which point the device actually goes through a reconnect cycle and comes back as a vendor specific only device, and then this driver binds and works too. The affected device uses VID/PID 0b95:1790, but we might as well change all of them for good measure, since there is no good reason for this driver to bind to standard CDC Ethernet interfaces. v3: Added VID/PID info to commit message Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20220731072209.45504-1-marcan@marcan.st Signed-off-by: Paolo Abeni commit e61b3125a4f036b3c6b87ffd656fc1ab00440ae9 Author: Xie Shaowen Date: Tue Aug 2 15:20:33 2022 +0800 Input: gscps2 - check return value of ioremap() in gscps2_probe() The function ioremap() in gscps2_probe() can fail, so its return value should be checked. Fixes: 4bdc0d676a643 ("remove ioremap_nocache and devm_ioremap_nocache") Cc: # v5.6+ Reported-by: Hacash Robot Signed-off-by: Xie Shaowen Signed-off-by: Helge Deller commit 1995943c3f2a59d73efe8bf9b33a92d0f1812af3 Author: Kleber Sacilotto de Souza Date: Mon Aug 1 14:46:15 2022 +0200 selftests: net: fix IOAM test skip return code The ioam6.sh test script exits with an error code (1) when tests are skipped due to lack of support from userspace/kernel or not enough permissions. It should return the kselftests SKIP code instead. Reviewed-by: Justin Iurman Signed-off-by: Kleber Sacilotto de Souza Link: https://lore.kernel.org/r/20220801124615.256416-1-kleber.souza@canonical.com Signed-off-by: Paolo Abeni commit f56530dcdb0684406661ac9f1accf48319d07600 Author: Maciej Żenczykowski Date: Sat Jul 30 16:01:13 2022 -0700 net: usb: make USB_RTL8153_ECM non user configurable This refixes: commit 7da17624e7948d5d9660b910f8079d26d26ce453 nt: usb: USB_RTL8153_ECM should not default to y In general, device drivers should not be enabled by default. which basically broke the commit it claimed to fix, ie: commit 657bc1d10bfc23ac06d5d687ce45826c760744f9 r8153_ecm: avoid to be prior to r8152 driver Avoid r8153_ecm is compiled as built-in, if r8152 driver is compiled as modules. Otherwise, the r8153_ecm would be used, even though the device is supported by r8152 driver. this commit amounted to: drivers/net/usb/Kconfig: +config USB_RTL8153_ECM + tristate "RTL8153 ECM support" + depends on USB_NET_CDCETHER && (USB_RTL8152 || USB_RTL8152=n) + default y + help + This option supports ECM mode for RTL8153 ethernet adapter, when + CONFIG_USB_RTL8152 is not set, or the RTL8153 device is not + supported by r8152 driver. drivers/net/usb/Makefile: -obj-$(CONFIG_USB_NET_CDCETHER) += cdc_ether.o r8153_ecm.o +obj-$(CONFIG_USB_NET_CDCETHER) += cdc_ether.o +obj-$(CONFIG_USB_RTL8153_ECM) += r8153_ecm.o And as can be seen it pulls a piece of the cdc_ether driver out into a separate config option to be able to make this piece modular in case cdc_ether is builtin, while r8152 is modular. While in general, device drivers should indeed not be enabled by default: this isn't a device driver per say, but rather this is support code for the CDCETHER (ECM) driver, and should thus be enabled if it is enabled. See also email thread at: https://www.spinics.net/lists/netdev/msg767649.html In: https://www.spinics.net/lists/netdev/msg768284.html Jakub wrote: And when we say "removed" we can just hide it from what's prompted to the user (whatever such internal options are called)? I believe this way we don't bring back Marek's complaint. Side note: these incorrect defaults will result in Android 13 on 5.15 GKI kernels lacking USB_RTL8153_ECM support while having USB_NET_CDCETHER (luckily we also have USB_RTL8150 and USB_RTL8152, so it's probably only an issue for very new RTL815x hardware with no native 5.15 driver). Fixes: 7da17624e7948d5d ("nt: usb: USB_RTL8153_ECM should not default to y") Cc: Geert Uytterhoeven Cc: Greg Kroah-Hartman Cc: Hayes Wang Cc: Jakub Kicinski Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20220730230113.4138858-1-zenczykowski@gmail.com Signed-off-by: Paolo Abeni commit 1d95af02f23031c2e1cca7607c514b86ce85bc6e Author: Stanimir Varbanov Date: Mon Aug 1 18:16:41 2022 +0300 venus: pm_helpers: Fix warning in OPP during probe Fix the following WARN triggered during Venus driver probe on 5.19.0-rc8-next-20220728: WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610 Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+) videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5 phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6 CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dev_pm_opp_set_config+0x49c/0x610 lr : dev_pm_opp_set_config+0x58/0x610 sp : ffff8000093c3710 x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00 x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810 x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810 x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000 x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858 x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000 x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0 x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640 x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008 x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860 Call trace: dev_pm_opp_set_config+0x49c/0x610 devm_pm_opp_set_config+0x18/0x70 vcodec_domains_get+0xb8/0x1638 [venus_core] core_get_v4+0x1d8/0x218 [venus_core] venus_probe+0xf4/0x468 [venus_core] platform_probe+0x68/0xd8 really_probe+0xbc/0x2a8 __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0xf0 __driver_attach+0x70/0x120 bus_for_each_dev+0x70/0xc0 driver_attach+0x24/0x30 bus_add_driver+0x150/0x200 driver_register+0x64/0x120 __platform_driver_register+0x28/0x38 qcom_venus_driver_init+0x24/0x1000 [venus_core] do_one_initcall+0x54/0x1c8 do_init_module+0x44/0x1d0 load_module+0x16c8/0x1aa0 __do_sys_finit_module+0xbc/0x110 __arm64_sys_finit_module+0x20/0x30 invoke_syscall+0x44/0x108 el0_svc_common.constprop.0+0xcc/0xf0 do_el0_svc+0x2c/0xb8 el0_svc+0x2c/0x88 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x18c/0x190 qcom-venus: probe of aa00000.video-codec failed with error -16 The fix is re-ordering the code related to OPP core. The OPP core expects all configuration options to be provided before the OPP table is added. Reported-by: Linux Kernel Functional Testing Suggested-by: Viresh Kumar Signed-off-by: Stanimir Varbanov Signed-off-by: Viresh Kumar commit 969e26c63d309c3555905f894560bcdee42f3464 Author: Sebin Sebastian Date: Mon Aug 1 09:37:31 2022 +0530 net: marvell: prestera: remove reduntant code Fixes the coverity warning 'EVALUATION_ORDER' violation. port is written twice with the same value. Signed-off-by: Sebin Sebastian Link: https://lore.kernel.org/r/20220801040731.34741-1-mailmesebin00@gmail.com Signed-off-by: Jakub Kicinski commit 53e99496abc1b6e9897ad78cf169a06c77db1b5e Author: Subbaraya Sundeep Date: Fri Jul 29 14:54:57 2022 +0530 octeontx2-pf: Reduce minimum mtu size to 60 PTP messages like SYNC, FOLLOW_UP, DELAY_REQ are of size 58 bytes. Using a minimum packet length as 64 makes NIX to pad 6 bytes of zeroes while transmission. This is causing latest ptp4l application to emit errors since length in PTP header and received packet are not same. Padding upto 3 bytes is fine but more than that makes ptp4l to assume the pad bytes as a TLV. Hence reduce the size to 60 from 64. Signed-off-by: Subbaraya Sundeep Signed-off-by: Naveen Mamindlapalli Signed-off-by: Sunil Kovvuri Goutham Link: https://lore.kernel.org/r/20220729092457.3850-1-naveenm@marvell.com Signed-off-by: Jakub Kicinski commit c6380f9924270d51cc233cfd592b279be3881e6d Author: Slark Xiao Date: Fri Jul 22 17:46:12 2022 +0800 scsi: pm8001: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Link: https://lore.kernel.org/r/20220722094612.78583-1-slark_xiao@163.com Acked-by: Jack Wang Signed-off-by: Slark Xiao Signed-off-by: Martin K. Petersen commit 6464d5b8a2768e8ff63d24b76299fe614e205aa7 Author: Colin Ian King Date: Sat Jul 30 13:45:09 2022 +0100 scsi: megaraid_sas: Remove redundant variable cmd_type The variable cmd_type is assigned a value but it is never read. The variable and the assignment are redundant and can be removed. Cleans up clang scan build warning: drivers/scsi/megaraid/megaraid_sas_fusion.c:3228:10: warning: Although the value stored to 'cmd_type' is used in the enclosing expression, the value is never actually read from 'cmd_type' [deadcode.DeadStores] Link: https://lore.kernel.org/r/20220730124509.148457-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 554b117e8fab4f7c53090eca693f47e0c7b18490 Author: Colin Ian King Date: Sat Jul 30 13:37:36 2022 +0100 scsi: FlashPoint: Remove redundant variable bm_int_st The variable bm_int_st is assigned a value but it is never read. The variable and the assignment are redundant and can be removed. Cleans up clang scan build warning: drivers/scsi/FlashPoint.c:1726:7: warning: Although the value stored to 'bm_int_st' is used in the enclosing expression, the value is never actually read from 'bm_int_st' [deadcode.DeadStores] Link: https://lore.kernel.org/r/20220730123736.147758-1-colin.i.king@gmail.com Acked-by: Khalid Aziz Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 4da8c5f76825269f28d6a89fa752934a4bcb6dfa Author: Steffen Maier Date: Fri Jul 29 18:25:29 2022 +0200 scsi: zfcp: Fix missing auto port scan and thus missing target ports Case (1): The only waiter on wka_port->completion_wq is zfcp_fc_wka_port_get() trying to open a WKA port. As such it should only be woken up by WKA port *open* responses, not by WKA port close responses. Case (2): A close WKA port response coming in just after having sent a new open WKA port request and before blocking for the open response with wait_event() in zfcp_fc_wka_port_get() erroneously renders the wait_event a NOP because the close handler overwrites wka_port->status. Hence the wait_event condition is erroneously true and it does not enter blocking state. With non-negligible probability, the following time space sequence happens depending on timing without this fix: user process ERP thread zfcp work queue tasklet system work queue ============ ========== =============== ======= ================= $ echo 1 > online zfcp_ccw_set_online zfcp_ccw_activate zfcp_erp_adapter_reopen msleep scan backoff zfcp_erp_strategy | ... | zfcp_erp_action_cleanup | ... | queue delayed scan_work | queue ns_up_work | ns_up_work: | zfcp_fc_wka_port_get | open wka request | open response | GSPN FC-GS | RSPN FC-GS [NPIV-only] | zfcp_fc_wka_port_put | (--wka->refcount==0) | sched delayed wka->work | ~~~Case (1)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ zfcp_erp_wait flush scan_work | wka->work: | wka->status=CLOSING | close wka request | scan_work: | zfcp_fc_wka_port_get | (wka->status==CLOSING) | wka->status=OPENING | open wka request | wait_event | | close response | | wka->status=OFFLINE | | wake_up /*WRONG*/ ~~~Case (2)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | wka->work: | wka->status=CLOSING | close wka request zfcp_erp_wait flush scan_work | scan_work: | zfcp_fc_wka_port_get | (wka->status==CLOSING) | wka->status=OPENING | open wka request | close response | wka->status=OFFLINE | wake_up /*WRONG&NOP*/ | wait_event /*NOP*/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | (wka->status!=ONLINE) | return -EIO | return early open response wka->status=ONLINE wake_up /*NOP*/ So we erroneously end up with no automatic port scan. This is a big problem when it happens during boot. The timing is influenced by v3.19 commit 18f87a67e6d6 ("zfcp: auto port scan resiliency"). Fix it by fully mutually excluding zfcp_fc_wka_port_get() and zfcp_fc_wka_port_offline(). For that to work, we make the latter block until we got the response for a close WKA port. In order not to penalize the system workqueue, we move wka_port->work to our own adapter workqueue. Note that before v2.6.30 commit 828bc1212a68 ("[SCSI] zfcp: Set WKA-port to offline on adapter deactivation"), zfcp did block in zfcp_fc_wka_port_offline() as well, but with a different condition. While at it, make non-functional cleanups to improve code reading in zfcp_fc_wka_port_get(). If we cannot send the WKA port open request, don't rely on the subsequent wait_event condition to immediately let this case pass without blocking. Also don't want to rely on the additional condition handling the refcount to be skipped just to finally return with -EIO. Link: https://lore.kernel.org/r/20220729162529.1620730-1-maier@linux.ibm.com Fixes: 5ab944f97e09 ("[SCSI] zfcp: attach and release SAN nameserver port on demand") Cc: #v2.6.28+ Reviewed-by: Benjamin Block Signed-off-by: Steffen Maier Signed-off-by: Martin K. Petersen commit f323896fe6fa8fa55ed37cb8b804fa97ead641c3 Author: Bart Van Assche Date: Thu Jul 28 15:18:51 2022 -0700 scsi: core: Call blk_mq_free_tag_set() earlier There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by moving the .exit_cmd_priv calls from scsi_host_dev_release() to scsi_forget_host(). Moving blk_mq_free_tag_set() from scsi_host_dev_release() to scsi_remove_host() is safe because scsi_forget_host() waits until all SCSI devices associated with the host have been removed. Fix the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/20220728221851.1822295-5-bvanassche@acm.org Fixes: 65ca846a5314 ("scsi: core: Introduce {init,exit}_cmd_priv()") Cc: Christoph Hellwig Cc: Mike Christie Cc: Hannes Reinecke Cc: John Garry Cc: Li Zhijian Reported-by: Li Zhijian Tested-by: Li Zhijian Reviewed-by: Ming Lei Reviewed-by: Mike Christie Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 1a9283782df2c91c7db5656753a2f548c43de6a7 Author: Ming Lei Date: Thu Jul 28 15:18:50 2022 -0700 scsi: core: Simplify LLD module reference counting Swap two statements in scsi_device_put() now that it is guaranteed that SCSI hosts outlive SCSI devices. Remove the reference counting code from scsi_sysfs.c that became superfluous because SCSI hosts now outlive SCSI devices. Link: https://lore.kernel.org/r/20220728221851.1822295-4-bvanassche@acm.org Cc: Christoph Hellwig Cc: Ming Lei Cc: Mike Christie Cc: Hannes Reinecke Cc: John Garry Reviewed-by: Mike Christie Signed-off-by: Ming Lei Signed-off-by: Bart Van Assche [ bvanassche: Extracted this patch from a larger patch ] Signed-off-by: Martin K. Petersen commit 16728aaba62e8b3b170735fdc3d8aa972835c136 Author: Ming Lei Date: Thu Jul 28 15:18:49 2022 -0700 scsi: core: Make sure that hosts outlive targets Fix the race conditions between SCSI LLD kernel module unloading and SCSI device and target removal by making sure that SCSI hosts are destroyed after all associated target and device objects have been freed. Link: https://lore.kernel.org/r/20220728221851.1822295-3-bvanassche@acm.org Cc: Christoph Hellwig Cc: Ming Lei Cc: Mike Christie Cc: Hannes Reinecke Cc: John Garry Reviewed-by: Mike Christie Signed-off-by: Ming Lei Signed-off-by: Bart Van Assche [ bvanassche: Reworked Ming's patch and split it ] Signed-off-by: Martin K. Petersen commit fe442604199ed3e60d5411137159f9623534e956 Author: Bart Van Assche Date: Thu Jul 28 15:18:48 2022 -0700 scsi: core: Make sure that targets outlive devices This commit prevents that the following sequence triggers a kernel crash: - Deletion of a SCSI device is requested via sysfs. Device removal takes some time because blk_cleanup_queue() is waiting for the SCSI error handler. - The SCSI target associated with that SCSI device is removed. - scsi_remove_target() returns and its caller frees the resources associated with the SCSI target. - The error handler makes progress and invokes an LLD callback that dereferences the SCSI target pointer. Link: https://lore.kernel.org/r/20220728221851.1822295-2-bvanassche@acm.org Cc: Christoph Hellwig Cc: Mike Christie Cc: Hannes Reinecke Cc: John Garry Cc: Li Zhijian Reported-by: Mike Christie Reviewed-by: Ming Lei Reviewed-by: Mike Christie Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit a19066788d875731a01ee7fa189b2202f0120036 Author: Daniil Lunev Date: Thu Jul 28 11:18:21 2022 +1000 scsi: ufs: ufs-pci: Correct check for RESET DSM dsm_fns is a bitmap, and it is 0-indexed according to the check in __intel_dsm function. But common initialization was checking it as if it was 1-indexed. This patch corrects the discrepancy. This change won't break any existing calls to the function, since before the change both bits 0 and 1 were checked and needed to be set. Link: https://lore.kernel.org/r/20220728111748.v3.1.I22460c4f4a9ccf2c96c3f9bb392b409926d80b2f@changeid Reviewed-by: Adrian Hunter Signed-off-by: Daniil Lunev Signed-off-by: Martin K. Petersen commit ef4f7e4bf1dc26aaa86cf8e5a13013684139be51 Author: Dmitry Bogdanov Date: Thu Jul 28 00:41:25 2022 +0300 scsi: target: core: De-RCU of se_lun and se_lun acl se_lun and se_lun_acl are immutable pointers of struct se_dev_entry. Remove RCU usage for access to those pointers. Link: https://lore.kernel.org/r/20220727214125.19647-3-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit dd0a66ada0bd0ae6c96ea45cfa1581797e867a40 Author: Dmitry Bogdanov Date: Thu Jul 28 00:41:24 2022 +0300 scsi: target: core: Fix race during ACL removal Under huge load there is a possibility of race condition in updating se_dev_entry object in ACL removal procedure: NIP [c0080000154093d0] transport_lookup_cmd_lun+0x1f8/0x3d0 [target_core_mod] LR [c00800001542ab34] target_submit_cmd_map_sgls+0x11c/0x300 [target_core_mod] Call Trace: target_submit_cmd_map_sgls+0x11c/0x300 [target_core_mod] target_submit_cmd+0x44/0x60 [target_core_mod] tcm_qla2xxx_handle_cmd+0x88/0xe0 [tcm_qla2xxx] qlt_do_work+0x2e4/0x3d0 [qla2xxx] process_one_work+0x298/0x5c Despite usage of RCU primitives with deve->se_lun pointer, it has not become dereference-safe because deve->se_lun is updated and not synchronized with a reader. That change might be in a release function called by synchronize_rcu(). But, in fact, there is no point in setting that pointer to NULL for deleting deve. All access to deve->se_lun is already under rcu_read_lock. And either deve->se_lun is always valid or deve is not valid itself and will not be found in the list_for_*. The same applicable for deve->se_lun_acl too. So a better solution is to remove that NULLing. Link: https://lore.kernel.org/r/20220727214125.19647-2-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 00511d2abf5708ad05dd5d1c36adb2468d274698 Author: Peter Wang Date: Wed Jul 27 11:05:26 2022 +0800 scsi: ufs: core: Correct ufshcd_shutdown() flow After ufshcd_wl_shutdown() set device power off and link off, ufshcd_shutdown() could turn off clock/power. Also remove pm_runtime_get_sync. The reason why it is safe to remove pm_runtime_get_sync() is because: - ufshcd_wl_shutdown() -> pm_runtime_get_sync() will resume hba->dev too. - device resume(turn on clk/power) is not required, even if device is in RPM_SUSPENDED. Link: https://lore.kernel.org/r/20220727030526.31022-1-peter.wang@mediatek.com Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Cc: # 5.15.x Reviewed-by: Stanley Chu Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit 86a44f045b8cbfd885b7425f4cd8a1c353593057 Author: Bart Van Assche Date: Tue Jul 26 15:52:21 2022 -0700 scsi: ufs: core: Increase the maximum data buffer size Measurements for one particular UFS controller + UFS device show a 25% higher read bandwidth if the maximum data buffer size is increased from 512 KiB to 1 MiB. Hence increase the maximum size of the data buffer associated with a single request from SCSI_DEFAULT_MAX_SECTORS (1024) * 512 bytes = 512 KiB to 1 MiB. Notes: - The maximum data buffer size supported by the UFSHCI specification is 65535 * 256 KiB or about 16 GiB. - The maximum data buffer size for READ(10) commands is 65535 logical blocks. To transfer more than 65535 * 4096 bytes = 255 MiB with a single SCSI command, the READ(16) command is required. Support for READ(16) is optional in the UFS 3.1 and UFS 4.0 standards. Link: https://lore.kernel.org/r/20220726225232.1362251-1-bvanassche@acm.org Cc: Adrian Hunter Cc: Avri Altman Cc: Bean Huo Cc: Stanley Chu Tested-by: Avri Altman Acked-by: Avri Altman Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit f00e0d7714895d10790e2bac4df00727ddb9abff Author: William Dean Date: Sat Jul 23 14:40:27 2022 +0800 scsi: lpfc: Check the return value of alloc_workqueue() The function alloc_workqueue() in lpfc_sli4_driver_resource_setup() can fail, but there is no check of its return value. The return value should be checked. Link: https://lore.kernel.org/r/20220723064027.2956623-1-williamsukatube@163.com Fixes: 3cee98db2610 ("scsi: lpfc: Fix crash on driver unload in wq free") Reported-by: Hacash Robot Reviewed-by: James Smart Signed-off-by: William Dean Signed-off-by: Martin K. Petersen commit 817b279467404ae3b16db8886b87eaefd8b13a6d Author: Dan Williams Date: Mon Aug 1 15:38:06 2022 -0700 cxl/region: Stop initializing interleave granularity In preparation for a patch that validates that the region ways setting is compatible with the granularity setting, the initial granularity setting needs to start at zero to indicate "unset". Reviewed-by: Vishal Verma Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/165853777484.2430596.3423921169034844397.stgit@dwillia2-xfh.jf.intel.com [djbw: fix up unused variable] Signed-off-by: Dan Williams commit 4d5c42a80bd17d1979dbcd40c5c44ff3c93e1476 Author: Dan Williams Date: Wed Jul 27 15:16:46 2022 -0700 cxl/hdm: Fix DPA reservation vs cxl_endpoint_decoder lifetime After adding support for emulating platform firmware established DPA reservations, the cxl-topology.sh [1] unit test started crashing with the following signature: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP [..] RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core] [..] Call Trace: __cxl_dpa_release+0x1b/0xd0 [cxl_core] cxl_dpa_release+0x1d/0x30 [cxl_core] release_nodes+0x63/0x90 devres_release_all+0x88/0xc0 ...i.e. a use after free of a 'struct cxl_endpoint_decoder' object. This results from the ordering of init_hdm_decoder() before add_hdm_decoder() where, at release time, the decoder is unregistered and released before the DPA reservation. Fix this by extending the life of the object until all DPA reservations have been released which also preserves platform decoder settings being settled by the time the decoder is published in sysfs (KOBJ_ADD time). Note that the @len == 0 case in __cxl_dpa_reserve() is avoided in practice as this function is only called for committed decoders and new non-zero DPA allocations. Link: https://github.com/pmem/ndctl/blob/pending/test/cxl-topology.sh [1] Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") Cc: Jonathan Cameron Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/165896020625.3546860.12390103413706292760.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit e77483055c325fa629c5835913b07f3dce3ac7fd Author: Dan Williams Date: Fri Jul 22 17:56:09 2022 -0700 cxl/acpi: Minimize granularity for x1 interleaves The kernel enforces that region granularity is >= to the top-level interleave-granularity for the given CXL window. However, when the CXL window interleave is x1, i.e. non-interleaved at the host bridge level, then the specified granularity does not matter. Override the window specified granularity to the CXL minimum so that any valid region granularity is >= to the root granularity. Reported-by: Jonathan Cameron Reviewed-by: Vishal Verma Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/165853776917.2430596.16823264262010844458.stgit@dwillia2-xfh.jf.intel.com [djbw: add CXL_DECODER_MIN_GRANULARITY per vishal] Signed-off-by: Dan Williams commit 2bde6dbebc1cf02fd1b3d740246b92df1514a370 Author: Dan Williams Date: Fri Jul 22 17:56:03 2022 -0700 cxl/region: Delete 'region' attribute from root decoders For switch and endpoint decoders the relationship of decoders to regions is 1:1. However, for root decoders the relationship is 1:N. Also, regions are already children of root decoders, so the 1:N relationship is observed by walking the following glob: /sys/bus/cxl/devices/$decoder/region* Hide the vestigial 'region' attribute for root decoders. Reviewed-by: Vishal Verma Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/165853776328.2430596.4647259305040072751.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit a53c28b6ae4bcda3c386bfd704b329926bcf3f92 Author: Dan Williams Date: Fri Jul 22 17:55:57 2022 -0700 cxl/acpi: Autoload driver for 'cxl_acpi' test devices In support of CXL unit tests in the ndctl project, arrange for the cxl_acpi driver to load in response to the registration of cxl_test devices. Reported-by: Dave Jiang Tested-by: Dave Jiang Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/165853775783.2430596.13637998086505316619.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 5e42bcbc3fef6e759dfb4d3f4cfb394c382b4249 Author: Dan Carpenter Date: Mon Aug 1 13:20:58 2022 +0300 cxl/region: decrement ->nr_targets on error in cxl_region_attach() The ++ needs a match -- on the clean up path. If the p->nr_targets value gets to be more than 16 it leads to uninitialized data in cxl_port_setup_targets(). drivers/cxl/core/region.c:995 cxl_port_setup_targets() error: uninitialized symbol 'eiw'. Fixes: 27b3f8d13830 ("cxl/region: Program target lists") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YuepCvUAoCtdpcoO@kili Signed-off-by: Dan Williams commit 4c2fdfc4c8049d94d4da0853da9e31832953f339 Merge: f2906aa863381 5e1e12d299200 Author: Stephen Boyd Date: Mon Aug 1 14:23:59 2022 -0700 Merge tag 'qcom-clk-for-5.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Introduces support for the camera clock controller in SM8450 and the display and gpu clock controllers in SM8350. - Various fixes, new clocks and USB GDSCs are introduced for IPQ8074 and for MSM8939 a series of fixes for issues introduced by inheriting the MSM8916 GCC driver is introduced. - Support for a new type of voteable GDSCs are introduced and put in use for the SC8280XP PCIe GDSCs. SC8280XP pipe clocks transitioned to the new phy-mux implementation. - MSM8996 GCC, the RPM clock driver and some clocks in MSM8994 GCC are transitioned to use parent_data. - The topology for Titan (camera) GDSCs on SDM845 and SM8250 are corrected and MSM8916 gains more possible frequencies for its GP clocks. - The GCC and tsens handling on MSM8960 is reworked to mimic the design in IPQ8074 and allow the GCC driver to probe earlier. - The regulator based mmcx supply for dispcc and videocc is dropped, as the only upstream target that adapted this interface was transitioned several kernel versions ago. - GDSCs found to be enabled at boot will now reflect in the enable count of the supply, as was done with the regulator supplies previously. * tag 'qcom-clk-for-5.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (62 commits) clk: qcom: gcc-msm8994: use parent_hws for gpll0/4 clk: qcom: clk-rpm: convert to parent_data API dt-bindings: clock: fix wrong clock documentation for qcom,rpmcc clk: qcom: gcc-msm8939: Add missing USB HS system clock frequencies clk: qcom: gcc-msm8939: Add missing MDSS MDP clock frequencies clk: qcom: gcc-msm8939: Add missing CAMSS CPP clock frequencies clk: qcom: gcc-msm8939: Fix venus0_vcodec0_clk frequency definitions clk: qcom: gcc-msm8939: Add missing CAMSS CCI bus clock clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled clk: qcom: Drop mmcx gdsc supply for dispcc and videocc clk: qcom: fix build error initializer element is not constant dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources clk: qcom: add support for SM8350 DISPCC clk: qcom: add support for SM8350 GPUCC clk: qcom: add camera clock controller driver for SM8450 SoC clk: qcom: clk-alpha-pll: add Rivian EVO PLL configuration interfaces clk: qcom: clk-alpha-pll: add Lucid EVO PLL configuration interfaces clk: qcom: clk-alpha-pll: limit exported symbols to GPL licensed code clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description ... commit 6312bb711e5c0bc5810a0966ff647a57b3236039 Author: Rob Herring Date: Thu Jul 28 11:51:37 2022 -0600 dt-bindings: PCI: host-generic-pci: Allow IOMMU and MSI properties Allow 'iommu-map', 'iommu-map-mask', and 'msi-parent' properties for generic host. This fixes unevaluated property warnings on Arm Juno, AMD Seattle, and FSL LS1028a. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220728175137.1172841-1-robh@kernel.org commit 6213c6c545cb273510047df881230d855e474d3b Author: Richard Zhu Date: Wed Jul 20 11:26:16 2022 +0800 PCI: imx6: Support more than Gen2 speed link mode Support more than Gen2 speed link mode, since i.MX8MP PCIe supports up to Gen3 link speed. Link: https://lore.kernel.org/r/1658287576-26908-1-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit 13f8f3d1e369f56dfaeea10a2238d56bc36c876c Author: Richard Zhu Date: Wed May 18 17:35:27 2022 +0800 PCI: imx6: Set PCIE_DBI_RO_WR_EN before writing DBI registers The PCIE_DBI_RO_WR_EN bit should be set when write some DBI registers. To make sure that the DBI registers are writable, set the PCIE_DBI_RO_WR_EN properly when writing the DBI registers. Link: https://lore.kernel.org/r/1652866528-13220-1-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit 835a345b18b013cc03b0fc392394fbccd61d4efb Author: Richard Zhu Date: Thu Jul 14 15:31:09 2022 +0800 PCI: imx6: Reformat suspend callback to keep symmetric with resume Create imx6_pcie_stop_link() and imx6_pcie_host_exit() functions. Encapsulate clocks, regulators disables and PHY uninitialization into imx6_pcie_host_exit(). To keep suspend/resume symmetric as much as possible, invoke these two new created functions in suspend callback. To be symmetric with imx6_pcie_host_exit(), move imx6_pcie_clk_enable() to imx6_pcie_host_init() from imx6_pcie_deassert_core_reset(). Link: https://lore.kernel.org/r/1657783869-19194-18-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit 1c5e761565c10945049e5d52fb17540cda23690e Author: Richard Zhu Date: Thu Jul 14 15:31:08 2022 +0800 PCI: imx6: Move the imx6_pcie_ltssm_disable() earlier Move the imx6_pcie_ltssm_disable() earlier and place it just behind the imx6_pcie_ltssm_enable(), since it might not be only used by suspend callback directly. To be symmetric with imx6_pcie_ltssm_enable(), add the IMX6Q and IMX8MQ switch cases in imx6_pcie_ltssm_disable(). Link: https://lore.kernel.org/r/1657783869-19194-17-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit 34eb543f4ffa6d9bcadfee29adb05d7c5937bc34 Author: Bjorn Helgaas Date: Thu Jul 14 15:31:07 2022 +0800 PCI: imx6: Disable clocks in reverse order of enable imx6_pcie_clk_enable() enables clocks in the order: pcie_phy pcie_bus pcie imx6_pcie_enable_ref_clk Change imx6_pcie_clk_disable() to disable them in the reverse order. Link: https://lore.kernel.org/r/1657783869-19194-16-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach Acked-by: Richard Zhu commit cf236e0c0d59b36e500c7a37e310e0cd6eefa5a0 Author: Richard Zhu Date: Thu Jul 14 15:31:06 2022 +0800 PCI: imx6: Do not hide PHY driver callbacks and refine the error handling Move the phy_power_on() to host_init from imx6_pcie_clk_enable(). Move the phy_init() to host_init from imx6_pcie_deassert_core_reset(). Refine the error handling in imx6_pcie_host_init() accordingly. Link: https://lore.kernel.org/r/1657783869-19194-15-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit af48f8226e94555bd3c5f93a437acf714024c2c3 Author: Richard Zhu Date: Thu Jul 14 15:31:05 2022 +0800 PCI: imx6: Reduce resume time by only starting link if it was up before suspend i.MX PCIe doesn't support hotplug. During resume, only start PCIe link training when the link was up before system suspend to avoid the long latency in the link training period. Link: https://lore.kernel.org/r/1657783869-19194-14-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit 508919d0a95c04ef04469e60776146a9795c07cf Author: Richard Zhu Date: Thu Jul 14 15:31:04 2022 +0800 PCI: imx6: Mark the link down as non-fatal error If the PCIe link is down, return zero from imx6_pcie_start_link() so the driver will probe successfully. Link: https://lore.kernel.org/r/1657783869-19194-13-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit f0691e326b270d86fff408f347bd6498949f3076 Author: Richard Zhu Date: Thu Jul 14 15:31:03 2022 +0800 PCI: imx6: Move regulator enable out of imx6_pcie_deassert_core_reset() Move regulator enable out of imx6_pcie_deassert_core_reset(), since the regulator_enable() has nothing to do with imx6_pcie_deassert_core_reset(). Link: https://lore.kernel.org/r/1657783869-19194-12-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit a4bb720eeb1e2f2b895734ccce0dceec0a64eebd Author: Richard Zhu Date: Thu Jul 14 15:31:02 2022 +0800 PCI: imx6: Turn off regulator when system is in suspend mode The driver should undo any enables it did itself. The regulator disable shouldn't be basing decisions on regulator_is_enabled(). Move the regulator_disable to the suspend function, turn off regulator when the system is in suspend mode. Link: https://lore.kernel.org/r/1657783869-19194-11-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas commit cfacf22e0df2e3db3e90306f830a4f6c08829b05 Author: Richard Zhu Date: Thu Jul 14 15:31:01 2022 +0800 PCI: imx6: Call host init function directly in resume Call imx6_pcie_host_init() instead of duplicating codes in resume. Note that this also means we do MPLL setup again during resume, which we didn't do before. [bhelgaas: add MPLL setup note, pointed out by Lucas] Link: https://lore.kernel.org/r/1657783869-19194-10-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit fea446eb9c77209dcd056fbd86c269a390075a29 Author: Richard Zhu Date: Thu Jul 14 15:31:00 2022 +0800 PCI: imx6: Disable i.MX6QDL clock when disabling ref clocks When disabling PCIe clocks, disable i.MX6QDL ref clock too. Link: https://lore.kernel.org/r/1657783869-19194-9-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit 9751f65db025a19a8f73e0531240b1d21a12139c Author: Richard Zhu Date: Thu Jul 14 15:30:59 2022 +0800 PCI: imx6: Propagate .host_init() errors to caller Since dw_pcie_host_init() checks for errors from ops->host_init(), check for errors when enabling power regulators and clocks and return them. [bhelgaas: commit log] Link: https://lore.kernel.org/r/1657783869-19194-8-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit 835fe229d7099dc07f34f16780cbad9081da7bf1 Author: Richard Zhu Date: Thu Jul 14 15:30:58 2022 +0800 PCI: imx6: Collect clock enables in imx6_pcie_clk_enable() Encapsulate the i.MX PCIe clock enable operations into one standalone function, imx6_pcie_clk_enable(). No functional change intended. [bhelgaas: split pure code moves into separate patches] Link: https://lore.kernel.org/r/1657783869-19194-7-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit d0a75c791f981546618c917293bc20094a923410 Author: Bjorn Helgaas Date: Thu Jul 14 15:30:57 2022 +0800 PCI: imx6: Factor out ref clock disable to match enable The PCIe ref clocks are specific to different variants. The enables are already split out into imx6_pcie_enable_ref_clk(), but the disables were combined with the more generic bus/phy/pcie clock disables in imx6_pcie_clk_disable(). Split out the variant-specific disables into imx6_pcie_disable_ref_clk() to match imx6_pcie_enable_ref_clk(). No functional change intended. Link: https://lore.kernel.org/r/1657783869-19194-6-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach Acked-by: Richard Zhu commit 34b1b9022586bf909ad0c7213d8669902150fc2a Author: Richard Zhu Date: Thu Jul 14 15:30:56 2022 +0800 PCI: imx6: Move imx6_pcie_clk_disable() earlier Move imx6_pcie_clk_disable() earlier to be near other clock-related functions. No functional change intended. [bhelgaas: reorder patch so pure moves are earlier] Link: https://lore.kernel.org/r/1657783869-19194-5-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach commit 276509690c2e4993016d1c2e220ca1929791b812 Author: Bjorn Helgaas Date: Thu Jul 14 15:30:55 2022 +0800 PCI: imx6: Move imx6_pcie_enable_ref_clk() earlier Move imx6_pcie_enable_ref_clk() earlier so it's not in the middle between imx6_pcie_assert_core_reset() and imx6_pcie_deassert_core_reset(). No functional change intended. Link: https://lore.kernel.org/r/1657783869-19194-4-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach Acked-by: Richard Zhu commit 6b1e989e491088b79f2582c9c0c7925ce1d67e06 Author: Bjorn Helgaas Date: Thu Jul 14 15:30:54 2022 +0800 PCI: imx6: Move PHY management functions together Collect imx6_pcie_init_phy(), imx7d_pcie_wait_for_phy_pll_lock(), and imx6_setup_phy_mpll() earlier with other PHY-related code. No functional change intended. Link: https://lore.kernel.org/r/1657783869-19194-3-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach Acked-by: Richard Zhu commit 79f14b6f1c60ea79e2209e301e31c12eb2a71e26 Author: Bjorn Helgaas Date: Thu Jul 14 15:30:53 2022 +0800 PCI: imx6: Move imx6_pcie_grp_offset(), imx6_pcie_configure_type() earlier Move imx6_pcie_grp_offset() and imx6_pcie_configure_type() earlier in the file since they depend on nothing and are used by several other functions that will be moved earlier. No functional change intended. Link: https://lore.kernel.org/r/1657783869-19194-2-git-send-email-hongxing.zhu@nxp.com Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas Stach Acked-by: Richard Zhu commit 9d14ad61551d72fdd78ee87bdf741e00f0d31ca7 Author: Bjorn Helgaas Date: Tue Jul 19 15:50:18 2022 -0500 PCI: imx6: Convert to NOIRQ_SYSTEM_SLEEP_PM_OPS() Replace SET_NOIRQ_SYSTEM_SLEEP_PM_OPS() with NOIRQ_SYSTEM_SLEEP_PM_OPS(), which has the advantage that the compiler always sees the PM callbacks as referenced, so they don't need to be wrapped with "#ifdef CONFIG_PM_SLEEP" or tagged with "__maybe_unused" to avoid "defined but not used" warnings. See 1a3c7bb08826 ("PM: core: Add new *_PM_OPS macros, deprecate old ones"). Signed-off-by: Bjorn Helgaas Reviewed-by: Arnd Bergmann commit 22f3571cbc84b9150238a43d271ffbf7fad3d81d Author: Marek Szyprowski Date: Wed Jun 29 00:04:09 2022 +0200 PCI: exynos: Correct generic PHY usage The proper initialization for generic PHYs is to call first phy_init(), then phy_power_on(). While touching this, remove the phy_reset() call. It is just a left-over from the obsoleted Exynos5440 support and the current exynos-pcie PHY driver doesn't even support this function. It is also rarely used by other drivers. Link: https://lore.kernel.org/r/20220628220409.26545-2-m.szyprowski@samsung.com Reported-by: Bjorn Helgaas Signed-off-by: Marek Szyprowski Signed-off-by: Bjorn Helgaas Reviewed-by: Chanho Park Acked-by: Krzysztof Kozlowski commit f2812227bb07e2eaee74253f11cea1576945df31 Author: Marek Szyprowski Date: Wed Jun 29 00:04:08 2022 +0200 phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks The exynos-pcie driver called phy_power_on() before phy_init() for some historical reasons. However the generic PHY framework assumes that the proper sequence is to call phy_init() first, then phy_power_on(). The operations done by both functions should be considered as one action and as such they are called by the exynos-pcie driver (without doing anything between them). The initialization is just a sequence of register writes, which cannot be altered without breaking the hardware operation. To match the generic PHY framework requirement, simply move all register writes to the phy_init()/phy_exit() and drop power_on()/power_off() callbacks. This way the driver will also work with the old (incorrect) PHY initialization call sequence. Link: https://lore.kernel.org/r/20220628220409.26545-1-m.szyprowski@samsung.com Reported-by: Bjorn Helgaas Signed-off-by: Marek Szyprowski Signed-off-by: Bjorn Helgaas Reviewed-by: Chanho Park Acked-by: Krzysztof Kozlowski Acked-By: Vinod Koul commit 91a773f9986b5cb4d6a6610b0326ef7c472dd543 Author: Dmitry Baryshkov Date: Thu Jul 7 16:47:32 2022 +0300 dt-bindings: PCI: qcom: Support additional MSI vectors On Qualcomm platforms each group of 32 MSI vectors is routed to the separate GIC interrupt. Document mapping of additional interrupts. Link: https://lore.kernel.org/r/20220707134733.2436629-6-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Reviewed-by: Johan Hovold Acked-by: Stanimir Varbanov commit cd761378e62c2614a3e7a1a8e4ecf68503a2c877 Author: Dmitry Baryshkov Date: Thu Jul 7 16:47:31 2022 +0300 PCI: dwc: Handle MSIs routed to multiple GIC interrupts On some Qualcomm platforms each group of 32 MSI vectors is routed to a separate GIC interrupt. Implement support for such configurations by parsing "msi0" ... "msiX" interrupts and attaching them to the chained handler. Note that if DT doesn't list an array of MSI interrupts and uses a single "msi" IRQ, the driver will limit the number of supported MSI vectors to 32. Link: https://lore.kernel.org/r/20220707134733.2436629-5-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam commit db388348acffe954656ec38440809ec770707417 Author: Dmitry Baryshkov Date: Fri Jul 22 11:34:12 2022 -0500 PCI: dwc: Convert struct pcie_port.msi_irq to an array The Qualcomm DWC PCIe controller supports more than 32 MSI interrupts, but they are routed to separate interrupts in groups of 32 vectors. To support this configuration, change the msi_irq field to an array. Let the DWC core handle all interrupts that were set in this array. [bhelgaas: reorder, drop "irq" temporary to make patch cleaner] Link: https://lore.kernel.org/r/20220707134733.2436629-3-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam commit 226ec087497a6a1a68d54c55f1fc5f1e8136610f Author: Dmitry Baryshkov Date: Fri Jul 22 11:28:28 2022 -0500 PCI: dwc: Split MSI IRQ parsing/allocation to a separate function Split handling of MSI host IRQs to a separate dw_pcie_msi_host_init() function. The code is complex enough to warrant a separate function. [bhelgaas: reorder patch earlier] Link: https://lore.kernel.org/r/20220707134733.2436629-4-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam commit 3c62f878a9695111a43dc2c1f90cf4b15efc76a0 Author: Dmitry Baryshkov Date: Thu Jul 7 16:47:28 2022 +0300 PCI: dwc: Correct msi_irq condition in dw_pcie_free_msi() The dwc-based drivers set pp->msi_irq to -ENODEV if they do not want the dwc core to do anything with pp->msi_irq. dw_pcie_host_init() sets the handler and data when "pp->msi_irq > 0", so use the same condition when removing the handler and data in dw_pcie_free_msi(). Link: https://lore.kernel.org/r/20220707134733.2436629-2-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam commit 6be6f8529bd7f3eb40a5f061badfc230e6a9fc9c Author: Christophe JAILLET Date: Sat Jul 9 16:10:52 2022 +0200 PCI: dwc: Use the bitmap API to allocate bitmaps Use devm_bitmap_zalloc() instead of hand-writing them. It is less verbose and it improves the semantic. Link: https://lore.kernel.org/r/bc6586a603abc0db7d4531308b698fbe7a6d7083.1657375829.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Bjorn Helgaas commit 35797e672ff0610224d80e3cc08393fef1032f9a Author: Will McVicker Date: Mon Jun 13 17:26:11 2022 -0500 PCI: dwc: Fix MSI msi_msg DMA mapping As of 07940c369a6b ("PCI: dwc: Fix MSI page leakage in suspend/resume"), the PCIe designware host driver has been using the driver data allocation for the msi_msg DMA mapping which can result in a DMA_MAPPING_ERROR due to the DMA overflow check in dma_direct_map_page() when the address is greater than 32 bits (reported in [1]). The commit was trying to address a memory leak on suspend/resume by moving the MSI mapping to dw_pcie_host_init(), but subsequently dropped the page allocation thinking it wasn't needed. To fix the DMA mapping issue as well as make msi_msg DMA'able, switch back to allocating a 32-bit page for the msi_msg. To avoid the suspend/resume leak, allocate the page in dw_pcie_host_init() since that shouldn't be called during suspend/resume. [1] https://lore.kernel.org/all/Yo0soniFborDl7+C@google.com/ Signed-off-by: Will McVicker Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring commit ce06bf570390fb8b41d581e5d594727b51367179 Author: Serge Semin Date: Fri Jun 24 17:39:46 2022 +0300 PCI: dwc: Check iATU in/outbound range setup status Make the DWC PCIe RC/EP safer and more verbose for invalid or failed inbound and outbound iATU window setups. Silently ignoring iATU regions setup errors may cause unpredictable errors. For instance if a cfg or IO window fails to be activated, then any CFG/IO requested won't reach target PCIe devices and the corresponding accessors will return platform-specific random values. [bhelgaas: trim commit log] Link: https://lore.kernel.org/r/20220624143947.8991-15-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit edf408b946d37cc70fbf0db6ab85bbf67dae1894 Author: Serge Semin Date: Fri Jun 24 17:39:45 2022 +0300 PCI: dwc: Validate iATU outbound mappings against hardware constraints Make __dw_pcie_prog_outbound_atu() check the requested region base and size against what the hardware can support. Return error if the region is not correctly aligned or of a supported size. [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-14-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit 89473aa9ab261948ed13b16effe841a675efed77 Author: Serge Semin Date: Fri Jun 24 17:39:44 2022 +0300 PCI: dwc: Add iATU regions size detection procedure The DWC PCIe RC/EP/DM IP core configuration parameters determine the number of inbound and outbound iATU windows, alignment requirements (which is also the minimum window size), minimum and maximum sizes. If internal ATU is enabled, the former settings are determined by CX_ATU_MIN_REGION_SIZE; the latter are determined by CX_ATU_MAX_REGION_SIZE. Determine the required alignment and maximum size supported by the controller and log it to help verify whether the requested inbound or outbound memory mappings can be fully created. Note 1. The extended iATU regions have been supported since DWC PCIe v4.60a. There is no need in testing the upper limit register availability for the older cores. Note 2. The regions alignment is determined with using the fls() method since the lower four bits of the ATU Limit register can be occupied with the Circular Buffer Increment setting, which can be initialized with zeros. Link: https://lore.kernel.org/r/20220624143947.8991-13-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit 5a163f5998185d3af58d825501765b08fd6ed32e Author: Serge Semin Date: Fri Jun 24 17:39:43 2022 +0300 PCI: dwc: Simplify in/outbound iATU setup methods Previously __dw_pcie_prog_outbound_atu() duplicated a lot of code between the iatu_unroll_enabled version and the PCIE_ATU_VIEWPORT version: __dw_pcie_prog_outbound_atu if (iatu_unroll_enabled) dw_pcie_prog_outbound_atu_unroll dw_pcie_writel_ob_unroll(PCIE_ATU_UNR_LOWER_BASE, ...) dw_pcie_writel_ob_unroll(PCIE_ATU_UNR_UPPER_BASE, ...) ... return dw_pcie_writel_dbi(PCIE_ATU_VIEWPORT, ...) dw_pcie_writel_dbi(PCIE_ATU_LOWER_BASE, ...) dw_pcie_writel_dbi(PCIE_ATU_UPPER_BASE, ...) ... Unify those by pushing the unroll address computation and viewport selection down into dw_pcie_writel_atu() so we can use the same dw_pcie_writel_atu_ob() accessor for both paths: __dw_pcie_prog_outbound_atu dw_pcie_writel_atu_ob(PCIE_ATU_LOWER_BASE, ...) dw_pcie_writel_atu dw_pcie_select_atu # new if (iatu_unroll_enabled) return pci->atu_base + PCIE_ATU_UNROLL_BASE(...) dw_pcie_writel_dbi(PCIE_ATU_VIEWPORT, ...) return pci->atu_base dw_pcie_write(base + reg) dw_pcie_writel_atu_ob(PCIE_ATU_UPPER_BASE, ...) ... In the non-unroll case, this does involve more MMIO writes to PCIE_ATU_VIEWPORT, but it's mainly in initialization paths and the code simplification is significant. [bhelgaas: commit log, simplify dw_pcie_select_atu()] Link: https://lore.kernel.org/r/20220624143947.8991-12-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas commit 38fe272389f44c223c689d74d9e2365257ed85e1 Author: Serge Semin Date: Fri Jun 24 17:39:42 2022 +0300 PCI: dwc: Drop enum dw_pcie_region_type in favor of PCIE_ATU_REGION_DIR_IB/OB Previously callers of dw_pcie_disable_atu() supplied enum dw_pcie_region_type (DW_PCIE_REGION_INBOUND, DW_PCIE_REGION_OUTBOUND), which dw_pcie_disable_atu() converted to the PCIE_ATU_REGION_DIR_IB or PCIE_ATU_REGION_DIR_OB values needed to program the ATU registers. Simplify the code by dropping the dw_pcie_region_type enum and passing PCIE_ATU_REGION_DIR_IB or PCIE_ATU_REGION_DIR_OB directly. Reorder dw_pcie_disable_atu() arguments to (dir, index) since "index" indicates an ATU window in the regions of the corresponding direction. [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-11-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit 4859db9bca5daafc4ec9ef4e5aab9e054b483e0c Author: Serge Semin Date: Fri Jun 24 17:39:41 2022 +0300 PCI: dwc: Drop enum dw_pcie_as_type in favor of PCIE_ATU_TYPE_MEM/IO Previously dw_pcie_ep_set_bar() converted the BAR PCI_BASE_ADDRESS_SPACE bit to the internal dw_pcie_as_type enum (DW_PCIE_AS_MEM, DW_PCIE_AS_IO) and passed it down to dw_pcie_prog_inbound_atu(), which converted the enum to the PCIE_ATU_TYPE_MEM/PCIE_ATU_TYPE_IO values needed to program the ATU registers. Simplify the code by dropping the dw_pcie_as_type enum and passing PCIE_ATU_TYPE_MEM or PCIE_ATU_TYPE_IO directly. Reorder inbound ATU function arguments to match the outbound functions, with address-related parameters at the end. [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-10-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit c6481d51dc65f27cf35df499d1cafbfe9327f7a3 Author: Serge Semin Date: Fri Jun 24 17:39:40 2022 +0300 PCI: dwc: Add dw_pcie_ops.host_deinit() callback dw_pcie_host_init() calls the dw_pcie_ops.host_init() callback to do platform-specific host initialization. Add a dw_pcie_ops.host_deinit() callback to perform the corresponding cleanups in dw_pcie_host_deinit() and in dw_pcie_host_init() failure paths. Link: https://lore.kernel.org/r/20220624143947.8991-9-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 58c379eee610276091fa21679e72fb5a9b80c18e Author: Serge Semin Date: Fri Jun 24 17:39:39 2022 +0300 PCI: tegra194: Drop manual DW PCIe controller version setup Since the DW PCIe common code (dw_pcie_version_detect()) now reads the IP core version directly from the hardware, there is no point manually setting the version for controllers newer than v4.70a. Tegra194 only supports v4.90a, so remove the now-superfluous code that sets struct dw_pcie.version. Suggested-by: Rob Herring Link: https://lore.kernel.org/r/20220624143947.8991-8-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 50deb8ac61705b98c89c98db711b64f48d9f9f49 Author: Serge Semin Date: Fri Jun 24 17:39:38 2022 +0300 PCI: intel-gw: Drop manual DW PCIe controller version setup Since the DW PCIe common code (dw_pcie_version_detect()) now reads the IP core version directly from the hardware, there is no point manually setting the version for controllers newer than v4.70a. Remove the now-superfluous intel-gw code that sets struct dw_pcie.version. Suggested-by: Rob Herring Link: https://lore.kernel.org/r/20220624143947.8991-7-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 0b0a780d52ad2bd51e4e154c190abcfed43e33bb Author: Serge Semin Date: Fri Jun 24 17:39:37 2022 +0300 PCI: dwc: Add macros to compare Synopsys IP core versions Add macros to compare DWC IP core versions: dw_pcie_ver_is() dw_pcie_ver_is_ge() dw_pcie_ver_type_is() dw_pcie_ver_type_is_ge() These are along the lines of DWC3_VER_IS() and dw_spi_ver_is(). [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-6-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring commit 13e9d3900c20247993db68856d9898161acb403a Author: Serge Semin Date: Fri Jun 24 17:39:36 2022 +0300 PCI: dwc: Read DWC IP core version from register Since DWC PCIe v4.70a, the controller version and version type can be read from the PORT_LOGIC.PCIE_VERSION_OFF and PORT_LOGIC.PCIE_VERSION_TYPE_OFF registers respectively. Read the version from those registers and warn if if's different from the version we got from the device tree. We can only read the version after platform-specific drivers have done any DBI-related initialization, such as reference clock activation. [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-5-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit afe1c6d50d33ea7d888b0105670fb2aaa5abf495 Author: Serge Semin Date: Fri Jun 24 17:39:35 2022 +0300 PCI: dwc: Use native DWC IP core version representation Save the DWC IP core version in the same format as the PORT_LOGIC.PCIE_VERSION_OFF register, similar to what other drivers for DWC IP do (dw_spi_hw_init(), dwc3_core_is_valid(), stmmac_hwif_init()). [bhelgaas: trim commit log] Link: https://lore.kernel.org/r/20220624143947.8991-4-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit e3dc79adfac96d7b1a62f3f27004c3f9013875bc Author: Serge Semin Date: Fri Jun 24 17:39:34 2022 +0300 PCI: dwc: Detect iATU settings after getting "addr_space" resource Previously, dw_pcie_ep_init() did: dw_pcie_iatu_detect(pci); res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "addr_space"); if (!res) return -EINVAL; The platform_get_resource_byname() can fail, and dw_pcie_iatu_detect() doesn't depend on the "addr_space" resource, so delay it until afterwards, i.e., platform_get_resource_byname(pdev, IORESOURCE_MEM, "addr_space"); dw_pcie_iatu_detect(pci); [bhelgaas: commit log] Link: https://lore.kernel.org/r/20220624143947.8991-3-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit 14c4ad125cf94ba226556dd5cffbd00c6482c6bd Author: Serge Semin Date: Fri Jun 24 17:39:33 2022 +0300 PCI: dwc: Log link speed and width if it comes up Printing just "link up" isn't very informative for PCI Express. Even if the link is up, bus performance can degrade to slower speeds or to narrower width than both Root Port and its partner is capable of. In that case it would be handy to know the link specifications as early as possible. If the link comes up, log the link speed (PCIe generation) and width. Link: https://lore.kernel.org/r/20220624143947.8991-2-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Manivannan Sadhasivam commit 9de1f9c8ca5100a02a2e271bdbde36202e251b4b Merge: dfea84827f7eb 779fda86bdeb8 Author: Linus Torvalds Date: Mon Aug 1 12:48:15 2022 -0700 Merge tag 'irq-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Updates for interrupt core and drivers: Core: - Fix a few inconsistencies between UP and SMP vs interrupt affinities - Small updates and cleanups all over the place New drivers: - LoongArch interrupt controller - Renesas RZ/G2L interrupt controller Updates: - Hotpath optimization for SiFive PLIC - Workaround for broken PLIC edge triggered interrupts - Simall cleanups and improvements as usual" * tag 'irq-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits) irqchip/mmp: Declare init functions in common header file irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() genirq: Use for_each_action_of_desc in actions_show() irqchip / ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch irqchip: Add LoongArch CPU interrupt controller support irqchip: Add Loongson Extended I/O interrupt controller support irqchip/loongson-liointc: Add ACPI init support irqchip/loongson-pch-msi: Add ACPI init support irqchip/loongson-pch-pic: Add ACPI init support irqchip: Add Loongson PCH LPC controller support LoongArch: Prepare to support multiple pch-pic and pch-msi irqdomain LoongArch: Use ACPI_GENERIC_GSI for gsi handling genirq/generic_chip: Export irq_unmap_generic_chip ACPI: irq: Allow acpi_gsi_to_irq() to have an arch-specific fallback APCI: irq: Add support for multiple GSI domains LoongArch: Provisionally add ACPICA data structures irqdomain: Use hwirq_max instead of revmap_size for NOMAP domains irqdomain: Report irq number for NOMAP domains irqchip/gic-v3: Fix comment typo dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/V2L SoC ... commit 80ef928643c1558a0474389fcd680a5ccd6c86e6 Author: Ammar Faizi Date: Mon Aug 1 18:59:56 2022 +0700 net: devlink: Fix missing mutex_unlock() call Commit 2dec18ad826f forgets to call mutex_unlock() before the function returns in the error path: New smatch warnings: net/core/devlink.c:6392 devlink_nl_cmd_region_new() warn: inconsistent \ returns '®ion->snapshot_lock'. Make sure we call mutex_unlock() in this error path. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 2dec18ad826f ("net: devlink: remove region snapshots list dependency on devlink->lock") Signed-off-by: Ammar Faizi Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20220801115742.1309329-1-ammar.faizi@intel.com Signed-off-by: Jakub Kicinski commit d81c7cdd7a6ddffcc8c00c991e3d6e24db84bd9e Author: Tariq Toukan Date: Mon Aug 1 14:24:44 2022 +0300 net/tls: Remove redundant workqueue flush before destroy destroy_workqueue() safely destroys the workqueue after draining it. No need for the explicit call to flush_workqueue(). Remove it. Signed-off-by: Tariq Toukan Link: https://lore.kernel.org/r/20220801112444.26175-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit dfea84827f7eb49ca41d837d92ac1cbd5353a742 Merge: 63e6053add5a6 cceeeb6a6d02e Author: Linus Torvalds Date: Mon Aug 1 12:37:54 2022 -0700 Merge tag 'timers-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Timers, timekeeping and related drivers update: Core: - Make wait_event_hrtimeout() aware of RT/DL tasks New drivers: - R-Car Gen4 timer - Tegra186 timer - Mediatek MT6795 CPUXGPT timer Updates: - Rework suspend/resume handling in timer drivers so it takes inactive clocks into account. - The usual device tree compatible add ons - Small fixed and cleanups all over the place" * tag 'timers-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) wait: Fix __wait_event_hrtimeout for RT/DL tasks clocksource/drivers/sun5i: Remove unnecessary (void*) conversions dt-bindings: timer: allwinner,sun4i-a10-timer: Add D1 compatible dt-bindings: timer: ingenic,tcu: use absolute path to other schema clocksource/drivers/sun4i: Remove unnecessary (void*) conversions dt-bindings: timer: renesas,cmt: Fix R-Car Gen4 fall-out clocksource/drivers/tegra186: Put Kconfig option 'tristate' to 'bool' clocksource/drivers/timer-ti-dm: Make driver selection bool for TI K3 clocksource/drivers/timer-ti-dm: Add compatible for am6 SoCs clocksource/drivers/timer-ti-dm: Make timer selectable for ARCH_K3 clocksource/drivers/timer-ti-dm: Move inline functions to driver for am6 clocksource/drivers/sh_cmt: Add R-Car Gen4 support dt-bindings: timer: renesas,cmt: R-Car V3U is R-Car Gen4 dt-bindings: timer: renesas,cmt: Add r8a779f0 and generic Gen4 CMT support clocksource/drivers/timer-microchip-pit64b: Fix compilation warnings clocksource/drivers/timer-microchip-pit64b: Use mchp_pit64b_{suspend, resume} clocksource/drivers/timer-microchip-pit64b: Remove suspend/resume ops for ce thermal/drivers/rcar_gen3_thermal: Add r8a779f0 support clocksource/drivers/timer-mediatek: Implement CPUXGPT timers dt-bindings: timer: mediatek: Add CPUX System Timer and MT6795 compatible ... commit 099fd2c2020751737d9288f923d562e0e05977eb Author: Bo Liu Date: Sun Jul 31 21:39:18 2022 -0400 vfio/pci: fix the wrong word This patch fixes a wrong word in comment. Signed-off-by: Bo Liu Link: https://lore.kernel.org/r/20220801013918.2520-1-liubo03@inspur.com Signed-off-by: Alex Williamson commit 4eb919663d97e056dff8963fde22df3b0ad4d02b Author: Eric Farman Date: Thu Jul 28 22:49:14 2022 +0200 vfio/ccw: Check return code from subchannel quiesce If a subchannel is busy when a close is performed, the subchannel needs to be quiesced and left nice and tidy, so nothing unexpected (like a solicited interrupt) shows up while in the closed state. Unfortunately, the return code from this call isn't checked, so any busy subchannel is treated as a failing one. Fix that, so that the close on a busy subchannel happens normally. Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20220728204914.2420989-4-farman@linux.ibm.com Signed-off-by: Alex Williamson commit 96a4c9ecaeac2863d53c086d4b5ec9985ba7154f Author: Eric Farman Date: Thu Jul 28 22:49:13 2022 +0200 vfio/ccw: Remove FSM Close from remove handlers Now that neither vfio_ccw_sch_probe() nor vfio_ccw_mdev_probe() affect the FSM state, it doesn't make sense for their _remove() counterparts try to revert things in this way. Since the FSM open and close are handled alongside MDEV open/close, these are unnecessary. Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20220728204914.2420989-3-farman@linux.ibm.com Signed-off-by: Alex Williamson commit 5a4fe7c41b586399d502f9970b077178e5dfbacf Author: Eric Farman Date: Thu Jul 28 22:49:12 2022 +0200 vfio/ccw: Add length to DMA_UNMAP checks As pointed out with the simplification of the VFIO_IOMMU_NOTIFY_DMA_UNMAP notifier [1], the length parameter was never used to check against the pinned pages. Let's correct that, and see if a page is within the affected range instead of simply the first page of the range. [1] https://lore.kernel.org/kvm/20220720170457.39cda0d0.alex.williamson@redhat.com/ Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20220728204914.2420989-2-farman@linux.ibm.com Signed-off-by: Alex Williamson commit 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Author: Tetsuo Handa Date: Mon Jul 25 22:49:25 2022 +0900 mtd: core: check partition before dereference syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1], for mtdram test device (CONFIG_MTD_MTDRAM) is not partition. Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1] Reported-by: syzbot Reported-by: kernel test robot Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions") Signed-off-by: Tetsuo Handa CC: stable@vger.kernel.org Signed-off-by: Richard Weinberger commit 9661524b9b26a45ecb045d7d36f85e83d8021a86 Merge: e8166841a6996 f8cd9f632f441 Author: Richard Weinberger Date: Mon Aug 1 21:31:22 2022 +0200 Merge tag 'spi-nor/for-5.20' into mtd/next SPI NOR core changes: - move SECT_4K_PMC flag out of the core as it's a vendor specific flag - s/addr_width/addr_nbytes: address width means the number of IO lines used for the address, whereas in the code it is used as the number of address bytes. - do not change nor->addr_nbytes at SFDP parsing time. At the SFDP parsing time we should not change members of struct spi_nor, but instead fill members of struct spi_nor_flash_parameters which could later on be used by the callers. - track flash's internal address mode so that we can use 4B opcodes together with opcodes that don't have a 4B opcode correspondent. SPI NOR manufacturer drivers changes: - esmt: Rename "f25l32qa" flash name to "f25l32qa-2s". - micron-st: Skip FSR reading if SPI controller does not support it to allow flashes that support FSR to work even when attached to such SPI controllers. - spansion: Add s25hl-t/s25hs-t IDs and fixups. commit 2e8f205d910eb1fc59faf24582f3faf774000360 Author: Christophe JAILLET Date: Sun Jul 31 18:34:15 2022 +0200 net: txgbe: Fix an error handling path in txgbe_probe() A pci_enable_pcie_error_reporting() should be balanced by a corresponding pci_disable_pcie_error_reporting() call in the error handling path, as already done in the remove function. Fixes: 3ce7547e5b71 ("net: txgbe: Add build support for txgbe") Signed-off-by: Christophe JAILLET Reviewed-by: Jiawen Wu Link: https://lore.kernel.org/r/082003d00be1f05578c9c6434272ceb314609b8e.1659285240.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit e8166841a6996ac837caa24ee0da9d3f1eaad7be Merge: ad9b10d1eaada e16eceea863b4 Author: Richard Weinberger Date: Mon Aug 1 21:24:54 2022 +0200 Merge remote-tracking branch 'korg_git/nand/next' into mtd/next commit 63e6053add5a6cec4dbfa3dec12e0d4439daac4a Merge: 22a39c3d86930 326ecc15c61c3 Author: Linus Torvalds Date: Mon Aug 1 12:24:30 2022 -0700 Merge tag 'perf-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events updates from Ingo Molnar: - Fix Intel Alder Lake PEBS memory access latency & data source profiling info bugs. - Use Intel large-PEBS hardware feature in more circumstances, to reduce PMI overhead & reduce sampling data. - Extend the lost-sample profiling output with the PERF_FORMAT_LOST ABI variant, which tells tooling the exact number of samples lost. - Add new IBS register bits definitions. - AMD uncore events: Add PerfMonV2 DF (Data Fabric) enhancements. * tag 'perf-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/ibs: Add new IBS register bits into header perf/x86/intel: Fix PEBS data source encoding for ADL perf/x86/intel: Fix PEBS memory access info encoding for ADL perf/core: Add a new read format to get a number of lost samples perf/x86/amd/uncore: Add PerfMonV2 RDPMC assignments perf/x86/amd/uncore: Add PerfMonV2 DF event format perf/x86/amd/uncore: Detect available DF counters perf/x86/amd/uncore: Use attr_update for format attributes perf/x86/amd/uncore: Use dynamic events array x86/events/intel/ds: Enable large PEBS for PERF_SAMPLE_WEIGHT_TYPE commit 062cf5ebc2e8ca8afb9908072493dea314f62862 Author: Xie Shaowen Date: Sat Jul 30 17:22:54 2022 +0800 net: dsa: Fix spelling mistakes and cleanup code fix follow spelling misktakes: desconstructed ==> deconstructed enforcment ==> enforcement Reported-by: Hacash Robot Signed-off-by: Xie Shaowen Link: https://lore.kernel.org/r/20220730092254.3102875-1-studentxswpy@163.com Signed-off-by: Jakub Kicinski commit 4ff7c8fc81cec31c852833b00afe9c85f9086b5d Author: Bagas Sanjaya Date: Sat Jul 30 09:20:57 2022 +0700 Documentation: devlink: add add devlink-selftests to the table of contents Commit 08f588fa301bef ("devlink: introduce framework for selftests") adds documentation for devlink selftests framework, but it is missing from table of contents. Add it. Link: https://lore.kernel.org/linux-doc/202207300406.CUBuyN5i-lkp@intel.com/ Fixes: 08f588fa301bef ("devlink: introduce framework for selftests") Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20220730022058.16813-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 22a39c3d8693001c301d070366435edb04d0778c Merge: b167fdffe9e73 eae6d58d67d97 Author: Linus Torvalds Date: Mon Aug 1 12:15:27 2022 -0700 Merge tag 'locking-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "This was a fairly quiet cycle for the locking subsystem: - lockdep: Fix a handful of the more complex lockdep_init_map_*() primitives that can lose the lock_type & cause false reports. No such mishap was observed in the wild. - jump_label improvements: simplify the cross-arch support of initial NOP patching by making it arch-specific code (used on MIPS only), and remove the s390 initial NOP patching that was superfluous" * tag 'locking-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/lockdep: Fix lockdep_init_map_*() confusion jump_label: make initial NOP patching the special case jump_label: mips: move module NOP patching into arch code jump_label: s390: avoid pointless initial NOP patching commit c7e3548cac4a8a8bc1ad183cc7c7249463dff55f Author: Dan Carpenter Date: Mon Aug 1 13:20:12 2022 +0300 cxl/region: prevent underflow in ways_to_cxl() The "ways" variable comes from the user. The ways_to_cxl() function has an upper bound but it doesn't check for negatives. Make the "ways" variable an unsigned int to fix this bug. Fixes: 80d10a6cee05 ("cxl/region: Add interleave geometry attributes") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yueo3NV2hFCXx1iV@kili [djbw: fixup interleave_ways_store() to only accept unsigned input] Signed-off-by: Dan Williams commit 88ab1dde792aa6a3902e2a30929e00acc99d351a Author: Dan Carpenter Date: Mon Aug 1 13:19:27 2022 +0300 cxl/region: uninitialized variable in alloc_hpa() This should check "p->res" instead of "res" (which is uninitialized). Fixes: 23a22cd1c98b ("cxl/region: Allocate HPA capacity to regions") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yueor88I/DkVSOtL@kili Signed-off-by: Dan Williams commit a41b17ff9dacd22f5f118ee53d82da0f3e52d5e3 Author: Hangyu Hua Date: Fri Jul 29 19:00:27 2022 +0800 dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock In the case of sk->dccps_qpolicy == DCCPQ_POLICY_PRIO, dccp_qpolicy_full will drop a skb when qpolicy is full. And the lock in dccp_sendmsg is released before sock_alloc_send_skb and then relocked after sock_alloc_send_skb. The following conditions may lead dccp_qpolicy_push to add skb to an already full sk_write_queue: thread1--->lock thread1--->dccp_qpolicy_full: queue is full. drop a skb thread1--->unlock thread2--->lock thread2--->dccp_qpolicy_full: queue is not full. no need to drop. thread2--->unlock thread1--->lock thread1--->dccp_qpolicy_push: add a skb. queue is full. thread1--->unlock thread2--->lock thread2--->dccp_qpolicy_push: add a skb! thread2--->unlock Fix this by moving dccp_qpolicy_full. Fixes: b1308dc015eb ("[DCCP]: Set TX Queue Length Bounds via Sysctl") Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220729110027.40569-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski commit 1e02fd7671fe8ef64866e7753659c635192f5061 Merge: 9fe2e6f396068 a86e86db5e6d7 Author: Jakub Kicinski Date: Mon Aug 1 12:09:37 2022 -0700 Merge branch 'net-fix-using-wrong-flags-to-check-features' Guangbin Huang says: ==================== net: fix using wrong flags to check features We find that some drivers may use wrong flags to check features, so fix them. ==================== Link: https://lore.kernel.org/r/20220729101755.4798-1-huangguangbin2@huawei.com Signed-off-by: Jakub Kicinski commit a86e86db5e6d72c82724a63ca1c5293409a21518 Author: Jian Shen Date: Fri Jul 29 18:17:55 2022 +0800 net: ionic: fix error check for vlan flags in ionic_set_nic_features() The prototype of input features of ionic_set_nic_features() is netdev_features_t, but the vlan_flags is using the private definition of ionic drivers. It should use the variable ctx.cmd.lif_setattr.features, rather than features to check the vlan flags. So fixes it. Fixes: beead698b173 ("ionic: Add the basic NDO callbacks for netdev support") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Acked-by: Shannon Nelson Signed-off-by: Jakub Kicinski commit 7dc839fe47611e6995f370cae37b9797cf7d2672 Author: Jian Shen Date: Fri Jul 29 18:17:54 2022 +0800 net: ice: fix error NETIF_F_HW_VLAN_CTAG_FILTER check in ice_vsi_sync_fltr() vsi->current_netdev_flags is used store the current net device flags, not the active netdevice features. So it should use vsi->netdev->featurs, rather than vsi->current_netdev_flags to check NETIF_F_HW_VLAN_CTAG_FILTER. Fixes: 1babaf77f49d ("ice: Advertise 802.1ad VLAN filtering and offloads for PF netdev") Signed-off-by: Jian Shen Signed-off-by: Guangbin Huang Acked-by: Tony Nguyen Signed-off-by: Jakub Kicinski commit 45490ce2ff833c4ec0de66705e46ba41320860cb Author: Baowen Zheng Date: Fri Jul 29 11:16:41 2022 +0200 nfp: flower: add support for tunnel offload without key ID Currently nfp driver will reject to offload tunnel key action without tunnel key ID which means tunnel ID is 0. But it is a normal case for tc flower since user can setup a tunnel with tunnel ID is 0. So we need to support this case to accept tunnel key action without tunnel key ID. Signed-off-by: Baowen Zheng Reviewed-by: Louis Peens Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220729091641.354748-1-simon.horman@corigine.com Signed-off-by: Jakub Kicinski commit f157cfa3a589f6900c81c90620eb895253705e59 Merge: 9936e07eaf5b7 2df91e397d85c Author: Jakub Kicinski Date: Mon Aug 1 11:59:25 2022 -0700 Merge branch 'net-rose-fix-module-unload-issues' Eric Dumazet says: ==================== net: rose: fix module unload issues Bernard Pidoux reported that unloading rose module could lead to infamous "unregistered_netdevice:" issues. First patch is the fix, stable candidate. Second patch is adding netdev ref tracker to af_rose. I chose net-next to not inflict merge conflicts, because Jakub changed dev_put_track() to netdev_put_track() in net-next. ==================== Link: https://lore.kernel.org/r/20220729091233.1030680-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2df91e397d85cd4c5206ab48d4e398e338db02d7 Author: Eric Dumazet Date: Fri Jul 29 09:12:33 2022 +0000 net: rose: add netdev ref tracker to 'struct rose_sock' This will help debugging netdevice refcount problems with CONFIG_NET_DEV_REFCNT_TRACKER=y Signed-off-by: Eric Dumazet Cc: Tested-by: Bernard Pidoux Signed-off-by: Jakub Kicinski commit 931027820e4dafabc78aff82af59f8c1c4bd3128 Author: Eric Dumazet Date: Fri Jul 29 09:12:32 2022 +0000 net: rose: fix netdev reference changes Bernard reported that trying to unload rose module would lead to infamous messages: unregistered_netdevice: waiting for rose0 to become free. Usage count = xx This patch solves the issue, by making sure each socket referring to a netdevice holds a reference count on it, and properly releases it in rose_release(). rose_dev_first() is also fixed to take a device reference before leaving the rcu_read_locked section. Following patch will add ref_tracker annotations to ease future bug hunting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Bernard Pidoux Signed-off-by: Eric Dumazet Tested-by: Bernard Pidoux Signed-off-by: Jakub Kicinski commit b167fdffe9e737007cbf7c691cde5fa489ca58d7 Merge: 0dd1cabe8a4a5 c17a6ff932135 Author: Linus Torvalds Date: Mon Aug 1 11:49:06 2022 -0700 Merge tag 'sched-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Load-balancing improvements: - Improve NUMA balancing on AMD Zen systems for affine workloads. - Improve the handling of reduced-capacity CPUs in load-balancing. - Energy Model improvements: fix & refine all the energy fairness metrics (PELT), and remove the conservative threshold requiring 6% energy savings to migrate a task. Doing this improves power efficiency for most workloads, and also increases the reliability of energy-efficiency scheduling. - Optimize/tweak select_idle_cpu() to spend (much) less time searching for an idle CPU on overloaded systems. There's reports of several milliseconds spent there on large systems with large workloads ... [ Since the search logic changed, there might be behavioral side effects. ] - Improve NUMA imbalance behavior. On certain systems with spare capacity, initial placement of tasks is non-deterministic, and such an artificial placement imbalance can persist for a long time, hurting (and sometimes helping) performance. The fix is to make fork-time task placement consistent with runtime NUMA balancing placement. Note that some performance regressions were reported against this, caused by workloads that are not memory bandwith limited, which benefit from the artificial locality of the placement bug(s). Mel Gorman's conclusion, with which we concur, was that consistency is better than random workload benefits from non-deterministic bugs: "Given there is no crystal ball and it's a tradeoff, I think it's better to be consistent and use similar logic at both fork time and runtime even if it doesn't have universal benefit." - Improve core scheduling by fixing a bug in sched_core_update_cookie() that caused unnecessary forced idling. - Improve wakeup-balancing by allowing same-LLC wakeup of idle CPUs for newly woken tasks. - Fix a newidle balancing bug that introduced unnecessary wakeup latencies. ABI improvements/fixes: - Do not check capabilities and do not issue capability check denial messages when a scheduler syscall doesn't require privileges. (Such as increasing niceness.) - Add forced-idle accounting to cgroups too. - Fix/improve the RSEQ ABI to not just silently accept unknown flags. (No existing tooling is known to have learned to rely on the previous behavior.) - Depreciate the (unused) RSEQ_CS_FLAG_NO_RESTART_ON_* flags. Optimizations: - Optimize & simplify leaf_cfs_rq_list() - Micro-optimize set_nr_{and_not,if}_polling() via try_cmpxchg(). Misc fixes & cleanups: - Fix the RSEQ self-tests on RISC-V and Glibc 2.35 systems. - Fix a full-NOHZ bug that can in some cases result in the tick not being re-enabled when the last SCHED_RT task is gone from a runqueue but there's still SCHED_OTHER tasks around. - Various PREEMPT_RT related fixes. - Misc cleanups & smaller fixes" * tag 'sched-core-2022-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (32 commits) rseq: Kill process when unknown flags are encountered in ABI structures rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags sched/core: Fix the bug that task won't enqueue into core tree when update cookie nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() sched/core: Always flush pending blk_plug sched/fair: fix case with reduced capacity CPU sched/core: Use try_cmpxchg in set_nr_{and_not,if}_polling sched/core: add forced idle accounting for cgroups sched/fair: Remove the energy margin in feec() sched/fair: Remove task_util from effective utilization in feec() sched/fair: Use the same cpumask per-PD throughout find_energy_efficient_cpu() sched/fair: Rename select_idle_mask to select_rq_mask sched, drivers: Remove max param from effective_cpu_util()/sched_cpu_util() sched/fair: Decay task PELT values during wakeup migration sched/fair: Provide u64 read for 32-bits arch helper sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg sched: only perform capability check on privileged operation sched: Remove unused function group_first_cpu() sched/fair: Remove redundant word " *" selftests/rseq: check if libc rseq support is registered ... commit 0dd1cabe8a4a568252ca70f7530c3ca10e728513 Merge: 0cec3f24a7ced 3041808b52203 Author: Linus Torvalds Date: Mon Aug 1 11:46:58 2022 -0700 Merge tag 'slab-for-5.20_or_6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - An addition of 'accounted' flag to slab allocation tracepoints to indicate memcg_kmem accounting, by Vasily - An optimization of memcg handling in freeing paths, by Muchun - Various smaller fixes and cleanups * tag 'slab-for-5.20_or_6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab_common: move generic bulk alloc/free functions to SLOB mm/sl[au]b: use own bulk free function when bulk alloc failed mm: slab: optimize memcg_slab_free_hook() mm/tracing: add 'accounted' entry into output of allocation tracepoints tools/vm/slabinfo: Handle files in debugfs mm/slub: Simplify __kmem_cache_alias() mm, slab: fix bad alignments commit 1e1613f64cc8a09d7a60ad01450c3321ca4ad454 Author: Andres Freund Date: Sun Jul 31 18:38:34 2022 -0700 tools bpftool: Don't display disassembler-four-args feature test The feature check does not seem important enough to display. Requested-by: Jiri Olsa Signed-off-by: Andres Freund Acked-by: Quentin Monnet Tested-by: Arnaldo Carvalho de Melo Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-9-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit 600b7b26c07a070d0153daa76b3806c1e52c9e00 Author: Andres Freund Date: Sun Jul 31 18:38:33 2022 -0700 tools bpftool: Fix compilation error with new binutils binutils changed the signature of init_disassemble_info(), which now causes compilation to fail for tools/bpf/bpftool/jit_disasm.c, e.g. on debian unstable. Relevant binutils commit: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=60a3da00bd5407f07 Wire up the feature test and switch to init_disassemble_info_compat(), which were introduced in prior commits, fixing the compilation failure. I verified that bpftool can still disassemble bpf programs, both with an old and new dis-asm.h API. There are no output changes for plain and json formats. When comparing the output from old binutils (2.35) to new bintuils with the patch (upstream snapshot) there are a few output differences, but they are unrelated to this patch. An example hunk is: 2f: pop %r14 31: pop %r13 33: pop %rbx - 34: leaveq - 35: retq + 34: leave + 35: ret Signed-off-by: Andres Freund Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Jiri Olsa Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-8-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit bab211f637dc52cfbae1f0f15a6aef71d7f35a1b Author: Andres Freund Date: Sun Jul 31 18:38:32 2022 -0700 tools bpf_jit_disasm: Don't display disassembler-four-args feature test The feature check does not seem important enough to display. Suggested-by: Jiri Olsa Signed-off-by: Andres Freund Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Daniel Borkmann Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-7-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit 96ed066054abf11c7d3e106e3011a51f3f1227a3 Author: Andres Freund Date: Sun Jul 31 18:38:31 2022 -0700 tools bpf_jit_disasm: Fix compilation error with new binutils binutils changed the signature of init_disassemble_info(), which now causes compilation to fail for tools/bpf/bpf_jit_disasm.c, e.g. on debian unstable. Relevant binutils commit: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=60a3da00bd5407f07 Wire up the feature test and switch to init_disassemble_info_compat(), which were introduced in prior commits, fixing the compilation failure. I verified that bpf_jit_disasm can still disassemble bpf programs, both with the old and new dis-asm.h API. With old binutils there's no change in output before/after this patch. When comparing the output from old binutils (2.35) to new bintuils with the patch (upstream snapshot) there are a few output differences, but they are unrelated to this patch. An example hunk is: f4: mov %r14,%rsi f7: mov %r15,%rdx fa: mov $0x2a,%ecx - ff: callq 0xffffffffea8c4988 + ff: call 0xffffffffea8c4988 104: test %rax,%rax 107: jge 0x0000000000000110 109: xor %eax,%eax - 10b: jmpq 0x0000000000000073 + 10b: jmp 0x0000000000000073 110: cmp $0x16,%rax However, I had to use an older kernel to generate the bpf_jit_enabled = 2 output, as that has been broken since 5.18 / 1022a5498f6f745c ("bpf, x86_64: Use bpf_jit_binary_pack_alloc"). https://lore.kernel.org/20220703030210.pmjft7qc2eajzi6c@alap3.anarazel.de Signed-off-by: Andres Freund Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Daniel Borkmann Cc: Jiri Olsa Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-6-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit 83aa0120487e8bc3f231e72c460add783f71f17c Author: Andres Freund Date: Sun Jul 31 18:38:30 2022 -0700 tools perf: Fix compilation error with new binutils binutils changed the signature of init_disassemble_info(), which now causes compilation failures for tools/perf/util/annotate.c, e.g. on debian unstable. Relevant binutils commit: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=60a3da00bd5407f07 Wire up the feature test and switch to init_disassemble_info_compat(), which were introduced in prior commits, fixing the compilation failure. I verified that perf can still disassemble bpf programs by using bpftrace under load, recording a perf trace, and then annotating the bpf "function" with and without the changes. With old binutils there's no change in output before/after this patch. When comparing the output from old binutils (2.35) to new bintuils with the patch (upstream snapshot) there are a few output differences, but they are unrelated to this patch. An example hunk is: 1.15 : 55:mov %rbp,%rdx 0.00 : 58:add $0xfffffffffffffff8,%rdx 0.00 : 5c:xor %ecx,%ecx - 1.03 : 5e:callq 0xffffffffe12aca3c + 1.03 : 5e:call 0xffffffffe12aca3c 0.00 : 63:xor %eax,%eax - 2.18 : 65:leaveq - 2.82 : 66:retq + 2.18 : 65:leave + 2.82 : 66:ret Signed-off-by: Andres Freund Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Jiri Olsa Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-5-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit a45b3d6926231c3d024ea0de4f7bd967f83709ee Author: Andres Freund Date: Sun Jul 31 18:38:29 2022 -0700 tools include: add dis-asm-compat.h to handle version differences binutils changed the signature of init_disassemble_info(), which now causes compilation failures for tools/{perf,bpf}, e.g. on debian unstable. Relevant binutils commit: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=60a3da00bd5407f07 This commit introduces a wrapper for init_disassemble_info(), to avoid spreading #ifdef DISASM_INIT_STYLED to a bunch of places. Subsequent commits will use it to fix the build failures. It likely is worth adding a wrapper for disassember(), to avoid the already existing DISASM_FOUR_ARGS_SIGNATURE ifdefery. Signed-off-by: Andres Freund Signed-off-by: Ben Hutchings Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Jiri Olsa Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-4-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit 516ddaadb42405a2713d21eb1a384e88e557440a Author: Andres Freund Date: Sun Jul 31 18:38:28 2022 -0700 tools build: Don't display disassembler-four-args feature test The feature check does not seem important enough to display. Suggested by Jiri Olsa. Signed-off-by: Andres Freund Acked-by: Quentin Monnet Tested-by: Arnaldo Carvalho de Melo Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Jiri Olsa Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-3-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit cfd59ca91467056bb2c36907b2fa67b8e1af9952 Author: Andres Freund Date: Sun Jul 31 18:38:27 2022 -0700 tools build: Add feature test for init_disassemble_info API changes binutils changed the signature of init_disassemble_info(), which now causes compilation failures for tools/{perf,bpf}, e.g. on debian unstable. Relevant binutils commit: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=60a3da00bd5407f07 This commit adds a feature test to detect the new signature. Subsequent commits will use it to fix the build failures. Signed-off-by: Andres Freund Acked-by: Quentin Monnet Cc: Alexei Starovoitov Cc: Ben Hutchings Cc: Jiri Olsa Cc: Quentin Monnet Cc: Sedat Dilek Cc: bpf@vger.kernel.org Link: http://lore.kernel.org/lkml/20220622181918.ykrs5rsnmx3og4sv@alap3.anarazel.de Link: https://lore.kernel.org/r/20220801013834.156015-2-andres@anarazel.de Signed-off-by: Arnaldo Carvalho de Melo commit aa16fb4b9e7e1057008d999138e7ae68a40bf167 Author: Xiu Jianfeng Date: Fri Jun 10 17:23:07 2022 +0800 smack: Remove the redundant lsm_inode_alloc It's not possible for inode->i_security to be NULL here because every inode will call inode_init_always and then lsm_inode_alloc to alloc memory for inode->security, this is what LSM infrastructure management do, so remove this redundant code. Signed-off-by: Xiu Jianfeng Signed-off-by: Casey Schaufler commit 63c3b5d2ca96b4a2a88ae01bea94021e874ce8fe Author: GONG, Ruiqi Date: Mon Jun 6 16:17:14 2022 +0800 smack: Replace kzalloc + strncpy with kstrndup Simplify the code by using kstrndup instead of kzalloc and strncpy in smk_parse_smack(), which meanwhile remove strncpy as [1] suggests. [1]: https://github.com/KSPP/linux/issues/90 Signed-off-by: GONG, Ruiqi Signed-off-by: Casey Schaufler commit 9936e07eaf5b764ff36c5677644bb5d556fb7e45 Merge: ad3564ccc3670 d8fae2504efee Author: Jakub Kicinski Date: Mon Aug 1 11:15:39 2022 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2022-07-28 Jacob Keller says: Convert all of the Intel drivers with PTP support to the newer .adjfine implementation which uses scaled parts per million. This improves the precision of the frequency adjustments by taking advantage of the full scaled parts per million input coming from user space. In addition, all implementations are converted to using the mul_u64_u64_div_u64 function which better handles the intermediate value. This function supports architecture specific instructions where possible to avoid loss of precision if the normal 64-bit multiplication would overflow. Of note, the i40e implementation is now able to avoid loss of precision on slower link speeds by taking advantage of this to multiply by the link speed factor first. This results in a significantly more precise adjustment by allowing the calculation to impact the lower bits. This also gets us a step closer to being able to remove the .adjfreq entirely by removing its use from many drivers. I plan to follow this up with a series to update the drivers from other vendors and drop the .adjfreq implementation entirely. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: igb: convert .adjfreq to .adjfine ixgbe: convert .adjfreq to .adjfine i40e: convert .adjfreq to .adjfine i40e: use mul_u64_u64_div_u64 for PTP frequency calculation e1000e: convert .adjfreq to .adjfine e1000e: remove unnecessary range check in e1000e_phc_adjfreq ice: implement adjfine with mul_u64_u64_div_u64 ==================== Link: https://lore.kernel.org/r/20220728181836.3387862-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ad3564ccc3670843c913b01ada77c167233bd5b5 Author: Wei Fang Date: Wed Jul 27 00:38:51 2022 +1000 dt-bindings: net: fsl,fec: Add i.MX8ULP FEC items Add fsl,imx8ulp-fec for i.MX8ULP platform. Signed-off-by: Wei Fang Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/all/20220726143853.23709-2-wei.fang@nxp.com/ Signed-off-by: Jakub Kicinski commit 5abbb7b92820cf6ba9154a35cff6d64b62d7f273 Author: David Sterba Date: Tue Jul 12 23:30:05 2022 +0200 affs: use memcpy_to_page and remove replace kmap_atomic() The use of kmap() is being deprecated in favor of kmap_local_page() where it is feasible. For kmap around a memcpy there's a convenience helper memcpy_to_page that also makes the flush_dcache_page() redundant. CC: Fabio M. De Francesco Reviewed-by: Ira Weiny Signed-off-by: David Sterba commit 00b32625982e0c796f0abb8effcac9c05ef55bd3 Author: Namhyung Kim Date: Fri Jul 1 16:09:32 2022 -0700 perf test: Add ARM SPE system wide test In the past it had a problem not setting the pid/tid on the sample correctly when system-wide mode is used. Although it's fixed now it'd be nice if we have a test case for it. Reviewed-by: German Gomez Signed-off-by: Namhyung Kim Tested-by: Leo Yan Cc: German Gomez Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mike Leach Cc: Peter Zijlstra Cc: Will Deacon Link: https://lore.kernel.org/r/20220701230932.1000495-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5f4e821c6c90dd6d471981735cec456f669f0e59 Author: Jiri Olsa Date: Thu Jun 16 22:22:14 2022 +0200 perf tools: Rework prologue generation code Some functions we use for bpf prologue generation are going to be deprecated. This change reworks current code not to use them. We need to replace following functions/struct: bpf_program__set_prep bpf_program__nth_fd struct bpf_prog_prep_result Currently we use bpf_program__set_prep to hook perf callback before program is loaded and provide new instructions with the prologue. We replace this function/ality by taking instructions for specific program, attaching prologue to them and load such new ebpf programs with prologue using separate bpf_prog_load calls (outside libbpf load machinery). Before we can take and use program instructions, we need libbpf to actually load it. This way we get the final shape of its instructions with all relocations and verifier adjustments). There's one glitch though.. perf kprobe program already assumes generated prologue code with proper values in argument registers, so loading such program directly will fail in the verifier. That's where the fallback pre-load handler fits in and prepends the initialization code to the program. Once such program is loaded we take its instructions, cut off the initialization code and prepend the prologue. I know.. sorry ;-) To have access to the program when loading this patch adds support to register 'fallback' section handler to take care of perf kprobe programs. The fallback means that it handles any section definition besides the ones that libbpf handles. The handler serves two purposes: - allows perf programs to have special arguments in section name - allows perf to use pre-load callback where we can attach init code (zeroing all argument registers) to each perf program Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Acked-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Ian Rogers Cc: Ingo Molnar Cc: John Fastabend Cc: Martin KaFai Lau Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Yonghong Song Cc: bpf@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lore.kernel.org/r/20220616202214.70359-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8b1e1a0347ea299b038f83dcfcd799508aa42d68 Author: Jiri Olsa Date: Mon Jul 4 17:27:21 2022 +0200 perf bpf: Convert legacy map definition to BTF-defined The libbpf is switching off support for legacy map definitions [1], which will break the perf llvm tests. Moving the base source map definition to BTF-defined, so we need to use -g compile option for to add debug/BTF info. [1] https://lore.kernel.org/bpf/20220627211527.2245459-1-andrii@kernel.org/ Signed-off-by: Jiri Olsa Acked-by: Andrii Nakryiko Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20220704152721.352046-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0cec3f24a7cedc726f8790d693aaff2c535dc4ce Merge: a82c58cf1a556 892f7237b3ffb Author: Linus Torvalds Date: Mon Aug 1 10:37:00 2022 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "Highlights include a major rework of our kPTI page-table rewriting code (which makes it both more maintainable and considerably faster in the cases where it is required) as well as significant changes to our early boot code to reduce the need for data cache maintenance and greatly simplify the KASLR relocation dance. Summary: - Remove unused generic cpuidle support (replaced by PSCI version) - Fix documentation describing the kernel virtual address space - Handling of some new CPU errata in Arm implementations - Rework of our exception table code in preparation for handling machine checks (i.e. RAS errors) more gracefully - Switch over to the generic implementation of ioremap() - Fix lockdep tracking in NMI context - Instrument our memory barrier macros for KCSAN - Rework of the kPTI G->nG page-table repainting so that the MMU remains enabled and the boot time is no longer slowed to a crawl for systems which require the late remapping - Enable support for direct swapping of 2MiB transparent huge-pages on systems without MTE - Fix handling of MTE tags with allocating new pages with HW KASAN - Expose the SMIDR register to userspace via sysfs - Continued rework of the stack unwinder, particularly improving the behaviour under KASAN - More repainting of our system register definitions to match the architectural terminology - Improvements to the layout of the vDSO objects - Support for allocating additional bits of HWCAP2 and exposing FEAT_EBF16 to userspace on CPUs that support it - Considerable rework and optimisation of our early boot code to reduce the need for cache maintenance and avoid jumping in and out of the kernel when handling relocation under KASLR - Support for disabling SVE and SME support on the kernel command-line - Support for the Hisilicon HNS3 PMU - Miscellanous cleanups, trivial updates and minor fixes" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (136 commits) arm64: Delay initialisation of cpuinfo_arm64::reg_{zcr,smcr} arm64: fix KASAN_INLINE arm64/hwcap: Support FEAT_EBF16 arm64/cpufeature: Store elf_hwcaps as a bitmap rather than unsigned long arm64/hwcap: Document allocation of upper bits of AT_HWCAP arm64: enable THP_SWAP for arm64 arm64/mm: use GENMASK_ULL for TTBR_BADDR_MASK_52 arm64: errata: Remove AES hwcap for COMPAT tasks arm64: numa: Don't check node against MAX_NUMNODES drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX perf: RISC-V: Add of_node_put() when breaking out of for_each_of_cpu_node() docs: perf: Include hns3-pmu.rst in toctree to fix 'htmldocs' WARNING arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" mm: kasan: Skip page unpoisoning only if __GFP_SKIP_KASAN_UNPOISON mm: kasan: Skip unpoisoning of user pages mm: kasan: Ensure the tags are visible before the tag in page->flags drivers/perf: hisi: add driver for HNS3 PMU drivers/perf: hisi: Add description for HNS3 PMU driver drivers/perf: riscv_pmu_sbi: perf format perf/arm-cci: Use the bitmap API to allocate bitmaps ... commit a82c58cf1a5560988d8b9b8abcd982e90a5fdaa4 Merge: 60ee49fac8177 b508128bb0d1e Author: Linus Torvalds Date: Mon Aug 1 10:32:06 2022 -0700 Merge tag 'm68k-for-v5.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Use RNG seed from bootinfo block on virt platform - defconfig updates - Minor fixes and improvements * tag 'm68k-for-v5.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v5.19-rc1 m68k: Add common forward declaration for show_registers() m68k: mac: Remove forward declaration for mac_nmi_handler() m68k: virt: Fix missing platform_device_unregister() on error in virt_platform_init() m68k: virt: Use RNG seed from bootinfo block m68k: bitops: Change __fls to return and accept unsigned long m68k: Kconfig.machine: Add endif comment m68k: Kconfig.debug: Replace single quotes m68k: Kconfig.cpu: Fix indentation and add endif comments m68k: q40: Align '*' in comments m68k: sun3: Use __func__ to get function's name in an output message m68k: mac: Fix typos in comments m68k: virt: Kconfig minor fixes commit 60ee49fac817754a465a16b837347d1e9b7b090e Merge: 8b7054528cd5a 68b8e9713c8ec Author: Linus Torvalds Date: Mon Aug 1 10:17:19 2022 -0700 Merge tag 'x86_kdump_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 kdump updates from Borislav Petkov: - Add the ability to pass early an RNG seed to the kernel from the boot loader - Add the ability to pass the IMA measurement of kernel and bootloader to the kexec-ed kernel * tag 'x86_kdump_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/setup: Use rng seeds from setup_data x86/kexec: Carry forward IMA measurement log on kexec commit 8b7054528cd5ac96383aa89315670d74865c8dc2 Merge: ecf9b7bfea60c 2d17bd24b0169 Author: Linus Torvalds Date: Mon Aug 1 10:14:19 2022 -0700 Merge tag 'x86_build_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Borislav Petkov: - Fix stack protector builds when cross compiling with Clang - Other Kbuild improvements and fixes * tag 'x86_build_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/purgatory: Omit use of bin2c x86/purgatory: Hard-code obj-y in Makefile x86/build: Remove unused OBJECT_FILES_NON_STANDARD_test_nx.o x86/Kconfig: Fix CONFIG_CC_HAS_SANE_STACKPROTECTOR when cross compiling with clang commit ecf9b7bfea60ca816b2b44716e3f1dde148ea196 Merge: 98b1783de202f a1a5482a2c6e3 Author: Linus Torvalds Date: Mon Aug 1 10:04:00 2022 -0700 Merge tag 'x86_core_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 core updates from Borislav Petkov: - Have invalid MSR accesses warnings appear only once after a pr_warn_once() change broke that - Simplify {JMP,CALL}_NOSPEC and let the objtool retpoline patching infra take care of them instead of having unreadable alternative macros there * tag 'x86_core_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/extable: Fix ex_handler_msr() print condition x86,nospec: Simplify {JMP,CALL}_NOSPEC commit 98b1783de202f3e82be7f32dcdc10a3d270b90e5 Merge: 42efa5e3a8888 d906fa7308274 Author: Linus Torvalds Date: Mon Aug 1 10:00:43 2022 -0700 Merge tag 'x86_misc_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: - Add a bunch of PCI IDs for new AMD CPUs and use them in k10temp - Free the pmem platform device on the registration error path * tag 'x86_misc_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hwmon: (k10temp): Add support for new family 17h and 19h models x86/amd_nb: Add AMD PCI IDs for SMN communication x86/pmem: Fix platform-device leak in error path commit 42efa5e3a8888c45c15fc5a567cd77049a2e30f1 Merge: 650ea1f626ab4 3f2adf00f52b5 Author: Linus Torvalds Date: Mon Aug 1 09:49:29 2022 -0700 Merge tag 'x86_cpu_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Borislav Petkov: - Remove the vendor check when selecting MWAIT as the default idle state - Respect idle=nomwait when supplied on the kernel cmdline - Two small cleanups * tag 'x86_cpu_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Use MSR_IA32_MISC_ENABLE constants x86: Fix comment for X86_FEATURE_ZEN x86: Remove vendor checks from prefer_mwait_c1_over_halt x86: Handle idle=nomwait cmdline properly for x86_idle commit 6431e92fc827bdd2d28f79150d90415ba9ce0d21 Author: Helge Deller Date: Mon Aug 1 17:36:15 2022 +0200 parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode For all syscalls in 32-bit compat mode on 64-bit kernels the upper 32-bits of the 64-bit registers are zeroed out, so a negative 32-bit signed value will show up as positive 64-bit signed value. This behaviour breaks the io_pgetevents_time64() syscall which expects signed 64-bit values for the "min_nr" and "nr" parameters. Fix this by switching to the compat_sys_io_pgetevents_time64() syscall, which uses "compat_long_t" types for those parameters. Cc: # v5.1+ Signed-off-by: Helge Deller commit cbe263b6b0eb1309adf6c7e5dbd53e2dbd81736b Author: Jason Wang Date: Sat Jul 23 17:23:41 2022 +0800 parisc: Drop zero variable initialisations in mm/init.c Initialise global and static variable to 0 is always unnecessary. Remove the unnecessary initialisations. Signed-off-by: Jason Wang Signed-off-by: Helge Deller commit b9e28d3c249211ec4d2de646975c32f22e5c201d Author: Xin Gao Date: Thu Jul 21 03:39:41 2022 +0800 parisc: Do not initialise statics to 0 Signed-off-by: Xin Gao Signed-off-by: Helge Deller commit cf59f34d7f978d14d6520fd80a78a5ad5cb8abf8 Author: William Dean Date: Fri Jul 22 10:57:09 2022 +0800 parisc: Check the return value of ioremap() in lba_driver_probe() The function ioremap() in lba_driver_probe() can fail, so its return value should be checked. Fixes: 4bdc0d676a643 ("remove ioremap_nocache and devm_ioremap_nocache") Reported-by: Hacash Robot Signed-off-by: William Dean Signed-off-by: Helge Deller Cc: # v5.6+ commit 3fbc9a7de0564c55d8a9584c9cd2c9dfe6bd6d43 Author: Helge Deller Date: Tue Jul 19 06:19:41 2022 +0200 parisc: Drop pa_swapper_pg_lock spinlock This spinlock was dropped with commit b7795074a046 ("parisc: Optimize per-pagetable spinlocks") in kernel v5.12. Remove it to silence a sparse warning. Signed-off-by: Helge Deller Reported-by: kernel test robot Cc: # v5.12+ commit 16bf37bf49ba293ab1c445db22b78a02fa48e1db Author: Jason Wang Date: Fri Jul 15 12:49:15 2022 +0800 parisc: Fix comment typo in fault.c The double `the' is duplicated in line 41, remove one. Signed-off-by: Jason Wang Signed-off-by: Helge Deller commit cab56b51ec0e69128909cef4650e1907248d821b Author: Helge Deller Date: Mon Jul 18 17:06:47 2022 +0200 parisc: Fix device names in /proc/iomem Fix the output of /proc/iomem to show the real hardware device name including the pa_pathname, e.g. "Merlin 160 Core Centronics [8:16:0]". Up to now only the pa_pathname ("[8:16.0]") was shown. Signed-off-by: Helge Deller Cc: # v4.9+ commit b383d94ad7ca52b9bf6c80fce6e9914b00527695 Author: Helge Deller Date: Mon Jul 18 17:29:38 2022 +0200 parisc: Clean up names in hardware database Stop guessing and just use the names for the hardware we know so far. Signed-off-by: Helge Deller commit 650ea1f626ab4d939fda00b7cca57698dcf57e5e Merge: 92598ae22f582 9f01129382774 Author: Linus Torvalds Date: Mon Aug 1 09:36:18 2022 -0700 Merge tag 'x86_fpu_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu update from Borislav Petkov: - Add machinery to initialize AMX register state in order for AMX-capable CPUs to be able to enter deeper low-power state * tag 'x86_fpu_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: intel_idle: Add a new flag to initialize the AMX state x86/fpu: Add a helper to prepare AMX state for low-power CPU idle commit 92598ae22f582547ebb060cf76f5869bc9780b80 Merge: 94e37e8489190 8f1d56f64f8d6 Author: Linus Torvalds Date: Mon Aug 1 09:34:39 2022 -0700 Merge tag 'x86_mm_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Borislav Petkov: - Rename a PKRU macro to make more sense when reading the code - Update pkeys documentation - Avoid reading contended mm's TLB generation var if not absolutely necessary along with fixing a case where arch_tlbbatch_flush() doesn't adhere to the generation scheme and thus violates the conditions for the above avoidance. * tag 'x86_mm_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/tlb: Ignore f->new_tlb_gen when zero x86/pkeys: Clarify PKRU_AD_KEY macro Documentation/protection-keys: Clean up documentation for User Space pkeys x86/mm/tlb: Avoid reading mm_tlb_gen when possible commit 94e37e84891900f56a01f49ac173bcb15e42e461 Merge: dbc1f5a9f42a9 9de76f41ea218 Author: Linus Torvalds Date: Mon Aug 1 09:33:17 2022 -0700 Merge tag 'x86_cleanups_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanup from Borislav Petkov: - A single CONFIG_ symbol correction in a comment * tag 'x86_cleanups_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Refer to the intended config STRICT_DEVMEM in a comment commit dbc1f5a9f42a9bb31b84bba4d40ced21952d505a Merge: 296d3b3e05ec8 4745ca43104b4 Author: Linus Torvalds Date: Mon Aug 1 09:31:49 2022 -0700 Merge tag 'x86_vmware_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vmware cleanup from Borislav Petkov: - A single statement simplification by using the BIT() macro * tag 'x86_vmware_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vmware: Use BIT() macro for shifting commit 296d3b3e05ec8aafb279acea3e8d7e86974795a7 Merge: 0fac198def2b4 891e465a1bd87 Author: Linus Torvalds Date: Mon Aug 1 09:29:41 2022 -0700 Merge tag 'ras_core_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS update from Borislav Petkov: "A single RAS change: - Probe whether hardware error injection (direct MSR writes) is possible when injecting errors on AMD platforms. In some cases, the platform could prohibit those" * tag 'ras_core_for_v6.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Check whether writes to MCA_STATUS are getting ignored commit 7913145afa51bbed9eaf8e5b4ee55fa9884a71e5 Author: Xu Qiang Date: Mon Aug 1 12:05:06 2022 +0000 of/fdt: declared return type does not match actual return type The commit 649cab56de8e (“of: properly check for error returned by fdt_get_name()”) changed the return value type from bool to int, but forgot to change the return value simultaneously. populate_node was only called in unflatten_dt_nodes, and returns with values greater than or equal to 0 were discarded without further processing. Considering that return 0 usually indicates success, return 0 instead of return true. Fixes: 649cab56de8e (“of: properly check for error returned by fdt_get_name()”) Signed-off-by: Xu Qiang Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220801120506.11461-2-xuqiang36@huawei.com commit 0fac198def2b41138850867b6aa92044c76ff802 Merge: bdfae5ce3820e ba40a57ff08bf Author: Linus Torvalds Date: Mon Aug 1 09:10:07 2022 -0700 Merge tag 'fs.idmapped.overlay.acl.v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull acl updates from Christian Brauner: "Last cycle we introduced support for mounting overlayfs on top of idmapped mounts. While looking into additional testing we realized that posix acls don't really work correctly with stacking filesystems on top of idmapped layers. We already knew what the fix were but it would require work that is more suitable for the merge window so we turned off posix acls for v5.19 for overlayfs on top of idmapped layers with Miklos routing my patch upstream in 72a8e05d4f66 ("Merge tag 'ovl-fixes-5.19-rc7' [..]"). This contains the work to support posix acls for overlayfs on top of idmapped layers. Since the posix acl fixes should use the new vfs{g,u}id_t work the associated branch has been merged in. (We sent a pull request for this earlier.) We've also pulled in Miklos pull request containing my patch to turn of posix acls on top of idmapped layers. This allowed us to avoid rebasing the branch which we didn't like because we were already at rc7 by then. Merging it in allows this branch to first fix posix acls and then to cleanly revert the temporary fix it brought in by commit 4a47c6385bb4 ("ovl: turn of SB_POSIXACL with idmapped layers temporarily"). The last patch in this series adds Seth Forshee as a co-maintainer for idmapped mounts. Seth has been integral to all of this work and is also the main architect behind the filesystem idmapping work which ultimately made filesystems such as FUSE and overlayfs available in containers. He continues to be active in both development and review. I'm very happy he decided to help and he has my full trust. This increases the bus factor which is always great for work like this. I'm honestly very excited about this because I think in general we don't do great in the bringing on new maintainers department" For more explanations of the ACL issues, see https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org/ * tag 'fs.idmapped.overlay.acl.v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: Add Seth Forshee as co-maintainer for idmapped mounts Revert "ovl: turn of SB_POSIXACL with idmapped layers temporarily" ovl: handle idmappings in ovl_get_acl() acl: make posix_acl_clone() available to overlayfs acl: port to vfs{g,u}id_t acl: move idmapped mount fixup into vfs_{g,s}etxattr() mnt_idmapping: add vfs[g,u]id_into_k[g,u]id() commit bdfae5ce3820e79e709bd530ab458302be2e0d9c Merge: e6a7cf70a3ca9 77940f0d96cd2 Author: Linus Torvalds Date: Mon Aug 1 08:56:55 2022 -0700 Merge tag 'fs.idmapped.vfsuid.v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux Pull fs idmapping updates from Christian Brauner: "This introduces the new vfs{g,u}id_t types we agreed on. Similar to k{g,u}id_t the new types are just simple wrapper structs around regular {g,u}id_t types. They allow to establish a type safety boundary in the VFS for idmapped mounts preventing confusion betwen {g,u}ids mapped into an idmapped mount and {g,u}ids mapped into the caller's or the filesystem's idmapping. An initial set of helpers is introduced that allows to operate on vfs{g,u}id_t types. We will remove all references to non-type safe idmapped mounts helpers in the very near future. The patches do already exist. This converts the core attribute changing codepaths which become significantly easier to reason about because of this change. Just a few highlights here as the patches give detailed overviews of what is happening in the commit messages: - The kernel internal struct iattr contains type safe vfs{g,u}id_t values clearly communicating that these values have to take a given mount's idmapping into account. - The ownership values placed in struct iattr to change ownership are identical for idmapped and non-idmapped mounts going forward. This also allows to simplify stacking filesystems such as overlayfs that change attributes In other words, they always represent the values. - Instead of open coding checks for whether ownership changes have been requested and an actual update of the inode is required we now have small static inline wrappers that abstract this logic away removing a lot of code duplication from individual filesystems that all open-coded the same checks" * tag 'fs.idmapped.vfsuid.v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: mnt_idmapping: align kernel doc and parameter order mnt_idmapping: use new helpers in mapped_fs{g,u}id() fs: port HAS_UNMAPPED_ID() to vfs{g,u}id_t mnt_idmapping: return false when comparing two invalid ids attr: fix kernel doc attr: port attribute changes to new types security: pass down mount idmapping to setattr hook quota: port quota helpers mount ids fs: port to iattr ownership update helpers fs: introduce tiny iattr ownership update helpers fs: use mount types in iattr fs: add two type safe mapping helpers mnt_idmapping: add vfs{g,u}id_t commit e6a7cf70a3ca9dc83419dd3d8ef09a800da3d7c1 Merge: e88745dcfd9de db4abb4a32ec9 Author: Linus Torvalds Date: Mon Aug 1 08:54:59 2022 -0700 Merge tag 'filelock-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "Just a couple of flock() patches from Kuniyuki Iwashima. The main change is that this moves a file_lock allocation from the slab to the stack" * tag 'filelock-v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: fs/lock: Rearrange ops in flock syscall. fs/lock: Don't allocate file_lock in flock_make_lock(). commit e88745dcfd9de5c7de1c17f81e7cecec3d88871d Merge: bec14d79f73e7 ecce9212d0fd7 Author: Linus Torvalds Date: Mon Aug 1 08:52:37 2022 -0700 Merge tag 'erofs-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "First of all, we'd like to add Yue Hu and Jeffle Xu as two new reviewers. Thank them for spending time working on EROFS! There is no major feature outstanding in this cycle, mainly a patchset I worked on to prepare for rolling hash deduplication and folios for compressed data as the next big features. It kills the unneeded PG_error flag dependency as well. Apart from that, there are bugfixes and cleanups as always. Details are listed below: - Add Yue Hu and Jeffle Xu as reviewers - Add the missing wake_up when updating lzma streams - Avoid consecutive detection for Highmem memory - Prepare for multi-reference pclusters and get rid of PG_error - Fix ctx->pos update for NFS export - minor cleanups" * tag 'erofs-for-5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: (23 commits) erofs: update ctx->pos for every emitted dirent erofs: get rid of the leftover PAGE_SIZE in dir.c erofs: get rid of erofs_prepare_dio() helper erofs: introduce multi-reference pclusters (fully-referenced) erofs: record the longest decompressed size in this round erofs: introduce z_erofs_do_decompressed_bvec() erofs: try to leave (de)compressed_pages on stack if possible erofs: introduce struct z_erofs_decompress_backend erofs: get rid of `z_pagemap_global' erofs: clean up `enum z_erofs_collectmode' erofs: get rid of `enum z_erofs_page_type' erofs: rework online page handling erofs: switch compressed_pages[] to bufvec erofs: introduce `z_erofs_parse_in_bvecs' erofs: drop the old pagevec approach erofs: introduce bufvec to store decompressed buffers erofs: introduce `z_erofs_parse_out_bvecs()' erofs: clean up z_erofs_collector_begin() erofs: get rid of unneeded `inode', `map' and `sb' erofs: avoid consecutive detection for Highmem memory ... commit bec14d79f73e7bc2530e73b7c7ee0484029ea0ea Merge: af07685b9ca18 feee1ce45a566 Author: Linus Torvalds Date: Mon Aug 1 08:50:39 2022 -0700 Merge tag 'fsnotify_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: - support for FAN_MARK_IGNORE which untangles some of the not well defined corner cases with fanotify ignore masks - small cleanups * tag 'fsnotify_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: Fix comment typo fanotify: introduce FAN_MARK_IGNORE fanotify: cleanups for fanotify_mark() input validations fanotify: prepare for setting event flags in ignore mask fs: inotify: Fix typo in inotify comment commit af07685b9ca18a5104c073847c83cf443f5c6114 Merge: eb43bbac4c3c9 fa78f33693724 Author: Linus Torvalds Date: Mon Aug 1 08:48:37 2022 -0700 Merge tag 'fs_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2 and reiserfs updates from Jan Kara: "A fix for ext2 handling of a corrupted fs image and cleanups in ext2 and reiserfs" * tag 'fs_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: Add more validity checks for inode counts fs/reiserfs/inode: remove dead code in _get_block_create_0() fs/ext2: replace ternary operator with min_t() commit eb43bbac4c3c97b34b72e1dbd91544ee0d48e8d6 Merge: 3d7cb6b04c3f3 958589892218e Author: Linus Torvalds Date: Mon Aug 1 08:46:53 2022 -0700 Merge tag 'dlm-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: - Delay the cleanup of interrupted posix lock requests until the user space result arrives. Previously, the immediate cleanup would lead to extraneous warnings when the result arrived. - Tracepoint improvements, e.g. adding the lock resource name. - Delay the completion of lockspace creation until one full recovery cycle has completed. This allows more error cases to be returned to the caller. - Remove warnings from the locking layer about delayed network replies. The recently added midcomms warnings are much more useful. - Begin the process of deprecating two unused lock-timeout-related features. These features now require enabling via a Kconfig option, and enabling them triggers deprecation warnings. We expect to remove the code in v6.2. * tag 'dlm-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: fs: dlm: move kref_put assert for lkb structs fs: dlm: don't use deprecated timeout features by default fs: dlm: add deprecation Kconfig and warnings for timeouts fs: dlm: remove timeout from dlm_user_adopt_orphan fs: dlm: remove waiter warnings fs: dlm: fix grammar in lowcomms output fs: dlm: add comment about lkb IFL flags fs: dlm: handle recovery result outside of ls_recover fs: dlm: make new_lockspace() wait until recovery completes fs: dlm: call dlm_lsop_recover_prep once fs: dlm: update comments about recovery and membership handling fs: dlm: add resource name to tracepoints fs: dlm: remove additional dereference of lksb fs: dlm: change ast and bast trace order fs: dlm: change posix lock sigint handling fs: dlm: use dlm_plock_info for do_unlock_close fs: dlm: change plock interrupted message to debug again fs: dlm: add pid to debug log fs: dlm: plock use list_first_entry commit 36d4b36b69590fed99356a4426c940a253a93800 Author: Yury Norov Date: Mon Jul 25 09:39:17 2022 -0700 lib/nodemask: inline next_node_in() and node_random() The functions are pretty thin wrappers around find_bit engine, and keeping them in c-file prevents compiler from small_const_nbits() optimization, which must take place for all systems with MAX_NUMNODES less than BITS_PER_LONG (default is 16 for me). Moving them to header file doesn't blow up the kernel size: add/remove: 1/2 grow/shrink: 9/5 up/down: 968/-88 (880) CC: Andy Shevchenko CC: Benjamin Herrenschmidt CC: Michael Ellerman CC: Paul Mackerras CC: Rasmus Villemoes CC: Stephen Rothwell CC: linuxppc-dev@lists.ozlabs.org Signed-off-by: Yury Norov commit 3e731203153de1c06a8b7a4f15061e9051c09a6f Author: Yury Norov Date: Sat Jul 23 14:45:36 2022 -0700 powerpc: drop dependency on in archrandom.h archrandom.h includes to refer ppc_md. This causes circular header dependency, if generic nodemask.h includes random.h: In file included from include/linux/cred.h:16, from include/linux/seq_file.h:13, from arch/powerpc/include/asm/machdep.h:6, from arch/powerpc/include/asm/archrandom.h:5, from include/linux/random.h:109, from include/linux/nodemask.h:97, from include/linux/list_lru.h:12, from include/linux/fs.h:13, from include/linux/compat.h:17, from arch/powerpc/kernel/asm-offsets.c:12: include/linux/sched.h:1203:9: error: unknown type name 'nodemask_t' 1203 | nodemask_t mems_allowed; | ^~~~~~~~~~ Fix it by removing dependency from archrandom.h Now as arch_get_random_seed_long() moved to c-file, and not exported, it's not available for modules. As Michael Ellerman says: I think we actually don't need it exported to modules, I think it's a private detail of the RNG <-> architecture interface, not something that modules should be calling. CC: Andy Shevchenko CC: Benjamin Herrenschmidt CC: Michael Ellerman CC: Paul Mackerras CC: Rasmus Villemoes CC: Stephen Rothwell CC: linuxppc-dev@lists.ozlabs.org Suggested-by: Michael Ellerman (for non-exporting) Acked-by: Michael Ellerman Acked-by: Michael Ellerman Signed-off-by: Yury Norov commit be55492e01ab8a2d259b3404ba24465a0ad27130 Author: Randy Dunlap Date: Sun Jul 31 19:52:21 2022 -0700 devicetree/bindings: correct possessive "its" typos Correct all uses of "it's" that are meant to be possessive "its". Signed-off-by: Randy Dunlap Cc: Jonathan Corbet Cc: Rob Herring Cc: Krzysztof Kozlowski Cc: devicetree@vger.kernel.org Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220801025221.30563-1-rdunlap@infradead.org commit 3d46d78480757e6d403c3bc2b32d2b05ecbed543 Author: Hans de Goede Date: Mon Aug 1 16:55:36 2022 +0200 platform/x86/intel/vsec: Fix wrong type for local status variables The local status variables in intel_vsec_pci_error_detected() and intel_vsec_pci_slot_reset() should have pci_ers_result_t as type (and not pci_channel_state_t). Also fix a whitespace error as well as intel_vsec_pci_err_handlers not being marked static. This fixes the following sparse errors: drivers/platform/x86/intel/vsec.c:429:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted pci_channel_state_t [usertype] status @@ got restricted pci_ers_result_t @@ drivers/platform/x86/intel/vsec.c:429:38: sparse: expected restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:429:38: sparse: got restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:434:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted pci_channel_state_t [usertype] status @@ got restricted pci_ers_result_t @@ drivers/platform/x86/intel/vsec.c:434:24: sparse: expected restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:434:24: sparse: got restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:438:16: sparse: sparse: incorrect type in return expression (different base types) @@ expected restricted pci_ers_result_t @@ got restricted pci_channel_state_t [usertype] status @@ drivers/platform/x86/intel/vsec.c:438:16: sparse: expected restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:438:16: sparse: got restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:444:38: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted pci_channel_state_t [usertype] status @@ got restricted pci_ers_result_t @@ drivers/platform/x86/intel/vsec.c:444:38: sparse: expected restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:444:38: sparse: got restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:457:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted pci_channel_state_t [usertype] status @@ got restricted pci_ers_result_t @@ drivers/platform/x86/intel/vsec.c:457:16: sparse: expected restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:457:16: sparse: got restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:472:16: sparse: sparse: incorrect type in return expression (different base types) @@ expected restricted pci_ers_result_t @@ got restricted pci_channel_state_t [usertype] status @@ drivers/platform/x86/intel/vsec.c:472:16: sparse: expected restricted pci_ers_result_t drivers/platform/x86/intel/vsec.c:472:16: sparse: got restricted pci_channel_state_t [usertype] status drivers/platform/x86/intel/vsec.c:480:33: sparse: sparse: symbol 'intel_vsec_pci_err_handlers' was not declared. Should it be static? Reported-by: kernel test robot Cc: Srinivas Pandruvada Cc: David E Box Cc: Gayatri Kammela Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220801145536.172410-1-hdegoede@redhat.com commit 958589892218e43ec83d5562438e0c1cc44a4716 Author: Alexander Aring Date: Thu Jun 23 21:28:58 2022 -0400 fs: dlm: move kref_put assert for lkb structs The unhold_lkb() function decrements the lock's kref, and asserts that the ref count was not the final one. Use the kref_put release function (which should not be called) to call the assert, rather than doing the assert based on the kref_put return value. Using kill_lkb() as the release function doesn't make sense if we only want to assert. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 6b0afc0cc3e9a9a91f5a76d0965d449781441e18 Author: Alexander Aring Date: Wed Jun 22 14:45:23 2022 -0400 fs: dlm: don't use deprecated timeout features by default This patch will disable use of deprecated timeout features if CONFIG_DLM_DEPRECATED_API is not set. The deprecated features will be removed in upcoming kernel release v6.2. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 81eeb82fc215afec7a0511dd5eab6b9cac8dac39 Author: Alexander Aring Date: Wed Jun 22 14:45:22 2022 -0400 fs: dlm: add deprecation Kconfig and warnings for timeouts This patch adds a CONFIG_DLM_DEPRECATED_API Kconfig option that must be enabled to use two timeout-related features that we intend to remove in kernel v6.2. Warnings are printed if either is enabled and used. Neither has ever been used as far as we know. . The DLM_LSFL_TIMEWARN lockspace creation flag will be removed, along with the associated configfs entry for setting the timeout. Setting the flag and configfs file would cause dlm to track how long locks were waiting for reply messages. After a timeout, a kernel message would be logged, and a netlink message would be sent to userspace. Recently, midcomms messages have been added that produce much better logging about actual problems with messages. No use has ever been found for the netlink messages. . The userspace libdlm API has allowed the DLM_LKF_TIMEOUT flag with a timeout value to be set in lock requests. The lock request would be cancelled after the timeout. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 5ecd39d1bc4b10df6d640c54e04b4a1c70447d13 Author: Johan Jonker Date: Fri Jun 3 18:35:37 2022 +0200 dt-bindings: net: convert emac_rockchip.txt to YAML Convert emac_rockchip.txt to YAML. Changes against original bindings: Add mdio sub node. Add extra clock for rk3036 Signed-off-by: Johan Jonker Reviewed-by: Rob Herring Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220603163539.537-1-jbx6244@gmail.com commit 42d0d4232ac1620c38a73bd133bf9927c9bc3ac4 Author: Andy Shevchenko Date: Mon Jul 18 17:53:28 2022 +0300 platform/x86: p2sb: Move out of X86_PLATFORM_DEVICES dependency The P2SB library is used for various drivers, including server platforms. That's why the dependency on X86_PLATFORM_DEVICES seems superfluous. Reported-by: kernel test robot Signed-off-by: Andy Shevchenko Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20220718145328.14374-1-andriy.shevchenko@linux.intel.com Signed-off-by: Hans de Goede commit 8906ced9a909158a3688dd90940a0a075ba32631 Merge: 6dd71251b9aee a6c80bec3c935 Author: Hans de Goede Date: Mon Aug 1 16:21:31 2022 +0200 Merge tag 'ib-mfd-edac-i2c-leds-pinctrl-platform-watchdog-v5.20' into review-hans Immutable branch between MFD, EDAC, I2C, LEDs, PinCtrl, Platform and Watchdog due for the v5.20 merge window commit a3b5d4715fd5a839857f8b7be78dff258a8d5a47 Merge: 9769e44d41a13 40d060b8158e2 Author: Takashi Iwai Date: Mon Aug 1 15:26:40 2022 +0200 Merge tag 'asoc-v5.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: More updates for v5.20 More updates that came in since the last pull request I sent, a series of driver specific changes: - Support for AMD RPL, some Intel platforms and Mediatek MT8186. commit c17a6ff9321355487d7d5ccaa7d406a0ea06b6c4 Author: Mathieu Desnoyers Date: Wed Jun 22 15:46:17 2022 -0400 rseq: Kill process when unknown flags are encountered in ABI structures rseq_abi()->flags and rseq_abi()->rseq_cs->flags 29 upper bits are currently unused. The current behavior when those bits are set is to ignore them. This is not an ideal behavior, because when future features will start using those flags, if user-space fails to correctly validate that the kernel indeed supports those flags (e.g. with a new sys_rseq flags bit) before using them, it may incorrectly assume that the kernel will handle those flags way when in fact those will be silently ignored on older kernels. Validating that unused flags bits are cleared will allow a smoother transition when those flags will start to be used by allowing applications to fail early, and obviously, when they attempt to use the new flags on an older kernel that does not support them. Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lkml.kernel.org/r/20220622194617.1155957-2-mathieu.desnoyers@efficios.com commit 0190e4198e47fe99d002d72588f34fd62c9ab570 Author: Mathieu Desnoyers Date: Wed Jun 22 15:46:16 2022 -0400 rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags The pretty much unused RSEQ_CS_FLAG_NO_RESTART_ON_* flags introduce complexity in rseq, and are subtly buggy [1]. Solving those issues requires introducing additional complexity in the rseq implementation for each supported architecture. Considering that it complexifies the rseq ABI, I am proposing that we deprecate those flags. [2] So far there appears to be consensus from maintainers of user-space projects impacted by this feature that its removal would be a welcome simplification. [3] The deprecation approach proposed here is to issue WARN_ON_ONCE() when encountering those flags and kill the offending process with sigsegv. This should allow us to quickly identify whether anyone yells at us for removing this. Link: https://lore.kernel.org/lkml/20220618182515.95831-1-minhquangbui99@gmail.com/ [1] Link: https://lore.kernel.org/lkml/258546133.12151.1655739550814.JavaMail.zimbra@efficios.com/ [2] Link: https://lore.kernel.org/lkml/87pmj1enjh.fsf@email.froward.int.ebiederm.org/ [3] Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/lkml/20220622194617.1155957-1-mathieu.desnoyers@efficios.com commit 281106f938d3daaea6f8b6723a8217a2a1ef6936 Author: Andrei Vagin Date: Fri Jul 22 16:02:40 2022 -0700 selftests: kvm: set rax before vmcall kvm_hypercall has to place the hypercall number in rax. Trace events show that kvm_pv_test doesn't work properly: kvm_pv_test-53132: kvm_hypercall: nr 0x0 a0 0x0 a1 0x0 a2 0x0 a3 0x0 kvm_pv_test-53132: kvm_hypercall: nr 0x0 a0 0x0 a1 0x0 a2 0x0 a3 0x0 kvm_pv_test-53132: kvm_hypercall: nr 0x0 a0 0x0 a1 0x0 a2 0x0 a3 0x0 With this change, it starts working as expected: kvm_pv_test-54285: kvm_hypercall: nr 0x5 a0 0x0 a1 0x0 a2 0x0 a3 0x0 kvm_pv_test-54285: kvm_hypercall: nr 0xa a0 0x0 a1 0x0 a2 0x0 a3 0x0 kvm_pv_test-54285: kvm_hypercall: nr 0xb a0 0x0 a1 0x0 a2 0x0 a3 0x0 Signed-off-by: Andrei Vagin Message-Id: <20220722230241.1944655-5-avagin@google.com> Fixes: ac4a4d6de22e ("selftests: kvm: test enforcement of paravirtual cpuid features") Signed-off-by: Paolo Bonzini commit 6d518ac7be6223811ab947897273b1bbef846180 Author: Ian Rogers Date: Sun Jul 31 09:49:23 2022 -0700 perf symbol: Fail to read phdr workaround The perf jvmti agent doesn't create program headers, in this case fallback on section headers as happened previously. Committer notes: To test this, from a public post by Ian: 1) download a Java workload dacapo-9.12-MR1-bach.jar from https://sourceforge.net/projects/dacapobench/ 2) build perf such as "make -C tools/perf O=/tmp/perf NO_LIBBFD=1" it should detect Java and create /tmp/perf/libperf-jvmti.so 3) run perf with the jvmti agent: perf record -k 1 java -agentpath:/tmp/perf/libperf-jvmti.so -jar dacapo-9.12-MR1-bach.jar -n 10 fop 4) run perf inject: perf inject -i perf.data -o perf-injected.data -j 5) run perf report perf report -i perf-injected.data | grep org.apache.fop With this patch reverted I see lots of symbols like: 0.00% java jitted-388040-4656.so [.] org.apache.fop.fo.FObj.bind(org.apache.fop.fo.PropertyList) With the patch (2d86612aacb7805f ("perf symbol: Correct address for bss symbols")) I see lots of: dso__load_sym_internal: failed to find program header for symbol: Lorg/apache/fop/fo/FObj;bind(Lorg/apache/fop/fo/PropertyList;)V st_value: 0x40 Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols") Reviewed-by: Leo Yan Signed-off-by: Ian Rogers Tested-by: Leo Yan Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20220731164923.691193-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6fda2405f414b24a6d4fc74f2b1ab24b7fe00d14 Author: Namhyung Kim Date: Fri Jul 29 13:07:56 2022 -0700 perf lock: Implement cpu and task filters for BPF Add -a/--all-cpus and -C/--cpu options for cpu filtering. Also -p/--pid and --tid options are added for task filtering. The short -t option is taken for --threads already. Tracking the command line workload is possible as well. $ sudo perf lock contention -a -b sleep 1 Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220729200756.666106-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 407b36f69efbdccf341ccc5be6a366ec0795aa83 Author: Namhyung Kim Date: Fri Jul 29 13:07:55 2022 -0700 perf lock: Use BPF for lock contention analysis Add -b/--use-bpf option to use BPF to collect lock contention stats. For simplicity it now runs system-wide and requires C-c to stop. Upcoming changes will add the usual filtering. $ sudo perf lock con -b ^C contended total wait max wait avg wait type caller 42 192.67 us 13.64 us 4.59 us spinlock queue_work_on+0x20 23 85.54 us 10.28 us 3.72 us spinlock worker_thread+0x14a 6 13.92 us 6.51 us 2.32 us mutex kernfs_iop_permission+0x30 3 11.59 us 10.04 us 3.86 us mutex kernfs_dop_revalidate+0x3c 1 7.52 us 7.52 us 7.52 us spinlock kthread+0x115 1 7.24 us 7.24 us 7.24 us rwlock:W sys_epoll_wait+0x148 2 7.08 us 3.99 us 3.54 us spinlock delayed_work_timer_fn+0x1b 1 6.41 us 6.41 us 6.41 us spinlock idle_balance+0xa06 2 2.50 us 1.83 us 1.25 us mutex kernfs_iop_lookup+0x2f 1 1.71 us 1.71 us 1.71 us mutex kernfs_iop_getattr+0x2c Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220729200756.666106-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 77d54a2cd6086d1cc3cadd124084b5d0d40b713e Author: Namhyung Kim Date: Fri Jul 29 13:07:54 2022 -0700 perf lock: Pass machine pointer to is_lock_function() This is a preparation for later change to expose the function externally so that it can be used without the implicit session data. Signed-off-by: Namhyung Kim Cc: Blake Jones Cc: Boqun Feng Cc: Davidlohr Bueso Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Waiman Long Cc: Will Deacon Link: https://lore.kernel.org/r/20220729200756.666106-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 Author: Zhouyi Zhou Date: Tue Jul 26 09:57:47 2022 +0800 powerpc/64: Init jump labels before parse_early_param() On 64-bit, calling jump_label_init() in setup_feature_keys() is too late because static keys may be used in subroutines of parse_early_param() which is again subroutine of early_init_devtree(). For example booting with "threadirqs": static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init() WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120 ... NIP static_key_enable_cpuslocked+0xfc/0x120 LR static_key_enable_cpuslocked+0xf8/0x120 Call Trace: static_key_enable_cpuslocked+0xf8/0x120 (unreliable) static_key_enable+0x30/0x50 setup_forced_irqthreads+0x28/0x40 do_early_param+0xa0/0x108 parse_args+0x290/0x4e0 parse_early_options+0x48/0x5c parse_early_param+0x58/0x84 early_init_devtree+0xd4/0x518 early_setup+0xb4/0x214 So call jump_label_init() just before parse_early_param() in early_init_devtree(). Suggested-by: Michael Ellerman Signed-off-by: Zhouyi Zhou [mpe: Add call trace to change log and minor wording edits.] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com commit ff446cd76854d47f451a84c26bb70934ae2ec5a7 Author: Michael Ellerman Date: Mon Aug 1 18:48:34 2022 +1000 selftests/powerpc: Avoid GCC 12 uninitialised variable warning GCC 12 thinks that `actual` might be used uninitialised. It's not, the use is guarded by `bad_mmcr2` which is only set to true at the same point where `actual` is initialised. cycles_with_mmcr2_test.c: In function ‘cycles_with_mmcr2’: cycles_with_mmcr2_test.c:81:17: error: ‘actual’ may be used uninitialized [-Werror=maybe-uninitialized] 81 | printf("Bad MMCR2 value seen is 0x%lx\n", actual); Silence the warning by initialising `actual` to zero. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220801113746.802046-1-mpe@ellerman.id.au commit df5d4b616ee76abc97e5bd348e22659c2b095b1c Author: Miaoqian Lin Date: Sun Jun 5 10:51:29 2022 +0400 powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() in the error path to avoid refcount leak. Fixes: ce21b3c9648a ("[CELL] add support for MSI on Axon-based Cell systems") Signed-off-by: Miaoqian Lin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220605065129.63906-1-linmq006@gmail.com commit 255b650cbec6849443ce2e0cdd187fd5e61c218c Author: Miaoqian Lin Date: Sun Jun 5 09:32:23 2022 +0400 powerpc/xive: Fix refcount leak in xive_get_max_prio of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller") Signed-off-by: Miaoqian Lin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220605053225.56125-1-linmq006@gmail.com commit 6ac059dacffa8ab2f7798f20e4bd3333890c541c Author: Miaoqian Lin Date: Fri Jun 3 16:15:42 2022 +0400 powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader of_find_node_by_path() returns remote device nodepointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 0afacde3df4c ("[POWERPC] spufs: allow isolated mode apps by starting the SPE loader") Signed-off-by: Miaoqian Lin Acked-by: Arnd Bergmann Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220603121543.22884-1-linmq006@gmail.com commit 8c9f37a78f70fad763f0d61f03245bb011765086 Author: Athira Rajeev Date: Thu Jul 28 22:07:46 2022 +0530 powerpc/perf: Include caps feature for power10 DD1 version Commit 6320e693d98c ("powerpc/perf: Add support for caps under sysfs in powerpc") added support for caps under sysfs in powerpc. This added caps directory to: /sys/bus/event_source/devices/cpu/ for power8, power9, power10 and generic compat PMU in respective PMU driver code. For power10, it is added under "power10_pmu_attr_groups". But for DD1 version, attr_groups are defined under dd1 array: "power10_pmu_attr_groups_dd1". Since caps is not added for DD1, it fails to include "cpu/caps" in DD1 model. The issue was observed while booting power10 pseries with qemu version 6, but not observed with qemu version 7. This is because qemu version 7 uses a DD 2.0 CPU model. Below is the trace log: Can't update unknown attr grp name: cpu/caps^M ------------[ cut here ]------------^M Failed to register pmu: cpu, reason -22^M WARNING: CPU: 1 PID: 1 at kernel/events/core.c:13427 perf_event_sysfs_init+0xbc/0x108^M Modules linked in:^M CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00111-g6320e693d98c #148^M NIP: c0000000020391f4 LR: c0000000020391f0 CTR: c0000000008c9c30^M REGS: c0000000044c38c0 TRAP: 0700 Not tainted (5.19.0-rc2-00111-g6320e693d98c)^M MSR: 8000000002029033 CR: 48000281 XER: 20040000^M CFAR: c00000000013feac IRQMASK: 0 ^M GPR00: c0000000020391f0 c0000000044c3b60 c00000000283db00 0000000000000027 ^M GPR04: 80000000ffffe0a8 0000000000000000 0000000000000004 00000000fdcd0000 ^M GPR08: 0000000000000027 c0000000ffe07e08 0000000000000001 0000000000000000 ^M GPR12: c00000000035dd90 c0000000fffff300 c000000000012478 0000000000000000 ^M GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ^M GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ^M GPR24: c000000002003480 0000000000000007 c0000000012a78d0 c000000001170a80 ^M GPR28: c0000000026c4df8 c0000000026c4e68 0000000000000000 c0000000025a8628 ^M NIP [c0000000020391f4] perf_event_sysfs_init+0xbc/0x108^M LR [c0000000020391f0] perf_event_sysfs_init+0xb8/0x108^M Call Trace:^M [c0000000044c3b60] [c0000000020391f0] perf_event_sysfs_init+0xb8/0x108 (unreliable)^M [c0000000044c3bf0] [c000000000011ec4] do_one_initcall+0x64/0x2d0^M [c0000000044c3cd0] [c0000000020049fc] kernel_init_freeable+0x338/0x3e0^M [c0000000044c3db0] [c0000000000124a0] kernel_init+0x30/0x1a0^M [c0000000044c3e10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64^M Instruction dump:^M 813f0038 2c090000 4180002c 7fe3fb78 4a3280c5 2c030000 7c651b78 41820018 ^M e89f0030 7f63db78 4a106c59 60000000 <0fe00000> ebff0000 4bffffb4 39200001 ^M ---[ end trace 0000000000000000 ]---^M Fix it by adding caps for dd1 attr_groups in power10 PMU driver. Fixes: 6320e693d98c ("powerpc/perf: Add support for caps under sysfs in powerpc") Signed-off-by: Athira Rajeev [mpe: Update change log to mention qemu 7 DD2.0 CPU model] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220728163746.85062-1-atrajeev@linux.vnet.ibm.com commit 96d50a1d874ca28bd779983ac9c2b791c2b406c0 Merge: f4a0318f278d9 4008d54e29531 Author: Michael Ellerman Date: Mon Aug 1 22:20:46 2022 +1000 Merge branch 'topic/ppc-kvm' into next Bring in a few more commits we are keeping in our KVM topic branch. commit 9bd7021809de194b2f8b3ef10b5509e229f339ef Author: Ian Rogers Date: Tue Jul 19 15:39:46 2022 -0700 perf test: Add user space counter reading tests These tests are based on test_stat_user_read in tools/lib/perf/tests/test-evsel.c. The tests are modified to skip if perf_event_open fails or rdpmc isn't supported. Committer testing: ⬢[acme@toolbox perf]$ perf test "mmap interface" 4: mmap interface tests : 4.1: Read samples using the mmap interface : Skip (permissions) ⬢[acme@toolbox perf]$ [root@five ~]# perf test "mmap interface" 4: mmap interface tests : 4.1: Read samples using the mmap interface : Ok [root@five ~]# Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anshuman Khandual Cc: Jiri Olsa Cc: Kajol Jain Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20220719223946.176299-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 481fadfb1073cbb0a9e7583a2aecf211c7897d2c Author: Ian Rogers Date: Tue Jul 19 15:39:45 2022 -0700 perf test: Remove x86 rdpmc test This test has been superseded by test_stat_user_read in: tools/lib/perf/tests/test-evsel.c The updated test doesn't divide-by-0 when running time of a counter is 0. It also supports ARM64. Signed-off-by: Ian Rogers Acked-by: Rob Herring Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anshuman Khandual Cc: Jiri Olsa Cc: Kajol Jain Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/20220719223946.176299-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit dd4d1c3bb3f1cd91a7a67ed3d73299ecb273ff92 Author: Oliver Upton Date: Tue Jul 19 14:31:34 2022 +0000 selftests: KVM: Add exponent check for boolean stats The only sensible exponent for a boolean stat is 0. Add a test assertion requiring all boolean statistics to have an exponent of 0. Signed-off-by: Oliver Upton Reviewed-by: Andrew Jones Message-Id: <20220719143134.3246798-4-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 7eebae78bc9754564779927976f37d04c2c01b64 Author: Oliver Upton Date: Tue Jul 19 14:31:33 2022 +0000 selftests: KVM: Provide descriptive assertions in kvm_binary_stats_test As it turns out, tests sometimes fail. When that is the case, packing the test assertion with as much relevant information helps track down the problem more quickly. Sharpen up the stat descriptor assertions in kvm_binary_stats_test to more precisely describe the reason for the test assertion and which stat is to blame. Signed-off-by: Oliver Upton Reviewed-by: Andrew Jones Message-Id: <20220719143134.3246798-3-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit ad5b072716e9ea7164b578a06c615966e9203c45 Author: Oliver Upton Date: Tue Jul 19 14:31:32 2022 +0000 selftests: KVM: Check stat name before other fields In order to provide more useful test assertions that describe the broken stats descriptor, perform sanity check on the stat name before any other descriptor field. While at it, avoid dereferencing the name field if the sanity check fails as it is more likely to contain garbage. Signed-off-by: Oliver Upton Reviewed-by: Andrew Jones Message-Id: <20220719143134.3246798-2-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 18808564aa3bc9ae3309fd8a5c0a93f7f9a23f9a Merge: 9a0b36266f7a8 3d7cb6b04c3f3 Author: Arnaldo Carvalho de Melo Date: Mon Aug 1 08:59:31 2022 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To pick up the fixes that went upstream via acme/perf/urgent and to get to v5.19. Signed-off-by: Arnaldo Carvalho de Melo commit 0a324c3263f1e456f54dd8dc8ce58575aea776bc Merge: d4d11f8ff14b2 8b684570eeaa2 Author: David S. Miller Date: Mon Aug 1 12:38:57 2022 +0100 Merge branch 'funeth-tx-xdp-frags' Dimitris Michailidis says: ==================== net/funeth: Tx support for XDP with frags Support XDP with fragments for XDP_TX and ndo_xdp_xmit. The first three patches rework existing code used by the skb path to make it suitable also for XDP. With these all the callees of the main Tx XDP function, fun_xdp_tx(), are fragment-capable. The last patch updates fun_xdp_tx() to handle fragments. ==================== Tested-by: Ido Schimmel Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 8b684570eeaa258d7878c6962a50ed7cce690f9c Author: Dimitris Michailidis Date: Fri Jul 29 00:32:57 2022 -0700 net/funeth: Tx handling of XDP with fragments. By now all the functions fun_xdp_tx() calls are shared with the skb path and thus are fragment-capable. Update fun_xdp_tx(), that up to now has been passing just one buffer, to check for fragments and call accordingly. This makes XDP_TX and ndo_xdp_xmit fragment-capable. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit 1c45b0cd6cf064e21ae1eda027b3e1699e15494d Author: Dimitris Michailidis Date: Fri Jul 29 00:32:56 2022 -0700 net/funeth: Unify skb/XDP packet mapping. Instead of passing an skb to the mapping function pass an skb_shared_info plus an additional address/length pair. This makes it usable for both skbs and XDP. Call it from the XDP path and adjust the skb path. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit a3b461bbd1847e02bb83957bbba0a195bc274e7a Author: Dimitris Michailidis Date: Fri Jul 29 00:32:55 2022 -0700 net/funeth: Unify skb/XDP gather list writing. Extract the Tx gather list writing code that skbs use into a utility function and use it also for XDP. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit 16ead40812a08248c89268736b973c53cfe6e16e Author: Dimitris Michailidis Date: Fri Jul 29 00:32:54 2022 -0700 net/funeth: Unify skb/XDP Tx packet unmapping. Current XDP unmapping is a subset of its skb analog, dealing with only one buffer. In preparation for multi-frag XDP rename the skb function and use it also for XDP. The XDP version is removed. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit 31f6e3832a0f1c366e54033335aed2375f6e447a Author: Paolo Bonzini Date: Mon Aug 1 07:27:18 2022 -0400 KVM: x86/mmu: remove unused variable The last use of 'pfn' went away with the same-named argument to host_pfn_mapping_level; now that the hugepage level is obtained exclusively from the host page tables, kvm_mmu_zap_collapsible_spte does not need to know host pfns at all. Fixes: a8ac499bb6ab ("KVM: x86/mmu: Don't require refcounted "struct page" to create huge SPTEs") Signed-off-by: Paolo Bonzini commit d4d11f8ff14b28a956d01700d4559620ffe4c2a2 Merge: 02a7cb2866dd6 09b278462f165 Author: David S. Miller Date: Mon Aug 1 12:14:01 2022 +0100 Merge branch 'devlink-parallel-commands' Jiri Pirko says: ==================== net: devlink: allow parallel commands on multiple devlinks Aim of this patchset is to remove devlink_mutex and eventually to enable parallel ops on devlink netlink interface. ==================== Tested-by: Ido Schimmel Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 09b278462f16569c63dd78ffa29bbfe048b4e604 Author: Jiri Pirko Date: Fri Jul 29 09:10:38 2022 +0200 net: devlink: enable parallel ops on netlink interface As the devlink_mutex was removed and all devlink instances are protected individually by devlink->lock mutex, allow the netlink ops to run in parallel and therefore allow user to execute commands on multiple devlink instances simultaneously. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit d3efc2a6a6d851bcd53805309f4632e018007436 Author: Jiri Pirko Date: Fri Jul 29 09:10:37 2022 +0200 net: devlink: remove devlink_mutex All accesses to devlink structure from userspace and drivers are locked with devlink->lock instance mutex. Also, devlinks xa_array iteration is taken care of by iteration helpers taking devlink reference. Therefore, remove devlink_mutex as it is no longer needed. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 644a66c60f02f302d82c3008ae2ffe67cf495383 Author: Jiri Pirko Date: Fri Jul 29 09:10:36 2022 +0200 net: devlink: convert reload command to take implicit devlink->lock Convert reload command to behave the same way as the rest of the commands and let if be called with devlink->lock held. Remove the temporary devl_lock taking from drivers. As the DEVLINK_NL_FLAG_NO_LOCK flag is no longer used, remove it alongside. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit c2368b19807affd7621f7c4638cd2e17fec13021 Author: Jiri Pirko Date: Fri Jul 29 09:10:35 2022 +0200 net: devlink: introduce "unregistering" mark and use it during devlinks iteration Add new mark called "unregistering" to be set at the beginning of devlink_unregister() function. Check this mark during devlinks iteration in order to prevent getting a reference of devlink which is being currently unregistered. Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit 02a7cb2866dd6e3ac7645b594289e1c308b68c4e Author: Kuniyuki Iwashima Date: Thu Jul 28 20:21:37 2022 -0700 udp: Remove redundant __udp_sysctl_init() call from udp_init(). __udp_sysctl_init() is called for init_net via udp_sysctl_ops. While at it, we can rename __udp_sysctl_init() to udp_sysctl_init(). Fixes: 1e8029515816 ("udp: Move the udp sysctl to namespace.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 9fe2e6f3960687ab2a297fe09837a3f47cd2331f Merge: 5121db6afb999 93cb804edab1b Author: David S. Miller Date: Mon Aug 1 12:00:53 2022 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2022-07-29 This series contains updates to iavf driver only. Przemyslaw prevents setting of TC max rate below minimum supported values and reports updated queue values when setting up TCs. --- v2: Dropped patch 3 (hw-tc-offload check) ==================== Signed-off-by: David S. Miller commit 5121db6afb999d0049d37e911b08cd440f6f8f82 Author: Li Qiong Date: Wed Jul 27 23:03:41 2022 +0800 net/rds: Use PTR_ERR instead of IS_ERR for rdsdebug() If 'local_odp_mr->r_trans_private' is a error code, it is better to print the error code than to print the value of IS_ERR(). Signed-off-by: Li Qiong Signed-off-by: David S. Miller commit b7d8912cfd1b72c970f727d7da1c8274d5b18803 Merge: 63757225a9335 7b584fbb36362 Author: David S. Miller Date: Mon Aug 1 11:42:11 2022 +0100 Merge tag 'linux-can-next-for-5.20-20220731' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2022-07-31 this is a pull request of 36 patches for net-next/master. The 1st patch is by me and fixes a typo in the mcp251xfd driver. Vincent Mailhol contributes a series of 9 patches, which clean up the drivers to make use of KBUILD_MODNAME instead of hard coded names and remove DRV_VERSION. Followed by 3 patches by Vincent Mailhol that directly set the ethtool_ops in instead of calling a function in the slcan, c_can and flexcan driver. Vincent Mailhol contributes a KBUILD_MODNAME and pr_fmt cleanup patch for the slcan driver. Dario Binacchi contributes 6 patches to clean up the driver and remove the legacy driver infrastructure. The next 14 patches are by Vincent Mailhol and target the various drivers, they add ethtool support and reporting of timestamping capabilities. Another patch by Vincent Mailhol for the etas_es58x driver to remove useless calls to usb_fill_bulk_urb(). The last patch is by Christophe JAILLET and fixes a broken link to Documentation in the can327 driver. ==================== Signed-off-by: David S. Miller commit c4edb2babc750d829cb551a6af7cb39b2afc9fb5 Merge: 63f4b210414b6 0982c8d859f8f Author: Paolo Bonzini Date: Fri Jul 29 10:07:59 2022 -0400 Merge tag 'kvmarm-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 5.20: - Unwinder implementations for both nVHE modes (classic and protected), complete with an overflow stack - Rework of the sysreg access from userspace, with a complete rewrite of the vgic-v3 view to allign with the rest of the infrastructure - Disagregation of the vcpu flags in separate sets to better track their use model. - A fix for the GICv2-on-v3 selftest - A small set of cosmetic fixes commit 63f4b210414b65aa3103c54369cacbd0b1bdf02f Merge: 2e2e91158febf 7edc3a68038ab Author: Paolo Bonzini Date: Fri Jul 29 09:46:01 2022 -0400 Merge remote-tracking branch 'kvm/next' into kvm-next-5.20 KVM/s390, KVM/x86 and common infrastructure changes for 5.20 x86: * Permit guests to ignore single-bit ECC errors * Fix races in gfn->pfn cache refresh; do not pin pages tracked by the cache * Intel IPI virtualization * Allow getting/setting pending triple fault with KVM_GET/SET_VCPU_EVENTS * PEBS virtualization * Simplify PMU emulation by just using PERF_TYPE_RAW events * More accurate event reinjection on SVM (avoid retrying instructions) * Allow getting/setting the state of the speaker port data bit * Refuse starting the kvm-intel module if VM-Entry/VM-Exit controls are inconsistent * "Notify" VM exit (detect microarchitectural hangs) for Intel * Cleanups for MCE MSR emulation s390: * add an interface to provide a hypervisor dump for secure guests * improve selftests to use TAP interface * enable interpretive execution of zPCI instructions (for PCI passthrough) * First part of deferred teardown * CPU Topology * PV attestation * Minor fixes Generic: * new selftests API using struct kvm_vcpu instead of a (vm, id) tuple x86: * Use try_cmpxchg64 instead of cmpxchg64 * Bugfixes * Ignore benign host accesses to PMU MSRs when PMU is disabled * Allow disabling KVM's "MONITOR/MWAIT are NOPs!" behavior * x86/MMU: Allow NX huge pages to be disabled on a per-vm basis * Port eager page splitting to shadow MMU as well * Enable CMCI capability by default and handle injected UCNA errors * Expose pid of vcpu threads in debugfs * x2AVIC support for AMD * cleanup PIO emulation * Fixes for LLDT/LTR emulation * Don't require refcounted "struct page" to create huge SPTEs x86 cleanups: * Use separate namespaces for guest PTEs and shadow PTEs bitmasks * PIO emulation * Reorganize rmap API, mostly around rmap destruction * Do not workaround very old KVM bugs for L0 that runs with nesting enabled * new selftests API for CPUID commit 97b82c07c4217260e448ef774e6099abf608bd1d Author: Steve French Date: Mon Aug 1 01:36:46 2022 -0500 cifs: trivial style fixup missing blank line after declaration Signed-off-by: Steve French commit aea02fc40a7fa6ac2c16e3c3a6f1d0fd7e6faaba Author: Yang Yingliang Date: Fri Jul 29 15:49:35 2022 +0800 cifs: fix wrong unlock before return from cifs_tree_connect() It should unlock 'tcon->tc_lock' before return from cifs_tree_connect(). Fixes: fe67bd563ec2 ("cifs: avoid use of global locks for high contention data") Signed-off-by: Yang Yingliang Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8 Author: Shyam Prasad N Date: Wed Jul 27 14:49:56 2022 -0500 cifs: avoid use of global locks for high contention data During analysis of multichannel perf, it was seen that the global locks cifs_tcp_ses_lock and GlobalMid_Lock, which were shared between various data structures were causing a lot of contention points. With this change, we're breaking down the use of these locks by introducing new locks at more granular levels. i.e. server->srv_lock, ses->ses_lock and tcon->tc_lock to protect the unprotected fields of server, session and tcon structs; and server->mid_lock to protect mid related lists and entries at server level. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 1bfa25ee30dfebe32a3b40c1a954052becbd7b8d Author: Steve French Date: Sun Jul 24 22:47:59 2022 -0500 cifs: remove remaining build warnings Removed remaining warnings related to externs. These warnings although harmless could be distracting e.g. fs/cifs/cifsfs.c: note: in included file: fs/cifs/cifsglob.h:1968:24: warning: symbol 'sesInfoAllocCount' was not declared. Should it be static? Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9543c8ab3016cefa6abb265234a7ef0ca2b3f89f Author: Enzo Matsumiya Date: Fri Jul 22 14:02:59 2022 -0300 cifs: list_for_each() -> list_for_each_entry() Replace list_for_each() by list_for_each_entr() where appropriate. Remove no longer used list_head stack variables. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit ec88cc57c39eef7f630a0f118955f3c16dc55a45 Author: Steve French Date: Thu Jul 21 10:22:48 2022 -0500 cifs: update MAINTAINERS file with reviewers And also correct the URL for the project web site. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit da3847894fddc27ca95d5ac0012f444a77a5e0c3 Author: Enzo Matsumiya Date: Tue Jul 19 14:31:51 2022 -0300 smb2: small refactor in smb2_check_message() If the command is SMB2_IOCTL, OutputLength and OutputContext are optional and can be zero, so return early and skip calculated length check. Move the mismatched length message to the end of the check, to avoid unnecessary logs when the check was not a real miscalculation. Also change the pr_warn_once() to a pr_warn() so we're sure to get a log for the real mismatches. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit c6f62f81b488d00afaa86bae26c6ce9ab12c709e Author: Matthew Wilcox (Oracle) Date: Mon Jul 18 20:06:24 2022 +0100 cifs: Fix memory leak when using fscache If we hit the 'index == next_cached' case, we leak a refcount on the struct page. Fix this by using readahead_folio() which takes care of the refcount for you. Fixes: 0174ee9947bd ("cifs: Implement cache I/O by accessing the cache directly") Cc: David Howells Cc: Jeff Layton Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Steve French commit 89e42f49ef58bf5601ce452683aad1cb1088878f Author: Steve French Date: Fri Jul 15 23:57:08 2022 -0500 cifs: remove minor build warning The build warning: warning: symbol 'cifs_tcp_ses_lock' was not declared. Should it be static? can be distracting. Fix two of these. Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit c2c17ddbf32bd89c4b5e3eb71068b52c890d07df Author: Steve French Date: Fri Jul 15 23:45:45 2022 -0500 cifs: remove some camelCase and also some static build warnings Remove warnings for five global variables. For example: fs/cifs/cifsglob.h:1984:24: warning: symbol 'midCount' was not declared. Should it be static? Also change them from camelCase (e.g. "midCount" to "mid_count") Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 0827f71b881c9d679df4cb33936cbe8bcaa77321 Author: Yu Zhe Date: Tue Jun 14 01:54:49 2022 -0700 cifs: remove unnecessary (void*) conversions. One more. remove unnecessary void* type castings. Signed-off-by: Yu Zhe Signed-off-by: Steve French commit 0f46608ae7a138ae5982f97414e8cfc38a2e0f7e Author: Yu Zhe Date: Thu Jun 30 17:30:27 2022 +0800 cifs: remove unnecessary type castings remove unnecessary void* type castings. Signed-off-by: Yu Zhe Signed-off-by: Steve French commit 4da2cd0517e08c2a996b5f3e8914bdda0286d911 Author: Colin Ian King Date: Tue Jun 28 22:32:29 2022 +0100 cifs: remove redundant initialization to variable mnt_sign_enabled Variable mnt_sign_enabled is being initialized with a value that is never read, it is being reassigned later on with a different value. The initialization is redundant and can be removed. Cleans up clang scan-build warning: fs/cifs/cifssmb.c:465:7: warning: Value stored to 'mnt_sign_enabled during its initialization is never read Signed-off-by: Colin Ian King Signed-off-by: Steve French commit 5fa2cffba0b82336a2244d941322eb1627ff787b Author: Steve French Date: Tue Jul 12 11:43:44 2022 -0500 smb3: check xattr value length earlier Coverity complains about assigning a pointer based on value length before checking that value length goes beyond the end of the SMB. Although this is even more unlikely as value length is a single byte, and the pointer is not dereferenced until laterm, it is clearer to check the lengths first. Addresses-Coverity: 1467704 ("Speculative execution data leak") Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 9769e44d41a1359b9000ff8458f0f2f66080ebf4 Merge: f38e6458e16df be561ffad708f Author: Takashi Iwai Date: Mon Aug 1 08:11:19 2022 +0200 Merge branch 'for-next' into for-linus commit 251e90e7e346a23742b90e2c4db19d322e071d99 Author: Juergen Gross Date: Wed Jun 22 08:38:38 2022 +0200 xen: don't require virtio with grants for non-PV guests Commit fa1f57421e0b ("xen/virtio: Enable restricted memory access using Xen grant mappings") introduced a new requirement for using virtio devices: the backend now needs to support the VIRTIO_F_ACCESS_PLATFORM feature. This is an undue requirement for non-PV guests, as those can be operated with existing backends without any problem, as long as those backends are running in dom0. Per default allow virtio devices without grant support for non-PV guests. On Arm require VIRTIO_F_ACCESS_PLATFORM for devices having been listed in the device tree to use grants. Add a new config item to always force use of grants for virtio. Fixes: fa1f57421e0b ("xen/virtio: Enable restricted memory access using Xen grant mappings") Reported-by: Viresh Kumar Signed-off-by: Juergen Gross Reviewed-by: Oleksandr Tyshchenko Tested-by: Oleksandr Tyshchenko # Arm64 guest using Xen Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20220622063838.8854-4-jgross@suse.com Signed-off-by: Juergen Gross commit a870544ca9d215449e91ebc01e35d80b23151c78 Author: Juergen Gross Date: Wed Jun 22 08:38:37 2022 +0200 kernel: remove platform_has() infrastructure The only use case of the platform_has() infrastructure has been removed again, so remove the whole feature. Signed-off-by: Juergen Gross Tested-by: Oleksandr Tyshchenko # Arm64 guest using Xen Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20220622063838.8854-3-jgross@suse.com Signed-off-by: Juergen Gross commit a603002eea8213eec5211be5a85db8340aea06d0 Author: Juergen Gross Date: Wed Jun 22 08:38:36 2022 +0200 virtio: replace restricted mem access flag with callback Instead of having a global flag to require restricted memory access for all virtio devices, introduce a callback which can select that requirement on a per-device basis. For convenience add a common function returning always true, which can be used for use cases like SEV. Per default use a callback always returning false. As the callback needs to be set in early init code already, add a virtio anchor which is builtin in case virtio is enabled. Signed-off-by: Juergen Gross Tested-by: Oleksandr Tyshchenko # Arm64 guest using Xen Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20220622063838.8854-2-jgross@suse.com Signed-off-by: Juergen Gross commit 8441dac05e7f346abc4f63a15d4af0adeabfaa9b Author: Zhang Jiaming Date: Thu Jun 30 15:50:27 2022 +0800 xen: Fix spelling mistake Change 'maped' to 'mapped'. Change 'unmaped' to 'unmapped'. Signed-off-by: Zhang Jiaming Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220630075027.68833-1-jiaming@nfschina.com Signed-off-by: Juergen Gross commit 67f43c9c6a47776493f790f5ee03d76974e1b39d Author: Ross Lagerwall Date: Mon Jun 27 15:28:22 2022 +0100 xen/manage: Use orderly_reboot() to reboot Currently when the toolstack issues a reboot, it gets translated into a call to ctrl_alt_del(). But tying reboot to ctrl-alt-del means rebooting may fail if e.g. the user has masked the ctrl-alt-del.target under systemd. A previous attempt to fix this issue made a change that sets the kernel.ctrl-alt-del sysctl to 1 before ctrl_alt_del() is called. However, this doesn't give userspace the opportunity to block rebooting or even do any cleanup or syncing. Instead, call orderly_reboot() which will call the "reboot" command, giving userspace the opportunity to block it or perform the usual reboot process while being independent of the ctrl-alt-del behaviour. It also matches what happens in the shutdown case. Signed-off-by: Ross Lagerwall Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220627142822.3612106-1-ross.lagerwall@citrix.com Signed-off-by: Juergen Gross commit 824d4f64c20093275f72fc8101394d75ff6a249e Author: Hyunchul Lee Date: Thu Jul 28 21:58:53 2022 +0900 ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT if Status is not 0 and PathLength is long, smb_strndup_from_utf16 could make out of bound read in smb2_tree_connnect. This bug can lead an oops looking something like: [ 1553.882047] BUG: KASAN: slab-out-of-bounds in smb_strndup_from_utf16+0x469/0x4c0 [ksmbd] [ 1553.882064] Read of size 2 at addr ffff88802c4eda04 by task kworker/0:2/42805 ... [ 1553.882095] Call Trace: [ 1553.882098] [ 1553.882101] dump_stack_lvl+0x49/0x5f [ 1553.882107] print_report.cold+0x5e/0x5cf [ 1553.882112] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd] [ 1553.882122] kasan_report+0xaa/0x120 [ 1553.882128] ? smb_strndup_from_utf16+0x469/0x4c0 [ksmbd] [ 1553.882139] __asan_report_load_n_noabort+0xf/0x20 [ 1553.882143] smb_strndup_from_utf16+0x469/0x4c0 [ksmbd] [ 1553.882155] ? smb_strtoUTF16+0x3b0/0x3b0 [ksmbd] [ 1553.882166] ? __kmalloc_node+0x185/0x430 [ 1553.882171] smb2_tree_connect+0x140/0xab0 [ksmbd] [ 1553.882185] handle_ksmbd_work+0x30e/0x1020 [ksmbd] [ 1553.882197] process_one_work+0x778/0x11c0 [ 1553.882201] ? _raw_spin_lock_irq+0x8e/0xe0 [ 1553.882206] worker_thread+0x544/0x1180 [ 1553.882209] ? __cpuidle_text_end+0x4/0x4 [ 1553.882214] kthread+0x282/0x320 [ 1553.882218] ? process_one_work+0x11c0/0x11c0 [ 1553.882221] ? kthread_complete_and_exit+0x30/0x30 [ 1553.882225] ret_from_fork+0x1f/0x30 [ 1553.882231] There is no need to check error request validation in server. This check allow invalid requests not to validate message. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17818 Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit ac60778b87e45576d7bfdbd6f53df902654e6f09 Author: Hyunchul Lee Date: Thu Jul 28 23:41:51 2022 +0900 ksmbd: prevent out of bound read for SMB2_WRITE OOB read memory can be written to a file, if DataOffset is 0 and Length is too large in SMB2_WRITE request of compound request. To prevent this, when checking the length of the data area of SMB2_WRITE in smb2_get_data_area_len(), let the minimum of DataOffset be the size of SMB2 header + the size of SMB2_WRITE header. This bug can lead an oops looking something like: [ 798.008715] BUG: KASAN: slab-out-of-bounds in copy_page_from_iter_atomic+0xd3d/0x14b0 [ 798.008724] Read of size 252 at addr ffff88800f863e90 by task kworker/0:2/2859 ... [ 798.008754] Call Trace: [ 798.008756] [ 798.008759] dump_stack_lvl+0x49/0x5f [ 798.008764] print_report.cold+0x5e/0x5cf [ 798.008768] ? __filemap_get_folio+0x285/0x6d0 [ 798.008774] ? copy_page_from_iter_atomic+0xd3d/0x14b0 [ 798.008777] kasan_report+0xaa/0x120 [ 798.008781] ? copy_page_from_iter_atomic+0xd3d/0x14b0 [ 798.008784] kasan_check_range+0x100/0x1e0 [ 798.008788] memcpy+0x24/0x60 [ 798.008792] copy_page_from_iter_atomic+0xd3d/0x14b0 [ 798.008795] ? pagecache_get_page+0x53/0x160 [ 798.008799] ? iov_iter_get_pages_alloc+0x1590/0x1590 [ 798.008803] ? ext4_write_begin+0xfc0/0xfc0 [ 798.008807] ? current_time+0x72/0x210 [ 798.008811] generic_perform_write+0x2c8/0x530 [ 798.008816] ? filemap_fdatawrite_wbc+0x180/0x180 [ 798.008820] ? down_write+0xb4/0x120 [ 798.008824] ? down_write_killable+0x130/0x130 [ 798.008829] ext4_buffered_write_iter+0x137/0x2c0 [ 798.008833] ext4_file_write_iter+0x40b/0x1490 [ 798.008837] ? __fsnotify_parent+0x275/0xb20 [ 798.008842] ? __fsnotify_update_child_dentry_flags+0x2c0/0x2c0 [ 798.008846] ? ext4_buffered_write_iter+0x2c0/0x2c0 [ 798.008851] __kernel_write+0x3a1/0xa70 [ 798.008855] ? __x64_sys_preadv2+0x160/0x160 [ 798.008860] ? security_file_permission+0x4a/0xa0 [ 798.008865] kernel_write+0xbb/0x360 [ 798.008869] ksmbd_vfs_write+0x27e/0xb90 [ksmbd] [ 798.008881] ? ksmbd_vfs_read+0x830/0x830 [ksmbd] [ 798.008892] ? _raw_read_unlock+0x2a/0x50 [ 798.008896] smb2_write+0xb45/0x14e0 [ksmbd] [ 798.008909] ? __kasan_check_write+0x14/0x20 [ 798.008912] ? _raw_spin_lock_bh+0xd0/0xe0 [ 798.008916] ? smb2_read+0x15e0/0x15e0 [ksmbd] [ 798.008927] ? memcpy+0x4e/0x60 [ 798.008931] ? _raw_spin_unlock+0x19/0x30 [ 798.008934] ? ksmbd_smb2_check_message+0x16af/0x2350 [ksmbd] [ 798.008946] ? _raw_spin_lock_bh+0xe0/0xe0 [ 798.008950] handle_ksmbd_work+0x30e/0x1020 [ksmbd] [ 798.008962] process_one_work+0x778/0x11c0 [ 798.008966] ? _raw_spin_lock_irq+0x8e/0xe0 [ 798.008970] worker_thread+0x544/0x1180 [ 798.008973] ? __cpuidle_text_end+0x4/0x4 [ 798.008977] kthread+0x282/0x320 [ 798.008982] ? process_one_work+0x11c0/0x11c0 [ 798.008985] ? kthread_complete_and_exit+0x30/0x30 [ 798.008989] ret_from_fork+0x1f/0x30 [ 798.008995] Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17817 Signed-off-by: Hyunchul Lee Acked-by: Namjae Jeon Signed-off-by: Steve French commit cf6531d98190fa2cf92a6d8bbc8af0a4740a223c Author: Namjae Jeon Date: Thu Jul 28 21:57:08 2022 +0900 ksmbd: fix use-after-free bug in smb2_tree_disconect smb2_tree_disconnect() freed the struct ksmbd_tree_connect, but it left the dangling pointer. It can be accessed again under compound requests. This bug can lead an oops looking something link: [ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] [ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807 ... [ 1685.468130 ] Call Trace: [ 1685.468132 ] [ 1685.468135 ] dump_stack_lvl+0x49/0x5f [ 1685.468141 ] print_report.cold+0x5e/0x5cf [ 1685.468145 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] [ 1685.468157 ] kasan_report+0xaa/0x120 [ 1685.468194 ] ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] [ 1685.468206 ] __asan_report_load4_noabort+0x14/0x20 [ 1685.468210 ] ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd] [ 1685.468222 ] smb2_tree_disconnect+0x175/0x250 [ksmbd] [ 1685.468235 ] handle_ksmbd_work+0x30e/0x1020 [ksmbd] [ 1685.468247 ] process_one_work+0x778/0x11c0 [ 1685.468251 ] ? _raw_spin_lock_irq+0x8e/0xe0 [ 1685.468289 ] worker_thread+0x544/0x1180 [ 1685.468293 ] ? __cpuidle_text_end+0x4/0x4 [ 1685.468297 ] kthread+0x282/0x320 [ 1685.468301 ] ? process_one_work+0x11c0/0x11c0 [ 1685.468305 ] ? kthread_complete_and_exit+0x30/0x30 [ 1685.468309 ] ret_from_fork+0x1f/0x30 Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816 Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit aa7253c2393f6dcd6a1468b0792f6da76edad917 Author: Namjae Jeon Date: Thu Jul 28 21:56:19 2022 +0900 ksmbd: fix memory leak in smb2_handle_negotiate The allocated memory didn't free under an error path in smb2_handle_negotiate(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17815 Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit af7c39d971e43cd0af488729bca362427ad99488 Author: Namjae Jeon Date: Mon Jul 25 13:36:52 2022 +0900 ksmbd: fix racy issue while destroying session on multichannel After multi-channel connection with windows, Several channels of session are connected. Among them, if there is a problem in one channel, Windows connects again after disconnecting the channel. In this process, the session is released and a kernel oop can occurs while processing requests to other channels. When the channel is disconnected, if other channels still exist in the session after deleting the channel from the channel list in the session, the session should not be released. Finally, the session will be released after all channels are disconnected. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit a14c573870a664386adc10526a6c2648ea56dae1 Author: Namjae Jeon Date: Thu Jul 28 23:35:18 2022 +0900 ksmbd: use wait_event instead of schedule_timeout() ksmbd threads eating masses of cputime when connection is disconnected. If connection is disconnected, ksmbd thread waits for pending requests to be processed using schedule_timeout. schedule_timeout() incorrectly is used, and it is more efficient to use wait_event/wake_up than to check r_count every time with timeout. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 45fef4c4b9c94e86d9c13f0b2e7e71bb32254509 Author: Guo Ren Date: Sun Jul 31 22:34:24 2022 -0400 csky: abiv1: Fixup compile error LD vmlinux.o arch/csky/lib/string.o: In function `memmove': string.c:(.text+0x108): multiple definition of `memmove' lib/string.o:string.c:(.text+0x7e8): first defined here arch/csky/lib/string.o: In function `memset': string.c:(.text+0x148): multiple definition of `memset' lib/string.o:string.c:(.text+0x2ac): first defined here scripts/Makefile.vmlinux_o:68: recipe for target 'vmlinux.o' failed make[4]: *** [vmlinux.o] Error 1 Fixes: e4df2d5e852a ("csky: Add C based string functions") Signed-off-by: Guo Ren Signed-off-by: Guo Ren Cc: commit f940dc0f225183ccdba044e87daeeb93398819ad Author: Guo Ren Date: Sun Jul 31 21:57:30 2022 -0400 csky: cmpxchg: Coding convention for BUILD_BUG() Use BUILD_BUG() instead of the custom bad_xchg. Signed-off-by: Guo Ren Signed-off-by: Guo Ren commit df13a3477635414f243d53344bb4b510385e994d Author: Petr Vorel Date: Sun Jul 31 18:03:07 2022 +0200 MAINTAINERS: Add Namjae's exfat git tree Add Namjae's exfat git tree. Signed-off-by: Petr Vorel Signed-off-by: Namjae Jeon commit 512b74d17a93ae580171258a32590b5a4fee5866 Author: Takashi Iwai Date: Tue Jul 26 10:39:29 2022 +0200 exfat: Drop superfluous new line for error messages exfat_err() adds the new line at the end of the message by itself, hence the passed string shouldn't contain a new line. Drop the superfluous newline letters in the error messages in a few places that have been put mistakenly. Reported-by: Joe Perches Signed-off-by: Takashi Iwai Signed-off-by: Namjae Jeon commit 64fca6e621715fde548ad1a96ac5e6a2f586763a Author: Takashi Iwai Date: Tue Jul 26 10:39:28 2022 +0200 exfat: Downgrade ENAMETOOLONG error message to debug messages The ENAMETOOLONG error message is printed at each time when user tries to operate with a too long name, and this can flood the kernel logs easily, as every user can trigger this. Let's downgrade this error message level to a debug message for suppressing the superfluous logs. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1201725 Reviewed-by: Petr Vorel Signed-off-by: Takashi Iwai Signed-off-by: Namjae Jeon commit 6425baabda21748daacc2141169e07e4c2644497 Author: Takashi Iwai Date: Tue Jul 26 10:39:27 2022 +0200 exfat: Expand exfat_err() and co directly to pr_*() macro Currently the error and info messages handled by exfat_err() and co are tossed to exfat_msg() function that does nothing but passes the strings with printk() invocation. Not only that this is more overhead by the indirect calls, but also this makes harder to extend for the debug print usage; because of the direct printk() call, you cannot make it for dynamic debug or without debug like the standard helpers such as pr_debug() or dev_dbg(). For addressing the problem, this patch replaces exfat_*() macro to expand to pr_*() directly. Along with it, add the new exfat_debug() macro that is expanded to pr_debug() (which output can be gracefully suppressed via dyndbg). Reviewed-by: Petr Vorel Signed-off-by: Takashi Iwai Signed-off-by: Namjae Jeon commit 1b1a9195ae962fefd8d0785e0af434de1a3447fd Author: Takashi Iwai Date: Tue Jul 26 10:39:26 2022 +0200 exfat: Define NLS_NAME_* as bit flags explicitly NLS_NAME_* are bit flags although they are currently defined as enum; it's casually working so far (from 0 to 2), but it's error-prone and may bring a problem when we want to add more flag. This patch changes the definitions of NLS_NAME_* explicitly being bit flags. Reviewed-by: Petr Vorel Signed-off-by: Takashi Iwai Signed-off-by: Namjae Jeon commit 86da53e8ff5dcfbbbd345edc0caef7d21ce567ae Author: Takashi Iwai Date: Tue Jul 26 10:39:25 2022 +0200 exfat: Return ENAMETOOLONG consistently for oversized paths LTP has a test for oversized file path renames and it expects the return value to be ENAMETOOLONG. However, exfat returns EINVAL unexpectedly in some cases, hence LTP test fails. The further investigation indicated that the problem happens only when iocharset isn't set to utf8. The difference comes from that, in the case of utf8, exfat_utf8_to_utf16() returns the error -ENAMETOOLONG directly and it's treated as the final error code. Meanwhile, on other iocharsets, exfat_nls_to_ucs2() returns the max path size but it sets NLS_NAME_OVERLEN to lossy flag instead; the caller side checks only whether lossy flag is set or not, resulting in always -EINVAL unconditionally. This patch aligns the return code for both cases by checking the lossy flag bit and returning ENAMETOOLONG when NLS_NAME_OVERLEN bit is set. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1201725 Reviewed-by: Petr Vorel Signed-off-by: Takashi Iwai Signed-off-by: Namjae Jeon commit be17b1ccd4e82a66b9d9676dec8edce137e967d8 Author: Yuezhang Mo Date: Wed Jun 29 11:05:51 2022 +0800 exfat: remove duplicate write inode for extending dir/file Since the timestamps need to be updated, the directory entries will be updated by mark_inode_dirty() whether or not a new cluster is allocated for the file or directory, so there is no need to use __exfat_write_inode() to update the directory entries when allocating a new cluster for a file or directory. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Daniel Palmer Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 4493895b2bdcca135a8e7c1384deaa35316e8e22 Author: Yuezhang Mo Date: Wed Jun 29 10:39:59 2022 +0800 exfat: remove duplicate write inode for truncating file This commit moves updating file attributes and timestamps before calling __exfat_write_inode(), so that all updates of the inode had been written by __exfat_write_inode(), mark_inode_dirty() is unneeded. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Daniel Palmer Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 23e6e1c9b373c164bf25d89c901eed2ac0d898a1 Author: Yuezhang Mo Date: Wed Jun 29 09:51:40 2022 +0800 exfat: reuse __exfat_write_inode() to update directory entry __exfat_write_inode() is used to update file and stream directory entries, except for file->start_clu and stream->flags. This commit moves update file->start_clu and stream->flags to __exfat_write_inode() and reuse __exfat_write_inode() to update directory entries. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Daniel Palmer Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit dd0b15bda48f59eb7dee17fab91eda8389f0e98d Author: Andreas Schwab Date: Tue Jul 26 10:01:22 2022 +0200 rtla: Define syscall numbers for riscv RISC-V uses the same (generic) syscall numbers as ARM64. Link: https://lkml.kernel.org/r/mvma68wl2ul.fsf@suse.de Signed-off-by: Andreas Schwab Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4f753c3be52c1d930afc0fe3169baa605dbaf611 Author: Andreas Schwab Date: Mon Jul 25 17:12:18 2022 +0200 rtla: Fix double free Avoid double free by making trace_instance_destroy indempotent. When trace_instance_init fails, it calls trace_instance_destroy, but its only caller osnoise_destroy_tool calls it again. Link: https://lkml.kernel.org/r/mvmilnlkyzx.fsf_-_@suse.de Fixes: 0605bf009f18 ("rtla: Add osnoise tool") Signed-off-by: Andreas Schwab Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit c7d8a598c5b1e21a0957f5dec2ef4139d2d1a23a Author: Daniel Bristot de Oliveira Date: Wed Jul 13 23:32:19 2022 +0200 rtla: Fix Makefile when called from -C tools/ Sedat Dilek reported an error on rtla Makefile when running: $ make -C tools/ clean [...] make[2]: Entering directory '/home/dileks/src/linux-kernel/git/tools/tracing/rtla' [...] '/home/dileks/src/linux-kernel/git/Documentation/tools/rtla' /bin/sh: 1: test: rtla-make[2]:: unexpected operator <------ The problem rm: cannot remove '/home/dileks/src/linux-kernel/git': Is a directory make[2]: *** [Makefile:120: clean] Error 1 make[2]: Leaving directory This occurred because the rtla calls kernel's Makefile to get the version in silence mode, e.g., $ make -sC ../../.. kernelversion 5.19.0-rc4 But the -s is being ignored when rtla's makefile is called indirectly, so the output looks like this: $ make -C ../../.. kernelversion make: Entering directory '/root/linux' 5.19.0-rc4 make: Leaving directory '/root/linux' Using 'grep -v make' avoids this problem, e.g., $ make -C ../../.. kernelversion | grep -v make 5.19.0-rc4 Thus, add | grep -v make. Link: https://lkml.kernel.org/r/870c02d4d97a921f02a31fa3b229fc549af61a20.1657747763.git.bristot@kernel.org Fixes: 8619e32825fd ("rtla: Follow kernel version") Reported-by: Sedat Dilek Tested-by: Sedat Dilek Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4c3d2f9388d36eb28640a220a6f908328442d873 Author: Steven Rostedt (Google) Date: Sun Jul 31 01:59:28 2022 -0400 tracing: Use a struct alignof to determine trace event field alignment alignof() gives an alignment of types as they would be as standalone variables. But alignment in structures might be different, and when building the fields of events, the alignment must be the actual alignment otherwise the field offsets may not match what they actually are. This caused trace-cmd to crash, as libtraceevent did not check if the field offset was bigger than the event. The write_msr and read_msr events on 32 bit had their fields incorrect, because it had a u64 field between two ints. alignof(u64) would give 8, but the u64 field was at a 4 byte alignment. Define a macro as: ALIGN_STRUCTFIELD(type) ((int)(offsetof(struct {char a; type b;}, b))) which gives the actual alignment of types in a structure. Link: https://lkml.kernel.org/r/20220731015928.7ab3a154@rorschach.local.home Cc: Ingo Molnar Cc: Andrew Morton Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Masami Hiramatsu Cc: stable@vger.kernel.org Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") Signed-off-by: Steven Rostedt (Google) commit 7b584fbb36362340a2d9cfe459e447619eecebea Author: Christophe JAILLET Date: Sun Jul 31 08:32:52 2022 +0200 can: can327: fix a broken link to Documentation Since commit 482a4360c56a ("docs: networking: convert netdevices.txt to ReST"), Documentation/networking/netdevices.txt has been replaced by Documentation/networking/netdevices.rst. Update the comment accordingly to avoid a 'make htmldocs' warning. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/all/6a54aff884ea4f84b661527d75aabd6632140715.1659249135.git.christophe.jaillet@wanadoo.fr Fixes: 43da2f07622f ("can: can327: CAN/ldisc driver for ELM327 based OBD-II adapters") Signed-off-by: Marc Kleine-Budde commit 5e9466a5d0604e20082d828008047b3165592caf Author: Xie Shaowen Date: Sun Jul 31 09:20:25 2022 -0700 xfs: delete extra space and tab in blank line delete extra space and tab in blank line, there is no functional change. Reported-by: Hacash Robot Signed-off-by: Xie Shaowen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 001c179c4e26d04db8c9f5e3fef9558b58356be6 Author: ChenXiaoSong Date: Wed Jul 27 17:21:52 2022 -0700 xfs: fix NULL pointer dereference in xfs_getbmap() Reproducer: 1. fallocate -l 100M image 2. mkfs.xfs -f image 3. mount image /mnt 4. setxattr("/mnt", "trusted.overlay.upper", NULL, 0, XATTR_CREATE) 5. char arg[32] = "\x01\xff\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x08\x00\x00\x00\xc6\x2a\xf7"; fd = open("/mnt", O_RDONLY|O_DIRECTORY); ioctl(fd, _IOC(_IOC_READ|_IOC_WRITE, 0x58, 0x2c, 0x20), arg); NULL pointer dereference will occur when race happens between xfs_getbmap() and xfs_bmap_set_attrforkoff(): ioctl | setxattr ----------------------------|--------------------------- xfs_getbmap | xfs_ifork_ptr | xfs_inode_has_attr_fork | ip->i_forkoff == 0 | return NULL | ifp == NULL | | xfs_bmap_set_attrforkoff | ip->i_forkoff > 0 xfs_inode_has_attr_fork | ip->i_forkoff > 0 | ifp == NULL | ifp->if_format | Fix this by locking i_lock before xfs_ifork_ptr(). Fixes: abbf9e8a4507 ("xfs: rewrite getbmap using the xfs_iext_* helpers") Signed-off-by: ChenXiaoSong Signed-off-by: Guo Xuenan Reviewed-by: Darrick J. Wong [djwong: added fixes tag] Signed-off-by: Darrick J. Wong commit ecce9212d0fd7a2d4a4998f0c4623a66887e14c8 Author: Hongnan Li Date: Fri Jul 22 16:27:32 2022 +0800 erofs: update ctx->pos for every emitted dirent erofs_readdir update ctx->pos after filling a batch of dentries and it may cause dir/files duplication for NFS readdirplus which depends on ctx->pos to fill dir correctly. So update ctx->pos for every emitted dirent in erofs_fill_dentries to fix it. Also fix the update of ctx->pos when the initial file position has exceeded nameoff. Fixes: 3e917cc305c6 ("erofs: make filesystem exportable") Signed-off-by: Hongnan Li Signed-off-by: Jeffle Xu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220722082732.30935-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 7f8030cea33001d08cdaf2ee5a24385b2c3f723e Author: Guo Ren Date: Sat Jul 23 22:52:17 2022 -0400 csky: Enable ARCH_INLINE_READ*/WRITE*/SPIN* Enable ARCH_INLINE_READ*/WRITE*/SPIN* when !PREEMPTION, it is copied from arch/arm64. It could reduce procedure calls and improves performance. Signed-off-by: Guo Ren Signed-off-by: Guo Ren commit 45e15c1a375ea380d55880be2f8182cb737b60ed Author: Guo Ren Date: Sat Jul 23 21:32:34 2022 -0400 csky: Add qspinlock support Enable qspinlock by the requirements mentioned in a8ad07e5240c9 ("asm-generic: qspinlock: Indicate the use of mixed-size atomics"). C-SKY only has "ldex/stex" for all atomic operations. So csky give a strong forward guarantee for "ldex/stex." That means when ldex grabbed the cache line into $L1, it would block other cores from snooping the address with several cycles. The atomic_fetch_add & xchg16 has the same forward guarantee level in C-SKY. Qspinlock has better code size and performance in a fast path. Signed-off-by: Guo Ren Signed-off-by: Guo Ren commit 87f600af59e8cf6abb04bac15328bcb517e26485 Author: Phillip Potter Date: Sun Jul 31 00:59:10 2022 +0100 staging: r8188eu: fix potential uninitialised variable use in rtw_pwrctrl.c Set ret to 0 (success) before entering first if statement, thereby assuring that even if the device is not associated and further checks pass, we do not then end up returning the uninitialized value of ret. This assignment is deliberately now directly before the if statement, in order to keep it clear what is happening as opposed to having it as an initialization at the start of the function like it was originally. Also add a comment to make it clear this first if block is currently a success path. As a side note, smatch does not trigger warnings for this change, for me at least. Within core/rtw_pwrctrl.c in the rtw_pwr_wakeup function, I previously dropped the initialization of 'ret' (int ret = 0;) in favour of its assignment which happens inside the first if block directly before its corresponding goto. This was the cause of this bug, and was introduced by: commit f3a76018dd55 ("staging: r8188eu: remove initializer from ret in rtw_pwr_wakeup"). Fixes: f3a76018dd55 ("staging: r8188eu: remove initializer from ret in rtw_pwr_wakeup") Reported-by: kernel test robot Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220730235910.1145-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 5316d73ba81b5dd7fe5ecfcd4ad494a0a68ae138 Author: Sven Peter Date: Thu Jun 2 19:42:13 2022 +0200 arm64: dts: apple: t8103: Add ANS2 NVMe nodes This allows using the internal disk attached via NVMe. Signed-off-by: Sven Peter Signed-off-by: Hector Martin commit be561ffad708f0cee18aee4231f80ffafaf7a419 Author: Tim Crawford Date: Sat Jul 30 21:22:43 2022 -0600 ALSA: hda/realtek: Add quirk for Clevo NV45PZ Fixes headset detection on Clevo NV45PZ. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220731032243.4300-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 09beadf289d6e300553e60d6e76f13c0427ecab3 Author: Chao Yu Date: Wed Jul 27 22:51:05 2022 +0800 f2fs: fix to do sanity check on segment type in build_sit_entries() As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216285 RIP: 0010:memcpy_erms+0x6/0x10 f2fs_update_meta_page+0x84/0x570 [f2fs] change_curseg.constprop.0+0x159/0xbd0 [f2fs] f2fs_do_replace_block+0x5c7/0x18a0 [f2fs] f2fs_replace_block+0xeb/0x180 [f2fs] recover_data+0x1abd/0x6f50 [f2fs] f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs] f2fs_fill_super+0x4459/0x6190 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is segment type is invalid, so in f2fs_do_replace_block(), f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type, result in accessing invalid curseg->sum_blk during memcpy in f2fs_update_meta_page(). Fix this by adding sanity check on segment type in build_sit_entries(). Reported-by: Wenqing Liu Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7b01ad7f339e0a272ba840d0bafd5dfbb4e4d501 Author: Chao Yu Date: Mon Jul 25 00:04:17 2022 +0800 f2fs: obsolete unused MAX_DISCARD_BLOCKS After commit a7eeb823854c ("f2fs: use bitmap in discard_entry"), MAX_DISCARD_BLOCKS became obsolete, remove it. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 141170b759e03958f296033bb7001be62d1d363b Author: Chao Yu Date: Mon Jul 25 00:03:23 2022 +0800 f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() As Dipanjan Das reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: write_all_xattrs fs/f2fs/xattr.c:487 [inline] __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 __do_sys_lsetxattr fs/xattr.c:653 [inline] __se_sys_lsetxattr fs/xattr.c:649 [inline] __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it may trigger BUG_ON() in f2fs_new_node_page(), fix it. Reported-by: Dipanjan Das Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8ee236dcaa690d09ca612622e8bc8d09c302021d Author: Chao Liu Date: Mon Jul 25 18:16:33 2022 +0800 f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time If the inode has the compress flag, it will fail to use 'chattr -c +m' to remove its compress flag and tag no compress flag. However, the same command will be successful when executed again, as shown below: $ touch foo.txt $ chattr +c foo.txt $ chattr -c +m foo.txt chattr: Invalid argument while setting flags on foo.txt $ chattr -c +m foo.txt $ f2fs_io getflags foo.txt get a flag on foo.txt ret=0, flags=nocompression,inline_data Fix this by removing some checks in f2fs_setflags_common() that do not affect the original logic. I go through all the possible scenarios, and the results are as follows. Bold is the only thing that has changed. +---------------+-----------+-----------+----------+ | | file flags | + command +-----------+-----------+----------+ | | no flag | compr | nocompr | +---------------+-----------+-----------+----------+ | chattr +c | compr | compr | -EINVAL | | chattr -c | no flag | no flag | nocompr | | chattr +m | nocompr | -EINVAL | nocompr | | chattr -m | no flag | compr | no flag | | chattr +c +m | -EINVAL | -EINVAL | -EINVAL | | chattr +c -m | compr | compr | compr | | chattr -c +m | nocompr | *nocompr* | nocompr | | chattr -c -m | no flag | no flag | no flag | +---------------+-----------+-----------+----------+ Link: https://lore.kernel.org/linux-f2fs-devel/20220621064833.1079383-1-chaoliu719@gmail.com/ Fixes: 4c8ff7095bef ("f2fs: support data compression") Reviewed-by: Chao Yu Signed-off-by: Chao Liu Signed-off-by: Jaegeuk Kim commit f8e2f32bcde5945e8f8dbb8714178c24d221366b Author: Daeho Jeong Date: Mon Jul 18 16:02:48 2022 -0700 f2fs: introduce sysfs atomic write statistics introduce the below 4 new sysfs node for atomic write statistics. - current_atomic_write: the total current atomic write block count, which is not committed yet. - peak_atomic_write: the peak value of total current atomic write block count after boot. - committed_atomic_block: the accumulated total committed atomic write block count after boot. - revoked_atomic_block: the accumulated total revoked atomic write block count after boot. Signed-off-by: Daeho Jeong Signed-off-by: Jaegeuk Kim commit 1adaa71ea9bff3a0ca0b37eabbb7f89225b595cb Author: qixiaoyu1 Date: Mon Jul 18 11:28:40 2022 +0800 f2fs: don't bother wait_ms by foreground gc f2fs_gc returns -EINVAL via f2fs_balance_fs when there is enough free secs after write checkpoint, but with gc_merge enabled, it will cause the sleep time of gc thread to be set to no_gc_sleep_time even if there are many dirty segments can be selected. Signed-off-by: qixiaoyu1 Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0d5b9d8156396bbe1c982708b38ab9e188c45ec9 Author: Chao Yu Date: Tue Jul 12 23:26:43 2022 +0800 f2fs: invalidate meta pages only for post_read required inode After commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write"), invalidate_mapping_pages() will be called to avoid race condition in between IPU/DIO and readahead for GC. However, readahead flow is only used for post_read required inode, so this patch adds check condition to avoids unnecessary page cache invalidating for non-post_read inode. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a8634ccf5d626506100bb753327e36e6c6b3df70 Author: Chao Liu Date: Thu Jul 7 17:09:24 2022 +0800 f2fs: allow compression of files without blocks Files created by truncate(1) have a size but no blocks, so they can be allowed to enable compression. Signed-off-by: Chao Liu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7165841d578e0592848e09dc9d131aa30be44e1b Author: Chao Yu Date: Tue Jul 12 11:17:15 2022 +0800 f2fs: fix to check inline_data during compressed inode conversion When converting inode to compressed one via ioctl, it needs to check inline_data, since inline_data flag and compressed flag are incompatible. Fixes: 4c8ff7095bef ("f2fs: support data compression") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1dd55358efc4f74e49fa9e1e97a03804852a4c20 Author: Fabio M. De Francesco Date: Sun Jul 17 10:36:13 2022 +0200 f2fs: Delete f2fs_copy_page() and replace with memcpy_page() f2fs_copy_page() is a wrapper around two kmap() + one memcpy() from/to the mapped pages. It unnecessarily duplicates a kernel API and it makes use of kmap(), which is being deprecated in favor of kmap_local_page(). Two main problems with kmap(): (1) It comes with an overhead as mapping space is restricted and protected by a global lock for synchronization and (2) it also requires global TLB invalidation when the kmap’s pool wraps and it might block when the mapping space is fully utilized until a slot becomes available. With kmap_local_page() the mappings are per thread, CPU local, can take page faults, and can be called from any context (including interrupts). It is faster than kmap() in kernels with HIGHMEM enabled. Therefore, its use in __clone_blkaddrs() is safe and should be preferred. Delete f2fs_copy_page() and use a plain memcpy_page() in the only one site calling the removed function. memcpy_page() avoids open coding two kmap_local_page() + one memcpy() between the two kernel virtual addresses. Suggested-by: Christoph Hellwig Suggested-by: Ira Weiny Signed-off-by: Fabio M. De Francesco Reviewed-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 67ca06872eb02944b4c6f92cffa9242e92c63109 Author: Chao Yu Date: Wed Jul 6 14:30:15 2022 +0800 f2fs: fix to invalidate META_MAPPING before DIO write Quoted from commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write") " Encrypted pages during GC are read and cached in META_MAPPING. However, due to cached pages in META_MAPPING, there is an issue where newly written pages are lost by IPU or DIO writes. Thread A - f2fs_gc() Thread B /* phase 3 */ down_write(i_gc_rwsem) ra_data_block() ---- (a) up_write(i_gc_rwsem) f2fs_direct_IO() : - down_read(i_gc_rwsem) - __blockdev_direct_io() - get_data_block_dio_write() - f2fs_dio_submit_bio() ---- (b) - up_read(i_gc_rwsem) /* phase 4 */ down_write(i_gc_rwsem) move_data_block() ---- (c) up_write(i_gc_rwsem) (a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and cached in META_MAPPING. (b) In thread B, writing new data by IPU or DIO write on same blkaddr as read in (a). cached page in META_MAPPING become out-dated. (c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to new blkaddr. In conclusion, the newly written data in (b) is lost. To address this issue, invalidating pages in META_MAPPING before IPU or DIO write. " In previous commit, we missed to cover extent cache hit case, and passed wrong value for parameter @end of invalidate_mapping_pages(), fix both issues. Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC") Fixes: e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write") Cc: Hyeong-Jun Kim Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8e0f54a70e9b0c88d6375933d281d631b7248153 Author: Jaegeuk Kim Date: Tue Jun 28 15:49:47 2022 -0700 f2fs: add a sysfs entry to show zone capacity This patch adds a sysfs entry showing the unusable space in a section made by zone capacity. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 074b5ea2900ea8e40f8e7a3fd37e0a55ad3d5874 Author: Jaegeuk Kim Date: Tue Jun 28 11:03:57 2022 -0700 f2fs: adjust zone capacity when considering valid block count This patch fixes counting unusable blocks set by zone capacity when checking the valid block count in a section. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b771aadc6e4c221a468fe4a2dfcfffec01a06722 Author: Jaegeuk Kim Date: Tue Jun 28 10:57:24 2022 -0700 f2fs: enforce single zone capacity In order to simplify the complicated per-zone capacity, let's support only one capacity for entire zoned device. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 14de5fc3ddf3dee89068a54a4d137fc17c2c971c Author: duguowei Date: Mon Jun 20 21:39:45 2022 +0800 f2fs: remove redundant code for gc condition Remove the redundant code and use local variant as the argument directly. Make it more human-readable. Signed-off-by: duguowei [Jaegeuk Kim: make code neat] Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7a8fc586180d8c57db5cc1e2acb32bb9986f642b Author: Daeho Jeong Date: Mon Jun 20 10:38:42 2022 -0700 f2fs: introduce memory mode Introduce memory mode to supports "normal" and "low" memory modes. "low" mode is to support low memory devices. Because of the nature of low memory devices, in this mode, f2fs will try to save memory sometimes by sacrificing performance. "normal" mode is the default mode and same as before. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e625e2238a270df743cbc623b3abad8d0010abc9 Author: Krzysztof Kozlowski Date: Tue Jul 19 09:45:42 2022 +0200 dt-bindings: leds: pwm-multicolor: document max-brigthness The Multicolor PWM LED uses max-brigthness property (in the example and in the driver), so document it to fixi dt_binding_check warning like: leds/leds-pwm-multicolor.example.dtb: led-controller: multi-led: Unevaluated properties are not allowed ('max-brightness' was unexpected) Reported-by: Rob Herring Reviewed-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Signed-off-by: Pavel Machek commit a01633cd867b8ddf2d8321fe575dc3c54e037b09 Author: Greg Kroah-Hartman Date: Fri Jul 29 16:03:46 2022 +0200 leds: turris-omnia: convert to use dev_groups The driver core supports the ability to handle the creation and removal of device-specific sysfs files in a race-free manner. Take advantage of that by converting this driver to use this by moving the sysfs attributes into a group and assigning the dev_groups pointer to it. Cc: Pavel Machek Cc: linux-leds@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Marek Behún Signed-off-by: Greg Kroah-Hartman Signed-off-by: Pavel Machek commit e88043c0ac16f19960048372dcffc6df7c05c5b8 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:55 2022 +0200 rv/reactor: Add the panic reactor Sample reactor that panics the system when an exception is found. This is useful both to capture a vmcore, or to fail-safe a critical system. Link: https://lkml.kernel.org/r/729aae3aba95f35738b8f8180e626d747d1d9da2.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 135b881ea88566f27dd4acc5d2ed83ad418a3a69 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:54 2022 +0200 rv/reactor: Add the printk reactor A reactor that printks the reaction message. Link: https://lkml.kernel.org/r/b65f18a7fd6dc6659a3008fd7b7392de3465d47b.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit ccc319dcb450d57b7befe924453d06804d83ba73 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:53 2022 +0200 rv/monitor: Add the wwnr monitor Per task wakeup while not running (wwnr) monitor. This model is broken, the reason is that a task can be running in the processor without being set as RUNNABLE. Think about a task about to sleep: 1: set_current_state(TASK_UNINTERRUPTIBLE); 2: schedule(); And then imagine an IRQ happening in between the lines one and two, waking the task up. BOOM, the wakeup will happen while the task is running. Q: Why do we need this model, so? A: To test the reactors. Link: https://lkml.kernel.org/r/473c0fc39967250fdebcff8b620311c11dccad30.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 10bde81c74863472047f31304064018c40f488ee Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:52 2022 +0200 rv/monitor: Add the wip monitor The wakeup in preemptive (wip) monitor verifies if the wakeup events always take place with preemption disabled: | | v #==================# H preemptive H <+ #==================# | | | | preempt_disable | preempt_enable v | sched_waking +------------------+ | +--------------- | | | | | non_preemptive | | +--------------> | | -+ +------------------+ The wakeup event always takes place with preemption disabled because of the scheduler synchronization. However, because the preempt_count and its trace event are not atomic with regard to interrupts, some inconsistencies might happen. The documentation illustrates one of these cases. Link: https://lkml.kernel.org/r/c98ca678df81115fddc04921b3c79720c836b18f.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 8812d21219b9c649dd25eb93915e00939944aeb7 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:51 2022 +0200 rv/monitor: Add the wip monitor skeleton created by dot2k THIS CODE IS NOT LINKED TO THE MAKEFILE. This model does not compile because it lacks the instrumentation part, which will be added next. In the typical case, there will be only one patch, but it was split into two patches for educational purposes. This is the direct output this command line: $ dot2k -d tools/verification/models/wip.dot -t per_cpu Link: https://lkml.kernel.org/r/5eb7a9118917e8a814c5e49853a72fc62be0a101.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit b6172b5185d4f57f93ef85b7729ee06c5bc0cbe3 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:50 2022 +0200 Documentation/rv: Add deterministic automata instrumentation documentation Add the da_monitor_instrumentation.rst. It describes the basics of RV monitor instrumentation. Link: https://lkml.kernel.org/r/0557d5c68e2fc252f2643c2cc5295a67e2b73277.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit d57aff24796f8f784e1f7beed6da3308e5bb13c0 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:49 2022 +0200 Documentation/rv: Add deterministic automata monitor synthesis documentation Add the da_monitor_synthesis.rst introduces some concepts behind the Deterministic Automata (DA) monitor synthesis and interface. Link: https://lkml.kernel.org/r/7873bdb7b2e5d2bc0b2eb6ca0b324af9a0ba27a0.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 24bce201d79807b668bf9d9e0aca801c5c0d5f78 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:48 2022 +0200 tools/rv: Add dot2k transform .dot file into kernel rv monitor usage: dot2k [-h] -d DOT_FILE -t MONITOR_TYPE [-n MODEL_NAME] [-D DESCRIPTION] optional arguments: -h, --help show this help message and exit -d DOT_FILE, --dot DOT_FILE -t MONITOR_TYPE, --monitor_type MONITOR_TYPE -n MODEL_NAME, --model_name MODEL_NAME -D DESCRIPTION, --description DESCRIPTION Link: https://lkml.kernel.org/r/083b3ae61e5a62c1e2e5d08009baa91f82181618.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4041b9bbfbcddd239ff2c090f0da43bb3df7818c Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:47 2022 +0200 Documentation/rv: Add deterministic automaton documentation Add documentation about deterministic automaton and its possible representations (formal, graphic, .dot and C). Link: https://lkml.kernel.org/r/387edaed87630bd5eb37c4275045dfd229700aa6.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit e3c9fc78f096b83e81329b213c25fb9a376e373a Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:46 2022 +0200 tools/rv: Add dot2c dot2c is a tool that transforms an automata in the graphiviz .dot file into an C representation of the automata. usage: dot2c [-h] dot_file dot2c: converts a .dot file into a C structure positional arguments: dot_file The dot file to be converted optional arguments: -h, --help show this help message and exit Link: https://lkml.kernel.org/r/b26204ba9509c80bcda31b76cdea31ddb188cd24.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit ff0aaf671230d409a68fd7400f41e9eb3ac61dd8 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:45 2022 +0200 Documentation/rv: Add a basic documentation Add the runtime-verification.rst document, explaining the basics of RV and how to use the interface. Link: https://lkml.kernel.org/r/4be7d1a88ab1e2eb0767521e1ab52a149a154bc4.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit cc8e71c81746de1f8a44873015bc963a868eccba Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:44 2022 +0200 rv/include: Add instrumentation helper functions Instrumentation helper functions to facilitate the instrumentation of auto-generated RV monitors create by dot2k. Link: https://lkml.kernel.org/r/3b36c9435f9d9299beb84e5c7c46920e205bedec.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 792575348ff70e05c6040d02fce38e949ef92c37 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:43 2022 +0200 rv/include: Add deterministic automata monitor definition via C macros In Linux terms, the runtime verification monitors are encapsulated inside the "RV monitor" abstraction. The "RV monitor" includes a set of instances of the monitor (per-cpu monitor, per-task monitor, and so on), the helper functions that glue the monitor to the system reference model, and the trace output as a reaction for event parsing and exceptions, as depicted below: Linux +----- RV Monitor ----------------------------------+ Formal Realm | | Realm +-------------------+ +----------------+ +-----------------+ | Linux kernel | | Monitor | | Reference | | Tracing | -> | Instance(s) | <- | Model | | (instrumentation) | | (verification) | | (specification) | +-------------------+ +----------------+ +-----------------+ | | | | V | | +----------+ | | | Reaction | | | +--+--+--+-+ | | | | | | | | | +-> trace output ? | +------------------------|--|----------------------+ | +----> panic ? +-------> Add the rv/da_monitor.h, enabling automatic code generation for the *Monitor Instance(s)* using C macros, and code to support it. The benefits of the usage of macro for monitor synthesis are 3-fold as it: - Reduces the code duplication; - Facilitates the bug fix/improvement; - Avoids the case of developers changing the core of the monitor code to manipulate the model in a (let's say) non-standard way. This initial implementation presents three different types of monitor instances: - DECLARE_DA_MON_GLOBAL(name, type) - DECLARE_DA_MON_PER_CPU(name, type) - DECLARE_DA_MON_PER_TASK(name, type) The first declares the functions for a global deterministic automata monitor, the second for monitors with per-cpu instances, and the third with per-task instances. Link: https://lkml.kernel.org/r/51b0bf425a281e226dfeba7401d2115d6091f84e.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 09ecd8b8c585c95a3b8dbdec86c15a981fdfeba1 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:42 2022 +0200 rv/include: Add helper functions for deterministic automata Formally, a deterministic automaton, denoted by G, is defined as a quintuple: G = { X, E, f, x_0, X_m } where: - X is the set of states; - E is the finite set of events; - x_0 is the initial state; - X_m (subset of X) is the set of marked states. - f : X x E -> X $ is the transition function. It defines the state transition in the occurrence of a event from E in the state X. In the special case of deterministic automata, the occurrence of the event in E in a state in X has a deterministic next state from X. An automaton can also be represented using a graphical format of vertices (nodes) and edges. The open-source tool Graphviz can produce this graphic format using the (textual) DOT language as the source code. The dot2c tool presented in this paper: De Oliveira, Daniel Bristot; Cucinotta, Tommaso; De Oliveira, Romulo Silva. Efficient formal verification for the Linux kernel. In: International Conference on Software Engineering and Formal Methods. Springer, Cham, 2019. p. 315-332. Translates a deterministic automaton in the DOT format into a C source code representation that to be used for monitoring. This header file implements helper functions to facilitate the usage of the C output from dot2c/k for monitoring. Link: https://lkml.kernel.org/r/563234f2bfa84b540f60cf9e39c2d9f0eea95a55.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 04acadcb4453cf8011dd3d4ce8d97fecac42d325 Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:41 2022 +0200 rv: Add runtime reactors interface A runtime monitor can cause a reaction to the detection of an exception on the model's execution. By default, the monitors have tracing reactions, printing the monitor output via tracepoints. But other reactions can be added (on-demand) via this interface. The user interface resembles the kernel tracing interface and presents these files: "available_reactors" - Reading shows the available reactors, one per line. For example: # cat available_reactors nop panic printk "reacting_on" - It is an on/off general switch for reactors, disabling all reactions. "monitors/MONITOR/reactors" - List available reactors, with the select reaction for the given MONITOR inside []. The default one is the nop (no operation) reactor. - Writing the name of a reactor enables it to the given MONITOR. For example: # cat monitors/wip/reactors [nop] panic printk # echo panic > monitors/wip/reactors # cat monitors/wip/reactors nop [panic] printk Link: https://lkml.kernel.org/r/1794eb994637457bdeaa6bad0b8263d2f7eece0c.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 102227b970a15256f5ffd12a6a276ddf978e6caf Author: Daniel Bristot de Oliveira Date: Fri Jul 29 11:38:40 2022 +0200 rv: Add Runtime Verification (RV) interface RV is a lightweight (yet rigorous) method that complements classical exhaustive verification techniques (such as model checking and theorem proving) with a more practical approach to complex systems. RV works by analyzing the trace of the system's actual execution, comparing it against a formal specification of the system behavior. RV can give precise information on the runtime behavior of the monitored system while enabling the reaction for unexpected events, avoiding, for example, the propagation of a failure on safety-critical systems. The development of this interface roots in the development of the paper: De Oliveira, Daniel Bristot; Cucinotta, Tommaso; De Oliveira, Romulo Silva. Efficient formal verification for the Linux kernel. In: International Conference on Software Engineering and Formal Methods. Springer, Cham, 2019. p. 315-332. And: De Oliveira, Daniel Bristot. Automata-based formal analysis and verification of the real-time Linux kernel. PhD Thesis, 2020. The RV interface resembles the tracing/ interface on purpose. The current path for the RV interface is /sys/kernel/tracing/rv/. It presents these files: "available_monitors" - List the available monitors, one per line. For example: # cat available_monitors wip wwnr "enabled_monitors" - Lists the enabled monitors, one per line; - Writing to it enables a given monitor; - Writing a monitor name with a '!' prefix disables it; - Truncating the file disables all enabled monitors. For example: # cat enabled_monitors # echo wip > enabled_monitors # echo wwnr >> enabled_monitors # cat enabled_monitors wip wwnr # echo '!wip' >> enabled_monitors # cat enabled_monitors wwnr # echo > enabled_monitors # cat enabled_monitors # Note that more than one monitor can be enabled concurrently. "monitoring_on" - It is an on/off general switcher for monitoring. Note that it does not disable enabled monitors or detach events, but stop the per-entity monitors of monitoring the events received from the system. It resembles the "tracing_on" switcher. "monitors/" Each monitor will have its one directory inside "monitors/". There the monitor specific files will be presented. The "monitors/" directory resembles the "events" directory on tracefs. For example: # cd monitors/wip/ # ls desc enable # cat desc wakeup in preemptive per-cpu testing monitor. # cat enable 0 For further information, see the comments in the header of kernel/trace/rv/rv.c from this patch. Link: https://lkml.kernel.org/r/a4bfe038f50cb047bfb343ad0e12b0e646ab308b.1659052063.git.bristot@kernel.org Cc: Wim Van Sebroeck Cc: Guenter Roeck Cc: Jonathan Corbet Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Will Deacon Cc: Catalin Marinas Cc: Marco Elver Cc: Dmitry Vyukov Cc: "Paul E. McKenney" Cc: Shuah Khan Cc: Gabriele Paoloni Cc: Juri Lelli Cc: Clark Williams Cc: Tao Zhou Cc: Randy Dunlap Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-devel@vger.kernel.org Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit ac6c1b2ca77e722a1e5d651f12f437f2f237e658 Author: Steven Rostedt (Google) Date: Tue Jul 26 10:18:51 2022 -0400 ftrace/x86: Add back ftrace_expected assignment When a ftrace_bug happens (where ftrace fails to modify a location) it is helpful to have what was at that location as well as what was expected to be there. But with the conversion to text_poke() the variable that assigns the expected for debugging was dropped. Unfortunately, I noticed this when I needed it. Add it back. Link: https://lkml.kernel.org/r/20220726101851.069d2e70@gandalf.local.home Cc: "x86@kernel.org" Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Andrew Morton Cc: stable@vger.kernel.org Fixes: 768ae4406a5c ("x86/ftrace: Use text_poke()") Signed-off-by: Steven Rostedt (Google) commit 3a2dcbaf4d31023106975d6ae75b6df080c454cb Author: Steven Rostedt (Google) Date: Tue Jul 19 18:20:04 2022 -0400 tracing: Use a copy of the va_list for __assign_vstr() If an instance of tracing enables the same trace event as another instance, or the top level instance, or even perf, then the va_list passed into some tracepoints can be used more than once. As va_list can only be traversed once, this can cause issues: # cat /sys/kernel/tracing/instances/qla2xxx/trace cat-56106 [012] ..... 2419873.470098: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered (null). cat-56106 [012] ..... 2419873.470101: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered ×+<96>²Ü<98>^H. cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0xde589000. # cat /sys/kernel/tracing/trace cat-56106 [012] ..... 2419873.470097: ql_dbg_log: qla2xxx [0000:05:00.0]-1054:14: Entered qla2x00_get_firmware_state. cat-56106 [012] ..... 2419873.470100: ql_dbg_log: qla2xxx [0000:05:00.0]-1000:14: Entered qla2x00_mailbox_command. cat-56106 [012] ..... 2419873.470102: ql_dbg_log: qla2xxx [0000:05:00.0]-1006:14: Prepare to issue mbox cmd=0x69. The instance version is corrupted because the top level instance iterated the va_list first. Use va_copy() in the __assign_vstr() macro to make sure that each trace event for each use case gets a fresh va_list. Link: https://lore.kernel.org/all/259d53a5-958e-6508-4e45-74dba2821242@marvell.com/ Link: https://lkml.kernel.org/r/20220719182004.21daa83e@gandalf.local.home Fixes: 0563231f93c6d ("tracing/events: Add __vstring() and __assign_vstr() helper macros") Reported-by: Arun Easi Signed-off-by: Steven Rostedt (Google) commit 9abc291812d784bd4a26c01af4ebdbf9f2dbf0bb Author: Steven Rostedt (Google) Date: Sun Jul 24 19:16:50 2022 -0400 batman-adv: tracing: Use the new __vstring() helper Instead of open coding a __dynamic_array() with a fixed length (which defeats the purpose of the dynamic array in the first place). Use the new __vstring() helper that will use a va_list and only write enough of the string into the ring buffer that is needed. Link: https://lkml.kernel.org/r/20220724191650.236b1355@rorschach.local.home Cc: Marek Lindner Cc: Ingo Molnar Cc: Andrew Morton Cc: Simon Wunderlich Cc: Antonio Quartulli Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: b.a.t.m.a.n@lists.open-mesh.org Cc: netdev@vger.kernel.org Acked-by: Sven Eckelmann Signed-off-by: Steven Rostedt (Google) commit ee47620367d5b5ee6a1934888bf1ae46576be757 Author: Masahiro Yamada Date: Sun Jul 24 18:59:19 2022 +0900 kbuild: add dtbs_prepare target Factor out the common prerequisites for DT compilation into the new target, dtbs_prepare. Add comments to explain why include/config/kernel.release is the prerequisite. Our policy is that installation targets must not rebuild anything in the tree. If 'make modules_install' is executed as root, include/config/kernel.release may be owned by root. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov commit d2139dfca361a1f5bfc4d4a23455b1a409a69cd4 Author: Andy Shevchenko Date: Sat Jul 30 18:28:46 2022 +0200 firmware: dmi: Use the proper accessor for the version field The byte at offset 6 represents length. Don't take it and drop it immediately by using proper accessor, i.e. get_unaligned_be24(). [JD: Change the subject to something less frightening] Signed-off-by: Andy Shevchenko Signed-off-by: Jean Delvare commit 4e8bb4ba5a558159ffbfa7e60322a1c151c3903c Author: Guo Ren Date: Mon Apr 18 21:01:54 2022 +0800 csky: Add jump-label implementation Add jump-label implementation for static branch Signed-off-by: Guo Ren Signed-off-by: Guo Ren commit 534ea58b3ceb41d668adf18c4e68a846e770a6c8 Author: Alexander Sverdlin Date: Mon Jul 25 11:17:40 2022 +0200 Revert "MIPS: octeon: Remove vestiges of CONFIG_CAVIUM_RESERVE32" This reverts commit e98b461bb057aaea6fa766260788c08825213837. We actually have been using the CONFIG_CAVIUM_RESERVE32 and previous patch defined it in the corresponding Kconfig. Signed-off-by: Alexander Sverdlin Signed-off-by: Thomas Bogendoerfer commit 3e3114ac460e94825e34d1fed6a48a9ce4b07689 Author: Alexander Sverdlin Date: Mon Jul 25 11:17:39 2022 +0200 MIPS: Introduce CAVIUM_RESERVE32 Kconfig option This options is used to reserve a shared memory region for user processes to use for hardware memory buffers. The actual code to support the option comes in the following patch. Signed-off-by: Corey Minyard Signed-off-by: Alexander Sverdlin Signed-off-by: Thomas Bogendoerfer commit d3cd4d9fc1f024b09967e672fb0ef82f05444b75 Author: Randy Dunlap Date: Sat Jul 23 22:57:23 2022 -0700 MIPS: msi-octeon: eliminate kernel-doc warnings Rearrange kernel-doc notation for 2 functions to eliminate kernel-doc warnings. Use Return: notation for the function return value description. Add function short descriptions for both functions. Correct 2 typos. Fixes these kernel-doc warnings: msi-octeon.c:49: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Called when a driver request MSI interrupts instead of the msi-octeon.c:49: warning: missing initial short description on line: * Called when a driver request MSI interrupts instead of the msi-octeon.c:62: warning: No description found for return value of 'arch_setup_msi_irq' msi-octeon.c:189: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Called when a device no longer needs its MSI interrupts. All msi-octeon.c:189: warning: missing initial short description on line: * Called when a device no longer needs its MSI interrupts. All Fixes: e8635b484f64 ("MIPS: Add Cavium OCTEON PCI support.") Reported-by: kernel test robot Signed-off-by: Randy Dunlap Cc: Aditya Srivastava Cc: Thomas Bogendoerfer Cc: linux-mips@vger.kernel.org Signed-off-by: Thomas Bogendoerfer commit b8295e44c7619289a7d5024156753c0e3a30daf8 Author: Jason Wang Date: Sat Jul 16 12:01:19 2022 +0800 MIPS: Fix comment typo Fix the typo `s/that that/than that/' in line 72. Signed-off-by: Jason Wang Signed-off-by: Thomas Bogendoerfer commit 04d9490986d1e04a38db88276115e6b3c9ec3faa Author: Shaoqin Huang Date: Fri Jul 29 10:11:25 2022 -0600 memblock test: Modify the obsolete description in README The VERBOSE option in Makefile has been moved, but there still have the description left in README. For now, we use `-v` options when running memblock test to print information, so using the new to replace the obsolete items. Signed-off-by: Shaoqin Huang Acked-by: Rebecca Mckeever Signed-off-by: Mike Rapoport Link: https://lore.kernel.org/r/20220729161125.190845-1-shaoqin.huang@intel.com commit 3790a3d6dbbc48e30586e9c3fc752a00e2e11946 Author: Philipp Jungkamp Date: Fri Jul 29 18:21:03 2022 +0200 ALSA: hda/realtek: Add quirk for Lenovo Yoga9 14IAP7 The Lenovo Yoga 9 14IAP7 is set up similarly to the Thinkpad X1 7th and 8th Gen. It also has the speakers attached to NID 0x14 and the bass speakers to NID 0x17, but here the codec misreports the NID 0x17 as unconnected. The pincfg and hda verbs connect and activate the bass speaker amplifiers, but the generic driver will connect them to NID 0x06 which has no volume control. Set connection list/preferred connections is required to gain volume control. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555 Signed-off-by: Philipp Jungkamp Cc: Link: https://lore.kernel.org/r/20220729162103.6062-1-p.jungkamp@gmx.net Signed-off-by: Takashi Iwai commit 63757225a93353bc2ce4499af5501eabdbbf23f9 Merge: 84a8d931ab213 069448b2fd0a4 Author: Jakub Kicinski Date: Fri Jul 29 21:39:06 2022 -0700 Merge tag 'mlx5-updates-2022-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2022-07-28 Misc updates to mlx5 driver: 1) Gal corrects to use skb_tcp_all_headers on encapsulated skbs. 2) Roi Adds the support for offloading standalone police actions. 3) lama, did some refactoring to minimize code coupling with mlx5e_priv "god object" in some of the follows, and converts some of the objects to pointers to preserve on memory when these objects aren't needed. This is part one of two parts series. * tag 'mlx5-updates-2022-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Move mlx5e_init_l2_addr to en_main net/mlx5e: Split en_fs ndo's and move to en_main net/mlx5e: Separate mlx5e_set_rx_mode_work and move caller to en_main net/mlx5e: Add mdev to flow_steering struct net/mlx5e: Report flow steering errors with mdev err report API net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer net/mlx5e: Allocate VLAN and TC for featured profiles only net/mlx5e: Make mlx5e_tc_table private net/mlx5e: Convert mlx5e_tc_table member of mlx5e_flow_steering to pointer net/mlx5e: TC, Support tc action api for police net/mlx5e: TC, Separate get/update/replace meter functions net/mlx5e: Add red and green counters for metering net/mlx5e: TC, Allocate post meter ft per rule net/mlx5: DR, Add support for flow metering ASO net/mlx5e: Fix wrong use of skb_tcp_all_headers() with encapsulation ==================== Link: https://lore.kernel.org/r/20220728205728.143074-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 50417d22d0efbb1be76c3cb66b2329f83741c9c7 Author: Sebastian Andrzej Siewior Date: Wed Jul 27 13:49:04 2022 +0200 fs/dcache: Move wakeup out of i_seq_dir write held region. __d_add() and __d_move() wake up waiters on dentry::d_wait from within the i_seq_dir write held region. This violates the PREEMPT_RT constraints as the wake up acquires wait_queue_head::lock which is a "sleeping" spinlock on RT. There is no requirement to do so. __d_lookup_unhash() has cleared DCACHE_PAR_LOOKUP and dentry::d_wait and returned the now unreachable wait queue head pointer to the caller, so the actual wake up can be postponed until the i_dir_seq write side critical section is left. The only requirement is that dentry::lock is held across the whole sequence including the wake up. The previous commit includes an analysis why this is considered safe. Move the wake up past end_dir_add() which leaves the i_dir_seq write side critical section and enables preemption. For non RT kernels there is no difference because preemption is still disabled due to dentry::lock being held, but it shortens the time between wake up and unlocking dentry::lock, which reduces the contention for the woken up waiter. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Al Viro commit 45f78b0a2743c4fd71b73400bd5d5339628bf538 Author: Sebastian Andrzej Siewior Date: Wed Jul 27 13:49:03 2022 +0200 fs/dcache: Move the wakeup from __d_lookup_done() to the caller. __d_lookup_done() wakes waiters on dentry->d_wait. On PREEMPT_RT we are not allowed to do that with preemption disabled, since the wakeup acquired wait_queue_head::lock, which is a "sleeping" spinlock on RT. Calling it under dentry->d_lock is not a problem, since that is also a "sleeping" spinlock on the same configs. Unfortunately, two of its callers (__d_add() and __d_move()) are holding more than just ->d_lock and that needs to be dealt with. The key observation is that wakeup can be moved to any point before dropping ->d_lock. As a first step to solve this, move the wake up outside of the hlist_bl_lock() held section. This is safe because: Waiters get inserted into ->d_wait only after they'd taken ->d_lock and observed DCACHE_PAR_LOOKUP in flags. As long as they are woken up (and evicted from the queue) between the moment __d_lookup_done() has removed DCACHE_PAR_LOOKUP and dropping ->d_lock, we are safe, since the waitqueue ->d_wait points to won't get destroyed without having __d_lookup_done(dentry) called (under ->d_lock). ->d_wait is set only by d_alloc_parallel() and only in case when it returns a freshly allocated in-lookup dentry. Whenever that happens, we are guaranteed that __d_lookup_done() will be called for resulting dentry (under ->d_lock) before the wq in question gets destroyed. With two exceptions wq lives in call frame of the caller of d_alloc_parallel() and we have an explicit d_lookup_done() on the resulting in-lookup dentry before we leave that frame. One of those exceptions is nfs_call_unlink(), where wq is embedded into (dynamically allocated) struct nfs_unlinkdata. It is destroyed in nfs_async_unlink_release() after an explicit d_lookup_done() on the dentry wq went into. Remaining exception is d_add_ci(). There wq is what we'd found in ->d_wait of d_add_ci() argument. Callers of d_add_ci() are two instances of ->d_lookup() and they must have been given an in-lookup dentry. Which means that they'd been called by __lookup_slow() or lookup_open(), with wq in the call frame of one of those. Result of d_alloc_parallel() in d_add_ci() is fed to d_splice_alias(), which either returns non-NULL (and d_add_ci() does d_lookup_done()) or feeds dentry to __d_add() that will do __d_lookup_done() under ->d_lock. That concludes the analysis. Let __d_lookup_unhash(): 1) Lock the lookup hash and clear DCACHE_PAR_LOOKUP 2) Unhash the dentry 3) Retrieve and clear dentry::d_wait 4) Unlock the hash and return the retrieved waitqueue head pointer 5) Let the caller handle the wake up. 6) Rename __d_lookup_done() to __d_lookup_unhash_wake() to enforce build failures for OOT code that used __d_lookup_done() and is not aware of the new return value. This does not yet solve the PREEMPT_RT problem completely because preemption is still disabled due to i_dir_seq being held for write. This will be addressed in subsequent steps. An alternative solution would be to switch the waitqueue to a simple waitqueue, but aside of Linus not being a fan of them, moving the wake up closer to the place where dentry::lock is unlocked reduces lock contention time for the woken up waiter. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Sebastian Andrzej Siewior Link: https://lkml.kernel.org/r/20220613140712.77932-3-bigeasy@linutronix.de Signed-off-by: Al Viro commit cf634d540a29018e8d69ab1befb7e08182bc6594 Author: Sebastian Andrzej Siewior Date: Wed Jul 27 13:49:02 2022 +0200 fs/dcache: Disable preemption on i_dir_seq write side on PREEMPT_RT i_dir_seq is a sequence counter with a lock which is represented by the lowest bit. The writer atomically updates the counter which ensures that it can be modified by only one writer at a time. This requires preemption to be disabled across the write side critical section. On !PREEMPT_RT kernels this is implicit by the caller acquiring dentry::lock. On PREEMPT_RT kernels spin_lock() does not disable preemption which means that a preempting writer or reader would live lock. It's therefore required to disable preemption explicitly. An alternative solution would be to replace i_dir_seq with a seqlock_t for PREEMPT_RT, but that comes with its own set of problems due to arbitrary lock nesting. A pure sequence count with an associated spinlock is not possible because the locks held by the caller are not necessarily related. As the critical section is small, disabling preemption is a sensible solution. Reported-by: Oleg.Karfich@wago.com Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Signed-off-by: Sebastian Andrzej Siewior Link: https://lkml.kernel.org/r/20220613140712.77932-2-bigeasy@linutronix.de Signed-off-by: Al Viro commit 40a3cb0d2314a41975aa385a74643878454f6eac Author: Al Viro Date: Sat Jul 30 00:29:05 2022 -0400 d_add_ci(): make sure we don't miss d_lookup_done() All callers of d_alloc_parallel() must make sure that resulting in-lookup dentry (if any) will encounter __d_lookup_done() before the final dput(). d_add_ci() might end up creating in-lookup dentries; they are fed to d_splice_alias(), which will normally make sure they meet __d_lookup_done(). However, it is possible to end up with d_splice_alias() failing with ERR_PTR(-ELOOP) without having done so. It takes a corrupted ntfs or case-insensitive xfs image, but neither should end up with memory corruption... Signed-off-by: Al Viro commit 9e98f8c7707f8bf4552806b17e42c54548d29527 Merge: b65a1534cfd60 42b4f7f66a43c Author: Jakub Kicinski Date: Fri Jul 29 21:28:56 2022 -0700 Merge tag 'mlx5-fixes-2022-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2022-07-28 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2022-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Fix driver use of uninitialized timeout net/mlx5: DR, Fix SMFS steering info dump format net/mlx5: Adjust log_max_qp to be 18 at most net/mlx5e: Modify slow path rules to go to slow fdb net/mlx5e: Fix calculations related to max MPWQE size net/mlx5e: xsk: Account for XSK RQ UMRs when calculating ICOSQ size net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS net/mlx5e: TC, Fix post_act to not match on in_port metadata net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version ==================== Link: https://lore.kernel.org/r/20220728204640.139990-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 84a8d931ab213250932959c4f929a7e7e670b8a7 Merge: ed3849e429179 44ece4e1a3ecb Author: Jakub Kicinski Date: Fri Jul 29 21:26:09 2022 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== 100GbE Intel Wired LAN Driver Updates 2022-07-28 This series contains updates to ice driver only. Michal allows for VF true promiscuous mode to be set for multiple VFs and adds clearing of promiscuous filters when VF trust is removed. Maciej refactors ice_set_features() to track/check changed features instead of constantly checking against netdev features and adds support for NETIF_F_LOOPBACK. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: allow toggling loopback mode via ndo_set_features callback ice: compress branches in ice_set_features() ice: Fix promiscuous mode not turning off ice: Introduce enabling promiscuous mode on multiple VF's ==================== Link: https://lore.kernel.org/r/20220728195538.3391360-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ed3849e429179cd9146a0d7815d23f1c7ed7508b Merge: 71930846b36f8 7267aa6d99f5b Author: Jakub Kicinski Date: Fri Jul 29 21:22:09 2022 -0700 Merge branch 'sfc-vf-representors-for-ef100-rx-side' Edward Cree says: ==================== sfc: VF representors for EF100 - RX side This series adds the receive path for EF100 VF representors, plus other minor features such as statistics. ==================== Link: https://lore.kernel.org/r/cover.1659034549.git.ecree.xilinx@gmail.com Signed-off-by: Jakub Kicinski commit 7267aa6d99f5b82f6d0e4f537d87fa9b6ab86411 Author: Edward Cree Date: Thu Jul 28 19:57:52 2022 +0100 sfc: implement ethtool get/set RX ring size for EF100 reps It's not truly a ring, but the maximum length of the list of queued RX SKBs is analogous to an RX ring size, so use that API to configure it. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit e37f3b1561a038c0630e7364740d6d55f2b5d5b5 Author: Edward Cree Date: Thu Jul 28 19:57:51 2022 +0100 sfc: use a dynamic m-port for representor RX and set it promisc Representors do not want to be subject to the PF's Ethernet address filters, since traffic from VFs will typically have a destination either elsewhere on the link segment or on an overlay network. So, create a dynamic m-port with promiscuous and all-multicast filters, and set it as the egress port of representor default rules. Since the m-port is an alias of the calling PF's own m-port, traffic will still be delivered to the PF's RXQs, but it will be subject to the VNRX filter rules installed on the dynamic m-port (specified by the v-port ID field of the filter spec). Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 77eb40749d73fe347c47d6903874a924840ff8d5 Author: Edward Cree Date: Thu Jul 28 19:57:50 2022 +0100 sfc: move table locking into filter_table_{probe,remove} methods We need to be able to drop the efx->filter_sem in ef100_filter_table_up() so that we can call functions that insert filters (and thus take that rwsem for read), which means the efx->type->filter_table_probe method needs to be responsible for taking the lock in the first place. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 67ab160ed08f5bb55aff55aa41e6bde56cb83661 Author: Edward Cree Date: Thu Jul 28 19:57:49 2022 +0100 sfc: insert default MAE rules to connect VFs to representors Default rules are low-priority switching rules which the hardware uses in the absence of higher-priority rules. Each representor requires a corresponding rule matching traffic from its representee VF and delivering to the PF (where a check on INGRESS_MPORT in __ef100_rx_packet() will direct it to the representor). No rule is required in the reverse direction, because representor TX uses a TX override descriptor to bypass the MAE and deliver directly to the VF. Since inserting any rule into the MAE disables the firmware's own default rules, also insert a pair of rules to connect the PF to the physical network port and vice-versa. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit f50e8fcda6b8d39db9098f7e1146dc491696ab91 Author: Edward Cree Date: Thu Jul 28 19:57:48 2022 +0100 sfc: receive packets from EF100 VFs into representors If the source m-port of a packet in __ef100_rx_packet() is a VF, hand off the packet to the corresponding representor with efx_ef100_rep_rx_packet(). Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 08d0b16ecb3649025336e104d8d25f56abde563c Author: Edward Cree Date: Thu Jul 28 19:57:47 2022 +0100 sfc: check ef100 RX packets are from the wire If not, for now drop them and warn. A subsequent patch will look up the source m-port to try and find a representor to deliver them to. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 6f6838aabff5ea99af1c78ab02838b8d471f218d Author: Edward Cree Date: Thu Jul 28 19:57:46 2022 +0100 sfc: determine wire m-port at EF100 PF probe time Traffic delivered to the (MAE admin) PF could be from either the wire or a VF. The INGRESS_MPORT field of the RX prefix distinguishes these; base_mport is the value this field will have for traffic from the wire (which should be delivered to the PF's netdevice, not a representor). Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 9fe00c800ecd667acb7748cab7fcd3068c58498a Author: Edward Cree Date: Thu Jul 28 19:57:45 2022 +0100 sfc: ef100 representor RX top half Representor RX uses a NAPI context driven by a 'fake interrupt': when the parent PF receives a packet destined for the representor, it adds it to an SKB list (efv->rx_list), and schedules NAPI if the 'fake interrupt' is primed. The NAPI poll then pulls packets off this list and feeds them to the stack with netif_receive_skb_list(). This scheme allows us to decouple representor RX from the parent PF's RX fast-path. This patch implements the 'top half', which builds an SKB, copies data into it from the RX buffer (which can then be released), adds it to the queue and fires the 'fake interrupt' if necessary. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 69bb5fa73d2b2d7fa3ccbf16e8b1f055fe2d26b1 Author: Edward Cree Date: Thu Jul 28 19:57:44 2022 +0100 sfc: ef100 representor RX NAPI poll This patch adds the 'bottom half' napi->poll routine for representor RX. See the next patch (with the top half) for an explanation of the 'fake interrupt' scheme used to drive this NAPI context. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit a95115c407a26c55fdeb6750811a0252687b331e Author: Edward Cree Date: Thu Jul 28 19:57:43 2022 +0100 sfc: plumb ef100 representor stats Implement .ndo_get_stats64() method to read values out of struct efx_rep_sw_stats. Signed-off-by: Edward Cree Signed-off-by: Jakub Kicinski commit 71930846b36f8e4e68267f8a3d47e33435c3657a Author: Dan Carpenter Date: Thu Jul 28 17:32:36 2022 +0300 net: marvell: prestera: uninitialized variable bug The "ret" variable needs to be initialized at the start. Fixes: 52323ef75414 ("net: marvell: prestera: add phylink support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YuKeBBuGtsmd7QdT@kili Signed-off-by: Jakub Kicinski commit 0f14a8351abd7d734ae617da05faa0008cd35927 Author: Yu Zhe Date: Fri Jul 29 14:17:12 2022 +0800 dn_route: replace "jiffies-now>0" with "jiffies!=now" Use "jiffies != now" to replace "jiffies - now > 0" to make code more readable. We want to put a limit on how long the loop can run for before rescheduling. Signed-off-by: Yu Zhe Link: https://lore.kernel.org/r/20220729061712.22666-1-yuzhe@nfschina.com Signed-off-by: Jakub Kicinski commit ff4970b130e74af4f2fe5bc6a7a963bc977cae1a Merge: 5fc7c5887c62f 35610745d71df Author: Jakub Kicinski Date: Fri Jul 29 19:34:45 2022 -0700 Merge tag 'wireless-next-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v5.20 Fourth set of patches for v5.20, last few patches before the merge window. Only driver changes this time, mostly just fixes and cleanup. Major changes: brcmfmac - support brcm,ccode-map-trivial DT property wcn36xx - add debugfs file to show firmware feature strings * tag 'wireless-next-2022-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (36 commits) wifi: rtw88: check the return value of alloc_workqueue() wifi: rtw89: 8852a: adjust IMR for SER L1 wifi: rtw89: 8852a: update RF radio A/B R56 wifi: wcn36xx: Add debugfs entry to read firmware feature strings wifi: wcn36xx: Move capability bitmap to string translation function to firmware.c wifi: wcn36xx: Move firmware feature bit storage to dedicated firmware.c file wifi: wcn36xx: Rename clunky firmware feature bit enum wifi: brcmfmac: prevent double-free on hardware-reset wifi: brcmfmac: support brcm,ccode-map-trivial DT property dt-bindings: bcm4329-fmac: add optional brcm,ccode-map-trivial wifi: brcmfmac: Replace default (not configured) MAC with a random MAC wifi: brcmfmac: Add brcmf_c_set_cur_etheraddr() helper wifi: brcmfmac: Remove #ifdef guards for PM related functions wifi: brcmfmac: use strreplace() in brcmf_of_probe() wifi: plfxlc: Use eth_zero_addr() to assign zero address wifi: wilc1000: use existing iftype variable to store the interface type wifi: wilc1000: add 'isinit' flag for SDIO bus similar to SPI wifi: wilc1000: cancel the connect operation during interface down wifi: wilc1000: get correct length of string WID from received config packet wifi: wilc1000: set station_info flag only when signal value is valid ... ==================== Link: https://lore.kernel.org/r/20220729192832.A5011C433D6@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 5fc7c5887c62f5485b606884a83eea972961423d Merge: 6957730e20389 14250fa4839b3 Author: Jakub Kicinski Date: Fri Jul 29 19:04:28 2022 -0700 Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Andrii Nakryiko says: ==================== bpf-next 2022-07-29 We've added 22 non-merge commits during the last 4 day(s) which contain a total of 27 files changed, 763 insertions(+), 120 deletions(-). The main changes are: 1) Fixes to allow setting any source IP with bpf_skb_set_tunnel_key() helper, from Paul Chaignon. 2) Fix for bpf_xdp_pointer() helper when doing sanity checking, from Joanne Koong. 3) Fix for XDP frame length calculation, from Lorenzo Bianconi. 4) Libbpf BPF_KSYSCALL docs improvements and fixes to selftests to accommodate s390x quirks with socketcall(), from Ilya Leoshkevich. 5) Allow/denylist and CI configs additions to selftests/bpf to improve BPF CI, from Daniel Müller. 6) BPF trampoline + ftrace follow up fixes, from Song Liu and Xu Kuohai. 7) Fix allocation warnings in netdevsim, from Jakub Kicinski. 8) bpf_obj_get_opts() libbpf API allowing to provide file flags, from Joe Burton. 9) vsnprintf usage fix in bpf_snprintf_btf(), from Fedor Tokarev. 10) Various small fixes and clean ups, from Daniel Müller, Rongguang Wei, Jörn-Thorben Hinz, Yang Li. * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (22 commits) bpf: Remove unneeded semicolon libbpf: Add bpf_obj_get_opts() netdevsim: Avoid allocation warnings triggered from user space bpf: Fix NULL pointer dereference when registering bpf trampoline bpf: Fix test_progs -j error with fentry/fexit tests selftests/bpf: Bump internal send_signal/send_signal_tracepoint timeout bpftool: Don't try to return value from void function in skeleton bpftool: Replace sizeof(arr)/sizeof(arr[0]) with ARRAY_SIZE macro bpf: btf: Fix vsnprintf return value check libbpf: Support PPC in arch_specific_syscall_pfx selftests/bpf: Adjust vmtest.sh to use local kernel configuration selftests/bpf: Copy over libbpf configs selftests/bpf: Sort configuration selftests/bpf: Attach to socketcall() in test_probe_user libbpf: Extend BPF_KSYSCALL documentation bpf, devmap: Compute proper xdp_frame len redirecting frames bpf: Fix bpf_xdp_pointer return pointer selftests/bpf: Don't assign outer source IP to host bpf: Set flow flag to allow any source IP in bpf_tunnel_key geneve: Use ip_tunnel_key flow flags in route lookups ... ==================== Link: https://lore.kernel.org/r/20220729230948.1313527-1-andrii@kernel.org Signed-off-by: Jakub Kicinski commit b99695580bfc1f91364023c673681ddb88e375dc Author: Aaron Tomlin Date: Tue Jul 12 12:02:48 2022 +0100 scripts/gdb: ensure the absolute path is generated on initial source Post 'make scripts_gdb' a symbolic link to scripts/gdb/vmlinux-gdb.py is created. Currently 'os.path.dirname(__file__)' does not generate the absolute path to scripts/gdb resulting in the following: (gdb) source vmlinux-gdb.py Traceback (most recent call last): File "scripts/gdb/vmlinux-gdb.py", line 25, in import linux.utils ModuleNotFoundError: No module named 'linux' This patch ensures that the absolute path to scripts/gdb in relation to the given file is generated so each module can be located accordingly. Link: https://lkml.kernel.org/r/20220712110248.1404125-1-atomlin@redhat.com Signed-off-by: Aaron Tomlin Reviewed-by: Douglas Anderson Cc: Jan Kiszka Cc: Kieran Bingham Signed-off-by: Andrew Morton commit 9f98911a9d6e08037903e8ecf44d50f4bcf2368d Author: Brendan Higgins Date: Mon Jul 25 18:07:37 2022 -0400 MAINTAINERS: kunit: add David Gow as a maintainer of KUnit David has been a de facto maintainer of KUnit for a long time now. Formalize this in the MAINTAINERS file. Link: https://lkml.kernel.org/r/20220725220737.790976-1-brendan.higgins@linux.dev Signed-off-by: Brendan Higgins Reviewed-by: David Gow Cc: Shuah Khan Cc: Daniel Latypov Signed-off-by: Andrew Morton commit 9f3cebf0bb84a2b94cb59df869f1463e4954e150 Author: Brendan Higgins Date: Mon Jul 25 17:58:33 2022 -0400 mailmap: add linux.dev alias for Brendan Higgins Because of my new work remote setup at Google, I can no longer use command line tools with my google.com email address, for this reason I got a linux.dev account. So update the mailmap to show the new alias I will be using. Link: https://lkml.kernel.org/r/20220725215833.789133-1-brendan.higgins@linux.dev Signed-off-by: Brendan Higgins Reviewed-by: David Gow Cc: Shuah Khan Cc: Daniel Latypov Signed-off-by: Andrew Morton commit 50feece7f770cd5d850334716d71bb8ea4868810 Author: Kirill Tkhai Date: Mon Jul 25 23:37:15 2022 +0300 mailmap: update Kirill's email I disconnected from both Virtuozzo and OpenVZ, so this updates my email to point to my own. I haven't used @openvz address for patches, so let's rewrite the line instead of to add a new one. CC all previous addresses. Link: https://lkml.kernel.org/r/14ca895b-e745-6ba2-8be8-652feacbc907@ya.ru Signed-off-by: Kirill Tkhai Signed-off-by: Andrew Morton commit 787dbea11a5d6843999ff71a3fb9aa1ed6d5d889 Author: Ben Dooks Date: Thu Jul 21 20:55:09 2022 +0100 profile: setup_profiling_timer() is moslty not implemented The setup_profiling_timer() is mostly un-implemented by many architectures. In many places it isn't guarded by CONFIG_PROFILE which is needed for it to be used. Make it a weak symbol in kernel/profile.c and remove the 'return -EINVAL' implementations from the kenrel. There are a couple of architectures which do return 0 from the setup_profiling_timer() function but they don't seem to do anything else with it. To keep the /proc compatibility for now, leave these for a future update or removal. On ARM, this fixes the following sparse warning: arch/arm/kernel/smp.c:793:5: warning: symbol 'setup_profiling_timer' was not declared. Should it be static? Link: https://lkml.kernel.org/r/20220721195509.418205-1-ben-linux@fluff.org Signed-off-by: Ben Dooks Signed-off-by: Andrew Morton commit 45ee6d1e935d879d86aebd1fd15afb3bc015c4a0 Author: Christophe JAILLET Date: Thu Jul 21 22:49:48 2022 +0200 ocfs2: fix a typo in a comment s/heartbaet/heartbeat Link: https://lkml.kernel.org/r/4d4a6786e8ad522bfad6d2401b7f6634f8af0e5d.1658436259.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Signed-off-by: Andrew Morton commit 702f3cf374b85d2e77431c80e870ee31ea03cdd8 Author: Christophe JAILLET Date: Thu Jul 21 22:49:37 2022 +0200 ocfs2: use the bitmap API to simplify code Use bitmap_zero() instead of hand-writing it. It is less verbose. While at it, add an explicit #include . Link: https://lkml.kernel.org/r/86d2a027c319db12055c98f00c65f7d01e703722.1658436259.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Signed-off-by: Andrew Morton commit 97d3b2676fc6bc4865eb825037f4492f0fb804eb Author: Christophe JAILLET Date: Thu Jul 21 22:49:25 2022 +0200 ocfs2: remove some useless functions Patch series "ocfs2: A few clean_ups", v2. __ocfs2_node_map_set_bit() and __ocfs2_node_map_clear_bit() are just wrapper around set_bit() and clear_bit(). The leading __ also makes think that these functions are non-atomic just like __set_bit() and __clear_bit(). So, just remove these wrappers and call set_bit() and clear_bit() directly. Link: https://lkml.kernel.org/r/cover.1658436259.git.christophe.jaillet@wanadoo.fr Link: https://lkml.kernel.org/r/bd1429c84ec7d174c96dbb67a2b42b1b456d9394.1658436259.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Signed-off-by: Andrew Morton commit cf069c3b47fed4e475a13e3ec89451fbdb88869a Author: Slark Xiao Date: Fri Jul 22 18:19:22 2022 +0800 lib/mpi: fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Link: https://lkml.kernel.org/r/20220722101922.81126-1-slark_xiao@163.com Signed-off-by: Slark Xiao Cc: Hongbo Li Cc: Herbert Xu Signed-off-by: Andrew Morton commit ed8fb78d7ecdeb3e2e86df0027e2c2cc55f9908b Author: Alexey Dobriyan Date: Sat Jul 23 20:09:07 2022 +0300 proc: add some (hopefully) insightful comments * /proc/${pid}/net status * removing PDE vs last close stuff (again!) * random small stuff Link: https://lkml.kernel.org/r/YtwrM6sDC0OQ53YB@localhost.localdomain Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton commit fa7d574ba4f4f3f4f78d432c8545d9045daa89b1 Author: Xiu Jianfeng Date: Tue Jul 19 16:33:49 2022 +0800 bdi: remove enum wb_congested_state enum wb_congested_state and the member 'congested' in bdi_writeback are useless since commit a88f2096d5a2 ("remove congestion tracking framework"), so remove it. Link: https://lkml.kernel.org/r/20220719083349.87547-1-xiujianfeng@huawei.com Signed-off-by: Xiu Jianfeng Reviewed-by: Jan Kara Cc: NeilBrown Signed-off-by: Andrew Morton commit 591c32bddbe20ba0e172d9def3c7f22b9c926ad9 Author: Ben Dooks Date: Thu Jul 14 08:47:44 2022 +0100 kernel/hung_task: fix address space of proc_dohung_task_timeout_secs The proc_dohung_task_timeout_secs() function is incorrectly marked as having a __user buffer as argument 3. However this is not the case and it is casing multiple sparse warnings. Fix the following warnings by removing __user from the argument: kernel/hung_task.c:237:52: warning: incorrect type in argument 3 (different address spaces) kernel/hung_task.c:237:52: expected void * kernel/hung_task.c:237:52: got void [noderef] __user *buffer kernel/hung_task.c:287:35: warning: incorrect type in initializer (incompatible argument 3 (different address spaces)) kernel/hung_task.c:287:35: expected int ( [usertype] *proc_handler )( ... ) kernel/hung_task.c:287:35: got int ( * )( ... ) kernel/hung_task.c:295:35: warning: incorrect type in initializer (incompatible argument 3 (different address spaces)) kernel/hung_task.c:295:35: expected int ( [usertype] *proc_handler )( ... ) kernel/hung_task.c:295:35: got int ( * )( ... ) Link: https://lkml.kernel.org/r/20220714074744.189017-1-ben.dooks@sifive.com Signed-off-by: Ben Dooks Cc: Signed-off-by: Andrew Morton commit a10c9ede9913fd54be61bbb01884e647e83dfcae Author: Jiangshan Yi Date: Thu Jul 14 09:54:41 2022 +0800 lib/lzo/lzo1x_compress.c: replace ternary operator with min() and min_t() Fix the following coccicheck warning: lib/lzo/lzo1x_compress.c:54: WARNING opportunity for min(). lib/lzo/lzo1x_compress.c:329: WARNING opportunity for min(). min() and min_t() macro is defined in include/linux/minmax.h. It avoids multiple evaluations of the arguments when non-constant and performs strict type-checking. Link: https://lkml.kernel.org/r/20220714015441.1313036-1-13667453960@163.com Signed-off-by: Jiangshan Yi Tested-by: Dave Rodgman Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit b09a7a036d2035b14636cd4c4c69518d73770f65 Author: Phillip Lougher Date: Fri Jun 17 16:38:15 2022 +0800 squashfs: support reading fragments in readahead call Add a function which can be used to read fragments in the readahead call. This function is necessary because filesystems built with the -tailends (or -always-use-fragments) option may have fragments present which cannot be currently handled. Link: https://lkml.kernel.org/r/20220617083810.337573-5-hsinyi@chromium.org Signed-off-by: Phillip Lougher Signed-off-by: Hsin-Yi Wang Cc: Hou Tao Cc: kernel test robot Cc: Marek Szyprowski Cc: Matthew Wilcox Cc: Miao Xie Cc: Xiongwei Song Cc: Zhang Yi Cc: Zheng Liang Signed-off-by: Andrew Morton commit 8fc78b6fe24c36b151ac98d7546591ed92083d4f Author: Hsin-Yi Wang Date: Fri Jun 17 16:38:13 2022 +0800 squashfs: implement readahead Implement readahead callback for squashfs. It will read datablocks which cover pages in readahead request. For a few cases it will not mark page as uptodate, including: - file end is 0. - zero filled blocks. - current batch of pages isn't in the same datablock. - decompressor error. Otherwise pages will be marked as uptodate. The unhandled pages will be updated by readpage later. Link: https://lkml.kernel.org/r/20220617083810.337573-4-hsinyi@chromium.org Signed-off-by: Hsin-Yi Wang Suggested-by: Matthew Wilcox Reported-by: Matthew Wilcox Reported-by: Phillip Lougher Reported-by: Xiongwei Song Reported-by: Andrew Morton Cc: Hou Tao Cc: kernel test robot Cc: Marek Szyprowski Cc: Miao Xie Cc: Zhang Yi Cc: Zheng Liang Signed-off-by: Andrew Morton commit db98b43086275350294f5c6f797249b714d6316d Author: Phillip Lougher Date: Fri Jun 17 16:38:11 2022 +0800 squashfs: always build "file direct" version of page actor Squashfs_readahead uses the "file direct" version of the page actor, and so build it unconditionally. Link: https://lkml.kernel.org/r/20220617083810.337573-3-hsinyi@chromium.org Signed-off-by: Phillip Lougher Signed-off-by: Hsin-Yi Wang Reported-by: kernel test robot Cc: Hou Tao Cc: Marek Szyprowski Cc: Matthew Wilcox Cc: Miao Xie Cc: Xiongwei Song Cc: Zhang Yi Cc: Zheng Liang Signed-off-by: Andrew Morton commit 0c12185728d602c27cd12a845249e7f37197f71f Author: Hsin-Yi Wang Date: Fri Jun 17 16:38:09 2022 +0800 Revert "squashfs: provide backing_dev_info in order to disable read-ahead" Patch series "Implement readahead for squashfs", v7. Commit 9eec1d897139("squashfs: provide backing_dev_info in order to disable read-ahead") mitigates the performance drop issue for squashfs by closing readahead for it. This series implements readahead callback for squashfs. This patch (of 4): This reverts 9eec1d897139e5 ("squashfs: provide backing_dev_info in order to disable read-ahead"). Revert closing the readahead to squashfs since the readahead callback for squashfs is implemented. Link: https://lkml.kernel.org/r/20220617083810.337573-1-hsinyi@chromium.org Link: https://lkml.kernel.org/r/20220617083810.337573-2-hsinyi@chromium.org Signed-off-by: Hsin-Yi Wang Suggested-by: Xiongwei Song Cc: Phillip Lougher Cc: Matthew Wilcox Cc: Marek Szyprowski Cc: Zheng Liang Cc: Zhang Yi Cc: Hou Tao Cc: Miao Xie Cc: kernel test robot Signed-off-by: Andrew Morton commit 1a44131d4f524e18d873bbe363598e39841001bf Author: Sophia Gabriella Date: Thu Jul 28 16:51:39 2022 +0000 mm: Kconfig: fix typo Fixes a typo in the help section for ZSWAP. Link: https://lkml.kernel.org/r/Message-ID: Signed-off-by: Sophia Gabriella Signed-off-by: Andrew Morton commit 96f96763de26d6ee333d5b2446d1b04a4e6bc75b Author: Kefeng Wang Date: Tue Jul 26 16:10:46 2022 +0800 mm: memory-failure: convert to pr_fmt() Use pr_fmt to prefix all pr_ output, but unpoison_memory() and soft_offline_page() are used by error injection, which have own prefixes like "Unpoison:" and "soft offline:", meanwhile, soft_offline_page() could be used by memory hotremove, so reset pr_fmt before unpoison_pr_info definition to keep the original output for them. [wangkefeng.wang@huawei.com: v3] Link: https://lkml.kernel.org/r/20220729031919.72331-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20220726081046.10742-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Signed-off-by: Andrew Morton commit 07252dfea2c7089bca68949710268cbbb0ce509e Author: Kefeng Wang Date: Tue Jul 26 21:11:35 2022 +0800 mm: use is_zone_movable_page() helper Use is_zone_movable_page() helper to simplify code. Link: https://lkml.kernel.org/r/20220726131135.146912-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: David Hildenbrand Reviewed-by: Pankaj Gupta Acked-by: Jason Wang Signed-off-by: Andrew Morton commit 116807634569bdb9defe1c01e442e76e4f432961 Author: Miaohe Lin Date: Tue Jul 26 22:29:18 2022 +0800 hugetlbfs: fix inaccurate comment in hugetlbfs_statfs() In some cases, e.g. when size option is not specified, f_blocks, f_bavail and f_bfree will be set to -1 instead of 0. Likewise, when nr_inodes isn't specified, f_files and f_ffree will be set to -1 too. Update the comment to make this clear. Link: https://lkml.kernel.org/r/20220726142918.51693-6-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit 445c809829dc164c5b1917c72e335bd294aa4dc8 Author: Miaohe Lin Date: Tue Jul 26 22:29:17 2022 +0800 hugetlbfs: cleanup some comments in inode.c The function generic_file_buffered_read has been renamed to filemap_read since commit 87fa0f3eb267 ("mm/filemap: rename generic_file_buffered_read to filemap_read"). Update the corresponding comment. And duplicated taken in hugetlbfs_fill_super is removed. Link: https://lkml.kernel.org/r/20220726142918.51693-5-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit 990e52b17d048970cb9629f1d546542b2c256f3a Author: Miaohe Lin Date: Tue Jul 26 22:29:16 2022 +0800 hugetlbfs: remove unneeded header file The header file signal.h is unneeded now. Remove it. Link: https://lkml.kernel.org/r/20220726142918.51693-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit 7ec3c362cfc4cf7aa8d29416c34d0dc0817cf9aa Author: Miaohe Lin Date: Tue Jul 26 22:29:15 2022 +0800 hugetlbfs: remove unneeded hugetlbfs_ops forward declaration The forward declaration for hugetlbfs_ops is unnecessary. Remove it. Link: https://lkml.kernel.org/r/20220726142918.51693-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit d00365175e092a3144ecbee3181f46682b5b5e97 Author: Miaohe Lin Date: Tue Jul 26 22:29:14 2022 +0800 hugetlbfs: use helper macro SZ_1{K,M} Patch series "A few cleanup and fixup patches for hugetlbfs", v2. This series contains a few cleaup patches to remove unneeded forward declaration, use helper macro and so on. More details can be found in the respective changelogs. This patch (of 5): Use helper macro SZ_1K and SZ_1M to do the size conversion. Minor readability improvement. Link: https://lkml.kernel.org/r/20220726142918.51693-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20220726142918.51693-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Mike Kravetz Reviewed-by: Muchun Song Signed-off-by: Andrew Morton commit bb077c3ffd5362a6d9e60574e1bcc83fe8e3fb27 Author: Kefeng Wang Date: Tue Jul 26 21:18:16 2022 +0800 mm: cleanup is_highmem() It is unnecessary to add CONFIG_HIGHMEM check in is_highmem(), which has been done in is_highmem_idx(), and move is_highmem() close to is_highmem_idx(). This has no functional impact. Link: https://lkml.kernel.org/r/20220726131816.149075-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Signed-off-by: Andrew Morton commit f6c3e1ae0114cd0f5123cf38187d450c1b119e67 Author: Ralph Campbell Date: Mon Jul 25 11:36:15 2022 -0700 mm/hmm: add a test for cross device private faults Add a simple test case for when hmm_range_fault() is called with the HMM_PFN_REQ_FAULT flag and a device private PTE is found for a device other than the hmm_range::dev_private_owner. This should cause the page to be faulted back to system memory from the other device and the PFN returned in the output array. Also, remove a piece of code that unnecessarily unmaps part of the buffer. Link: https://lkml.kernel.org/r/20220727000837.4128709-3-rcampbell@nvidia.com Link: https://lkml.kernel.org/r/20220725183615.4118795-3-rcampbell@nvidia.com Signed-off-by: Ralph Campbell Reviewed-by: Alistair Popple Cc: Felix Kuehling Cc: Philip Yang Cc: Jason Gunthorpe Signed-off-by: Andrew Morton commit 68deb82a7bfcf67c6491c2387215e038b525475f Author: Peter Xu Date: Mon Jul 25 10:20:48 2022 -0400 selftests: add soft-dirty into run_vmtests.sh Link: https://lkml.kernel.org/r/20220725142048.30450-4-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Nadav Amit Signed-off-by: Andrew Morton commit c942f5bd17b3a520710c6b80634be5c44aaa109e Author: Peter Xu Date: Mon Jul 25 10:20:47 2022 -0400 selftests: soft-dirty: add test for mprotect Add two soft-dirty test cases for mprotect() on both anon or file. Link: https://lkml.kernel.org/r/20220725142048.30450-3-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Nadav Amit Signed-off-by: Andrew Morton commit 76aefad628aae152207ee624a7981b9aa1a267d8 Author: Peter Xu Date: Mon Jul 25 10:20:46 2022 -0400 mm/mprotect: fix soft-dirty check in can_change_pte_writable() Patch series "mm/mprotect: Fix soft-dirty checks", v4. This patch (of 3): The check wanted to make sure when soft-dirty tracking is enabled we won't grant write bit by accident, as a page fault is needed for dirty tracking. The intention is correct but we didn't check it right because VM_SOFTDIRTY set actually means soft-dirty tracking disabled. Fix it. There's another thing tricky about soft-dirty is that, we can't check the vma flag !(vma_flags & VM_SOFTDIRTY) directly but only check it after we checked CONFIG_MEM_SOFT_DIRTY because otherwise VM_SOFTDIRTY will be defined as zero, and !(vma_flags & VM_SOFTDIRTY) will constantly return true. To avoid misuse, introduce a helper for checking whether vma has soft-dirty tracking enabled. We can easily verify this with any exclusive anonymous page, like program below: =======8<====== #include #include #include #include #include #include #include #include #include #include #include #include #include #define BIT_ULL(nr) (1ULL << (nr)) #define PM_SOFT_DIRTY BIT_ULL(55) unsigned int psize; char *page; uint64_t pagemap_read_vaddr(int fd, void *vaddr) { uint64_t value; int ret; ret = pread(fd, &value, sizeof(uint64_t), ((uint64_t)vaddr >> 12) * sizeof(uint64_t)); assert(ret == sizeof(uint64_t)); return value; } void clear_refs_write(void) { int fd = open("/proc/self/clear_refs", O_RDWR); assert(fd >= 0); write(fd, "4", 2); close(fd); } #define check_soft_dirty(str, expect) do { \ bool dirty = pagemap_read_vaddr(fd, page) & PM_SOFT_DIRTY; \ if (dirty != expect) { \ printf("ERROR: %s, soft-dirty=%d (expect: %d) ", str, dirty, expect); \ exit(-1); \ } \ } while (0) int main(void) { int fd = open("/proc/self/pagemap", O_RDONLY); assert(fd >= 0); psize = getpagesize(); page = mmap(NULL, psize, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); assert(page != MAP_FAILED); *page = 1; check_soft_dirty("Just faulted in page", 1); clear_refs_write(); check_soft_dirty("Clear_refs written", 0); mprotect(page, psize, PROT_READ); check_soft_dirty("Marked RO", 0); mprotect(page, psize, PROT_READ|PROT_WRITE); check_soft_dirty("Marked RW", 0); *page = 2; check_soft_dirty("Wrote page again", 1); munmap(page, psize); close(fd); printf("Test passed. "); return 0; } =======8<====== Here we attach a Fixes to commit 64fe24a3e05e only for easy tracking, as this patch won't apply to a tree before that point. However the commit wasn't the source of problem, but instead 64e455079e1b. It's just that after 64fe24a3e05e anonymous memory will also suffer from this problem with mprotect(). Link: https://lkml.kernel.org/r/20220725142048.30450-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20220725142048.30450-2-peterx@redhat.com Fixes: 64e455079e1b ("mm: softdirty: enable write notifications on VMAs after VM_SOFTDIRTY cleared") Fixes: 64fe24a3e05e ("mm/mprotect: try avoiding write faults for exclusive anonymous pages when changing protection") Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Nadav Amit Cc: Andrea Arcangeli Signed-off-by: Andrew Morton commit 68aaee147e597b495622b7c9038e5922c7c61f57 Author: Tetsuo Handa Date: Fri Jul 22 19:45:39 2022 +0900 mm: memcontrol: fix potential oom_lock recursion deadlock syzbot is reporting GFP_KERNEL allocation with oom_lock held when reporting memcg OOM [1]. If this allocation triggers the global OOM situation then the system can livelock because the GFP_KERNEL allocation with oom_lock held cannot trigger the global OOM killer because __alloc_pages_may_oom() fails to hold oom_lock. Fix this problem by removing the allocation from memory_stat_format() completely, and pass static buffer when calling from memcg OOM path. Note that the caller holding filesystem lock was the trigger for syzbot to report this locking dependency. Doing GFP_KERNEL allocation with filesystem lock held can deadlock the system even without involving OOM situation. Link: https://syzkaller.appspot.com/bug?extid=2d2aeadc6ce1e1f11d45 [1] Link: https://lkml.kernel.org/r/86afb39f-8c65-bec2-6cfc-c5e3cd600c0b@I-love.SAKURA.ne.jp Fixes: c8713d0b23123759 ("mm: memcontrol: dump memory.stat during cgroup OOM") Signed-off-by: Tetsuo Handa Reported-by: syzbot Suggested-by: Michal Hocko Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 65974cb9107d9c6da18cefda22f84aeabc638b16 Author: Alistair Popple Date: Thu Jul 21 12:05:52 2022 +1000 mm/gup.c: fix formatting in check_and_migrate_movable_page() Commit b05a79d4377f ("mm/gup: migrate device coherent pages when pinning instead of failing") added a badly formatted if statement. Fix it. Link: https://lkml.kernel.org/r/20220721020552.1397598-2-apopple@nvidia.com Signed-off-by: Alistair Popple Reported-by: David Hildenbrand Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 35fcd75af3edf035638e632bb49607cc8fc3cdf4 Author: Shiyang Ruan Date: Thu Jun 9 22:34:35 2022 +0800 xfs: fail dax mount if reflink is enabled on a partition Failure notification is not supported on partitions. So, when we mount a reflink enabled xfs on a partition with dax option, let it fail with -EINVAL code. Link: https://lkml.kernel.org/r/20220609143435.393724-1-ruansy.fnst@fujitsu.com Signed-off-by: Shiyang Ruan Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Cc: Dave Chinner Signed-off-by: Andrew Morton commit 873f64b791a2b43c246e78b7d9fdd64ce909685b Author: Jiebin Sun Date: Sat Jul 23 00:49:49 2022 +0800 mm/memcontrol.c: remove the redundant updating of stats_flush_threshold Remove the redundant updating of stats_flush_threshold. If the global var stats_flush_threshold has exceeded the trigger value for __mem_cgroup_flush_stats, further increment is unnecessary. Apply the patch and test the pts/hackbench-1.0.0 Count:4 (160 threads). Score gain: 1.95x Reduce CPU cycles in __mod_memcg_lruvec_state (44.88% -> 0.12%) CPU: ICX 8380 x 2 sockets Core number: 40 x 2 physical cores Benchmark: pts/hackbench-1.0.0 Count:4 (160 threads) Link: https://lkml.kernel.org/r/20220722164949.47760-1-jiebin.sun@intel.com Signed-off-by: Jiebin Sun Acked-by: Shakeel Butt Reviewed-by: Roman Gushchin Reviewed-by: Tim Chen Acked-by: Muchun Song Cc: Johannes Weiner Cc: Michal Hocko Cc: "Huang, Ying" Cc: Amadeusz Sawiski Signed-off-by: Andrew Morton commit 914eedcb9ba0ff53c3380829a024b7cef16accfb Author: Axel Rasmussen Date: Fri Jul 22 13:15:13 2022 -0700 userfaultfd: don't fail on unrecognized features The basic interaction for setting up a userfaultfd is, userspace issues a UFFDIO_API ioctl, and passes in a set of zero or more feature flags, indicating the features they would prefer to use. Of course, different kernels may support different sets of features (depending on kernel version, kconfig options, architecture, etc). Userspace's expectations may also not match: perhaps it was built against newer kernel headers, which defined some features the kernel it's running on doesn't support. Currently, if userspace passes in a flag we don't recognize, the initialization fails and we return -EINVAL. This isn't great, though. Userspace doesn't have an obvious way to react to this; sure, one of the features I asked for was unavailable, but which one? The only option it has is to turn off things "at random" and hope something works. Instead, modify UFFDIO_API to just ignore any unrecognized feature flags. The interaction is now that the initialization will succeed, and as always we return the *subset* of feature flags that can actually be used back to userspace. Now userspace has an obvious way to react: it checks if any flags it asked for are missing. If so, it can conclude this kernel doesn't support those, and it can either resign itself to not using them, or fail with an error on its own, or whatever else. Link: https://lkml.kernel.org/r/20220722201513.1624158-1-axelrasmussen@google.com Signed-off-by: Axel Rasmussen Cc: Peter Xu Cc: Axel Rasmussen Signed-off-by: Andrew Morton commit 2727cfe4072a35ce813e3708f74c135de7da8897 Author: Miaohe Lin Date: Sat Jul 23 15:38:04 2022 +0800 hugetlb_cgroup: fix wrong hugetlb cgroup numa stat We forget to set cft->private for numa stat file. As a result, numa stat of hstates[0] is always showed for all hstates. Encode the hstates index into cft->private to fix this issue. Link: https://lkml.kernel.org/r/20220723073804.53035-1-linmiaohe@huawei.com Fixes: f47761999052 ("hugetlb: add hugetlb.*.numa_stat file") Signed-off-by: Miaohe Lin Acked-by: Muchun Song Cc: Kees Cook Cc: Mike Kravetz Cc: Mina Almasry Cc: Shakeel Butt Cc: Signed-off-by: Andrew Morton commit 360b420dbded8ad5b70a41de98e77354dd9e7d36 Author: Dan Carpenter Date: Tue Jul 19 12:04:14 2022 +0300 selftest/vm: uninitialized variable in main() Initialize "length" to zero by default. Link: https://lkml.kernel.org/r/YtZzjvHXVXMXxpXO@kili Fixes: ff712a627f72 ("selftests/vm: cleanup hugetlb file after mremap test") Signed-off-by: Dan Carpenter Reviewed-by: Mina Almasry Reviewed-by: Muchun Song Cc: Mike Kravetz Cc: Shuah Khan Signed-off-by: Andrew Morton commit 198729c9627a754b26aebdc8a26e559424c8f06c Author: Kassey Li Date: Tue Jul 19 17:15:54 2022 +0800 mm/cma_debug.c: align the name buffer length as struct cma Avoids truncating the debugfs output to 16 chars. Potentially alters the userspace output, but this is a debugfs interface and there are no stability guarantees. Link: https://lkml.kernel.org/r/20220719091554.27864-1-quic_yingangl@quicinc.com Signed-off-by: Kassey Li Cc: Sasha Levin Cc: Joonsoo Kim Cc: Minchan Kim Signed-off-by: Andrew Morton commit 3d5367a0426da61c7cb616cc85b6239467e261dd Author: Dan Carpenter Date: Tue Jul 19 12:42:48 2022 +0300 tools/testing/selftests/vm/hugetlb-madvise.c: silence uninitialized variable warning This code just reads from memory without caring about the data itself. However static checkers complain that "tmp" is never properly initialized. Initialize it to zero and change the name to "dummy" to show that we don't care about the value stored in it. Link: https://lkml.kernel.org/r/YtZ8mKJmktA2GaHB@kili Fixes: c4b6cb884011 ("selftests/vm: add hugetlb madvise MADV_DONTNEED MADV_REMOVE test") Signed-off-by: Dan Carpenter Acked-by: Souptick Joarder (HPE) Reviewed-by: Mike Kravetz Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6d97cf88ddde9c976d04b886b10b464ec8006c85 Author: Miaohe Lin Date: Tue Jul 19 19:52:33 2022 +0800 mm/mempolicy: remove unneeded out label We can use unlock label to unlock ptl and return ret directly to remove the unneeded out label and reduce the size of mempolicy.o. No functional change intended. [Before] text data bss dec hex filename 26702 3972 6168 36842 8fea mm/mempolicy.o [After] text data bss dec hex filename 26662 3972 6168 36802 8fc2 mm/mempolicy.o Link: https://lkml.kernel.org/r/20220719115233.6706-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Signed-off-by: Andrew Morton commit 189cdcfeeff31a285313c5132b81ae0b998dcad5 Author: Mark-PK Tsai Date: Mon Jul 18 20:03:35 2022 +0800 mm/page_alloc: correct the wrong cpuset file path in comment cpuset.c was moved to kernel/cgroup/ in below commit 201af4c0fab0 ("cgroup: move cgroup files under kernel/cgroup/") Correct the wrong path in comment. Link: https://lkml.kernel.org/r/20220718120336.5145-1-mark-pk.tsai@mediatek.com Signed-off-by: Mark-PK Tsai Signed-off-by: Andrew Morton commit 4d8ff64097092701a5e5506d0d7f643d421e0432 Author: Miaohe Lin Date: Sat Jul 16 16:18:16 2022 +0800 mm: remove unneeded PageAnon check in restore_exclusive_pte() When code reaches here, the page must be !PageAnon. There's no need to check PageAnon again. Remove it. Link: https://lkml.kernel.org/r/20220716081816.10752-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 9b7a4039d6856f66521486da68c76838929039eb Author: Yixuan Cao Date: Mon Jul 18 03:55:06 2022 +0800 tools/vm/page_owner_sort.c: adjust the indent in is_need() I noticed one more indentation than necessary in is_need(). Link: https://lkml.kernel.org/r/20220717195506.7602-1-caoyixuan2019@email.szu.edu.cn Signed-off-by: Yixuan Cao Signed-off-by: Andrew Morton commit e408e695f5f1f60d784913afc45ff2c387a5aeb8 Author: Theodore Ts'o Date: Thu Jul 14 21:59:12 2022 -0400 mm/shmem: support FS_IOC_[SG]ETFLAGS in tmpfs This allows userspace to set flags like FS_APPEND_FL, FS_IMMUTABLE_FL, FS_NODUMP_FL, etc., like all other standard Linux file systems. [akpm@linux-foundation.org: fix CONFIG_TMPFS_XATTR=n warnings] Link: https://lkml.kernel.org/r/20220715015912.2560575-1-tytso@mit.edu Signed-off-by: Theodore Ts'o Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 188043c7f4f2bd662f2a55957d684fffa543e600 Author: Jianglei Nie Date: Thu Jul 14 14:37:46 2022 +0800 mm/damon/reclaim: fix potential memory leak in damon_reclaim_init() damon_reclaim_init() allocates a memory chunk for ctx with damon_new_ctx(). When damon_select_ops() fails, ctx is not released, which will lead to a memory leak. We should release the ctx with damon_destroy_ctx() when damon_select_ops() fails to fix the memory leak. Link: https://lkml.kernel.org/r/20220714063746.2343549-1-niejianglei2021@163.com Fixes: 4d69c3457821 ("mm/damon/reclaim: use damon_select_ops() instead of damon_{v,p}a_set_operations()") Signed-off-by: Jianglei Nie Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 73b73bac90d97400e29e585c678c4d0ebfd2680d Author: Yosry Ahmed Date: Thu Jul 14 06:49:18 2022 +0000 mm: vmpressure: don't count proactive reclaim in vmpressure memory.reclaim is a cgroup v2 interface that allows users to proactively reclaim memory from a memcg, without real memory pressure. Reclaim operations invoke vmpressure, which is used: (a) To notify userspace of reclaim efficiency in cgroup v1, and (b) As a signal for a memcg being under memory pressure for networking (see mem_cgroup_under_socket_pressure()). For (a), vmpressure notifications in v1 are not affected by this change since memory.reclaim is a v2 feature. For (b), the effects of the vmpressure signal (according to Shakeel [1]) are as follows: 1. Reducing send and receive buffers of the current socket. 2. May drop packets on the rx path. 3. May throttle current thread on the tx path. Since proactive reclaim is invoked directly by userspace, not by memory pressure, it makes sense not to throttle networking. Hence, this change makes sure that proactive reclaim caused by memory.reclaim does not trigger vmpressure. [1] https://lore.kernel.org/lkml/CALvZod68WdrXEmBpOkadhB5GPYmCXaDZzXH=yyGOCAjFRn4NDQ@mail.gmail.com/ [yosryahmed@google.com: update documentation] Link: https://lkml.kernel.org/r/20220721173015.2643248-1-yosryahmed@google.com Link: https://lkml.kernel.org/r/20220714064918.2576464-1-yosryahmed@google.com Signed-off-by: Yosry Ahmed Acked-by: Shakeel Butt Acked-by: Michal Hocko Acked-by: David Rientjes Cc: Johannes Weiner Cc: Roman Gushchin Cc: Muchun Song Cc: Matthew Wilcox Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Miaohe Lin Cc: NeilBrown Cc: Alistair Popple Cc: Suren Baghdasaryan Cc: Peter Xu Signed-off-by: Andrew Morton commit c7e6f17b52e9486a9d997368819dfec032b550e2 Author: Hui Zhu Date: Thu Jul 14 16:07:57 2022 +0800 zsmalloc: zs_malloc: return ERR_PTR on failure zs_malloc returns 0 if it fails. zs_zpool_malloc will return -1 when zs_malloc return 0. But -1 makes the return value unclear. For example, when zswap_frontswap_store calls zs_malloc through zs_zpool_malloc, it will return -1 to its caller. The other return value is -EINVAL, -ENODEV or something else. This commit changes zs_malloc to return ERR_PTR on failure. It didn't just let zs_zpool_malloc return -ENOMEM becaue zs_malloc has two types of failure: - size is not OK return -EINVAL - memory alloc fail return -ENOMEM. Link: https://lkml.kernel.org/r/20220714080757.12161-1-teawater@gmail.com Signed-off-by: Hui Zhu Cc: Minchan Kim Cc: Nitin Gupta Cc: Sergey Senozhatsky Cc: Jens Axboe Signed-off-by: Andrew Morton commit fef3e9066d19230f661048ca86937d954c12cd50 Author: Xiu Jianfeng Date: Thu Jul 14 16:41:47 2022 +0800 writeback: remove inode_to_wb_is_valid() inode_to_wb_is_valid() is no longer used since commit fe55d563d417 ("remove inode_congested()"), remove it. Link: https://lkml.kernel.org/r/20220714084147.140324-1-xiujianfeng@huawei.com Signed-off-by: Xiu Jianfeng Reviewed-by: Johannes Thumshirn Reviewed-by: Jan Kara Signed-off-by: Andrew Morton commit 450d0e74d886c172ac2f72518b797a18ee8d1327 Author: Zhou Guanghui Date: Wed Jun 15 10:27:42 2022 +0000 memblock,arm64: expand the static memblock memory table In a system(Huawei Ascend ARM64 SoC) using HBM, a multi-bit ECC error occurs, and the BIOS will mark the corresponding area (for example, 2 MB) as unusable. When the system restarts next time, these areas are not reported or reported as EFI_UNUSABLE_MEMORY. Both cases lead to an increase in the number of memblocks, whereas EFI_UNUSABLE_MEMORY leads to a larger number of memblocks. For example, if the EFI_UNUSABLE_MEMORY type is reported: ... memory[0x92] [0x0000200834a00000-0x0000200835bfffff], 0x0000000001200000 bytes on node 7 flags: 0x0 memory[0x93] [0x0000200835c00000-0x0000200835dfffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x94] [0x0000200835e00000-0x00002008367fffff], 0x0000000000a00000 bytes on node 7 flags: 0x0 memory[0x95] [0x0000200836800000-0x00002008369fffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x96] [0x0000200836a00000-0x0000200837bfffff], 0x0000000001200000 bytes on node 7 flags: 0x0 memory[0x97] [0x0000200837c00000-0x0000200837dfffff], 0x0000000000200000 bytes on node 7 flags: 0x4 memory[0x98] [0x0000200837e00000-0x000020087fffffff], 0x0000000048200000 bytes on node 7 flags: 0x0 memory[0x99] [0x0000200880000000-0x0000200bcfffffff], 0x0000000350000000 bytes on node 6 flags: 0x0 memory[0x9a] [0x0000200bd0000000-0x0000200bd01fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9b] [0x0000200bd0200000-0x0000200bd07fffff], 0x0000000000600000 bytes on node 6 flags: 0x0 memory[0x9c] [0x0000200bd0800000-0x0000200bd09fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9d] [0x0000200bd0a00000-0x0000200fcfffffff], 0x00000003ff600000 bytes on node 6 flags: 0x0 memory[0x9e] [0x0000200fd0000000-0x0000200fd01fffff], 0x0000000000200000 bytes on node 6 flags: 0x4 memory[0x9f] [0x0000200fd0200000-0x0000200fffffffff], 0x000000002fe00000 bytes on node 6 flags: 0x0 ... The EFI memory map is parsed to construct the memblock arrays before the memblock arrays can be resized. As the result, memory regions beyond INIT_MEMBLOCK_REGIONS are lost. Add a new macro INIT_MEMBLOCK_MEMORY_REGIONS to replace INIT_MEMBLOCK_REGTIONS to define the size of the static memblock.memory array. Allow overriding memblock.memory array size with architecture defined INIT_MEMBLOCK_MEMORY_REGIONS and make arm64 to set INIT_MEMBLOCK_MEMORY_REGIONS to 1024 when CONFIG_EFI is enabled. Link: https://lkml.kernel.org/r/20220615102742.96450-1-zhouguanghui1@huawei.com Signed-off-by: Zhou Guanghui Acked-by: Mike Rapoport Tested-by: Darren Hart Acked-by: Will Deacon [arm64] Reviewed-by: Anshuman Khandual Cc: Xu Qiang Signed-off-by: Andrew Morton commit 0f0b6931ff0d8de344392f5d470f88af64130709 Author: Miaohe Lin Date: Sat Jul 16 16:03:59 2022 +0800 mm: remove obsolete comment in do_fault_around() Since commit 7267ec008b5c ("mm: postpone page table allocation until we have page to map"), do_fault_around is not called with page table lock held. Cleanup the corresponding comments. Link: https://lkml.kernel.org/r/20220716080359.38791-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Signed-off-by: Andrew Morton commit b717d6b93b54ec2a2a7d3bb7268d3ff847cc54c5 Author: William Lam Date: Mon Jul 11 21:28:06 2022 +0100 mm: compaction: include compound page count for scanning in pageblock isolation The number of scanned pages can be lower than the number of isolated pages when isolating mirgratable or free pageblock. The metric is being reported in trace event and also used in vmstat. some example output from trace where it shows nr_taken can be greater than nr_scanned: Produced by kernel v5.19-rc6 kcompactd0-42 [001] ..... 1210.268022: mm_compaction_isolate_migratepages: range=(0x107ae4 ~ 0x107c00) nr_scanned=265 nr_taken=255 [...] kcompactd0-42 [001] ..... 1210.268382: mm_compaction_isolate_freepages: range=(0x215800 ~ 0x215a00) nr_scanned=13 nr_taken=128 kcompactd0-42 [001] ..... 1210.268383: mm_compaction_isolate_freepages: range=(0x215600 ~ 0x215680) nr_scanned=1 nr_taken=128 mm_compaction_isolate_migratepages does not seem to have this behaviour, but for the reason of consistency, nr_scanned should also be taken care of in that side. This behaviour is confusing since currently the count for isolated pages takes account of compound page but not for the case of scanned pages. And given that the number of isolated pages(nr_taken) reported in mm_compaction_isolate_template trace event is on a single-page basis, the ambiguity when reporting the number of scanned pages can be removed by also including compound page count. Link: https://lkml.kernel.org/r/20220711202806.22296-1-william.lam@bytedance.com Signed-off-by: William Lam Reviewed-by: Punit Agrawal Cc: Mel Gorman Signed-off-by: Andrew Morton commit ac3ced5fc12fb3d7268054485cbc36441c05cf24 Author: Adam Sindelar Date: Mon Jul 4 14:38:13 2022 +0200 selftests/vm: skip 128TBswitch on unsupported arch The test va_128TBswitch.c exercises a feature only supported on PPC and x86_64, but it's run on other 64-bit archs as well. Before this patch, the test did nothing and returned 0 for KSFT_PASS. This patch makes it return the KSFT codes from kselftest.h, including KSFT_SKIP when appropriate. Verified on arm64 and x86_64. Link: https://lkml.kernel.org/r/20220704123813.427625-1-adam@wowsignal.io Signed-off-by: Adam Sindelar Cc: David Vernet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3b8e7f5c42d1aa44f71fd219717c80e34101361e Author: Adam Sindelar Date: Mon Jul 4 19:33:51 2022 +0200 selftests/vm: fix errno handling in mrelease_test mrelease_test should return KSFT_SKIP when process_mrelease is not defined, but due to a perror call consuming the errno, it returns KSFT_FAIL. This patch decides the exit code before calling perror. [adam@wowsignal.io: fix remaining instances of errno mishandling] Link: https://lkml.kernel.org/r/20220706141602.10159-1-adam@wowsignal.io Link: https://lkml.kernel.org/r/20220704173351.19595-1-adam@wowsignal.io Fixes: 33776141b812 ("selftests: vm: add process_mrelease tests") Signed-off-by: Adam Sindelar Reviewed-by: David Vernet Reviewed-by: Suren Baghdasaryan Cc: Shuah Khan Signed-off-by: Andrew Morton commit d6e103a757fa7876e7ded76128d5dffe12402ab9 Author: Roman Gushchin Date: Fri Jul 1 20:35:21 2022 -0700 mm: memcontrol: do not miss MEMCG_MAX events for enforced allocations Yafang Shao reported an issue related to the accounting of bpf memory: if a bpf map is charged indirectly for memory consumed from an interrupt context and allocations are enforced, MEMCG_MAX events are not raised. It's not/less of an issue in a generic case because consequent allocations from a process context will trigger the direct reclaim and MEMCG_MAX events will be raised. However a bpf map can belong to a dying/abandoned memory cgroup, so there will be no allocations from a process context and no MEMCG_MAX events will be triggered. Link: https://lkml.kernel.org/r/20220702033521.64630-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Reported-by: Yafang Shao Acked-by: Shakeel Butt Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Muchun Song Signed-off-by: Andrew Morton commit ccac11da679bc283a5fe3db694d9f4f40245a07e Author: Miaohe Lin Date: Mon Jun 27 21:23:51 2022 +0800 filemap: minor cleanup for filemap_write_and_wait_range Restructure the logic in filemap_write_and_wait_range to simplify the code and make it more consistent with file_write_and_wait_range. No functional change intended. Link: https://lkml.kernel.org/r/20220627132351.55680-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reviewed-by: Muchun Song Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 7f82f922319ede486540e8746769865b9508d2c2 Author: Miaohe Lin Date: Sat Jun 18 16:20:27 2022 +0800 mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Since the beginning, charged is set to 0 to avoid calling vm_unacct_memory twice because vm_unacct_memory will be called by above unmap_region. But since commit 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces"), unmap_region doesn't call vm_unacct_memory anymore. So charged shouldn't be set to 0 now otherwise the calling to paired vm_unacct_memory will be missed and leads to imbalanced account. Link: https://lkml.kernel.org/r/20220618082027.43391-1-linmiaohe@huawei.com Fixes: 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces") Signed-off-by: Miaohe Lin Signed-off-by: Andrew Morton commit b0cab80ecd54ae3b2356bb081af0bffd538c8265 Author: Liam Howlett Date: Mon Jun 27 15:18:59 2022 +0000 android: binder: fix lockdep check on clearing vma When munmapping a vma, the mmap_lock can be degraded to a write before calling close() on the file handle. The binder close() function calls binder_alloc_set_vma() to clear the vma address, which now has a lock dep check for writing on the mmap_lock. Change the lockdep check to ensure the reading lock is held while clearing and keep the write check while writing. Link: https://lkml.kernel.org/r/20220627151857.2316964-1-Liam.Howlett@oracle.com Fixes: 472a68df605b ("android: binder: stop saving a pointer to the VMA") Signed-off-by: Liam R. Howlett Reported-by: syzbot+da54fa8d793ca89c741f@syzkaller.appspotmail.com Acked-by: Todd Kjos Cc: "Arve Hjønnevåg" Cc: Christian Brauner (Microsoft) Cc: Greg Kroah-Hartman Cc: Hridya Valsaraju Cc: Joel Fernandes Cc: Martijn Coenen Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit a43cfc87caaf46710c8027a8c23b8a55f1078f19 Author: Liam R. Howlett Date: Mon Jun 20 21:09:09 2022 -0400 android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with. Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary. [akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c] Link: https://lkml.kernel.org/r/20220621140212.vpkio64idahetbyf@revolver Fixes: da1b9564e85b ("android: binder: fix the race mmap and alloc_new_buf_locked") Reported-by: syzbot+58b51ac2b04e388ab7b0@syzkaller.appspotmail.com Signed-off-by: Liam R. Howlett Cc: Minchan Kim Cc: Christian Brauner (Microsoft) Cc: Greg Kroah-Hartman Cc: Hridya Valsaraju Cc: Joel Fernandes Cc: Martijn Coenen Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 15d2ce7129f25c51d8a840a8a002c7ba0bb1509d Author: Liam R. Howlett Date: Fri Jul 29 18:07:13 2022 -0700 mips: rename mt_init to mips_mt_init Move mt_init out of the way for the maple tree. Use mips_mt prefix to match the rest of the functions in the file. Link: https://lkml.kernel.org/r/20220504002554.654642-2-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Catalin Marinas Cc: David Howells Cc: "Matthew Wilcox (Oracle)" Cc: SeongJae Park Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 14773bfa70e67f4d4ebd60e60cb6e25e8c84d4c0 Author: Tetsuo Handa Date: Wed Jul 20 23:47:55 2022 +0900 mm: shrinkers: fix double kfree on shrinker name syzbot is reporting double kfree() at free_prealloced_shrinker() [1], for destroy_unused_super() calls free_prealloced_shrinker() even if prealloc_shrinker() returned an error. Explicitly clear shrinker name when prealloc_shrinker() called kfree(). [roman.gushchin@linux.dev: zero shrinker->name in all cases where shrinker->name is freed] Link: https://lkml.kernel.org/r/YtgteTnQTgyuKUSY@castle Link: https://syzkaller.appspot.com/bug?extid=8b481578352d4637f510 [1] Link: https://lkml.kernel.org/r/ffa62ece-6a42-2644-16cf-0d33ef32c676@I-love.SAKURA.ne.jp Fixes: e33c267ab70de424 ("mm: shrinkers: provide shrinkers with names") Reported-by: syzbot Signed-off-by: Tetsuo Handa Acked-by: Roman Gushchin Signed-off-by: Andrew Morton commit d6a97d3f589a3a46a16183e03f3774daee251317 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: add security label to struct nfsd_attrs nfsd_setattr() now sets a security label if provided, and nfsv4 provides it in the 'open' and 'create' paths and the 'setattr' path. If setting the label failed (including because the kernel doesn't support labels), an error field in 'struct nfsd_attrs' is set, and the caller can respond. The open/create callers clear FATTR4_WORD2_SECURITY_LABEL in the returned attr set in this case. The setattr caller returns the error. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 93adc1e391a761441d783828b93979b38093d011 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: set attributes when creating symlinks The NFS protocol includes attributes when creating symlinks. Linux does store attributes for symlinks and allows them to be set, though they are not used for permission checking. NFSD currently doesn't set standard (struct iattr) attributes when creating symlinks, but for NFSv4 it does set ACLs and security labels. This is inconsistent. To improve consistency, pass the provided attributes into nfsd_symlink() and call nfsd_create_setattr() to set them. NOTE: this results in a behaviour change for all NFS versions when the client sends non-default attributes with a SYMLINK request. With the Linux client, the only attributes are: attr.ia_mode = S_IFLNK | S_IRWXUGO; attr.ia_valid = ATTR_MODE; so the final outcome will be unchanged. Other clients might sent different attributes, and if they did they probably expect them to be honoured. We ignore any error from nfsd_create_setattr(). It isn't really clear what should be done if a file is successfully created, but the attributes cannot be set. NFS doesn't allow partial success to be reported. Reporting failure is probably more misleading than reporting success, so the status is ignored. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 7fe2a71dda349a1afa75781f0cc7975be9784d15 Author: NeilBrown Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: introduce struct nfsd_attrs The attributes that nfsd might want to set on a file include 'struct iattr' as well as an ACL and security label. The latter two are passed around quite separately from the first, in part because they are only needed for NFSv4. This leads to some clumsiness in the code, such as the attributes NOT being set in nfsd_create_setattr(). We need to keep the directory locked until all attributes are set to ensure the file is never visibile without all its attributes. This need combined with the inconsistent handling of attributes leads to more clumsiness. As a first step towards tidying this up, introduce 'struct nfsd_attrs'. This is passed (by reference) to vfs.c functions that work with attributes, and is assembled by the various nfs*proc functions which call them. As yet only iattr is included, but future patches will expand this. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 876c553cb41026cb6ad3cef970a35e5f69c42a25 Author: Jeff Layton Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: verify the opened dentry after setting a delegation Between opening a file and setting a delegation on it, someone could rename or unlink the dentry. If this happens, we do not want to grant a delegation on the open. On a CLAIM_NULL open, we're opening by filename, and we may (in the non-create case) or may not (in the create case) be holding i_rwsem when attempting to set a delegation. The latter case allows a race. After getting a lease, redo the lookup of the file being opened and validate that the resulting dentry matches the one in the open file description. To properly redo the lookup we need an rqst pointer to pass to nfsd_lookup_dentry(), so make sure that is available. Signed-off-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit bbf936edd543e7220f60f9cbd6933b916550396d Author: Jeff Layton Date: Tue Jul 26 16:45:30 2022 +1000 NFSD: drop fh argument from alloc_init_deleg Currently, we pass the fh of the opened file down through several functions so that alloc_init_deleg can pass it to delegation_blocked. The filehandle of the open file is available in the nfs4_file however, so there's no need to pass it in a separate argument. Drop the argument from alloc_init_deleg, nfs4_open_delegation and nfs4_set_delegation. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit a11ada99ce93a79393dc6683d22f7915748c8f6b Author: Chuck Lever Date: Wed Jul 27 14:41:18 2022 -0400 NFSD: Move copy offload callback arguments into a separate structure Refactor so that CB_OFFLOAD arguments can be passed without allocating a whole struct nfsd4_copy object. On my system (x86_64) this removes another 96 bytes from struct nfsd4_copy. Signed-off-by: Chuck Lever commit e72f9bc006c08841c46d27747a4debc747a8fe13 Author: Chuck Lever Date: Wed Jul 27 14:41:12 2022 -0400 NFSD: Add nfsd4_send_cb_offload() Refactor for legibility. Signed-off-by: Chuck Lever commit ad1e46c9b07b13659635ee5405f83ad0df143116 Author: Chuck Lever Date: Wed Jul 27 14:41:06 2022 -0400 NFSD: Remove kmalloc from nfsd4_do_async_copy() Instead of manufacturing a phony struct nfsd_file, pass the struct file returned by nfs42_ssc_open() directly to nfsd4_do_copy(). Signed-off-by: Chuck Lever commit 3b7bf5933cada732783554edf0dc61283551c6cf Author: Chuck Lever Date: Wed Jul 27 14:40:59 2022 -0400 NFSD: Refactor nfsd4_do_copy() Refactor: Now that nfsd4_do_copy() no longer calls the cleanup helpers, plumb the use of struct file pointers all the way down to _nfsd_copy_file_range(). Signed-off-by: Chuck Lever commit 478ed7b10d875da2743d1a22822b9f8a82df8f12 Author: Chuck Lever Date: Wed Jul 27 14:40:53 2022 -0400 NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2) Move the nfsd4_cleanup_*() call sites out of nfsd4_do_copy(). A subsequent patch will modify one of the new call sites to avoid the need to manufacture the phony struct nfsd_file. Signed-off-by: Chuck Lever commit 24d796ea383b8a4c8234e06d1b14bbcd371192ea Author: Chuck Lever Date: Wed Jul 27 14:40:47 2022 -0400 NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2) The @src parameter is sometimes a pointer to a struct nfsd_file and sometimes a pointer to struct file hiding in a phony struct nfsd_file. Refactor nfsd4_cleanup_inter_ssc() so the @src parameter is always an explicit struct file. Signed-off-by: Chuck Lever commit 1913cdf56cb5bfbc8170873728d13598cbecda23 Author: Chuck Lever Date: Wed Jul 27 14:40:41 2022 -0400 NFSD: Replace boolean fields in struct nfsd4_copy Clean up: saves 8 bytes, and we can replace check_and_set_stop_copy() with an atomic bitop. Signed-off-by: Chuck Lever commit 8ea6e2c90bb0eb74a595a12e23a1dff9abbc760a Author: Chuck Lever Date: Wed Jul 27 14:40:35 2022 -0400 NFSD: Make nfs4_put_copy() static Clean up: All call sites are in fs/nfsd/nfs4proc.c. Signed-off-by: Chuck Lever commit d314309425ad5dc1b6facdb2d456580fb5fa5e3a Author: Chuck Lever Date: Wed Jul 27 14:40:28 2022 -0400 NFSD: Reorder the fields in struct nfsd4_op Pack the fields to reduce the size of struct nfsd4_op, which is used an array in struct nfsd4_compoundargs. sizeof(struct nfsd4_op): Before: /* size: 672, cachelines: 11, members: 5 */ After: /* size: 640, cachelines: 10, members: 5 */ Signed-off-by: Chuck Lever commit 87689df694916c40e8e6c179ab1c8710f65cb6c6 Author: Chuck Lever Date: Wed Jul 27 14:40:22 2022 -0400 NFSD: Shrink size of struct nfsd4_copy struct nfsd4_copy is part of struct nfsd4_op, which resides in an 8-element array. sizeof(struct nfsd4_op): Before: /* size: 1696, cachelines: 27, members: 5 */ After: /* size: 672, cachelines: 11, members: 5 */ Signed-off-by: Chuck Lever commit 09426ef2a64ee189ca1e3298f1e874842dbf35ea Author: Chuck Lever Date: Wed Jul 27 14:40:16 2022 -0400 NFSD: Shrink size of struct nfsd4_copy_notify struct nfsd4_copy_notify is part of struct nfsd4_op, which resides in an 8-element array. sizeof(struct nfsd4_op): Before: /* size: 2208, cachelines: 35, members: 5 */ After: /* size: 1696, cachelines: 27, members: 5 */ Signed-off-by: Chuck Lever commit bb4d842722b84a2731257054b6405f2d866fc5f3 Author: Chuck Lever Date: Wed Jul 27 14:40:09 2022 -0400 NFSD: nfserrno(-ENOMEM) is nfserr_jukebox Suggested-by: Dai Ngo Signed-off-by: Chuck Lever commit 5304877936c0a67e1a01464d113bae4c81eacdb6 Author: Chuck Lever Date: Wed Jul 27 14:40:03 2022 -0400 NFSD: Fix strncpy() fortify warning In function ‘strncpy’, inlined from ‘nfsd4_ssc_setup_dul’ at /home/cel/src/linux/manet/fs/nfsd/nfs4proc.c:1392:3, inlined from ‘nfsd4_interssc_connect’ at /home/cel/src/linux/manet/fs/nfsd/nfs4proc.c:1489:11: /home/cel/src/linux/manet/include/linux/fortify-string.h:52:33: warning: ‘__builtin_strncpy’ specified bound 63 equals destination size [-Wstringop-truncation] 52 | #define __underlying_strncpy __builtin_strncpy | ^ /home/cel/src/linux/manet/include/linux/fortify-string.h:89:16: note: in expansion of macro ‘__underlying_strncpy’ 89 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ Signed-off-by: Chuck Lever commit 99b002a1fa00d90e66357315757e7277447ce973 Author: Chuck Lever Date: Fri Jul 22 16:09:23 2022 -0400 NFSD: Clean up nfsd4_encode_readlink() Similar changes to nfsd4_encode_readv(), all bundled into a single patch. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5e64d85c7d0c59cfcd61d899720b8ccfe895d743 Author: Chuck Lever Date: Fri Jul 22 16:09:16 2022 -0400 NFSD: Use xdr_pad_size() Clean up: Use a helper instead of open-coding the calculation of the XDR pad size. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 071ae99feadfc55979f89287d6ad2c6a315cb46d Author: Chuck Lever Date: Fri Jul 22 16:09:10 2022 -0400 NFSD: Simplify starting_len Clean-up: Now that nfsd4_encode_readv() does not have to encode the EOF or rd_length values, it no longer needs to subtract 8 from @starting_len. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 28d5bc468efe74b790e052f758ce083a5015c665 Author: Chuck Lever Date: Fri Jul 22 16:09:04 2022 -0400 NFSD: Optimize nfsd4_encode_readv() write_bytes_to_xdr_buf() is pretty expensive to use for inserting an XDR data item that is always 1 XDR_UNIT at an address that is always XDR word-aligned. Since both the readv and splice read paths encode EOF and maxcount values, move both to a common code path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 24c7fb85498eda1d4c6b42cc4886328429814990 Author: Chuck Lever Date: Fri Jul 22 16:08:57 2022 -0400 NFSD: Add an nfsd4_read::rd_eof field Refactor: Make the EOF result available in the entire NFSv4 READ path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c738b218a2e5a753a336b4b7fee6720b902c7ace Author: Chuck Lever Date: Fri Jul 22 16:08:51 2022 -0400 NFSD: Clean up SPLICE_OK in nfsd4_encode_read() Do the test_bit() once -- this reduces the number of locked-bus operations and makes the function a little easier to read. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ab04de60ae1cc64ae16b77feae795311b97720c7 Author: Chuck Lever Date: Fri Jul 22 16:08:45 2022 -0400 NFSD: Optimize nfsd4_encode_fattr() write_bytes_to_xdr_buf() is a generic way to place a variable-length data item in an already-reserved spot in the encoding buffer. However, it is costly. In nfsd4_encode_fattr(), it is unnecessary because the data item is fixed in size and the buffer destination address is always word-aligned. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 095a764b7afb06c9499b798c04eaa3cbf70ebe2d Author: Chuck Lever Date: Fri Jul 22 16:08:38 2022 -0400 NFSD: Optimize nfsd4_encode_operation() write_bytes_to_xdr_buf() is a generic way to place a variable-length data item in an already-reserved spot in the encoding buffer. However, it is costly, and here, it is unnecessary because the data item is fixed in size, the buffer destination address is always word-aligned, and the destination location is already in @p. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3a5940bfa17fb9964bf9688b4356ca643a8f5e2d Author: Jeff Layton Date: Wed Jul 20 08:39:23 2022 -0400 nfsd: silence extraneous printk on nfsd.ko insertion This printk pops every time nfsd.ko gets plugged in. Most kmods don't do that and this one is not very informative. Olaf's email address seems to be defunct at this point anyway. Just drop it. Cc: Olaf Kirch Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 4271c2c0887562318a0afef97d32d8a71cbe0743 Author: Dai Ngo Date: Fri Jul 15 16:54:53 2022 -0700 NFSD: limit the number of v4 clients to 1024 per 1GB of system memory Currently there is no limit on how many v4 clients are supported by the system. This can be a problem in systems with small memory configuration to function properly when a very large number of clients exist that creates memory shortage conditions. This patch enforces a limit of 1024 NFSv4 clients, including courtesy clients, per 1GB of system memory. When the number of the clients reaches the limit, requests that create new clients are returned with NFS4ERR_DELAY and the laundromat is kicked start to trim old clients. Due to the overhead of the upcall to remove the client record, the maximun number of clients the laundromat removes on each run is limited to 128. This is done to ensure the laundromat can still process the other tasks in a timely manner. Since there is now a limit of the number of clients, the 24-hr idle time limit of courtesy client is no longer needed and was removed. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 0926c39515aa065a296e97dfc8790026f1e53f86 Author: Dai Ngo Date: Fri Jul 15 16:54:52 2022 -0700 NFSD: keep track of the number of v4 clients in the system Add counter nfs4_client_count to keep track of the total number of v4 clients, including courtesy clients, in the system. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 6867137ebcf4155fe25f2ecf7c29b9fb90a76d1d Author: Dai Ngo Date: Fri Jul 15 16:54:51 2022 -0700 NFSD: refactoring v4 specific code to a helper in nfs4state.c This patch moves the v4 specific code from nfsd_init_net() to nfsd4_init_leases_net() helper in nfs4state.c Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 427f5f83a3191cbf024c5aea6e5b601cdf88d895 Author: Chuck Lever Date: Fri Jul 8 14:27:09 2022 -0400 NFSD: Ensure nf_inode is never dereferenced The documenting comment for struct nf_file states: /* * A representation of a file that has been opened by knfsd. These are hashed * in the hashtable by inode pointer value. Note that this object doesn't * hold a reference to the inode by itself, so the nf_inode pointer should * never be dereferenced, only used for comparison. */ Replace the two existing dereferences to make the comment always true. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5e138c4a750dc140d881dab4a8804b094bbc08d2 Author: Chuck Lever Date: Fri Jul 8 14:27:02 2022 -0400 NFSD: NFSv4 CLOSE should release an nfsd_file immediately The last close of a file should enable other accessors to open and use that file immediately. Leaving the file open in the filecache prevents other users from accessing that file until the filecache garbage-collects the file -- sometimes that takes several seconds. Reported-by: Wang Yugui Link: https://bugzilla.linux-nfs.org/show_bug.cgi?387 Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b40a2839470cd62ed68c4a32d72a18ee8975b1ac Author: Chuck Lever Date: Fri Jul 8 14:26:49 2022 -0400 NFSD: Move nfsd_file_trace_alloc() tracepoint Avoid recording the allocation of an nfsd_file item that is immediately released because a matching item was already inserted in the hash. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit be0230069fcbf7d332d010b57c1d0cfd623a84d6 Author: Chuck Lever Date: Fri Jul 8 14:26:43 2022 -0400 NFSD: Separate tracepoints for acquire and create These tracepoints collect different information: the create case does not open a file, so there's no nf_file available. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0ec8e9d1539a7b8109a554028bbce441052f847e Author: Chuck Lever Date: Fri Jul 8 14:26:36 2022 -0400 NFSD: Clean up unused code after rhashtable conversion Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ce502f81ba884c1fe45dc0ebddbcaaa4ec0fc5fb Author: Chuck Lever Date: Fri Jul 8 14:26:30 2022 -0400 NFSD: Convert the filecache to use rhashtable Enable the filecache hash table to start small, then grow with the workload. Smaller server deployments benefit because there should be lower memory utilization. Larger server deployments should see improved scaling with the number of open files. Suggested-by: Jeff Layton Suggested-by: Dave Chinner Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit fc22945ecc2a0a028f3683115f98a922d506c284 Author: Chuck Lever Date: Fri Jul 8 14:26:23 2022 -0400 NFSD: Set up an rhashtable for the filecache Add code to initialize and tear down an rhashtable. The rhashtable is not used yet. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c7b824c3d06c85e054caf86e227255112c5e3c38 Author: Chuck Lever Date: Fri Jul 8 14:26:16 2022 -0400 NFSD: Replace the "init once" mechanism In a moment, the nfsd_file_hashtbl global will be replaced with an rhashtable. Replace the one or two spots that need to check if the hash table is available. We can easily reuse the SHUTDOWN flag for this purpose. Document that this mechanism relies on callers to hold the nfsd_mutex to prevent init, shutdown, and purging to run concurrently. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f0743c2b25c65debd4f599a7c861428cd9de5906 Author: Chuck Lever Date: Fri Jul 8 14:26:10 2022 -0400 NFSD: Remove nfsd_file::nf_hashval The value in this field can always be computed from nf_inode, thus it is no longer used. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit cb7ec76e73ff6640241c8f1f2f35c81d4005a2d6 Author: Chuck Lever Date: Fri Jul 8 14:26:03 2022 -0400 NFSD: nfsd_file_hash_remove can compute hashval Remove an unnecessary use of nf_hashval. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a845511007a63467fee575353c706806c21218b1 Author: Chuck Lever Date: Fri Jul 8 14:25:57 2022 -0400 NFSD: Refactor __nfsd_file_close_inode() The code that computes the hashval is the same in both callers. To prevent them from going stale, reframe the documenting comments to remove descriptions of the underlying hash table structure, which is about to be replaced. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8755326399f471ec3b31e2ab8c5074c0d28a0fb5 Author: Chuck Lever Date: Fri Jul 8 14:25:50 2022 -0400 NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode Remove an unnecessary usage of nf_hashval. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f53cef15dddec7203df702cdc62e554190385450 Author: Chuck Lever Date: Fri Jul 8 14:25:44 2022 -0400 NFSD: Remove lockdep assertion from unhash_and_release_locked() IIUC, holding the hash bucket lock is needed only in nfsd_file_unhash, and there is already a lockdep assertion there. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 54f7df7094b329ca35d9f9808692bb16c48b13e9 Author: Chuck Lever Date: Fri Jul 8 14:25:37 2022 -0400 NFSD: No longer record nf_hashval in the trace log I'm about to replace nfsd_file_hashtbl with an rhashtable. The individual hash values will no longer be visible or relevant, so remove them from the tracepoints. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6df19411367a5fb4ef61854cbd1af269c077f917 Author: Chuck Lever Date: Fri Jul 8 14:25:30 2022 -0400 NFSD: Never call nfsd_file_gc() in foreground paths The checks in nfsd_file_acquire() and nfsd_file_put() that directly invoke filecache garbage collection are intended to keep cache occupancy between a low- and high-watermark. The reason to limit the capacity of the filecache is to keep filecache lookups reasonably fast. However, invoking garbage collection at those points has some undesirable negative impacts. Files that are held open by NFSv4 clients often push the occupancy of the filecache over these watermarks. At that point: - Every call to nfsd_file_acquire() and nfsd_file_put() results in an LRU walk. This has the same effect on lookup latency as long chains in the hash table. - Garbage collection will then run on every nfsd thread, causing a lot of unnecessary lock contention. - Limiting cache capacity pushes out files used only by NFSv3 clients, which are the type of files the filecache is supposed to help. To address those negative impacts, remove the direct calls to the garbage collector. Subsequent patches will address maintaining lookup efficiency as cache capacity increases. Suggested-by: Wang Yugui Suggested-by: Dave Chinner Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit edead3a55804739b2e4af0f35e9c7326264e7b22 Author: Chuck Lever Date: Fri Jul 8 14:25:24 2022 -0400 NFSD: Fix the filecache LRU shrinker Without LRU item rotation, the shrinker visits only a few items on the end of the LRU list, and those would always be long-term OPEN files for NFSv4 workloads. That makes the filecache shrinker completely ineffective. Adopt the same strategy as the inode LRU by using LRU_ROTATE. Suggested-by: Dave Chinner Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4a0e73e635e3f36b616ad5c943e3d23debe4632f Author: Chuck Lever Date: Fri Jul 8 14:25:17 2022 -0400 NFSD: Leave open files out of the filecache LRU There have been reports of problems when running fstests generic/531 against Linux NFS servers with NFSv4. The NFS server that hosts the test's SCRATCH_DEV suffers from CPU soft lock-ups during the test. Analysis shows that: fs/nfsd/filecache.c 482 ret = list_lru_walk(&nfsd_file_lru, 483 nfsd_file_lru_cb, 484 &head, LONG_MAX); causes nfsd_file_gc() to walk the entire length of the filecache LRU list every time it is called (which is quite frequently). The walk holds a spinlock the entire time that prevents other nfsd threads from accessing the filecache. What's more, for NFSv4 workloads, none of the items that are visited during this walk may be evicted, since they are all files that are held OPEN by NFS clients. Address this by ensuring that open files are not kept on the LRU list. Reported-by: Frank van der Linden Reported-by: Wang Yugui Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=386 Suggested-by: Trond Myklebust Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c46203acddd9b9200dbc53d0603c97355fd3a03b Author: Chuck Lever Date: Fri Jul 8 14:25:11 2022 -0400 NFSD: Trace filecache LRU activity Observe the operation of garbage collection and the lifetime of filecache items. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 668ed92e651d3c25f9b6e8cb7ceca54d00daa96d Author: Chuck Lever Date: Fri Jul 8 14:25:04 2022 -0400 NFSD: WARN when freeing an item still linked via nf_lru Add a guardrail to prevent freeing memory that is still on a list. This includes either a dispose list or the LRU list. This is the sign of a bug, but this class of bugs can be detected so that they don't endanger system stability, especially while debugging. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2e6c6e4c4375bfd3defa5b1ff3604d9f33d1c936 Author: Chuck Lever Date: Fri Jul 8 14:24:58 2022 -0400 NFSD: Hook up the filecache stat file There has always been the capability of exporting filecache metrics via /proc, but it was never hooked up. Let's surface these metrics to enable better observability of the filecache. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8b330f78040cbe16cf8029df70391b2a491f17e2 Author: Chuck Lever Date: Fri Jul 8 14:24:51 2022 -0400 NFSD: Zero counters when the filecache is re-initialized If nfsd_file_cache_init() is called after a shutdown, be sure the stat counters are reset. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit df2aff524faceaf743b7c5ab0f4fb86cb511f782 Author: Chuck Lever Date: Fri Jul 8 14:24:45 2022 -0400 NFSD: Record number of flush calls Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 94660cc19c75083af046b0f8362e3d3bc2eba21d Author: Chuck Lever Date: Fri Jul 8 14:24:38 2022 -0400 NFSD: Report the number of items evicted by the LRU walk Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 39f1d1ff8148902c5692ffb0e1c4479416ab44a7 Author: Chuck Lever Date: Fri Jul 8 14:24:31 2022 -0400 NFSD: Refactor nfsd_file_lru_scan() Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3bc6d3470fe412f818f9bff6b71d1be3a76af8f3 Author: Chuck Lever Date: Fri Jul 8 14:24:25 2022 -0400 NFSD: Refactor nfsd_file_gc() Refactor nfsd_file_gc() to use the new list_lru helper. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0bac5a264d9a923f5b01f3521e1519a8d0358342 Author: Chuck Lever Date: Fri Jul 8 14:24:18 2022 -0400 NFSD: Add nfsd_file_lru_dispose_list() helper Refactor the invariant part of nfsd_file_lru_walk_list() into a separate helper function. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 904940e94a887701db24401e3ed6928a1d4e329f Author: Chuck Lever Date: Fri Jul 8 14:24:12 2022 -0400 NFSD: Report average age of filecache items This is a measure of how long items stay in the filecache, to help assess how efficient the cache is. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d63293272abb51c02457f1017dfd61c3270d9ae3 Author: Chuck Lever Date: Fri Jul 8 14:24:05 2022 -0400 NFSD: Report count of freed filecache items Surface the count of freed nfsd_file items. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 29d4bdbbb910f33d6058d2c51278f00f656df325 Author: Chuck Lever Date: Fri Jul 8 14:23:59 2022 -0400 NFSD: Report count of calls to nfsd_file_acquire() Count the number of successful acquisitions that did not create a file (ie, acquisitions that do not result in a compulsory cache miss). This count can be compared directly with the reported hit count to compute a hit ratio. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0fd244c115f0321fc5e34ad2291f2a572508e3f7 Author: Chuck Lever Date: Fri Jul 8 14:23:52 2022 -0400 NFSD: Report filecache LRU size Surface the NFSD filecache's LRU list length to help field troubleshooters monitor filecache issues. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ca3f9acb6d3faf78da2b63324f7c737dbddf7f69 Author: Chuck Lever Date: Fri Jul 8 14:23:45 2022 -0400 NFSD: Demote a WARN to a pr_warn() The call trace doesn't add much value, but it sure is noisy. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 36f2ef2dd44e1c34b281336a41cf42a477d4b43f Author: Chuck Lever Date: Fri Jul 1 10:37:15 2022 -0400 SUNRPC: Fix server-side fault injection documentation Fixes: 37324e6bb120 ("SUNRPC: Cache deferral injection") Signed-off-by: Chuck Lever commit 842e00ac3aa3b4a4f7f750c8ab54f8578fc875d3 Author: Colin Ian King Date: Tue Jun 28 22:25:25 2022 +0100 nfsd: remove redundant assignment to variable len Variable len is being assigned a value zero and this is never read, it is being re-assigned later. The assignment is redundant and can be removed. Cleans up clang scan-build warning: fs/nfsd/nfsctl.c:636:2: warning: Value stored to 'len' is never read Signed-off-by: Colin Ian King Signed-off-by: Chuck Lever commit f532c9ff103897be0e2a787c0876683c3dc39ed3 Author: Zhang Jiaming Date: Thu Jun 23 16:20:05 2022 +0800 NFSD: Fix space and spelling mistake Add a blank space after ','. Change 'succesful' to 'successful'. Signed-off-by: Zhang Jiaming Signed-off-by: Chuck Lever commit 051382885552e12541cc0ebf82092be374a9ed2a Author: Chuck Lever Date: Tue Jun 21 10:06:23 2022 -0400 NFSD: Instrument fh_verify() Capture file handles and how they map to local inodes. In particular, NFSv4 PUTFH uses fh_verify() so we can now observe which file handles are the target of OPEN, LOOKUP, RENAME, and so on. Signed-off-by: Chuck Lever commit 28fffa6c57906ffa07e84f12aae5d99993cafdae Author: Chuck Lever Date: Tue Jun 21 10:06:16 2022 -0400 SUNRPC: Expand the svc_alloc_arg_err tracepoint Record not only the number of pages requested, but the number of pages that were actually allocated, to get a measure of progress (or lack thereof). Signed-off-by: Chuck Lever commit 184cefbe62627730c30282df12bcff9aae4816ea Author: Benjamin Coddington Date: Mon Jun 13 09:40:06 2022 -0400 NLM: Defend against file_lock changes after vfs_test_lock() Instead of trusting that struct file_lock returns completely unchanged after vfs_test_lock() when there's no conflicting lock, stash away our nlm_lockowner reference so we can properly release it for all cases. This defends against another file_lock implementation overwriting fl_owner when the return type is F_UNLCK. Reported-by: Roberto Bergantinos Corpas Tested-by: Roberto Bergantinos Corpas Signed-off-by: Benjamin Coddington Signed-off-by: Chuck Lever commit c770f31d8f580ed4b965c64f924ec1cc50e41734 Author: Chuck Lever Date: Tue Jul 19 09:18:35 2022 -0400 SUNRPC: Fix xdr_encode_bool() I discovered that xdr_encode_bool() was returning the same address that was passed in the @p parameter. The documenting comment states that the intent is to return the address of the next buffer location, just like the other "xdr_encode_*" helpers. The result was the encoded results of NFSv3 PATHCONF operations were not formed correctly. Fixes: ded04a587f6c ("NFSD: Update the NFSv3 PATHCONF3res encoder to use struct xdr_stream") Signed-off-by: Chuck Lever Reviewed-by: Jeff Layton commit 23ba98de6dcec665e15c0ca19244379bb0d30932 Author: Jeff Layton Date: Fri Jul 29 17:01:07 2022 -0400 nfsd: eliminate the NFSD_FILE_BREAK_* flags We had a report from the spring Bake-a-thon of data corruption in some nfstest_interop tests. Looking at the traces showed the NFS server allowing a v3 WRITE to proceed while a read delegation was still outstanding. Currently, we only set NFSD_FILE_BREAK_* flags if NFSD_MAY_NOT_BREAK_LEASE was set when we call nfsd_file_alloc. NFSD_MAY_NOT_BREAK_LEASE was intended to be set when finding files for COMMIT ops, where we need a writeable filehandle but don't need to break read leases. It doesn't make any sense to consult that flag when allocating a file since the file may be used on subsequent calls where we do want to break the lease (and the usage of it here seems to be reverse from what it should be anyway). Also, after calling nfsd_open_break_lease, we don't want to clear the BREAK_* bits. A lease could end up being set on it later (more than once) and we need to be able to break those leases as well. This means that the NFSD_FILE_BREAK_* flags now just mirror NFSD_MAY_{READ,WRITE} flags, so there's no need for them at all. Just drop those flags and unconditionally call nfsd_open_break_lease every time. Reported-by: Olga Kornieskaia Link: https://bugzilla.redhat.com/show_bug.cgi?id=2107360 Fixes: 65294c1f2c5e (nfsd: add a new struct file caching facility to nfsd) Cc: # 5.4.x : bb283ca18d1e NFSD: Clean up the show_nf_flags() macro Cc: # 5.4.x Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6ebd5247ad2aa210b3ff4481c6ed8aa32a032b12 Author: Marijn Suijten Date: Thu Jun 30 00:53:23 2022 +0200 clk: fixed-factor: Introduce *clk_hw_register_fixed_factor_parent_hw() Add the devres and non-devres variant of clk_hw_register_fixed_factor_parent_hw() for registering a fixed factor clock with clk_hw parent pointer instead of parent name. Signed-off-by: Marijn Suijten Link: https://lore.kernel.org/r/20220629225331.357308-4-marijn.suijten@somainline.org Signed-off-by: Stephen Boyd commit df63af17f3375239e0be124844f304b4a4b60665 Author: Marijn Suijten Date: Thu Jun 30 00:53:22 2022 +0200 clk: mux: Introduce devm_clk_hw_register_mux_parent_hws() Add the devres variant of clk_hw_register_mux_hws() for registering a mux clock with clk_hw parent pointers instead of parent names. Signed-off-by: Marijn Suijten Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220629225331.357308-3-marijn.suijten@somainline.org Signed-off-by: Stephen Boyd commit 909fcb195201f7c3aa81523cc182a4c9b52210e5 Author: Marijn Suijten Date: Thu Jun 30 00:53:21 2022 +0200 clk: divider: Introduce devm_clk_hw_register_divider_parent_hw() Add the devres variant of clk_hw_register_divider_parent_hw() for registering a divider clock with clk_hw parent pointer instead of parent name. Signed-off-by: Marijn Suijten Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220629225331.357308-2-marijn.suijten@somainline.org Signed-off-by: Stephen Boyd commit b600d6a6c55eac2c4af6f3bf8cf7a2deacecd83b Author: Krzysztof Kozlowski Date: Wed Jul 27 18:44:24 2022 +0200 dt-bindings: eeprom: microchip,93lc46b: move to eeprom directory Move the Atmel/Microchip 93xx46 SPI compatible EEPROM family bindings from misc to eeprom directory to properly match subsystem. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220727164424.386499-2-krzysztof.kozlowski@linaro.org commit 532b04d846ddf3c90c37547baeb1c54de7b36ea6 Author: Krzysztof Kozlowski Date: Wed Jul 27 18:44:23 2022 +0200 dt-bindings: eeprom: at25: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220727164424.386499-1-krzysztof.kozlowski@linaro.org commit 944ad762bb47529da644e19bad65b1ef24e57844 Author: Krzysztof Kozlowski Date: Wed Jul 27 18:43:12 2022 +0200 dt-bindings: display: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS. The sitronix,st7735r references also panel-common.yaml and lists explicitly allowed properties, thus here reference only spi-peripheral-props.yaml for purpose of documenting the SPI slave device and bringing spi-max-frequency type validation. Signed-off-by: Krzysztof Kozlowski Acked-by: Sam Ravnborg Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220727164312.385836-1-krzysztof.kozlowski@linaro.org commit 7f637be4d46029bd7700c9f244945a42dbd976fa Author: Jason A. Donenfeld Date: Sat Jul 30 01:12:25 2022 +0200 random: correct spelling of "overwrites" It was missing an 'r'. Fixes: 186873c549df ("random: use simpler fast key erasure flow on per-cpu keys") Signed-off-by: Jason A. Donenfeld commit 14250fa4839b3a48c979e7faaf4cbcce619d02bd Author: Yang Li Date: Tue Jul 26 06:27:33 2022 +0800 bpf: Remove unneeded semicolon Eliminate the following coccicheck warning: /kernel/bpf/trampoline.c:101:2-3: Unneeded semicolon Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220725222733.55613-1-yang.lee@linux.alibaba.com commit 395fc4fa33e98944384d0d6c8b3ecd9fb4b50d00 Author: Joe Burton Date: Fri Jul 29 20:27:27 2022 +0000 libbpf: Add bpf_obj_get_opts() Add an extensible variant of bpf_obj_get() capable of setting the `file_flags` parameter. This parameter is needed to enable unprivileged access to BPF maps. Without a method like this, users must manually make the syscall. Signed-off-by: Joe Burton Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220729202727.3311806-1-jevburton.kernel@gmail.com commit d0b80a9edb1a029ff913e81b47540e57ad034329 Author: Jakub Kicinski Date: Tue Jul 26 14:36:05 2022 -0700 netdevsim: Avoid allocation warnings triggered from user space We need to suppress warnings from sily map sizes. Also switch from GFP_USER to GFP_KERNEL_ACCOUNT, I'm pretty sure I misunderstood the flags when writing this code. Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload") Reported-by: syzbot+ad24705d3fd6463b18c6@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220726213605.154204-1-kuba@kernel.org commit 3b317abc71598bda8ff9a9c483ad8ae167b18382 Author: Xu Kuohai Date: Thu Jul 28 07:40:48 2022 -0400 bpf: Fix NULL pointer dereference when registering bpf trampoline A panic was reported on arm64: [ 44.517109] audit: type=1334 audit(1658859870.268:59): prog-id=19 op=LOAD [ 44.622031] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 [ 44.624321] Mem abort info: [ 44.625049] ESR = 0x0000000096000004 [ 44.625935] EC = 0x25: DABT (current EL), IL = 32 bits [ 44.627182] SET = 0, FnV = 0 [ 44.627930] EA = 0, S1PTW = 0 [ 44.628684] FSC = 0x04: level 0 translation fault [ 44.629788] Data abort info: [ 44.630474] ISV = 0, ISS = 0x00000004 [ 44.631362] CM = 0, WnR = 0 [ 44.632041] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100ab5000 [ 44.633494] [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 [ 44.635202] Internal error: Oops: 96000004 [#1] SMP [ 44.636452] Modules linked in: xfs crct10dif_ce ghash_ce virtio_blk virtio_console virtio_mmio qemu_fw_cfg [ 44.638713] CPU: 2 PID: 1 Comm: systemd Not tainted 5.19.0-rc7 #1 [ 44.640164] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 44.641799] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 44.643404] pc : ftrace_set_filter_ip+0x24/0xa0 [ 44.644659] lr : bpf_trampoline_update.constprop.0+0x428/0x4a0 [ 44.646118] sp : ffff80000803b9f0 [ 44.646950] x29: ffff80000803b9f0 x28: ffff0b5d80364400 x27: ffff80000803bb48 [ 44.648721] x26: ffff8000085ad000 x25: ffff0b5d809d2400 x24: 0000000000000000 [ 44.650493] x23: 00000000ffffffed x22: ffff0b5dd7ea0900 x21: 0000000000000000 [ 44.652279] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff [ 44.654067] x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff [ 44.655787] x14: ffff0b5d809d2498 x13: ffff0b5d809d2432 x12: 0000000005f5e100 [ 44.657535] x11: abcc77118461cefd x10: 000000000000005f x9 : ffffa7219cb5b190 [ 44.659254] x8 : ffffa7219c8e0000 x7 : 0000000000000000 x6 : ffffa7219db075e0 [ 44.661066] x5 : ffffa7219d3130e0 x4 : ffffa7219cab9da0 x3 : 0000000000000000 [ 44.662837] x2 : 0000000000000000 x1 : ffffa7219cb7a5c0 x0 : 0000000000000000 [ 44.664675] Call trace: [ 44.665274] ftrace_set_filter_ip+0x24/0xa0 [ 44.666327] bpf_trampoline_update.constprop.0+0x428/0x4a0 [ 44.667696] __bpf_trampoline_link_prog+0xcc/0x1c0 [ 44.668834] bpf_trampoline_link_prog+0x40/0x64 [ 44.669919] bpf_tracing_prog_attach+0x120/0x490 [ 44.671011] link_create+0xe0/0x2b0 [ 44.671869] __sys_bpf+0x484/0xd30 [ 44.672706] __arm64_sys_bpf+0x30/0x40 [ 44.673678] invoke_syscall+0x78/0x100 [ 44.674623] el0_svc_common.constprop.0+0x4c/0xf4 [ 44.675783] do_el0_svc+0x38/0x4c [ 44.676624] el0_svc+0x34/0x100 [ 44.677429] el0t_64_sync_handler+0x11c/0x150 [ 44.678532] el0t_64_sync+0x190/0x194 [ 44.679439] Code: 2a0203f4 f90013f5 2a0303f5 f9001fe1 (f9400800) [ 44.680959] ---[ end trace 0000000000000000 ]--- [ 44.682111] Kernel panic - not syncing: Oops: Fatal exception [ 44.683488] SMP: stopping secondary CPUs [ 44.684551] Kernel Offset: 0x2721948e0000 from 0xffff800008000000 [ 44.686095] PHYS_OFFSET: 0xfffff4a380000000 [ 44.687144] CPU features: 0x010,00022811,19001080 [ 44.688308] Memory Limit: none [ 44.689082] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- It's caused by a NULL tr->fops passed to ftrace_set_filter_ip(). tr->fops is initialized to NULL and is assigned to an allocated memory address if CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled. Since there is no direct call on arm64 yet, the config can't be enabled. To fix it, call ftrace_set_filter_ip() only if tr->fops is not NULL. Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)") Reported-by: Bruno Goncalves Signed-off-by: Xu Kuohai Signed-off-by: Andrii Nakryiko Tested-by: Bruno Goncalves Acked-by: Song Liu Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20220728114048.3540461-1-xukuohai@huaweicloud.com commit dc81f8d1e8ea3f5dfa88919cb834a135a6a536b8 Author: Song Liu Date: Fri Jul 29 12:41:06 2022 -0700 bpf: Fix test_progs -j error with fentry/fexit tests When multiple threads are attaching/detaching fentry/fexit programs to the same trampoline, we may call register_fentry on the same trampoline twice: register_fentry(), unregister_fentry(), then register_fentry again. This causes ftrace_set_filter_ip() for the same ip on tr->fops twice, which leaves duplicated ip in tr->fops. The extra ip is not cleaned up properly on unregister and thus causes failures with further register in register_ftrace_direct_multi(): register_ftrace_direct_multi() { ... for (i = 0; i < size; i++) { hlist_for_each_entry(entry, &hash->buckets[i], hlist) { if (ftrace_find_rec_direct(entry->ip)) goto out_unlock; } } ... } This can be triggered with parallel fentry/fexit tests with test_progs: ./test_progs -t fentry,fexit -j Fix this by resetting tr->fops in ftrace_set_filter_ip(), so that there will never be duplicated entries in tr->fops. Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)") Reported-by: Andrii Nakryiko Signed-off-by: Song Liu Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220729194106.1207472-1-song@kernel.org commit c5c7502e960d9128eae1a5663fb62506d8685ac3 Author: Yang Yingliang Date: Fri Jul 29 10:41:34 2022 +0800 video: fbdev: imxfb: fix return value check in imxfb_probe() If devm_ioremap_resource() fails, it never return NULL, replace NULL test with IS_ERR(). Fixes: b083c22d5114 ("video: fbdev: imxfb: Convert request_mem_region + ioremap to devm_ioremap_resource") Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit 52e0ea900202d23843daee8f7089817e81dd3dd7 Author: Stafford Horne Date: Fri Jul 29 19:54:08 2022 +0900 openrisc: io: Define iounmap argument as volatile When OpenRISC enables PCI it allows for more drivers to be compiled resulting in exposing the following with -Werror. drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe': drivers/video/fbdev/riva/fbdev.c:2062:42: error: passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type drivers/video/fbdev/nvidia/nvidia.c: In function 'nvidiafb_probe': drivers/video/fbdev/nvidia/nvidia.c:1414:20: error: passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type drivers/scsi/aic7xxx/aic7xxx_osm.c: In function 'ahc_platform_free': drivers/scsi/aic7xxx/aic7xxx_osm.c:1231:41: error: passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type Most architectures define the iounmap argument to be volatile. To fix this issue we do the same for OpenRISC. This patch must go before PCI is enabled on OpenRISC to avoid any compile failures. Link: https://lore.kernel.org/lkml/20220729033728.GA2195022@roeck-us.net/ Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Stafford Horne commit 3d316164e9a9699c322e003a37f528e8aecda24e Author: Stafford Horne Date: Sat Jul 23 06:00:41 2022 +0900 MAINTAINERS: Update Richard Henderson's address Richard's address at twiddle.net no longer works and we are getting bounces. This patch updates to his Linaro address. Reviewed-by: Richard Henderson Signed-off-by: Stafford Horne commit 740ea2bb22aa53a2ad5845b8bd8f013d08b037b7 Author: Stafford Horne Date: Sun Jun 5 11:03:31 2022 +0900 openrisc: Add virt defconfig I have been developing a new qemu virt platform to help with more efficient toolchain and kernel testing [1]. This patch adds the defconfig which is needed to support booting linux on the platform. [1] https://lore.kernel.org/qemu-devel/YpwNtowUTxRbh2Uq@antec/T/#m6db180b0d682785fb320e4a05345c12a063e0c47 Signed-off-by: Stafford Horne commit ded2ee36313c941f1a12b6f85cde295b575264ae Author: Stafford Horne Date: Sun Jun 12 08:42:33 2022 +0900 openrisc: Add pci bus support This patch adds required definitions to allow for PCI buses on OpenRISC. This is being tested on the OpenRISC QEMU virt platform which is in development. OpenRISC does not have IO ports so we keep the definition of IO_SPACE_LIMIT and PIO_RESERVED to be 0. Note, since commit 66bcd06099bb ("parport_pc: Also enable driver for PCI systems") all platforms that support PCI also need to support parallel port. We add a generic header to support compiling parallel port drivers, though they generally will not work as they require IO ports. Signed-off-by: Stafford Horne commit 0757060a438835df82bd8aec40d4abc7dc4c9584 Merge: 32346491ddf24 933c5a4f87d92 Author: Stafford Horne Date: Sat Jul 30 05:47:13 2022 +0900 Merge branch 'pci/header-cleanup-immutable' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci.git The OpenRISC PCI support depends on the fixups done in the pci/header-cleanup-immutable branch. Also, there are OpenRISC irqchip fixups in v5.19-rc6 that are needed to test the virt platform. This merge creates a base for the OpenRISC PCI changes. commit b5605148e6ce36bb21020d49010b617693933128 Author: Bart Van Assche Date: Wed Jul 27 12:34:15 2022 -0700 RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct srpt_device as long as either an RDMA port or a LIO target port is associated with it. This patch decouples the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt] Read of size 8 at addr ffff888141cc34b8 by task check/5093 Call Trace: show_stack+0x4e/0x53 dump_stack_lvl+0x51/0x66 print_address_description.constprop.0.cold+0xea/0x41e print_report.cold+0x90/0x205 kasan_report+0xb9/0xf0 __asan_load8+0x69/0x90 srpt_enable_tpg+0x31/0x70 [ib_srpt] target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod] configfs_write_iter+0x18b/0x210 new_sync_write+0x1f2/0x2f0 vfs_write+0x3e3/0x540 ksys_write+0xbb/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/20220727193415.1583860-4-bvanassche@acm.org Reported-by: Li Zhijian Tested-by: Li Zhijian Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") Signed-off-by: Bart Van Assche Signed-off-by: Jason Gunthorpe commit aa7dfbb41b5a60ab90e244d6f586b8cb5c791c3e Author: Bart Van Assche Date: Wed Jul 27 12:34:14 2022 -0700 RDMA/srpt: Introduce a reference count in struct srpt_device This will be used to keep struct srpt_device around as long as either the RDMA port exists or a LIO target port is associated with the struct srpt_device. Link: https://lore.kernel.org/r/20220727193415.1583860-3-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Jason Gunthorpe commit b03b1ae2a3125d4475452e4f19f5d3a6e910ff6e Author: Bart Van Assche Date: Wed Jul 27 12:34:13 2022 -0700 RDMA/srpt: Duplicate port name members Prepare for decoupling the lifetimes of struct srpt_port and struct srpt_port_id by duplicating the port name into struct srpt_port. Link: https://lore.kernel.org/r/20220727193415.1583860-2-bvanassche@acm.org Signed-off-by: Bart Van Assche Signed-off-by: Jason Gunthorpe commit 64f991590ff4410041a70ee7ec2db079bc953929 Author: Rodrigo Siqueira Date: Thu Jul 28 16:33:47 2022 -0400 drm/amd/display: Fix a compilation failure on PowerPC caused by FPU code We got a report from Stephen/Michael that the PowerPC build was failing with the following error: ld: drivers/gpu/drm/amd/display/dc/dml/display_mode_lib.o uses hard float, drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.o uses soft float ld: failed to merge target specific data of file drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.o This error happened because of the function optc3_set_vrr_m_const. This function expects a double as a parameter in a code that is not allowed to have FPU operations. After further investigation, it became clear that optc3_set_vrr_m_const was never invoked, so we can safely drop this function and fix the ld issue. Cc: Alex Deucher Cc: Melissa Wen Reported-by: Stephen Rothwell Reported-by: Michael Ellerman Tested-by: Michael Ellerman Acked-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 7e8a3ca972adfc89609718c931577a86c494967b Author: Xiaojian Du Date: Wed Jul 27 15:52:33 2022 +0800 drm/amdgpu: enable support for psp 13.0.4 block This patch will enable support for psp 13.0.4 blcok. Signed-off-by: Xiaojian Du Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 2605e60c82604508f60dbf427b82cd48154d88ee Author: Xiaojian Du Date: Thu Jul 28 13:25:26 2022 +0800 drm/amdgpu: add files for PSP 13.0.4 This patch will add files for PSP 13.0.4. Signed-off-by: Xiaojian Du Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 492af34c9f67ef864319d0db930c8518a04b1937 Author: Xiaojian Du Date: Thu Jul 28 13:23:38 2022 +0800 drm/amdgpu: add header files for MP 13.0.4 This patch will add header files for MP 13.0.4. Signed-off-by: Xiaojian Du Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit a16161a869d5633d7d9a825a2546b68953e3a6f0 Author: Yifan Zhang Date: Wed Jul 27 14:53:47 2022 +0800 drm/amdgpu: correct RLC_RLCS_BOOTLOAD_STATUS offset and index This patch corrects RLC_RLCS_BOOTLOAD_STATUS offset and index for GC 11.0.1. Signed-off-by: Yifan Zhang Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 69243df953e70c134c6735b31ba0e658c53d3cda Merge: 66bbf1441d218 a1848b0fa2517 Author: Mark Brown Date: Fri Jul 29 20:22:22 2022 +0100 Add SPI Driver to HPE GXP Architecture Merge series from nick.hawkins@hpe.com : The GXP supports 3 separate SPI interfaces to accommodate the system flash, core flash, and other functions. The SPI engine supports variable clock frequency, selectable 3-byte or 4-byte addressing and a configurable x1, x2, and x4 command/address/data modes. The memory buffer for reading and writing ranges between 256 bytes and 8KB. This driver supports access to the core flash and bios part. commit b834fc94c102eef751ff741aa0d9b814d0a81af1 Author: Xiaojian Du Date: Wed Jul 27 14:40:21 2022 +0800 drm/amdgpu: send msg to IMU for the front-door loading This patch will make SMU send msg to IMU for the front-door loading, it is required by some ASICs. Signed-off-by: Yifan Zhang Signed-off-by: Xiaojian Du Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit dcfe584b00f1d6dcbeeb769b939f53a3c4f04143 Author: Yu Zhe Date: Thu Jul 28 11:30:26 2022 +0800 drm/amdkfd: use time_is_before_jiffies(a + b) to replace "jiffies - a > b" time_is_before_jiffies deals with timer wrapping correctly. Signed-off-by: Yu Zhe Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 6352f3478a95cc413ecfee4fdb3300009fd3679a Merge: 59fa06cd8529e 03c440a26cba6 2c65e312bc6bb 9066e151c3795 Author: Rafael J. Wysocki Date: Fri Jul 29 20:27:37 2022 +0200 Merge branches 'acpi-video', 'acpi-pci' and 'acpi-docs' Merge ACPI backlight driver changes, ACPI changes related to PCI and ACPI documentation changes for v5.20-rc1: - Use native backlight on Dell Inspiron N4010 (Hans de Goede). - Use native backlight on some TongFang devices (Werner Sembach). - Drop X86 dependency from the ACPI backlight driver Kconfig (Riwen Lu). - Shorten the quirk list in the ACPI backlight driver by identifying Clevo by board_name only (Werner Sembach). - Remove useless NULL pointer checks from 2 ACPI PCI link management functions (Andrey Strachuk). - Fix obsolete example in the ACPI EINJ documentation (Qifu Zhang). - Update links and references to _DSD-related documents (Sudeep Holla). * acpi-video: ACPI: video: Use native backlight on Dell Inspiron N4010 ACPI: video: Shortening quirk list by identifying Clevo by board_name only ACPI: video: Force backlight native for some TongFang devices ACPI: video: Drop X86 dependency from Kconfig * acpi-pci: ACPI/PCI: Remove useless NULL pointer checks * acpi-docs: Documentation: ACPI: EINJ: Fix obsolete example Documentation: ACPI: Update links and references to DSD related docs commit 59fa06cd8529e05a1498f810d61d99008597cf49 Merge: 198c414ef21a0 ec6c050319041 b4f1f61ed5928 3dcb861dbc6ab 9946e39fe8d0a Author: Rafael J. Wysocki Date: Fri Jul 29 20:16:42 2022 +0200 Merge branches 'acpi-pm', 'acpi-soc', 'acpi-tables' and 'acpi-resource' Merge ACPI power management changes, ACPI LPSS driver changes, ACPI table parsing code changes and ACPI resource handling changes for v5.20-rc1: - Save NVS memory during transitions into S3 on Lenovo G40-45 (Manyi Li). - Add support for upcoming AMD uPEP device ID AMDI008 to the ACPI suspend-to-idle driver for x86 platforms (Shyam Sundar S K). - Clean up checks related to the ACPI_FADT_LOW_POWER_S0 platform flag in the LPIT table driver and the suspend-to-idle driver for x86 platforms (Rafael Wysocki). - Print information messages regarding declared LPS0 idle support in the platform firmware (Rafael Wysocki). - Fix missing check in register_device_clock() in the ACPI driver for Intel SoCs (huhai). - Fix ACS setup in the VIOT table parser (Eric Auger). - Skip IRQ override on AMD Zen platforms where it's harmful (Chuanhong Guo). * acpi-pm: ACPI: PM: x86: Print messages regarding LPS0 idle support ACPI: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset Revert "ACPI / PM: LPIT: Register sysfs attributes based on FADT" ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 ACPI: PM: save NVS memory for Lenovo G40-45 * acpi-soc: ACPI: LPSS: Fix missing check in register_device_clock() * acpi-tables: ACPI: VIOT: Fix ACS setup * acpi-resource: ACPI: resource: skip IRQ override on AMD Zen platforms commit 639de43ef0dda165441af400ecb372e16b7f9354 Author: Daniel Müller Date: Wed Jul 27 18:29:55 2022 +0000 selftests/bpf: Bump internal send_signal/send_signal_tracepoint timeout The send_signal/send_signal_tracepoint is pretty flaky, with at least one failure in every ten runs on a few attempts I've tried it: > test_send_signal_common:PASS:pipe_c2p 0 nsec > test_send_signal_common:PASS:pipe_p2c 0 nsec > test_send_signal_common:PASS:fork 0 nsec > test_send_signal_common:PASS:skel_open_and_load 0 nsec > test_send_signal_common:PASS:skel_attach 0 nsec > test_send_signal_common:PASS:pipe_read 0 nsec > test_send_signal_common:PASS:pipe_write 0 nsec > test_send_signal_common:PASS:reading pipe 0 nsec > test_send_signal_common:PASS:reading pipe error: size 0 0 nsec > test_send_signal_common:FAIL:incorrect result unexpected incorrect result: actual 48 != expected 50 > test_send_signal_common:PASS:pipe_write 0 nsec > #139/1 send_signal/send_signal_tracepoint:FAIL The reason does not appear to be a correctness issue in the strict sense. Rather, we merely do not receive the signal we are waiting for within the provided timeout. Let's bump the timeout by a factor of ten. With that change I have not been able to reproduce the failure in 150+ iterations. I am also sneaking in a small simplification to the test_progs test selection logic. Signed-off-by: Daniel Müller Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20220727182955.4044988-1-deso@posteo.net commit 198c414ef21a0b3521490430cade6aa7863a249e Merge: d60b6b0bc0036 e414207d12f38 b13a3e5fd40b7 3e6573c5d275c Author: Rafael J. Wysocki Date: Fri Jul 29 20:08:25 2022 +0200 Merge branches 'acpi-processor', 'acpi-apei' and 'acpi-ec' Merge ACPI processor driver changes, APEI changes and ACPI EC driver changes for v5.20-rc1: - Drop leftover acpi_processor_get_limit_info() declaration (Riwen Lu). - Split out thermal initialization from ACPI PSS (Riwen Lu). - Annotate more functions in the ACPI CPU idle driver to live in the cpuidle section (Guilherme G. Piccoli). - Fix _EINJ vs "special purpose" EFI memory regions (Dan Williams). - Implement a better fix to avoid spamming the console with old error logs (Tony Luck). - Fix typo in a comment in the APEI code (Xiang wangx). - Clean up the ACPI EC driver after previous changes in it (Hans de Goede). * acpi-processor: ACPI: processor: Drop leftover acpi_processor_get_limit_info() declaration ACPI: processor: Split out thermal initialization from ACPI PSS ACPI: processor/idle: Annotate more functions to live in cpuidle section * acpi-apei: ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ACPI: APEI: Better fix to avoid spamming the console with old error logs ACPI: APEI: Fix double word in a comment * acpi-ec: ACPI: EC: Drop unused ident initializers from dmi_system_id tables ACPI: EC: Re-use boot_ec when possible even when EC_FLAGS_TRUST_DSDT_GPE is set ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks commit d60b6b0bc00365ab338804213437785d269f777b Merge: 4f4179fcf4208 e6bdbcc764af8 Author: Rafael J. Wysocki Date: Fri Jul 29 19:58:52 2022 +0200 Merge branch 'acpi-bus' Merge ACPI device object management changes for v5.20-rc1. - Use the facilities provided by the driver core and some additional helpers to handle the children of a given ACPI device object in multiple places instead of using the children and node list heads in struct acpi_device which is error prone (Rafael Wysocki). - Fix ACPI-related device reference counting issue in the hisi_lpc bus driver (Yang Yingliang). - Drop the children and node list heads that are not needed any more from struct acpi_device (Rafael Wysocki). - Drop driver member from struct acpi_device (Uwe Kleine-König). - Drop redundant check from acpi_device_remove() (Uwe Kleine-König). * acpi-bus: ACPI: bus: Drop unused list heads from struct acpi_device hisi_lpc: Use acpi_dev_for_each_child() bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() ACPI: bus: Drop driver member of struct acpi_device ACPI: bus: Drop redundant check in acpi_device_remove() mfd: core: Use acpi_dev_for_each_child() ACPI / MMC: PM: Unify fixing up device power soundwire: Use acpi_dev_for_each_child() platform/x86/thinkpad_acpi: Use acpi_dev_for_each_child() ACPI: scan: Walk ACPI device's children using driver core ACPI: bus: Introduce acpi_dev_for_each_child_reverse() ACPI: video: Use acpi_dev_for_each_child() ACPI: bus: Export acpi_dev_for_each_child() to modules ACPI: property: Use acpi_dev_for_each_child() for child lookup ACPI: container: Use acpi_dev_for_each_child() USB: ACPI: Replace usb_acpi_find_port() with acpi_find_child_by_adr() thunderbolt: ACPI: Replace tb_acpi_find_port() with acpi_find_child_by_adr() ACPI: glue: Introduce acpi_find_child_by_adr() ACPI: glue: Introduce acpi_dev_has_children() ACPI: glue: Use acpi_dev_for_each_child() commit aa727b7b4b67dba2a6cfebdd98767c455c2b3d69 Merge: 954a83fc60c80 b2111a01dc3c3 8d36694245f2a b3f6c43d008c5 7c4300eb05fbf Author: Rafael J. Wysocki Date: Fri Jul 29 19:46:00 2022 +0200 Merge branches 'pm-devfreq', 'pm-qos', 'pm-tools' and 'pm-docs' Merge devfreq changes, PM QoS change, and power management tools and documentation changes for v5.20-rc1: - Add new devfreq driver for Mediatek CCI (Cache Coherent Interconnect) (Johnson Wang). - Convert the Samsung Exynos SoC Bus bindings to DT schema of exynos-bus.c (Krzysztof Kozlowski). - Address kernel-doc warnings by adding the description for unused fucntion parameters in devfreq core (Mauro Carvalho Chehab). - Use NULL to pass a null pointer rather than zero according to the function propotype in imx-bus.c (Colin Ian King). - Print error message instead of error interger value in tegra30-devfreq.c (Dmitry Osipenko). - Add checks to prevent setting negative frequency QoS limits for CPUs (Shivnandan Kumar). - Update the pm-graph suite of utilities to the latest revision 5.9 including multiple improvements (Todd Brandt). - Drop pme_interrupt reference from the PCI power management documentation (Mario Limonciello). * pm-devfreq: PM / devfreq: tegra30: Add error message for devm_devfreq_add_device() PM / devfreq: imx-bus: use NULL to pass a null pointer rather than zero PM / devfreq: shut up kernel-doc warnings dt-bindings: interconnect: samsung,exynos-bus: convert to dtschema PM / devfreq: mediatek: Introduce MediaTek CCI devfreq driver dt-bindings: interconnect: Add MediaTek CCI dt-bindings * pm-qos: PM: QoS: Add check to make sure CPU freq is non-negative * pm-tools: pm-graph v5.9 * pm-docs: Documentation: PM: Drop pme_interrupt reference commit a6df06744b2d0b953615e0d6ca8b5e84ae4019fc Author: Jörn-Thorben Hinz Date: Tue Jul 26 15:32:03 2022 +0200 bpftool: Don't try to return value from void function in skeleton A skeleton generated by bpftool previously contained a return followed by an expression in OBJ_NAME__detach(), which has return type void. This did not hurt, the bpf_object__detach_skeleton() called there returns void itself anyway, but led to a warning when compiling with e.g. -pedantic. Signed-off-by: Jörn-Thorben Hinz Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20220726133203.514087-1-jthinz@mailbox.tu-berlin.de commit 5eff8c18f124e47da0be79fb2b776e1c2cac0b07 Author: Rongguang Wei Date: Tue Jul 26 17:30:45 2022 +0800 bpftool: Replace sizeof(arr)/sizeof(arr[0]) with ARRAY_SIZE macro Use the ARRAY_SIZE macro and make the code more compact. Signed-off-by: Rongguang Wei Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20220726093045.3374026-1-clementwei90@163.com commit 954a83fc60c805f138db26747645710f243a9939 Merge: 82b6c2e7df79e c46a0d5ae4f93 8386c414e27ca b08b95cf30f53 37101d3c71938 f3ac888fc5fbd Author: Rafael J. Wysocki Date: Fri Jul 29 19:33:13 2022 +0200 Merge branches 'pm-core', 'pm-sleep', 'powercap', 'pm-domains' and 'pm-em' Merge core device power management changes for v5.20-rc1: - Extend support for wakeirq to callback wrappers used during system suspend and resume (Ulf Hansson). - Defer waiting for device probe before loading a hibernation image till the first actual device access to avoid possible deadlocks reported by syzbot (Tetsuo Handa). - Unify device_init_wakeup() for PM_SLEEP and !PM_SLEEP (Bjorn Helgaas). - Add Raptor Lake-P to the list of processors supported by the Intel RAPL driver (George D Sworo). - Add Alder Lake-N and Raptor Lake-P to the list of processors for which Power Limit4 is supported in the Intel RAPL driver (Sumeet Pawnikar). - Make pm_genpd_remove() check genpd_debugfs_dir against NULL before attempting to remove it (Hsin-Yi Wang). - Change the Energy Model code to represent power in micro-Watts and adjust its users accordingly (Lukasz Luba). * pm-core: PM: runtime: Extend support for wakeirq for force_suspend|resume * pm-sleep: PM: hibernate: defer device probing when resuming from hibernation PM: wakeup: Unify device_init_wakeup() for PM_SLEEP and !PM_SLEEP * powercap: powercap: RAPL: Add Power Limit4 support for Alder Lake-N and Raptor Lake-P powercap: intel_rapl: Add support for RAPTORLAKE_P * pm-domains: PM: domains: Ensure genpd_debugfs_dir exists before remove * pm-em: cpufreq: scmi: Support the power scale in micro-Watts in SCMI v3.1 firmware: arm_scmi: Get detailed power scale from perf Documentation: EM: Switch to micro-Watts scale PM: EM: convert power field to micro-Watts precision and align drivers commit 82b6c2e7df79eb01ef561f8bf7a881f7db466c7a Merge: 3e5c04f97c87f f611b33af2a88 Author: Rafael J. Wysocki Date: Fri Jul 29 19:19:23 2022 +0200 Merge branches 'pm-cpufreq' and 'pm-cpuidle' Merge processor power management changes for v5.20-rc1: - Make cpufreq_show_cpus() more straightforward (Viresh Kumar). - Drop unnecessary CPU hotplug locking from store() used by cpufreq sysfs attributes (Viresh Kumar). - Make the ACPI cpufreq driver support the boost control interface on Zhaoxin/Centaur processors (Tony W Wang-oc). - Print a warning message on attempts to free an active cpufreq policy which should never happen (Viresh Kumar). - Fix grammar in the Kconfig help text for the loongson2 cpufreq driver (Randy Dunlap). - Use cpumask_var_t for an on-stack CPU mask in the ondemand cpufreq governor (Zhao Liu). - Add trace points for guest_halt_poll_ns grow/shrink to the haltpoll cpuidle driver (Eiichi Tsukata). - Modify intel_idle to treat C1 and C1E as independent idle states on Sapphire Rapids (Artem Bityutskiy). * pm-cpufreq: cpufreq: ondemand: Use cpumask_var_t for on-stack cpu mask cpufreq: loongson2: fix Kconfig "its" grammar cpufreq: Warn users while freeing active policy cpufreq: ACPI: Add Zhaoxin/Centaur turbo boost control interface support cpufreq: Drop unnecessary cpus locking from store() cpufreq: Optimize cpufreq_show_cpus() * pm-cpuidle: intel_idle: make SPR C1 and C1E be independent cpuidle: haltpoll: Add trace points for guest_halt_poll_ns grow/shrink commit 5147ba8af2d707d9bbd65e84286c42b11d612c83 Author: Krishna chaitanya chundru Date: Fri Jul 15 17:29:25 2022 +0530 PCI: qcom: Allow ASPM L1 and substates for 2.7.0 Allow ASPM L1 and its substates. By default this is disabled in the qcom specific hardware. Enable it explicitly only for controllers belonging to 2_7_0. This does not affect any link capability registers; it will allow the link transitions to L1 and its substates only if they are already supported. Link: https://lore.kernel.org/r/1657886366-32685-1-git-send-email-quic_krichai@quicinc.com Signed-off-by: Krishna chaitanya chundru Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Acked-by: Stanimir Varbanov commit da9d01794e31714a90a38e395c14723fb46f90b0 Merge: a2ed4e7e3b3ac d0c75fa2c17f0 Author: Rafael J. Wysocki Date: Fri Jul 29 19:10:56 2022 +0200 Merge tag 'thermal-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal control changes for 5.20-rc1 from Daniel Lezcano: "- Make per cpufreq / devfreq cooling device ops instead of using a global variable, fix comments and rework the trace information (Lukasz Luba) - Add the include/dt-bindings/thermal.h under the area covered by the thermal maintainer in the MAINTAINERS file (Lukas Bulwahn) - Improve the error output by giving the sensor identification when a thermal zone failed to initialize, the DT bindings by changing the positive logic and adding the r8a779f0 support on the rcar3 (Wolfram Sang) - Convert the QCom tsens DT binding to the dtsformat format (Krzysztof Kozlowski) - Remove the pointless get_trend() function in the QCom, Ux500 and tegra thermal drivers, along with the unused DROP_FULL and RAISE_FULL trends definitions. Simplify the code by using clamp() macros (Daniel Lezcano) - Fix ref_table memory leak at probe time on the k3_j72xx bandgap (Bryan Brattlof) - Fix array underflow in prep_lookup_table (Dan Carpenter) - Add static annotation to the k3_j72xx_bandgap_j7* data structure (Jin Xiaoyun) - Fix typos in comments detected on sun8i by Coccinelle (Julia Lawall) - Fix typos in comments on rzg2l (Biju Das) - Remove as unnecessary call to dev_err() as the error is already printed by the failing function on u8500 (Yang Li) - Register the thermal zones as hwmon sensors for the Qcom thermal sensors (Dmitry Baryshkov) - Fix 'tmon' tool compilation issue by adding phtread.h include (Markus Mayer) - Fix typo in the comments for the 'tmon' tool (Slark Xiao) - Consolidate the thermal core code by beginning to move the thermal trip structure from the thermal OF code as a generic structure to be used by the different sensors when registering a thermal zone (Daniel Lezcano)" * tag 'thermal-v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (36 commits) thermal/of: Initialize trip points separately thermal/of: Use thermal trips stored in the thermal zone thermal/core: Add thermal_trip in thermal_zone thermal/core: Rename 'trips' to 'num_trips' thermal/core: Move thermal_set_delay_jiffies to static thermal/core: Remove unneeded EXPORT_SYMBOLS thermal/of: Move thermal_trip structure to thermal.h thermal/of: Remove the device node pointer for thermal_trip thermal/of: Replace device node match with device node search thermal/core: Remove duplicate information when an error occurs thermal/core: Avoid calling ->get_trip_temp() unnecessarily thermal/tools/tmon: Fix typo 'the the' in comment thermal/tools/tmon: Include pthread and time headers in tmon.h thermal/ti-soc-thermal: Fix comment typo thermal/drivers/qcom/spmi-adc-tm5: Register thermal zones as hwmon sensors thermal/drivers/qcom/temp-alarm: Register thermal zones as hwmon sensors thermal/drivers/u8500: Remove unnecessary print function dev_err() thermal/drivers/rzg2l: Fix comments thermal/drivers/sun8i: Fix typo in comment thermal/drivers/k3_j72xx_bandgap: Make k3_j72xx_bandgap_j721e_data and k3_j72xx_bandgap_j7200_data static ... commit c1ef322491cb880fea4e52535b15448f2a573ded Author: Arnd Bergmann Date: Fri Jul 15 17:36:17 2022 +0200 sparc: Use generic pci_mmap_resource_range() The main feature of the sparc-specific implementation of pci_mmap_resource_range() is that it allows mapping the entire PCI I/O space for a PCI host bridge using the /proc/bus/pci interface on a bridge device. The generic implementation cannot do this, but it also appears that this got broken for sparc by commit 9eff02e2042f ("PCI: check mmap range of /proc/bus/pci files too"), which enforces that each address is part of a BAR for kernels after 2.6.28. Remove it all, assuming that the corresponding user space code has already been changed to access /dev/ioport instead a long time ago. Add pci_iobar_pfn() to make it possible to map I/O resources. This is adapted from the powerpc version. Link: https://lore.kernel.org/lkml/1519887203.622.3.camel@infradead.org/t/ Link: https://lore.kernel.org/r/20220715153617.3393420-2-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Bjorn Helgaas commit 0ad722f159e44983ddea1929ffd90d0c20a86f24 Author: Arnd Bergmann Date: Fri Jul 15 17:36:16 2022 +0200 PCI: Remove pci_mmap_page_range() wrapper The ARCH_GENERIC_PCI_MMAP_RESOURCE symbol came up in a recent discussion, and I noticed that this was left behind by an unfinished cleanup from 2017. The only architecture that still relies on providing its own pci_mmap_page_range() helper instead of using the generic pci_mmap_resource_range() is sparc. Presumably the reasons for this have not changed, but at least this can be simplified by converting sparc to use the same interface as the others. The only difference between the two is the device-specific offset that gets added to or subtracted from vma->vm_pgoff. Change the only caller of pci_mmap_page_range() in common code to subtract this offset and call the modern interface, while adding it back in the sparc implementation to preserve the existing behavior. This removes the complexities of the dual interfaces from the common code, and keeps it all specific to the sparc architecture code. According to David Miller, the sparc code lets user space poke into the VGA I/O port registers by mmapping the I/O space of the parent bridge device, which is something that the generic pci_mmap_resource_range() code apparently does not. Link: https://lore.kernel.org/lkml/1519887203.622.3.camel@infradead.org/t/ Link: https://lore.kernel.org/lkml/20220714214657.2402250-3-shorne@gmail.com/ Link: https://lore.kernel.org/r/20220715153617.3393420-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Bjorn Helgaas Cc: David Woodhouse Cc: David S. Miller Cc: Stafford Horne commit a2ed4e7e3b3ac20769ee292795e7c2d086800261 Merge: b3ca7aff3cbb0 5a5b7d8d54168 Author: Rafael J. Wysocki Date: Fri Jul 29 19:08:18 2022 +0200 Merge branch 'thermal-core' Merge changes that make the thermal core use ida_alloc()/free() directly instead of ida_simple_get()/ida_simple_remove() that have been deprecated. * thermal-core: thermal: Directly use ida_alloc()/free() commit 933c5a4f87d92a865d1db76caf190f1a4a1927f9 Author: Stafford Horne Date: Sat Jul 23 06:22:48 2022 +0900 PCI: Stub __pci_ioport_map() for arches that don't support it at all When building OpenRISC PCI, which has no ioport_map(), we get the following build error: lib/pci_iomap.c: In function 'pci_iomap_range': CC drivers/i2c/i2c-core-base.o ./include/asm-generic/pci_iomap.h:29:41: error: implicit declaration of function 'ioport_map'; did you mean 'ioremap'? [-Werror=implicit-function-declaration] 29 | #define __pci_ioport_map(dev, port, nr) ioport_map((port), (nr)) | ^~~~~~~~~~ lib/pci_iomap.c:44:24: note: in expansion of macro '__pci_ioport_map' 44 | return __pci_ioport_map(dev, start, len); | ^~~~~~~~~~~~~~~~ Add a NULL definition of __pci_ioport_map() for architectures that do not support ioport_map(). Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/r/20220722212248.802500-1-shorne@gmail.com Signed-off-by: Stafford Horne Signed-off-by: Bjorn Helgaas commit 58250ae350de8d28ce91ade4605d32c9e7f062a8 Author: Fedor Tokarev Date: Mon Jul 11 23:13:17 2022 +0200 bpf: btf: Fix vsnprintf return value check vsnprintf returns the number of characters which would have been written if enough space had been available, excluding the terminating null byte. Thus, the return value of 'len_left' means that the last character has been dropped. Signed-off-by: Fedor Tokarev Signed-off-by: Andrii Nakryiko Acked-by: Alan Maguire Link: https://lore.kernel.org/bpf/20220711211317.GA1143610@laptop commit 9a0b36266f7a83912592052035b84f13b12e30da Author: Zhengjun Xing Date: Thu Jul 21 14:57:06 2022 +0800 perf stat: Add topdown metrics in the default perf stat on the hybrid machine Topdown metrics are missed in the default perf stat on the hybrid machine, add Topdown metrics in default perf stat for hybrid systems. Currently, we support the perf metrics Topdown for the p-core PMU in the perf stat default, the perf metrics Topdown support for e-core PMU will be implemented later separately. Refactor the code adds two x86 specific functions. Widen the size of the event name column by 7 chars, so that all metrics after the "#" become aligned again. The perf metrics topdown feature is supported on the cpu_core of ADL. The dedicated perf metrics counter and the fixed counter 3 are used for the topdown events. Adding the topdown metrics doesn't trigger multiplexing. Before: # ./perf stat -a true Performance counter stats for 'system wide': 53.70 msec cpu-clock # 25.736 CPUs utilized 80 context-switches # 1.490 K/sec 24 cpu-migrations # 446.951 /sec 52 page-faults # 968.394 /sec 2,788,555 cpu_core/cycles/ # 51.931 M/sec 851,129 cpu_atom/cycles/ # 15.851 M/sec 2,974,030 cpu_core/instructions/ # 55.385 M/sec 416,919 cpu_atom/instructions/ # 7.764 M/sec 586,136 cpu_core/branches/ # 10.916 M/sec 79,872 cpu_atom/branches/ # 1.487 M/sec 14,220 cpu_core/branch-misses/ # 264.819 K/sec 7,691 cpu_atom/branch-misses/ # 143.229 K/sec 0.002086438 seconds time elapsed After: # ./perf stat -a true Performance counter stats for 'system wide': 61.39 msec cpu-clock # 24.874 CPUs utilized 76 context-switches # 1.238 K/sec 24 cpu-migrations # 390.968 /sec 52 page-faults # 847.097 /sec 2,753,695 cpu_core/cycles/ # 44.859 M/sec 903,899 cpu_atom/cycles/ # 14.725 M/sec 2,927,529 cpu_core/instructions/ # 47.690 M/sec 428,498 cpu_atom/instructions/ # 6.980 M/sec 581,299 cpu_core/branches/ # 9.470 M/sec 83,409 cpu_atom/branches/ # 1.359 M/sec 13,641 cpu_core/branch-misses/ # 222.216 K/sec 8,008 cpu_atom/branch-misses/ # 130.453 K/sec 14,761,308 cpu_core/slots/ # 240.466 M/sec 3,288,625 cpu_core/topdown-retiring/ # 22.3% retiring 1,323,323 cpu_core/topdown-bad-spec/ # 9.0% bad speculation 5,477,470 cpu_core/topdown-fe-bound/ # 37.1% frontend bound 4,679,199 cpu_core/topdown-be-bound/ # 31.7% backend bound 646,194 cpu_core/topdown-heavy-ops/ # 4.4% heavy operations # 17.9% light operations 1,244,999 cpu_core/topdown-br-mispredict/ # 8.4% branch mispredict # 0.5% machine clears 3,891,800 cpu_core/topdown-fetch-lat/ # 26.4% fetch latency # 10.7% fetch bandwidth 1,879,034 cpu_core/topdown-mem-bound/ # 12.7% memory bound # 19.0% Core bound 0.002467839 seconds time elapsed Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220721065706.2886112-6-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit cdb204ad42232070ccc2deb0c451b25d1d4cc892 Author: Kan Liang Date: Thu Jul 21 14:57:05 2022 +0800 perf x86 evlist: Add default hybrid events for perf stat Provide a new solution to replace the reverted commit ac2dc29edd21f9ec ("perf stat: Add default hybrid events") For the default software attrs, nothing is changed. For the default hardware attrs, create a new evsel for each hybrid pmu. With the new solution, adding a new default attr will not require the special support for the hybrid platform anymore. Also, the "--detailed" is supported on the hybrid platform With the patch, $ perf stat -a -ddd sleep 1 Performance counter stats for 'system wide': 32,231.06 msec cpu-clock # 32.056 CPUs utilized 529 context-switches # 16.413 /sec 32 cpu-migrations # 0.993 /sec 69 page-faults # 2.141 /sec 176,754,151 cpu_core/cycles/ # 5.484 M/sec (41.65%) 161,695,280 cpu_atom/cycles/ # 5.017 M/sec (49.92%) 48,595,992 cpu_core/instructions/ # 1.508 M/sec (49.98%) 32,363,337 cpu_atom/instructions/ # 1.004 M/sec (58.26%) 10,088,639 cpu_core/branches/ # 313.010 K/sec (58.31%) 6,390,582 cpu_atom/branches/ # 198.274 K/sec (58.26%) 846,201 cpu_core/branch-misses/ # 26.254 K/sec (66.65%) 676,477 cpu_atom/branch-misses/ # 20.988 K/sec (58.27%) 14,290,070 cpu_core/L1-dcache-loads/ # 443.363 K/sec (66.66%) 9,983,532 cpu_atom/L1-dcache-loads/ # 309.749 K/sec (58.27%) 740,725 cpu_core/L1-dcache-load-misses/ # 22.982 K/sec (66.66%) cpu_atom/L1-dcache-load-misses/ 480,441 cpu_core/LLC-loads/ # 14.906 K/sec (66.67%) 326,570 cpu_atom/LLC-loads/ # 10.132 K/sec (58.27%) 329 cpu_core/LLC-load-misses/ # 10.208 /sec (66.68%) 0 cpu_atom/LLC-load-misses/ # 0.000 /sec (58.32%) cpu_core/L1-icache-loads/ 21,982,491 cpu_atom/L1-icache-loads/ # 682.028 K/sec (58.43%) 4,493,189 cpu_core/L1-icache-load-misses/ # 139.406 K/sec (33.34%) 4,711,404 cpu_atom/L1-icache-load-misses/ # 146.176 K/sec (50.08%) 13,713,090 cpu_core/dTLB-loads/ # 425.462 K/sec (33.34%) 9,384,727 cpu_atom/dTLB-loads/ # 291.170 K/sec (50.08%) 157,387 cpu_core/dTLB-load-misses/ # 4.883 K/sec (33.33%) 108,328 cpu_atom/dTLB-load-misses/ # 3.361 K/sec (50.08%) cpu_core/iTLB-loads/ cpu_atom/iTLB-loads/ 37,655 cpu_core/iTLB-load-misses/ # 1.168 K/sec (33.32%) 61,661 cpu_atom/iTLB-load-misses/ # 1.913 K/sec (50.03%) cpu_core/L1-dcache-prefetches/ cpu_atom/L1-dcache-prefetches/ cpu_core/L1-dcache-prefetch-misses/ cpu_atom/L1-dcache-prefetch-misses/ 1.005466919 seconds time elapsed Signed-off-by: Kan Liang Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220721065706.2886112-5-zhengjun.xing@linux.intel.com Signed-off-by: Xing Zhengjun Signed-off-by: Arnaldo Carvalho de Melo commit a9c1ecdabc4f2ef04ef5334b8deb3a5c5910136d Author: Kan Liang Date: Thu Jul 21 14:57:04 2022 +0800 perf evlist: Always use arch_evlist__add_default_attrs() Current perf stat uses the evlist__add_default_attrs() to add the generic default attrs, and uses arch_evlist__add_default_attrs() to add the Arch specific default attrs, e.g., Topdown for x86. It works well for the non-hybrid platforms. However, for a hybrid platform, the hard code generic default attrs don't work. Uses arch_evlist__add_default_attrs() to replace the evlist__add_default_attrs(). The arch_evlist__add_default_attrs() is modified to invoke the same __evlist__add_default_attrs() for the generic default attrs. No functional change. Add default_null_attrs[] to indicate the arch specific attrs. No functional change for the arch specific default attrs either. Signed-off-by: Kan Liang Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220721065706.2886112-4-zhengjun.xing@linux.intel.com Signed-off-by: Xing Zhengjun Signed-off-by: Arnaldo Carvalho de Melo commit ff4207f79307dc4910a27771e4306e1a64fde3e1 Author: Kan Liang Date: Thu Jul 21 14:57:03 2022 +0800 perf evsel: Add arch_evsel__hw_name() The commit 55bcf6ef314ae8ba ("perf: Extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE") extends the two types to become PMU aware types for a hybrid system. However, current evsel__hw_name doesn't take the PMU type into account. It mistakenly returns the "unknown-hardware" for the hardware event with a specific PMU type. Add an arch specific arch_evsel__hw_name() to specially handle the PMU aware hardware event. Currently, the extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE is only supported by X86. Only implement the specific arch_evsel__hw_name() for X86 in the patch. Nothing is changed for the other archs. Signed-off-by: Kan Liang Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220721065706.2886112-3-zhengjun.xing@linux.intel.com Signed-off-by: Xing Zhengjun Signed-off-by: Arnaldo Carvalho de Melo commit ace3e31e653e79cae9b047e85f567e6b44c98532 Author: Kan Liang Date: Thu Jul 21 14:57:02 2022 +0800 perf stat: Revert "perf stat: Add default hybrid events" This reverts commit Fixes: ac2dc29edd21f9ec ("perf stat: Add default hybrid events") Between this patch and the reverted patch, the commit 6c1912898ed21bef ("perf parse-events: Rename parse_events_error functions") and the commit 07eafd4e053a41d7 ("perf parse-event: Add init and exit to parse_event_error") clean up the parse_events_error_*() codes. The related change is also reverted. The reverted patch is hard to be extended to support new default events, e.g., Topdown events, and the existing "--detailed" option on a hybrid platform. A new solution will be proposed in the following patch to enable the perf stat default on a hybrid platform. Signed-off-by: Kan Liang Acked-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220721065706.2886112-2-zhengjun.xing@linux.intel.com Signed-off-by: Xing Zhengjun Signed-off-by: Arnaldo Carvalho de Melo commit a1848b0fa2517a8d0bbc2783c90aefd4b7e7567a Author: Nick Hawkins Date: Thu Jul 28 11:14:59 2022 -0500 MAINTAINERS: add spi support to GXP Add the spi driver and dt-binding documentation Signed-off-by: Nick Hawkins Link: https://lore.kernel.org/r/20220728161459.7738-6-nick.hawkins@hpe.com Signed-off-by: Mark Brown commit 8cc35b86546dc35fb4f5ff7d1d163c5efc78bf0e Author: Nick Hawkins Date: Thu Jul 28 11:14:56 2022 -0500 spi: dt-bindings: add documentation for hpe,gxp-spifi Create documentation for the hpe,gxp-spifi binding to support access to the SPI parts Signed-off-by: Nick Hawkins Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220728161459.7738-3-nick.hawkins@hpe.com Signed-off-by: Mark Brown commit 730bc8ba5e9ec103065142975015a793558f09a0 Author: Nick Hawkins Date: Thu Jul 28 11:14:55 2022 -0500 spi: spi-gxp: Add support for HPE GXP SoCs The GXP supports 3 separate SPI interfaces to accommodate the system flash, core flash, and other functions. The SPI engine supports variable clock frequency, selectable 3-byte or 4-byte addressing and a configurable x1, x2, and x4 command/address/data modes. The memory buffer for reading and writing ranges between 256 bytes and 8KB. This driver supports access to the core flash and bios part. Signed-off-by: Nick Hawkins Link: https://lore.kernel.org/r/20220728161459.7738-2-nick.hawkins@hpe.com Signed-off-by: Mark Brown commit 93cb804edab1b9a5bb7bb7b6824012dbb20abf22 Author: Przemyslaw Patynowski Date: Wed Jun 15 15:36:29 2022 +0200 iavf: Fix 'tc qdisc show' listing too many queues Fix tc qdisc show dev root displaying too many fq_codel qdiscs. tc_modify_qdisc, which is caller of ndo_setup_tc, expects driver to call netif_set_real_num_tx_queues, which prepares qdiscs. Without this patch, fq_codel qdiscs would not be adjusted to number of queues on VF. e.g.: tc qdisc show dev qdisc mq 0: root qdisc fq_codel 0: parent :4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent :3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent :2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent :1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 tc qdisc add dev root mqprio num_tc 2 map 1 0 0 0 0 0 0 0 queues 1@0 1@1 hw 1 mode channel shaper bw_rlimit max_rate 5000Mbit 150Mbit tc qdisc show dev qdisc mqprio 8003: root tc 2 map 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues:(0:0) (1:1) mode:channel shaper:bw_rlimit max_rate:5Gbit 150Mbit qdisc fq_codel 0: parent 8003:4 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent 8003:3 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent 8003:2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent 8003:1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 While after fix: tc qdisc add dev root mqprio num_tc 2 map 1 0 0 0 0 0 0 0 queues 1@0 1@1 hw 1 mode channel shaper bw_rlimit max_rate 5000Mbit 150Mbit tc qdisc show dev #should show 2, shows 4 qdisc mqprio 8004: root tc 2 map 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues:(0:0) (1:1) mode:channel shaper:bw_rlimit max_rate:5Gbit 150Mbit qdisc fq_codel 0: parent 8004:2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc fq_codel 0: parent 8004:1 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") Signed-off-by: Przemyslaw Patynowski Co-developed-by: Grzegorz Szczurek Signed-off-by: Grzegorz Szczurek Co-developed-by: Kiran Patil Signed-off-by: Kiran Patil Signed-off-by: Jedrzej Jagielski Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit ec60d54cb9a3d43a02c5612a03093c18233e6601 Author: Przemyslaw Patynowski Date: Mon Jun 13 18:41:23 2022 -0400 iavf: Fix max_rate limiting Fix max_rate option in TC, check for proper quanta boundaries. Check for minimum value provided and if it fits expected 50Mbps quanta. Without this patch, iavf could send settings for max_rate limiting that would be accepted from by PF even the max_rate option is less than expected 50Mbps quanta. It results in no rate limiting on traffic as rate limiting will be floored to 0. Example: tc qdisc add dev $vf root mqprio num_tc 3 map 0 2 1 queues \ 2@0 2@2 2@4 hw 1 mode channel shaper bw_rlimit \ max_rate 50Mbps 500Mbps 500Mbps Should limit TC0 to circa 50 Mbps tc qdisc add dev $vf root mqprio num_tc 3 map 0 2 1 queues \ 2@0 2@2 2@4 hw 1 mode channel shaper bw_rlimit \ max_rate 0Mbps 100Kbit 500Mbps Should return error Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") Signed-off-by: Przemyslaw Patynowski Signed-off-by: Jun Zhang Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit f611b33af2a88f4179b130d4bf7c482271ce1c81 Merge: d295ad34f236c 1548fac47a114 Author: Rafael J. Wysocki Date: Fri Jul 29 17:15:30 2022 +0200 Merge back cpuidle material for 5.20. commit 452e21cf3438aca19b678d1f182d7d6525648956 Author: Michael Ellerman Date: Fri Jul 29 16:13:55 2022 +1000 powerpc/mm: Export memory_add_physaddr_to_nid() for modules The cxl_pmem module wants to call memory_add_physaddr_to_nid(), so export the symbol. Link: http://lore.kernel.org/r/87sfmkbfyg.fsf@mpe.ellerman.id.au Fixes: 04ad63f086d1 ("cxl/region: Introduce cxl_pmem_region objects") Reported-by: Sachin Sant Signed-off-by: Michael Ellerman Tested-by: Sachin Sant Signed-off-by: Dan Williams commit 273aaa24369cb8d0f246bb16f7122b91a1ef5188 Author: Greg Kroah-Hartman Date: Fri Jul 29 15:45:17 2022 +0200 docs: embargoed-hardware-issues: fix invalid AMD contact email The current AMD contact info email address is incorrect, so fix it up to use the correct one. Cc: Jonathan Corbet Cc: Alex Shi Cc: Yanteng Si Cc: Hu Haowen Cc: Tom Lendacky Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220729134517.2284700-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 35610745d71df567297bb40c5e4263cda38dddd5 Merge: 42bbf810e155e 5cc8cc4406ede Author: Kalle Valo Date: Fri Jul 29 16:38:03 2022 +0300 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v5.20. Major changes: ath11k: * fix WCN9074 to work again * revert rfkill support as it was causing problems commit 42bbf810e155efc6129a3a648ae5300f00b79d7b Author: William Dean Date: Sat Jul 23 14:37:56 2022 +0800 wifi: rtw88: check the return value of alloc_workqueue() The function alloc_workqueue() in rtw_core_init() can fail, but there is no check of its return value. To fix this bug, its return value should be checked with new error handling code. Fixes: fe101716c7c9d ("rtw88: replace tx tasklet with work queue") Reported-by: Hacash Robot Signed-off-by: William Dean Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220723063756.2956189-1-williamsukatube@163.com commit 334facd651b98f2e6c6bb699405f8b7421b9b40c Author: Zong-Zhe Yang Date: Thu Jul 21 15:49:52 2022 +0800 wifi: rtw89: 8852a: adjust IMR for SER L1 SER (system error recovery) L1 (level 1) has a step-by-step handshake process with FW. These handshakes still rely on B_AX_HS0ISR_IND_INT_EN. So, even already during recovery, we enable this bit in IMR. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220721074952.19676-1-pkshih@realtek.com commit 87de35cbf65cdb5b059dc30801aa63cdec3c7c2a Author: Ping-Ke Shih Date: Wed Jun 22 17:19:37 2022 +0800 wifi: rtw89: 8852a: update RF radio A/B R56 Update to internal tag HALRF_027_00_060. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220622091937.11325-1-pkshih@realtek.com commit 2e2e91158febfeb73b5d4f249440218304f34101 Merge: e0dccc3b76fb3 6bb2e00ea304f Author: Paolo Bonzini Date: Fri Jul 29 09:34:45 2022 -0400 Merge tag 'kvm-riscv-5.20-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 5.20 * Track ISA extensions used by Guest using bitmap * Added system instruction emulation framework * Added CSR emulation framework * Added gfp_custom flag in struct kvm_mmu_memory_cache * Added G-stage ioremap() and iounmap() functions * Added support for Svpbmt inside Guest commit fb5962f81ebbd8b4f3199115b5ddb7b7c7545458 Author: Thomas Richter Date: Wed Jul 27 16:14:39 2022 +0200 perf test: Fix test case 95 ("Check branch stack sampling") on s390 and use same event On linux-next tree 'perf test 95' ("Check branch stack sampling") was added recently. s390 does not support branch sampling at all and the test case fails despite for checking branch support before hand. The check for support of branching uses the software event named "dummy", as seen in the line: perf record -b -o- -e dummy -B true > /dev/null 2>&1 || exit 2 However when the branch recording is actually done, a different event is used, as seen in the line: perf record -o $TMPDIR/... --branch-filter any,save_type,u -- ... The event is omitted and for "perf record" the default event is cycles, which is not supported by s390 and this fails when executed on s390: # perf record --branch-filter any,save_type,u -- /tmp/__perf_test.program.iDSmQ/a.out Error: cycles: PMU Hardware or event type doesn't support branch stack sampling. # Therefore fix this and use the same event cycles for testing support and actually running the test. Output before: # ./perf test -Fv 95 95: Check branch stack sampling : --- start --- Testing user branch stack sampling ---- end ---- Check branch stack sampling: FAILED! # Output after: # ./perf test -Fv 95 95: Check branch stack sampling : --- start --- ---- end ---- Check branch stack sampling: Skip # Fixes: b55878c90ab92a24 ("perf test: Add test for branch stack sampling") Reviewed-by: James Clark Signed-off-by: Thomas Richter Acked-by: German Gomez Cc: German Gomez Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20220727141439.712582-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 5cc8cc4406edee1bc22991c23d38efbbb797aa6d Author: Bryan O'Donoghue Date: Wed Jul 27 17:16:55 2022 +0100 wifi: wcn36xx: Add debugfs entry to read firmware feature strings Add in the ability to easily find the firmware feature bits reported in the get feature exchange without having to compile-in debug prints. root@linaro-alip:~# cat /sys/kernel/debug/ieee80211/phy0/wcn36xx/firmware_feat_caps MCC P2P DOT11AC SLM_SESSIONIZATION DOT11AC_OPMODE SAP32STA TDLS P2P_GO_NOA_DECOUPLE_INIT_SCAN WLANACTIVE_OFFLOAD BEACON_OFFLOAD SCAN_OFFLOAD BCN_MISS_OFFLOAD STA_POWERSAVE STA_ADVANCED_PWRSAVE BCN_FILTER RTT RATECTRL WOW WLAN_ROAM_SCAN_OFFLOAD SPECULATIVE_PS_POLL IBSS_HEARTBEAT_OFFLOAD WLAN_SCAN_OFFLOAD WLAN_PERIODIC_TX_PTRN ADVANCE_TDLS BATCH_SCAN FW_IN_TX_PATH EXTENDED_NSOFFLOAD_SLOT CH_SWITCH_V1 HT40_OBSS_SCAN UPDATE_CHANNEL_LIST WLAN_MCADDR_FLT WLAN_CH144 TDLS_SCAN_COEXISTENCE LINK_LAYER_STATS_MEAS MU_MIMO EXTENDED_SCAN DYNAMIC_WMM_PS MAC_SPOOFED_SCAN FW_STATS WPS_PRBRSP_TMPL BCN_IE_FLT_DELTA Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220727161655.2286867-5-bryan.odonoghue@linaro.org commit 75072b2970a8f806595017a57ad7daf4b67533f1 Author: Bryan O'Donoghue Date: Wed Jul 27 17:16:54 2022 +0100 wifi: wcn36xx: Move capability bitmap to string translation function to firmware.c Move wcn36xx_get_cap_name() function in main.c into firmware.c as wcn36xx_firmware_get_cap_name(). Reviewed-by: Loic Poulain Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220727161655.2286867-4-bryan.odonoghue@linaro.org commit 37de943d01539a0b36ab52cf73c1dfad140f697a Author: Bryan O'Donoghue Date: Wed Jul 27 17:16:53 2022 +0100 wifi: wcn36xx: Move firmware feature bit storage to dedicated firmware.c file The naming of the get/set/clear firmware feature capability bits doesn't really follow the established namespace pattern of wcn36xx_logicalblock_do_something(); The feature bits are accessed by smd.c and main.c. It would be nice to display the found feature bits in debugfs. To do so though we should tidy up the namespace a bit. Move the firmware feature exchange API to its own file - firmware.c giving us the opportunity to functionally decompose other firmware related accessors as appropriate in future. Reviewed-by: Loic Poulain Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220727161655.2286867-3-bryan.odonoghue@linaro.org commit 5b7fc772e657824455507fc97f6b92287075a237 Author: Bryan O'Donoghue Date: Wed Jul 27 17:16:52 2022 +0100 wifi: wcn36xx: Rename clunky firmware feature bit enum The enum name "place_holder_in_cap_bitmap" is self descriptively asking to be changed to something else. Rename place_holder_in_cap_bitmap to wcn36xx_firmware_feat_caps so that the contents and intent of the enum is obvious. Reviewed-by: Loic Poulain Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220727161655.2286867-2-bryan.odonoghue@linaro.org commit 6bb2e00ea304ffc0446f345c46fe22713ce43cbf Author: Anup Patel Date: Fri Jul 29 17:15:18 2022 +0530 RISC-V: KVM: Add support for Svpbmt inside Guest/VM The Guest/VM can use Svpbmt in VS-stage page tables when allowed by the Hypervisor using the henvcfg.PBMTE bit. We add Svpbmt support for the KVM Guest/VM which can be enabled/disabled by the KVM user-space (QEMU/KVMTOOL) using the ISA extension ONE_REG interface. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 659ad6d82c3121088daeaa38ba94d182b55bbb22 Author: Anup Patel Date: Fri Jul 29 17:15:12 2022 +0530 RISC-V: KVM: Use PAGE_KERNEL_IO in kvm_riscv_gstage_ioremap() When the host has Svpbmt extension, we should use page based memory type 2 (i.e. IO) for IO mappings in the G-stage page table. To achieve this, we replace use of PAGE_KERNEL with PAGE_KERNEL_IO in the kvm_riscv_gstage_ioremap(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit c9d57373fc87a3ad00d12cffd0bb4c8108c73ff9 Author: Anup Patel Date: Fri Jul 29 17:15:06 2022 +0530 RISC-V: KVM: Add G-stage ioremap() and iounmap() functions The in-kernel AIA IMSIC support requires on-demand mapping / unmapping of Guest IMSIC address to Host IMSIC guest files. To help achieve this, we add kvm_riscv_stage2_ioremap() and kvm_riscv_stage2_iounmap() functions. These new functions for updating G-stage page table mappings will be called in atomic context so we have special "in_atomic" parameter for this purpose. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 4ab0e470c06dc741f6583578da44961669331b78 Author: Anup Patel Date: Fri Jul 29 17:15:00 2022 +0530 KVM: Add gfp_custom flag in struct kvm_mmu_memory_cache The kvm_mmu_topup_memory_cache() always uses GFP_KERNEL_ACCOUNT for memory allocation which prevents it's use in atomic context. To address this limitation of kvm_mmu_topup_memory_cache(), we add gfp_custom flag in struct kvm_mmu_memory_cache. When the gfp_custom flag is set to some GFP_xyz flags, the kvm_mmu_topup_memory_cache() will use that instead of GFP_KERNEL_ACCOUNT. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit 8a061562e2f2b32bfb5bff5bf3afc64e37d95a27 Author: Anup Patel Date: Fri Jul 29 17:14:53 2022 +0530 RISC-V: KVM: Add extensible CSR emulation framework We add an extensible CSR emulation framework which is based upon the existing system instruction emulation. This will be useful to upcoming AIA, PMU, Nested and other virtualization features. The CSR emulation framework also has provision to emulate CSR in user space but this will be used only in very specific cases such as AIA IMSIC CSR emulation in user space or vendor specific CSR emulation in user space. By default, all CSRs not handled by KVM RISC-V will be redirected back to Guest VCPU as illegal instruction trap. Signed-off-by: Anup Patel Signed-off-by: Anup Patel commit 1222b55cee2396a1a286e924d9f6abb6d7a04f55 Author: Anup Patel Date: Fri Jul 29 17:14:46 2022 +0530 RISC-V: KVM: Add extensible system instruction emulation framework We will be emulating more system instructions in near future with upcoming AIA, PMU, Nested and other virtualization features. To accommodate above, we add an extensible system instruction emulation framework in vcpu_insn.c. Signed-off-by: Anup Patel Signed-off-by: Anup Patel commit b91f0e4cb8a3ce4f2716a13739ade0f7bea8eadb Author: Anup Patel Date: Fri Jul 29 17:14:40 2022 +0530 RISC-V: KVM: Factor-out instruction emulation into separate sources The instruction and CSR emulation for VCPU is going to grow over time due to upcoming AIA, PMU, Nested and other virtualization features. Let us factor-out VCPU instruction emulation from vcpu_exit.c to a separate source dedicated for this purpose. Signed-off-by: Anup Patel Signed-off-by: Anup Patel commit fe283e5fa1edc59f37265c91dc79bf119a5ccc79 Author: Nikolay Borisov Date: Fri Jul 29 17:14:34 2022 +0530 RISC-V: KVM: move preempt_disable() call in kvm_arch_vcpu_ioctl_run local_irq_disable provides stronger guarantees than preempt_disable so calling the latter is redundant when interrupts are disabled. Instead, explicitly disable preemption right before interrupts are enabled/disabled to ensure that the time accounted in guest_timing_exit_irqoff includes time taken by the guest or interrupts. Signed-off-by: Nikolay Borisov Signed-off-by: Anup Patel commit cca986fab9e819319353bece789cb9d2890c1115 Author: Nikolay Borisov Date: Fri Jul 29 17:14:26 2022 +0530 RISC-V: KVM: Make kvm_riscv_guest_timer_init a void function It can never fail so convey that fact explicitly by making the function void. Also in kvm_arch_init_vm it makes it clear that there no need to do any cleanup after kvm_riscv_gstage_vmid_init has been called. Signed-off-by: Nikolay Borisov Signed-off-by: Anup Patel commit 6259d2f834f2834e32254e0c02a4c4996d34495a Author: Zhang Jiaming Date: Fri Jul 29 17:14:17 2022 +0530 RISC-V: KVM: Fix variable spelling mistake There is a spelling mistake in mmu.c and vcpu_exit.c. Fix it. Signed-off-by: Zhang Jiaming Signed-off-by: Anup Patel commit 9bfd900beeecaba009ccde8cf13716d3cac4d2e1 Author: Atish Patra Date: Fri Jul 29 17:14:11 2022 +0530 RISC-V: KVM: Improve ISA extension by using a bitmap Currently, the every vcpu only stores the ISA extensions in a unsigned long which is not scalable as number of extensions will continue to grow. Using a bitmap allows the ISA extension to support any number of extensions. The CONFIG one reg interface implementation is modified to support the bitmap as well. But it is meant only for base extensions. Thus, the first element of the bitmap array is sufficient for that interface. In the future, all the new multi-letter extensions must use the ISA_EXT one reg interface that allows enabling/disabling any extension now. Signed-off-by: Atish Patra Signed-off-by: Anup Patel commit 8933d30c5f468d6cc1e4bf9bb535149da35f202e Author: Uwe Kleine-König Date: Tue Jul 12 18:15:19 2022 +0200 pwm: lpc18xx: Fix period handling The calculation: val = (u64)NSEC_PER_SEC * LPC18XX_PWM_TIMER_MAX; do_div(val, lpc18xx_pwm->clk_rate); lpc18xx_pwm->max_period_ns = val; is bogus because with NSEC_PER_SEC = 1000000000, LPC18XX_PWM_TIMER_MAX = 0xffffffff and clk_rate < NSEC_PER_SEC this overflows the (on lpc18xx (i.e. ARM32) 32 bit wide) unsigned int .max_period_ns. This results (dependant of the actual clk rate) in an arbitrary limitation of the maximal period. E.g. for clkrate = 333333333 (Hz) we get max_period_ns = 9 instead of 12884901897. So make .max_period_ns an u64 and pass period and duty as u64 to not discard relevant digits. And also make use of mul_u64_u64_div_u64() which prevents all overflows assuming clk_rate < NSEC_PER_SEC. Fixes: 841e6f90bb78 ("pwm: NXP LPC18xx PWM/SCT driver") Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 2ba1aede6d4184a6fd95bef3eda9acb1f40e2221 Author: Uwe Kleine-König Date: Tue Jul 12 18:15:18 2022 +0200 pwm: lpc18xx: Convert to use dev_err_probe() This has various upsides: - It emits the symbolic name of the error code - It is silent in the EPROBE_DEFER case and properly sets the defer reason - It reduces the number of code lines slightly Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit ea95b29983b999eac4522d50da78e6ba70c3d065 Author: Uwe Kleine-König Date: Tue Jul 12 10:46:56 2022 +0200 pwm: twl-led: Document some limitations and link to the reference manual I found these just from reading the reference manual and the driver source. It's unclear to me if there are glitches when updating the ON and OFF registers. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 3391780b74b94f39d6619c5c3570468f7170643d Author: Lee Jones Date: Thu Jul 14 12:25:28 2022 +0100 MAINTAINERS: Remove myself as PWM maintainer Thierry and Uwe are doing a fine job, leaving me surplus to requirement. Happy to pop back on-board if anything changes in the future. Cc: Thierry Reding Cc: Uwe Kleine-König Cc: linux-pwm@vger.kernel.org Signed-off-by: Lee Jones Signed-off-by: Lee Jones Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 0afe57ca3a776ced18d88d1236163ad02a4d0f6b Author: Lukas Bulwahn Date: Mon Jun 13 14:33:19 2022 +0200 MAINTAINERS: Add include/dt-bindings/pwm to PWM SUBSYSTEM Maintainers of the directory Documentation/devicetree/bindings/pwm are also the maintainers of the corresponding directory include/dt-bindings/pwm. Add the file entry for include/dt-bindings/pwm to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 3bf5f2f0c02ef7f8047a26ca599035d4a5eab34a Author: Fabien Parent Date: Tue May 31 13:45:43 2022 +0200 dt-bindings: pwm: mediatek: Add compatible string for MT8195 MT8195's PWM IP is compatible with the MT8183 PWM IP. Signed-off-by: Fabien Parent Acked-by: Rob Herring Reviewed-by: AngeloGioacchino Del Regno Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 901f8f5404f14fe0cf62bc3cd52ccff32738b404 Author: Nikita Travkin Date: Tue Jul 12 01:33:40 2022 +0500 pwm: Add clock based PWM output driver Some systems have clocks exposed to external devices. If the clock controller supports duty-cycle configuration, such clocks can be used as pwm outputs. In fact PWM and CLK subsystems are interfaced with in a similar way and an "opposite" driver already exists (clk-pwm). Add a driver that would enable pwm devices to be used via clk subsystem. Acked-by: Uwe Kleine-König Signed-off-by: Nikita Travkin Signed-off-by: Thierry Reding commit c2252c181ab5d6d764e505143a55775187670543 Author: Nikita Travkin Date: Tue Jul 12 01:33:39 2022 +0500 dt-bindings: pwm: Document clk based PWM controller Add YAML devicetree binding for clk based PWM controller Reviewed-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Signed-off-by: Nikita Travkin Signed-off-by: Thierry Reding commit 2375e964d541bb09158cd2dff67b5d74e8de61cd Author: Uwe Kleine-König Date: Thu Jul 21 12:31:29 2022 +0200 pwm: sifive: Shut down hardware only after pwmchip_remove() completed The PWMs are expected to be functional until pwmchip_remove() is called. So disable the clks only afterwards. Fixes: 9e37a53eb051 ("pwm: sifive: Add a driver for SiFive SoC PWM") Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit ace41d7564e655c39f709a78c035188a460c7cbd Author: Uwe Kleine-König Date: Thu Jul 21 12:31:28 2022 +0200 pwm: sifive: Ensure the clk is enabled exactly once per running PWM .apply() assumes the clk to be for a given PWM iff the PWM is enabled. So make sure this is the case when .probe() completes. And in .remove() disable the according number of times. This fixes a clk enable/disable imbalance, if some PWMs are already running at probe time. Fixes: 9e37a53eb051 (pwm: sifive: Add a driver for SiFive SoC PWM) Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 1695b421e1b587caf7931eae927a9c5fb34a75f1 Author: Uwe Kleine-König Date: Thu Jul 21 12:31:27 2022 +0200 pwm: sifive: Simplify clk handling The clk is necessary for both register access and (enabled) operation of the PWM. Instead of clk_enable() update_hw() if pwm_got_enabled(): clk_enable() elif pwm_got_disabled(): clk_disable() clk_disable() which is some cases only calls clk_enable() to immediately afterwards call clk_disable again, do: if (!prev_state.enabled) clk_enable() # clk enabled exactly once update_hw() if (!next_state.enabled) clk_disable() which is much easier. Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 3586b02663f098a9b0a3df13bcb3ea2d67635562 Author: Uwe Kleine-König Date: Thu Jul 21 12:31:26 2022 +0200 pwm: sifive: Enable clk only after period check in .apply() For the period check and the initial calculations of register values there is no hardware access needed. So delay enabling the clk a bit to simplify the code flow a bit. Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 0f02f491b786143f08eb19840f1cf4f12aec6dee Author: Uwe Kleine-König Date: Thu Jul 21 12:31:25 2022 +0200 pwm: sifive: Reduce time the controller lock is held The lock is only to serialize access and update to user_count and approx_period between different PWMs served by the same pwm_chip. So the lock needs only to be taken during the check if the (chip global) period can and/or needs to be changed. Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 61180f68ad5b9058008e227d5f289934a963af1f Author: Uwe Kleine-König Date: Thu Jul 21 12:31:24 2022 +0200 pwm: sifive: Fold pwm_sifive_enable() into its only caller There is only a single caller of pwm_sifive_enable() which only enables or disables the clk. Put this implementation directly into pwm_sifive_apply() which allows further simplification in the next change. There is no change in behaviour. Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 20550a61880fc55e68a0d290ad195b74729c0e7b Author: Uwe Kleine-König Date: Thu Jul 21 12:31:23 2022 +0200 pwm: sifive: Simplify offset calculation for PWMCMP registers Instead of explicitly using PWM_SIFIVE_PWMCMP0 + pwm->hwpwm * PWM_SIFIVE_SIZE_PWMCMP for each access to one of the PWMCMP registers, introduce a macro that takes the hwpwm id as parameter. For the register definition using a plain 4 instead of the cpp constant PWM_SIFIVE_SIZE_PWMCMP is easier to read, so define the offset macro without the constant. The latter can then be dropped as there are no users left. Signed-off-by: Uwe Kleine-König Tested-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit b65a1534cfd60929b671aecf8a20a3c8daf4c804 Merge: 944fd1aeacb62 40823f3ee05f7 Author: David S. Miller Date: Fri Jul 29 12:21:02 2022 +0100 Merge branch 'netdevsim-fib-route-delete-leak' Ido Schimmel says: ==================== netdevsim: fib: Fix reference count leak on route deletion failure Fix a recently reported netdevsim bug found using syzkaller. Patch #1 fixes the bug. Patch #2 adds a debugfs knob to allow us to test the fix. Patch #3 adds test cases. ==================== Signed-off-by: David S. Miller commit 40823f3ee05f7f55cbd4419062a1a388249e88da Author: Ido Schimmel Date: Thu Jul 28 14:45:35 2022 +0300 selftests: netdevsim: Add test cases for route deletion failure Add IPv4 and IPv6 test cases that ensure that we are not leaking a reference on the nexthop device when we are unable to delete its associated route. Without the fix in a previous patch ("netdevsim: fib: Fix reference count leak on route deletion failure") both test cases get stuck, waiting for the reference to be released from the dummy device [1][2]. [1] unregister_netdevice: waiting for dummy1 to become free. Usage count = 5 leaked reference. fib_check_nh+0x275/0x620 fib_create_info+0x237c/0x4d30 fib_table_insert+0x1dd/0x1d20 inet_rtm_newroute+0x11b/0x200 rtnetlink_rcv_msg+0x43b/0xd20 netlink_rcv_skb+0x15e/0x430 netlink_unicast+0x53b/0x800 netlink_sendmsg+0x945/0xe40 ____sys_sendmsg+0x747/0x960 ___sys_sendmsg+0x11d/0x190 __sys_sendmsg+0x118/0x1e0 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [2] unregister_netdevice: waiting for dummy1 to become free. Usage count = 5 leaked reference. fib6_nh_init+0xc46/0x1ca0 ip6_route_info_create+0x1167/0x19a0 ip6_route_add+0x27/0x150 inet6_rtm_newroute+0x161/0x170 rtnetlink_rcv_msg+0x43b/0xd20 netlink_rcv_skb+0x15e/0x430 netlink_unicast+0x53b/0x800 netlink_sendmsg+0x945/0xe40 ____sys_sendmsg+0x747/0x960 ___sys_sendmsg+0x11d/0x190 __sys_sendmsg+0x118/0x1e0 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 974be75f250378a6913c7bb268adbfd9a76a6df9 Author: Ido Schimmel Date: Thu Jul 28 14:45:34 2022 +0300 netdevsim: fib: Add debugfs knob to simulate route deletion failure The previous patch ("netdevsim: fib: Fix reference count leak on route deletion failure") fixed a reference count leak that happens on route deletion failure. Such failures can only be simulated by injecting slab allocation failures, which cannot be surgically injected. In order to be able to specifically test this scenario, add a debugfs knob that allows user space to fail route deletion requests when enabled. Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 180a6a3ee60a7cb69ed1232388460644f6a21f00 Author: Ido Schimmel Date: Thu Jul 28 14:45:33 2022 +0300 netdevsim: fib: Fix reference count leak on route deletion failure As part of FIB offload simulation, netdevsim stores IPv4 and IPv6 routes and holds a reference on FIB info structures that in turn hold a reference on the associated nexthop device(s). In the unlikely case where we are unable to allocate memory to process a route deletion request, netdevsim will not release the reference from the associated FIB info structure, thereby preventing the associated nexthop device(s) from ever being removed [1]. Fix this by scheduling a work item that will flush netdevsim's FIB table upon route deletion failure. This will cause netdevsim to release its reference from all the FIB info structures in its table. Reported by Lucas Leong of Trend Micro Zero Day Initiative. Fixes: 0ae3eb7b4611 ("netdevsim: fib: Perform the route programming in a non-atomic context") Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 6957730e20389a63eb333afb6fcf38b45f549ea8 Merge: ed6dc4b871c0a 853246dbf5e80 Author: David S. Miller Date: Fri Jul 29 12:18:10 2022 +0100 Merge branch 'mtk_eth_soc-xdp-multi-frame' Lorenzo Bianconi says: ==================== mtk_eth_soc: introduce xdp multi-frag support Convert mtk_eth_soc driver to xdp_return_frame_bulk APIs. =================== Signed-off-by: David S. Miller commit 853246dbf5e806e2775b584a0726be281ab7b0a0 Author: Lorenzo Bianconi Date: Wed Jul 27 23:20:52 2022 +0200 net: ethernet: mtk_eth_soc: add xdp tx return bulking support Convert mtk_eth_soc driver to xdp_return_frame_bulk APIs. Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 155738a4f319538a09f734ce1f5a2eac3ada1de2 Author: Lorenzo Bianconi Date: Wed Jul 27 23:20:51 2022 +0200 net: ethernet: mtk_eth_soc: introduce xdp multi-frag support Add the capability to map non-linear xdp frames in XDP_TX and ndo_xdp_xmit callback. Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit b16fe6d82b71fa0dd5c957bc22d66a694976d6eb Author: Lorenzo Bianconi Date: Wed Jul 27 23:20:50 2022 +0200 net: ethernet: mtk_eth_soc: introduce mtk_xdp_frame_map utility routine This is a preliminary patch to add xdp multi-frag support to mtk_eth_soc driver Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit ed6dc4b871c0a1cf298298bbe96f51104abfb55c Merge: 5b91884bf50b2 95baa4e8fe69a Author: David S. Miller Date: Fri Jul 29 12:14:03 2022 +0100 Merge branch 'seg6-headend-reduced' Andrea Mayer says: ==================== seg6: add support for SRv6 Headend Reduced This patchset adds support for SRv6 Headend behavior with Reduced Encapsulation. It introduces the H.Encaps.Red and H.L2Encaps.Red versions of the SRv6 H.Encaps and H.L2Encaps behaviors, according to RFC 8986 [1]. In details, the patchset is made of: - patch 1/4: add support for SRv6 H.Encaps.Red behavior; - Patch 2/4: add support for SRv6 H.L2Encaps.Red behavior; - patch 2/4: add selftest for SRv6 H.Encaps.Red behavior; - patch 3/4: add selftest for SRv6 H.L2Encaps.Red behavior. The corresponding iproute2 patch for supporting SRv6 H.Encaps.Red and H.L2Encaps.Red behaviors is provided in a separated patchset. [1] - https://datatracker.ietf.org/doc/html/rfc8986 V4 -> v5: - Fix skb checksum for SRH Reduced encapsulation/insertion; - Improve selftests by: i) adding a random suffix to network namespaces; ii) creating net devices directly into network namespaces; iii) using trap EXIT command to properly clean up selftest networks. Thanks to Paolo Abeni. v3 -> v4: - Add selftests to the Makefile, thanks to Jakub Kicinski. v2 -> v3: - Keep SRH when HMAC TLV is present; - Split the support for H.Encaps.Red and H.L2Encaps.Red behaviors in two patches (respectively, patch 1/4 and patch 2/4); - Add selftests for SRv6 H.Encaps.Red and H.L2Encaps.Red. v1 -> v2: - Fixed sparse warnings; - memset now uses sizeof() instead of hardcoded value; - Removed EXPORT_SYMBOL_GPL. ==================== Signed-off-by: David S. Miller commit 95baa4e8fe69ae511cbbcfd0ffef010108e2ca43 Author: Andrea Mayer Date: Wed Jul 27 20:54:08 2022 +0200 selftests: seg6: add selftest for SRv6 H.L2Encaps.Red behavior This selftest is designed for testing the H.L2Encaps.Red behavior. It instantiates a virtual network composed of several nodes: hosts and SRv6 routers. Each node is realized using a network namespace that is properly interconnected to others through veth pairs. The test considers SRv6 routers implementing a L2 VPN leveraged by hosts for communicating with each other. Such routers make use of the SRv6 H.L2Encaps.Red behavior for applying SRv6 policies to L2 traffic coming from hosts. The correct execution of the behavior is verified through reachability tests carried out between hosts belonging to the same VPN. Signed-off-by: Andrea Mayer Signed-off-by: David S. Miller commit 6ab4eb5a52a734dc60e0366c66e06446a0032903 Author: Andrea Mayer Date: Wed Jul 27 20:54:07 2022 +0200 selftests: seg6: add selftest for SRv6 H.Encaps.Red behavior This selftest is designed for testing the H.Encaps.Red behavior. It instantiates a virtual network composed of several nodes: hosts and SRv6 routers. Each node is realized using a network namespace that is properly interconnected to others through veth pairs. The test considers SRv6 routers implementing L3 VPNs leveraged by hosts for communicating with each other. Such routers make use of the SRv6 H.Encaps.Red behavior for applying SRv6 policies to L3 traffic coming from hosts. The correct execution of the behavior is verified through reachability tests carried out between hosts belonging to the same VPN. Signed-off-by: Andrea Mayer Signed-off-by: David S. Miller commit 13f0296be8ece1189cbc4383a45ba97cafaecc09 Author: Andrea Mayer Date: Wed Jul 27 20:54:06 2022 +0200 seg6: add support for SRv6 H.L2Encaps.Red behavior The SRv6 H.L2Encaps.Red behavior described in [1] is an optimization of the SRv6 H.L2Encaps behavior [2]. H.L2Encaps.Red reduces the length of the SRH by excluding the first segment (SID) in the SRH of the pushed IPv6 header. The first SID is only placed in the IPv6 Destination Address field of the pushed IPv6 header. When the SRv6 Policy only contains one SID the SRH is omitted, unless there is an HMAC TLV to be carried. [1] - https://datatracker.ietf.org/doc/html/rfc8986#section-5.4 [2] - https://datatracker.ietf.org/doc/html/rfc8986#section-5.3 Signed-off-by: Andrea Mayer Signed-off-by: Anton Makarov Signed-off-by: David S. Miller commit b07c8cdbe918aa17da864da9a89b22afaed0393e Author: Andrea Mayer Date: Wed Jul 27 20:54:05 2022 +0200 seg6: add support for SRv6 H.Encaps.Red behavior The SRv6 H.Encaps.Red behavior described in [1] is an optimization of the SRv6 H.Encaps behavior [2]. H.Encaps.Red reduces the length of the SRH by excluding the first segment (SID) in the SRH of the pushed IPv6 header. The first SID is only placed in the IPv6 Destination Address field of the pushed IPv6 header. When the SRv6 Policy only contains one SID the SRH is omitted, unless there is an HMAC TLV to be carried. [1] - https://datatracker.ietf.org/doc/html/rfc8986#section-5.2 [2] - https://datatracker.ietf.org/doc/html/rfc8986#section-5.1 Signed-off-by: Andrea Mayer Signed-off-by: Anton Makarov Signed-off-by: David S. Miller commit 5b91884bf50b21d34bd3daa5c8f8b7e92e0a2c46 Author: Ronak Doshi Date: Wed Jul 27 10:30:37 2022 -0700 vmxnet3: do not reschedule napi for rx processing Commit '2c5a5748105a ("vmxnet3: add support for out of order rx completion")' added support for out of order rx completion. Within that patch, an enhancement was done to reschedule napi for processing rx completions. However, it can lead to missing an interrupt. So, this patch reverts that part of the code. Fixes: 2c5a5748105a ("vmxnet3: add support for out of order rx completion") Signed-off-by: Ronak Doshi Acked-by: Guolin Yang Signed-off-by: David S. Miller commit 1c7249e4af8e1aea1c47739ec9dc63cc828b5d08 Author: Guillaume Nault Date: Wed Jul 27 13:18:21 2022 +0200 Documentation: Describe net.ipv4.tcp_reflect_tos. The tcp_reflect_tos option was introduced in Linux 5.10 but was still undocumented. Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller commit dc633700f00f726e027846a318c5ffeb8deaaeda Author: Zhengchao Shao Date: Wed Jul 27 17:33:12 2022 +0800 net/af_packet: check len when min_header_len equals to 0 User can use AF_PACKET socket to send packets with the length of 0. When min_header_len equals to 0, packet_snd will call __dev_queue_xmit to send packets, and sock->type can be any type. Reported-by: syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len") Signed-off-by: Zhengchao Shao Signed-off-by: David S. Miller commit 944fd1aeacb627fa617f85f8e5a34f7ae8ea4d8e Author: Mike Manning Date: Mon Jul 25 19:14:42 2022 +0100 net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set The commit 3c82a21f4320 ("net: allow binding socket in a VRF when there's an unbound socket") changed the inet socket lookup to avoid packets in a VRF from matching an unbound socket. This is to ensure the necessary isolation between the default and other VRFs for routing and forwarding. VRF-unaware processes running in the default VRF cannot access another VRF and have to be run with 'ip vrf exec '. This is to be expected with tcp_l3mdev_accept disabled, but could be reallowed when this sysctl option is enabled. So instead of directly checking dif and sdif in inet[6]_match, here call inet_sk_bound_dev_eq(). This allows a match on unbound socket for non-zero sdif i.e. for packets in a VRF, if tcp_l3mdev_accept is enabled. Fixes: 3c82a21f4320 ("net: allow binding socket in a VRF when there's an unbound socket") Signed-off-by: Mike Manning Link: https://lore.kernel.org/netdev/a54c149aed38fded2d3b5fdb1a6c89e36a083b74.camel@lasnet.de/ Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 Author: Takashi Iwai Date: Thu Jul 28 14:59:45 2022 +0200 ALSA: control: Use deferred fasync helper For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from the control API. Note that it's merely a workaround. Another note: although we haven't received reports about the deadlock with the control API, the deadlock is still potentially possible, and it's better to align the behavior with other core APIs (PCM and timer); so let's move altogether. Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit 96b097091c66df4f6fbf5cbff21df6cc02a2f055 Author: Takashi Iwai Date: Thu Jul 28 14:59:44 2022 +0200 ALSA: pcm: Use deferred fasync helper For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from timer API. Note that it's merely a workaround. Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c Author: Takashi Iwai Date: Thu Jul 28 14:59:43 2022 +0200 ALSA: timer: Use deferred fasync helper For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from PCI API. Note that it's merely a workaround. Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 Author: Takashi Iwai Date: Thu Jul 28 14:59:42 2022 +0200 ALSA: core: Add async signal helpers Currently the call of kill_fasync() from an interrupt handler might lead to potential spin deadlocks, as spotted by syzkaller. Unfortunately, it's not so trivial to fix this lock chain as it's involved with the tasklist_lock that is touched in allover places. As a temporary workaround, this patch provides the way to defer the async signal notification in a work. The new helper functions, snd_fasync_helper() and snd_kill_faync() are replacements for fasync_helper() and kill_fasync(), respectively. In addition, snd_fasync_free() needs to be called at the destructor of the relevant file object. Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5b7d1d575e3f1917cd493761781314be7bc73ef4 Author: Slark Xiao Date: Thu Jul 21 15:15:20 2022 +0800 microblaze: Fix some typos in comment Replace 'the the' with 'like the' in the comment. Replace 'an' with 'a'. Signed-off-by: Slark Xiao Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/20220721071520.48384-1-slark_xiao@163.com commit af5d35b83f642399c719ea9a8599a13b8a0c4167 Author: Jason Wang Date: Sat Jul 23 17:26:40 2022 +0800 crypto: tcrypt - Remove the static variable initialisations to NULL Initialise global and static variable to NULL is always unnecessary. Remove the unnecessary initialisations. Signed-off-by: Jason Wang Signed-off-by: Herbert Xu commit 7ae19d422c7da84b5f13bc08b98bd737a08d3a53 Author: GUO Zihua Date: Fri Jul 22 14:31:57 2022 +0800 crypto: arm64/poly1305 - fix a read out-of-bound A kasan error was reported during fuzzing: BUG: KASAN: slab-out-of-bounds in neon_poly1305_blocks.constprop.0+0x1b4/0x250 [poly1305_neon] Read of size 4 at addr ffff0010e293f010 by task syz-executor.5/1646715 CPU: 4 PID: 1646715 Comm: syz-executor.5 Kdump: loaded Not tainted 5.10.0.aarch64 #1 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.59 01/31/2019 Call trace: dump_backtrace+0x0/0x394 show_stack+0x34/0x4c arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x158/0x1e4 lib/dump_stack.c:118 print_address_description.constprop.0+0x68/0x204 mm/kasan/report.c:387 __kasan_report+0xe0/0x140 mm/kasan/report.c:547 kasan_report+0x44/0xe0 mm/kasan/report.c:564 check_memory_region_inline mm/kasan/generic.c:187 [inline] __asan_load4+0x94/0xd0 mm/kasan/generic.c:252 neon_poly1305_blocks.constprop.0+0x1b4/0x250 [poly1305_neon] neon_poly1305_do_update+0x6c/0x15c [poly1305_neon] neon_poly1305_update+0x9c/0x1c4 [poly1305_neon] crypto_shash_update crypto/shash.c:131 [inline] shash_finup_unaligned+0x84/0x15c crypto/shash.c:179 crypto_shash_finup+0x8c/0x140 crypto/shash.c:193 shash_digest_unaligned+0xb8/0xe4 crypto/shash.c:201 crypto_shash_digest+0xa4/0xfc crypto/shash.c:217 crypto_shash_tfm_digest+0xb4/0x150 crypto/shash.c:229 essiv_skcipher_setkey+0x164/0x200 [essiv] crypto_skcipher_setkey+0xb0/0x160 crypto/skcipher.c:612 skcipher_setkey+0x3c/0x50 crypto/algif_skcipher.c:305 alg_setkey+0x114/0x2a0 crypto/af_alg.c:220 alg_setsockopt+0x19c/0x210 crypto/af_alg.c:253 __sys_setsockopt+0x190/0x2e0 net/socket.c:2123 __do_sys_setsockopt net/socket.c:2134 [inline] __se_sys_setsockopt net/socket.c:2131 [inline] __arm64_sys_setsockopt+0x78/0x94 net/socket.c:2131 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall+0x64/0x100 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x220/0x230 arch/arm64/kernel/syscall.c:155 do_el0_svc+0xb4/0xd4 arch/arm64/kernel/syscall.c:217 el0_svc+0x24/0x3c arch/arm64/kernel/entry-common.c:353 el0_sync_handler+0x160/0x164 arch/arm64/kernel/entry-common.c:369 el0_sync+0x160/0x180 arch/arm64/kernel/entry.S:683 This error can be reproduced by the following code compiled as ko on a system with kasan enabled: #include #include #include #include char test_data[] = "\x00\x01\x02\x03\x04\x05\x06\x07" "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17" "\x18\x19\x1a\x1b\x1c\x1d\x1e"; int init(void) { struct crypto_shash *tfm = NULL; char *data = NULL, *out = NULL; tfm = crypto_alloc_shash("poly1305", 0, 0); data = kmalloc(POLY1305_KEY_SIZE - 1, GFP_KERNEL); out = kmalloc(POLY1305_DIGEST_SIZE, GFP_KERNEL); memcpy(data, test_data, POLY1305_KEY_SIZE - 1); crypto_shash_tfm_digest(tfm, data, POLY1305_KEY_SIZE - 1, out); kfree(data); kfree(out); return 0; } void deinit(void) { } module_init(init) module_exit(deinit) MODULE_LICENSE("GPL"); The root cause of the bug sits in neon_poly1305_blocks. The logic neon_poly1305_blocks() performed is that if it was called with both s[] and r[] uninitialized, it will first try to initialize them with the data from the first "block" that it believed to be 32 bytes in length. First 16 bytes are used as the key and the next 16 bytes for s[]. This would lead to the aforementioned read out-of-bound. However, after calling poly1305_init_arch(), only 16 bytes were deducted from the input and s[] is initialized yet again with the following 16 bytes. The second initialization of s[] is certainly redundent which indicates that the first initialization should be for r[] only. This patch fixes the issue by calling poly1305_init_arm64() instead of poly1305_init_arch(). This is also the implementation for the same algorithm on arm platform. Fixes: f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS NEON implementation") Cc: stable@vger.kernel.org Signed-off-by: GUO Zihua Reviewed-by: Eric Biggers Acked-by: Will Deacon Signed-off-by: Herbert Xu commit 11364d61314eb97b12d6b6facb1ededada52fcc1 Author: Christophe JAILLET Date: Thu Jul 21 22:58:53 2022 +0200 crypto: hisilicon/zip - Use the bitmap API to allocate bitmaps Use bitmap_zalloc()/bitmap_free() instead of hand-writing them. It is less verbose and it improves the semantic. While at it, add an explicit include . Signed-off-by: Christophe JAILLET Signed-off-by: Herbert Xu commit 45f5d0176d8426cc1ab0bab84fbd8ef5c57526c6 Author: Kai Ye Date: Thu Jul 21 10:18:31 2022 +0800 crypto: hisilicon/sec - fix auth key size error The authentication algorithm supports a maximum of 128-byte keys. The allocated key memory is insufficient. Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2") Signed-off-by: Kai Ye Signed-off-by: Herbert Xu commit 383ce25dd2b117da0c092dc0b45e7ad0e9ffcbb2 Author: Christophe JAILLET Date: Wed Jul 20 15:28:44 2022 +0200 crypto: ccree - Remove a useless dma_supported() call There is no point in calling dma_supported() before calling dma_set_coherent_mask(). This function already calls dma_supported() and returns an error (-EIO) if it fails. So remove the superfluous dma_supported() call. Moreover, setting a larger DMA mask will never fail when setting a smaller one will succeed, so the whole "while" loop can be removed as well. (see [1]) While at it, fix the name of the function reported in a dev_err(). [1]: https://lore.kernel.org/all/YteQ6Vx2C03UtCkG@infradead.org/ Suggested-by: Christoph Hellwig Signed-off-by: Christophe JAILLET Acked-by: Gilad Ben-Yossef Signed-off-by: Herbert Xu commit 96ec8dfdd094b7b2b015e092d581835a732949ff Author: Mario Limonciello Date: Tue Jul 19 11:13:28 2022 -0500 crypto: ccp - Add support for new CCP/PSP device ID Add a new CCP/PSP PCI device ID. This uses same register offsets as the previously supported structure. Signed-off-by: Mario Limonciello Acked-by: Tom Lendacky Acked-by: Rijo Thomas Signed-off-by: Herbert Xu commit fa4d57b85786ec0e16565c75a51c208834b0c24d Author: Pali Rohár Date: Tue Jul 19 09:54:03 2022 +0200 crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of Without MODULE_DEVICE_TABLE, crypto_safexcel.ko module is not automatically loaded on platforms where inside-secure crypto HW is specified in device tree (e.g. Armada 3720). So add missing MODULE_DEVICE_TABLE for of. Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") Signed-off-by: Pali Rohár Acked-by: Marek Behún Signed-off-by: Herbert Xu commit 98dfa9343f37bdd4112966292751e3a93aaf2e56 Author: Zhengchao Shao Date: Tue Jul 19 12:23:23 2022 +0800 crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq The hpre encryption driver may be used to encrypt and decrypt packets during the rx softirq, it is not allowed to use GFP_KERNEL. Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator") Signed-off-by: Zhengchao Shao Signed-off-by: Herbert Xu commit c10100a416c16b598bf5155e759307b34dac0d7d Merge: e0dccc3b76fb3 7fee5d6f41b4a 3168010d2ab44 f066b8f7d961b d4ebd11f32a12 7e62edd7a33ac 25357900f4e67 be280ea763f7d de0269765b268 Author: Joerg Roedel Date: Fri Jul 29 12:06:56 2022 +0200 Merge branches 'arm/exynos', 'arm/mediatek', 'arm/msm', 'arm/smmu', 'virtio', 'x86/vt-d', 'x86/amd' and 'core' into next commit be280ea763f7db492e0e30ba22873433aea0f468 Author: Joerg Roedel Date: Fri Jul 29 12:04:32 2022 +0200 iommu/amd: Fix compile warning in init code A recent commit introduced these compile warnings: CC drivers/iommu/amd/init.o drivers/iommu/amd/init.c:938:12: error: ‘iommu_init_ga_log’ defined but not used [-Werror=unused-function] 938 | static int iommu_init_ga_log(struct amd_iommu *iommu) | ^~~~~~~~~~~~~~~~~ drivers/iommu/amd/init.c:902:12: error: ‘iommu_ga_log_enable’ defined but not used [-Werror=unused-function] 902 | static int iommu_ga_log_enable(struct amd_iommu *iommu) | ^~~~~~~~~~~~~~~~~~~ The warnings appear because both functions are defined when IRQ remapping is not enabled, but only used when IRQ remapping is enabled. Fix it by only defining the functions when IRQ remapping is enabled. Fixes: c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") Signed-off-by: Joerg Roedel Link: https://lore.kernel.org/r/20220729100432.22474-1-joro@8bytes.org commit 3b1c31474cb934be352a8d75389bfe04773799c6 Merge: ba323f6bee1d1 eba28aaf2f539 Author: David S. Miller Date: Fri Jul 29 11:02:24 2022 +0100 Merge branch 'mlxsw-ptp-spectrum-2' Ido Schimmel says: ==================== mlxsw: Add PTP support for Spectrum-2 and newer ASICs This patchset adds PTP support for Spectrum-{2,3,4} switch ASICs. They all act largely the same with respect to PTP except for a workaround implemented for Spectrum-{2,3} in patch #6. Spectrum-2 and newer ASICs essentially implement a transparent clock between all the switch ports, including the CPU port. The hardware will generate the UTC time stamp for transmitted / received packets at the CPU port, but will compensate for forwarding delays in the ASIC by adjusting the correction field in the PTP header (for PTP events) at the ingress and egress ports. Specifically, the hardware will subtract the current time stamp from the correction field at the ingress port and will add the current time stamp to the correction field at the egress port. For the purpose of an ordinary or boundary clock (this patchset), the correction field will always be adjusted between the CPU port and one of the front panel ports, but never between two front panel ports. Patchset overview: Patch #1 extracts a helper to configure traps for PTP packets (event and general messages). The helper is shared between all Spectrum generations. Patch #2 transitions Spectrum-2 and newer ASICs to use a different format of Tx completions that includes the UTC time stamp of transmitted packets. Patch #3 adds basic initialization required for Spectrum-2 PTP support. It mainly invokes the helper from patch #1. Patch #4 adds helpers to read the UTC time (seconds and nanoseconds) from the device over memory-mapped I/O instead of going through firmware which is slower and therefore inaccurate. The helpers will be used to implement various PHC operations (e.g., gettimex64) and to construct the full UTC time stamp from the truncated one reported over Tx / Rx completions. Patch #5 implements the various PHC operations. Patch #6 implements the previously described workaround for Spectrum-{2,3}. Patch #7 adds the ability to report a hardware time stamp for a received / transmitted packet based off the associated Rx / Tx completion that includes a truncated UTC time stamp. Patches #8 and #9 implement support for the SIOCGHWTSTAMP / SIOCSHWTSTAMP ioctls and the get_ts_info ethtool callback, respectively. ==================== Signed-off-by: David S. Miller commit eba28aaf2f539c3a8844878d64ad4a43d60d4e48 Author: Danielle Ratson Date: Wed Jul 27 09:23:28 2022 +0300 mlxsw: spectrum: Support ethtool 'get_ts_info' callback in Spectrum-2 The 'get_ts_info' callback is used for obtaining information about time stamping and PTP hardware clock capabilities of a network device. The existing function of Spectrum-1 is used to advertise the PHC capabilities and the supported RX and TX filters. Implement a similar function for Spectrum-2, expose that the supported 'rx_filters' are all PTP event packets, as for these packets the driver fills the time stamp from the CQE in the SKB. In the future, mlxsw driver will be extended to support one-step PTP in Spectrum-2 and newer ASICs. Then additional 'tx_types' will be supported. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 08ef8bc825d961d6adde6fc2665f293e43ab3777 Author: Danielle Ratson Date: Wed Jul 27 09:23:27 2022 +0300 mlxsw: spectrum_ptp: Support SIOCGHWTSTAMP, SIOCSHWTSTAMP ioctls The SIOCSHWTSTAMP ioctl configures HW timestamping on a given port. In Spectrum-2 and above, each packet gets time stamp by default, but in order to provide an accurate time stamp, software should configure to update the correction field. In addition, the PTP traps are not enabled by default, software should enable it per port or for all ports. The switch behaves like a transparent clock between CPU port and each front panel port. If ingress correction is set on a port for a given packet type, then when such a packet is received via the port, the current time stamp is subtracted from the correction field. If egress correction is set on a port for a given packet type, then when such a packet is transmitted via the port, the current time stamp is added to the correction field. The result is that as the packet ingresses through a port with ingress correction enabled, and egresses through a port with egress correction enabled, the PTP correction field is updated to reflect the time that the packet spent in the ASIC. This can be used to update the correction field of trapped packets by enabling ingress correction on a port where time stamping was enabled, and egress correction on the CPU port. Similarly, for packets transmitted from the host, ingress correction should be enabled on the CPU port, and egress correction on a front-panel port. However, since the correction fields will be updated for all PTP packets crossing the CPU port, in order not to mangle the correction field, the front panel port involved in the packet transfer must have the corresponding correction enabled as well. Therefore, when HW timestamping is enabled on at least one port, we have to configure hardware to update the correction field and trap PTP event packets on all ports. Add reference count as part of 'struct mlxsw_sp_ptp_state', to maintain how many ports use HW timestamping. Handle the correction field configuration only when the first port enables time stamping and when the last port disables time stamping. Store the configuration as part of 'struct mlxsw_sp_ptp_state', as it is global for all ports. The SIOCGHWTSTAMP ioctl is a getter for the current configuration, implement it and use the global configuration. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 382ad0d957932dded55984c1da3a98e8c3544d93 Author: Danielle Ratson Date: Wed Jul 27 09:23:26 2022 +0300 mlxsw: spectrum: Support time stamping on Spectrum-2 As opposed to Spectrum-1, in which time stamps arrive through a pair of dedicated events into a queue and later are being matched to the corresponding packets, in Spectrum-2 we are reading the time stamps directly from the CQE. Software can get the time stamp in UTC format using CQEv2. Add a time stamp field to 'struct mlxsw_skb_cb'. In mlxsw_pci_cqe_{rdq,sdq}_handle() extract the time stamp from the CQE into the new time stamp field. Note that the time stamp in the CQE is represented by 38 bits, which is a short representation of UTC time. Software should create the full time stamp using the global UTC clock. Read UTC clock from hardware only for PTP packets which were trapped to CPU with PTP0 trap ID (event packets). Use the time stamp from the SKB when packet is received or transmitted. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 24157bc69f45e8340af5ed72422afe8a248e0153 Author: Danielle Ratson Date: Wed Jul 27 09:23:25 2022 +0300 mlxsw: Send PTP packets as data packets to overcome a limitation In Spectrum-2 and Spectrum-3, the correction field of PTP packets which are sent as control packets is not updated at egress port. To overcome this limitation, PTP packets which require time stamp, should be sent as data packets with the following details: 1. FID valid = 1 2. FID value above the maximum FID 3. rx_router_port = 1 >From Spectrum-4 and on, this limitation will be solved. Extend the function which handles TX header, in case that the packet is a PTP packet, add TX header with type=data and all the above mentioned requirements. Add operation as part of 'struct mlxsw_sp_ptp_ops', to be able to separate the handling of PTP packets between different ASICs. Use the data packet solution only for Spectrum-2 and Spectrum-3. Therefore, add a dedicated operation structure for Spectrum-4, as it will be same to Spectrum-2 in PTP implementation, just will not have the limitation of control packets. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit a5bf8e5e8b8d36c4bfa7e41f18c40afa03a18161 Author: Danielle Ratson Date: Wed Jul 27 09:23:24 2022 +0300 mlxsw: spectrum_ptp: Add implementation for physical hardware clock operations Implement physical hardware clock operations. The main difference between the existing operations of Spectrum-1 and the new operations of Spectrum-2 is the usage of UTC hardware clock instead of FRC. Add support for init() and fini() functions for PTP clock in Spectrum-2. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit bbd300570a9e8628a6e2b644f1dbda1ae7e0effe Author: Danielle Ratson Date: Wed Jul 27 09:23:23 2022 +0300 mlxsw: Query UTC sec and nsec PCI offsets and values Query UTC sec and nsec PCI offsets during the pci_init(), to be able to read UTC time later. Implement functions to read UTC seconds and nanoseconds from the offset which was read as part of initialization. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit d25ff63a181b6943d94797c350de332cffadfab2 Author: Danielle Ratson Date: Wed Jul 27 09:23:22 2022 +0300 mlxsw: spectrum_ptp: Add PTP initialization / finalization for Spectrum-2 Lay the groundwork for Spectrum-2 support. On Spectrum-2, the packets get the time stamps from the CQE, which means that the time stamp is attached to its packet. Configure MTPTPT to set which message types should arrive under which PTP trap. PTP0 will be used for event message types, which means that the packets require time stamp. PTP1 will be used for other packets. Note that in Spectrum-2, all packets contain time stamp by default. The two types of traps (PTP0, PTP1) will be used to separate between PTP_EVENT traps and PTP_GENERAL traps, so then the driver will fill the time stamp as part of the SKB only for event message types. Later the driver will enable the traps using 'MTPCPC.ptp_trap_en' bit. Then, PTP packets start arriving through the PTP traps. Currently, the structure 'mlxsw_sp2_ptp_state' contains only the common structure, the next patches will extend it. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 42823208b946d85d20a7065a1b2ef6e35a7be3a9 Author: Danielle Ratson Date: Wed Jul 27 09:23:21 2022 +0300 mlxsw: Support CQEv2 for SDQ in Spectrum-2 and newer ASICs Currently, Tx completions are reported using Completion Queue Element version 1 (CQEv1). These elements do not contain the Tx time stamp, which is fine as Spectrum-1 reads Tx time stamps via a dedicated FIFO and Spectrum-2 does not currently support PTP. In preparation for Spectrum-2 PTP support, use CQEv2 for Spectrum-2 and newer ASICs, as this CQE format encodes the Tx time stamp. Signed-off-by: Danielle Ratson Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 37b62b282b182acd2113f97c1b9fd651d4211027 Author: Amit Cohen Date: Wed Jul 27 09:23:20 2022 +0300 mlxsw: spectrum_ptp: Add helper functions to configure PTP traps MTPTPT register is used to set which message types should arrive under which PTP trap. Currently, PTP0 is used for event message types, which means that the packets require time stamp. PTP1 is used for other packets. This configuration will be same for Spectrum-2 and newer ASICs. In preparation for Spectrum-2 PTP support, add helper functions to configure PTP traps and use them for Spectrum-1. These functions will be used later also for Spectrum-2. Signed-off-by: Amit Cohen Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 432e5dfc7eb75681b412c2b0cafb8604475e0aba Author: Suravee Suthikulpanit Date: Tue Jul 26 08:43:48 2022 -0500 iommu/amd: Add support for AVIC when SNP is enabled In order to support AVIC on SNP-enabled system, The IOMMU driver needs to check EFR2[SNPAVICSup] and enables the support by setting SNPAVICEn bit in the IOMMU control register (MMIO offset 18h). For detail, please see section "SEV-SNP Guest Virtual APIC Support" of the AMD I/O Virtualization Technology (IOMMU) Specification. (https://www.amd.com/system/files/TechDocs/48882_IOMMU.pdf) Signed-off-by: Suravee Suthikulpanit Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20220726134348.6438-3-suravee.suthikulpanit@amd.com Signed-off-by: Joerg Roedel commit c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b Author: Suravee Suthikulpanit Date: Tue Jul 26 08:43:47 2022 -0500 iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement Currently, enabling AVIC requires individually detect and enable GAM and GALOG features on each IOMMU, which is difficult to keep track on multi-IOMMU system, where the features needs to be enabled system-wide. In addition, these features do not need to be enabled in early stage. It can be delayed until after amd_iommu_init_pci(). Therefore, consolidate logic for detecting and enabling IOMMU GAM and GALOG features into a helper function, enable_iommus_vapic(), which uses the check_feature_on_all_iommus() helper function to ensure system-wide support of the features before enabling them, and postpone until after amd_iommu_init_pci(). The new function also check and clean up feature enablement residue from previous boot (e.g. in case of booting into kdump kernel), which triggers a WARN_ON (shown below) introduced by the commit a8d4a37d1bb9 ("iommu/amd: Restore GA log/tail pointer on host resume") in iommu_ga_log_enable(). [ 7.731955] ------------[ cut here ]------------ [ 7.736575] WARNING: CPU: 0 PID: 1 at drivers/iommu/amd/init.c:829 iommu_ga_log_enable.isra.0+0x16f/0x190 [ 7.746135] Modules linked in: [ 7.749193] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W -------- --- 5.19.0-0.rc7.53.eln120.x86_64 #1 [ 7.759706] Hardware name: Dell Inc. PowerEdge R7525/04D5GJ, BIOS 2.1.6 03/09/2021 [ 7.767274] RIP: 0010:iommu_ga_log_enable.isra.0+0x16f/0x190 [ 7.772931] Code: 20 20 00 00 8b 00 f6 c4 01 74 da 48 8b 44 24 08 65 48 2b 04 25 28 00 00 00 75 13 48 83 c4 10 5b 5d e9 f5 00 72 00 0f 0b eb e1 <0f> 0b eb dd e8 f8 66 42 00 48 8b 15 f1 85 53 01 e9 29 ff ff ff 48 [ 7.791679] RSP: 0018:ffffc90000107d20 EFLAGS: 00010206 [ 7.796905] RAX: ffffc90000780000 RBX: 0000000000000100 RCX: ffffc90000780000 [ 7.804038] RDX: 0000000000000001 RSI: ffffc90000780000 RDI: ffff8880451f9800 [ 7.811170] RBP: ffff8880451f9800 R08: ffffffffffffffff R09: 0000000000000000 [ 7.818303] R10: 0000000000000000 R11: 0000000000000000 R12: 0008000000000000 [ 7.825435] R13: ffff8880462ea900 R14: 0000000000000021 R15: 0000000000000000 [ 7.832572] FS: 0000000000000000(0000) GS:ffff888054a00000(0000) knlGS:0000000000000000 [ 7.840657] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7.846400] CR2: ffff888054dff000 CR3: 0000000053210000 CR4: 0000000000350eb0 [ 7.853533] Call Trace: [ 7.855979] [ 7.858085] amd_iommu_enable_interrupts+0x180/0x270 [ 7.863051] ? iommu_setup+0x271/0x271 [ 7.866803] state_next+0x197/0x2c0 [ 7.870295] ? iommu_setup+0x271/0x271 [ 7.874049] iommu_go_to_state+0x24/0x2c [ 7.877976] amd_iommu_init+0xf/0x29 [ 7.881554] pci_iommu_init+0xe/0x36 [ 7.885133] do_one_initcall+0x44/0x200 [ 7.888975] do_initcalls+0xc8/0xe1 [ 7.892466] kernel_init_freeable+0x14c/0x199 [ 7.896826] ? rest_init+0xd0/0xd0 [ 7.900231] kernel_init+0x16/0x130 [ 7.903723] ret_from_fork+0x22/0x30 [ 7.907306] [ 7.909497] ---[ end trace 0000000000000000 ]--- Fixes: commit a8d4a37d1bb9 ("iommu/amd: Restore GA log/tail pointer on host resume") Reported-by: Jerry Snitselaar Cc: Joerg Roedel Cc: Maxim Levitsky Cc: Will Deacon (maintainer:IOMMU DRIVERS) Signed-off-by: Suravee Suthikulpanit Reviewed-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20220726134348.6438-2-suravee.suthikulpanit@amd.com Signed-off-by: Joerg Roedel commit de0269765b268717b70f16f809560e83d5a8d0e7 Author: Ren Zhijie Date: Tue Jul 26 11:35:20 2022 +0800 ACPI/IORT: Fix build error implicit-function-declaration If CONFIG_ACPI_IORT=y and CONFIG_IOMMU_API is not set, make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu-, will be failed, like this: drivers/acpi/arm64/iort.c: In function ‘iort_get_rmr_sids’: drivers/acpi/arm64/iort.c:1406:2: error: implicit declaration of function ‘iort_iommu_rmr_get_resv_regions’; did you mean ‘iort_iommu_get_resv_regions’? [-Werror=implicit-function-declaration] iort_iommu_rmr_get_resv_regions(iommu_fwnode, NULL, head); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ iort_iommu_get_resv_regions cc1: some warnings being treated as errors make[3]: *** [drivers/acpi/arm64/iort.o] Error 1 The function iort_iommu_rmr_get_resv_regions() is declared under CONFIG_IOMMU_API, and the callers of iort_get_rmr_sids() and iort_put_rmr_sids() would select IOMMU_API. To fix this error, move the definitions to #ifdef CONFIG_IOMMU_API. Fixes: e302eea8f497 ("ACPI/IORT: Add a helper to retrieve RMR info directly") Signed-off-by: Ren Zhijie Acked-by: Hanjun Guo Link: https://lore.kernel.org/r/20220726033520.47865-1-renzhijie2@huawei.com Signed-off-by: Joerg Roedel commit e0f3907b3901df814c12ca54d65ef37000ce1515 Author: Vincent Mailhol Date: Fri Jul 29 17:09:02 2022 +0900 can: etas_es58x: remove useless calls to usb_fill_bulk_urb() Aside of urb->transfer_buffer_length and urb->context which might change in the TX path, all the other URB parameters remains constant during runtime. So, there is no reasons to call usb_fill_bulk_urb() each time before submitting an URB. Make sure to initialize all the fields of the URB at allocation time. For the TX branch, replace the call usb_fill_bulk_urb() by an assignment of urb->context. urb->urb->transfer_buffer_length is already set by the caller functions, no need to set it again. For the RX branch, because all parameters are unchanged, simply remove the call to usb_fill_bulk_urb(). Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220729080902.25839-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit f3a76018dd55d8ddcd28cb47049f46ae5c0ce557 Author: Phillip Potter Date: Fri Jul 29 00:11:49 2022 +0100 staging: r8188eu: remove initializer from ret in rtw_pwr_wakeup Remove the success initializer from the ret variable in rtw_pwr_wakeup, as we set it later anyway in the success path, and also set on failure. This makes the function appear cleaner and more consistent. Suggested-by: Dan Carpenter Tested-by: Philipp Hortmann Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220728231150.972-2-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 0a7e91528202bec8e8dc5787c7568e6c60ce7f43 Author: Liu Xinpeng Date: Wed Jul 27 18:07:33 2022 +0800 memblock tests: fix compilation errors Do 'make -C tools/testing/memblock', get the following errors: memblock.o: In function `memblock_find_in_range.constprop.9': memblock.c:(.text+0x4651): undefined reference to `pr_warn_ratelimited' memblock.o: In function `memblock_mark_mirror': memblock.c:(.text+0x7171): undefined reference to `mirrored_kernelcore' Fixes: 902c2d91582c ("memblock: Disable mirror feature if kernelcore is not specified") Fixes: 14d9a675fd0d ("mm: Ratelimited mirrored memory related warning messages") Signed-off-by: Liu Xinpeng Tested-by: Ma Wupeng Signed-off-by: Mike Rapoport Link: https://lore.kernel.org/r/1658916453-26312-1-git-send-email-liuxp11@chinatelecom.cn commit ba323f6bee1d1e70aed280f8c89ac06959559855 Author: Krzysztof Kozlowski Date: Wed Jul 27 18:41:29 2022 +0200 dt-bindings: nfc: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220727164130.385411-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 92b54e09c002c8d48e5c3b7d8d8feee5281340bf Merge: 29192a170e157 9d1bcb1f293f1 Author: Jakub Kicinski Date: Thu Jul 28 22:24:41 2022 -0700 Merge branch 'net-dsa-qca8k-code-split-for-qca8k' Christian Marangi says: ==================== net: dsa: qca8k: code split for qca8k This is needed ad ipq4019 SoC have an internal switch that is based on qca8k with very minor changes. The general function is equal. Because of this we split the driver to common and specific code. As the common function needs to be moved to a different file to be reused, we had to convert every remaining user of qca8k_read/write/rmw to regmap variant. We had also to generilized the special handling for the ethtool_stats function that makes use of the autocast mib. (ipq4019 will have a different tagger and use mmio so it could be quicker to use mmio instead of automib feature) And we had to convert the regmap read/write to bulk implementation to drop the special function that makes use of it. This will be compatible with ipq4019 and at the same time permits normal switch to use the eth mgmt way to send the entire ATU table read/write in one go. ==================== Link: https://lore.kernel.org/r/20220727113523.19742-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 9d1bcb1f293f1391302a109c9819c3705c804700 Author: Christian Marangi Date: Wed Jul 27 13:35:23 2022 +0200 net: dsa: qca8k: move read_switch_id function to common code The same function to read the switch id is used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit e9bbf019af44b204b71ef8edf224002550aab641 Author: Christian Marangi Date: Wed Jul 27 13:35:22 2022 +0200 net: dsa: qca8k: move port LAG functions to common code The same port LAG functions are used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit c5290f636624b98e76a82bd63ffec0a8a9daa620 Author: Christian Marangi Date: Wed Jul 27 13:35:21 2022 +0200 net: dsa: qca8k: move port VLAN functions to common code The same port VLAN functions are used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. Also drop exposing busy_wait and make it static. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 742d37a84d3f7bb60d9b2d9ada9ad4e599f65ebf Author: Christian Marangi Date: Wed Jul 27 13:35:20 2022 +0200 net: dsa: qca8k: move port mirror functions to common code The same port mirror functions are used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 2e5bd96eea86a246b4de3bf756f7a11b43e6187d Author: Christian Marangi Date: Wed Jul 27 13:35:19 2022 +0200 net: dsa: qca8k: move port FDB/MDB function to common code The same port FDB/MDB function are used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. Also drop bulk read/write functions and make them static Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit b3a302b171f73425b41de8d3357fae3fa7057322 Author: Christian Marangi Date: Wed Jul 27 13:35:18 2022 +0200 net: dsa: qca8k: move set age/MTU/port enable/disable functions to common code The same set age, MTU and port enable/disable function are used by driver based on qca8k family switch. Move them to common code to make them accessible also by other drivers. While at it also drop unnecessary qca8k_priv cast for void pointers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit fd3cae2f3ac190d06e48f43739237e02f9dc51ff Author: Christian Marangi Date: Wed Jul 27 13:35:17 2022 +0200 net: dsa: qca8k: move bridge functions to common code The same bridge functions are used by drivers based on qca8k family switch. Move them to common code to make them accessible also by other drivers. While at it also drop unnecessary qca8k_priv cast for void pointers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 472fcea160f27a5d9b7526093d9d8d89ba0b6137 Author: Christian Marangi Date: Wed Jul 27 13:35:16 2022 +0200 net: dsa: qca8k: move port set status/eee/ethtool stats function to common code The same logic to disable/enable port, set eee and get ethtool stats is used by drivers based on qca8k family switch. Move it to common code to make it accessible also by other drivers. While at it also drop unnecessary qca8k_priv cast for void pointers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit fce1ec0c4e2d03d9c62ffc615a42bdba78eb4c14 Author: Christian Marangi Date: Wed Jul 27 13:35:15 2022 +0200 net: dsa: qca8k: move mib init function to common code The same mib function is used by drivers based on qca8k family switch. Move it to common code to make it accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 910746444313dc463396cd63024cdf54ef04ef39 Author: Christian Marangi Date: Wed Jul 27 13:35:14 2022 +0200 net: dsa: qca8k: move qca8k bulk read/write helper to common code The same ATU function are used by drivers based on qca8k family switch. Move the bulk read/write helper to common code to declare these shared ATU functions in common code. These helper will be dropped when regmap correctly support bulk read/write. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit d5f901eab2e9dfed1095995dfc98f231f4fd2971 Author: Christian Marangi Date: Wed Jul 27 13:35:13 2022 +0200 net: dsa: qca8k: move qca8k read/write/rmw and reg table to common code The same reg table and read/write/rmw function are used by drivers based on qca8k family switch. Move them to common code to make it accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 027152b830434e3632ad5dd678cc5d4740358dbb Author: Christian Marangi Date: Wed Jul 27 13:35:12 2022 +0200 net: dsa: qca8k: move mib struct to common code The same MIB struct is used by drivers based on qca8k family switch. Move it to common code to make it accessible also by other drivers. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 533c64bca62a8654f00698bc893f639013e38c7b Author: Christian Marangi Date: Wed Jul 27 13:35:11 2022 +0200 net: dsa: qca8k: make mib autocast feature optional Some switch may not support mib autocast feature and require the legacy way of reading the regs directly. Make the mib autocast feature optional and permit to declare support for it using match_data struct in a dedicated qca8k_info_ops struct. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 3bb0844e7bcd0fb0bcfab6202b5edd349ef5250a Author: Christian Marangi Date: Wed Jul 27 13:35:10 2022 +0200 net: dsa: qca8k: cache match data to speed up access Using of_device_get_match_data is expensive. Cache match data to speed up access and rework user of match data to use the new cached value. Signed-off-by: Christian Marangi Reviewed-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 29192a170e1579ac8293d00c88d9938c2b2f5aab Author: Andy Shevchenko Date: Tue Jul 26 17:49:06 2022 +0300 firewire: net: Make use of get_unaligned_be48(), put_unaligned_be48() Since we have a proper endianness converters for BE 48-bit data use them. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220726144906.5217-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 39befe3a43a5856b36de4e880804b9b110dd2885 Author: Ruffalo Lavoisier Date: Thu Jul 28 12:28:54 2022 +0900 amt: fix typo in comment Correct spelling on 'non-existent' in comment Signed-off-by: Ruffalo Lavoisier Link: https://lore.kernel.org/r/20220728032854.151180-1-RuffaloLavoisier@gmail.com Signed-off-by: Jakub Kicinski commit 707e304dd2e8e169c2a34220b7081649249ec8e7 Author: Yang Li Date: Thu Jul 28 07:38:01 2022 +0800 mlxsw: core_linecards: Remove duplicated include in core_linecard_dev.c Fix following includecheck warning: ./drivers/net/ethernet/mellanox/mlxsw/core_linecard_dev.c: linux/err.h is included more than once. Reported-by: Abaci Robot Signed-off-by: Yang Li Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20220727233801.23781-1-yang.lee@linux.alibaba.com Signed-off-by: Jakub Kicinski commit d7c4c9e075f8cc6d88d277bc24e5d99297f03c06 Author: Eric Dumazet Date: Wed Jul 27 22:18:21 2022 -0700 ax25: fix incorrect dev_tracker usage While investigating a separate rose issue [1], and enabling CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2] An ax25_dev can be used by one (or many) struct ax25_cb. We thus need different dev_tracker, one per struct ax25_cb. After this patch is applied, we are able to focus on rose. [1] https://lore.kernel.org/netdev/fb7544a1-f42e-9254-18cc-c9b071f4ca70@free.fr/ [2] [ 205.798723] reference already released. [ 205.798732] allocated in: [ 205.798734] ax25_bind+0x1a2/0x230 [ax25] [ 205.798747] __sys_bind+0xea/0x110 [ 205.798753] __x64_sys_bind+0x18/0x20 [ 205.798758] do_syscall_64+0x5c/0x80 [ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798768] freed in: [ 205.798770] ax25_release+0x115/0x370 [ax25] [ 205.798778] __sock_release+0x42/0xb0 [ 205.798782] sock_close+0x15/0x20 [ 205.798785] __fput+0x9f/0x260 [ 205.798789] ____fput+0xe/0x10 [ 205.798792] task_work_run+0x64/0xa0 [ 205.798798] exit_to_user_mode_prepare+0x18b/0x190 [ 205.798804] syscall_exit_to_user_mode+0x26/0x40 [ 205.798808] do_syscall_64+0x69/0x80 [ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.798827] ------------[ cut here ]------------ [ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81 [ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea processor_thermal_device_pci_legacy sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211 processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24 snd intel_pch_thermal intel_rapl_common ttm soundcore int340x_thermal_zone video [ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci realtek lpc_ich xhci_pci_renesas [last unloaded: ax25] [ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3 [ 205.798996] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020 [ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81 [ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7 ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0 fa 4e [ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286 [ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000 [ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff [ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618 [ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0 [ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001 [ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000) knlGS:0000000000000000 [ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0 [ 205.799033] Call Trace: [ 205.799035] [ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25] [ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25] [ 205.799055] ? raw_notifier_call_chain+0x49/0x60 [ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0 [ 205.799065] ? dev_close_many+0xc8/0x120 [ 205.799070] ? unregister_netdevice_many+0x13d/0x890 [ 205.799073] ? unregister_netdevice_queue+0x90/0xe0 [ 205.799076] ? unregister_netdev+0x1d/0x30 [ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss] [ 205.799084] ? tty_ldisc_close+0x2e/0x40 [ 205.799089] ? tty_ldisc_hangup+0x137/0x210 [ 205.799092] ? __tty_hangup.part.0+0x208/0x350 [ 205.799098] ? tty_vhangup+0x15/0x20 [ 205.799103] ? pty_close+0x127/0x160 [ 205.799108] ? tty_release+0x139/0x5e0 [ 205.799112] ? __fput+0x9f/0x260 [ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25] [ 205.799126] ax25_device_event+0x9f/0x270 [ax25] [ 205.799135] raw_notifier_call_chain+0x49/0x60 [ 205.799140] call_netdevice_notifiers_info+0x52/0xa0 [ 205.799146] dev_close_many+0xc8/0x120 [ 205.799152] unregister_netdevice_many+0x13d/0x890 [ 205.799157] unregister_netdevice_queue+0x90/0xe0 [ 205.799161] unregister_netdev+0x1d/0x30 [ 205.799165] mkiss_close+0x7c/0xc0 [mkiss] [ 205.799170] tty_ldisc_close+0x2e/0x40 [ 205.799173] tty_ldisc_hangup+0x137/0x210 [ 205.799178] __tty_hangup.part.0+0x208/0x350 [ 205.799184] tty_vhangup+0x15/0x20 [ 205.799188] pty_close+0x127/0x160 [ 205.799193] tty_release+0x139/0x5e0 [ 205.799199] __fput+0x9f/0x260 [ 205.799203] ____fput+0xe/0x10 [ 205.799208] task_work_run+0x64/0xa0 [ 205.799213] do_exit+0x33b/0xab0 [ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0 [ 205.799224] do_group_exit+0x35/0xa0 [ 205.799228] __x64_sys_exit_group+0x18/0x20 [ 205.799232] do_syscall_64+0x5c/0x80 [ 205.799238] ? handle_mm_fault+0xba/0x290 [ 205.799242] ? debug_smp_processor_id+0x17/0x20 [ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50 [ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190 [ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20 [ 205.799260] ? irqentry_exit+0x33/0x40 [ 205.799263] ? exc_page_fault+0x87/0x170 [ 205.799268] ? asm_exc_page_fault+0x8/0x30 [ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 205.799277] RIP: 0033:0x7ff6b80eaca1 [ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77. [ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1 [ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028 [ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00 [ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00 [ 205.799304] Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") Reported-by: Bernard F6BVP Signed-off-by: Eric Dumazet Cc: Duoming Zhou Link: https://lore.kernel.org/r/20220728051821.3160118-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit 6ecf206d602fafd077811b6033c183deb0c0a9c8 Author: Martin Blumenstingl Date: Wed Jul 27 21:16:42 2022 +0200 selftests: net: dsa: Add a Makefile which installs the selftests Add a Makefile which takes care of installing the selftests in tools/testing/selftests/drivers/net/dsa. This can be used to install all DSA specific selftests and forwarding.config using the same approach as for the selftests in tools/testing/selftests/net/forwarding. Signed-off-by: Martin Blumenstingl Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220727191642.480279-1-martin.blumenstingl@googlemail.com Signed-off-by: Jakub Kicinski commit 13719a5bf19254a3daada33445073d6c8d4f98d9 Merge: 1515a1b8991d0 c90005b5f75ce Author: Jakub Kicinski Date: Thu Jul 28 21:58:49 2022 -0700 Merge branch 'take-devlink-lock-on-mlx4-and-mlx5-callbacks' Moshe Shemesh says: ==================== Take devlink lock on mlx4 and mlx5 callbacks Prepare mlx4 and mlx5 drivers to have all devlink callbacks called with devlink instance locked. Change mlx4 driver to use devl_ API where needed to have devlink reload callbacks locked. Change mlx5 driver to use devl_ API where needed to have devlink reload and devlink health callbacks locked. As mlx5 is the only driver which needed changes to enable calling health callbacks with devlink instance locked, this patchset also removes DEVLINK_NL_FLAG_NO_LOCK flag from devlink health callbacks. This patchset will be followed by a patchset that will remove DEVLINK_NL_FLAG_NO_LOCK flag from devlink and will remove devlink_mutex. ==================== Link: https://lore.kernel.org/r/1659023630-32006-1-git-send-email-moshe@nvidia.com Signed-off-by: Jakub Kicinski commit c90005b5f75ce3ef6170281ac4d77e8b7123995b Author: Moshe Shemesh Date: Thu Jul 28 18:53:50 2022 +0300 devlink: Hold the instance lock in health callbacks Let the core take the devlink instance lock around health callbacks and remove the now redundant locking in the drivers. Signed-off-by: Moshe Shemesh Signed-off-by: Jakub Kicinski commit d3dbdc9f8ddce46ae2646b2257106d8cdb3d5887 Author: Moshe Shemesh Date: Thu Jul 28 18:53:49 2022 +0300 net/mlx5: Lock mlx5 devlink health recovery callback Change devlink instance locks in mlx5 driver to have devlink health recovery callback locked, while keeping all driver paths which lead to devl_ API functions called by the driver locked. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 60d7ceea4b2a2f7106f61a0bb712a71868875106 Author: Moshe Shemesh Date: Thu Jul 28 18:53:48 2022 +0300 net/mlx4: Lock mlx4 devlink reload callback Change devlink instance locks in mlx4 driver to have devlink reload callback locked, while keeping all driver paths which leads to devl_ API functions called by the mlx4 driver locked. Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit a8c05514b2f8fe105d69796cce31fb344c50fb2a Author: Moshe Shemesh Date: Thu Jul 28 18:53:47 2022 +0300 net/mlx4: Use devl_ API for devlink port register / unregister Use devl_ API to call devl_port_register() and devl_port_unregister() instead of devlink_port_register() and devlink_port_unregister(). Add devlink instance lock in mlx4 driver paths to these functions. This will be used by the downstream patch to invoke mlx4 devlink reload callbacks with devlink lock held. Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 9cb7e94a78b54f935de602f514313e73cc5b8a48 Author: Moshe Shemesh Date: Thu Jul 28 18:53:46 2022 +0300 net/mlx4: Use devl_ API for devlink region create / destroy Use devl_ API to call devl_region_create() and devl_region_destroy() instead of devlink_region_create() and devlink_region_destroy(). Add devlink instance lock in mlx4 driver paths to these functions. This will be used by the downstream patch to invoke mlx4 devlink reload callbacks with devlink lock held. Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 84a433a40d0ebf3bbf36b8bfa58c6f45dc782344 Author: Moshe Shemesh Date: Thu Jul 28 18:53:45 2022 +0300 net/mlx5: Lock mlx5 devlink reload callbacks Change devlink instance locks in mlx5 driver to have devlink reload callbacks locked, while keeping all driver paths which lead to devl_ API functions called by the driver locked. Add mlx5_load_one_devl_locked() and mlx5_unload_one_devl_locked() which are used by the paths which are already locked such as devlink reload callbacks. This patch makes the driver use devl_ API also for traps register as these functions are called from the driver paths parallel to reload that requires locking now. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit c12f4c6ac3b49bdf38b31f7362cfde5ed63ea7cb Author: Moshe Shemesh Date: Thu Jul 28 18:53:44 2022 +0300 net/mlx5: Move fw reset unload to mlx5_fw_reset_complete_reload Refactor fw reset code to have the unload driver part done on mlx5_fw_reset_complete_reload(), so if it was called by the PF which initiated the reload fw activate flow, the unload part will be handled by the mlx5_devlink_reload_fw_activate() callback itself and not by the reset event work. This will be used by the downstream patch to invoke devlink reload callbacks with devlink lock held. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 2dec18ad826f52658f7781ee995d236cc449b678 Author: Jiri Pirko Date: Thu Jul 28 18:53:43 2022 +0300 net: devlink: remove region snapshots list dependency on devlink->lock After mlx4 driver is converted to do locked reload, devlink_region_snapshot_create() may be called from both locked and unlocked context. Note that in mlx4 region snapshots could be created on any command failure. That can happen in any flow that involves commands to FW, which means most of the driver flows. So resolve this by removing dependency on devlink->lock for region snapshots list consistency and introduce new mutex to ensure it. Signed-off-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 5502e8712c9be509a0b16e15ed64ef4e4bbc7e2c Author: Jiri Pirko Date: Thu Jul 28 18:53:42 2022 +0300 net: devlink: remove region snapshot ID tracking dependency on devlink->lock After mlx4 driver is converted to do locked reload, functions to get/put regions snapshot ID may be called from both locked and unlocked context. So resolve this by removing dependency on devlink->lock for region snapshot ID tracking by using internal xa_lock() to maintain shapshot_ids xa_array consistency. Signed-off-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 1515a1b8991d00079d78e333bbd0c5e29a5de104 Merge: 68be7b82e77f5 5b6ff128fdf60 Author: Jakub Kicinski Date: Thu Jul 28 21:57:11 2022 -0700 Merge branch 'add-framework-for-selftests-in-devlink' Vikas Gupta says: ==================== add framework for selftests in devlink Add support for selftests in the devlink framework. Adds a callback .selftests_check and .selftests_run in devlink_ops. User can add test(s) suite which is subsequently passed to the driver and driver can opt for running particular tests based on its capabilities. Patchset adds a flash based test for the bnxt_en driver. ==================== Link: https://lore.kernel.org/r/20220727165721.37959-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 5b6ff128fdf60b08c67b9b50addadc8fb8da4410 Author: vikas Date: Wed Jul 27 22:27:21 2022 +0530 bnxt_en: implement callbacks for devlink selftests Add callbacks ============= .selftest_check: returns true for flash selftest. .selftest_run: runs a flash selftest. Also, refactor NVM APIs so that they can be used with devlink and ethtool both. Signed-off-by: Vikas Gupta Reviewed-by: Andy Gospodarek Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 08f588fa301bef264576fc915da6bf31b585a824 Author: Vikas Gupta Date: Wed Jul 27 22:27:20 2022 +0530 devlink: introduce framework for selftests Add a framework for running selftests. Framework exposes devlink commands and test suite(s) to the user to execute and query the supported tests by the driver. Below are new entries in devlink_nl_ops devlink_nl_cmd_selftests_show_doit/dumpit: To query the supported selftests by the drivers. devlink_nl_cmd_selftests_run: To execute selftests. Users can provide a test mask for executing group tests or standalone tests. Documentation/networking/devlink/ path is already part of MAINTAINERS & the new files come under this path. Hence no update needed to the MAINTAINERS Signed-off-by: Vikas Gupta Reviewed-by: Andy Gospodarek Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 68be7b82e77f5ddf4a216f49fd965e74caf3f2e8 Merge: 8fd1e15177928 624bf09921338 Author: Jakub Kicinski Date: Thu Jul 28 21:50:57 2022 -0700 Merge branch 'mlx5e-use-tls-tx-pool-to-improve-connection-rate' Tariq Toukan says: ==================== mlx5e use TLS TX pool to improve connection rate To offload encryption operations, the mlx5 device maintains state and keeps track of every kTLS device-offloaded connection. Two HW objects are used per TX context of a kTLS offloaded connection: a. Transport interface send (TIS) object, to reach the HW context. b. Data Encryption Key (DEK) to perform the crypto operations. These two objects are created and destroyed per TLS TX context, via FW commands. In total, 4 FW commands are issued per TLS TX context, which seriously limits the connection rate. In this series, we aim to save creation and destroy of TIS objects by recycling them. Upon recycling of a TIS, the HW still needs to be notified for the re-mapping between a TIS and a context. This is done by posting WQEs via an SQ, significantly faster API than the FW command interface. A pool is used for recycling. The pool dynamically interacts to the load and connection rate, growing and shrinking accordingly. Saving the TIS FW commands per context increases connection rate by ~42%, from 11.6K to 16.5K connections per sec. Connection rate is still limited by FW bottleneck due to the remaining per context FW commands (DEK create/destroy). This will soon be addressed in a followup series. By combining the two series, the FW bottleneck will be released, and a significantly higher (about 100K connections per sec) kTLS TX device-offloaded connection rate is reached. ==================== Link: https://lore.kernel.org/r/20220727094346.10540-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 624bf09921338f977ca81e70817ff2fd3aa9216d Author: Tariq Toukan Date: Wed Jul 27 12:43:46 2022 +0300 net/mlx5e: kTLS, Dynamically re-size TX recycling pool Let the TLS TX recycle pool be more flexible in size, by continuously and dynamically allocating and releasing HW resources in response to changes in the connections rate and load. Allocate and release pool entries in bulks (16). Use a workqueue to release/allocate in the background. Allocate a new bulk when the pool size goes lower than the low threshold (1K). Symmetric operation is done when the pool size gets greater than the upper threshold (4K). Every idle pool entry holds: 1 TIS, 1 DEK (HW resources), in addition to ~100 bytes in host memory. Start with an empty pool to minimize memory and HW resources waste for non-TLS users that have the device-offload TLS enabled. Upon a new request, in case the pool is empty, do not wait for a whole bulk allocation to complete. Instead, trigger an instant allocation of a single resource to reduce latency. Performance tests: Before: 11,684 CPS After: 16,556 CPS Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit c4dfe704f53fb530e2a198c8d68e489cb68ebd70 Author: Tariq Toukan Date: Wed Jul 27 12:43:45 2022 +0300 net/mlx5e: kTLS, Recycle objects of device-offloaded TLS TX connections The transport interface send (TIS) object is responsible for performing all transport related operations of the transmit side. The ConnectX HW uses a TIS object to save and access the TLS crypto information and state of an offloaded TX kTLS connection. Before this patch, we used to create a new TIS per connection and destroy it once it’s closed. Every create and destroy of a TIS is a FW command. Same applies for the private TLS context, where we used to dynamically allocate and free it per connection. Resources recycling reduce the impact of the allocation/free operations and helps speeding up the connection rate. In this feature we maintain a pool of TX objects and use it to recycle the resources instead of re-creating them per connection. A cached TIS popped from the pool is updated to serve the new connection via the fast-path HW interface, updating the tls static and progress params. This is a very fast operation, significantly faster than FW commands. On recycling, a WQE fence is required after the context params change. This guarantees that the data is sent after the context has been successfully updated in hardware, and that the context modification doesn't interfere with existing traffic. Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 23b1cf1e3fe02c997f21d6c8412432d4713ba2c7 Author: Tariq Toukan Date: Wed Jul 27 12:43:44 2022 +0300 net/mlx5e: kTLS, Take stats out of OOO handler Let the caller of mlx5e_ktls_tx_handle_ooo() take care of updating the stats, according to the returned value. As the switch/case blocks are already there, this change saves unnecessary branches in the handler. Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit da6682faa82f4dfa5dbc2bc05bd166f1800c4f80 Author: Tariq Toukan Date: Wed Jul 27 12:43:43 2022 +0300 net/mlx5e: kTLS, Introduce TLS-specific create TIS TLS TIS objects have a defined role in mapping and reaching the HW TLS contexts. Some standard TIS attributes (like LAG port affinity) are not relevant for them. Use a dedicated TLS TIS create function instead of the generic mlx5e_create_tis. Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 7adc91e0c93901a0eeeea10665d0feb48ffde2d4 Author: Tariq Toukan Date: Wed Jul 27 12:43:42 2022 +0300 net/tls: Multi-threaded calls to TX tls_dev_del Multiple TLS device-offloaded contexts can be added in parallel via concurrent calls to .tls_dev_add, while calls to .tls_dev_del are sequential in tls_device_gc_task. This is not a sustainable behavior. This creates a rate gap between add and del operations (addition rate outperforms the deletion rate). When running for enough time, the TLS device resources could get exhausted, failing to offload new connections. Replace the single-threaded garbage collector work with a per-context alternative, so they can be handled on several cores in parallel. Use a new dedicated destruct workqueue for this. Tested with mlx5 device: Before: 22141 add/sec, 103 del/sec After: 11684 add/sec, 11684 del/sec Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 113671b255ee3b9f5585a6d496ef0e675e698698 Author: Tariq Toukan Date: Wed Jul 27 12:43:41 2022 +0300 net/tls: Perform immediate device ctx cleanup when possible TLS context destructor can be run in atomic context. Cleanup operations for device-offloaded contexts could require access and interaction with the device callbacks, which might sleep. Hence, the cleanup of such contexts must be deferred and completed inside an async work. For all others, this is not necessary, as cleanup is atomic. Invoke cleanup immediately for them, avoiding queueing redundant gc work. Signed-off-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed Signed-off-by: Jakub Kicinski commit 8fd1e151779285b211e7184e9237bba69bd74386 Author: Yang Li Date: Thu Jul 28 11:10:19 2022 +0800 tls: rx: Fix unsigned comparison with less than zero The return from the call to tls_rx_msg_size() is int, it can be a negative error code, however this is being assigned to an unsigned long variable 'sz', so making 'sz' an int. Eliminate the following coccicheck warning: ./net/tls/tls_strp.c:211:6-8: WARNING: Unsigned expression compared with zero: sz < 0 Reported-by: Abaci Robot Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20220728031019.32838-1-yang.lee@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 37e26188345b454aaffe05d651ada0dd7f470234 Merge: efe3e6b5aeefa e20691fa36c42 Author: Jakub Kicinski Date: Thu Jul 28 21:50:02 2022 -0700 Merge branch 'tls-rx-follow-ups-to-rx-work' Jakub Kicinski says: ==================== tls: rx: follow ups to rx work A selection of unrelated changes. First some selftest polishing. Next a change to rcvtimeo handling for locking based on an exchange with Eric. Follow up to Paolo's comments from yesterday. Last but not least a fix to a false positive warning, turns out I've been testing with DEBUG_NET=n this whole time. ==================== Link: https://lore.kernel.org/r/20220727031524.358216-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e20691fa36c42ff89c2b582f38ca0cc9e3d043ba Author: Jakub Kicinski Date: Tue Jul 26 20:15:24 2022 -0700 tls: rx: fix the false positive warning I went too far in the accessor conversion, we can't use tls_strp_msg() after decryption because the message may not be ready. What we care about on this path is that the output skb is detached, i.e. we didn't somehow just turn around and used the input skb with its TCP data still attached. So look at the anchor directly. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Signed-off-by: Jakub Kicinski commit d11ef9cc5a6792c8508cb00308b604836f9a9053 Author: Jakub Kicinski Date: Tue Jul 26 20:15:23 2022 -0700 tls: strp: rename and multithread the workqueue Paolo points out that there seems to be no strong reason strparser users a single threaded workqueue. Perhaps there were some performance or pinning considerations? Since we don't know (and it's the slow path) let's default to the most natural, multi-threaded choice. Also rename the workqueue to "tls-". Suggested-by: Paolo Abeni Signed-off-by: Jakub Kicinski commit 70f03fc2fc142d8c18e891dfa55ae8c5579f1e82 Author: Jakub Kicinski Date: Tue Jul 26 20:15:22 2022 -0700 tls: rx: don't consider sock_rcvtimeo() cumulative Eric indicates that restarting rcvtimeo on every wait may be fine. I thought that we should consider it cumulative, and made tls_rx_reader_lock() return the remaining timeo after acquiring the reader lock. tls_rx_rec_wait() gets its timeout passed in by value so it does not keep track of time previously spent. Make the lock waiting consistent with tls_rx_rec_wait() - don't keep track of time spent. Read the timeo fresh in tls_rx_rec_wait(). It's unclear to me why callers are supposed to cache the value. Link: https://lore.kernel.org/all/CANn89iKcmSfWgvZjzNGbsrndmCch2HC_EPZ7qmGboDNaWoviNQ@mail.gmail.com/ Signed-off-by: Jakub Kicinski commit 86c591fb9142e772d3ba26b601f4a49123e7079c Author: Jakub Kicinski Date: Tue Jul 26 20:15:21 2022 -0700 selftests: tls: handful of memrnd() and length checks Add a handful of memory randomizations and precise length checks. Nothing is really broken here, I did this to increase confidence when debugging. It does fix a GCC warning, tho. Apparently GCC recognizes that memory needs to be initialized for send() but does not recognize that for write(). Signed-off-by: Jakub Kicinski commit efe3e6b5aeefaabed9ad5dcb3682b581bf34c187 Author: Xie Shaowen Date: Wed Jul 27 16:12:53 2022 +0800 net: usb: delete extra space and tab in blank line delete extra space and tab in blank line, there is no functional change. Signed-off-by: Xie Shaowen Link: https://lore.kernel.org/r/20220727081253.3043941-1-studentxswpy@163.com Signed-off-by: Jakub Kicinski commit 27603a606fda0806d7c08914bc976931aa42020e Author: Matthias Kaehlcke Date: Thu Jul 28 08:54:41 2022 -0700 dm: verity-loadpin: Drop use of dm_table_get_num_targets() Commit 2aec377a2925 ("dm table: remove dm_table_get_num_targets() wrapper") in linux-dm/for-next removed the function dm_table_get_num_targets() which is used by verity-loadpin. Access table->num_targets directly instead of using the defunct wrapper. Fixes: b6c1c5745ccc ("dm: Add verity helpers for LoadPin") Reported-by: Stephen Rothwell Signed-off-by: Matthias Kaehlcke Reviewed-by: Douglas Anderson Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220728085412.1.I242d21b378410eb6f9897a3160efb56e5608c59d@changeid commit 272ac32f566e3f925b20c231a2b30f6893aa258a Merge: 623cd87006983 33ea1340bafe1 Author: Jakub Kicinski Date: Thu Jul 28 18:21:16 2022 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net No conflicts. Signed-off-by: Jakub Kicinski commit 64893e83f916145fd23182209009e9d2ce36d2df Author: Daniel Müller Date: Thu Jul 28 22:23:45 2022 +0000 libbpf: Support PPC in arch_specific_syscall_pfx Commit 708ac5bea0ce ("libbpf: add ksyscall/kretsyscall sections support for syscall kprobes") added the arch_specific_syscall_pfx() function, which returns a string representing the architecture in use. As it turns out this function is currently not aware of Power PC, where NULL is returned. That's being flagged by the libbpf CI system, which builds for ppc64le and the compiler sees a NULL pointer being passed in to a %s format string. With this change we add representations for two more architectures, for Power PC and Power PC 64, and also adjust the string format logic to handle NULL pointers gracefully, in an attempt to prevent similar issues with other architectures in the future. Fixes: 708ac5bea0ce ("libbpf: add ksyscall/kretsyscall sections support for syscall kprobes") Signed-off-by: Daniel Müller Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20220728222345.3125975-1-deso@posteo.net commit 1631ba1259d6d7f49b6028f2a1a0fa02be1c522a Author: Heiko Stuebner Date: Thu Jul 7 01:15:35 2022 +0200 riscv: Add support for non-coherent devices using zicbom extension The Zicbom ISA-extension was ratified in november 2021 and introduces instructions for dcache invalidate, clean and flush operations. Implement cache management operations for non-coherent devices based on them. Of course not all cores will support this, so implement an alternative-based mechanism that replaces empty instructions with ones done around Zicbom instructions. As discussed in previous versions, assume the platform being coherent by default so that non-coherent devices need to get marked accordingly by firmware. Reviewed-by: Christoph Hellwig Signed-off-by: Heiko Stuebner Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20220706231536.2041855-4-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit d1afce6709595b39cd159bdc54fe2093808c02fc Author: Heiko Stuebner Date: Thu Jul 7 01:15:34 2022 +0200 dt-bindings: riscv: document cbom-block-size The Zicbom operates on a block-size defined for the cpu-core, which does not necessarily match other cache-sizes used. So add the necessary property for the system to know the core's block-size. Reviewed-by: Anup Patel Reviewed-by: Guo Ren Acked-by: Rob Herring Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220706231536.2041855-3-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit 12b827758f51d4b614a677dd453b0e854e46aa65 Author: Heiko Stuebner Date: Thu Jul 7 01:15:33 2022 +0200 of: also handle dma-noncoherent in of_dma_is_coherent() of_dma_is_coherent() currently expects the architecture to be non-coherent and some devices being coherent getting marked as such with the dma-coherent devicetree property. For PowerPC CONFIG_OF_DMA_DEFAULT_COHERENT was added which currently makes of_dma_is_coherent() always return true but doesn't handle the case of the architecture being coherent but some devices not. So modify the function to also check for dma-noncoherent and set a suitable default return value. If CONFIG_OF_DMA_DEFAULT_COHERENT is set the value starts with true and finding dma-noncoherent will set it to false and without CONFIG_OF_DMA_DEFAULT_COHERENT, the behaviour is reversed. Reviewed-by: Christoph Hellwig Reviewed-by: Rob Herring Reviewed-by: Guo Ren Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20220706231536.2041855-2-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit b32d45824aa7e07a0c3257a16e3a2a691b11b39a Author: Nathan Huckleberry Date: Fri Jul 22 09:38:22 2022 +0000 dm bufio: Add DM_BUFIO_CLIENT_NO_SLEEP flag Add an optional flag that ensures dm_bufio_client does not sleep (primary focus is to service dm_bufio_get without sleeping). This allows the dm-bufio cache to be queried from interrupt context. To ensure that dm-bufio does not sleep, dm-bufio must use a spinlock instead of a mutex. Additionally, to avoid deadlocks, special care must be taken so that dm-bufio does not sleep while holding the spinlock. But again: the scope of this no_sleep is initially confined to dm_bufio_get, so __alloc_buffer_wait_no_callback is _not_ changed to avoid sleeping because __bufio_new avoids allocation for NF_GET. Signed-off-by: Nathan Huckleberry Signed-off-by: Mike Snitzer commit 0fcb100d50835d6823723ef0898cd565b3796e0a Author: Nathan Huckleberry Date: Fri Jul 22 09:38:21 2022 +0000 dm bufio: Add flags argument to dm_bufio_client_create Add a flags argument to dm_bufio_client_create and update all the callers. This is in preparation to add the DM_BUFIO_NO_SLEEP flag. Signed-off-by: Nathan Huckleberry Signed-off-by: Mike Snitzer commit 9dd1cd3220eca534f2d47afad7ce85f4c40118d8 Author: Mike Snitzer Date: Wed Jul 20 13:58:04 2022 -0400 dm: fix dm-raid crash if md_handle_request() splits bio Commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") introduced the optimization to _not_ perform bio_associate_blkg()'s relatively costly work when DM core clones its bio. But in doing so it exposed the possibility for DM's cloned bio to alter DM target behavior (e.g. crash) if a target were to issue IO without first calling bio_set_dev(). The DM raid target can trigger an MD crash due to its need to split the DM bio that is passed to md_handle_request(). The split will recurse to submit_bio_noacct() using a bio with an uninitialized ->bi_blkg. This NULL bio->bi_blkg causes blk_throtl_bio() to dereference a NULL blkg_to_tg(bio->bi_blkg). Fix this in DM core by adding a new 'needs_bio_set_dev' target flag that will make alloc_tio() call bio_set_dev() on behalf of the target. dm-raid is the only target that requires this flag. bio_set_dev() initializes the DM cloned bio's ->bi_blkg, using bio_associate_blkg, before passing the bio to md_handle_request(). Long-term fix would be to audit and refactor MD code to rely on DM to split its bio, using dm_accept_partial_bio(), but there are MD raid personalities (e.g. raid1 and raid10) whose implementation are tightly coupled to handling the bio splitting inline. Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 7dad24db59d2d2803576f2e3645728866a056dab Author: Mikulas Patocka Date: Sun Jul 24 14:33:52 2022 -0400 dm raid: fix address sanitizer warning in raid_resume There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks is greater than rs->raid_disks, so the loop touches one entry beyond the allocated length. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 Author: Mikulas Patocka Date: Sun Jul 24 14:31:35 2022 -0400 dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid ================================================================== BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3. #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit c6adada5b70403d526e0ac5b5c50ae245ac92bc7 Author: Mike Christie Date: Sun Jul 17 17:45:08 2022 -0500 dm: Start pr_preempt from the same starting path pr_preempt has a similar issue as reserve where for all the reservation types except the All Registrants ones the preempt can create a reservation. And a follow up reservation or release needs to go down the same path the preempt did. This has the pr_preempt work like reserve and release where we always start from the first path in the first group. This commit has been tested with windows failover clustering's validation test and libiscsi's PGR tests to check for regressions. They both don't have tests to verify this case, so I tested it manually. Signed-off-by: Mike Christie Signed-off-by: Mike Snitzer commit 08a3c338e080d25dd5613a22d71741f19fc0e0fa Author: Mike Christie Date: Sun Jul 17 17:45:07 2022 -0500 dm: Fix PR release handling for non All Registrants This commit fixes a bug where we are leaving the reservation in place even though pr_release has run and returned success. If we have a Write Exclusive, Exclusive Access, or Write/Exclusive Registrants only reservation, the release must be sent down the path that is the reservation holder. The problem is multipath_prepare_ioctl most likely selected path N for the reservation, then later when we do the release multipath_prepare_ioctl will select a completely different path. The device will then return success becuase the nvme and scsi specs say to return success if there is no reservation or if the release is sent down from a path that is not the holder. We then think we have released the reservation. This commit has us loop over each path and send a release so we can make sure the release is executed on the correct path. It has been tested with windows failover clustering's validation test which checks this case, and it has been tested manually (the libiscsi PGR tests don't have a test case for this yet, but I will be adding one). Signed-off-by: Mike Christie Signed-off-by: Mike Snitzer commit 701510875975ed7e188566de205990d29f34c8d8 Author: Mike Christie Date: Sun Jul 17 17:45:06 2022 -0500 dm: Start pr_reserve from the same starting path When an app does a pr_reserve it will go to whatever path we happen to be using at the time. This can result in errors when the app does a second pr_reserve call and expects success but gets a failure because the reserve is not done on the holder's path. This commit has us always start trying to do reserves from the first path in the first group. Windows failover clustering will produce the type of pattern above. With this commit, we will now pass its validation test for this case. Signed-off-by: Mike Christie Signed-off-by: Mike Snitzer commit 8dd87f3c5283de7f95396a236e420487226f3951 Author: Mike Christie Date: Sun Jul 17 17:45:05 2022 -0500 dm: Allow dm_call_pr to be used for path searches The specs state that if you send a reserve down a path that is already the holder success must be returned and if it goes down a path that is not the holder reservation conflict must be returned. Windows failover clustering will send a second reservation and expects that a device returns success. The problem for multipathing is that for an All Registrants reservation, we can send the reserve down any path but for all other reservation types there is one path that is the holder. To handle this we could add PR state to dm but that can get nasty. Look at target_core_pr.c for an example of the type of things we'd have to track. It will also get more complicated because other initiators can change the state so we will have to add in async event/sense handling. This commit, and the 3 commits that follow, tries to keep dm simple and keep just doing passthrough. This commit modifies dm_call_pr to be able to find the first usable path that can execute our pr_op then return. When dm_pr_reserve is converted to dm_call_pr in the next commit for the normal case we will use the same path for every reserve. Signed-off-by: Mike Christie Signed-off-by: Mike Snitzer commit e120a5f1e78fab6223544e425015f393d90d6f0d Author: Mike Snitzer Date: Fri Jul 22 15:31:23 2022 -0400 dm: return early from dm_pr_call() if DM device is suspended Otherwise PR ops may be issued while the broader DM device is being reconfigured, etc. Fixes: 9c72bad1f31a ("dm: call PR reserve/unreserve on each underlying device") Signed-off-by: Mike Snitzer commit 069448b2fd0a40b5252915dc10ae561c4b5c8c5a Author: Lama Kayal Date: Mon Jan 31 15:58:30 2022 +0200 net/mlx5e: Move mlx5e_init_l2_addr to en_main Move the function declaration of mlx5e_init_l2_addr to en/fs.h, rename to mlx5e_fs_init_l2_addr to align with the fs API functions naming convention and let it take mlx5e_flow_steering as arguments while keeping implementation at en_fs.c file. This helps maintain a clean driver code and avoids unnecessary dependencies. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit a02c07ea5d0b38815282a787a9621007f86965d1 Author: Lama Kayal Date: Sun Jan 23 17:44:12 2022 +0200 net/mlx5e: Split en_fs ndo's and move to en_main Add inner callee for ndo mlx5e_vlan_rx_add_vid and mlx5e_vlan_rx_kill_vid, to separate the priv usage from other flow steering flows. Move wrapper ndo's into en_main, and split the rest of the functionality into a separate part inside en_fs. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 5b031add2f94b3c34b0ab2057cdc061132bd3eb9 Author: Lama Kayal Date: Sun Jan 23 13:13:18 2022 +0200 net/mlx5e: Separate mlx5e_set_rx_mode_work and move caller to en_main Separate mlx5e_set_rx_mode into two, and move caller to en_main while keeping implementation in en_fs in the newly declared function mlx5e_fs_set_rx_mode. This; to minimize the coupling of flow_steering to priv. Add a parallel boolean member vlan_strip_disable to mlx5e_flow_steering that's updated similarly as its identical in priv, thus making it possible to adjust the rx_mode work handler to current changes. Also, add state_destroy boolean to mlx5e_flow_steering struct which replaces the old check : !test_bit(MLX5E_STATE_DESTROYING, &priv->state). This state member is updated accordingly prior to INIT_WORK(mlx5e_set_rx_mode_work), This is done for similar purposes as mentioned earlier and to minimize argument passings. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 7bb7071568e3faec8f5a59c52c15ff9ec879ddb7 Author: Lama Kayal Date: Sun Jan 23 14:15:19 2022 +0200 net/mlx5e: Add mdev to flow_steering struct Make flow_steering struct contain mlx5_core_dev such that it becomes self contained and easier to decouple later on this series. Let its values be initialized in mlx5e_fs_init(). Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 6a7bc5d0e1c34444eb82ab325fb9dd9ddefc6b73 Author: Lama Kayal Date: Sun Jan 9 11:23:05 2022 +0200 net/mlx5e: Report flow steering errors with mdev err report API Let en_fs report errors via mdev error report API, aka mlx5_core_* macros, thus replace the netdev API reports. This to minimize netdev coupling to the flow steering struct. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit af8bbf7300686961f74e72e2dc10a76672603cb3 Author: Lama Kayal Date: Sun Jan 9 11:23:05 2022 +0200 net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer Make mlx5e_flow_steering member of mlx5e_priv a pointer. Add dynamic allocation respectively. Allocate fs for all profiles when initializing profile, symmetrically deallocate at profile cleanup. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 454533aa87f4472826779bc8a2925548bf1ed4da Author: Lama Kayal Date: Thu Apr 28 16:41:20 2022 +0300 net/mlx5e: Allocate VLAN and TC for featured profiles only Introduce allocation and de-allocation functions for both flow steering VLAN and TC as part of fs API. Add allocations of VLAN and TC as nic profile feature, such that fs_init() will allocate both VLAN and TC only if they're featured in the profile. VLAN and TC are relevant for nic_profile only. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 23bde065c3a228e1e65c7ba9495f0b54535bea1a Author: Lama Kayal Date: Mon Jan 31 10:14:58 2022 +0200 net/mlx5e: Make mlx5e_tc_table private Move mlx5e_tc_table struct to en_tc.c thus make it private. Introduce allocation and deallocation functions as part of the tc API to allow this switch smoothly. Convert mlx5e_nic_chain() macro to a function of en_tc.c. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 65f586c2730ca342404abe1363a7ecaa8f48ca38 Author: Lama Kayal Date: Mon Jan 10 13:36:59 2022 +0200 net/mlx5e: Convert mlx5e_tc_table member of mlx5e_flow_steering to pointer Make fs.tc be a pointer and allocate it dynamically. Add mlx5e_priv pointer to mlx5e_tc_table, and thus get a work-around to accessing priv via tc when handling tc events inside mlx5e_tc_netdev_event. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 7d1a5ce46e475378761432263e9b1a385968a9af Author: Roi Dayan Date: Thu Jul 21 11:04:51 2022 +0300 net/mlx5e: TC, Support tc action api for police Add support for tc action api for police. Offloading standalone police action without a tc rule and reporting stats. Signed-off-by: Roi Dayan Reviewed-by: Jianbo Liu Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit f8e9d413a28a36f7451ca3b53306a6a8daa7b997 Author: Roi Dayan Date: Sun Jul 24 14:14:55 2022 +0300 net/mlx5e: TC, Separate get/update/replace meter functions mlx5e_tc_meter_get() to get an existing meter. mlx5e_tc_meter_update() to update an existing meter without refcount. mlx5e_tc_meter_replace() to get/create a meter and update if needed. Signed-off-by: Roi Dayan Reviewed-by: Jianbo Liu Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit b50ce4350c107c96a6a3e481b5e07208f0d058bb Author: Roi Dayan Date: Tue Jul 19 16:09:41 2022 +0300 net/mlx5e: Add red and green counters for metering Add red and green counters per meter instance. TC police action is implemented as a meter instance. The meter counters represent the police action notexceed/exceed counters. TC rules using the same meter instance will use the same counters. Signed-off-by: Roi Dayan Reviewed-by: Jianbo Liu Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit e5b1db27410e5d625a49b57db133f0551e01dd56 Author: Roi Dayan Date: Tue Feb 22 16:30:35 2022 +0200 net/mlx5e: TC, Allocate post meter ft per rule To support a TC police action notexceed counter and supporting actions other than drop/pipe there is a need to create separate ft and rules per rule and not to use a common one created on eswitch init. Signed-off-by: Roi Dayan Reviewed-by: Jianbo Liu Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed commit 8920d92b8be61c8a209ac21769028bbefdc17a4f Author: Yevgeny Kliteynik Date: Fri Jul 16 00:16:53 2021 +0300 net/mlx5: DR, Add support for flow metering ASO Add support for ASO action of type flow metering on device that supports STEv1. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Hamdan Igbaria Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit ec082d31c161976a0e81c5d2e3ac317237ac5a0d Author: Gal Pressman Date: Sun Jul 17 14:04:29 2022 +0300 net/mlx5e: Fix wrong use of skb_tcp_all_headers() with encapsulation Use skb_inner_tcp_all_headers() instead of skb_tcp_all_headers() when transmitting an encapsulated packet in mlx5e_tx_get_gso_ihs(). Fixes: 504148fedb85 ("net: add skb_[inner_]tcp_all_headers helpers") Cc: Eric Dumazet Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 42b4f7f66a43cdb9216e76e595c8a9af154806da Author: Shay Drory Date: Mon Jun 27 16:05:31 2022 +0300 net/mlx5: Fix driver use of uninitialized timeout Currently, driver is setting default values to all timeouts during function setup. The offending commit is using a timeout before function setup, meaning: the timeout is 0 (or garbage), since no value have been set. This may result in failure to probe the driver: mlx5_function_setup:1034:(pid 69850): Firmware over 4294967296 MS in pre-initializing state, aborting probe_one:1591:(pid 69850): mlx5_init_one failed with error code -16 Hence, set default values to timeouts during tout_init() Fixes: 37ca95e62ee2 ("net/mlx5: Increase FW pre-init timeout for health recovery") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 62d2664351ef37da34f6f3a3fd8ab34257d6fe30 Author: Yevgeny Kliteynik Date: Mon Jul 25 00:06:12 2022 +0300 net/mlx5: DR, Fix SMFS steering info dump format Fix several issues in SMFS steering info dump: - Fix outdated macro value for matcher mask in the SMFS debug dump format. The existing value denotes the old format of the matcher mask, as it was used during the early stages of development, and it results in wrong parsing by the steering dump parser - wrong fields are shown in the parsed output. - Add the missing destination table to the dumped action. The missing dest table handle breaks the ability to associate between the "go to table" action and the actual table in the steering info. Fixes: 9222f0b27da2 ("net/mlx5: DR, Add support for dumping steering info") Signed-off-by: Yevgeny Kliteynik Signed-off-by: Muhammad Sammar Reviewed-by: Alex Vesker Signed-off-by: Saeed Mahameed commit a6e9085d791f8306084fd5bc44dd3fdd4e1ac27b Author: Maher Sanalla Date: Sun Jul 24 11:28:21 2022 +0300 net/mlx5: Adjust log_max_qp to be 18 at most The cited commit limited log_max_qp to be 17 due to FW capabilities. Recently, it turned out that there are old FW versions that supported more than 17, so the cited commit caused a degradation. Thus, set the maximum log_max_qp back to 18 as it was before the cited commit. Fixes: 7f839965b2d7 ("net/mlx5: Update log_max_qp value to be 17 at most") Signed-off-by: Maher Sanalla Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit c0063a43700fa8c98cac2637aa1afcf40bb9e403 Author: Vlad Buslov Date: Thu Jul 7 21:49:18 2022 +0200 net/mlx5e: Modify slow path rules to go to slow fdb While extending available range of supported chains/prios referenced commit also modified slow path rules to go to FT chain instead of actual slow FDB. However neither of existing users of the MLX5_ATTR_FLAG_SLOW_PATH flag (tunnel encap entries with invalid encap and flows with trap action) need to match on FT chain. After bridge offload was implemented packets of such flows can also be matched by bridge priority tables which is undesirable. Restore slow path flows implementation to redirect packets to slow_fdb. Fixes: 278d51f24330 ("net/mlx5: E-Switch, Increase number of chains and priorities") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 677e78c8d44f326a73a77d71acf3a49ea562c1d9 Author: Maxim Mikityanskiy Date: Thu Jun 2 15:14:08 2022 +0300 net/mlx5e: Fix calculations related to max MPWQE size Before commit 76c31e5f7585 ("net/mlx5e: Use FW limitation for max MPW WQEBBs"), the maximum size of MPWQE in WQEBBs was hardcoded as a driver constant. That commit started using the firmware capability that can further limit the size, however, it unintentionally changed a few things: 1. The calculation of MLX5E_MAX_KLM_PER_WQE used the size in DS, which was replaced by the size in WQEBBs, making the resulting value 4 times smaller. 2. MLX5E_TX_MPW_MAX_WQEBBS used to be aligned to the cache line size (either 64 or 128 bytes, i.e. 1 or 2 WQEBBs), but it's no longer the case if the firmware capability is smaller than the driver maximum. Fix both issues by using the correct units for MLX5E_MAX_KLM_PER_WQE and by aligning mlx5e_get_sw_max_sq_mpw_wqebbs after taking the minimum. Besides fixing the arithmetics in calculation of MLX5E_MAX_KLM_PER_WQE, also use appropriate constants: `size of BSF * num of DS per WQEBB * number of WQEBBs` (the calculation before the blamed commit) doesn't make much sense to calculate the WQE size in bytes, so just use `size of WQEBB * number of WQEBBs`. While at it, replace the types that hold the number of WQEBBs by u8. These values don't exceed 16, and it allows to fill holes in two structs. Fixes: 76c31e5f7585 ("net/mlx5e: Use FW limitation for max MPW WQEBBs") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 52586d2f56b3e4f528ca7268d65074e92c936681 Author: Maxim Mikityanskiy Date: Mon May 30 21:06:03 2022 +0300 net/mlx5e: xsk: Account for XSK RQ UMRs when calculating ICOSQ size ICOSQ is used to post UMR WQEs for both regular RQ and XSK RQ. However, space in ICOSQ is reserved only for the regular RQ, which may cause ICOSQ overflows when using XSK (the most risk is on activating channels). This commit fixes the issue by reserving space for XSK UMR WQEs as well. As XSK may be enabled without restarting the channel and recreating the ICOSQ, this space is reserved unconditionally. Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 562696c3c62c7c23dd896e9447252ce9268cb812 Author: Maxim Mikityanskiy Date: Thu May 26 16:48:47 2022 +0300 net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS MLX5E_MAX_RQ_NUM_MTTS should be the maximum value, so that MLX5_MTT_OCTW(MLX5E_MAX_RQ_NUM_MTTS) fits into u16. The current value of 1 << 17 results in MLX5_MTT_OCTW(1 << 17) = 1 << 16, which doesn't fit into u16. This commit replaces it with the maximum value that still fits u16. Fixes: 73281b78a37a ("net/mlx5e: Derive Striding RQ size from MTU") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 903f2194f74bbd289f3170114035d472a36a8ab4 Author: Maor Dickman Date: Mon Jul 18 09:44:13 2022 +0300 net/mlx5e: TC, Fix post_act to not match on in_port metadata The cited commit changed CT to use multi table actions post act infrastructure instead of using it own post act infrastructure, this broke decap during VF tunnel offload (Stack devices) with CT due to wrong match on in_port metadata in the post act table. This changed only broke VF tunnel offload because it modify the packet in_port metadata to be VF metadata and it isn't propagate the post act creation. Fixed by modify post act rules to match only on fte_id and not match on in_port metadata which isn't needed. Fixes: a81283263bb0 ("net/mlx5e: Use multi table support for CT and sample actions") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 115d9f95ea7ab780ef315dc356bebba2e07cb731 Author: Gal Pressman Date: Wed Jul 13 13:57:03 2022 +0300 net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version The driver reports whether TX/RX TLS device offloads are supported, but not which ciphers/versions, these should be handled by returning -EOPNOTSUPP when .tls_dev_add() is called. Remove the WARN_ON kernel trace when the driver gets a request to offload a cipher/version that is not supported as it is expected. Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Reviewed-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed commit 1ff186ff32997049a6d263031819517eab4e93aa Author: Jonathan Kim Date: Thu Jul 28 12:36:09 2022 -0400 drm/amdgpu: fix hive reference leak when reflecting psp topology info Hives that require psp topology info to be reflected will leak hive reference so fix it. Signed-off-by: Jonathan Kim Reviewed-by: Shaoyun Liu Signed-off-by: Alex Deucher commit e1c42213f3f9b24200d4b60da806303dbeae5a4d Author: Evan Quan Date: Fri Jul 15 11:03:01 2022 +0800 drm/amd/pm: enable GFX ULV feature support for SMU13.0.0 The feature is ready with latest firmwares. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1f3dfde4fba4f4b7822c389b9c994089a4ab588b Author: Evan Quan Date: Mon Jul 25 11:45:43 2022 +0800 drm/amd/pm: update driver if header for SMU 13.0.0 And get the version bumped to 0x2C to match the latest PMFW. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ed67f7292b99f5d3876fa02dd51a43f46986c61c Author: Jack Xiao Date: Wed Jul 20 15:57:22 2022 +0800 drm/amdgpu: move mes self test after drm sched re-started mes self test rely on vm mapping, move it after drm sched re-started so that vm mapping can work during gpu reset. Signed-off-by: Jack Xiao Acked-and-tested-by: Evan Quan Signed-off-by: Alex Deucher commit 0da0def7705dff7ee938662ea06f90770cb6f9fc Author: Evan Quan Date: Wed Jul 20 16:51:58 2022 +0800 drm/amdgpu: drop non-necessary call trace dump This extra call trace dump comes out in every gpu reset. And it gives people a wrong impression that something went wrong. Although actually there was not. Signed-off-by: Evan Quan Acked-by: Christian König Signed-off-by: Alex Deucher commit 47231d5e396a94e869b877bb1a0dcd526d91ac6e Author: Sonny Jiang Date: Thu Jul 21 13:27:12 2022 -0400 drm/amdgpu: enable VCN cg and JPEG cg/pg Not enable VCN pg because encode issue Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 1c0a90364859c17d57a7f08d6209b73e7e1142cd Author: Sonny Jiang Date: Thu Jul 21 13:27:11 2022 -0400 drm/amdgpu: vcn_4_0_2 video codec query Enable support for vcn_4_0_2 video codec Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit cbe93a234bcce489be319e678dbf167b7a5f915a Author: Sonny Jiang Date: Thu Jul 21 13:27:10 2022 -0400 drm/amdgpu: add VCN_4_0_2 firmware support Add VCN_4_0_2 firmware support Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 4ac77cce84a4afa3b76fe7c763aa3e754cdac422 Author: Sonny Jiang Date: Thu Jul 21 13:27:09 2022 -0400 drm/amdgpu: add VCN function in NBIO v7.7 Add function to support VCN_4_0_2 doorbell Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 736f7308d3e6201322142d98abe4e9af33a429f7 Author: Sonny Jiang Date: Thu Jul 21 13:27:08 2022 -0400 drm/amdgpu: fix a vcn4 boot poll bug in emulation mode The return value should be set in vcn4 boot poll. Signed-off-by: Sonny Jiang Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 6fdd2077ec03f4b34d127a1713ca19248539d6e0 Author: Chengming Gui Date: Thu Jul 28 09:15:43 2022 +0800 drm/amd/amdgpu: add memory training support for PSP_V13 Add PSP_V13 memory training support funcs. v2: replace DRM_{DEBUG/ERROR} with dev_{dbg/err}. (Hawking) v3: fix checkpatch error (Alex) Signed-off-by: Chengming Gui Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e22ec18750be01298763b10f7056ec8edfbf064f Author: Lang Yu Date: Mon Jul 25 15:06:55 2022 +0800 drm/amdkfd: remove an unnecessary amdgpu_bo_ref No need to reference the BO here, dmabuf framework will handle that. Signed-off-by: Lang Yu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 674b9e08a02903fef75beadca0df490348d8f560 Author: Shikai Guo Date: Wed Jul 20 19:38:24 2022 +0800 drm/amd/pm: Add get_gfx_off_status interface for yellow carp add get_gfx_off_status interface to yellow_carp_ppt_funcs structure. Signed-off-by: Shikai Guo Reviewed-by: Aaron Liu Reviewed-by: Prike Liang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit e4bb7fee188dab08b7e589fff7616716cdbd5c3b Author: Krzysztof Kozlowski Date: Thu Jul 28 13:16:02 2022 -0700 dt-bindings: input: ariel-pwrbutton: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS.a The binding references also input.yaml and lists explicitly allowed properties, thus here reference only spi-peripheral-props.yaml for purpose of documenting the SPI slave device and bringing spi-max-frequency type validation. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220727164230.385614-1-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Torokhov commit 2182cb7029e9c5cc4b63d1c5682f62ebb65cc952 Author: Maíra Canal Date: Wed Jul 27 14:50:33 2022 -0300 drm/amd/display: Remove unused struct freesync_context All references to struct freesync_context were removed, so remove the struct freesync_context itself and its entry on struct dc_stream_state. Reviewed-by: Rodrigo Siqueira Signed-off-by: Maíra Canal Signed-off-by: Alex Deucher commit 7c8e4a257246399c4f1ff43a06fc53ec53423754 Author: Chengming Gui Date: Mon Jun 20 15:52:29 2022 +0800 drm/amd/amdgpu: add additional page fault settings for gfx11 Add three additional page fault settings. V2: move reg offset definition to header file. (Alex) V3: add all shift/mask definitions of used reg. (Hawking) Signed-off-by: Chengming Gui Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 53bd83dfff8618d4a1affa171288b895add40476 Author: Yang Li Date: Wed Jul 27 06:28:09 2022 +0800 drm/amd/display: remove unneeded semicolon Eliminate the following coccicheck warning: ./drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c:2344:67-68: Unneeded semicolon Reported-by: Abaci Robot Reviewed-by: Rodrigo Siqueira Signed-off-by: Yang Li Signed-off-by: Alex Deucher commit b2065fb21d9a789b14f737ea90facedabadeb8a4 Author: Vijendar Mukunda Date: Wed Jul 27 16:15:43 2022 +0530 drm/amdgpu: fix i2s_pdata out of bound array access Fixed following Smatch static checker warning: drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init() error: buffer overflow 'i2s_pdata' 3 <= 3 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init() error: buffer overflow 'i2s_pdata' 3 <= 3 Fixes: 4c33e5179ff1 ("drm/amdgpu: create I2S platform devices for Jadeite platform") Reported-by: Dan Carpenter Signed-off-by: Vijendar Mukunda Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 0dc204bc3f199de0a0924f3d5f7c26295e5c012e Author: Lang Yu Date: Tue Jul 26 13:32:39 2022 +0800 drm/amdkfd: fix kgd_mem memory leak when importing dmabuf The kgd_mem memory allocated in amdgpu_amdkfd_gpuvm_import_dmabuf() is not freed properly. Explicitly free it in amdgpu_amdkfd_gpuvm_free_memory_of_gpu() under condition "mem->bo->kfd_bo != mem". Suggested-by: Felix Kuehling Signed-off-by: Lang Yu Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 3d2af401cf851be0bf2d4d89af6f120819b786a7 Author: Alex Sierra Date: Mon Jun 13 13:31:41 2022 -0500 drm/amdgpu: add debugfs for kfd system and ttm mem used This keeps track of kfd system mem used and kfd ttm mem used. Signed-off-by: Alex Sierra Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit f9af3c16bfe19d145cf0588afa06d7f1070cbe2d Author: Alex Sierra Date: Tue May 17 17:43:06 2022 -0500 drm/amdkfd: track unified memory reservation with xnack off [WHY] Unified memory with xnack off should be tracked, as userptr mappings and legacy allocations do. To avoid oversuscribe system memory when xnack off. [How] Exposing functions reserve_mem_limit and unreserve_mem_limit to SVM API and call them on every prange creation and free. Signed-off-by: Alex Sierra Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 06ac561fb0edf868f7b292fb4a3c8ffbbb1e14bb Author: Dan Carpenter Date: Tue Jul 26 18:15:31 2022 +0300 drm/amd/display: fix signedness bug in execute_synaptics_rc_command() The "ret" variable needs to be signed for the error handling to work. Fixes: 2ca97adccdc9 ("drm/amd/display: Add Synaptics Fifo Reset Workaround") Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit e3b0079be8f0a2ccb533f7e38757b27ab6b6018c Author: Jiapeng Chong Date: Tue Jul 26 15:25:55 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1372 dp_dsc_clock_en_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1478 dp_dsc_clock_en_write() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1563 dp_dsc_slice_width_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1667 dp_dsc_slice_width_write() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1752 dp_dsc_slice_height_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1856 dp_dsc_slice_height_write() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1937 dp_dsc_bits_per_pixel_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:2038 dp_dsc_bits_per_pixel_write() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:2117 dp_dsc_pic_width_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:2178 dp_dsc_pic_height_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:2254 dp_dsc_chunk_size_read() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:2330 dp_dsc_slice_bpg_offset_read() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 66bd94debe4aca171bd0220de7af3feee6542d8a Author: Jiapeng Chong Date: Tue Jul 26 15:25:54 2022 +0800 drm/amd/display: Clean up some inconsistent indenting Clean up some inconsistent indenting, replace sizeof(x) / sizeof((x)[0])) with ARRAY_SIZE(x). smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/dcn30_fpu.c:185 optc3_fpu_set_vrr_m_const() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/dcn30_fpu.c:355 dcn30_fpu_set_mcif_arb_params() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/dcn30_fpu.c:384 dcn30_fpu_calculate_wm_and_dlg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/dcn30_fpu.c:390 dcn30_fpu_calculate_wm_and_dlg() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 1be3188a6dda544dd4d78503eba5f5a77462b348 Author: Jiapeng Chong Date: Tue Jul 26 15:25:53 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn303/dcn303_fpu.c:205 dcn303_fpu_update_bw_bounding_box() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn303/dcn303_fpu.c:355 dcn303_fpu_init_soc_bounding_box() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 1422ca01be6a816ec5a445a6fdce00342adcc5f8 Author: Jiapeng Chong Date: Tue Jul 26 15:25:52 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_util_32.c:713 dml32_CalculateSwathWidth() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 4557489e0370ac0e9f1f5f100f300e9278be0733 Author: Jiapeng Chong Date: Tue Jul 26 15:25:51 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:51 dml32_rq_dlg_get_rq_reg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:68 dml32_rq_dlg_get_rq_reg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:220 dml32_rq_dlg_get_dlg_reg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:224 dml32_rq_dlg_get_dlg_reg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:235 dml32_rq_dlg_get_dlg_reg() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_rq_dlg_calc_32.c:240 dml32_rq_dlg_get_dlg_reg() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 931fa55b2fac18f226622a95e42bc968bb852cd8 Author: Jiapeng Chong Date: Tue Jul 26 15:25:50 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_hwseq.c:1728 dcn20_program_front_end_for_ctx() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 64f857b5479a7ce2eaa56bef5f459da5542ad90d Author: Jiapeng Chong Date: Tue Jul 26 15:25:49 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_dpp_cm.c:450 dpp20_get_blndgam_current() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_dpp_cm.c:543 dpp20_get_shaper_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 292956cfd9d38835f95021445525b35502837ff7 Author: Jiapeng Chong Date: Tue Jul 26 15:25:48 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_mpc.c:305 mpc20_get_ogam_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit fbad6c418e1e63a29c83e8b56a3636915406a9b7 Author: Jiapeng Chong Date: Tue Jul 26 15:25:47 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn20/dcn20_dwb.c:104 dwb2_enable() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 9ced2e492ba9436524a2beed27df730042cbcc3e Author: Jiapeng Chong Date: Tue Jul 26 15:25:46 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_optc.c:186 optc3_set_dsc_config() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit e3b2bbb33e26d0a0327f878782632ec35cf96a72 Author: Jiapeng Chong Date: Tue Jul 26 15:25:45 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_mpc.c:116 mpc3_get_ogam_current() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_mpc.c:445 mpc3_get_shaper_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit afb185008d40930895a7f7465a9661afeac0b84b Author: Jiapeng Chong Date: Tue Jul 26 15:25:44 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp.c:724 dpp3_get_blndgam_current() warn: inconsistent indenting. drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp.c:823 dpp3_get_shaper_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 980e09e8b74c26baa32f0d65d272ecb1401606c9 Author: Jiapeng Chong Date: Tue Jul 26 15:25:43 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_dpp_cm.c:67 dpp30_get_gamcor_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 05381583a1d0c38cd2c4907ee93ec624250b8912 Author: Jiapeng Chong Date: Tue Jul 26 15:25:42 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c:726 dcn31_clk_mgr_construct() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 203dc777865621b0c7f8f5b19ec18e572730278c Author: Jiapeng Chong Date: Tue Jul 26 15:25:41 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c:655 dcn315_clk_mgr_construct() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 84e2fd649482435c3e12d9099784976ce8bea1e2 Author: Jiapeng Chong Date: Tue Jul 26 15:25:40 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c:683 dcn316_clk_mgr_construct() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit ed63b7cf2d6ebc01a765be31630c3e4a64f7f095 Author: Jiapeng Chong Date: Tue Jul 26 15:25:39 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn201/dcn201_clk_mgr.c:107 dcn201_update_clocks() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit fcac1ac7f1e3fb877aad51c134ff2776bd24f9d6 Author: Jiapeng Chong Date: Tue Jul 26 15:25:38 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c:716 dcn314_clk_mgr_construct() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 3f5a3881f1e26aa5e3ae34e34e439edce291ef5a Author: Jiapeng Chong Date: Tue Jul 26 15:25:37 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warnings: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn32/dcn32_mpc.c:306 mpc32_get_shaper_current() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 8b3120dfc192a4c61f73a0798755713ba2d3eb8a Author: Jiapeng Chong Date: Tue Jul 26 15:25:36 2022 +0800 drm/amd/display: Clean up some inconsistent indenting No functional modification involved. smatch warning: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn32/dcn32_hwseq.c:910 dcn32_init_hw() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 5640cb8921c9aff1270557482237e06af00c388b Author: Philip Yang Date: Mon Jul 25 07:10:10 2022 -0400 drm/amdkfd: Split giant svm range Giant svm range split to smaller ranges, align the range start address to max svm range pages to improve MMU TLB usage. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 4959e609de1ed4199f33124a88a4c9ab95f5cd9a Author: Philip Yang Date: Mon Jul 25 07:06:38 2022 -0400 drm/amdkfd: Set svm range max pages This will be used to split giant svm range into smaller ranges, to support VRAM overcommitment by giant range and improve GPU retry fault recover on giant range. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 79b2c54f19110235041d8f1250e3c3694047a902 Author: Philip Yang Date: Fri Jul 22 15:07:00 2022 -0400 drm/amdgpu: Allow TTM to evict svm bo from same process To support SVM range VRAM overcommitment, TTM should be able to evict svm bo of same process to system memory, to get space to alloc new svm bo. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 1f83db6be37c53f6d395a41ee2602e3280ee60c2 Author: Roy Sun Date: Wed Jul 20 16:19:50 2022 +0800 drm/amdgpu: Fix the incomplete product number The comments say that the product number is a 16-digit HEX string so the buffer needs to be at least 17 characters to hold the NUL terminator. Expand the buffer size to 20 to avoid the alignment issues. The comment:Product number should only be 16 characters. Any more,and something could be wrong. Cap it at 16 to be safe Signed-off-by: Roy Sun Reviewed-by: André Almeida Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8585732baa40455fbae9575d0c8316f4b0cf68f5 Author: Guchun Chen Date: Mon Jul 25 14:15:09 2022 +0800 drm/amdgpu: use adev_to_drm for consistency Keep code consistency when accessing drm_device from amdgpu driver. Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit aa316247c726d96f0bc205413c54ab49622ca737 Author: wangjianli Date: Sun Jul 24 15:41:50 2022 +0800 drm/amdgpu/dc/dce: fix repeated words in comments Delete the redundant word 'in'. Signed-off-by: wangjianli Signed-off-by: Alex Deucher commit 08c1d7a1595e9a7f14d85937c66f02f7ae1733ad Author: Nick Forrington Date: Fri Jun 10 18:44:59 2022 +0100 perf vendor events arm64: Arm Cortex-A78C and X1C Add PMU events for the Arm Cortex-A78C and Arm Cortex-X1C CPUs. Events for Arm Cortex-A78C match those for Arm Cortex-A78. Events for Arm Cortex-X1C match those for Arm Cortex- X1. As such, this is just a mapfile change. Main ID Register (MIDR) and event data is sourced from the corresponding Arm Technical Reference Manuals: Arm Cortex-A78C: https://developer.arm.com/documentation/102226/ Arm Cortex-X1C: https://developer.arm.com/documentation/101968/ Reviewed-by: John Garry Signed-off-by: Nick Forrington Cc: Alexander Shishkin Cc: Andrew Kilroy Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20220610174459.615995-1-nick.forrington@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit ebcdbf7a6aa610ed555c94db14256403907432ad Author: Ian Rogers Date: Wed Jul 27 15:08:32 2022 -0700 perf vendor events: Update Intel snowridgex Update to v1.20, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the snowridgex files into perf and update mapfile.csv. Tested on a non-snowridgex with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok This change just updates the version number. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-31-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6b47be608b84d6c44f9f26d6be1cc1637d804011 Author: Ian Rogers Date: Wed Jul 27 15:08:31 2022 -0700 perf vendor events: Update Intel westmereex Update to v3, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the westmereex files into perf and update mapfile.csv. This change just aligns whitespace and updates the version number. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-30-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4823edd648c71d8bc38ad796e0c232ccbf541ad5 Author: Ian Rogers Date: Wed Jul 27 15:08:30 2022 -0700 perf vendor events: Update Intel westmereep-sp Update to v3, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the westmereep-sp files into perf and update mapfile.csv. This change just aligns whitespace and updates the version number. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-29-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ae2fa1ccf10e8eda240ce328a4c210ea98b6caa7 Author: Ian Rogers Date: Wed Jul 27 15:08:29 2022 -0700 perf vendor events: Update Intel westmereep-dp Update to v2, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the westmereep-dp files into perf and update mapfile.csv. This change just aligns whitespace. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-28-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5e1dd4f24ab5c8c0d7eee1ff99a4631f177298da Author: Ian Rogers Date: Wed Jul 27 15:08:28 2022 -0700 perf vendor events: Update Intel tigerlake Update to v1.07, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the tigerlake files into perf and update mapfile.csv. Tested on a non-tigerlake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-27-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 59fd7d3225c2eee16a7010cb727b2f723a130822 Author: Ian Rogers Date: Wed Jul 27 15:08:27 2022 -0700 perf vendor events: Update Intel skylakex Update to v1.28, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the skylakex files into perf and update mapfile.csv. Tested with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok 90: perf all metricgroups test : Ok 91: perf all metrics test : Skip 93: perf all PMU test : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-26-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 35d652770172a41efe2a7a6ebfa75a7883f9b5ea Author: Ian Rogers Date: Wed Jul 27 15:08:26 2022 -0700 perf vendor events: Update Intel skylake Update to v53, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the skylake files into perf and update mapfile.csv. Tested on a non-skylake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-25-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 89072caf14c0b27f4b0c762c3deef4319bdf4d4a Author: Ian Rogers Date: Wed Jul 27 15:08:25 2022 -0700 perf vendor events: Update Intel silvermont Update to v14, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the silvermont files into perf and update mapfile.csv. Other than aligning whitespace this change just folds the mapfile.csv entries for silvertmont onto one line. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-24-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 34122105f9e89e76de510d684fcd0aa5de2ae5b0 Author: Ian Rogers Date: Wed Jul 27 15:08:24 2022 -0700 perf vendor events: Update Intel sapphirerapids Update to v1.04, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the sapphirerapids files into perf and update mapfile.csv. Tested on a non-sapphirerapids with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-23-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 777e1312440f3655f1cefceb4561adafc156a9ce Author: Ian Rogers Date: Wed Jul 27 15:08:23 2022 -0700 perf vendor events: Update Intel sandybridge Update to v17, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the sandybridge files into perf and update mapfile.csv. Tested on a non-sandybridge with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-22-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8fe33fd5d3a28a3429e0a311089b28a0be06d710 Author: Ian Rogers Date: Wed Jul 27 15:08:22 2022 -0700 perf vendor events: Update Intel nehalemex Update to v3, there are no TMA metrics for nehalemex. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the nehalemex files into perf and update mapfile.csv. Tested on a non-nehalemex with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Note: most of this change is just sorting the keys in the json dictionaries. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-21-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit bcc344a3bfc8a38e0dd6941c394db3a4d763d81c Author: Ian Rogers Date: Wed Jul 27 15:08:21 2022 -0700 perf vendor events: Update Intel nehalemep Update to v3, the are no TMA metrics for nehalemep. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the nehalemep files into perf and update mapfile.csv. Tested on a non-nehalemep with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-20-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1ab4ef06fa82b0e5c54a370073539b3ea6969463 Author: Ian Rogers Date: Wed Jul 27 15:08:20 2022 -0700 perf vendor events: Add Intel meteorlake Events are v1.00, there are no metrics yet. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the events and metrics. Manually copy the meteorlake files into perf and update mapfile.csv. Tested on a non-meteorlake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-19-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ae7bcd600e1ccfdef2373754587b49bed2fdb487 Author: Ian Rogers Date: Wed Jul 27 15:08:19 2022 -0700 perf vendor events: Update Intel knightslanding Update to v9, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the knightslanding files into perf and update mapfile.csv. Tested on a non-knightslanding with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Note: uncore-memory has become uncore-other as the topic was determined this way in the conversion scripts. For simplicity the scripts naming is maintained. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-18-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 376d8b581b7639c9c41cef8392e68f10aff613e3 Author: Ian Rogers Date: Wed Jul 27 15:08:18 2022 -0700 perf vendor events: Update Intel jaketown Update to v21, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the jaketown files into perf and update mapfile.csv. Tested on a non-jaketown with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-17-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6220136831e346152a58b13a5bde14dda1437446 Author: Ian Rogers Date: Wed Jul 27 15:08:17 2022 -0700 perf vendor events: Update Intel ivytown Update to v21, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the ivytown files into perf and update mapfile.csv. Tested on a non-ivytown with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-16-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 80c14459f6a3686b1e906da7067b51c0cc383967 Author: Ian Rogers Date: Wed Jul 27 15:08:16 2022 -0700 perf vendor events: Update Intel ivybridge Update to v22, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the ivybridge files into perf and update mapfile.csv. Tested on a non-ivybridge with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-15-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d214d0c2612a3070d21ee6355ca21ba768538fc6 Author: Ian Rogers Date: Wed Jul 27 15:08:15 2022 -0700 perf vendor events: Update Intel icelakex Update to v1.15, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the icelakex files into perf and update mapfile.csv. Tested with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok 90: perf all metricgroups test : Ok 91: perf all metrics test : Skip 93: perf all PMU test : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-14-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a4a4353ebf80b9fbb32ea8a38cb2a946930f5a14 Author: Ian Rogers Date: Wed Jul 27 15:08:14 2022 -0700 perf vendor events: Update Intel icelake Update to v1.14, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the icelake files into perf and update mapfile.csv. Tested on a non-icelake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-13-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 859fe0f4f2be73c1727fffaa4eed1a4e0d16cf5e Author: Ian Rogers Date: Wed Jul 27 15:08:13 2022 -0700 perf vendor events: Update Intel haswellx Update to v25, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the haswellx files into perf and update mapfile.csv. Tested with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok 90: perf all metricgroups test : Ok 91: perf all metrics test : Failed 93: perf all PMU test : Ok The test 91 failure is a pre-existing failure on the test system with the metric Load_Miss_Real_Latency which is fixed by prefixing it with --metric-no-group. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-12-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 8e6389f931444f1833baf4778cd1925463d9b7c0 Author: Ian Rogers Date: Wed Jul 27 15:08:12 2022 -0700 perf vendor events: Update Intel haswell Update to v31, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the haswell files into perf and update mapfile.csv. Tested on a non-haswell with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-11-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ae54f70dd9d5a962e823a3577271c5dddf046522 Author: Ian Rogers Date: Wed Jul 27 15:08:11 2022 -0700 perf vendor events: Update goldmontplus mapfile.csv Align end of file whitespace with what is generated by: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py Correct the version in mapfile.csv. Event json remains at v1.01, there are no goldmontplus metrics. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-10-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit beb2db9bed367ea28433f4a1088f0be2069529e5 Author: Ian Rogers Date: Wed Jul 27 15:08:10 2022 -0700 perf vendor events: Update goldmont mapfile.csv Align end of file whitespace with what is generated by: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py Modify mapfile.csv to have a missing goldmont cpuid. Event json remains at v13, there are no goldmont metrics. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-9-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3c9c31571105fcc1844b813743b676aaf63c9077 Author: Ian Rogers Date: Wed Jul 27 15:08:09 2022 -0700 perf vendor events: Update Intel elkhartlake Update to v1.03. Elkhartlake metrics aren't in TMA but basic metrics are left unchanged. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the elkhartlake files into perf and update mapfile.csv. Tested on a non-elkhartlake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-8-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4c392516accfe51a1aaf80ed163517646f8f0476 Author: Maíra Canal Date: Wed Jul 20 15:57:19 2022 -0300 Documentation: KUnit: Fix example with compilation error The Parameterized Testing example contains a compilation error, as the signature for the description helper function is void(*)(const struct sha1_test_case *, char *), and the struct is non-const. This is warned by Clang: error: initialization of ‘void (*)(struct sha1_test_case *, char *)’ from incompatible pointer type ‘void (*)(const struct sha1_test_case *, char *)’ [-Werror=incompatible-pointer-types] 33 | KUNIT_ARRAY_PARAM(sha1, cases, case_to_desc); | ^~~~~~~~~~~~ ../include/kunit/test.h:1339:70: note: in definition of macro ‘KUNIT_ARRAY_PARAM’ 1339 | void (*__get_desc)(typeof(__next), char *) = get_desc; \ Signed-off-by: Maíra Canal Reviewed-by: Daniel Latypov Reviewed-by: Brendan Higgins Signed-off-by: Shuah Khan commit f9d45862eca393ee2beb9e09db13bcb08f9588fc Author: Ian Rogers Date: Wed Jul 27 15:08:08 2022 -0700 perf vendor events: Update Intel cascadelakex Update to v1.16, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the cascadelakex files into perf and update mapfile.csv. Tested with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok 90: perf all metricgroups test : Ok 91: perf all metrics test : Skip 93: perf all PMU test : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-7-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9709ede1a179b29129c51c683c8375db6a1262b5 Author: Ian Rogers Date: Wed Jul 27 15:08:07 2022 -0700 perf vendor events: Update bonnell mapfile.csv Align end of file whitespace with what is generated by: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py Fold the mapfile.csv entries together with a more complex regular expression. This will reduce the pmu-events.c table size. The files following this change are still at v4. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-6-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a95ab294a50847ce75c8feb4530843795bba96fa Author: Ian Rogers Date: Wed Jul 27 15:08:06 2022 -0700 perf vendor events: Update Intel alderlake Update to v1.13, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the alderlake files into perf and update mapfile.csv. Tested on a non-alderlake with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-5-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ef908a192512bf45b542672973c2a2fffa13e2f2 Author: Ian Rogers Date: Wed Jul 27 15:08:05 2022 -0700 perf vendor events: Update Intel broadwellde Update to v7, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the broadwellde files into perf and update mapfile.csv. Tested on a non-broadwellde with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 1775634ea406af3befaa8d4e0dc5b245f8cb8fe1 Author: Ian Rogers Date: Wed Jul 27 15:08:04 2022 -0700 perf vendor events: Update Intel broadwell Update to v26, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the broadwell files into perf and update mapfile.csv. Tested on a non-broadwell with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4266081e33082f029c4d03c9412ea0674f00ded4 Author: Ian Rogers Date: Wed Jul 27 15:08:03 2022 -0700 perf vendor events: Update Intel broadwellx Update to v19, the metrics are based on TMA 4.4 full. Use script at: https://github.com/intel/event-converter-for-linux-perf/blob/master/download_and_gen.py to download and generate the latest events and metrics. Manually copy the broadwellx files into perf and update mapfile.csv. Tested with 'perf test': 10: PMU events : 10.1: PMU event table sanity : Ok 10.2: PMU event map aliases : Ok 10.3: Parsing of PMU event table metrics : Ok 10.4: Parsing of PMU event table metrics with fake PMUs : Ok 90: perf all metricgroups test : Ok 91: perf all metrics test : Skip 93: perf all PMU test : Ok Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220727220832.2865794-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6dd71251b9aeedd540fd7003bc5f73d59dd6dcb2 Author: Xin Gao Date: Fri Jul 22 10:23:37 2022 +0800 platform/x86: pmc_atom: Fix comment typo The double `of' is duplicated in line 50, remove one. Signed-off-by: Xin Gao Link: https://lore.kernel.org/r/20220722022337.15903-1-gaoxin@cdjrlc.com Signed-off-by: Hans de Goede commit 44ece4e1a3ecb07fd757699ffc2483463a202965 Author: Maciej Fijalkowski Date: Thu Jul 7 12:16:51 2022 +0200 ice: allow toggling loopback mode via ndo_set_features callback Add support for NETIF_F_LOOPBACK. This feature can be set via: $ ethtool -K eth0 loopback Feature can be useful for local data path tests. Acked-by: Jakub Kicinski Acked-by: John Fastabend Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit c67672fa26959b5b636c149634e69491a4d64206 Author: Maciej Fijalkowski Date: Thu Jul 7 12:16:50 2022 +0200 ice: compress branches in ice_set_features() Instead of rather verbose comparison of current netdev->features bits vs the incoming ones from user, let us compress them by a helper features set that will be the result of netdev->features XOR features. This way, current, extensive branches: if (features & NETIF_F_BIT && !(netdev->features & NETIF_F_BIT)) set_feature(true); else if (!(features & NETIF_F_BIT) && netdev->features & NETIF_F_BIT) set_feature(false); can become: netdev_features_t changed = netdev->features ^ features; if (changed & NETIF_F_BIT) set_feature(!!(features & NETIF_F_BIT)); This is nothing new as currently several other drivers use this approach, which I find much more convenient. Acked-by: John Fastabend Signed-off-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen commit a419526de6079e4b8a001bcbb8ac7370ba581963 Author: Michal Wilczynski Date: Mon Jul 4 15:12:27 2022 +0200 ice: Fix promiscuous mode not turning off When trust is turned off for the VF, the expectation is that promiscuous and allmulticast filters are removed. Currently default VSI filter is not getting cleared in this flow. Example: ip link set enp236s0f0 vf 0 trust on ip link set enp236s0f0v0 promisc on ip link set enp236s0f0 vf 0 trust off /* promiscuous mode is still enabled on VF0 */ Remove switch filters for both cases. This commit fixes above behavior by removing default VSI filters and allmulticast filters when vf-true-promisc-support is OFF. Signed-off-by: Michal Wilczynski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit d7393425e7c8819ac4a6dbc03f061954665f62ee Author: Michal Wilczynski Date: Mon Jul 4 15:12:26 2022 +0200 ice: Introduce enabling promiscuous mode on multiple VF's In current implementation default VSI switch filter is only able to forward traffic to a single VSI. This limits promiscuous mode with private flag 'vf-true-promisc-support' to a single VF. Enabling it on the second VF won't work. Also allmulticast support doesn't seem to be properly implemented when vf-true-promisc-support is true. Use standard ice_add_rule_internal() function that already implements forwarding to multiple VSI's instead of constructing AQ call manually. Add switch filter for allmulticast mode when vf-true-promisc-support is enabled. The same filter is added regardless of the flag - it doesn't matter for this case. Remove unnecessary fields in switch structure. From now on book keeping will be done by ice_add_rule_internal(). Refactor unnecessarily passed function arguments. To test: 1) Create 2 VM's, and two VF's. Attach VF's to VM's. 2) Enable promiscuous mode on both of them and check if traffic is seen on both of them. Signed-off-by: Michal Wilczynski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit e6abe8ff8e0c4fa905567775f48e102005ae960b Author: Maximilian Luz Date: Thu Jul 21 14:11:20 2022 +0200 platform/surface: gpe: Add support for 13" Intel version of Surface Laptop 4 The 13" Intel version of the Surface Laptop 4 uses the same GPE as the Surface Laptop Studio for wakeups via the lid. Set it up accordingly. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20220721121120.2002430-1-luzmaximilian@gmail.com Signed-off-by: Hans de Goede commit 40ec787e1adf302c11668d4cc69838f4d584187d Author: Dan Carpenter Date: Wed Jul 20 21:23:38 2022 +0300 platform/olpc: Fix uninitialized data in debugfs write The call to: size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); will succeed if at least one byte is written to the "cmdbuf" buffer. The "*ppos" value controls which byte is written. Another problem is that this code does not check for errors so it's possible for the entire buffer to be uninitialized. Inintialize the struct to zero to prevent reading uninitialized stack data. Debugfs is normally only writable by root so the impact of this bug is very minimal. Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3afe697b74bc6c59f0b9a9c89d5b163db56fd4b1 Author: Len Brown Date: Thu Jul 28 14:38:55 2022 -0400 tools/power turbostat: version 2022.07.28 update version number Signed-off-by: Len Brown commit b4b830a34d8046633231b7fe87f6f2cb6240dc9f Author: Vadim Pasternak Date: Tue Jul 19 18:35:40 2022 +0300 platform/mellanox: mlxreg-lc: Fix error flow and extend verbosity Fix error flow: - Clean-up client object in case of probing failure. - Prevent running remove routine in case of probing failure. Probing and removing are invoked by hotplug events raised upon line card insertion and removing. If probing procedure failed all data is cleared and there is nothing to do in remove routine. Fixes: 62f9529b8d5c ("platform/mellanox: mlxreg-lc: Add initial support for Nvidia line card devices") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20220719153540.61304-1-vadimp@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6287e6f0fdd36be4bbde6f539df6ea85eb2476c2 Author: Artem Bityutskiy Date: Tue Jul 26 18:29:35 2022 +0300 tools/power turbostat: do not decode ACC for ICX and SPR The ACC (automatic C-state conversion) feature was available on Sky Lake and Cascade Lake Xeons (SKX and CLX), but it is not available on Ice Lake and Sapphire Rapids Xeons (ICX and SPR). Therefore, stop decoding it for ICX and SPR. Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit 0e4d42af81471ab801e059e1feac8e27547230cf Author: Artem Bityutskiy Date: Tue Jul 26 18:29:34 2022 +0300 tools/power turbostat: fix SPR PC6 limits Sapphire Rapids Xeon (SPR) supports 2 flavors of PC6 - PC6N (non-retention) and PC6R (retention). Before this patch we used ICX package C-state limits, which was wrong, because ICX has only one PC6 flavor. With this patch, we use SKX PC6 limits for SPR, because they are the same. Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit eade39b2bf7f35294a814e62e2f5d8117615f18b Author: Artem Bityutskiy Date: Tue Jul 26 18:29:33 2022 +0300 tools/power turbostat: cleanup 'automatic_cstate_conversion_probe()' The 'automatic_cstate_conversion_probe()' function has a too long 'if' statement, convert it to a 'switch' statement in order to improve code readability a bit. Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit 684e40e99e594e0da1dc1b358fbd51c03c606e75 Author: Artem Bityutskiy Date: Tue Jul 26 18:29:32 2022 +0300 tools/power turbostat: separate SPR from ICX Before this patch, SPR platform was considered identical to ICX platform. This patch separates SPR support from ICX. This patch is a preparation for adding SPR-specific package C-state limits support. Signed-off-by: Artem Bityutskiy Reviewed-by: Chen Yu Signed-off-by: Len Brown commit 2db0e5eb9c4843cde76bb118750369ef231254e8 Author: Jiang Jian Date: Tue Jun 21 16:16:17 2022 +0800 tools/power turbosstat: fix comment remove duplicate "the" in comment Signed-off-by: Jiang Jian Signed-off-by: Len Brown commit 6f9cf553deb84ca5d390dfe7b23022fecbd838df Author: George D Sworo Date: Wed Jun 1 14:49:23 2022 -0700 tools/power turbostat: Support RAPTORLAKE P Add initial support for Raptorlake model Signed-off-by: George D Sworo Signed-off-by: Len Brown commit c9d959fc32a5f9312282817052d8986614f2dc08 Author: Hans de Goede Date: Thu Jul 28 20:06:35 2022 +0200 platform/x86: pmc_atom: Match all Lex BayTrail boards with critclk_systems DMI table The critclk_systems[] DMI match table already contains 2 Lex BayTrail boards and patches were just submitted to add 3 more entries for the following models: 3I380NX, 3I380A, 3I380CW. Looking at: https://www.lex.com.tw/products/embedded-ipc-board/ we can see that Lex BayTrail makes many embedded boards with multiple ethernet boards and none of their products are battery powered so we don't need to worry (too much) about power consumption when suspended. Add a new DMI match which simply matches all Lex BayTrail boards and drop the 2 existing board specific quirks. Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") Reported-by: Michael Schöne Reported-by: Paul Spooren Reported-by: Matwey V. Kornilov Signed-off-by: Hans de Goede commit 1c1313b50af7300865bcfa5b805122f06aa95422 Author: Zhang Rui Date: Fri May 13 13:02:29 2022 +0800 tools/power turbostat: add support for ALDERLAKE_N Add support for ALDERLAKE_N platform. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 4af184ee8b2c0a69a038483ba605510203bf015b Author: Len Brown Date: Tue May 31 17:29:13 2022 -1000 tools/power turbostat: dump secondary Turbo-Ratio-Limit Intel Performance Hybrid processors have a 2nd MSR describing the turbo limits enforced on the Ecores. Note, TRL and Secondary-TRL are usually R/O information, but on overclock-capable parts, they can be written. Signed-off-by: Len Brown commit 5d6228452c008d1186e8d6a5ef3079e608e7a888 Author: Len Brown Date: Tue May 31 17:21:06 2022 -1000 tools/power turbostat: simplify dump_turbo_ratio_limits() code cleanup only. no functional change. Signed-off-by: Len Brown commit 774627c59848844e4bc46bb45a0d13e3a1b723e9 Author: Len Brown Date: Tue May 31 17:08:25 2022 -1000 tools/power turbostat: dump CPUID.7.EDX.Hybrid CPUID leaf 7 EDX now tells us if the processor has hybrid CPUs Signed-off-by: Len Brown commit 7535249d10a889577b5d344e0bd52c28716a6e2f Author: Len Brown Date: Thu May 12 21:35:39 2022 -1000 tools/power turbostat: update turbostat.8 Update turbostat.8 to reflect new uncore frequency output (UncMHz) Also, refresh examples. Signed-off-by: Len Brown commit a5c6d65d06ebd09251fc3ff43f600d4d70966a4d Author: Len Brown Date: Thu May 12 21:35:39 2022 -1000 tools/power turbostat: Show uncore frequency When CONFIG_INTEL_UNCORE_FREQ_CONTROL is effective, (Linux 5.9 and later), print the current (and default) min and max uncore frequency limits. When that driver provides the current uncore frequency (Linux 5.18 and later), print a UncMHz column reflecting the current uncore frequency. Note that UncMHz is an instantaneous sample, not an average. eg. $ sudo ./turbostat -S --show frequency ... Uncore Frequency pkg0 die0: 800 - 3900 MHz (800 - 3900 MHz) ... Avg_MHz Busy% Bzy_MHz TSC_MHz UncMHz 28 0.70 4049 3095 3900 Signed-off-by: Len Brown commit 5e5fd36c58d6c820f7292ee492c3731c9a104a41 Author: Colin Ian King Date: Tue Apr 26 14:16:07 2022 +0100 tools/power turbostat: Fix file pointer leak Currently if a fscanf fails then an early return leaks an open file pointer. Fix this by fclosing the file before the return. Detected using static analysis with cppcheck: tools/power/x86/turbostat/turbostat.c:2039:3: error: Resource leak: fp [resourceLeak] Fixes: eae97e053fe3 ("tools/power turbostat: Support thermal throttle count print") Signed-off-by: Colin Ian King Acked-by: Chen Yu Reviewed-by: Tom Rix Signed-off-by: Len Brown commit e13da9a1dbe4c97431286660ec35eceb50003bb3 Author: Colin Ian King Date: Tue Apr 26 14:10:24 2022 +0100 tools/power turbostat: replace strncmp with single character compare Using strncmp for a single character comparison is overly complicated, just use a simpler single character comparison instead. Also stops static analyzers (such as cppcheck) from complaining about strncmp on non-null terminated strings. Signed-off-by: Colin Ian King Signed-off-by: Len Brown commit 033312336d67a2ca9b5ff4ad35e5dfd99042d2a3 Author: Chen Yu Date: Thu Apr 21 22:38:34 2022 +0800 tools/power turbostat: print the kernel boot commandline It would be handy to have cmdline in turbostat output. For example, according to the turbostat output, there are no C-states requested. In this case the user is very curious if something like intel_idle.max_cstate=0 was used, or may be idle=none too. It is also curious whether things like intel_pstate=nohwp were used. Print the boot command line accordingly: turbostat version 21.05.04 - Len Brown Kernel command line: BOOT_IMAGE=/boot/vmlinuz-5.16.0+ root=UUID= b42359ed-1e05-42eb-8757-6bf2a1c19070 ro quiet splash vt.handoff=7 Suggested-by: Artem Bityutskiy Signed-off-by: Chen Yu Signed-off-by: Len Brown commit fb5e29df8d15a131a02a4e04bbd9df8450eecc7d Author: Zhang Rui Date: Thu Apr 21 22:19:08 2022 +0800 tools/power turbostat: Introduce support for RaptorLake RaptorLake is compatible with AlderLake. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit d8fae2504efee73958cbbf9c7122f13f95495222 Author: Jacob Keller Date: Thu Jul 21 14:30:01 2022 -0700 igb: convert .adjfreq to .adjfine The 82576 PTP implementation still uses .adjfreq instead of using the newer .adjfine. This implementation uses a pre-simplified calculation since the base increment value for the 82576 is just 16 * 2^19. Converting this into scaled_ppm is tricky, and makes the intent a bit less clear. Simply convert to the normal flow of multiplying the base increment value by the scaled_ppm and then dividing by 1000000ULL << 16. This can be implemented using mul_u64_u64_div_u64 which can avoid the possible overflow that might occur for large adjustments. Use of .adjfine can improve the precision of small adjustments and gets us one driver closer to removing the old implementation from the kernel entirely. Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7edc3a68038ab151a8791ddb6217755a5e4a5809 Author: Kai Huang Date: Thu Jul 28 15:04:52 2022 +1200 KVM, x86/mmu: Fix the comment around kvm_tdp_mmu_zap_leafs() Now kvm_tdp_mmu_zap_leafs() only zaps leaf SPTEs but not any non-root pages within that GFN range anymore, so the comment around it isn't right. Fix it by shifting the comment from tdp_mmu_zap_leafs() instead of duplicating it, as tdp_mmu_zap_leafs() is static and is only called by kvm_tdp_mmu_zap_leafs(). Opportunistically tweak the blurb about SPTEs being cleared to (a) say "zapped" instead of "cleared" because "cleared" will be wrong if/when KVM allows a non-zero value for non-present SPTE (i.e. for Intel TDX), and (b) to clarify that a flush is needed if and only if a SPTE has been zapped since MMU lock was last acquired. Fixes: f47e5bbbc92f ("KVM: x86/mmu: Zap only TDP MMU leafs in zap range and mmu_notifier unmap") Suggested-by: Sean Christopherson Reviewed-by: Sean Christopherson Signed-off-by: Kai Huang Message-Id: <20220728030452.484261-1-kai.huang@intel.com> Signed-off-by: Paolo Bonzini commit 6fac42f127b8e8464b8c13036dfed825981881d9 Author: Jarkko Sakkinen Date: Thu Jul 28 08:09:19 2022 +0300 KVM: SVM: Dump Virtual Machine Save Area (VMSA) to klog As Virtual Machine Save Area (VMSA) is essential in troubleshooting attestation, dump it to the klog with the KERN_DEBUG level of priority. Cc: Jarkko Sakkinen Suggested-by: Harald Hoyer Signed-off-by: Jarkko Sakkinen Message-Id: <20220728050919.24113-1-jarkko@profian.com> Signed-off-by: Paolo Bonzini commit 5a5542324a4af2e161bb8709d330fab7d895cd6e Author: Jacob Keller Date: Thu Jul 21 14:30:00 2022 -0700 ixgbe: convert .adjfreq to .adjfine Convert the ixgbe PTP frequency adjustment implementations from .adjfreq to .adjfine. This allows using the scaled parts per million adjustment from the PTP core and results in a more precise adjustment for small corrections. To avoid overflow, use mul_u64_u64_div_u64 to perform the calculation. On X86 platforms, this will use instructions that perform the operations with 128bit intermediate values. For other architectures, the implementation will limit the loss of precision as much as possible. This change slightly improves the precision of frequency adjustments for all ixgbe based devices, and gets us one driver closer to being able to remove the older .adjfreq implementation from the kernel. Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit ccd3bf98592117f59be2daa0f2ca00f352d7abbc Author: Jacob Keller Date: Thu Jul 21 14:29:59 2022 -0700 i40e: convert .adjfreq to .adjfine The i40e driver currently implements the .adjfreq handler for frequency adjustments. This takes the adjustment parameter in parts per billion. The PTP core supports .adjfine which provides an adjustment in scaled parts per million. This has a higher resolution and can result in more precise adjustments for small corrections. Convert the existing .adjfreq implementation to the newer .adjfine implementation. This is trivial since it just requires changing the divisor from 1000000000ULL to (1000000ULL << 16) in the mul_u64_u64_div_u64 call. This improves the precision of the adjustments and gets us one driver closer to removing the old .adjfreq support from the kernel. Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3626a690b717c18a969274e1fe000f8885d5afad Author: Jacob Keller Date: Thu Jul 21 14:29:58 2022 -0700 i40e: use mul_u64_u64_div_u64 for PTP frequency calculation The i40e device has a different clock rate depending on the current link speed. This requires using a different increment rate for the PTP clock registers. For slower link speeds, the base increment value is larger. Directly multiplying the larger increment value by the parts per billion adjustment might overflow. To avoid this, the i40e implementation defaults to using the lower increment value and then multiplying the adjustment afterwards. This causes a loss of precision for lower link speeds. We can fix this by using mul_u64_u64_div_u64 instead of performing the multiplications using standard C operations. On X86, this will use special instructions that perform the multiplication and division with 128bit intermediate values. For other architectures, the fallback implementation will limit the loss of precision for large values. Small adjustments don't overflow anyways and won't lose precision at all. This allows first multiplying the base increment value and then performing the adjustment calculation, since we no longer fear overflowing. It also makes it easier to convert to the even more precise .adjfine implementation in a following change. Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit abab010f16378c73e14257573bbcbad4378e80c3 Author: Jacob Keller Date: Thu Jul 21 14:29:57 2022 -0700 e1000e: convert .adjfreq to .adjfine The PTP implementation for the e1000e driver uses the older .adjfreq method. This method takes an adjustment in parts per billion. The newer .adjfine implementation uses scaled_ppm. The use of scaled_ppm allows for finer grained adjustments and is preferred over using the older implementation. Make use of mul_u64_u64_div_u64 in order to handle possible overflow of the multiplication used to calculate the desired adjustment to the hardware increment value. Signed-off-by: Jacob Keller Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit ab8e8db27e829bc7077c4db36ed9e3e0c5daeae8 Author: Jacob Keller Date: Thu Jul 21 14:29:56 2022 -0700 e1000e: remove unnecessary range check in e1000e_phc_adjfreq The e1000e_phc_adjfreq function validates that the input delta is within the maximum range. This is already handled by the core PTP code and this is a duplicate and thus unnecessary check. It also complicates refactoring to use the newer .adjfine implementation, where the input is no longer specified in parts per billion. Remove the range validation check. Signed-off-by: Jacob Keller Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 4488df1401522cd263166ef8799d56661baf83b0 Author: Jacob Keller Date: Thu Jul 21 14:29:54 2022 -0700 ice: implement adjfine with mul_u64_u64_div_u64 The PTP frequency adjustment code needs to determine an appropriate adjustment given an input scaled_ppm adjustment. We calculate the adjustment to the register by multiplying the base (nominal) increment value by the scaled_ppm and then dividing by the scaled one million value. For very large adjustments, this might overflow. To avoid this, both the scaled_ppm and divisor values are downshifted. We can avoid that on X86 architectures by using mul_u64_u64_div_u64. This helper function will perform the multiplication and division with 128bit intermediate values. We know that scaled_ppm is never larger than the divisor so this operation will never result in an overflow. This improves the accuracy of the calculations for large adjustment values on X86. It is likely an improvement on other architectures as well because the default implementation of mul_u64_u64_div_u64 is smarter than the original approach taken in the ice code. Additionally, this implementation is easier to read, using fewer local variables and lines of code to implement. Signed-off-by: Jacob Keller Tested-by: Gurucharan (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 6c6ab524cfae0799e55c82b2c1d61f1af0156f8d Author: Sean Christopherson Date: Sat Jul 23 01:30:29 2022 +0000 KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT Treat the NX bit as valid when using NPT, as KVM will set the NX bit when the NX huge page mitigation is enabled (mindblowing) and trigger the WARN that fires on reserved SPTE bits being set. KVM has required NX support for SVM since commit b26a71a1a5b9 ("KVM: SVM: Refuse to load kvm_amd if NX support is not available") for exactly this reason, but apparently it never occurred to anyone to actually test NPT with the mitigation enabled. ------------[ cut here ]------------ spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000 WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm] Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 RIP: 0010:make_spte+0x327/0x340 [kvm] Call Trace: tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm] kvm_tdp_mmu_map+0x343/0x3b0 [kvm] direct_page_fault+0x1ae/0x2a0 [kvm] kvm_tdp_page_fault+0x7d/0x90 [kvm] kvm_mmu_page_fault+0xfb/0x2e0 [kvm] npf_interception+0x55/0x90 [kvm_amd] svm_invoke_exit_handler+0x31/0xf0 [kvm_amd] svm_handle_exit+0xf6/0x1d0 [kvm_amd] vcpu_enter_guest+0xb6d/0xee0 [kvm] ? kvm_pmu_trigger_event+0x6d/0x230 [kvm] vcpu_run+0x65/0x2c0 [kvm] kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm] kvm_vcpu_ioctl+0x551/0x610 [kvm] __se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220723013029.1753623-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1bd9dfec9fd419920572b057e2c98d9877190b06 Author: Suravee Suthikulpanit Date: Mon Jul 25 00:33:56 2022 -0500 KVM: x86: Do not block APIC write for non ICR registers The commit 5413bcba7ed5 ("KVM: x86: Add support for vICR APIC-write VM-Exits in x2APIC mode") introduces logic to prevent APIC write for offset other than ICR in kvm_apic_write_nodecode() function. This breaks x2AVIC support, which requires KVM to trap and emulate x2APIC MSR writes. Therefore, removes the warning and modify to logic to allow MSR write. Fixes: 5413bcba7ed5 ("KVM: x86: Add support for vICR APIC-write VM-Exits in x2APIC mode") Cc: Zeng Guang Suggested-by: Sean Christopherson Signed-off-by: Suravee Suthikulpanit Message-Id: <20220725053356.4275-1-suravee.suthikulpanit@amd.com> Signed-off-by: Paolo Bonzini commit 0a8735a6acf36ac35499563dc44f3e3d5034a2ce Author: Suravee Suthikulpanit Date: Sun Jul 24 22:34:28 2022 -0500 KVM: SVM: Do not virtualize MSR accesses for APIC LVTT register AMD does not support APIC TSC-deadline timer mode. AVIC hardware will generate GP fault when guest kernel writes 1 to bits [18] of the APIC LVTT register (offset 0x32) to set the timer mode. (Note: bit 18 is reserved on AMD system). Therefore, always intercept and let KVM emulate the MSR accesses. Fixes: f3d7c8aa6882 ("KVM: SVM: Fix x2APIC MSRs interception") Signed-off-by: Suravee Suthikulpanit Message-Id: <20220725033428.3699-1-suravee.suthikulpanit@amd.com> Signed-off-by: Paolo Bonzini commit 7842efa5e194122ba2d2795102c70db00906024e Author: Andrey Strachuk Date: Tue Jul 19 14:03:41 2022 +0300 platform/x86: sony-laptop: Remove useless comparisons in sony_pic_read_possible_resource() Local variable 'p' is initialized by an address of field of acpi_resource structure, so it does not make sense to compare 'p' with NULL. Local variable 'io' is initialized by an address of field of acpi_resource structure, so it does not make sense to compare 'io' with NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Strachuk Link: https://lore.kernel.org/r/20220719110341.7239-1-strochuk@ispras.ru Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c55ae10230a719020d8ad5a221cbe347d5225157 Author: Xin Gao Date: Mon Jul 18 20:49:07 2022 +0800 tools/power/x86/intel-speed-select: Remove unneeded semicolon Remove an unneeded semicolon. Signed-off-by: Xin Gao Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit d9f74d98bbec978edbf860f729b531281ba0d8ff Author: Dan Carpenter Date: Mon Jul 18 16:17:17 2022 +0300 tools/power/x86/intel-speed-select: Fix off by one check Change > MAX_DIE_PER_PACKAGE to >= MAX_DIE_PER_PACKAGE to prevent accessing one element beyond the end of the array. Fixes: 7fd786dfbd2c ("tools/power/x86/intel-speed-select: OOB daemon mode") Signed-off-by: Dan Carpenter Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 265792d0dede9259f0ca56bb3efcc23eceee7d01 Author: Waiman Long Date: Wed Jul 27 20:58:15 2022 -0400 cgroup: Skip subtree root in cgroup_update_dfl_csses() The cgroup_update_dfl_csses() function updates css associations when a cgroup's subtree_control file is modified. Any changes made to a cgroup's subtree_control file, however, will only affect its descendants but not the cgroup itself. So there is no point in migrating csses associated with that cgroup. We can skip them instead. Signed-off-by: Waiman Long Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit ce30d8b976b46b697cfcbc0aa5dab03edb0301dc Author: Sean Christopherson Date: Tue Jun 7 21:36:04 2022 +0000 KVM: selftests: Verify VMX MSRs can be restored to KVM-supported values Verify that KVM allows toggling VMX MSR bits to be "more" restrictive, and also allows restoring each MSR to KVM's original, less restrictive value. Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-16-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a910b5ab6b250a88fff1866bf708642d83317466 Author: Sean Christopherson Date: Tue Jun 7 21:36:00 2022 +0000 KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP Make UMIP an "allowed-1" bit CR4_FIXED1 MSR when KVM is emulating UMIP. KVM emulates UMIP for both L1 and L2, and so should enumerate that L2 is allowed to have CR4.UMIP=1. Not setting the bit doesn't immediately break nVMX, as KVM does set/clear the bit in CR4_FIXED1 in response to a guest CPUID update, i.e. KVM will correctly (dis)allow nested VM-Entry based on whether or not UMIP is exposed to L1. That said, KVM should enumerate the bit as being allowed from time zero, e.g. userspace will see the wrong value if the MSR is read before CPUID is written. Fixes: 0367f205a3b7 ("KVM: vmx: add support for emulating UMIP") Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-12-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 9389d5774aca444b6343d3b5f9b05f0820fe705e Author: Paolo Bonzini Date: Fri Jul 22 22:44:09 2022 +0000 Revert "KVM: nVMX: Expose load IA32_PERF_GLOBAL_CTRL VM-{Entry,Exit} control" This reverts commit 03a8871add95213827e2bea84c12133ae5df952e. Since commit 03a8871add95 ("KVM: nVMX: Expose load IA32_PERF_GLOBAL_CTRL VM-{Entry,Exit} control"), KVM has taken ownership of the "load IA32_PERF_GLOBAL_CTRL" VMX entry/exit control bits, trying to set these bits in the IA32_VMX_TRUE_{ENTRY,EXIT}_CTLS MSRs if the guest's CPUID supports the architectural PMU (CPUID[EAX=0Ah].EAX[7:0]=1), and clear otherwise. This was a misguided attempt at mimicking what commit 5f76f6f5ff96 ("KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled", 2018-10-01) did for MPX. However, that commit was a workaround for another KVM bug and not something that should be imitated. Mucking with the VMX MSRs creates a subtle, difficult to maintain ABI as KVM must ensure that any internal changes, e.g. to how KVM handles _any_ guest CPUID changes, yield the same functional result. Therefore, KVM's policy is to let userspace have full control of the guest vCPU model so long as the host kernel is not at risk. Now that KVM really truly ensures kvm_set_msr() will succeed by loading PERF_GLOBAL_CTRL if and only if it exists, revert KVM's misguided and roundabout behavior. Signed-off-by: Paolo Bonzini [sean: make it a pure revert] Signed-off-by: Sean Christopherson Message-Id: <20220722224409.1336532-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4496a6f9b45e8cd83343ad86a3984d614e22cf54 Author: Sean Christopherson Date: Fri Jul 22 22:44:08 2022 +0000 KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists Attempt to load PERF_GLOBAL_CTRL during nested VM-Enter/VM-Exit if and only if the MSR exists (according to the guest vCPU model). KVM has very misguided handling of VM_{ENTRY,EXIT}_LOAD_IA32_PERF_GLOBAL_CTRL and attempts to force the nVMX MSR settings to match the vPMU model, i.e. to hide/expose the control based on whether or not the MSR exists from the guest's perspective. KVM's modifications fail to handle the scenario where the vPMU is hidden from the guest _after_ being exposed to the guest, e.g. by userspace doing multiple KVM_SET_CPUID2 calls, which is allowed if done before any KVM_RUN. nested_vmx_pmu_refresh() is called if and only if there's a recognized vPMU, i.e. KVM will leave the bits in the allow state and then ultimately reject the MSR load and WARN. KVM should not force the VMX MSRs in the first place. KVM taking control of the MSRs was a misguided attempt at mimicking what commit 5f76f6f5ff96 ("KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled", 2018-10-01) did for MPX. However, the MPX commit was a workaround for another KVM bug and not something that should be imitated (and it should never been done in the first place). In other words, KVM's ABI _should_ be that userspace has full control over the MSRs, at which point triggering the WARN that loading the MSR must not fail is trivial. The intent of the WARN is still valid; KVM has consistency checks to ensure that vmcs12->{guest,host}_ia32_perf_global_ctrl is valid. The problem is that '0' must be considered a valid value at all times, and so the simple/obvious solution is to just not actually load the MSR when it does not exist. It is userspace's responsibility to provide a sane vCPU model, i.e. KVM is well within its ABI and Intel's VMX architecture to skip the loads if the MSR does not exist. Fixes: 03a8871add95 ("KVM: nVMX: Expose load IA32_PERF_GLOBAL_CTRL VM-{Entry,Exit} control") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220722224409.1336532-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit b663f0b5f3d665c261256d1f76e98f077c6e56af Author: Sean Christopherson Date: Fri Jul 22 22:44:07 2022 +0000 KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL Add a helper to check of the guest PMU has PERF_GLOBAL_CTRL, which is unintuitive _and_ diverges from Intel's architecturally defined behavior. Even worse, KVM currently implements the check using two different (but equivalent) checks, _and_ there has been at least one attempt to add a _third_ flavor. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220722224409.1336532-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 93255bf92939d948bc86d81c6bb70bb0fecc5db1 Author: Sean Christopherson Date: Fri Jul 22 22:44:06 2022 +0000 KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU Mark all MSR_CORE_PERF_GLOBAL_CTRL and MSR_CORE_PERF_GLOBAL_OVF_CTRL bits as reserved if there is no guest vPMU. The nVMX VM-Entry consistency checks do not check for a valid vPMU prior to consuming the masks via kvm_valid_perf_global_ctrl(), i.e. may incorrectly allow a non-zero mask to be loaded via VM-Enter or VM-Exit (well, attempted to be loaded, the actual MSR load will be rejected by intel_is_valid_msr()). Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220722224409.1336532-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 8805875aa4732340af49aa601f59a60e482f635f Author: Paolo Bonzini Date: Fri Jul 22 05:07:39 2022 -0400 Revert "KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled" Since commit 5f76f6f5ff96 ("KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled"), KVM has taken ownership of the "load IA32_BNDCFGS" and "clear IA32_BNDCFGS" VMX entry/exit controls, trying to set these bits in the IA32_VMX_TRUE_{ENTRY,EXIT}_CTLS MSRs if the guest's CPUID supports MPX, and clear otherwise. The intent of the patch was to apply it to L0 in order to work around L1 kernels that lack the fix in commit 691bd4340bef ("kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS", 2017-07-04): by hiding the control bits from L0, L1 hides BNDCFGS from KVM_GET_MSR_INDEX_LIST, and the L1 bug is neutralized even in the lack of commit 691bd4340bef. This was perhaps a sensible kludge at the time, but a horrible idea in the long term and in fact it has not been extended to other CPUID bits like these: X86_FEATURE_LM => VM_EXIT_HOST_ADDR_SPACE_SIZE, VM_ENTRY_IA32E_MODE, VMX_MISC_SAVE_EFER_LMA X86_FEATURE_TSC => CPU_BASED_RDTSC_EXITING, CPU_BASED_USE_TSC_OFFSETTING, SECONDARY_EXEC_TSC_SCALING X86_FEATURE_INVPCID_SINGLE => SECONDARY_EXEC_ENABLE_INVPCID X86_FEATURE_MWAIT => CPU_BASED_MONITOR_EXITING, CPU_BASED_MWAIT_EXITING X86_FEATURE_INTEL_PT => SECONDARY_EXEC_PT_CONCEAL_VMX, SECONDARY_EXEC_PT_USE_GPA, VM_EXIT_CLEAR_IA32_RTIT_CTL, VM_ENTRY_LOAD_IA32_RTIT_CTL X86_FEATURE_XSAVES => SECONDARY_EXEC_XSAVES These days it's sort of common knowledge that any MSR in KVM_GET_MSR_INDEX_LIST must allow *at least* setting it with KVM_SET_MSR to a default value, so it is unlikely that something like commit 5f76f6f5ff96 will be needed again. So revert it, at the potential cost of breaking L1s with a 6 year old kernel. While in principle the L0 owner doesn't control what runs on L1, such an old hypervisor would probably have many other bugs. Signed-off-by: Paolo Bonzini commit f8ae08f9789ad59d318ea75b570caa454aceda81 Author: Sean Christopherson Date: Tue Jun 7 21:35:54 2022 +0000 KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value Restrict the nVMX MSRs based on KVM's config, not based on the guest's current config. Using the guest's config to audit the new config prevents userspace from restoring the original config (KVM's config) if at any point in the past the guest's config was restricted in any way. Fixes: 62cc6b9dc61e ("KVM: nVMX: support restore of VMX capability MSRs") Cc: stable@vger.kernel.org Cc: David Matlack Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a645c2b506fbca06f671b22f0991bd99064d7e69 Author: Sean Christopherson Date: Tue Jun 7 21:35:53 2022 +0000 KVM: nVMX: Rename handle_vm{on,off}() to handle_vmx{on,off}() Rename the exit handlers for VMXON and VMXOFF to match the instruction names, the terms "vmon" and "vmoff" are not used anywhere in Intel's documentation, nor are they used elsehwere in KVM. Sadly, the exit reasons are exposed to userspace and so cannot be renamed without breaking userspace. :-( Fixes: ec378aeef9df ("KVM: nVMX: Implement VMXON and VMXOFF") Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c7d855c2aff2d511fd60ee2e356134c4fb394799 Author: Sean Christopherson Date: Tue Jun 7 21:35:52 2022 +0000 KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 Inject a #UD if L1 attempts VMXON with a CR0 or CR4 that is disallowed per the associated nested VMX MSRs' fixed0/1 settings. KVM cannot rely on hardware to perform the checks, even for the few checks that have higher priority than VM-Exit, as (a) KVM may have forced CR0/CR4 bits in hardware while running the guest, (b) there may incompatible CR0/CR4 bits that have lower priority than VM-Exit, e.g. CR0.NE, and (c) userspace may have further restricted the allowed CR0/CR4 values by manipulating the guest's nested VMX MSRs. Note, despite a very strong desire to throw shade at Jim, commit 70f3aac964ae ("kvm: nVMX: Remove superfluous VMX instruction fault checks") is not to blame for the buggy behavior (though the comment...). That commit only removed the CR0.PE, EFLAGS.VM, and COMPATIBILITY mode checks (though it did erroneously drop the CPL check, but that has already been remedied). KVM may force CR0.PE=1, but will do so only when also forcing EFLAGS.VM=1 to emulate Real Mode, i.e. hardware will still #UD. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216033 Fixes: ec378aeef9df ("KVM: nVMX: Implement VMXON and VMXOFF") Reported-by: Eric Li Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit ca58f3aa53d165afe4ab74c755bc2f6d168617ac Author: Sean Christopherson Date: Tue Jun 7 21:35:51 2022 +0000 KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks Check that the guest (L2) and host (L1) CR4 values that would be loaded by nested VM-Enter and VM-Exit respectively are valid with respect to KVM's (L0 host) allowed CR4 bits. Failure to check KVM reserved bits would allow L1 to load an illegal CR4 (or trigger hardware VM-Fail or failed VM-Entry) by massaging guest CPUID to allow features that are not supported by KVM. Amusingly, KVM itself is an accomplice in its doom, as KVM adjusts L1's MSR_IA32_VMX_CR4_FIXED1 to allow L1 to enable bits for L2 based on L1's CPUID model. Note, although nested_{guest,host}_cr4_valid() are _currently_ used if and only if the vCPU is post-VMXON (nested.vmxon == true), that may not be true in the future, e.g. emulating VMXON has a bug where it doesn't check the allowed/required CR0/CR4 bits. Cc: stable@vger.kernel.org Fixes: 3899152ccbf4 ("KVM: nVMX: fix checks on CR{0,4} during virtual VMX operation") Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c33f6f2228fe8517e38941a508e9f905f99ecba9 Author: Sean Christopherson Date: Tue Jun 7 21:35:50 2022 +0000 KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits Split the common x86 parts of kvm_is_valid_cr4(), i.e. the reserved bits checks, into a separate helper, __kvm_is_valid_cr4(), and export only the inner helper to vendor code in order to prevent nested VMX from calling back into vmx_is_valid_cr4() via kvm_is_valid_cr4(). On SVM, this is a nop as SVM doesn't place any additional restrictions on CR4. On VMX, this is also currently a nop, but only because nested VMX is missing checks on reserved CR4 bits for nested VM-Enter. That bug will be fixed in a future patch, and could simply use kvm_is_valid_cr4() as-is, but nVMX has _another_ bug where VMXON emulation doesn't enforce VMX's restrictions on CR0/CR4. The cleanest and most intuitive way to fix the VMXON bug is to use nested_host_cr{0,4}_valid(). If the CR4 variant routes through kvm_is_valid_cr4(), using nested_host_cr4_valid() won't do the right thing for the VMXON case as vmx_is_valid_cr4() enforces VMX's restrictions if and only if the vCPU is post-VMXON. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220607213604.3346000-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit cfe12e64b0657142824819d939fcfe62f14104a1 Author: Sean Christopherson Date: Fri Jul 15 23:21:07 2022 +0000 KVM: selftests: Add an option to run vCPUs while disabling dirty logging Add a command line option to dirty_log_perf_test to run vCPUs for the entire duration of disabling dirty logging. By default, the test stops running runs vCPUs before disabling dirty logging, which is faster but less interesting as it doesn't stress KVM's handling of contention between page faults and the zapping of collapsible SPTEs. Enabling the flag also lets the user verify that KVM is indeed rebuilding zapped SPTEs as huge pages by checking KVM's pages_{1g,2m,4k} stats. Without vCPUs to fault in the zapped SPTEs, the stats will show that KVM is zapping pages, but they never show whether or not KVM actually allows huge pages to be recreated. Note! Enabling the flag can _significantly_ increase runtime, especially if the thread that's disabling dirty logging doesn't have a dedicated pCPU, e.g. if all pCPUs are used to run vCPUs. Signed-off-by: Sean Christopherson Message-Id: <20220715232107.3775620-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 85f44f8cc07b5f61bef30fe5343d629fd4263230 Author: Sean Christopherson Date: Fri Jul 15 23:21:06 2022 +0000 KVM: x86/mmu: Don't bottom out on leafs when zapping collapsible SPTEs When zapping collapsible SPTEs in the TDP MMU, don't bottom out on a leaf SPTE now that KVM doesn't require a PFN to compute the host mapping level, i.e. now that there's no need to first find a leaf SPTE and then step back up. Drop the now unused tdp_iter_step_up(), as it is not the safest of helpers (using any of the low level iterators requires some understanding of the various side effects). Signed-off-by: Sean Christopherson Message-Id: <20220715232107.3775620-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 65e3b446bcceaac7448cb25a2a5bf4adbcf25fe6 Author: Sean Christopherson Date: Fri Jul 15 23:21:05 2022 +0000 KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Add a comment to document how host_pfn_mapping_level() can be used safely, as the line between safe and dangerous is quite thin. E.g. if KVM were to ever support in-place promotion to create huge pages, consuming the level is safe if the caller holds mmu_lock and checks that there's an existing _leaf_ SPTE, but unsafe if the caller only checks that there's a non-leaf SPTE. Opportunistically tweak the existing comments to explicitly document why KVM needs to use READ_ONCE(). No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715232107.3775620-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a8ac499bb6abbd55fe60f1dc2d053f4b5b13aa73 Author: Sean Christopherson Date: Fri Jul 15 23:21:04 2022 +0000 KVM: x86/mmu: Don't require refcounted "struct page" to create huge SPTEs Drop the requirement that a pfn be backed by a refcounted, compound or or ZONE_DEVICE, struct page, and instead rely solely on the host page tables to identify huge pages. The PageCompound() check is a remnant of an old implementation that identified (well, attempt to identify) huge pages without walking the host page tables. The ZONE_DEVICE check was added as an exception to the PageCompound() requirement. In other words, neither check is actually a hard requirement, if the primary has a pfn backed with a huge page, then KVM can back the pfn with a huge page regardless of the backing store. Dropping the @pfn parameter will also allow KVM to query the max host mapping level without having to first get the pfn, which is advantageous for use outside of the page fault path where KVM wants to take action if and only if a page can be mapped huge, i.e. avoids the pfn lookup for gfns that can't be backed with a huge page. Cc: Mingwei Zhang Signed-off-by: Sean Christopherson Reviewed-by: Mingwei Zhang Message-Id: <20220715232107.3775620-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit d5e90a699875ce552d0058d05b9b4b458b46fa6a Author: Sean Christopherson Date: Fri Jul 15 23:00:16 2022 +0000 KVM: x86/mmu: Restrict mapping level based on guest MTRR iff they're used Restrict the mapping level for SPTEs based on the guest MTRRs if and only if KVM may actually use the guest MTRRs to compute the "real" memtype. For all forms of paging, guest MTRRs are purely virtual in the sense that they are completely ignored by hardware, i.e. they affect the memtype only if software manually consumes them. The only scenario where KVM consumes the guest MTRRs is when shadow_memtype_mask is non-zero and the guest has non-coherent DMA, in all other cases KVM simply leaves the PAT field in SPTEs as '0' to encode WB memtype. Note, KVM may still ultimately ignore guest MTRRs, e.g. if the backing pfn is host MMIO, but false positives are ok as they only cause a slight performance blip (unless the guest is doing weird things with its MTRRs, which is extremely unlikely). Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Message-Id: <20220715230016.3762909-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 38bf9d7bf277bb40c4dceedd2b5eb87d02c36d5b Author: Sean Christopherson Date: Fri Jul 15 23:00:15 2022 +0000 KVM: x86/mmu: Add shadow mask for effective host MTRR memtype Add shadow_memtype_mask to capture that EPT needs a non-zero memtype mask instead of relying on TDP being enabled, as NPT doesn't need a non-zero mask. This is a glorified nop as kvm_x86_ops.get_mt_mask() returns zero for NPT anyways. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Message-Id: <20220715230016.3762909-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 82ffad2ddf5d7b5b9c14c705fed4a7d5f2ec4c38 Author: Sean Christopherson Date: Fri Jul 15 23:00:14 2022 +0000 KVM: x86: Drop unnecessary goto+label in kvm_arch_init() Return directly if kvm_arch_init() detects an error before doing any real work, jumping through a label obfuscates what's happening and carries the unnecessary risk of leaving 'r' uninitialized. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Message-Id: <20220715230016.3762909-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 94bda2f4cd868046094351b06b87d7d1053e990d Author: Sean Christopherson Date: Fri Jul 15 23:00:13 2022 +0000 KVM: x86: Reject loading KVM if host.PAT[0] != WB Reject KVM if entry '0' in the host's IA32_PAT MSR is not programmed to writeback (WB) memtype. KVM subtly relies on IA32_PAT entry '0' to be programmed to WB by leaving the PAT bits in shadow paging and NPT SPTEs as '0'. If something other than WB is in PAT[0], at _best_ guests will suffer very poor performance, and at worst KVM will crash the system by breaking cache-coherency expecations (e.g. using WC for guest memory). Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Message-Id: <20220715230016.3762909-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 01e69cef63f88d809181f62f03a01d7295f2d5a4 Author: Suravee Suthikulpanit Date: Mon Jul 18 03:38:33 2022 -0500 KVM: SVM: Fix x2APIC MSRs interception The index for svm_direct_access_msrs was incorrectly initialized with the APIC MMIO register macros. Fix by introducing a macro for calculating x2APIC MSRs. Fixes: 5c127c85472c ("KVM: SVM: Adding support for configuring x2APIC MSRs interception") Cc: Maxim Levitsky Signed-off-by: Suravee Suthikulpanit Message-Id: <20220718083833.222117-1-suravee.suthikulpanit@amd.com> Reviewed-by: Maxim Levitsky Signed-off-by: Paolo Bonzini commit 3c2e10373ec73cdd78411a28a14a9abb9da1bef6 Author: Sean Christopherson Date: Fri Jul 15 22:42:26 2022 +0000 KVM: x86/mmu: Remove underscores from __pte_list_remove() Remove the underscores from __pte_list_remove(), the function formerly known as pte_list_remove() is now named kvm_zap_one_rmap_spte() to show that it zaps rmaps/PTEs, i.e. doesn't just remove an entry from a list. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-8-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 9202aee816c84d69179f94193c5dd321bb0e8530 Author: Sean Christopherson Date: Fri Jul 15 22:42:25 2022 +0000 KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Rename pte_list_remove() and pte_list_destroy() to kvm_zap_one_rmap_spte() and kvm_zap_all_rmap_sptes() respectively to document that (a) they zap SPTEs and (b) to better document how they differ (remove vs. destroy does not exactly scream "one vs. all"). No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-7-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f8480721a74b82c6e88fff09286aa452d5ed6d71 Author: Sean Christopherson Date: Fri Jul 15 22:42:24 2022 +0000 KVM: x86/mmu: Rename rmap zap helpers to eliminate "unmap" wrapper Rename kvm_unmap_rmap() and kvm_zap_rmap() to kvm_zap_rmap() and __kvm_zap_rmap() respectively to show that what was the "unmap" helper is just a wrapper for the "zap" helper, i.e. that they do the exact same thing, one just exists to deal with its caller passing in more params. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 2833eda0e296ba3c410e9d57636de14d2589ad4e Author: Sean Christopherson Date: Fri Jul 15 22:42:23 2022 +0000 KVM: x86/mmu: Rename __kvm_zap_rmaps() to align with other nomenclature Rename __kvm_zap_rmaps() to kvm_rmap_zap_gfn_range() to avoid future confusion with a soon-to-be-introduced __kvm_zap_rmap(). Using a plural "rmaps" is somewhat ambiguous without additional context, as it's not obvious whether it's referring to multiple rmap lists, versus multiple rmap entries within a single list. Use kvm_rmap_zap_gfn_range() to align with the pattern established by kvm_rmap_zap_collapsible_sptes(), without losing the information that it zaps only rmap-based MMUs, i.e. don't rename it to __kvm_zap_gfn_range(). No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit aed02fe3cae41c4f9a5f31390b198025bfc9cf88 Author: Sean Christopherson Date: Fri Jul 15 22:42:22 2022 +0000 KVM: x86/mmu: Drop the "p is for pointer" from rmap helpers Drop the trailing "p" from rmap helpers, i.e. rename functions to simply be kvm__rmap(). Declaring that a function takes a pointer is completely unnecessary and goes against kernel style. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a42989e7fbb0186d9fee05b29e0ea9cb639d0bd3 Author: Sean Christopherson Date: Fri Jul 15 22:42:21 2022 +0000 KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Use pte_list_destroy() directly when recycling rmaps instead of bouncing through kvm_unmap_rmapp() and kvm_zap_rmapp(). Calling kvm_unmap_rmapp() is unnecessary and odd as it requires passing dummy parameters; passing NULL for @slot when __rmap_add() already has a valid slot is especially weird and confusing. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 35d539c3e44f2021ff47a91cf4e6a35c550b6fbc Author: Sean Christopherson Date: Fri Jul 15 22:42:20 2022 +0000 KVM: x86/mmu: Return a u64 (the old SPTE) from mmu_spte_clear_track_bits() Return a u64, not an int, from mmu_spte_clear_track_bits(). The return value is the old SPTE value, which is very much a 64-bit value. The sole caller that consumes the return value, drop_spte(), already uses a u64. The only reason that truncating the SPTE value is not problematic is because drop_spte() only queries the shadow-present bit, which is in the lower 32 bits. Signed-off-by: Sean Christopherson Message-Id: <20220715224226.3749507-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit da0b93d65e5bba6d4381f9dc99c547b60582e7a7 Author: Maciej S. Szmigiero Date: Mon Jul 18 17:47:13 2022 +0200 KVM: nSVM: Pull CS.Base from actual VMCB12 for soft int/ex re-injection enter_svm_guest_mode() first calls nested_vmcb02_prepare_control() to copy control fields from VMCB12 to the current VMCB, then nested_vmcb02_prepare_save() to perform a similar copy of the save area. This means that nested_vmcb02_prepare_control() still runs with the previous save area values in the current VMCB so it shouldn't take the L2 guest CS.Base from this area. Explicitly pull CS.Base from the actual VMCB12 instead in enter_svm_guest_mode(). Granted, having a non-zero CS.Base is a very rare thing (and even impossible in 64-bit mode), having it change between nested VMRUNs is probably even rarer, but if it happens it would create a really subtle bug so it's better to fix it upfront. Fixes: 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction") Signed-off-by: Maciej S. Szmigiero Message-Id: <4caa0f67589ae3c22c311ee0e6139496902f2edc.1658159083.git.maciej.szmigiero@oracle.com> Signed-off-by: Paolo Bonzini commit ded466e1806686794b403ebf031133bbaca76bb2 Author: Sumanth Korikkar Date: Tue Jul 26 18:57:59 2022 +0200 s390/unwind: fix fgraph return address recovery When HAVE_FUNCTION_GRAPH_RET_ADDR_PTR is defined, the return address to the fgraph caller is recovered by tagging it along with the stack pointer of ftrace stack. This makes the stack unwinding more reliable. When the fgraph return address is modified to return_to_handler, ftrace_graph_ret_addr tries to restore it to the original value using tagged stack pointer. Fix this by passing tagged sp to ftrace_graph_ret_addr. Fixes: d81675b60d09 ("s390/unwind: recover kretprobe modified return address in stacktrace") Cc: # 5.18 Reviewed-by: Vasily Gorbik Signed-off-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit 520763a3272abf0ebf161c748bdbc8dad275521c Author: Sven Schnelle Date: Tue Jul 26 09:43:53 2022 +0200 s390/nmi: use irqentry_nmi_enter()/irqentry_nmi_exit() With generic entry in place switch the nmi handler to use the generic entry helper functions. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit a0c0c44e9aa2b5da876467083c359b368f3ce95e Author: Janosch Frank Date: Wed Jul 20 12:43:28 2022 +0000 s390: add ELF note type for encrypted CPU state of a PV VCPU The type NT_S390_PV_CPU_DATA note contains the encrypted CPU state of a PV VCPU. It's only relevant in dumps of s390 PV VMs and can't be decrypted without a second block of encrypted data which provides key parts. Therefore we only reserve the note type here. The zgetdump tool from the s390-tools package can, together with a Customer Communication Key, be used to convert a PV VM dump into a normal VM dump. zgetdump will decrypt the CPU data and overwrite the other respective notes to make the data accessible for crash and other debugging tools. Signed-off-by: Janosch Frank Acked-by: Heiko Carstens [agordeev@linux.ibm.com changed desctiption] Signed-off-by: Alexander Gordeev commit e409b7f19172a3c154de62de4baf32a2c25a375a Author: Alexander Gordeev Date: Wed Jul 20 08:32:13 2022 +0200 s390/smp,ptdump: add absolute lowcore markers Add "Lowcore Area Start" and "Lowcore Area End" markers that fence pages where absolute lowcore resides. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 7d06fed77b7d8fc9f6cc41b4e3f2823d32532ad8 Author: Alexander Gordeev Date: Wed Jul 20 08:22:01 2022 +0200 s390/smp: rework absolute lowcore access Temporary unsetting of the prefix page in memcpy_absolute() routine poses a risk of executing code path with unexpectedly disabled prefix page. This rework avoids the prefix page uninstalling and disabling of normal and machine check interrupts when accessing the absolute zero memory. Although memcpy_absolute() routine can access the whole memory, it is only used to update the absolute zero lowcore. This rework therefore introduces a new mechanism for the absolute zero lowcore access and scraps memcpy_absolute() routine for good. Instead, an area is reserved in the virtual memory that is used for the absolute lowcore access only. That area holds an array of 8KB virtual mappings - one per CPU. Whenever a CPU is brought online, the corresponding item is mapped to the real address of the previously installed prefix page. The absolute zero lowcore access works like this: a CPU calls the new primitive get_abs_lowcore() to obtain its 8KB mapping as a pointer to the struct lowcore. Virtual address references to that pointer get translated to the real addresses of the prefix page, which in turn gets swapped with the absolute zero memory addresses due to prefixing. Once the pointer is not needed it must be released with put_abs_lowcore() primitive: struct lowcore *abs_lc; unsigned long flags; abs_lc = get_abs_lowcore(&flags); abs_lc->... = ...; put_abs_lowcore(abs_lc, flags); To ensure the described mechanism works large segment- and region- table entries must be avoided for the 8KB mappings. Failure to do so results in usage of Region-Frame Absolute Address (RFAA) or Segment-Frame Absolute Address (SFAA) large page fields. In that case absolute addresses would be used to address the prefix page instead of the real ones and the prefixing would get bypassed. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 2e2493c675dfdb75d8aa1bc6ae436b9d7cc4abfa Author: Alexander Gordeev Date: Fri Jul 22 20:34:05 2022 +0200 s390/setup: rearrange absolute lowcore initialization Make the absolute lowcore assignments immediately follow the boot CPU lowcore same member assignments. This way readability improves when reading from up to down, with no out of order mcck stack allocation in-between. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 57ad19bcdefb1c65b0a90330b7b29ce658ef1a76 Author: Alexander Gordeev Date: Thu May 26 07:57:36 2022 +0200 s390/boot: cleanup adjust_to_uv_max() function Uncouple input and output arguments by making the latter the function return value. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 6f5c672d17f583b081e283927f5040f726c54598 Author: Alexander Gordeev Date: Wed Jul 20 07:24:03 2022 +0200 s390/smp: enforce lowcore protection on CPU restart As result of commit 915fea04f932 ("s390/smp: enable DAT before CPU restart callback is called") the low-address protection bit gets mistakenly unset in control register 0 save area of the absolute zero memory. That area is used when manual PSW restart happened to hit an offline CPU. In this case the low-address protection for that CPU will be dropped. Reviewed-by: Heiko Carstens Fixes: 915fea04f932 ("s390/smp: enable DAT before CPU restart callback is called") Signed-off-by: Alexander Gordeev commit fc7fab3f9156df73cd5f2705f001451265453d34 Author: Jason Wang Date: Fri Jul 15 13:38:38 2022 +0800 s390/tape: fix comment typo Remove duplicated `that' in a comment Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20220715053838.5005-1-wangborong@cdjrlc.com [agordeev@linux.ibm.com rephrased commit message] Signed-off-by: Alexander Gordeev commit 57c3ae8e44bba158c3f7064a3f9628eddfd5c276 Author: Randy Dunlap Date: Thu Jul 14 19:00:10 2022 -0700 s390/hmcdrv: fix Kconfig "its" grammar Use the possessive "its" instead of the contraction "it's" where appropriate. Signed-off-by: Randy Dunlap Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: linux-s390@vger.kernel.org Link: https://lore.kernel.org/r/20220715020010.12678-1-rdunlap@infradead.org Signed-off-by: Alexander Gordeev commit 2f089a3846a28b9893697e807f85c2177fd9d829 Merge: 9aa938ddce81c ebbc957016914 Author: Alexander Gordeev Date: Thu Jul 28 17:53:11 2022 +0200 Merge branch 'vmcore-iov_iter' into features Pull changes that finalize switching of copy_oldmem_page() callback to iov_iter interface. These changes were pulled in work.iov_iter of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git Signed-off-by: Alexander Gordeev commit dd390cba54bbd74fb675a4ac0a78dc23a20d49e2 Author: wangjianli Date: Sun Jul 24 15:44:07 2022 +0800 IB/qib: Fix repeated "in" within comments Delete the redundant word 'in'. Link: https://lore.kernel.org/r/20220724074407.18552-1-wangjianli@cdjrlc.com Signed-off-by: wangjianli Signed-off-by: Jason Gunthorpe commit 339170d8d3da5685762619080263abb78700ab4c Author: João Paulo Rechi Vita Date: Wed Jul 27 10:05:39 2022 -0400 docs: efi-stub: Fix paths for x86 / arm stubs This fixes the paths of x86 / arm efi-stub source files. Signed-off-by: João Paulo Rechi Vita Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220727140539.10021-1-jprvita@endlessos.org Signed-off-by: Jonathan Corbet commit 4116ff79749d8842f6a6dfce5a17a5ea15fc290b Author: Yanteng Si Date: Thu Jul 28 13:08:43 2022 +0800 Docs/zh_CN: Update the translation of sched-stats to 5.19-rc8 Update to commit 6c757e9f55f0 ("docs/scheduler: fix unit error") ddb21d27a6a5 ("docs/scheduler: Change unit of cpu_time and rq_time to nanoseconds") Signed-off-by: Yanteng Si Reviewed-by: Wu XiangCheng Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/3cb1c4c466dfa38d72a867dc6e2c833ceb69ecb7.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit ce1120076c53681fc084240627bc9c974039da97 Author: Yanteng Si Date: Thu Jul 28 13:08:26 2022 +0800 Docs/zh_CN: Update the translation of pci to 5.19-rc8 Update to commit f21949c14968 ("PCI/doc:Update obsolete pci_set_dma_mask() references") 05b0ebd06ae6 ("PCI/doc: cleanup references to the legacy PCI DMA API") Signed-off-by: Yanteng Si Reviewed-by: Wu XiangCheng Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/bccb98a1c6706ecfd4aaba8c27f1c64024e1c139.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit c78478e164d4163419dc027fba7e3a2261d0c1d9 Author: Yanteng Si Date: Thu Jul 28 13:08:10 2022 +0800 Docs/zh_CN: Update the translation of pci-iov-howto to 5.19-rc8 Update to commit 4f23bd5d09af ("PCI/doc: Convert examples to generic power management") Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/24c53aabc9d942f6fe38b8d3a843329edca3d18c.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit 83b41bb27b25b4b972d03b593e8da7e3dd5735aa Author: Yanteng Si Date: Thu Jul 28 13:07:59 2022 +0800 Docs/zh_CN: Update the translation of usage to 5.19-rc8 Update to commit b57e39a743e4 ("Docs/admin-guide /damon/sysfs: document 'LRU_DEPRIO' scheme action") 0bcba960b1fa ("Docs/admin-guide/damon/sysfs: document 'LRU_PRIO' scheme action") Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/130795ae1a4097e25e8e354870e65c3018241a8e.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit 63c1d2516b057e2d49f58812d8c149acfd5348a5 Author: Yanteng Si Date: Thu Jul 28 13:07:48 2022 +0800 Docs/zh_CN: Update the translation of testing-overview to 5.19-rc8 Update to commit 12379401c000 ("Documentation: dev-tools: Add a section for static analysis tools") Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/b9911916446f858fe95e4d4bfeaecdab14bc0b6a.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit 6a5057e9dc13dd31d1577652162c4ca2869d8950 Author: Yanteng Si Date: Thu Jul 28 13:05:58 2022 +0800 Docs/zh_CN: Update the translation of sparse to 5.19-rc8 Update to commit179fd6ba3bac ("Documentation/sparse: add hints about __CHECKER__") Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/2ecdf7ddc8644e9031e4e2af947b97d63ab046f0.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit 507f48799ab0915788df79edf794d659ad8104c7 Author: Yanteng Si Date: Thu Jul 28 13:05:57 2022 +0800 Docs/zh_CN: Update the translation of kasan to 5.19-rc8 update to commit 3ff16d30f593 ("kasan: test: improve failure message in KUNIT_EXPECT_KASAN_FAIL()") c9d1af2b780a ("mm/kasan: move kasan.fault to mm/kasan/report.c") 2d27e5851473 ("kasan: Extend KASAN mode kernel parameter") 8479d7b5be2f ("kasan: documentation updates") c2ec0c8f6877 ("kasan: update documentation") Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/abbb6c5cc5a7daf0720a9cb0a8255472d4ac69b4.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit 659797dc4d64ee4814e5e9a5387933e38a11fb7a Author: Yanteng Si Date: Thu Jul 28 13:05:56 2022 +0800 Docs/zh_CN: Update the translation of iio_configfs to 5.19-rc8 update to commit dafcf4ed8392 ("iio: hrtimer: Allow sub Hz granularity"). c1d82dbcb0a6 ("docs: iio: fix example formatting"). Remove some useless spaces. Signed-off-by: Yanteng Si Reviewed-by: Alex Shi Link: https://lore.kernel.org/r/1c0ae3e0932d813d41de666c1c65379786e79ba6.1658983157.git.siyanteng@loongson.cn Signed-off-by: Jonathan Corbet commit da1d9caf95def6f0320819cf941c9fd1069ba9e1 Author: Federico Vaga Date: Sat Jul 2 23:08:20 2022 +0200 doc:it_IT: align Italian documentation Translation for the following patches commit df05c0e9496c ("Documentation: Raise the minimum supported version of LLVM to 11.0.0") commit 333b11e541fe ("Documentation: Add minimum pahole version") commit 6d6a8d6a4ed0 ("docs: Update Sphinx requirements") commit 76ae847497bc ("Documentation: raise minimum supported version of GCC to 5.1") commit 59c6a716b14b ("Documentation/process/maintainer-pgp-guide: Replace broken link to PGP path finder") commit 85eafc63d032 ("docs: update file link location") commit 869f496e1aa6 ("docs: process: submitting-patches: Clarify the Reported-by usage") commit 6c5ccd24ff17 ("Remove mentions of the Trivial Patch Monkey") commit aa9b5e0df226 ("Documentation/process: fix self reference") commit b96ff02ab2be ("Documentation/process: fix a cross reference") commit 1f57bd42b77c ("docs: submitting-patches: make section about the Link: tag more explicit") commit a9d85efb25fb ("docs: use the lore redirector everywhere") commit 31c9d7c82975 ("Documentation/process: Add tip tree handbook") commit 604370e106cc ("Documentation/process: Add maintainer handbooks section") commit bf33a9d42d0c ("docs: 5.Posting.rst: describe Fixes: and Link: tags") commit c04639a7d2fb ("coding-style.rst: trivial: fix location of driver model macros") commit d5b421fe0282 ("docs: Explain the desired position of function attributes") commit 3577cdb23b8f ("docs: deprecated.rst: Clarify open-coded arithmetic with literals") commit db67eb748e7a ("docs: discourage use of list tables") commit 0e805b118662 ("docs: address some text issues with css/theme support") commit 135707d3765e ("docs: allow to pass extra DOCS_CSS themes via make") commit fe450eeb4e6f ("Documentation: in_irq() cleanup") commit 10855b45a428 ("docs: fix typo in Documentation/kernel-hacking/locking.rst") commit bc67f1c454fb ("docs: futex: Fix kernel-doc references") commit abf36fe0be7d ("docs: kernel-hacking: Remove inappropriate text") commit f35cf1a59e9a ("Documentation: kernel-hacking: minor edits for style") commit f35cf1a59e9a ("Documentation: kernel-hacking: minor edits for style") commit 980c3799c500 ("Documentation: kernel-doc: Promote two chapter headings to page title") commit e1be43d9b5d0 ("overflow: Implement size_t saturating arithmetic helpers") commit 615f3eea0d5f ("Documentation: add note block surrounding security patch note") commit 587d39b260c4 ("Documentation: add link to stable release candidate tree") commit 555d44932c67 ("Documentation: update stable tree link") commit 88d99e870143 ("Documentation: update stable review cycle documentation") commit 0c603a5c704f ("Documentation/process: mention patch changelog in review process") commit 6d5aa418b3bd ("docs: submitting-patches: Fix crossref to 'The canonical patch format'") commit f1a693994b1c ("Documentation/process: use scripts/get_maintainer.pl on patches") commit 69ef0920bdd3 ("Docs: Add cpio requirement to changes.rst") commit 5a5866c28b43 ("Docs: Replace version by 'current' in changes.rst") commit 9b5a7f4a2a8d ("x86/configs: Add x86 debugging Kconfig fragment plus docs") commit f1a693994b1c ("Documentation/process: use scripts/get_maintainer.pl on patches") commit e8c07082a810 ("Kbuild: move to -std=gnu11") Signed-off-by: Federico Vaga Link: https://lore.kernel.org/r/20220702210820.13118-1-federico.vaga@vaga.pv.it Signed-off-by: Jonathan Corbet commit d0c75fa2c17f082b32a5f26ff40bf378b12952de Author: Daniel Lezcano Date: Fri Jul 22 22:00:07 2022 +0200 thermal/of: Initialize trip points separately Self contain the trip initialization from the device tree in a single function for the sake of making the code flow more clear. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-11-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit 14ccb5edd76e40259d8c1bd8f984cfc9016e1633 Author: Daniel Lezcano Date: Fri Jul 22 22:00:06 2022 +0200 thermal/of: Use thermal trips stored in the thermal zone Now that we have the thermal trip stored in the thermal zone in a generic way, we can rely on them and remove one indirection we found in the thermal_of code and do one more step forward the removal of the duplicated structures. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-10-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit fae11de507f0e420ba3733729317559e7cea6274 Author: Daniel Lezcano Date: Fri Jul 22 22:00:05 2022 +0200 thermal/core: Add thermal_trip in thermal_zone The thermal trip points are properties of a thermal zone and the different sub systems should be able to save them in the thermal zone structure instead of having their own definition. Give the opportunity to the drivers to create a thermal zone with thermal trips which will be accessible directly from the thermal core framework. As we added the thermal trip points structure in the thermal zone, let's extend the thermal zone register function to have the thermal trip structures as a parameter and store it in the 'trips' field of the thermal zone structure. The thermal zone contains the trip point, we can store them directly when registering the thermal zone. That will allow another step forward to remove the duplicate thermal zone structure we find in the thermal_of code. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-9-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit e5bfcd30f88fdb0ce830229e7ccdeddcb7a59b04 Author: Daniel Lezcano Date: Fri Jul 22 22:00:04 2022 +0200 thermal/core: Rename 'trips' to 'num_trips' In order to use thermal trips defined in the thermal structure, rename the 'trips' field to 'num_trips' to have the 'trips' field containing the thermal trip points. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-8-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit e5f2cda61d068e14af95ed8ee74c80e565af3f29 Author: Daniel Lezcano Date: Fri Jul 22 22:00:03 2022 +0200 thermal/core: Move thermal_set_delay_jiffies to static The function 'thermal_set_delay_jiffies' is only used in thermal_core.c but it is defined and implemented in a separate file. Move the function to thermal_core.c and make it static. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20220722200007.1839356-7-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit 6390383b67fab6bfa652a39e87e904bfc3066235 Author: Daniel Lezcano Date: Fri Jul 22 22:00:02 2022 +0200 thermal/core: Remove unneeded EXPORT_SYMBOLS Different functions are exporting the symbols but are actually only used by the thermal framework internals. Remove these EXPORT_SYMBOLS. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-6-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit 646274ddaf756dc549fc98cc581fc1ce4fef517a Author: Daniel Lezcano Date: Fri Jul 22 22:00:01 2022 +0200 thermal/of: Move thermal_trip structure to thermal.h The structure thermal_trip is now generic and will be usable by the different sensor drivers in place of their own structure. Move its definition to thermal.h to make it accessible. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20220722200007.1839356-5-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit af9f251b8e396eca8355904ad8a4361a95af4e61 Author: Daniel Lezcano Date: Fri Jul 22 22:00:00 2022 +0200 thermal/of: Remove the device node pointer for thermal_trip The device node pointer is no longer needed in the thermal trip structure, remove it. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20220722200007.1839356-4-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit a3193edcbdf9a8ae73b6e1f2da96e920582c1849 Author: Daniel Lezcano Date: Fri Jul 22 21:59:59 2022 +0200 thermal/of: Replace device node match with device node search The thermal_of code builds a trip array associated with the node pointer in order to compare the trip point phandle with the list. The thermal trip is a thermal zone property and should be moved there. If some sensors have hardcoded trip points, they should use the exported structure instead of redefining again and again their own structure and data to describe exactly the same things. In order to move this to the thermal.h header and allow more cleanup, we need to remove the node pointer from the structure. Instead of building storing the device node, we search directly in the device tree the corresponding node. That results in a simplification of the code and allows to move the structure to thermal.h Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220722200007.1839356-3-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit 3f95ac324535eafafd436d35bf58f0319dd4a70b Author: Daniel Lezcano Date: Fri Jul 22 21:59:58 2022 +0200 thermal/core: Remove duplicate information when an error occurs The pr_err already tells it is an error, it is pointless to add the 'Error:' string in the messages. Remove them. Cc: Alexandre Bailon Cc: Kevin Hilman Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20220722200007.1839356-2-daniel.lezcano@linexp.org Signed-off-by: Daniel Lezcano commit 50e53291e9f188a44652f11606ae6b544facdccc Author: Daniel Lezcano Date: Mon Jul 18 16:50:36 2022 +0200 thermal/core: Avoid calling ->get_trip_temp() unnecessarily As the trip temperature is already available when calling the function handle_critical_trips(), pass it as a parameter instead of having this function calling the ops again to retrieve the same data. Reviewed-by: Lukasz Luba Reviewed-by: Zhang Rui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220718145038.1114379-2-daniel.lezcano@linaro.org commit 7a12f9188529d9529704b54ca51d3b6ef4a14094 Author: Slark Xiao Date: Fri Jul 22 18:40:47 2022 +0800 thermal/tools/tmon: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220722104047.83312-1-slark_xiao@163.com Signed-off-by: Daniel Lezcano commit 0cf51bfe999524377fbb71becb583b4ca6d07cfc Author: Markus Mayer Date: Sun Jul 17 20:10:39 2022 -0700 thermal/tools/tmon: Include pthread and time headers in tmon.h Include sys/time.h and pthread.h in tmon.h, so that types "pthread_mutex_t" and "struct timeval tv" are known when tmon.h references them. Without these headers, compiling tmon against musl-libc will fail with these errors: In file included from sysfs.c:31:0: tmon.h:47:8: error: unknown type name 'pthread_mutex_t' extern pthread_mutex_t input_lock; ^~~~~~~~~~~~~~~ make[3]: *** [: sysfs.o] Error 1 make[3]: *** Waiting for unfinished jobs.... In file included from tui.c:31:0: tmon.h:54:17: error: field 'tv' has incomplete type struct timeval tv; ^~ make[3]: *** [: tui.o] Error 1 make[2]: *** [Makefile:83: tmon] Error 2 Signed-off-by: Markus Mayer Acked-by: Florian Fainelli Reviewed-by: Sumeet Pawnikar Acked-by: Alejandro González Tested-by: Alejandro González Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem") Link: https://lore.kernel.org/r/20220718031040.44714-1-f.fainelli@gmail.com Signed-off-by: Daniel Lezcano commit 8b74a003a94134c791fb9bb3d474d1bce6a05b2d Author: Jason Wang Date: Fri Jul 15 13:18:29 2022 +0800 thermal/ti-soc-thermal: Fix comment typo The double `and' is duplicated in line 229, remove one. Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20220715051829.30927-1-wangborong@cdjrlc.com Signed-off-by: Daniel Lezcano commit ee35f721477a96cd7a5ee8b0d24507ff4e67fa65 Author: Dmitry Baryshkov Date: Tue Jul 19 08:49:40 2022 +0300 thermal/drivers/qcom/spmi-adc-tm5: Register thermal zones as hwmon sensors Register thermal zones as hwmon sensors to let userspace read temperatures using standard hwmon interface. Signed-off-by: Dmitry Baryshkov Reviewed-by: Bhupesh Sharma Link: https://lore.kernel.org/r/20220719054940.755907-2-dmitry.baryshkov@linaro.org Signed-off-by: Daniel Lezcano commit fb55b0129787ec98eace23ddccd429188d318574 Author: Dmitry Baryshkov Date: Tue Jul 19 08:49:39 2022 +0300 thermal/drivers/qcom/temp-alarm: Register thermal zones as hwmon sensors Register thermal zones as hwmon sensors to let userspace read temperatures using standard hwmon interface. Signed-off-by: Dmitry Baryshkov Reviewed-by: Bhupesh Sharma Link: https://lore.kernel.org/r/20220719054940.755907-1-dmitry.baryshkov@linaro.org Signed-off-by: Daniel Lezcano commit 8cf18eea46e24a337c5a095edeed42ca03e97811 Author: Yang Li Date: Tue Jul 19 08:35:56 2022 +0800 thermal/drivers/u8500: Remove unnecessary print function dev_err() The print function dev_err() is redundant because platform_get_irq() already prints an error. Eliminate the follow coccicheck warnings: ./drivers/thermal/db8500_thermal.c:162:2-9: line 162 is redundant because platform_get_irq() already prints an error ./drivers/thermal/db8500_thermal.c:176:2-9: line 176 is redundant because platform_get_irq() already prints an error Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20220719003556.74460-1-yang.lee@linux.alibaba.com Signed-off-by: Daniel Lezcano commit 8f5a9371e69664cf4ad22a84204340323d5165cc Author: Biju Das Date: Mon Jul 18 13:14:40 2022 +0100 thermal/drivers/rzg2l: Fix comments This patch replaces 'Capture times'->'Total number of ADC data samples' as the former does not really explain much. It also fixes the typo * caliberation->calibration Lastly, as per the coding style /* should be on a separate line. This patch fixes this issue. Reported-by: Pavel Machek Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20220718121440.556408-1-biju.das.jz@bp.renesas.com Signed-off-by: Daniel Lezcano commit 11188b439974b8ef8fe8c4c6df6ab8b6486c8c45 Author: Julia Lawall Date: Sat May 21 13:10:46 2022 +0200 thermal/drivers/sun8i: Fix typo in comment Spelling mistake (triple letters) in comment. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Acked-by: Vasily Khoruzhick Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220521111145.81697-36-Julia.Lawall@inria.fr Signed-off-by: Daniel Lezcano commit 4aaec53b84418e83fcee6907fcff177df1f12f44 Author: Jin Xiaoyun Date: Mon Jun 13 14:31:11 2022 +0800 thermal/drivers/k3_j72xx_bandgap: Make k3_j72xx_bandgap_j721e_data and k3_j72xx_bandgap_j7200_data static Fix sparse warnings: drivers/thermal/k3_j72xx_bandgap.c:532:36: sparse: sparse: symbol 'k3_j72xx_bandgap_j721e_data' was not declared. Should it be static? drivers/thermal/k3_j72xx_bandgap.c:536:36: sparse: sparse: symbol 'k3_j72xx_bandgap_j7200_data' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: Jin Xiaoyun Link: https://lore.kernel.org/r/20220613063111.654893-1-jinxiaoyun2@huawei.com Signed-off-by: Daniel Lezcano commit cc67ca28cf8b29245b71e01117927ed2793f35b7 Author: Dan Carpenter Date: Fri May 20 18:02:39 2022 +0300 thermal/drivers/k3_j72xx_bandgap: Fix array underflow in prep_lookup_table() This while loop exits with "i" set to -1 and so then it sets: derived_table[-1] = derived_table[0] - 300; There is no need for this assignment at all. Just delete it. Fixes: 72b3fc61c752 ("thermal: k3_j72xx_bandgap: Add the bandgap driver support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YoetjwcOEzYEFp9b@kili Signed-off-by: Daniel Lezcano commit 99a049aace3257cf7644c3bbf67cb1a655248cc2 Author: Bryan Brattlof Date: Wed May 25 16:36:17 2022 -0500 thermal/drivers/k3_j72xx_bandgap: Fix ref_table memory leak during probe If an error occurs in the k3_j72xx_bandgap_probe() function the memory allocated to the 'ref_table' will not be released. Add a err_free_ref_table step to the error path to free 'ref_table' Fixes: 72b3fc61c752 ("thermal: k3_j72xx_bandgap: Add the bandgap driver support") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Bryan Brattlof Reviewed-by: Keerthy Link: https://lore.kernel.org/r/20220525213617.30002-1-bb@ti.com Signed-off-by: Daniel Lezcano commit 4102c4042a33c682021683ec26c2dca3fd9d7cc2 Author: Daniel Lezcano Date: Wed Jun 29 17:10:12 2022 +0200 thermal/core: Remove DROP_FULL and RAISE_FULL The trends DROP_FULL and RAISE_FULL are not used and were never used in the past AFAICT. Remove these conditions as they seems to not be handled anywhere. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220629151012.3115773-2-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano commit 25bff3ed9a8aaee45c3b554cca58673f1bea1bdc Author: Daniel Lezcano Date: Wed Jun 29 17:10:11 2022 +0200 thermal/core: Use clamp() helper in the stepwise governor The code is actually clampling the next cooling device state using the lowest and highest states of the thermal instance. That code can be replaced by the clamp() macro which does exactly the same. It results in a simpler routine to read. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220629151012.3115773-1-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano commit 66a0b101efca70097a14aece9c76bc24cd0da119 Author: Daniel Lezcano Date: Thu Jun 16 22:25:37 2022 +0200 thermal/drivers/u8500: Remove the get_trend function The get_trend function relies on the interrupt to set the raising or dropping trend. However the interpolated temperature is already giving the temperature information to the thermal framework which is able to deduce the trend. Remove the trend code. Signed-off-by: Daniel Lezcano Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20220616202537.303655-3-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano commit afbeb99e2e33df7cb0833f94128320989c58d6d2 Author: Daniel Lezcano Date: Thu Jun 16 22:25:36 2022 +0200 thermal/drivers/tegra: Remove get_trend function The get_trend function does already what the generic framework does. Remove it. Signed-off-by: Daniel Lezcano Tested-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20220616202537.303655-2-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano commit 198fa45252d84baea593456cfda01deeb9dff13f Author: Daniel Lezcano Date: Thu Jun 16 22:25:35 2022 +0200 thermal/drivers/qcom: Remove get_trend function There is a get_trend function which is a wrapper to call a private get_trend function. However, this private get_trend function is not assigned anywhere. Remove this dead code. Signed-off-by: Daniel Lezcano Acked-by: Amit Kucheria Link: https://lore.kernel.org/r/20220616202537.303655-1-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano commit 83b4466b3f1b00da0cbc754e055e89a7b02b2034 Author: Wolfram Sang Date: Fri Jun 10 22:17:01 2022 +0200 dt-bindings: thermal: rcar-gen3-thermal: Add r8a779f0 support Add support for R-Car S4. The S4 IP differs a bit from its siblings in such way that it has 3 out of 4 TSC nodes for Linux and the interrupts are not routed to the INTC-AP but to the ECM. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220610201701.7946-2-wsa+renesas@sang-engineering.com Signed-off-by: Daniel Lezcano commit 3c1fa94cd0baca8d573aead43f33785eca66ed42 Author: Wolfram Sang Date: Fri Jun 10 22:17:00 2022 +0200 dt-bindings: thermal: rcar-gen3-thermal: use positive logic When handling the V3U/r8a779a0 exception, avoid using 'not:' because then its subschemas are far away in the 'else:' branch. Keep them together using positive logic. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220610201701.7946-1-wsa+renesas@sang-engineering.com Signed-off-by: Daniel Lezcano commit f16d37056be2feeae0680b3675b95ae876ab8c5c Author: Krzysztof Kozlowski Date: Wed Jun 8 13:27:01 2022 +0200 dt-bindings: thermal: qcom,spmi-temp-alarm: convert to dtschema Convert the Qualcomm QPNP PMIC Temperature Alarm to DT Schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220608112702.80873-1-krzysztof.kozlowski@linaro.org Signed-off-by: Daniel Lezcano commit 404dd7dfb13028d315514f63ed3cf9da46307a39 Author: Wolfram Sang Date: Fri Jun 10 22:04:59 2022 +0200 drivers/thermal/rcar_gen3_thermal: Improve logging during probe When setting up a new board, a plain "Can't register thermal zone" didn't help me much because the thermal zones in DT were all fine. I just had a sensor entry too much in the parent TSC node. Reword the failure/success messages to contain the sensor number to make it easier to understand which sensor is affected. Example output now: rcar_gen3_thermal e6198000.thermal: Sensor 0: Loaded 1 trip points rcar_gen3_thermal e6198000.thermal: Sensor 1: Loaded 1 trip points rcar_gen3_thermal e6198000.thermal: Sensor 2: Loaded 1 trip points rcar_gen3_thermal e6198000.thermal: Sensor 3: Can't register thermal zone Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20220610200500.6727-1-wsa+renesas@sang-engineering.com Signed-off-by: Daniel Lezcano commit 037a6ea0debbe3da3f5cef311d835fb7f1a5e2c7 Author: Lukas Bulwahn Date: Mon Jun 13 14:43:09 2022 +0200 MAINTAINERS: add include/dt-bindings/thermal to THERMAL Maintainers of the directory Documentation/devicetree/bindings/thermal are also the maintainers of the corresponding directory include/dt-bindings/thermal. Add the file entry for include/dt-bindings/thermal to the appropriate section in MAINTAINERS. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20220613124309.28790-1-lukas.bulwahn@gmail.com Signed-off-by: Daniel Lezcano commit 829f416643f9738b0fda9e3f1bf8712113f61a23 Author: Lukasz Luba Date: Mon Jun 13 13:43:27 2022 +0100 drivers/thermal/devfreq_cooling: Extend the devfreq_cooling_device with ops Remove unneeded global variable devfreq_cooling_ops which is used only as a copy pattern. Instead, extend the struct devfreq_cooling_device with the needed ops structure. This also simplifies the allocation/free code during the setup/cleanup. Signed-off-by: Lukasz Luba Link: https://lore.kernel.org/r/20220613124327.30766-5-lukasz.luba@arm.com Signed-off-by: Daniel Lezcano commit 9784d2fbb858ec0dd8d0032293aa06fa736d6ea2 Author: Lukasz Luba Date: Mon Jun 13 13:43:26 2022 +0100 drivers/thermal/cpufreq_cooling: Update outdated comments The code has moved and left some comments stale. Update them where there is a need. Acked-by: Viresh Kumar Signed-off-by: Lukasz Luba Link: https://lore.kernel.org/r/20220613124327.30766-4-lukasz.luba@arm.com Signed-off-by: Daniel Lezcano commit 3f7ced7ac9af43fbc0b886aa9ef4397a5fa4b6e1 Author: Lukasz Luba Date: Mon Jun 13 13:43:25 2022 +0100 drivers/thermal/cpufreq_cooling : Refactor thermal_power_cpu_get_power tracing Simplify the thermal_power_cpu_get_power trace event by removing complicated cpumask and variable length array. Now the tools parsing trace output don't have to hassle to get this power data. The simplified format version uses 'policy->cpu'. Remove also the 'load' information completely since there is very little value of it in this trace event. To get the CPUs' load (or utilization) there are other dedicated trace hooks in the kernel. This patch also simplifies and speeds-up the main cooling code when that trace event is enabled. Rename the trace event to avoid confusion of tools which parse the trace file. Acked-by: Viresh Kumar Signed-off-by: Lukasz Luba Link: https://lore.kernel.org/r/20220613124327.30766-3-lukasz.luba@arm.com Signed-off-by: Daniel Lezcano commit 3cbf6a8ab70b21de75bc389d384911392cf7f616 Author: Lukasz Luba Date: Mon Jun 13 13:43:24 2022 +0100 drivers/thermal/cpufreq_cooling: Use private callback ops for each cooling device It is very unlikely that one CPU cluster would have the EM and some other won't have it (because EM registration failed or DT lacks needed entry). Although, we should avoid modifying global variable with callbacks anyway. Redesign this and add safety for such situation. Signed-off-by: Lukasz Luba Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20220613124327.30766-2-lukasz.luba@arm.com Signed-off-by: Daniel Lezcano commit 014482b667d3550d7a610c5f11b6351fe47eb39a Author: Jason Wang Date: Fri Jul 15 13:44:01 2022 +0800 tty: amiserial: Fix comment typo The double `should' is duplicated in line 15, remove one. Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20220715054401.9870-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit f2d57765b79857264fb0ddc52679d661b60ecc21 Author: Fabio M. De Francesco Date: Fri Jul 15 01:50:30 2022 +0200 firmware_loader: Replace kmap() with kmap_local_page() The use of kmap() is being deprecated in favor of kmap_local_page(). Two main problems with kmap(): (1) It comes with an overhead as mapping space is restricted and protected by a global lock for synchronization and (2) kmap() also requires global TLB invalidation when the kmap’s pool wraps and it might block when the mapping space is fully utilized until a slot becomes available. kmap_local_page() is preferred over kmap() and kmap_atomic(). Where it cannot mechanically replace the latters, code refactor should be considered (special care must be taken if kernel virtual addresses are aliases in different contexts). With kmap_local_page() the mappings are per thread, CPU local, can take page faults, and can be called from any context (including interrupts). Call kmap_local_page() in firmware_loader wherever kmap() is currently used. In firmware_rw() use the helpers copy_{from,to}_page() instead of open coding the local mappings + memcpy(). Successfully tested with "firmware" selftests on a QEMU/KVM 32-bits VM with 4GB RAM, booting a kernel with HIGHMEM64GB enabled. Cc: Greg Kroah-Hartman Cc: Luis Chamberlain Suggested-by: Ira Weiny Reviewed-by: Takashi Iwai Signed-off-by: Fabio M. De Francesco Link: https://lore.kernel.org/r/20220714235030.12732-1-fmdefrancesco@gmail.com Signed-off-by: Greg Kroah-Hartman commit b18ee4a44e3ff21936d35a9b215cfd6cd5f3af9a Author: Slark Xiao Date: Thu Jul 21 10:06:23 2022 +0800 sysfs docs: ABI: Fix typo in comment Fix typo in the comment Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220721020623.20974-1-slark_xiao@163.com Signed-off-by: Greg Kroah-Hartman commit b6c694740ea21620c2b86ad37be2c0dc7051a48c Author: Randy Dunlap Date: Thu Jul 14 18:59:59 2022 -0700 kobject: fix Kconfig.debug "its" grammar Use the possessive "its" instead of the contraction "it's" where appropriate. Cc: Russell King Cc: Greg Kroah-Hartman Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20220715015959.12657-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit f38e6458e16df7bac3871f4e69f9681c0b3c58bd Merge: cf33ce6f0c220 30097967e0566 Author: Takashi Iwai Date: Thu Jul 28 16:28:24 2022 +0200 Merge tag 'asoc-fix-v5.19-rc8' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 A few more small fixes, they could all wait for the merge window if you prefer. commit 5c850d31880e00f063fa2a3746ba212c4bcc510f Author: Tianyu Lan Date: Thu Jul 28 03:24:20 2022 -0400 swiotlb: fix passing local variable to debugfs_create_ulong() Debugfs node will be run-timely checked and so local variable should be not passed to debugfs_create_ulong(). Fix it via debugfs_create_file() to create io_tlb_used node and calculate used io tlb number with fops_io_tlb_used attribute. Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock") Signed-off-by: Tianyu Lan Signed-off-by: Christoph Hellwig commit 8419702489f3be7f9e4fcf12c04d9d3f00114d35 Author: Logan Gunthorpe Date: Wed Jul 27 13:15:22 2022 -0600 dma-mapping: reformat comment to suppress htmldoc warning make html doc reports a cryptic warning with the commit named below: kernel/dma/mapping.c:258: WARNING: Option list ends without a blank line; unexpected unindent. Seems the parser is a bit fussy about the tabbing and having a single space tab causes the warning. To suppress the warning add another tab to the list and reindent everything. Fixes: 7c2645a2a30a ("dma-mapping: allow EREMOTEIO return code for P2PDMA transfers") Signed-off-by: Logan Gunthorpe Signed-off-by: Christoph Hellwig commit b5276c924497705ca927ad85a763c37f2de98349 Author: Justin Stitt Date: Thu Jul 21 14:57:06 2022 -0700 drivers: lkdtm: fix clang -Wformat warning When building with Clang we encounter the following warning (ARCH=hexagon + CONFIG_FRAME_WARN=0): | ../drivers/misc/lkdtm/bugs.c:107:3: error: format specifies type | 'unsigned long' but the argument has type 'int' [-Werror,-Wformat] | REC_STACK_SIZE, recur_count); | ^~~~~~~~~~~~~~ Cast REC_STACK_SIZE to `unsigned long` to match format specifier `%lu` as well as maintain symmetry with `#define REC_STACK_SIZE (_AC(CONFIG_FRAME_WARN, UL) / 2)`. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Fixes: 24cccab42c419 ("lkdtm/bugs: Adjust recursion test to avoid elision") Reported-by: Nathan Chancellor Suggested-by: Nathan Chancellor Suggested-by: Nick Desaulniers Tested-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Acked-by: Kees Cook Signed-off-by: Justin Stitt Link: https://lore.kernel.org/r/20220721215706.4153027-1-justinstitt@google.com Signed-off-by: Greg Kroah-Hartman commit 1208ec59eac7d9fceb016c7b565d48838776f779 Author: Thomas Bogendoerfer Date: Sat Jul 16 15:08:01 2022 +0200 char: remove VR41XX related char driver Commit d3164e2f3b0a ("MIPS: Remove VR41xx support") removed support for MIPS VR41xx platform, so remove exclusive drivers for this platform, too. Signed-off-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20220716130802.11660-1-tsbogend@alpha.franken.de Signed-off-by: Greg Kroah-Hartman commit f2d3b9a46e0ed4742abaa00506b18bb2ca9179d8 Author: Saravana Kannan Date: Wed Jul 27 19:19:35 2022 +0100 ARM: 9220/1: amba: Remove deferred device addition The uevents generated for an amba device need PID and CID information that's available only when the amba device is powered on, clocked and out of reset. So, if those resources aren't available, the information can't be read to generate the uevents. To workaround this requirement, if the resources weren't available, the device addition was deferred and retried periodically. However, this deferred addition retry isn't based on resources becoming available. Instead, it's retried every 5 seconds and causes arbitrary probe delays for amba devices and their consumers. Also, maintaining a separate deferred-probe like mechanism is maintenance headache. With this commit, instead of deferring the device addition, we simply defer the generation of uevents for the device and probing of the device (because drivers needs PID and CID to match) until the PID and CID information can be read. This allows us to delete all the amba specific deferring code and also avoid the arbitrary probing delays. Cc: Rob Herring Cc: Ulf Hansson Cc: Saravana Kannan Cc: Linus Walleij Cc: Sudeep Holla Cc: Nicolas Saenz Julienne Cc: Geert Uytterhoeven Cc: Marek Szyprowski Cc: Kefeng Wang Cc: Greg Kroah-Hartman Cc: patches@armlinux.org.uk Signed-off-by: Saravana Kannan Tested-by: Marek Szyprowski Tested-by: Kefeng Wang Tested-by: Sudeep Holla Signed-off-by: Russell King (Oracle) commit fe520635ddc4377e84f78c6cf1c54393f1dfa33b Author: Ben Dooks Date: Sun Jul 24 23:39:22 2022 +0100 ARM: 9219/1: fix undeclared soft_restart The soft_restart() is declared in so include that to fix the following sparse warning: arch/arm/kernel/reboot.c:78:6: warning: symbol 'soft_restart' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Russell King (Oracle) commit 3437021484dd8f71685012d47c2d2de6f020e943 Author: Ben Dooks Date: Sun Jul 24 23:39:21 2022 +0100 ARM: 9218/1: dma-mapping: fix pointer/integer warning Fix the use of a pointer assignment from integer where false is being used instead of NULL. Fix the following warning by usign NULL: arch/arm/mm/dma-mapping.c:712:52: warning: Using plain integer as NULL pointer Signed-off-by: Ben Dooks Signed-off-by: Russell King (Oracle) commit b97abb4d0e23766650619a6a57a52c91deb89b8a Author: Ben Dooks Date: Sun Jul 24 23:39:20 2022 +0100 ARM: 9217/1: add definition of arch_irq_work_raise() The arm does not define arch_irq_work_raise() so is triggering the following sparse warning. Add a definiton to fix this: kernel/irq_work.c:70:13: warning: symbol 'arch_irq_work_raise' was not declared. Should it be static? arch/arm/kernel/smp.c:582:6: warning: symbol 'arch_irq_work_raise' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Russell King (Oracle) commit 8fa7ea40bf56945c3ff5af00c0dca1fd9e26f129 Author: Lecopzer Chen Date: Wed Apr 27 15:30:00 2022 +0100 ARM: 9203/1: kconfig: fix MODULE_PLTS for KASAN with KASAN_VMALLOC When we run out of module space address with ko insertion, and with MODULE_PLTS, module would turn to try to find memory from VMALLOC address space. Unfortunately, with KASAN enabled, VMALLOC doesn't work without KASAN_VMALLOC, thus select KASAN_VMALLOC by default. 8<--- cut here --- Unable to handle kernel paging request at virtual address bd300860 [bd300860] *pgd=41cf1811, *pte=41cf26df, *ppte=41cf265f Internal error: Oops: 80f [#1] PREEMPT SMP ARM Modules linked in: hello(O+) CPU: 0 PID: 89 Comm: insmod Tainted: G O 5.16.0-rc6+ #19 Hardware name: Generic DT based system PC is at mmioset+0x30/0xa8 LR is at 0x0 pc : [] lr : [<00000000>] psr: 20000013 sp : c451fc18 ip : bd300860 fp : c451fc2c r10: f18042cc r9 : f18042d0 r8 : 00000000 r7 : 00000001 r6 : 00000003 r5 : 01312d00 r4 : f1804300 r3 : 00000000 r2 : 00262560 r1 : 00000000 r0 : bd300860 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 43e9406a DAC: 00000051 Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: 4887-page vmalloc region starting at 0xf1802000 allocated at load_module+0x14f4/0x32a8 Register r5 information: non-paged memory Register r6 information: non-paged memory Register r7 information: non-paged memory Register r8 information: NULL pointer Register r9 information: 4887-page vmalloc region starting at 0xf1802000 allocated at load_module+0x14f4/0x32a8 Register r10 information: 4887-page vmalloc region starting at 0xf1802000 allocated at load_module+0x14f4/0x32a8 Register r11 information: non-slab/vmalloc memory Register r12 information: non-paged memory Process insmod (pid: 89, stack limit = 0xc451c000) Stack: (0xc451fc18 to 0xc4520000) fc00: f18041f0 c04803a4 fc20: c451fc44 c451fc30 c048053c c0480358 f1804030 01312cff c451fc64 c451fc48 fc40: c047f330 c0480500 f18040c0 c1b52ccc 00000001 c5be7700 c451fc74 c451fc68 fc60: f1802098 c047f300 c451fcb4 c451fc78 c026106c f180208c c4880004 00000000 fc80: c451fcb4 bf001000 c044ff48 c451fec0 f18040c0 00000000 c1b54cc4 00000000 fca0: c451fdf0 f1804268 c451fe64 c451fcb8 c0264e88 c0260d48 ffff8000 00007fff fcc0: f18040c0 c025cd00 c451fd14 00000003 0157f008 f1804258 f180425c f1804174 fce0: f1804154 f180424c f18041f0 f180414c f1804178 f18041c0 bf0025d4 188a3fa8 fd00: 0000009e f1804170 f2b18000 c451ff10 c0d92e40 f180416c c451feec 00000001 fd20: 00000000 c451fec8 c451fe20 c451fed0 f18040cc 00000000 f17ea000 c451fdc0 fd40: 41b58ab3 c1387729 c0261c28 c047fb5c c451fe2c c451fd60 c0525308 c048033c fd60: 188a3fb4 c3ccb090 c451fe00 c3ccb080 00000000 00000000 00016920 00000000 fd80: c02d0388 c047f55c c02d0388 00000000 c451fddc c451fda0 c02d0388 00000000 fda0: 41b58ab3 c13a72d0 c0524ff0 c1705f48 c451fdfc c451fdc0 c02d0388 c047f55c fdc0: 00016920 00000000 00000003 c1bb2384 c451fdfc c3ccb080 c1bb2384 00000000 fde0: 00000000 00000000 00000000 00000000 c451fe1c c451fe00 c04e9d70 c1705f48 fe00: c1b54cc4 c1bbc71c c3ccb080 00000000 c3ccb080 00000000 00000003 c451fec0 fe20: c451fe64 c451fe30 c0525918 c0524ffc c451feb0 c1705f48 00000000 c1b54cc4 fe40: b78a3fd0 c451ff60 00000000 0157f008 00000003 c451fec0 c451ffa4 c451fe68 fe60: c0265480 c0261c34 c451feb0 7fffffff 00000000 00000002 00000000 c4880000 fe80: 41b58ab3 c138777b c02652cc c04803ec 000a0000 c451ff00 ffffff9c b6ac9f60 fea0: c451fed4 c1705f48 c04a4a90 b78a3fdc f17ea000 ffffff9c b6ac9f60 c0100244 fec0: f17ea21a f17ea300 f17ea000 00016920 f1800240 f18000ac f17fb7dc 01316000 fee0: 013161b0 00002590 01316250 00000000 00000000 00000000 00002580 00000029 ff00: 0000002a 00000013 00000000 0000000c 00000000 00000000 0157f004 c451ffb0 ff20: c1719be0 aed6f410 c451ff74 c451ff38 c0c4103c c0c407d0 c451ff84 c451ff48 ff40: 00000805 c02c8658 c1604230 c1719c30 00000805 0157f004 00000005 c451ffb0 ff60: c1719be0 aed6f410 c451ffac c451ff78 c0122130 c1705f48 c451ffac 0157f008 ff80: 00000006 0000005f 0000017b c0100244 c4880000 0000017b 00000000 c451ffa8 ffa0: c0100060 c02652d8 0157f008 00000006 00000003 0157f008 00000000 b6ac9f60 ffc0: 0157f008 00000006 0000005f 0000017b 00000000 00000000 aed85f74 00000000 ffe0: b6ac9cd8 b6ac9cc8 00030200 aecf2d60 a0000010 00000003 00000000 00000000 Backtrace: [] (kasan_poison) from [] (kasan_unpoison+0x48/0x5c) [] (kasan_unpoison) from [] (__asan_register_globals+0x3c/0x64) r5:01312cff r4:f1804030 [] (__asan_register_globals) from [] (_sub_I_65535_1+0x18/0xf80 [hello]) r7:c5be7700 r6:00000001 r5:c1b52ccc r4:f18040c0 [] (_sub_I_65535_1 [hello]) from [] (do_init_module+0x330/0x72c) [] (do_init_module) from [] (load_module+0x3260/0x32a8) r10:f1804268 r9:c451fdf0 r8:00000000 r7:c1b54cc4 r6:00000000 r5:f18040c0 r4:c451fec0 [] (load_module) from [] (sys_finit_module+0x1b4/0x1e8) r10:c451fec0 r9:00000003 r8:0157f008 r7:00000000 r6:c451ff60 r5:b78a3fd0 r4:c1b54cc4 [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x1c) Exception stack(0xc451ffa8 to 0xc451fff0) ffa0: 0157f008 00000006 00000003 0157f008 00000000 b6ac9f60 ffc0: 0157f008 00000006 0000005f 0000017b 00000000 00000000 aed85f74 00000000 ffe0: b6ac9cd8 b6ac9cc8 00030200 aecf2d60 r10:0000017b r9:c4880000 r8:c0100244 r7:0000017b r6:0000005f r5:00000006 r4:0157f008 Code: e92d4100 e1a08001 e1a0e003 e2522040 (a8ac410a) ---[ end trace df6e12843197b6f5 ]--- Signed-off-by: Lecopzer Chen Tested-by: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit 565cbaad83d83e288927b96565211109bc984007 Author: Lecopzer Chen Date: Wed Apr 27 15:29:01 2022 +0100 ARM: 9202/1: kasan: support CONFIG_KASAN_VMALLOC Simply make shadow of vmalloc area mapped on demand. Since the virtual address of vmalloc for Arm is also between MODULE_VADDR and 0x100000000 (ZONE_HIGHMEM), which means the shadow address has already included between KASAN_SHADOW_START and KASAN_SHADOW_END. Thus we need to change nothing for memory map of Arm. This can fix ARM_MODULE_PLTS with KASan, support KASan for higmem and support CONFIG_VMAP_STACK with KASan. Signed-off-by: Lecopzer Chen Tested-by: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Russell King (Oracle) commit c4f0d16daa6d1c5d862d063379c03310387095d5 Author: Jesse Taube Date: Sat Jul 23 12:05:04 2022 -0400 dt-bindings: gpio: fsl-imx-gpio: Add i.MXRT compatibles Both the i.MXRT1170 and 1050 have the same gpio controller as "fsl,imx35-gpio". Add i.MXRT to the compatible list. Signed-off-by: Jesse Taube Acked-by: Rob Herring Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit e3c1d6c8c59ae542e53c6ef4602eabc39c108575 Author: Andy Shevchenko Date: Tue Jul 26 12:14:48 2022 +0300 gpio: 74xx-mmio: Use bits instead of plain numbers for flags The initial code was misleading to use bitwise AND against plain number, and the commit d3054ba1db62 ("gpio: 74xx-mmio: Check MMIO_74XX_DIR_IN flag in mmio_74xx_dir_in()") missed that. Switch definitions to be defined bits for the correct comparison. Fixes: d3054ba1db62 ("gpio: 74xx-mmio: Check MMIO_74XX_DIR_IN flag in mmio_74xx_dir_in()") Reported-by: Dan Carpenter Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit dd524b7f317de8d31d638cbfdc7be4cf9b770e42 Author: Jiachen Zhang Date: Thu Jul 28 19:49:15 2022 +0800 ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() Some code paths cannot guarantee the inode have any dentry alias. So WARN_ON() all !dentry may flood the kernel logs. For example, when an overlayfs inode is watched by inotifywait (1), and someone is trying to read the /proc/$(pidof inotifywait)/fdinfo/INOTIFY_FD, at that time if the dentry has been reclaimed by kernel (such as echo 2 > /proc/sys/vm/drop_caches), there will be a WARN_ON(). The printed call stack would be like: ? show_mark_fhandle+0xf0/0xf0 show_mark_fhandle+0x4a/0xf0 ? show_mark_fhandle+0xf0/0xf0 ? seq_vprintf+0x30/0x50 ? seq_printf+0x53/0x70 ? show_mark_fhandle+0xf0/0xf0 inotify_fdinfo+0x70/0x90 show_fdinfo.isra.4+0x53/0x70 seq_show+0x130/0x170 seq_read+0x153/0x440 vfs_read+0x94/0x150 ksys_read+0x5f/0xe0 do_syscall_64+0x59/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 So let's drop WARN_ON() to avoid kernel log flooding. Reported-by: Hongbo Yin Signed-off-by: Jiachen Zhang Signed-off-by: Tianci Zhang Fixes: 8ed5eec9d6c4 ("ovl: encode pure upper file handles") Cc: # v4.16 Signed-off-by: Miklos Szeredi commit d985db83622679fc496ed824088e066528b3a872 Author: Colin Ian King Date: Thu Jul 28 12:05:54 2022 +0100 reset: tps380x: Fix spelling mistake "Voltags" -> "Voltage" There is a spelling mistake in the MODULE_DESCRIPTION text. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220728110554.18320-1-colin.i.king@gmail.com commit ded536561a3674327dfa4bb389085705cae22b8a Author: Yang Xu Date: Thu Jul 28 10:49:24 2022 +0800 ovl: improve ovl_get_acl() if POSIX ACL support is off Provide a proper stub for the !CONFIG_FS_POSIX_ACL case. Signed-off-by: Yang Xu Signed-off-by: Miklos Szeredi commit 623cd87006983935de6c2ad8e2d50e68f1b7d6e7 Author: Krzysztof Kozlowski Date: Tue Jul 26 09:08:02 2022 +0200 net: cdns,macb: use correct xlnx prefix for Xilinx Use correct vendor for Xilinx versions of Cadence MACB/GEM Ethernet controller. The Versal compatible was not released, so it can be changed. Zynq-7xxx and Ultrascale+ has to be kept in new and deprecated form. Signed-off-by: Krzysztof Kozlowski Acked-by: Harini Katakam Link: https://lore.kernel.org/r/20220726070802.26579-2-krzysztof.kozlowski@linaro.org Signed-off-by: Paolo Abeni commit afa950b8adc91c9bacf66c5987fa912bf971188f Author: Krzysztof Kozlowski Date: Tue Jul 26 09:08:01 2022 +0200 dt-bindings: net: cdns,macb: use correct xlnx prefix for Xilinx Use correct vendor for Xilinx versions of Cadence MACB/GEM Ethernet controller. The Versal compatible was not released, so it can be changed. Zynq-7xxx and Ultrascale+ has to be kept in new and deprecated form. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20220726070802.26579-1-krzysztof.kozlowski@linaro.org Signed-off-by: Paolo Abeni commit 40d060b8158e26438398bf1132925f666e3b6480 Author: Gustavo A. R. Silva Date: Wed Oct 6 13:08:10 2021 -0500 ASoC: q6asm: use kcalloc() instead of kzalloc() Use 2-factor multiplication argument form kcalloc() instead of kzalloc(). Link: https://github.com/KSPP/linux/issues/162 Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20211006180810.GA913370@embeddedor Signed-off-by: Mark Brown commit 779fda86bdeb86bad6daa4f0ecf37788dfc26f6c Merge: ac165aab46989 2bd1753e8c431 Author: Thomas Gleixner Date: Thu Jul 28 12:36:35 2022 +0200 Merge tag 'irqchip-5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip/genirq updates from Marc Zyngier: * Core code update: - Non-SMP IRQ affinity fixes, allowing UP kernel to behave similarly to SMP ones for the purpose of interrupt affinity - Let irq_set_chip_handler_name_locked() take a const struct irq_chip * - Tidy-up the NOMAP irqdomain API variant - Teach action_show() to use for_each_action_of_desc() - Make irq_chip_request_resources_parent() allow the parent callback to be optional - Remove dynamic allocations from populate_parent_alloc_arg() * New drivers: - Merge the long awaited IRQ support for the LoongArch architecture, with the provisional ACPICA update (to be reverted once the official support lands) - New Renesas RZ/G2L IRQC driver, equipped with its companion GPIO driver * Driver updates - Optimise the hot path operations for the SiFive PLIC, trading the locking for per-CPU priority masking masking operations which are apparently faster - Work around broken PLIC implementations that deal pretty badly with edge-triggered interrupts. Flag two implementations as affected. - Simplify the irq-stm32-exti driver, particularly the table that remaps the interrupts from exti to the GIC, reducing the memory usage - Convert the ocelot irq_chip to being immutable - Check ioremap() return value in the MIPS GIC driver - Move MMP driver init function declarations into the common .h - The obligatory typo fixes Link: https://lore.kernel.org/all/20220727192356.1860546-1-maz@kernel.org commit cceeeb6a6d02e7b9a74ddd27a3225013b34174aa Author: Juri Lelli Date: Mon Jun 27 11:50:51 2022 +0200 wait: Fix __wait_event_hrtimeout for RT/DL tasks Changes to hrtimer mode (potentially made by __hrtimer_init_sleeper on PREEMPT_RT) are not visible to hrtimer_start_range_ns, thus not accounted for by hrtimer_start_expires call paths. In particular, __wait_event_hrtimeout suffers from this problem as we have, for example: fs/aio.c::read_events wait_event_interruptible_hrtimeout __wait_event_hrtimeout hrtimer_init_sleeper_on_stack <- this might "mode |= HRTIMER_MODE_HARD" on RT if task runs at RT/DL priority hrtimer_start_range_ns WARN_ON_ONCE(!(mode & HRTIMER_MODE_HARD) ^ !timer->is_hard) fires since the latter doesn't see the change of mode done by init_sleeper Fix it by making __wait_event_hrtimeout call hrtimer_sleeper_start_expires, which is aware of the special RT/DL case, instead of hrtimer_start_range_ns. Reported-by: Bruno Goncalves Signed-off-by: Juri Lelli Signed-off-by: Thomas Gleixner Reviewed-by: Daniel Bristot de Oliveira Reviewed-by: Valentin Schneider Link: https://lore.kernel.org/r/20220627095051.42470-1-juri.lelli@redhat.com commit 75fed76ebc8f75e7a9f8c9ca39482aa34932ad41 Merge: e0dccc3b76fb3 148399c90e25b Author: Thomas Gleixner Date: Thu Jul 28 12:33:34 2022 +0200 Merge tag 'timers-v5.20-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevent/source updates from Daniel Lezcano: - Add the missing DT bindings for the MTU nomadik timer (Linus Walleij) - Fix grammar typo in the ARM global timer Kconfig option (Randy Dunlap) - Add the tegra186 timer and use it on the tegra234 board (Thierry Reding) - Add the 'CPUXGPT' CPU timer for Mediatek MT6795 and implement a workaround to overcome an ATF bug where the timer is not correctly initialized (AngeloGioacchino Del Regno) - Rework the suspend/resume approach to enable the feature on the timer even it is not an active clock and fix a compilation warning (Claudiu Beznea) - Add the Add R-Car Gen4 timer support along with the DT bindings (Wolfram Sang) - Add compatible for ti,am654-timer to support AM6 SoC (Tony Lindgren) - Fix Kconfig option to put it back to 'bool' instead of 'tristate' for the tegra186 (Daniel Lezcano) - Sort 'family,type' DT bindings for the Renesas timers (Geert Uytterhoeven) - Add compatible 'allwinner,sun20i-d1-timer' for Allwinner D1 (Samuel Holland) - Remove unnecessary (void*) conversions for sun4i (XU pengfei) - Remove unnecessary (void*) conversions for sun5i (Li zeming) Link: https://lore.kernel.org/all/7472984e-f502-5f27-82bf-070127dd85a5@linaro.org commit cb774bd35318c1b4cb61f6f2caac85537d07fbde Author: Danny van Heumen Date: Mon Jul 11 23:21:16 2022 +0000 wifi: brcmfmac: prevent double-free on hardware-reset In case of buggy firmware, brcmfmac may perform a hardware reset. If during reset and subsequent probing an early failure occurs, a memory region is accidentally double-freed. With hardened memory allocation enabled, this error will be detected. - return early where appropriate to skip unnecessary clean-up. - set '.freezer' pointer to NULL to prevent double-freeing under possible other circumstances and to re-align result under various different behaviors of memory allocation freeing. - correctly claim host on func1 for disabling func2. - after reset, do not initiate probing immediately, but rely on events. Given a firmware crash, function 'brcmf_sdio_bus_reset' is called. It calls 'brcmf_sdiod_remove', then follows up with 'brcmf_sdiod_probe' to reinitialize the hardware. If 'brcmf_sdiod_probe' fails to "set F1 blocksize", it exits early, which includes calling 'brcmf_sdiod_remove'. In both cases 'brcmf_sdiod_freezer_detach' is called to free allocated '.freezer', which has not yet been re-allocated the second time. Stacktrace of (failing) hardware reset after firmware-crash: Code: b9402b82 8b0202c0 eb1a02df 54000041 (d4210000) ret_from_fork+0x10/0x20 kthread+0x154/0x160 worker_thread+0x188/0x504 process_one_work+0x1f4/0x490 brcmf_core_bus_reset+0x34/0x44 [brcmfmac] brcmf_sdio_bus_reset+0x68/0xc0 [brcmfmac] brcmf_sdiod_probe+0x170/0x21c [brcmfmac] brcmf_sdiod_remove+0x48/0xc0 [brcmfmac] kfree+0x210/0x220 __slab_free+0x58/0x40c Call trace: x2 : 0000000000000040 x1 : fffffc00002d2b80 x0 : ffff00000b4aee40 x5 : ffff8000013fa728 x4 : 0000000000000001 x3 : ffff00000b4aee00 x8 : ffff800009967ce0 x7 : ffff8000099bfce0 x6 : 00000006f8005d01 x11: ffff8000099bfce0 x10: 00000000fffff000 x9 : ffff8000083401d0 x14: 0000000000000000 x13: 657a69736b636f6c x12: 6220314620746573 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000030 x20: fffffc00002d2ba0 x19: fffffc00002d2b80 x18: 0000000000000000 x23: ffff00000b4aee00 x22: ffff00000b4aee00 x21: 0000000000000001 x26: ffff00000b4aee00 x25: ffff0000f7753705 x24: 000000000001288a x29: ffff80000a22bbf0 x28: ffff000000401200 x27: 000000008020001a sp : ffff80000a22bbf0 lr : kfree+0x210/0x220 pc : __slab_free+0x58/0x40c pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) Workqueue: events brcmf_core_bus_reset [brcmfmac] Hardware name: Pine64 Pinebook Pro (DT) CPU: 2 PID: 639 Comm: kworker/2:2 Tainted: G C 5.16.0-0.bpo.4-arm64 #1 Debian 5.16.12-1~bpo11+1 nvmem_rockchip_efuse industrialio_triggered_buffer videodev snd_soc_core snd_pcm_dmaengine kfifo_buf snd_pcm io_domain mc industrialio mt> Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reje> Internal error: Oops - BUG: 0 [#1] SMP kernel BUG at mm/slub.c:379! Signed-off-by: Danny van Heumen Reviewed-by: Arend van Spriel Reviewed-by: Ulf Hansson Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/id1HN6qCMAirApBzTA6fT7ZFWBBGCJhULpflxQ7NT6cgCboVnn3RHpiOFjA9SbRqzBRFLk9ES0C4FNvO6fUQsNg7pqF6ZSNAYUo99nHy8PY=@dannyvanheumen.nl commit 5c54ab24377b999c7f1c30b41218e6490cd4ac80 Author: Alvin Šipraga Date: Mon Jul 11 14:30:04 2022 +0200 wifi: brcmfmac: support brcm,ccode-map-trivial DT property Commit a21bf90e927f ("brcmfmac: use ISO3166 country code and 0 rev as fallback on some devices") introduced a fallback mechanism whereby a trivial mapping from ISO3166 country codes to firmware country code and revision is used on some devices. This fallback operates on the device level, so it is enabled only for certain supported chipsets. In general though, the firmware country codes are determined by the CLM blob, which is board-specific and may vary despite the underlying chipset being the same. The aforementioned commit is actually a refinement of a previous commit that was reverted in commit 151a7c12c4fc ("Revert "brcmfmac: use ISO3166 country code and 0 rev as fallback"") due to regressions with a BCM4359 device. The refinement restricted the fallback mechanism to specific chipsets such as the BCM4345. We use a chipset - CYW88359 - that the driver identifies as a BCM4359 too. But in our case, the CLM blob uses ISO3166 country codes internally, and all with revision 0. So the trivial mapping is exactly what is needed in order for the driver to sync the kernel regulatory domain to the firmware. This is just a matter of how the CLM blob was prepared by the hardware vendor. The same could hold for other boards too. Although the brcm,ccode-map device tree property is useful for cases where the mapping is more complex, the trivial case invites a much simpler specification. This patch adds support for parsing the brcm,ccode-map-trivial device tree property. Subordinate to the more specific brcm,ccode-map property, this new proprety simply informs the driver that the fallback method should be used in every case. In the absence of the new property in the device tree, expect no functional change. Signed-off-by: Alvin Šipraga Reviewed-by: Ahmad Fatoum Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220711123005.3055300-3-alvin@pqrs.dk commit 8406993a891f39a0c7062bf071f7591bacb800bc Author: Alvin Šipraga Date: Mon Jul 11 14:30:03 2022 +0200 dt-bindings: bcm4329-fmac: add optional brcm,ccode-map-trivial The bindings already offer a brcm,ccode-map property to describe the mapping between the kernel's ISO3166 alpha 2 country code string and the firmware's country code string and revision number. This is a board-specific property and determined by the CLM blob firmware provided by the hardware vendor. However, in some cases the firmware will also use ISO3166 country codes internally, and the revision will always be zero. This implies a trivial mapping: cc -> { cc, 0 }. For such cases, add an optional property brcm,ccode-map-trivial which obviates the need to describe every trivial country code mapping in the device tree with the existing brcm,ccode-map property. The new property is subordinate to the more explicit brcm,ccode-map property. Signed-off-by: Alvin Šipraga Reviewed-by: Ahmad Fatoum Acked-by: Rob Herring Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220711123005.3055300-2-alvin@pqrs.dk commit 4af4c0b93c15ece3732dee5e5dbcf0a01904413a Author: Hans de Goede Date: Fri Jul 8 15:37:12 2022 +0200 wifi: brcmfmac: Replace default (not configured) MAC with a random MAC On some boards there is no eeprom to hold the nvram, in this case instead a board specific nvram is loaded from /lib/firmware. On most boards the macaddr=... setting in the /lib/firmware nvram file is ignored because the wifi/bt chip has a unique MAC programmed into the chip itself. But in some cases the actual MAC from the /lib/firmware nvram file gets used, leading to MAC conflicts. The MAC addresses in the troublesome nvram files seem to all come from the same nvram file template, so we can detect this by checking for the template nvram file MAC. Detect that the default MAC address is being used and replace it with a random MAC address to avoid MAC address conflicts. Note that udev will detect this is a random MAC based on /sys/class/net/wlan0/addr_assign_type and then replace this with a MAC based on hashing the netdev-name + the machine-id. So that the MAC address is both guaranteed to be unique per machine while it is still the same/persistent at each boot (assuming the default Link.MACAddressPolicy=persistent udev setting). Signed-off-by: Hans de Goede Reviewed-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220708133712.102179-2-hdegoede@redhat.com commit cf1239e5b7bf3db82cb54dc754fca5b5d4a6b3eb Author: Hans de Goede Date: Fri Jul 8 15:37:11 2022 +0200 wifi: brcmfmac: Add brcmf_c_set_cur_etheraddr() helper Add a little helper to send "cur_etheraddr" commands to the interface and to handle the error reporting of it in a single place. Signed-off-by: Hans de Goede Acked-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220708133712.102179-1-hdegoede@redhat.com commit 02a186f1e96bfca8fd19862dad14ea011712ce9d Author: Paul Cercueil Date: Mon Jun 27 20:37:01 2022 +0100 wifi: brcmfmac: Remove #ifdef guards for PM related functions Use the new DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() macros to handle the .suspend/.resume callbacks. These macros allow the suspend and resume functions to be automatically dropped by the compiler when CONFIG_SUSPEND is disabled, without having to use #ifdef guards. Some other functions not directly called by the .suspend/.resume callbacks, but still related to PM were also taken outside #ifdef guards. The advantage is then that these functions are now always compiled independently of any Kconfig option, and thanks to that bugs and regressions are easier to catch. Signed-off-by: Paul Cercueil Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220627193701.31074-1-paul@crapouillou.net commit bef11f1edc40cee156c60f9dbbbd9725a56b3639 Author: Dan Carpenter Date: Thu Jun 16 10:54:24 2022 +0300 wifi: brcmfmac: use strreplace() in brcmf_of_probe() The for loop in brcmf_of_probe() would ideally end with something like "i <= strlen(board_type)" instead of "i < board_type[i]". But fortunately, the two are equivalent. Anyway, it's simpler to use strreplace() instead. Signed-off-by: Dan Carpenter Suggested-by: Johannes Berg Reviewed-by: Linus Walleij Acked-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YqrhsKcjEA7B2pC4@kili commit 7d85e9cb405e00bb6583dc1f821eae905711382d Merge: 5f10376b6bc1e cd8efeeed16e8 Author: Paolo Abeni Date: Thu Jul 28 11:54:56 2022 +0200 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: PPPoE offload support Marcin Szycik says: Add support for dissecting PPPoE and PPP-specific fields in flow dissector: PPPoE session id and PPP protocol type. Add support for those fields in tc-flower and support offloading PPPoE. Finally, add support for hardware offload of PPPoE packets in switchdev mode in ice driver. Example filter: tc filter add dev $PF1 ingress protocol ppp_ses prio 1 flower pppoe_sid \ 1234 ppp_proto ip skip_sw action mirred egress redirect dev $VF1_PR Changes in iproute2 are required to use the new fields (will be submitted soon). ICE COMMS DDP package is required to create a filter in ice. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: Add support for PPPoE hardware offload flow_offload: Introduce flow_match_pppoe net/sched: flower: Add PPPoE filter flow_dissector: Add PPPoE dissectors ==================== Link: https://lore.kernel.org/r/20220726203133.2171332-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit 12a18d79dc14c80b358dbd26461614b97f2ea4a6 Merge: 7c862ee928adf bedd94835a352 Author: Marc Kleine-Budde Date: Thu Jul 28 09:32:28 2022 +0200 Merge patch series "can: add ethtool support and reporting of timestamping capabilities" Vincent Mailhol says: ==================== This series revolves around ethtool and timestamping. Its ultimate goal is that the timestamping implementation within socketCAN meets the specification of other network drivers in the kernel. This way, tcpdump or other tools derived from libpcap can be used to do timestamping on CAN devices. * Example on a device with hardware timestamp support * Before this series: | # tcpdump -j adapter_unsynced -i can0 | tcpdump: WARNING: When trying to set timestamp type | 'adapter_unsynced' on can0: That type of time stamp is not supported | by that device After applying this series, the warning disappears and tcpdump can be used to get RX hardware timestamps. This series is articulated in three major parts. * Part 1: Add TX software timestamps and report the software timestamping capabilities through ethtool. All the drivers using can_put_echo_skb() already support TX software timestamps. However, the five drivers not using this function (namely can327, janz-ican3, slcan, vcan and vxcan) lack such support. Patch 1 to 4 adds this support. Finally, patch 5 advertises the timesamping capabilities of all drivers which do not support hardware timestamps. * Part 2: add TX hardware timestapms This part is a single patch. In SocketCAN TX hardware is equal to the RX hardware timestamps of the corresponding loopback frame. Reuse the TX hardware timestamp to populate the RX hardware timestamp. While the need of this feature can be debatable, we implement it here so that generic timestamping tools which are agnostic of the specificity of SocketCAN can still obtain the value. For example, tcpdump expects for both TX and RX hardware timestamps to be supported in order to do: | # tcpdump -j adapter_unsynced -i canX * Part 3: report the hardware timestamping capabilities and implement the hardware timestamps ioctls. The kernel documentation specifies in [1] that, for the drivers which support hardware timestamping, SIOCSHWTSTAMP ioctl must be supported and that SIOCGHWTSTAMP ioctl should be supported. Currently, none of the CAN drivers do so. This is a gap. Furthermore, even if not specified, the tools based on libpcap (e.g. tcpdump) also expect ethtool_ops::get_ts_info to be implemented. This last part first adds some generic implementation of net_device_ops::ndo_eth_ioctl and ethtool_ops::get_ts_info which can be used by the drivers with hardware timestamping capabilities. It then uses those generic functions to add ioctl and reporting functionalities to the drivers with hardware timestamping support (namely: mcp251xfd, etas_es58x, kvaser_{pciefd,usb}, peak_{canfd,usb}) [1] Kernel doc: Timestamping, section 3.1 "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers * Testing * I also developed a tool to test all the different timestamps. For those who would also like to test it, please have a look at: https://lore.kernel.org/linux-can/20220725134345.432367-1-mailhol.vincent@wanadoo.fr/T/ * Changelog * changes since v3: https://lore.kernel.org/all/20220726102454.95096-1-mailhol.vincent@wanadoo.fr * The peak drivers (both PCI and USB) do not support hardware TX timestamps (only RX). Implement specific ioctl and ethtool callback functions for this device. changes since v2: https://lore.kernel.org/all/20220725155354.482986-1-mailhol.vincent@wanadoo.fr * The c_can, flexcan, mcp251xfd and the slcan drivers already declared a struct ethtool_ops. Do not declare again the same structure and instead populate the .get_ts_info() field of the existing structures. changes since v1: https://lore.kernel.org/all/20220725133208.432176-1-mailhol.vincent@wanadoo.fr * First series had a patch to implement ethtool_ops::get_drvinfo. This proved to be useless. This patch was removed and all the clean-up patches made in preparation of that one were moved to a separate series: https://lore.kernel.org/linux-can/20220725153124.467061-1-mailhol.vincent@wanadoo.fr/T/#u ==================== Link: https://lore.kernel.org/all/20220727101641.198847-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit bedd94835a352ba4ec352c7a7ad13f41861590dd Author: Vincent Mailhol Date: Wed Jul 27 19:16:41 2022 +0900 can: peak_usb: advertise timestamping capabilities and add ioctl support Currently, userland has no method to query which timestamping features are supported by the peak_usb driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way to add hardware timestamp support is to implement ethtool_ops::get_ts_info() in order to advertise the timestamping capabilities and to implement net_device_ops::ndo_eth_ioctl() as requested in [1]. Currently, the driver only supports hardware RX timestamps [2] but not hardware TX. For this reason, the generic function can_ethtool_op_get_ts_info_hwts() and can_eth_ioctl_hwts() can not be reused and instead this patch adds pcan_get_ts_info() and peak_eth_ioctl(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers [2] https://lore.kernel.org/linux-can/20220727080634.l6uttnbrmwbabh3o@pengutronix.de/ CC: Stephane Grosjean Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-15-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 8ba09bfa2b08802e023519e91798ea83c32f2c2f Author: Vincent Mailhol Date: Wed Jul 27 19:16:40 2022 +0900 can: peak_canfd: advertise timestamping capabilities and add ioctl support Currently, userland has no method to query which timestamping features are supported by the peak_canfd driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way to add hardware timestamp support is to implement ethtool_ops::get_ts_info() in order to advertise the timestamping capabilities and to implement net_device_ops::ndo_eth_ioctl() as requested in [1]. Currently, the driver only supports hardware RX timestamps [2] but not hardware TX. For this reason, the generic function can_ethtool_op_get_ts_info_hwts() and can_eth_ioctl_hwts() can not be reused and instead this patch adds peak_get_ts_info() and peak_eth_ioctl(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers [2] https://lore.kernel.org/linux-can/20220727084257.brcbbf7lksoeekbr@pengutronix.de/ CC: Stephane Grosjean Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-14-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 1d5eeda23f361827ef6fe459732f0573dce22670 Author: Vincent Mailhol Date: Wed Jul 27 19:16:39 2022 +0900 can: kvaser_usb: advertise timestamping capabilities and add ioctl support Currently, userland has no method to query which timestamping features are supported by the kvaser_usb driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way for a network driver to advertise what kind of timestamping it supports is to implement ethtool_ops::get_ts_info(). Here, we use the CAN specific can_ethtool_op_get_ts_info_hwts() function to achieve this. In addition, the driver currently does not support the hardware timestamps ioctls. According to [1], SIOCSHWTSTAMP is "must" and SIOCGHWTSTAMP is "should". This patch fills up that gap by implementing net_device_ops::ndo_eth_ioctl() using the CAN specific function can_eth_ioctl_hwts(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers CC: Jimmy Assarsson Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-13-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit fa5cc7e115d7b7e0a55ba347070984553a952bf0 Author: Vincent Mailhol Date: Wed Jul 27 19:16:38 2022 +0900 can: kvaser_pciefd: advertise timestamping capabilities and add ioctl support Currently, userland has no method to query which timestamping features are supported by the kvaser_pciefd driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way for a network driver to advertise what kind of timestamping it supports is to implement ethtool_ops::get_ts_info(). Here, we use the CAN specific can_ethtool_op_get_ts_info_hwts() function to achieve this. In addition, the driver currently does not support the hardware timestamps ioctls. According to [1], SIOCSHWTSTAMP is "must" and SIOCGHWTSTAMP is "should". This patch fills up that gap by implementing net_device_ops::ndo_eth_ioctl() using the CAN specific function can_eth_ioctl_hwts(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers CC: Jimmy Assarsson Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-12-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 1d46efa0008a6d73dad40e78a2b3fa6d3cfb74e4 Author: Vincent Mailhol Date: Wed Jul 27 19:16:37 2022 +0900 can: etas_es58x: advertise timestamping capabilities and add ioctl support Currently, userland has no method to query which timestamping features are supported by the etas_es58x driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way for a network driver to advertise what kind of timestamping is supports is to implement ethtool_ops::get_ts_info(). Here, we use the CAN specific can_ethtool_op_get_ts_info_hwts() function to achieve this. In addition, the driver currently does not support the hardware timestamps ioctls. According to [1], SIOCSHWTSTAMP is "must" and SIOCGHWTSTAMP is "should". This patch fills up that gap by implementing net_device_ops::ndo_eth_ioctl() using the CAN specific function can_eth_ioctl_hwts(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-11-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit b1f6b93e678fb0ce2cecb0032709fc17c6526299 Author: Vincent Mailhol Date: Wed Jul 27 19:16:36 2022 +0900 can: mcp251xfd: advertise timestamping capabilities and add ioctl support Currently, userland has no methods to query which timestamping features are supported by the mcp251xfd driver (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way for a network driver to advertise what kind of timestamping it supports is to implement ethtool_ops::get_ts_info(). Here, we use the CAN specific can_ethtool_op_get_ts_info_hwts() function to achieve this. In addition, the driver currently does not support the hardware timestamps ioctls. According to [1], SIOCSHWTSTAMP is "must" and SIOCGHWTSTAMP is "should". This patch fills up that gap by implementing net_device_ops::ndo_eth_ioctl() using the CAN specific function can_eth_ioctl_hwts(). [1] kernel doc Timestamping, section 3.1: "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-10-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 90f942c5a6d775bad1be33ba214755314105da4a Author: Vincent Mailhol Date: Wed Jul 27 19:16:35 2022 +0900 can: dev: add generic function can_eth_ioctl_hwts() Tools based on libpcap (such as tcpdump) expect the SIOCSHWTSTAMP ioctl call to be supported. This is also specified in the kernel doc [1]. The purpose of this ioctl is to toggle the hardware timestamps. Currently, CAN devices which support hardware timestamping have those always activated. can_eth_ioctl_hwts() is a dumb function that will always succeed when requested to set tx_type to HWTSTAMP_TX_ON or rx_filter to HWTSTAMP_FILTER_ALL. [1] Kernel doc: Timestamping, section 3.1 "Hardware Timestamping Implementation: Device Drivers" Link: https://docs.kernel.org/networking/timestamping.html#hardware-timestamping-implementation-device-drivers Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-9-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 7fb48d25b5ce3bc488dbb019bf1736248181de9a Author: Vincent Mailhol Date: Wed Jul 27 19:16:34 2022 +0900 can: dev: add generic function can_ethtool_op_get_ts_info_hwts() Add function can_ethtool_op_get_ts_info_hwts(). This function will be used by CAN devices with hardware TX/RX timestamping support to implement ethtool_ops::get_ts_info. This function does not offer support to activate/deactivate hardware timestamps at device level nor support the filter options (which is currently the case for all CAN devices with hardware timestamping support). The fact that hardware timestamp can not be deactivated at hardware level does not impact the userland. As long as the user do not set SO_TIMESTAMPING using a setsockopt() or ioctl(), the kernel will not emit TX timestamps (RX timestamps will still be reproted as it is the case currently). Drivers which need more fine grained control remains free to implement their own function, but we foresee that the generic function introduced here will be sufficient for the majority. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-8-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 8bdd1112edcd3edce2843e03826204a84a61042d Author: Vincent Mailhol Date: Wed Jul 27 19:16:33 2022 +0900 can: dev: add hardware TX timestamp Because of the loopback feature of socket CAN, hardware TX timestamps are nothing else than the hardware RX timespamp of the corresponding loopback packet. This patch simply reuses the hardware RX timestamp. The rationale to clone this timestamp value is that existing tools which rely of libpcap (such as tcpdump) expect support for both TX and RX hardware timestamps in order to activate the feature (i.e. no granular control to activate either of TX or RX hardware timestamps). Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-7-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 409c188c57cdb5cb1dfcac79e72b5169f0463fe4 Author: Vincent Mailhol Date: Wed Jul 27 19:16:32 2022 +0900 can: tree-wide: advertise software timestamping capabilities Currently, some CAN drivers support hardware timestamping, some do not. But userland has no method to query which features are supported (aside maybe of getting RX messages and observe whether or not hardware timestamps stay at zero). The canonical way for a network driver to advertised what kind of timestamping it supports is to implement ethtool_ops::get_ts_info(). This patch only targets the CAN drivers which *do not* support hardware timestamping. For each of those CAN drivers, implement the get_ts_info() using the generic ethtool_op_get_ts_info(). This way, userland can do: | $ ethtool --show-time-stamping canX to confirm the device timestamping capacities. N.B. the drivers which support hardware timestamping will be migrated in separate patches. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-6-mailhol.vincent@wanadoo.fr [mkl: mscan: add missing mscan_ethtool_ops] Signed-off-by: Marc Kleine-Budde commit 87eb04bb87fbdf1d53f0fc64e6fc56ba2b504762 Author: Lucas Tanure Date: Wed Jul 27 10:59:23 2022 +0100 ACPI: scan: Add CLSA0101 Laptop Support Add CLSA0101 id to the ignore_serial_bus_ids so serial-multi-instantiate can correctly instantiate the driver. Signed-off-by: Lucas Tanure Link: https://lore.kernel.org/r/20220727095924.80884-4-tanureal@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 1e24881d8b2a7c198a67fe9e5179e9efb2140df7 Author: Lucas Tanure Date: Wed Jul 27 10:59:22 2022 +0100 ALSA: hda: cs35l41: Support CLSA0101 Add support for Intel version of Legion 7 laptop. Signed-off-by: Lucas Tanure Link: https://lore.kernel.org/r/20220727095924.80884-3-tanureal@opensource.cirrus.com Signed-off-by: Takashi Iwai commit f81ee579c0898201eb2b5105718bedf34c0401f9 Author: Lucas Tanure Date: Wed Jul 27 10:59:21 2022 +0100 ALSA: hda: cs35l41: Use the CS35L41 HDA internal define Follow GPIO1 pattern, use cs35l41 HDA internal define for IRQ and then translate to ASoC cs35l41 define. Signed-off-by: Lucas Tanure Link: https://lore.kernel.org/r/20220727095924.80884-2-tanureal@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 5f10376b6bc1e2773f56977980ab08c9e4fa91a7 Author: Jakub Kicinski Date: Tue Jul 26 14:56:52 2022 -0700 add missing includes and forward declarations to networking includes under linux/ Similarly to a recent include/net/ cleanup, this patch adds missing includes to networking headers under include/linux. All these problems are currently masked by the existing users including the missing dependency before the broken header. Link: https://lore.kernel.org/all/20220723045755.2676857-1-kuba@kernel.org/ v1 Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20220726215652.158167-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 3fe4076482789c2c4a772f6676b246a0d96c99c4 Author: Slark Xiao Date: Fri Jul 22 18:05:18 2022 +0800 kernfs: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220722100518.79741-1-slark_xiao@163.com Signed-off-by: Greg Kroah-Hartman commit 321eaf317dec3710e7a4ad3b3c363d9314c15195 Author: Dave Airlie Date: Thu Jul 21 14:43:52 2022 +1000 docs: driver-api: firmware: add driver firmware guidelines. (v3) A recent snafu where Intel ignored upstream feedback on a firmware change, led to a late rc6 fix being required. In order to avoid this in the future we should document some expectations around linux-firmware. I was originally going to write this for drm, but it seems quite generic advice. v2: rewritten with suggestions from Thorsten Leemhuis v3: rewritten with suggestions from Mauro Acked-by: Luis Chamberlain Acked-by: Rodrigo Vivi Acked-by: Daniel Vetter Acked-by: Harry Wentland Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20220721044352.3110507-1-airlied@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4158e38967975f14c3e6fb0e04df90e32061d463 Author: Paolo Abeni Date: Tue Jul 26 13:09:27 2022 +0200 Revert "Merge branch 'octeontx2-minor-tc-fixes'" This reverts commit 35d099da41967f114c6472b838e12014706c26e7, reversing changes made to 58d8bcd47ecc55f1ab92320fe36c31ff4d83cc0c. I wrongly applied that to the net-next tree instead of the intended target tree (net). Reverting it on net-next. Signed-off-by: Paolo Abeni commit c528bbb7dc062c707f6064eec1bccafb8490758f Author: Philipp Hortmann Date: Thu Jul 28 07:59:45 2022 +0200 staging: vt6655: Convert macro vt6655_mac_clear_stck_ds to function Convert once used macro to static function. Multiline macros are not liked by kernel community. Rename variable byOrgValue to reg_value to avoid CamelCase which is not accepted by checkpatch.pl. Change variable declaration to u8 as this improves readability. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/cbfe5cc170b68564ff45bb7f45c63de241c2a664.1658986804.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 899336721928914bfbda515457706616bf2e676d Author: Philipp Hortmann Date: Thu Jul 28 07:59:32 2022 +0200 staging: vt6655: Rename MACvClearStckDS Rename MACvClearStckDS macro to vt6655_mac_clear_stck_ds to avoid CamelCase which is not accepted by checkpatch.pl and to clean up namespace. Signed-off-by: Philipp Hortmann Link: https://lore.kernel.org/r/8ba4413d52e95406393755f48da065511b891f03.1658986804.git.philipp.g.hortmann@gmail.com Signed-off-by: Greg Kroah-Hartman commit 81e878887ff82a7dd42f22951391069a5d520627 Author: Peter Suti Date: Wed Jul 27 09:35:50 2022 +0200 staging: fbtft: core: set smem_len before fb_deferred_io_init call The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before initializing info->fix.smem_len. It is set to zero by the framebuffer_alloc() function. It will trigger a WARN_ON() at the start of fb_deferred_io_init() and the function will not do anything. Fixes: 856082f021a2 ("fbdev: defio: fix the pagelist corruption") Signed-off-by: Peter Suti Link: https://lore.kernel.org/r/20220727073550.1491126-1-peter.suti@streamunlimited.com Signed-off-by: Greg Kroah-Hartman commit 96dd9a2f958be4781d8d01ed881a46864bf458aa Author: Justin Stitt Date: Mon Jul 18 16:06:26 2022 -0700 lib/test_printf.c: fix clang -Wformat warnings see warnings: | lib/test_printf.c:157:52: error: format specifies type 'unsigned char' | but the argument has type 'int' [-Werror,-Wformat] test("0|1|1|128|255", | "%hhu|%hhu|%hhu|%hhu|%hhu", 0, 1, 257, 128, -1); - | lib/test_printf.c:158:55: error: format specifies type 'char' but the | argument has type 'int' [-Werror,-Wformat] test("0|1|1|-128|-1", | "%hhd|%hhd|%hhd|%hhd|%hhd", 0, 1, 257, 128, -1); - | lib/test_printf.c:159:41: error: format specifies type 'unsigned short' | but the argument has type 'int' [-Werror,-Wformat] | test("2015122420151225", "%ho%ho%#ho", 1037, 5282, -11627); There's an ongoing movement to eventually enable the -Wformat flag for clang. Previous patches have targeted incorrect usage of format specifiers. In this case, however, the "incorrect" format specifiers are intrinsically part of the test cases. Hence, fixing them would be misaligned with their intended purpose. My proposed fix is to simply disable the warnings so that one day a clean build of the kernel with clang (and -Wformat enabled) would be possible. It would also keep us in the green for alot of the CI bots. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Suggested-by: Nathan Chancellor Suggested-by: Nick Desaulniers Signed-off-by: Justin Stitt Reviewed-by: Petr Mladek Reviewed-by: Nick Desaulniers Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20220718230626.1029318-1-justinstitt@google.com commit 9e5f399f5c9f62e537735f2f8e42bd2f7c255c1f Author: Jiri Slaby Date: Thu Jul 28 08:10:56 2022 +0200 tty: serial: document uart_get_console() This was the only function mentioned in the text, but was neither linked nor documented. So document and link it, so that hyperlinking works in the text. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-6-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 987233b342b950653d21c5e3e5b78689c995c869 Author: Jiri Slaby Date: Thu Jul 28 08:10:55 2022 +0200 tty: serial: serial_core, reformat kernel-doc for functions There are many annotated functions in serial_core.c, but they do not completely conform to the kernel-doc style. So reformat them and link them from the Documentation. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-5-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit d34d7c4b774dac1d4be440207ab9e347f599dd30 Author: Jiri Slaby Date: Thu Jul 28 08:10:54 2022 +0200 Documentation: serial: link uart_ops properly The syntax to reference a struct in text is "struct XY". So reference uart_ops properly, so that hyperlinks work. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-4-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 27940abd555228fdda39a40081ae02450c500f35 Author: Jiri Slaby Date: Thu Jul 28 08:10:53 2022 +0200 Documentation: serial: move GPIO kernel-doc to the functions The GPIO uart functions are documented in Documentation. Move and transform this documentation into kernel-doc directly in the code and reference it in Documentation using kernel-doc:. This makes it easier to update, maintain and check by the build. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-3-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit c4bd17a6ddf3b92bf9d7939ae251570ace14bb52 Author: Jiri Slaby Date: Thu Jul 28 08:10:52 2022 +0200 Documentation: serial: dedup kernel-doc for uart functions Some of the serial (uart_*) functions are documented twice. Once as kernel-doc along their sources and once in Documentation. So deduplicate these texts, merge them into kernel-doc in the sources, and link them using kernel-doc: from the Documentation. To be properly linked and rendered, tabulators had to be removed from the comments. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit e60a7233684aa8bbe9090537720fe6a1e901d823 Author: Jiri Slaby Date: Thu Jul 28 08:10:51 2022 +0200 Documentation: serial: move uart_ops documentation to the struct While it's a lot of text, it always helps to keep it up to date when it's by the source. (And not in a separate file.) The documentation tooling also makes sure that all members of the structure are documented. (If not, it complains loudly.) Finally, there needs to be no comments inlined in the structure, so they are dropped as they are superfluous now. The compilation time of this header (tested with serial_core.c) didn't change in my testing at all. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220728061056.20799-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman commit 0f42d7f23fd9be143de73eb040c2806a75db8853 Author: Jagan Teki Date: Sun Jul 24 02:13:25 2022 +0530 dt-bindings: serial: snps-dw-apb-uart: Document Rockchip RV1126 Document compatible string for Rockchip RV1126 SoC. Signed-off-by: Jagan Teki Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220723204335.750095-13-jagan@edgeble.ai Signed-off-by: Greg Kroah-Hartman commit a7209541239e5dd44d981289e5f9059222d40fd1 Author: Narendra Hadke Date: Tue Jul 26 11:12:21 2022 +0200 serial: mvebu-uart: uart2 error bits clearing For mvebu uart2, error bits are not cleared on buffer read. This causes interrupt loop and system hang. Cc: stable@vger.kernel.org Reviewed-by: Yi Guo Reviewed-by: Nadav Haklai Signed-off-by: Narendra Hadke Signed-off-by: Pali Rohár Link: https://lore.kernel.org/r/20220726091221.12358-1-pali@kernel.org Signed-off-by: Greg Kroah-Hartman commit 707f816f25590c20e056b3bd4a17ce69b03fe856 Author: Sherry Sun Date: Mon Jul 25 13:01:15 2022 +0800 tty: serial: fsl_lpuart: correct the count of break characters The LPUART can't distinguish between a break signal and a framing error, so need to count the break characters if there is a framing error and received data is zero instead of the parity error. Fixes: 5541a9bacfe5 ("serial: fsl_lpuart: handle break and make sysrq work") Reviewed-by: Michael Walle Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20220725050115.12396-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit c7039ce904c0f80253a1171d10353e7832c3e4b3 Author: Ben Dooks Date: Thu Jul 21 22:24:30 2022 +0100 serial: stm32: make info structs static to avoid sparse warnings The info structs are local only to the stm32-usart.c driver and are triggering sparse warnings about being undecalred. Move these into the main driver code and make them static to avoid the following warnings: drivers/tty/serial/stm32-usart.h:42:25: warning: symbol 'stm32f4_info' was not declared. Should it be static? drivers/tty/serial/stm32-usart.h:63:25: warning: symbol 'stm32f7_info' was not declared. Should it be static? drivers/tty/serial/stm32-usart.h:85:25: warning: symbol 'stm32h7_info' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20220721212430.453192-1-ben-linux@fluff.org Signed-off-by: Greg Kroah-Hartman commit 070298c84e5b924c688a4d08c3a9193175cdffd8 Author: Shenwei Wang Date: Thu Jul 14 13:58:58 2022 -0500 serial: fsl_lpuart: zero out parity bit in CS7 mode The LPUART hardware doesn't zero out the parity bit on the received characters. This behavior won't impact the use cases of CS8 because the parity bit is the 9th bit which is not currently used by software. But the parity bit for CS7 must be zeroed out by software in order to get the correct raw data. Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20220714185858.615373-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman commit c474c775716edd46a51bf8161142bbd1545f8733 Author: Vijaya Krishna Nivarthi Date: Sat Jul 16 00:25:43 2022 +0530 tty: serial: qcom-geni-serial: Fix get_clk_div_rate() which otherwise could return a sub-optimal clock rate. In the logic around call to clk_round_rate(), for some corner conditions, get_clk_div_rate() could return an sub-optimal clock rate. Also, if an exact clock rate was not found lowest clock was being returned. Search for suitable clock rate in 2 steps a) exact match or within 2% tolerance b) within 5% tolerance This also takes care of corner conditions. Fixes: c2194bc999d4 ("tty: serial: qcom-geni-serial: Remove uart frequency table. Instead, find suitable frequency with call to clk_round_rate") Reviewed-by: Douglas Anderson Signed-off-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/1657911343-1909-1-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Greg Kroah-Hartman commit b9f1736e475dba0d6da48fdcb831248ab1597886 Author: Guo Mengqi Date: Fri Jul 15 10:33:12 2022 +0800 serial: 8250_bcm2835aux: Add missing clk_disable_unprepare() The error path when get clock frequency fails in bcm2835aux_serial driver does not correctly disable the clock. This flaw was found using a static analysis tool "Hulk Robot", which reported the following warning when analyzing linux-next/master: drivers/tty/serial/8250/8250_bcm2835aux.c: warning: clk_disable_unprepare_missing.cocci The cocci script checks for the existence of clk_disable_unprepare() paired with clk_prepare_enable(). Add the missing clk_disable_unprepare() to the error path. Fixes: fcc446c8aa63 ("serial: 8250_bcm2835aux: Add ACPI support") Reported-by: Hulk Robot Reviewed-by: Florian Fainelli Signed-off-by: Guo Mengqi Link: https://lore.kernel.org/r/20220715023312.37808-1-guomengqi3@huawei.com Signed-off-by: Greg Kroah-Hartman commit 6a37a28b1864c447a20a1609f90f3e2dfaff0705 Author: Vincent Mailhol Date: Wed Jul 27 19:16:31 2022 +0900 can: v(x)can: add software tx timestamps TX timestamps were added to the can_put_echo_skb() function of can_dev modules in [1]. However, vcan and vxcan do not rely on that function and as such do not offer TX timestamping. While it could be arguable whether TX timestamps are really needed for virtual interfaces, we prefer to still add it so that all CAN drivers, without exception, support the software TX timestamps. Add a call to skb_tx_timestamp() in the vcan_tx() and vxcan_xmit() functions so that the modules now support TX software timestamps. [1] commit 741b91f1b0ea ("can: dev: can_put_echo_skb(): add software tx timestamps") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=741b91f1b0ea34f00f6a7d4539b767c409291fcf Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-5-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 6153a7ea650ff1249d703d09a3351c3f77f1fbfa Author: Vincent Mailhol Date: Wed Jul 27 19:16:30 2022 +0900 can: slcan: add software tx timestamps TX timestamps were added to the can_put_echo_skb() function of can_dev modules in [1]. However, slcan does not rely on that function and as such does not offer TX timestamping. Add a call to skb_tx_timestamp() in the slc_xmit() function so that the module now supports TX software timestamps. [1] commit 741b91f1b0ea ("can: dev: can_put_echo_skb(): add software tx timestamps") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=741b91f1b0ea34f00f6a7d4539b767c409291fcf CC: Dario Binacchi Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-4-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 221d14bd3d2e9acc3a33cfcf8f66485d592e5038 Author: Vincent Mailhol Date: Wed Jul 27 19:16:29 2022 +0900 can: janz-ican3: add software tx timestamp TX timestamps were added to the can_put_echo_skb() function of can_dev modules in [1]. However, janz-ican3 does not rely on that function but instead implements its own echo_skb logic. As such it does not offer TX timestamping. Add a call to skb_tx_timestamp() in the ican3_put_echo_skb() function so that the module now supports TX software timestamps. [1] commit 741b91f1b0ea ("can: dev: can_put_echo_skb(): add software tx timestamps") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=741b91f1b0ea34f00f6a7d4539b767c409291fcf Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-3-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 303066fc5a4916cfc777d360391a95fb8eb8a527 Author: Vincent Mailhol Date: Wed Jul 27 19:16:28 2022 +0900 can: can327: add software tx timestamps TX timestamps were added to the can_put_echo_skb() function of can_dev modules in [1]. However, can327 does not rely on that function and as such does not offer TX timestamping. Add a call to skb_tx_timestamp() in the can327_netdev_start_xmit() function so that the module now supports TX software timestamps. [1] commit 741b91f1b0ea ("can: dev: can_put_echo_skb(): add software tx timestamps") Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=741b91f1b0ea34f00f6a7d4539b767c409291fcf Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727101641.198847-2-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 8288c99fc263bcafc5df5fa8c278b2eb8106364e Author: Alexander Stein Date: Thu Jul 28 08:49:37 2022 +0200 usb: misc: onboard_usb_hub: Remove duplicated power_on delay onboard_hub_power_on() already ensures the reset pulse width delay, so there is no need to wait right after requesting GPIO as well. Fixes: 40758e493f4d ("usb: misc: onboard_usb_hub: Add reset-gpio support") Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20220728064937.917935-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 7c862ee928adfa0c2652b8acaa50e97b99716da3 Merge: 9d8dd3725f403 4aeccfd84d280 Author: Marc Kleine-Budde Date: Thu Jul 28 09:16:27 2022 +0200 Merge patch series "can: slcan: extend supported features (step 2)" Dario Binacchi says: ==================== With this series I try to finish the task, started with the series [1], of completely removing the dependency of the slcan driver from the userspace slcand/slcan_attach applications. The series also contains patches that remove the legacy stuff (slcan_devs, SLCAN_MAGIC, ...) and do some module cleanup. The series has been created on top of the patches: can: slcan: convert comments to network style comments can: slcan: slcan_init() convert printk(LEVEL ...) to pr_level() can: slcan: fix whitespace issues can: slcan: convert comparison to NULL into !val can: slcan: clean up if/else can: slcan: use scnprintf() as a hardening measure can: slcan: do not report txerr and rxerr during bus-off can: slcan: do not sleep with a spin lock held applied to linux-next. [1] https://lore.kernel.org/all/20220628163137.413025-1-dario.binacchi@amarulasolutions.com Changes since v3: https://lore.kernel.org/all/20220726210217.3368497-1-dario.binacchi@amarulasolutions.com - Add Max Staudt's `Reviewed-by' tag. - Drop the patch "ethtool: add support to get/set CAN bit time register". - Drop the patch "can: slcan: add support to set bit time register (btr)". - Remove the RFC prefix from the series. Changes since v2: https://lore.kernel.org/all/20220725065419.3005015-1-dario.binacchi@amarulasolutions.com - Update the commit message. - Use 1 space in front of the =. - Put the series as RFC again. - Pick up the patch "can: slcan: use KBUILD_MODNAME and define pr_fmt to replace hardcoded names". - Add the patch "ethtool: add support to get/set CAN bit time register" to the series. - Add the patch "can: slcan: add support to set bit time register (btr)" to the series. - Replace the link https://marc.info/?l=linux-can&m=165806705927851&w=2 with https://lore.kernel.org/all/507b5973-d673-4755-3b64-b41cb9a13b6f@hartkopp.net. - Add the `Suggested-by' tag. Changes since RFC: https://lore.kernel.org/all/20220716170007.2020037-1-dario.binacchi@amarulasolutions.com - Re-add headers that export at least one symbol used by the module. - Update the commit description. - Drop the old "slcan" name to use the standard canX interface naming. - Remove comment on listen-only command. - Update the commit subject and description. - Add the patch "MAINTAINERS: Add myself as maintainer of the SLCAN driver" to the series. ==================== mkl: rebased to can-next/master Link: https://lore.kernel.org/all/20220728070254.267974-1-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 4aeccfd84d2808574ef32b19877f022462c81d79 Author: Dario Binacchi Date: Thu Jul 28 09:02:54 2022 +0200 MAINTAINERS: Add maintainer for the slcan driver At the suggestion of its author Oliver Hartkopp ([1]), I take over the maintainer-ship and add myself to the authors of the driver. [1] https://lore.kernel.org/all/507b5973-d673-4755-3b64-b41cb9a13b6f@hartkopp.net Suggested-by: Oliver Hartkopp Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-8-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 3e720131960bb724e2ae365aa9e240c1c11f45c1 Author: Dario Binacchi Date: Thu Jul 28 09:02:53 2022 +0200 can: slcan: add support for listen-only mode For non-legacy, i.e. ip based configuration, add support for listen-only mode. If listen-only is requested send a listen-only ("L\r") command instead of an open ("O\r") command to the adapter. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-7-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 341c5724d7a1c71899752201dab88f87343c0c2b Author: Dario Binacchi Date: Thu Jul 28 09:02:52 2022 +0200 can: slcan: use the generic can_change_mtu() It is useless to define a custom function that does nothing but always return the same error code. Better to use the generic can_change_mtu() function. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-6-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 0cef03b109ca671252cf00481eabc3032acb9d80 Author: Dario Binacchi Date: Thu Jul 28 09:02:51 2022 +0200 can: slcan: change every `slc' occurrence in `slcan' In the driver there are parts of code where the prefix `slc' is used and others where the prefix `slcan' is used instead. The patch replaces every occurrence of `slc' with `slcan', except for the netdev functions where, to avoid compilation conflicts, it was necessary to replace `slc' with `slcan_netdev'. The patch does not make any functional changes. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-5-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit cfcb4465e9923bb9ac168abcea84e880633f9cef Author: Dario Binacchi Date: Thu Jul 28 09:02:50 2022 +0200 can: slcan: remove legacy infrastructure Taking inspiration from the drivers/net/can/can327.c driver and at the suggestion of its author Max Staudt, I removed legacy stuff like `SLCAN_MAGIC' and `slcan_devs' resulting in simplification of the code and its maintainability. The use of slcan_devs is derived from a very old kernel, since slip.c is about 30 years old, so today's kernel allows us to remove it. The .hangup() ldisc function, which only called the ldisc .close(), has been removed since the ldisc layer calls .close() in a good place anyway. The old slcanX name has been dropped in order to use the standard canX interface naming. The ioctl SIOCGIFNAME can be used to query the name of the created interface. Furthermore, there are several ways to get stable interfaces names in user space, e.g. udev or systemd-networkd. The `maxdev' module parameter has also been removed. CC: Max Staudt Signed-off-by: Dario Binacchi Reviewed-by: Max Staudt Link: https://lore.kernel.org/all/20220728070254.267974-4-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit 7a1fc3eea76f0d85ddfaede0885fca765d17cf6a Author: Dario Binacchi Date: Thu Jul 28 09:02:49 2022 +0200 can: slcan: remove useless header inclusions Include only the necessary headers. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-3-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit e2c9bb0297a32eedab83294e350896053900e20a Author: Vincent Mailhol Date: Thu Jul 28 09:02:48 2022 +0200 can: slcan: use KBUILD_MODNAME and define pr_fmt to replace hardcoded names The driver uses the string "slcan" to populate tty_ldisc_ops::name. KBUILD_MODNAME also evaluates to "slcan". Use KBUILD_MODNAME to get rid on the hardcoded string names. Similarly, the pr_info() and pr_err() hardcoded the "slcan" prefix. Define pr_fmt so that the "slcan" prefix gets automatically added. CC: Dario Binacchi Signed-off-by: Vincent Mailhol Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/all/20220728070254.267974-2-dario.binacchi@amarulasolutions.com Signed-off-by: Marc Kleine-Budde commit f4a0318f278d98d9492916722e85f258c2221f88 Author: Xiu Jianfeng Date: Fri Jul 1 16:24:35 2022 +0800 powerpc: add support for syscall stack randomization Add support for adding a random offset to the stack while handling syscalls. This patch uses mftb() instead of get_random_int() for better performance. In order to avoid unconditional stack canaries on syscall entry (due to the use of alloca()), also disable stack protector to avoid triggering needless checks and slowing down the entry path. As there is no general way to control stack protector coverage with a function attribute, this must be disabled at the compilation unit level. Signed-off-by: Xiu Jianfeng Reviewed-by: Kees Cook Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220701082435.126596-3-xiujianfeng@huawei.com commit 1547db7d1f4481c1f3ec731f3edc724ef3026ede Author: Xiu Jianfeng Date: Fri Jul 1 16:24:34 2022 +0800 powerpc: Move system_call_exception() to syscall.c This is a lead-up patch to enable syscall stack randomization, which uses alloca() and makes the compiler add unconditional stack canaries on syscall entry. In order to avoid triggering needless checks and slowing down the entry path, the feature needs to disable stack protector at the compilation unit level as there is no general way to control stack protector coverage with a function attribute. So move system_call_exception() to syscall.c to avoid affecting other functions in interrupt.c. Suggested-by: Michael Ellerman Signed-off-by: Xiu Jianfeng Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220701082435.126596-2-xiujianfeng@huawei.com commit 978030f054ff97d9079b35f0178e2013918fb316 Author: Jason A. Donenfeld Date: Thu Jul 28 00:32:19 2022 +1000 powerpc/powernv: rename remaining rng powernv_ functions to pnv_ The preferred nomenclature is pnv_, not powernv_, but rng.c used powernv_ for some reason, which isn't consistent with the rest. A recent commit added a few pnv_ functions to rng.c, making the file a bit of a mishmash. This commit just replaces the rest of them. Fixes: f3eac426657d ("powerpc/powernv: wire up rng during setup_arch") Signed-off-by: Jason A. Donenfeld Tested-by: Sachin Sant [mpe: Reorder after bug fix commits] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220727143219.2684192-3-mpe@ellerman.id.au commit 7ef3d06f1bc4a5e62273726f3dc2bd258ae1c71f Author: Jason A. Donenfeld Date: Thu Jul 28 00:32:18 2022 +1000 powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 The existing logic in KVM to support guests calling H_RANDOM only works on Power8, because it looks for an RNG in the device tree, but on Power9 we just use darn. In addition the existing code needs to work in real mode, so we have the special cased powernv_get_random_real_mode() to deal with that. Instead just have KVM call ppc_md.get_random_seed(), and do the real mode check inside of there, that way we use whatever RNG is available, including darn on Power9. Fixes: e928e9cb3601 ("KVM: PPC: Book3S HV: Add fast real-mode H_RANDOM implementation.") Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Jason A. Donenfeld Tested-by: Sachin Sant [mpe: Rebase on previous commit, update change log appropriately] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220727143219.2684192-2-mpe@ellerman.id.au commit 90b5d4fe0b3ba7f589c6723c6bfb559d9e83956a Author: Michael Ellerman Date: Thu Jul 28 00:32:17 2022 +1000 powerpc/powernv: Avoid crashing if rng is NULL On a bare-metal Power8 system that doesn't have an "ibm,power-rng", a malicious QEMU and guest that ignore the absence of the KVM_CAP_PPC_HWRNG flag, and calls H_RANDOM anyway, will dereference a NULL pointer. In practice all Power8 machines have an "ibm,power-rng", but let's not rely on that, add a NULL check and early return in powernv_get_random_real_mode(). Fixes: e928e9cb3601 ("KVM: PPC: Book3S HV: Add fast real-mode H_RANDOM implementation.") Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Jason A. Donenfeld Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220727143219.2684192-1-mpe@ellerman.id.au commit cd1e64935f79e31d666172c52c951ca97152b783 Author: Rashmica Gupta Date: Fri Jun 17 14:39:35 2022 +1000 selftests/powerpc: Fix matrix multiply assist test The ISA states: "when ACC[i] contains defined data, the contents of VSRs 4×i to 4×i+3 are undefined until either a VSX Move From ACC instruction is used to copy the contents of ACC[i] to VSRs 4×i to 4×i+3 or some other instruction directly writes to one of these VSRs." We aren't doing this. This test only works on Power10 because the hardware implementation happens to map ACC0 to VSRs 0-3, but will fail on any other implementation that doesn't do this. So add xxmfacc between writing to the accumulator and accessing the VSRs. Fixes: 3527e1ab9a79 ("selftests/powerpc: Add matrix multiply assist (MMA) test") Signed-off-by: Rashmica Gupta Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220617043935.428083-1-rashmica@linux.ibm.com commit e4787e71ae2de3f60bc04fe09d1be4ef628b6c68 Author: Rashmica Gupta Date: Fri Jun 17 14:31:35 2022 +1000 powerpc/signal: Update comment for clarity The comment being referred to was deleted in commit af1bbc3dd3d5 ("powerpc: Remove UP only lazy floating point and vector optimisations"). Add a bit more detail so it's clear why we need to clear the FP/VEC/VSX bits here. Signed-off-by: Rashmica Gupta Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220617043135.426897-1-rashmica@linux.ibm.com commit fcdb758ce113c5d1b2b7034a058a9c472e42415e Author: Rashmica Gupta Date: Fri Jun 17 14:28:05 2022 +1000 powerpc: make facility_unavailable_exception 64s The facility unavailable exception is only available on ppc book3s machines so use CONFIG_PPC_BOOK3S_64 rather than CONFIG_PPC64. tm_unavailable is only called from facility_unavailable_exception so can also be under this Kconfig symbol. Signed-off-by: Rashmica Gupta Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220617042805.426231-1-rashmica@linux.ibm.com commit 95b002e4e47a36d88deec70808ef36674fb33cf5 Author: Uwe Kleine-König Date: Thu Jul 7 08:14:41 2022 +0200 powerpc/platforms/83xx/suspend: Remove write-only global variable pmc_dev is only assigned in .probe(), otherwise the variable is unused. So drop this pointer that serves no purpose. Signed-off-by: Uwe Kleine-König Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220707061441.193869-3-u.kleine-koenig@pengutronix.de commit ccc1439b924bca5d5a5d81cf6b0d4b10b321282e Author: Uwe Kleine-König Date: Thu Jul 7 08:14:40 2022 +0200 powerpc/platforms/83xx/suspend: Prevent unloading the driver Returning an error in .remove() doesn't prevent a driver from being unloaded. On unbind this only results in an error message, but the device is remove anyhow. I guess the author's idea of just returning -EPERM in .remove() was to prevent unbinding a device. To achieve that set the suppress_bind_attrs driver property and drop the useless .remove callback. This is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König Reviewed-by: Christophe Leroy Acked-by: Scott Wood Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220707061441.193869-2-u.kleine-koenig@pengutronix.de commit fde345e4d39a4f16697a8060564fff1dbac05035 Author: Uwe Kleine-König Date: Thu Jul 7 08:14:39 2022 +0200 powerpc/platforms/83xx/suspend: Reorder to get rid of a forward declaration By moving up pmc_types and pmc_match, the forward declaration for pmc_match can be dropped. Signed-off-by: Uwe Kleine-König Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220707061441.193869-1-u.kleine-koenig@pengutronix.de commit 738f9dca0df3bb630e6f06a19573ab4e31bd443a Author: Jason Wang Date: Fri Jul 15 11:52:50 2022 +0800 powerpc/sysdev: Fix comment typo The double `is' is duplicated in line 110, remove one. Signed-off-by: Jason Wang Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220715035250.5978-1-wangborong@cdjrlc.com commit 901a30cf5f765a26f1308701d9df9e7f3d0023a5 Author: Jason Wang Date: Mon Jul 18 15:55:53 2022 +0800 powerpc/pseries/vas: Fix comment typo The double `the' in line 807 is duplicated, remove one. Signed-off-by: Jason Wang Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220718075553.70897-1-wangborong@cdjrlc.com commit 1f00b5ab992c122c51bc37662b3b4df5963462f3 Author: Pali Rohár Date: Wed May 4 20:08:22 2022 +0200 powerpc/85xx: P2020: Add law_trgt_if property to PCIe DT nodes DT law_trgt_if property defines Local Access Window Target Interface. Local Access Window Target Interface is used for identifying individual peripheral and mapping its memory to CPU. Interface id is defined by hardware itself. U-Boot uses law_trgt_if DT property in PCIe nodes for configuring memory mapping of individual PCIe controllers. Linux kernel fsl_pci.c driver currently does not touch Local Access Window and expects that U-Boot configures it properly. Add law_trgt_if property to PCIe DT nodes for P2020. This allows usage of kernel P2020 PCIe DT nodes in U-Boot. And therefore allows to share P2020 DTS files between Linux kernel and U-Boot. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220504180822.29782-1-pali@kernel.org commit 0fe1e96fef0a5c53b4c0d1500d356f3906000f81 Author: Pali Rohár Date: Wed Jul 6 12:21:48 2022 +0200 powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias Other Linux architectures use DT property 'linux,pci-domain' for specifying fixed PCI domain of PCI controller specified in Device-Tree. And lot of Freescale powerpc boards have defined numbered pci alias in Device-Tree for every PCIe controller which number specify preferred PCI domain. So prefer usage of DT property 'linux,pci-domain' (via function of_get_pci_domain_nr()) and DT pci alias (via function of_alias_get_id()) on powerpc architecture for assigning PCI domain to PCI controller. Fixes: 63a72284b159 ("powerpc/pci: Assign fixed PHB number based on device-tree properties") Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706102148.5060-2-pali@kernel.org commit d20c96deb3e2c1cedc47d2be9fc110ffed81b1af Author: Pali Rohár Date: Sat Jul 9 14:43:05 2022 +0200 powerpc/85xx: Fix description of MPC85xx and P1/P2 boards options More MPC85xx and P1/P2 boards options have incorrect description. Fix them to include list of all boards for which they enable/disable support. Signed-off-by: Pali Rohár Acked-by: Scott Wood Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220709124305.17559-1-pali@kernel.org commit 2454a7af0f2a42918aa972147a0bec38e6656cd8 Author: Nayna Jain Date: Sat Jul 23 07:30:46 2022 -0400 powerpc/pseries: define driver for Platform KeyStore PowerVM provides an isolated Platform Keystore(PKS) storage allocation for each LPAR with individually managed access controls to store sensitive information securely. It provides a new set of hypervisor calls for Linux kernel to access PKS storage. Define POWER LPAR Platform KeyStore(PLPKS) driver using H_CALL interface to access PKS storage. Signed-off-by: Nayna Jain Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220723113048.521744-2-nayna@linux.ibm.com commit d80f6de9d601c30b53c17f00cb7cfe3169f2ddad Author: Alexey Kardashevskiy Date: Thu Jul 14 18:11:19 2022 +1000 powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case The existing iommu_table_in_use() helper checks if the kernel is using any of TCEs. There are some reserved TCEs: 1) the very first one if DMA window starts from 0 to avoid having a zero but still valid DMA handle; 2) it_reserved_start..it_reserved_end to exclude MMIO32 window in case the default window spans across that - this is the default for the first DMA window on PowerNV. When 1) is the case and 2) is not the helper does not skip 1) and returns wrong status. This only seems occurring when passing through a PCI device to a nested guest (not something we support really well) so it has not been seen before. This fixes the bug by adding a special case for no MMIO32 reservation. Fixes: 3c33066a2190 ("powerpc/kernel/iommu: Add new iommu_table_in_use() helper") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220714081119.3714605-1-aik@ozlabs.ru commit d73b46c3c1449bf27f793b9d9ee86ed70c7a7163 Author: Alexey Kardashevskiy Date: Thu Jul 14 18:08:00 2022 +1000 powerpc/ioda/iommu/debugfs: Generate unique debugfs entries The iommu_table::it_index is a LIOBN which is not initialized on PowerNV as it is not used except IOMMU debugfs where it is used for a node name. This initializes it_index witn a unique number to avoid warnings and have a node for every iommu_table. This should not cause any behavioral change without CONFIG_IOMMU_DEBUGFS. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220714080800.3712998-1-aik@ozlabs.ru commit b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d Author: Alexey Kardashevskiy Date: Wed Jun 29 16:06:14 2022 +1000 pseries/iommu/ddw: Fix kdump to work in absence of ibm,dma-window The pseries platform uses 32bit default DMA window (always 4K pages) and optional 64bit DMA window available via DDW ("Dynamic DMA Windows"), 64K or 2M pages. For ages the default one was not removed and a huge window was created in addition. Things changed with SRIOV-enabled PowerVM which creates a default-and-bigger DMA window in 64bit space (still using 4K pages) for IOV VFs so certain OSes do not need to use the DDW API in order to utilize all available TCE budget. Linux on the other hand removes the default window and creates a bigger one (with more TCEs or/and a bigger page size - 64K/2M) in a bid to map the entire RAM, and if the new window size is smaller than that - it still uses this new bigger window. The result is that the default window is removed but the "ibm,dma-window" property is not. When kdump is invoked, the existing code tries reusing the existing 64bit DMA window which location and parameters are stored in the device tree but this fails as the new property does not make it to the kdump device tree blob. So the code falls back to the default window which does not exist anymore although the device tree says that it does. The result of that is that PCI devices become unusable and cannot be used for kdumping. This preserves the DMA64 and DIRECT64 properties in the device tree blob for the crash kernel. Since the crash kernel setup is done after device drivers are loaded and probed, the proper DMA config is stored at least for boot time devices. Because DDW window is optional and the code configures the default window first, the existing code creates an IOMMU table descriptor for the non-existing default DMA window. It is harmless for kdump as it does not touch the actual window (only reads what is mapped and marks those IO pages as used) but it is bad for kexec which clears it thinking it is a smaller default window rather than a bigger DDW window. This removes the "ibm,dma-window" property from the device tree after a bigger window is created and the crash kernel setup picks it up. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Signed-off-by: Alexey Kardashevskiy Acked-by: Hari Bathini Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220629060614.1680476-1-aik@ozlabs.ru commit c7255058b5430b5c42932383bd8887d591e7973a Author: Hari Bathini Date: Thu Jun 30 12:19:42 2022 +0530 powerpc/crash: save cpu register data in crash_smp_send_stop() During kdump, two set of NMI IPIs are sent to secondary CPUs, if 'crash_kexec_post_notifiers' option is set. The first set of NMI IPIs to stop the CPUs and the other set to collect register data. Instead, capture register data for secondary CPUs while stopping them itself. Also, fallback to smp_send_stop() in case the function gets called without kdump configured. Signed-off-by: Hari Bathini Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220630064942.192283-1-hbathini@linux.ibm.com commit 51ac6d4ceaa4f2e878c1aa399135f2514a6acc24 Author: Michael Ellerman Date: Wed Jun 29 16:08:17 2022 +1000 powerpc: Update reviewers Christophe and Nick have been active in recent years on the mailing list and making contributions, add them as reviewers. Paul and Ben are no longer actively reviewing powerpc patches, remove them from the reviewers, they're still on linuxppc-dev if needed. Acked-by: Benjamin Herrenschmidt Acked-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220629060817.2943966-1-mpe@ellerman.id.au commit 36afe68714d45edf34430d28e3dc787425ad8b22 Author: Christophe Leroy Date: Fri Jul 8 09:11:08 2022 +0200 powerpc: Finally remove unnecessary headers from asm/prom.h Remove all headers included from asm/prom.h which are not used by asm/prom.h itself. Declare struct device_node and struct property locally to avoid including of.h Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/4be954abef978b34cff9193fc566ffefdd3517bb.1657264228.git.christophe.leroy@csgroup.eu commit 4d5c5bad51935482437528f7fa4dffdcb3330d8b Author: Christophe Leroy Date: Fri Jul 8 09:11:07 2022 +0200 powerpc: Remove asm/prom.h from asm/mpc52xx.h and asm/pci.h asm/pci.h and asm/mpc52xx.h don't need asm/prom.h Declare struct device_node locally to avoid including of.h Signed-off-by: Christophe Leroy [mpe: Add missing include of prom.h to of_rtc.c] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/cf5243343e2364c2b40f22ee5ad9a6e2453d1121.1657264228.git.christophe.leroy@csgroup.eu commit 4177ab2283dcd98735572ebda56b9d479dc1d7f2 Author: Michael Ellerman Date: Wed Jul 27 15:03:52 2022 +1000 EDAC/mpc85xx: Include required of headers directly A subsequent commit to cleanup powerpc's asm/prom.h leads to build errors in mpc85xx_edac.c due to missing headers. Include all required headers directly to avoid the build failure. Reported-by: kernel test robot Signed-off-by: Michael Ellerman commit 61657dcd528b75cd196adaf56890124c13953c8d Author: Christophe Leroy Date: Fri Jul 8 09:11:06 2022 +0200 scsi: cxlflash: Include missing linux/irqdomain.h powerpc's asm/prom.h brings some headers that it doesn't need itself. Once those headers are removed from asm/prom.h, the following errors occur: CC [M] drivers/scsi/cxlflash/ocxl_hw.o drivers/scsi/cxlflash/ocxl_hw.c: In function 'afu_map_irq': drivers/scsi/cxlflash/ocxl_hw.c:195:16: error: implicit declaration of function 'irq_create_mapping' [-Werror=implicit-function-declaration] 195 | virq = irq_create_mapping(NULL, irq->hwirq); | ^~~~~~~~~~~~~~~~~~ drivers/scsi/cxlflash/ocxl_hw.c:222:9: error: implicit declaration of function 'irq_dispose_mapping' [-Werror=implicit-function-declaration] 222 | irq_dispose_mapping(virq); | ^~~~~~~~~~~~~~~~~~~ drivers/scsi/cxlflash/ocxl_hw.c: In function 'afu_unmap_irq': drivers/scsi/cxlflash/ocxl_hw.c:264:13: error: implicit declaration of function 'irq_find_mapping'; did you mean 'is_cow_mapping'? [-Werror=implicit-function-declaration] 264 | if (irq_find_mapping(NULL, irq->hwirq)) { | ^~~~~~~~~~~~~~~~ | is_cow_mapping cc1: some warnings being treated as errors Fix it by including linux/irqdomain.h Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/c6c0cc5e9179a642370a61439f95158271a78c03.1657264228.git.christophe.leroy@csgroup.eu commit ebef8abc963b9e537c0a0d619dd8faf1b8f2b183 Author: Christophe Leroy Date: Fri Jul 8 09:11:05 2022 +0200 video: fbdev: offb: Include missing linux/platform_device.h A lot of drivers were getting platform and of headers indirectly via headers like asm/pci.h or asm/prom.h Most of them were fixed during 5.19 cycle but a newissue was introduced by commit 52b1b46c39ae ("of: Create platform devices for OF framebuffers") Include missing platform_device.h to allow cleaning asm/pci.h Fixes: 52b1b46c39ae ("of: Create platform devices for OF framebuffers") Signed-off-by: Christophe Leroy Acked-by: Helge Deller Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/f75b383673663e27f6b57e50b4abfb9fe3780b00.1657264228.git.christophe.leroy@csgroup.eu commit a05aae92f84ba6d2705f6dac206ef5dcf097ea96 Author: Bagas Sanjaya Date: Thu Jul 28 10:33:33 2022 +0700 docs: powerpc: add elf_hwcaps to table of contents elf_hwcaps documentation is missing from table of contents at index.rst, hence triggers Sphinx warning: Documentation/powerpc/elf_hwcaps.rst: WARNING: document isn't included in any toctree Add the documentation to the index to fix the warning. Fixes: 3df1ff42e69e91 ("powerpc: add documentation for HWCAPs") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/linuxppc-dev/20220727220050.549db613@canb.auug.org.au/ Link: https://lore.kernel.org/r/20220728033332.27836-4-bagasdotme@gmail.com commit 0595a216920cb035030c73cec3ab9fe413ef1d77 Author: Bagas Sanjaya Date: Thu Jul 28 10:33:32 2022 +0700 docs: powerpc: use different label name for elf_hwcaps.rst Sphinx reported duplicate label warning: WARNING: duplicate label elf_hwcaps_index, other instance in Documentation/arm64/elf_hwcaps.rst The warning is caused by elf_hwcaps_index label name is already used for arm64 documentation, whileas powerpc use the same name. Disambiguate the label name for powerpc. Fixes: 3df1ff42e69e91 ("powerpc: add documentation for HWCAPs") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/linuxppc-dev/20220727220050.549db613@canb.auug.org.au/ Link: https://lore.kernel.org/r/20220728033332.27836-3-bagasdotme@gmail.com commit 4515862b66d3bdaf681cade1c72f047c93d94d01 Author: Bagas Sanjaya Date: Thu Jul 28 10:33:31 2022 +0700 docs: powerpc: fix indentation warnings Sphinx reported unexpected indentation warnings: Documentation/powerpc/elf_hwcaps.rst:82: WARNING: Unexpected indentation. Documentation/powerpc/elf_hwcaps.rst:100: WARNING: Unexpected indentation. Documentation/powerpc/elf_hwcaps.rst:117: WARNING: Unexpected indentation. Documentation/powerpc/elf_hwcaps.rst:122: WARNING: Unexpected indentation. Documentation/powerpc/elf_hwcaps.rst:144: WARNING: Unexpected indentation. Fix these warnings by unindenting commit references and using literal code block for instructions list for PPC_FEATURE_ICACHE_SNOOP. Fixes: 3df1ff42e69e91 ("powerpc: add documentation for HWCAPs") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/linuxppc-dev/20220727220050.549db613@canb.auug.org.au/ Link: https://lore.kernel.org/r/20220728033332.27836-2-bagasdotme@gmail.com commit cc1049ccee20df870f2394c4d5d5fa8cabc4d0af Author: Marcin Wojtas Date: Wed Jul 27 01:09:18 2022 +0200 net: dsa: mv88e6xxx: fix speed setting for CPU/DSA ports Commit 3c783b83bd0f ("net: dsa: mv88e6xxx: get rid of SPEED_MAX setting") stopped relying on SPEED_MAX constant and hardcoded speed settings for the switch ports and rely on phylink configuration. It turned out, however, that when the relevant code is called, the mac_capabilites of CPU/DSA port remain unset. mv88e6xxx_setup_port() is called via mv88e6xxx_setup() in dsa_tree_setup_switches(), which precedes setting the caps in phylink_get_caps down in the chain of dsa_tree_setup_ports(). As a result the mac_capabilites are 0 and the default speed for CPU/DSA port is 10M at the start. To fix that, execute mv88e6xxx_get_caps() and obtain the capabilities driectly. Fixes: 3c783b83bd0f ("net: dsa: mv88e6xxx: get rid of SPEED_MAX setting") Signed-off-by: Marcin Wojtas Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220726230918.2772378-1-mw@semihalf.com Signed-off-by: Jakub Kicinski commit f8cd9f632f4415b1e8838bdca8ab42cfb37a6584 Author: Patrice Chotard Date: Wed Jun 29 15:30:13 2022 +0200 mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() For erase operations, reg_proto must be used as indicated in struct spi_nor description in spi-nor.h. This issue was found when DT property spi-tx-bus-width is set to 4. In this case the spi_mem_op->addr.buswidth is set to 4 for erase command which is not correct. Tested on stm32mp157c-ev1 board with mx66l51235f spi-nor. Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") Signed-off-by: Patrice Chotard [ta: use nor->reg_proto in spi_nor_controller_ops_erase()] Signed-off-by: Tudor Ambarus Tested-by: Alexander Sverdlin Reviewed-by: Pratyush Yadav Link: https://lore.kernel.org/r/20220629133013.3382393-1-patrice.chotard@foss.st.com commit b6b23833fc42a10ceed00006cb0a6184f9b9bbde Author: Takahiro Kuwano Date: Mon Jul 25 12:25:05 2022 +0300 mtd: spi-nor: spansion: Add s25hl-t/s25hs-t IDs and fixups The S25HL-T/S25HS-T family is the Infineon SEMPER Flash with Quad SPI. These Infineon chips support volatile version of configuration registers and it is recommended to update volatile registers in the field application due to a risk of the non-volatile registers corruption by power interrupt. Add support for volatile QE bit. For the single-die package parts (512Mb and 1Gb), only bottom 4KB and uniform sector sizes are supported. This is due to missing or incorrect entries in SMPT. Fixup for other sector sizes configurations will be followed up as needed. Tested on Xilinx Zynq-7000 FPGA board. Signed-off-by: Takahiro Kuwano Signed-off-by: Tudor Ambarus Acked-by: Michael Walle Link: https://lore.kernel.org/r/20220725092505.446315-8-tudor.ambarus@microchip.com commit a6b50aa1279614df7033f8b57d6854fce0334e27 Author: Takahiro Kuwano Date: Mon Jul 25 12:25:04 2022 +0300 mtd: spi-nor: spansion: Add local function to discover page size The page size check in s28hs512t fixup can be used for s25hs/hl-t as well. Move that to a newly created local function. Signed-off-by: Takahiro Kuwano Signed-off-by: Tudor Ambarus Reviewed-by: Michael Walle Link: https://lore.kernel.org/r/20220725092505.446315-7-tudor.ambarus@microchip.com commit d7931a21506321327351f68fdebf74a56a58e675 Author: Tudor Ambarus Date: Mon Jul 25 12:25:03 2022 +0300 mtd: spi-nor: core: Track flash's internal address mode We need to track the flash's internal address mode as there are flashes that can operate with 4B opcodes but unfortunately do not have a 4B opcode correspondent for all the 3B opcodes. Such an example is the Infineon Semper chips which provide 4B opcodes for read/program/erase but do not provide 4B opcodes for Read/Write Any Register. These registers are indexed by address and require the internal address mode of the flash before Read/Write Any Register opcodes are issued. 4B opcodes are preferred over changing the flash's address mode to 4byte, as set_4byte_addr_mode could be done in a non-volatile way and could break the boot sequence. Thus we need to track the flash's internal address mode so that we can use 4B opcodes together with opcodes that don't have a 4B opcode correspondent. Track flash's internal address mode. addr_mode_nbytes is discovered when parsing BFPT. For the BFPT_DWORD1_ADDRESS_BYTES_3_OR_4 case, one could introduce a method that queries the flash's internal address mode at run-time (works for Winbond). If a run-time querying can not be accomplished or if SFDP is not defined at all, but the address mode is volatile and resets to a default known value at boot, one can change the default addr_mode_nbytes value of 3 by introducing a flash_info flag. If the address mode can not be queried, discovered and it is configured via a non-volatile register, we may introduce a dt property, but it will harm the generic approach of the jedec,spi-nor compatible. All this complexity is not needed now, so let it for future development. Signed-off-by: Tudor Ambarus Reviewed-by: Takahiro Kuwano Reviewed-by: Michael Walle Link: https://lore.kernel.org/r/20220725092505.446315-6-tudor.ambarus@microchip.com commit 08412e72afba3a2daef3e7f3378c3753255a0017 Author: Takahiro Kuwano Date: Mon Jul 25 12:25:02 2022 +0300 mtd: spi-nor: core: Return error code from set_4byte_addr_mode() The prams->set_4byte_addr_mode returns error code but is not handled in spi_nor_init(). Handle the return code from set_4byte_addr_mode(). Suggested-by: Michael Walle Signed-off-by: Takahiro Kuwano Signed-off-by: Tudor Ambarus Reviewed-by: Pratyush Yadav Reviewed-by: Michael Walle Link: https://lore.kernel.org/r/20220725092505.446315-5-tudor.ambarus@microchip.com commit 47c6f8a67f2ce1b95202c16fa126411d6f5c7d5c Author: Tudor Ambarus Date: Mon Jul 25 12:25:01 2022 +0300 mtd: spi-nor: Do not change nor->addr_nbytes at SFDP parsing time At the SFDP parsing time we should not change members of struct spi_nor, but instead fill members of struct spi_nor_flash_parameters which could later on be used by callers. The caller will then decide if SFDP params should be used and more importantly when they should be used. Clean the code flow and don't initialize nor->addr_nbytes at SFDP parsing time. Signed-off-by: Tudor Ambarus Tested-by: Takahiro Kuwano Reviewed-by: Michael Walle Reviewed-by: Pratyush Yadav Link: https://lore.kernel.org/r/20220725092505.446315-4-tudor.ambarus@microchip.com commit aa5d980a144cd0bf717eb16609c29ff276f8bd47 Author: Tudor Ambarus Date: Mon Jul 25 12:25:00 2022 +0300 mtd: spi-nor: core: Shrink the storage size of the flash_info's addr_nbytes The maximum number of address bytes in SPI NOR is 4. Shrink the storage size of the flash_info's addr_nbytes. Signed-off-by: Tudor Ambarus Reviewed-by: Michael Walle Reviewed-by: Pratyush Yadav Link: https://lore.kernel.org/r/20220725092505.446315-3-tudor.ambarus@microchip.com commit c452d49849d48bd37ae97fc2bc92c6435707c35f Author: Tudor Ambarus Date: Mon Jul 25 12:24:59 2022 +0300 mtd: spi-nor: s/addr_width/addr_nbytes Address width was an unfortunate name, as it means the number of IO lines used for the address, whereas in the code it is used as the number of address bytes. s/addr_width/addr_nbytes throughout the entire SPI NOR framework. Signed-off-by: Tudor Ambarus Reviewed-by: Michael Walle Acked-by: Pratyush Yadav Link: https://lore.kernel.org/r/20220725092505.446315-2-tudor.ambarus@microchip.com commit 2bb88b2c4f7334bd91c734f3983492a133250edb Author: Jiri Pirko Date: Wed Jul 27 07:59:12 2022 +0200 net: devlink: remove redundant net_eq() check from sb_pool_get_dumpit() The net_eq() check is already performed inside devlinks_xa_for_each_registered_get() helper, so remove the redundant appearance. Signed-off-by: Jiri Pirko Link: https://lore.kernel.org/r/20220727055912.568391-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit a683dc5c148aeda51384a780945c0affda74f20c Author: Krzysztof Kozlowski Date: Tue Jul 26 13:56:50 2022 +0200 dt-bindings: net: hirschmann,hellcreek: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Acked-by: Kurt Kanzenbach Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220726115650.100726-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit a482d47d33ac06295840e1e2ec3806713ccc04f3 Author: Zhengchao Shao Date: Tue Jul 26 11:07:48 2022 +0800 net/sched: sch_cbq: change the type of cbq_set_lss to void Change the type of cbq_set_lss to void. Signed-off-by: Zhengchao Shao Link: https://lore.kernel.org/r/20220726030748.243505-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit b01156128f4953204e83ff0e67b4a8b52e67f3d8 Merge: abed2baf68145 403fcb5118a0f Author: Mark Brown Date: Thu Jul 28 01:21:40 2022 +0100 ASoC: atmel: one fix and one cleanup Merge series from Claudiu Beznea : Hi, The series adds one fix for mchp-spdifrx and one cleanups for mchp-spdifrx and mchp-spdifrx drivers. Thank you, Claudiu Beznea Changes in v3: - changed cover letter title s/few/one, s/cleanups/cleanup - fix compilation error and warnings - keep only patch 1/5 and patch 3/5 from previous version as the rest of them were integrated Changes in v2: - s/tag/tab in the title of patch 2/5 Claudiu Beznea (2): ASoC: mchp-spdifrx: disable end of block interrupt on failures ASoC: mchp-spdiftx: remove references to mchp_i2s_caps sound/soc/atmel/mchp-spdifrx.c | 9 ++++++--- sound/soc/atmel/mchp-spdiftx.c | 8 -------- 2 files changed, 6 insertions(+), 11 deletions(-) -- 2.34.1 commit efc93392960cb9c3534e7aed15481ca7bcfdf15c Merge: 9cc0590ae351a 1de452a0edda2 Author: Mark Brown Date: Thu Jul 28 00:01:30 2022 +0100 regulator: Consumer load management improvements Merge series from Douglas Anderson : The main goal of this series is to make a small dent in cleaning up the way we deal with regulator loads. The idea is to add some extra functionality to the regulator "bulk" API so that consumers can specify the load using that. commit c6e8e36c6ae4b11bed5643317afb66b6c3cadba8 Author: Fabio M. De Francesco Date: Sun Jul 24 23:25:23 2022 +0200 exec: Call kmap_local_page() in copy_string_kernel() The use of kmap_atomic() is being deprecated in favor of kmap_local_page(). With kmap_local_page(), the mappings are per thread, CPU local and not globally visible. Furthermore, the mappings can be acquired from any context (including interrupts). Therefore, replace kmap_atomic() with kmap_local_page() in copy_string_kernel(). Instead of open-coding local mapping + memcpy(), use memcpy_to_page(). Delete a redundant call to flush_dcache_page(). Tested with xfstests on a QEMU/ KVM x86_32 VM, 6GB RAM, booting a kernel with HIGHMEM64GB enabled. Suggested-by: Ira Weiny Signed-off-by: Fabio M. De Francesco Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220724212523.13317-1-fmdefrancesco@gmail.com commit 485ade76c95ac5ccaa52fee9d712471c9211b989 Author: Ezequiel Garcia Date: Mon Jul 18 23:41:22 2022 +0200 media: hantro: Remove dedicated control documentation The dedicated control required by the HEVC support was removed, and the driver now calculates the value internally. Remove the ad-hoc documentation as well. [hverkuil: remove hantro from Documentation/userspace-api/media/drivers/index.rst] Fixes: 3360755ef89ab ("media: hantro: Stop using Hantro dedicated control") Signed-off-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit aaf50b1969d7933a51ea421b11432a7fb90974e3 Author: Kees Cook Date: Wed Jun 8 14:40:24 2022 -0700 kasan: test: Silence GCC 12 warnings GCC 12 continues to get smarter about array accesses. The KASAN tests are expecting to explicitly test out-of-bounds conditions at run-time, so hide the variable from GCC, to avoid warnings like: ../lib/test_kasan.c: In function 'ksize_uaf': ../lib/test_kasan.c:790:61: warning: array subscript 120 is outside array bounds of 'void[120]' [-Warray-bounds] 790 | KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~ ../lib/test_kasan.c:97:9: note: in definition of macro 'KUNIT_EXPECT_KASAN_FAIL' 97 | expression; \ | ^~~~~~~~~~ Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: kasan-dev@googlegroups.com Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220608214024.1068451-1-keescook@chromium.org commit 72691a269f0baad6d5f4aa7af97c29081b86d70f Author: Trond Myklebust Date: Wed Jul 27 13:02:27 2022 -0400 SUNRPC: Don't reuse bvec on retransmission of the request If a request is re-encoded and then retransmitted, we need to make sure that we also re-encode the bvec, in case the page lists have changed. Fixes: ff053dbbaffe ("SUNRPC: Move the call to xprt_send_pagedata() out of xprt_sock_sendmsg()") Signed-off-by: Trond Myklebust commit abed2baf6814597f244cd879285b2210b0870548 Author: Krzysztof Kozlowski Date: Wed Jul 27 18:40:50 2022 +0200 ASoC: dt-bindings: use spi-peripheral-props.yaml Instead of listing directly properties typical for SPI peripherals, reference the spi-peripheral-props.yaml schema. This allows using all properties typical for SPI-connected devices, even these which device bindings author did not tried yet. Remove the spi-* properties which now come via spi-peripheral-props.yaml schema, except for the cases when device schema adds some constraints like maximum frequency. While changing additionalProperties->unevaluatedProperties, put it in typical place, just before example DTS. Signed-off-by: Krzysztof Kozlowski Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220727164050.385241-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 74944c873602a3ed8d16ff7af3f64af80c0f9dac Author: Josef Bacik Date: Mon Jul 25 13:05:05 2022 -0400 btrfs: reset RO counter on block group if we fail to relocate With the automatic block group reclaim code we will preemptively try to mark the block group RO before we start the relocation. We do this to make sure we should actually try to relocate the block group. However if we hit an error during the actual relocation we won't clean up our RO counter and the block group will remain RO. This was observed internally with file systems reporting less space available from df when we had failed background relocations. Fix this by doing the dec_ro in the error case. Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Boris Burkov Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 2c65e312bc6bb6e175c16a17db8ec86d2dcd1608 Author: Andrey Strachuk Date: Thu Jul 21 17:11:33 2022 +0300 ACPI/PCI: Remove useless NULL pointer checks Local variable 'p' is initialized by an address of field of acpi_resource, so it does not make sense to compare 'p' with NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Strachuk Reviewed-by: Bjorn Helgaas Signed-off-by: Rafael J. Wysocki commit 369af6bf2c28f9f57438e82f953f6351cf2a94cd Author: Sakari Ailus Date: Mon Jul 11 14:26:06 2022 +0300 ACPI: property: Read buffer properties as integers Instead of adding a new property type, read buffer properties as integers. Even though the internal representation in ACPI is different, the data type is the same (byte) than on 8-bit integers. Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 103e10c69c611efabccf57d799c4b191d53ee765 Author: Sakari Ailus Date: Fri Jul 22 09:57:46 2022 +0300 ACPI: property: Add support for parsing buffer property UUID Add support for newly added buffer property UUID, as defined in the DSD guide section 3.3 [1] Link: https://github.com/UEFI/DSD-Guide/blob/main/src/dsd-guide.adoc#buffer-data-extension-uuid # [1] Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 923044133367c8d72662938da0ea531bbdb39799 Author: Sakari Ailus Date: Mon Jul 11 14:26:04 2022 +0300 ACPI: property: Unify integer value reading functions Unify functions reading ACPI property integer values into a single macro using C99 _Generic(). Also use size_t for the counter instead of int. Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 88af7bbdea37af59a43072243b358753189fd7a5 Author: Sakari Ailus Date: Mon Jul 11 14:26:03 2022 +0300 ACPI: property: Switch node property referencing from ifs to a switch __acpi_node_get_property_reference() uses a series of if () statements for testing the same variable. There's soon going to be one more value to be tested. Switch to use switch() instead. Signed-off-by: Sakari Ailus Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 1aef25d9d1edbcf5b9af4611448d931d0752377c Author: Sakari Ailus Date: Mon Jul 11 14:26:02 2022 +0300 ACPI: property: Move property ref argument parsing into a new function Split out property reference argument parsing out of the __acpi_node_get_property_reference() function into a new one, acpi_get_ref_args(). The new function will be needed also for parsing string references soon. Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 5ee772883af5ed2dfe17e8af2b09d7003344be6c Author: Sakari Ailus Date: Mon Jul 11 14:26:01 2022 +0300 ACPI: property: Use acpi_object_type consistently in property ref parsing The type of union acpi_object field type is acpi_object_type. Use that instead of int. Signed-off-by: Sakari Ailus Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 1d52f10917a751f90e269a0ed9b6cca60dbe0300 Author: Sakari Ailus Date: Mon Jul 11 14:26:00 2022 +0300 ACPI: property: Tie data nodes to acpi handles ACPICA allows associating additional information (i.e. pointers with specific tag) to acpi_handles. The acpi_device's are associated to acpi_handle's in acpi_tie_acpi_dev() in scan.c, do the same here for the _DSD data nodes. This allows direct data node references in properties, implemented later on in the series. Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 85140ef275f577f64e8a2c5789447222dfc14fc4 Author: Sakari Ailus Date: Mon Jul 11 14:25:59 2022 +0300 ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool The value acpi_add_nondev_subnodes() returns is bool so change the return type of the function to match that. Fixes: 445b0eb058f5 ("ACPI / property: Add support for data-only subnodes") Signed-off-by: Sakari Ailus Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit b4909252da9be56fe1e0a23c2c1908c5630525fa Author: Justin Stitt Date: Thu Jul 21 14:57:06 2022 -0700 drivers: lkdtm: fix clang -Wformat warning When building with Clang we encounter the following warning (ARCH=hexagon + CONFIG_FRAME_WARN=0): | ../drivers/misc/lkdtm/bugs.c:107:3: error: format specifies type | 'unsigned long' but the argument has type 'int' [-Werror,-Wformat] | REC_STACK_SIZE, recur_count); | ^~~~~~~~~~~~~~ Cast REC_STACK_SIZE to `unsigned long` to match format specifier `%lu` as well as maintain symmetry with `#define REC_STACK_SIZE (_AC(CONFIG_FRAME_WARN, UL) / 2)`. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Reported-by: Nathan Chancellor Suggested-by: Nathan Chancellor Suggested-by: Nick Desaulniers Signed-off-by: Justin Stitt Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Acked-by: Kees Cook Fixes: 24cccab42c419 ("lkdtm/bugs: Adjust recursion test to avoid elision") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220721215706.4153027-1-justinstitt@google.com commit 3ce4b78f73e8e00fb86bad67ee7f6fe12019707e Author: YiFei Zhu Date: Thu May 26 22:34:07 2022 +0000 selftests/seccomp: Fix compile warning when CC=clang clang has -Wconstant-conversion by default, and the constant 0xAAAAAAAAA (9 As) being converted to an int, which is generally 32 bits, results in the compile warning: clang -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/ -lpthread seccomp_bpf.c -lcap -o seccomp_bpf seccomp_bpf.c:812:67: warning: implicit conversion from 'long' to 'int' changes value from 45812984490 to -1431655766 [-Wconstant-conversion] int kill = kill_how == KILL_PROCESS ? SECCOMP_RET_KILL_PROCESS : 0xAAAAAAAAA; ~~~~ ^~~~~~~~~~~ 1 warning generated. -1431655766 is the expected truncation, 0xAAAAAAAA (8 As), so use this directly in the code to avoid the warning. Fixes: 3932fcecd962 ("selftests/seccomp: Add test for unknown SECCOMP_RET kill behavior") Signed-off-by: YiFei Zhu Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220526223407.1686936-1-zhuyifei@google.com commit 3e93c0b8a981b55c8ee45aae2abf6028730ab194 Merge: 0113780870b15 ca7fd6cff3b8d Author: Jason Gunthorpe Date: Wed Jul 27 16:09:25 2022 -0300 Merge branch 'erdma' into rdma.git for-next Cheng Xu says ==================== This v14 patch set introduces the Elastic RDMA Adapter (ERDMA) driver, which released in Apsara Conference 2021 by Alibaba. The PR of ERDMA userspace provider has already been created [1]. ERDMA enables large-scale RDMA acceleration capability in Alibaba ECS environment, initially offered in g7re instance. It can improve the efficiency of large-scale distributed computing and communication significantly and expand dynamically with the cluster scale of Alibaba Cloud. ERDMA is a RDMA networking adapter based on the Alibaba MOC hardware. It works in the VPC network environment (overlay network), and uses iWarp transport protocol. ERDMA supports reliable connection (RC). ERDMA also supports both kernel space and user space verbs. Now we have already supported HPC/AI applications with libfabric, NoF and some other internal verbs libraries, such as xrdma, epsl, etc,. For the ECS instance with RDMA enabled, our MOC hardware generates two kinds of PCI devices: one for ERDMA, and one for the original net device (virtio-net). They are separated PCI devices. ==================== * branch 'erdma': RDMA/erdma: Add driver to kernel build environment RDMA/erdma: Add the ABI definitions RDMA/erdma: Add the erdma module RDMA/erdma: Add connection management (CM) support RDMA/erdma: Add verbs implementation RDMA/erdma: Add verbs header file RDMA/erdma: Add event queue implementation RDMA/erdma: Add cmdq implementation RDMA/erdma: Add main include file RDMA/erdma: Add the hardware related definitions RDMA: Add ERDMA to rdma_driver_id definition Signed-off-by: Jason Gunthorpe commit ca7fd6cff3b8df436f3e46b8fc80e6989700c8da Author: Cheng Xu Date: Wed Jul 27 09:49:27 2022 +0800 RDMA/erdma: Add driver to kernel build environment Add erdma to the kernel build environment, and sort the source order in drivers/infiniband/Kconfig. Link: https://lore.kernel.org/r/20220727014927.76564-12-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit f5995fe2a0b1f4ec5e52e2022452246a13bf89b7 Author: Cheng Xu Date: Wed Jul 27 09:49:26 2022 +0800 RDMA/erdma: Add the ABI definitions Add erdma ABI definitions which will be shared between kernel and userspace. This commit also fix compile issues reported by lkp. Link: https://lore.kernel.org/r/20220727014927.76564-11-chengyou@linux.alibaba.com Reported-by: kernel test robot Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit df9ec2fc8e70e01532fd9161cd98711969561ff6 Author: Ezequiel Garcia Date: Mon Jul 18 18:41:23 2022 -0300 hantro: Remove incorrect HEVC SPS validation Currently, the driver tries to validat the HEVC SPS against the CAPTURE queue format (i.e. the decoded format). This is not correct, because typically the SPS control is set before the CAPTURE queue is negotiated. Fixes: 135ad96cb4d6b ("media: hantro: Be more accurate on pixel formats step_width constraints") Signed-off-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit d55e6fb4803c274918d7b41ea80b3848ef12695c Author: Cheng Xu Date: Wed Jul 27 09:49:25 2022 +0800 RDMA/erdma: Add the erdma module Add the main erdma module, which provides interface to infiniband subsystem. This commit includes a modification from Christophe, that using the bitmap API to allocate bitmaps instead of hand-writing. And the commit also fixes warnings reported by static checkers. Link: https://lore.kernel.org/r/20220727014927.76564-10-chengyou@linux.alibaba.com Signed-off-by: Christophe JAILLET Signed-off-by: Dan Carpenter Reported-by: kernel test robot Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit 920d93eac8b97778fef48f34f10e58ddf870fc2a Author: Cheng Xu Date: Wed Jul 27 09:49:24 2022 +0800 RDMA/erdma: Add connection management (CM) support ERDMA's transport protocol is iWarp, so the driver must support CM interface. In CM part, we use the same way as SoftiWarp: using kernel socket to set up the connection, then performing MPA negotiation in kernel. So, this part of code mainly comes from SoftiWarp, base on it, we add some more features, such as non-blocking iw_connect implementation. This commit also fixes a duplicated include issue reported by Abaci Robot. Link: https://lore.kernel.org/r/20220727014927.76564-9-chengyou@linux.alibaba.com Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit 155055771704f8cbb5c176a4309b7dc30a50450c Author: Cheng Xu Date: Wed Jul 27 09:49:23 2022 +0800 RDMA/erdma: Add verbs implementation The RDMA verbs implementation of erdma is divided into three files: erdma_qp.c, erdma_cq.c, and erdma_verbs.c. Internal used functions and datapath functions of QP/CQ are put in erdma_qp.c and erdma_cq.c, the rest is in erdma_verbs.c. This commit also fixes some static check warnings. Link: https://lore.kernel.org/r/20220727014927.76564-8-chengyou@linux.alibaba.com Reported-by: Dan Carpenter Reported-by: Abaci Robot Signed-off-by: Yang Li Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit db23ae64caac84622c025860df69d4bc4859fa9c Author: Cheng Xu Date: Wed Jul 27 09:49:22 2022 +0800 RDMA/erdma: Add verbs header file This header file defines the main structures and functions used for RDMA Verbs, including qp, cq, mr, ucontext, etc,. Link: https://lore.kernel.org/r/20220727014927.76564-7-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit f2a0a630b953451a59a2612ad8c29246638f0a38 Author: Cheng Xu Date: Wed Jul 27 09:49:21 2022 +0800 RDMA/erdma: Add event queue implementation Event queue (EQ) is the main notification way from erdma hardware to its driver. Each erdma device contains 2 kinds EQs: asynchronous EQ (AEQ) and completion EQ (CEQ). Per device has 1 AEQ, which used for RDMA async event report, and max to 32 CEQs (numbered for CEQ0 to CEQ31). CEQ0 is used for cmdq completion event report, and the rest CEQs are used for RDMA completion event report. Link: https://lore.kernel.org/r/20220727014927.76564-6-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit 2af541bf8e32ee73f17fb28e2b3766a96b7311e5 Author: Cheng Xu Date: Wed Jul 27 09:49:20 2022 +0800 RDMA/erdma: Add cmdq implementation Cmdq is the main control plane channel between erdma driver and hardware. After erdma device is initialized, the cmdq channel will be active in the whole lifecycle of this driver. This commit also includes two modifications from Christophe, one is using the bitmap API to allocate bitmaps instead of hand-writing, and another is using the non-atomic bitmap API when applicable. Link: https://lore.kernel.org/r/20220727014927.76564-5-chengyou@linux.alibaba.com Signed-off-by: Christophe JAILLET Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit bee85e0e31ecd2afbd19d2ae900f029a6f0c9e6d Author: Cheng Xu Date: Wed Jul 27 09:49:19 2022 +0800 RDMA/erdma: Add main include file Add ERDMA driver main header file, defining internal used data structures and operations. The defined data structures includes *cmdq*, which is used as the communication channel between ERDMA driver and hardware. Link: https://lore.kernel.org/r/20220727014927.76564-4-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit be3cff0f242d8b5ea43ca5beb4c2b44b216d0fe1 Author: Cheng Xu Date: Wed Jul 27 09:49:18 2022 +0800 RDMA/erdma: Add the hardware related definitions ERDMA is a PCIe device, and this file provides ERDMA hardware related definitions, mainly including PCIe device capabilities and restrictions, device registers definitions, doorbell space, doorbell structure definitions and WQE definitions. Link: https://lore.kernel.org/r/20220727014927.76564-3-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit d8f70c47394c26a8d7c6e602d909de88d1bdae5e Author: Cheng Xu Date: Wed Jul 27 09:49:17 2022 +0800 RDMA: Add ERDMA to rdma_driver_id definition Define RDMA_DRIVER_ERDMA in enum rdma_driver_id. Link: https://lore.kernel.org/r/20220727014927.76564-2-chengyou@linux.alibaba.com Signed-off-by: Cheng Xu Signed-off-by: Jason Gunthorpe commit 143201a6435bf65f0115435e9dc6d95c66b908e9 Author: Jernej Skrabec Date: Mon Jul 18 18:56:49 2022 +0200 media: cedrus: hevc: Add check for invalid timestamp Not all DPB entries will be used most of the time. Unused entries will thus have invalid timestamps. They will produce negative buffer index which is not specifically handled. This works just by chance in current code. It will even produce bogus pointer, but since it's not used, it won't do any harm. Let's fix that brittle design by skipping writing DPB entry altogether if timestamp is invalid. Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support") Signed-off-by: Jernej Skrabec Reviewed-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit e39cc4960207a67a26b39ebc8449f15c53da0a99 Author: Hans Verkuil Date: Mon Jul 18 16:54:53 2022 +0200 media: sunxi: sun6i_mipi_csi2.c/sun8i_a83t_mipi_csi2.c: clarify error handling Both sun6i_mipi_csi2.c and sun8i_a83t_mipi_csi2.c have the same issue: the comment before the ret = 0 assignment is incorrect, drop it and always assign the result of the v4l2_subdev_call(..., 0) to ret. In the disable label check for !on and set ret to 0 in that case. This fixes two smatch warnings: drivers/media/platform/sunxi/sun6i-mipi-csi2/sun6i_mipi_csi2.c:193 sun6i_mipi_csi2_s_stream() warn: missing error code 'ret' drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/sun8i_a83t_mipi_csi2.c:225 sun8i_a83t_mipi_csi2_s_stream() warn: missing error code 'ret' Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 21b1b6797fbe4fb5863c96f350359d0e982faddd Author: Laurent Pinchart Date: Mon Jul 18 14:12:19 2022 +0200 media: uvcvideo: Fix invalid pointer in uvc_ctrl_init_ctrl() The handling of per-device mappings introduced in commit 86f7ef773156 ("media: uvcvideo: Add support for per-device control mapping overrides") overwrote the mapping variable after it was initialized and before it was used, leading to usage of an invalid pointer for devices with per-device mappings. Fix it. Fixes: 86f7ef773156 ("media: uvcvideo: Add support for per-device control mapping overrides") Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit bb85604b9a05135e2c821e0506a59cfbee404aa9 Author: Laurent Pinchart Date: Mon Jul 18 14:24:02 2022 +0200 media: Documentation: mc-core: Fix typo Fix a typo in the mc-core.rst media driver API documentation. Due to its nature, the typo unfortunately caused a warning during documentation build. Fixes: 03b282861ca7 ("media: mc-entity: Add a new helper function to get a remote pad for a pad") Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 4b9233731f78298fcbdf2c16f0801c36d65863bb Author: Hans Verkuil Date: Fri Jul 15 17:10:33 2022 +0200 media: videodev2.h.rst.exceptions: add missing exceptions Add new exceptions for V4L2_COLORSPACE_LAST, V4L2_XFER_FUNC_LAST and V4L2_YCBCR_ENC_LAST. This fixes documentation warnings: Documentation/output/videodev2.h.rst:6: WARNING: undefined label: v4l2-colorspace-last Documentation/output/videodev2.h.rst:6: WARNING: undefined label: v4l2-xfer-func-last Documentation/output/videodev2.h.rst:6: WARNING: undefined label: v4l2-ycbcr-enc-last Signed-off-by: Hans Verkuil Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit af89bb206d66950c3abe96970c766d3afca1cc43 Author: Hans Verkuil Date: Fri Jul 15 17:06:05 2022 +0200 media: vimc: wrong pointer is used with PTR_ERR Fix smatch warning: drivers/media/test-drivers/vimc/vimc-core.c:214 vimc_create_links() warn: passing a valid pointer to 'PTR_ERR' Signed-off-by: Hans Verkuil Reviewed-by: Kieran Bingham Signed-off-by: Mauro Carvalho Chehab commit c808f4632349bda65b2ec41220f0a2035f780619 Author: Tejun Heo Date: Wed Jul 27 07:54:55 2022 -1000 cgroup: remove "no" prefixed mount options 30312730bd02 ("cgroup: Add "no" prefixed mount options") added "no" prefixed mount options to allow turning them off and 6a010a49b63a ("cgroup: Make !percpu threadgroup_rwsem operations optional") added one more "no" prefixed mount option. However, Michal pointed out that the "no" prefixed options aren't necessary in allowing mount options to be turned off: # grep group /proc/mounts cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,relatime,nsdelegate,memory_recursiveprot 0 0 # mount -o remount,nsdelegate,memory_recursiveprot none /sys/fs/cgroup # grep cgroup /proc/mounts cgroup2 /sys/fs/cgroup cgroup2 rw,relatime,nsdelegate,memory_recursiveprot 0 0 Note that this is different from the remount behavior when the mount(1) is invoked without the device argument - "none": # grep cgroup /proc/mounts cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot 0 0 # mount -o remount,nsdelegate,memory_recursiveprot /sys/fs/cgroup # grep cgroup /proc/mounts cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot 0 0 While a bit confusing, given that there is a way to turn off the options, there's no reason to have the explicit "no" prefixed options. Let's remove them. Signed-off-by: Tejun Heo Cc: Michal Koutný Signed-off-by: Tejun Heo commit 0113780870b1597ae49f30abfa4957c239f913d3 Author: Aharon Landau Date: Tue Jul 26 10:19:11 2022 +0300 RDMA/mlx5: Rename the mkey cache variables and functions After replacing the MR cache with an Mkey cache, rename the variables and functions to fit the new meaning. Link: https://lore.kernel.org/r/20220726071911.122765-6-michaelgur@nvidia.com Signed-off-by: Aharon Landau Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 6b7533869523ae58e2b914551305b0e47cbeb247 Author: Aharon Landau Date: Tue Jul 26 10:19:10 2022 +0300 RDMA/mlx5: Store in the cache mkeys instead of mrs Currently, the driver stores mlx5_ib_mr struct in the cache entries, although the only use of the cached MR is the mkey. Store only the mkey in the cache. Link: https://lore.kernel.org/r/20220726071911.122765-5-michaelgur@nvidia.com Signed-off-by: Aharon Landau Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 19591f134c59703dfc272356808e6fe2037d0d40 Author: Aharon Landau Date: Tue Jul 26 10:19:09 2022 +0300 RDMA/mlx5: Store the number of in_use cache mkeys instead of total_mrs total_mrs is used only to calculate the number of mkeys currently in use. To simplify things, replace it with a new member called "in_use" and directly store the number of mkeys currently in use. Link: https://lore.kernel.org/r/20220726071911.122765-4-michaelgur@nvidia.com Signed-off-by: Aharon Landau Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 86457a92df1bebdcd8e20afa286427e4b525aa08 Author: Aharon Landau Date: Tue Jul 26 10:19:08 2022 +0300 RDMA/mlx5: Replace cache list with Xarray The Xarray allows us to store the cached mkeys in memory efficient way. Entries are reserved in the Xarray using xa_cmpxchg before calling to the upcoming callbacks to avoid allocations in interrupt context. The xa_cmpxchg can sleep when using GFP_KERNEL, so we call it in a loop to ensure one reserved entry for each process trying to reserve. Link: https://lore.kernel.org/r/20220726071911.122765-3-michaelgur@nvidia.com Signed-off-by: Aharon Landau Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 17ae355926ed1832449d52748334b8fa799301f1 Author: Aharon Landau Date: Tue Jul 26 10:19:07 2022 +0300 RDMA/mlx5: Replace ent->lock with xa_lock In the next patch, ent->list will be replaced with an xarray. The xarray uses an internal lock to protect the indexes. Use it to protect all the entry fields, and get rid of ent->lock. Link: https://lore.kernel.org/r/20220726071911.122765-2-michaelgur@nvidia.com Signed-off-by: Aharon Landau Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 0982c8d859f8f7022b9fd44d421c7ec721bb41f9 Merge: ae98a4a989935 a4c750e2328a1 Author: Marc Zyngier Date: Wed Jul 27 18:33:27 2022 +0100 Merge branch kvm-arm64/nvhe-stacktrace into kvmarm-master/next * kvm-arm64/nvhe-stacktrace: (27 commits) : . : Add an overflow stack to the nVHE EL2 code, allowing : the implementation of an unwinder, courtesy of : Kalesh Singh. From the cover letter (slightly edited): : : "nVHE has two modes of operation: protected (pKVM) and unprotected : (conventional nVHE). Depending on the mode, a slightly different approach : is used to dump the hypervisor stacktrace but the core unwinding logic : remains the same. : : * Protected nVHE (pKVM) stacktraces: : : In protected nVHE mode, the host cannot directly access hypervisor memory. : : The hypervisor stack unwinding happens in EL2 and is made accessible to : the host via a shared buffer. Symbolizing and printing the stacktrace : addresses is delegated to the host and happens in EL1. : : * Non-protected (Conventional) nVHE stacktraces: : : In non-protected mode, the host is able to directly access the hypervisor : stack pages. : : The hypervisor stack unwinding and dumping of the stacktrace is performed : by the host in EL1, as this avoids the memory overhead of setting up : shared buffers between the host and hypervisor." : : Additional patches from Oliver Upton and Marc Zyngier, tidying up : the initial series. : . arm64: Update 'unwinder howto' KVM: arm64: Don't open code ARRAY_SIZE() KVM: arm64: Move nVHE-only helpers into kvm/stacktrace.c KVM: arm64: Make unwind()/on_accessible_stack() per-unwinder functions KVM: arm64: Move nVHE stacktrace unwinding into its own compilation unit KVM: arm64: Move PROTECTED_NVHE_STACKTRACE around KVM: arm64: Introduce pkvm_dump_backtrace() KVM: arm64: Implement protected nVHE hyp stack unwinder KVM: arm64: Save protected-nVHE (pKVM) hyp stacktrace KVM: arm64: Stub implementation of pKVM HYP stack unwinder KVM: arm64: Allocate shared pKVM hyp stacktrace buffers KVM: arm64: Add PROTECTED_NVHE_STACKTRACE Kconfig KVM: arm64: Introduce hyp_dump_backtrace() KVM: arm64: Implement non-protected nVHE hyp stack unwinder KVM: arm64: Prepare non-protected nVHE hypervisor stacktrace KVM: arm64: Stub implementation of non-protected nVHE HYP stack unwinder KVM: arm64: On stack overflow switch to hyp overflow_stack arm64: stacktrace: Add description of stacktrace/common.h arm64: stacktrace: Factor out common unwind() arm64: stacktrace: Handle frame pointer from different address spaces ... Signed-off-by: Marc Zyngier commit a4c750e2328a117dc9b19a2a61db0d4347902029 Author: Marc Zyngier Date: Wed Jul 27 15:29:06 2022 +0100 arm64: Update 'unwinder howto' Implementing a new unwinder is a bit more involved than writing a couple of helpers, so let's not lure the reader into a false sense of comfort. Instead, let's point out what they should call into, and what sort of parameter they need to provide. Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20220727142906.1856759-7-maz@kernel.org commit 62ae21627aa96f6ef361981dd181c74dc7aa314c Author: Oliver Upton Date: Wed Jul 27 15:29:05 2022 +0100 KVM: arm64: Don't open code ARRAY_SIZE() Use ARRAY_SIZE() instead of an open-coded version. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Link: https://lore.kernel.org/r/20220727142906.1856759-6-maz@kernel.org commit 0e773da1e688a1425ef7deae58fa11c5c7e09533 Author: Marc Zyngier Date: Wed Jul 27 15:29:04 2022 +0100 KVM: arm64: Move nVHE-only helpers into kvm/stacktrace.c kvm_nvhe_stack_kern_va() only makes sense as part of the nVHE unwinder, so simply move it there. Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20220727142906.1856759-5-maz@kernel.org commit 4e00532f37365967e9896966b1fe61888e659259 Author: Marc Zyngier Date: Wed Jul 27 15:29:03 2022 +0100 KVM: arm64: Make unwind()/on_accessible_stack() per-unwinder functions Having multiple versions of on_accessible_stack() (one per unwinder) makes it very hard to reason about what is used where due to the complexity of the various includes, the forward declarations, and the reliance on everything being 'inline'. Instead, move the code back where it should be. Each unwinder implements: - on_accessible_stack() as well as the helpers it depends on, - unwind()/unwind_next(), as they pass on_accessible_stack as a parameter to unwind_next_common() (which is the only common code here) This hardly results in any duplication, and makes it much easier to reason about the code. Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20220727142906.1856759-4-maz@kernel.org commit 9f5fee05f6897d0fe0e3a44ade71bb85cd97b2ef Author: Marc Zyngier Date: Wed Jul 27 15:29:02 2022 +0100 KVM: arm64: Move nVHE stacktrace unwinding into its own compilation unit The unwinding code doesn't really belong to the exit handling code. Instead, move it to a file (conveniently named stacktrace.c to confuse the reviewer), and move all the stacktrace-related stuff there. It will be joined by more code very soon. Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20220727142906.1856759-3-maz@kernel.org commit 03fe9cd05b9f38353208c23bd791dac47c912054 Author: Marc Zyngier Date: Wed Jul 27 15:29:01 2022 +0100 KVM: arm64: Move PROTECTED_NVHE_STACKTRACE around Make the dependency with EL2_DEBUG more obvious by moving the stacktrace configurtion *after* it. Signed-off-by: Marc Zyngier Reviewed-by: Kalesh Singh Tested-by: Kalesh Singh Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20220727142906.1856759-2-maz@kernel.org commit 19b7858c3357df038d896c10e0d5e4572a77dd25 Author: Bjorn Helgaas Date: Tue Jul 19 16:13:25 2022 -0500 PCI: Convert to new *_PM_OPS macros Replace SET_*_PM_OPS with *_PM_OPS, which which have the advantage that the compiler always sees the PM callbacks as referenced, so they don't need to be wrapped with "#ifdef CONFIG_PM_SLEEP" or tagged with "__maybe_unused" to avoid "defined but not used" warnings. See 1a3c7bb08826 ("PM: core: Add new *_PM_OPS macros, deprecate old ones"). Link: https://lore.kernel.org/r/20220719215108.1583108-1-helgaas@kernel.org Tested-by: Arnd Bergmann Signed-off-by: Bjorn Helgaas Reviewed-by: Pali Rohár # pci-mvebu.c Reviewed-by: Arnd Bergmann commit 94c6511636302889be7d0d7cc216d6a1a2433c7b Author: Jim Quinlan Date: Tue Jul 26 12:39:11 2022 -0500 PCI: brcmstb: Rename .map_bus() functions to end with 'map_bus' Rename the .map_bus() functions to end with 'map_bus' so they're easy to find with, e.g., 'git grep "^static.*_map_bus" drivers/pci/'. [bhelgaas: rename brcm_pcie_map_bus32() to brcm7425_pcie_map_bus() for better cscope-ability (".*_map_bus" is not the same as ".*_map_bus.*")] Link: https://lore.kernel.org/r/20220725151258.42574-8-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 7a32e9b3ff01cdc12ea124fa258aacd31490dd11 Author: Jim Quinlan Date: Mon Jul 25 11:12:54 2022 -0400 PCI: brcmstb: Disable/enable regulators in suspend/resume If we found power regulators for a device below the Root Port, disable them during suspend and re-enable them during resume. If any downstream device can be a wakeup device, do not turn off the regulators as the device will need them on. [bhelgaas: drop unused regulator_oops, skip wrapping of .add_bus()/ .remove_bus(), move brcm_pcie_start_link() to .add_bus() in previous patch, squash WOL checking into this patch] Link: https://lore.kernel.org/r/20220725151258.42574-6-jim2101024@gmail.com Link: https://lore.kernel.org/r/20220725151258.42574-7-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 9e6be018b26347c26a93e63fb50a37ee2c9311de Author: Jim Quinlan Date: Mon Jul 25 11:12:53 2022 -0400 PCI: brcmstb: Enable child bus device regulators from DT Some platforms have power regulators for slots or devices below Root Ports. On platforms like Raspberry Pi 4, these regulators are described in the Root Port device tree node, since they logically belong to the Root Port, not to the host bridge itself. Add an .add_bus() hook (called when pci_alloc_child_bus() allocates the secondary ("child") bus for a bridge), and look for such regulators. If we find some, enable them before bringing up the link and enumerating devices on the child bus. Similarly, when pci_remove_bus() calls the ops->remove_bus() hook, disable the regulators. The regulators that may be described in a Root Port DT device are: vpcie3v3 vpcie3v3aux vpcie12v These control power to the device downstream from the Root Port. [bhelgaas: commit log, name hooks brcm_pcie_add_bus(), etc, since we only support one set of subregulator info, save info in struct brcm_pcie instead of dev->driver_data, move brcm_pcie_start_link() from probe to .add_bus() (from subsequent patch)] Link: https://lore.kernel.org/r/20220725151258.42574-5-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 0693b4207fd73c1a23edb21fbfc0020532f53fb9 Author: Jim Quinlan Date: Mon Jul 25 11:12:51 2022 -0400 PCI: brcmstb: Split post-link up initialization to brcm_pcie_start_link() Previously brcm_pcie_setup() initialized the Root Port itself as well as doing the actual link-up. Split brcm_pcie_setup() into two functions: - brcm_pcie_setup(), which initializes everything that does not require the link itself to be up, and - brcm_pcie_start_link(), which brings up the link and initializes things that depend on the link being up. [bhelgaas: condense commit log, deferring details for future changes] Link: https://lore.kernel.org/r/20220725151258.42574-3-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 5fb8f2628edf26c679d0079fae19b99aef82af03 Author: Jim Quinlan Date: Mon Jul 25 11:12:52 2022 -0400 PCI: brcmstb: Prevent config space access when link is down When the link is down, config accesses to downstream devices cause CPU aborts. Allow config accesses only when the link is up. As the following scenario shows, this check is racy and cannot completely avoid CPU aborts, but it makes them less likely: pci_generic_config_read addr = brcm_pcie_map_conf # bus->ops->map_bus() brcm_pcie_link_up # returns "true"; link is up *val = readb(addr) # link is now down Note that config space accesses to the Root Port are not affected by link status. [bhelgaas: commit log, use PCIE_ECAM_REG() instead of magic 0xfff masks; note that pci_generic_config_read32() masks low two bits already] Link: https://lore.kernel.org/r/20220725151258.42574-4-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 0ac2ff426e3d48e6c642b14b53858e2174607231 Author: Jim Quinlan Date: Mon Jul 25 11:12:50 2022 -0400 PCI: brcmstb: Remove unnecessary forward declarations Remove forward function declarations in this driver. Also move some constant structure definitions lower in the file. There are no changes to the code that has been moved. Link: https://lore.kernel.org/r/20220725151258.42574-2-jim2101024@gmail.com Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Tested-by: Florian Fainelli commit 6622e3a73112fc336c1c2c582428fb5ef18e456a Author: Trond Myklebust Date: Wed Jul 27 12:27:54 2022 -0400 SUNRPC: Reinitialise the backchannel request buffers before reuse When we're reusing the backchannel requests instead of freeing them, then we should reinitialise any values of the send/receive xdr_bufs so that they reflect the available space. Fixes: 0d2a970d0ae5 ("SUNRPC: Fix a backchannel race") Signed-off-by: Trond Myklebust commit 60320e6ef485079ded4c081326e96aaadbe96ae1 Author: Krzysztof Kozlowski Date: Tue Jul 26 14:02:15 2022 +0200 dt-bindings: watchdog: qcom,pm8916-wdt: convert to dtschema Convert the Qualcomm PM8916 watchdog timer controller bindings to DT schema and include them in parent device schema. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vinod Koul Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220726120215.101868-3-krzysztof.kozlowski@linaro.org commit 99cab201fc634f2cdb1fd2c99be00df99ee04f6c Author: Krzysztof Kozlowski Date: Tue Jul 26 14:02:14 2022 +0200 dt-bindings: power: reset: qcom,pon: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vinod Koul Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220726120215.101868-2-krzysztof.kozlowski@linaro.org commit 40b09653b1977c9630f24c9ca17322d5b38f1ca5 Author: Daniel Müller Date: Wed Jul 27 00:11:56 2022 +0000 selftests/bpf: Adjust vmtest.sh to use local kernel configuration So far the vmtest.sh script, which can be used as a convenient way to run bpf selftests, has obtained the kernel config safe to use for testing from the libbpf/libbpf GitHub repository [0]. Given that we now have included this configuration into this very repository, we can just consume it from here as well, eliminating the necessity of remote accesses. With this change we adjust the logic in the script to use the configuration from below tools/testing/selftests/bpf/configs/ instead of pulling it over the network. [0] https://github.com/libbpf/libbpf Signed-off-by: Daniel Müller Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Mykola Lysenko Link: https://lore.kernel.org/bpf/20220727001156.3553701-4-deso@posteo.net commit cbd620fc18cad51500c46e222328ca60adaa4644 Author: Daniel Müller Date: Wed Jul 27 00:11:55 2022 +0000 selftests/bpf: Copy over libbpf configs This change integrates libbpf maintained configurations and black/white lists [0] into the repository, co-located with the BPF selftests themselves. We minimize the kernel configurations to keep future updates as small as possible [1]. Furthermore, we make both kernel configurations build on top of the existing configuration tools/testing/selftests/bpf/config (to be concatenated before build). Lastly, we replaced the terms blacklist & whitelist with denylist and allowlist, respectively. [0] https://github.com/libbpf/libbpf/tree/20f03302350a4143825cedcbd210c4d7112c1898/travis-ci/vmtest/configs [1] https://lore.kernel.org/bpf/20220712212124.3180314-1-deso@posteo.net/T/#m30a53648352ed494e556ac003042a9ad0a8f98c6 Signed-off-by: Daniel Müller Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Mykola Lysenko Link: https://lore.kernel.org/bpf/20220727001156.3553701-3-deso@posteo.net commit aee993bbd05cede097885fa74e2627a458d3418a Author: Daniel Müller Date: Wed Jul 27 00:11:54 2022 +0000 selftests/bpf: Sort configuration This change makes sure to sort the existing minimal kernel configuration containing options required for running BPF selftests alphabetically. Doing so will make it easier to diff it against other configurations, which in turn helps with maintaining disjunct config files that build on top of each other. It also helped identify the CONFIG_IPV6_GRE being set twice and removes one of the occurrences. Lastly, we change NET_CLS_BPF from 'm' to 'y'. Having this option as 'm' will cause failures of the btf_skc_cls_ingress selftest. Signed-off-by: Daniel Müller Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Mykola Lysenko Link: https://lore.kernel.org/bpf/20220727001156.3553701-2-deso@posteo.net commit 148399c90e25bb5d1aa6f3e1dde25fec6f4005f2 Author: Li zeming Date: Wed Jul 27 16:37:51 2022 +0800 clocksource/drivers/sun5i: Remove unnecessary (void*) conversions Remove unnecessary void* type castings. Signed-off-by: Li zeming Link: https://lore.kernel.org/r/20220727083751.5540-1-zeming@nfschina.com Signed-off-by: Daniel Lezcano commit c329fb5318ef82e8793432f845ad916c3199a5b6 Author: Samuel Holland Date: Mon Jul 25 00:17:14 2022 -0500 dt-bindings: timer: allwinner,sun4i-a10-timer: Add D1 compatible Allwinner D1 contains the usual sun4i MMIO timer device. It contains two timers like other recent SoCs, so it is compatible with the A23 variant. Signed-off-by: Samuel Holland Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220725051715.56427-1-samuel@sholland.org Signed-off-by: Daniel Lezcano commit 561a0846182ef6fe87c20426d43fd956a644687a Author: Krzysztof Kozlowski Date: Tue Jul 26 13:59:37 2022 +0200 dt-bindings: timer: ingenic,tcu: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Acked-by: Paul Cercueil Link: https://lore.kernel.org/r/20220726115937.101432-1-krzysztof.kozlowski@linaro.org Signed-off-by: Daniel Lezcano commit 7a93d490900edcdbd3833d8bb9a01b23d8bb461e Author: XU pengfei Date: Wed Jul 20 10:07:35 2022 +0800 clocksource/drivers/sun4i: Remove unnecessary (void*) conversions Remove unnecessary void* type casting. Signed-off-by: XU pengfei Link: https://lore.kernel.org/r/20220720020735.3771-1-xupengfei@nfschina.com Signed-off-by: Daniel Lezcano commit 4abb38595b1b116bd1440c76c69c9f0416ec55a4 Author: Geert Uytterhoeven Date: Wed Jul 20 09:53:34 2022 +0200 dt-bindings: timer: renesas,cmt: Fix R-Car Gen4 fall-out Restore sort order (by family, followed by type). Update the conditional sections specifying the number of interrupts. Fixes: 525b296185b4b0ab ("dt-bindings: timer: renesas,cmt: Add r8a779f0 and generic Gen4 CMT support") Signed-off-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/2e3863ae32e17d49f41111580f195dd34e2b769d.1658303544.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano commit 110a25357584a2d2d9f50accb1e89455c54290b6 Author: Daniel Lezcano Date: Mon Jul 18 23:36:57 2022 +0200 clocksource/drivers/tegra186: Put Kconfig option 'tristate' to 'bool' The clocksources are built-in, they are not modules. We don't know if the core time framework is ready for clockevents / clocksources as modules. Revert back this option to 'bool'. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20220718213657.1303538-1-daniel.lezcano@linaro.org commit 775343f9fde99b4e5e6470f9d8afd519ee67dfa3 Author: Tony Lindgren Date: Mon May 23 18:14:48 2022 +0300 clocksource/drivers/timer-ti-dm: Make driver selection bool for TI K3 The clocksource drivers do not currently have loadable modules as pointed out by Daniel Lezcano . Let's reconsider this later on once timer removal discussion has been done, and set timer-ti-dm to bool for TI K3 SoC. Cc: Keerthy Cc: Nishanth Menon Cc: Vignesh Raghavendra Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220523151448.23732-1-tony@atomide.com Signed-off-by: Daniel Lezcano commit 4e3203610a889c72e96ddfc9e601b9349ef19c00 Author: Tony Lindgren Date: Fri Apr 8 13:17:15 2022 +0300 clocksource/drivers/timer-ti-dm: Add compatible for am6 SoCs Add compatible for ti,am654-timer to support the timers. For example, am654 has four timers in the MCU domain and 12 timers in the MAIN domain. Cc: Keerthy Cc: Nishanth Menon Cc: Vignesh Raghavendra Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220408101715.43697-4-tony@atomide.com Signed-off-by: Daniel Lezcano commit ab0bbef3ae0f6b5a3b60671cd0124d0fc4fc2567 Author: Tony Lindgren Date: Fri Apr 8 13:17:14 2022 +0300 clocksource/drivers/timer-ti-dm: Make timer selectable for ARCH_K3 Let's make timer-ti-dm selectable for ARCH_K3, and add a separate option for OMAP_DM_SYSTIMER as there should be no need for it on ARCH_K3. For older TI SoCs, we are already selecting OMAP_DM_TIMER in arch/arm/mach-omap*/Kconfig. For mach-omap2, we need to now also select OMAP_DM_SYSTIMER. Cc: Keerthy Cc: Nishanth Menon Cc: Vignesh Raghavendra Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220408101715.43697-3-tony@atomide.com Signed-off-by: Daniel Lezcano commit 41e79b1d458477212d0a880c87622bcaa69ab3ea Author: Tony Lindgren Date: Fri Apr 8 13:17:13 2022 +0300 clocksource/drivers/timer-ti-dm: Move inline functions to driver for am6 The __omap_dm_timer_* inline functions in the header are no longer needed outside the driver, and the header ifdefs prevent the driver working for ARCH_K3. Let's move the inline functions to the driver and drop the ifdefs and drop the unused functions __omap_dm_timer_override_errata() and __omap_dm_timer_load_start(). Cc: Keerthy Cc: Nishanth Menon Cc: Vignesh Raghavendra Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20220408101715.43697-2-tony@atomide.com Signed-off-by: Daniel Lezcano commit f9d88f93ec6d1f81e6907d0e18aa201bf649f4f7 Author: Rob Herring Date: Tue Jul 19 15:51:52 2022 -0600 dt-bindings: iio/dac: adi,ad5766: Add missing type to 'output-range-microvolts' 'output-range-microvolts' is missing a type definition. '-microvolts' is not a standard unit (should be '-microvolt'). As the property is already in use, add a type reference. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220719215152.1877776-1-robh@kernel.org commit fe75ac871214e83b192fe64c8329489d8e1a6a14 Author: Rob Herring Date: Tue Jul 19 15:50:16 2022 -0600 dt-bindings: power: supply: charger-manager: Add missing type for 'cm-battery-stat' 'cm-battery-stat' is missing a type definition and is not a common property. The type is boolean. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220719215017.1875530-1-robh@kernel.org commit 14b146b688ad9593f5eee93d51a34d09a47e50b5 Author: Pavel Begunkov Date: Wed Jul 27 10:30:41 2022 +0100 io_uring: notification completion optimisation We want to use all optimisations that we have for io_uring requests like completion batching, memory caching and more but for zc notifications. Fortunately, notification perfectly fit the request model so we can overlay them onto struct io_kiocb and use all the infratructure. Most of the fields of struct io_notif natively fits into io_kiocb, so we replace struct io_notif with struct io_kiocb carrying struct io_notif_data in the cmd cache line. Then we adapt io_alloc_notif() to use io_alloc_req()/io_alloc_req_refill(), and kill leftovers of hand coded caching. __io_notif_complete_tw() is converted to use io_uring's tw infra. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9e010125175e80baf51f0ca63bdc7cc6a4a9fa56.1658913593.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit bd1a3783dd749012134b142b52e5704f7c142897 Author: Pavel Begunkov Date: Wed Jul 27 10:30:40 2022 +0100 io_uring: export req alloc from core We want to do request allocation out of the core io_uring code, make the allocation functions public for other io_uring parts. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/0314fedd3a02a514210ba42d4720332538c65956.1658913593.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 9c5dd8034e3544d139c2531e58d3ca41bbf343dd Author: Yang Li Date: Wed Jun 1 10:28:14 2022 +0800 ovl: fix some kernel-doc comments Remove warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. fs/overlayfs/super.c:311: warning: Function parameter or member 'dentry' not described in 'ovl_statfs' fs/overlayfs/super.c:311: warning: Excess function parameter 'sb' description in 'ovl_statfs' fs/overlayfs/super.c:357: warning: Function parameter or member 'm' not described in 'ovl_show_options' fs/overlayfs/super.c:357: warning: Function parameter or member 'dentry' not described in 'ovl_show_options' Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Miklos Szeredi commit b10b85fe5149ee8b39fbbf86095b303632dde2cd Author: Miklos Szeredi Date: Wed Jul 27 16:31:30 2022 +0200 ovl: warn if trusted xattr creation fails When mounting overlayfs in an unprivileged user namespace, trusted xattr creation will fail. This will lead to failures in some file operations, e.g. in the following situation: mkdir lower upper work merged mkdir lower/directory mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged rmdir merged/directory mkdir merged/directory The last mkdir will fail: mkdir: cannot create directory 'merged/directory': Input/output error The cause for these failures is currently extremely non-obvious and hard to debug. Hence, warn the user and suggest using the userxattr mount option, if it is not already supplied and xattr creation fails during the self-check. Reported-by: Alois Wohlschlager Signed-off-by: Miklos Szeredi commit 47d8f8b78b9b42e9817feeb75bbf758f2a3cbff8 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:58:39 2022 +0200 dt-bindings: soc: bcm: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220726115841.101249-2-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit d07ae9004f18f06a8c9c0c3470daa49dd6b56bb9 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:58:38 2022 +0200 dt-bindings: soc: bcm: drop quotes when not needed Id and schema fields do not need quotes. Signed-off-by: Krzysztof Kozlowski Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220726115841.101249-1-krzysztof.kozlowski@linaro.org' Signed-off-by: Arnd Bergmann commit ed92f4353ef53e544db5311fd8efa0cd7fdc4e08 Author: Alexander Stein Date: Wed Jul 27 16:11:17 2022 +0200 usb: misc: onboard_usb_hub: Add TI USB8041 hub support This is a 4-port 3.0 USB hub. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20220727141117.909361-2-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 40758e493f4d08093fbf58390f8a4bc55b501a49 Author: Alexander Stein Date: Wed Jul 27 16:11:16 2022 +0200 usb: misc: onboard_usb_hub: Add reset-gpio support Despite default reset upon probe, release reset line after powering up the hub and assert reset again before powering down. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20220727141117.909361-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 40d02efad9801c1277b092c83f6471a31e77c59b Merge: a061a8ad3f906 39c3c396f8131 Author: Arnaldo Carvalho de Melo Date: Wed Jul 27 11:08:48 2022 -0300 Merge remote-tracking branch 'torvalds/master' into perf/core To get upstream fixes. Signed-off-by: Arnaldo Carvalho de Melo commit e35a5e782f67ed76a65ad0f23a484444a95f000f Author: Zhang Xianwei Date: Wed Jul 27 18:01:07 2022 +0800 NFSv4.1: RECLAIM_COMPLETE must handle EACCES A client should be able to handle getting an EACCES error while doing a mount operation to reclaim state due to NFS4CLNT_RECLAIM_REBOOT being set. If the server returns RPC_AUTH_BADCRED because authentication failed when we execute "exportfs -au", then RECLAIM_COMPLETE will go a wrong way. After mount succeeds, all OPEN call will fail due to an NFS4ERR_GRACE error being returned. This patch is to fix it by resending a RPC request. Signed-off-by: Zhang Xianwei Signed-off-by: Yi Wang Fixes: aa5190d0ed7d ("NFSv4: Kill nfs4_async_handle_error() abuses by NFSv4.1") Signed-off-by: Trond Myklebust commit 28188546df027970eb61ef2be4c2174aa6d77a93 Merge: 10c4c5279b76e e48ef9a9c5297 Author: Arnd Bergmann Date: Wed Jul 27 15:47:13 2022 +0200 Merge tag 'at91-dt-5.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/dt AT91 DT for v5.20 #4 It contains one new LAN966 based board, namely pcb8309, a cleanup on Makefile to sort alphabetically LAN966 entries and 2 cleanups on bindings. * tag 'at91-dt-5.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: dt-bindings: soc: microchip: use absolute path to other schema dt-bindings: soc: microchip: drop quotes when not needed ARM: dts: lan966x: keep lan966 entries alphabetically sorted ARM: dts: lan966x: add support for pcb8309 dt-bindings: arm: at91: add lan966 pcb8309 board Link: https://lore.kernel.org/r/20220727075749.2445000-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 30097967e0566cac817273ef76add100f6b0f463 Author: Srinivas Kandagatla Date: Wed Jul 27 13:47:49 2022 +0100 ASoC: codecs: va-macro: use fsgen as clock VA Macro fsgen clock is supplied to other LPASS Macros using proper clock apis, however the internal user uses the registers directly without clk apis. This approch has race condition where in external users of the clock might cut the clock while VA macro is actively using this. Moving the internal usage to clk apis would provide a proper refcounting and avoid such race conditions. This issue was noticed while headset was pulled out while recording is in progress and shifting record patch to DMIC. Reported-by: Srinivasa Rao Mandadapu Signed-off-by: Srinivas Kandagatla Tested-by: Srinivasa Rao Mandadapu Link: https://lore.kernel.org/r/20220727124749.4604-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit c95a5712beee635c4626f78218e52b978f075a17 Author: John Garry Date: Tue Jul 26 17:24:33 2022 +0800 arm64: defconfig: Sync some configs with savedefconfig Some configs can obviously be removed when sync'ing with savedefconfig, as follows: - config SECCOMP was changed to def_bool y in commit 282a181b1a0d (" seccomp: Move config option SECCOMP to arch/Kconfig"), so no need to explicitly enable in the defconfig. - config MAILBOX is already selected by some drivers enabled in the defconfig, so no need to explicitly enable. - config QRTR was enabled in the defconfig from commit 1bdf91fd2ae82 (" arm64: defconfig: Enable Qualcomm QRTR"). However until many kernel versions later in commit 231a136fdf46 ("arm64: defconfig: enable ath11k driver"), no driver depended on config QRTR - not for building anyway. In commit 231a136fdf46, config ATH11K_PCI was enabled and this selects config QRTR, so there is no need to explicitly enable in the defconfig. Signed-off-by: John Garry Link: https://lore.kernel.org/r/1658827473-121156-1-git-send-email-john.garry@huawei.com' Signed-off-by: Arnd Bergmann commit 70c898d4bad1a21e0889ae12f355ff8c68ce5b9f Author: Xu Qiang Date: Fri Jul 1 08:29:35 2022 +0000 wifi: plfxlc: Use eth_zero_addr() to assign zero address Using eth_zero_addr() to assign zero address instead of memset(). Reported-by: Hulk Robot Signed-off-by: Xu Qiang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220701082935.110924-1-xuqiang36@huawei.com commit cdbe34da01e32024e56fff5c6854a263a012d7ff Author: Aleksa Savic Date: Wed Jul 27 12:06:05 2022 +0200 hwmon: (aquacomputer_d5next) Add support for Aquacomputer Quadro fan controller Extend aquacomputer_d5next driver to expose hardware temperature sensors and fans of the Aquacomputer Quadro fan controller, which communicates through a proprietary USB HID protocol. Implemented by Jack Doan [1]. Four temperature sensors and PWM controllable fans are available. The liquid flow sensor is also exposed, implemented by Leonard Anderweit [2]. Additionally, serial number, firmware version and power-on count are exposed through debugfs. This driver has been tested on x86_64. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/5 [2] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/pull/9 Originally-from: Jack Doan Originally-from: Leonard Anderweit Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20220727100606.9328-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck commit 41cd4373274239a79a5a3e1127607225908a0fbb Author: Armin Wolf Date: Wed Jul 27 10:30:04 2022 +0200 hwmon: (dell-smm) Improve documentation Notify users of this driver that each pwmX attribute controls fan number X, meaning that probing of pwm channels is unnecessary. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220727083004.5684-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 4c2742146de06a39d24e91155e3deec278e11932 Author: Ajay Singh Date: Wed Jul 20 16:03:06 2022 +0000 wifi: wilc1000: use existing iftype variable to store the interface type For consistency, use an existing 'iftype' element which was already having the interface type. Replace 'mode' with 'iftype' as it was used for the same purpose. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-8-ajay.kathat@microchip.com commit 39d0f1b0bf914885880d73f89e1eb1508d5eaa16 Author: Ajay Singh Date: Wed Jul 20 16:03:05 2022 +0000 wifi: wilc1000: add 'isinit' flag for SDIO bus similar to SPI Similar to SPI priv data, add 'isinit' variable in SDIO priv. Make use of the state to invoke hif_init() once, and acquire the lock before accessing hif function. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-7-ajay.kathat@microchip.com commit ad3e683ae4dc311baea7a8724315b6d8d9a7aaa9 Author: Ajay Singh Date: Wed Jul 20 16:03:05 2022 +0000 wifi: wilc1000: cancel the connect operation during interface down Cancel the ongoing connection request to avoid any issue if the interface is set down before the connection request is completed. host_int_handle_disconnect was already available, so renamed it and used the same API for 'ndio_close' cb. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-6-ajay.kathat@microchip.com commit 12fb1ae537a416b77ac9cbaefa6dd9dacaa27ed0 Author: Ajay Singh Date: Wed Jul 20 16:03:04 2022 +0000 wifi: wilc1000: get correct length of string WID from received config packet For string type WID packet, the data length is received as 16-bit value so use 'get_unaligned_le16' conversion API to extract the correct length. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-5-ajay.kathat@microchip.com commit 33d4a577c7b184bac755deb68fe6e84ae009d70f Author: Ajay Singh Date: Wed Jul 20 16:03:04 2022 +0000 wifi: wilc1000: set station_info flag only when signal value is valid Set station_info->filled to indicate signal level only when its value is received successfully using wilc_get_rssi(). Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-4-ajay.kathat@microchip.com commit f589b5d941c712d982868fd548a000e07fc5cf59 Author: Ajay Singh Date: Wed Jul 20 16:03:03 2022 +0000 wifi: wilc1000: set correct value of 'close' variable in failure case Set 'close' variable to '1' to indicate closing operation when initialisation fails during wlan_initialize_threads() call. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-3-ajay.kathat@microchip.com commit 2f6e44ee6e969ea22d330c2810d7c891e63e6a08 Author: Ajay Singh Date: Wed Jul 20 16:03:03 2022 +0000 wifi: wilc1000: add WID_TX_POWER WID in g_cfg_byte array WID_TX_POWER WID value is fetched from the firmware so it should be added in'g_cfg_byte' array to store the data which is received from firmware. Signed-off-by: Ajay Singh Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720160302.231516-2-ajay.kathat@microchip.com commit dbf8cd368a4786d7a6a3a4c842d083a4924658f5 Author: Xin Gao Date: Thu Jul 21 03:42:45 2022 +0800 wifi: b43: do not initialise static variable to 0 No need to initialise static variables to zero. Signed-off-by: Xin Gao Acked-by: Larry Finger [kvalo@kernel.org: improve commit log] Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220720194245.8442-1-gaoxin@cdjrlc.com commit 7d13c0ae38a62835ead261527727a9f9bf949d43 Author: Yang Li Date: Tue Jul 19 15:56:37 2022 +0800 wifi: b43legacy: clean up one inconsistent indenting Eliminate the follow smatch warning: drivers/net/wireless/broadcom/b43legacy/main.c:2947 b43legacy_wireless_core_stop() warn: inconsistent indenting Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220719075637.111716-1-yang.lee@linux.alibaba.com commit 13876f2a087ad352bf640a7a0a4a4229ea6e9e4f Author: Zheyu Ma Date: Sat Jul 16 21:04:44 2022 +0800 wifi: rtl8xxxu: Fix the error handling of the probe function When the driver fails at ieee80211_alloc_hw() at the probe time, the driver will free the 'hw' which is not allocated, causing a bug. The following log can reveal it: [ 15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40 [ 15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373 [ 15.982583] Call Trace: [ 15.984282] ieee80211_free_hw+0x22/0x390 [ 15.984446] rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu] Fix the bug by changing the order of the error handling. Signed-off-by: Zheyu Ma Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220716130444.2950690-1-zheyuma97@gmail.com commit 69ddcea564437ce4b0d5143f37a9154fcef8d3d2 Author: Uwe Kleine-König Date: Sat Jul 16 00:46:19 2022 +0200 wifi: wl12xx: Drop if with an always false condition The remove callback is only called after probe completed successfully. In this case platform_set_drvdata() was called with a non-NULL argument (in wlcore_probe()) and so wl is never NULL. This is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220715224619.ht7bbzzrmysielm7@pengutronix.de commit 6fd57e1d120bf13d4dc6c200a7cf914e6347a316 Author: Hangyu Hua Date: Mon Jun 20 17:23:50 2022 +0800 wifi: libertas: Fix possible refcount leak in if_usb_probe() usb_get_dev will be called before lbs_get_firmware_async which means that usb_put_dev need to be called when lbs_get_firmware_async fails. Fixes: ce84bb69f50e ("libertas USB: convert to asynchronous firmware loading") Signed-off-by: Hangyu Hua Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220620092350.39960-1-hbh25y@gmail.com Link: https://lore.kernel.org/r/20220622113402.16969-1-colin.i.king@gmail.com commit e0c6b1f3d7574dea3bec7deb18578e896d2cfaa2 Author: Xuezhi Zhang Date: Wed Jul 27 20:44:15 2022 +0800 USB: usbsevseg: convert sysfs snprintf to sysfs_emit Fix the following coccincheck warning: drivers/usb/misc/usbsevseg.c:170:8-16: WARNING: use scnprintf or sprintf Signed-off-by: Xuezhi Zhang Link: https://lore.kernel.org/r/20220727124415.8340-1-zhangxuezhi3@gmail.com Signed-off-by: Greg Kroah-Hartman commit 06ce07860b3237296da299dede242b114d184849 Author: Yang Li Date: Wed Jun 15 08:53:16 2022 +0800 wifi: mwifiex: clean up one inconsistent indenting Eliminate the follow smatch warning: drivers/net/wireless/marvell/mwifiex/pcie.c:3364 mwifiex_unregister_dev() warn: inconsistent indenting Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220615005316.9596-1-yang.lee@linux.alibaba.com commit 1de452a0edda26f1483d1d934f692eab13ba669a Author: Douglas Anderson Date: Tue Jul 26 10:38:23 2022 -0700 regulator: core: Allow drivers to define their init data as const Drivers tend to want to define the names of their regulators somewhere in their source file as "static const". This means, inevitable, that every driver out there open codes something like this: static const char * const supply_names[] = { "vcc", "vccl", }; static int get_regulators(struct my_data *data) { int i; data->supplies = devm_kzalloc(...) if (!data->supplies) return -ENOMEM; for (i = 0; i < ARRAY_SIZE(supply_names); i++) data->supplies[i].supply = supply_names[i]; return devm_regulator_bulk_get(data->dev, ARRAY_SIZE(supply_names), data->supplies); } Let's make this more convenient by doing providing a helper that does the copy. I have chosen to have the "const" input structure here be the exact same structure as the normal one passed to devm_regulator_bulk_get(). This is slightly inefficent since the input data can't possibly have anything useful for "ret" or consumer and thus we waste 8 bytes per structure. This seems an OK tradeoff for not introducing an extra structure. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20220726103631.v2.6.I38fc508a73135a5c1b873851f3553ff2a3a625f5@changeid Signed-off-by: Mark Brown commit 6eabfc018e8d1033e7fc1efce30a872e2dccb537 Author: Douglas Anderson Date: Tue Jul 26 10:38:21 2022 -0700 regulator: core: Allow specifying an initial load w/ the bulk API There are a number of drivers that follow a pattern that looks like this: 1. Use the regulator bulk API to get a bunch of regulators. 2. Set the load on each of the regulators to use whenever the regulators are enabled. Let's make this easier by just allowing the drivers to pass the load in. As part of this change we need to move the error printing in regulator_bulk_get() around; let's switch to the new dev_err_probe() to simplify it. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20220726103631.v2.4.Ie85f68215ada39f502a96dcb8a1f3ad977e3f68a@changeid Signed-off-by: Mark Brown commit 40e58a8a7ca6ac7f03a5fbfdbc0119fc0caaa072 Author: Alexander Stein Date: Wed Jul 27 11:37:59 2022 +0200 dt-bindings: usb: Add binding for TI USB8041 hub controller The TI USB8041 is a USB 3.0 hub controller with 4 ports. This initial version of the binding only describes USB related aspects of the USB8041, it does not cover the option of connecting the controller as an i2c slave. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20220727093801.687361-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 76e960597635ee80d7c713f606b0f6ac9228d98e Author: Fabrice Gasnier Date: Tue Jul 26 10:07:08 2022 +0200 ARM: multi_v7_defconfig: enable USB onboard HUB driver Enable the USB onboard HUB driver, used on STM32MP1 boards. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220726080708.162547-5-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 0d0fb2b605c7512e67b328f3077d24ec5e4c5b38 Author: Fabrice Gasnier Date: Tue Jul 26 10:07:07 2022 +0200 ARM: dts: stm32: add support for USB2514B onboard hub on stm32mp15xx-dkx Add support for USB2514B onboard hub on stm32mp15 DK boards. The HUB is supplied by a 3v3 PMIC regulator. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220726080708.162547-4-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 43993626de00f8faea2cf4d54aaea8f607331fcf Author: Fabrice Gasnier Date: Tue Jul 26 10:07:06 2022 +0200 usb: misc: onboard-hub: add support for Microchip USB2514B USB 2.0 hub Add support for Microchip USB2514B USB 2.0 hub to the onboard usb hub driver. Adopt the generic usb-device compatible ("usbVID,PID"). Some STM32MP1 boards have this hub on-board, with a supply that needs to be enabled for proper operation. Acked-by: Matthias Kaehlcke Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220726080708.162547-3-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 817f9ee0dad570a6ba6a285f662de657760094cd Author: Fabrice Gasnier Date: Tue Jul 26 10:07:05 2022 +0200 dt-bindings: usb: generic-ehci: allow usb-hcd schema properties Allow properties and usb-device child nodes as defined in usb-hcd.yaml, by using unevaluatedProperties: false. By the way, remove the "companion" property as it's redundant with usb-hcd.yaml. As example, this allows an onboard hub, to be described in generic-ehci controller node: usb { compatible = "generic-ehci"; #address-cells = <1>; #size-cells = <0>; /* onboard HUB */ hub@1 { compatible = "usb424,2514"; reg = <1>; vdd-supply = <&v3v3>; }; }; Without this, dtbs_check complains on '#address-cells', '#size-cells', 'hub@1' do not match any of the regexes: 'pinctrl-[0-9]+' From schema: ..../generic-ehci.yaml Reviewed-by: Rob Herring Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220726080708.162547-2-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 2d945194cce11ce2800949c8746bc3e788d89067 Author: Fabrice Gasnier Date: Wed Jul 13 14:08:42 2022 +0200 usb: typec: ucsi: stm32g0: add bootloader support STM32G0 comes with STM32 bootloader in its system memory. Add support for some I2C bootloader commands as described in application notes AN2606 and AN4221, to enable STM32G0 UCSI firmware update. Upon probing, the driver needs to know the STM32G0 state: - In bootloader mode, STM32 G0 answers at i2c addr 0x51. - In running mode, STM32 G0 firmware may answer at two address. - The main address specified in DT is used for UCSI. - 0x51 addr can be re-used for FW controls like getting software version or jump to booloader request. So probe using the main firmware i2c address first, before attempting bootloader address (e.g. check for blank, erased or previously aborted firmware update). Acked-by: Heikki Krogerus Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220713120842.560902-4-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 72849d4fcee7cc9e6b98637738b722f78502525d Author: Fabrice Gasnier Date: Wed Jul 13 14:08:41 2022 +0200 usb: typec: ucsi: stm32g0: add support for stm32g0 controller STM32G0 provides an integrated USB Type-C and power delivery interface. It can be programmed with a firmware to handle UCSI protocol over I2C interface. A GPIO is used as an interrupt line. Type-C connector can be used as a wakeup source (typically to detect changes on the port, like attach or detach). PM suspend / resume routines are used to enable wake irqs, and signal a wakeup event in case the IRQ has fired while in suspend. The i2c core is doing the necessary initialization when the "wakeup-source" flag is provided. Note: the interrupt handler shouldn't be called before the i2c bus resumes. So, the interrupts are disabled during suspend period, and re-enabled upon resume, to avoid i2c transfer while suspended, from the irq handler. Acked-by: Heikki Krogerus Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220713120842.560902-3-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit b60fd9361b6e0041299e9e677603dd1df7c9677b Author: Fabrice Gasnier Date: Wed Jul 13 14:08:40 2022 +0200 dt-bindings: usb: typec: add bindings for stm32g0 controller Add DT schema documentation for the STM32G0 Type-C PD (Power Delivery) controller. STM32G0 provides an integrated USB Type-C and power delivery interface. It can be programmed with a firmware to handle UCSI protocol over I2C interface. A GPIO is used as an interrupt line. It may be used as a wakeup source, so use optional "wakeup-source" and "power-domains" properties to support wakeup. The firmware itself may be flashed or later updated (optional). Choice is let to the application to allow firmware update. A default firmware could be already programmed in production and be customized (to not allow it). So the firmware-name is made optional to represent this option. Reviewed-by: Rob Herring Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220713120842.560902-2-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit a7dc438b5e446afcd1b3b6651da28271400722f2 Author: Linyu Yuan Date: Tue Jul 26 14:45:49 2022 +0800 usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion We found PPM will not send any notification after it report error status and OPM issue GET_ERROR_STATUS command to read the details about error. According UCSI spec, PPM may clear the Error Status Data after the OPM has acknowledged the command completion. This change add operation to acknowledge the command completion from PPM. Fixes: bdc62f2bae8f (usb: typec: ucsi: Simplified registration and I/O API) Cc: # 5.10 Signed-off-by: Jack Pham Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1658817949-4632-1-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman commit c3ffc9c4ca44bfe9562166793d133e1fb0630ea6 Author: Andrey Strachuk Date: Mon Jul 18 19:00:52 2022 +0300 usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Acked-by: Peter Chen Signed-off-by: Andrey Strachuk Link: https://lore.kernel.org/r/20220718160052.4188-1-strochuk@ispras.ru Signed-off-by: Greg Kroah-Hartman commit fe3cc0cebe6091675c8bacd94e232a3203b939b8 Author: Jilin Yuan Date: Sat Jul 16 21:16:30 2022 +0800 usb/chipidea: fix repeated words in comments Delete the redundant word 'power'. Acked-by: Peter Chen Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716131630.33151-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit b2d0dd5155c437ec5aad2141d74a8fac97ef755f Author: Chen Xingdi Date: Wed Jul 27 11:11:46 2022 +0800 usb: renesas-xhci: Do not print any log while fw verif success When drivers are working properly, they should be quiet. Signed-off-by: Chen Xingdi Link: https://lore.kernel.org/r/20220727031146.19345-1-chenxingdi@huawei.com Signed-off-by: Greg Kroah-Hartman commit 0c34043897736a3fac259564a6323a1f045100bb Author: Nícolas F. R. A. Prado Date: Mon Jul 25 16:31:29 2022 -0400 usb: typec: retimer: Add missing id check in match callback The fwnode_connection_find_match() function handles two cases: named references and graph endpoints. In the second case, the match function passed in is called with the id to check for the match. However, the match function for the recently added type-c retimer class assumes the connection has already been matched (which is only true for the first case). The result is that with that change, all type-c nodes with graph endpoints defer probe indefinitely, independently of having a retimer connection or not. Add the missing check, like is done by the type-c mux and usb role switch code, to fix the issue. Fixes: ddaf8d96f93b ("usb: typec: Add support for retimers") Reviewed-by: Prashant Malani Signed-off-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/r/20220725203129.1973260-1-nfraprado@collabora.com Signed-off-by: Greg Kroah-Hartman commit 13da6f41fbe01afc4937aabef87950223d52c83f Author: Jason Wang Date: Sat Jul 16 12:17:55 2022 +0800 USB: xhci: Fix comment typo The double `the' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20220716041755.34016-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit 908d34aad1ef9214899ec07bfb2a9924f8ed52ff Author: Jilin Yuan Date: Sat Jul 16 21:56:42 2022 +0800 usb/typec/tcpm: fix repeated words in comments Delete the redundant word 'to'. Reviewed-by: Guenter Roeck Acked-by: Heikki Krogerus Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716135642.52460-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit d5851c2480253e6a58965d832d5ffbffba6c4729 Author: Jilin Yuan Date: Sat Jul 16 21:44:57 2022 +0800 usb/musb: fix repeated words in comments Delete the redundant word 'mode'. Delete the redundant word 'than'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716134457.46535-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit 676cb83b11c3648f513e84cf3a8616e9e1539d44 Author: Jilin Yuan Date: Sat Jul 16 21:41:05 2022 +0800 usb/misc: fix repeated words in comments Delete the redundant word 'with'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716134105.44710-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit cd86f367eb6b5154230650c8f8c4003da0c12f54 Author: Jilin Yuan Date: Sat Jul 16 21:38:25 2022 +0800 usb/image: fix repeated words in comments Delete the redundant word 'the'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716133825.43161-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit 973939279a20c1368bbd818b49ad2443689cd926 Author: Jilin Yuan Date: Sat Jul 16 21:36:24 2022 +0800 usb/host: fix repeated words in comments Delete the redundant word 'the'. Delete the redundant word 'to'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716133624.41994-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit a7a9f4c0060e8f29a5fc2fe610575c3eabfc2253 Author: Jilin Yuan Date: Sat Jul 16 21:24:03 2022 +0800 usb/core: fix repeated words in comments Delete the redundant word 'the'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716132403.35270-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit 86c4bb4f124eec79423b90ef138402bf0b809bce Author: Jilin Yuan Date: Sat Jul 16 21:13:12 2022 +0800 usb/atm: fix repeated words in comments Delete the redundant word 'was'. Signed-off-by: Jilin Yuan Link: https://lore.kernel.org/r/20220716131312.31767-1-yuanjilin@cdjrlc.com Signed-off-by: Greg Kroah-Hartman commit 2191c00855b03aa59c20e698be713d952d51fc18 Author: Alan Stern Date: Thu Jul 21 11:07:10 2022 -0400 USB: gadget: Fix use-after-free Read in usb_udc_uevent() The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug: --------------------------------------------------------------- BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 Read of size 8 at addr ffff888078ce2050 by task udevd/2968 CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 dev_uevent+0x290/0x770 drivers/base/core.c:2424 --------------------------------------------------------------- The bug occurs because usb_udc_uevent() dereferences udc->driver but does so without acquiring the udc_lock mutex, which protects this field. If the gadget driver is unbound from the udc concurrently with uevent processing, the driver structure may be accessed after it has been deallocated. To prevent the race, we make sure that the routine holds the mutex around the racing accesses. Link: CC: stable@vger.kernel.org # fc274c1e9973 Reported-and-tested-by: syzbot+b0de012ceb1e2a97891b@syzkaller.appspotmail.com Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YtlrnhHyrHsSky9m@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 26c6c2f8a907c9e3a2f24990552a4d77235791e6 Author: Weitao Wang Date: Tue Jul 26 15:49:18 2022 +0800 USB: HCD: Fix URB giveback issue in tasklet function Usb core introduce the mechanism of giveback of URB in tasklet context to reduce hardware interrupt handling time. On some test situation(such as FIO with 4KB block size), when tasklet callback function called to giveback URB, interrupt handler add URB node to the bh->head list also. If check bh->head list again after finish all URB giveback of local_list, then it may introduce a "dynamic balance" between giveback URB and add URB to bh->head list. This tasklet callback function may not exit for a long time, which will cause other tasklet function calls to be delayed. Some real-time applications(such as KB and Mouse) will see noticeable lag. In order to prevent the tasklet function from occupying the cpu for a long time at a time, new URBS will not be added to the local_list even though the bh->head list is not empty. But also need to ensure the left URB giveback to be processed in time, so add a member high_prio for structure giveback_urb_bh to prioritize tasklet and schelule this tasklet again if bh->head list is not empty. At the same time, we are able to prioritize tasklet through structure member high_prio. So, replace the local high_prio_bh variable with this structure member in usb_hcd_giveback_urb. Fixes: 94dfd7edfd5c ("USB: HCD: support giveback of URB in tasklet context") Cc: stable Reviewed-by: Alan Stern Signed-off-by: Weitao Wang Link: https://lore.kernel.org/r/20220726074918.5114-1-WeitaoWang-oc@zhaoxin.com Signed-off-by: Greg Kroah-Hartman commit d7de14d74d6551f0d097430f9893ce82ad17e5b8 Author: Alexey Sheplyakov Date: Fri Jul 22 18:17:00 2022 +0400 usb: xhci_plat_remove: avoid NULL dereference Since commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") xhci->shared_hcd can be NULL, which causes the following Oops on reboot: [ 710.124450] systemd-shutdown[1]: Rebooting. [ 710.298861] xhci-hcd xhci-hcd.2.auto: remove, state 4 [ 710.304217] usb usb3: USB disconnect, device number 1 [ 710.317441] xhci-hcd xhci-hcd.2.auto: USB bus 3 deregistered [ 710.323280] xhci-hcd xhci-hcd.2.auto: remove, state 1 [ 710.328401] usb usb2: USB disconnect, device number 1 [ 710.333515] usb 2-3: USB disconnect, device number 2 [ 710.467649] xhci-hcd xhci-hcd.2.auto: USB bus 2 deregistered [ 710.475450] Unable to handle kernel NULL pointer dereference at virtual address 00000000000003b8 [ 710.484425] Mem abort info: [ 710.487265] ESR = 0x0000000096000004 [ 710.491060] EC = 0x25: DABT (current EL), IL = 32 bits [ 710.496427] SET = 0, FnV = 0 [ 710.499525] EA = 0, S1PTW = 0 [ 710.502716] FSC = 0x04: level 0 translation fault [ 710.507648] Data abort info: [ 710.510577] ISV = 0, ISS = 0x00000004 [ 710.514462] CM = 0, WnR = 0 [ 710.517480] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008b0050000 [ 710.523976] [00000000000003b8] pgd=0000000000000000, p4d=0000000000000000 [ 710.530961] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 710.536551] Modules linked in: rfkill input_leds snd_soc_simple_card snd_soc_simple_card_utils snd_soc_nau8822 designware_i2s snd_soc_core dw_hdmi_ahb_audio snd_pcm_dmaengine arm_ccn panfrost ac97_bus gpu_sched snd_pcm at24 fuse configfs sdhci_of_dwcmshc sdhci_pltfm sdhci nvme led_class mmc_core nvme_core bt1_pvt polynomial tp_serio snd_seq_midi snd_seq_midi_event snd_seq snd_timer snd_rawmidi snd_seq_device snd soundcore efivarfs ipv6 [ 710.575286] CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 5.19.0-rc7-00043-gfd8619f4fd54 #1 [ 710.583822] Hardware name: T-Platforms TF307-MB/BM1BM1-A, BIOS 5.6 07/06/2022 [ 710.590972] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 710.597949] pc : usb_remove_hcd+0x34/0x1e4 [ 710.602067] lr : xhci_plat_remove+0x74/0x140 [ 710.606351] sp : ffff800009f3b7c0 [ 710.609674] x29: ffff800009f3b7c0 x28: ffff000800960040 x27: 0000000000000000 [ 710.616833] x26: ffff800008dc22a0 x25: 0000000000000000 x24: 0000000000000000 [ 710.623992] x23: 0000000000000000 x22: ffff000805465810 x21: ffff000805465800 [ 710.631149] x20: ffff000800f80000 x19: 0000000000000000 x18: ffffffffffffffff [ 710.638307] x17: ffff000805096000 x16: ffff00080633b800 x15: ffff000806537a1c [ 710.645465] x14: 0000000000000001 x13: 0000000000000000 x12: ffff00080378d6f0 [ 710.652621] x11: ffff00080041a900 x10: ffff800009b204e8 x9 : ffff8000088abaa4 [ 710.659779] x8 : ffff000800960040 x7 : ffff800009409000 x6 : 0000000000000001 [ 710.666936] x5 : ffff800009241000 x4 : ffff800009241440 x3 : 0000000000000000 [ 710.674094] x2 : ffff000800960040 x1 : ffff000800960040 x0 : 0000000000000000 [ 710.681251] Call trace: [ 710.683704] usb_remove_hcd+0x34/0x1e4 [ 710.687467] xhci_plat_remove+0x74/0x140 [ 710.691400] platform_remove+0x34/0x70 [ 710.695165] device_remove+0x54/0x90 [ 710.698753] device_release_driver_internal+0x200/0x270 [ 710.703992] device_release_driver+0x24/0x30 [ 710.708273] bus_remove_device+0xe0/0x16c [ 710.712293] device_del+0x178/0x390 [ 710.715797] platform_device_del.part.0+0x24/0x90 [ 710.720514] platform_device_unregister+0x30/0x50 [ 710.725232] dwc3_host_exit+0x20/0x30 [ 710.728907] dwc3_remove+0x174/0x1b0 [ 710.732494] platform_remove+0x34/0x70 [ 710.736254] device_remove+0x54/0x90 [ 710.739840] device_release_driver_internal+0x200/0x270 [ 710.745078] device_release_driver+0x24/0x30 [ 710.749359] bus_remove_device+0xe0/0x16c [ 710.753380] device_del+0x178/0x390 [ 710.756881] platform_device_del.part.0+0x24/0x90 [ 710.761598] platform_device_unregister+0x30/0x50 [ 710.766314] of_platform_device_destroy+0xe8/0x100 [ 710.771119] device_for_each_child_reverse+0x70/0xc0 [ 710.776099] of_platform_depopulate+0x48/0x90 [ 710.780468] __dwc3_of_simple_teardown+0x28/0xe0 [ 710.785099] dwc3_of_simple_shutdown+0x20/0x30 [ 710.789555] platform_shutdown+0x30/0x40 [ 710.793490] device_shutdown+0x138/0x32c [ 710.797425] __do_sys_reboot+0x1c4/0x2ac [ 710.801362] __arm64_sys_reboot+0x30/0x40 [ 710.805383] invoke_syscall+0x50/0x120 [ 710.809146] el0_svc_common.constprop.0+0x68/0x124 [ 710.813950] do_el0_svc+0x3c/0xcc [ 710.817275] el0_svc+0x60/0x12c [ 710.820428] el0t_64_sync_handler+0xc0/0x13c [ 710.824710] el0t_64_sync+0x18c/0x190 [ 710.828386] Code: a9025bf5 f942c420 f9001fe0 d2800000 (b943ba62) [ 710.834498] ---[ end trace 0000000000000000 ]--- [ 710.875958] pstore: crypto_comp_compress failed, ret = -22! [ 710.895047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 710.902757] Kernel Offset: disabled [ 710.906255] CPU features: 0x800,00004811,00001082 [ 710.910971] Memory Limit: none [ 710.927474] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- To avoid the problem check for NULL in usb_remove_hcd. Fixes: 4736ebd7fcaf ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") Signed-off-by: Alexey Sheplyakov Link: https://lore.kernel.org/r/20220722141700.1271439-1-asheplyakov@basealt.ru Signed-off-by: Greg Kroah-Hartman commit 23bb7b49597139d38f4da9392df28a24229697b6 Author: Xin Ji Date: Fri Jul 22 16:18:34 2022 +0800 usb: typec: anx7411: fix passing zero to 'PTR_ERR' Fix anx7411_register_partner() warn: passing zero to 'PTR_ERR' Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Xin Ji Link: https://lore.kernel.org/r/20220722081836.3380885-1-xji@analogixsemi.com Signed-off-by: Greg Kroah-Hartman commit d183a57cad920087a770c45721e98f45feea0fde Author: Yang Yingliang Date: Thu Jul 21 15:12:01 2022 +0800 usb: typec: anx7411: Fix error return code in anx7411_i2c_probe() Add mising error return code when failed to get interrupt or failed to register psy. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220721071201.269344-3-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 5cda657679f8fcb2896e4ac0aa8e231f12f9fb04 Author: Yang Yingliang Date: Thu Jul 21 15:12:00 2022 +0800 usb: typec: anx7411: Fix return value check in anx7411_register_i2c_dummy_clients() If i2c_new_dummy_device() fails, it never return NULL pointer, replace NULL test with IS_ERR() to fix it. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220721071201.269344-2-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 67fb0cc02f89049e532b008faa35818c82aa0d62 Author: Yang Yingliang Date: Thu Jul 21 15:11:59 2022 +0800 usb: typec: anx7411: Fix wrong pointer passed to PTR_ERR() It should be 'ctx->typec.amode[i]' passed to PTR_ERR() when typec_partner_register_altmode() failed. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220721071201.269344-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 0c25bab1abb43dbe2662e88f56e157ccac76f8c2 Author: Dan Carpenter Date: Fri Jul 22 09:29:52 2022 +0300 usb: typec: anx7411: use semi-colons instead of commas Semi colons and commas are equivalent in this context but semi-colons are better style. Reviewed-by: Xin Ji Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YtpD4MKBa43higNc@kili Signed-off-by: Greg Kroah-Hartman commit 9310bd4bf20ff9ab180a0158f917b1d9af3247dc Author: Dan Carpenter Date: Fri Jul 22 09:29:07 2022 +0300 usb: typec: anx7411: fix error checking in anx7411_get_gpio_irq() This is a minor bug which means that certain error messages are not printed. The devm_gpiod_get_optional() function can return either error pointers or NULL. It returns error pointers if there is an allocation failure, or a similar issue. It returns NULL if no GPIO was assigned to the requested function. Print an error in either case. The gpiod_to_irq() function never returns zero. It either returns a positive IRQ number or a negative error code. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Reviewed-by: Xin Ji Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YtpDs8VsWIbl/Smd@kili Signed-off-by: Greg Kroah-Hartman commit cfed201e2db273562de152d22b74f74dee77e301 Author: Dan Carpenter Date: Fri Jul 22 09:25:42 2022 +0300 usb: typec: anx7411: Fix an array out of bounds This should be ARRAY_SIZE() instead of sizeof(). ARRAY_SIZE is 4 and sizeof is 8. Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") Reviewed-by: Xin Ji Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YtpC5s4/AD8vFz+X@kili Signed-off-by: Greg Kroah-Hartman commit ff50a91ee5e6db357c900dce280a7129dc9e363c Author: Colin Ian King Date: Fri Jul 15 23:56:57 2022 +0100 usb: phy: remove redundant store to variable var after & operation There is no need to store the result of the & operation back to the variable var. The store is redundant, replace &= with just &. Cleans up clang scan warning: drivers/usb/phy/phy-keystone.c:62:5: warning: Although the value stored to 'val' is used in the enclosing expression, the value is never actually read from 'val' [deadcode.DeadStores] Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20220715225657.353828-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5ffcba41de5579566f7d6933b96e8ca63335f790 Merge: 2f0f6b176e083 28ec53f3a8307 Author: David S. Miller Date: Wed Jul 27 13:24:43 2022 +0100 Merge branch 'smc-updates' Wenjia Zhang says: ==================== net/smc: updates 2022-07-25 please apply the following patches to netdev's net-next tree. These patches do some preparation to make ISM available for uses beyond SMC-D, and a bunch of cleanups. v2: add "Reviewed-by: Tony Lu " ==================== Signed-off-by: David S. Miller commit 28ec53f3a830750f1b5ccf73cb13dae66ade1660 Author: Stefan Raspl Date: Mon Jul 25 16:10:00 2022 +0200 net/smc: Enable module load on netlink usage Previously, the smc and smc_diag modules were automatically loaded as dependencies of the ism module whenever an ISM device was present. With the pending rework of the ISM API, the smc module will no longer automatically be loaded in presence of an ISM device. Usage of an AF_SMC socket will still trigger loading of the smc modules, but usage of a netlink socket will not. This is addressed by setting the correct module aliases. Signed-off-by: Stefan Raspl Signed-off-by: Wenjia Zhang < wenjia@linux.ibm.com> Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 8b2fed8e2712e8c23665df3c9e0fbabbb76e466c Author: Stefan Raspl Date: Mon Jul 25 16:09:59 2022 +0200 net/smc: Pass on DMBE bit mask in IRQ handler Make the DMBE bits, which are passed on individually in ism_move() as parameter idx, available to the receiver. Signed-off-by: Stefan Raspl Signed-off-by: Wenjia Zhang < wenjia@linux.ibm.com> Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 0a2f4f9893c83bd722bd55a903fb682da2eb24ba Author: Stefan Raspl Date: Mon Jul 25 16:09:58 2022 +0200 s390/ism: Cleanups Reworked signature of the function to retrieve the system EID: No plausible reason to use a double pointer. And neither to pass in the device as an argument, as this identifier is by definition per system, not per device. Plus some minor consistency edits. Signed-off-by: Stefan Raspl Signed-off-by: Wenjia Zhang < wenjia@linux.ibm.com> Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit eb481b02bd182a96e22070895bf887277b82150f Author: Heiko Carstens Date: Mon Jul 25 16:09:57 2022 +0200 net/smc: Eliminate struct smc_ism_position This struct is used in a single place only, and its usage generates inefficient code. Time to clean up! Signed-off-by: Heiko Carstens Reviewed-and-tested-by: Stefan Raspl Signed-off-by: Wenjia Zhang < wenjia@linux.ibm.com> Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 7dea20f2fecbde5df321d6d9d0b7765be6edc28c Author: Randy Dunlap Date: Wed Jul 20 10:37:49 2022 -0700 kconfig: Qt5: tell the user which packages are required Along with saying "Please install Qt5 ...", tell exactly which parts of Qt5 are needed. This is useful when parts of Qt5 are installed but some of the required pieces are missing, and it eliminates the need for the user to find the shell script and the line in it that provide that information. Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit abe864b8e19adf33b48997de8bc1a8f095390ade Author: Masahiro Yamada Date: Wed Jul 20 01:53:00 2022 +0900 modpost: use sym_get_data() to get module device_table data Use sym_get_data() to replace the long code. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 5764f6626f5f334b27e168a33735b3899d08bcd2 Author: Masahiro Yamada Date: Wed Jul 20 01:52:59 2022 +0900 modpost: drop executable ELF support Since commit 269a535ca931 ("modpost: generate vmlinux.symvers and reuse it for the second modpost"), modpost only parses relocatable files (ET_REL). Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 1fd49a0b5c4330ceefef4de498cec271e240aaf1 Author: Wadim Mueller Date: Wed Jul 13 21:41:10 2022 +0200 checkstack: add riscv support for scripts/checkstack.pl scripts/checkstack.pl lacks support for the riscv architecture. Add support to detect "addi sp,sp,-FRAME_SIZE" stack frame generation instruction Signed-off-by: Wadim Mueller Signed-off-by: Masahiro Yamada commit 10269fd37fc60bda700dd2554ff382446d45771d Author: Masahiro Yamada Date: Tue Jul 19 11:35:39 2022 +0900 kconfig: shorten the temporary directory name for cc-option The cc-option macro creates the temporary directory, .tmp_$$$$. Shell expands '$$' into its process ID. '$$$$' results in repeated PID. In Makefile, '$$$$' is correct (see TMPOUT in scripts/Malefile.compiler) because '$$' is an escape sequence of '$'. Make expands '$$$$' into '$$', then shell expands it into the process ID. This does not apply to Kconfig because Kconfig requires variable references to be enclosed by curly braces, like ${variable}. The '$' that is not followed by '{' loses its effect. Signed-off-by: Masahiro Yamada Tested-by: Nicolas Schier commit e3b746a384fc2f3b7b4a8c9aad5024130a975c43 Author: Nicolas Schier Date: Mon Jul 18 08:14:13 2022 +0200 scripts: headers_install.sh: Update config leak ignore entries Remove two dated config leak ignore entries from scripts/headers_install.sh: arch/alpha/include/uapi/asm/setup.h does no more leak any CONFIG_* symbol to user-space any more since commit 3cb8b1537f8a ("alpha: Move setup.h out of uapi"). Same holds for include/uapi/asm-generic/fcntl.h since commit 306f7cc1e906 ("uapi: always define F_GETLK64/F_SETLK64/F_SETLKW64 in fcntl.h"). Signed-off-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 84850dbbbe60a75b27eb0f272fdbc28cfaae689b Author: Masahiro Yamada Date: Thu Jul 14 14:02:43 2022 +0900 kbuild: error out if $(INSTALL_MOD_PATH) contains % or : If the directory path given to INSTALL_MOD_PATH contains % or :, the module_install fails. % is used in pattern rules, and : as the separator of dependencies. Bail out with a clearer error message. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 9a68fd7fd8b05050b27ae67a829a2035b2b7a993 Author: Masahiro Yamada Date: Thu Jul 14 14:02:42 2022 +0900 kbuild: error out if $(KBUILD_EXTMOD) contains % or : If the directory path given to KBUILD_EXTMOD (or M=) contains % or :, the module fails to build. % is used in pattern rules, and : as the separator of dependencies. Bail out with a clearer error message. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 6105e4f6511d6b383738be89efb99c607e158a29 Author: Masahiro Yamada Date: Thu Jul 14 14:02:41 2022 +0900 kbuild: rpm-pkg: pass 'linux' to --target option of rpmbuild Presumably, _target_os is defined even if the --target flag does not specify it, but it is better to make it explicit. Signed-off-by: Masahiro Yamada commit 3089b2be0cce14bd026a1018b8f6e5aed8244545 Author: Masahiro Yamada Date: Thu Jul 14 14:02:40 2022 +0900 kbuild: rpm-pkg: fix build error when _arch is undefined Cross-building (bin)rpm-pkg fails on several architectures. For example, 'make ARCH=arm binrpm-pkg' fails like follows: sh ./scripts/package/mkspec prebuilt > ./binkernel.spec rpmbuild --define "_builddir ." --target \ arm -bb ./binkernel.spec Building target platforms: arm Building for target arm warning: line 19: It's not recommended to have unversioned Obsoletes: Obsoletes: kernel-headers Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.0S8t2F + umask 022 + cd . + mkdir -p /home/masahiro/rpmbuild/BUILDROOT/kernel-5.19.0_rc6-19.%{_arch}/boot + make -f ./Makefile image_name + cp arch/arm/boot/zImage /home/masahiro/rpmbuild/BUILDROOT/kernel-5.19.0_rc6-19.%{_arch}/boot/vmlinuz-5.19.0-rc6 + make -f ./Makefile INSTALL_MOD_PATH=/home/masahiro/rpmbuild/BUILDROOT/kernel-5.19.0_rc6-19.%{_arch} modules_install make[3]: *** No rule to make target '/home/masahiro/rpmbuild/BUILDROOT/kernel-5.19.0_rc6-19.arch/arm/crypto/aes-arm-bs.ko{_arch}/lib/modules/5.19.0-rc6/kernel/%', needed by '__modinst'. Stop. make[2]: *** [Makefile:1768: modules_install] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.0S8t2F (%install) By default, 'buildroot' contains %{_arch} (see /usr/lib/rpm/macros). _arch is generally defined in /usr/lib/rpm/platforms/*/macros, where the platform sub-directory is specified by --target= option for cross builds. If the given arch does not exist, %{_arch} is not expanded. In the example above, --target=arm is passed to rpmbuild, but /usr/lib/rpm/platforms/arm-linux/ does not exist. The '%' character in the path confuses GNU make and rpmbuild. The same occurs for such architectures as csky, microblaze, nios2, etc. Define _arch if it has not been defined. Reported-by: Jason Self Signed-off-by: Masahiro Yamada commit 59316eac0e5ba5863594a793f6d8b5d8ccb8e880 Author: Baruch Siach Date: Thu Jul 14 07:25:46 2022 +0300 docs: kbuild: fix typo on -> one. Signed-off-by: Baruch Siach Signed-off-by: Masahiro Yamada commit aac289653fa5adf9e9985e4912c1d24a3e8cbab2 Author: Ondrej Mosnacek Date: Mon Jul 11 14:09:23 2022 +0200 kbuild: dummy-tools: avoid tmpdir leak in dummy gcc When passed -print-file-name=plugin, the dummy gcc script creates a temporary directory that is never cleaned up. To avoid cluttering $TMPDIR, instead use a static directory included in the source tree. Fixes: 76426e238834 ("kbuild: add dummy toolchains to enable all cc-option etc. in Kconfig") Signed-off-by: Ondrej Mosnacek Signed-off-by: Masahiro Yamada commit 028062ec222d6ed0235bbf9612ba8a05efc9e633 Author: Masahiro Yamada Date: Mon Jul 11 13:49:41 2022 +0900 Revert "scripts/mod/modpost.c: permit '.cranges' secton for sh64 architecture." This reverts commit 4d10c223baab8be8f717df3625cfece5be26dead. Commit 37744feebc08 ("sh: remove sh5 support") removed the sh64 support entirely. Note: .cranges was only used for sh64 ever. Commit 211dc24b8744 ("Remove sh5 and sh64 support") in binutils-gdb already removed the relevant code. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit bdf0fe33a4dc57e6397d90a4e024f7bbf89b1c08 Author: Baruch Siach Date: Thu Jul 7 07:43:29 2022 +0300 init/Kconfig: update KALLSYMS_ALL help text CONFIG_KALLSYMS_ALL is required for kernel live patching which is a common use case that is enabled in some major distros. Update the Kconfig help text to reflect that. While at it, s/e.g./i.e./ to match the text intention. Signed-off-by: Baruch Siach Signed-off-by: Masahiro Yamada commit a6036a41bffba3d5007e377483b425d470ad8042 Author: Nick Desaulniers Date: Tue Jun 28 14:04:07 2022 -0700 kbuild: drop support for CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3 The difference in most compilers between `-O3` and `-O2` is mostly down to whether loops with statically determinable trip counts are fully unrolled vs unrolled to a multiple of SIMD width. This patch is effectively a revert of commit 15f5db60a137 ("kbuild,arc: add CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3 for ARC") without re-adding ARCH_CFLAGS Ever since commit cfdbc2e16e65 ("ARC: Build system: Makefiles, Kconfig, Linker script") ARC has been built with -O3, though the reason for doing so was not specified in inline comments or the commit message. This commit does not re-add -O3 to arch/arc/Makefile. Folks looking to experiment with `-O3` (or any compiler flag for that matter) may pass them along to the command line invocation of make: $ make KCFLAGS=-O3 Code that looks to re-add an explicit Kconfig option for `-O3` should provide: 1. A rigorous and reproducible performance profile of a reasonable userspace workload that demonstrates a hot loop in the kernel that would benefit from `-O3` over `-O2`. 2. Disassembly of said loop body before and after. 3. Provides stats on terms of increase in file size. Link: https://lore.kernel.org/linux-kbuild/CA+55aFz2sNBbZyg-_i8_Ldr2e8o9dfvdSfHHuRzVtP2VMAUWPg@mail.gmail.com/ Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 5439d4d4dcee548b1ad984c293225c1668045ad2 Author: Masahiro Yamada Date: Tue Jun 14 14:51:49 2022 +0900 kbuild: remove sed command from cmd_ar_builtin Replace a pipeline of echo and sed with printf to decrease process forks. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 31f6d95c2cab1898c05a95f434f54a327431f158 Author: Masahiro Yamada Date: Sun Jun 12 02:22:33 2022 +0900 certs: unify blacklist_hashes.c and blacklist_nohashes.c These two files are very similar. Unify them. Signed-off-by: Masahiro Yamada Reviewed-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen commit 9008a676662a77ab98727d05bdffa0e3c38cba53 Author: Masahiro Yamada Date: Sun Jun 12 02:22:32 2022 +0900 certs: move scripts/check-blacklist-hashes.awk to certs/ This script is only used in certs/Makefile, so certs/ is a better home for it. Signed-off-by: Masahiro Yamada Reviewed-by: Mickaël Salaün Reviewed-by: Jarkko Sakkinen commit 9cc0590ae351a354c51375a1ee22edc2e4931fd0 Author: Jean Delvare Date: Wed Jul 27 13:26:37 2022 +0200 regulator: mt6380: Fix unused array warning With the following configuration options: CONFIG_OF is not set CONFIG_REGULATOR_MT6380=y we get the following build warning: CC drivers/regulator/mt6380-regulator.o drivers/regulator/mt6380-regulator.c:322:34: warning: ‘mt6380_of_match’ defined but not used [-Wunused-const-variable=] Fix this by annotating that array with __maybe_unused, as done in various regulator drivers. Signed-off-by: Jean Delvare Reported-by: kernel test robot Link: https://lore.kernel.org/all/202207240252.ZY5hSCNB-lkp@intel.com/ Cc: Liam Girdwood Cc: Mark Brown Cc: Matthias Brugger Cc: Chenglin Xu Link: https://lore.kernel.org/r/20220727132637.76d6073f@endymion.delvare Signed-off-by: Mark Brown commit d7bffbe9cbd3c96fe51a8482127cabf6fa1fd9b2 Author: Jiaxin Yu Date: Tue Jul 26 23:42:20 2022 +0800 ASoC: mediatek: mt8186: remove unnecessary judgments The afe_priv->dai_priv[] is allocated when platform driver probe(), if it failed, the ASoC platform driver probe() will return fail first. Therefore, this is excessive judgment, and the condition will never be established. Bug report: https://www.spinics.net/lists/alsa-devel/msg145609.html This is a semi-automatic email about new static checker warnings. The patch ae92dcbee8b6: "ASoC: mediatek: mt8186: support tdm in platform driver" from May 23, 2022, leads to the following Smatch complaint: sound/soc/mediatek/mt8186/mt8186-dai-tdm.c:424 mtk_dai_tdm_hw_params() warn: variable dereferenced before check 'tdm_priv' (see line 406) sound/soc/mediatek/mt8186/mt8186-dai-tdm.c 405 struct mtk_afe_tdm_priv *tdm_priv = afe_priv->dai_priv[tdm_id]; 406 unsigned int tdm_mode = tdm_priv->tdm_mode; ^^^^^^^^^^^^^^^^^^^ Lot's of dereferences 407 unsigned int data_mode = tdm_priv->data_mode; 408 unsigned int rate = params_rate(params); 409 unsigned int channels = params_channels(params); 410 snd_pcm_format_t format = params_format(params); 411 unsigned int bit_width = 412 snd_pcm_format_physical_width(format); 413 unsigned int tdm_channels = (data_mode == TDM_DATA_ONE_PIN) ? 414 get_tdm_ch_per_sdata(tdm_mode, channels) : 2; 415 unsigned int lrck_width = 416 get_tdm_lrck_width(format, tdm_mode); 417 unsigned int tdm_con = 0; 418 bool slave_mode = tdm_priv->slave_mode; 419 bool lrck_inv = tdm_priv->lck_invert; 420 bool bck_inv = tdm_priv->bck_invert; 421 unsigned int tran_rate; 422 unsigned int tran_relatch_rate; 423 424 if (!tdm_priv) { ^^^^^^^^^ Checked too late 425 dev_err(afe->dev, "%s(), tdm_priv == NULL", __func__); 426 return -EINVAL; Fixes: ae92dcbee8b6 ("ASoC: mediatek: mt8186: support tdm in platform driver") Signed-off-by: Jiaxin Yu Link: https://lore.kernel.org/r/20220726154220.28141-1-jiaxin.yu@mediatek.com Signed-off-by: Mark Brown commit 9f8267b9b29937d997c3b4cec426252aae6311b5 Author: Borislav Petkov Date: Wed Jul 27 13:49:48 2022 +0200 misc: Mark MICROCODE_MINOR unused This one is unused since 181b6f40e9ea ("x86/microcode: Rip out the OLD_INTERFACE") so comment it out. Link: https://lore.kernel.org/r/20220525161232.14924-1-bp@alien8.de Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220727114948.30123-1-bp@alien8.de Signed-off-by: Greg Kroah-Hartman commit 326ecc15c61c349cd49d1700ff9e3e31c6fd1cd5 Author: Ravi Bangoria Date: Sat Jun 4 10:15:17 2022 +0530 perf/x86/ibs: Add new IBS register bits into header IBS support has been enhanced with two new features in upcoming uarch: 1. DataSrc extension and 2. L3 miss filtering. Additional set of bits has been introduced in IBS registers to use these features. Define these new bits into arch/x86/ header. [ bp: Massage commit message. ] Signed-off-by: Ravi Bangoria Signed-off-by: Borislav Petkov Acked-by: Ian Rogers Link: https://lore.kernel.org/r/20220604044519.594-7-ravi.bangoria@amd.com commit d6b551b8f90cc92c7d3c09cf38c748efe305ecb4 Author: Christophe Leroy Date: Mon Jul 11 16:19:33 2022 +0200 powerpc/64e: Fix build failure with GCC 12 (unrecognized opcode: `wrteei') With GCC 12, corenet64_smp_defconfig leads to the following build errors: CC arch/powerpc/kernel/irq.o {standard input}: Assembler messages: {standard input}:3616: Error: unrecognized opcode: `wrteei' {standard input}:5689: Error: unrecognized opcode: `wrteei' CC arch/powerpc/kernel/pmc.o {standard input}: Assembler messages: {standard input}:42: Error: unrecognized opcode: `mfpmr' {standard input}:53: Error: unrecognized opcode: `mtpmr' CC arch/powerpc/kernel/io.o {standard input}: Assembler messages: {standard input}:376: Error: unrecognized opcode: `mbar' ... CC arch/powerpc/mm/nohash/book3e_hugetlbpage.o {standard input}: Assembler messages: {standard input}:291: Error: unrecognized opcode: `tlbsx' {standard input}:482: Error: unrecognized opcode: `tlbwe' {standard input}:608: Error: unrecognized opcode: `lbarx' {standard input}:608: Error: unrecognized opcode: `stbcx.' -mpcu=powerpc64 cannot be used anymore for book3e, it must be a booke CPU. But then we get: CC arch/powerpc/lib/xor_vmx.o cc1: error: AltiVec not supported in this target Altivec is not supported with -mcpu=e5500 so don't allow selection of altivec when e5500 is selected. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/77255a5a957967723b84d0356d9e5fb21569f4e8.1657549153.git.christophe.leroy@csgroup.eu commit 2255411d1d0f0661d1e5acd5f6edf4e6652a345a Author: Christophe Leroy Date: Mon Jul 11 16:19:32 2022 +0200 powerpc/44x: Fix build failure with GCC 12 (unrecognized opcode: `wrteei') Building ppc40x_defconfig leads to following error CC arch/powerpc/kernel/idle.o {standard input}: Assembler messages: {standard input}:67: Error: unrecognized opcode: `wrteei' {standard input}:78: Error: unrecognized opcode: `wrteei' Add -mcpu=440 by default and alternatively 464 and 476. Once that's done, -mcpu=powerpc is only for book3s/32 now. But then comes CC arch/powerpc/kernel/io.o {standard input}: Assembler messages: {standard input}:198: Error: unrecognized opcode: `eieio' {standard input}:230: Error: unrecognized opcode: `eieio' {standard input}:245: Error: unrecognized opcode: `eieio' {standard input}:254: Error: unrecognized opcode: `eieio' {standard input}:273: Error: unrecognized opcode: `eieio' {standard input}:396: Error: unrecognized opcode: `eieio' {standard input}:404: Error: unrecognized opcode: `eieio' {standard input}:423: Error: unrecognized opcode: `eieio' {standard input}:512: Error: unrecognized opcode: `eieio' {standard input}:520: Error: unrecognized opcode: `eieio' {standard input}:539: Error: unrecognized opcode: `eieio' {standard input}:628: Error: unrecognized opcode: `eieio' {standard input}:636: Error: unrecognized opcode: `eieio' {standard input}:655: Error: unrecognized opcode: `eieio' Fix it by replacing eieio by mbar on booke. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b0d982e223314ed82ab959f5d4ad2c4c00bedb99.1657549153.git.christophe.leroy@csgroup.eu commit ff27d9200a98757efc7c2cdf198904fd79cf4ffd Author: Christophe Leroy Date: Mon Jul 11 16:19:31 2022 +0200 powerpc/405: Fix build failure with GCC 12 (unrecognized opcode: `wrteei') Building ppc40x_defconfig leads to following error CC arch/powerpc/kernel/process.o {standard input}: Assembler messages: {standard input}:626: Error: unrecognized opcode: `wrteei' Add -mcpu=405 by default. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d344a42c99061cfe10a28e00de4e31a1363f4251.1657549153.git.christophe.leroy@csgroup.eu commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 Author: Christophe Leroy Date: Mon Jul 11 16:19:30 2022 +0200 powerpc/32: Don't always pass -mcpu=powerpc to the compiler Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic machine type for 32-bit compile"), when building a 32 bits kernel with a bi-arch version of GCC, or when building a book3s/32 kernel, the option -mcpu=powerpc is passed to GCC at all time, relying on it being eventually overriden by a subsequent -mcpu=xxxx. But when building the same kernel with a 32 bits only version of GCC, that is not done, relying on gcc being built with the expected default CPU. This logic has two problems. First, it is a bit fragile to rely on whether the GCC version is bi-arch or not, because today we can have bi-arch versions of GCC configured with a 32 bits default. Second, there are some versions of GCC which don't support -mcpu=powerpc, for instance for e500 SPE-only versions. So, stop relying on this approximative logic and allow the user to decide whether he/she wants to use the toolchain's default CPU or if he/she wants to set one, and allow only possible CPUs based on the selected target. Reported-by: Pali Rohár Signed-off-by: Christophe Leroy Tested-by: Pali Rohár Reviewed-by: Arnd Bergmann Reviewed-by: Segher Boessenkool Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu commit 9be013b2a9ecb29b5168e4b9db0e48ed53acf37c Author: Christophe Leroy Date: Mon Jul 11 16:19:29 2022 +0200 powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 Commit 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32") enlarged the CPU selection logic to PPC32 by removing depend to PPC64, and failed to restrict that depend to E5500_CPU and E6500_CPU. Fortunately that got unnoticed because -mcpu=8540 will override the -mcpu=e500mc64 or -mpcu=e6500 as they are ealier, but that's fragile and may no be right in the future. Add back the depend PPC64 on E5500_CPU and E6500_CPU. Fixes: 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/8abab4888da69ff78b73a56f64d9678a7bf684e9.1657549153.git.christophe.leroy@csgroup.eu commit de40303b54bc458d7df0d4b4ee1d296df7fe98c7 Author: Christophe Leroy Date: Thu Jul 7 16:55:16 2022 +0200 powerpc/ppc-opcode: Define and use PPC_RAW_SETB() We have PPC_INST_SETB then build the 'setb' instruction in the user. Instead, define PPC_RAW_SETB() and use it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b08a4f26919a8f8cdcf7544ab552d9c1c63418b5.1657205708.git.christophe.leroy@csgroup.eu commit d00d762daf1278641eec92d74011a7e625e84a68 Author: Christophe Leroy Date: Thu Jul 7 16:55:15 2022 +0200 powerpc/ppc-opcode: Define and use PPC_RAW_TRAP() and PPC_RAW_TW() Add and use PPC_RAW_TRAP() instead of opencoding. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/52c7e522e56a38e3ff0363906919445920005a8f.1657205708.git.christophe.leroy@csgroup.eu commit 7b48377e1d9f68a1b58dfd22d40b083f38ce76a0 Author: Christophe Leroy Date: Thu Jul 7 16:55:14 2022 +0200 powerpc/probes: Remove ppc_opcode_t ppc_opcode_t is just an u32. There is no point in hiding u32 behind such a typedef. Remove it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b2d762191b095530789ac8b71b167c6740bb6aed.1657205708.git.christophe.leroy@csgroup.eu commit 62ccae78820b25a0ac64bb0f648388ec834fcb3c Author: Christophe Leroy Date: Thu Jul 7 16:37:18 2022 +0200 powerpc: Remove remaining parts of oprofile Commit 9850b6c69356 ("arch: powerpc: Remove oprofile") removed oprofile. Remove all remaining parts of it. Signed-off-by: Christophe Leroy Acked-by: Viresh Kumar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/298432fe1a14c0a415760011d72c3f0999efd5e2.1657204631.git.christophe.leroy@csgroup.eu commit ec3eb9d941a98f4c0dac263110729680a734279b Author: Rashmica Gupta Date: Thu Jul 7 16:37:17 2022 +0200 powerpc/perf: Use PVR rather than oprofile field to determine CPU version Currently the perf CPU backend drivers detect what CPU they're on using cur_cpu_spec->oprofile_cpu_type. Although that works, it's a bit crufty to be using oprofile related fields, especially seeing as oprofile is more or less unused these days. It also means perf is reliant on the fragile logic in setup_cpu_spec() which detects when we're using a logical PVR and copies back the PMU related fields from the raw CPU entry. So lets check the PVR directly. Suggested-by: Michael Ellerman Signed-off-by: Rashmica Gupta Signed-off-by: Christophe Leroy Reviewed-by: Madhavan Srinivasan [chleroy: Added power10 and fixed checkpatch issues] Reviewed-and-tested-by: Athira Rajeev Reviewed-and-tested-By: Kajol Jain [For 24x7 side changes] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20c0ee7f99dbf0dbf8658df6b39f84753e6db1ef.1657204631.git.christophe.leroy@csgroup.eu commit 6042a1652d643d1d34fa89bb314cb102960c0800 Author: Christophe Leroy Date: Fri Jul 1 08:06:15 2022 +0200 powerpc/32s: Fix boot failure with KASAN + SMP + JUMP_LABEL_FEATURE_CHECK_DEBUG Since commit 4291d085b0b0 ("powerpc/32s: Make pte_update() non atomic on 603 core"), pte_update() has been using mmu_has_feature(MMU_FTR_HPTE_TABLE) to avoid a useless atomic operation on 603 cores. When kasan_early_init() sets up the early zero shadow, it uses __set_pte_at(). On book3s/32, __set_pte_at() calls pte_update() when CONFIG_SMP is selected in order to ensure the preservation of _PAGE_HASHPTE in case of concurrent update of the PTE. But that's too early for mmu_has_feature(), so when CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG is selected, mmu_has_feature() calls printk(). That's too early to call printk() because KASAN early zero shadow page is not set up yet. It leads to a deadlock. However, when kasan_early_init() is called, there is only one CPU running and no risk of concurrent PTE update. So __set_pte_at() can be called with the 'percpu' flag. With that flag set, the PTE is written directly instead of being written via pte_update(). Fixes: 4291d085b0b0 ("powerpc/32s: Make pte_update() non atomic on 603 core") Reported-by: Erhard Furtner Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/2ee707512b8b212b079b877f4ceb525a1606a3fb.1656655567.git.christophe.leroy@csgroup.eu commit 2a0fb3c155c97c75176e557d61f8e66c1bd9b735 Author: Christophe Leroy Date: Tue Jun 14 12:34:09 2022 +0200 powerpc/32: Set an IBAT covering up to _einittext during init Always set an IBAT covering up to _einittext during init because when CONFIG_MODULES is not selected there is no reason to have an exception handler for kernel instruction TLB misses. It implies DBAT and IBAT are now totaly independent, IBATs are set by setibat() and DBAT by setbat(). This allows to revert commit 9bb162fa26ed ("powerpc/603: Fix boot failure with DEBUG_PAGEALLOC and KFENCE") Reported-by: Maxime Bizon Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/ce7f04a39593934d9b1ee68c69144ccd3d4da4a1.1655202804.git.christophe.leroy@csgroup.eu commit 980bbf7ca72012d317617fcdbfabe8708e4cef29 Author: Christophe Leroy Date: Tue Jun 14 12:34:08 2022 +0200 powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping. mark_initmem_nx() calls either mmu_mark_initmem_nx() or set_memory_attr() based on return from v_block_mapped() of _sinittext. But we can now handle text and data independently, so that text may be mapped by block even when data is mapped by pages. On the 8xx for instance, at startup 32Mbytes of memory are pinned in TLB. So the pinned entries need to go away for sinittext. In next patch a BAT will be set to also covers sinittext on book3s/32. So it will also be needed to call mmu_mark_initmem_nx() even when data above sinittext is not mapped with BATs. As this is highly dependent on the platform, call mmu_mark_initmem_nx() regardless of data block mapping. Then the platform will know what to do. Modify 8xx mmu_mark_initmem_nx() so that inittext mapping is modified only when pagealloc debug and kfence are not active, otherwise inittext is mapped with standard pages. And don't do anything on kernel text which is already mapped with PAGE_KERNEL_TEXT. Fixes: da1adea07576 ("powerpc/8xx: Allow STRICT_KERNEL_RwX with pinned TLB") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/db3fc14f3bfa6215b0786ef58a6e2bc1e1f964d7.1655202804.git.christophe.leroy@csgroup.eu commit f57261e69825b332f22480b37a33e03d066c0da2 Author: Nicholas Piggin Date: Mon Jul 11 13:06:52 2022 +1000 powerpc/mce: use early_cpu_to_node() in mce_init() cpu_to_node() is not yet available (setup_arch() is called before setup_per_cpu_areas() by start_kernel()). Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220711030653.150950-1-npiggin@gmail.com commit fd193f85d3206cc7e7aeea2b6033d105cca38d01 Author: Nicholas Piggin Date: Wed May 25 12:23:58 2022 +1000 powerpc/64s: Remove spurious fault flushing for NMMU Commit 6d8278c414cb2 ("powerpc/64s/radix: do not flush TLB on spurious fault") removed the TLB flush for spurious faults, except when a coprocessor (nest MMU) maps the address space. This is not needed because the NMMU workaround in the PTE permission upgrade paths prevents PTEs existing with less restrictive access permissions than their corresponding TLB entries have. Remove it and replace with a comment. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220525022358.780745-4-npiggin@gmail.com commit 2a8a0f420f74425bf5f80760fd14d7a2c3abb87d Author: Nicholas Piggin Date: Wed May 25 12:23:57 2022 +1000 powerpc/64s: POWER10 nest MMU can upgrade PTE access authority without TLB flush The nest MMU in POWER9 does not re-fetch the PTE in response to permission mismatch, contrary to the architecture[*] and unlike the core MMU. This requires a TLB flush before upgrading permissions of valid PTEs, for any address space with a coprocessor attached. Per (non-public) Nest MMU Workbook, POWER10 nest MMU conforms to the architecture in this regard, so skip the workaround. [*] See: Power ISA Version 3.1B, 6.10.1.2 Modifying a Translation Table Entry, Setting a Reference or Change Bit or Upgrading Access Authority (PTE Subject to Atomic Hardware Updates): "If the only change being made to a valid PTE that is subject to atomic hardware updates is to set the Reference or Change bit to 1 or to upgrade access authority, a simpler sequence suffices because the translation hardware will refetch the PTE if an access is attempted for which the only problems were reference and/or change bits needing to be set or insufficient access authority." Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220525022358.780745-3-npiggin@gmail.com commit abf0878ce95f8a9b47d8ecf2de1d4617bec21711 Author: Nicholas Piggin Date: Wed May 25 12:23:56 2022 +1000 powerpc/64s: POWER10 nest MMU does not require flush escalation workaround Per (non-public) Nest MMU Workbook, POWER10 and POWER9P NMMU does not cache PTEs in PWC, so does not require PWC flush to invalidate these translations. Skip the workaround on POWER10 and later. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220525022358.780745-2-npiggin@gmail.com commit ef1911c6d26678b0e91fea33f076e98925997f0c Author: Nicholas Piggin Date: Fri Jul 15 11:26:36 2022 +1000 powerpc: add documentation for HWCAPs Take the arm64 HWCAP documentation file and adjust it for powerpc. Signed-off-by: Nicholas Piggin Reviewed-by: Segher Boessenkool [mpe: Fix ARCH_2_05 comment, as noticed by Tulio.] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220715012636.165948-1-npiggin@gmail.com commit 28f07fab26319dacc5675ae01dfc84d82122c59b Author: Nicholas Piggin Date: Fri May 20 22:36:49 2022 +1000 powerpc/vdso: Fix __kernel_sync_dicache sequence with coherent icache Processors with coherent icache require the sequence sync ; icbi ; isync to entire store->execute coherency. icbi (to any address) must be executed to ensure isync flushes the pipeline. See "POWER9 Processor User's Manual, 4.6.2.2 Instruction Cache Block Invalidate (icbi)" for details. __kernel_sync_dicache is missing icbi for the coherent icache path. Add it. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220520123649.258440-1-npiggin@gmail.com commit 5663568130825458a2a8535ccef0db9a1bf7be82 Author: Pali Rohár Date: Wed Jul 6 12:43:08 2022 +0200 powerpc/pci: Add config option for using all 256 PCI buses By default on PPC32 PCI bus numbers are unique across all PCI domains. So a system could have only 256 PCI buses independently of available PCI domains. This is due to filling DT property pci-OF-bus-map which does not support a multi-domain setup. On all powerpc platforms except chrp and powermac there is no DT property pci-OF-bus-map anymore and therefore it is possible on non-chrp/powermac platforms to avoid this limitation of maximum number of 256 PCI buses in a system even on multi-domain setup. But avoiding this limitation would mean that all PCI and PCIe devices would be present on completely different BDF addresses as every PCI domain starts numbering PCI bueses from zero (instead of the last bus number of previous enumerated PCI domain). Such change could break existing software which expects fixed PCI bus numbers. So add a new config option CONFIG_PPC_PCI_BUS_NUM_DOMAIN_DEPENDENT which enables this change. By default it is disabled. It causes the initial value of hose->first_busno to be zero. Signed-off-by: Pali Rohár [mpe: Minor change log wording] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706104308.5390-6-pali@kernel.org commit 7f102d61983275ab68b5ac2715afa35c5f4ffd86 Author: Pali Rohár Date: Wed Jul 6 12:43:07 2022 +0200 powerpc/pci: Disable filling pci-OF-bus-map for non-chrp/powermac Creating or filling pci-OF-bus-map property in the device-tree is deprecated since May 2006 [1] and was used only in old platforms like PowerMac. Currently kernel code handles it only for chrp and powermac code. So completely disable filling pci-OF-bus-map property for non-chrp and non-powermac platforms. [1] - https://lore.kernel.org/linuxppc-dev/1148016268.13249.14.camel@localhost.localdomain/ Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706104308.5390-5-pali@kernel.org commit 704544588735b2e1115212dbba1c210b3687ff7a Author: Pali Rohár Date: Wed Jul 6 12:43:06 2022 +0200 powerpc/pci: Hide pci_create_OF_bus_map() for non-chrp code Function pci_create_OF_bus_map() is used only in chrp code. So hide it from all other platforms. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706104308.5390-4-pali@kernel.org commit 407a767182d3dc87176aabddd7c109b36a5727e9 Author: Pali Rohár Date: Wed Jul 6 12:43:05 2022 +0200 powerpc/pci: Make pcibios_make_OF_bus_map() static Function pcibios_make_OF_bus_map() is used only in pci_32.c. So make it static. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706104308.5390-3-pali@kernel.org commit a2954a7e47b60bb8d8c51f1b4d55af7585a4108a Author: Pali Rohár Date: Wed Jul 6 12:43:04 2022 +0200 powerpc/pci: Hide pci_device_from_OF_node() for non-powermac code Function pci_device_from_OF_node() is used only in powermac code. So hide it from all other platforms. Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706104308.5390-2-pali@kernel.org commit 0531a4abd1c6c2e270f5ac6fc725ff550fcd14ab Author: Pali Rohár Date: Wed Jul 13 15:44:29 2022 +0200 powerpc: dts: turris1x.dts: Add CPLD reboot node CPLD firmware can reset board by writing value 0x01 at CPLD memory offset 0x0d. Define syscon-reboot node for this reset support. Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers") Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220713134429.18748-1-pali@kernel.org commit 0c551abfa004ce154d487d91777bf221c808a64f Author: Pali Rohár Date: Wed Jul 6 12:10:43 2022 +0200 powerpc/fsl-pci: Fix Class Code of PCIe Root Port By default old pre-3.0 Freescale PCIe controllers reports invalid PCI Class Code 0x0b20 for PCIe Root Port. It can be seen by lspci -b output on P2020 board which has this pre-3.0 controller: $ lspci -bvnn 00:00.0 Power PC [0b20]: Freescale Semiconductor Inc P2020E [1957:0070] (rev 21) !!! Invalid class 0b20 for header type 01 Capabilities: [4c] Express Root Port (Slot-), MSI 00 Fix this issue by programming correct PCI Class Code 0x0604 for PCIe Root Port to the Freescale specific PCIe register 0x474. With this change lspci -b output is: $ lspci -bvnn 00:00.0 PCI bridge [0604]: Freescale Semiconductor Inc P2020E [1957:0070] (rev 21) (prog-if 00 [Normal decode]) Capabilities: [4c] Express Root Port (Slot-), MSI 00 Without any "Invalid class" error. So class code was properly reflected into standard (read-only) PCI register 0x08. Same fix is already implemented in U-Boot pcie_fsl.c driver in commit: http://source.denx.de/u-boot/u-boot/-/commit/d18d06ac35229345a0af80977a408cfbe1d1015b Fix activated by U-Boot stay active also after booting Linux kernel. But boards which use older U-Boot version without that fix are affected and still require this fix. So implement this class code fix also in kernel fsl_pci.c driver. Cc: stable@vger.kernel.org Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706101043.4867-1-pali@kernel.org commit 9257971377e2fe6e82f41f688651a82a2f160a88 Author: Masahiro Yamada Date: Mon Jul 25 10:56:19 2022 +0900 powerpc/purgatory: Omit use of bin2c The .incbin assembler directive is much faster than bin2c + $(CC). Do similar refactoring as in commit 4c0f032d4963 ("s390/purgatory: Omit use of bin2c"). Please note the .quad directive matches to size_t in C (both 8 byte) because the purgatory is compiled only for the 64-bit kernel. (KEXEC_FILE depends on PPC64). Signed-off-by: Masahiro Yamada Reviewed-by: Segher Boessenkool Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220725015619.618070-1-masahiroy@kernel.org commit 118b1366930c8c833b8b36abef657f40d4e26610 Author: Laurent Dufour Date: Wed Jul 13 17:47:29 2022 +0200 powerpc/pseries/mobility: set NMI watchdog factor during an LPM During an LPM, while the memory transfer is in progress on the arrival side, some latencies are generated when accessing not yet transferred pages on the arrival side. Thus, the NMI watchdog may be triggered too frequently, which increases the risk to hit an NMI interrupt in a bad place in the kernel, leading to a kernel panic. Disabling the Hard Lockup Watchdog until the memory transfer could be a too strong work around, some users would want this timeout to be eventually triggered if the system is hanging even during an LPM. Introduce a new sysctl variable nmi_watchdog_factor. It allows to apply a factor to the NMI watchdog timeout during an LPM. Just before the CPUs are stopped for the switchover sequence, the NMI watchdog timer is set to watchdog_thresh + factor% A value of 0 has no effect. The default value is 200, meaning that the NMI watchdog is set to 30s during LPM (based on a 10s watchdog_thresh value). Once the memory transfer is achieved, the factor is reset to 0. Setting this value to a high number is like disabling the NMI watchdog during an LPM. Signed-off-by: Laurent Dufour Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220713154729.80789-5-ldufour@linux.ibm.com commit f5e74e836097d1004077390717d4bd95d4a2c27a Author: Laurent Dufour Date: Wed Jul 13 17:47:28 2022 +0200 powerpc/watchdog: introduce a NMI watchdog's factor Introduce a factor which would apply to the NMI watchdog timeout. This factor is a percentage added to the watchdog_tresh value. The value is set under the watchdog_mutex protection and lockup_detector_reconfigure() is called to recompute wd_panic_timeout_tb. Once the factor is set, it remains until it is set back to 0, which means no impact. Signed-off-by: Laurent Dufour Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220713154729.80789-4-ldufour@linux.ibm.com commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf Author: Laurent Dufour Date: Wed Jul 13 17:47:27 2022 +0200 watchdog: export lockup_detector_reconfigure In some circumstances it may be interesting to reconfigure the watchdog from inside the kernel. On PowerPC, this may helpful before and after a LPAR migration (LPM) is initiated, because it implies some latencies, watchdog, and especially NMI watchdog is expected to be triggered during this operation. Reconfiguring the watchdog with a factor, would prevent it to happen too frequently during LPM. Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and create a new function lockup_detector_reconfigure() calling __lockup_detector_reconfigure() under the protection of watchdog_mutex. Signed-off-by: Laurent Dufour [mpe: Squash in build fix from Laurent, reported by Sachin] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com commit 9d8dd3725f4032f94d9cf65304559e0780e04ad7 Merge: a6e6231ac10a0 b4b97079a49ec Author: Marc Kleine-Budde Date: Wed Jul 27 13:09:39 2022 +0200 Merge patch series "can: export export slcan_ethtool_ops and remove setter functions" Vincent Mailhol says: ==================== The c_can, flexcan and slcan use a setter function to populate net_device::ethtool_ops. Using a setter here add one additional function call and add some small bloat in the object file. Exporting the structure allow to remove this setter. The mcp251xfd uses a similar pattern except that it does some additional initialization. As such, this driver is left untouched. * Statistics * For the slcan driver, this patch reduces the object file by 14 bytes (details in the first patch). Although we did not conduct a benchmark for the other drivers but we expect the exact same figures. ==================== Link: https://lore.kernel.org/all/20220727104939.279022-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit b4b97079a49ec81fa2236fb2ebbba867fff5d4ba Author: Vincent Mailhol Date: Wed Jul 27 19:49:39 2022 +0900 can: flexcan: export flexcan_ethtool_ops and remove flexcan_set_ethtool_ops() The function flexcan_set_ethtool_ops() does one thing: populate net_device::ethtool_ops. Instead, it is possible to directly assign this field and remove one function call and slightly reduce the object size. To do so, export flexcan_ethtool_ops so it becomes visible to flexcan-core.c. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727104939.279022-4-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 0ccb3e0b0a001c9de1e039bef43040351df9b8aa Author: Vincent Mailhol Date: Wed Jul 27 19:49:38 2022 +0900 can: c_can: export c_can_ethtool_ops and remove c_can_set_ethtool_ops() The function c_can_set_ethtool_ops() does one thing: populate net_device::ethtool_ops. Instead, it is possible to directly assign this field and remove one function call and slightly reduce the object size. To do so, export c_can_ethtool_ops so it becomes visible to c_can_main.c. Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727104939.279022-3-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 1851532fd39c674906f83b431650c73e065c4a77 Author: Vincent Mailhol Date: Wed Jul 27 19:49:37 2022 +0900 can: slcan: export slcan_ethtool_ops and remove slcan_set_ethtool_ops() The function slcan_set_ethtool_ops() does one thing: populate net_device::ethtool_ops. Instead, it is possible to directly assign this field and remove one function call and slightly reduce the object size. To do so, export slcan_ethtool_ops so it becomes visible to sclan-core.c. This patch reduces the footprint by 14 bytes: | $ ./scripts/bloat-o-meter drivers/net/can/slcan/slcan.{old,new}.o | drivers/net/can/slcan/slcan.o | add/remove: 0/1 grow/shrink: 1/0 up/down: 15/-29 (-14) | Function old new delta | slcan_open 1010 1025 +15 | slcan_set_ethtool_ops 29 - -29 | Total: Before=11115, After=11101, chg -0.13% Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/all/20220727104939.279022-2-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 8a7a5c0251e19ae7a288c94ab8de8d6302b98927 Author: Zhang Jiaming Date: Wed Jun 22 16:25:24 2022 +0800 wifi: rtlwifi: Remove duplicate word and Fix typo Remove duplicate 'in'. Change 'entrys' to 'entries'. Signed-off-by: Zhang Jiaming Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220622082524.21304-1-jiaming@nfschina.com commit 403fcb5118a0f4091001a537e76923031fb45eaf Author: Claudiu Beznea Date: Wed Jul 27 12:08:14 2022 +0300 ASoC: mchp-spdiftx: remove references to mchp_i2s_caps Remove references to struct mchp_i2s_caps as they are not used. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220727090814.2446111-3-claudiu.beznea@microchip.com Signed-off-by: Mark Brown commit 768ac4f12ca0fda935f58eb8c5120e9d795bc6e3 Author: Claudiu Beznea Date: Wed Jul 27 12:08:13 2022 +0300 ASoC: mchp-spdifrx: disable end of block interrupt on failures Disable end of block interrupt in case of wait for completion timeout or errors to undo previously enable operation (done in mchp_spdifrx_isr_blockend_en()). Otherwise we can end up with an unbalanced reference counter for this interrupt. Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220727090814.2446111-2-claudiu.beznea@microchip.com Signed-off-by: Mark Brown commit 08df8fbeb24114eaa9aa0f55b3555f7b2b9cefff Author: Jason Wang Date: Fri Jul 15 13:00:53 2022 +0800 wifi: mwifiex: Fix comment typo The double `the' is duplicated in line 1540, remove one. Signed-off-by: Jason Wang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220715050053.24382-1-wangborong@cdjrlc.com Link: https://lore.kernel.org/r/20220722083031.74847-1-slark_xiao@163.com Link: https://lore.kernel.org/r/20220722084158.75647-1-slark_xiao@163.com Link: https://lore.kernel.org/r/20220722084833.76159-1-slark_xiao@163.com commit c2ce2145f7f3c1e92b9adceb729756a8be7ca145 Author: Li Qiong Date: Mon Jun 6 21:54:49 2022 +0800 wifi: mwl8k: use time_after to replace "jiffies > a" time_after deals with timer wrapping correctly. Signed-off-by: Li Qiong Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220606135449.23256-1-liqiong@nfschina.com Link: https://lore.kernel.org/r/20220618131305.13101-1-wangxiang@cdjrlc.com Link: https://lore.kernel.org/r/20220715050016.24164-1-wangborong@cdjrlc.com commit 14a3aacf517a9de725dd3219dbbcf741e31763c4 Author: Jose Ignacio Tornos Martinez Date: Tue Jul 19 17:35:42 2022 +0200 wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old one and produce a BUG like this: [ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388). [ 46.535283] ------------[ cut here ]------------ [ 46.535284] kernel BUG at lib/list_debug.c:26! [ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1 [ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012 [ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f [ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1 [ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286 [ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000 [ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff [ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666 [ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388 [ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0 [ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000 [ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0 [ 46.687422] Call Trace: [ 46.689906] [ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm] [ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211] [ 46.702973] ? sta_info_get+0x46/0x60 [mac80211] [ 46.707703] ieee80211_tx+0xad/0x110 [mac80211] [ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211] ... In order to avoid this problem, we must also remove the related lists when station queues are disabled. Fixes: cfbc6c4c5b91c ("iwlwifi: mvm: support mac80211 TXQs model") Reported-by: Takayuki Nagata Reported-by: Petr Stourac Tested-by: Petr Stourac Signed-off-by: Jose Ignacio Tornos Martinez Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220719153542.81466-1-jtornosm@redhat.com commit 7819b3d1dab585602905b7a213ad17ec6de6b005 Author: Justin Stitt Date: Mon Jul 11 15:29:19 2022 -0700 wifi: iwlwifi: mvm: fix clang -Wformat warnings When building with Clang we encounter these warnings: | drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c:1108:47: error: | format specifies type 'unsigned char' but the argument has type 's16' | (aka 'short') [-Werror,-Wformat] IWL_DEBUG_INFO(mvm, "\tburst index: | %hhu\n", res->ftm.burst_index); - | drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c:1111:47: error: | format specifies type 'unsigned char' but the argument has type 's32' | (aka 'int') [-Werror,-Wformat] IWL_DEBUG_INFO(mvm, "\trssi spread: | %hhu\n", res->ftm.rssi_spread); The previous format specifier `%hhu` describes a u8 but our arguments are wider than this which means bits are potentially being lost. Variadic functions (printf-like) undergo default argument promotion. Documentation/core-api/printk-formats.rst specifically recommends using the promoted-to-type's format flag. As per C11 6.3.1.1: (https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf) `If an int can represent all values of the original type ..., the value is converted to an int; otherwise, it is converted to an unsigned int. These are called the integer promotions.` Thus it makes sense to change `%hhu` to `%d` for both instances of the warning. Link: https://github.com/ClangBuiltLinux/linux/issues/378 Signed-off-by: Justin Stitt Reviewed-by: Nick Desaulniers Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220711222919.2043613-1-justinstitt@google.com commit d578e0af3a003736f6c440188b156483d451b329 Author: Ammar Faizi Date: Mon Jul 25 20:49:11 2022 +0300 wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` Commit 7a4836560a61 changes simple_write_to_buffer() with memdup_user() but it forgets to change the value to be returned that came from simple_write_to_buffer() call. It results in the following warning: warning: variable 'rc' is uninitialized when used here [-Wuninitialized] return rc; ^~ Remove rc variable and just return the passed in length if the memdup_user() succeeds. Cc: Dan Carpenter Reported-by: kernel test robot Fixes: 7a4836560a6198d245d5732e26f94898b12eb760 ("wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()") Fixes: ff974e4083341383d3dd4079e52ed30f57f376f0 ("wil6210: debugfs interface to send raw WMI command") Signed-off-by: Ammar Faizi Reviewed-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220724202452.61846-1-ammar.faizi@intel.com commit 169ede1f594809d1f0f46d95c071d672dbfc0eb1 Author: Kalle Valo Date: Mon Jul 25 20:49:10 2022 +0300 Revert "ath11k: add support for hardware rfkill for QCA6390" This reverts commit ec038c6127fa772d2c5604e329f22371830d5fa6. Tyler reported that on L390 Yoga Thinkpad with QCA6390 the suspend was failing because of this commit. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Link: https://bugzilla.kernel.org/show_bug.cgi?id=215881 Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220708164656.29549-1-kvalo@kernel.org commit 867f4eeee862d6568a0f142d6a38f8bb724ff80e Author: Manikanta Pubbisetty Date: Mon Jul 25 20:49:10 2022 +0300 wifi: ath11k: Fix register write failure on QCN9074 Commit 56c8ccf331bd ("ath11k: Add register access logic for WCN6750") regressed QCN9074. With the above mentioned commit, writes are failing for some registers on QCN9074 although the device seems to work normally. ath11k_pci 0000:03:00.0: failed to set pcie link register0x01e0e0a8: 0xffffffff != 0x00000010 ath11k_pci 0000:03:00.0: failed to set sysclk: -110 PCIe devices in ath11k (QCA6390, WCN6855, QCN9074, WCN6750) use window concept for register accesses. There are two schemes, dynamic & static window. In dynamic window scheme, a single window(region in the BAR) is mapped either to CE or DP register windows at any give time. QCA6390 & WCN6855 follow this scheme for register accesses. In static window scheme, CE & DP register windows are statically mapped to separate regions with in the BAR so that there is no switching of register windows between CE & DP register accesses. QCN9074 & WCN6750 follow this scheme although the window start offsets are different for QCN9074 & WCN6750. QCN9074 uses 3rd & 2nd window for DP & CE register accesses respectively whereas WCN6750 uses 1st & 2nd window for DP & CE. In QCN9074, along with 2nd & 3rd windows, 1st window is also used for certain configurations which commit 56c8ccf331bd ("ath11k: Add register access logic for WCN6750") did not account for and hence the regression. Fix this by going back to the original way of accessing the registers on QCN9074. Since this diverges from WCN6750 way of accessing registers, it is required to register window_read32/window_write32() pci_ops for WCN6750. We can also get rid of dp_window_idx & ce_window_idx members in hw_params, so remove them. Also add a new API ath11k_pcic_register_pci_ops() for registering pci_ops to the ath11k core. This API checks for mandatory pci_ops() and reports error if those are missing. Also initialize unused pci_ops to NULL. Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-00887-QCAMSLSWPLZ-1 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 Fixes: 56c8ccf331bd ("ath11k: Add register access logic for WCN6750") Reported-by: Maxime Bizon Tested-by: Maxime Bizon Signed-off-by: Manikanta Pubbisetty Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220608062954.27792-1-quic_mpubbise@quicinc.com commit 247861c325c2e4f5ad3c2f9a77ab9d85d15cbcfc Author: Daniil Lunev Date: Wed Jul 27 16:44:25 2022 +1000 fuse: retire block-device-based superblock on force unmount Force unmount of FUSE severes the connection with the user space, even if there are still open files. Subsequent remount tries to re-use the superblock held by the open files, which is meaningless in the FUSE case after disconnect - reused super block doesn't have userspace counterpart attached to it and is incapable of doing any IO. This patch adds the functionality only for the block-device-based supers, since the primary use case of the feature is to gracefully handle force unmount of external devices, mounted with FUSE. This can be further extended to cover all superblocks, if the need arises. Signed-off-by: Daniil Lunev Signed-off-by: Miklos Szeredi commit 04b9407197789c81fffac52921e703cb47967d6a Author: Daniil Lunev Date: Wed Jul 27 16:44:24 2022 +1000 vfs: function to prevent re-use of block-device-based superblocks The function is to be called from filesystem-specific code to mark a superblock to be ignored by superblock test and thus never re-used. The function also unregisters bdi if the bdi is per-superblock to avoid collision if a new superblock is created to represent the filesystem. generic_shutdown_super() skips unregistering bdi for a retired superlock as it assumes retire function has already done it. This patch adds the functionality only for the block-device-based supers, since the primary use case of the feature is to gracefully handle force unmount of external devices, mounted with FUSE. This can be further extended to cover all superblocks, if the need arises. Signed-off-by: Daniil Lunev Reviewed-by: Christoph Hellwig Signed-off-by: Miklos Szeredi commit 1e75550648da1fa1cd1969e7597355de8fe8caf6 Author: Li Zhijian Date: Tue Jul 26 03:16:26 2022 +0000 Revert "RDMA/rxe: Create duplicate mapping tables for FMRs" Below 2 commits will be reverted: commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()") commit 647bf13ce944 ("RDMA/rxe: Create duplicate mapping tables for FMRs") The community has a few bug reports which pointed this commit at last. Some proposals are raised up in the meantime but all of them have no follow-up operation. The previous commit led the map_set of FMR to be not available any more if the MR is registered again after invalidating. Although the mentioned patch try to fix a potential race in building/accessing the same table for fast memory regions, it broke rtrs etc ULPs. Since the latter could be worse, revert this patch. With previous commit, it's observed that a same MR in rnbd server will trigger below code path: -> rxe_mr_init_fast() |-> alloc map_set() # map_set is uninitialized |...-> rxe_map_mr_sg() # build the map_set |-> rxe_mr_set_page() |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means # we can access host memory(such rxe_mr_copy) |...-> rxe_invalidate_mr() # mr->state change to FREE from VALID |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE, # but map_set was not built again |...-> rxe_mr_copy() # kernel crash due to access wild addresses # that lookup from the map_set The backtraces are not always identical. [1st]---------- RIP: 0010:lookup_iova+0x66/0xa0 [rdma_rxe] Code: 00 00 00 48 d3 ee 89 32 c3 4c 8b 18 49 8b 3b 48 8b 47 08 48 39 c6 72 38 48 29 c6 45 31 d2 b8 01 00 00 00 48 63 c8 48 c1 e1 04 <48> 8b 4c 0f 08 48 39 f1 77 21 83 c0 01 48 29 ce 3d 00 01 00 00 75 RSP: 0018:ffffb7ff80063bf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9b9949d86800 RCX: 0000000000000000 RDX: ffffb7ff80063c00 RSI: 0000000049f6b378 RDI: 002818da00000004 RBP: 0000000000000120 R08: ffffb7ff80063c08 R09: ffffb7ff80063c04 R10: 0000000000000002 R11: ffff9b9916f7eef8 R12: ffff9b99488a0038 R13: ffff9b99488a0038 R14: ffff9b9914fb346a R15: ffff9b990ab27000 FS: 0000000000000000(0000) GS:ffff9b997dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efc33a98ed0 CR3: 0000000014f32004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_mr_copy.part.0+0x6f/0x140 [rdma_rxe] rxe_responder+0x12ee/0x1b60 [rdma_rxe] ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] ? rxe_rcv+0x1d0/0x780 [rdma_rxe] ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] rxe_do_task+0x67/0xb0 [rdma_rxe] rxe_xmit_packet+0xc7/0x210 [rdma_rxe] rxe_requester+0x680/0xee0 [rdma_rxe] ? update_load_avg+0x5f/0x690 ? update_load_avg+0x5f/0x690 ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] [2nd]---------- RIP: 0010:rxe_mr_copy.part.0+0xa8/0x140 [rdma_rxe] Code: 00 00 49 c1 e7 04 48 8b 00 4c 8d 2c d0 48 8b 44 24 10 4d 03 7d 00 85 ed 7f 10 eb 6c 89 54 24 0c 49 83 c7 10 31 c0 85 ed 7e 5e <49> 8b 3f 8b 14 24 4c 89 f6 48 01 c7 85 d2 74 06 48 89 fe 4c 89 f7 RSP: 0018:ffffae3580063bf8 EFLAGS: 00010202 RAX: 0000000000018978 RBX: ffff9d7ef7a03600 RCX: 0000000000000008 RDX: 000000000000007c RSI: 000000000000007c RDI: ffff9d7ef7a03600 RBP: 0000000000000120 R08: ffffae3580063c08 R09: ffffae3580063c04 R10: ffff9d7efece0038 R11: ffff9d7ec4b1db00 R12: ffff9d7efece0038 R13: ffff9d7ef4098260 R14: ffff9d7f11e23c6a R15: 4c79500065708144 FS: 0000000000000000(0000) GS:ffff9d7f3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fce47276c60 CR3: 0000000003f66004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_responder+0x12ee/0x1b60 [rdma_rxe] ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] ? rxe_rcv+0x1d0/0x780 [rdma_rxe] ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] rxe_do_task+0x67/0xb0 [rdma_rxe] rxe_xmit_packet+0xc7/0x210 [rdma_rxe] rxe_requester+0x680/0xee0 [rdma_rxe] ? update_load_avg+0x5f/0x690 ? update_load_avg+0x5f/0x690 ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] rxe_do_task+0x67/0xb0 [rdma_rxe] tasklet_action_common.constprop.0+0x92/0xc0 __do_softirq+0xe1/0x2d8 run_ksoftirqd+0x21/0x30 smpboot_thread_fn+0x183/0x220 ? sort_range+0x20/0x20 kthread+0xe2/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Link: https://lore.kernel.org/r/1658805386-2-1-git-send-email-lizhijian@fujitsu.com Link: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/ Link: https://www.spinics.net/lists/linux-rdma/msg110836.html Link: https://lore.kernel.org/lkml/94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev/t/ Tested-by: Md Haris Iqbal Reviewed-by: Bob Pearson Signed-off-by: Li Zhijian Signed-off-by: Leon Romanovsky commit 8a4e6154fb17b691917dcf7f4b0cc1d2fb8d46c6 Author: Marco Felsch Date: Mon May 30 11:22:26 2022 +0200 reset: tps380x: Add TPS380x device driver supprt The TI TPS380x family [1] is a voltage supervisor with a dedicated manual reset (mr) line input and a reset output. The chip(s) have a build in reset delay, depending on the chip partnumber. This simple driver addresses this so the cosumer don't need to care about it. [1] https://www.ti.com/product/TPS3801 Signed-off-by: Marco Felsch [p.zabel@pengutronix.de: drop Todo comment about min/typ/max reset time] Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220530092226.748644-2-m.felsch@pengutronix.de commit 2f0f6b176e083b08667b22d52eaf56d8403ff6f4 Merge: 060468f0ddbbd f3d890f5f90eb Author: David S. Miller Date: Wed Jul 27 09:39:17 2022 +0100 Merge branch 'dsa-microchip-phylink-mac-config' Arun Ramadoss says: ==================== net: dsa: microchip: add support for phylink mac config and link up This patch series add support common phylink mac config and link up for the ksz series switches. At present, ksz8795 and ksz9477 doesn't implement the phylink mac config and link up. It configures the mac interface in the port setup hook. ksz8830 series switch does not mac link configuration. For lan937x switches, in the part support patch series has support only for MII and RMII configuration. Some group of switches have some register address and bit fields common and others are different. So, this patch aims to have common phylink implementation which configures the register based on the chip id. Changes in v2 - combined the modification of duplex, tx_pause and rx_pause into single function. Changes in v1 - Squash the reading rgmii value from dt to patch which apply the rgmii value - Created the new function ksz_port_set_xmii_speed - Seperated the namespace values for xmii_ctrl_0 and xmii_ctrl_1 register - Applied the rgmii delay value based on the rx/tx-internal-delay-ps ==================== Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit f3d890f5f90ebadab82fbfce4bb80aefd97def34 Author: Arun Ramadoss Date: Sun Jul 24 15:08:12 2022 +0530 net: dsa: microchip: add support for phylink mac config This patch add support for phylink mac config for ksz series of switches. All the files ksz8795, ksz9477 and lan937x uses the ksz common xmii function. Instead of calling from the individual files, it is moved to the ksz common phylink mac config function. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit c476bede4b0f07a26c84e38b0bc34bdaca8135da Author: Arun Ramadoss Date: Sun Jul 24 14:58:22 2022 +0530 net: dsa: microchip: ksz8795: use common xmii function This patch updates the ksz8795 cpu configuration to use the ksz common xmii set functions. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit 0ab7f6bf1675b5ffbfcd6fffd13be8d98a4d5757 Author: Arun Ramadoss Date: Sun Jul 24 14:58:21 2022 +0530 net: dsa: microchip: ksz9477: use common xmii function In ksz9477.c file, configuring the xmii register is performed based on the flag NEW_XMII. The flag is reset for ksz9893 switch and set for other switch. This patch uses the ksz common xmii set and get function. The bit values are configured based on the chip id. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit b19ac41faa3f9602f245d1ab679f7fa96d388320 Author: Arun Ramadoss Date: Sun Jul 24 14:58:20 2022 +0530 net: dsa: microchip: apply rgmii tx and rx delay in phylink mac config This patch read the rgmii tx and rx delay from device tree and stored it in the ksz_port. It applies the rgmii delay to the xmii tune adjust register based on the interface selected in phylink mac config. There are two rgmii port in LAN937x and value to be loaded in the register vary depends on the port selected. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit dc1c596edba5e656256c2d6e6922246c7803f2de Author: Arun Ramadoss Date: Sun Jul 24 14:58:19 2022 +0530 net: dsa: microchip: lan937x: add support for configuing xMII register This patch add the common ksz_set_xmii function for ksz series switch and update the lan937x code phylink mac config. The register address for the ksz8795 is Port 5 Interface control 6 and for all other switch is xMII Control 1. The bit value for selecting the interface is same for KSZ8795 and KSZ9893 are same. The bit values for KSZ9477 and lan973x are same. So, this patch add the bit value for each switches in ksz_chip_data and configure the registers based on the chip id. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit da8cd08520f3abac9ff288136b70ea991e1ec6ab Author: Arun Ramadoss Date: Sun Jul 24 14:58:18 2022 +0530 net: dsa: microchip: add support for common phylink mac link up This patch add the support for common phylink mac link up for the ksz series switch. The register address, bit position and values are configured based on the chip id to the dev->info structure. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit 8560664fd32aa055b3c128337356e32e8fc25b5a Author: Arun Ramadoss Date: Sun Jul 24 14:58:17 2022 +0530 net: dsa: microchip: add common duplex and flow control function This patch add common function for configuring the Full/Half duplex and transmit/receive flow control. KSZ8795 uses the Global control register 4 for configuring the duplex and flow control, whereas all other KSZ9477 based switch uses the xMII Control 0 register. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit aa5b8b73d4bd34618508165bc0e5b7eb4b7c2c20 Author: Arun Ramadoss Date: Sun Jul 24 14:58:16 2022 +0530 net: dsa: microchip: add common ksz port xmii speed selection function This patch adds the function for configuring the 100/10Mbps speed selection for the ksz switches. KSZ8795 switch uses Global control 4 register 0x06 bit 4 for choosing 100/10Mpbs. Other switches uses xMII control 1 0xN300 for it. For KSZ8795, if the bit is set then 10Mbps is chosen and if bit is clear then 100Mbps chosen. For all other switches it is other way around, if the bit is set then 100Mbps is chosen. So, this patch add the generic function for ksz switch to select the 100/10Mbps speed selection. While configuring, first it disables the gigabit functionality and then configure the respective speed. Signed-off-by: Arun Ramadoss Signed-off-by: David S. Miller commit 46f80fa8981bcbb0ab522b34c919d0186a0cff02 Author: Arun Ramadoss Date: Sun Jul 24 14:58:15 2022 +0530 net: dsa: microchip: add common gigabit set and get function This patch add helper function for setting and getting the gigabit enable for the ksz series switch. KSZ8795 switch has different register address compared to all other ksz switches. KSZ8795 series uses the Port 5 Interface control 6 Bit 6 for configuring the 1Gbps or 100/10Mbps speed selection. All other switches uses the xMII control 1 0xN301 register Bit6 for gigabit. Further, for KSZ8795 & KSZ9893 switches if bit 1 then 1Gbps is chosen and if bit 0 then 100/10Mbps is chosen. It is other way around for other switches bit 0 is for 1Gbps. So, this patch implements the common function for configuring the gigabit set and get capability. Signed-off-by: Arun Ramadoss Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit ba40a57ff08bf606135866bfe5fddc572089ac16 Author: Christian Brauner Date: Tue Jul 26 16:16:15 2022 +0200 Add Seth Forshee as co-maintainer for idmapped mounts Seth has been integral in the design and implementation of idmapped mounts and was the main architect behind the s_user_ns work which ultimately made filesystems such as FUSE and overlayfs available in containers. He continues to be active in both development and review. I'm very happy he decided to maintain this feature. He has my full trust. Link: https://lore.kernel.org/r/20220726141615.1046027-1-brauner@kernel.org Cc: Seth Forshee Signed-off-by: Christian Brauner (Microsoft) commit e48ef9a9c52972d14c788d59024dcc7f566ed2c9 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:58:41 2022 +0200 dt-bindings: soc: microchip: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Claudiu Beznea Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220726115841.101249-4-krzysztof.kozlowski@linaro.org commit 43f45415f31d0ca5b623dc5f7e22299da93d61f3 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:58:40 2022 +0200 dt-bindings: soc: microchip: drop quotes when not needed Id and schema fields do not need quotes. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Claudiu Beznea Reviewed-by: Conor Dooley Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220726115841.101249-3-krzysztof.kozlowski@linaro.org commit ed65704f3a8f5add6542c1f363abc715934ade98 Author: Claudiu Beznea Date: Tue Jul 26 11:49:31 2022 +0300 ARM: dts: lan966x: keep lan966 entries alphabetically sorted Keep LAN966 entries alphabetically sorted. Signed-off-by: Claudiu Beznea Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220726084931.1789855-1-claudiu.beznea@microchip.com commit 2b5002e2cc1483b6333d31e21902b78a1997909e Author: Phillip Potter Date: Mon Jul 25 23:07:45 2022 +0100 staging: r8188eu: convert rtw_pwr_wakeup to correct error code semantics Convert the rtw_pwr_wakeup function to use 0 on success and an appropriate error code on error. For the first failure block where ips_leave is invoked, use -ENOMEM as this is the main cause of failure here anyway. For the second failure block, use -EBUSY, as it seems the most appropriate. Finally, within the functions rtw_wx_set_mode, rtw_wx_set_wap, rtw_wx_set_scan and rtw_wx_set_essid, pass the error code on from rtw_pwr_wakeup as appropriate now that it is converted. This gets the driver closer to removal of the non-standard _SUCCESS and _FAIL definitions, which are inverted compared to the standard in-kernel error code mechanism. Tested-by: Philipp Hortmann # Edimax N150 Reviewed-by: Dan Carpenter Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20220725220745.12739-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman commit 47092381023050ab90c3f0603a587f798d37f194 Author: Michael Straube Date: Sun Jul 24 20:25:20 2022 +0200 staging: r8188eu: make dump_chip_info() static The function dump_chip_info() is only used in rtl8188e_hal_init.c. Make it static to reduce the driver object file size by 281 bytes. before: text data bss dec hex filename 530606 43897 7072 581575 8dfc7 drivers/staging/r8188eu/r8188eu.o after: text data bss dec hex filename 530405 43817 7072 581294 8deae drivers/staging/r8188eu/r8188eu.o Tested-by: Philipp Hortmann # Edimax N150 Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220724182520.7794-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 123b3b754e3fb4f3c8632eb88e32a36d356513eb Author: Martin Kaiser Date: Sun Jul 24 17:33:49 2022 +0200 staging: r8188eu: remove DoReserved prototype The DoReserved function was removed in commit 869ddbfccdea ("staging: r8188eu: remove dummy entries from OnAction_tbl"). Remove the prototype as well. Tested-by: Philipp Hortmann # Edimax N150 Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220724153349.138741-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit 51ee8ea588bca025cb03b0caa922d78bdb8ba901 Author: Martin Kaiser Date: Sun Jul 24 17:33:48 2022 +0200 staging: r8188eu: remove OnAtim prototype The OnAtim function was removed in commit 6d933902c609 ("staging: r8188eu: remove OnAtim"). Remove the prototype as well. Tested-by: Philipp Hortmann # Edimax N150 Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20220724153349.138741-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit b9ad667059d72713729761fa3d9e087cfa065e52 Author: Michael Straube Date: Fri Jul 15 08:29:08 2022 +0200 staging: r8188eu: remove SetHwReg8188EU() Remove the case HW_VAR_CORRECT_TSF from SetHwReg8188EU() and move the functionality to the function that calls SetHwReg8188EU() with HW_VAR_CORRECT_TSF. SetHwReg8188EU() is empty now and we can finally remove it. Tested-by: Martin Kaiser Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220715062908.8547-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7136ef70a067095ec207ad1d710fed44154d51a6 Author: Michael Straube Date: Fri Jul 15 08:29:07 2022 +0200 staging: r8188eu: make update_TSF() and correct_TSF() static The functions update_TSF() and correct_TSF() are only used in rtw_mlme_ext.c. Make them static. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220715062908.8547-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 21b044c903384898b1972c35a7927ed184a46e47 Author: Michael Straube Date: Fri Jul 15 08:29:06 2022 +0200 staging: r8188eu: remove unused parameter from update_TSF() The parameter 'len' of update_TSF() is unused. Remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220715062908.8547-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0f83ff0129577f113242b207bdae284eb15696e5 Author: Michael Straube Date: Fri Jul 15 08:29:05 2022 +0200 staging: r8188eu: remove unused parameter from correct_TSF() The parameter 'pmlmeext' of correct_TSF() is unused. Remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220715062908.8547-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3cc664a99e2f6f06cccee1941b6ea221779031fb Author: Michael Straube Date: Fri Jul 15 08:29:04 2022 +0200 staging: r8188eu: remove HW_VAR_SET_OPMODE from SetHwReg8188EU() Remove the HW_VAR_SET_OPMODE case from SetHwReg8188EU() and move the functions that are called by that case to rtw_mlme_ext.c. This is part of the ongoing effort to get rid of SetHwReg8188EU(). Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20220715062908.8547-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6a74f103e3e0ce81ea29146070900d563b984e0f Author: Sidong Yang Date: Mon Jul 25 12:45:13 2022 +0100 staging: pi433: remove duplicated comments Remove duplicated words in comments for readability. The words are duplicated from a sentence below. Signed-off-by: Sidong Yang Link: https://lore.kernel.org/r/20220725114513.85089-1-realwakka@gmail.com Signed-off-by: Greg Kroah-Hartman commit 97c9a70f129f43f90b8b3fa7af8a02ed6c977a60 Author: Binyi Han Date: Thu Jul 14 23:17:54 2022 -0700 staging: qlge: refine variable name tmp as a variable name don't have much information, change tmp to dma. Signed-off-by: Binyi Han Link: https://lore.kernel.org/r/20220715061754.GA6657@cloud-MacBookPro Signed-off-by: Greg Kroah-Hartman commit 17ea92a9f6d0b9a97aaec5ab748e4591d70a562c Author: Namjae Jeon Date: Fri Jul 22 10:17:06 2022 +0900 ksmbd: fix kernel oops from idr_remove() There is a report that kernel oops happen from idr_remove(). kernel: BUG: kernel NULL pointer dereference, address: 0000000000000010 kernel: RIP: 0010:idr_remove+0x1/0x20 kernel: __ksmbd_close_fd+0xb2/0x2d0 [ksmbd] kernel: ksmbd_vfs_read+0x91/0x190 [ksmbd] kernel: ksmbd_fd_put+0x29/0x40 [ksmbd] kernel: smb2_read+0x210/0x390 [ksmbd] kernel: __process_request+0xa4/0x180 [ksmbd] kernel: __handle_ksmbd_work+0xf0/0x290 [ksmbd] kernel: handle_ksmbd_work+0x2d/0x50 [ksmbd] kernel: process_one_work+0x21d/0x3f0 kernel: worker_thread+0x50/0x3d0 kernel: rescuer_thread+0x390/0x390 kernel: kthread+0xee/0x120 kthread_complete_and_exit+0x20/0x20 kernel: ret_from_fork+0x22/0x30 While accessing files, If connection is disconnected, windows send session setup request included previous session destroy. But while still processing requests on previous session, this request destroy file table, which mean file table idr will be freed and set to NULL. So kernel oops happen from ft->idr in __ksmbd_close_fd(). This patch don't directly destroy session in destroy_previous_session(). It just set to KSMBD_SESS_EXITING so that connection will be terminated after finishing the rest of requests. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 8e06b31e348107c5d78e2c90bb7e69388cb97fb6 Author: Namjae Jeon Date: Fri Jul 22 10:15:57 2022 +0900 ksmbd: add channel rwlock Add missing rwlock for channel list in session. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit e4d3e6b524c0c928f7fc9e03e047885c4951ae60 Author: Namjae Jeon Date: Fri Jul 22 10:15:10 2022 +0900 ksmbd: replace sessions list in connection with xarray Replace sessions list in connection with xarray. Signed-off-by: Namjae Jeon Reviewed-by: Hyunchul Lee Signed-off-by: Steve French commit 060468f0ddbbd3396944ad234077e44af1841efc Author: Slark Xiao Date: Mon Jul 25 10:01:24 2022 +0800 selftests: net: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220725020124.5760-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 38ac173b0ef85a66bfd6d03ce74d4afe37f7f00c Author: Robert Schmidt Date: Tue Jul 26 23:16:17 2022 +0200 hwmon: (nct6775) add ASUS TUF GAMING B550-PLUS WIFI II Add ASUS TUF GAMING B550-PLUS WIFI II to the WMI monitoring list to enable support for HW monitoring on that board. Signed-off-by: Robert Schmidt Link: https://lore.kernel.org/r/YuBZodZHOnDll5zy@hydra Signed-off-by: Guenter Roeck commit a7e555d4a184d7da72ed6df7d6741dc190b5ca5b Author: Eric Dumazet Date: Mon Jul 25 13:05:54 2022 -0700 ip6mr: remove stray rcu_read_unlock() from ip6_mr_forward() One rcu_read_unlock() should have been removed in blamed commit. Fixes: 9b1c21d898fd ("ip6mr: do not acquire mrt_lock while calling ip6_mr_forward()") Reported-by: Vladimir Oltean Signed-off-by: Eric Dumazet Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220725200554.2563581-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski commit 8fcdc238ce1b492e1f57a73a2ce4131d63f45397 Author: Mike Christie Date: Tue Jul 26 18:53:39 2022 -0500 scsi: target: Remove XDWRITEREAD emulated support This patch removes XDWRITEREAD support because it never fully worked when it was added in the initial LIO merge and it's been fully broken since 2013 from commit a2890087499a ("target: Add compare_and_write_post() completion callback fall through"). The two issues above are: 1. XDWRITEREAD support was just never completed when LIO was merged. We never did the DISABLE WRITE check and so we never write data out. 2. Since the commit above, we never complete the command. After we do the XOR, we return from xdreadwrite_callback and that's it. We never send a response for the command, so the command will always time out and fail. Since this has been fully broken for almost nine years this patch just removes emulated support. Link: https://lore.kernel.org/r/20220726235339.14551-1-michael.christie@oracle.com Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen commit 68126eeb6df6cb53aae4dc450ec20792e1819861 Author: Jason Wang Date: Sat Jul 23 17:16:20 2022 +0800 scsi: megaraid: Remove the static variable initialisation Initialising global and static variables to 0 is unnecessary. Remove the initialisation. Link: https://lore.kernel.org/r/20220723091620.5463-1-wangborong@cdjrlc.com Signed-off-by: Jason Wang Signed-off-by: Martin K. Petersen commit 241b79b1e964bed8cda8892ac0448721bfe4b55a Author: Xin Gao Date: Thu Jul 21 03:52:29 2022 +0800 scsi: ch: Do not initialise statics to 0 Link: https://lore.kernel.org/r/20220720195229.9109-1-gaoxin@cdjrlc.com Signed-off-by: Xin Gao Signed-off-by: Martin K. Petersen commit aaa26e383bfc566eca059dcfe1123338cfc9f659 Author: Colin Ian King Date: Tue Jul 19 12:06:49 2022 +0100 scsi: ufs: core: Fix spelling mistake "Cannnot" -> "Cannot" There is a spelling mistake in a dev_dbg message. Fix it. Link: https://lore.kernel.org/r/20220719110649.759821-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit 292cef5e6262e7976dca310ed9c86f135b807bb4 Author: Dmitry Bogdanov Date: Mon Jul 18 18:25:55 2022 +0300 scsi: target: iscsi: Do not require target authentication RFC7143 states that Initiator decides what type of authentication to use: The initiator MUST continue with: CHAP_N= CHAP_R= or, if it requires target authentication, with: CHAP_N= CHAP_R= CHAP_I= CHAP_C= Allow one way authentication if mutual authentication is configured. That passes some tests from Windows HLK for Mutual CHAP with iSNS. Link: https://lore.kernel.org/r/20220718152555.17084-5-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit e52b904b49273df35766826ce8dfb8cc3dd1ff37 Author: Dmitry Bogdanov Date: Mon Jul 18 18:25:54 2022 +0300 scsi: target: iscsi: Allow AuthMethod=None Allow negotiating AuthMethod=None at CSG=0 (Security Negotiation) when authentication is not required. That is required by the CHAP test in Windows HLK. Link: https://lore.kernel.org/r/20220718152555.17084-4-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 1e5733883421495908f3b90d9d807663038b4136 Author: Dmitry Bogdanov Date: Mon Jul 18 18:25:53 2022 +0300 scsi: target: iscsi: Support base64 in CHAP RFC7143 allows both Base64 and Hex encoding for CHAP binary entities like Challenge and Response. Currently the Linux iSCSI target supports only Hex encoding. Add support for Base64 encoded CHAP Challenge and CHAP Response required for CHAP tests in Windows HLK. Link: https://lore.kernel.org/r/20220718152555.17084-3-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 8f1f7d297bce50d9daea95ca67e1c10aea6c232c Author: Dmitry Bogdanov Date: Mon Jul 18 18:25:52 2022 +0300 scsi: target: iscsi: Add support for extended CDB AHS Variable length SCSI commands are transferred over iSCSI via two CDB buffers - in Basic Header Segment and in Additional Header Segment (AHS). Since AHS is not supported yet, a target reads just BHS (48 byte) from TCP and treats the remaining octets as a next new iSCSI PDU that causes protocol errors. Add support for the Extended CDB AHS type. Link: https://lore.kernel.org/r/20220718152555.17084-2-d.bogdanov@yadro.com Reviewed-by: Mike Christie Signed-off-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 2f3b3200ac389d09135fa42ade45ff23de7ce605 Author: Johan Hovold Date: Mon Jul 11 12:14:41 2022 +0200 scsi: ufs: dt-bindings: Add SC8280XP binding Add SC8280XP to the DT schema. Link: https://lore.kernel.org/r/20220711101441.4896-1-johan+linaro@kernel.org Reviewed-by: Alim Akhtar Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Signed-off-by: Martin K. Petersen commit 2bc7ea71a73747a77e7f83bc085b0d2393235410 Merge: ee8b1ef9a6b08 dfc4005f8c172 Author: Dave Airlie Date: Wed Jul 27 10:11:59 2022 +1000 Merge tag 'topic/nouveau-misc-2022-07-27' of git://anongit.freedesktop.org/drm/drm into drm-next drm/nouveau-misc: display patches. These are just some precursor and cleanup display patches from Ben, tested by Lyude. Signed-off-by: Dave Airlie From: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/CAPM=9ty0R37q0mohBr_CegpYLXK2=fAH54QfAsMhHfPygTsdQA@mail.gmail.com commit 4062eba9f3d072e72645860fbc5d160428a75c50 Author: Guillaume Tucker Date: Wed Jul 13 08:33:43 2022 +0200 Makefile: replace headers_install with headers for kselftest Replace headers_install with headers as kselftest uses the header files from within the kernel tree rather than from a system-wide installation. We can still run this directly: $ make O=build kselftest-all and when building from the selftests directory: $ make O=build headers $ make O=build -C tools/testing/selftests all Signed-off-by: Guillaume Tucker Reported-by: Masahiro Yamada Acked-by: Shuah Khan Signed-off-by: Shuah Khan commit 187e7c41445a0f202bb551f08ca7f8158fea1cd7 Author: Adam Sindelar Date: Fri Jul 8 11:06:46 2022 +0200 selftests/vm: fix va_128TBswitch.sh permissions Restore the +x bit to va_128TBswitch.sh, which got dropped from the previous patch, somehow. Link: https://lkml.kernel.org/r/20220708090646.34927-1-adam@wowsignal.io Fixes: 1afd01d43efc3 ("selftests/vm: Only run 128TBswitch with 5-level paging") Signed-off-by: Adam Sindelar Signed-off-by: Andrew Morton commit ee8b1ef9a6b089abf7a9c7d094b6e93fa05f15b9 Merge: 417c1c1963549 1b54a0121dba1 Author: Dave Airlie Date: Wed Jul 27 09:33:44 2022 +1000 Merge tag 'amd-drm-next-5.20-2022-07-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amdgpu: - VCN4 fixes - RAS support for UMC 8.10 - ACP support for jadeite platforms - NBIO HDP flush fixes - Misc spelling and grammar fixes - Runtime PM fixes - Non-DC HPD fix - Clean up amdgpu DM code - DSC fixes - Expose some additional GFXOFF data via debugfs - More FP clean up for new DCN blocks - PPC DC FP fixes - DCN 3.1.4 fixes - DC DML stack usage fixes - GMC fixes - SPM fixes for RDNA2 amdkfd: - MMU notifier fix - Mutex fix UAPI: - Add a comment about VCN4 unified queues - IP version information for UMDs Proposed mesa change: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/17411/diffs?commit_id=c8a63590dfd0d64e6e6a634dcfed993f135dd075 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20220726181536.5759-1-alexander.deucher@amd.com commit dfc4005f8c172eea359f9db08c3b2b0ff0153699 Author: Ben Skeggs Date: Wed Jun 1 20:46:31 2022 +1000 drm/nouveau/disp: move DAC load detection method Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 1b255f1ccc883256e23db279ea164273ea0f7462 Author: Ben Skeggs Date: Wed Jun 1 20:46:31 2022 +1000 drm/nouveau/disp: add output class Will be used to more cleanly implement existing method interfaces that take some confusing (IEDTkey, inherited from VBIOS, which RM no longer uses on Ampere) match values to determine which display path to operate on. Methods will be protected from racing with supervisor, and from being called where they shouldn't be (ie. without an OR assigned). v2: - use ?: (lyude) v3: - fix return code if noacquire() method fails Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie commit a6fd8f936402c3bcc5ac6aed9cca8e73b5ca08f7 Author: Ben Skeggs Date: Wed Jun 1 20:46:31 2022 +1000 drm/nouveau/disp: add supervisor mutex Will be used to protect NVIF_CLASS_OUTP method calls from racing with in-progress supervisor handling. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 32dd9236698bcd2ffdb69954b167a851fd50182a Author: Ben Skeggs Date: Wed Jun 1 20:46:30 2022 +1000 drm/nouveau/disp: add conn method to query HPD pin status And use it to bail early in DP detection and avoid futile AUX transactions. This could be used on other connector types too in theory, but it's not something we've ever done before and I'd rather not risk breaking working systems without looking into it more closely. It's safe for DP though. We already do this by checking an AUX register that contains HPD status and aborting the transaction. However, this is much deeper in the stack - after taking various mutexes, poking HW for no good reason, and making a mess in debug logs. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 95983aea80038539ebc70e41e73e9bb4eabd1a92 Author: Ben Skeggs Date: Wed Jun 1 20:46:30 2022 +1000 drm/nouveau/disp: add connector class Will be used to provide more solid driver interfaces in general, but the immediate motivation is work towards fixing issues with handling hotplug/DP IRQ events. Its use is currently limited to where we support non-polled hotplug already (ie. any GPU since NV40ish era, where our DCB handling works well enough), until that gets cleaned up someday. v2: - use ?: (lyude) Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 889fcbe949bdd8470931a90b91f273ca18c510c1 Author: Ben Skeggs Date: Wed Jun 1 20:46:29 2022 +1000 drm/nouveau/disp: add common channel class handling Replaces a bunch of unnecessarily duplicated boilerplate in per-chipset code with a simpler, common, implementation. Channel "awaken" notify code is completely gone for now. KMS has never made use of it so far, and event notify handling is about to be changed in general anyway. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 7bcf89eed48f3fba8d0e2c19236e7dc547b6e037 Author: Ben Skeggs Date: Wed Jun 1 20:46:29 2022 +1000 drm/nouveau/disp: split sor hda funcs out to their own struct Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 9a4514fbffda6083d9f7fba4882142686783cfe4 Author: Ben Skeggs Date: Wed Jun 1 20:46:29 2022 +1000 drm/nouveau/disp: split sor dp funcs out to their own struct Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 79c453af55d9f1e85b906211ea4051364d28dcb4 Author: Ben Skeggs Date: Wed Jun 1 20:46:28 2022 +1000 drm/nouveau/disp: replace hda func pointer check with flag Simpler, and less error-prone than a separate set of function pointers. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 1c6aab75ece7c1d450e4561cb2263403eeb7ae2f Author: Ben Skeggs Date: Wed Jun 1 20:46:28 2022 +1000 drm/nouveau/disp: merge nv50_disp_new_() and nvkm_disp_new() Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 3517e6b6fee05b6259ca21741cbe5d7bf68aa672 Author: Ben Skeggs Date: Wed Jun 1 20:46:28 2022 +1000 drm/nouveau/disp: group supervisor-related struct members Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit acbe9ecfb7fb14db868ddbeda8f43e623026316b Author: Ben Skeggs Date: Wed Jun 1 20:46:27 2022 +1000 drm/nouveau/disp: merge head/outp/ior code into chipset files No changes to code at all here, just shuffling it around and removing a bunch of (now unnecessary) forward-declarations from headers. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 168c02994399f2714bc6c73f85b7ce4d827f97aa Author: Ben Skeggs Date: Wed Jun 1 20:46:27 2022 +1000 drm/nouveau/disp: add common class handling between =nv50 About to expose head/output path/connector objects everywhere, so we will need support for child classes prior to nv50 now. Somewhat cleaner than the code >=nv50 used previously. v2: - use ?: (lyude) Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 92fba5d3c8f5b757c4e3fdc89afe76a8f6c4da68 Author: Ben Skeggs Date: Wed Jun 1 20:46:26 2022 +1000 drm/nouveau/disp: collapse nv50_disp into nvkm_disp Dump of one struct's members into another, with a couple of list renames because of collisions. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 0407b33fadcd7a5d31ba3c473cef95b2b418d8c4 Author: Ben Skeggs Date: Wed Jun 1 20:46:26 2022 +1000 drm/nouveau/disp: collapse nv50_disp_func into nvkm_disp_func Aside from a chicken-and-egg problem with a duplicate 'root' member, this is a straight dump of function pointers from one struct into another. The left-over wrapping mess in >=nv50 structs will be fixed later. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 412dfcf34e0695fa1714ad422b2a5d0ed1406437 Author: Ben Skeggs Date: Wed Jun 1 20:46:25 2022 +1000 drm/nouveau/disp: clean up nvkm_outp constructors Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 7786fb366e598e984ee9307616b0c72979bd191c Author: Ben Skeggs Date: Wed Jun 1 20:46:25 2022 +1000 drm/nouveau/disp: collapse nvkm_dp into nvkm_outp There should be no changes to code here other than modifying the dereferences. Signed-off-by: Ben Skeggs Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie commit 48c022d1627295ef4c4a85f00caf002b59800f67 Merge: 4fd310c74432d 84c61fe1a75b4 Author: Jakub Kicinski Date: Tue Jul 26 14:38:53 2022 -0700 Merge branch 'tls-rx-decrypt-from-the-tcp-queue' Jakub Kicinski says: ==================== tls: rx: decrypt from the TCP queue This is the final part of my TLS Rx rework. It switches from strparser to decrypting data from skbs queued in TCP. We don't need the full strparser for TLS, its needs are very basic. This set gives us a small but measurable (6%) performance improvement (continuous stream). ==================== Link: https://lore.kernel.org/r/20220722235033.2594446-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Author: Jakub Kicinski Date: Fri Jul 22 16:50:33 2022 -0700 tls: rx: do not use the standard strparser TLS is a relatively poor fit for strparser. We pause the input every time a message is received, wait for a read which will decrypt the message, start the parser, repeat. strparser is built to delineate the messages, wrap them in individual skbs and let them float off into the stack or a different socket. TLS wants the data pages and nothing else. There's no need for TLS to keep cloning (and occasionally skb_unclone()'ing) the TCP rx queue. This patch uses a pre-allocated skb and attaches the skbs from the TCP rx queue to it as frags. TLS is careful never to modify the input skb without CoW'ing / detaching it first. Since we call TCP rx queue cleanup directly we also get back the benefit of skb deferred free. Overall this results in a 6% gain in my benchmarks. Acked-by: Paolo Abeni Signed-off-by: Jakub Kicinski commit 8b3c59a7a0bed6fe365755ac211dcf94fdac81b4 Author: Jakub Kicinski Date: Fri Jul 22 16:50:32 2022 -0700 tls: rx: device: add input CoW helper Wrap the remaining skb_cow_data() into a helper, so it's easier to replace down the lane. The new version will change the skb so make sure relevant pointers get reloaded after the call. Signed-off-by: Jakub Kicinski commit 3f92a64e44e5823a975cbf2c9f05ab1893fd4cb7 Author: Jakub Kicinski Date: Fri Jul 22 16:50:31 2022 -0700 tcp: allow tls to decrypt directly from the tcp rcv queue Expose TCP rx queue accessor and cleanup, so that TLS can decrypt directly from the TCP queue. The expectation is that the caller can access the skb returned from tcp_recv_skb() and up to inq bytes worth of data (some of which may be in ->next skbs) and then call tcp_read_done() when data has been consumed. The socket lock must be held continuously across those two operations. Signed-off-by: Jakub Kicinski commit d4e5db6452211467f668521f5a3bd3c3928918e1 Author: Jakub Kicinski Date: Fri Jul 22 16:50:30 2022 -0700 tls: rx: device: keep the zero copy status with offload The non-zero-copy path assumes a full skb with decrypted contents. This means the device offload would have to CoW the data. Try to keep the zero-copy status instead, copy the data to user space. Signed-off-by: Jakub Kicinski commit b93f5700164dabc59f5c82857dbe571e0ccb2d35 Author: Jakub Kicinski Date: Fri Jul 22 16:50:29 2022 -0700 tls: rx: don't free the output in case of zero-copy In the future we'll want to reuse the input skb in case of zero-copy so we shouldn't always free darg.skb. Move the freeing of darg.skb into the non-zc cases. All cases will now free ctx->recv_pkt (inside let tls_rx_rec_done()). Signed-off-by: Jakub Kicinski commit dd47ed3620e693636b4d912db4810fe0c092eb2c Author: Jakub Kicinski Date: Fri Jul 22 16:50:28 2022 -0700 tls: rx: factor SW handling out of tls_rx_one_record() After recent changes the SW side of tls_rx_one_record() can be nicely encapsulated in its own function. Move the pad handling as well. This will be useful for ->zc handling in tls_decrypt_device(). Signed-off-by: Jakub Kicinski commit b92a13d488de2e87c869a4a6c0393d1f9eebe6dd Author: Jakub Kicinski Date: Fri Jul 22 16:50:27 2022 -0700 tls: rx: wrap recv_pkt accesses in helpers To allow for the logic to change later wrap accesses which interrogate the input skb in helper functions. Signed-off-by: Jakub Kicinski commit a11821495fd4d9b5c97945db929e02c473b7a5d9 Author: Wolfram Sang Date: Sun Jul 24 20:46:28 2022 +0200 i2c: extend documentation about retvals of master_xfer functions It was stated how the error codes should be. It was not stated what the regular case should return. Add this. Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 6435319c34704994e19b0767f6a4e6f37439867b Author: Liang He Date: Fri Jul 22 09:24:01 2022 +0800 i2c: mux-gpmux: Add of_node_put() when breaking out of loop In i2c_mux_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount. Fixes: ac8498f0ce53 ("i2c: i2c-mux-gpmux: new driver") Signed-off-by: Liang He Acked-by: Peter Rosin Signed-off-by: Wolfram Sang commit 49897cfe620dc7445d18d6ae6e1da9c8d4c02c94 Author: Jagan Teki Date: Sun Jul 24 02:13:26 2022 +0530 dt-bindings: i2c: i2c-rk3x: Document Rockchip RV1126 Document compatible string for Rockchip RV1126 SoC. Signed-off-by: Jagan Teki Acked-by: Rob Herring [wsa: rebased] Signed-off-by: Wolfram Sang commit 9c9cb23e00ddf45679b21b4dacc11d1ae7961ebe Author: Xin Xiong Date: Sun Jul 24 17:55:58 2022 +0800 xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in __xfrm_policy_check(). When the fetching process of the object `pols[1]` fails, the function simply returns 0, forgetting to decrement the reference count of `pols[0]`, which is incremented earlier by either xfrm_sk_policy_lookup() or xfrm_policy_lookup(). This may result in memory leaks. Fix it by decreasing the reference count of `pols[0]` in that path. Fixes: 134b0fc544ba ("IPsec: propagate security module errors up from flow_cache_lookup") Signed-off-by: Xin Xiong Signed-off-by: Xin Tan Signed-off-by: Steffen Klassert commit 4fd310c74432d19e8f58a4291b44db0ddebe7bf3 Merge: 35d099da41967 949c84f05eb65 Author: Jakub Kicinski Date: Tue Jul 26 13:54:58 2022 -0700 Merge branch 'implement-dev-info-and-dev-flash-for-line-cards' Jiri Pirko says: ==================== Implement dev info and dev flash for line cards This patchset implements two features: 1) "devlink dev info" is exposed for line card (patches 6-9) 2) "devlink dev flash" is implemented for line card gearbox flashing (patch 10) For every line card, "a nested" auxiliary device is created which allows to bind the features mentioned above (patch 4). The relationship between line card and its auxiliary dev devlink is carried over extra line card netlink attribute (patches 3 and 5). The first patch removes devlink_mutex from devlink_register/unregister() which eliminates possible deadlock during devlink reload command. The second patchset follows up with putting net pointer check into new helper. Examples: $ devlink lc show pci/0000:01:00.0 lc 1 pci/0000:01:00.0: lc 1 state active type 16x100G nested_devlink auxiliary/mlxsw_core.lc.0 supported_types: 16x100G $ devlink dev show auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0 $ devlink dev info auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0: versions: fixed: hw.revision 0 fw.psid MT_0000000749 running: ini.version 4 fw 19.2010.1312 $ devlink dev flash auxiliary/mlxsw_core.lc.0 file mellanox/fw-AGB-rel-19_2010_1312-022-EVB.mfa2 ==================== Link: https://lore.kernel.org/r/20220725082925.366455-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 949c84f05eb65b0a41f7f5c62ee9ffc5d8e39c89 Author: Jiri Pirko Date: Mon Jul 25 10:29:25 2022 +0200 selftests: mlxsw: Check line card info on activated line card Once line card is activated, check the FW version and PSID are exposed. Signed-off-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit e96c8da380391cca7889a4fd4b09c8fbc14aeef8 Author: Jiri Pirko Date: Mon Jul 25 10:29:24 2022 +0200 selftests: mlxsw: Check line card info on provisioned line card Once line card is provisioned, check if HW revision and INI version are exposed on associated nested auxiliary device. Signed-off-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit 9ca6a7a5f42de2ef330d6bc4243d850663d9acab Author: Jiri Pirko Date: Mon Jul 25 10:29:23 2022 +0200 mlxsw: core_linecards: Implement line card device flashing Implement flash_update() devlink op for the line card devlink instance to allow user to update line card gearbox FW using MDDT register and mlxfw. Example: $ devlink dev flash auxiliary/mlxsw_core.lc.0 file mellanox/fw-AGB-rel-19_2010_1312-022-EVB.mfa2 Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 3fc0c51905fb0f57d8f7093cc5efe45d8a9557ca Author: Jiri Pirko Date: Mon Jul 25 10:29:22 2022 +0200 mlxsw: core_linecards: Expose device PSID over device info Use tunneled MGIR to obtain PSID of line card device and extend device_info_get() op to fill up the info with that. Example: $ devlink dev info auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0: versions: fixed: hw.revision 0 fw.psid MT_0000000749 running: ini.version 4 fw 19.2010.1312 Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 8f9b0513a950040e2e9414059854b9a2372c1fb7 Author: Jiri Pirko Date: Mon Jul 25 10:29:21 2022 +0200 mlxsw: reg: Add Management DownStream Device Tunneling Register The MDDT register allows to deliver query and request messages (PRM registers, commands) to a DownStream device. Signed-off-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 4da0eb2a75eb14a474a94d9249255f97a9175a3c Author: Jiri Pirko Date: Mon Jul 25 10:29:20 2022 +0200 mlxsw: core_linecards: Probe active line cards for devices and expose FW version In case the line card is active, go over all possible existing devices (gearboxes) on it and expose FW version of the flashable one. Example: $ devlink dev info auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0: versions: fixed: hw.revision 0 running: ini.version 4 fw 19.2010.1312 Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 4ea07cf638dbd6260664b69b0f69cc951934194d Author: Jiri Pirko Date: Mon Jul 25 10:29:19 2022 +0200 mlxsw: reg: Extend MDDQ by device_info Extend existing MDDQ register by possibility to query information about devices residing on a line card. Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 5ba325fec511fecdfcf3815695c275f6c0ba817b Author: Jiri Pirko Date: Mon Jul 25 10:29:18 2022 +0200 mlxsw: core_linecards: Expose HW revision and INI version Implement info_get() to expose HW revision of a linecard and loaded INI version. Example: $ devlink dev info auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0: versions: fixed: hw.revision 0 running: ini.version 4 Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit bd02fd76d1909637c95e8ef13e7fd1e748af910d Author: Jiri Pirko Date: Mon Jul 25 10:29:17 2022 +0200 mlxsw: core_linecards: Introduce per line card auxiliary device In order to be eventually able to expose line card gearbox version and possibility to flash FW, model the line card as a separate device on auxiliary bus. Add the auxiliary device for provisioned line card in order to be able to expose provisioned line card info over devlink dev info. When the line card becomes active, there may be other additional info added to the output. Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 7b2d9a1a50ec3bedf067fe234a4a71196c89e826 Author: Jiri Pirko Date: Mon Jul 25 10:29:16 2022 +0200 net: devlink: introduce nested devlink entity for line card For the purpose of exposing device info and allow flash update which is going to be implemented in follow-up patches, introduce a possibility for a line card to expose relation to nested devlink entity. The nested devlink entity represents the line card. Example: $ devlink lc show pci/0000:01:00.0 lc 1 pci/0000:01:00.0: lc 1 state active type 16x100G nested_devlink auxiliary/mlxsw_core.lc.0 supported_types: 16x100G $ devlink dev show auxiliary/mlxsw_core.lc.0 auxiliary/mlxsw_core.lc.0 Signed-off-by: Jiri Pirko Acked-by: Jakub Kicinski Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski commit 294c4f57cfe3303ee2f050d1728c76a401e573a7 Author: Jiri Pirko Date: Mon Jul 25 10:29:15 2022 +0200 net: devlink: move net check into devlinks_xa_for_each_registered_get() Benefit from having devlinks iterator helper devlinks_xa_for_each_registered_get() and move the net pointer check inside. Suggested-by: Jakub Kicinski Signed-off-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit 30bab7cdb56da4819ff081ad658646f2df16c098 Author: Jiri Pirko Date: Mon Jul 25 10:29:14 2022 +0200 net: devlink: make sure that devlink_try_get() works with valid pointer during xarray iteration Remove dependency on devlink_mutex during devlinks xarray iteration. The reason is that devlink_register/unregister() functions taking devlink_mutex would deadlock during devlink reload operation of devlink instance which registers/unregisters nested devlink instances. The devlinks xarray consistency is ensured internally by xarray. There is a reference taken when working with devlink using devlink_try_get(). But there is no guarantee that devlink pointer picked during xarray iteration is not freed before devlink_try_get() is called. Make sure that devlink_try_get() works with valid pointer. Achieve it by: 1) Splitting devlink_put() so the completion is sent only after grace period. Completion unblocks the devlink_unregister() routine, which is followed-up by devlink_free() 2) During devlinks xa_array iteration, get devlink pointer from xa_array holding RCU read lock and taking reference using devlink_try_get() before unlock. Signed-off-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit 957063874c76ff0cba4b62716e708af2a63cdf63 Author: Sadiya Kazi Date: Tue Jul 26 04:12:50 2022 +0000 Documentation: kunit: Add CLI args for kunit_tool Some kunit_tool command line arguments are missing in run_wrapper.rst. Document them. Reported-by: Bagas Sanjaya Reported-by: kernel test robot Reviewed-by: David Gow Reviewed-by: Brendan Higgins Reviewed-by: Daniel Latypov Reviewed-by: Maíra Canal Signed-off-by: Sadiya Kazi Reviewed-by: Bagas Sanjaya Tested-by: Bagas Sanjaya Signed-off-by: Shuah Khan commit 88b61b130334212f8f05175e291c04adeb2bf30b Merge: c808a6ec71661 0828c4a39be57 Author: Mimi Zohar Date: Fri Jul 15 12:54:01 2022 -0400 Merge remote-tracking branch 'linux-integrity/kexec-keyrings' into next-integrity From the cover letter: Currently when loading a kernel image via the kexec_file_load() system call, x86 can make use of three keyrings i.e. the .builtin_trusted_keys, .secondary_trusted_keys and .platform keyrings to verify a signature. However, arm64 and s390 can only use the .builtin_trusted_keys and .platform keyring respectively. For example, one resulting problem is kexec'ing a kernel image would be rejected with the error "Lockdown: kexec: kexec of unsigned images is restricted; see man kernel_lockdown.7". This patch set enables arm64 and s390 to make use of the same keyrings as x86 to verify the signature kexec'ed kernel image. The recently introduced .machine keyring impacts the roots of trust by linking the .machine keyring to the .secondary keyring. The roots of trust for different keyrings are described as follows, .builtin_trusted_keys: Keys may be built into the kernel during build or inserted into memory reserved for keys post build. The root of trust is based on verification of the kernel image signature. For example, on a physical system in a secure boot environment, this trust is rooted in hardware. .machine: If the end-users choose to trust the keys provided by first-stage UEFI bootloader shim i.e. Machine Owner Keys (MOK keys), the keys will be added to this keyring which is linked to the .secondary_trusted_keys keyring as the same as the .builtin_trusted_keys keyring. Shim has built-in keys from a Linux distribution or the end-users-enrolled keys. So the root of trust of this keyring is either a Linux distribution vendor or the end-users. .secondary_trusted_keys: Certificates signed by keys on the .builtin_trusted_keys, .machine, or existing keys on the .secondary_trusted_keys keryings may be loaded onto the .secondary_trusted_keys keyring. This establishes a signature chain of trust based on keys loaded on either the .builtin_trusted_keys or .machine keyrings, if configured and enabled. .platform: The .platform keyring consist of UEFI db and MOK keys which are used by shim to verify the first boot kernel's image signature. If end-users choose to trust MOK keys and the kernel has the .machine keyring enabled, the .platform keyring only consists of UEFI db keys since the MOK keys are added to the .machine keyring instead. Because the end-users could also enroll their own MOK keys, the root of trust could be hardware and the end-users. commit a061a8ad3f906d331020006084558e2acddc2ff7 Author: Ian Rogers Date: Mon Jul 25 15:36:02 2022 -0700 perf test: Avoid sysfs state affecting fake events Icelake has a slots event, on my Skylakex I have CPU events in sysfs of topdown-slots-issued and topdown-total-slots. Legacy event parsing would try to use '-' to separate parts of an event and so perf_pmu__parse_init sets 'slots' to be a PMU_EVENT_SYMBOL_SUFFIX2. As such parsing the slots event for a fake PMU fails as a PMU_EVENT_SYMBOL_SUFFIX2 isn't made into the PE_PMU_EVENT_FAKE token. Resolve this issue by test initializing the PMU parsing state before every parse. This must be done every parse as the state is removes after each parse_events. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Andi Kleen Cc: Caleb Biggers Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Kshipra Bopardikar Cc: Mark Rutland Cc: Maxime Coquelin Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sedat Dilek Cc: Stephane Eranian Cc: Xing Zhengjun Link: http://lore.kernel.org/lkml/20220725223633.2301737-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit bedd17381b9cc34ad20c1d545a4ed2dfbb4d8068 Author: Zhengjun Xing Date: Tue Jun 14 22:50:19 2022 +0800 perf vendor events intel: Update event list for haswellx Update JSON core/uncore events for haswellx to perf. Based on HSX JSON list v24: https://download.01.org/perfmon/HSX Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220614145019.2177071-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 28738de918b530e41b305eb4209e47fe36960529 Author: Zhengjun Xing Date: Tue Jun 14 22:50:18 2022 +0800 perf vendor events intel: Update event list for broadwellx Update JSON core/uncore events for broadwellx to perf. Based on BDX JSON list v19: https://download.01.org/perfmon/BDX Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220614145019.2177071-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b43a5442d894ef66fb861b25680b32acd0e0dd7c Author: Zhengjun Xing Date: Thu Jun 9 17:42:22 2022 +0800 perf vendor events intel: Update event list for Snowridgex More uncore events are added in the converter tool: https://github.com/intel/event-converter-for-linux-perf Keep both alias and the original name for the events, in case someone already used the alias in their script. Generate the perf events based on Snowridgex(SNR) event list v1.20: https://download.01.org/perfmon/SNR/ Signed-off-by: Xing Zhengjun Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220609094222.2030167-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 9146af441315d03efdf95f4d53682f5e621a79a6 Author: Zhengjun Xing Date: Thu Jun 9 17:42:21 2022 +0800 perf vendor events intel: Rename tremontx to snowridgex Tremontx was an old name for Snowridgex, so rename Tremontx to Snowridgex. Reviewed-by: Kan Liang Signed-off-by: Xing Zhengjun Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220609094222.2030167-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 6a92916de5189ee71dfaec50c4708161f02a9270 Author: Zhengjun Xing Date: Tue Jun 7 17:27:49 2022 +0800 perf vendor events intel: Update event list for Sapphirerapids Update JSON event list for Sapphirerapids to perf. Based on JSON list v1.02: https://download.01.org/perfmon/SPR/ Signed-off-by: Xing Zhengjun Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220607092749.1976878-2-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5fa2481cdfe05855ba99a2a9028fd2c9c1af2dcf Author: Zhengjun Xing Date: Tue Jun 7 17:27:48 2022 +0800 perf vendor events intel: Update event list for Alderlake Update JSON event list for Alderlake to perf. It is a hybrid event list for both Atom and Core. Based on JSON list v1.11: https://download.01.org/perfmon/ADL/ Signed-off-by: Xing Zhengjun Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220607092749.1976878-1-zhengjun.xing@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 8147f79ea575463d60ddc0735bceaef89bb34a4c Author: Colin Ian King Date: Thu Jul 21 13:45:28 2022 +0100 perf inject: Fix spelling mistake "theads" -> "threads" There is a spelling mistake in a pr_err message. Fix it. Signed-off-by: Colin Ian King Acked-by: Ian Rogers Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: kernel-janitors@vger.kernel.org Link: https://lore.kernel.org/r/20220721124528.20997-1-colin.i.king@gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit acfb65fe1d11a97fcbac2e9dd857eb60a1af2897 Author: Yang Jihong Date: Sat Jul 9 09:50:33 2022 +0800 perf kwork: Add workqueue trace BPF support Implements workqueue trace bpf function. Test cases: # perf kwork -k workqueue lat -b Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (w)addrconf_verify_work | 0002 | 5.856 ms | 1 | 5.856 ms | 111994.634313 s | 111994.640169 s | (w)vmstat_update | 0001 | 1.247 ms | 1 | 1.247 ms | 111996.462651 s | 111996.463899 s | (w)neigh_periodic_work | 0001 | 1.183 ms | 1 | 1.183 ms | 111996.462789 s | 111996.463973 s | (w)neigh_managed_work | 0001 | 0.989 ms | 2 | 1.635 ms | 111996.462820 s | 111996.464455 s | (w)wb_workfn | 0000 | 0.667 ms | 1 | 0.667 ms | 111996.384273 s | 111996.384940 s | (w)bpf_prog_free_deferred | 0001 | 0.495 ms | 1 | 0.495 ms | 111986.314201 s | 111986.314696 s | (w)mix_interrupt_randomness | 0002 | 0.421 ms | 6 | 0.749 ms | 111995.927750 s | 111995.928499 s | (w)vmstat_shepherd | 0000 | 0.374 ms | 2 | 0.385 ms | 111991.265242 s | 111991.265627 s | (w)e1000_watchdog | 0002 | 0.356 ms | 5 | 0.390 ms | 111994.528380 s | 111994.528770 s | (w)vmstat_update | 0000 | 0.231 ms | 2 | 0.365 ms | 111996.384407 s | 111996.384772 s | (w)flush_to_ldisc | 0006 | 0.165 ms | 1 | 0.165 ms | 111995.930606 s | 111995.930771 s | (w)flush_to_ldisc | 0000 | 0.094 ms | 2 | 0.095 ms | 111996.460453 s | 111996.460548 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k workqueue rep -b Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (w)e1000_watchdog | 0002 | 0.627 ms | 2 | 0.324 ms | 112002.720665 s | 112002.720989 s | (w)flush_to_ldisc | 0007 | 0.598 ms | 2 | 0.534 ms | 112000.875226 s | 112000.875761 s | (w)wq_barrier_func | 0007 | 0.492 ms | 1 | 0.492 ms | 112000.876981 s | 112000.877473 s | (w)flush_to_ldisc | 0007 | 0.281 ms | 1 | 0.281 ms | 112005.826882 s | 112005.827163 s | (w)mix_interrupt_randomness | 0002 | 0.229 ms | 3 | 0.102 ms | 112005.825671 s | 112005.825774 s | (w)vmstat_shepherd | 0000 | 0.202 ms | 1 | 0.202 ms | 112001.504511 s | 112001.504713 s | (w)bpf_prog_free_deferred | 0001 | 0.181 ms | 1 | 0.181 ms | 112000.883251 s | 112000.883432 s | (w)wb_workfn | 0007 | 0.130 ms | 1 | 0.130 ms | 112001.505195 s | 112001.505325 s | (w)vmstat_update | 0000 | 0.053 ms | 1 | 0.053 ms | 112001.504763 s | 112001.504815 s | -------------------------------------------------------------------------------------------------------------------------------- Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-18-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 5a81927a407c050ab870a253b2684a7e48d604a3 Author: Yang Jihong Date: Sat Jul 9 09:50:32 2022 +0800 perf kwork: Add softirq trace BPF support Implements softirq trace bpf function. Test cases: Trace softirq latency without filter: # perf kwork -k softirq lat -b Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)RCU:9 | 0005 | 0.281 ms | 3 | 0.338 ms | 111295.752222 s | 111295.752560 s | (s)RCU:9 | 0002 | 0.262 ms | 24 | 1.400 ms | 111301.335986 s | 111301.337386 s | (s)SCHED:7 | 0005 | 0.177 ms | 14 | 0.212 ms | 111295.752270 s | 111295.752481 s | (s)RCU:9 | 0007 | 0.161 ms | 47 | 2.022 ms | 111295.402159 s | 111295.404181 s | (s)NET_RX:3 | 0003 | 0.149 ms | 12 | 1.261 ms | 111301.192964 s | 111301.194225 s | (s)TIMER:1 | 0001 | 0.105 ms | 9 | 0.198 ms | 111301.180191 s | 111301.180389 s | ... ... (s)NET_RX:3 | 0002 | 0.098 ms | 6 | 0.124 ms | 111295.403760 s | 111295.403884 s | (s)SCHED:7 | 0001 | 0.093 ms | 19 | 0.242 ms | 111301.180256 s | 111301.180498 s | (s)SCHED:7 | 0007 | 0.078 ms | 15 | 0.188 ms | 111300.064226 s | 111300.064415 s | (s)SCHED:7 | 0004 | 0.077 ms | 11 | 0.213 ms | 111301.361759 s | 111301.361973 s | (s)SCHED:7 | 0000 | 0.063 ms | 33 | 0.805 ms | 111295.401811 s | 111295.402616 s | (s)SCHED:7 | 0003 | 0.063 ms | 14 | 0.085 ms | 111301.192255 s | 111301.192340 s | -------------------------------------------------------------------------------------------------------------------------------- Trace softirq latency with cpu filter: # perf kwork -k softirq lat -b -C 1 Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)RCU:9 | 0001 | 0.178 ms | 5 | 0.572 ms | 111435.534135 s | 111435.534707 s | -------------------------------------------------------------------------------------------------------------------------------- Trace softirq latency with name filter: # perf kwork -k softirq lat -b -n SCHED Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)SCHED:7 | 0001 | 0.295 ms | 15 | 2.183 ms | 111452.534950 s | 111452.537133 s | (s)SCHED:7 | 0002 | 0.215 ms | 10 | 0.315 ms | 111460.000238 s | 111460.000553 s | (s)SCHED:7 | 0005 | 0.190 ms | 29 | 0.338 ms | 111457.032538 s | 111457.032876 s | (s)SCHED:7 | 0003 | 0.097 ms | 10 | 0.319 ms | 111452.434351 s | 111452.434670 s | (s)SCHED:7 | 0006 | 0.089 ms | 1 | 0.089 ms | 111450.737450 s | 111450.737539 s | (s)SCHED:7 | 0007 | 0.085 ms | 17 | 0.169 ms | 111452.471333 s | 111452.471502 s | (s)SCHED:7 | 0004 | 0.071 ms | 15 | 0.221 ms | 111452.535252 s | 111452.535473 s | (s)SCHED:7 | 0000 | 0.044 ms | 32 | 0.130 ms | 111460.001982 s | 111460.002112 s | -------------------------------------------------------------------------------------------------------------------------------- Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-17-yangjihong1@huawei.com [ Add {} for multiline if blocks ] Signed-off-by: Arnaldo Carvalho de Melo commit 420298aefe94840f577a711add335105306faece Author: Yang Jihong Date: Sat Jul 9 09:50:31 2022 +0800 perf kwork: Add IRQ trace BPF support Implements irq trace bpf function. Test cases: Trace irq without filter: # perf kwork -k irq rep -b Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 31.026 ms | 285 | 1.493 ms | 110326.049963 s | 110326.051456 s | eth0:10 | 0002 | 7.875 ms | 96 | 1.429 ms | 110313.916835 s | 110313.918264 s | ata_piix:14 | 0002 | 2.510 ms | 28 | 0.396 ms | 110331.367987 s | 110331.368383 s | -------------------------------------------------------------------------------------------------------------------------------- Trace irq with cpu filter: # perf kwork -k irq rep -b -C 0 Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 34.288 ms | 282 | 2.061 ms | 110358.078968 s | 110358.081029 s | -------------------------------------------------------------------------------------------------------------------------------- Trace irq with name filter: # perf kwork -k irq rep -b -n eth0 Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- eth0:10 | 0002 | 2.184 ms | 21 | 0.572 ms | 110386.541699 s | 110386.542271 s | -------------------------------------------------------------------------------------------------------------------------------- Trace irq with summary: # perf kwork -k irq rep -b -S Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 42.923 ms | 285 | 1.181 ms | 110418.128867 s | 110418.130049 s | eth0:10 | 0002 | 2.085 ms | 20 | 0.668 ms | 110416.002935 s | 110416.003603 s | ata_piix:14 | 0002 | 0.970 ms | 4 | 0.656 ms | 110424.034482 s | 110424.035138 s | -------------------------------------------------------------------------------------------------------------------------------- Total count : 309 Total runtime (msec) : 45.977 (0.003% load average) Total time span (msec) : 17017.655 -------------------------------------------------------------------------------------------------------------------------------- Committer testing: # perf kwork -k irq rep -b Starting trace, Hit to stop and report ^C Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- nvme0q20:145 | 0019 | 0.570 ms | 28 | 0.064 ms | 26966.635102 s | 26966.635167 s | amdgpu:162 | 0002 | 0.568 ms | 29 | 0.068 ms | 26966.644346 s | 26966.644414 s | nvme0q4:129 | 0003 | 0.565 ms | 31 | 0.037 ms | 26966.614830 s | 26966.614866 s | nvme0q16:141 | 0015 | 0.205 ms | 66 | 0.012 ms | 26967.145161 s | 26967.145174 s | nvme0q29:154 | 0028 | 0.154 ms | 44 | 0.014 ms | 26967.078970 s | 26967.078984 s | nvme0q10:135 | 0009 | 0.134 ms | 43 | 0.011 ms | 26967.132093 s | 26967.132104 s | nvme0q2:127 | 0001 | 0.132 ms | 26 | 0.011 ms | 26966.883584 s | 26966.883595 s | nvme0q25:150 | 0024 | 0.127 ms | 32 | 0.014 ms | 26966.631419 s | 26966.631433 s | nvme0q14:139 | 0013 | 0.110 ms | 21 | 0.017 ms | 26966.760843 s | 26966.760861 s | nvme0q30:155 | 0029 | 0.102 ms | 30 | 0.022 ms | 26966.677171 s | 26966.677193 s | nvme0q13:138 | 0012 | 0.088 ms | 20 | 0.015 ms | 26966.738733 s | 26966.738748 s | nvme0q6:131 | 0005 | 0.087 ms | 13 | 0.020 ms | 26966.648445 s | 26966.648465 s | nvme0q28:153 | 0027 | 0.066 ms | 12 | 0.015 ms | 26966.771431 s | 26966.771447 s | nvme0q26:151 | 0025 | 0.060 ms | 13 | 0.012 ms | 26966.704266 s | 26966.704278 s | nvme0q21:146 | 0020 | 0.054 ms | 20 | 0.011 ms | 26967.322082 s | 26967.322094 s | nvme0q1:126 | 0000 | 0.046 ms | 11 | 0.013 ms | 26966.859754 s | 26966.859767 s | nvme0q17:142 | 0016 | 0.046 ms | 10 | 0.011 ms | 26967.114513 s | 26967.114524 s | xhci_hcd:74 | 0015 | 0.041 ms | 3 | 0.016 ms | 26967.086004 s | 26967.086020 s | nvme0q8:133 | 0007 | 0.039 ms | 12 | 0.008 ms | 26966.712056 s | 26966.712063 s | nvme0q32:157 | 0031 | 0.036 ms | 10 | 0.014 ms | 26966.627054 s | 26966.627068 s | nvme0q9:134 | 0008 | 0.036 ms | 11 | 0.011 ms | 26967.258452 s | 26967.258462 s | nvme0q7:132 | 0006 | 0.024 ms | 3 | 0.014 ms | 26966.767404 s | 26966.767418 s | nvme0q11:136 | 0010 | 0.023 ms | 5 | 0.006 ms | 26966.935455 s | 26966.935461 s | nvme0q31:156 | 0030 | 0.018 ms | 5 | 0.006 ms | 26966.627517 s | 26966.627524 s | nvme0q12:137 | 0011 | 0.015 ms | 2 | 0.014 ms | 26966.799588 s | 26966.799602 s | enp5s0-rx-0:164 | 0006 | 0.009 ms | 2 | 0.005 ms | 26966.742024 s | 26966.742028 s | enp5s0-rx-1:165 | 0007 | 0.006 ms | 2 | 0.004 ms | 26966.939486 s | 26966.939490 s | enp5s0-tx-0:166 | 0008 | 0.005 ms | 1 | 0.005 ms | 26966.939484 s | 26966.939489 s | enp5s0-tx-1:167 | 0009 | 0.005 ms | 1 | 0.005 ms | 26966.939484 s | 26966.939489 s | -------------------------------------------------------------------------------------------------------------------------------- #t Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-16-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit daf07d220710a3c8a3a6d2170486fa9d2b1f80fd Author: Yang Jihong Date: Sat Jul 9 09:50:30 2022 +0800 perf kwork: Implement BPF trace 'perf record' generates perf.data, which generates extra interrupts for hard disk, amount of data to be collected increases with time. Using eBPF trace can process the data in kernel, which solves the preceding two problems. Add -b/--use-bpf option for latency and report to support tracing kwork events using eBPF: 1. Create bpf prog and attach to tracepoints, 2. Start tracing after command is entered, 3. After user hit "ctrl+c", stop tracing and report, 4. Support CPU and name filtering. This commit implements the framework code and does not add specific event support. Test cases: # perf kwork rep -h Usage: perf kwork report [] -b, --use-bpf Use BPF to measure kwork runtime -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): runtime, max, count -S, --with-summary Show summary with statistics --time Time span for analysis (start,stop) # perf kwork lat -h Usage: perf kwork latency [] -b, --use-bpf Use BPF to measure kwork latency -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): avg, max, count --time Time span for analysis (start,stop) # perf kwork lat -b Unsupported bpf trace class irq # perf kwork rep -b Unsupported bpf trace class irq Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-15-yangjihong1@huawei.com [ Simplify work_findnew() ] Signed-off-by: Arnaldo Carvalho de Melo commit bcc8b3e88d6fa1a3a3662bfebd26214b62b61c81 Author: Yang Jihong Date: Sat Jul 9 09:50:29 2022 +0800 perf kwork: Implement perf kwork timehist Implements framework of perf kwork timehist, to provide an analysis of kernel work events. Test cases: # perf kwork tim Runtime start Runtime end Cpu Kwork name Runtime Delaytime (TYPE)NAME:NUM (msec) (msec) ----------------- ----------------- ------ ------------------------------ ---------- ---------- 91576.060290 91576.060344 [0000] (s)RCU:9 0.055 0.111 91576.061470 91576.061547 [0000] (s)SCHED:7 0.077 0.073 91576.062604 91576.062697 [0001] (s)RCU:9 0.094 0.409 91576.064443 91576.064517 [0002] (s)RCU:9 0.074 0.114 91576.065144 91576.065211 [0000] (s)SCHED:7 0.067 0.058 91576.066564 91576.066609 [0003] (s)RCU:9 0.045 0.110 91576.068495 91576.068559 [0000] (s)SCHED:7 0.064 0.059 91576.068900 91576.068996 [0004] (s)RCU:9 0.096 0.726 91576.069364 91576.069420 [0002] (s)RCU:9 0.056 0.082 91576.069649 91576.069701 [0004] (s)RCU:9 0.052 0.111 91576.070147 91576.070206 [0000] (s)SCHED:7 0.060 0.057 91576.073147 91576.073202 [0000] (s)SCHED:7 0.054 0.060 # perf kwork tim --max-stack 2 -g Runtime start Runtime end Cpu Kwork name Runtime Delaytime (TYPE)NAME:NUM (msec) (msec) ----------------- ----------------- ------ ------------------------------ ---------- ---------- 91576.060290 91576.060344 [0000] (s)RCU:9 0.055 0.111 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.061470 91576.061547 [0000] (s)SCHED:7 0.077 0.073 irq_exit_rcu <- sysvec_call_function_single 91576.062604 91576.062697 [0001] (s)RCU:9 0.094 0.409 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.064443 91576.064517 [0002] (s)RCU:9 0.074 0.114 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.065144 91576.065211 [0000] (s)SCHED:7 0.067 0.058 irq_exit_rcu <- sysvec_call_function_single 91576.066564 91576.066609 [0003] (s)RCU:9 0.045 0.110 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.068495 91576.068559 [0000] (s)SCHED:7 0.064 0.059 irq_exit_rcu <- sysvec_call_function_single 91576.068900 91576.068996 [0004] (s)RCU:9 0.096 0.726 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.069364 91576.069420 [0002] (s)RCU:9 0.056 0.082 irq_exit_rcu <- sysvec_apic_timer_interrupt 91576.069649 91576.069701 [0004] (s)RCU:9 0.052 0.111 irq_exit_rcu <- sysvec_apic_timer_interrupt Committer testing: # perf kwork -k workqueue timehist | head -40 Runtime start Runtime end Cpu Kwork name Runtime Delaytime (TYPE)NAME:NUM (msec) (msec) ----------------- ----------------- ------ ------------------------------ ---------- ---------- 26520.211825 26520.211832 [0019] (w)free_work 0.007 0.004 26520.212929 26520.212934 [0020] (w)free_work 0.005 0.004 26520.213226 26520.213228 [0014] (w)kfree_rcu_work 0.002 0.004 26520.214057 26520.214061 [0021] (w)free_work 0.004 0.004 26520.221239 26520.221241 [0007] (w)kfree_rcu_work 0.002 0.009 26520.223232 26520.223238 [0013] (w)psi_avgs_work 0.005 0.006 26520.230057 26520.230060 [0020] (w)free_work 0.003 0.003 26520.270428 26520.270434 [0015] (w)free_work 0.006 0.004 26520.270546 26520.270550 [0014] (w)free_work 0.004 0.003 26520.281626 26520.281629 [0015] (w)free_work 0.003 0.002 26520.287225 26520.287230 [0012] (w)psi_avgs_work 0.005 0.008 26520.287231 26520.287235 [0001] (w)psi_avgs_work 0.004 0.011 26520.287236 26520.287239 [0001] (w)psi_avgs_work 0.003 0.012 26520.329488 26520.329492 [0024] (w)free_work 0.004 0.004 26520.330600 26520.330605 [0007] (w)free_work 0.005 0.004 26520.334218 26520.334218 [0007] (w)kfree_rcu_monitor 0.001 0.002 26520.335220 26520.335221 [0005] (w)kfree_rcu_monitor 0.001 0.004 26520.343980 26520.343985 [0007] (w)free_work 0.005 0.002 26520.345093 26520.345097 [0006] (w)free_work 0.004 0.003 26520.351233 26520.351238 [0027] (w)psi_avgs_work 0.005 0.008 26520.353228 26520.353229 [0007] (w)kfree_rcu_work 0.001 0.002 26520.353229 26520.353231 [0005] (w)kfree_rcu_work 0.001 0.006 26520.382381 26520.382383 [0006] (w)free_work 0.003 0.002 26520.386547 26520.386548 [0006] (w)free_work 0.002 0.001 26520.391243 26520.391245 [0015] (w)console_callback 0.002 0.016 26520.415369 26520.415621 [0027] (w)btrfs_work_helper 0.252 26520.415351 26520.416174 [0002] (w)btrfs_work_helper 0.823 0.037 26520.415343 26520.416304 [0031] (w)btrfs_work_helper 0.961 26520.415335 26520.417078 [0001] (w)btrfs_work_helper 1.743 26520.415250 26520.417564 [0002] (w)wb_workfn 2.314 26520.424777 26520.424787 [0002] (w)btrfs_work_helper 0.010 26520.424788 26520.424798 [0002] (w)btrfs_work_helper 0.010 26520.424790 26520.424805 [0001] (w)btrfs_work_helper 0.016 0.016 26520.424801 26520.424807 [0002] (w)btrfs_work_helper 0.006 26520.424809 26520.424831 [0002] (w)btrfs_work_helper 0.022 0.030 26520.424824 26520.424835 [0027] (w)btrfs_work_helper 0.011 26520.424809 26520.424867 [0001] (w)btrfs_work_helper 0.059 0.032 # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-14-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 53e49e32ae651984463b536fa379eab5149b5ead Author: Yang Jihong Date: Sat Jul 9 09:50:28 2022 +0800 perf kwork: Add workqueue latency support Implements workqueue latency function. Test cases: # perf kwork -k workqueue lat Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (w)vmstat_update | 0001 | 5.004 ms | 1 | 5.004 ms | 44001.745646 s | 44001.750650 s | (w)vmstat_update | 0006 | 1.773 ms | 1 | 1.773 ms | 44000.830840 s | 44000.832613 s | (w)vmstat_shepherd | 0000 | 0.992 ms | 8 | 2.474 ms | 44007.717845 s | 44007.720318 s | (w)vmstat_update | 0000 | 0.974 ms | 5 | 2.624 ms | 44004.785970 s | 44004.788594 s | (w)e1000_watchdog | 0002 | 0.687 ms | 5 | 2.632 ms | 44005.009334 s | 44005.011966 s | (w)vmstat_update | 0002 | 0.307 ms | 1 | 0.307 ms | 44004.817395 s | 44004.817702 s | (w)vmstat_update | 0004 | 0.296 ms | 1 | 0.296 ms | 43997.913677 s | 43997.913973 s | (w)mix_interrupt_randomness | 0000 | 0.283 ms | 285 | 3.724 ms | 44006.790889 s | 44006.794613 s | (w)neigh_managed_work | 0001 | 0.271 ms | 1 | 0.271 ms | 43997.665542 s | 43997.665813 s | (w)vmstat_update | 0005 | 0.261 ms | 1 | 0.261 ms | 44007.820542 s | 44007.820803 s | (w)neigh_managed_work | 0004 | 0.220 ms | 1 | 0.220 ms | 44002.953287 s | 44002.953507 s | (w)neigh_periodic_work | 0004 | 0.217 ms | 1 | 0.217 ms | 43999.929718 s | 43999.929935 s | (w)mix_interrupt_randomness | 0002 | 0.199 ms | 5 | 0.310 ms | 44005.012316 s | 44005.012625 s | (w)vmstat_update | 0003 | 0.199 ms | 4 | 0.307 ms | 44005.714391 s | 44005.714699 s | (w)gc_worker | 0001 | 0.071 ms | 173 | 1.128 ms | 44002.062579 s | 44002.063707 s | -------------------------------------------------------------------------------------------------------------------------------- INFO: 0.020% skipped events (17 including 10 raise, 7 entry, 0 exit) Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-13-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 19807bba5ad612c4f95139152aa059c4efb4aba7 Author: Yang Jihong Date: Sat Jul 9 09:50:27 2022 +0800 perf kwork: Add softirq latency support Implements softirq latency function. Test cases: # perf kwork -k softirq lat Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0006 | 1.048 ms | 1 | 1.048 ms | 44000.829759 s | 44000.830807 s | (s)TIMER:1 | 0001 | 1.008 ms | 4 | 3.434 ms | 43997.662069 s | 43997.665503 s | (s)RCU:9 | 0006 | 0.675 ms | 7 | 1.328 ms | 43997.670304 s | 43997.671632 s | (s)RCU:9 | 0000 | 0.414 ms | 701 | 3.996 ms | 43997.661170 s | 43997.665167 s | (s)RCU:9 | 0005 | 0.245 ms | 88 | 1.866 ms | 43997.683105 s | 43997.684971 s | (s)SCHED:7 | 0000 | 0.158 ms | 677 | 2.639 ms | 44004.785716 s | 44004.788355 s | ... ... (s)RCU:9 | 0002 | 0.141 ms | 932 | 1.662 ms | 44005.010206 s | 44005.011868 s | (s)RCU:9 | 0003 | 0.129 ms | 2193 | 1.507 ms | 44006.010208 s | 44006.011715 s | (s)TIMER:1 | 0005 | 0.128 ms | 1 | 0.128 ms | 44007.820346 s | 44007.820474 s | (s)SCHED:7 | 0002 | 0.040 ms | 1731 | 0.211 ms | 44005.009237 s | 44005.009447 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k softirq lat -C 1,2 Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0001 | 1.008 ms | 4 | 3.434 ms | 43997.662069 s | 43997.665503 s | (s)RCU:9 | 0001 | 0.216 ms | 1619 | 3.659 ms | 43997.662069 s | 43997.665727 s | (s)RCU:9 | 0002 | 0.141 ms | 932 | 1.662 ms | 44005.010206 s | 44005.011868 s | (s)NET_RX:3 | 0002 | 0.106 ms | 5 | 0.163 ms | 44005.012255 s | 44005.012418 s | (s)TIMER:1 | 0002 | 0.084 ms | 9 | 0.114 ms | 44005.009168 s | 44005.009282 s | (s)SCHED:7 | 0001 | 0.049 ms | 655 | 0.837 ms | 44005.707998 s | 44005.708835 s | (s)SCHED:7 | 0002 | 0.040 ms | 1731 | 0.211 ms | 44005.009237 s | 44005.009447 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k softirq lat -n RCU Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)RCU:9 | 0006 | 0.675 ms | 7 | 1.328 ms | 43997.670304 s | 43997.671632 s | (s)RCU:9 | 0000 | 0.414 ms | 701 | 3.996 ms | 43997.661170 s | 43997.665167 s | (s)RCU:9 | 0005 | 0.245 ms | 88 | 1.866 ms | 43997.683105 s | 43997.684971 s | (s)RCU:9 | 0004 | 0.237 ms | 26 | 0.792 ms | 43997.683018 s | 43997.683810 s | (s)RCU:9 | 0007 | 0.217 ms | 140 | 1.335 ms | 43997.671080 s | 43997.672415 s | (s)RCU:9 | 0001 | 0.216 ms | 1619 | 3.659 ms | 43997.662069 s | 43997.665727 s | (s)RCU:9 | 0002 | 0.141 ms | 932 | 1.662 ms | 44005.010206 s | 44005.011868 s | (s)RCU:9 | 0003 | 0.129 ms | 2193 | 1.507 ms | 44006.010208 s | 44006.011715 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k softirq lat -s count,avg -n RCU Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)RCU:9 | 0003 | 0.129 ms | 2193 | 1.507 ms | 44006.010208 s | 44006.011715 s | (s)RCU:9 | 0001 | 0.216 ms | 1619 | 3.659 ms | 43997.662069 s | 43997.665727 s | (s)RCU:9 | 0002 | 0.141 ms | 932 | 1.662 ms | 44005.010206 s | 44005.011868 s | (s)RCU:9 | 0000 | 0.414 ms | 701 | 3.996 ms | 43997.661170 s | 43997.665167 s | (s)RCU:9 | 0007 | 0.217 ms | 140 | 1.335 ms | 43997.671080 s | 43997.672415 s | (s)RCU:9 | 0005 | 0.245 ms | 88 | 1.866 ms | 43997.683105 s | 43997.684971 s | (s)RCU:9 | 0004 | 0.237 ms | 26 | 0.792 ms | 43997.683018 s | 43997.683810 s | (s)RCU:9 | 0006 | 0.675 ms | 7 | 1.328 ms | 43997.670304 s | 43997.671632 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k softirq lat --time 43997, Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0006 | 1.048 ms | 1 | 1.048 ms | 44000.829759 s | 44000.830807 s | (s)TIMER:1 | 0001 | 1.008 ms | 4 | 3.434 ms | 43997.662069 s | 43997.665503 s | (s)RCU:9 | 0006 | 0.675 ms | 7 | 1.328 ms | 43997.670304 s | 43997.671632 s | (s)RCU:9 | 0000 | 0.414 ms | 701 | 3.996 ms | 43997.661170 s | 43997.665167 s | (s)TIMER:1 | 0004 | 0.083 ms | 21 | 0.127 ms | 44004.969171 s | 44004.969298 s | ... ... (s)SCHED:7 | 0005 | 0.050 ms | 4 | 0.086 ms | 43997.684852 s | 43997.684938 s | (s)SCHED:7 | 0001 | 0.049 ms | 655 | 0.837 ms | 44005.707998 s | 44005.708835 s | (s)SCHED:7 | 0007 | 0.044 ms | 171 | 0.077 ms | 43997.943265 s | 43997.943342 s | (s)SCHED:7 | 0002 | 0.040 ms | 1731 | 0.211 ms | 44005.009237 s | 44005.009447 s | -------------------------------------------------------------------------------------------------------------------------------- Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-12-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit ad3d9f7a929ab2df9615f3068f2c1c61bdbd4535 Author: Yang Jihong Date: Sat Jul 9 09:50:26 2022 +0800 perf kwork: Implement perf kwork latency Implements framework of perf kwork latency, which is used to report time properties such as delay time and frequency. Test cases: # perf kwork lat -h Usage: perf kwork latency [] -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): avg, max, count --time Time span for analysis (start,stop) # perf kwork lat -C 199 Requested CPU 199 too large. Consider raising MAX_NR_CPUS Invalid cpu bitmap # perf kwork lat -i perf_no_exist.data failed to open perf_no_exist.data: No such file or directory # perf kwork lat -s avg1 Error: Unknown --sort key: `avg1' Usage: perf kwork latency [] -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): avg, max, count --time Time span for analysis (start,stop) # perf kwork lat --time FFFF, Invalid time span # perf kwork lat Kwork Name | Cpu | Avg delay | Count | Max delay | Max delay start | Max delay end | -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- INFO: 36.570% skipped events (31537 including 0 raise, 31537 entry, 0 exit) Since there are no latency-enabled events, the output is empty. Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-11-yangjihong1@huawei.com [ Add {} for multiline if blocks ] Signed-off-by: Arnaldo Carvalho de Melo commit 8dbc3c86896f75cd3b23926fe04ced49b92796e4 Author: Yang Jihong Date: Sat Jul 9 09:50:25 2022 +0800 perf kwork: Add workqueue report support Implements workqueue report function. Test cases: # perf kwork -k workqueue rep Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (w)gc_worker | 0001 | 1912.389 ms | 173 | 12.896 ms | 44002.050787 s | 44002.063683 s | (w)mix_interrupt_randomness | 0000 | 24.308 ms | 285 | 3.349 ms | 44004.784908 s | 44004.788257 s | (w)e1000_watchdog | 0002 | 5.332 ms | 5 | 2.059 ms | 44000.914366 s | 44000.916424 s | (w)vmstat_update | 0005 | 0.989 ms | 2 | 0.953 ms | 43997.986991 s | 43997.987944 s | (w)vmstat_shepherd | 0000 | 0.964 ms | 8 | 0.195 ms | 43997.986453 s | 43997.986648 s | (w)vmstat_update | 0003 | 0.306 ms | 6 | 0.077 ms | 44004.689543 s | 44004.689620 s | (w)vmstat_update | 0000 | 0.196 ms | 5 | 0.049 ms | 44005.713732 s | 44005.713781 s | (w)vmstat_update | 0001 | 0.162 ms | 2 | 0.130 ms | 44000.192034 s | 44000.192164 s | (w)mix_interrupt_randomness | 0002 | 0.114 ms | 5 | 0.037 ms | 44005.012625 s | 44005.012662 s | (w)vmstat_update | 0002 | 0.084 ms | 2 | 0.043 ms | 44004.817702 s | 44004.817745 s | (w)vmstat_update | 0006 | 0.067 ms | 2 | 0.041 ms | 43997.987214 s | 43997.987254 s | (w)neigh_periodic_work | 0004 | 0.039 ms | 1 | 0.039 ms | 43999.929935 s | 43999.929974 s | (w)vmstat_update | 0007 | 0.037 ms | 1 | 0.037 ms | 43997.988969 s | 43997.989006 s | (w)neigh_managed_work | 0001 | 0.036 ms | 1 | 0.036 ms | 43997.665813 s | 43997.665849 s | (w)neigh_managed_work | 0004 | 0.036 ms | 1 | 0.036 ms | 44002.953507 s | 44002.953543 s | (w)vmstat_update | 0004 | 0.027 ms | 1 | 0.027 ms | 43997.913973 s | 43997.914000 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k workqueue rep -S Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (w)gc_worker | 0001 | 1912.389 ms | 173 | 12.896 ms | 44002.050787 s | 44002.063683 s | (w)mix_interrupt_randomness | 0000 | 24.308 ms | 285 | 3.349 ms | 44004.784908 s | 44004.788257 s | (w)e1000_watchdog | 0002 | 5.332 ms | 5 | 2.059 ms | 44000.914366 s | 44000.916424 s | (w)vmstat_update | 0005 | 0.989 ms | 2 | 0.953 ms | 43997.986991 s | 43997.987944 s | (w)vmstat_shepherd | 0000 | 0.964 ms | 8 | 0.195 ms | 43997.986453 s | 43997.986648 s | (w)vmstat_update | 0003 | 0.306 ms | 6 | 0.077 ms | 44004.689543 s | 44004.689620 s | (w)vmstat_update | 0000 | 0.196 ms | 5 | 0.049 ms | 44005.713732 s | 44005.713781 s | (w)vmstat_update | 0001 | 0.162 ms | 2 | 0.130 ms | 44000.192034 s | 44000.192164 s | (w)mix_interrupt_randomness | 0002 | 0.114 ms | 5 | 0.037 ms | 44005.012625 s | 44005.012662 s | (w)vmstat_update | 0002 | 0.084 ms | 2 | 0.043 ms | 44004.817702 s | 44004.817745 s | (w)vmstat_update | 0006 | 0.067 ms | 2 | 0.041 ms | 43997.987214 s | 43997.987254 s | (w)neigh_periodic_work | 0004 | 0.039 ms | 1 | 0.039 ms | 43999.929935 s | 43999.929974 s | (w)vmstat_update | 0007 | 0.037 ms | 1 | 0.037 ms | 43997.988969 s | 43997.989006 s | (w)neigh_managed_work | 0001 | 0.036 ms | 1 | 0.036 ms | 43997.665813 s | 43997.665849 s | (w)neigh_managed_work | 0004 | 0.036 ms | 1 | 0.036 ms | 44002.953507 s | 44002.953543 s | (w)vmstat_update | 0004 | 0.027 ms | 1 | 0.027 ms | 43997.913973 s | 43997.914000 s | -------------------------------------------------------------------------------------------------------------------------------- Total count : 500 Total runtime (msec) : 1945.085 (0.192% load average) Total time span (msec) : 10155.026 -------------------------------------------------------------------------------------------------------------------------------- # perf kwork -k workqueue rep -n vmstat_update Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (w)vmstat_update | 0005 | 0.989 ms | 2 | 0.953 ms | 43997.986991 s | 43997.987944 s | (w)vmstat_update | 0003 | 0.306 ms | 6 | 0.077 ms | 44004.689543 s | 44004.689620 s | (w)vmstat_update | 0000 | 0.196 ms | 5 | 0.049 ms | 44005.713732 s | 44005.713781 s | (w)vmstat_update | 0001 | 0.162 ms | 2 | 0.130 ms | 44000.192034 s | 44000.192164 s | (w)vmstat_update | 0002 | 0.084 ms | 2 | 0.043 ms | 44004.817702 s | 44004.817745 s | (w)vmstat_update | 0006 | 0.067 ms | 2 | 0.041 ms | 43997.987214 s | 43997.987254 s | (w)vmstat_update | 0007 | 0.037 ms | 1 | 0.037 ms | 43997.988969 s | 43997.989006 s | (w)vmstat_update | 0004 | 0.027 ms | 1 | 0.027 ms | 43997.913973 s | 43997.914000 s | -------------------------------------------------------------------------------------------------------------------------------- Committer testing: # perf kwork -k workqueue rep -C 1 | head -20 Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (w)commit_work | 0001 | 25.896 ms | 2 | 13.200 ms | 26522.906700 s | 26522.919900 s | (w)commit_work | 0001 | 13.316 ms | 1 | 13.316 ms | 26522.573246 s | 26522.586562 s | (w)commit_work | 0001 | 13.177 ms | 1 | 13.177 ms | 26522.673406 s | 26522.686583 s | (w)commit_work | 0001 | 12.630 ms | 1 | 12.630 ms | 26522.123921 s | 26522.136551 s | (w)btrfs_work_helper | 0001 | 3.544 ms | 1 | 3.544 ms | 26529.131296 s | 26529.134840 s | (w)btrfs_work_helper | 0001 | 3.330 ms | 1 | 3.330 ms | 26529.137698 s | 26529.141028 s | (w)btrfs_work_helper | 0001 | 2.855 ms | 1 | 2.855 ms | 26529.134842 s | 26529.137697 s | (w)btrfs_work_helper | 0001 | 2.757 ms | 1 | 2.757 ms | 26529.124086 s | 26529.126843 s | (w)btrfs_work_helper | 0001 | 2.182 ms | 1 | 2.182 ms | 26529.141030 s | 26529.143212 s | (w)btrfs_work_helper | 0001 | 1.743 ms | 1 | 1.743 ms | 26520.415335 s | 26520.417078 s | (w)btrfs_work_helper | 0001 | 1.499 ms | 1 | 1.499 ms | 26529.127774 s | 26529.129272 s | (w)btrfs_work_helper | 0001 | 1.446 ms | 1 | 1.446 ms | 26529.129848 s | 26529.131294 s | (w)btrfs_work_helper | 0001 | 1.373 ms | 1 | 1.373 ms | 26523.808270 s | 26523.809643 s | (w)wb_workfn | 0001 | 1.165 ms | 2 | 0.763 ms | 26527.071056 s | 26527.071819 s | (w)btrfs_work_helper | 0001 | 0.926 ms | 1 | 0.926 ms | 26529.126846 s | 26529.127771 s | (w)btrfs_work_helper | 0001 | 0.571 ms | 1 | 0.571 ms | 26529.129275 s | 26529.129846 s | (w)wb_workfn | 0001 | 0.525 ms | 1 | 0.525 ms | 26522.975151 s | 26522.975676 s | # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-10-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 4c14819169b7a89b0fd016c0e7c2f1e50a82744c Author: Yang Jihong Date: Sat Jul 9 09:50:24 2022 +0800 perf kwork: Add softirq report support Implements softirq kwork report function. Test cases: # perf kwork -k softirq rep Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0003 | 181.387 ms | 2476 | 1.240 ms | 44004.787960 s | 44004.789201 s | (s)RCU:9 | 0003 | 91.573 ms | 2193 | 0.650 ms | 44004.790258 s | 44004.790908 s | (s)RCU:9 | 0001 | 78.960 ms | 1619 | 1.195 ms | 44001.496553 s | 44001.497749 s | (s)SCHED:7 | 0003 | 55.962 ms | 1255 | 0.954 ms | 44004.812008 s | 44004.812962 s | ... ... (s)RCU:9 | 0004 | 0.830 ms | 26 | 0.058 ms | 43997.666418 s | 43997.666476 s | (s)TIMER:1 | 0001 | 0.471 ms | 4 | 0.158 ms | 44007.834694 s | 44007.834852 s | (s)RCU:9 | 0006 | 0.220 ms | 7 | 0.048 ms | 44004.833764 s | 44004.833812 s | (s)NET_RX:3 | 0002 | 0.164 ms | 5 | 0.049 ms | 44005.012418 s | 44005.012466 s | (s)TIMER:1 | 0005 | 0.164 ms | 1 | 0.164 ms | 44007.820474 s | 44007.820638 s | (s)TIMER:1 | 0006 | 0.087 ms | 1 | 0.087 ms | 44000.830807 s | 44000.830894 s | (s)SCHED:7 | 0006 | 0.080 ms | 2 | 0.044 ms | 43997.826145 s | 43997.826189 s | -------------------------------------------------------------------------------------------------------------------------------- # # perf kwork -k softirq rep -S Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0003 | 181.387 ms | 2476 | 1.240 ms | 44004.787960 s | 44004.789201 s | (s)RCU:9 | 0003 | 91.573 ms | 2193 | 0.650 ms | 44004.790258 s | 44004.790908 s | (s)RCU:9 | 0001 | 78.960 ms | 1619 | 1.195 ms | 44001.496553 s | 44001.497749 s | (s)SCHED:7 | 0000 | 63.631 ms | 680 | 2.690 ms | 44006.721976 s | 44006.724666 s | ... ... (s)SCHED:7 | 0003 | 55.962 ms | 1255 | 0.954 ms | 44004.812008 s | 44004.812962 s | (s)RCU:9 | 0006 | 0.220 ms | 7 | 0.048 ms | 44004.833764 s | 44004.833812 s | (s)NET_RX:3 | 0002 | 0.164 ms | 5 | 0.049 ms | 44005.012418 s | 44005.012466 s | (s)TIMER:1 | 0005 | 0.164 ms | 1 | 0.164 ms | 44007.820474 s | 44007.820638 s | (s)TIMER:1 | 0006 | 0.087 ms | 1 | 0.087 ms | 44000.830807 s | 44000.830894 s | (s)SCHED:7 | 0006 | 0.080 ms | 2 | 0.044 ms | 43997.826145 s | 43997.826189 s | -------------------------------------------------------------------------------------------------------------------------------- Total count : 12748 Total runtime (msec) : 661.433 (0.065% load average) Total time span (msec) : 10176.441 -------------------------------------------------------------------------------------------------------------------------------- # # perf kwork -k softirq rep -s count,max Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (s)TIMER:1 | 0003 | 181.387 ms | 2476 | 1.240 ms | 44004.787960 s | 44004.789201 s | (s)RCU:9 | 0003 | 91.573 ms | 2193 | 0.650 ms | 44004.790258 s | 44004.790908 s | (s)SCHED:7 | 0002 | 50.039 ms | 1731 | 0.074 ms | 44005.009447 s | 44005.009521 s | (s)RCU:9 | 0001 | 78.960 ms | 1619 | 1.195 ms | 44001.496553 s | 44001.497749 s | (s)SCHED:7 | 0003 | 55.962 ms | 1255 | 0.954 ms | 44004.812008 s | 44004.812962 s | ... ... (s)RCU:9 | 0002 | 35.241 ms | 932 | 0.407 ms | 44005.009541 s | 44005.009949 s | (s)RCU:9 | 0000 | 45.710 ms | 702 | 1.144 ms | 44004.787023 s | 44004.788167 s | (s)SCHED:7 | 0006 | 0.080 ms | 2 | 0.044 ms | 43997.826145 s | 43997.826189 s | (s)TIMER:1 | 0005 | 0.164 ms | 1 | 0.164 ms | 44007.820474 s | 44007.820638 s | (s)TIMER:1 | 0006 | 0.087 ms | 1 | 0.087 ms | 44000.830807 s | 44000.830894 s | -------------------------------------------------------------------------------------------------------------------------------- Committer testing: # perf kwork -k softirq report -C 2 -s count,max Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- (s)SCHED:7 | 0002 | 0.980 ms | 159 | 0.024 ms | 26035.571037 s | 26035.571061 s | (s)RCU:9 | 0002 | 0.124 ms | 88 | 0.021 ms | 26035.177050 s | 26035.177071 s | (s)TIMER:1 | 0002 | 0.122 ms | 56 | 0.007 ms | 26035.468045 s | 26035.468052 s | -------------------------------------------------------------------------------------------------------------------------------- # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-9-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 94348520c6f1313041373d5f7f9c7d636996fdba Author: Yang Jihong Date: Sat Jul 9 09:50:23 2022 +0800 perf kwork: Add irq report support Implements irq kwork report function. Test cases: # perf kwork record -- sleep 10 [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 6.134 MB perf.data ] # perf kwork report Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 1167.501 ms | 18284 | 1.096 ms | 44004.464905 s | 44004.466001 s | eth0:10 | 0002 | 0.185 ms | 5 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -C 2 Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- eth0:10 | 0002 | 0.185 ms | 5 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -C 3 Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -i perf.data Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 1167.501 ms | 18284 | 1.096 ms | 44004.464905 s | 44004.466001 s | eth0:10 | 0002 | 0.185 ms | 5 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -s max,freq Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 1167.501 ms | 18284 | 1.096 ms | 44004.464905 s | 44004.466001 s | eth0:10 | 0002 | 0.185 ms | 5 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -S Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 1167.501 ms | 18284 | 1.096 ms | 44004.464905 s | 44004.466001 s | eth0:10 | 0002 | 0.185 ms | 5 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- Total count : 18289 Total runtime (msec) : 1167.686 (0.115% load average) Total time span (msec) : 10159.155 -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report --time 44005, Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- virtio0-requests:25 | 0000 | 402.173 ms | 4695 | 0.981 ms | 44007.831992 s | 44007.832973 s | eth0:10 | 0002 | 0.089 ms | 2 | 0.058 ms | 44005.012222 s | 44005.012280 s | -------------------------------------------------------------------------------------------------------------------------------- Committer testing: # perf kwork report Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- nvme0q5:130 | 0004 | 1.101 ms | 49 | 0.051 ms | 26035.056403 s | 26035.056455 s | amdgpu:162 | 0002 | 0.176 ms | 9 | 0.046 ms | 26035.268020 s | 26035.268066 s | nvme0q24:149 | 0023 | 0.161 ms | 55 | 0.009 ms | 26035.655280 s | 26035.655288 s | nvme0q20:145 | 0019 | 0.090 ms | 33 | 0.014 ms | 26035.939018 s | 26035.939032 s | nvme0q31:156 | 0030 | 0.075 ms | 21 | 0.010 ms | 26035.052237 s | 26035.052247 s | nvme0q8:133 | 0007 | 0.062 ms | 12 | 0.021 ms | 26035.416840 s | 26035.416861 s | nvme0q6:131 | 0005 | 0.054 ms | 22 | 0.010 ms | 26035.199919 s | 26035.199929 s | nvme0q19:144 | 0018 | 0.052 ms | 14 | 0.010 ms | 26035.110615 s | 26035.110625 s | nvme0q7:132 | 0006 | 0.049 ms | 13 | 0.007 ms | 26035.125180 s | 26035.125187 s | nvme0q18:143 | 0017 | 0.033 ms | 14 | 0.007 ms | 26035.169698 s | 26035.169705 s | nvme0q17:142 | 0016 | 0.013 ms | 1 | 0.013 ms | 26035.565147 s | 26035.565160 s | enp5s0-rx-0:164 | 0006 | 0.004 ms | 4 | 0.002 ms | 26035.928882 s | 26035.928884 s | enp5s0-tx-0:166 | 0008 | 0.003 ms | 3 | 0.002 ms | 26035.870923 s | 26035.870925 s | -------------------------------------------------------------------------------------------------------------------------------- # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-8-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit f98919ec4fccdacf45c63c4ee73b31f3e6b6024d Author: Yang Jihong Date: Sat Jul 9 09:50:22 2022 +0800 perf kwork: Implement 'report' subcommand Implements framework of 'perf kwork report', which is used to report time properties such as run time and frequency: Test cases: # perf kwork Usage: perf kwork [] {record|report} -D, --dump-raw-trace dump raw trace in ASCII -f, --force don't complain, do it -k, --kwork list of kwork to profile (irq, softirq, workqueue, etc) -v, --verbose be more verbose (show symbol address, etc) # perf kwork report -h Usage: perf kwork report [] -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): runtime, max, count -S, --with-summary Show summary with statistics --time Time span for analysis (start,stop) # perf kwork report Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -S Kwork Name | Cpu | Total Runtime | Count | Max runtime | Max runtime start | Max runtime end | -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- Total count : 0 Total runtime (msec) : 0.000 (0.000% load average) Total time span (msec) : 0.000 -------------------------------------------------------------------------------------------------------------------------------- # perf kwork report -C 0,100 Requested CPU 100 too large. Consider raising MAX_NR_CPUS Invalid cpu bitmap # perf kwork report -s runtime1 Error: Unknown --sort key: `runtime1' Usage: perf kwork report [] -C, --cpu list of cpus to profile -i, --input input file name -n, --name event name to profile -s, --sort sort by key(s): runtime, max, count -S, --with-summary Show summary with statistics --time Time span for analysis (start,stop) # perf kwork report -i perf_no_exist.data failed to open perf_no_exist.data: No such file or directory # perf kwork report --time 00FFF, Invalid time span Since there are no report supported events, the output is empty. Briefly describe the data structure: 1. "class" indicates event type. For example, irq and softiq correspond to different types. 2. "cluster" refers to a specific event corresponding to a type. For example, RCU and TIMER in softirq correspond to different clusters, which contains three types of events: raise, entry, and exit. 3. "atom" includes time of each sample and sample of the previous phase. (For example, exit corresponds to entry, which is used for timehist.) Committer notes: - Add {} for multiline if blocks. - report_print_work() should either return that ret variable that accounts how many bytes were printed or stop accounting and be void. Do the former for now to avoid this: builtin-kwork.c:534:6: error: variable 'ret' set but not used [-Werror,-Wunused-but-set-variable] int ret = 0; ^ 1 error generated. When building with: ⬢[acme@toolbox perf]$ clang --version clang version 13.0.0 (https://github.com/llvm/llvm-project e8991caea8690ec2d17b0b7e1c29bf0da6609076) Also: - if ((dst_type >= 0) && (dst_type < KWORK_TRACE_MAX)) { + if (dst_type < KWORK_TRACE_MAX) { Several versions of clang and at least this gcc: 3 51.40 alpine:3.9 : FAIL gcc version 8.3.0 (Alpine 8.3.0) builtin-kwork.c:411:16: error: comparison of unsigned enum expression >= 0 is always true [-Werror,-Wtautological-compare] if ((dst_type >= 0) && (dst_type < KWORK_TRACE_MAX)) { As the first entry in a enum is zero. Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-7-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 17d9c15c9b9e7fb285f7ac5367dfb5f00ff575e3 Author: Li Jinlin Date: Mon Jul 25 11:20:50 2022 +0800 fsdax: Fix infinite loop in dax_iomap_rw() I got an infinite loop and a WARNING report when executing a tail command in virtiofs. WARNING: CPU: 10 PID: 964 at fs/iomap/iter.c:34 iomap_iter+0x3a2/0x3d0 Modules linked in: CPU: 10 PID: 964 Comm: tail Not tainted 5.19.0-rc7 Call Trace: dax_iomap_rw+0xea/0x620 ? __this_cpu_preempt_check+0x13/0x20 fuse_dax_read_iter+0x47/0x80 fuse_file_read_iter+0xae/0xd0 new_sync_read+0xfe/0x180 ? 0xffffffff81000000 vfs_read+0x14d/0x1a0 ksys_read+0x6d/0xf0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The tail command will call read() with a count of 0. In this case, iomap_iter() will report this WARNING, and always return 1 which casuing the infinite loop in dax_iomap_rw(). Fixing by checking count whether is 0 in dax_iomap_rw(). Fixes: ca289e0b95af ("fsdax: switch dax_iomap_rw to use iomap_iter") Signed-off-by: Li Jinlin Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20220725032050.3873372-1-lijinlin3@huawei.com Signed-off-by: Dan Williams commit 04ad63f086d1a9649b8b082748cbc7a570ade461 Author: Dan Williams Date: Tue Jan 11 08:06:40 2022 -0800 cxl/region: Introduce cxl_pmem_region objects The LIBNVDIMM subsystem is a platform agnostic representation of system NVDIMM / persistent memory resources. To date, the CXL subsystem's interaction with LIBNVDIMM has been to register an nvdimm-bridge device and cxl_nvdimm objects to proxy CXL capabilities into existing LIBNVDIMM subsystem mechanics. With regions the approach is the same. Create a new cxl_pmem_region object to proxy CXL region details into a LIBNVDIMM definition. With this enabling LIBNVDIMM can partition CXL persistent memory regions with legacy namespace labels. A follow-on patch will add CXL region label and CXL namespace label support to persist region configurations across driver reload / system-reset events. Co-developed-by: Ben Widawsky Signed-off-by: Ben Widawsky Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165784340111.1758207.3036498385188290968.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 99183d26ed6191010fca09518dae34d6aff3cd14 Author: Dan Williams Date: Fri Jun 10 17:39:59 2022 -0700 cxl/pmem: Fix offline_nvdimm_bus() to offline by bridge Be careful to only disable cxl_pmem objects related to a given cxl_nvdimm_bridge. Otherwise, offline_nvdimm_bus() reaches across CXL domains and disables more than is expected. Fixes: 21083f51521f ("cxl/pmem: Register 'pmem' / cxl_nvdimm devices") Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/165784339569.1758207.1557084545278004577.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 8d48817df6ac2049955b6b3a4f1b68dbe5b31f1b Author: Dan Williams Date: Tue Jun 15 14:00:40 2021 -0700 cxl/region: Add region driver boiler plate The CXL region driver is responsible for routing fully formed CXL regions to one of libnvdimm, for persistent memory regions, device-dax for volatile memory regions, or just act as an enumeration placeholder if the region was setup and configuration locked by platform firmware. In the platform-firmware-setup case the expectation is that region is already accounted in the system memory map, i.e. already enabled as "System RAM". For now, just attach to CXL regions in the CXL_CONFIG_COMMIT state, and take no further action. Given this driver is just a small / simple router, include it in the core rather than its own module. Co-developed-by: Ben Widawsky Signed-off-by: Ben Widawsky Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20220624041950.559155-18-dan.j.williams@intel.com Signed-off-by: Dan Williams commit d63ed7fe85eed2e70bdb16610f327edc765f4c44 Author: Randy Dunlap Date: Mon Jul 25 13:22:24 2022 -0700 x86/cyrix: include header linux/isa-dma.h x86/kernel/cpu/cyrix.c now needs to include since the 'isa_dma_bridge_buggy' variable was moved to it. Fixes this build error: ../arch/x86/kernel/cpu/cyrix.c: In function ‘init_cyrix’: ../arch/x86/kernel/cpu/cyrix.c:277:17: error: ‘isa_dma_bridge_buggy’ undeclared (first use in this function) 277 | isa_dma_bridge_buggy = 2; Fixes: abb4970ac335 ("PCI: Move isa_dma_bridge_buggy out of asm/dma.h") Link: https://lore.kernel.org/r/20220725202224.29269-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Bjorn Helgaas Acked-by: Stafford Horne Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org commit e432947ef5500f0c89ab044e00ee7842d38bdb39 Author: Yang Jihong Date: Sat Jul 9 09:50:21 2022 +0800 tools lib: Add list_last_entry_or_null() Add list_last_entry_or_null() to get the last element from a list, returns NULL if the list is empty. Signed-off-by: Yang Jihong Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-6-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 97179d9d086ff96b3af0f00f0e279203ec7b57c4 Author: Yang Jihong Date: Sat Jul 9 09:50:20 2022 +0800 perf kwork: Add workqueue kwork record support Record workqueue events workqueue:workqueue_activate_work, workqueue:workqueue_execute_start & workqueue:workqueue_execute_end Tese cases: Record all events: # perf kwork record -o perf_kwork.date -- sleep 1 [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 0.857 MB perf_kwork.date ] # # perf evlist -i perf_kwork.date irq:irq_handler_entry irq:irq_handler_exit irq:softirq_raise irq:softirq_entry irq:softirq_exit workqueue:workqueue_activate_work workqueue:workqueue_execute_start workqueue:workqueue_execute_end dummy:HG # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events Record workqueue events: # perf kwork -k workqueue record -o perf_kwork.date -- sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.081 MB perf_kwork.date ] # # perf evlist -i perf_kwork.date workqueue:workqueue_activate_work workqueue:workqueue_execute_start workqueue:workqueue_execute_end dummy:HG # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events Committer testing: # perf kwork record sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 3.430 MB perf.data (24130 samples) ] # perf evlist -v irq:irq_handler_entry: type: 2, size: 128, config: 0x97, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:irq_handler_exit: type: 2, size: 128, config: 0x96, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_raise: type: 2, size: 128, config: 0x93, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_entry: type: 2, size: 128, config: 0x95, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_exit: type: 2, size: 128, config: 0x94, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 workqueue:workqueue_activate_work: type: 2, size: 128, config: 0x106, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 workqueue:workqueue_execute_start: type: 2, size: 128, config: 0x105, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 workqueue:workqueue_execute_end: type: 2, size: 128, config: 0x104, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 dummy:HG: type: 1, size: 128, config: 0x9, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|RAW|IDENTIFIER, read_format: ID, inherit: 1, mmap: 1, comm: 1, task: 1, sample_id_all: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1 # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events # perf script | grep workqueue | head swapper 0 [018] 26035.043289: workqueue:workqueue_activate_work: work struct 0xffff8b8ffeeae368 kworker/18:2-ev 70440 [018] 26035.043293: workqueue:workqueue_execute_start: work struct 0xffff8b8ffeeae368: function free_work kworker/18:2-ev 70440 [018] 26035.043301: workqueue:workqueue_execute_end: work struct 0xffff8b8ffeeae368: function free_work swapper 0 [021] 26035.044704: workqueue:workqueue_activate_work: work struct 0xffff8b8ffef6e368 kworker/21:0-ev 4080535 [021] 26035.044709: workqueue:workqueue_execute_start: work struct 0xffff8b8ffef6e368: function free_work kworker/21:0-ev 4080535 [021] 26035.044716: workqueue:workqueue_execute_end: work struct 0xffff8b8ffef6e368: function free_work swapper 0 [018] 26035.045230: workqueue:workqueue_activate_work: work struct 0xffff8b8ffeeae368 kworker/18:2-ev 70440 [018] 26035.045232: workqueue:workqueue_execute_start: work struct 0xffff8b8ffeeae368: function free_work kworker/18:2-ev 70440 [018] 26035.045235: workqueue:workqueue_execute_end: work struct 0xffff8b8ffeeae368: function free_work swapper 0 [001] 26035.052046: workqueue:workqueue_activate_work: work struct 0xffff8b8108901590 # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-5-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit e64393219069879e26483a6f92ec0cf2e1c43582 Author: Yang Jihong Date: Sat Jul 9 09:50:19 2022 +0800 perf kwork: Add softirq kwork record support Record softirq events irq:softirq_raise, irq:softirq_entry & irq:softirq_exit. Test cases: Record all events: # perf kwork record -o perf_kwork.date -- sleep 1 [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 0.897 MB perf_kwork.date ] # # perf evlist -i perf_kwork.date irq:irq_handler_entry irq:irq_handler_exit irq:softirq_raise irq:softirq_entry irq:softirq_exit dummy:HG # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events Record softirq events: # perf kwork -k softirq record -o perf_kwork.date -- sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.141 MB perf_kwork.date ] # # perf evlist -i perf_kwork.date irq:softirq_raise irq:softirq_entry irq:softirq_exit dummy:HG # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events Committer testing: # perf kwork record sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 3.078 MB perf.data (17433 samples) ] # perf evlist -v irq:irq_handler_entry: type: 2, size: 128, config: 0x97, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:irq_handler_exit: type: 2, size: 128, config: 0x96, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_raise: type: 2, size: 128, config: 0x93, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_entry: type: 2, size: 128, config: 0x95, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 irq:softirq_exit: type: 2, size: 128, config: 0x94, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, sample_id_all: 1, exclude_guest: 1 dummy:HG: type: 1, size: 128, config: 0x9, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|RAW|IDENTIFIER, read_format: ID, inherit: 1, mmap: 1, comm: 1, task: 1, sample_id_all: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1 # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events # perf script | head migration/12 73 [012] 25884.940992: irq:softirq_raise: vec=9 [action=RCU] migration/12 73 [012] 25884.940994: irq:softirq_entry: vec=9 [action=RCU] migration/12 73 [012] 25884.940995: irq:softirq_exit: vec=9 [action=RCU] swapper 0 [004] 25884.940995: irq:softirq_raise: vec=9 [action=RCU] swapper 0 [004] 25884.940998: irq:softirq_entry: vec=9 [action=RCU] swapper 0 [004] 25884.940999: irq:softirq_exit: vec=9 [action=RCU] cc1 71212 [021] 25884.941990: irq:softirq_raise: vec=9 [action=RCU] swapper 0 [004] 25884.941991: irq:softirq_raise: vec=9 [action=RCU] cc1 71212 [021] 25884.941992: irq:softirq_raise: vec=7 [action=SCHED] perf-exec 71208 [013] 25884.941992: irq:softirq_raise: vec=9 [action=RCU] # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-4-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 4f8ae962f0f71c682f97be5a9491694f9fbd814a Author: Yang Jihong Date: Sat Jul 9 09:50:18 2022 +0800 perf kwork: Add irq kwork record support Record interrupt events irq:irq_handler_entry & irq_handler_exit Test cases: # perf kwork record -o perf_kwork.date -- sleep 1 [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 0.556 MB perf_kwork.date ] # # perf evlist -i perf_kwork.date irq:irq_handler_entry irq:irq_handler_exit dummy:HG # Tip: use 'perf evlist --trace-fields' to show fields for tracepoint events # Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-3-yangjihong1@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit 0f70d8e9db4f250f694a3befe88501027b1dc88e Author: Yang Jihong Date: Sat Jul 9 09:50:17 2022 +0800 perf kwork: New tool to trace time properties of kernel work (such as softirq, and workqueue) The 'perf kwork' tool is used to trace time properties of kernel work (such as irq, softirq, and workqueue), including runtime, latency, and timehist, using the infrastructure in the perf tools to allow tracing extra targets. This is the first commit to reuse the 'perf record' framework code to implement a simple record function, kwork is not supported currently. Test cases: # perf usage: perf [--version] [--help] [OPTIONS] COMMAND [ARGS] The most commonly used perf commands are: iostat Show I/O performance metrics kallsyms Searches running kernel for symbols kmem Tool to trace/measure kernel memory properties kvm Tool to trace/measure kvm guest os kwork Tool to trace/measure kernel work properties (latencies) list List all symbolic event types lock Analyze lock events mem Profile memory accesses record Run a command and record its profile into perf.data See 'perf help COMMAND' for more information on a specific command. # perf kwork Usage: perf kwork [] {record} -D, --dump-raw-trace dump raw trace in ASCII -f, --force don't complain, do it -k, --kwork list of kwork to profile -v, --verbose be more verbose (show symbol address, etc) # perf kwork record -- sleep 1 [ perf record: Woken up 0 times to write data ] [ perf record: Captured and wrote 1.787 MB perf.data ] Signed-off-by: Yang Jihong Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Paul Clarke Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220709015033.38326-2-yangjihong1@huawei.com [ Add {} for multiline if blocks ] Signed-off-by: Arnaldo Carvalho de Melo commit b08b95cf30f53b674bdef510d4cfd0623199b036 Author: Sumeet Pawnikar Date: Tue Jul 26 18:32:29 2022 +0530 powercap: RAPL: Add Power Limit4 support for Alder Lake-N and Raptor Lake-P Add Alder Lake-N and Raptor Lake-P to the list of processor models for which Power Limit4 is supported by the Intel RAPL driver. Signed-off-by: Sumeet Pawnikar Reviewed-by: Srinivas Pandruvada Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 4f4179fcf420873002035cf1941d844c9e0e7cb3 Author: Rafael J. Wysocki Date: Thu Jul 21 19:41:10 2022 +0200 ACPI: CPPC: Do not prevent CPPC from working in the future There is a problem with the current revision checks in is_cppc_supported() that they essentially prevent the CPPC support from working if a new _CPC package format revision being a proper superset of the v3 and only causing _CPC to return a package with more entries (while retaining the types and meaning of the entries defined by the v3) is introduced in the future and used by the platform firmware. In that case, as long as the number of entries in the _CPC return package is at least CPPC_V3_NUM_ENT, it should be perfectly fine to use the v3 support code and disregard the additional package entries added by the new package format revision. For this reason, drop is_cppc_supported() altogether, put the revision checks directly into acpi_cppc_processor_probe() so they are easier to follow and rework them to take the case mentioned above into account. Fixes: 4773e77cdc9b ("ACPI / CPPC: Add support for CPPC v3") Cc: 4.18+ # 4.18+ Signed-off-by: Rafael J. Wysocki commit ec6c0503190417abf8b8f8e3e955ae583a4e50d4 Author: Rafael J. Wysocki Date: Thu Jul 21 18:13:30 2022 +0200 ACPI: PM: x86: Print messages regarding LPS0 idle support Because suspend-to-idle is always supported and on x86 it is the only way to suspend the system if S3 is not supported by the platform, the kernel attempts to enter low-power S0 idle in the suspend-to-idle flow regardless of whether or not the ACPI_FADT_LOW_POWER_S0 flag is set in the FADT. However, if that flag is not set, residency counters associated with low-power S0 idle may not count and the platform may refuse to put the EC into a low-power mode, for example. For this reason, print diagnostic messages when the platform should achieve significant energy savings in low-power S0 idle (because the ACPI_FADT_LOW_POWER_S0 flag is set in the FADT) and when suspend-to-idle becomes the default suspend method (because low-power S0 idle should be equally or more efficient than S3, if available). Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello commit 8d36694245f2aec17f03a5e0b2797953d2e36704 Author: Shivnandan Kumar Date: Fri Jul 15 17:55:39 2022 +0530 PM: QoS: Add check to make sure CPU freq is non-negative CPU frequency should never be negative. If some client driver calls freq_qos_update_request with a negative value which will be very high in absolute terms, then frequency QoS sets max CPU freq at fmax as it considers it's absolute value but it will add plist node with negative priority. plist node has priority from INT_MIN (highest) to INT_MAX(lowest). Once priority is set as negative, another client will not be able to reduce CPU frequency. Adding check to make sure CPU freq is non-negative will fix this problem. Signed-off-by: Shivnandan Kumar [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 8386c414e27caba8501119948e9551e52b527f59 Author: Tetsuo Handa Date: Fri Jul 15 14:49:58 2022 +0900 PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface. Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Tested-by: syzbot Signed-off-by: Rafael J. Wysocki commit 8d9fdb6011b4d413271eba3a62e10f89efecc419 Author: Dan Carpenter Date: Tue Jul 26 17:12:23 2022 +0300 ublk_drv: fix double shift bug The test/clear_bit() functions take a bit number, but this code is passing as shifted value. It's the equivalent of saying BIT(BIT(0)) instead of just BIT(0). This doesn't affect runtime because numbers are small and it's done consistently. Fixes: fa362045564e ("ublk: simplify ublk_ch_open and ublk_ch_release") Signed-off-by: Dan Carpenter Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/Yt/2R/+MJf/MSoyl@kili Signed-off-by: Jens Axboe commit cd8efeeed16e8ecf30071583865f3f468db9e854 Author: Marcin Szycik Date: Mon Jul 18 14:18:13 2022 +0200 ice: Add support for PPPoE hardware offload Add support for creating PPPoE filters in switchdev mode. Add support for parsing PPPoE and PPP-specific tc options: pppoe_sid and ppp_proto. Example filter: tc filter add dev $PF1 ingress protocol ppp_ses prio 1 flower pppoe_sid \ 1234 ppp_proto ip skip_sw action mirred egress redirect dev $VF1_PR Changes in iproute2 are required to use the new fields. ICE COMMS DDP package is required to create a filter as it contains PPPoE profiles. Added a warning message when loaded DDP package does not contain required profiles. Signed-off-by: Marcin Szycik Signed-off-by: Tony Nguyen commit 6a21b0856daaf9b7f63225f5b449ddee170c6f0a Author: Wojciech Drewek Date: Mon Jul 18 14:18:12 2022 +0200 flow_offload: Introduce flow_match_pppoe Allow to offload PPPoE filters by adding flow_rule_match_pppoe. Drivers can extract PPPoE specific fields from now on. Signed-off-by: Wojciech Drewek Signed-off-by: Tony Nguyen commit f2a2f2c9aed21944095c2f867640a9089759c7e7 Author: Shubhrajyoti Datta Date: Thu Jul 21 14:30:21 2022 +0530 gpio: xilinx: add missing blank line after declarations Add a missing blank line. No functional changes. WARNING: Missing a blank line after declarations 128: FILE: drivers/gpio/gpio-xilinx.c:120: + void __iomem *addr = chip->regs + reg + xgpio_regoffset(chip, bit / 32); + xgpio_set_value32(a, bit, xgpio_readreg(addr)); WARNING: Missing a blank line after declarations 136: FILE: drivers/gpio/gpio-xilinx.c:126: + void __iomem *addr = chip->regs + reg + xgpio_regoffset(chip, bit / 32); + xgpio_writereg(addr, xgpio_get_value32(a, bit)); Signed-off-by: Shubhrajyoti Datta Reviewed-by: Michal Simek Signed-off-by: Bartosz Golaszewski commit 5008750eff5d4af8a3aed4a7567c4cfb2b3cb156 Author: Wojciech Drewek Date: Mon Jul 18 14:18:11 2022 +0200 net/sched: flower: Add PPPoE filter Add support for PPPoE specific fields for tc-flower. Those fields can be provided only when protocol was set to ETH_P_PPP_SES. Defines, dump, load and set are being done here. Overwrite basic.n_proto only in case of PPP_IP and PPP_IPV6, otherwise leave it as ETH_P_PPP_SES. Signed-off-by: Wojciech Drewek Acked-by: Guillaume Nault Signed-off-by: Tony Nguyen commit 46126db9c86110e5fc1e369b9bb89735ddefdae4 Author: Wojciech Drewek Date: Mon Jul 18 14:18:10 2022 +0200 flow_dissector: Add PPPoE dissectors Allow to dissect PPPoE specific fields which are: - session ID (16 bits) - ppp protocol (16 bits) - type (16 bits) - this is PPPoE ethertype, for now only ETH_P_PPP_SES is supported, possible ETH_P_PPP_DISC in the future The goal is to make the following TC command possible: # tc filter add dev ens6f0 ingress prio 1 protocol ppp_ses \ flower \ pppoe_sid 12 \ ppp_proto ip \ action drop Note that only PPPoE Session is supported. Signed-off-by: Wojciech Drewek Acked-by: Guillaume Nault Signed-off-by: Tony Nguyen commit a1873f837f9e5c1001462a635af1b0bab31aa9fd Author: Slark Xiao Date: Thu Jul 21 13:56:47 2022 +0800 dmaengine: mediatek: mtk-hsdma: Fix typo 'the the' in comment Replace 'the the' with 'the' in the comment. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220721055647.46085-1-slark_xiao@163.com Signed-off-by: Vinod Koul commit 9327c7e7539371c6f202303d5539afbae006ec72 Author: Mathias Tausen Date: Tue Jul 26 16:02:12 2022 +0200 dmaengine: axi-dmac: check cache coherency register Marking the DMA as cache coherent (dma-coherent in devicetree) is only safe with versions of axi_dmac that have this feature enabled. Cc: Lars-Peter Clausen Cc: Vinod Koul Acked-by: Nuno Sá Signed-off-by: Mathias Tausen Link: https://lore.kernel.org/r/20220726140213.786939-1-mta@satlab.com Signed-off-by: Vinod Koul commit 7df92384c86f36d0452e7abad21c7eaa91aeeef7 Author: Jiaxin Yu Date: Tue Jul 26 23:31:30 2022 +0800 ASoC: mediatek: mt8186: set the correct string to strncmp() Fix Smatch static checker warning. strncmp() here only needs to compare the first seven bytes, so in order to make the code more clear, only the first seven bytes of the string used as the comparison are reserved. Bug report: https://www.spinics.net/lists/alsa-devel/msg145608.html sound/soc/mediatek/mt8186/mt8186-dai-adda.c:78 get_adda_priv_by_name() warn: strncmp() with weird length: 17 vs 7 sound/soc/mediatek/mt8186/mt8186-dai-adda.c 72 static struct mtk_afe_adda_priv *get_adda_priv_by_name(struct mtk_base_afe *afe, 73 const char *name) 74 { 75 struct mt8186_afe_private *afe_priv = afe->platform_priv; 76 int dai_id; 77 --> 78 if (strncmp(name, "aud_dac_hires_clk", 7) == 0 || 79 strncmp(name, "aud_adc_hires_clk", 7) == 0) Fixes: b65c466220b3 ("ASoC: mediatek: mt8186: support adda in platform driver") Signed-off-by: Jiaxin Yu Link: https://lore.kernel.org/r/20220726153130.27584-1-jiaxin.yu@mediatek.com Signed-off-by: Mark Brown commit 66bbf1441d218316948877f7ec6b477c9a49d554 Author: Noam Date: Tue Jul 26 16:00:37 2022 +0300 spi: a3700: support BE for AC5 SPI driver Signed-off-by: Noam Tested-by: Raz Adashi Reviewed-by: Raz Adashi Signed-off-by: Vadym Kochan Link: https://lore.kernel.org/r/20220726130038.20995-1-vadym.kochan@plvision.eu Signed-off-by: Mark Brown commit 729a8a57355f12d9ecba150fbef693e51b99e7ec Author: Marco Felsch Date: Mon May 30 11:22:25 2022 +0200 dt-bindings: reset: Add TPS380x documentation Add device-tree binding documentation for the tps380x reset driver. The binding uses enum to make it easy to add more devices from that family. Signed-off-by: Marco Felsch Reviewed-by: Krzysztof Kozlowski Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220530092226.748644-1-m.felsch@pengutronix.de commit 9c68d4e621ebfc166f672fa7afe14591f91d144c Author: Biju Das Date: Sat Apr 23 14:46:01 2022 +0100 dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G2UL USBPHY Control bindings Add device tree binding document for RZ/G2UL USBPHY Control Device. RZ/G2UL USBPHY Control Device is identical to one found on the RZ/G2L SoC. No driver changes are required as generic compatible string "renesas,rzg2l-usbphy-ctrl" will be used as a fallback. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220423134601.141975-1-biju.das.jz@bp.renesas.com commit 7209344223f77311aee677ea820a93b9ba0bcae0 Author: Raphael-Xu <13691752556@139.com> Date: Fri Jul 22 18:53:45 2022 +0800 ASoC: dt-bindings: tas2780: remove tas2780 and will merge it to tas27xx Remove tas2780 binding documentation, the binding will be documented in the tax27xx binding. Signed-off-by: Raphael-Xu <13691752556@139.com> Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220722105345.175-1-13691752556@139.com Signed-off-by: Mark Brown commit 5adbaed16cc63542057627642d2414f603f2db69 Author: Mia Lin Date: Wed Jul 13 17:06:47 2022 +0800 rtc: Add NCT3018Y real time clock driver Add real time clock support for NCT3018Y. Signed-off-by: Mia Lin Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220713090647.8028-4-mimi05633@gmail.com commit 8b30b09317ec6fda5f36a428e9e331253b5c4739 Author: Mia Lin Date: Wed Jul 13 17:06:45 2022 +0800 dt-bindings: rtc: nuvoton: add NCT3018Y Real Time Clock Document devicetree bindings for the Nuvoton NCT3018Y Real Time Clock. Reviewed-by: Rob Herring Signed-off-by: Mia Lin Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220713090647.8028-2-mimi05633@gmail.com commit 03009a605f2ae18c0cb77a78b329f79821a4c545 Author: Andy Shevchenko Date: Tue Jul 26 17:31:10 2022 +0300 hwmon: (occ) Replace open-coded variant of %*phN specifier printf()-like functions in the kernel have extensions, such as %*phN to dump small pieces of memory as hex bytes. Replace custom approach with the direct use of %*phN. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220726143110.4809-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit 10e1fb88c7b7e71ae04895511f4f98a7721c9e6e Author: Alexander Stein Date: Mon Jul 25 09:19:19 2022 +0200 dt-bindings: rtc: nxp,pcf85063: Convert to DT schema Convert the NXP PCF85063 RTC binding to DT schema format. Add 'interrupts' and 'wakeup-source' as this device has an interrupt which was not documented, but is in use. 'clock-output-names' and '#clock-cells' are added as well, those were probably missed when adding clkout support in commit 8c229ab6048b ("rtc: pcf85063: Add pcf85063 clkout control to common clock framework") Signed-off-by: Alexander Stein Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220725071919.25342-1-alexander.stein@ew.tq-group.com commit 527f36f5efa45b6a897190cabf982e2d207887da Author: Axe Yang Date: Tue Jul 26 14:28:42 2022 +0800 mmc: mediatek: add support for SDIO eint wakup IRQ Add support for eint IRQ when MSDC is used as an SDIO host. This feature requires SDIO device support async IRQ function. With this feature, SDIO host can be awakened by SDIO card in suspend state, without additional pin. MSDC driver will time-share the SDIO DAT1 pin. During suspend, MSDC turn off clock and switch SDIO DAT1 pin to GPIO mode. And during resume, switch GPIO function back to DAT1 mode then turn on clock. Some device tree property should be added or modified in MSDC node to support SDIO eint IRQ. Pinctrls "state_eint" is mandatory. Since this feature depends on asynchronous interrupts, "wakeup-source", "keep-power-in-suspend" and "cap-sdio-irq" flags are necessary, and the interrupts list should be extended(the interrupt named with sdio_wakeup): &mmcX { ... interrupt-names = "msdc", "sdio_wakeup"; interrupts-extended = <...>, <&pio xxx IRQ_TYPE_LEVEL_LOW>; ... pinctrl-names = "default", "state_uhs", "state_eint"; ... pinctrl-2 = <&mmc2_pins_eint>; ... cap-sdio-irq; keep-power-in-suspend; wakeup-source; ... }; Co-developed-by: Yong Mao Signed-off-by: Yong Mao Reviewed-by: Chaotian Jing Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Linus Walleij Signed-off-by: Axe Yang Link: https://lore.kernel.org/r/20220726062842.18846-4-axe.yang@mediatek.com Signed-off-by: Ulf Hansson commit 019e442bb0d5e7f25ada8eb4252e22e62d17a95e Author: Axe Yang Date: Tue Jul 26 14:28:41 2022 +0800 mmc: core: Add support for SDIO wakeup interrupt If wakeup-source flag is set in host dts node, parse EAI information from SDIO CCCR interrupt externsion segment for in-band wakeup. If async interrupt is supported by SDIO card then enable it and set enable_async_irq flag in sdio_cccr structure to 1. The parse flow is implemented in sdio_read_cccr(). Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Axe Yang Link: https://lore.kernel.org/r/20220726062842.18846-3-axe.yang@mediatek.com Signed-off-by: Ulf Hansson commit 035cc3951797df0e1e831f9fd71b7cda63e71705 Author: Axe Yang Date: Tue Jul 26 14:28:40 2022 +0800 dt-bindings: mmc: mtk-sd: extend interrupts and pinctrls properties Extend interrupts and pinctrls for SDIO wakeup interrupt feature. This feature allow SDIO devices alarm asynchronous interrupt to host even when host stop providing clock to SDIO card. An extra wakeup interrupt and pinctrl states for SDIO DAT1 pin state switching are required in this scenario. Reviewed-by: Rob Herring Signed-off-by: Axe Yang Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20220726062842.18846-2-axe.yang@mediatek.com Signed-off-by: Ulf Hansson commit 2830320122d87fb65632f09cdffe129046915d51 Author: Rob Herring Date: Tue Jul 19 15:51:42 2022 -0600 dt-bindings: rtc: microcrystal,rv3032: Add missing type to 'trickle-voltage-millivolt' 'trickle-voltage-millivolt' is missing a type definition. '-millivolt' is not a standard unit (should be '-microvolt'). As the property is already in use, add a type reference. Signed-off-by: Rob Herring Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220719215143.1877566-1-robh@kernel.org commit 71af91565052214ad86f288e0d8ffb165f790995 Author: Mathew McBride Date: Wed Jul 6 07:42:36 2022 +0000 rtc: rx8025: fix 12/24 hour mode detection on RX-8035 The 12/24hr flag in the RX-8035 can be found in the hour register, instead of the CTRL1 on the RX-8025. This was overlooked when support for the RX-8035 was added, and was causing read errors when the hour register 'overflowed'. To deal with the relevant register not always being visible in the relevant functions, determine the 12/24 mode at startup and store it in the driver state. Signed-off-by: Mathew McBride Fixes: f120e2e33ac8 ("rtc: rx8025: implement RX-8035 support") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220706074236.24011-1-matt@traverse.com.au commit d2f35ed0aae12bf7b3c5f9bae41b0ada4a292f20 Author: Jagan Teki Date: Sun Jul 24 02:13:24 2022 +0530 dt-bindings: mmc: rockchip-dw-mshc: Document Rockchip RV1126 Add a compatible string for Rockchip RV1126 SoC. Signed-off-by: Jagan Teki Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220723204335.750095-12-jagan@edgeble.ai Signed-off-by: Ulf Hansson commit 5c9f41443e8d5fbd414ad0dfa8e0996b937d135a Author: Uwe Kleine-König Date: Thu Jul 7 17:31:56 2022 +0200 rtc: cros-ec: Only warn once in .remove() about notifier_chain problems When a remove platform device callback returns an error code, the driver core emits an error message ("remove callback returned a non-zero value. This will be ignored.\n") and still removes the device. As the driver already emits a more specific error message, return 0 to suppress the core's error message. This is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König Acked-by: Tzung-Bi Shih Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220707153156.214841-1-u.kleine-koenig@pengutronix.de commit 2a692245b6de1f17baef24db46fed03186ff3cc3 Author: Thomas Bogendoerfer Date: Fri Jul 15 15:53:30 2022 +0200 rtc: vr41xx: remove driver Commit d3164e2f3b0a ("MIPS: Remove VR41xx support") removed support for MIPS VR41xx platform, so remove exclusive drivers for this platform, too. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220715135330.134684-1-tsbogend@alpha.franken.de commit 03d7a732815069a78c8c655092e48fcdd52734fb Author: Tom Rix Date: Mon Jun 27 16:59:43 2022 -0400 rtc: mpfs: remove 'pending' variable from mpfs_rtc_wakeup_irq_handler() cppcheck reports [drivers/rtc/rtc-mpfs.c:219]: (style) Variable 'pending' is assigned a value that is never used. The fetched CONTROL_REG stored in pending is unused and partially duplicates the functionality of the later call to mpfs_rtc_clear(). This looks like leftover development code, so remove pending. Fixes: 0b31d703598d ("rtc: Add driver for Microchip PolarFire SoC") Signed-off-by: Tom Rix Reviewed-by: Conor Dooley Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220627205943.2075043-1-trix@redhat.com commit d295daf505758f9a0e4d05f4ee3bfdfb4192c18f Author: Ilya Leoshkevich Date: Tue Jul 26 15:40:08 2022 +0200 selftests/bpf: Attach to socketcall() in test_probe_user test_probe_user fails on architectures where libc uses socketcall(SYS_CONNECT) instead of connect(). Fix by attaching to socketcall as well. Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20220726134008.256968-3-iii@linux.ibm.com commit 2d369b4b0044d4f6a3fa4071807f66eced0f2725 Author: Ilya Leoshkevich Date: Tue Jul 26 15:40:07 2022 +0200 libbpf: Extend BPF_KSYSCALL documentation Explicitly list known quirks. Mention that socket-related syscalls can be invoked via socketcall(). Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20220726134008.256968-2-iii@linux.ibm.com commit bd82ea52f0ee2890b698155a6d7bf9ea5bd8930d Author: Lorenzo Bianconi Date: Sat Jul 23 19:17:10 2022 +0200 bpf, devmap: Compute proper xdp_frame len redirecting frames Even if it is currently forbidden to XDP_REDIRECT a multi-frag xdp_frame into a devmap, compute proper xdp_frame length in __xdp_enqueue and is_valid_dst routines running xdp_get_frame_len(). Signed-off-by: Lorenzo Bianconi Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/894d99c01139e921bdb6868158ff8e67f661c072.1658596075.git.lorenzo@kernel.org commit 7d4edccc9bbfe1dcdff641343f7b0c6763fbe774 Author: Uwe Kleine-König Date: Mon Jul 25 21:43:44 2022 +0200 hwmon: (sht15) Fix wrong assumptions in device remove callback Taking a lock at the beginning of .remove() doesn't prevent new readers. With the existing approach it can happen, that a read occurs just when the lock was taken blocking the reader until the lock is released at the end of the remove callback which then accessed *data that is already freed then. To actually fix this problem the hwmon core needs some adaption. Until this is implemented take the optimistic approach of assuming that all readers are gone after hwmon_device_unregister() and sysfs_remove_group() as most other drivers do. (And once the core implements that, taking the lock would deadlock.) So drop the lock, move the reset to after device unregistration to keep the device in a workable state until it's deregistered. Also add a error message in case the reset fails and return 0 anyhow. (Returning an error code, doesn't stop the platform device unregistration and only results in a little helpful error message before the devm cleanup handlers are called.) Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20220725194344.150098-1-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck commit f4caa26216411040e3c7cb80bf351104e3cd3488 Author: Aleksa Savic Date: Tue Jul 26 14:02:03 2022 +0200 hwmon: (aquacomputer_d5next) Add support for reading the +12V voltage sensor on D5 Next Add support for reading the +12V voltage that the D5 Next pump receives. Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20220726120203.33773-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck commit ffe71829574a4848e9a376010a2ea74ae6d2d211 Author: Krzysztof Kozlowski Date: Tue Jul 26 13:59:17 2022 +0200 ASoC: dt-bindings: qcom,wcd934x: use absolute path to other schema Absolute path to other DT schema is preferred over relative one. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220726115917.101371-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit fcc5b37cfd9e177d735af31a6e2938a8087ac854 Merge: d81677410f172 96f6017d652a7 Author: Mark Brown Date: Tue Jul 26 14:06:52 2022 +0100 ASoC: atmel: one fix and few cleanups Merge series from Claudiu Beznea : The series adds one fix for mchp-spdifrx and few cleanups for mchp-spdifrx and mchp-spdifrx drivers. commit 7d3a3aaaa9cc8ec53e9ef4f3e1711827107f76c5 Author: Biju Das Date: Fri Jul 22 09:44:30 2022 +0100 dmaengine: sh: rz-dmac: Add device_synchronize callback Some on-chip peripheral modules(for eg:- rspi) on RZ/G2L SoC use the same signal for both interrupt and DMA transfer requests. The signal works as a DMA transfer request signal by setting DMARS, and subsequent interrupt requests to the interrupt controller are masked. We can re-enable the interrupt by clearing the DMARS. This patch adds device_synchronize callback for clearing DMARS and thereby allowing DMA consumers to switch to interrupt mode. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220722084430.969333-1-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc Author: Uwe Kleine-König Date: Thu Jul 21 22:40:54 2022 +0200 dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed It's not allowed to quit remove early without cleaning up completely. Otherwise this results in resource leaks that probably yield graver problems later. Here for example some tasklets might survive the lifetime of the sprd-dma device and access sdev which is freed after .remove() returns. As none of the device freeing requires an active device, just ignore the return value of pm_runtime_get_sync(). Signed-off-by: Uwe Kleine-König Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de Signed-off-by: Vinod Koul commit a6e6231ac10a0e94ed298de8297574b8944f7bfa Merge: 1dba745ca8c63 ddbce345f194e Author: Marc Kleine-Budde Date: Tue Jul 26 10:47:39 2022 +0200 Merge patch series "can: remove litteral strings used for driver names and remove DRV_VERSION" Vincent Mailhol says: ==================== This is a cleanup series. The patches 1 to 8 get rid of any hardcoded strings and instead relies on the KBUILD_MODNAME macros to get the device name. Patch 9 replaces the ES58X_MODULE_NAME macro with KBUILD_MODNAME in etas_es58x. Finally, also in etas_es58x, patch 10 removes the DRV_VERSION so that the module uses the default behavior and advertise the kernel version instead of a custom version. * Changelog * v1 -> v2: * The patch for esd_usb contained some changes for ems_usb. * v1 assumed that KBUILD_MODNAME could only be used when the file basename and the module had the same name (e.g. vcan.c for the vcan.ko). The fact is that KBUILD_NAME extends to the module name and can thus be used even if the basename is different (e.g. slcan-core.c and slcan.ko) * Add patch #9: can: etas_es58x: replace ES58X_MODULE_NAME with KBUILD_MODNAME v1: https://lore.kernel.org/all/20220725153124.467061-1-mailhol.vincent@wanadoo.fr This series are the first 9 patches of: https://lore.kernel.org/linux-can/20220725133208.432176-1-mailhol.vincent@wanadoo.fr/T/ The initial intent of those 9 patches was to do so cleanup in order to implement ethtool_ops::get_drvinfo but this appeared to be useless: https://lore.kernel.org/linux-can/20220725140911.2djwxfrx3kdmjeuc@pengutronix.de/ Instead, those patch are send as a standalone series. ==================== Drop "[PATCH v2 03/10] can: slcan: use KBUILD_MODNAME and define pr_fmt to replace hardcoded names" to avoid conflicts with Dario Binacchi's work on the slcan driver. Link: https://lore.kernel.org/all/20220726082707.58758-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 36834c67016794b8fa03d7672a5b7f2cc4529298 Author: Akhil R Date: Wed Jul 20 16:10:44 2022 +0530 dmaengine: tegra: Add terminate() for Tegra234 In certain cases where the DMA client bus gets corrupted or if the end device ceases to send/receive data, DMA can wait indefinitely for the data to be received/sent. Attempting to terminate the transfer will put the DMA in pause flush mode and it remains there. The channel is irrecoverable once this pause times out in Tegra194 and earlier chips. Whereas, from Tegra234, it can be recovered by disabling the channel and reprograming it. Hence add a new terminate() function that ignores the outcome of dma_pause() so that terminate_all() can proceed to disable the channel. Signed-off-by: Akhil R Reviewed-by: Jon Hunter Link: https://lore.kernel.org/r/20220720104045.16099-3-akhilrajeev@nvidia.com Signed-off-by: Vinod Koul commit 37a0d69d00f50f2a0c387bbbbb2946e771af243d Author: Akhil R Date: Wed Jul 20 16:10:43 2022 +0530 dt-bindings: dmaengine: Add compatible for Tegra234 Document the compatible string used by GPCDMA controller for Tegra234. Signed-off-by: Akhil R Reviewed-by: Jon Hunter Acked-by: Rob Herring Link: https://lore.kernel.org/r/20220720104045.16099-2-akhilrajeev@nvidia.com Signed-off-by: Vinod Koul commit d81677410f172c2b946393c09b46ff9e8dc1b6ec Author: Nathan Chancellor Date: Mon Jul 25 11:05:39 2022 -0700 ASoC: amd: acp: Fix initialization of ext_intr_stat1 in i2s_irq_handler() Clang warns: ../sound/soc/amd/acp/acp-platform.c:117:19: error: variable 'ext_intr_stat1' is uninitialized when used here [-Werror,-Wuninitialized] if (stream && (ext_intr_stat1 & stream->irq_bit)) { ^~~~~~~~~~~~~~ ../sound/soc/amd/acp/acp-platform.c:97:35: note: initialize the variable 'ext_intr_stat1' to silence this warning u32 ext_intr_stat, ext_intr_stat1, i; ^ = 0 1 error generated. The variable was not properly renamed, correct it to resolve the warning. Fixes: 93f53881473c ("ASoC: amd: acp: Modify local variables name to generic") Link: https://github.com/ClangBuiltLinux/linux/issues/1675 Signed-off-by: Nathan Chancellor Reviewed-by: Tom Rix Link: https://lore.kernel.org/r/20220725180539.1315066-1-nathan@kernel.org Signed-off-by: Mark Brown commit feee1ce45a5666bbdb08c5bb2f5f394047b1915b Author: Xin Gao Date: Sat Jul 23 03:46:39 2022 +0800 fsnotify: Fix comment typo The double `if' is duplicated in line 104, remove one. Signed-off-by: Xin Gao Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20220722194639.18545-1-gaoxin@cdjrlc.com commit 494afd7a3535ac963e02f6ee2320a6c90aef79b2 Merge: 4782b7cb6ff83 5b56db90bbaf9 Author: Mark Brown Date: Tue Jul 26 12:29:57 2022 +0100 ASoC: Intel: machine driver updates for 5.20 Merge series from Pierre-Louis Bossart : A couple of minor updates contributed and tested by Intel teams or end-users. commit 4782b7cb6ff836b35342a75e217aa6821b1928f5 Merge: f20d5116b7f3d af468aadf0048 Author: Mark Brown Date: Tue Jul 26 12:29:56 2022 +0100 ASoC: SOF: minor updates for 5.20 Merge series from Pierre-Louis Bossart : One sanity check for SSP index reported by NHLT/BIOS and two updates for Mediatek and Intel Chromebooks related to already-merged firmware changes. commit 0d06132fc84bd91379300768c75a19474e06d0c5 Author: Logan Gunthorpe Date: Fri Jul 8 10:51:04 2022 -0600 PCI/P2PDMA: Remove pci_p2pdma_[un]map_sg() This interface is superseded by support in dma_map_sg() which now supports heterogeneous scatterlists. There are no longer any users, so remove it. Signed-off-by: Logan Gunthorpe Acked-by: Bjorn Helgaas Reviewed-by: Jason Gunthorpe Rev